dckcandClaude Opus 5.5
f0557d29d6
The switchboard now serves a Cap'n Web Handle on each of its sockets:
public (no loopback or private addresses) and local. A socket's labels
are fixed in config, so holding the socket's fd is holding that handle;
constrain(labels) returns a narrower one, as Flower's Constrain returns
a narrower fd. Labels only accumulate: a missing key matches anything,
and a key both sides set must agree (labels.js, shared by both).
The switchboard enforces the labels; toybox's Egress no longer checks
URLs itself. It opens a session to its one switchboard socket, constrains
the handle to the vat's grant, and forwards through it; a WebSocket
crosses the session as a pair of message streams. A vat narrows its own
grant with env.egress.constrain().
Grants are now labels as JSON. One stored before, a bare host[:port],
reads as {host, port}.
pnpm start and the systemd units give toybox the public handle; the
switchboard unit binds the local one in its own 0700 runtime directory.
The tests give their toybox the local handle to reach an echo server,
and check that a toybox holding only the public one never reaches it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
102 lines
2.9 KiB
YAML
102 lines
2.9 KiB
YAML
lockfileVersion: '9.0'
|
|
|
|
settings:
|
|
autoInstallPeers: true
|
|
excludeLinksFromLockfile: false
|
|
|
|
importers:
|
|
|
|
.:
|
|
dependencies:
|
|
capnweb:
|
|
specifier: 0.12.0
|
|
version: 0.12.0
|
|
devDependencies:
|
|
workerd:
|
|
specifier: 1.20261006.1
|
|
version: 1.20261006.1
|
|
ws:
|
|
specifier: 8.22.0
|
|
version: 8.22.0
|
|
|
|
packages:
|
|
|
|
'@cloudflare/workerd-darwin-64@1.20261006.1':
|
|
resolution: {integrity: sha512-lCX6avJO2It9AyDEYitjmOtJRVp/xmaW0TziyoLAnfxlzozyyRbSFfIIMMCiDx/sTP1++E4VLbV+7BHSD33f0Q==}
|
|
engines: {node: '>=16'}
|
|
cpu: [x64]
|
|
os: [darwin]
|
|
|
|
'@cloudflare/workerd-darwin-arm64@1.20261006.1':
|
|
resolution: {integrity: sha512-PyFGjOaldtppnLuKsdkoYWXfLVpDjuf8u+uoykX+1Xvxo2EPmCVViq0iDKm+U7c7PRno85ehS3/MPVXyk2HwHw==}
|
|
engines: {node: '>=16'}
|
|
cpu: [arm64]
|
|
os: [darwin]
|
|
|
|
'@cloudflare/workerd-linux-64@1.20261006.1':
|
|
resolution: {integrity: sha512-Ntf9S8eesmVufdjaT2kzWlz6Ng9XGYTc6cHQVRKAg59lFufwsIabGeMT6U4KkrpEeSIxgHq8aPtuLbZXE19tCA==}
|
|
engines: {node: '>=16'}
|
|
cpu: [x64]
|
|
os: [linux]
|
|
|
|
'@cloudflare/workerd-linux-arm64@1.20261006.1':
|
|
resolution: {integrity: sha512-JyeDBymVWw5tVRebSsVE8ojDYxd6UlZrAseHU8G+NpIyd5wF61tXlF/axLeCUqu0pOhBFHb8I5QKi0jwrCK41Q==}
|
|
engines: {node: '>=16'}
|
|
cpu: [arm64]
|
|
os: [linux]
|
|
|
|
'@cloudflare/workerd-windows-64@1.20261006.1':
|
|
resolution: {integrity: sha512-nWP0URNqOBN9fa/gZ7eh/w051DwjOXN8j4lDZDYVXyQPsux6sV3DfyYZT+CjR/rt9nKBSmJT9QE9/bWT18+84w==}
|
|
engines: {node: '>=16'}
|
|
cpu: [x64]
|
|
os: [win32]
|
|
|
|
capnweb@0.12.0:
|
|
resolution: {integrity: sha512-jgZ/LMtMVTi+RVlooIslH78Gg23XbDTdvcLghWx3oz17D6u5GuJARt+uhZk/wcTo+f81eeabfnow4d3zLBj+JQ==}
|
|
|
|
workerd@1.20261006.1:
|
|
resolution: {integrity: sha512-8MadBuffZ5NdpLwZjUmsqT5QlaKXq4gjgT6wzcKeynZTICNXyePhc+5QVoKiK7+MMhFTLNrRO2KXLlpk8Q6BkA==}
|
|
engines: {node: '>=16'}
|
|
hasBin: true
|
|
|
|
ws@8.22.0:
|
|
resolution: {integrity: sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==}
|
|
engines: {node: '>=10.0.0'}
|
|
peerDependencies:
|
|
bufferutil: ^4.0.1
|
|
utf-8-validate: '>=5.0.2'
|
|
peerDependenciesMeta:
|
|
bufferutil:
|
|
optional: true
|
|
utf-8-validate:
|
|
optional: true
|
|
|
|
snapshots:
|
|
|
|
'@cloudflare/workerd-darwin-64@1.20261006.1':
|
|
optional: true
|
|
|
|
'@cloudflare/workerd-darwin-arm64@1.20261006.1':
|
|
optional: true
|
|
|
|
'@cloudflare/workerd-linux-64@1.20261006.1':
|
|
optional: true
|
|
|
|
'@cloudflare/workerd-linux-arm64@1.20261006.1':
|
|
optional: true
|
|
|
|
'@cloudflare/workerd-windows-64@1.20261006.1':
|
|
optional: true
|
|
|
|
capnweb@0.12.0: {}
|
|
|
|
workerd@1.20261006.1:
|
|
optionalDependencies:
|
|
'@cloudflare/workerd-darwin-64': 1.20261006.1
|
|
'@cloudflare/workerd-darwin-arm64': 1.20261006.1
|
|
'@cloudflare/workerd-linux-64': 1.20261006.1
|
|
'@cloudflare/workerd-linux-arm64': 1.20261006.1
|
|
'@cloudflare/workerd-windows-64': 1.20261006.1
|
|
|
|
ws@8.22.0: {}
|