@sweny-ai/core 0.1.150 → 0.1.151

package/dist/cli/main.js

@@ -1313,11 +1313,12 @@ workflowCmd
 program
     .command("tool-bridge", { hidden: true })
     .description("Internal: stdio MCP shim for sweny skill tools")
-    .requiredOption("--socket <path>", "Per-run bridge socket")
+    .option("--socket <path>", "Per-run bridge socket")
+    .option("--connect <host:port>", "Per-run bridge TCP endpoint (inside the process sandbox, via its proxy)")
     .option("--token <token>", "Per-run token (default: SWENY_TOOL_BRIDGE_TOKEN)")
     .action(async (options) => {
     const { runToolBridgeShim } = await import("../harness/tool-bridge/shim.js");
-    await runToolBridgeShim({ socket: options.socket, token: options.token, version });
+    await runToolBridgeShim({ socket: options.socket, connect: options.connect, token: options.token, version });
 });
 // ── sweny upgrade / update ────────────────────────────────────────────
 // Self-update the globally-installed @sweny-ai/core. Mirrors the UX of

package/dist/harness/pi.js

@@ -771,15 +771,24 @@ export class PiHarness {
                     tools: req.tools,
                     context: this.defaultContext,
                     logger: this.logger,
+                    // Wrapped, the shim cannot open the unix socket (srt blocks AF_UNIX on
+                    // Linux); it tunnels to a loopback port through the sandbox proxy (#439).
+                    tcp: wrapper !== undefined,
                     ...(this.toolBridgeShim ? { shimCommand: this.toolBridgeShim } : {}),
                 });
                 const shim = bridge.mcpServer;
                 // The token reaches the shim by reference (`${VAR}`), never in a file or argv.
                 env[TOKEN_ENV] = bridge.token;
+                const ref = (name) => "${" + name + "}";
                 entries[PI_BRIDGE_SERVER] = {
                     command: shim.command,
                     args: shim.args ?? [],
-                    env: { SWENY_NO_UPDATE_CHECK: "1", [TOKEN_ENV]: "${" + TOKEN_ENV + "}" },
+                    env: {
+                        SWENY_NO_UPDATE_CHECK: "1",
+                        [TOKEN_ENV]: ref(TOKEN_ENV),
+                        // The proxy srt sets for pi, which pi's MCP client does not pass on by itself.
+                        ...(bridge.tcp ? { HTTP_PROXY: ref("HTTP_PROXY"), http_proxy: ref("http_proxy") } : {}),
+                    },
                     exposure: "direct",
                     timeout: 600,
                 };
@@ -802,8 +811,10 @@ export class PiHarness {
                 toolArgs.push("--exclude-tools", [...excluded].join(","));
             }
             const args = [...this.baseArgs(model, Object.keys(entries).length > 0), ...toolArgs];
-            const harnessEgress = piBackendHosts(process.env, model);
-            if (mode !== "off" && harnessEgress.length === 0 && !this.egressWarned) {
+            const backendHosts = piBackendHosts(process.env, model);
+            // The bridge's loopback endpoint (wrapped runs only): the one extra host the shim needs.
+            const harnessEgress = [...backendHosts, ...(bridge?.egress ?? [])];
+            if (mode !== "off" && backendHosts.length === 0 && !this.egressWarned) {
                 this.egressWarned = true;
                 this.logger.warn("pi runs inside the sandbox wrapper with no known model API host; add it with SWENY_SANDBOX_ALLOWED_DOMAINS.");
             }

package/dist/harness/tool-bridge/server.d.ts

@@ -9,6 +9,11 @@
  * Security properties (this is an injection boundary):
  * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
  *   chmod 0600, so other users cannot connect.
+ * - With `tcp` (only for agents inside the process sandbox wrapper, #439) the
+ *   same handler also listens on 127.0.0.1:<random port>. Other local users
+ *   can open that port, so there the token is the only gate; the sandboxed
+ *   agent reaches it through srt's proxy only because the adapter allowlists
+ *   exactly that host:port for the run.
  * - A random 256-bit token is required on every frame. A wrong or missing
  *   token gets an `unauthorized` error and the connection is dropped.
  * - Only the tools passed in are listed or callable. The executor has already
@@ -37,12 +42,27 @@ export interface ToolBridgeOptions {
     };
     /** Parent directory for the private socket dir. Default: `os.tmpdir()`. */
     tmpDir?: string;
+    /**
+     * Also serve on a loopback TCP port, and point the shim there (#439). For an
+     * agent inside the process sandbox wrapper: srt blocks `socket(AF_UNIX)` on
+     * Linux, so the shim cannot reach the unix socket, but it can reach an
+     * allowlisted host through srt's egress proxy. The adapter adds
+     * {@link ToolBridge.egress} to the node's egress; nothing else is opened.
+     */
+    tcp?: boolean;
 }
 export interface ToolBridge {
     /** Absolute path of the unix socket. */
     readonly socketPath: string;
     /** Per-run token. Never log it. */
     readonly token: string;
+    /** Loopback TCP endpoint, when started with `tcp: true`. */
+    readonly tcp?: {
+        host: string;
+        port: number;
+    };
+    /** Hosts a sandboxed shim must reach (`127.0.0.1:<port>` with `tcp`, else none). */
+    readonly egress: string[];
     /** stdio MCP server config a harness uses to start the shim. The token rides in `env`, not argv. */
     readonly mcpServer: McpServerConfig;
     /** Stop serving, drop connections, remove the socket and its directory. Idempotent. */

package/dist/harness/tool-bridge/server.js

@@ -9,6 +9,11 @@
  * Security properties (this is an injection boundary):
  * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
  *   chmod 0600, so other users cannot connect.
+ * - With `tcp` (only for agents inside the process sandbox wrapper, #439) the
+ *   same handler also listens on 127.0.0.1:<random port>. Other local users
+ *   can open that port, so there the token is the only gate; the sandboxed
+ *   agent reaches it through srt's proxy only because the adapter allowlists
+ *   exactly that host:port for the run.
  * - A random 256-bit token is required on every frame. A wrong or missing
  *   token gets an `unauthorized` error and the connection is dropped.
  * - Only the tools passed in are listed or callable. The executor has already
@@ -98,7 +103,7 @@ export async function startToolBridge(opts) {
     liveDirs.add(dir);
     installCrashHooks();
     const sockets = new Set();
-    const server = net.createServer((sock) => {
+    const onConnection = (sock) => {
         sockets.add(sock);
         sock.on("close", () => sockets.delete(sock));
         sock.on("error", () => sock.destroy());
@@ -143,19 +148,29 @@ export async function startToolBridge(opts) {
             sock.destroy();
         });
         sock.on("data", read);
+    };
+    const server = net.createServer(onConnection);
+    // Same handler and token check; only started for sandboxed agents.
+    const tcpServer = opts.tcp ? net.createServer(onConnection) : undefined;
+    const listen = (s, options) => new Promise((resolve, reject) => {
+        s.once("error", reject);
+        s.listen(options, () => {
+            s.removeListener("error", reject);
+            resolve();
+        });
     });
+    let tcp;
     try {
-        await new Promise((resolve, reject) => {
-            server.once("error", reject);
-            server.listen(socketPath, () => {
-                server.removeListener("error", reject);
-                resolve();
-            });
-        });
+        await listen(server, { path: socketPath });
         fs.chmodSync(socketPath, 0o600);
+        if (tcpServer) {
+            await listen(tcpServer, { port: 0, host: "127.0.0.1" });
+            tcp = { host: "127.0.0.1", port: tcpServer.address().port };
+        }
     }
     catch (err) {
         server.close();
+        tcpServer?.close();
         liveDirs.delete(dir);
         removeDirSync(dir);
         uninstallCrashHooksIfIdle();
@@ -167,10 +182,12 @@ export async function startToolBridge(opts) {
     return {
         socketPath,
         token,
+        tcp,
+        egress: tcp ? [`${tcp.host}:${tcp.port}`] : [],
         mcpServer: {
             type: "stdio",
             command: shim.command,
-            args: [...shim.args, "--socket", socketPath],
+            args: [...shim.args, ...(tcp ? ["--connect", `${tcp.host}:${tcp.port}`] : ["--socket", socketPath])],
             // No update-check nudge in the shim: its stdio belongs to MCP.
             env: { [TOKEN_ENV]: token, SWENY_NO_UPDATE_CHECK: "1" },
         },
@@ -180,7 +197,7 @@ export async function startToolBridge(opts) {
             closed = true;
             for (const s of sockets)
                 s.destroy();
-            await new Promise((resolve) => server.close(() => resolve()));
+            await Promise.all([server, tcpServer].map((s) => (s ? new Promise((resolve) => s.close(() => resolve())) : undefined)));
             liveDirs.delete(dir);
             removeDirSync(dir);
             uninstallCrashHooksIfIdle();

package/dist/harness/tool-bridge/shim.d.ts

@@ -1,5 +1,7 @@
 /**
- * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`, or
+ * `--connect 127.0.0.1:<port>` inside the process sandbox (#439), where it
+ * tunnels through the sandbox's HTTP proxy.
  *
  * A stdio MCP server a harness starts as a child process. It holds no tools
  * of its own: `tools/list` and `tools/call` are forwarded over the per-run
@@ -9,17 +11,49 @@
  * `--token` or, by default, the `SWENY_TOOL_BRIDGE_TOKEN` env var the server
  * puts in the MCP server config, so it never shows up in `ps` output.
  */
+import * as net from "node:net";
 import { type BridgeMethod, type BridgeResponse } from "./protocol.js";
+/** Where the bridge listens: the per-run unix socket, or its loopback TCP port (#439). */
+export type BridgeEndpoint = {
+    socketPath: string;
+} | {
+    host: string;
+    port: number;
+};
+/** Parse `--connect host:port` (IPv4 literal or `localhost`, or `[v6]:port`). */
+export declare function parseConnectTarget(value: string): {
+    host: string;
+    port: number;
+} | undefined;
+/**
+ * The HTTP proxy a sandboxed shim must tunnel through, from its env. srt sets
+ * HTTP_PROXY / HTTPS_PROXY (with its per-run credentials) for everything it
+ * wraps; inside the sandbox nothing else reaches the host. NO_PROXY is
+ * ignored on purpose: srt lists 127.0.0.1 there, but inside the sandbox's own
+ * network namespace 127.0.0.1 is not the host.
+ */
+export declare function bridgeProxyFromEnv(env: NodeJS.ProcessEnv): URL | undefined;
+/**
+ * Open a byte stream to the bridge. A TCP endpoint goes through an HTTP
+ * CONNECT tunnel when the env names a proxy (the sandboxed case), else
+ * straight to the port. `leftover` holds any bytes read past the proxy's
+ * response header.
+ */
+export declare function openBridgeStream(endpoint: BridgeEndpoint, env?: NodeJS.ProcessEnv): Promise<{
+    sock: net.Socket;
+    leftover: Buffer;
+}>;
 /** Socket client that multiplexes requests by id over one connection. */
 export declare class BridgeClient {
-    private readonly socketPath;
     private readonly token;
+    private readonly env;
     private sock;
     private connecting;
     private nextId;
     private pending;
     private closedError;
-    constructor(socketPath: string, token: string);
+    private readonly endpoint;
+    constructor(endpoint: string | BridgeEndpoint, token: string, env?: NodeJS.ProcessEnv);
     private connect;
     private failAll;
     request(method: BridgeMethod, params?: {
@@ -29,7 +63,10 @@ export declare class BridgeClient {
     close(): void;
 }
 export interface ShimOptions {
-    socket: string;
+    /** The per-run unix socket. */
+    socket?: string;
+    /** Or the bridge's loopback TCP endpoint, `host:port` (sandboxed agents, #439). */
+    connect?: string;
     /** Falls back to `SWENY_TOOL_BRIDGE_TOKEN`. */
     token?: string;
     version?: string;

package/dist/harness/tool-bridge/shim.js

@@ -1,5 +1,7 @@
 /**
- * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`, or
+ * `--connect 127.0.0.1:<port>` inside the process sandbox (#439), where it
+ * tunnels through the sandbox's HTTP proxy.
  *
  * A stdio MCP server a harness starts as a child process. It holds no tools
  * of its own: `tools/list` and `tools/call` are forwarded over the per-run
@@ -14,18 +16,116 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { BRIDGE_PROTOCOL_VERSION, TOKEN_ENV, createFrameReader, encodeFrame, } from "./protocol.js";
+/** Parse `--connect host:port` (IPv4 literal or `localhost`, or `[v6]:port`). */
+export function parseConnectTarget(value) {
+    const m = /^(?:\[([0-9a-fA-F:.]+)\]|([A-Za-z0-9.-]+)):([1-9][0-9]{0,4})$/.exec(value);
+    if (!m)
+        return undefined;
+    const port = Number(m[3]);
+    return port <= 65535 ? { host: m[1] ?? m[2], port } : undefined;
+}
+/**
+ * The HTTP proxy a sandboxed shim must tunnel through, from its env. srt sets
+ * HTTP_PROXY / HTTPS_PROXY (with its per-run credentials) for everything it
+ * wraps; inside the sandbox nothing else reaches the host. NO_PROXY is
+ * ignored on purpose: srt lists 127.0.0.1 there, but inside the sandbox's own
+ * network namespace 127.0.0.1 is not the host.
+ */
+export function bridgeProxyFromEnv(env) {
+    for (const k of ["HTTP_PROXY", "http_proxy", "HTTPS_PROXY", "https_proxy", "ALL_PROXY", "all_proxy"]) {
+        const v = env[k];
+        if (!v)
+            continue;
+        try {
+            const u = new URL(v);
+            if (u.protocol === "http:")
+                return u;
+        }
+        catch {
+            // not a URL: try the next variable
+        }
+    }
+    return undefined;
+}
+const MAX_PROXY_RESPONSE_BYTES = 16 * 1024;
+/**
+ * Open a byte stream to the bridge. A TCP endpoint goes through an HTTP
+ * CONNECT tunnel when the env names a proxy (the sandboxed case), else
+ * straight to the port. `leftover` holds any bytes read past the proxy's
+ * response header.
+ */
+export function openBridgeStream(endpoint, env = process.env) {
+    const direct = (sock) => new Promise((resolve, reject) => {
+        sock.once("error", reject);
+        sock.once("connect", () => {
+            sock.removeListener("error", reject);
+            resolve({ sock, leftover: Buffer.alloc(0) });
+        });
+    });
+    if ("socketPath" in endpoint)
+        return direct(net.createConnection(endpoint.socketPath));
+    const proxy = bridgeProxyFromEnv(env);
+    if (!proxy)
+        return direct(net.createConnection(endpoint.port, endpoint.host));
+    return new Promise((resolve, reject) => {
+        const target = endpoint.host.includes(":")
+            ? `[${endpoint.host}]:${endpoint.port}`
+            : `${endpoint.host}:${endpoint.port}`;
+        const sock = net.createConnection(Number(proxy.port || 80), proxy.hostname.replace(/^\[|\]$/g, ""));
+        let buf = Buffer.alloc(0);
+        let done = false;
+        const fail = (err) => {
+            if (done)
+                return;
+            done = true;
+            sock.destroy();
+            reject(err);
+        };
+        const onData = (chunk) => {
+            buf = Buffer.concat([buf, chunk]);
+            const end = buf.indexOf("\r\n\r\n");
+            if (end === -1) {
+                if (buf.length > MAX_PROXY_RESPONSE_BYTES)
+                    fail(new Error("tool bridge: malformed proxy response"));
+                return;
+            }
+            const status = buf.subarray(0, buf.indexOf("\r\n")).toString("latin1");
+            if (!/^HTTP\/1\.[01] 200(\s|$)/.test(status)) {
+                fail(new Error(`tool bridge: the sandbox proxy refused ${target} (${status})`));
+                return;
+            }
+            done = true;
+            sock.removeListener("data", onData);
+            sock.removeListener("error", fail);
+            sock.removeListener("close", onClose);
+            resolve({ sock, leftover: buf.subarray(end + 4) });
+        };
+        const onClose = () => fail(new Error("tool bridge: the sandbox proxy closed the connection"));
+        sock.on("data", onData);
+        sock.once("error", fail);
+        sock.once("close", onClose);
+        sock.once("connect", () => {
+            const user = decodeURIComponent(proxy.username);
+            const pass = decodeURIComponent(proxy.password);
+            const auth = user || pass ? `Proxy-Authorization: Basic ${Buffer.from(`${user}:${pass}`).toString("base64")}\r\n` : "";
+            sock.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n${auth}\r\n`);
+        });
+    });
+}
 /** Socket client that multiplexes requests by id over one connection. */
 export class BridgeClient {
-    socketPath;
     token;
+    env;
     sock;
     connecting;
     nextId = 1;
     pending = new Map();
     closedError;
-    constructor(socketPath, token) {
-        this.socketPath = socketPath;
+    endpoint;
+    constructor(endpoint, token, env = process.env) {
         this.token = token;
+        this.env = env;
+        this.endpoint = typeof endpoint === "string" ? { socketPath: endpoint } : endpoint;
     }
     connect() {
         // Once the connection is gone (bad token, server closed) every later call fails fast.
@@ -33,8 +133,7 @@ export class BridgeClient {
             return Promise.reject(this.closedError);
         if (this.sock)
             return Promise.resolve(this.sock);
-        this.connecting ??= new Promise((resolve, reject) => {
-            const sock = net.createConnection(this.socketPath);
+        this.connecting ??= openBridgeStream(this.endpoint, this.env).then(({ sock, leftover }) => {
             const read = createFrameReader((value) => {
                 const res = value;
                 if (!res || typeof res.id !== "number")
@@ -50,15 +149,15 @@ export class BridgeClient {
                 }
             }, () => this.failAll(new Error("tool bridge: response frame too large")));
             sock.on("data", read);
-            sock.once("connect", () => {
-                this.sock = sock;
-                resolve(sock);
-            });
-            sock.once("error", (err) => {
-                reject(err);
-                this.failAll(err);
-            });
+            sock.once("error", (err) => this.failAll(err));
             sock.once("close", () => this.failAll(new Error("tool bridge: connection closed")));
+            this.sock = sock;
+            if (leftover.length > 0)
+                read(leftover);
+            return sock;
+        }, (err) => {
+            this.failAll(err);
+            throw err;
         });
         return this.connecting;
     }
@@ -89,13 +188,15 @@ export class BridgeClient {
 /** Run the stdio MCP shim until stdin closes or the bridge goes away. */
 export async function runToolBridgeShim(opts) {
     const token = opts.token ?? process.env[TOKEN_ENV];
-    if (!opts.socket || !token) {
-        process.stderr.write(`sweny tool-bridge: --socket and a token (--token or ${TOKEN_ENV}) are required\n`);
+    const tcp = opts.connect ? parseConnectTarget(opts.connect) : undefined;
+    const endpoint = opts.socket ? { socketPath: opts.socket } : tcp;
+    if (!endpoint || (opts.socket && opts.connect) || (opts.connect && !tcp) || !token) {
+        process.stderr.write(`sweny tool-bridge: one of --socket <path> or --connect <host:port>, and a token (--token or ${TOKEN_ENV}), are required\n`);
         process.exit(2);
     }
     // Keep the token out of anything the shim might spawn or report.
     delete process.env[TOKEN_ENV];
-    const client = new BridgeClient(opts.socket, token);
+    const client = new BridgeClient(endpoint, token);
     const server = new Server({ name: "sweny-core", version: opts.version ?? "0.0.0" }, { capabilities: { tools: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => {
         const res = await client.request("tools/list");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.150",
+  "version": "0.1.151",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"