Constant NETWORK_COMMANDS 

pub const NETWORK_COMMANDS: &[&str];

Shell commands that perform outbound network egress.

Used both to derive ShellConfig::allow_network’s effective blocklist entries here, and by check_blocklist callers outside this module (e.g. zeph-subagent’s NetworkDenyToolExecutor) that need to block network egress for a single sub-agent spawn without mutating the shared executor’s global policy.

Beyond the classic HTTP/TCP fetch tools (curl, wget, nc/ncat/netcat), this also covers remote-access and generic-egress vectors that a network-denied sub-agent could otherwise reach for: ssh/scp/rsync (remote shell/copy), openssl s_client and socat (raw TCP), and one-liner script interpreters (python3 -c, python -c, perl -e, ruby -e) that can open sockets via their standard library. This is a best-effort, substring/prefix blocklist — see check_blocklist doc — not a sandbox boundary.

Known residual gaps (a name blocklist cannot be exhaustive; these are not covered, not merely “arbitrary in-language networking hidden behind a script file”):

• Flag insertion before -c/-e defeats the prefix match: python3 -B -c '...', perl -MIO::Socket -e '...' are one inserted token away from bypassing the python3 -c / perl -e entries, since the underlying multi-word matcher only matches a contiguous prefix starting at token 0.
• Versioned or alternate interpreter names not in this list: python3.11 -c, python2 -c, pypy3 -c (basename differs from python3/python), and interpreters not listed at all (node -e, php -r, lua -e, deno, bun, gawk).
• Wrapper commands not in the transparent-prefix list (env, command, exec, nice, nohup, time, xargs) — e.g. busybox nc host port — bypass entirely, since the wrapped nc invocation is never reached.