Network
[network] says which hosts web_fetch may reach without asking. It is the
allowlist behind the web_fetch levels described in
Permissions.
[network]
# Include the curated default hosts listed below.
defaults = true
# Hosts web_fetch may reach at Level 1, in any turn. Exact hostnames only;
# wildcards are rejected.
allow = ["docs.python.org", "wiki.internal.example.com"]
# Hosts web_fetch may never reach, whatever else says.
deny = ["pastebin.com"]
# Hosts you accepted at a prompt with A. Heph appends here.
promoted = ["docs.tokio.rs"]
| Key | Meaning | Default |
|---|---|---|
defaults | Whether the curated hosts below are on the allowlist. | true |
allow | Hosts fetched at Level 1: no prompt, the call shown as it runs. | none |
deny | Hosts refused before anything else is considered, session approvals included. The model is told which host refused it. | none |
promoted | Hosts heph appends when you answer A to a web_fetch prompt. They fetch like allow; the separate list keeps what you typed apart from what heph wrote. | none |
The curated defaults are documentation and forge hosts, each a single tenant
with its own request logs: docs.rs, crates.io, doc.rust-lang.org,
github.com, raw.githubusercontent.com, developer.mozilla.org,
stackoverflow.com, en.wikipedia.org. defaults = false with an empty
allow makes every fetch ask.
Project lists are added to the user's; a project's defaults = false wins over
the user's file.
What a host is
An entry is one exact hostname as it appears in the URL, lowercase: docs.rs,
rust-lang.github.io. It matches that host and nothing else: not its
subdomains, not a port, not a path. Wildcards (*.github.io) are rejected when
the file is read, because on a multi-tenant host any subdomain is a server whose
logs anyone can provision, and a wildcard would allowlist them all.
The list applies to https:// URLs only. A plain http:// URL shows its whole
path to every network hop, so it asks every time and cannot be remembered.
What is accepted but not yet read
search_max_uses and search_domains are for web_search, which the model
provider runs and which has not landed. They parse and do
nothing.