From 19b7343af27a7d8b8e0e3fc36e592bc8cb507e91 Mon Sep 17 00:00:00 2001
From: Brady Gaster <brady.gaster@gmail.com>
Date: Thu, 3 Sep 2026 15:02:41 -0700
Subject: [PATCH] fix(gh-aw): preserve research source URLs

Allow the public Microsoft Learn and Aspire documentation domains through safe-output URL sanitization while retaining credential and sensitive-query safeguards.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: f3bb47aa-1b45-4302-8ec2-5e3dc868de42
---
 test/gh-aw-research-online.test.ts | 15 +++++++++++++++
 workflows/squad.md                 |  8 +++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/test/gh-aw-research-online.test.ts b/test/gh-aw-research-online.test.ts
index 4dff755a3..e014edcec 100644
--- a/test/gh-aw-research-online.test.ts
+++ b/test/gh-aw-research-online.test.ts
@@ -117,6 +117,21 @@ describe('gh-aw: /squad research online-documentation capability', () => {
     expect(researchSkill).toContain('masquerade as one that consulted a source');
   });
 
+  it('preserves full public documentation URLs without weakening general URL sanitization', () => {
+    const safeOutputsMatch = frontmatter.match(
+      /^safe-outputs:\n((?:[ \t].*\n?)*)/m
+    );
+    expect(safeOutputsMatch, 'safe-outputs: block should exist in frontmatter').not.toBeNull();
+    expect(safeOutputsMatch![1]).toMatch(
+      /allowed-domains:\n\s+- learn\.microsoft\.com\n\s+- aspire\.dev/
+    );
+    expect(researchSkill).toMatch(/Preserve\s+each public documentation URL in full/);
+    expect(researchSkill).toContain('do not replace the path with `/redacted`');
+    expect(researchSkill).toMatch(
+      /Never include URL userinfo, credentials, access tokens,[\s\S]*secret-bearing query parameters/
+    );
+  });
+
   it('lists Online sources as a required labeled section of the artifact', () => {
     // The structural contract MUST-contain list includes Online sources. Bound
     // the match to the enumeration SENTENCE (up to its terminating period) so it
diff --git a/workflows/squad.md b/workflows/squad.md
index 44427433e..8bd4ec277 100644
--- a/workflows/squad.md
+++ b/workflows/squad.md
@@ -169,6 +169,9 @@ pre-agent-steps:
       SQUAD_CAST_VALIDATOR_RUNNER
       chmod 500 "$validator_runner"
 safe-outputs:
+  allowed-domains:
+    - learn.microsoft.com
+    - aspire.dev
   messages:
     append-only-comments: true
     run-success: "🤖 [{workflow_name}]({run_url}) finished processing. This completion message does not indicate Cast success. For Cast, only a linked Cast pull request indicates success."
@@ -1464,7 +1467,10 @@ section MUST state exactly one status so a later reader or test can assert on it
 instead of trusting silence:
 
 - `Online sources: consulted` — followed by the list of URLs actually fetched
-  this run (each URL also appears as a citation in the evidence table); or
+  this run (each URL also appears as a citation in the evidence table). Preserve
+  each public documentation URL in full, including its path; do not replace the
+  path with `/redacted`. Never include URL userinfo, credentials, access tokens,
+  or secret-bearing query parameters; omit those sensitive parts instead; or
 - `Online sources: unavailable — <reason>` — when no external documentation was
   fetched, e.g. the network policy disallowed it, no external source was needed,
   or a requested source-of-truth site was unreachable.