Documentation
¶
Overview ¶
Package portguard keeps the registry of TCP ports that belong to Pando itself: the HTTP API, the AG-UI listener, the MCP HTTP server, the LLM proxy, the IPC bus, OAuth callbacks, the browser's DevTools port, ... A sandboxed command must never reach them: every one of those listeners can change the configuration (turning the sandbox off), run commands outside the sandbox or hand out credentials, and most of them trust loopback callers. internal/sandbox reads Ports into Policy.DenyConnectPorts and the backends refuse TCP connections to those ports.
The registry has two halves:
- an in-process one (Register / Guard), always used;
- a shared one: each Pando process mirrors its own ports into <global config dir>/run/ports/<pid>.json, and Ports also returns the ports of every other live Pando process. The global config directory is a protected path of every sandbox policy, so a sandboxed command cannot remove an entry. This covers other instances on the same machine: an IPC primary, a `pando serve` started by the Projects feature, the desktop app, another project's TUI.
This package is a leaf (standard library only) so that any package with a listener can use it without an import cycle; internal/sandbox re-exports RegisterGuardedPort / GuardedPorts.
Index ¶
- func Guard(l net.Listener, owner string) net.Listener
- func LocalOwners() map[int][]string
- func LocalPorts() []int
- func Ports() []int
- func Register(port int, owner string) (unregister func())
- func RegisterAddr(addr net.Addr, owner string) (unregister func())
- func ResetForTests()
- func SetSharedDirForTests(dir string) (restore func())
- func SharedDir() string
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Guard ¶
Guard registers the port of l and returns a listener whose Close also removes the registration. The returned listener forwards everything else to l unchanged.
func LocalOwners ¶
LocalOwners returns port -> owners registered by this process, for diagnostics (pando sandbox status).
func LocalPorts ¶
func LocalPorts() []int
LocalPorts returns the ports registered by this process, sorted and deduplicated.
func Ports ¶
func Ports() []int
Ports returns every guarded port: this process's registrations plus the ones published by other live Pando processes. Sorted and deduplicated.
func Register ¶
Register records port as belonging to this Pando process. owner is a short label for diagnostics ("api", "ipc-pub", ...). The returned function removes the registration; it is safe to call more than once. Ports outside 1-65535 are ignored.
func RegisterAddr ¶
RegisterAddr registers the TCP port of addr (a net.Addr from a listener). Non-TCP addresses are ignored.
func SetSharedDirForTests ¶
func SetSharedDirForTests(dir string) (restore func())
SetSharedDirForTests points the shared registry at dir ("" disables it) until the returned function is called. By default the shared registry is disabled inside `go test` binaries so tests never write into the real home directory.
Types ¶
This section is empty.
Source Files