fix(network): allow localhost connect on declared open ports in proxy mode

[Frankie-Xu]

Linked Issue

Refs #1652

This PR intentionally does not close #1652 — it delivers a focused Phase-1 subset (proxy-mode localhost connect on declared ports + CLI range flags). Port 0 cross-platform semantics and dynamic bind→connect remain for maintainer direction.

Summary

In Linux proxy mode, seccomp previously allowed localhost connect only to the nono proxy listener port. That blocked legitimate localhost IPC to ports the profile already declared via open_port / listen_port (and ranges), while macOS ProxyOnly already permitted those connects.

This change:

• Allows loopback connect/sendto/sendmsg/sendmmsg to declared bind/open ports and ranges in the Linux supervisor (still fail-closed for non-loopback and undeclared ports).
• Adds --open-port-range / --listen-port-range CLI flags (with allow-port-range / allow-bind-range aliases) matching existing profile keys.
• Adds CapabilitySet::merged_localhost_port_ranges() as a pure merge helper over client-provided grants (no library policy).

Agent Disclosure

This PR was prepared by an AI coding agent on behalf of Frankie-Xu.

Consulted:

• AGENTS.md / CONTRIBUTING.md (library vs CLI boundary, DCO, unwrap policy)
• Issue Improve support for localhost whitelisting #1652 discussion (Phase-1 plan; seeking direction on port 0 / dynamic tracking)
• crates/nono-cli/src/exec_strategy/supervisor_linux.rs (decide_network_notification)
• crates/nono-cli/src/proxy_runtime.rs, cli.rs, capability_ext.rs, supervised_runtime.rs
• crates/nono-cli/src/tool-sandbox/platform/{linux,macos}.rs
• crates/nono/src/capability.rs (grant merge helper only)

Confirms compliance with repository coding and security requirements for this scoped change.

Test Plan

• make fmt-check
• make clippy
• make test / make ci locally (macOS); Linux supervisor unit tests for declared-port connect allow/deny
• scripts/test-list-aliases.sh / scripts/lint-docs.sh
• CI on GitHub (fork PRs need maintainer workflow approval)

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates (CLI --help / alias inventory; no broader docs change required for this subset)

Agent Compliance Check

• I am not prohibited from contributing under this policy
• An issue already exists
• I disclosed that I am an agent in the issue discussion
• I described my intent and approach in the issue discussion
• I reviewed repository coding and security rules for the affected area
• I provided required attribution for reused or adapted code
• I did not use forbidden patterns such as unwrap/expect
• I used NonoError where required
• I validated and canonicalized all relevant paths (N/A for this network-port change; no new path grants)
• This PR matches the approved or disclosed issue scope (focused Phase-1 subset; larger items explicitly deferred)

Made with Cursor

[Frankie-Xu]

CI approve requested — fork PR needs maintainer workflow approval. Local make ci is green on macOS (clippy/fmt/tests/audit/alias+docs lints); Linux supervisor unit coverage is included in the suite.

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+547
Lines removed	-25
Total changed	572
Classification	Large (> 300 lines)

Affected crates

• crates/nono (core library) — careful review required. This is the security-critical sandbox primitive. A bug here bypasses OS-level isolation for every downstream user.
• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

1 medium severity bug found: --listen-port-range is ignored when building the capability set.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[Frankie-Xu]

Converting to draft to honor the 1–2 open PR limit. While it's a draft I'll fix the --listen-port-range bug nogent found (parsed into allow_bind_range but never added to the capability set). No action needed from reviewers now.

[nogent-nolabs-ai]

nogent code review

No blocking issues or findings identified; the network-port sandbox extension is fully covered by tests and correctly implemented.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}