docs: update network.md to document Codex and Gemini engine support for firewall/network features

[Copilot]

• Update engine coverage statement to list all four engines
• Update protocol-specific filtering note to clarify Copilot and Claude support
• Add Copilot engine subsection with AWF details
• Consolidate Claude, Codex, and Gemini into a single minimal subsection (same firewall for all), pointing to domains.go for default domain lists

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] Update network.md to document Codex and Gemini engine support for firewall/network features</issue_title>
<issue_description>## Context

From schema consistency discussion #17876 (2026-02-23 run, finding 7).

Objective

Update the network reference documentation to accurately reflect that all four engines (Copilot, Claude, Codex, Gemini) support network/firewall features.

Issues to Fix

Outdated engine coverage statement

• File: docs/src/content/docs/reference/network.md (lines 10, 40, 186)
• Current text says: "Network permissions are currently supported by the Claude engine and the Copilot engine (when using the firewall feature)."
• Codex and Gemini both have supportsFirewall: true and dedicated default domain lists (CodexDefaultDomains in domains.go:40, GeminiDefaultDomains in domains.go:95).
• The "Implementation" section (line 186) only documents Copilot engine; Claude, Codex, and Gemini subsections are absent.

Changes Required

1. Update the engine support statement to list all four engines.
2. Add engine-specific subsections to the Implementation section documenting:
   • Codex engine: its default domain list and firewall behavior
   • Gemini engine: its default domain list and firewall behavior
3. Ensure consistency between the docs and schema description (after fixing the schema in a related issue).

Files to Modify

• docs/src/content/docs/reference/network.md

Acceptance Criteria

• The engine coverage statement lists all four engines (Copilot, Claude, Codex, Gemini)
• The Implementation section has subsections for each engine
• Default domain lists for each engine are referenced or documented
• Documentation follows the Diátaxis framework and GitHub-flavored Markdown

Generated by Plan Command for issue #discussion #17876

• expires on Feb 25, 2026, 12:04 PM UTC

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] Update network.md to document Codex and Gemini engine support for firewall/network features #17903

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pelikhan]

@copilot the firewall is the same for all engines

[Copilot]

Removed "the same firewall infrastructure used by the Copilot engine" from the Claude subsection — all four engine descriptions now use the same phrasing: "supports network permissions through AWF (Agent Workflow Firewall)." (commit 4898779)

[pelikhan]

@copilot keep the network section minimal in each engine, it is the same for all. Point to better docs

[Copilot]

@copilot keep the network section minimal in each engine, it is the same for all. Point to better docs

Done in 58a91de. Replaced the four separate engine subsections with a single "Claude, Codex, and Gemini Engines" section that shows minimal config examples for each and points to domains.go for the default domain lists. The Copilot section retains its AWF detail as the primary reference.

[Copilot]

Pull request overview

Updates the network permissions reference to reflect firewall/network feature support across all four engines (Copilot, Claude, Codex, Gemini), and expands the Implementation section accordingly.

Changes:

• Update the engine support note to list Copilot, Claude, Codex, and Gemini.
• Update protocol-specific filtering documentation to include Claude (in addition to Copilot).
• Add an Implementation subsection for Claude/Codex/Gemini, including example configs and a link to default-domain lists in domains.go.

Comments suppressed due to low confidence (2)

docs/src/content/docs/reference/network.md:97

• This paragraph states protocol-specific filtering is supported only by Copilot and Claude. In code, protocol-prefixed domains are validated for network.allowed generally and then included in the AWF --allow-domains list for all AWF-wrapped engines (including Codex and Gemini). Please update this statement to include Codex/Gemini as supported (or add a brief explanation if they’re intentionally not supported at runtime).

Restrict domains to a specific protocol (HTTP or HTTPS only) for legacy systems, strict HTTPS enforcement, or gradual migration. Currently supported by the Copilot and Claude engines with AWF firewall enabled; domains without a protocol prefix allow both HTTP and HTTPS.

docs/src/content/docs/reference/network.md:215

• This section says Claude/Codex/Gemini “use the same AWF firewall as the Copilot engine,” but the Copilot subsection above describes AWF as a wrapper around Copilot CLI execution, which now reads as Copilot-specific. Consider adjusting wording (either here or in the Copilot subsection) to make it clear AWF is the shared sandbox/firewall wrapper used to run all engine CLIs, not a Copilot-only mechanism.

The Claude, Codex, and Gemini engines use the same AWF firewall as the Copilot engine. Configure network permissions using the same `network.allowed` / `network.blocked` fields:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The note implies network permissions are supported “via the AWF firewall”, but later this page explains that when the firewall is disabled, network permissions only affect content sanitization (network egress becomes unrestricted). Consider clarifying here that network egress enforcement happens when the AWF sandbox/firewall is enabled (default unless explicitly disabled), while sanitization applies regardless.

Suggested change

> **Note**: Network permissions are supported by all four engines: Copilot, Claude, Codex, and Gemini (via the AWF firewall). See the [Implementation](#implementation) section for engine-specific details.

> **Note**: Network permissions are supported by all four engines: Copilot, Claude, Codex, and Gemini. Network egress enforcement is provided when the AWF sandbox/firewall is enabled (default unless explicitly disabled), while content sanitization based on these permissions applies regardless. See the [Implementation](#implementation) section for engine-specific details and engine-specific behavior.

[Copilot]

This comment says protocol-specific filtering is “Copilot and Claude engines only”, but the compiler’s domain validation and AWF argument generation are engine-agnostic (protocol prefixes are accepted in network.allowed via validateDomainPattern, and passed through to AWF’s --allow-domains for Codex/Gemini as well). Unless there’s an intentional product limitation outside this repo, the docs should include Codex and Gemini too (or explain why they’re excluded).

This issue also appears on line 97 of the same file.

Suggested change

	# Protocol-specific domain filtering (Copilot and Claude engines only)
	# Protocol-specific domain filtering (all engines: Copilot, Claude, Codex, and Gemini)