@open-everywhere/core 0.1.0

package/dist/agent/access/egress-status.js

@@ -0,0 +1,130 @@
+// The in-sandbox egress self-diagnosis files, derived from the COMPILED policy so they cannot drift from what is enforced. HOSTS ONLY: never a credential value, never a header name, and `compileError` is a boolean rather than the thrown message.
+import { lockCommand, unlockCommand } from "../memory/readonly.js";
+import { ruleStampsCredential } from "./egress.js";
+/** Workspace-relative dir, top-level and unhidden on purpose: the consumer is an agent running `ls`, and a dotfile is a surface nobody finds when they need it. */
+const EGRESS_DIR = "egress";
+export const EGRESS_STATUS_PATH = `${EGRESS_DIR}/STATUS.json`;
+export const EGRESS_README_PATH = `${EGRESS_DIR}/README.md`;
+/** Reduce a compiled policy to its DISCLOSABLE shape. Pure, and it reads a closed set of fields rather than mapping over the object, because it is the one function allowed to turn a credential-bearing policy into sandbox-visible bytes. */
+export function summariseEgressPolicy(policy) {
+    if (typeof policy === "string") {
+        return { defaultAction: policy === "allow-all" ? "allow" : "deny", allow: [] };
+    }
+    const allowMap = policy.allow ?? {};
+    const allow = [];
+    for (const host of Object.keys(allowMap).sort((a, b) => a.localeCompare(b))) {
+        const rules = allowMap[host] ?? [];
+        const methods = new Set();
+        const prefixes = new Set();
+        let credentialInjected = false;
+        for (const rule of rules) {
+            for (const m of rule.match?.method ?? [])
+                methods.add(m);
+            const prefix = rule.match?.path?.startsWith;
+            if (typeof prefix === "string" && prefix.length > 0)
+                prefixes.add(prefix);
+            // Boolean only: never read a header key, never a value — only whether the rule stamps anything. Through the SHARED discriminator, so the file the agent reads and the audit row the auditor reads cannot disagree about one policy.
+            if (ruleStampsCredential(rule))
+                credentialInjected = true;
+        }
+        allow.push({
+            host,
+            ...(methods.size > 0 ? { methods: [...methods].sort() } : {}),
+            ...(prefixes.size > 0 ? { pathPrefixes: [...prefixes].sort() } : {}),
+            credentialInjected,
+        });
+    }
+    return { defaultAction: "deny", allow };
+}
+/** The status file's bytes, DETERMINISTIC — no clock and no counter — so two sessions on one policy produce byte-identical files. The *when* lives in the audit row. */
+export function renderEgressStatus(input) {
+    const summary = summariseEgressPolicy(input.policy);
+    return `${JSON.stringify({
+        enforcement: input.state,
+        defaultAction: summary.defaultAction,
+        policyFingerprint: input.fingerprint,
+        compileError: input.compileError,
+        allow: summary.allow,
+        readme: `./${EGRESS_README_PATH.split("/").pop()}`,
+    }, null, 2)}\n`;
+}
+/** The self-help README: STATIC and pinned byte-for-byte by `egress-status-test.ts`, because every load-bearing sentence is a claim about how this deployment behaves. It must state BOTH tiers — a self-host proxy logs each denial as an `egress.denied` row, the Vercel sandbox host logs none. */
+export const EGRESS_README = `# Egress from this sandbox
+
+Network access out of this sandbox is **default-deny**. Only the hosts listed in
+\`STATUS.json\` are reachable; everything else fails at the firewall.
+
+Read \`STATUS.json\` first. It carries the enforcement state, every allowed host with any
+method/path narrowing on it, and \`policyFingerprint\`.
+
+## If a request was blocked
+
+**Do not retry it, and do not try to route around it.** A denial here is policy, not an
+outage: a retry, a mirror, a proxy, a different port and a different DNS name all fail the
+same way, and the only thing they cost is your turn.
+
+**Report it instead**, in your answer, naming the host you needed and what you needed it
+for. The policy that denied you is on the record — an \`egress.policy\` audit row carries the
+\`policyFingerprint\` above — but whether **the individual blocked request** is depends on the
+tier. Where the proxy is ours (self-host) each denial becomes an \`egress.denied\` row — host,
+that fingerprint, a count, nothing else — which \`permission_fit_report\` reads as widening
+evidence. On the Vercel sandbox host the deny is out of band and no row exists at all. You
+cannot tell which from in here, so report either way: yours is the only signal that always
+exists, and the only one that says what you wanted the host **for**.
+
+Widening is deliberately not something either of us can do at runtime: a reachable host is
+config-as-code, and it changes by reviewed pull request against the bundle that grants it —
+a \`domains\` entry for an uncredentialed host, or a connection's \`allowedWebsites\` for a
+credentialed one. It then lands on the session's next turn.
+
+## Three things that will save you a wrong guess
+
+**Never add an \`Authorization\` header yourself.** Where \`credentialInjected\` is true in
+\`STATUS.json\`, the firewall stamps the credential onto the request as it leaves. You do not
+hold that secret and cannot read it. A 401 from such a host means the credential is wrong or
+expired upstream, so report it; do not go looking for a key.
+
+**This route cannot use anyone's own account.** One credential per host per session, so an
+own-account ask withholds that vendor's hosts from \`STATUS.json\`. A worker never holds them.
+A seat is covered from the ask onward, and this file was written when the turn began — so for
+the rest of THAT turn the host can still be listed here, on the team key. Do not use it: the
+team key is never the answer to "act as me". A host missing for that reason is
+not a config gap: say so, and send the person to their DM with me, where a personal grant is
+minted.
+
+**\`web_fetch\` and \`web_search\` do not run in here.** They execute host-side, outside this
+sandbox. That changes WHO enforces, not WHAT is allowed: \`web_fetch\` is fenced against this
+same allow-list before it dispatches, so a host absent from \`STATUS.json\` is refused there
+too — audibly, naming the host, unlike the silent failure you get in here. \`web_search\` runs
+inside the model call and is bounded by neither. \`github.com\` is the exception: a repo grant
+lists it for \`git\`, not for \`web_fetch\`. This file is about what **you** run in here:
+\`curl\`, \`git\`, \`npm\`.
+
+## If \`enforcement\` is not "enforced"
+
+\`dry-run\` means the intended policy was computed but not applied (\`egress.enforce: false\`);
+\`unenforced\` means the backend refused it and the operator accepted that. In both cases the
+list is what the operator INTENDS you to reach. Stay inside it, and say so if you notice you
+did not have to.
+`;
+/** The `policyFingerprint` currently published in this sandbox, or `undefined` when there is none to read. TOTAL and fail-soft by contract: `undefined` means "cannot assert", never "violated" — this is a tripwire on a bug, not a control against the child. */
+export async function readPublishedEgressFingerprint(sandbox) {
+    try {
+        const raw = await sandbox.readTextFile({ path: EGRESS_STATUS_PATH });
+        if (typeof raw !== "string" || raw.length === 0)
+            return undefined;
+        const parsed = JSON.parse(raw);
+        const fp = parsed?.policyFingerprint;
+        return typeof fp === "string" && fp.length > 0 ? fp : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function publishEgressStatus(sandbox, input) {
+    await sandbox.run({ command: `${unlockCommand(EGRESS_DIR)} 2>/dev/null || true` });
+    await sandbox.writeTextFile({ path: EGRESS_STATUS_PATH, content: renderEgressStatus(input) });
+    await sandbox.writeTextFile({ path: EGRESS_README_PATH, content: EGRESS_README });
+    await sandbox.run({ command: `${lockCommand(EGRESS_DIR)} 2>/dev/null || true` });
+}
+//# sourceMappingURL=egress-status.js.map

package/dist/agent/access/egress-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-status.js","sourceRoot":"","sources":["../../../agent/access/egress-status.ts"],"names":[],"mappings":"AAAA,sPAAsP;AAGtP,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,mKAAmK;AACnK,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,UAAU,cAAc,CAAC;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,UAAU,YAAY,CAAC;AA0C5D,+OAA+O;AAC/O,MAAM,UAAU,qBAAqB,CAAC,MAA4B;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,QAAQ,GAAI,MAA4D,CAAC,KAAK,IAAI,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC;YAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1E,oOAAoO;YACpO,IAAI,oBAAoB,CAAC,IAAI,CAAC;gBAAE,kBAAkB,GAAG,IAAI,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,wKAAwK;AACxK,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,iBAAiB,EAAE,KAAK,CAAC,WAAW;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,KAAK,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;KACnD,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED,sSAAsS;AACtS,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyD5B,CAAC;AAqBF,mQAAmQ;AACnQ,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAAoC;IACvF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACrE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,EAAE,GAAI,MAAiD,EAAE,iBAAiB,CAAC;QACjF,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA4B,EAAE,KAAwB;IAC9F,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACnF,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC;AACnF,CAAC"}

package/dist/agent/access/egress.d.ts

@@ -0,0 +1,86 @@
+import type { SandboxNetworkPolicy } from "eve/sandbox";
+import type { EffectiveAccess, ReachableHost } from "./resolver.js";
+import { type Connection } from "./bundle.js";
+import { type BrowserHostDeclaration } from "./browser-hosts.js";
+import { type NetworkAccessLevel } from "./network-access.js";
+export { GIT_BROKER_HOSTS } from "./reserved-hosts.js";
+export type EgressPlane = "sandbox" | "host";
+/** What ONE row counts — see the header's unit rule. `"call"` is one outbound call; `"policy"` is
+ *  one host that one firewall apply left open. Deliberately NOT called a grain: see the header. */
+export type EgressRowUnit = "call" | "policy";
+/** On unit "call": allowed means dispatched, denied means refused by policy before the dispatch (an SSRF refusal is denied, never failed), failed means attempted and errored. On unit "policy": granted only — the firewall was set to admit this host, which must never be read as a call. */
+export type EgressOutcome = "allowed" | "denied" | "failed" | "granted";
+/** One outbound-egress evidence row, in the shape BOTH planes write. Spread it through egressAuditFields and never hand-spell it at a writer: a second copy is how one plane starts naming a field something else and the join quietly stops working. */
+export interface EgressAuditRow {
+    readonly plane: EgressPlane;
+    readonly unit: EgressRowUnit;
+    /** The destination host, lower-cased. `"*"` is a catch-all allow rule, not a hostname. */
+    readonly host: string;
+    /** The HTTP verbs this row covers: exactly one on a call, the admitted set on a policy — or
+     *  `"any"` when the rule declares no method match at all and so admits DELETE as readily as GET.
+     *  Upper-cased and sorted so two rows for the same subject compare byte-for-byte. */
+    readonly verb: readonly string[] | "any";
+    /** WHOSE credential rides, by IDENTITY — a bundle `Connection.id`, or a credential ref name.
+     *  `null` is a positive claim: nothing was attached by the plane. 🔴 Never a secret value. */
+    readonly credential: string | null;
+    readonly outcome: EgressOutcome;
+}
+/** Every field an {@link EgressAuditRow} carries. The contract test iterates THIS list against a
+ *  row from each plane, so a field added here without a writer to fill it fails loudly rather than
+ *  landing as an absence on one plane only. */
+export declare const EGRESS_AUDIT_ROW_FIELDS: readonly ["plane", "unit", "host", "verb", "credential", "outcome"];
+/** Upper-case, de-duplicate and sort a verb list, or pass `"any"` through. Shared so a call's one
+ *  verb and a policy's set are normalised by the same rule. */
+export declare function normaliseVerbs(verbs: readonly string[] | "any"): readonly string[] | "any";
+/** Render one row, ready to spread into an audit detail. Total and pure: the host is lower-cased and the verbs normalised here rather than at each writer, so two planes describing the same host cannot disagree on its spelling. */
+export declare function egressAuditFields(row: EgressAuditRow): Record<string, unknown>;
+/** The host plane's row: one call Open Everywhere dispatched itself. credential defaults to null — the oeFetch case, which sends nothing on a model-supplied URL by construction — and a seam that does attach one passes its ref NAME. */
+export declare function hostCallAuditFields(args: {
+    readonly host: string;
+    readonly verb: string;
+    readonly outcome: EgressOutcome;
+    readonly credential?: string | null;
+}): Record<string, unknown>;
+/** The sandbox plane's row: one host one firewall apply left open. outcome is fixed at "granted" and is not a parameter, because the only way this plane could report a call's fate is a per-call observation it does not have. */
+export declare function sandboxPolicyAuditFields(args: {
+    readonly host: string;
+    readonly verb: readonly string[] | "any";
+    readonly credential: string | null;
+}): Record<string, unknown>;
+export type ResolveHeaders = (connection: Connection) => Promise<Record<string, string>>;
+/** Resolve the still-granted subset of connection ids against the live connector_override store — the same break-glass overlay the credential gate consults, narrow-only. null means the store read itself failed: fail closed and deny every credentialed host rather than fall back to the config grant. Injected so this compiler stays pure and testable. */
+export type NarrowConnections = (connectionIds: readonly string[]) => Promise<readonly string[] | null>;
+export type EgressRule = {
+    match?: {
+        method?: string[];
+        path?: {
+            startsWith?: string;
+        };
+    };
+    transform: {
+        headers?: Record<string, string>;
+    }[];
+};
+/** Build the sandbox NetworkPolicy for a resolved session; returns "deny-all" when nothing is reachable, which is fail-closed. networkAccessLevel is ADDITIVE only — "none" adds nothing, "trusted" adds bare registry and developer hosts, "full" adds a catch-all — and a host the resolved access already reaches keeps its own rules. */
+export declare function compileNetworkPolicy(access: EffectiveAccess, resolveHeaders: ResolveHeaders, narrowConnections: NarrowConnections, networkAccessLevel?: NetworkAccessLevel): Promise<SandboxNetworkPolicy>;
+/** A host one compiled policy leaves open to a mutating request. credential and verb are the SHARED egress-row names, not local spellings: rename either and the cross-plane join silently stops working, and the contract test is what says so. */
+export interface OpenWriteHost {
+    /** The allow-list key. `"*"` is the `networkAccessLevel: "full"` catch-all. */
+    readonly host: string;
+    /** The egress Connection.id whose credential this policy stamps on requests to this host, or null when no bundle connection names the stamp — an uncredentialed host, or a stamp from outside the bundle such as the broker's installation token. It is the credential's IDENTITY and never its value; read it WITH credentialed. */
+    readonly credential: string | null;
+    /** Whether this policy stamps ANY credential on this host, read off the compiled rules' own transform and never off the config. false is a positive claim, so an unrecognised transform shape errs toward "a credential rides" rather than toward that claim. */
+    readonly credentialed: boolean;
+    /** The methods the rules admit, upper-cased and de-duplicated — or `"any"` when at least one
+     *  rule for the host declares no method match, which admits DELETE as readily as GET. */
+    readonly verb: readonly string[] | "any";
+}
+/** THE one discriminator for "does the firewall stamp a credential here" — the audit row and the sandbox STATUS.json both call it, and nothing else may spell the test again, or a policy could make one say a credential rides while the other says nothing does. It reads the transform ENTRY rather than its headers, so an unrecognised shape resolves toward "a credential rides"; it returns a boolean, and no key and no value leaves it. */
+export declare function ruleStampsCredential(rule: {
+    readonly transform?: readonly unknown[];
+}): boolean;
+/** The writeHosts trio, ready to spread into an egress.policy detail, shared rather than spelled at each of the three writers an auditor joins on these names. writeHostCount rides EVERY row, 0 included, and each listed entry carries unit "policy", which tells a reader joining the planes that it is a reach the firewall granted and not a call anybody observed. */
+export declare function writeHostsAuditFields(writeHosts: readonly OpenWriteHost[]): Record<string, unknown>;
+/** Pure and total, sorted by host so two rows for one policy generation compare byte-for-byte; every unrecognised policy shape resolves toward MORE open, because an empty result reads as "this policy opened nothing mutating". A host is attributed only where its compiled rules really carry a transform, and a CALLER that replaced a host's rules must drop that host from reachableHosts, or the row names a bundle connection whose secret is not the one riding. */
+export declare function openWriteHosts(policy: SandboxNetworkPolicy, reachableHosts?: readonly ReachableHost[], browserHosts?: readonly BrowserHostDeclaration[]): readonly OpenWriteHost[];
+//# sourceMappingURL=egress.d.ts.map

package/dist/agent/access/egress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.d.ts","sourceRoot":"","sources":["../../../agent/access/egress.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAEvF,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAErF,OAAO,EAAsD,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGlH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAMvD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AAE7C;mGACmG;AACnG,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9C,gSAAgS;AAChS,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExE,yPAAyP;AACzP,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;yFAEqF;IACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IACzC;kGAC8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAED;;+CAE+C;AAC/C,eAAO,MAAM,uBAAuB,YAAI,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAU,CAAC;AAE3G;+DAC+D;AAC/D,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,GAAG,SAAS,MAAM,EAAE,GAAG,KAAK,CAG1F;AAED,sOAAsO;AACtO,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS9E;AAED,2OAA2O;AAC3O,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS1B;AAED,mOAAmO;AACnO,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS1B;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzF,iWAAiW;AACjW,MAAM,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;AAGxG,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC9D,SAAS,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,EAAE,CAAC;CACnD,CAAC;AAmEF,6UAA6U;AAC7U,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,eAAe,EACvB,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,iBAAiB,EACpC,kBAAkB,GAAE,kBAAiD,GACpE,OAAO,CAAC,oBAAoB,CAAC,CA6C/B;AAQD,oPAAoP;AACpP,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qUAAqU;IACrU,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iQAAiQ;IACjQ,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;6FACyF;IACzF,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;CAC1C;AAED,obAAob;AACpb,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GAAG,OAAO,CAE/F;AAMD,4WAA4W;AAC5W,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUnG;AAED,8cAA8c;AAC9c,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,cAAc,GAAE,SAAS,aAAa,EAAO,EAC7C,YAAY,GAAE,SAAS,sBAAsB,EAAO,GACnD,SAAS,aAAa,EAAE,CA6C1B"}

package/dist/agent/access/egress.js

@@ -0,0 +1,236 @@
+// Compiles resolved access into a Vercel sandbox NetworkPolicy: a credentialed host becomes an allow rule whose transform injects the auth header AT THE FIREWALL, so the secret never enters the sandbox process, and a host with no key is denied implicitly. Fine-grained policies are honoured only by the Vercel sandbox backend — Docker honours coarse allow-all/deny-all and just-bash rejects setNetworkPolicy — so this compiles everywhere and enforces only there.
+import { EgressHostCollisionError } from "./resolver.js";
+import { egressHostsOverlap, normaliseEgressHost } from "./bundle.js";
+import { extraEgressHosts } from "./extra-hosts.js";
+import { browserEgressHosts } from "./browser-hosts.js";
+import { GIT_BROKER_HOSTS } from "./reserved-hosts.js";
+import { DEFAULT_NETWORK_ACCESS_LEVEL, TRUSTED_ACCESS_HOSTS } from "./network-access.js";
+// The git read-broker's reserved hosts live in access/reserved-hosts.ts, which imports nothing, because browser-hosts.ts is a fourth reader and could not import them back from here without a cycle. Re-exported so every existing caller keeps one import path.
+export { GIT_BROKER_HOSTS } from "./reserved-hosts.js";
+/** Every field an {@link EgressAuditRow} carries. The contract test iterates THIS list against a
+ *  row from each plane, so a field added here without a writer to fill it fails loudly rather than
+ *  landing as an absence on one plane only. */
+export const EGRESS_AUDIT_ROW_FIELDS = ["plane", "unit", "host", "verb", "credential", "outcome"];
+/** Upper-case, de-duplicate and sort a verb list, or pass `"any"` through. Shared so a call's one
+ *  verb and a policy's set are normalised by the same rule. */
+export function normaliseVerbs(verbs) {
+    if (verbs === "any")
+        return "any";
+    return [...new Set(verbs.map((v) => v.toUpperCase()))].sort();
+}
+/** Render one row, ready to spread into an audit detail. Total and pure: the host is lower-cased and the verbs normalised here rather than at each writer, so two planes describing the same host cannot disagree on its spelling. */
+export function egressAuditFields(row) {
+    return {
+        plane: row.plane,
+        unit: row.unit,
+        host: row.host.toLowerCase(),
+        verb: normaliseVerbs(row.verb),
+        credential: row.credential,
+        outcome: row.outcome,
+    };
+}
+/** The host plane's row: one call Open Everywhere dispatched itself. credential defaults to null — the oeFetch case, which sends nothing on a model-supplied URL by construction — and a seam that does attach one passes its ref NAME. */
+export function hostCallAuditFields(args) {
+    return egressAuditFields({
+        plane: "host",
+        unit: "call",
+        host: args.host,
+        verb: [args.verb],
+        credential: args.credential ?? null,
+        outcome: args.outcome,
+    });
+}
+/** The sandbox plane's row: one host one firewall apply left open. outcome is fixed at "granted" and is not a parameter, because the only way this plane could report a call's fate is a per-call observation it does not have. */
+export function sandboxPolicyAuditFields(args) {
+    return egressAuditFields({
+        plane: "sandbox",
+        unit: "policy",
+        host: args.host,
+        verb: args.verb,
+        credential: args.credential,
+        outcome: "granted",
+    });
+}
+function ruleForHost(host, headers) {
+    if (host.viaConnection === null)
+        return [];
+    const method = host.methods && host.methods.length > 0 ? [...host.methods] : undefined;
+    const transform = headers && Object.keys(headers).length > 0 ? [{ headers }] : [];
+    // Emit ONE allow rule per prefix — the rules array is an OR. Narrowing only when exactly one prefix was declared produced NO path restriction for two, which is fail-OPEN; every rule still carries the method match and the credential transform.
+    const prefixes = host.pathPrefixes ?? [];
+    if (prefixes.length > 0) {
+        return prefixes.map((prefix) => {
+            const rule = { match: { path: { startsWith: prefix } }, transform };
+            if (method)
+                rule.match.method = method;
+            return rule;
+        });
+    }
+    const rule = { transform };
+    if (method)
+        rule.match = { method };
+    return [rule];
+}
+// A declared browser host compiles to a host+METHOD row the firewall enforces, so there is no verb the row omits that the browser can still reach, and a row naming a credential this session does not carry is DROPPED entirely rather than opened bare. The secret lives in transform and nowhere else, and this does NOT scope it to the browser: the stamped host is equally reachable from bash in that session, bounded only by the declared methods.
+/** The allow-map entries the declared browser hosts contribute, keyed by host. byId, grantedIds and resolveHeaders are passed in rather than re-derived, because a second lookup path is how a break-glass revoke stops reaching one of two callers; a null grantedIds denies every credentialed host here exactly as it does for a bundle host. */
+async function browserHostRules(byId, grantedIds, resolveHeaders) {
+    const armed = browserEgressHosts();
+    // A reserved broker host is REFUSED here, not merged: the broker replaces those hosts' rules wholesale mid-turn, so a declared row on github.com would lose both its verb narrowing and the credential the operator named. The throw is the same error family hooks/egress.ts turns into a deny-all apply, and the check overlaps and normalises rather than using a bare includes, because it is a backstop for a declaration the config lint never saw.
+    const collisions = [];
+    for (const row of armed) {
+        const claimed = normaliseEgressHost(row.host);
+        for (const host of GIT_BROKER_HOSTS) {
+            if (!egressHostsOverlap(claimed, host))
+                continue;
+            const where = claimed === host ? host : `${claimed} overlaps ${host}`;
+            collisions.push(`${where} (declared browser host, and the git read-broker, which replaces that host's rules mid-turn)`);
+        }
+    }
+    if (collisions.length > 0)
+        throw new EgressHostCollisionError(collisions);
+    const out = {};
+    for (const row of armed) {
+        const method = [...row.methods];
+        if (row.credential === undefined) {
+            out[row.host] = [{ match: { method }, transform: [] }];
+            continue;
+        }
+        if (grantedIds === null || !grantedIds.has(row.credential))
+            continue; // revoked / unreadable store
+        const conn = byId.get(row.credential);
+        if (conn === undefined)
+            continue; // this session's access does not carry the named connection
+        const headers = await resolveHeaders(conn);
+        // An empty header map means the broker resolved nothing. That is the same unhonourable request as
+        // a missing connection — omit rather than open the host with no credential on it.
+        if (Object.keys(headers).length === 0)
+            continue;
+        out[row.host] = [{ match: { method }, transform: [{ headers }] }];
+    }
+    return out;
+}
+/** Build the sandbox NetworkPolicy for a resolved session; returns "deny-all" when nothing is reachable, which is fail-closed. networkAccessLevel is ADDITIVE only — "none" adds nothing, "trusted" adds bare registry and developer hosts, "full" adds a catch-all — and a host the resolved access already reaches keeps its own rules. */
+export async function compileNetworkPolicy(access, resolveHeaders, narrowConnections, networkAccessLevel = DEFAULT_NETWORK_ACCESS_LEVEL) {
+    const byId = new Map(access.connections.map((c) => [c.id, c]));
+    const allow = {};
+    // The live revoke_connector override is consulted HERE too, keyed by connection id and narrow-only: applied only at the credential gate, a revoked host kept its injected credential in this allow-list until a deploy removed the bundle grant. The store read is skipped when nothing credentialed needs narrowing, which keeps a domain-only bundle's per-turn recompile a pure function.
+    const connectionIds = [...byId.keys()];
+    const granted = connectionIds.length > 0 ? await narrowConnections(connectionIds) : [];
+    // `null` = the override-store read itself failed: fail closed like the credential wall, denying
+    // EVERY credentialed host rather than trusting the config grant — an unreadable store must never
+    // be read as "nothing was revoked".
+    const grantedIds = granted === null ? null : new Set(granted);
+    for (const host of access.reachableHosts) {
+        if (host.viaConnection !== null && (grantedIds === null || !grantedIds.has(host.viaConnection))) {
+            continue; // narrowed by a break-glass revoke, or the override store couldn't be read
+        }
+        let headers = null;
+        if (host.viaConnection) {
+            const conn = byId.get(host.viaConnection);
+            headers = conn ? await resolveHeaders(conn) : null;
+        }
+        allow[host.host] = ruleForHost(host, headers);
+    }
+    // The declared browser hosts are merged under the SAME composition rule as everything else here: a host the bundle already reaches keeps its bundle rules.
+    for (const [host, rules] of Object.entries(await browserHostRules(byId, grantedIds, resolveHeaders))) {
+        if (!(host in allow))
+            allow[host] = rules;
+    }
+    // Capability-registered hosts merge as bare credential-less allows, and a host the bundle already reaches keeps its rules; living here means every recompile carries them. It runs AFTER the browser section and the order is load-bearing: a browser host that section narrowed, or fail-closed omitted, must not be re-opened here as a bare all-verbs allow.
+    for (const host of extraEgressHosts()) {
+        if (!(host in allow))
+            allow[host] = [];
+    }
+    // A granted repo implies the git host must be reachable, as a BARE allow: the read credential is brokered separately at SCM-call time, by a recompile that replaces this entry with owner-scoped rules. The bare entry stands as-is only where the firewall cannot be enforced at all.
+    if (access.repos.length > 0 && !allow["github.com"])
+        allow["github.com"] = [];
+    if (networkAccessLevel === "trusted") {
+        for (const host of TRUSTED_ACCESS_HOSTS)
+            if (!(host in allow))
+                allow[host] = [];
+    }
+    else if (networkAccessLevel === "full") {
+        if (!("*" in allow))
+            allow["*"] = [];
+    }
+    if (Object.keys(allow).length === 0)
+        return "deny-all"; // fail-closed: nothing reachable
+    return { allow };
+}
+// The join an auditor needs: the hosts a policy leaves open to a MUTATING verb, each beside the connection id that opened it. Deliberately narrow, because listing every read-only allow would bury the two that matter. No byte of transform may reach a row — it is read for PRESENCE alone — and the input is the COMPILED policy, so a revoked host is absent and a registry or access-level top-up is present.
+/** The HTTP verbs that read. Anything else — and any rule that declares no method match at all —
+ *  can mutate the far side, so it is what {@link openWriteHosts} reports. */
+const READ_ONLY_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/** THE one discriminator for "does the firewall stamp a credential here" — the audit row and the sandbox STATUS.json both call it, and nothing else may spell the test again, or a policy could make one say a credential rides while the other says nothing does. It reads the transform ENTRY rather than its headers, so an unrecognised shape resolves toward "a credential rides"; it returns a boolean, and no key and no value leaves it. */
+export function ruleStampsCredential(rule) {
+    return (rule.transform ?? []).length > 0;
+}
+/** Cap on the `writeHosts` names ONE audit row lists. The `writeHostCount` beside it stays exact,
+ *  so a truncated list never tells a reader a smaller number. */
+const WRITE_HOSTS_ROW_CAP = 20;
+/** The writeHosts trio, ready to spread into an egress.policy detail, shared rather than spelled at each of the three writers an auditor joins on these names. writeHostCount rides EVERY row, 0 included, and each listed entry carries unit "policy", which tells a reader joining the planes that it is a reach the firewall granted and not a call anybody observed. */
+export function writeHostsAuditFields(writeHosts) {
+    const listed = writeHosts.slice(0, WRITE_HOSTS_ROW_CAP).map((h) => ({
+        ...sandboxPolicyAuditFields({ host: h.host, verb: h.verb, credential: h.credential }),
+        credentialed: h.credentialed,
+    }));
+    return {
+        writeHostCount: writeHosts.length,
+        ...(listed.length > 0 ? { writeHosts: listed } : {}),
+        ...(writeHosts.length > WRITE_HOSTS_ROW_CAP ? { writeHostsTruncated: true } : {}),
+    };
+}
+/** Pure and total, sorted by host so two rows for one policy generation compare byte-for-byte; every unrecognised policy shape resolves toward MORE open, because an empty result reads as "this policy opened nothing mutating". A host is attributed only where its compiled rules really carry a transform, and a CALLER that replaced a host's rules must drop that host from reachableHosts, or the row names a bundle connection whose secret is not the one riding. */
+export function openWriteHosts(policy, reachableHosts = [], browserHosts = []) {
+    if (typeof policy === "string") {
+        // `"allow-all"` carries no rules, so it stamps nothing — it is reach without a credential.
+        return policy === "allow-all" ? [{ host: "*", credential: null, credentialed: false, verb: "any" }] : [];
+    }
+    const allow = policy.allow;
+    if (!allow)
+        return [];
+    // A declared browser host's credential is named by its own declaration, not by reachableHosts, which never mentions it. Layered UNDER the bundle entries on purpose: where both name one host the bundle's rules are the ones that compiled, so the bundle's connection id is the one that rides.
+    const viaByHost = new Map(browserHosts.map((h) => [h.host, h.credential ?? null]));
+    for (const h of reachableHosts)
+        viaByHost.set(h.host, h.viaConnection);
+    const byHost = (a, b) => (a.host < b.host ? -1 : a.host > b.host ? 1 : 0);
+    if (Array.isArray(allow)) {
+        // A bare host array declares no rules at all, so it stamps no credential on any of its hosts —
+        // whatever the config wished for them.
+        return allow.map((host) => ({ host, credential: null, credentialed: false, verb: "any" })).sort(byHost);
+    }
+    const out = [];
+    for (const [host, rules] of Object.entries(allow)) {
+        let unrestricted = false;
+        let credentialed = false;
+        const methods = new Set();
+        for (const rule of rules ?? []) {
+            if (ruleStampsCredential(rule))
+                credentialed = true;
+            const declared = rule.match?.method;
+            // A rule with no method match admits every verb — the un-narrowed shape access/lint.ts's
+            // `methods` floor exists to make an operator declare away.
+            if (!declared || declared.length === 0) {
+                unrestricted = true;
+                continue;
+            }
+            for (const m of declared)
+                methods.add(m.toUpperCase());
+        }
+        // An EMPTY rules array is the bare allow `ruleForHost` emits for a credential-less host: no
+        // match, so no narrowing, so every verb.
+        if ((rules ?? []).length === 0)
+            unrestricted = true;
+        const writes = unrestricted || [...methods].some((m) => !READ_ONLY_METHODS.has(m));
+        if (!writes)
+            continue;
+        out.push({
+            host,
+            credential: credentialed ? (viaByHost.get(host) ?? null) : null,
+            credentialed,
+            verb: unrestricted ? "any" : [...methods].sort(),
+        });
+    }
+    return out.sort(byHost);
+}
+//# sourceMappingURL=egress.js.map

package/dist/agent/access/egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../../agent/access/egress.ts"],"names":[],"mappings":"AAAA,+cAA+c;AAI/c,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAmB,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAA+B,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAA2B,MAAM,qBAAqB,CAAC;AAElH,kQAAkQ;AAClQ,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA+BvD;;+CAE+C;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAU,CAAC;AAE3G;+DAC+D;AAC/D,MAAM,UAAU,cAAc,CAAC,KAAgC;IAC7D,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAChE,CAAC;AAED,sOAAsO;AACtO,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,2OAA2O;AAC3O,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,OAAO,iBAAiB,CAAC;QACvB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC;AAED,mOAAmO;AACnO,MAAM,UAAU,wBAAwB,CAAC,IAIxC;IACC,OAAO,iBAAiB,CAAC;QACvB,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,SAAS;KACnB,CAAC,CAAC;AACL,CAAC;AAaD,SAAS,WAAW,CAClB,IAAmB,EACnB,OAAsC;IAEtC,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElF,mPAAmP;IACnP,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAe,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;YAChF,IAAI,MAAM;gBAAE,IAAI,CAAC,KAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAe,EAAE,SAAS,EAAE,CAAC;IACvC,IAAI,MAAM;QAAE,IAAI,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC;IACpC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,4bAA4b;AAE5b,oVAAoV;AACpV,KAAK,UAAU,gBAAgB,CAC7B,IAAqC,EACrC,UAAsC,EACtC,cAA8B;IAE9B,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IAEnC,0bAA0b;IAC1b,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAS;YACjD,MAAM,KAAK,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,IAAI,EAAE,CAAC;YACtE,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,8FAA8F,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAE1E,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,6BAA6B;QACnG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS,CAAC,4DAA4D;QAC9F,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3C,kGAAkG;QAClG,kFAAkF;QAClF,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6UAA6U;AAC7U,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAuB,EACvB,cAA8B,EAC9B,iBAAoC,EACpC,kBAAkB,GAAuB,4BAA4B;IAErE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAiC,EAAE,CAAC;IAE/C,6XAA6X;IAC7X,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,gGAAgG;IAChG,iGAAiG;IACjG,oCAAoC;IACpC,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAE9D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAChG,SAAS,CAAC,2EAA2E;QACvF,CAAC;QACD,IAAI,OAAO,GAAkC,IAAI,CAAC;QAClD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1C,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,2JAA2J;IAC3J,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACrG,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IAED,gWAAgW;IAChW,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,uRAAuR;IACvR,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;IAE9E,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB;YAAE,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAClF,CAAC;SAAM,IAAI,kBAAkB,KAAK,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,CAAC,iCAAiC;IACzF,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,oZAAoZ;AAEpZ;6EAC6E;AAC7E,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAenF,obAAob;AACpb,MAAM,UAAU,oBAAoB,CAAC,IAAiD;IACpF,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;iEACiE;AACjE,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,4WAA4W;AAC5W,MAAM,UAAU,qBAAqB,CAAC,UAAoC;IACxE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,GAAG,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACrF,YAAY,EAAE,CAAC,CAAC,YAAY;KAC7B,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,cAAc,EAAE,UAAU,CAAC,MAAM;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,8cAA8c;AAC9c,MAAM,UAAU,cAAc,CAC5B,MAA4B,EAC5B,cAAc,GAA6B,EAAE,EAC7C,YAAY,GAAsC,EAAE;IAEpD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,2FAA2F;QAC3F,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3G,CAAC;IACD,MAAM,KAAK,GAAI,MAAuE,CAAC,KAAK,CAAC;IAC7F,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,kSAAkS;IAClS,MAAM,SAAS,GAAG,IAAI,GAAG,CAAwB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1G,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,CAAmB,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,+FAA+F;QAC/F,uCAAuC;QACvC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,oBAAoB,CAAC,IAAI,CAAC;gBAAE,YAAY,GAAG,IAAI,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACpC,yFAAyF;YACzF,2DAA2D;YAC3D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,YAAY,GAAG,IAAI,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,4FAA4F;QAC5F,yCAAyC;QACzC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,YAAY,GAAG,IAAI,CAAC;QACpD,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/D,YAAY;YACZ,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC"}

package/dist/agent/access/enforcement.d.ts

@@ -0,0 +1,8 @@
+/** Stamp whether THIS session's egress policy is actually being enforced. Fail-soft. */
+export declare function stampEnforcement(enforced: boolean): void;
+/**
+ * Is this session's firewall enforced? Fail-closed: outside a session (unit tests,
+ * CLI) or before the hook has stamped anything, reads as enforced.
+ */
+export declare function isEnforced(): boolean;
+//# sourceMappingURL=enforcement.d.ts.map

package/dist/agent/access/enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../../../agent/access/enforcement.ts"],"names":[],"mappings":"AAMA,wFAAwF;AACxF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAKxD;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAMpC"}

package/dist/agent/access/enforcement.js

@@ -0,0 +1,24 @@
+// Carries whether THIS session's egress firewall is genuinely enforced, stamped once by hooks/egress.ts so an SCM tool can pick a posture without re-running the resolve. Not enforced means the sandbox is not actually firewalled, so the read token falls back into the sandbox. FAIL CLOSED on the read side.
+import { defineState } from "eve/context";
+const slot = defineState("open-everywhere.egress-enforced", () => true);
+/** Stamp whether THIS session's egress policy is actually being enforced. Fail-soft. */
+export function stampEnforcement(enforced) {
+    try {
+        slot.update(() => enforced);
+    }
+    catch {
+    }
+}
+/**
+ * Is this session's firewall enforced? Fail-closed: outside a session (unit tests,
+ * CLI) or before the hook has stamped anything, reads as enforced.
+ */
+export function isEnforced() {
+    try {
+        return slot.get();
+    }
+    catch {
+        return true;
+    }
+}
+//# sourceMappingURL=enforcement.js.map

package/dist/agent/access/enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../../../agent/access/enforcement.ts"],"names":[],"mappings":"AAAA,kTAAkT;AAElT,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,IAAI,GAAG,WAAW,CAAU,iCAAiC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAEjF,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;IACT,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/agent/access/eve-patch-probe-boot.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=eve-patch-probe-boot.d.ts.map

package/dist/agent/access/eve-patch-probe-boot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-patch-probe-boot.d.ts","sourceRoot":"","sources":["../../../agent/access/eve-patch-probe-boot.ts"],"names":[],"mappings":""}