@cabane/companion 0.6.123 → 0.6.124

package/dist/cli.js

@@ -9640,8 +9640,10 @@ var init_dispatcher = __esm({
 });
 
 // src/runner/harness-sandbox.ts
+import { lookup } from "dns/promises";
 import { chmodSync as chmodSync5, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync7, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir3, tmpdir as tmpdir2, userInfo as userInfo2 } from "os";
+import { isIP } from "net";
+import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir2, userInfo as userInfo2 } from "os";
 import { join as join15 } from "path";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function accountHome() {
@@ -9654,19 +9656,36 @@ function accountHome() {
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-function cabaneHostEntry(baseUrl) {
+function cabaneHostEntries(baseUrl, resolved, ownAddresses2) {
   const url = new URL(baseUrl);
-  const loopback = ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
-  if (!loopback) return url.hostname;
   const port = url.port || (url.protocol === "https:" ? "443" : "80");
-  return `127.0.0.1:${port}`;
+  if (["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)) return [`127.0.0.1:${port}`];
+  const own = new Set(ownAddresses2);
+  const literals = resolved.filter((address) => own.has(address)).map((address) => address.includes(":") ? `[${address}]:${port}` : `${address}:${port}`);
+  return [url.hostname, ...literals];
+}
+async function resolvedAddresses(baseUrl) {
+  const { hostname: hostname5 } = new URL(baseUrl);
+  if (isIP(hostname5)) return [];
+  try {
+    const answers = await lookup(hostname5, { all: true });
+    return answers.map((a) => a.address);
+  } catch {
+    return [];
+  }
+}
+function ownAddresses() {
+  return Object.values(networkInterfaces()).flat().flatMap((i) => i ? [i.address] : []);
 }
 function harnessSandboxConfig(input) {
   const claudeDir = input.claudeConfigDir ?? join15(input.home, ".claude");
   const codexDir = input.codexHome ?? join15(input.home, ".codex");
   return {
     network: {
-      allowedDomains: [cabaneHostEntry(input.baseUrl), ...MODEL_AND_GIT_HOSTS],
+      allowedDomains: [
+        ...cabaneHostEntries(input.baseUrl, input.resolved, input.ownAddresses),
+        ...MODEL_AND_GIT_HOSTS
+      ],
       deniedDomains: [],
       allowLocalBinding: true
     },
@@ -9719,6 +9738,8 @@ async function prepareHarnessSandbox(input) {
     const config = harnessSandboxConfig({
       cwd: input.cwd,
       baseUrl: input.baseUrl,
+      resolved: await resolvedAddresses(input.baseUrl),
+      ownAddresses: ownAddresses(),
       home: homedir3(),
       accountHome: accountHome(),
       tmp: tmpdir2(),

package/dist/runtime.js

@@ -10797,8 +10797,10 @@ var DeviceLocks = class {
 };
 
 // src/runner/harness-sandbox.ts
+import { lookup } from "dns/promises";
 import { chmodSync as chmodSync5, mkdirSync as mkdirSync9, mkdtempSync, rmSync as rmSync7, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir3, tmpdir as tmpdir2, userInfo as userInfo2 } from "os";
+import { isIP } from "net";
+import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir2, userInfo as userInfo2 } from "os";
 import { join as join15 } from "path";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function osSandboxUsable(log) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.123",
+  "version": "0.6.124",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",