allowlist
URL allow-list policy for the web-search add-on.
A configured allow-list restricts which URLs the tools will surface or
fetch. Each entry is a glob compiled by @dbx-tools/path’s
match.toPathMatcher (the same Minimatch-backed matcher the
package’s file scanning uses). Because that matcher treats / as a
path-segment boundary, entries are matched against the right slice of the
URL rather than the raw href:
- A host entry (no
/after the optional scheme, e.g.databricks.comor*.databricks.com) is tested against the URL’shostname. A bare host with no wildcard also matches its subdomains, sodatabricks.compermitsdocs.databricks.com- the intuitive reading of a domain allow-list. - A path entry (contains a
/, e.g.docs.example.com/api/**) is tested againsthost + pathname(scheme and query stripped), so path globs work without fighting thehttps://prefix.
Enforcement is asymmetric by design (see the module’s two consumers):
web_search results are SILENTLY filtered to the permitted set, while an
explicit web_fetch of a disallowed URL is refused with an error - the
search never leaks a URL the caller then can’t fetch, but a direct fetch
of a blocked URL is a visible, correctable mistake rather than a silent
empty.
An empty / absent allow-list permits everything.