Module proxy 

The Lonca network proxy (observation level H2).

The harness sandbox routes every outbound connection of sandboxed shell commands here (Claude Code: sandbox.network.httpProxyPort). Each connection is logged as an observation of the session it belongs to, which taints that session; repository policy may refuse it instead. The proxy itself lives in lonca-net; this module is Lonca’s gate.

Functions

bind

Binds the proxy. Only loopback addresses are accepted: the proxy is for processes on this machine.

is_private

Whether ip is anything but the public internet: this computer, its network, a link, a documentation or benchmarking range, multicast or reserved, or any of those inside an IPv6 address (mapped, NAT64, or the old IPv4-compatible form).

peer_cwd

Working directory of the process on the other end of peer, if the operating system tells us (same user only).

serve