# http_proxy: Add hostname allowlist policy types \(\#59217\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/f73b9daf3b2d71e17ee1271da0e58ba2fbf2aa28)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: f73b9daf3b2d71e17ee1271da0e58ba2fbf2aa28

Requested commit: f73b9daf3b2d71e17ee1271da0e58ba2fbf2aa28

Commit: f73b9daf3b2d71e17ee1271da0e58ba2fbf2aa28

Tree: e2cee1f32101fe2cec2ac56dd45d20a042d8d579

Author: Richard Feldman

Committer: GitHub

## Message

```
http_proxy: Add hostname allowlist policy types (#59217)

First of a stack adding hostname-allowlisted network access to agent
terminal sandboxing. Adds a new `http_proxy` crate containing only the
allowlist policy types.

`HostPattern` parses exact hostnames or leading-`*.` subdomain
wildcards, normalizes IDNs to punycode, and rejects IP literals and
localhost-family names. `Allowlist` holds a set of patterns (or an
allow-any escape hatch), and `covers` implements host-pattern
subsumption (`*.github.com` covers `api.github.com`) used later to
decide when an already-granted permission covers a new request — the
network analogue of write-path subtree containment.

Pure, self-contained logic with no callers yet. The upstream-proxy
config and the proxy server that enforces these policies land in the
next two PRs.

Release Notes:

- N/A
```

## Parents

- [f16a46967b1f748003fa518609703f503e9d0d67](https://git.cafe/gitcafe/zed/commit/f16a46967b1f748003fa518609703f503e9d0d67?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/f73b9daf3b2d71e17ee1271da0e58ba2fbf2aa28?format=markdown)