Bounded network egress for sandboxed kernels by KB-syntheticsciences · Pull Request #280 · synthetic-sciences/openscience

docs: ADR for a three-state sandbox network policy

KB (KB-syntheticsciences)

committed

c51c4b6

docs: mark ADR 0002's forward decisions apart from its measurements

KB (KB-syntheticsciences)

committed

a887206

feat(sandbox): allowlist egress proxy and loopback shim

KB (KB-syntheticsciences)

committed

74d9388

feat(sandbox): three-state network policy with a socket egress route

KB (KB-syntheticsciences)

committed

e55ce20

fix(sandbox): close the egress-as-write-escape gap, correct stale comments

KB (KB-syntheticsciences)

committed

6d8d9a3

fix(sandbox): normalize egress through dedupe before the over-broad check

KB (KB-syntheticsciences)

committed

c602246

feat(sandbox): bridge loopback to the egress socket inside the namespace

KB (KB-syntheticsciences)

committed

05cb7db

fix(sandbox): shim must not touch CLI middleware, resolve entry structurally

KB (KB-syntheticsciences)

committed

d2633b6

fix(sandbox): bind the shim's launcher explicitly, don't rely on its location

KB (KB-syntheticsciences)

committed

4ebae67

fix(sandbox): bind the interpreter too, and stop shadowing writable overlaps

KB (KB-syntheticsciences)

committed

efc101e

fix(sandbox): bundle the dev egress shim so it resolves nothing from disk

KB (KB-syntheticsciences)

committed

412cc8d

fix(sandbox): classify the shim bundle's imports against the real builtin list

KB (KB-syntheticsciences)

committed

312dccd

feat(sandbox): egress proxy lifecycle and allowlist config

KB (KB-syntheticsciences)

committed

d368520

fix(sandbox): wire the egress proxy into every wrapArgv/plan caller

KB (KB-syntheticsciences)

committed

f048be8

fix(sandbox): honour write backpressure, unlatch proxy start, cut spawn latency

KB (KB-syntheticsciences)

committed

ca6edf8

fix(sandbox): one upstream per client, and none left behind

KB (KB-syntheticsciences)

committed

3bfc983

fix(sandbox): bound what one client can make the host allocate

KB (KB-syntheticsciences)

committed

de016f5

fix(sandbox): wire allowHosts, widen the CLI network enum, unify egress defaults

KB (KB-syntheticsciences)

committed

e509136

test(sandbox): prove egress is bounded and is the only route

KB (KB-syntheticsciences)

committed

fce582b

fix(sandbox): give curl headroom under the outer test timeout

KB (KB-syntheticsciences)

committed

00159ab

fix(sandbox): ro-bind the egress socket so a sandboxed process can't chmod it shut

KB (KB-syntheticsciences)

committed

30934e8

fix(sandbox): let the settings GUI represent allowlist, add allowHosts editor

KB (KB-syntheticsciences)

committed

c0a7b15

docs(sandbox): correct macOS/allowlist claims across ADR, docs, and frontend types

KB (KB-syntheticsciences)

committed

c7f1dd0

Navigation Menu

Uh oh!

Bounded network egress for sandboxed kernels - #280

Bounded network egress for sandboxed kernels#280
KB (KB-syntheticsciences) wants to merge 33 commits into
mainfrom
feat/sandbox-network-policy

Commits on Aug 10, 2026

docs: ADR for a three-state sandbox network policy

docs: mark ADR 0002's forward decisions apart from its measurements

feat(sandbox): allowlist egress proxy and loopback shim

feat(sandbox): three-state network policy with a socket egress route

fix(sandbox): close the egress-as-write-escape gap, correct stale comments

fix(sandbox): normalize egress through dedupe before the over-broad check

feat(sandbox): bridge loopback to the egress socket inside the namespace

fix(sandbox): shim must not touch CLI middleware, resolve entry structurally

fix(sandbox): bind the shim's launcher explicitly, don't rely on its location

fix(sandbox): bind the interpreter too, and stop shadowing writable overlaps

fix(sandbox): bundle the dev egress shim so it resolves nothing from disk

fix(sandbox): classify the shim bundle's imports against the real builtin list

feat(sandbox): egress proxy lifecycle and allowlist config

fix(sandbox): wire the egress proxy into every wrapArgv/plan caller

fix(sandbox): honour write backpressure, unlatch proxy start, cut spawn latency

fix(sandbox): one upstream per client, and none left behind

fix(sandbox): bound what one client can make the host allocate

fix(sandbox): wire allowHosts, widen the CLI network enum, unify egress defaults

test(sandbox): prove egress is bounded and is the only route

fix(sandbox): give curl headroom under the outer test timeout

fix(sandbox): ro-bind the egress socket so a sandboxed process can't chmod it shut

fix(sandbox): let the settings GUI represent allowlist, add allowHosts editor

docs(sandbox): correct macOS/allowlist claims across ADR, docs, and frontend types

Commits on Aug 11, 2026

feat(sandbox): macOS seatbelt support for network:"allowlist"

fix(sandbox): darwin proxy must listen on TCP directly, not bridge to the unix socket, and must require Proxy-Authorization

fix(sandbox): fix round 1 — match the ADR's seatbelt reference shape, fail closed on a cached-wrong-platform proxy, fix two tests, pin the auth seam with real clients

docs(sandbox): record seatbeltProfile's network-bind/inbound residual (fix round 2)

docs: Windows sandbox design — AppContainer plus a broker

test(sandbox): first-ever macOS CI leg for seatbelt network:"allowlist"

fix: make the shim readiness cap a deadline, and pin platform in tests

Merge branch 'main' into feat/sandbox-network-policy

test: poll on the asserted predicate in the allowHosts round-trip

test: pip install under network "allowlist", live, on both backends