lonca-daemon 0.2.0

The Lonca daemon: the single writer every operation goes through (decide, sign, log, apply)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

//! The Lonca network proxy (observation level H2).
//!
//! The harness sandbox routes every outbound connection of sandboxed shell
//! commands here (Claude Code: `sandbox.network.httpProxyPort`). Each
//! connection is logged as an observation of the session it belongs to,
//! which taints that session; repository policy may refuse it instead.
//! The proxy itself lives in `lonca-net`; this module is Lonca's gate.

use std::net::TcpListener;
use std::sync::Arc;

pub use lonca_net::{bind, is_private, peer_cwd};

use crate::service::Service;

impl lonca_net::Gate for Service {
    fn decide(&self, request: &lonca_net::Request<'_>) -> lonca_net::Verdict {
        let verdict = self.proxy_connect(
            peer_cwd(request.peer, request.local).as_deref(),
            request.host,
            request.port,
            request.peer,
        );
        lonca_net::Verdict {
            allow: verdict.allow,
            allow_private: verdict.allow_private,
            reason: verdict.reason,
        }
    }

    fn finished(&self, request: &lonca_net::Request<'_>, _outcome: lonca_net::Outcome) {
        self.proxy_finished(request.peer);
    }

    fn carried(&self, request: &lonca_net::Request<'_>, bytes: u64) -> bool {
        self.proxy_carried(request.peer, bytes)
    }
}

pub fn serve(listener: TcpListener, svc: Arc<Service>) {
    lonca_net::serve(listener, svc);
}