Fix remaining native fetch declarations to restore full CI

README.md

@@ -154,6 +154,16 @@ gh aw update   # Update added workflows
 
 This automatically updates agent files, applies codemods, updates actions versions, and recompiles all workflows.
 
+The Copilot CLI samples use GitHub read tools and proxy-aware `curl` for external references instead of the unsupported native `web-fetch` tool. The accessibility sample uses its existing Playwright browser. Fetches must respect the configured network allowlist and TLS verification; report blocked requests instead of bypassing these controls.
+
+To validate changes, run the same checks as CI, including both workflow directories:
+
+```bash
+python3 -m unittest discover -s tests -p 'test_repo_assist_*.py'
+gh aw compile --verbose
+gh aw compile --workflows-dir workflows --verbose
+```
+
 📖 [Learn more about GitHub Agentic Workflows](https://github.github.io/gh-aw/)
 
 ## 💬 Share Feedback

docs/link-checker.md

@@ -33,7 +33,7 @@ graph LR
     G --> J[Create PR]
 ```
 
-A bash script pre-processes links before the AI agent runs. The agent investigates broken links, tries common variations (www, http vs https), and uses web-fetch to find where content moved.
+A bash script pre-processes links before the AI agent runs. The agent investigates broken links, tries common variations (www, http vs https), and uses GitHub read tools or proxy-aware `curl` to find where content moved within the configured network allowlist. Firewall blocks and transient fetch failures are reported rather than cached as permanently unfixable links.
 
 ## Usage
 

workflows/accessibility-review.md

@@ -26,7 +26,6 @@ safe-outputs:
 
 tools:
   playwright:
-  web-fetch:
   github:
     toolsets: [all]
 
@@ -54,8 +53,9 @@ with details.
 
 Our team uses the Web Content Accessibility Guidelines (WCAG) 2.2.  You may 
 refer to these as necessary by browsing to https://www.w3.org/TR/WCAG22/ using
-the WebFetch tool.  You may also search the internet using WebSearch if you need
-additional information about WCAG 2.2.
+the Playwright browser tool. Use GitHub read tools for repository references.
+Do not bypass the network allowlist or TLS verification; if a reference is blocked,
+report it and continue with available verified material.
 
 The code of the application has been checked out to the current working directory.
 

workflows/adhoc-qa.md

@@ -46,13 +46,14 @@ safe-outputs:
 tools:
   github:
     toolsets: [all]
-  web-fetch:
   bash: true
 
 ---
 
 # Adhoc QA
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 ## Job Description
 
 <!-- Note - this file can be customized to your needs. Replace this section directly, or add further instructions here. After editing run 'gh aw compile' -->

workflows/ci-coach.md

@@ -36,7 +36,6 @@ tools:
   github:
     toolsets: [default]
   bash: true
-  web-fetch:
 
 safe-outputs:
   create-pull-request:
@@ -49,6 +48,8 @@ timeout-minutes: 30
 
 # CI Optimization Coach
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 You are the CI Optimization Coach, an expert system that analyzes GitHub Actions workflow performance to identify opportunities for optimization, efficiency improvements, and cost reduction.
 
 ## Mission

workflows/daily-issue-triage.md

@@ -31,8 +31,7 @@ safe-outputs:
     max: 50
 
 tools:
-  bash: ["cat", "ls", "find", "grep", "head", "tail", "wc"]
-  web-fetch:
+  bash: ["cat", "ls", "find", "grep", "head", "tail", "wc", "curl"]
   github:
     toolsets: [issues, labels]
     min-integrity: none
@@ -42,6 +41,8 @@ timeout-minutes: 60
 
 # Daily Issue Triage
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 <!-- Note - this file can be customized to your needs. Replace this section directly, or add further instructions here. After editing run 'gh aw compile' -->
 
 You are a batch triage assistant for GitHub issues. Your task is to find untriaged issues in **${{ github.repository }}** and triage them one by one. Your triage comments are written for maintainers reviewing the triage, not for the issue author.

workflows/efficiency-improver.md

@@ -61,7 +61,6 @@ safe-outputs:
     max: 1
 
 tools:
-  web-fetch:
   github:
     toolsets: [all]
   bash: true
@@ -71,6 +70,8 @@ tools:
 
 # Efficiency Improver
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 You are **Efficiency Improver** for `${{ github.repository }}`. Your job is to systematically identify and implement **energy efficiency improvements** across all dimensions of the codebase — code, data, network/I/O, and frontend/UI — with the north-star goal of **reducing the energy consumption and computational footprint** of the software.
 
 You never merge pull requests yourself; you leave that decision to the human maintainers.

workflows/lean-squad.md

@@ -50,7 +50,6 @@ checkout:
   fetch-depth: 0   # fetch full history
 
 tools:
-  web-fetch:
   github:
     toolsets: [default]
   bash: true
@@ -658,7 +657,7 @@ formal-verification/
    - **Proof tractability**: likely `decide` / routine `simp`+`omega`, or requires substantial proof engineering?
    - **Approximations needed**: what aspects of the original code can't be directly modelled in Lean (e.g., I/O, side effects, memory layout)? Document these clearly.
    - **Approach**: enumeration/`decide`, inductive invariant, equational proof, model checking via bounded `decide`?
-5. Search the web (`web-fetch`) for Lean 4 FV patterns relevant to the language/domain. Check Mathlib for relevant existing lemmas and automation.
+5. Research Lean 4 FV patterns relevant to the language/domain using GitHub read tools and proxy-aware `curl` through bash. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. Check Mathlib for relevant existing lemmas and automation.
 6. Create or update `formal-verification/RESEARCH.md` and `formal-verification/TARGETS.md`. If updating, include a section noting how critique feedback was incorporated (e.g., re-prioritised targets, revised approaches, new targets added from gap analysis). Create a PR.
 7. Optionally, open an issue summarising the survey and inviting maintainer input on priorities.
 8. Update memory with identified targets, approach choices, rationale, and any critique-driven adjustments.

workflows/link-checker.md

@@ -98,7 +98,7 @@ tools:
   github:
     toolsets: [default]
   cache-memory: true
-  web-fetch:
+  bash: ["cat", "curl"]
 
 safe-outputs:
   create-pull-request:
@@ -162,7 +162,8 @@ For each broken link found in the test results (but NOT in the unfixable list):
      - The surrounding documentation
 
 2. **Search for alternatives:**
-   - Use web-fetch to search for if the content has moved to a new URL
+   - Use GitHub read tools or proxy-aware `curl` through bash, within the configured network allowlist, to check whether the content has moved to a new URL
+   - Report firewall blocks or transient fetch failures; do not treat them as proof that content is permanently gone or cache them as unfixable links
    - Try common alternatives (www vs non-www, http vs https, with/without trailing slash)
    - Look for redirects or updated documentation
    - Check if there's an official replacement
@@ -208,7 +209,7 @@ Based on your work:
 - **Preserve context:** When replacing links, make sure the new URL points to equivalent or better content
 - **Document everything:** Keep the cache memory up to date with unfixable links
 - **Be selective:** Only add links to the unfixable list if you've genuinely tried to find alternatives
-- **Use web-fetch wisely:** Try to fetch the broken URL and check for redirects or alternatives
+- **Fetch within the allowlist:** Use proxy-aware `curl` to check redirects or alternatives; do not bypass the firewall or disable TLS verification
 - **Relative links:** Focus only on HTTP(S) links. Skip relative links and anchors (they're tested differently)
 
 ## Example Cache Memory Update

workflows/perf-improver.md

@@ -70,7 +70,6 @@ safe-outputs:
     max: 1
 
 tools:
-  web-fetch:
   github:
     toolsets: [all]
   bash: true
@@ -80,6 +79,8 @@ tools:
 
 # Perf Improver
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 ## Command Mode
 
 Take heed of **instructions**: "${{ steps.sanitized.outputs.text }}"

workflows/plan.md

@@ -23,21 +23,22 @@ safe-outputs:
     close-older-discussions: true
 
 tools:
-  bash: ["cat", "ls", "find", "grep", "head", "tail", "wc"]
+  bash: ["cat", "ls", "find", "grep", "head", "tail", "wc", "curl"]
   github:
     toolsets: [all]
     # If in a public repo, setting `lockdown: false` allows
     # reading issues, pull requests and comments from 3rd-parties
     # If in a private repo this has no particular effect.
     lockdown: false
     min-integrity: none # This workflow is allowed to examine and comment on any issues
-  web-fetch:
 
 timeout-minutes: 15
 ---
 
 # Agentic Planner
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 ## Job Description
 
 Your job is to act as a planner for the GitHub repository ${{ github.repository }}.
@@ -60,4 +61,3 @@ Your job is to act as a planner for the GitHub repository ${{ github.repository
 
    3a. Create a discussion with an appropriate title starting with "[plan]" and the current date (e.g., "[plan] 2025-10-10"), using the project plan as the body.
 
-

workflows/pr-fix.md

@@ -17,7 +17,6 @@ permissions: read-all
 network: defaults
 
 tools:
-  web-fetch:
   bash: true
   github:
     min-integrity: none # This workflow is allowed to examine any PR because it's invoked by a repo maintainer
@@ -35,6 +34,8 @@ timeout-minutes: 20
 
 # PR Fix
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 You are an AI assistant specialized in fixing pull requests with failing CI checks. Your job is to analyze the failure logs, identify the root cause of the failure, and push a fix to the pull request branch for pull request #${{ github.event.issue.number }} in the repository ${{ github.repository }}.
 
 1. Read the pull request and the comments
@@ -57,4 +58,3 @@ You are an AI assistant specialized in fixing pull requests with failing CI chec
 
 9. Add a comment to the pull request summarizing the changes you made and the reason for the fix.
 
-

workflows/repo-ask.md

@@ -19,7 +19,6 @@ safe-outputs:
   add-comment:
 
 tools:
-  web-fetch:
   bash: true
   github:
     toolsets: [default, discussions]
@@ -31,7 +30,7 @@ timeout-minutes: 20
 
 # Question Answering Researcher
 
-You are an AI assistant specialized in researching and answering questions in the context of a software repository. Your goal is to provide accurate, concise, and relevant answers to user questions by leveraging the tools at your disposal. You can use web search and web fetch to gather information from the internet, and you can run bash commands within the confines of the GitHub Actions virtual machine to inspect the repository, run tests, or perform other tasks.
+You are an AI assistant specialized in researching and answering questions in the context of a software repository. Your goal is to provide accurate, concise, and relevant answers to user questions by leveraging the tools at your disposal. Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. You can run bash commands within the confines of the GitHub Actions virtual machine to inspect the repository, run tests, or perform other tasks.
 
 You have been invoked in the context of the pull request or issue #${{ github.event.issue.number }} in the repository ${{ github.repository }}.
 

workflows/test-improver.md

@@ -70,7 +70,6 @@ safe-outputs:
     max: 1
 
 tools:
-  web-fetch:
   bash: true
   github:
     toolsets: [all]
@@ -80,6 +79,8 @@ tools:
 
 # Test Improver
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 ## Command Mode
 
 Take heed of **instructions**: "${{ steps.sanitized.outputs.text }}"

workflows/update-docs.md

@@ -28,7 +28,6 @@ safe-outputs:
 tools:
   github:
     toolsets: [all]
-  web-fetch:
   # By default this workflow allows all bash commands within the confine of Github Actions VM 
   bash: true
 
@@ -37,6 +36,8 @@ timeout-minutes: 15
 
 # Update Docs
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 ## Job Description
 
 <!-- Note - this file can be customized to your needs. Replace this section directly, or add further instructions here. After editing run 'gh aw compile' -->

workflows/weekly-research.md

@@ -20,18 +20,19 @@ safe-outputs:
     category: "ideas"
 
 tools:
-  bash: ["cat", "ls", "find", "grep", "head", "tail", "wc"]
+  bash: ["cat", "ls", "find", "grep", "head", "tail", "wc", "curl"]
   github:
     toolsets: [all]
     min-integrity: none # This workflow is allowed to examine and comment on any issues or PRs
-  web-fetch:
 
 timeout-minutes: 15
 
 ---
 
 # Weekly Research
 
+Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content.
+
 ## Job Description
 
 Do a deep research investigation in ${{ github.repository }} repository, and the related industry in general.
@@ -56,4 +57,3 @@ At the end of the report list write a collapsed section with the following:
 - All bash commands you executed
 - All MCP tools you used
 
-