Merge pull request #115 from makeitfutureDev/release/0.6.0

Release 0.6.0

Author: makeitfutureDev

AGENTS.md

@@ -20,8 +20,9 @@ see [README.md](./README.md).
   claude login          # or set ANTHROPIC_API_KEY
   claude --version      # must work
   ```
-- **(Optional) OpenAI Codex CLI** — only if you'll use the Codex engine. Its host sign-in file is
-  bind-mounted into the channel containers (sessions stay per channel; the sign-in is shared):
+- **(Optional) OpenAI Codex CLI** — only if you'll use the Codex engine. Its host sign-in is
+  relayed into the channel containers through the egress proxy — each container gets an access-only
+  stand-in, never the host's login file (sessions stay per channel):
   ```bash
   npm install -g @openai/codex
   codex login           # or set OPENAI_API_KEY

CHANGELOG.md

@@ -284,14 +284,19 @@ background and scheduled engine run uses the same runtime boundary.
    work/runtime mounts. Other channel workspaces and the operator's home are excluded by default.
    An explicit, off-by-default Full-access home-sharing option exposes the operator's whole home
    to admitted authors in those channels; choose shared work folders and this option deliberately.
-2. **Network access is not an egress firewall.** Containers use bridge networking. The
-   *Allow network* switch communicates policy to the engines; there is no domain filtering or
-   container-level egress cut-off in this release.
-3. **Usable credentials have runtime exposure.** Claude's host credentials file is never copied
-   or mounted; runs receive a relay of its access token or a configured credential. Codex's host
-   sign-in file is shared with its containers while sessions stay per channel. Protected transient
-   MCP artifacts can contain credentials. Channel environment secrets have no reveal endpoint,
-   but an agent using them can access their runtime values; masking and redaction are not a vault.
+2. **Egress goes through a per-channel proxy.** Containers run with no network of their own; the
+   daemon's egress proxy is their only way out. It enforces the *Allow network* switch on every
+   request (off: engine endpoints and selected connectors only), always refuses private, loopback
+   and cloud-metadata addresses, and has no per-domain allow-list when the switch is on. The
+   legacy open-bridge mode and a channel's raw-socket escape make the switch advisory again.
+3. **Usable credentials have runtime exposure, reduced by placeholders.** Claude's host credentials
+   file is never copied or mounted; containers receive a placeholder for the relayed access token,
+   swapped in by the egress proxy on the Anthropic API only. Secrets with an egress rule (built in
+   for GitHub, Vercel, Supabase, Make and Composio tokens, or declared "used on hosts") are
+   placeholders too; any other secret is injected raw and flagged unprotected. Codex's host sign-in
+   file is still shared with its containers while sessions stay per channel. Channel environment
+   secrets have no reveal endpoint, but an agent can use whatever it is given; masking and
+   redaction are not a vault.
 4. **Authorization is checked before a run.** Channel use/manage policies and guest grants are
    enforced; unknown users without a guest grant are denied, and DMs require approval or admin status. Admin bypass needs an admin author and Admin mode. API callers cannot
    claim personal connector identities or widen a channel's durable tool permissions.

FEATURES.md

@@ -52,7 +52,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 # this layer.
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
-      ca-certificates curl ffmpeg git jq less openssh-client openssh-server pipx postgresql-client procps python3 python3-pip python3-venv ripgrep tini unzip \
+      bubblewrap ca-certificates curl ffmpeg git jq less openssh-client openssh-server pipx postgresql-client procps python3 python3-pip python3-venv ripgrep tini unzip \
  && rm -f /etc/ssh/ssh_host_*_key /etc/ssh/ssh_host_*_key.pub \
  && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
  && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \

INSTALL.md

@@ -0,0 +1,9 @@
+#!/bin/sh
+# cg-egress-connect — an SSH ProxyCommand through the gateway's egress proxy (docs/SSH-ACCESS.md).
+# A `--network none` channel container has no route of its own; this speaks `CONNECT host:port` to
+# the in-container forwarder (127.0.0.1:3128) and pipes stdio through the raw tunnel the proxy
+# allows (github.com:22, plus the channel's declared raw hosts, with Allow network on). An SSH
+# session's GIT_SSH_COMMAND already uses it; for your own ssh:
+#   ssh -o ProxyCommand='/opt/channelgate/bin/cg-egress-connect %h %p' user@host
+# The implementation is bin/cg-egress-connect.mjs, staged verbatim from src/mcp/egress-connect.js.
+exec node /opt/channelgate/bin/cg-egress-connect.mjs "$@"

README.md

@@ -45,6 +45,28 @@ if [ -d "$VSCODE_SHARED" ] && [ ! -e "$VSCODE_HOME/.cg-no-shared-server" ]; then
   done
 fi
 
+# The egress forwarder (container-secrets P2). A proxy-mode container is created with
+# `--network none`: its only way out is 127.0.0.1:3128 (HTTPS_PROXY), which cg-egress pipes to the
+# daemon's per-channel egress socket. Started in the background on EVERY start (a stop kills it with
+# everything else), only when the daemon created this container with CG_EGRESS=proxy. It never
+# exits on an error, and a second copy just finds the port taken. Its failure lines (at most one
+# per category a minute) go to /run/cg/egress.log on the /run tmpfs: readable with `podman exec`,
+# gone at the next start.
+if [ "${CG_EGRESS:-}" = "proxy" ] && [ -f /opt/channelgate/bin/cg-egress.mjs ]; then
+  node /opt/channelgate/bin/cg-egress.mjs </dev/null >/dev/null 2>>/run/cg/egress.log &
+fi
+
+# Codex behind the egress proxy (container-secrets P4) is RELAYED: before each Codex run the daemon
+# writes an ACCESS-ONLY auth.json here (a placeholder token, an EMPTY refresh token). So under the
+# proxy a Codex login file in this volume that carries a refresh token is never the daemon's — it is
+# a leftover from before the relay (an old copy of a real login) — and is removed on every start.
+# A mounted file (the shared-file mode an API-key login keeps) is never touched.
+CODEX_AUTH=/home/agent/.codex/auth.json
+if [ "${CG_EGRESS:-}" = "proxy" ] && [ -f "$CODEX_AUTH" ] && ! grep -q " $CODEX_AUTH " /proc/self/mountinfo 2>/dev/null \
+   && grep -q '"refresh_token"[[:space:]]*:[[:space:]]*"[^"]' "$CODEX_AUTH" 2>/dev/null; then
+  rm -f "$CODEX_AUTH"
+fi
+
 # Claude credentials are NEVER copied in here: the daemon hands the engine a `claude setup-token`
 # value through the exec environment (CLAUDE_CODE_OAUTH_TOKEN). A copy of the gateway's own login
 # would refresh, rotate the refresh token and log the gateway itself out (2026-09-02 incident).

TEST-PLAN.md

@@ -1,11 +1,11 @@
 {
-  "imageSpecVersion": "1.5.1",
+  "imageSpecVersion": "1.6.1",
   "comment": "Pinned toolchain for the channel image. Keep `claude` and `codex` at the versions the gateway host runs, so a channel behaves identically on either runtime backend; bump deliberately, rebuild, and let the image-id fingerprint recreate the containers. `imageSpecVersion` is the image CONTRACT (paths, PATH, baked-in packages), not the pins: bump it when the image gains or moves something the daemon relies on, keep it equal to IMAGE_SPEC_VERSION in src/runtimes/container/image-paths.js (a test pins them together), and the daemon will tell an operator at boot when the built image is older.",
   "base": "node:22-bookworm-slim",
   "npm": {
     "@anthropic-ai/claude-code": "2.1.281",
     "@openai/codex": "0.156.1",
-    "mcp-remote": "0.8.3",
+    "mcp-remote": "0.14.3",
     "vercel": "59.11.1",
     "supabase": "2.116.0",
     "playwright": "1.63.0",