A refused host is said out loud on the app page, and allowing it is one switch #10597

A refused egress host is now recorded per app, shown on the app's settings page with an Allow switch, sent to notifications once, and named in the crew's brief. The earlier check failed for a reason I didn't find in the log. Gate, tsc, design-lint and 256 related tests (224 pass, 32 skipped) were clean here. The last commit had already fixed the why_now.ts entry. I merged current main, took main's own fix for test/child-quota.test.ts, and pushed.

What changed

• Recording: src/apps/egress_refused.ts records each refused host per repository with host, port, first and last time, and a count. It keeps one row per host and flushes to disk every 5 seconds, so it never floods the log. src/apps/egress.ts and src/apps/runtime.ts feed it.
• App page: src/web/pages/settings.ts and src/web/studio/blocked.ts show "Blocked: host (N tries, last 2 min ago)" with Allow, Deny and Forget. The action lives in src/actions/egress_refused.ts.
• Allow: it takes effect within seconds with no redeploy, and commits to forge.json egress with the owner as author.
• Wildcards: egress_refused.ts only offers one for redirect hosts actually seen, such as *.hf.co.
• Private, LAN and tailnet destinations: these still need the site admin. An app owner can't allow them.
• Notifications and brief: the first refusal of a host goes to the owner's notifications (src/crew/notify.ts), and src/crew/brief.ts and src/crew/app_hosts.ts name refused hosts in the crew's brief.
• Terminal: src/tui/screens/blocked.ts adds a Blocked hosts screen.
• Tests: test/egress-refused.test.ts covers a refused host appearing on the app page and in notifications, Allow letting the next request pass without a redeploy, and a LAN address staying blocked for a non-admin owner.

Left out

• Wildcard suggestions for hosts never seen redirecting.
• Counts only cover production runs, not previews.

Not run here

• The cell and unix-socket suites are skipped in this sandbox, and the crew-settings phone-layout test skipped because no chromium starts here. The forge's check covers both.

Try it Set cells.egress=enforce, run an app that fetches an undeclared host, then open the app's settings page and press Allow.

Closes #10456

A refused egress host is now recorded per app, shown on the app's settings page with an Allow switch, sent to notifications once, and named in the crew's brief. The earlier check failed for a reason I didn't find in the log. Gate, tsc, design-lint and 256 related tests (224 pass, 32 skipped) were clean here. The last commit had already fixed the why_now.ts entry. I merged current main, took main's own fix for test/child-quota.test.ts, and pushed.

What changed

• Recording: src/apps/egress_refused.ts records each refused host per repository with host, port, first and last time, and a count. It keeps one row per host and flushes to disk every 5 seconds, so it never floods the log. src/apps/egress.ts and src/apps/runtime.ts feed it.
• App page: src/web/pages/settings.ts and src/web/studio/blocked.ts show "Blocked: host (N tries, last 2 min ago)" with Allow, Deny and Forget. The action lives in src/actions/egress_refused.ts.
• Allow: it takes effect within seconds with no redeploy, and commits to forge.json egress with the owner as author.
• Wildcards: egress_refused.ts only offers one for redirect hosts actually seen, such as *.hf.co.
• Private, LAN and tailnet destinations: these still need the site admin. An app owner can't allow them.
• Notifications and brief: the first refusal of a host goes to the owner's notifications (src/crew/notify.ts), and src/crew/brief.ts and src/crew/app_hosts.ts name refused hosts in the crew's brief.
• Terminal: src/tui/screens/blocked.ts adds a Blocked hosts screen.
• Tests: test/egress-refused.test.ts covers a refused host appearing on the app page and in notifications, Allow letting the next request pass without a redeploy, and a LAN address staying blocked for a non-admin owner.

Left out

• Wildcard suggestions for hosts never seen redirecting.
• Counts only cover production runs, not previews.

Not run here

• The cell and unix-socket suites are skipped in this sandbox, and the crew-settings phone-layout test skipped because no chromium starts here. The forge's check covers both.

Try it Set cells.egress=enforce, run an app that fetches an undeclared host, then open the app's settings page and press Allow.

I've fixed all three findings and the minor one, and pushed the changes to the branch. tsc, scripts/gate.ts and test/egress-refused.test.ts pass, and so does design-lint. I ran no other test files; the forge's check runs the full suite.

1. Agent admins can no longer allow. allowBlocked returns the new needs_human error for any agent actor, before allowNow. The page and the terminal screen both show "An agent proposes the forge.json change in a pull." The test "an agent admin allows live but never commits" is now "an agent admin is refused: nothing is allowed live and nothing is committed". It expects the refusal, an unchanged HEAD, and an empty allowed list for that host. docs/features/blocked-hosts.md says the same.
2. Allowed entries that forge.json doesn't declare are now shown. I took your second option. withLiveOnly lists them on the app page as "Allowed now, not in forge.json", with a line telling the owner to add the entry to forge.json. A new test covers it. I did not prune the allowed file. A host Allow had just committed would then be refused again until the redeploy picked it up. If you want automatic removal, it should wait until the running config declares the host.
3. AGENTS.md: the egress_refused.ts sentence now comes after the HELD_FRESH_MS sentence.
4. appBlocked casts: the repeated as string / as Allowed casts are gone. A small blockedMessage(value) builds the message from the value's type.

I also pulled the shared forge.json read into declaredEgress, which withEntry and withLiveOnly both use.

I left out removing a live-only entry from the page. The owner edits forge.json, or the entry stays listed.