Method validateStrictNetwork

pkg/workflow/strict_mode_network_validation.go:18–46

validateStrictNetwork validates network configuration in strict mode and refuses "*" wildcard Note: networkPermissions should never be nil at this point because the compiler orchestrator applies defaults (Allowed: ["defaults"]) when no network configuration is specified in frontmatter. This automati

(networkPermissions *NetworkPermissions)

// applies defaults (Allowed: ["defaults"]) when no network configuration is specified in frontmatter.
// This automatic default application means users don't need to explicitly declare network in strict mode.
func (c *Compiler) validateStrictNetwork(networkPermissions *NetworkPermissions) error {
	// This check should never trigger in production since the compiler orchestrator
	// always applies defaults before calling validation. However, we keep it for defensive programming
	// and to handle direct unit test calls.
	if networkPermissions == nil {
		strictModeValidationLog.Printf("Network configuration unexpectedly nil (defaults should have been applied)")
		return errors.New("internal error: network permissions not initialized (this should not happen in normal operation)")
	}

	// If allowed list contains "defaults", that's acceptable (this is the automatic default)
	if slices.Contains(networkPermissions.Allowed, "defaults") {
		strictModeValidationLog.Printf("Network validation passed: allowed list contains 'defaults'")
		return nil
	}

	// Check for wildcard "*" in allowed domains
	if slices.Contains(networkPermissions.Allowed, "*") {
		strictModeValidationLog.Printf("Network validation failed: wildcard detected")
		return NewValidationError(
			"network.allowed",
			"*",
			"strict mode: wildcard '*' is not allowed in network.allowed domains to prevent unrestricted internet access; expected explicit domains or ecosystem identifiers",
			"Use specific domains or supported ecosystem identifiers:\n\nnetwork:\n  allowed:\n    - github.com\n    - api.github.com\n    - python",
		)
	}

	strictModeValidationLog.Printf("Network validation passed: allowed_count=%d", len(networkPermissions.Allowed))
	return nil
}

// validateStrictMCPNetwork requires top-level network configuration when custom MCP servers use containers
func (c *Compiler) validateStrictMCPNetwork(frontmatter map[string]any, networkPermissions *NetworkPermissions) error {