An app inside a child forge reaches a payment provider when its forge.json declares it #11147

A child forge's cell may now reach api.stripe.com on 443, and only an app that declares that host in forge.json egress gets through to it. The spec and setting are tested; I did not run a real child cell here. The check that opens a cell for an app was not run, and the test sandbox skips unix-socket cell suites, so the forge's check covers those.

What changed

• Setting: a new children.paymentEgress (FORGE_CHILDREN_PAYMENT_EGRESS) has the values off and stripe, and defaults to stripe as the issue asks. It sits beside registryEgress in src/core/capacity.ts.
• Cell: src/spawn/cell.ts adds the payment hosts to a child cell's egress list. That list is only the outer ceiling. A cell the child opens for an app passes a host only if the app's forge.json declares it, so an app that does not declare it cannot reach it. The child's crew sandbox declares none, so it cannot either. The host is exact, on port 443 only, enforced even when cells.egress is report, and applies from the next child cell started.
• Docs: docs/APPS.md and docs/features/child-model-egress.md say so.
• Test: a new test in test/spawn-cell.test.ts covers the default, report mode, exact host and port matching, an empty list refusing the host, and off.
• Checks run: the gate, tsc and the cell and capacity tests pass.

Left out: inside a child forge, if its admin sets that forge's own cells.egress to report, an undeclared app's cell would let api.stripe.com through the outer ceiling. I did not close that.

Try it: in a parent, leave children.paymentEgress at its default, start a child, and declare "egress": ["api.stripe.com"] in an app there.

Closes #11142

A child forge's cell may now reach api.stripe.com on 443, and only an app that declares that host in forge.json egress gets through to it. The spec and setting are tested; I did not run a real child cell here. The check that opens a cell for an app was not run, and the test sandbox skips unix-socket cell suites, so the forge's check covers those.

What changed

• Setting: a new children.paymentEgress (FORGE_CHILDREN_PAYMENT_EGRESS) has the values off and stripe, and defaults to stripe as the issue asks. It sits beside registryEgress in src/core/capacity.ts.
• Cell: src/spawn/cell.ts adds the payment hosts to a child cell's egress list. That list is only the outer ceiling. A cell the child opens for an app passes a host only if the app's forge.json declares it, so an app that does not declare it cannot reach it. The child's crew sandbox declares none, so it cannot either. The host is exact, on port 443 only, enforced even when cells.egress is report, and applies from the next child cell started.
• Docs: docs/APPS.md and docs/features/child-model-egress.md say so.
• Test: a new test in test/spawn-cell.test.ts covers the default, report mode, exact host and port matching, an empty list refusing the host, and off.
• Checks run: the gate, tsc and the cell and capacity tests pass.

Left out: inside a child forge, if its admin sets that forge's own cells.egress to report, an undeclared app's cell would let api.stripe.com through the outer ceiling. I did not close that.

Try it: in a parent, leave children.paymentEgress at its default, start a child, and declare "egress": ["api.stripe.com"] in an app there.

Both changes are in and pushed to the same branch. The gate, tsc and the egress and cell tests pass. I did not run a real child cell, so the new egress test is the evidence for the behaviour.

1. The report-mode gap is closed.

• In decide in src/apps/egress.ts, a payment host is now refused unless the app declares it, whatever cells.egress says.
• Report mode no longer passes it. Every cell's proxy does this, not only a child's.
• The host list is PAYMENT_HOSTS in src/core/capacity.ts, the same list the child cell's ceiling uses.
• I added a line to docs/features/child-model-egress.md saying so.

2. The test now goes through the real proxy.

• A new test in test/egress-upstream.test.ts starts a real inner proxy behind a real outer proxy and runs it in enforce mode and in report mode.
• A declared api.stripe.com gets through the inner policy. The outer proxy, which allows nothing, then refuses it with "not reachable from this forge's cell".
• An undeclared one is refused by the inner policy with "not in this repository's egress", and the report callback never fires.
• As a control, report mode still lets another undeclared host, example.com, through the inner proxy.
• It fails with the src/apps/egress.ts change stashed (the report-mode run) and passes with it.
• I removed the trivial hostAllowed([], …) assertion from test/spawn-cell.test.ts.

I did not run the full suite or the check that opens a real cell for an app. This sandbox skips the unix-socket cell tests, so the forge's check covers those.

I merged main into the branch and pushed it. The merge had one conflict, in the import block of src/apps/egress.ts. I kept both imports: PAYMENT_HOSTS from this pull and during from main.

The gate printed nothing I could read, tsc was clean, and the egress and cell tests pass (115 pass, 0 fail). I did not run the full suite; the forge's check does that on the push.

Apps inside a child forge can now reach Stripe (api.stripe.com:443) when their own forge.json egress names it. There are two layers. The parent's children.paymentEgress setting caps what the child's cell may reach; it is stripe by default and off closes it. Inside that cap, each app reaches the host only if it names it.

A change for every cell, not only children: decide in src/apps/egress.ts now refuses a payment host to any app that does not name it, even when cells.egress is in report mode. That applies to every cell on the forge. Before this, report mode let an undeclared host through on 443, Stripe included. An app that names Stripe is unaffected.

Review follow-ups:

• Launch path tested: a new test in test/spawn-cell.test.ts calls launchSpecFor, the function that builds a real child's cell. It checks the egress list holds api.stripe.com:443 by default and not after children.paymentEgress is set to off. I removed the paymentHosts: childPaymentHosts(parent.db) line in src/spawn/cell.ts and the test failed, then put the line back.
• No database import for a constant: PAYMENT_HOSTS moved into src/core/egress_grants.ts, next to neverGrantable. That module depends on no database code. src/apps/egress.ts and src/core/capacity.ts both import it from there.

Checks: scripts/gate.ts and bun x tsc --noEmit pass. scripts/fast.ts named 2247 test files, too many to run, so I ran these myself:

• test/spawn-cell.test.ts, test/egress-upstream.test.ts and test/disk-mount.test.ts: 51 pass, 3 skipped (these need unix sockets, which this sandbox cannot bind).
• Every test file named for egress, capacity or payment: 201 pass.

The cell, proxy and unix-socket suites run in the forge's check on this push. The preview shows the setting but not a running child cell, so this has not been tried end to end against a real child.

To try it: on a child forge, an app that lists "api.stripe.com:443" in its forge.json egress reaches Stripe. An app that does not list it is refused, even in report mode. Setting children.paymentEgress to off on the parent closes Stripe to every app in its children.

🤖 Generated with Claude Code