Module net 

Network diagnostics — the executor behind brain net check/trace/cert and the net.check / net.trace / net.cert native capabilities (Issue 139).

Three probes, each with a structured report and a render() for human/LLM output:

• check — DNS resolution + a timed TCP connect to a host[:port]. Pure Rust (std + tokio), no subprocess, no sandbox concern.
• cert — a TLS handshake that captures the presented certificate chain with a permissive verifier, so it can inspect expired / self-signed / untrusted certs and report the problem rather than fail. X.509 fields (subject, issuer, validity, SANs) are parsed with x509-cert. Also pure Rust.
• trace — traceroute (Unix). traceroute needs privileged raw sockets, so — exactly like brain logs analyze --source system — it runs as a timeout-bounded child process rather than inside the exec sandbox (Apple’s Seatbelt and Linux namespaces both deny the raw-socket path). This is the macOS-sandbox gotcha called out for slice 139.

The same core functions back both surfaces: the CLI calls them directly and prints render(); NetDiagnostics wraps them to satisfy the cortex::actions::NetDiagnosticsBackend trait the chat tool-loop dispatches through.

Structs

CertReport

Result of a TLS certificate inspection.

CheckReport

Result of a reachability check.

NetDiagnostics

The cortex::actions::NetDiagnosticsBackend implementation. Each method runs the matching probe and returns the rendered report (or an error string the dispatcher relays). The chat tool-loop dispatches net.check/trace/cert through this; the CLI calls the free functions above directly.

TraceReport

Result of a traceroute.

Enums

NetError

Errors from a network probe.

Constants

DEFAULT_PORT

Default port used when a check/cert target names only a host. 443 is the most useful default for a local-first kernel probing HTTPS API endpoints.

Functions

capabilities

The capabilities this backend declares: read-only network diagnostics (check/trace/cert). Always wired — they neither search nor fetch, so they don’t track actions.web_search; egress consent is enforced at dispatch.

cert

Open a TLS connection to target and report on the presented certificate.

check

Resolve target and time a TCP connect to it.

trace

Trace the route to target. traceroute needs privileged raw sockets, so it runs as a timeout-bounded child process (not inside the exec sandbox, which denies the raw-socket path on both macOS Seatbelt and Linux namespaces — the same reason brain logs analyze --source system bypasses it).