security: compile-time URL/host egress allowlist

[proggeramlug]

Walk every fetch(url) / http.get(url) / net.connect(host, port) / WebSocket(url) / https.request(...) call site where the URL/host is a string literal (or computed from compile-time constants). Cross-reference against the host's perry.allowedHosts allowlist. Refuse to compile if a literal host isn't permitted.

For non-literal arguments (URL computed at runtime from variables), default-deny — require explicit perry.allowDynamicHosts: true in the host package.json, or per-call-site annotation. The static guarantee: grep-ing the binary's egress is reliable.

Mechanism

HIR walk identifies all egress call sites; literal-or-foldable args checked against the allowlist; non-literal args fail unless explicitly allowed. Zero runtime cost — compile-time analysis only.

Combined with the per-package capability net:<host> token (separate issue), gives static egress control at two granularities: per-package and per-host.

Acceptance

• Host package.json perry.allowedHosts: ["api.example.com", "*.cdn.example.com", "https://api.acme.com/v1/*"]
• All fetch / http.get / https.request / net.connect / WebSocket call sites analyzed
• Literal host not in allowlist → build fails at call site with clear message
• Non-literal host → build fails unless perry.allowDynamicHosts: true
• Pattern matching: glob-style host wildcards, URL prefix matching
• Stronger than runtime allowlists: violations caught before binary exists
• perry audit lists every literal egress in the build for review

---

Part of the supply-chain hardening series. Host-app-controlled. Zero runtime cost (compile-time HIR walk only).

[gkgoat1]

Walk every fetch(url) / http.get(url) / net.connect(host, port) / WebSocket(url) / https.request(...) call site where the URL/host is a string literal (or computed from compile-time constants). Cross-reference against the host's perry.allowedHosts allowlist. Refuse to compile if a literal host isn't permitted.

For non-literal arguments (URL computed at runtime from variables), default-deny — require explicit perry.allowDynamicHosts: true in the host package.json, or per-call-site annotation. The static guarantee: grep-ing the binary's egress is reliable.

Mechanism

HIR walk identifies all egress call sites; literal-or-foldable args checked against the allowlist; non-literal args fail unless explicitly allowed. Zero runtime cost — compile-time analysis only.

Or, we can add a runtime check, that could get optimized out on literal arguments, while dynamic arguments don't get an escape hatch--the grep invariant is preserved, and networking is slower than a check anyways.

Combined with the per-package capability net:<host> token (separate issue), gives static egress control at two granularities: per-package and per-host.

Acceptance

• Host package.json perry.allowedHosts: ["api.example.com", "*.cdn.example.com", "https://api.acme.com/v1/*"][ ] All fetch / http.get / https.request / net.connect / WebSocket call sites analyzed[ ] Literal host not in allowlist → build fails at call site with clear message[ ] Non-literal host → build fails unless perry.allowDynamicHosts: true[ ] Pattern matching: glob-style host wildcards, URL prefix matching[ ] Stronger than runtime allowlists: violations caught before binary exists[ ] perry audit lists every literal egress in the build for review

Part of the supply-chain hardening series. Host-app-controlled. Zero runtime cost (compile-time HIR walk only).