Merge safe-outputs.allowed-domains and allowed-url-domains; rename default-redaction to default-safe-outputs

.github/workflows/smoke-agent-all-merged.md

@@ -23,7 +23,7 @@ network:
     - defaults
     - github
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   add-comment:
     hide-older-comments: true
     max: 2

.github/workflows/smoke-agent-all-none.md

@@ -23,7 +23,7 @@ network:
     - defaults
     - github
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   add-comment:
     hide-older-comments: true
     max: 2

.github/workflows/smoke-agent-public-approved.md

@@ -23,7 +23,7 @@ network:
     - defaults
     - github
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   assign-to-agent:
     target: "*"
     max: 1

.github/workflows/smoke-agent-public-none.md

@@ -23,7 +23,7 @@ network:
     - defaults
     - github
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   add-comment:
     hide-older-comments: true
     max: 2

.github/workflows/smoke-agent-scoped-approved.md

@@ -25,7 +25,7 @@ network:
     - defaults
     - github
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   add-comment:
     hide-older-comments: true
     max: 2

.github/workflows/smoke-call-workflow.md

@@ -17,7 +17,7 @@ network:
   allowed:
     - defaults
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   call-workflow:
     workflows:
       - smoke-workflow-call

.github/workflows/smoke-claude.md

@@ -55,7 +55,7 @@ runtimes:
   go:
     version: "1.25"
 safe-outputs:
-    allowed-url-domains: [default-redaction]
+    allowed-domains: [default-safe-outputs]
     add-comment:
       hide-older-comments: true
       max: 2

.github/workflows/smoke-codex.md

@@ -41,7 +41,7 @@ sandbox:
   mcp:
     container: "ghcr.io/github/gh-aw-mcpg"
 safe-outputs:
-    allowed-url-domains: [default-redaction]
+    allowed-domains: [default-safe-outputs]
     add-comment:
       hide-older-comments: true
       max: 2

.github/workflows/smoke-copilot-arm.md

@@ -45,7 +45,7 @@ sandbox:
   mcp:
     container: "ghcr.io/github/gh-aw-mcpg"
 safe-outputs:
-    allowed-url-domains: [default-redaction]
+    allowed-domains: [default-safe-outputs]
     add-comment:
       allowed-repos: ["github/gh-aw"]
       hide-older-comments: true

.github/workflows/smoke-copilot.md

@@ -48,7 +48,7 @@ sandbox:
   mcp:
     container: "ghcr.io/github/gh-aw-mcpg"
 safe-outputs:
-    allowed-url-domains: [default-redaction]
+    allowed-domains: [default-safe-outputs]
     add-comment:
       allowed-repos: ["github/gh-aw"]
       hide-older-comments: true

.github/workflows/smoke-create-cross-repo-pr.md

@@ -32,7 +32,7 @@ tools:
     github-token: ${{ secrets.GH_AW_SIDE_REPO_PAT }}
 
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   create-pull-request:
     target-repo: "githubnext/gh-aw-side-repo"
     github-token: ${{ secrets.GH_AW_SIDE_REPO_PAT }}

.github/workflows/smoke-gemini.md

@@ -32,7 +32,7 @@ tools:
     - "*"
   web-fetch:
 safe-outputs:
-    allowed-url-domains: [default-redaction]
+    allowed-domains: [default-safe-outputs]
     add-comment:
       hide-older-comments: true
       max: 2

.github/workflows/smoke-multi-pr.md

@@ -25,7 +25,7 @@ tools:
     - "echo *"
     - "printf *"
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   create-pull-request:
     title-prefix: "[smoke-multi-pr] "
     if-no-changes: "warn"

.github/workflows/smoke-project.md

@@ -24,7 +24,7 @@ tools:
   bash:
     - "*"
 safe-outputs:
-    allowed-url-domains: [default-redaction]
+    allowed-domains: [default-safe-outputs]
     add-comment:
       hide-older-comments: true
       max: 2

.github/workflows/smoke-temporary-id.md

@@ -20,7 +20,7 @@ network:
     - defaults
     - node
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   create-issue:
     expires: 2h
     title-prefix: "[smoke-temporary-id] "

.github/workflows/smoke-test-tools.md

@@ -34,7 +34,7 @@ tools:
   bash:
     - "*"
 safe-outputs:
-    allowed-url-domains: [default-redaction]
+    allowed-domains: [default-safe-outputs]
     add-comment:
       hide-older-comments: true
       max: 2

.github/workflows/smoke-update-cross-repo-pr.md

@@ -36,7 +36,7 @@ tools:
     github-token: ${{ secrets.GH_AW_SIDE_REPO_PAT }}
 
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   create-issue:
     expires: 2h
     close-older-issues: true

.github/workflows/smoke-workflow-call-with-inputs.md

@@ -30,7 +30,7 @@ tools:
     - "echo *"
     - "date"
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   noop:
 timeout-minutes: 5
 ---

.github/workflows/smoke-workflow-call.md

@@ -35,7 +35,7 @@ tools:
     - "git remote *"
     - "echo *"
 safe-outputs:
-  allowed-url-domains: [default-redaction]
+  allowed-domains: [default-safe-outputs]
   add-comment:
     hide-older-comments: true
     max: 1

pkg/cli/add_integration_test.go

@@ -978,7 +978,11 @@ func TestAddWorkflowWithDispatchWorkflowFromSharedImport(t *testing.T) {
 	// frontmatter. haiku-printer lives as haiku-printer.yml (a plain GitHub Actions
 	// workflow). The fetcher falls back to .yml when .md is 404, so both the main
 	// workflow and the dispatch-workflow dependency are written to disk.
-	workflowSpec := "github/gh-aw/.github/workflows/smoke-copilot.md@main"
+	//
+	// Note: pinned to a specific commit SHA from the branch that renamed
+	// allowed-url-domains → allowed-domains (schema change). Update to @main once
+	// that change has been merged.
+	workflowSpec := "github/gh-aw/.github/workflows/smoke-copilot.md@c93eec8"
 
 	cmd := exec.Command(setup.binaryPath, "add", workflowSpec, "--verbose")
 	cmd.Dir = setup.tempDir

pkg/parser/schemas/main_workflow_schema.json

@@ -4136,7 +4136,7 @@
       "properties": {
         "allowed-domains": {
           "type": "array",
-          "description": "List of allowed domains for URI filtering in AI workflow output. URLs from other domains will be replaced with '(redacted)' for security.",
+          "description": "List of allowed domains for URL redaction in safe output handlers. Supports ecosystem identifiers (e.g., \"python\", \"node\", \"default-safe-outputs\") like network.allowed. These domains are unioned with the engine defaults and network.allowed when computing the final allowed domain set. localhost and github.com are always included.",
           "items": {
             "type": "string"
           }
@@ -7411,13 +7411,6 @@
               }
             ]
           ]
-        },
-        "allowed-url-domains": {
-          "type": "array",
-          "description": "Additional allowed domains for URL redaction in safe output handlers. Supports the same ecosystem identifiers as network.allowed (e.g., \"python\", \"node\", \"dev-tools\"). These domains are unioned with the engine defaults and network.allowed when computing the final allowed domain set. localhost and github.com are always included.",
-          "items": {
-            "type": "string"
-          }
         }
       },
       "additionalProperties": false