feat(sandbox): enable network_via_proxy_only for the Go ecosystem profile (#375)

docs/sandbox.md

@@ -438,7 +438,29 @@ does not have this limitation; its `file-read*` and `file-write*` rules are inde
 <details>
 <summary>macOS (Seatbelt)</summary>
 
-**Network filtering is limited**: Seatbelt supports network rules in policies, but fine-grained `host:port` filtering is not enforced.
+**Network lockdown (`network_via_proxy_only`)**: Fine-grained `host:port` filtering is not
+expressible in Seatbelt, so per-host control happens at the PMG proxy instead. With
+`network_via_proxy_only: true`, the sandbox denies all non-loopback outbound network; only the
+running PMG proxy's port is reachable, and profiles with `allow_network_bind` additionally keep
+loopback↔loopback connects open. Raw sockets, QUIC, and arbitrary non-loopback ports are blocked
+at the kernel.
+Direct DNS is disabled by default (the proxy resolves names); `allow_direct_dns: true` re-opens
+it. The Go profile ships with lockdown enabled.
+
+Lockdown is fail-closed: it requires the proxy flow, and pmg errors out rather than running
+without confinement when no proxy is available — including on Linux, where
+`network_via_proxy_only` is not yet supported (the drivers reject it with a clear error, never a
+silent fallback).
+
+For local development: plain commands like `npm run dev` are not sandboxed unless
+`enforce_always` is set; loopback↔loopback traffic keeps working via `allow_network_bind` (as
+noted above); and
+proxy-honoring clients reach any destination through the proxy CONNECT path. What breaks under
+lockdown is direct non-loopback sockets — tools that ignore `HTTP_PROXY`/`HTTPS_PROXY` and
+non-HTTP wire protocols (e.g. Postgres or Redis clients pointed at non-loopback hosts). Such
+denials render as:
+
+> direct network access blocked by network_via_proxy_only — traffic must flow through the PMG proxy (a tool may have ignored HTTP_PROXY/HTTPS_PROXY)
 
 </details>
 

sandbox/profiles/go.yml

@@ -11,6 +11,13 @@ allow_pty: true
 # binds and outbound traffic are unaffected.
 allow_network_bind: true
 
+# All non-loopback outbound traffic is denied: only the PMG proxy's port is
+# reachable, plus loopback-to-loopback connects since this profile sets
+# allow_network_bind. Per-host control happens at the proxy; direct DNS is
+# disabled (the proxy resolves). Requires the proxy flow; pmg fails closed
+# if the proxy is not running.
+network_via_proxy_only: true
+
 # .git/config stays blocked (default). go build embeds VCS info by default
 # (-buildvcs=auto) which invokes git; if git fails on the blocked config, build
 # with -buildvcs=false or set allow_git_config: true in a custom profile.
@@ -59,12 +66,11 @@ filesystem:
     - /usr/**
 
 network:
-  # Per-host rules are NOT enforced on any platform. macOS Seatbelt and Linux
-  # Bubblewrap only make a binary decision: any allow_outbound entry enables
-  # ALL outbound traffic, and "*:*" in deny_outbound disables the network
-  # entirely only when allow_outbound is empty. The hosts below document the
-  # default Go module endpoints and keep the network enabled; actual module
-  # traffic control comes from the PMG proxy's fail-closed GOPROXY rewrite.
+  # These hosts are documentation of the default Go module endpoints and the
+  # future input to proxy-level per-host policy. They are NOT kernel-enforced:
+  # with network_via_proxy_only, the sandbox denies all non-loopback outbound
+  # traffic, and the proxy (with fail-closed GOPROXY rewrite) controls module
+  # traffic.
   allow_outbound:
     - proxy.golang.org:443
     - sum.golang.org:443