fix: allow yarn's registry through the egress sidecar (SYD-269) (#231)

yarn defaults to registry.yarnpkg.com, which EGRESS_BASELINE never
allowed, so every `yarn install` in a dispatched session got a 403
CONNECT from the syd-egress sidecar. Reproduced against the live
sidecar: `npm view left-pad` returns 1.3.0 while `yarn add left-pad`
fails with "tunneling socket could not be established, statusCode=403".
HEX-4's session reported this as "no network access", which read as a
generic sandbox limit rather than a one-host allowlist gap.

Added to the baseline rather than derived from a project's stack.cli.
Deriving is what the issue proposed and it looks tidier, but there is
one shared sidecar per host and each worker stands it up from its own
config: the base config serves the yarn project while the codex and
gemini configs ask for github.com, so derivation makes those configs
disjoint instead of nested and they rebuild the sidecar in turn -- the
boot-order-dependent allowlist SYD-270 just fixed. The baseline keeps
`satisfies()`'s nesting invariant intact and covers the next yarn
project without anyone remembering to declare it. Exposure is
unchanged: registry.yarnpkg.com is a CDN alias serving the same public
packages as the already-allowed registry.npmjs.org.

The two ensureEgressGuard suites now derive their expected
ALLOWED_DOMAINS from egressAllowlist() instead of spelling it out --
those cases are about docker orchestration and credential injection,
not allowlist contents, which are asserted directly. New tests pin the
yarn host as unconditional and assert the nesting invariant a future
derivation would break.

Author: seanperkins

Dockerfile.worker

@@ -29,9 +29,10 @@ RUN npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} \
 #
 # A concrete pinned binary rather than `corepack enable` on purpose: corepack
 # shims fetch whatever version a repo pins in "packageManager" lazily, at
-# session start, from repo.yarnpkg.com as well as registry.npmjs.org -- only
-# the latter is in the sidecar's allowlist (EGRESS_BASELINE in
-# scripts/worker-select.ts), so a shim would reintroduce the same silent
+# session start, from repo.yarnpkg.com -- which is NOT in the sidecar's
+# allowlist (EGRESS_BASELINE in scripts/worker-select.ts allows the npm and
+# yarn *registries*, registry.npmjs.org and registry.yarnpkg.com, but not
+# corepack's distribution host), so a shim would reintroduce the same silent
 # no-dependencies failure behind a network block. Pinned for reproducible
 # rebuilds, same as CLAUDE_CODE_VERSION above.
 ARG PNPM_VERSION=11.17.0

README.md

@@ -319,7 +319,8 @@ this:
    `--internal` Docker network (`syd-workers`) with no route out; their only
    exit is a tinyproxy sidecar (`syd-egress`, built by
    `npm run build:worker-image` from `Dockerfile.egress-proxy`) that forwards
-   only to `api.anthropic.com`, `registry.npmjs.org`, and the tracker host
+   only to `api.anthropic.com`, `registry.npmjs.org`, `registry.yarnpkg.com`
+   (yarn's default registry — SYD-269), and the tracker host
    from `url`. Add hosts with `egressAllow: ["host.name"]`; opt out entirely
    with `egress: "open"` in `switchyard-worker.json`. The worker stands the
    network and sidecar up automatically at startup (and refuses to start if

scripts/worker-select.ts

@@ -183,8 +183,8 @@ export type WorkerConfig = {
    * "open" is the escape hatch: plain default-bridge networking, full egress.
    */
   egress?: "proxy" | "open";
-  /** Extra hostnames the egress proxy should allow, beyond the tracker host,
-   * api.anthropic.com, and registry.npmjs.org. */
+  /** Extra hostnames the egress proxy should allow, beyond the tracker host
+   * and EGRESS_BASELINE (api.anthropic.com plus the npm and yarn registries). */
   egressAllow?: string[];
 };
 
@@ -947,9 +947,25 @@ export function injectKeyNames(env: NodeJS.ProcessEnv): string[] {
   return PROVIDER_KEY_VARS.filter((v) => env[v]).sort();
 }
 
-/** Baseline hosts every session needs: the Anthropic API and npm's registry
- * (sessions run `npm ci`). The tracker host comes from config.url. */
-const EGRESS_BASELINE = ["api.anthropic.com", "registry.npmjs.org"];
+/**
+ * Baseline hosts every session needs: the Anthropic API and the package
+ * registries sessions install from. The tracker host comes from config.url.
+ *
+ * Both registries are unconditional rather than derived from a project's
+ * `stack.cli` (SYD-269). Deriving looks tidier — only the workers serving a
+ * yarn project would allow yarn's registry — but there is ONE shared
+ * `syd-egress` sidecar for the whole host and each worker stands it up from
+ * its own config. Derivation would make those configs disjoint rather than
+ * nested (the base config serves a yarn project, the codex/gemini ones ask for
+ * `github.com`), and disjoint configs rebuild the sidecar in turn — exactly
+ * the boot-order-dependent allowlist SYD-270 fixed. Keeping the registries in
+ * the baseline preserves the nesting invariant `satisfies()` relies on, and
+ * covers the next yarn project without anyone remembering to.
+ *
+ * The added exposure is nil: registry.yarnpkg.com is a CDN alias serving the
+ * same public npm packages as registry.npmjs.org, which is already allowed.
+ */
+const EGRESS_BASELINE = ["api.anthropic.com", "registry.npmjs.org", "registry.yarnpkg.com"];
 
 export function egressMode(config: WorkerConfig): "proxy" | "open" {
   return config.egress ?? "proxy";

tests/scripts/worker-select.egress.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from "vitest";
 import {
   ensureEgressGuard,
+  egressAllowlist,
   injectKeyEnvArgs,
   EGRESS_CA_VOLUME,
   EGRESS_CA_DIR,
@@ -20,7 +21,10 @@ const config: WorkerConfig = {
   projects: { SYD: { repo: "/repo/syd" } },
 };
 
-const domainsCsv = "api.anthropic.com,localhost,registry.npmjs.org";
+// Derived rather than spelled out: these cases are about credential injection
+// and the CA volume, not the allowlist's contents (asserted in
+// worker-select.test.ts), so a new baseline host shouldn't break them.
+const domainsCsv = egressAllowlist(config).join(",");
 
 type Call = { cmd: string; args: string[] };
 function mockExec(respond: (call: Call) => string | Error) {

tests/scripts/worker-select.test.ts

@@ -13,6 +13,7 @@ import {
   buildDockerArgs,
   egressMode,
   egressAllowlist,
+  satisfies,
   ensureEgressGuard,
   buildContainerizedPrompt,
   stackChecksEnv,
@@ -665,11 +666,12 @@ describe("egress config (SYD-110)", () => {
     expect(egressMode({ ...config, egress: "proxy" })).toBe("proxy");
   });
 
-  it("egressAllowlist covers the Anthropic API, npm registry, and the tracker host", () => {
+  it("egressAllowlist covers the Anthropic API, both package registries, and the tracker host", () => {
     expect(egressAllowlist(config)).toEqual([
       "api.anthropic.com",
       "localhost",
       "registry.npmjs.org",
+      "registry.yarnpkg.com",
     ]);
   });
 
@@ -680,7 +682,40 @@ describe("egress config (SYD-110)", () => {
         url: "http://nas.local:3300",
         egressAllow: ["github.com", "api.anthropic.com"],
       }),
-    ).toEqual(["api.anthropic.com", "github.com", "nas.local", "registry.npmjs.org"]);
+    ).toEqual([
+      "api.anthropic.com",
+      "github.com",
+      "nas.local",
+      "registry.npmjs.org",
+      "registry.yarnpkg.com",
+    ]);
+  });
+
+  // SYD-269: yarn defaults to registry.yarnpkg.com, so a session for a yarn
+  // project got a 403 CONNECT from the sidecar on every install. Assert the
+  // host is unconditional — a project declaring `yarn` in stack.cli must not be
+  // what turns it on, or the base config and the codex/gemini ones (which ask
+  // for github.com and serve no yarn project) become disjoint instead of
+  // nested, and rebuild the shared sidecar in turn. See the next test.
+  it("egressAllowlist allows the yarn registry regardless of any project's stack", () => {
+    expect(egressAllowlist(config)).toContain("registry.yarnpkg.com");
+    expect(
+      egressAllowlist({
+        ...config,
+        projects: {
+          SYD: { repo: "/repo/syd", stack: { cli: [{ name: "yarn", check: "yarn -v" }] } },
+        },
+      }),
+    ).toEqual(egressAllowlist(config));
+  });
+
+  // The invariant satisfies() depends on (SYD-270): every worker config on the
+  // host must be nested, so the widest one creates the sidecar and the rest
+  // accept it. Disjoint sets ping-pong the sidecar on every boot.
+  it("a config's extras keep it a superset of the bare config — sidecar sets stay nested", () => {
+    const base = egressAllowlist(config);
+    const withExtras = egressAllowlist({ ...config, egressAllow: ["github.com"] });
+    expect(satisfies(withExtras, base)).toBe(true);
   });
 });
 
@@ -700,7 +735,10 @@ describe("ensureEgressGuard (SYD-110)", () => {
     return { calls, exec };
   }
 
-  const domainsCsv = "api.anthropic.com,localhost,registry.npmjs.org";
+  // Derived, not spelled out: these cases exercise the guard's docker
+  // orchestration, not the allowlist's contents (asserted directly above), so
+  // adding a baseline host shouldn't have to be re-typed here.
+  const domainsCsv = egressAllowlist(config).join(",");
   // SYD-186: the sidecar now also injects provider creds; env supplies them and
   // seeds the INJECT_KEYS freshness sentinel (CLAUDE_CODE_OAUTH_TOKEN here).
   const egressEnv = { CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat-REAL" } as NodeJS.ProcessEnv;