# Tinyproxy Filter: ONE regex per line, matched against the bare
# domain for CONNECT requests (the log shows e.g. filtered domain
# "xcmapi.org" -- no scheme, no :port suffix).
#
# CRITICAL: Tinyproxy compiles these as POSIX BASIC regex, not
# extended regex. Extended syntax (+ ? ( ) |) does NOT work here:
# an extended-style anchored pattern (^(.+\.)?xcmapi\.org$) was
# verified on 2026-10-26 to deny even xcmapi.org itself, while the
# basic-syntax equivalent below allows it. In basic regex, groups
# are \(...\), repetition of a group is \(...\)*, and + ? ( ) are
# literal characters. Do NOT "modernize" these patterns.
#
# Each entry is anchored (^...$) to the domain and its subdomains
# only: a bare substring "github.com" would also match
# "evilgithub.com". The \(.*\.\)* prefix matches zero or more
# "label." segments, so xcmapi.org and api.xcmapi.org match, while
# notxcmapi.org and xcmapi.org.evil.com do not.
^\(.*\.\)*xcmapi\.org$
^\(.*\.\)*github\.com$
^\(.*\.\)*githubusercontent\.com$
^\(.*\.\)*pypi\.org$
^\(.*\.\)*pythonhosted\.org$
^\(.*\.\)*npmjs\.org$
# Web search MCP v1 (see docs/web-search-mcp.md). Each line is the
# API host's domain, subdomains included, in the same BASIC form.
# searx.diante.me is exact-only on purpose: a \(.*\.\)*diante.me$
# line would also let tasks reach api.diante.me (the control plane).
^\(.*\.\)*perplexity\.ai$
^\(.*\.\)*exa\.ai$
^\(.*\.\)*tavily\.com$
^\(.*\.\)*search\.brave\.com$
^\(.*\.\)*duckduckgo\.com$
^searx\.diante\.me$
# live-info primary sources (2026-10-30, user-approved): time
# APIs + weather primary sources only, so web_fetch can verify
# numbers instead of failing 403 Filtered. Deliberately NOT
# included: time.is / time.org.cn / time.ms (commercial or
# secondary time sites; worldtimeapi + timeapi cover time),
# and no general news/social domains -- the whitelist stays
# fail-closed, these are the only fetch destinations live-info
# needs. Each line is domain + subdomains, same BASIC form.
^\(.*\.\)*worldtimeapi\.org$
^\(.*\.\)*timeapi\.io$
^\(.*\.\)*open-meteo\.com$
^\(.*\.\)*weather\.com\.cn$
^\(.*\.\)*meteoblue\.com$
^\(.*\.\)*accuweather\.com$
# Platform browser programming sources (2026-11-01, feat-platform-browser).
# Only programming sources: official docs, GitHub, package registries,
# Stack Overflow, CVE/NVD. Deliberately NOT included: shopping, social,
# mail, general news, video sites. Same BASIC form as above.
# Already present above, not duplicated here: github.com, pypi.org,
# npmjs.org (plus pythonhosted.org for pip). Notes on coverage:
# docs.python.org is covered by the python.org line (subdomain rule);
# docs.rust-lang.org by rust-lang.org; nodejs.org docs live on
# nodejs.org itself. developer.mozilla.org is scoped to that host
# only, NOT a mozilla.org wildcard, so no other Mozilla host opens.
^\(.*\.\)*python\.org$
^\(.*\.\)*nodejs\.org$
^\(.*\.\)*go\.dev$
^\(.*\.\)*pkg\.go\.dev$
^\(.*\.\)*rust-lang\.org$
^\(.*\.\)*developer\.mozilla\.org$
^\(.*\.\)*crates\.io$
^\(.*\.\)*stackoverflow\.com$
^\(.*\.\)*cve\.mitre\.org$
^\(.*\.\)*nvd\.nist\.gov$