fixed codex building issues

cmd/firewall.go

@@ -0,0 +1,126 @@
+// ExitBox - Multi-Agent Container Sandbox
+// Copyright (C) 2026 Cloud Exit B.V.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package cmd
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/cloud-exit/exitbox/internal/config"
+	"github.com/cloud-exit/exitbox/internal/network"
+	"github.com/cloud-exit/exitbox/internal/ui"
+	"github.com/spf13/cobra"
+)
+
+func newFirewallCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "firewall",
+		Short: "Manage firewall exclusions",
+	}
+	ports := &cobra.Command{
+		Use:   "ports",
+		Short: "Manage host ports reachable as localhost:<port> from agents",
+	}
+	ports.AddCommand(newFirewallPortsListCmd())
+	ports.AddCommand(newFirewallPortsAddCmd())
+	ports.AddCommand(newFirewallPortsRemoveCmd())
+	cmd.AddCommand(ports)
+	return cmd
+}
+
+func newFirewallPortsListCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "list",
+		Short: "List persistent host port exclusions",
+		Run: func(cmd *cobra.Command, args []string) {
+			al := config.LoadAllowlistOrDefault()
+			ports := network.NormalizeHostPorts(al.HostPorts)
+			if len(ports) == 0 {
+				ui.Info("No host ports configured.")
+				return
+			}
+			for _, port := range ports {
+				fmt.Println(port)
+			}
+		},
+	}
+}
+
+func newFirewallPortsAddCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "add <port> [port...]",
+		Short: "Allow host ports from agents via localhost:<port>",
+		Args:  cobra.MinimumNArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			ports := parseFirewallPorts(args)
+			al := config.LoadAllowlistOrDefault()
+			al.HostPorts = network.NormalizeHostPorts(append(al.HostPorts, ports...))
+			if err := config.SaveAllowlist(al); err != nil {
+				ui.Errorf("Failed to save firewall ports: %v", err)
+			}
+			ui.Successf("Allowed host ports: %s", network.HostPortsEnvValue(al.HostPorts))
+		},
+	}
+}
+
+func newFirewallPortsRemoveCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "remove <port> [port...]",
+		Short: "Remove persistent host port exclusions",
+		Args:  cobra.MinimumNArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			ports := parseFirewallPorts(args)
+			remove := make(map[int]struct{}, len(ports))
+			for _, port := range ports {
+				remove[port] = struct{}{}
+			}
+
+			al := config.LoadAllowlistOrDefault()
+			var kept []int
+			for _, port := range network.NormalizeHostPorts(al.HostPorts) {
+				if _, ok := remove[port]; !ok {
+					kept = append(kept, port)
+				}
+			}
+			al.HostPorts = kept
+			if err := config.SaveAllowlist(al); err != nil {
+				ui.Errorf("Failed to save firewall ports: %v", err)
+			}
+			if len(al.HostPorts) == 0 {
+				ui.Success("No host ports allowed.")
+			} else {
+				ui.Successf("Allowed host ports: %s", network.HostPortsEnvValue(al.HostPorts))
+			}
+		},
+	}
+}
+
+func parseFirewallPorts(args []string) []int {
+	var ports []int
+	for _, arg := range args {
+		port, err := strconv.Atoi(arg)
+		if err != nil || port < 1 || port > 65535 {
+			ui.Errorf("Invalid port %q: must be 1-65535", arg)
+		}
+		ports = append(ports, port)
+	}
+	return ports
+}
+
+func init() {
+	rootCmd.AddCommand(newFirewallCmd())
+}

cmd/root.go

@@ -80,6 +80,7 @@ func init() {
 	rootCmd.PersistentFlags().StringSliceP("include-dir", "i", nil, "Mount host dir inside /workspace")
 	rootCmd.PersistentFlags().StringSliceP("tools", "t", nil, "Add Alpine packages to the image")
 	rootCmd.PersistentFlags().StringSliceP("allow-urls", "a", nil, "Allow extra domains for this session")
+	rootCmd.PersistentFlags().IntSlice("host-port", nil, "Allow localhost:PORT in the agent to reach the host")
 
 	rootCmd.AddCommand(versionCmd)
 

cmd/run.go

@@ -95,6 +95,8 @@ Flags (passed after the agent name):
   -t, --tools PKG         Add Alpine packages to the image
   -i, --include-dir DIR   Mount host dir inside /workspace
   -a, --allow-urls DOM    Allow extra domains for this session
+      --host-port PORT    Allow localhost:PORT in the agent to reach the host
+                          Persist ports with: exitbox firewall ports add PORT
       --ollama            Use host Ollama for local models
       --memory SIZE       Container memory limit (default: 8g)
       --cpus COUNT        Container CPU limit (default: 4)
@@ -164,6 +166,9 @@ func runAgent(agentName string, passthrough []string) {
 
 	flags := parseRunFlags(passthrough, cfg.Settings.DefaultFlags)
 	flags = applySessionResumeDefaults(flags)
+	if len(flags.HostPortErrors) > 0 {
+		ui.Errorf("Invalid --host-port value(s): %s", strings.Join(flags.HostPortErrors, ", "))
+	}
 
 	if flags.Verbose {
 		ui.Verbose = true
@@ -312,6 +317,7 @@ func runAgent(agentName string, passthrough []string) {
 			EnvVars:           flags.EnvVars,
 			IncludeDirs:       flags.IncludeDirs,
 			AllowURLs:         flags.AllowURLs,
+			HostPorts:         flags.HostPorts,
 			Passthrough:       flags.Remaining,
 			Verbose:           flags.Verbose,
 			StatusBar:         cfg.Settings.StatusBar,
@@ -418,6 +424,8 @@ type parsedFlags struct {
 	EnvVars        []string
 	IncludeDirs    []string
 	AllowURLs      []string
+	HostPorts      []int
+	HostPortErrors []string
 	Tools          []string
 	Remaining      []string
 }
@@ -498,6 +506,13 @@ func parseRunFlags(passthrough []string, defaults config.DefaultFlags) parsedFla
 				i++
 				f.AllowURLs = append(f.AllowURLs, passthrough[i])
 			}
+		case "--host-port":
+			if i+1 < len(passthrough) {
+				i++
+				ports, errs := parseHostPortList(passthrough[i])
+				f.HostPorts = append(f.HostPorts, ports...)
+				f.HostPortErrors = append(f.HostPortErrors, errs...)
+			}
 		case "--ollama":
 			f.Ollama = true
 		case "--memory":
@@ -521,6 +536,30 @@ func parseRunFlags(passthrough []string, defaults config.DefaultFlags) parsedFla
 	return f
 }
 
+func parseHostPortList(raw string) ([]int, []string) {
+	fields := strings.FieldsFunc(raw, func(r rune) bool {
+		return r == ',' || r == ' '
+	})
+	var ports []int
+	var errs []string
+	for _, field := range fields {
+		field = strings.TrimSpace(field)
+		if field == "" {
+			continue
+		}
+		port, err := strconv.Atoi(field)
+		if err != nil || port < 1 || port > 65535 {
+			errs = append(errs, field)
+			continue
+		}
+		ports = append(ports, port)
+	}
+	if len(fields) == 0 && strings.TrimSpace(raw) != "" {
+		errs = append(errs, raw)
+	}
+	return ports, errs
+}
+
 func applySessionResumeDefaults(f parsedFlags) parsedFlags {
 	// Named sessions (--name) imply auto-resume: if the session already
 	// exists it will be resumed, otherwise a fresh one is created.

cmd/run_flags_test.go

@@ -68,6 +68,32 @@ func TestParseRunFlags_Tools(t *testing.T) {
 	}
 }
 
+func TestParseRunFlags_HostPort(t *testing.T) {
+	f := parseRunFlags([]string{"--host-port", "3000", "--host-port", "5173,8080"}, config.DefaultFlags{})
+	want := []int{3000, 5173, 8080}
+	if len(f.HostPorts) != len(want) {
+		t.Fatalf("expected %d host ports, got %d: %v", len(want), len(f.HostPorts), f.HostPorts)
+	}
+	for i := range want {
+		if f.HostPorts[i] != want[i] {
+			t.Fatalf("HostPorts[%d] = %d, want %d", i, f.HostPorts[i], want[i])
+		}
+	}
+	if len(f.HostPortErrors) != 0 {
+		t.Fatalf("unexpected host port errors: %v", f.HostPortErrors)
+	}
+}
+
+func TestParseRunFlags_HostPortInvalid(t *testing.T) {
+	f := parseRunFlags([]string{"--host-port", "0,abc,70000"}, config.DefaultFlags{})
+	if len(f.HostPorts) != 0 {
+		t.Fatalf("expected no valid host ports, got %v", f.HostPorts)
+	}
+	if len(f.HostPortErrors) != 3 {
+		t.Fatalf("expected 3 host port errors, got %v", f.HostPortErrors)
+	}
+}
+
 func TestParseRunFlags_DoubleDash(t *testing.T) {
 	f := parseRunFlags([]string{"-f", "--", "-r", "extra"}, config.DefaultFlags{})
 	if !f.NoFirewall {

internal/config/types.go

@@ -113,6 +113,7 @@ type Allowlist struct {
 	Development    []string `yaml:"development"`
 	CloudServices  []string `yaml:"cloud_services"`
 	CommonServices []string `yaml:"common_services"`
+	HostPorts      []int    `yaml:"host_ports,omitempty"`
 	Custom         []string `yaml:"custom,omitempty"`
 }