Network destinations need an optional port

[jeffmaury]

Is your feature request related to a problem? Please describe

OpenShell does network authorization using hostname and port. We are using only ports. Thus only ports 80 and 443 are reachable

Describe the solution you'd like

Add an optional port field for each destination. As destinations are stored as strings, we could

• use host:port notation
• change from string to { host, port} inside the workspace.json but that would required handling the 2 use cases

Describe alternatives you've considered

No response

Additional context

No response

[fullsend-ai-triage]

🤖 Triage · ⚠️ Cancelled · Started 2:51 PM UTC · Ended 2:51 PM UTC
Commit: 43d8096 · View workflow run →

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 2:52 PM UTC · Completed 2:57 PM UTC
Commit: 43d8096 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: Medium · Category: Feature

Problem

OpenShell authorizes network access using hostname and port, but Kaiden stores network destinations as plain hostname strings. In buildPolicyObject(), each host is hardcoded to produce endpoints for ports 443 and 80 only. This means sandboxes cannot reach services running on non-standard ports (e.g., 8080, 3000).

Root Cause

In openshell-network-policy.ts, the buildPolicyObject function expands each host string into two fixed endpoints (port 443 and port 80). There is no mechanism to specify a custom port.

Recommended Fix

Two approaches were proposed:

1. Parse host:port notation from existing string[] — no upstream schema change needed. Update buildPolicyObject to extract an optional :port suffix. When present, create a single endpoint on that port; when absent, fall back to the current 80/443 behavior. Update the create and settings UI to support port input.
2. Change the type from string[] to Array<{host, port?}> — cleaner but requires an upstream change to @openkaiden/workspace-configuration.

Approach 1 is the lower-friction path and can land without upstream coordination.

Proposed Test Case

// In openshell-network-policy.spec.ts

test('builds endpoints with explicit port from host:port string', () => {
  const policy = buildPolicyObject({ mode: 'deny', hosts: ['api.example.com:8080'] });
  const endpoints = policy!.network_policies!['kdn-network']!.endpoints;
  // Should produce a single endpoint on port 8080, not the default 80/443 pair
  expect(endpoints).toHaveLength(1);
  expect(endpoints[0]).toMatchObject({ host: 'api.example.com', port: 8080 });
});

test('falls back to ports 80 and 443 for plain hostname without port', () => {
  const policy = buildPolicyObject({ mode: 'deny', hosts: ['registry.npmjs.org'] });
  const endpoints = policy!.network_policies!['kdn-network']!.endpoints;
  expect(endpoints).toHaveLength(2);
  expect(endpoints[0]!.port).toBe(443);
  expect(endpoints[1]!.port).toBe(80);
});

test('rejects invalid port numbers', () => {
  const policy = buildPolicyObject({ mode: 'deny', hosts: ['api.example.com:99999'] });
  // Should either skip the invalid entry or fall back to default ports
});

---

Labels: This is a feature enhancement to the agentic workspace networking subsystem.