From 4082b6601d118c3bc5ad3e755ae0ef25adc28ce8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 24 Sep 2026 20:13:13 +0000
Subject: [PATCH 1/2] Initial plan


From c2adbf5726d3a94af9d3aa6fc0ab6cc4a4b3e394 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 24 Sep 2026 20:21:22 +0000
Subject: [PATCH 2/2] Fix successful NONE_NONE firewall warnings

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 ...h-successful-none-none-firewall-records.md |  5 +++++
 actions/setup/js/firewall_blocked_domains.cjs |  9 ++++-----
 .../js/firewall_blocked_domains.test.cjs      | 20 +++++++++++++++++++
 3 files changed, 29 insertions(+), 5 deletions(-)
 create mode 100644 .changeset/patch-successful-none-none-firewall-records.md

diff --git a/.changeset/patch-successful-none-none-firewall-records.md b/.changeset/patch-successful-none-none-firewall-records.md
new file mode 100644
index 00000000000..880084a1803
--- /dev/null
+++ b/.changeset/patch-successful-none-none-firewall-records.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Avoid blocked-domain warnings for successful firewall records whose decision is `NONE_NONE`.
diff --git a/actions/setup/js/firewall_blocked_domains.cjs b/actions/setup/js/firewall_blocked_domains.cjs
index de4ef1e17b7..756416f5de5 100644
--- a/actions/setup/js/firewall_blocked_domains.cjs
+++ b/actions/setup/js/firewall_blocked_domains.cjs
@@ -73,6 +73,10 @@ function parseFirewallLogLine(line) {
 function isRequestBlocked(decision, status) {
   // Check status code first
   const statusCode = parseInt(status, 10);
+  if (statusCode === 200 || statusCode === 206 || statusCode === 304) {
+    return false;
+  }
+
   if (statusCode === 403 || statusCode === 407) {
     return true;
   }
@@ -82,11 +86,6 @@ function isRequestBlocked(decision, status) {
     return true;
   }
 
-  // Check for allowed indicators
-  if (statusCode === 200 || statusCode === 206 || statusCode === 304) {
-    return false;
-  }
-
   if (decision.includes("TCP_TUNNEL") || decision.includes("TCP_HIT") || decision.includes("TCP_MISS")) {
     return false;
   }
diff --git a/actions/setup/js/firewall_blocked_domains.test.cjs b/actions/setup/js/firewall_blocked_domains.test.cjs
index d7fa446d642..94aaa031a64 100644
--- a/actions/setup/js/firewall_blocked_domains.test.cjs
+++ b/actions/setup/js/firewall_blocked_domains.test.cjs
@@ -102,6 +102,12 @@ describe("firewall_blocked_domains.cjs", () => {
       expect(isRequestBlocked("TCP_TUNNEL:HIER_DIRECT", "200")).toBe(false);
     });
 
+    it("should identify successful NONE_NONE requests as allowed", () => {
+      expect(isRequestBlocked("NONE_NONE:HIER_NONE", "200")).toBe(false);
+      expect(isRequestBlocked("NONE_NONE:HIER_NONE", "206")).toBe(false);
+      expect(isRequestBlocked("NONE_NONE:HIER_NONE", "304")).toBe(false);
+    });
+
     it("should identify allowed request with TCP_TUNNEL decision", () => {
       expect(isRequestBlocked("TCP_TUNNEL:HIER_DIRECT", "200")).toBe(false);
     });
@@ -291,6 +297,20 @@ describe("firewall_blocked_domains.cjs", () => {
       expect(result).not.toContain("api.anthropic.com");
     });
 
+    it("should not report successful SNI guard records as blocked", () => {
+      const logsDir = path.join(testDir, "logs-sni-guard");
+      fs.mkdirSync(logsDir, { recursive: true });
+
+      const logContent = [
+        '1773003475.166 172.30.0.30:50232 api.anthropic.com:443 18.64.224.91:443 1.1 CONNECT 200 NONE_NONE:HIER_NONE api.anthropic.com:443 "-"',
+        '1773003475.167 172.30.0.30:50232 api.anthropic.com:443 18.64.224.91:443 1.1 CONNECT 200 TCP_TUNNEL:HIER_DIRECT api.anthropic.com:443 "-"',
+      ].join("\n");
+
+      fs.writeFileSync(path.join(logsDir, "access.log"), logContent);
+
+      expect(getBlockedDomains(logsDir)).toEqual([]);
+    });
+
     it("should handle invalid log lines gracefully", () => {
       const logsDir = path.join(testDir, "logs6");
       fs.mkdirSync(logsDir, { recursive: true });