@bivy/bivy 0.6.0-staging.87 → 0.6.0-staging.88

package/dist/harness/egress.js

@@ -7,8 +7,16 @@
 // subprocess — without process.ts importing the server. Opt-in via the
 // BIVY_EGRESS_PROXY env var, so routing all agent traffic through the broker is
 // an explicit choice (it adds a hop and logs destinations).
-import { EgressProxy } from "./net-proxy.js";
+import { EgressProxy, denyAllDecider } from "./net-proxy.js";
 let proxy;
+// Per-session egress proxies, keyed by session id. This is the plan's
+// "per-workflow proxy/decider, never the singleton": a session that needs its own
+// network policy (e.g. a read-only sandbox that must actually block egress, or a
+// workflow with an allowlist) gets its OWN EgressProxy with its OWN decider,
+// injected into just that session's subprocess — the node-global `proxy` above and
+// every other session are untouched. Empty by default, so nothing here changes the
+// default path.
+const sessionProxies = new Map();
 /** Start the egress proxy if BIVY_EGRESS_PROXY is set. Idempotent. */
 export async function startEgressProxyIfEnabled(onEvent) {
     if (proxy)
@@ -28,3 +36,58 @@ export async function stopEgressProxy() {
     await proxy.stop();
     proxy = undefined;
 }
+// --- Per-session egress (the per-workflow proxy/decider) --------------------
+/**
+ * Start a per-session egress proxy governed by `decide`, keyed to `sessionId`.
+ * Its `env()` is what `sessionEgressEnv(sessionId)` returns, so the runtime
+ * injects it into that session's subprocess *instead of* the node-global proxy.
+ * Idempotent per session. Best-effort — a listen failure leaves the session on the
+ * default path rather than blocking it.
+ */
+export async function startSessionEgress(sessionId, decide, onEvent) {
+    if (sessionProxies.has(sessionId))
+        return;
+    try {
+        const p = await EgressProxy.start({ decide, onEvent });
+        // A concurrent start for the same id won the race — keep the first, stop this.
+        if (sessionProxies.has(sessionId)) {
+            await p.stop();
+            return;
+        }
+        sessionProxies.set(sessionId, p);
+    }
+    catch {
+        // Leave the session on the default egress path (global proxy or none).
+    }
+}
+/** The per-session proxy env to inject for `sessionId`, or undefined when it has
+ *  none (the caller then falls back to the node-global `egressEnv()`). */
+export function sessionEgressEnv(sessionId) {
+    return sessionProxies.get(sessionId)?.env();
+}
+/** Tear down a session's own egress proxy (call on session close). Idempotent. */
+export async function stopSessionEgress(sessionId) {
+    const p = sessionProxies.get(sessionId);
+    if (!p)
+        return;
+    sessionProxies.delete(sessionId);
+    await p.stop().catch(() => { });
+}
+/**
+ * Apply the sandbox tier's network policy to a session as a per-session proxy.
+ * `read-only` means "no writes, no network" (see sandbox.ts), but only agents with
+ * a native sandbox enforce the network half — a CLI agent without one (opencode,
+ * aider, goose) would still reach the internet. When enforcement is opted in
+ * (`BIVY_SANDBOX_NET`), a read-only session gets a deny-all egress proxy so the
+ * contract holds for every agent. Other tiers (workspace-write, danger-full-access)
+ * allow network and get no per-session proxy. No-op unless opted in, so the default
+ * path is unchanged. Node-local traffic (the daemon's MCP/API) is exempt via the
+ * proxy env's NO_PROXY, so read-only sessions keep working against localhost.
+ */
+export async function applySessionSandboxEgress(sessionId, tier, onEvent) {
+    if (!process.env.BIVY_SANDBOX_NET)
+        return;
+    if (tier !== "read-only")
+        return;
+    await startSessionEgress(sessionId, denyAllDecider(), onEvent);
+}

package/dist/harness/net-proxy.js

@@ -18,6 +18,34 @@
 // networking, unit-tested in test/harness-net-proxy.test.ts.
 import http from "node:http";
 import net from "node:net";
+/** Allow every destination (the proxy's default — pure observe-and-log). */
+export const allowAllDecider = () => ({ allow: true });
+/**
+ * Deny every destination. Used for a per-session egress proxy that enforces the
+ * `read-only` sandbox tier's "no network" contract for agents whose own sandbox
+ * doesn't (see egress.ts). Node-local traffic never reaches here — the proxy env's
+ * NO_PROXY exempts localhost — so the agent can still reach the daemon's own MCP/API.
+ */
+export function denyAllDecider(reason = "read-only sandbox: outbound network is disabled") {
+    return () => ({ allow: false, reason });
+}
+/**
+ * Allow only hosts in `hosts` (exact, or a subdomain of a listed apex — "api.x.com"
+ * matches an entry "x.com"), denying everything else. The building block for a
+ * per-workflow egress allowlist that never touches the node-global decider. Host
+ * matching is case-insensitive; an empty list denies all.
+ */
+export function allowlistDecider(hosts, reason = "not on this session's egress allowlist") {
+    const allow = new Set(hosts.map((h) => h.trim().toLowerCase()).filter(Boolean));
+    return (host) => {
+        const h = host.trim().toLowerCase();
+        for (const entry of allow) {
+            if (h === entry || h.endsWith(`.${entry}`))
+                return { allow: true };
+        }
+        return { allow: false, reason };
+    };
+}
 /** Split "host:port" (CONNECT target) into parts, defaulting the port. */
 export function parseHostPort(authority, defaultPort) {
     // IPv6 literal like [::1]:443

package/dist/runtime/process.js

@@ -5,7 +5,7 @@ import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { stripAnsi } from "./ansi.js";
 import { buildAgentCredentialEnv } from "./credentials.js";
-import { egressEnv } from "../harness/egress.js";
+import { egressEnv, sessionEgressEnv } from "../harness/egress.js";
 import { depCacheEnv } from "../harness/dep-cache.js";
 import { bivySessionEnv } from "./session-env.js";
 /**
@@ -300,12 +300,14 @@ class ProcessSession {
         // src/harness/sandbox.ts). Bivy no longer wraps the process in an OS jail.
         const child = spawn(this.runtimeOptions.command, args, {
             cwd: this.cwd,
-            // egressEnv() routes this agent's outbound traffic through the harness
-            // network broker when BIVY_EGRESS_PROXY is enabled (else it's {}).
-            // bivySessionEnv() lets the agent's own shell resolve its session for
-            // `bivy attach <path>` (see session-env.ts); spread last so it can never
-            // be shadowed by an operator-configured env var of the same name.
-            env: { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...credentialEnv, ...prepareEnv, ...egressEnv(), ...bivySessionEnv(this.id) },
+            // Route this agent's outbound traffic through an egress proxy: this
+            // session's OWN proxy if it has one (a per-session sandbox/workflow network
+            // policy — sessionEgressEnv), else the node-global broker when
+            // BIVY_EGRESS_PROXY is enabled (else {}). bivySessionEnv() lets the agent's
+            // own shell resolve its session for `bivy attach <path>` (see
+            // session-env.ts); spread last so it can never be shadowed by an operator-
+            // configured env var of the same name.
+            env: { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...credentialEnv, ...prepareEnv, ...(sessionEgressEnv(this.id) ?? egressEnv()), ...bivySessionEnv(this.id) },
             stdio: "pipe",
             // Detached so the child becomes the leader of its own process group
             // (POSIX) — see killProcessGroup() / abort() below, which kill that whole

package/dist/server.js

@@ -53,7 +53,7 @@ import { commandLaunch } from "./command-launch.js";
 import { listMultiplexerSessions, attachCommand } from "./multiplexer.js";
 import { createWorktree, removeWorktree, branchSlug, gitRepoRoot } from "./worktree.js";
 import { HarnessManager } from "./harness/manager.js";
-import { startEgressProxyIfEnabled } from "./harness/egress.js";
+import { startEgressProxyIfEnabled, applySessionSandboxEgress, stopSessionEgress } from "./harness/egress.js";
 import { initSharedDepCache, sharedDepCacheRoot } from "./harness/dep-cache.js";
 import { evictToCap, dirSizeBytes } from "./harness/cache-evict.js";
 import { checkDiskAdmission } from "./harness/disk-admission.js";
@@ -6772,6 +6772,9 @@ function closeSessionRecord(record, reason = "closed") {
     sessionEvents.clear(record.id);
     record.session.dispose();
     harness.detach(record.id);
+    // Tear down this session's own egress proxy, if it started one (read-only /
+    // workflow network policy). No-op for the default path.
+    void stopSessionEgress(record.id);
     record.mcpRestore?.();
     openSessions.delete(record.id);
     if (record.sessionFile)
@@ -7951,6 +7954,12 @@ async function createSession(workspace = defaultWorkspace, sessionFile, opts = {
     // session legitimately starts "active now".
     const resumedLastActive = requestedSessionFile ? metaLastActiveMs(storedMeta) : undefined;
     const record = { id: sessionId, session, runtimeId: rt.id, sandbox: sessionSandbox, approvalMode: opts.approvalMode, workspace: sessionWorkspace, sessionFile: session.sessionFile, agentServiceAddress: attachedAddress ?? rt.agentServiceAddress, worktree, source, prUrl: storedMeta?.prUrl, prs: storedMeta?.prs, lastTouchedAt: resumedLastActive ?? Date.now(), warning: modelFallbackMessage, ephemeral: opts.ephemeral };
+    // Apply this session's sandbox network policy as a per-session egress proxy
+    // (its own proxy/decider, never the node-global one). Opt-in via BIVY_SANDBOX_NET:
+    // a read-only session then actually blocks outbound network even for a CLI agent
+    // whose own sandbox doesn't (opencode/aider/goose). No-op otherwise. Fire-and-
+    // forget — a slow proxy listen never delays session creation.
+    void applySessionSandboxEgress(record.id, sessionSandbox, (event) => broadcast({ type: "node.egress", event }));
     // Stage 2 slice 4: a re-attached session recovers its still-running TUI
     // terminal link (the PTY survives a detach) from the session→terminal registry.
     if (attached) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.6.0-staging.87",
+  "version": "0.6.0-staging.88",
   "type": "module",
   "license": "FSL-1.1-ALv2",
   "description": "Run coding agents on machines you own. Source-available, self-hostable agent workspace.",