Fix: Ensure localhost domains are always included in Playwright allowed_domains

[Copilot]

Problem

When users specified custom allowed_domains for Playwright tools, the localhost domains (localhost and 127.0.0.1) were completely replaced instead of being preserved alongside the custom domains. This broke local development and testing workflows.

Before (broken behavior):

tools:
  playwright:
    allowed_domains: ["github.com", "*.github.com"]

Result: "github.com,*.github.com" ❌ (localhost access lost)

After (fixed behavior):

tools:
  playwright:
    allowed_domains: ["github.com", "*.github.com"]

Result: "localhost,127.0.0.1,github.com,*.github.com" ✅ (localhost preserved)

Root Cause

The issue existed in two locations where custom domains completely overwrote the default localhost domains:

1. pkg/parser/mcp.go (lines 177, 179-186): MCP configuration parser
2. pkg/workflow/compiler.go (line 3029): Workflow compilation logic

Both locations used direct assignment instead of merging domains.

Solution

Added ensureLocalhostDomains helper functions that intelligently merge localhost domains with custom domains:

• Checks if localhost and 127.0.0.1 are already present in the custom domains
• Adds missing localhost domains to the beginning of the list
• Preserves all user-specified custom domains
• Maintains the same order for predictable behavior

Testing

• Updated existing tests to expect localhost domains alongside custom domains
• Added comprehensive test coverage for the helper functions
• Manual verification confirms the fix works correctly in compiled workflows
• All existing tests pass with no regressions

Impact

This fix ensures that Playwright workflows maintain localhost access for local development and testing while respecting user-defined custom domains. The change is backward compatible and enhances both security and functionality.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.contoso.com
  • Triggering command: /tmp/go-build3267414842/b279/cli.test -test.testlogfile=/tmp/go-build3267414842/b279/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build997092829/b279/cli.test -test.testlogfile=/tmp/go-build997092829/b279/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: /tmp/go-build71345873/b279/cli.test -test.testlogfile=/tmp/go-build71345873/b279/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.