Add AWF-aware Playwright CLI policy prompt

[Copilot]

Playwright CLI mode in AWF sandboxes needs an enforced secure browser topology (loopback-only servers, Squid-routed egress) rather than relying solely on generic upstream skill guidance that suggests runtime installs or arbitrary navigation. This is a first, self-contained slice of a larger multi-part hardening effort (compiler-staged/pinned CLI+Chromium assets, cross-runtime mounts, an in-sandbox pre-agent lifecycle hook, and enforced Docker sbx egress remain as follow-up work).

Policy prompt

• Added actions/setup/md/playwright_awf_prompt.md, instructing the agent to:
  • bind local servers only to 127.0.0.1, never 0.0.0.0 or published ports
  • poll for loopback readiness before navigating
  • keep localhost/127.0.0.1 on the proxy bypass list; never treat the model-provider proxy as a browser proxy
  • never install packages, browsers, or system dependencies at runtime
  • clean up browser/server processes when done
• This guidance explicitly takes precedence over generic Playwright CLI skill suggestions (e.g. npm install, npx fallback installs, navigating to arbitrary example domains).

Compiler wiring

• Injected via collectPromptSections in pkg/workflow/unified_prompt_step.go, gated on isPlaywrightCLIMode(...) && isFirewallEnabled(...) — only appears when Playwright CLI mode and the AWF firewall/sandbox are both active, alongside the existing playwright_prompt.md section.

tools:
  playwright:
    mode: cli
sandbox:
  agent:
    id: awf

Docs

• Documented the new AWF policy behavior in docs/src/content/docs/reference/playwright.md.

• Fixes Add secure first-class Playwright CLI support across AWF runtimes #57581

---

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 17.5 AIC · ⌖ 8.66 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

🟡 Changes recommended

The prompt incorrectly claims browser staging and enforced proxy routing that remain deferred follow-up work.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds AWF-specific Playwright CLI policy guidance and compiler injection when the firewall is active.

Changes:

• Adds secure loopback, proxy, installation, and cleanup guidance.
• Wires the policy into unified prompts with gating tests.
• Updates documentation and compiler golden outputs.

File summaries

File	Description
actions/setup/md/playwright_awf_prompt.md	Defines the AWF Playwright policy.
pkg/workflow/unified_prompt_step.go	Conditionally injects the policy.
pkg/workflow/prompt_constants.go	Registers the prompt filename.
pkg/workflow/prompts_test.go	Tests firewall-based inclusion.
docs/src/content/docs/reference/playwright.md	Documents policy behavior.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden	Updates CLI-mode output.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden	Updates smoke output.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Addressed in aceb416: reworded this section to state the required behavior (keep localhost/127.0.0.1 on the bypass list, route everything else through the proxy) and instruct the agent to fail closed and report the failure if the expected proxy topology isn't in place, rather than implying enforcement already exists.

[gh-aw-bot]

@copilot this PR is ready for the next forward-progress pass.

Please refresh the branch state if needed, address the outstanding review feedback from copilot-pull-request-reviewer, run the pr-finisher skill, and re-request review when done.

• Blocking review: Add AWF-aware Playwright CLI policy prompt #57594 (review)
• Workflow run: https://github.com/github/gh-aw/actions/runs/33467970842

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 17.5 AIC · ⌖ 8.66 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[lpcox]

@copilot run pr-finisher skill

[Copilot]

@copilot this PR is ready for the next forward-progress pass.

Please refresh the branch state if needed, address the outstanding review feedback from copilot-pull-request-reviewer, run the `pr-fini...

Addressed in aceb416: removed the false "already staged" claim for the Playwright CLI/Chromium and reworded the proxy guidance as a required behavior that must fail closed if the expected bypass/proxy topology isn't in place, rather than implying it's already enforced.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.88.0