@kenkaiiii/ggcoder 5.23.3 → 5.25.0

package/dist/core/local-endpoint-store.test.js

@@ -0,0 +1,131 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { AuthStorage } from "@kenkaiiii/gg-core";
+import { LocalEndpointError, addCustomEndpoint, listAllEndpoints, listCustomEndpoints, normalizeLocalBaseUrl, removeCustomEndpoint, syncEndpointCredentials, } from "./local-endpoint-store.js";
+let dir;
+let opts;
+let auth;
+// Both file paths are injected rather than redirected via $HOME: os.homedir()
+// reads USERPROFILE on Windows, so a HOME override silently writes to the real
+// ~/.gg there — which leaks state between tests and pollutes the user's files.
+beforeEach(async () => {
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), "gg-local-endpoints-"));
+    auth = new AuthStorage(path.join(dir, "auth.json"));
+    opts = { settingsFile: path.join(dir, "gg-app.json"), auth };
+});
+afterEach(async () => {
+    await fs.rm(dir, { recursive: true, force: true });
+});
+async function settings() {
+    return JSON.parse(await fs.readFile(opts.settingsFile, "utf-8"));
+}
+describe("normalizeLocalBaseUrl", () => {
+    it("accepts the shapes users actually paste", () => {
+        expect(normalizeLocalBaseUrl("127.0.0.1:1234")).toBe("http://127.0.0.1:1234/v1");
+        expect(normalizeLocalBaseUrl("http://localhost:8000")).toBe("http://localhost:8000/v1");
+        expect(normalizeLocalBaseUrl("http://localhost:8000/v1")).toBe("http://localhost:8000/v1");
+        expect(normalizeLocalBaseUrl("  http://localhost:8000/v1/  ")).toBe("http://localhost:8000/v1");
+        expect(normalizeLocalBaseUrl("http://box.lan:8080/v1/chat/completions")).toBe("http://box.lan:8080/v1");
+        expect(normalizeLocalBaseUrl("http://box.lan:8080/v1/models")).toBe("http://box.lan:8080/v1");
+        // A gateway on a sub-path keeps the path.
+        expect(normalizeLocalBaseUrl("https://gw.example.com/openai")).toBe("https://gw.example.com/openai/v1");
+    });
+    it("rejects empty, malformed, and non-http URLs", () => {
+        expect(() => normalizeLocalBaseUrl("   ")).toThrow(LocalEndpointError);
+        expect(() => normalizeLocalBaseUrl("http://")).toThrow(LocalEndpointError);
+        expect(() => normalizeLocalBaseUrl("ftp://host/v1")).toThrow(LocalEndpointError);
+    });
+});
+describe("custom endpoints", () => {
+    it("adds an endpoint, persists it, and writes its auth credential", async () => {
+        const endpoint = await addCustomEndpoint({ label: "Workstation", baseUrl: "192.168.1.4:8000", apiKey: "secret" }, opts);
+        expect(endpoint).toMatchObject({
+            id: "custom-192-168-1-4-8000",
+            label: "Workstation",
+            baseUrl: "http://192.168.1.4:8000/v1",
+            kind: "custom",
+            custom: true,
+            apiKey: "secret",
+        });
+        expect(await listCustomEndpoints(opts)).toEqual([endpoint]);
+        const creds = await auth.getCredentials("local:custom-192-168-1-4-8000");
+        expect(creds).toMatchObject({ accessToken: "secret", baseUrl: "http://192.168.1.4:8000/v1" });
+        expect(creds.expiresAt).toBeGreaterThan(Date.now());
+        expect(await auth.hasProviderAuth("local")).toBe(true);
+    });
+    it("defaults the label to the host and the key to a placeholder", async () => {
+        await addCustomEndpoint({ baseUrl: "http://localhost:9999" }, opts);
+        const stored = (await listCustomEndpoints(opts))[0];
+        expect(stored.label).toBe("localhost:9999");
+        expect(stored.apiKey).toBeUndefined();
+        expect(await auth.getCredentials("local:custom-localhost-9999")).toMatchObject({
+            accessToken: "local",
+        });
+    });
+    it("updates in place when the same host is re-added", async () => {
+        await addCustomEndpoint({ baseUrl: "http://localhost:9999", apiKey: "wrong" }, opts);
+        await addCustomEndpoint({ label: "Fixed", baseUrl: "http://localhost:9999/v1", apiKey: "right" }, opts);
+        const stored = await listCustomEndpoints(opts);
+        expect(stored).toHaveLength(1);
+        expect(stored[0]).toMatchObject({ label: "Fixed", apiKey: "right" });
+        expect(await auth.getCredentials("local:custom-localhost-9999")).toMatchObject({
+            accessToken: "right",
+        });
+    });
+    it("refuses a URL already covered by a built-in endpoint", async () => {
+        await expect(addCustomEndpoint({ baseUrl: "http://127.0.0.1:11434/v1" }, opts)).rejects.toThrow(/already probed automatically as Ollama/);
+    });
+    it("removes an endpoint and its credential", async () => {
+        await addCustomEndpoint({ baseUrl: "http://localhost:9999" }, opts);
+        await removeCustomEndpoint("custom-localhost-9999", opts);
+        expect(await listCustomEndpoints(opts)).toEqual([]);
+        expect(await auth.getCredentials("local:custom-localhost-9999")).toBeUndefined();
+        expect(await auth.hasProviderAuth("local")).toBe(false);
+    });
+    it("refuses to remove a built-in or unknown endpoint", async () => {
+        await expect(removeCustomEndpoint("ollama", opts)).rejects.toThrow(/built-in/);
+        await expect(removeCustomEndpoint("custom-nope", opts)).rejects.toThrow(/Unknown local/);
+    });
+    it("preserves unrelated gg-app.json keys", async () => {
+        await fs.writeFile(opts.settingsFile, JSON.stringify({ projectsRoot: "/tmp/projects", autopilot: { "/a": true } }), "utf-8");
+        await addCustomEndpoint({ baseUrl: "http://localhost:9999" }, opts);
+        expect(await settings()).toMatchObject({
+            projectsRoot: "/tmp/projects",
+            autopilot: { "/a": true },
+        });
+        await removeCustomEndpoint("custom-localhost-9999", opts);
+        expect(await settings()).toMatchObject({ projectsRoot: "/tmp/projects" });
+    });
+    it("ignores a corrupt settings file instead of throwing", async () => {
+        await fs.writeFile(opts.settingsFile, "{not json", "utf-8");
+        expect(await listCustomEndpoints(opts)).toEqual([]);
+    });
+    it("lists built-in endpoints before custom ones", async () => {
+        await addCustomEndpoint({ baseUrl: "http://localhost:9999" }, opts);
+        expect((await listAllEndpoints(opts)).map((e) => e.id)).toEqual([
+            "ollama",
+            "lmstudio",
+            "llamacpp",
+            "vllm",
+            "custom-localhost-9999",
+        ]);
+    });
+});
+describe("syncEndpointCredentials", () => {
+    it("writes a baseUrl-carrying credential for every endpoint", async () => {
+        await syncEndpointCredentials(await listAllEndpoints(opts), opts);
+        expect((await auth.listLocalEndpointIds()).sort()).toEqual([
+            "llamacpp",
+            "lmstudio",
+            "ollama",
+            "vllm",
+        ]);
+        expect(await auth.getCredentials("local:ollama")).toMatchObject({
+            baseUrl: "http://127.0.0.1:11434/v1",
+            accessToken: "local",
+        });
+    });
+});
+//# sourceMappingURL=local-endpoint-store.test.js.map

package/dist/core/local-endpoint-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-endpoint-store.test.js","sourceRoot":"","sources":["../../src/core/local-endpoint-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,2BAA2B,CAAC;AAEnC,IAAI,GAAW,CAAC;AAChB,IAAI,IAA+B,CAAC;AACpC,IAAI,IAAiB,CAAC;AAEtB,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACtE,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,QAAQ;IACrB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAa,EAAE,OAAO,CAAC,CAA4B,CAAC;AAC/F,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACjF,MAAM,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxF,MAAM,CAAC,qBAAqB,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC3F,MAAM,CAAC,qBAAqB,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAChG,MAAM,CAAC,qBAAqB,CAAC,yCAAyC,CAAC,CAAC,CAAC,IAAI,CAC3E,wBAAwB,CACzB,CAAC;QACF,MAAM,CAAC,qBAAqB,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC9F,0CAA0C;QAC1C,MAAM,CAAC,qBAAqB,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CACjE,kCAAkC,CACnC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,EACvE,IAAI,CACL,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,4BAA4B;YACrC,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,+BAA+B,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAM,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,IAAI,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC,CAAC,CAAC,aAAa,CAAC;YAC7E,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;QACrF,MAAM,iBAAiB,CACrB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,EACxE,IAAI,CACL,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC,CAAC,CAAC,aAAa,CAAC;YAC7E,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7F,wCAAwC,CACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,IAAI,CAAC,CAAC;QAEpE,MAAM,oBAAoB,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACjF,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/E,MAAM,MAAM,CAAC,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAC5E,OAAO,CACR,CAAC;QAEF,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,IAAI,CAAC,CAAC;QAEpE,MAAM,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC;YACrC,YAAY,EAAE,eAAe;YAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,MAAM,oBAAoB,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,YAAa,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,IAAI,CAAC,CAAC;QAEpE,MAAM,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,QAAQ;YACR,UAAU;YACV,UAAU;YACV,MAAM;YACN,uBAAuB;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,uBAAuB,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAElE,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACzD,UAAU;YACV,UAAU;YACV,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9D,OAAO,EAAE,2BAA2B;YACpC,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/network-guard.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Network egress allowlist.
+ *
+ * Two layers, with very different strength:
+ *
+ * 1. **Real enforcement** — the agent's own egress paths (`web-fetch`,
+ *    `web-search`) check every request URL and every redirect hop against the
+ *    allowlist. Nothing gets out of those tools to a disallowed host.
+ *
+ * 2. **Defence in depth (bypassable by design)** — {@link extractCommandHosts}
+ *    recognises the common network command shapes (`curl`, `wget`, `git`,
+ *    `ssh`/`scp`, package installs) so `bash` can refuse an obvious egress to a
+ *    disallowed host. It is *not* a sandbox: `python -c`, a shell variable, a
+ *    base64'd URL, or any unrecognised tool walks straight past it. It exists
+ *    to catch accidents, not to contain a hostile model. Real containment needs
+ *    OS-level enforcement (sandbox-exec, Landlock/seccomp, a netns proxy).
+ *
+ * Deliberately allow-shaped, not deny-shaped: a command with no recognised host
+ * is never blocked, so ordinary work is unaffected.
+ */
+/** Host pattern match: exact, or `*.example.com` matching any subdomain. */
+export declare function isHostAllowed(host: string, allow: readonly string[]): boolean;
+/** Hostname of a URL-ish token, or undefined when it isn't one. */
+export declare function hostFromUrl(value: string): string | undefined;
+/**
+ * Best-effort extraction of the hosts a shell command would contact.
+ * Returns an empty array when nothing recognisable is found — never guesses.
+ */
+export declare function extractCommandHosts(command: string): string[];
+/**
+ * Check a shell command against the allowlist.
+ * @returns an error string when a recognised host is disallowed, else null.
+ */
+export declare function checkCommandNetwork(command: string, mode: "off" | "allowlist", allow: readonly string[]): string | null;
+/** Check a URL the agent is about to fetch (or a redirect target). */
+export declare function checkUrlNetwork(url: string, mode: "off" | "allowlist", allow: readonly string[]): string | null;
+/** Resolved egress policy, read lazily so a settings change applies live. */
+export interface NetworkPolicy {
+    mode: "off" | "allowlist";
+    allow: readonly string[];
+}
+export type GetNetworkPolicy = () => NetworkPolicy | undefined;
+/** Check a URL against a possibly-absent policy. */
+export declare function checkUrlPolicy(url: string, getPolicy?: GetNetworkPolicy): string | null;
+/** Check a shell command against a possibly-absent policy. */
+export declare function checkCommandPolicy(command: string, getPolicy?: GetNetworkPolicy): string | null;
+//# sourceMappingURL=network-guard.d.ts.map

package/dist/core/network-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-guard.d.ts","sourceRoot":"","sources":["../../src/core/network-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAc7E;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ7D;AA0CD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAoE7D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,KAAK,GAAG,WAAW,EACzB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CAUf;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,GAAG,WAAW,EACzB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CAUf;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,KAAK,GAAG,WAAW,CAAC;IAC1B,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,aAAa,GAAG,SAAS,CAAC;AAE/D,oDAAoD;AACpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAIvF;AAED,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAI/F"}

package/dist/core/network-guard.js

@@ -0,0 +1,208 @@
+/**
+ * Network egress allowlist.
+ *
+ * Two layers, with very different strength:
+ *
+ * 1. **Real enforcement** — the agent's own egress paths (`web-fetch`,
+ *    `web-search`) check every request URL and every redirect hop against the
+ *    allowlist. Nothing gets out of those tools to a disallowed host.
+ *
+ * 2. **Defence in depth (bypassable by design)** — {@link extractCommandHosts}
+ *    recognises the common network command shapes (`curl`, `wget`, `git`,
+ *    `ssh`/`scp`, package installs) so `bash` can refuse an obvious egress to a
+ *    disallowed host. It is *not* a sandbox: `python -c`, a shell variable, a
+ *    base64'd URL, or any unrecognised tool walks straight past it. It exists
+ *    to catch accidents, not to contain a hostile model. Real containment needs
+ *    OS-level enforcement (sandbox-exec, Landlock/seccomp, a netns proxy).
+ *
+ * Deliberately allow-shaped, not deny-shaped: a command with no recognised host
+ * is never blocked, so ordinary work is unaffected.
+ */
+/** Host pattern match: exact, or `*.example.com` matching any subdomain. */
+export function isHostAllowed(host, allow) {
+    const target = host.trim().toLowerCase().replace(/\.$/, "");
+    if (!target)
+        return false;
+    for (const raw of allow) {
+        const pattern = raw.trim().toLowerCase().replace(/\.$/, "");
+        if (!pattern)
+            continue;
+        if (pattern.startsWith("*.")) {
+            const suffix = pattern.slice(1); // ".example.com"
+            if (target.endsWith(suffix) && target.length > suffix.length)
+                return true;
+            continue;
+        }
+        if (target === pattern)
+            return true;
+    }
+    return false;
+}
+/** Hostname of a URL-ish token, or undefined when it isn't one. */
+export function hostFromUrl(value) {
+    const candidate = /^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : `https://${value}`;
+    try {
+        const host = new URL(candidate).hostname.toLowerCase();
+        return host || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Default registry hosts for package managers that install from the network. */
+const REGISTRY_HOSTS = {
+    npm: "registry.npmjs.org",
+    pnpm: "registry.npmjs.org",
+    yarn: "registry.yarnpkg.com",
+    bun: "registry.npmjs.org",
+    pip: "pypi.org",
+    pip3: "pypi.org",
+};
+const INSTALL_SUBCOMMANDS = new Set(["install", "i", "add", "ci", "update", "upgrade", "dlx", "x"]);
+const GIT_NETWORK_SUBCOMMANDS = new Set(["clone", "fetch", "pull", "push", "ls-remote"]);
+function stripQuotes(token) {
+    const trimmed = token.trim();
+    if (trimmed.length >= 2 &&
+        ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+            (trimmed.startsWith("'") && trimmed.endsWith("'")))) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+/**
+ * Host part of an `scp`/`ssh` target: `[user@]host[:path]`.
+ * `requireRemoteMarker` distinguishes `scp file.txt host:/tmp` (only the second
+ * token is remote) from `ssh host` (a bare host is the target).
+ */
+function hostFromSshTarget(token, requireRemoteMarker = false) {
+    if (requireRemoteMarker && !token.includes("@") && !token.includes(":"))
+        return undefined;
+    const withoutUser = token.includes("@") ? token.slice(token.lastIndexOf("@") + 1) : token;
+    const host = withoutUser.split(":")[0];
+    if (!host || host.startsWith("-") || !/^[a-z0-9._-]+$/i.test(host))
+        return undefined;
+    // A bare local path (`./dir`, `dir`) has no dots-as-domain shape.
+    if (!host.includes(".") && host !== "localhost")
+        return undefined;
+    return host.toLowerCase();
+}
+/**
+ * Best-effort extraction of the hosts a shell command would contact.
+ * Returns an empty array when nothing recognisable is found — never guesses.
+ */
+export function extractCommandHosts(command) {
+    const hosts = new Set();
+    // Split on shell separators so `cd x && curl https://…` is inspected too.
+    for (const segment of command.split(/(?:&&|\|\||[;|\n])/)) {
+        const tokens = segment
+            .trim()
+            .split(/\s+/)
+            .map(stripQuotes)
+            .filter((t) => t.length > 0);
+        if (tokens.length === 0)
+            continue;
+        let index = 0;
+        if (tokens[index] === "sudo")
+            index++;
+        const program = (tokens[index] ?? "").split("/").pop() ?? "";
+        const args = tokens.slice(index + 1);
+        if (program === "curl" || program === "wget" || program === "http" || program === "https") {
+            for (const arg of args) {
+                if (arg.startsWith("-"))
+                    continue;
+                const host = /^[a-z][a-z0-9+.-]*:\/\//i.test(arg) ? hostFromUrl(arg) : undefined;
+                if (host)
+                    hosts.add(host);
+            }
+            continue;
+        }
+        if (program === "git") {
+            const sub = args.find((a) => !a.startsWith("-"));
+            if (!sub || !GIT_NETWORK_SUBCOMMANDS.has(sub))
+                continue;
+            for (const arg of args.slice(args.indexOf(sub) + 1)) {
+                if (arg.startsWith("-"))
+                    continue;
+                if (/^[a-z][a-z0-9+.-]*:\/\//i.test(arg)) {
+                    const host = hostFromUrl(arg);
+                    if (host)
+                        hosts.add(host);
+                    continue;
+                }
+                // scp-style remote: git@github.com:owner/repo.git
+                if (arg.includes("@") && arg.includes(":")) {
+                    const host = hostFromSshTarget(arg);
+                    if (host)
+                        hosts.add(host);
+                }
+            }
+            continue;
+        }
+        if (program === "ssh" || program === "scp" || program === "sftp" || program === "rsync") {
+            // Only `ssh`'s first bare operand is a host; file-copy tools mark the
+            // remote side with `user@` or `host:path`.
+            const requireRemoteMarker = program !== "ssh";
+            for (const arg of args) {
+                if (arg.startsWith("-"))
+                    continue;
+                const host = hostFromSshTarget(arg, requireRemoteMarker);
+                if (host) {
+                    hosts.add(host);
+                    break;
+                }
+            }
+            continue;
+        }
+        const registry = REGISTRY_HOSTS[program];
+        if (registry) {
+            const sub = args.find((a) => !a.startsWith("-"));
+            if (sub && INSTALL_SUBCOMMANDS.has(sub))
+                hosts.add(registry);
+            continue;
+        }
+    }
+    return [...hosts];
+}
+/**
+ * Check a shell command against the allowlist.
+ * @returns an error string when a recognised host is disallowed, else null.
+ */
+export function checkCommandNetwork(command, mode, allow) {
+    if (mode !== "allowlist")
+        return null;
+    const blocked = extractCommandHosts(command).filter((host) => !isHostAllowed(host, allow));
+    if (blocked.length === 0)
+        return null;
+    const allowed = allow.length > 0 ? allow.join(", ") : "(none)";
+    return (`Blocked by the network allowlist: ${blocked.join(", ")}. ` +
+        `Allowed hosts: ${allowed}. Ask the user to add the host to the networkAllow setting, ` +
+        `or accomplish the task without network access.`);
+}
+/** Check a URL the agent is about to fetch (or a redirect target). */
+export function checkUrlNetwork(url, mode, allow) {
+    if (mode !== "allowlist")
+        return null;
+    const host = hostFromUrl(url);
+    if (!host)
+        return `Blocked by the network allowlist: ${url} has no resolvable host.`;
+    if (isHostAllowed(host, allow))
+        return null;
+    const allowed = allow.length > 0 ? allow.join(", ") : "(none)";
+    return (`Blocked by the network allowlist: ${host}. Allowed hosts: ${allowed}. ` +
+        `Ask the user to add the host to the networkAllow setting.`);
+}
+/** Check a URL against a possibly-absent policy. */
+export function checkUrlPolicy(url, getPolicy) {
+    const policy = getPolicy?.();
+    if (!policy)
+        return null;
+    return checkUrlNetwork(url, policy.mode, policy.allow);
+}
+/** Check a shell command against a possibly-absent policy. */
+export function checkCommandPolicy(command, getPolicy) {
+    const policy = getPolicy?.();
+    if (!policy)
+        return null;
+    return checkCommandNetwork(command, policy.mode, policy.allow);
+}
+//# sourceMappingURL=network-guard.js.map

package/dist/core/network-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-guard.js","sourceRoot":"","sources":["../../src/core/network-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAwB;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;YAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,cAAc,GAA2B;IAC7C,GAAG,EAAE,oBAAoB;IACzB,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE,sBAAsB;IAC5B,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,UAAU;CACjB,CAAC;AAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACpG,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAEzF,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,OAAO,CAAC,MAAM,IAAI,CAAC;QACnB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EACrD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAa,EAAE,mBAAmB,GAAG,KAAK;IACnE,IAAI,mBAAmB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1F,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,kEAAkE;IAClE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,0EAA0E;IAC1E,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO;aACnB,IAAI,EAAE;aACN,KAAK,CAAC,KAAK,CAAC;aACZ,GAAG,CAAC,WAAW,CAAC;aAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAElC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,KAAK,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAErC,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YAC1F,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClC,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,IAAI,IAAI;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACxD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClC,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,IAAI;wBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC1B,SAAS;gBACX,CAAC;gBACD,kDAAkD;gBAClD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;oBACpC,IAAI,IAAI;wBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxF,sEAAsE;YACtE,2CAA2C;YAC3C,MAAM,mBAAmB,GAAG,OAAO,KAAK,KAAK,CAAC;YAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,CAAC;oBACT,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAChB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,IAAyB,EACzB,KAAwB;IAExB,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/D,OAAO,CACL,qCAAqC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC3D,kBAAkB,OAAO,8DAA8D;QACvF,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,IAAyB,EACzB,KAAwB;IAExB,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,qCAAqC,GAAG,0BAA0B,CAAC;IACrF,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/D,OAAO,CACL,qCAAqC,IAAI,oBAAoB,OAAO,IAAI;QACxE,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAUD,oDAAoD;AACpD,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAA4B;IACtE,MAAM,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAA4B;IAC9E,MAAM,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/dist/core/network-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=network-guard.test.d.ts.map

package/dist/core/network-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-guard.test.d.ts","sourceRoot":"","sources":["../../src/core/network-guard.test.ts"],"names":[],"mappings":""}

package/dist/core/network-guard.test.js

@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vitest";
+import { checkCommandNetwork, checkUrlNetwork, extractCommandHosts, isHostAllowed, } from "./network-guard.js";
+describe("isHostAllowed", () => {
+    it("matches exact hosts case-insensitively", () => {
+        expect(isHostAllowed("GitHub.com", ["github.com"])).toBe(true);
+        expect(isHostAllowed("github.com", ["GITHUB.COM"])).toBe(true);
+        expect(isHostAllowed("gitlab.com", ["github.com"])).toBe(false);
+    });
+    it("matches a leading *. wildcard against subdomains only", () => {
+        expect(isHostAllowed("api.github.com", ["*.github.com"])).toBe(true);
+        expect(isHostAllowed("a.b.github.com", ["*.github.com"])).toBe(true);
+        expect(isHostAllowed("github.com", ["*.github.com"])).toBe(false);
+        expect(isHostAllowed("evilgithub.com", ["*.github.com"])).toBe(false);
+    });
+    it("rejects everything against an empty allowlist", () => {
+        expect(isHostAllowed("github.com", [])).toBe(false);
+        expect(isHostAllowed("", ["github.com"])).toBe(false);
+    });
+});
+describe("extractCommandHosts", () => {
+    it.each([
+        ["curl -sSL https://example.com/x.sh", ["example.com"]],
+        ["wget https://files.example.org/a.tar.gz -O a.tgz", ["files.example.org"]],
+        ["git clone https://github.com/owner/repo.git", ["github.com"]],
+        ["git clone git@gitlab.com:owner/repo.git", ["gitlab.com"]],
+        ["git push origin main", []],
+        ["ssh deploy@prod.example.com 'uptime'", ["prod.example.com"]],
+        ["scp file.txt deploy@prod.example.com:/tmp", ["prod.example.com"]],
+        ["npm install left-pad", ["registry.npmjs.org"]],
+        ["pnpm add -D vitest", ["registry.npmjs.org"]],
+        ["yarn add react", ["registry.yarnpkg.com"]],
+        ["pip install requests", ["pypi.org"]],
+        ["cd repo && curl https://api.example.com/v1", ["api.example.com"]],
+    ])("extracts hosts from %s", (command, expected) => {
+        expect(extractCommandHosts(command).sort()).toEqual(expected.sort());
+    });
+    it.each([
+        "ls -la",
+        "npm run build",
+        "git status",
+        "git commit -m 'curl https://example.com'",
+        "echo hello",
+        "python3 script.py",
+        "rm -rf node_modules",
+    ])("finds no host in %s (no false blocks)", (command) => {
+        expect(extractCommandHosts(command)).toEqual([]);
+    });
+});
+describe("checkCommandNetwork", () => {
+    it("is a total no-op when the mode is off", () => {
+        expect(checkCommandNetwork("curl https://evil.example", "off", [])).toBeNull();
+    });
+    it("blocks a disallowed host and names the setting", () => {
+        const error = checkCommandNetwork("curl https://evil.example/x", "allowlist", ["github.com"]);
+        expect(error).toContain("evil.example");
+        expect(error).toContain("networkAllow");
+    });
+    it("allows an allow-listed host and unrecognised commands", () => {
+        expect(checkCommandNetwork("git clone https://github.com/o/r.git", "allowlist", ["github.com"])).toBeNull();
+        expect(checkCommandNetwork("make build", "allowlist", [])).toBeNull();
+    });
+});
+describe("checkUrlNetwork", () => {
+    it("is a total no-op when the mode is off", () => {
+        expect(checkUrlNetwork("https://evil.example", "off", [])).toBeNull();
+    });
+    it("enforces the allowlist on a URL", () => {
+        expect(checkUrlNetwork("https://api.github.com/x", "allowlist", ["*.github.com"])).toBeNull();
+        expect(checkUrlNetwork("https://evil.example/x", "allowlist", ["*.github.com"])).toContain("evil.example");
+    });
+});
+//# sourceMappingURL=network-guard.test.js.map

package/dist/core/network-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-guard.test.js","sourceRoot":"","sources":["../../src/core/network-guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,IAAI,CAAqB;QAC1B,CAAC,oCAAoC,EAAE,CAAC,aAAa,CAAC,CAAC;QACvD,CAAC,kDAAkD,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC3E,CAAC,6CAA6C,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/D,CAAC,yCAAyC,EAAE,CAAC,YAAY,CAAC,CAAC;QAC3D,CAAC,sBAAsB,EAAE,EAAE,CAAC;QAC5B,CAAC,sCAAsC,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC9D,CAAC,2CAA2C,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACnE,CAAC,sBAAsB,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAChD,CAAC,oBAAoB,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAC9C,CAAC,gBAAgB,EAAE,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC,sBAAsB,EAAE,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC,4CAA4C,EAAE,CAAC,iBAAiB,CAAC,CAAC;KACpE,CAAC,CAAC,wBAAwB,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACjD,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,QAAQ;QACR,eAAe;QACf,YAAY;QACZ,0CAA0C;QAC1C,YAAY;QACZ,mBAAmB;QACnB,qBAAqB;KACtB,CAAC,CAAC,uCAAuC,EAAE,CAAC,OAAO,EAAE,EAAE;QACtD,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,mBAAmB,CAAC,2BAA2B,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,6BAA6B,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CACJ,mBAAmB,CAAC,sCAAsC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CACzF,CAAC,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,mBAAmB,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,eAAe,CAAC,sBAAsB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,eAAe,CAAC,0BAA0B,EAAE,WAAW,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9F,MAAM,CAAC,eAAe,CAAC,wBAAwB,EAAE,WAAW,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CACxF,cAAc,CACf,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/prompt-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-commands.d.ts","sourceRoot":"","sources":["../../src/core/prompt-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AA4BD,eAAO,MAAM,eAAe,EAAE,aAAa,EAihB1C,CAAC;AAEF,gDAAgD;AAChD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAExE"}
+{"version":3,"file":"prompt-commands.d.ts","sourceRoot":"","sources":["../../src/core/prompt-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AA+BD,eAAO,MAAM,eAAe,EAAE,aAAa,EAiiB1C,CAAC;AAEF,gDAAgD;AAChD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAExE"}