This makes unrestricted sandbox network access an explicit sandbox mode
instead of a fallback when the enforcing proxy is unavailable.
Host-specific network access still uses the proxy, while approved
arbitrary network access skips proxy setup and maps directly to
unrestricted egress.
Release Notes:
- Improved agent terminal sandbox network permission handling.
---------
Co-authored-by: Martin Ye <martin@zed.dev>
Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
Third of the `http_proxy` stack. Stacked on #59217 and the
upstream-config PR — review/merge those first.
Adds the in-process HTTP/HTTPS proxy server that enforces an
`Allowlist`. It speaks HTTP CONNECT for HTTPS tunnels and forward
proxying for plain HTTP, vets resolved addresses against
loopback/private/link-local ranges to prevent DNS-rebinding past the
sandbox, pins each connection to the destination approved for its first
request (so later keep-alive requests can't escape the policy decision),
optionally chains through the upstream proxy, and bounds header sizes,
connection counts, and connect/handshake waits since its sole client is
untrusted model-driven code running inside the editor process. Includes
end-to-end tests covering allowed/denied CONNECT and HTTP forward,
IP-literal handling, DNS-rebinding denial, and upstream chaining.
Still has no callers; wired into the agent terminal sandbox in the
remaining PRs of the stack.
Release Notes:
- N/A
---------
Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
Second of the `http_proxy` stack. Stacked on #59217 — review/merge that
first; this PR's diff is just the upstream-proxy config.
Adds `UpstreamProxy`: parsing of an upstream HTTP proxy from the
environment (`HTTPS_PROXY` / `HTTP_PROXY` / `ALL_PROXY` and lowercase
forms) with `NO_PROXY` bypass matching delegated to the `proxyvars`
crate, basic-auth credentials kept out of `Debug`/`Display`, and
IPv6/default-port normalization. The proxy server (next PR) uses this to
chain outbound connections through a corporate proxy when one is
configured.
Release Notes:
- N/A
First of a stack adding hostname-allowlisted network access to agent
terminal sandboxing. Adds a new `http_proxy` crate containing only the
allowlist policy types.
`HostPattern` parses exact hostnames or leading-`*.` subdomain
wildcards, normalizes IDNs to punycode, and rejects IP literals and
localhost-family names. `Allowlist` holds a set of patterns (or an
allow-any escape hatch), and `covers` implements host-pattern
subsumption (`*.github.com` covers `api.github.com`) used later to
decide when an already-granted permission covers a new request — the
network analogue of write-path subtree containment.
Pure, self-contained logic with no callers yet. The upstream-proxy
config and the proxy server that enforces these policies land in the
next two PRs.
Release Notes:
- N/A
