Repository navigation
guards(egress): guard_egress is opt-in at 28 of ~103 shared-client call sites — ruling needed on the default #17233
Description
Activity
Adjacent finding while auditing the LLM provider layer, filed separately as #17249 rather than folded in here, because it sits outside this issue's measured population.
This issue counts
guard_egressacross the ~103 shared-client callers and the ~51 directrequests/httpx/aiohttpcallers. There is a third bucket: subsystems that reach the network through a vendor SDK, which never touch the shared client at all, so whatever ruling lands here does not reach them.grep -rn 'guard_egress' autobot-backend/llm_shared/providers/→ 0 hits.OpenAICompatibleProvider._create_client(autobot-backend/llm_shared/providers/openai_compatible.py:96-98) handsbase_urlto the SDK, which owns the socket.CustomOpenAIProvider._resolve_base_url(custom_openai.py:54-60) resolves that host fromCUSTOM_OPENAI_BASE_URL— operator-supplied stored config, i.e. exactly the Rule 8 trigger — and the request never reaches_assert_egress_allowed.Noting it here only so the blast-radius measurement in this issue's first acceptance criterion is not read as covering the LLM path. It does not.
- added a commit that references this issue
on Sep 22, 2026
Owner ruling 2026-09-21: each default-off control gets its own ruling issue, with its blast
radius measured before the default is touched. This is the egress one.
Current state
guard_egress=is a per-call-site opt-in parameter, not a global default. It appears at 28call sites against ~103 shared-client callers, and a further ~51 files call
requests/httpx/aiohttpdirectly, bypassing the shared client entirely.The guard itself is an address deny-list (loopback, link-local, cloud-metadata, reserved),
not a destination allow-list — so with the guard on, internal addresses are refused but
any public host is reachable.
Evidence:
autobot_shared/http_client_manager.py:209-272.Not every
guard_egress=Falseis wrong.autobot-backend/llm_shared/pricing/live_sources.py:48documents its own as deliberate — public addresses only, redirects refused — and that call site
is a reasonable exception. The defect is that the safe setting is the one you have to ask for.
Why the default matters here
A control that must be requested protects only the call sites whose author knew to request it.
The 28/103 ratio is the measurement of that gap, and the ~51 direct-library callers are outside
the mechanism altogether — flipping the default does nothing for them.
Acceptance criteria
callers, whether it would still function with the guard on, and which of the 28 existing
Falsesites are deliberate exceptions like the pricing one.guard_egress=Falseexplicitly with acomment saying why, so the exception is visible at the call site.
requests/httpx/aiohttpcallers are counted and tracked — flipping theshared-client default does not reach them, and a ruling that ignores them overstates its own
coverage. File separately if out of scope here.
Related