egress: require opt-in for HTTPS git fetch

bot_bottle/egress.py

@@ -91,6 +91,7 @@ def egress_manifest_routes(
             auth_scheme=r.AuthScheme,
             token_ref=r.TokenRef,
             roles=r.Role,
+            git_fetch=r.GitFetch,
             outbound_detectors=r.OutboundDetectors,
             inbound_detectors=r.InboundDetectors,
         ))
@@ -173,6 +174,8 @@ def _route_to_yaml_fields(r: Route) -> dict[str, object]:
                 entry_data["headers"] = headers_data
             matches_data.append(entry_data)
         fields["matches"] = matches_data
+    if r.git_fetch:
+        fields["git"] = {"fetch": True}
     if r.outbound_detectors is not None or r.inbound_detectors is not None:
         dlp: dict[str, object] = {}
         if r.outbound_detectors is not None:
@@ -242,6 +245,11 @@ def egress_render_routes(
             lines.append("    matches:")
             for entry in f["matches"]:  # type: ignore[union-attr]
                 lines.extend(_render_match_entry(entry))  # type: ignore[arg-type]
+        if "git" in f:
+            git_dict: dict[str, object] = f["git"]  # type: ignore
+            lines.append("    git:")
+            if git_dict.get("fetch") is True:
+                lines.append("      fetch: true")
         if "dlp" in f:
             dlp_dict: dict[str, object] = f["dlp"]  # type: ignore
             lines.append("    dlp:")

bot_bottle/egress_addon.py

@@ -21,6 +21,8 @@ from egress_addon_core import (  # type: ignore[import-not-found]  # pylint: dis
     build_inbound_scan_text,
     build_outbound_scan_text,
     decide,
+    decide_git_fetch,
+    is_git_fetch_request,
     is_git_push_request,
     load_config,
     match_route,
@@ -181,6 +183,18 @@ class EgressAddon:
             )
             return
 
+        if is_git_fetch_request(request_path, query):
+            git_decision = decide_git_fetch(
+                self.config.routes, flow.request.pretty_host,
+            )
+            if git_decision.action == "block":
+                self._block(
+                    flow,
+                    git_decision.reason,
+                    ctx=self._req_ctx(flow),
+                )
+                return
+
         # Strip agent-set Authorization after DLP scan so smuggled tokens
         # are caught above; the route may inject sidecar-owned auth below.
         flow.request.headers.pop("authorization", None)

bot_bottle/egress_addon_core.py

@@ -66,6 +66,7 @@ class Route:
     matches: tuple[MatchEntry, ...] = ()
     auth_scheme: str = ""
     token_env: str = ""
+    git_fetch: bool = False
     outbound_detectors: tuple[str, ...] | None = None
     inbound_detectors: tuple[str, ...] | None = None
 
@@ -316,16 +317,35 @@ def _parse_one(idx: int, raw: object) -> Route:
             f"token_env={token_env!r})"
         )
 
+    # git-over-HTTPS policy
+    git_fetch = False
+    git_raw = raw_dict.get("git")
+    if git_raw is not None:
+        if not isinstance(git_raw, dict):
+            raise ValueError(f"{label} ({host}): 'git' must be an object")
+        git_dict: dict[str, object] = typing.cast(dict[str, object], git_raw)
+        fetch_raw = git_dict.get("fetch", False)
+        if fetch_raw is True or fetch_raw is False:
+            git_fetch = fetch_raw
+        else:
+            raise ValueError(f"{label} ({host}): 'git.fetch' must be a boolean")
+        for k in git_dict:
+            if k != "fetch":
+                raise ValueError(
+                    f"{label} ({host}): git has unknown key {k!r}; "
+                    "accepted key is 'fetch'"
+                )
+
     # dlp detectors
     outbound_detectors, inbound_detectors = _parse_detectors(
         idx, host, raw_dict,
     )
 
     for k in raw_dict:
-        if k not in ("host", "matches", "auth_scheme", "token_env", "dlp"):
+        if k not in ("host", "matches", "auth_scheme", "token_env", "dlp", "git"):
             raise ValueError(
                 f"{label} ({host}): unknown key {k!r}; accepted keys "
-                f"are 'host', 'matches', 'auth_scheme', 'token_env', 'dlp'"
+                f"are 'host', 'matches', 'auth_scheme', 'token_env', 'dlp', 'git'"
             )
 
     return Route(
@@ -333,6 +353,7 @@ def _parse_one(idx: int, raw: object) -> Route:
         matches=matches,
         auth_scheme=auth_scheme,
         token_env=token_env,
+        git_fetch=git_fetch,
         outbound_detectors=outbound_detectors,
         inbound_detectors=inbound_detectors,
     )
@@ -450,6 +471,17 @@ def is_git_push_request(path: str, query: str) -> bool:
     return False
 
 
+def is_git_fetch_request(path: str, query: str) -> bool:
+    if path.endswith("/git-upload-pack"):
+        return True
+    if path.endswith("/info/refs"):
+        for pair in query.split("&"):
+            k, _, v = pair.partition("=")
+            if k == "service" and v == "git-upload-pack":
+                return True
+    return False
+
+
 # ---------------------------------------------------------------------------
 # Route lookup + decision
 # ---------------------------------------------------------------------------
@@ -513,6 +545,24 @@ def decide(
     return Decision(action="forward")
 
 
+def decide_git_fetch(
+    routes: typing.Sequence[Route],
+    request_host: str,
+) -> Decision:
+    route = match_route(routes, request_host)
+    if route is not None and route.git_fetch:
+        return Decision(action="forward")
+    return Decision(
+        action="block",
+        reason=(
+            "egress: git fetch/clone over HTTPS is not allowed by default; "
+            "use git-gate for declared repos or set "
+            "egress.routes[].git.fetch=true for explicit read-only "
+            "HTTPS Git access."
+        ),
+    )
+
+
 # ---------------------------------------------------------------------------
 # DLP scan dispatch (PRD 0053)
 # ---------------------------------------------------------------------------
@@ -660,8 +710,10 @@ __all__ = [
     "build_inbound_scan_text",
     "build_outbound_scan_text",
     "decide",
+    "decide_git_fetch",
     "evaluate_matches",
     "is_git_push_request",
+    "is_git_fetch_request",
     "load_config",
     "load_routes",
     "match_route",

bot_bottle/manifest_egress.py

@@ -64,6 +64,7 @@ class ManifestEgressRoute:
     AuthScheme: str = ""
     TokenRef: str = ""
     Role: tuple[str, ...] = ()
+    GitFetch: bool = False
     OutboundDetectors: tuple[str, ...] | None = None
     InboundDetectors: tuple[str, ...] | None = None
 
@@ -165,11 +166,30 @@ class ManifestEgressRoute:
                 label, d.get("dlp"),
             )
 
+        # --- git-over-HTTPS policy ---
+        git_fetch = False
+        if "git" in d:
+            git_d = as_json_object(d.get("git"), f"{label} git")
+            raw_fetch = git_d.get("fetch", False)
+            if isinstance(raw_fetch, bool):
+                git_fetch = raw_fetch
+            else:
+                raise ManifestError(
+                    f"{label} git.fetch must be a boolean "
+                    f"(was {type(raw_fetch).__name__})"
+                )
+            for k in git_d:
+                if k != "fetch":
+                    raise ManifestError(
+                        f"{label} git has unknown key {k!r}; "
+                        f"only 'fetch' is accepted"
+                    )
+
         for k in d:
-            if k not in ("host", "matches", "auth", "role", "dlp"):
+            if k not in ("host", "matches", "auth", "role", "dlp", "git"):
                 raise ManifestError(
                     f"{label} has unknown key {k!r}; accepted keys are "
-                    f"'host', 'matches', 'auth', 'role', 'dlp'"
+                    f"'host', 'matches', 'auth', 'role', 'dlp', 'git'"
                 )
 
         return cls(
@@ -178,6 +198,7 @@ class ManifestEgressRoute:
             AuthScheme=auth_scheme,
             TokenRef=token_ref,
             Role=roles,
+            GitFetch=git_fetch,
             OutboundDetectors=outbound_detectors,
             InboundDetectors=inbound_detectors,
         )