Function getHttpHookPolicy

src/utils/hooks/execHttpHook.ts:49–58

* Read HTTP hook allowlist restrictions from merged settings (all sources). * Follows the allowedMcpServers precedent: arrays concatenate across sources. * When allowManagedHooksOnly is set in managed settings, only admin-defined * hooks run anyway, so no separate lock-down boolean is needed here

()

 * hooks run anyway, so no separate lock-down boolean is needed here.
 */
function getHttpHookPolicy(): {
  allowedUrls: string[] | undefined
  allowedEnvVars: string[] | undefined
} {
  const settings = settingsModule.getInitialSettings()
  return {
    allowedUrls: settings.allowedHttpHookUrls,
    allowedEnvVars: settings.httpHookAllowedEnvVars,
  }
}

/**
 * Match a URL against a pattern with * as a wildcard (any characters).