terminalhire 0.42.21 → 0.42.23

package/dist/bin/proxy/egressProxy.js

@@ -27,6 +27,31 @@ export const DEFAULT_INSTALL_ALLOWLIST = [
     'static.crates.io',
     'index.crates.io',
     'crates.io',
+    // TERM-1139. `ruby` has had an image since the mapping existed and `bundle install`
+    // as its derived command, and this host was missing — so every ruby repo could start
+    // and could never install. Install is the ONLY step with a network grant at all, so a
+    // denial here is terminal, not a slow path.
+    //
+    // One entry, not two: `hostAllowed` is dot-anchored SUFFIX matching, so this covers
+    // `index.rubygems.org` as well. Listing that separately would advertise the grant as
+    // narrower than it is, which the `github.com` note below rejects for the same reason.
+    'rubygems.org',
+    // TERM-1139, added with the `dotnet` image mapping. `dotnet restore` fetches from
+    // NuGet; the coupling test refuses a mapped runtime whose registry is unreachable, and
+    // it caught this one the moment the image landed.
+    'api.nuget.org',
+    // TERM-1122, added with the `jvm` image mapping, each from a MEASURED denial
+    // through `th run` (the proxy's 403 in the build's own output), not a guess:
+    //   - Maven Central, where both `mvn` and Gradle's `mavenCentral()` resolve.
+    //   - `services.gradle.org`, where a Gradle wrapper fetches its distribution.
+    //   - `release-assets.githubusercontent.com`, where that fetch LANDS. Measured
+    //     chain: services.gradle.org 307 -> github.com 302 -> this host 200. The
+    //     `github.com` note below keeps `githubusercontent.com` denied until a real
+    //     install needs it; this is that install. Only this one host: raw blobs and
+    //     `objects.githubusercontent.com` stay denied.
+    'repo.maven.apache.org',
+    'services.gradle.org',
+    'release-assets.githubusercontent.com',
     // Git dependencies. Approved by Eric 2026-07-22 after a live run measured the
     // chokepoint working under load (20 events, 16 allowed / 4 denied by host).
     //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "terminalhire",
-  "version": "0.42.21",
+  "version": "0.42.23",
   "description": "Developer jobs and paid bounties, matched in the terminal — ambient matches in the Claude Code spinner. Claim a scoped bounty and get paid when the poster accepts it.",
   "repository": {
     "type": "git",