@bike4mind/cli 1.1.0 → 1.2.0

package/dist/{ProxyManager-C1-lgzEU.mjs → ProxyManager-B0-RuR2w.mjs}

@@ -194,14 +194,30 @@ var ProxyManager = class {
 	constructor(networkConfig) {
 		this.proxy = null;
 		this.eventHandlers = /* @__PURE__ */ new Set();
+		this.startPromise = null;
 		this.networkConfig = {
 			...networkConfig,
 			allowedDomains: [...networkConfig.allowedDomains]
 		};
 	}
-	async start() {
-		if (!this.networkConfig.enabled) return;
-		if (this.proxy?.isRunning()) return;
+	/**
+	* Update the live enabled flag so a runtime toggle takes effect on the next
+	* start()/stop(). Without this, start() would early-return on the enabled value
+	* snapshotted at construction and grant egress with no proxy actually running.
+	*/
+	setEnabled(enabled) {
+		this.networkConfig.enabled = enabled;
+	}
+	start() {
+		if (!this.networkConfig.enabled) return Promise.resolve();
+		if (this.proxy?.isRunning()) return Promise.resolve();
+		if (this.startPromise) return this.startPromise;
+		this.startPromise = this.doStart().finally(() => {
+			this.startPromise = null;
+		});
+		return this.startPromise;
+	}
+	async doStart() {
 		this.proxy = new HttpConnectProxy({ allowedDomains: this.networkConfig.allowedDomains });
 		this.proxy.on("proxy-event", (event) => {
 			for (const handler of this.eventHandlers) handler(event);
@@ -209,6 +225,7 @@ var ProxyManager = class {
 		await this.proxy.start();
 	}
 	async stop() {
+		if (this.startPromise) await this.startPromise.catch(() => {});
 		if (!this.proxy) return;
 		await this.proxy.stop();
 		this.proxy = null;
@@ -256,4 +273,4 @@ var ProxyManager = class {
 	}
 };
 //#endregion
-export { ProxyManager as t };
+export { ProxyManager };

package/dist/{SandboxOrchestrator-CIegJrCj.mjs → SandboxOrchestrator-BcUv9fQ3.mjs}

@@ -10,7 +10,7 @@ var SandboxOrchestrator = class {
 			violations: 0
 		};
 		this.violationStore = null;
-		this.config = config ?? DEFAULT_SANDBOX_CONFIG;
+		this.config = structuredClone(config ?? DEFAULT_SANDBOX_CONFIG);
 		this.runtime = runtime ?? null;
 		this.proxyManager = proxyManager ?? null;
 	}
@@ -52,6 +52,7 @@ var SandboxOrchestrator = class {
 				command,
 				cwd,
 				filesystemConfig: this.config.filesystem,
+				networkEnabled: this.config.network.enabled && (this.proxyManager?.isRunning() ?? false),
 				env: proxyEnv,
 				...this.runtime.platform === "linux" && this.config.platform.linux.seccompProfile && { seccompProfile: this.config.platform.linux.seccompProfile }
 			})
@@ -78,21 +79,54 @@ var SandboxOrchestrator = class {
 	getConfig() {
 		return this.config;
 	}
-	/** Update config (does not persist - caller must save) */
-	updateConfig(config) {
-		this.config = config;
+	/**
+	* Toggle network egress at runtime and keep the runtime flag and the actual
+	* proxy in lockstep - this is the SINGLE lifecycle owner. Fail-closed: when
+	* enabling, the proxy must be running afterwards or the flag stays false. The
+	* flag is not trusted on its own either - shouldSandbox additionally gates on
+	* proxyManager.isRunning(), so a stale network.enabled left by any other path
+	* can never hand the runtime raw egress. Note the proxy only filters clients
+	* that honor HTTP(S)_PROXY; raw sockets (`curl --noproxy`, `nc`) still egress
+	* when network is on, so allowedDomains binds proxy-aware traffic only.
+	* Returns whether network is enabled on return. Does not persist - caller saves.
+	*/
+	async setNetworkEnabled(enabled) {
+		if (!enabled) {
+			this.config.network.enabled = false;
+			this.proxyManager?.setEnabled(false);
+			await this.proxyManager?.stop().catch(() => {});
+			return false;
+		}
+		if (!this.proxyManager) {
+			this.config.network.enabled = false;
+			return false;
+		}
+		this.proxyManager.setEnabled(true);
+		try {
+			await this.proxyManager.start();
+		} catch {}
+		if (!this.proxyManager.isRunning()) {
+			this.proxyManager.setEnabled(false);
+			this.config.network.enabled = false;
+			return false;
+		}
+		this.config.network.enabled = true;
+		return true;
 	}
 	/** Get the ProxyManager instance (if any) */
 	getProxyManager() {
 		return this.proxyManager;
 	}
-	/** Start the network proxy (if configured) */
-	async startProxy() {
-		await this.proxyManager?.start();
-	}
-	/** Stop the network proxy */
-	async stopProxy() {
-		await this.proxyManager?.stop();
+	/**
+	* Trust a domain for network egress. Updates BOTH the persisted config (the
+	* source of truth getConfig/saveSandboxConfig read) and the live proxy - the
+	* config is structuredClone'd at construction, so updating only the proxy would
+	* leave getConfig()'s allowedDomains stale and a later /sandbox:network or
+	* /sandbox:enable save would silently drop the grant. No-op on a duplicate.
+	*/
+	addAllowedDomain(domain) {
+		if (!this.config.network.allowedDomains.includes(domain)) this.config.network.allowedDomains.push(domain);
+		this.proxyManager?.addAllowedDomain(domain);
 	}
 	/** Get full status information for display */
 	getStatus() {
@@ -156,4 +190,4 @@ var SandboxOrchestrator = class {
 	}
 };
 //#endregion
-export { SandboxOrchestrator as t };
+export { SandboxOrchestrator };

package/dist/{SandboxRuntimeAdapter-ChGlxSGQ.mjs → SandboxRuntimeAdapter-BgLUVTJL.mjs}

@@ -42,12 +42,12 @@ async function createSandboxRuntime() {
 	const platform = detectPlatform();
 	if (!platform) return null;
 	if (platform === "darwin") {
-		const { SeatbeltRuntime } = await import("./SeatbeltRuntime-Qqt19cAN.mjs");
+		const { SeatbeltRuntime } = await import("./SeatbeltRuntime-C_Y8q8Mr.mjs");
 		const runtime = new SeatbeltRuntime();
 		return runtime.isAvailable() ? runtime : null;
 	}
 	if (platform === "linux") {
-		const { BubblewrapRuntime } = await import("./BubblewrapRuntime-CkL9-gnG.mjs");
+		const { BubblewrapRuntime } = await import("./BubblewrapRuntime-5bLPTwEC.mjs");
 		const runtime = new BubblewrapRuntime();
 		return runtime.isAvailable() ? runtime : null;
 	}

package/dist/{SandboxRuntimeAdapter-CKelGICD.mjs → SandboxRuntimeAdapter-BmHELLuM.mjs}

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import { i as isBinaryAvailable, n as detectPlatform, r as expandPath, t as createSandboxRuntime } from "./SandboxRuntimeAdapter-ChGlxSGQ.mjs";
+import { i as isBinaryAvailable, n as detectPlatform, r as expandPath, t as createSandboxRuntime } from "./SandboxRuntimeAdapter-BgLUVTJL.mjs";
 export { createSandboxRuntime, detectPlatform, expandPath, isBinaryAvailable };

package/dist/{SeatbeltRuntime-Qqt19cAN.mjs → SeatbeltRuntime-C_Y8q8Mr.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as isBinaryAvailable, r as expandPath } from "./SandboxRuntimeAdapter-ChGlxSGQ.mjs";
+import { i as isBinaryAvailable, r as expandPath } from "./SandboxRuntimeAdapter-BgLUVTJL.mjs";
 import { mkdtempSync, writeFileSync } from "fs";
 import os from "os";
 import path from "path";
@@ -54,6 +54,14 @@ var SeatbeltRuntime = class {
 			"(allow default)",
 			""
 		];
+		if (!options.networkEnabled) {
+			lines.push("; Deny all network, then re-allow local unix sockets (net: IP-only denial)");
+			lines.push("(deny network*)");
+			lines.push("(allow network-outbound (remote unix-socket))");
+			lines.push("(allow network-inbound (local unix-socket))");
+			lines.push("(allow network-bind (local unix-socket))");
+			lines.push("");
+		}
 		if (filesystemConfig.writeOnlyToWorkingDir) {
 			lines.push("; Deny all file writes globally");
 			lines.push("(deny file-write*)");