tenant.openagents/omega

1//! In-process HTTP/HTTPS proxy that enforces a hostname allowlist.
2//!
3//! Spawned per terminal command from the parent process. The sandbox is
4//! configured to permit network only to this proxy's port; everything the
5//! sandboxed command tries to reach the network for has to come through here.
6//!
7//! The proxy:
8//!
9//! - Speaks HTTP CONNECT for HTTPS tunnels and HTTP forward proxying for
10//!   plain HTTP. Other protocols cannot reach it (the seatbelt rule limits
11//!   the sandboxed process to this one TCP destination, and this proxy only
12//!   speaks HTTP).
13//! - Checks the destination hostname against an allowlist of exact hostnames
14//!   and leading-`*.` subdomain wildcards. Unless the allowlist allows any
15//!   host, IP-literal targets are denied, and hostnames whose DNS resolves
16//!   only into loopback / private / link-local space are denied too
17//!   (DNS-rebinding protection — the proxy runs outside the sandbox, so it
18//!   must not reopen the local network the Seatbelt rule closed off).
19//! - Pins each TCP connection to the destination approved for its first
20//!   request: directly (to the vetted resolved addresses) or via a CONNECT
21//!   tunnel through an optional upstream HTTP proxy from the parent's
22//!   environment (`HTTPS_PROXY` / `HTTP_PROXY`), honoring `NO_PROXY`. Plain
23//!   HTTP is also tunneled when chaining, so keep-alive requests after the
24//!   first can never be routed to a different host by the upstream.
25//! - Reports per-connection events (allowed, denied, completed) over an
26//!   mpsc supplied by the caller.
27//!
28//! ## Trust assumptions
29//!
30//! The proxy's sole client is model-driven code running inside the sandbox —
31//! exactly the party the sandbox distrusts — and the proxy itself runs inside
32//! the editor process. It therefore caps request header sizes and concurrent
33//! connections, and bounds connect/handshake waits with timeouts, so a
34//! malicious command can't exhaust the editor's memory, threads, or file
35//! descriptors through it. Bandwidth is deliberately not capped; the
36//! command's lifetime bounds it.
37//!
38//! ## "No proxy here" principle
39//!
40//! The agent and tools running inside the sandbox should not need to know
41//! that a proxy is in front of them. The only response code the proxy
42//! synthesizes itself is `511 Network Authentication Required`, used solely
43//! for policy denials (with `Via:` and `Proxy-Status:` headers and a
44//! plain-text body explaining the policy decision). Other failure modes
45//! (upstream connection failure, malformed input from the client, etc.) are
46//! handled by silently closing the connection — same behavior the client
47//! would see from a direct network failure, no proxy fingerprint.
48
49mod allowlist;
50mod pinned_host;
51mod proxy;
52
53pub use allowlist::{Allowlist, HostPattern, HostPatternError};
54pub use pinned_host::{PinnedHost, PinnedHostError, is_forbidden_ip};
55pub use proxy::{
56    DenyReason, ProxyConfig, ProxyEvent, ProxyHandle, RequestMethod, RequestOutcome, UpstreamProxy,
57};
58