vigiles 2.5.0 → 3.0.0

package/dist/adapters/claude-code/egress-entry.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * vigiles — the allowlisted-egress orchestrator (in-process subprocess entry).
+ *
+ * `runHook` is synchronous (`spawnSync`), but allowlisted egress needs TWO
+ * processes alive at once: `bwrap` (which creates the netns and runs the hook)
+ * and `slirp4netns` (which, from the PARENT netns, attaches a tap to bwrap's netns
+ * to give it controlled egress). So the parent `spawnSync`s THIS entry, which runs
+ * the concurrent dance and writes a result file the parent reads back — keeping
+ * `runHook` synchronous while the handoff happens here.
+ *
+ * The dance (proven in `research/spikes/sandbox-network-allowlist.sh`):
+ *   1. spawn bwrap with `--info-fd` → learn the sandboxed child's PID;
+ *   2. `slirp4netns --configure --ready-fd N <pid> tap0` → tap up inside the netns;
+ *   3. touch the netready file → the in-sandbox wrapper (blocked on it) proceeds:
+ *      it loads the nft allowlist, runs the hook, then dumps the nft counters to a
+ *      bound file BEFORE exiting (the netns dies with the child, so the read-back
+ *      must happen inside);
+ *   4. capture bwrap's stdout/stderr/exit + the counters → write the result file.
+ *
+ * Run as: `node dist/egress-entry.js <config.json>`. v8-ignored: it spawns real
+ * bwrap + slirp4netns and is exercised only by the bwrap/slirp-gated integration
+ * test; the testable logic (ruleset, counter parse) lives in `src/egress.ts`.
+ */
+/* v8 ignore start */
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Is a binary on PATH? (probe via `--version`; ENOENT sets `.error`.) */
+function hasBinary(name) {
+    return !(0, node_child_process_1.spawnSync)(name, ["--version"], { stdio: "ignore" }).error;
+}
+/** Poll a file until it has content (the info / ready fd targets), or time out. */
+async function waitForFile(path, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            if ((0, node_fs_1.readFileSync)(path, "utf-8").trim().length > 0)
+                return true;
+        }
+        catch {
+            /* not written yet */
+        }
+        await sleep(50);
+    }
+    return false;
+}
+async function main() {
+    const cfg = JSON.parse((0, node_fs_1.readFileSync)(process.argv[2], "utf-8"));
+    // bwrap writes the sandboxed child's PID (init-namespace view) to fd 3.
+    const infoFd = (0, node_fs_1.openSync)(cfg.infoFile, "w");
+    const bwrap = (0, node_child_process_1.spawn)("bwrap", cfg.bwrapArgv, {
+        stdio: ["ignore", "pipe", "pipe", infoFd],
+    });
+    (0, node_fs_1.closeSync)(infoFd);
+    let stdout = "";
+    let stderr = "";
+    bwrap.stdout?.on("data", (d) => (stdout += d.toString()));
+    bwrap.stderr?.on("data", (d) => (stderr += d.toString()));
+    let connector;
+    const timer = setTimeout(() => bwrap.kill("SIGKILL"), cfg.timeoutMs);
+    const exit = new Promise((resolve) => {
+        bwrap.on("close", (status, signal) => {
+            resolve({ status, signal });
+        });
+    });
+    // Learn the child PID, attach a rootless egress connector to its netns, release
+    // the wrapper. Prefer pasta (passt): it routes on hosted runners where
+    // slirp4netns's tap-attach silently fails (the netns ends up with only `lo`).
+    // Fall back to slirp4netns where pasta isn't installed. nft (the allowlist wall)
+    // matches on destination, not interface name, so it's connector-agnostic. See
+    // research/egress-sandbox-tooling.md.
+    if (await waitForFile(cfg.infoFile, 5_000)) {
+        const info = (0, node_fs_1.readFileSync)(cfg.infoFile, "utf-8");
+        const m = /"child-pid":\s*(\d+)/.exec(info);
+        if (m) {
+            if (cfg.connector === "pasta" && hasBinary("pasta")) {
+                // pasta configures the netns then forks to background; no ready-fd, so
+                // give it a moment to bring the interface + routes up. (Experimental:
+                // pasta's attach-to-existing-netns path is fragile in nested-namespace
+                // sandboxes — see research/egress-sandbox-tooling.md. The connector
+                // defaults to slirp4netns; both need /dev/net/tun + privilege, which is
+                // why the e2e CI job runs privileged.)
+                connector = (0, node_child_process_1.spawn)("pasta", [...cfg.pastaArgs, m[1]], {
+                    stdio: "ignore",
+                });
+                await sleep(800);
+            }
+            else {
+                const readyFd = (0, node_fs_1.openSync)(cfg.readyFile, "w");
+                connector = (0, node_child_process_1.spawn)("slirp4netns", [...cfg.slirpArgs, "--ready-fd", "4", m[1], "tap0"], { stdio: ["ignore", "ignore", "ignore", "ignore", readyFd] });
+                (0, node_fs_1.closeSync)(readyFd);
+                // slirp writes "1" to the ready fd once tap0 is configured; fall back to a
+                // short sleep if it never signals (older builds).
+                if (!(await waitForFile(cfg.readyFile, 4_000)))
+                    await sleep(800);
+            }
+        }
+    }
+    (0, node_fs_1.writeFileSync)(cfg.netreadyFile, "1");
+    const { status, signal } = await exit;
+    clearTimeout(timer);
+    connector?.kill("SIGKILL");
+    const counters = (0, node_fs_1.existsSync)(cfg.countersFile)
+        ? (0, node_fs_1.readFileSync)(cfg.countersFile, "utf-8")
+        : "";
+    (0, node_fs_1.writeFileSync)(cfg.resultFile, JSON.stringify({ status, signal, stdout, stderr, counters }));
+}
+main().catch((e) => {
+    (0, node_fs_1.writeFileSync)(process.argv[2] + ".error", e instanceof Error ? (e.stack ?? e.message) : String(e));
+    process.exit(1);
+});
+/* v8 ignore stop */
+//# sourceMappingURL=egress-entry.js.map

package/dist/adapters/claude-code/egress-proxy.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=egress-proxy.d.ts.map

package/dist/adapters/claude-code/egress-proxy.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Recording egress proxy — runs INSIDE the sandbox netns (on loopback), so a
+ * confined hook configured with `HTTP(S)_PROXY` routes its network attempts here.
+ * It RECORDS each target (`host:port`) to an ndjson log and BLOCKS it (responds
+ * 502 / closes) — the netns already has no external route, so nothing actually
+ * leaves; this just turns "silently blocked" into "blocked AND recorded", so a
+ * test can assert what a hook/skill tried to reach (phone-home / which registry
+ * an install would hit).
+ *
+ * Honest limit: this records what PROXY-honoring tools (npm, pip, curl, fetch)
+ * attempt. Raw-socket egress bypasses the proxy — but the netns still blocks it
+ * hard, so it can't get out; it just won't appear in the record. The block is the
+ * boundary; the record is best-effort observability over it.
+ *
+ * Run as: `node dist/egress-proxy.js <egress-log-path> <port-file-path>`.
+ */
+/* v8 ignore start -- a standalone subprocess run only inside the sandbox netns;
+   exercised by the bwrap-gated end-to-end test, not the unit gate. The pure
+   parser (parseEgressLog) carries the testable logic. */
+const node_http_1 = require("node:http");
+const node_fs_1 = require("node:fs");
+const [, , logPath, portPath] = process.argv;
+function record(host, port) {
+    try {
+        (0, node_fs_1.appendFileSync)(logPath, JSON.stringify({ host, port, ts: Date.now() }) + "\n");
+    }
+    catch {
+        /* best-effort: a recording failure must not crash the hook under test */
+    }
+}
+const server = (0, node_http_1.createServer)((req, res) => {
+    // Plain HTTP via a proxy: req.url is absolute, e.g. http://host:port/path.
+    try {
+        const u = new URL(req.url ?? "");
+        record(u.hostname, Number(u.port) || 80);
+    }
+    catch {
+        /* unparseable target — skip */
+    }
+    res.writeHead(502, { "content-type": "text/plain" });
+    res.end("blocked by vigiles egress recorder\n");
+});
+// HTTPS via a proxy: the client sends `CONNECT host:port`. Record + refuse.
+server.on("connect", (req, socket) => {
+    const [host, port] = (req.url ?? "").split(":");
+    record(host, Number(port) || 443);
+    socket.write("HTTP/1.1 502 Blocked\r\n\r\n");
+    socket.end();
+});
+server.on("clientError", (_e, socket) => socket.destroy());
+server.listen(0, "127.0.0.1", () => {
+    const addr = server.address();
+    const port = typeof addr === "object" && addr ? addr.port : 0;
+    // Hand the chosen port back to the wrapper, which exports HTTP(S)_PROXY.
+    (0, node_fs_1.writeFileSync)(portPath, String(port));
+});
+/* v8 ignore stop */
+//# sourceMappingURL=egress-proxy.js.map

package/dist/adapters/claude-code/egress.d.ts

@@ -0,0 +1,114 @@
+import { type EgressAttempt } from "./sandbox.js";
+/** A host plus the IPs it resolved to, split by family (nft needs them apart). */
+export interface ResolvedHost {
+    readonly host: string;
+    readonly v4: readonly string[];
+    readonly v6: readonly string[];
+}
+/** Per-host and aggregate nftables counters read back after a confined run. */
+export interface EgressCounters {
+    /** Allowlisted hosts that saw traffic, with the nft counter for each. */
+    readonly allowed: readonly {
+        readonly host: string;
+        readonly packets: number;
+        readonly bytes: number;
+    }[];
+    /** The catch-all drop rule: traffic to anything OFF the allowlist. */
+    readonly dropped: {
+        readonly packets: number;
+        readonly bytes: number;
+    };
+}
+/**
+ * Whether this host can run the allowlisted-egress sandbox: it needs the same
+ * bubblewrap confinement the other tiers use PLUS `slirp4netns` (the rootless
+ * gateway) and `nft` (the packet-layer allowlist). Cached — the answer can't
+ * change within a run. `available` is injected so the bwrap probe isn't repeated.
+ */
+export declare function probeEgressAvailable(available: boolean): boolean;
+/** Cached {@link probeEgressAvailable}. `available` = the bwrap-sandbox probe. */
+export declare function egressAvailable(available: boolean): boolean;
+/**
+ * Parse `getent ahosts <host>` output into the unique IPs, split by family. The
+ * first whitespace token of each line is an address; `:` marks IPv6. Pure, so the
+ * resolution-parsing is unit-tested without touching DNS.
+ */
+export declare function parseGetent(stdout: string): {
+    v4: string[];
+    v6: string[];
+};
+/**
+ * Resolve every allowlisted host to IPs. The lookup is injectable so the
+ * empty-result / family-split behaviour is unit-tested with a fake resolver.
+ */
+export declare function resolveAllow(hosts: readonly string[], lookup?: (host: string) => {
+    v4: string[];
+    v6: string[];
+}): ResolvedHost[];
+/**
+ * Nameservers usable from INSIDE the egress netns. Parses a resolv.conf body but
+ * drops loopback stubs (see {@link isLoopbackResolver}) — they can't be reached
+ * across the namespace — and falls back to a public resolver (8.8.8.8, which
+ * slirp4netns NATs out) when nothing routable remains.
+ */
+export declare function parseResolvers(resolvConf: string): string[];
+/**
+ * Build the nftables ruleset that enforces the allowlist INSIDE the netns: a
+ * `policy drop` output chain that accepts loopback, established replies, DNS to
+ * the resolvers, and each allowlisted host's resolved IPs (a per-host `counter` +
+ * `comment "allow:<host>"` so the read-back maps traffic to a name), then a
+ * catch-all `log`+`counter`+`drop`. v4 and v6 are separate rules (an `inet` set
+ * can't mix families) sharing the host's comment. Pure → the ruleset is asserted
+ * in a unit test.
+ */
+export declare function buildEgressNft(opts: {
+    allow: readonly ResolvedHost[];
+    resolvers: readonly string[];
+}): string;
+/** The bound paths the in-netns wrapper and the orchestrator hand back through. */
+export interface EgressFiles {
+    readonly ioDir: string;
+    readonly netready: string;
+    readonly nft: string;
+    readonly event: string;
+    readonly counters: string;
+}
+/**
+ * Assemble the full bwrap argv for an allowlisted-egress run: the shared
+ * confinement args, the hook's added-back env, `CAP_NET_ADMIN` (so the in-netns
+ * wrapper can load nft), `--info-fd 3` (so the orchestrator learns the child PID
+ * to hand slirp4netns), the `VIG_*` paths the wrapper reads, and the trailing
+ * `sh -c <wrapper>`. Pure (the bwrap/setenv args are computed by the caller), so
+ * the assembled shape — caps, info-fd, the VIG_* env, the wrapper payload — is
+ * asserted in a unit test.
+ */
+export declare function buildEgressBwrapArgv(opts: {
+    base: readonly string[];
+    setenv: readonly string[];
+    files: EgressFiles;
+    command: string;
+    wrapper: string;
+    /** Host path to the generated resolv.conf bound over /etc/resolv.conf in-netns,
+     * so the hook resolves via the routable resolvers, not the host's loopback stub. */
+    resolvConf: string;
+}): string[];
+/**
+ * Parse `nft list chain inet vig output` back into per-host allowed counters and
+ * the aggregate drop counter. Sums multiple rules that share a host comment (the
+ * v4 + v6 split). Pure, so the read-back is unit-tested without a sandbox.
+ */
+export declare function parseNftCounters(nftText: string): EgressCounters;
+/**
+ * Map parsed counters to the run result: one {@link EgressAttempt} per
+ * allowlisted host that saw traffic (`allowed: true`, with its packet/byte
+ * counts), plus the aggregate dropped counter. `ts` is stamped once per run (the
+ * counters are end-of-run totals, not per-connection events). Pure.
+ */
+export declare function countersToResult(counters: EgressCounters, now: number): {
+    egress: EgressAttempt[];
+    egressDropped: {
+        packets: number;
+        bytes: number;
+    };
+};
+//# sourceMappingURL=egress.d.ts.map

package/dist/adapters/claude-code/egress.js

@@ -0,0 +1,276 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.probeEgressAvailable = probeEgressAvailable;
+exports.egressAvailable = egressAvailable;
+exports.parseGetent = parseGetent;
+exports.resolveAllow = resolveAllow;
+exports.parseResolvers = parseResolvers;
+exports.buildEgressNft = buildEgressNft;
+exports.buildEgressBwrapArgv = buildEgressBwrapArgv;
+exports.parseNftCounters = parseNftCounters;
+exports.countersToResult = countersToResult;
+/**
+ * vigiles — allowlisted, recorded egress for a confined hook (`egress: { allow }`).
+ *
+ * The deny-all wall (`--unshare-all`) and the `recordEgress` proxy both BLOCK; a
+ * hook whose setup needs a real `npm install` can't be tested under either. This
+ * is the in-between: let traffic actually reach the network, but **only to an
+ * allowlist**, and **record** it — with the boundary at the packet layer so it
+ * can't be bypassed by a raw socket (an `HTTP_PROXY` allowlist can).
+ *
+ * How it works (proven in `research/spikes/sandbox-network-allowlist.sh`):
+ * `slirp4netns --configure` attaches a `tap` to the bwrap netns (rootless egress
+ * via a userspace TCP/IP stack), then an `nft` ruleset INSIDE the netns — a
+ * `policy drop` output chain that `accept`s only the resolved allowlist IPs (plus
+ * loopback + the DNS resolver) and `log`+`drop`s the rest — is the hard wall. The
+ * per-rule `counter`s read back which allowlisted hosts were actually reached and
+ * how much was dropped.
+ *
+ * This module holds the PURE seams — resolution parsing, ruleset generation,
+ * counter parsing, result mapping — so the enforcement logic is unit-tested
+ * without a sandbox. The orchestration (`src/egress-entry.ts`) needs real bwrap +
+ * slirp4netns + nft and is covered by the gated integration test.
+ *
+ * Honest limits (see `docs/sandboxing.md`): the allowlist is resolved to IPs at
+ * launch (a host whose DNS rotates outside the run's window could miss an IP —
+ * the dynamic resolver-pinned set is the documented next layer). The record names
+ * the allowlisted hosts that were reached and counts what was dropped, but does
+ * not yet name the DROPPED hosts (that needs the in-netns DNS-query log).
+ */
+const node_child_process_1 = require("node:child_process");
+let cachedEgressAvailable;
+/** Does a binary resolve on PATH? (probe via `command -v`, no output kept.) */
+function hasBinary(name) {
+    try {
+        return ((0, node_child_process_1.spawnSync)("sh", ["-c", `command -v ${name}`], {
+            stdio: "ignore",
+            timeout: 5_000,
+        }).status === 0);
+    }
+    catch {
+        /* v8 ignore next -- spawnSync only throws on a fork failure */
+        return false;
+    }
+}
+/**
+ * Whether this host can run the allowlisted-egress sandbox: it needs the same
+ * bubblewrap confinement the other tiers use PLUS `slirp4netns` (the rootless
+ * gateway) and `nft` (the packet-layer allowlist). Cached — the answer can't
+ * change within a run. `available` is injected so the bwrap probe isn't repeated.
+ */
+function probeEgressAvailable(available) {
+    /* v8 ignore next -- non-Linux has no bwrap/slirp; CI/coverage runs on Linux */
+    if (process.platform !== "linux")
+        return false;
+    return available && hasBinary("slirp4netns") && hasBinary("nft");
+}
+/** Cached {@link probeEgressAvailable}. `available` = the bwrap-sandbox probe. */
+function egressAvailable(available) {
+    if (cachedEgressAvailable === undefined) {
+        cachedEgressAvailable = probeEgressAvailable(available);
+    }
+    return cachedEgressAvailable;
+}
+/**
+ * Parse `getent ahosts <host>` output into the unique IPs, split by family. The
+ * first whitespace token of each line is an address; `:` marks IPv6. Pure, so the
+ * resolution-parsing is unit-tested without touching DNS.
+ */
+function parseGetent(stdout) {
+    const v4 = new Set();
+    const v6 = new Set();
+    for (const line of stdout.split("\n")) {
+        const ip = line.trim().split(/\s+/)[0];
+        if (!ip)
+            continue;
+        if (ip.includes(":"))
+            v6.add(ip);
+        else if (/^\d+\.\d+\.\d+\.\d+$/.test(ip))
+            v4.add(ip);
+    }
+    return { v4: [...v4], v6: [...v6] };
+}
+/** Resolve a host to IPs via the system resolver (`getent`, synchronous). */
+function getentLookup(host) {
+    /* v8 ignore start -- shells out to the real resolver; the parse is parseGetent */
+    const res = (0, node_child_process_1.spawnSync)("getent", ["ahosts", host], {
+        encoding: "utf-8",
+        timeout: 10_000,
+    });
+    return parseGetent(res.stdout ?? "");
+    /* v8 ignore stop */
+}
+/**
+ * Resolve every allowlisted host to IPs. The lookup is injectable so the
+ * empty-result / family-split behaviour is unit-tested with a fake resolver.
+ */
+function resolveAllow(hosts, lookup = getentLookup) {
+    return hosts.map((host) => {
+        const { v4, v6 } = lookup(host);
+        return { host, v4, v6 };
+    });
+}
+/** A loopback nameserver (127.0.0.0/8 or ::1) — e.g. systemd-resolved's
+ * 127.0.0.53 stub. Unreachable from inside the slirp4netns netns (which runs
+ * with `--disable-host-loopback`), so it must never be used as the in-netns
+ * resolver. GitHub-hosted runners ship exactly this stub, which is why the
+ * egress tests saw zero packets there. */
+function isLoopbackResolver(ip) {
+    return ip === "::1" || /^127\./.test(ip);
+}
+/**
+ * Nameservers usable from INSIDE the egress netns. Parses a resolv.conf body but
+ * drops loopback stubs (see {@link isLoopbackResolver}) — they can't be reached
+ * across the namespace — and falls back to a public resolver (8.8.8.8, which
+ * slirp4netns NATs out) when nothing routable remains.
+ */
+function parseResolvers(resolvConf) {
+    const out = [];
+    for (const line of resolvConf.split("\n")) {
+        const m = /^\s*nameserver\s+(\S+)/.exec(line);
+        if (m && !isLoopbackResolver(m[1]))
+            out.push(m[1]);
+    }
+    return out.length > 0 ? out : ["8.8.8.8"];
+}
+/** Escape an nft set comment label so a hostname can't break the ruleset. */
+function nftLabel(host) {
+    return host.replace(/[^A-Za-z0-9._:-]/g, "_");
+}
+/**
+ * Build the nftables ruleset that enforces the allowlist INSIDE the netns: a
+ * `policy drop` output chain that accepts loopback, established replies, DNS to
+ * the resolvers, and each allowlisted host's resolved IPs (a per-host `counter` +
+ * `comment "allow:<host>"` so the read-back maps traffic to a name), then a
+ * catch-all `log`+`counter`+`drop`. v4 and v6 are separate rules (an `inet` set
+ * can't mix families) sharing the host's comment. Pure → the ruleset is asserted
+ * in a unit test.
+ */
+function buildEgressNft(opts) {
+    const lines = [
+        "table inet vig {",
+        "  chain output {",
+        "    type filter hook output priority 0; policy drop;",
+        '    oifname "lo" accept',
+        "    ct state established,related accept",
+    ];
+    for (const r of opts.resolvers) {
+        const fam = r.includes(":") ? "ip6" : "ip";
+        lines.push(`    ${fam} daddr ${r} udp dport 53 counter accept comment "dns"`);
+        lines.push(`    ${fam} daddr ${r} tcp dport 53 counter accept comment "dns"`);
+    }
+    for (const h of opts.allow) {
+        const label = nftLabel(h.host);
+        if (h.v4.length > 0) {
+            lines.push(`    ip daddr { ${h.v4.join(", ")} } counter accept comment "allow:${label}"`);
+        }
+        if (h.v6.length > 0) {
+            lines.push(`    ip6 daddr { ${h.v6.join(", ")} } counter accept comment "allow:${label}"`);
+        }
+    }
+    lines.push('    log prefix "vig-drop " counter drop');
+    lines.push("  }", "}");
+    return lines.join("\n") + "\n";
+}
+/**
+ * Assemble the full bwrap argv for an allowlisted-egress run: the shared
+ * confinement args, the hook's added-back env, `CAP_NET_ADMIN` (so the in-netns
+ * wrapper can load nft), `--info-fd 3` (so the orchestrator learns the child PID
+ * to hand slirp4netns), the `VIG_*` paths the wrapper reads, and the trailing
+ * `sh -c <wrapper>`. Pure (the bwrap/setenv args are computed by the caller), so
+ * the assembled shape — caps, info-fd, the VIG_* env, the wrapper payload — is
+ * asserted in a unit test.
+ */
+function buildEgressBwrapArgv(opts) {
+    return [
+        ...opts.base,
+        // Override the host's /etc/resolv.conf (often a 127.0.0.53 stub) with one
+        // listing only netns-routable resolvers — placed after `base` so it shadows
+        // the `--ro-bind / /` copy.
+        "--ro-bind",
+        opts.resolvConf,
+        "/etc/resolv.conf",
+        "--cap-add",
+        "CAP_NET_ADMIN",
+        ...opts.setenv,
+        "--setenv",
+        "VIG_NETREADY",
+        opts.files.netready,
+        "--setenv",
+        "VIG_NFT",
+        opts.files.nft,
+        "--setenv",
+        "VIG_EVENT",
+        opts.files.event,
+        "--setenv",
+        "VIG_COUNTERS",
+        opts.files.counters,
+        "--setenv",
+        "VIG_IODIR",
+        opts.files.ioDir,
+        "--setenv",
+        "VIG_HOOK",
+        opts.command,
+        "--info-fd",
+        "3",
+        "sh",
+        "-c",
+        opts.wrapper,
+    ];
+}
+const COUNTER = /counter packets (\d+) bytes (\d+)/;
+const ALLOW_COMMENT = /comment "allow:([^"]+)"/;
+/**
+ * Parse `nft list chain inet vig output` back into per-host allowed counters and
+ * the aggregate drop counter. Sums multiple rules that share a host comment (the
+ * v4 + v6 split). Pure, so the read-back is unit-tested without a sandbox.
+ */
+function parseNftCounters(nftText) {
+    const allowed = new Map();
+    let dropped = { packets: 0, bytes: 0 };
+    for (const line of nftText.split("\n")) {
+        const c = COUNTER.exec(line);
+        if (!c)
+            continue;
+        const packets = Number(c[1]);
+        const bytes = Number(c[2]);
+        const a = ALLOW_COMMENT.exec(line);
+        if (a) {
+            const prev = allowed.get(a[1]) ?? { packets: 0, bytes: 0 };
+            allowed.set(a[1], {
+                packets: prev.packets + packets,
+                bytes: prev.bytes + bytes,
+            });
+        }
+        else if (line.includes("vig-drop") || /\bdrop\b/.test(line)) {
+            dropped = {
+                packets: dropped.packets + packets,
+                bytes: dropped.bytes + bytes,
+            };
+        }
+    }
+    return {
+        allowed: [...allowed.entries()].map(([host, v]) => ({ host, ...v })),
+        dropped,
+    };
+}
+/**
+ * Map parsed counters to the run result: one {@link EgressAttempt} per
+ * allowlisted host that saw traffic (`allowed: true`, with its packet/byte
+ * counts), plus the aggregate dropped counter. `ts` is stamped once per run (the
+ * counters are end-of-run totals, not per-connection events). Pure.
+ */
+function countersToResult(counters, now) {
+    const egress = counters.allowed
+        .filter((a) => a.packets > 0)
+        .map((a) => ({
+        host: a.host,
+        port: 0,
+        ts: now,
+        allowed: true,
+        packets: a.packets,
+        bytes: a.bytes,
+    }));
+    return { egress, egressDropped: counters.dropped };
+}
+//# sourceMappingURL=egress.js.map

package/dist/adapters/claude-code/eval-baseline.d.ts

@@ -0,0 +1,68 @@
+import type { EvalReport } from "./eval.js";
+import { type Comparison } from "./stats.js";
+/** Bumped only on a breaking change to the on-disk shape. */
+export declare const BASELINE_VERSION = 1;
+/** The committed baseline: the recorded `EvalReport`s, keyed by report name. */
+export interface BaselineFile {
+    readonly version: number;
+    /** ISO-8601 timestamp the baseline was recorded (provenance / future trend). */
+    readonly recordedAt: string;
+    /** Recorded reports, keyed by `report.name` (so multiple eval files coexist). */
+    readonly reports: Record<string, EvalReport>;
+}
+/** How a metric moved between baseline and current run. */
+export type DiffStatus = "regressed" | "improved" | "unchanged";
+/** One arm×metric comparison of a current run against the baseline. */
+export interface MetricDiff {
+    /** The `report.name` this entry belongs to. */
+    readonly report: string;
+    readonly arm: string;
+    readonly metric: string;
+    readonly status: DiffStatus;
+    /** Welch comparison, current vs. baseline (`delta = current − baseline`). */
+    readonly comparison: Comparison;
+}
+export interface BaselineDiff {
+    /** Every arm×metric present in BOTH the baseline and the current run. */
+    readonly entries: readonly MetricDiff[];
+    /** The subset that regressed (significant move in the bad direction). */
+    readonly regressions: readonly MetricDiff[];
+    /** The subset that improved (significant move in the good direction). */
+    readonly improvements: readonly MetricDiff[];
+    /** True when there are no regressions — the gate. */
+    readonly passed: boolean;
+}
+export interface DiffOptions {
+    /** Significance level for the Welch test. Default 0.05. */
+    readonly alpha?: number;
+    /**
+     * Metrics where a DECREASE is the improvement (e.g. `cost`, `latency`,
+     * `turns`). For these, a significant increase is the regression. Everything
+     * else is treated as higher-is-better.
+     */
+    readonly lowerIsBetter?: readonly string[];
+}
+/** Build a `BaselineFile` envelope from a run's reports (keyed by name). */
+export declare function toBaselineFile(reports: readonly EvalReport[], recordedAt?: string): BaselineFile;
+/** Parse + validate a baseline JSON string (throws on a bad version/shape). */
+export declare function parseBaselineFile(json: string): BaselineFile;
+/**
+ * Diff a current run against a committed baseline. Compares every arm×metric
+ * present in both (by report name), flagging a *significant* move in the
+ * undesired direction as a regression. Metrics absent from one side are skipped
+ * (a new arm/metric is not a regression).
+ */
+export declare function diffReports(baseline: BaselineFile, current: readonly EvalReport[], opts?: DiffOptions): BaselineDiff;
+/** Format a baseline diff as a compact console report. */
+export declare function formatBaselineDiff(diff: BaselineDiff): string;
+/**
+ * Render a baseline diff as JUnit XML — one `<testcase>` per arm×metric, a
+ * `<failure>` for each regression. Lets a CI provider show eval regressions in
+ * the same place as unit-test failures.
+ */
+export declare function diffToJUnit(diff: BaselineDiff): string;
+/** Read + parse a baseline file, or null if it doesn't exist yet. */
+export declare function readBaseline(path: string): BaselineFile | null;
+/** Write reports as the committed baseline (pretty JSON, parent dirs created). */
+export declare function writeBaseline(path: string, reports: readonly EvalReport[]): void;
+//# sourceMappingURL=eval-baseline.d.ts.map