allowed_domains (web.py)

Web capability — `web.fetch` + `web.search`, stdlib-only, allowlist-gated. The first capability that lets an agent read the open web, so egress is default-deny twice over: 1. **Config allowlist** — `web.allowed_domains` in `config.yaml` (exact host or `*.example.com`). No allowli

"""Web capability — `web.fetch` + `web.search`, stdlib-only, allowlist-gated.

The first capability that lets an agent read the open web, so egress is
default-deny twice over:

1. **Config allowlist** — `web.allowed_domains` in `config.yaml` (exact host or
   `*.example.com`). No allowlist → every fetch is refused with a message that
   says how to enable it. The search host is implicitly allowed for
   `web.search` only.
2. **Per-agent network policy** — `evaluate_network(agent, host)` (the same
   Milestone-E-in-miniature egress check channel capabilities use), so a
   locked-down agent can't fetch even an allowlisted host.

Responses are text-extracted (tags stripped via stdlib HTMLParser) and
truncated — an agent reads pages, it doesn't mirror them. Fetched content is
untrusted input: 

... (truncated -- full source via MCP)