cyrus-edge-worker 0.2.44 → 0.2.46

package/dist/ConfigManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigManager.d.ts","sourceRoot":"","sources":["../src/ConfigManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9E;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,yEAAyE;IACzE,SAAS,EAAE,gBAAgB,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,aAAc,SAAQ,YAAY;IAC9C,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,aAAa,CAAC,CAAY;gBAGjC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAa5C;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IA2B1B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B;;OAEG;IACH,SAAS,IAAI,gBAAgB;IAI7B;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAIzC;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAQvC;;OAEG;YACW,kBAAkB;IA2ChC;;;OAGG;YACW,gBAAgB;IA+E9B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAoC/B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;OAEG;IACH,OAAO,CAAC,SAAS;CAGjB"}
+{"version":3,"file":"ConfigManager.d.ts","sourceRoot":"","sources":["../src/ConfigManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9E;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,yEAAyE;IACzE,SAAS,EAAE,gBAAgB,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,aAAc,SAAQ,YAAY;IAC9C,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,aAAa,CAAC,CAAY;gBAGjC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAa5C;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IA2B1B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B;;OAEG;IACH,SAAS,IAAI,gBAAgB;IAI7B;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAIzC;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAQvC;;OAEG;YACW,kBAAkB;IA2ChC;;;OAGG;YACW,gBAAgB;IAiF9B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAoC/B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IA0BjC;;OAEG;IACH,OAAO,CAAC,SAAS;CAGjB"}

package/dist/ConfigManager.js

@@ -174,6 +174,8 @@ export class ConfigManager extends EventEmitter {
                 // Issue update trigger: use parsed value if explicitly set,
                 // otherwise keep current or default to true
                 issueUpdateTrigger: parsedConfig.issueUpdateTrigger ?? this.config.issueUpdateTrigger,
+                // Sandbox / egress proxy config
+                sandbox: parsedConfig.sandbox ?? this.config.sandbox,
             };
             // Basic validation
             if (!Array.isArray(newConfig.repositories)) {
@@ -246,6 +248,7 @@ export class ConfigManager extends EventEmitter {
             "issueUpdateTrigger",
             "linearWorkspaces",
             "userAccessControl",
+            "sandbox",
         ];
         for (const key of globalKeys) {
             if (!this.deepEqual(this.config[key], newConfig[key])) {

package/dist/ConfigManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigManager.js","sourceRoot":"","sources":["../src/ConfigManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,aAAa,EAAkB,MAAM,UAAU,CAAC;AAsBlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,aAAc,SAAQ,YAAY;IACtC,MAAM,CAAmB;IAChB,MAAM,CAAU;IACzB,UAAU,CAAU;IAC5B,yEAAyE;IACxD,YAAY,CAAgC;IACrD,aAAa,CAAa;IAElC,YACC,MAAwB,EACxB,MAAe,EACf,UAA8B,EAC9B,YAA2C;QAE3C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IAClC,CAAC;IAED,qEAAqE;IACrE,aAAa;IACb,qEAAqE;IAErE;;;;OAIG;IACH,kBAAkB;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACzE,OAAO;QACR,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE;YACnD,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE;gBACjB,kBAAkB,EAAE,GAAG;gBACvB,YAAY,EAAE,GAAG;aACjB;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACzD,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE;YACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACT,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAED;;OAEG;IACH,SAAS;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAwB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,UAAkB;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,CAAC;IAED,qEAAqE;IACrE,mBAAmB;IACnB,qEAAqE;IAErE;;OAEG;IACK,KAAK,CAAC,kBAAkB;QAC/B,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO;YACR,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAExD,MAAM,cAAc,GACnB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC3B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAE5B,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;YAEnE,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACnD,OAAO;YACR,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,mCAAmC,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,cAAc,OAAO,CAAC,OAAO,CAAC,MAAM,UAAU,CACvI,CAAC;YACH,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YAED,6DAA6D;YAC7D,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS;aACmB,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;IACF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB;QAC7B,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACb,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAE/C,iDAAiD;YACjD,MAAM,SAAS,GAAqB;gBACnC,GAAG,IAAI,CAAC,MAAM;gBACd,YAAY,EAAE,YAAY,CAAC,YAAY,IAAI,EAAE;gBAC7C,cAAc,EACb,YAAY,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc;gBAC1D,gBAAgB,EACf,YAAY,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9D,kBAAkB,EACjB,YAAY,CAAC,kBAAkB;oBAC/B,YAAY,CAAC,YAAY;oBACzB,IAAI,CAAC,MAAM,CAAC,kBAAkB;oBAC9B,IAAI,CAAC,MAAM,CAAC,YAAY;gBACzB,0BAA0B,EACzB,YAAY,CAAC,0BAA0B;oBACvC,YAAY,CAAC,oBAAoB;oBACjC,IAAI,CAAC,MAAM,CAAC,0BAA0B;oBACtC,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBACjC,kBAAkB,EACjB,YAAY,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB;gBAClE,iBAAiB,EAChB,YAAY,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBAChE,aAAa,EAAE,YAAY,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa;gBACtE,cAAc,EACb,YAAY,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc;gBAC1D,4DAA4D;gBAC5D,YAAY,EAAE,YAAY,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY;gBACnE,oBAAoB,EACnB,YAAY,CAAC,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBACtE,mBAAmB,EAClB,YAAY,CAAC,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB;gBACpE,sBAAsB,EACrB,YAAY,CAAC,sBAAsB;oBACnC,IAAI,CAAC,MAAM,CAAC,sBAAsB;gBACnC,4DAA4D;gBAC5D,4CAA4C;gBAC5C,kBAAkB,EACjB,YAAY,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB;aAClE,CAAC;YAEF,mBAAmB;YACnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,OAAO,IAAI,CAAC;YACb,CAAC;YAED,+CAA+C;YAC/C,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;gBAC3C,IACC,CAAC,IAAI,CAAC,EAAE;oBACR,CAAC,IAAI,CAAC,IAAI;oBACV,CAAC,IAAI,CAAC,cAAc;oBACpB,CAAC,IAAI,CAAC,UAAU,EACf,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,6FAA6F,EAC7F,IAAI,CACJ,CAAC;oBACF,OAAO,IAAI,CAAC;gBACb,CAAC;YACF,CAAC;YAED,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,SAA2B;QAK1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAC9D,CAAC;QAEF,MAAM,KAAK,GAAuB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAuB,EAAE,CAAC;QAEvC,uCAAuC;QACvC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACP,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzC,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACF,CAAC;QACF,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACK,yBAAyB,CAAC,SAA2B;QAC5D,MAAM,UAAU,GAAkC;YACjD,eAAe;YACf,oBAAoB;YACpB,4BAA4B;YAC5B,oBAAoB;YACpB,mBAAmB;YACnB,cAAc;YACd,sBAAsB;YACtB,qBAAqB;YACrB,wBAAwB;YACxB,gBAAgB;YAChB,oBAAoB;YACpB,kBAAkB;YAClB,mBAAmB;SACnB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,IAAa,EAAE,IAAa;QAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;CACD"}
+{"version":3,"file":"ConfigManager.js","sourceRoot":"","sources":["../src/ConfigManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,aAAa,EAAkB,MAAM,UAAU,CAAC;AAsBlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,aAAc,SAAQ,YAAY;IACtC,MAAM,CAAmB;IAChB,MAAM,CAAU;IACzB,UAAU,CAAU;IAC5B,yEAAyE;IACxD,YAAY,CAAgC;IACrD,aAAa,CAAa;IAElC,YACC,MAAwB,EACxB,MAAe,EACf,UAA8B,EAC9B,YAA2C;QAE3C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IAClC,CAAC;IAED,qEAAqE;IACrE,aAAa;IACb,qEAAqE;IAErE;;;;OAIG;IACH,kBAAkB;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACzE,OAAO;QACR,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE;YACnD,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE;gBACjB,kBAAkB,EAAE,GAAG;gBACvB,YAAY,EAAE,GAAG;aACjB;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACzD,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE;YACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACT,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAED;;OAEG;IACH,SAAS;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAwB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,UAAkB;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,CAAC;IAED,qEAAqE;IACrE,mBAAmB;IACnB,qEAAqE;IAErE;;OAEG;IACK,KAAK,CAAC,kBAAkB;QAC/B,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO;YACR,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAExD,MAAM,cAAc,GACnB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC3B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAE5B,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;YAEnE,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACnD,OAAO;YACR,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,mCAAmC,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,cAAc,OAAO,CAAC,OAAO,CAAC,MAAM,UAAU,CACvI,CAAC;YACH,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YAED,6DAA6D;YAC7D,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS;aACmB,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;IACF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB;QAC7B,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACb,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAE/C,iDAAiD;YACjD,MAAM,SAAS,GAAqB;gBACnC,GAAG,IAAI,CAAC,MAAM;gBACd,YAAY,EAAE,YAAY,CAAC,YAAY,IAAI,EAAE;gBAC7C,cAAc,EACb,YAAY,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc;gBAC1D,gBAAgB,EACf,YAAY,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9D,kBAAkB,EACjB,YAAY,CAAC,kBAAkB;oBAC/B,YAAY,CAAC,YAAY;oBACzB,IAAI,CAAC,MAAM,CAAC,kBAAkB;oBAC9B,IAAI,CAAC,MAAM,CAAC,YAAY;gBACzB,0BAA0B,EACzB,YAAY,CAAC,0BAA0B;oBACvC,YAAY,CAAC,oBAAoB;oBACjC,IAAI,CAAC,MAAM,CAAC,0BAA0B;oBACtC,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBACjC,kBAAkB,EACjB,YAAY,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB;gBAClE,iBAAiB,EAChB,YAAY,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBAChE,aAAa,EAAE,YAAY,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa;gBACtE,cAAc,EACb,YAAY,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc;gBAC1D,4DAA4D;gBAC5D,YAAY,EAAE,YAAY,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY;gBACnE,oBAAoB,EACnB,YAAY,CAAC,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBACtE,mBAAmB,EAClB,YAAY,CAAC,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB;gBACpE,sBAAsB,EACrB,YAAY,CAAC,sBAAsB;oBACnC,IAAI,CAAC,MAAM,CAAC,sBAAsB;gBACnC,4DAA4D;gBAC5D,4CAA4C;gBAC5C,kBAAkB,EACjB,YAAY,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB;gBAClE,gCAAgC;gBAChC,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;aACpD,CAAC;YAEF,mBAAmB;YACnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,OAAO,IAAI,CAAC;YACb,CAAC;YAED,+CAA+C;YAC/C,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;gBAC3C,IACC,CAAC,IAAI,CAAC,EAAE;oBACR,CAAC,IAAI,CAAC,IAAI;oBACV,CAAC,IAAI,CAAC,cAAc;oBACpB,CAAC,IAAI,CAAC,UAAU,EACf,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAChB,6FAA6F,EAC7F,IAAI,CACJ,CAAC;oBACF,OAAO,IAAI,CAAC;gBACb,CAAC;YACF,CAAC;YAED,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,SAA2B;QAK1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAC9D,CAAC;QAEF,MAAM,KAAK,GAAuB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAuB,EAAE,CAAC;QAEvC,uCAAuC;QACvC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACP,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzC,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACF,CAAC;QACF,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACK,yBAAyB,CAAC,SAA2B;QAC5D,MAAM,UAAU,GAAkC;YACjD,eAAe;YACf,oBAAoB;YACpB,4BAA4B;YAC5B,oBAAoB;YACpB,mBAAmB;YACnB,cAAc;YACd,sBAAsB;YACtB,qBAAqB;YACrB,wBAAwB;YACxB,gBAAgB;YAChB,oBAAoB;YACpB,kBAAkB;YAClB,mBAAmB;YACnB,SAAS;SACT,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,IAAa,EAAE,IAAa;QAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;CACD"}

package/dist/EdgeWorker.d.ts

@@ -58,6 +58,14 @@ export declare class EdgeWorker extends EventEmitter {
     private cyrusToolsMcpRegistered;
     private cyrusToolsMcpRequestContext;
     private cyrusToolsMcpSessions;
+    /** Validates webhook source IPs against known provider allowlists */
+    private webhookIpValidator;
+    /** Egress proxy for sandbox network traffic filtering and header injection */
+    private egressProxy;
+    /** Base SDK sandbox settings to pass to ClaudeRunner sessions (set when proxy starts) */
+    private sdkSandboxSettings;
+    /** CA cert path for MITM TLS termination (passed per-session env, not process.env) */
+    private egressCaCertPath;
     /**
      * Tracks recently processed issue-update webhook keys to prevent
      * duplicate deliveries from Linear's at-least-once delivery.
@@ -176,6 +184,26 @@ export declare class EdgeWorker extends EventEmitter {
      * Stop the edge worker
      */
     stop(): Promise<void>;
+    /**
+     * Apply sandbox config changes from a config reload.
+     * Handles three transitions:
+     * - enabled → enabled: update network policy on the running proxy
+     * - disabled → enabled: start a new proxy
+     * - enabled → disabled: stop the running proxy
+     */
+    private applySandboxConfigChanges;
+    /**
+     * Log instructions for trusting the egress proxy CA certificate.
+     * When systemWideCert is true, logs that env vars are skipped and trust
+     * is expected from the OS cert store. Otherwise logs env var list and
+     * checks macOS keychain trust status.
+     */
+    private logCertTrustInstructions;
+    /**
+     * Check whether the Cyrus egress proxy CA is trusted at the OS level.
+     * macOS: searches the System keychain. Linux: checks update-ca-certificates output.
+     */
+    private isCertTrustedSystemWide;
     /**
      * Set the config file path for dynamic reloading
      */
@@ -308,6 +336,10 @@ export declare class EdgeWorker extends EventEmitter {
      * Get issue tracker for a workspace (direct lookup by workspace ID)
      */
     private getIssueTrackerForWorkspace;
+    /**
+     * Get the activity sink for a repository by looking up its workspace.
+     */
+    private getActivitySinkForRepo;
     /**
      * Get the Linear API token for a workspace from workspace-level config.
      */

package/dist/EdgeWorker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EdgeWorker.d.ts","sourceRoot":"","sources":["../src/EdgeWorker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C,OAAO,KAAK,EAQX,iBAAiB,EACjB,gBAAgB,EAMhB,KAAK,EAKL,gBAAgB,EAEhB,2BAA2B,EAQ3B,MAAM,YAAY,CAAC;AAoFpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAkB/D,OAAO,EACN,gBAAgB,EAEhB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGrE,MAAM,CAAC,OAAO,WAAW,UAAU;IAClC,EAAE,CAAC,CAAC,SAAS,MAAM,gBAAgB,EAClC,KAAK,EAAE,CAAC,EACR,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,IAAI,CAAC;IACR,IAAI,CAAC,CAAC,SAAS,MAAM,gBAAgB,EACpC,KAAK,EAAE,CAAC,EACR,GAAG,IAAI,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC;CACX;AAMD;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,YAAY;IAC3C,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,YAAY,CAA4C;IAChE,OAAO,CAAC,mBAAmB,CAAsB;IACjD,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,mBAAmB,CAAkC;IAC7D,OAAO,CAAC,aAAa,CAAgD;IACrE,OAAO,CAAC,oBAAoB,CAAqC;IACjE,OAAO,CAAC,oBAAoB,CAAqC;IACjE,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,oBAAoB,CAAqC;IACjE,OAAO,CAAC,mBAAmB,CAAoC;IAC/D,OAAO,CAAC,kBAAkB,CACpB;IACN,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,uBAAuB,CAA0B;IACzD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,2CAA2C;IACpC,gBAAgB,EAAE,gBAAgB,CAAC;IAC1C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,kBAAkB,CAAK;IAC/B,4EAA4E;IAC5E,OAAO,CAAC,sBAAsB,CAAyB;IACvD,qEAAqE;IACrE,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,MAAM,CAAU;IAExB,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,sBAAsB,CAAyB;IACvD,OAAO,CAAC,sBAAsB,CAAyB;IACvD,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,mBAAmB,CAAsB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;IAC5D,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,2BAA2B,CACY;IAC/C,OAAO,CAAC,qBAAqB,CAAuB;IACpD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB,CAAqB;gBAEzC,MAAM,EAAE,gBAAgB;IAgPpC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkC5B;;OAEG;YACW,oBAAoB;IA6HlC;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAY9B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAmEpC;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IA+CpC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IA+FnC;;;;;OAKG;IACH;;;;;OAKG;YACW,kBAAkB;YAiBlB,mBAAmB;IA0TjC;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAgBjC;;;;OAIG;YACW,iBAAiB;IAsD/B;;;OAGG;YACW,qBAAqB;IAqDnC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA8B/B;;OAEG;IACH,OAAO,CAAC,oCAAoC;IA2C5C;;OAEG;YACW,eAAe;IAiF7B;;;OAGG;YACW,mBAAmB;IA+QjC;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAejC;;;OAGG;YACW,qBAAqB;IAoDnC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA+B/B;;OAEG;IACH,OAAO,CAAC,oCAAoC;IA2C5C;;OAEG;YACW,eAAe;IAiF7B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAsBrB;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA4C3B;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAKvC;;;;OAIG;YACW,yBAAyB;IAmGvC;;;;;;;;OAQG;IACH,OAAO,CAAC,2BAA2B;IAwCnC;;OAEG;YACW,kBAAkB;IAkEhC;;OAEG;YACW,0BAA0B;IA2FxC;;OAEG;YACW,yBAAyB;IAqFvC;;OAEG;IACH,OAAO,CAAC,WAAW;IAKnB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAK3B;;OAEG;YACW,aAAa;IAsE3B;;;;;;OAMG;YACW,aAAa;IA8C3B;;;;;OAKG;YACW,yBAAyB;IAWvC;;;;;OAKG;YACW,uBAAuB;IAWrC;;;;;OAKG;YACW,uBAAuB;IAWrC;;;;;OAKG;YACW,0BAA0B;IAWxC;;;;;OAKG;YACW,qBAAqB;IASnC;;;OAGG;YACW,6BAA6B;IAyC3C;;OAEG;YACW,4BAA4B;IA8D1C;;;;;;;;;;;;;;;;;OAiBG;YACW,wBAAwB;IAwMtC;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAoB9B;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAMnC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAWlC;;;;;;;;OAQG;YACW,uBAAuB;IAwKrC;;;;;OAKG;YACW,gCAAgC;IAiH9C;;;;;;;;;;;;;OAaG;YACW,qBAAqB;IAkOnC;;;;;;;OAOG;YACW,gBAAgB;IAiD9B;;;;;;;OAOG;YACW,iCAAiC;IA2D/C;;;;;OAKG;YACW,6BAA6B;IA0C3C;;;OAGG;YACW,4BAA4B;IA6M1C;;;;;;;;OAQG;YACW,+BAA+B;IAiI7C;;;;OAIG;YACW,qBAAqB;IA8BnC;;OAEG;YACW,mBAAmB;IAQjC;;;OAGG;YACW,iBAAiB;IAiB/B;;OAEG;YACW,gBAAgB;IAI9B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAIhC;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAMxC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAkB3B;;OAEG;YACW,+BAA+B;IAqB7C;;;;;;;;OAQG;YACW,kBAAkB;IAchC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAIhC;;OAEG;IACH,mBAAmB,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;IAY3C;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG;IAKtC;;OAEG;IACG,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAChD,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,EAAE,MAAM,CAAC;KAC5B,CAAC;IAKF;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,mBAAmB,IAAI,MAAM;IAI7B;;;;OAIG;YAEW,uBAAuB;IA+ErC;;OAEG;IAeH;;OAEG;YACW,WAAW;IAczB;;OAEG;IASH;;;;;OAKG;YACW,wBAAwB;IActC;;;;;;OAMG;YACW,0BAA0B;IAmBxC;;OAEG;IACH,OAAO,CAAC,6BAA6B;YASvB,6BAA6B;IA0G3C,OAAO,CAAC,uBAAuB;IAe/B,OAAO,CAAC,yBAAyB;YAgBnB,oCAAoC;IA2HlD,OAAO,CAAC,mBAAmB;IAW3B;;;;;;;;;;OAUG;YACW,kBAAkB;IAuChC;;;OAGG;YACW,cAAc;IAiB5B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAuB5B;;OAEG;YACW,qBAAqB;IA8FnC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAY9B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAmC/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;OAEG;YACW,sBAAsB;IAIpC;;OAEG;YACW,kCAAkC;IA8ChD;;;;OAIG;IACH;;;;OAIG;YACW,sBAAsB;IAmDpC;;;;;;;OAOG;IACH,OAAO,CAAC,6BAA6B;IAgBrC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAe5B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB;;OAEG;IACI,wBAAwB,CAC9B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACnB,GAAG,EAAE;IAQR;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAqBvB;;;;;;OAMG;YACW,iBAAiB;IA0C/B;;OAEG;YACW,kBAAkB;IAchC;;OAEG;YACW,kBAAkB;IAYhC;;OAEG;IACI,iBAAiB,IAAI,2BAA2B;IAqBvD;;OAEG;IACI,eAAe,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI;IAmEhE;;;;;;OAMG;YACW,kBAAkB;IAQhC;;OAEG;YACW,yBAAyB;IAUvC;;OAEG;YACW,8BAA8B;IAU5C;;OAEG;YACW,mBAAmB;IAcjC;;;;;;;;;;;;;;;;;OAiBG;YACW,8BAA8B;IA0D5C;;OAEG;YACW,gCAAgC;IAc9C;;;;;;;;;;OAUG;IACG,kBAAkB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,mBAAmB,EACxC,UAAU,EAAE,MAAM,EAClB,kBAAkB,GAAE,MAAW,EAC/B,YAAY,GAAE,OAAe,EAC7B,4BAA4B,GAAE,MAAM,EAAO,EAC3C,iBAAiB,CAAC,EAAE,MAAM,EAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,EACtB,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC;IA+JhB;;OAEG;YACW,iCAAiC;IAY/C;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;OAEG;IACU,qBAAqB,CACjC,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,MAAM,GACvB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAqCxB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAmDxB;;OAEG;YACW,eAAe;CAqD7B"}
+{"version":3,"file":"EdgeWorker.d.ts","sourceRoot":"","sources":["../src/EdgeWorker.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C,OAAO,KAAK,EAQX,iBAAiB,EACjB,gBAAgB,EAMhB,KAAK,EAKL,gBAAgB,EAEhB,2BAA2B,EAQ3B,MAAM,YAAY,CAAC;AAqFpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAmB/D,OAAO,EACN,gBAAgB,EAEhB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGrE,MAAM,CAAC,OAAO,WAAW,UAAU;IAClC,EAAE,CAAC,CAAC,SAAS,MAAM,gBAAgB,EAClC,KAAK,EAAE,CAAC,EACR,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,IAAI,CAAC;IACR,IAAI,CAAC,CAAC,SAAS,MAAM,gBAAgB,EACpC,KAAK,EAAE,CAAC,EACR,GAAG,IAAI,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC;CACX;AAMD;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,YAAY;IAC3C,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,YAAY,CAA4C;IAChE,OAAO,CAAC,mBAAmB,CAAsB;IACjD,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,mBAAmB,CAAkC;IAC7D,OAAO,CAAC,aAAa,CAAgD;IACrE,OAAO,CAAC,oBAAoB,CAAqC;IACjE,OAAO,CAAC,oBAAoB,CAAqC;IACjE,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,oBAAoB,CAAqC;IACjE,OAAO,CAAC,mBAAmB,CAAoC;IAC/D,OAAO,CAAC,kBAAkB,CACpB;IACN,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,uBAAuB,CAA0B;IACzD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,2CAA2C;IACpC,gBAAgB,EAAE,gBAAgB,CAAC;IAC1C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,kBAAkB,CAAK;IAC/B,4EAA4E;IAC5E,OAAO,CAAC,sBAAsB,CAAyB;IACvD,qEAAqE;IACrE,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,MAAM,CAAU;IAExB,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,sBAAsB,CAAyB;IACvD,OAAO,CAAC,sBAAsB,CAAyB;IACvD,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,mBAAmB,CAAsB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;IAC5D,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,2BAA2B,CACY;IAC/C,OAAO,CAAC,qBAAqB,CAAuB;IACpD,qEAAqE;IACrE,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,8EAA8E;IAC9E,OAAO,CAAC,WAAW,CAA4B;IAC/C,yFAAyF;IACzF,OAAO,CAAC,kBAAkB,CAEX;IACf,sFAAsF;IACtF,OAAO,CAAC,gBAAgB,CAAuB;IAC/C;;;;OAIG;IACH,OAAO,CAAC,wBAAwB,CAAqB;gBAEzC,MAAM,EAAE,gBAAgB;IA2PpC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAmF5B;;OAEG;YACW,oBAAoB;IAiIlC;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAY9B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAuEpC;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IA+CpC;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IA+FnC;;;;;OAKG;IACH;;;;;OAKG;YACW,kBAAkB;YAiBlB,mBAAmB;IA0TjC;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAgBjC;;;;OAIG;YACW,iBAAiB;IAsD/B;;;OAGG;YACW,qBAAqB;IAqDnC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA8B/B;;OAEG;IACH,OAAO,CAAC,oCAAoC;IA2C5C;;OAEG;YACW,eAAe;IAiF7B;;;OAGG;YACW,mBAAmB;IA+QjC;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAejC;;;OAGG;YACW,qBAAqB;IAoDnC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA+B/B;;OAEG;IACH,OAAO,CAAC,oCAAoC;IA2C5C;;OAEG;YACW,eAAe;IAiF7B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAsBrB;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoD3B;;;;;;OAMG;YACW,yBAAyB;IAwDvC;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAgDhC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAuB/B;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAKvC;;;;OAIG;YACW,yBAAyB;IAmGvC;;;;;;;;OAQG;IACH,OAAO,CAAC,2BAA2B;IA4CnC;;OAEG;YACW,kBAAkB;IAmChC;;OAEG;YACW,0BAA0B;IAsDxC;;OAEG;YACW,yBAAyB;IAsFvC;;OAEG;IACH,OAAO,CAAC,WAAW;IAKnB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAK3B;;OAEG;YACW,aAAa;IAsE3B;;;;;;OAMG;YACW,aAAa;IA8C3B;;;;;OAKG;YACW,yBAAyB;IAWvC;;;;;OAKG;YACW,uBAAuB;IAWrC;;;;;OAKG;YACW,uBAAuB;IAWrC;;;;;OAKG;YACW,0BAA0B;IAWxC;;;;;OAKG;YACW,qBAAqB;IASnC;;;OAGG;YACW,6BAA6B;IAyC3C;;OAEG;YACW,4BAA4B;IA8D1C;;;;;;;;;;;;;;;;;OAiBG;YACW,wBAAwB;IAwMtC;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAoB9B;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAMnC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAM9B;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAWlC;;;;;;;;OAQG;YACW,uBAAuB;IAwKrC;;;;;OAKG;YACW,gCAAgC;IAiH9C;;;;;;;;;;;;;OAaG;YACW,qBAAqB;IAkOnC;;;;;;;OAOG;YACW,gBAAgB;IAiD9B;;;;;;;OAOG;YACW,iCAAiC;IA2D/C;;;;;OAKG;YACW,6BAA6B;IA0C3C;;;OAGG;YACW,4BAA4B;IA6M1C;;;;;;;;OAQG;YACW,+BAA+B;IAiI7C;;;;OAIG;YACW,qBAAqB;IA8BnC;;OAEG;YACW,mBAAmB;IAQjC;;;OAGG;YACW,iBAAiB;IAiB/B;;OAEG;YACW,gBAAgB;IAI9B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAIhC;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAMxC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAkB3B;;OAEG;YACW,+BAA+B;IAqB7C;;;;;;;;OAQG;YACW,kBAAkB;IAchC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAIhC;;OAEG;IACH,mBAAmB,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;IAY3C;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG;IAKtC;;OAEG;IACG,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAChD,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,EAAE,MAAM,CAAC;KAC5B,CAAC;IAKF;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,mBAAmB,IAAI,MAAM;IAI7B;;;;OAIG;YAEW,uBAAuB;IA+ErC;;OAEG;IAeH;;OAEG;YACW,WAAW;IAczB;;OAEG;IASH;;;;;OAKG;YACW,wBAAwB;IActC;;;;;;OAMG;YACW,0BAA0B;IAmBxC;;OAEG;IACH,OAAO,CAAC,6BAA6B;YASvB,6BAA6B;IA0G3C,OAAO,CAAC,uBAAuB;IAe/B,OAAO,CAAC,yBAAyB;YAgBnB,oCAAoC;IA2HlD,OAAO,CAAC,mBAAmB;IAW3B;;;;;;;;;;OAUG;YACW,kBAAkB;IAuChC;;;OAGG;YACW,cAAc;IAiB5B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAuB5B;;OAEG;YACW,qBAAqB;IAuGnC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAoB9B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAmC/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;OAEG;YACW,sBAAsB;IAIpC;;OAEG;YACW,kCAAkC;IAgDhD;;;;OAIG;IACH;;;;OAIG;YACW,sBAAsB;IAqDpC;;;;;;;OAOG;IACH,OAAO,CAAC,6BAA6B;IAgBrC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAe5B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB;;OAEG;IACI,wBAAwB,CAC9B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACnB,GAAG,EAAE;IAQR;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAqBvB;;;;;;OAMG;YACW,iBAAiB;IA0C/B;;OAEG;YACW,kBAAkB;IAchC;;OAEG;YACW,kBAAkB;IAYhC;;OAEG;IACI,iBAAiB,IAAI,2BAA2B;IAqBvD;;OAEG;IACI,eAAe,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI;IAmEhE;;;;;;OAMG;YACW,kBAAkB;IAQhC;;OAEG;YACW,yBAAyB;IAUvC;;OAEG;YACW,8BAA8B;IAU5C;;OAEG;YACW,mBAAmB;IAcjC;;;;;;;;;;;;;;;;;OAiBG;YACW,8BAA8B;IA0D5C;;OAEG;YACW,gCAAgC;IAc9C;;;;;;;;;;OAUG;IACG,kBAAkB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,mBAAmB,EACxC,UAAU,EAAE,MAAM,EAClB,kBAAkB,GAAE,MAAW,EAC/B,YAAY,GAAE,OAAe,EAC7B,4BAA4B,GAAE,MAAM,EAAO,EAC3C,iBAAiB,CAAC,EAAE,MAAM,EAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,EACtB,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC;IA+JhB;;OAEG;YACW,iCAAiC;IAY/C;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;OAEG;IACU,qBAAqB,CACjC,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,MAAM,GACvB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAqCxB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAmDxB;;OAEG;YACW,eAAe;CAqD7B"}

package/dist/EdgeWorker.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { execSync } from "node:child_process";
 import { EventEmitter } from "node:events";
 import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
@@ -6,7 +7,7 @@ import { LinearClient } from "@linear/sdk";
 import { ClaudeRunner } from "cyrus-claude-runner";
 import { CodexRunner } from "cyrus-codex-runner";
 import { ConfigUpdater } from "cyrus-config-updater";
-import { CLIIssueTrackerService, CLIRPCServer, createLogger, DEFAULT_PROXY_URL, isAgentSessionCreatedWebhook, isAgentSessionPromptedWebhook, isContentUpdateMessage, isIssueAssignedWebhook, isIssueCommentMentionWebhook, isIssueDeletedWebhook, isIssueNewCommentWebhook, isIssueStateChangeMessage, isIssueStateChangeWebhook, isIssueTitleOrDescriptionUpdateWebhook, isIssueUnassignedWebhook, isSessionStartMessage, isStopSignalMessage, isUnassignMessage, isUserPromptMessage, PersistenceManager, requireLinearWorkspaceId, resolvePath, } from "cyrus-core";
+import { CLIIssueTrackerService, CLIRPCServer, createLogger, DEFAULT_PROXY_URL, isAgentSessionCreatedWebhook, isAgentSessionPromptedWebhook, isContentUpdateMessage, isIssueAssignedWebhook, isIssueCommentMentionWebhook, isIssueDeletedWebhook, isIssueNewCommentWebhook, isIssueStateChangeMessage, isIssueStateChangeWebhook, isIssueTitleOrDescriptionUpdateWebhook, isIssueUnassignedWebhook, isSessionStartMessage, isStopSignalMessage, isUnassignMessage, isUserPromptMessage, PersistenceManager, requireLinearWorkspaceId, resolvePath, WebhookIpValidator, } from "cyrus-core";
 import { CursorRunner } from "cyrus-cursor-runner";
 import { GeminiRunner } from "cyrus-gemini-runner";
 import { extractCommentAuthor, extractCommentBody, extractCommentId, extractCommentUrl, extractPRBaseBranchRef, extractPRBranchRef, extractPRNumber, extractPRTitle, extractRepoFullName, extractRepoName, extractRepoOwner, extractSessionKey, GitHubAppTokenProvider, GitHubCommentService, GitHubEventTransport, isCommentOnPullRequest, isIssueCommentPayload, isPullRequestReviewCommentPayload, isPullRequestReviewPayload, stripMention, } from "cyrus-github-event-transport";
@@ -23,6 +24,7 @@ import { LiveChatRepositoryProvider } from "./ChatRepositoryProvider.js";
 import { ChatSessionHandler } from "./ChatSessionHandler.js";
 import { ConfigManager } from "./ConfigManager.js";
 import { DefaultSkillsDeployer } from "./DefaultSkillsDeployer.js";
+import { EgressProxy } from "./EgressProxy.js";
 import { GitService } from "./GitService.js";
 import { GlobalSessionRegistry } from "./GlobalSessionRegistry.js";
 import { McpConfigService } from "./McpConfigService.js";
@@ -46,7 +48,7 @@ export class EdgeWorker extends EventEmitter {
     config;
     repositories = new Map(); // repository 'id' (internal, stored in config.json) mapped to the full repo config
     agentSessionManager; // Single instance managing all agent sessions across repositories
-    activitySinks = new Map(); // Maps repository ID to activity sink
+    activitySinks = new Map(); // Maps Linear workspace ID to activity sink (one per workspace, mirrors issueTrackers)
     sessionRepositories = new Map(); // Maps session ID to repository ID
     issueTrackers = new Map(); // one issue tracker per Linear workspace (keyed by linearWorkspaceId)
     linearEventTransport = null; // Single event transport for webhook delivery
@@ -88,6 +90,14 @@ export class EdgeWorker extends EventEmitter {
     cyrusToolsMcpRegistered = false;
     cyrusToolsMcpRequestContext = new AsyncLocalStorage();
     cyrusToolsMcpSessions = new Sessions();
+    /** Validates webhook source IPs against known provider allowlists */
+    webhookIpValidator;
+    /** Egress proxy for sandbox network traffic filtering and header injection */
+    egressProxy = null;
+    /** Base SDK sandbox settings to pass to ClaudeRunner sessions (set when proxy starts) */
+    sdkSandboxSettings = null;
+    /** CA cert path for MITM TLS termination (passed per-session env, not process.env) */
+    egressCaCertPath = null;
     /**
      * Tracks recently processed issue-update webhook keys to prevent
      * duplicate deliveries from Linear's at-least-once delivery.
@@ -147,6 +157,19 @@ export class EdgeWorker extends EventEmitter {
                 return this.getIssueTrackerForWorkspace(linearWorkspaceId) ?? null;
             },
         });
+        // Initialize webhook IP validator
+        // Enabled by default in self-hosted mode (CYRUS_HOST_EXTERNAL=true),
+        // can be overridden with WEBHOOK_IP_VALIDATION=false to disable
+        const isExternalHost = process.env.CYRUS_HOST_EXTERNAL?.toLowerCase().trim() === "true";
+        const ipValidationEnv = process.env.WEBHOOK_IP_VALIDATION?.toLowerCase().trim();
+        const ipValidationEnabled = ipValidationEnv === "true" ||
+            (ipValidationEnv !== "false" && isExternalHost);
+        this.webhookIpValidator = new WebhookIpValidator({
+            enabled: ipValidationEnabled,
+        });
+        if (ipValidationEnabled) {
+            this.logger.info("Webhook IP validation enabled");
+        }
         // Initialize shared application server
         const serverPort = config.serverPort || config.webhookPort || 3456;
         const serverHost = config.serverHost || "localhost";
@@ -202,15 +225,9 @@ export class EdgeWorker extends EventEmitter {
                 this.issueTrackers.set(linearWorkspaceId, issueTracker);
             }
         }
-        // Create activity sinks for each repository (uses workspace issue tracker)
-        for (const [repoId, repo] of this.repositories) {
-            if (!repo.linearWorkspaceId)
-                continue;
-            const issueTracker = this.issueTrackers.get(repo.linearWorkspaceId);
-            if (issueTracker) {
-                const activitySink = new LinearActivitySink(issueTracker, repo.linearWorkspaceId);
-                this.activitySinks.set(repoId, activitySink);
-            }
+        // Create activity sinks per workspace (one per workspace, mirrors issueTrackers)
+        for (const [workspaceId, issueTracker] of this.issueTrackers) {
+            this.activitySinks.set(workspaceId, new LinearActivitySink(issueTracker, workspaceId));
         }
         // Initialize user access control with global and per-repository configs
         const repoAccessConfigs = new Map();
@@ -238,7 +255,6 @@ export class EdgeWorker extends EventEmitter {
             repositories: this.repositories,
             issueTrackers: this.issueTrackers,
             gitService: this.gitService,
-            config: this.config,
         });
         this.defaultSkillsDeployer = new DefaultSkillsDeployer(this.cyrusHome, this.logger);
         this.skillsPluginResolver = new SkillsPluginResolver(this.cyrusHome, this.logger);
@@ -256,19 +272,52 @@ export class EdgeWorker extends EventEmitter {
         await this.loadPersistedState();
         // Start config file watcher via ConfigManager
         this.configManager.on("configChanged", async (changes) => {
+            this.updateLinearWorkspaceTokens(changes.newConfig);
             await this.removeDeletedRepositories(changes.removed);
             await this.updateModifiedRepositories(changes.modified);
             await this.addNewRepositories(changes.added);
-            // Detect and apply workspace token changes before overwriting config
-            this.updateLinearWorkspaceTokens(changes.newConfig);
+            // Live-update sandbox / egress proxy settings
+            await this.applySandboxConfigChanges(changes.newConfig);
             this.config = changes.newConfig;
             this.configManager.setConfig(changes.newConfig);
             this.runnerSelectionService.setConfig(changes.newConfig);
             this.toolPermissionResolver.setConfig(changes.newConfig);
         });
         this.configManager.startConfigWatcher();
+        // Start egress proxy if sandbox is enabled.
+        // The proxy intercepts Bash-spawned subprocess traffic only (git, gh, npm, etc.).
+        // Claude's inference API, MCP servers, and built-in file tools bypass the proxy.
+        if (this.config.sandbox?.enabled) {
+            this.logger.info("🛡️  Sandbox egress proxy: starting...");
+            this.egressProxy = new EgressProxy(this.config.sandbox, this.cyrusHome, this.logger);
+            await this.egressProxy.start();
+            // Store base SDK sandbox settings — merged per-session with worktree path
+            this.sdkSandboxSettings = {
+                enabled: true,
+                network: {
+                    httpProxyPort: this.egressProxy.getHttpProxyPort(),
+                    socksProxyPort: this.egressProxy.getSocksProxyPort(),
+                },
+            };
+            const systemWideCert = this.config.sandbox?.systemWideCert === true;
+            this.logCertTrustInstructions(this.egressProxy.getCACertPath(), systemWideCert);
+            // When systemWideCert is true, the OS cert store handles trust
+            // for all tools — skip per-session cert env vars.
+            if (!systemWideCert) {
+                this.egressCaCertPath = this.egressProxy.buildCACertBundle();
+            }
+        }
+        else {
+            this.logger.info("🛡️  Sandbox egress proxy: disabled (set sandbox.enabled=true in config.json to enable)");
+        }
         // Initialize and register components BEFORE starting server (routes must be registered before listen())
         await this.initializeComponents();
+        // Refresh GitHub webhook allowlist from /meta API (non-blocking)
+        if (this.webhookIpValidator.isEnabled()) {
+            this.webhookIpValidator.refreshGitHubAllowlist().catch((error) => {
+                this.logger.warn("Failed to refresh GitHub webhook allowlist", error instanceof Error ? error : new Error(String(error)));
+            });
+        }
         // Start shared application server (this also starts Cloudflare tunnel if CLOUDFLARE_TOKEN is set)
         await this.sharedApplicationServer.start();
     }
@@ -322,6 +371,9 @@ export class EdgeWorker extends EventEmitter {
                 fastifyServer: this.sharedApplicationServer.getFastifyInstance(),
                 verificationMode,
                 secret,
+                ipAllowlist: verificationMode === "direct" && this.webhookIpValidator.isEnabled()
+                    ? this.webhookIpValidator.getAllowlist("linear")
+                    : undefined,
             });
             // Listen for legacy webhook events (deprecated, kept for backward compatibility)
             this.linearEventTransport.on("event", (event) => {
@@ -410,6 +462,9 @@ export class EdgeWorker extends EventEmitter {
             fastifyServer: this.sharedApplicationServer.getFastifyInstance(),
             verificationMode,
             secret,
+            ipAllowlist: useSignatureVerification && this.webhookIpValidator.isEnabled()
+                ? this.webhookIpValidator.getAllowlist("github")
+                : undefined,
         });
         // Listen for legacy GitHub webhook events (deprecated, kept for backward compatibility)
         this.gitHubEventTransport.on("event", (event) => {
@@ -721,7 +776,7 @@ export class EdgeWorker extends EventEmitter {
             ]);
             // Register session-to-repo mapping and activity sink
             this.sessionRepositories.set(githubSessionId, repository.id);
-            const activitySink = this.activitySinks.get(repository.id);
+            const activitySink = this.getActivitySinkForRepo(repository.id);
             if (activitySink) {
                 agentSessionManager.setActivitySink(githubSessionId, activitySink);
             }
@@ -1129,7 +1184,7 @@ ${taskSection}`;
             ]);
             // Register session-to-repo mapping and activity sink
             this.sessionRepositories.set(gitlabSessionId, repository.id);
-            const activitySink = this.activitySinks.get(repository.id);
+            const activitySink = this.getActivitySinkForRepo(repository.id);
             if (activitySink) {
                 agentSessionManager.setActivitySink(gitlabSessionId, activitySink);
             }
@@ -1435,9 +1490,121 @@ ${taskSection}`;
         this.mcpConfigService.clearAllContexts();
         this.cyrusToolsMcpSessions.removeAllListeners();
         this.cyrusToolsMcpRegistered = false;
+        // Stop egress proxy
+        if (this.egressProxy) {
+            await this.egressProxy.stop();
+            this.egressProxy = null;
+            this.sdkSandboxSettings = null;
+            this.egressCaCertPath = null;
+        }
         // Stop shared application server (this also stops Cloudflare tunnel if running)
         await this.sharedApplicationServer.stop();
     }
+    /**
+     * Apply sandbox config changes from a config reload.
+     * Handles three transitions:
+     * - enabled → enabled: update network policy on the running proxy
+     * - disabled → enabled: start a new proxy
+     * - enabled → disabled: stop the running proxy
+     */
+    async applySandboxConfigChanges(newConfig) {
+        const wasEnabled = this.egressProxy !== null;
+        const isEnabled = newConfig.sandbox?.enabled === true;
+        if (wasEnabled && isEnabled) {
+            // Policy update — proxy stays running, rules change
+            // Pass current policy (or empty object to reset to allow-all)
+            this.egressProxy.updateNetworkPolicy(newConfig.sandbox?.networkPolicy ?? {});
+            // Handle systemWideCert toggling while proxy is running
+            if (newConfig.sandbox?.systemWideCert) {
+                this.egressCaCertPath = null;
+            }
+            else if (!this.egressCaCertPath) {
+                this.egressCaCertPath = this.egressProxy.buildCACertBundle();
+            }
+        }
+        else if (!wasEnabled && isEnabled) {
+            // Start proxy for the first time
+            this.logger.info("🛡️  Sandbox egress proxy: starting (config change)...");
+            this.egressProxy = new EgressProxy(newConfig.sandbox, this.cyrusHome, this.logger);
+            await this.egressProxy.start();
+            this.sdkSandboxSettings = {
+                enabled: true,
+                network: {
+                    httpProxyPort: this.egressProxy.getHttpProxyPort(),
+                    socksProxyPort: this.egressProxy.getSocksProxyPort(),
+                },
+            };
+            const systemWideCert = newConfig.sandbox?.systemWideCert === true;
+            this.logCertTrustInstructions(this.egressProxy.getCACertPath(), systemWideCert);
+            if (!systemWideCert) {
+                this.egressCaCertPath = this.egressProxy.buildCACertBundle();
+            }
+        }
+        else if (wasEnabled && !isEnabled) {
+            // Stop proxy
+            this.logger.info("🛡️  Sandbox egress proxy: stopping (disabled in config)");
+            await this.egressProxy.stop();
+            this.egressProxy = null;
+            this.sdkSandboxSettings = null;
+            this.egressCaCertPath = null;
+        }
+    }
+    /**
+     * Log instructions for trusting the egress proxy CA certificate.
+     * When systemWideCert is true, logs that env vars are skipped and trust
+     * is expected from the OS cert store. Otherwise logs env var list and
+     * checks macOS keychain trust status.
+     */
+    logCertTrustInstructions(certPath, systemWideCert = false) {
+        this.logger.info(`🛡️  Sandbox TLS interception CA certificate: ${certPath}`);
+        if (systemWideCert) {
+            this.logger.info("🛡️  systemWideCert: true — per-session CA cert env vars are skipped (OS cert store handles trust)");
+        }
+        else {
+            this.logger.info("🛡️  Per-session env vars are set automatically: NODE_EXTRA_CA_CERTS, GIT_SSL_CAINFO, SSL_CERT_FILE, REQUESTS_CA_BUNDLE, PIP_CERT, CURL_CA_BUNDLE, CARGO_HTTP_CAINFO, AWS_CA_BUNDLE, DENO_CERT");
+        }
+        const trusted = this.isCertTrustedSystemWide();
+        if (trusted) {
+            this.logger.info("🛡️  CA certificate is trusted system-wide ✓");
+            if (!systemWideCert) {
+                this.logger.info("🛡️  Tip: set sandbox.systemWideCert: true in config.json to skip per-session cert env vars");
+            }
+        }
+        else {
+            if (process.platform === "darwin") {
+                this.logger.warn("🛡️  CA certificate is NOT trusted in the macOS System keychain. To trust (requires sudo):");
+                this.logger.warn(`🛡️  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${certPath}`);
+            }
+            else if (process.platform === "linux") {
+                this.logger.warn("🛡️  CA certificate is NOT trusted system-wide. To trust (requires sudo):");
+                this.logger.warn(`🛡️  sudo cp ${certPath} /usr/local/share/ca-certificates/cyrus-egress-ca.crt && sudo update-ca-certificates`);
+            }
+            if (systemWideCert) {
+                this.logger.warn("🛡️  systemWideCert is true but cert is not trusted — tools using the OS cert store will fail TLS verification");
+            }
+        }
+    }
+    /**
+     * Check whether the Cyrus egress proxy CA is trusted at the OS level.
+     * macOS: searches the System keychain. Linux: checks update-ca-certificates output.
+     */
+    isCertTrustedSystemWide() {
+        try {
+            if (process.platform === "darwin") {
+                execSync('security find-certificate -c "Cyrus Egress Proxy CA" /Library/Keychains/System.keychain', { stdio: "ignore" });
+                return true;
+            }
+            if (process.platform === "linux") {
+                // Check if our cert exists in the system CA certificates directory
+                execSync("test -f /usr/local/share/ca-certificates/cyrus-egress-ca.crt", { stdio: "ignore" });
+                return true;
+            }
+            return false;
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Set the config file path for dynamic reloading
      */
@@ -1531,9 +1698,10 @@ ${taskSection}`;
                 this.logger.info(`🔑 Updated Linear token for workspace ${workspaceId}`);
             }
             else if (this.config.platform !== "cli") {
-                // Workspace is new — create a tracker for it
+                // Workspace is new — create a tracker and activity sink for it
                 const newIssueTracker = new LinearIssueTrackerService(new LinearClient({ accessToken: newToken }), this.buildOAuthConfig(workspaceId));
                 this.issueTrackers.set(workspaceId, newIssueTracker);
+                this.activitySinks.set(workspaceId, new LinearActivitySink(newIssueTracker, workspaceId));
                 this.logger.info(`🔑 Created issue tracker for new workspace ${workspaceId}`);
             }
         }
@@ -1569,24 +1737,6 @@ ${taskSection}`;
                 };
                 // Add to internal map
                 this.repositories.set(repo.id, resolvedRepo);
-                // Create issue tracker for this workspace if not already present
-                if (!this.issueTrackers.has(requireLinearWorkspaceId(repo))) {
-                    const linearToken = this.getLinearTokenForWorkspace(requireLinearWorkspaceId(repo));
-                    const issueTracker = this.config.platform === "cli"
-                        ? (() => {
-                            const service = new CLIIssueTrackerService();
-                            service.seedDefaultData();
-                            return service;
-                        })()
-                        : new LinearIssueTrackerService(new LinearClient({
-                            accessToken: linearToken,
-                        }), this.buildOAuthConfig(requireLinearWorkspaceId(repo)));
-                    this.issueTrackers.set(requireLinearWorkspaceId(repo), issueTracker);
-                }
-                // Create activity sink for this repository
-                const issueTracker = this.issueTrackers.get(requireLinearWorkspaceId(repo));
-                const activitySink = new LinearActivitySink(issueTracker, requireLinearWorkspaceId(repo));
-                this.activitySinks.set(repo.id, activitySink);
                 this.logger.info(`✅ Repository added successfully: ${repo.name}`);
             }
             catch (error) {
@@ -1622,28 +1772,6 @@ ${taskSection}`;
                 };
                 // Update stored config
                 this.repositories.set(repo.id, resolvedRepo);
-                // If workspace changed or token was updated, ensure issue tracker is current
-                const currentToken = this.getLinearTokenForWorkspace(requireLinearWorkspaceId(repo));
-                if (!this.issueTrackers.has(requireLinearWorkspaceId(repo))) {
-                    this.logger.info(`  🔑 Creating issue tracker for workspace ${requireLinearWorkspaceId(repo)}`);
-                    const newIssueTracker = this.config.platform === "cli"
-                        ? (() => {
-                            const service = new CLIIssueTrackerService();
-                            service.seedDefaultData();
-                            return service;
-                        })()
-                        : new LinearIssueTrackerService(new LinearClient({
-                            accessToken: currentToken,
-                        }), this.buildOAuthConfig(requireLinearWorkspaceId(repo)));
-                    this.issueTrackers.set(requireLinearWorkspaceId(repo), newIssueTracker);
-                }
-                else {
-                    // Update token on existing issue tracker if it changed
-                    const issueTracker = this.issueTrackers.get(requireLinearWorkspaceId(repo));
-                    if (issueTracker && currentToken) {
-                        issueTracker.setAccessToken(currentToken);
-                    }
-                }
                 // If active status changed
                 if (oldRepo.isActive !== repo.isActive) {
                     if (repo.isActive === false) {
@@ -1702,11 +1830,12 @@ ${taskSection}`;
                 }
                 // Remove repository from all maps
                 this.repositories.delete(repo.id);
-                this.activitySinks.delete(repo.id);
-                // Only remove workspace issue tracker if no other repos use this workspace
-                const workspaceStillInUse = Array.from(this.repositories.values()).some((r) => r.linearWorkspaceId === requireLinearWorkspaceId(repo));
+                // Only remove workspace issue tracker and activity sink if no other repos use this workspace
+                const wsId = requireLinearWorkspaceId(repo);
+                const workspaceStillInUse = Array.from(this.repositories.values()).some((r) => r.linearWorkspaceId === wsId);
                 if (!workspaceStillInUse) {
-                    this.issueTrackers.delete(requireLinearWorkspaceId(repo));
+                    this.issueTrackers.delete(wsId);
+                    this.activitySinks.delete(wsId);
                 }
                 this.logger.info(`✅ Repository removed successfully: ${repo.name}`);
             }
@@ -2150,6 +2279,15 @@ ${taskSection}`;
     getIssueTrackerForWorkspace(linearWorkspaceId) {
         return this.issueTrackers.get(linearWorkspaceId);
     }
+    /**
+     * Get the activity sink for a repository by looking up its workspace.
+     */
+    getActivitySinkForRepo(repoId) {
+        const repo = this.repositories.get(repoId);
+        if (!repo?.linearWorkspaceId)
+            return undefined;
+        return this.activitySinks.get(repo.linearWorkspaceId);
+    }
     /**
      * Get the Linear API token for a workspace from workspace-level config.
      */
@@ -2208,7 +2346,7 @@ ${taskSection}`;
         agentSessionManager.createCyrusAgentSession(sessionId, issue.id, issueMinimal, workspace, "linear", repositoryContexts);
         // Register session-to-repo mapping and activity sink (use primary repo)
         this.sessionRepositories.set(sessionId, primaryRepo.id);
-        const activitySink = this.activitySinks.get(primaryRepo.id);
+        const activitySink = this.getActivitySinkForRepo(primaryRepo.id);
         if (activitySink) {
             agentSessionManager.setActivitySink(sessionId, activitySink);
         }
@@ -3344,7 +3482,14 @@ ${taskSection}`;
         // 5. Build issue context using appropriate builder
         // Use label-based prompt ONLY if we have a label-based system prompt
         const promptType = this.determinePromptType(input, !!labelBasedSystemPrompt);
-        const issueContext = await this.buildIssueContextForPromptAssembly(input.fullIssue, repositories, promptType, input.attachmentManifest, input.guidance, input.agentSession, input.resolvedBaseBranches);
+        // Build workspace repo paths map for prompt context.
+        // For multi-repo sessions, workspace.repoPaths maps each repo ID to its worktree.
+        // For single-repo sessions, use workspace.path as the worktree for the primary repo.
+        const workspaceRepoPaths = input.session.workspace.repoPaths ??
+            (repositories.length === 1
+                ? { [repositories[0].id]: input.session.workspace.path }
+                : undefined);
+        const issueContext = await this.buildIssueContextForPromptAssembly(input.fullIssue, repositories, promptType, input.attachmentManifest, input.guidance, input.agentSession, input.resolvedBaseBranches, workspaceRepoPaths);
         parts.push(issueContext.prompt);
         components.push("issue-context");
         // 4. Add user comment (if present)
@@ -3390,11 +3535,18 @@ ${input.userComment}
      * correct bot account without hardcoding.
      */
     buildAgentContextBlock() {
-        const githubBot = process.env.GITHUB_BOT_USERNAME || "cyrusagent";
-        const gitlabBot = process.env.GITLAB_BOT_USERNAME || "cyrusagent";
+        const githubBot = process.env.GITHUB_BOT_USERNAME || "";
+        const gitlabBot = process.env.GITLAB_BOT_USERNAME || "";
+        if (!githubBot && !gitlabBot) {
+            return "";
+        }
         const lines = ["\n\n<agent_context>"];
-        lines.push(`  <github_bot_username>${githubBot}</github_bot_username>`);
-        lines.push(`  <gitlab_bot_username>${gitlabBot}</gitlab_bot_username>`);
+        if (githubBot) {
+            lines.push(`  <github_bot_username>${githubBot}</github_bot_username>`);
+        }
+        if (gitlabBot) {
+            lines.push(`  <gitlab_bot_username>${gitlabBot}</gitlab_bot_username>`);
+        }
         lines.push("</agent_context>");
         return lines.join("\n");
     }
@@ -3455,7 +3607,7 @@ ${input.userComment}
     /**
      * Adapter method for prompt assembly - routes to appropriate issue context builder
      */
-    async buildIssueContextForPromptAssembly(issue, repositories, promptType, attachmentManifest, guidance, agentSession, resolvedBaseBranches) {
+    async buildIssueContextForPromptAssembly(issue, repositories, promptType, attachmentManifest, guidance, agentSession, resolvedBaseBranches, workspaceRepoPaths) {
         // Delegate to appropriate builder based on promptType
         if (promptType === "mention") {
             if (!agentSession) {
@@ -3469,7 +3621,7 @@ ${input.userComment}
         }
         // Fallback to standard issue context
         return this.promptBuilder.buildIssueContextPrompt(issue, repositories, undefined, // No new comment for initial prompt assembly
-        attachmentManifest, guidance, resolvedBaseBranches);
+        attachmentManifest, guidance, resolvedBaseBranches, workspaceRepoPaths);
     }
     /**
      * Resolve the default runner type for SimpleRunner (classification) use.
@@ -3504,6 +3656,8 @@ ${input.userComment}
             cyrusHome: this.cyrusHome,
             logger: log,
             plugins: await this.skillsPluginResolver.resolve(),
+            sandboxSettings: this.sdkSandboxSettings ?? undefined,
+            egressCaCertPath: this.egressCaCertPath ?? undefined,
             onMessage: (message) => {
                 this.handleClaudeMessage(sessionId, message, repository.id);
             },
@@ -3668,7 +3822,7 @@ ${input.userComment}
                         if (repoId) {
                             this.sessionRepositories.set(sessionId, repoId);
                             // Also register the activity sink for this restored session
-                            const activitySink = this.activitySinks.get(repoId);
+                            const activitySink = this.getActivitySinkForRepo(repoId);
                             if (activitySink) {
                                 this.agentSessionManager.setActivitySink(sessionId, activitySink);
                             }