feat: network policy create flags (#123)

## Description

This PR updates the `rl-cli` to support the newly introduced `allow AI
gateway` and `allow MCP gateway` flags for network policy creation,
aligning the CLI with recent backend controller changes.

**Note:** PR titles should follow [Conventional
Commits](https://www.conventionalcommits.org/) format (e.g.,
`feat(devbox): add support for custom env vars` or `fix(snapshot):
resolve pagination issue`) as they are used for automatic release notes
generation.

## Type of Change

<!-- Mark the relevant option with an 'x' -->

- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] Documentation update
- [ ] Code refactoring
- [ ] Performance improvement
- [ ] Test updates

## Related Issues

<!-- Link to related issues using #issue-number -->
Closes #

## Changes Made

- **CLI Command:** Added `--allow-ai-gateway` and `--allow-mcp-gateway`
flags to the `rl network-policy create` command.
- **Type Definitions & Interfaces:** Updated `CreateOptions`,
`CreateNetworkPolicyParams`, `UpdateNetworkPolicyParams`, and
`ExtendedEgress` to include the new `allowAiGateway` and
`allowMcpGateway` fields.
- **Service Layer:** Modified `createNetworkPolicy`,
`updateNetworkPolicy`, `getNetworkPolicy`, and `listNetworkPolicies`
functions in `networkPolicyService` to handle the new gateway fields.
- **UI Components:** Integrated form fields for `allowAiGateway` and
`allowMcpGateway` into the `NetworkPolicyCreatePage` and added display
for these settings in the `NetworkPolicyDetailScreen`.

## Testing

<!-- Describe how you tested your changes -->

- [x] I have tested locally
- [ ] I have added/updated tests
- [x] All existing tests pass

Verified:
-   CLI help output for `network-policy create` displays the new flags.
-   TypeScript compilation is successful with no errors.
- Functional testing of creating and viewing network policies via the
CLI and UI, confirming the new gateway settings are correctly applied
and displayed.

## Checklist

- [x] My code follows the code style of this project
- [x] I have performed a self-review of my own code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [x] I have updated the documentation accordingly (CLI help output)
- [x] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [x] Any dependent changes have been merged and published

## Screenshots (if applicable)

<!-- Add screenshots to help explain your changes -->

## Additional Notes

The new `allow AI gateway` and `allow MCP gateway` flags default to "No"
in the UI.

---
[Slack
Thread](https://runloophq.slack.com/archives/C079G6098BH/p1772056925156089?thread_ts=1772056925.156089&cid=C079G6098BH)

<p><a
href="https://cursor.com/agents/bc-c2e84086-a2bf-5e94-9875-8f69a1de7263"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-c2e84086-a2bf-5e94-9875-8f69a1de7263"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</p>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: alb-rl

.github/workflows/pr-title.yml

@@ -3,52 +3,83 @@ name: PR Title Check
 on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
+  workflow_dispatch:
 
 jobs:
   pr-title-check:
     runs-on: ubuntu-slim
     steps:
-      - uses: amannn/action-semantic-pull-request@v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Validate PR title
+        uses: actions/github-script@v7
         with:
-          # Configure which types are allowed
-          types: |
-            feat
-            fix
-            docs
-            style
-            refactor
-            perf
-            test
-            build
-            ci
-            chore
-            revert
-          # Require scope to be provided
-          requireScope: false
-          # Configure which scopes are allowed (empty = any scope allowed)
-          scopes: |
-            cli
-            mcp
-            devbox
-            benchmark
-            secret  
-            blueprint
-            storage-object
-            network-policy
-            main
-            snapshot
-            config
-            auth
-            deps
-          # Ensure the subject starts with a lowercase letter
-          subjectPattern: ^(?![A-Z]).+$
-          subjectPatternError: |
-            The subject "{subject}" found in the pull request title "{title}"
-            should start with a lowercase letter.
-
-            Examples:
-            - feat: add new devbox command
-            - fix(cli): resolve argument parsing issue
-            - docs: update README with usage examples
+          script: |
+            // Fetch current PR to always get latest title, even on workflow re-runs
+            const prNumber = context.issue.number || context.payload.pull_request?.number;
+            if (!prNumber) {
+              core.setFailed('Unable to determine PR number');
+              return;
+            }
+            
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber
+            });
+            
+            const title = pr.title;
+            console.log(`Validating PR title: "${title}"`);
+            
+            // Define allowed types
+            const types = [
+              'feat', 'fix', 'docs', 'style', 'refactor',
+              'perf', 'test', 'build', 'ci', 'chore', 'revert'
+            ];
+            
+            // Define allowed scopes (optional)
+            const scopes = [
+              'cli', 'mcp', 'devbox', 'benchmark', 'secret',
+              'blueprint', 'storage-object', 'network-policy',
+              'main', 'snapshot', 'config', 'auth', 'deps'
+            ];
+            
+            // Regex pattern: type(scope)?: description
+            // type is required, scope is optional, description must start with lowercase
+            const pattern = /^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([a-z0-9-]+\))?:\s*[a-z].+$/;
+            
+            if (!pattern.test(title)) {
+              const errorMsg = [
+                '❌ PR title does not follow the conventional commit format.',
+                '',
+                `Found: "${title}"`,
+                '',
+                'Expected format: type(scope)?: description',
+                '',
+                'Where:',
+                `- type: one of ${types.join(', ')}`,
+                `- scope (optional): one of ${scopes.join(', ')}`,
+                '- description: starts with a lowercase letter',
+                '',
+                'Examples:',
+                '- feat: add new devbox command',
+                '- fix(cli): resolve argument parsing issue',
+                '- docs: update README with usage examples',
+                '- feat(network-policy): add support for gateway flags'
+              ].join('\n');
+              
+              core.setFailed(errorMsg);
+              return;
+            }
+            
+            // Extract and validate scope if present
+            const scopeMatch = title.match(/\(([^)]+)\)/);
+            if (scopeMatch) {
+              const scope = scopeMatch[1];
+              if (!scopes.includes(scope)) {
+                core.setFailed(
+                  `❌ Invalid scope "${scope}".\n\nAllowed scopes: ${scopes.join(', ')}`
+                );
+                return;
+              }
+            }
+            
+            console.log('✅ PR title is valid!');

package.json

@@ -71,7 +71,7 @@
   "dependencies": {
     "@js-temporal/polyfill": "^0.5.1",
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "@runloop/api-client": "1.6.0",
+    "@runloop/api-client": "1.9.0",
     "@types/express": "^5.0.6",
     "chalk": "^5.6.2",
     "commander": "^14.0.2",

pnpm-lock.yaml

@@ -10,6 +10,8 @@ interface CreateOptions {
   description?: string;
   allowAll?: boolean;
   allowDevboxToDevbox?: boolean;
+  allowAiGateway?: boolean;
+  allowMcpGateway?: boolean;
   allowedHostnames?: string[];
   output?: string;
 }
@@ -23,6 +25,8 @@ export async function createNetworkPolicy(options: CreateOptions) {
       description: options.description,
       allow_all: options.allowAll ?? false,
       allow_devbox_to_devbox: options.allowDevboxToDevbox ?? false,
+      allow_ai_gateway: options.allowAiGateway ?? false,
+      allow_mcp_gateway: options.allowMcpGateway ?? false,
       allowed_hostnames: options.allowedHostnames ?? [],
     });
 

src/commands/network-policy/create.ts

@@ -40,6 +40,8 @@ interface NetworkPolicyListItem {
   egress: {
     allow_all: boolean;
     allow_devbox_to_devbox: boolean;
+    allow_ai_gateway: boolean;
+    allow_mcp_gateway: boolean;
     allowed_hostnames: string[];
   };
 }
@@ -165,6 +167,8 @@ const ListNetworkPoliciesUI = ({
             egress: {
               allow_all: p.egress.allow_all,
               allow_devbox_to_devbox: p.egress.allow_devbox_to_devbox,
+              allow_ai_gateway: p.egress.allow_ai_gateway,
+              allow_mcp_gateway: p.egress.allow_mcp_gateway,
               allowed_hostnames: [...(p.egress.allowed_hostnames || [])],
             },
           });

src/commands/network-policy/list.tsx

@@ -35,13 +35,17 @@ type FormField =
   | "description"
   | "allow_all"
   | "allow_devbox_to_devbox"
+  | "allow_ai_gateway"
+  | "allow_mcp_gateway"
   | "allowed_hostnames";
 
 interface FormData {
   name: string;
   description: string;
   allow_all: "Yes" | "No";
   allow_devbox_to_devbox: "Yes" | "No";
+  allow_ai_gateway: "Yes" | "No";
+  allow_mcp_gateway: "Yes" | "No";
   allowed_hostnames: string[];
 }
 
@@ -63,6 +67,10 @@ export const NetworkPolicyCreatePage = ({
         allow_devbox_to_devbox: initialPolicy.egress.allow_devbox_to_devbox
           ? "Yes"
           : "No",
+        allow_ai_gateway: initialPolicy.egress.allow_ai_gateway ? "Yes" : "No",
+        allow_mcp_gateway: initialPolicy.egress.allow_mcp_gateway
+          ? "Yes"
+          : "No",
         allowed_hostnames: initialPolicy.egress.allowed_hostnames || [],
       };
     }
@@ -71,6 +79,8 @@ export const NetworkPolicyCreatePage = ({
       description: "",
       allow_all: "No",
       allow_devbox_to_devbox: "No",
+      allow_ai_gateway: "No",
+      allow_mcp_gateway: "No",
       allowed_hostnames: [],
     };
   });
@@ -100,6 +110,16 @@ export const NetworkPolicyCreatePage = ({
       label: "Allow Devbox-to-Devbox",
       type: "select",
     },
+    {
+      key: "allow_ai_gateway",
+      label: "Allow AI Gateway",
+      type: "select",
+    },
+    {
+      key: "allow_mcp_gateway",
+      label: "Allow MCP Gateway",
+      type: "select",
+    },
     { key: "allowed_hostnames", label: "Allowed Hostnames", type: "list" },
   ];
 
@@ -233,6 +253,8 @@ export const NetworkPolicyCreatePage = ({
         description?: string;
         allow_all?: boolean;
         allow_devbox_to_devbox?: boolean;
+        allow_ai_gateway?: boolean;
+        allow_mcp_gateway?: boolean;
         allowed_hostnames?: string[];
       } = {};
 
@@ -252,6 +274,8 @@ export const NetworkPolicyCreatePage = ({
 
       params.allow_all = formData.allow_all === "Yes";
       params.allow_devbox_to_devbox = formData.allow_devbox_to_devbox === "Yes";
+      params.allow_ai_gateway = formData.allow_ai_gateway === "Yes";
+      params.allow_mcp_gateway = formData.allow_mcp_gateway === "Yes";
 
       // For allowed_hostnames, always send the current list
       // (empty array means no hostnames allowed)

src/components/NetworkPolicyCreatePage.tsx

@@ -332,6 +332,18 @@ export function NetworkPolicyDetailScreen({
         {np.egress.allow_devbox_to_devbox ? "Yes" : "No"}
       </Text>,
     );
+    lines.push(
+      <Text key="egress-ai-gateway" dimColor>
+        {" "}
+        Allow AI Gateway: {np.egress.allow_ai_gateway ? "Yes" : "No"}
+      </Text>,
+    );
+    lines.push(
+      <Text key="egress-mcp-gateway" dimColor>
+        {" "}
+        Allow MCP Gateway: {np.egress.allow_mcp_gateway ? "Yes" : "No"}
+      </Text>,
+    );
     lines.push(<Text key="egress-space"> </Text>);
 
     // Allowed Hostnames

src/screens/NetworkPolicyDetailScreen.tsx

@@ -64,6 +64,8 @@ export async function listNetworkPolicies(
         egress: {
           allow_all: p.egress.allow_all,
           allow_devbox_to_devbox: p.egress.allow_devbox_to_devbox,
+          allow_ai_gateway: p.egress.allow_ai_gateway,
+          allow_mcp_gateway: p.egress.allow_mcp_gateway,
           allowed_hostnames: p.egress.allowed_hostnames || [],
         },
       });
@@ -95,6 +97,8 @@ export async function getNetworkPolicy(id: string): Promise<NetworkPolicy> {
     egress: {
       allow_all: policy.egress.allow_all,
       allow_devbox_to_devbox: policy.egress.allow_devbox_to_devbox,
+      allow_ai_gateway: policy.egress.allow_ai_gateway,
+      allow_mcp_gateway: policy.egress.allow_mcp_gateway,
       allowed_hostnames: policy.egress.allowed_hostnames || [],
     },
   };
@@ -116,6 +120,8 @@ export interface CreateNetworkPolicyParams {
   description?: string;
   allow_all?: boolean;
   allow_devbox_to_devbox?: boolean;
+  allow_ai_gateway?: boolean;
+  allow_mcp_gateway?: boolean;
   allowed_hostnames?: string[];
 }
 
@@ -134,6 +140,8 @@ export async function createNetworkPolicy(
     egress: {
       allow_all: policy.egress.allow_all,
       allow_devbox_to_devbox: policy.egress.allow_devbox_to_devbox,
+      allow_ai_gateway: policy.egress.allow_ai_gateway,
+      allow_mcp_gateway: policy.egress.allow_mcp_gateway,
       allowed_hostnames: policy.egress.allowed_hostnames || [],
     },
   };
@@ -147,6 +155,8 @@ export interface UpdateNetworkPolicyParams {
   description?: string;
   allow_all?: boolean;
   allow_devbox_to_devbox?: boolean;
+  allow_ai_gateway?: boolean;
+  allow_mcp_gateway?: boolean;
   allowed_hostnames?: string[];
 }
 
@@ -166,6 +176,8 @@ export async function updateNetworkPolicy(
     egress: {
       allow_all: policy.egress.allow_all,
       allow_devbox_to_devbox: policy.egress.allow_devbox_to_devbox,
+      allow_ai_gateway: policy.egress.allow_ai_gateway,
+      allow_mcp_gateway: policy.egress.allow_mcp_gateway,
       allowed_hostnames: policy.egress.allowed_hostnames || [],
     },
   };

src/services/networkPolicyService.ts

@@ -712,6 +712,8 @@ export function createProgram(): Command {
     .option("--description <description>", "Policy description")
     .option("--allow-all", "Allow all egress traffic")
     .option("--allow-devbox-to-devbox", "Allow devbox-to-devbox communication")
+    .option("--allow-ai-gateway", "Allow AI gateway access")
+    .option("--allow-mcp-gateway", "Allow MCP gateway access")
     .option(
       "--allowed-hostnames <hostnames...>",
       "List of allowed hostnames for egress",