lonca_daemon/
proxy.rs

1//! The Lonca network proxy (observation level H2).
2//!
3//! The harness sandbox routes every outbound connection of sandboxed shell
4//! commands here (Claude Code: `sandbox.network.httpProxyPort`). Each
5//! connection is logged as an observation of the session it belongs to,
6//! which taints that session; repository policy may refuse it instead.
7//! The proxy itself lives in `lonca-net`; this module is Lonca's gate.
8
9use std::net::TcpListener;
10use std::sync::Arc;
11
12pub use lonca_net::{bind, is_private, peer_cwd};
13
14use crate::service::Service;
15
16impl lonca_net::Gate for Service {
17    fn decide(&self, request: &lonca_net::Request<'_>) -> lonca_net::Verdict {
18        let verdict = self.proxy_connect(
19            peer_cwd(request.peer, request.local).as_deref(),
20            request.host,
21            request.port,
22            request.peer,
23        );
24        lonca_net::Verdict {
25            allow: verdict.allow,
26            allow_private: verdict.allow_private,
27            reason: verdict.reason,
28        }
29    }
30
31    fn finished(&self, request: &lonca_net::Request<'_>, _outcome: lonca_net::Outcome) {
32        self.proxy_finished(request.peer);
33    }
34
35    fn carried(&self, request: &lonca_net::Request<'_>, bytes: u64) -> bool {
36        self.proxy_carried(request.peer, bytes)
37    }
38}
39
40pub fn serve(listener: TcpListener, svc: Arc<Service>) {
41    lonca_net::serve(listener, svc);
42}
lonca_daemon/proxy.rs

lonca_daemon/
proxy.rs
