@hotcell/daemon 0.1.0

package/dist/logger.js

@@ -0,0 +1,67 @@
+/**
+ * Tiny dependency-free structured logger. Emits either one JSON object per line
+ * (machine-friendly, the Phase 2 "structured logs" deliverable) or a coloured
+ * human line for local dev. A single process-wide logger is configured at
+ * startup via `configureLogger`; modules import `log` and use it directly so we
+ * don't thread a logger through every call site.
+ */
+const LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };
+class JsonLogger {
+    level;
+    format;
+    base;
+    constructor(level, format, base = {}) {
+        this.level = level;
+        this.format = format;
+        this.base = base;
+    }
+    child(fields) {
+        return new JsonLogger(this.level, this.format, { ...this.base, ...fields });
+    }
+    debug(msg, fields) {
+        this.emit("debug", msg, fields);
+    }
+    info(msg, fields) {
+        this.emit("info", msg, fields);
+    }
+    warn(msg, fields) {
+        this.emit("warn", msg, fields);
+    }
+    error(msg, fields) {
+        this.emit("error", msg, fields);
+    }
+    emit(level, msg, fields) {
+        if (LEVEL_RANK[level] < LEVEL_RANK[this.level])
+            return;
+        const merged = { ...this.base, ...fields };
+        // Logs go to stderr so they never intermix with a command's piped stdout.
+        if (this.format === "json") {
+            process.stderr.write(JSON.stringify({ ts: new Date().toISOString(), level, msg, ...merged }) + "\n");
+            return;
+        }
+        const ts = new Date().toISOString().slice(11, 23);
+        const tag = PRETTY_TAG[level];
+        const extra = Object.entries(merged)
+            .map(([k, v]) => `${k}=${formatVal(v)}`)
+            .join(" ");
+        process.stderr.write(`${ts} ${tag} ${msg}${extra ? " " + extra : ""}\n`);
+    }
+}
+const PRETTY_TAG = {
+    debug: "\x1b[90mDBG\x1b[0m",
+    info: "\x1b[32mINF\x1b[0m",
+    warn: "\x1b[33mWRN\x1b[0m",
+    error: "\x1b[31mERR\x1b[0m",
+};
+function formatVal(v) {
+    if (typeof v === "string")
+        return /\s/.test(v) ? JSON.stringify(v) : v;
+    return JSON.stringify(v);
+}
+/** Process-wide logger. Replaced by `configureLogger`; defaults are quiet-ish. */
+export let log = new JsonLogger("info", "pretty");
+export function configureLogger(opts) {
+    log = new JsonLogger(opts.level, opts.format);
+    return log;
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,MAAM,UAAU,GAA6B,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAa1F,MAAM,UAAU;IAEK;IACA;IACA;IAHnB,YACmB,KAAe,EACf,MAAiB,EACjB,OAAkB,EAAE;QAFpB,UAAK,GAAL,KAAK,CAAU;QACf,WAAM,GAAN,MAAM,CAAW;QACjB,SAAI,GAAJ,IAAI,CAAgB;IACpC,CAAC;IAEJ,KAAK,CAAC,MAAiB;QACrB,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,MAAkB;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,GAAW,EAAE,MAAkB;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,GAAW,EAAE,MAAkB;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,GAAW,EAAE,MAAkB;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAEO,IAAI,CAAC,KAAe,EAAE,GAAW,EAAE,MAAkB;QAC3D,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QACvD,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;QAC3C,0EAA0E;QAC1E,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAC/E,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;aACvC,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;CACF;AAED,MAAM,UAAU,GAA6B;IAC3C,KAAK,EAAE,oBAAoB;IAC3B,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,oBAAoB;CAC5B,CAAC;AAEF,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,IAAI,GAAG,GAAW,IAAI,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAE1D,MAAM,UAAU,eAAe,CAAC,IAA4C;IAC1E,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/metrics.d.ts

@@ -0,0 +1,46 @@
+import type { Driver } from "./driver/types.js";
+import type { SandboxStore } from "./store.js";
+/** One point in a sandbox's live-metrics history (for dashboard sparklines). */
+export interface MetricSample {
+    at: string;
+    cpuPercent: number;
+    memBytes: number;
+    netRxBytes: number;
+    netTxBytes: number;
+    pids: number;
+}
+/**
+ * In-memory ring of recent live samples per sandbox — backs the dashboard's CPU
+ * and memory sparklines (`GET /sandboxes/:id/metrics/history`). Deliberately not
+ * persisted: it's a short rolling window, cheap to rebuild after a restart.
+ */
+export declare class MetricsHistory {
+    private readonly cap;
+    private readonly byId;
+    constructor(cap?: number);
+    record(id: string, sample: MetricSample): void;
+    get(id: string): MetricSample[];
+    /** Most-recently-sampled resident memory (bytes) for a sandbox, if any. */
+    latestMemBytes(id: string): number | undefined;
+    clear(id: string): void;
+}
+/**
+ * In-process metrics sampler — the cAdvisor-style collection the plan calls for,
+ * minus a per-sandbox sidecar. On each tick it snapshots every running sandbox's
+ * stats and integrates cumulative usage:
+ *   - CPU: the delta of the container's cumulative CPU-ns (reset-safe — a drop
+ *     means the container was recreated, so the new total is counted from zero).
+ *   - Memory: current resident bytes × wall-clock seconds since the last sample.
+ * Totals are persisted via `store.setUsage`, so they survive a daemon restart.
+ */
+export declare function sampleUsage(driver: Driver, store: SandboxStore, history?: MetricsHistory, now?: number): Promise<void>;
+/**
+ * Start the periodic metrics sampler. Returns the interval handle (unref'd so it
+ * won't keep the process alive); pass it to `clearInterval` on shutdown.
+ */
+export declare function startSampler(opts: {
+    driver: Driver;
+    store: SandboxStore;
+    intervalMs: number;
+    history?: MetricsHistory;
+}): NodeJS.Timeout;

package/dist/metrics.js

@@ -0,0 +1,92 @@
+import { log } from "./logger.js";
+/**
+ * In-memory ring of recent live samples per sandbox — backs the dashboard's CPU
+ * and memory sparklines (`GET /sandboxes/:id/metrics/history`). Deliberately not
+ * persisted: it's a short rolling window, cheap to rebuild after a restart.
+ */
+export class MetricsHistory {
+    cap;
+    byId = new Map();
+    constructor(cap = 60) {
+        this.cap = cap;
+    }
+    record(id, sample) {
+        let arr = this.byId.get(id);
+        if (!arr) {
+            arr = [];
+            this.byId.set(id, arr);
+        }
+        arr.push(sample);
+        while (arr.length > this.cap)
+            arr.shift();
+    }
+    get(id) {
+        return this.byId.get(id) ?? [];
+    }
+    /** Most-recently-sampled resident memory (bytes) for a sandbox, if any. */
+    latestMemBytes(id) {
+        const arr = this.byId.get(id);
+        return arr && arr.length ? arr[arr.length - 1].memBytes : undefined;
+    }
+    clear(id) {
+        this.byId.delete(id);
+    }
+}
+/**
+ * In-process metrics sampler — the cAdvisor-style collection the plan calls for,
+ * minus a per-sandbox sidecar. On each tick it snapshots every running sandbox's
+ * stats and integrates cumulative usage:
+ *   - CPU: the delta of the container's cumulative CPU-ns (reset-safe — a drop
+ *     means the container was recreated, so the new total is counted from zero).
+ *   - Memory: current resident bytes × wall-clock seconds since the last sample.
+ * Totals are persisted via `store.setUsage`, so they survive a daemon restart.
+ */
+export async function sampleUsage(driver, store, history, now = Date.now()) {
+    for (const record of store.list()) {
+        if (record.status !== "running")
+            continue;
+        try {
+            const s = await driver.stats(record.id);
+            const prev = record.usage;
+            history?.record(record.id, {
+                at: new Date(now).toISOString(),
+                cpuPercent: s.cpuPercent,
+                memBytes: s.memBytes,
+                netRxBytes: s.netRxBytes,
+                netTxBytes: s.netTxBytes,
+                pids: s.pids,
+            });
+            let cpuDeltaNs = s.cpuTotalUsageNs - prev.lastCpuTotalNs;
+            if (cpuDeltaNs < 0)
+                cpuDeltaNs = s.cpuTotalUsageNs; // container recreated
+            const lastMs = prev.lastSampledAt ? Date.parse(prev.lastSampledAt) : now;
+            const dtSeconds = Math.max(0, (now - lastMs) / 1000);
+            const next = {
+                // egress + provider counters are metered by the proxies, not the sampler.
+                ...prev,
+                cpuSeconds: prev.cpuSeconds + cpuDeltaNs / 1e9,
+                memByteSeconds: prev.memByteSeconds + s.memBytes * dtSeconds,
+                lastCpuTotalNs: s.cpuTotalUsageNs,
+                lastSampledAt: new Date(now).toISOString(),
+            };
+            store.setUsage(record.id, next);
+        }
+        catch (err) {
+            // A sandbox can race a stop/destroy mid-tick; skip it and move on.
+            log.debug("metrics sample failed", { sandbox: record.id, error: String(err) });
+        }
+    }
+}
+/**
+ * Start the periodic metrics sampler. Returns the interval handle (unref'd so it
+ * won't keep the process alive); pass it to `clearInterval` on shutdown.
+ */
+export function startSampler(opts) {
+    const { driver, store, intervalMs, history } = opts;
+    const timer = setInterval(() => {
+        sampleUsage(driver, store, history).catch((err) => log.error("sampler error", { error: String(err) }));
+    }, intervalMs);
+    timer.unref?.();
+    return timer;
+}
+//# sourceMappingURL=metrics.js.map

package/dist/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAclC;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAGI;IAFZ,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE1D,YAA6B,MAAM,EAAE;QAAR,QAAG,GAAH,GAAG,CAAK;IAAG,CAAC;IAEzC,MAAM,CAAC,EAAU,EAAE,MAAoB;QACrC,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjB,OAAO,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG;YAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,2EAA2E;IAC3E,cAAc,CAAC,EAAU;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,EAAU;QACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,KAAmB,EACnB,OAAwB,EACxB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC1C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;YAE1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;gBACzB,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBAC/B,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC;YAEH,IAAI,UAAU,GAAG,CAAC,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC;YACzD,IAAI,UAAU,GAAG,CAAC;gBAAE,UAAU,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,sBAAsB;YAE1E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACzE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YAErD,MAAM,IAAI,GAAiB;gBACzB,0EAA0E;gBAC1E,GAAG,IAAI;gBACP,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,UAAU,GAAG,GAAG;gBAC9C,cAAc,EAAE,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,QAAQ,GAAG,SAAS;gBAC5D,cAAc,EAAE,CAAC,CAAC,eAAe;gBACjC,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aAC3C,CAAC;YACF,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAK5B;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAChD,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,EAAE,UAAU,CAAC,CAAC;IACf,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/net/firewall.d.ts

@@ -0,0 +1,4 @@
+import type { Config } from "../config.js";
+/** Derive the bridge gateway IP (`.1`) from a `/24`-style subnet base. */
+export declare function gatewayOf(subnet: string): string;
+export declare function ensureEgressFirewall(config: Config): Promise<void>;

package/dist/net/firewall.js

@@ -0,0 +1,80 @@
+import { execFile } from "node:child_process";
+import { platform } from "node:os";
+import { promisify } from "node:util";
+import { log } from "../logger.js";
+const exec = promisify(execFile);
+/**
+ * Host-side default-deny egress firewall for sandboxes (Linux only).
+ *
+ * When `SBX_EGRESS_ENFORCE=true`, sandboxes run on a dedicated bridge network
+ * (`config.egressSubnet`). This installs `iptables` rules in the `DOCKER-USER`
+ * chain — the supported, operator-owned hook Docker consults before its own rules
+ * — so traffic from that subnet may reach ONLY the egress gateway (the bridge
+ * gateway `.1` on `egressPort`) and the pinned DNS resolver; everything else is
+ * dropped. The sandbox holds no `CAP_NET_ADMIN`, so it cannot edit these rules.
+ *
+ * Rules live in a dedicated `SBX-EGRESS` chain that is flushed + rebuilt on every
+ * startup (idempotent), with a single jump from `DOCKER-USER`.
+ *
+ * NOT a hard isolation boundary: a kernel-shared container is weaker than a VM,
+ * and on Docker Desktop (macOS) `DOCKER-USER` isn't host-editable — there
+ * enforcement degrades to advisory (proxy env is still set, but direct egress is
+ * not blocked). Transparent, in-guest-enforced default-deny is the microVM driver's
+ * job; this is the best that plain Docker on Linux can do. Requires the daemon to
+ * run with iptables privileges (root or `CAP_NET_ADMIN`).
+ */
+const CHAIN = "SBX-EGRESS";
+/** Derive the bridge gateway IP (`.1`) from a `/24`-style subnet base. */
+export function gatewayOf(subnet) {
+    const base = subnet.split("/")[0] ?? subnet;
+    const octets = base.split(".");
+    if (octets.length !== 4)
+        return base;
+    octets[3] = "1";
+    return octets.join(".");
+}
+export async function ensureEgressFirewall(config) {
+    if (!config.egressEnforce)
+        return;
+    if (platform() !== "linux") {
+        log.warn("egress enforcement requested but host is not Linux — fail-closed firewall is ADVISORY only " +
+            "(proxy env is injected, but direct egress is NOT blocked). Use the microVM driver for hard isolation.", { platform: platform() });
+        return;
+    }
+    const subnet = config.egressSubnet;
+    const gateway = gatewayOf(subnet);
+    const port = String(config.egressPort);
+    const dns = config.egressDnsResolver;
+    // The ordered rule set for the SBX-EGRESS chain. Allows return traffic, the
+    // gateway, and DNS (to the pinned resolver if set, else the bridge gateway, which
+    // Docker's embedded resolver forwards through); drops the rest.
+    const rules = [
+        ["-m", "state", "--state", "ESTABLISHED,RELATED", "-j", "ACCEPT"],
+        ["-p", "tcp", "-d", gateway, "--dport", port, "-j", "ACCEPT"],
+        ["-p", "udp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
+        ["-p", "tcp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
+        ["-j", "DROP"],
+    ];
+    try {
+        // Create (ignore "exists"), then flush so we rebuild cleanly each boot.
+        await ipt(["-N", CHAIN]).catch(() => { });
+        await ipt(["-F", CHAIN]);
+        for (const rule of rules)
+            await ipt(["-A", CHAIN, ...rule]);
+        // Jump from DOCKER-USER for our subnet, exactly once.
+        const jump = ["-s", subnet, "-j", CHAIN];
+        const present = await ipt(["-C", "DOCKER-USER", ...jump]).then(() => true, () => false);
+        if (!present)
+            await ipt(["-I", "DOCKER-USER", ...jump]);
+        log.info("egress firewall installed (default-deny)", { subnet, gateway, port, dns: dns || "embedded" });
+    }
+    catch (err) {
+        log.error("egress firewall: failed to install iptables rules — egress is NOT locked down. " +
+            "Run the daemon with root / CAP_NET_ADMIN, or disable SBX_EGRESS_ENFORCE.", { error: String(err?.message ?? err) });
+    }
+}
+/** Run an `iptables` command, throwing with stderr on failure. */
+async function ipt(args) {
+    await exec("iptables", ["-w", ...args]);
+}
+//# sourceMappingURL=firewall.js.map

package/dist/net/firewall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall.js","sourceRoot":"","sources":["../../src/net/firewall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,KAAK,GAAG,YAAY,CAAC;AAE3B,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO;IAClC,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CACN,6FAA6F;YAC3F,uGAAuG,EACzG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACzB,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAErC,4EAA4E;IAC5E,kFAAkF;IAClF,gEAAgE;IAChE,MAAM,KAAK,GAAe;QACxB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC;QACjE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC7D,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACpE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACpE,CAAC,IAAI,EAAE,MAAM,CAAC;KACf,CAAC;IAEF,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAC5D,sDAAsD;QACtD,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAC5D,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC;IAC1G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CACP,iFAAiF;YAC/E,0EAA0E,EAC5E,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,GAAG,CAAC,IAAc;IAC/B,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/pricing.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Model price table — USD per million tokens, input/output. Used to compute an
+ * LLM call's cost when the provider does **not** report one itself (OpenAI,
+ * Anthropic, Google all return token counts but no dollar figure; only OpenRouter
+ * inlines `usage.cost`). When a provider *does* report cost, that figure is
+ * authoritative and this table is not consulted — see `proxy/egress.ts`.
+ *
+ * Prices are a best-effort default snapshot and are meant to be overridden in
+ * production via `SBX_MODEL_PRICES` (a JSON file of the same shape). Keys are
+ * lower-cased; lookup also tries prefix matches so dated aliases
+ * (`gpt-4o-2024-08-06` → `gpt-4o`) resolve without an exact entry.
+ */
+export interface ModelPrice {
+    /** USD per 1M input/prompt tokens. */
+    inputPerMTok: number;
+    /** USD per 1M output/completion tokens. */
+    outputPerMTok: number;
+}
+export type ModelPrices = Record<string, ModelPrice>;
+/** Built-in default prices (USD / 1M tokens). Override via `SBX_MODEL_PRICES`. */
+export declare const DEFAULT_MODEL_PRICES: ModelPrices;
+/**
+ * Load the model price table: built-in defaults overlaid with a JSON file at
+ * `path` (the `SBX_MODEL_PRICES` config), so operators can reprice without a
+ * rebuild. A missing/unreadable/malformed file logs a warning and falls back to
+ * defaults — pricing must never crash the daemon.
+ */
+export declare function loadModelPrices(path: string): ModelPrices;
+/** Resolve a model's price: exact (lower-cased) match, else longest prefix match. */
+export declare function priceFor(model: string, prices: ModelPrices): ModelPrice | undefined;
+/**
+ * Compute an LLM call's USD cost from token counts. Returns 0 (and warns once per
+ * unknown model) when the model isn't priced — so a gap is observable rather than
+ * silently billed as free.
+ */
+export declare function computeModelCost(model: string | undefined, tokensIn: number, tokensOut: number, prices: ModelPrices): number;

package/dist/pricing.js

@@ -0,0 +1,81 @@
+import { readFileSync } from "node:fs";
+import { log } from "./logger.js";
+/** Built-in default prices (USD / 1M tokens). Override via `SBX_MODEL_PRICES`. */
+export const DEFAULT_MODEL_PRICES = {
+    // OpenAI
+    "gpt-4o": { inputPerMTok: 2.5, outputPerMTok: 10 },
+    "gpt-4o-mini": { inputPerMTok: 0.15, outputPerMTok: 0.6 },
+    "gpt-4.1": { inputPerMTok: 2, outputPerMTok: 8 },
+    "gpt-4.1-mini": { inputPerMTok: 0.4, outputPerMTok: 1.6 },
+    "gpt-4.1-nano": { inputPerMTok: 0.1, outputPerMTok: 0.4 },
+    "o3": { inputPerMTok: 2, outputPerMTok: 8 },
+    "o4-mini": { inputPerMTok: 1.1, outputPerMTok: 4.4 },
+    // Anthropic
+    "claude-3-5-sonnet": { inputPerMTok: 3, outputPerMTok: 15 },
+    "claude-3-5-haiku": { inputPerMTok: 0.8, outputPerMTok: 4 },
+    "claude-3-7-sonnet": { inputPerMTok: 3, outputPerMTok: 15 },
+    "claude-3-opus": { inputPerMTok: 15, outputPerMTok: 75 },
+    "claude-sonnet-4": { inputPerMTok: 3, outputPerMTok: 15 },
+    "claude-opus-4": { inputPerMTok: 15, outputPerMTok: 75 },
+    // Google Gemini
+    "gemini-1.5-pro": { inputPerMTok: 1.25, outputPerMTok: 5 },
+    "gemini-1.5-flash": { inputPerMTok: 0.075, outputPerMTok: 0.3 },
+    "gemini-2.0-flash": { inputPerMTok: 0.1, outputPerMTok: 0.4 },
+    "gemini-2.5-pro": { inputPerMTok: 1.25, outputPerMTok: 10 },
+};
+/**
+ * Load the model price table: built-in defaults overlaid with a JSON file at
+ * `path` (the `SBX_MODEL_PRICES` config), so operators can reprice without a
+ * rebuild. A missing/unreadable/malformed file logs a warning and falls back to
+ * defaults — pricing must never crash the daemon.
+ */
+export function loadModelPrices(path) {
+    if (!path)
+        return { ...DEFAULT_MODEL_PRICES };
+    try {
+        const overrides = JSON.parse(readFileSync(path, "utf8"));
+        const merged = { ...DEFAULT_MODEL_PRICES };
+        for (const [name, price] of Object.entries(overrides)) {
+            if (price && typeof price.inputPerMTok === "number" && typeof price.outputPerMTok === "number") {
+                merged[name.toLowerCase()] = price;
+            }
+        }
+        return merged;
+    }
+    catch (err) {
+        log.warn("model prices: failed to load overrides, using defaults", {
+            path,
+            error: String(err?.message ?? err),
+        });
+        return { ...DEFAULT_MODEL_PRICES };
+    }
+}
+/** Resolve a model's price: exact (lower-cased) match, else longest prefix match. */
+export function priceFor(model, prices) {
+    const key = model.toLowerCase();
+    if (prices[key])
+        return prices[key];
+    let best;
+    for (const [name, price] of Object.entries(prices)) {
+        if (key.startsWith(name) && (!best || name.length > best.name.length)) {
+            best = { name, price };
+        }
+    }
+    return best?.price;
+}
+/**
+ * Compute an LLM call's USD cost from token counts. Returns 0 (and warns once per
+ * unknown model) when the model isn't priced — so a gap is observable rather than
+ * silently billed as free.
+ */
+export function computeModelCost(model, tokensIn, tokensOut, prices) {
+    if (!model)
+        return 0;
+    const price = priceFor(model, prices);
+    if (!price) {
+        log.warn("no price for model — cost computed as 0", { model });
+        return 0;
+    }
+    return (tokensIn / 1e6) * price.inputPerMTok + (tokensOut / 1e6) * price.outputPerMTok;
+}
+//# sourceMappingURL=pricing.js.map

package/dist/pricing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricing.js","sourceRoot":"","sources":["../src/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAuBlC,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAC/C,SAAS;IACT,QAAQ,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE;IAClD,aAAa,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE;IACzD,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;IAChD,cAAc,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE;IACzD,cAAc,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE;IACzD,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;IAC3C,SAAS,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE;IACpD,YAAY;IACZ,mBAAmB,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;IAC3D,kBAAkB,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE;IAC3D,mBAAmB,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;IAC3D,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;IACxD,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;IACzD,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;IACxD,gBAAgB;IAChB,gBAAgB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE;IAC1D,kBAAkB,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE;IAC/D,kBAAkB,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE;IAC7D,gBAAgB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE;CAC5D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgB,CAAC;QACxE,MAAM,MAAM,GAAgB,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACtD,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAC/F,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE;YACjE,IAAI;YACJ,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,MAAmB;IACzD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,IAAqD,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,KAAK,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAyB,EACzB,QAAgB,EAChB,SAAiB,EACjB,MAAmB;IAEnB,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC;AACzF,CAAC"}

package/dist/proxy/allowlist-default.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Curated DEFAULT egress allowlist — the "agents can do real work" baseline.
+ * Checked into the repo so the community can audit and PR it. Domain/SNI names
+ * only (never IPs). Operators override wholesale with `SBX_ALLOWLIST_FILE`, extend
+ * with `SBX_ALLOWLIST_EXTRA`, or drop the riskier `source_control` tier with
+ * `SBX_ALLOW_SOURCE_CONTROL=false`.
+ *
+ * Tiers:
+ *  - `registries`     — package managers + their CDNs. ON by default.
+ *  - `source_control` — git hosts (github/gitlab/bitbucket). ON by default, but
+ *                       NOTE: a writable git host is also an exfil channel
+ *                       (`git push` to an attacker repo). High-security operators
+ *                       should disable this tier.
+ *
+ * `deny` is checked before `allow` and lists DNS-over-HTTPS endpoints, so an agent
+ * can't tunnel DNS (or arbitrary data) out through a DoH resolver even if a wide
+ * allowlist would otherwise permit it.
+ */
+export interface AllowlistData {
+    deny: string[];
+    tiers: Record<string, string[]>;
+}
+export declare const DEFAULT_ALLOWLIST: AllowlistData;

package/dist/proxy/allowlist-default.js

@@ -0,0 +1,53 @@
+export const DEFAULT_ALLOWLIST = {
+    deny: [
+        // DNS-over-HTTPS resolvers (DNS/data exfil channel).
+        "cloudflare-dns.com",
+        "mozilla.cloudflare-dns.com",
+        "dns.google",
+        "dns.google.com",
+        "dns.quad9.net",
+        "doh.opendns.com",
+        "doh.cleanbrowsing.org",
+        "*.dns.nextdns.io",
+    ],
+    tiers: {
+        registries: [
+            // Python
+            "pypi.org",
+            "files.pythonhosted.org",
+            // Node
+            "registry.npmjs.org",
+            // Rust
+            "crates.io",
+            "static.crates.io",
+            "index.crates.io",
+            // Go
+            "proxy.golang.org",
+            "sum.golang.org",
+            // Ruby
+            "rubygems.org",
+            "*.rubygems.org",
+            // Java / Maven
+            "repo.maven.apache.org",
+            "repo1.maven.org",
+            // PHP / Composer
+            "packagist.org",
+            "repo.packagist.org",
+            // OS packages (base images)
+            "deb.debian.org",
+            "security.debian.org",
+            "archive.ubuntu.com",
+            "security.ubuntu.com",
+            "ports.ubuntu.com",
+            "dl-cdn.alpinelinux.org",
+        ],
+        source_control: [
+            "github.com",
+            "codeload.github.com",
+            "*.githubusercontent.com",
+            "gitlab.com",
+            "bitbucket.org",
+        ],
+    },
+};
+//# sourceMappingURL=allowlist-default.js.map

package/dist/proxy/allowlist-default.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist-default.js","sourceRoot":"","sources":["../../src/proxy/allowlist-default.ts"],"names":[],"mappings":"AAuBA,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC9C,IAAI,EAAE;QACJ,qDAAqD;QACrD,oBAAoB;QACpB,4BAA4B;QAC5B,YAAY;QACZ,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,uBAAuB;QACvB,kBAAkB;KACnB;IACD,KAAK,EAAE;QACL,UAAU,EAAE;YACV,SAAS;YACT,UAAU;YACV,wBAAwB;YACxB,OAAO;YACP,oBAAoB;YACpB,OAAO;YACP,WAAW;YACX,kBAAkB;YAClB,iBAAiB;YACjB,KAAK;YACL,kBAAkB;YAClB,gBAAgB;YAChB,OAAO;YACP,cAAc;YACd,gBAAgB;YAChB,eAAe;YACf,uBAAuB;YACvB,iBAAiB;YACjB,iBAAiB;YACjB,eAAe;YACf,oBAAoB;YACpB,4BAA4B;YAC5B,gBAAgB;YAChB,qBAAqB;YACrB,oBAAoB;YACpB,qBAAqB;YACrB,kBAAkB;YAClB,wBAAwB;SACzB;QACD,cAAc,EAAE;YACd,YAAY;YACZ,qBAAqB;YACrB,yBAAyB;YACzB,YAAY;YACZ,eAAe;SAChB;KACF;CACF,CAAC"}

package/dist/proxy/allowlist.d.ts

@@ -0,0 +1,43 @@
+import type { Config } from "../config.js";
+/**
+ * Domain allowlist for the egress control plane's forward-proxy path (the
+ * absolute-form HTTP and CONNECT tunnels that carry pip/npm/git/apt traffic).
+ *
+ * Default-deny: a host is reachable only if it matches the allowlist AND does not
+ * match the denylist (which wins). Matching is by **domain/SNI name, not IP** —
+ * registries and code hosts hide behind rotating CDN IPs (Fastly, Cloudflare, S3),
+ * so an IP allowlist is both unmaintainable and leaky. The host comes from the
+ * forward-proxy request target / the CONNECT authority / the TLS SNI, none of
+ * which require decrypting traffic, so there is no MITM.
+ *
+ * The denylist exists so that even an operator who widens the allowlist can't
+ * accidentally re-open DNS-over-HTTPS endpoints (a DNS-exfil / allowlist-bypass
+ * channel) without explicitly removing the deny entry.
+ */
+export interface AllowlistDecision {
+    allow: boolean;
+    /** Why: `denylist` | `allowlist` | `default-deny`. */
+    reason: "denylist" | "allowlist" | "default-deny";
+}
+export declare class Allowlist {
+    private allowExact;
+    private allowSuffix;
+    private denyExact;
+    private denySuffix;
+    constructor(allow: string[], deny: string[]);
+    private add;
+    /** Decide whether `host` (may include a port) may be reached. Deny wins. */
+    check(host: string): AllowlistDecision;
+    private matches;
+    /** Hosts on the allowlist (for logging/introspection). */
+    size(): number;
+}
+/** Strip a `:port` and trailing dot, lower-case. */
+export declare function normalizeHost(host: string): string;
+/**
+ * Build the deployment allowlist: the checked-in defaults (registries always; the
+ * `source_control` tier unless `SBX_ALLOW_SOURCE_CONTROL=false`) plus
+ * `SBX_ALLOWLIST_EXTRA` hosts, OR — when `SBX_ALLOWLIST_FILE` is set — that file's
+ * `{allow, deny}` verbatim (a full override for operators who want total control).
+ */
+export declare function loadAllowlist(config: Config): Allowlist;

package/dist/proxy/allowlist.js

@@ -0,0 +1,87 @@
+import { readFileSync } from "node:fs";
+import { log } from "../logger.js";
+import { DEFAULT_ALLOWLIST } from "./allowlist-default.js";
+export class Allowlist {
+    allowExact = new Set();
+    allowSuffix = []; // ".foo.com" — matches apex + any subdomain
+    denyExact = new Set();
+    denySuffix = [];
+    constructor(allow, deny) {
+        for (const p of allow)
+            this.add(p, this.allowExact, this.allowSuffix);
+        for (const p of deny)
+            this.add(p, this.denyExact, this.denySuffix);
+    }
+    add(pattern, exact, suffix) {
+        const p = pattern.trim().toLowerCase().replace(/\.$/, "");
+        if (!p)
+            return;
+        if (p.startsWith("*."))
+            suffix.push(p.slice(1)); // "*.foo.com" -> ".foo.com"
+        else
+            exact.add(p);
+    }
+    /** Decide whether `host` (may include a port) may be reached. Deny wins. */
+    check(host) {
+        const h = normalizeHost(host);
+        if (this.matches(h, this.denyExact, this.denySuffix))
+            return { allow: false, reason: "denylist" };
+        if (this.matches(h, this.allowExact, this.allowSuffix))
+            return { allow: true, reason: "allowlist" };
+        return { allow: false, reason: "default-deny" };
+    }
+    matches(host, exact, suffix) {
+        if (exact.has(host))
+            return true;
+        // "*.foo.com" (stored as ".foo.com") matches subdomains AND the apex "foo.com".
+        return suffix.some((s) => host.endsWith(s) || host === s.slice(1));
+    }
+    /** Hosts on the allowlist (for logging/introspection). */
+    size() {
+        return this.allowExact.size + this.allowSuffix.length;
+    }
+}
+/** Strip a `:port` and trailing dot, lower-case. */
+export function normalizeHost(host) {
+    let h = host.trim().toLowerCase();
+    // Strip a trailing :port (but not the colons inside an IPv6 literal).
+    if (!h.includes("[") && h.lastIndexOf(":") > h.indexOf(".")) {
+        h = h.slice(0, h.lastIndexOf(":"));
+    }
+    else if (h.startsWith("[")) {
+        h = h.slice(1, h.indexOf("]"));
+    }
+    return h.replace(/\.$/, "");
+}
+/**
+ * Build the deployment allowlist: the checked-in defaults (registries always; the
+ * `source_control` tier unless `SBX_ALLOW_SOURCE_CONTROL=false`) plus
+ * `SBX_ALLOWLIST_EXTRA` hosts, OR — when `SBX_ALLOWLIST_FILE` is set — that file's
+ * `{allow, deny}` verbatim (a full override for operators who want total control).
+ */
+export function loadAllowlist(config) {
+    if (config.allowlistFile) {
+        try {
+            const f = JSON.parse(readFileSync(config.allowlistFile, "utf8"));
+            const allow = [...(f.allow ?? []), ...Object.values(f.tiers ?? {}).flat(), ...config.allowlistExtra];
+            return new Allowlist(allow, f.deny ?? []);
+        }
+        catch (err) {
+            log.error("allowlist: SBX_ALLOWLIST_FILE unreadable — failing closed (deny all)", {
+                path: config.allowlistFile,
+                error: String(err?.message ?? err),
+            });
+            return new Allowlist([], []); // fail closed: deny everything rather than silently open
+        }
+    }
+    const def = DEFAULT_ALLOWLIST;
+    const allow = [];
+    for (const [name, hosts] of Object.entries(def.tiers)) {
+        if (name === "source_control" && !config.allowSourceControl)
+            continue;
+        allow.push(...hosts);
+    }
+    allow.push(...config.allowlistExtra);
+    return new Allowlist(allow, def.deny);
+}
+//# sourceMappingURL=allowlist.js.map