review/network_guard.mjs

// Test-only process-level network guard. Loaded before prototype code.
import fs from 'node:fs';
import net from 'node:net';
import http from 'node:http';
import https from 'node:https';
import tls from 'node:tls';
import dns from 'node:dns';
import dgram from 'node:dgram';
import { syncBuiltinESMExports } from 'node:module';
const log = process.env.REVIEW_NETWORK_LOG;
function deny(kind) {
  return function (...args) {
    const event = {kind, at: new Date().toISOString()};
    if (log) fs.appendFileSync(log, JSON.stringify(event) + '\n');
    throw new Error('Independent review network guard denied ' + kind);
  };
}
globalThis.fetch = deny('fetch');
net.Socket.prototype.connect = deny('net.Socket.connect');
net.connect = deny('net.connect');
net.createConnection = deny('net.createConnection');
http.request = deny('http.request');
http.get = deny('http.get');
https.request = deny('https.request');
https.get = deny('https.get');
tls.connect = deny('tls.connect');
dns.lookup = deny('dns.lookup');
dns.resolve = deny('dns.resolve');
dgram.createSocket = deny('dgram.createSocket');
syncBuiltinESMExports();