Add the sandbox network protocol, client and Linux network service (#346)

* Add the sandbox network protocol, client and Linux network service

internal/sandboxnet defines the Network protocol (one Connect per Link
stream, then raw bytes), its strict codec, host grammar and egress check,
the Connect client with a net.Conn, and the generic Serve that resolves,
checks, dials and splices with orderly half-close and abort kept apart.
apps/sandboxio/internal/netservice is the Linux resolver and dialer.
sandboxlink.Stream gains the deadline methods yamux streams already have.

* Tighten the network egress check, dial effects, forwarding and Conn

Never permit an unspecified destination, which a TCP stack connects to the
sandbox itself, and dial the checked literal over tcp4 or tcp6. Give an
errno-typed dial failure EffectNone only when socket or connect returned it.
Hold bytes that arrive after a successful dial until Connected is written.
Serialize Conn reads and writes and fail calls after a passed deadline, as
net.Conn does. State the Stream deadline and concurrency contract, the two
request ID sequences on a service stream and the half-close residual.

* Order the network Conn's FIN after writes and type native dial timeouts

Take the write lock for CloseWrite and the orderly Close, so no Write
lands after the FIN; Close aborts instead when a Write is in progress, which
ends the pending call. Update a deadline and its cached copy under one lock.
Type a native dial timeout as TimedOut in the Linux service, and read the
Connect's deadline from the clock, since a socket deadline can fire before
the context reports its end.

Author: SaladDay

AGENTS.md

@@ -25,6 +25,7 @@ OpenAgentCore is protocol-first and modular. Core orchestrates operations that p
 | Provider–Sandbox I/O startup | `internal/sandboxbootstrap/bootstrap.go` | [Sandbox bootstrap](docs/sandbox-bootstrap.md) |
 | Runtime–file service | `internal/sandboxfs/protocol.go` | [File access protocol](docs/file-access-protocol.md) |
 | Runtime–process service | `internal/sandboxprocess/protocol.go` | [Process protocol](docs/process-protocol.md) |
+| Runtime–network service | `internal/sandboxnet/protocol.go` | [Sandbox network protocol](docs/sandbox-network-protocol.md) |
 | Core–Runtime wire | `internal/agentdaemon/proto/` | [Core–Runtime protocol](docs/runtime-protocol.md) |
 | Runtime–Harness | `apps/daemon/internal/agent/harness.go` | [Harness onboarding](contracts/agents-api/harness-onboarding.md) |
 | Harness–Model provider | `internal/modelprovider/config.go` | [Model execution](contracts/agents-api/model-execution.md) |

apps/sandboxio/internal/netservice/service.go

@@ -0,0 +1,101 @@
+//go:build linux
+
+// Package netservice is the Linux network service of the Sandbox I/O service.
+// It resolves names with the sandbox's resolver and dials TCP from the
+// sandbox's network namespace. sandboxnet.Serve runs the Network protocol over
+// it: the one Connect, the egress check, the answer and the splice.
+package netservice
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/netip"
+	"os"
+	"syscall"
+
+	"github.com/MiniMax-AI/OpenAgentCore/internal/sandboxlink"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/sandboxnet"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/sandboxwire"
+)
+
+// Service resolves and dials for sandboxnet.Serve.
+type Service struct {
+	resolver *net.Resolver
+	dialer   net.Dialer
+}
+
+var _ sandboxnet.Service = (*Service)(nil)
+
+// New returns a service that resolves with the sandbox's system resolver.
+func New() *Service { return &Service{resolver: net.DefaultResolver} }
+
+// Handle serves one Network stream under the egress its Bind carries. It is
+// the Serve function of the sandboxlink.ServiceNetwork handler.
+func (s *Service) Handle(ctx context.Context, b sandboxlink.Bind, st sandboxlink.Stream) {
+	sandboxnet.Serve(ctx, st, b.Egress, s)
+}
+
+// Resolve returns the IPv4 and IPv6 addresses of host. A name the resolver
+// reports as nonexistent, or without addresses, is NameNotResolved.
+func (s *Service) Resolve(ctx context.Context, host string) ([]netip.Addr, error) {
+	addrs, err := s.resolver.LookupNetIP(ctx, "ip", host)
+	var dnsErr *net.DNSError
+	if errors.As(err, &dnsErr) && dnsErr.IsNotFound {
+		return nil, &sandboxnet.Error{Code: sandboxnet.CodeNameNotResolved, Effect: sandboxwire.EffectNone, Cause: err}
+	}
+	return addrs, err
+}
+
+// Dial connects to addr. The address is a literal and the network names its
+// family, so nothing is resolved and no other address is tried.
+func (s *Service) Dial(ctx context.Context, addr netip.AddrPort) (*net.TCPConn, error) {
+	network := "tcp4"
+	if addr.Addr().Is6() {
+		network = "tcp6"
+	}
+	c, err := s.dialer.DialContext(ctx, network, addr.String())
+	if err != nil {
+		return nil, dialError(err)
+	}
+	return c.(*net.TCPConn), nil
+}
+
+// dialError types a failed dial by its errno. Only an errno that socket or
+// connect itself returned proves that no connection was made, so only that
+// carries EffectNone. A kernel connect timeout, and any errno from a later
+// step, such as registering the socket with the poller after connect was
+// issued, carry EffectPossible. Without an errno, the socket deadline Go sets
+// from the Connect's timeout is TimedOut: it can fire before the context
+// reports its end.
+func dialError(err error) error {
+	var errno syscall.Errno
+	if !errors.As(err, &errno) {
+		var ne net.Error
+		if errors.Is(err, os.ErrDeadlineExceeded) || errors.As(err, &ne) && ne.Timeout() {
+			return &sandboxnet.Error{Code: sandboxnet.CodeTimedOut, Effect: sandboxwire.EffectPossible, Cause: err}
+		}
+		return err
+	}
+	effect := sandboxwire.EffectPossible
+	var sys *os.SyscallError
+	if errors.As(err, &sys) && (sys.Syscall == "socket" || sys.Syscall == "connect") {
+		effect = sandboxwire.EffectNone
+	}
+	var code sandboxnet.Code
+	switch errno {
+	case syscall.ECONNREFUSED:
+		code = sandboxnet.CodeConnectionRefused
+	case syscall.ENETUNREACH, syscall.EHOSTUNREACH, syscall.ENETDOWN, syscall.EHOSTDOWN, syscall.EAFNOSUPPORT:
+		code = sandboxnet.CodeUnreachable
+	case syscall.EADDRNOTAVAIL, syscall.EMFILE, syscall.ENFILE, syscall.ENOBUFS, syscall.ENOMEM, syscall.EAGAIN:
+		code = sandboxnet.CodeResourceExhausted
+	case syscall.EACCES, syscall.EPERM:
+		code = sandboxnet.CodeDenied
+	case syscall.ETIMEDOUT:
+		code, effect = sandboxnet.CodeTimedOut, sandboxwire.EffectPossible
+	default:
+		return err
+	}
+	return &sandboxnet.Error{Code: code, Effect: effect, Cause: err}
+}