# Tinyproxy Filter: ONE regex per line, matched against the bare
# domain for CONNECT requests (the log shows e.g. filtered domain
# "xcmapi.org" -- no scheme, no :port suffix).
#
# CRITICAL: Tinyproxy compiles these as POSIX BASIC regex, not
# extended regex. Extended syntax (+ ? ( ) |) does NOT work here:
# an extended-style anchored pattern (^(.+\.)?xcmapi\.org$) was
# verified on 2026-10-26 to deny even xcmapi.org itself, while the
# basic-syntax equivalent below allows it. In basic regex, groups
# are \(...\), repetition of a group is \(...\)*, and + ? ( ) are
# literal characters. Do NOT "modernize" these patterns.
#
# Each entry is anchored (^...$) to the domain and its subdomains
# only: a bare substring "github.com" would also match
# "evilgithub.com". The \(.*\.\)* prefix matches zero or more
# "label." segments, so xcmapi.org and api.xcmapi.org match, while
# notxcmapi.org and xcmapi.org.evil.com do not.
^\(.*\.\)*xcmapi\.org$
^\(.*\.\)*github\.com$
^\(.*\.\)*githubusercontent\.com$
^\(.*\.\)*pypi\.org$
^\(.*\.\)*pythonhosted\.org$
^\(.*\.\)*npmjs\.org$
# Web search MCP v1 (see docs/web-search-mcp.md). Each line is the
# API host's domain, subdomains included, in the same BASIC form.
# searx.diante.me is exact-only on purpose: a \(.*\.\)*diante.me$
# line would also let tasks reach api.diante.me (the control plane).
^\(.*\.\)*perplexity\.ai$
^\(.*\.\)*exa\.ai$
^\(.*\.\)*tavily\.com$
^\(.*\.\)*search\.brave\.com$
^\(.*\.\)*duckduckgo\.com$
^searx\.diante\.me$