feat: enforce owner allowlisted bwrap HTTPS egress

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

scripts/smoke-bwrap-egress-manager.py

@@ -0,0 +1,70 @@
+import importlib.util
+import json
+import os
+import tempfile
+from pathlib import Path
+from unittest.mock import patch
+
+from sandboxer.core.manager import SandboxManager
+from sandboxer.extensions.bwrap import BwrapExtension
+from sandboxer.lifecycle.store import SandboxStore
+from sandboxer.models import Extension, Profile, SandboxCreateRequest, SandboxExecRequest
+
+spec = importlib.util.spec_from_file_location(
+    "proof", Path(__file__).with_name("smoke-bwrap-egress.py")
+)
+proof = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(proof)
+os.environ["SANDBOXER_NO_STATE_HUB"] = "1"
+with tempfile.TemporaryDirectory(prefix="glas-managed-egress-") as directory:
+    root = Path(directory)
+    profile = Profile(
+        id="profile.egress-proof",
+        version="1",
+        extension="ext.bwrap",
+        network={"default": "deny", "egress": ["api.anthropic.com:443"]},
+    )
+    ext = Extension(
+        id="ext.bwrap",
+        title="proof",
+        handler="sandboxer.extensions.bwrap:BwrapExtension",
+        config={"base_dir": str(root / "sandboxes"), "allowed_egress": ["api.anthropic.com:443"]},
+    )
+    consumer = {"actor": "agt", "project": "glas-harness", "run_id": "egress-proof"}
+    with (
+        patch("sandboxer.core.manager.load_profile", return_value=profile),
+        patch("sandboxer.core.manager.resolve_extension", return_value=ext),
+        patch("sandboxer.core.manager.load_extension", return_value=ext),
+    ):
+        store = SandboxStore(path=root / "sandboxes.json")
+        mgr = SandboxManager(store=store)
+        created = mgr.create(
+            SandboxCreateRequest(profile=profile.id, consumer=consumer), host="localhost"
+        )
+        try:
+            # Different manager and store instances reconstruct the persisted owner handle.
+            resumed = SandboxManager(store=SandboxStore(path=root / "sandboxes.json"))
+            result = resumed.execute(
+                created.sandbox_id,
+                SandboxExecRequest(
+                    command=["python3", "-c", proof.PROBE], consumer=consumer, timeout_seconds=40
+                ),
+            )
+            assert result.exit_code == 0, result.stderr
+        finally:
+            SandboxManager(store=SandboxStore(path=root / "sandboxes.json")).destroy(
+                created.sandbox_id
+            )
+        assert not Path(created.inputs["egress_dir"]).exists()
+        assert not BwrapExtension._pid_alive(int(created.inputs["egress_pid"]))
+        print(
+            json.dumps(
+                {
+                    "sandbox_id": created.sandbox_id,
+                    "manager_restart": True,
+                    "proof": json.loads(result.stdout),
+                    "proxy_removed": True,
+                    "model_call": False,
+                }
+            )
+        )