From b87f9ddd55e253804fe1e9cd813c2b495e034582 Mon Sep 17 00:00:00 2001
From: Serge Gatezh <2880401+gatezh@users.noreply.github.com>
Date: Mon, 4 May 2026 11:21:50 -0600
Subject: [PATCH] fix(init-firewall): unblock startup on dead allowlist host
 (#94)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`statsig.anthropic.com` no longer resolves (Statsig migration), and the
resolver loop's `exit 1` was killing `postStartCommand` for every
consumer of these scripts. Two fixes:

- Drop `statsig.anthropic.com` from the allowlist in both
  `.devcontainer/claude-sandbox/init-firewall.sh` and
  `claude-bun/.devcontainer/init-firewall.sh`.
- Make the resolver tolerant: log `WARN` and `continue` instead of
  exiting. The default-DROP OUTPUT policy plus the explicit REJECT
  rule keep the perimeter fail-closed — a skipped host gets no allow
  rule, which is the desired posture.

Bundled adjacent consistency fix in `claude-bun`: add `-exist` to the
two `ipset add` calls so duplicate IPs returned by DNS no longer abort
the script (matches the existing `claude-sandbox` script and avoids
the failure mode in anthropics/claude-code#35197).
---
 .devcontainer/claude-sandbox/init-firewall.sh | 5 ++---
 claude-bun/.devcontainer/init-firewall.sh     | 9 ++++-----
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/.devcontainer/claude-sandbox/init-firewall.sh b/.devcontainer/claude-sandbox/init-firewall.sh
index b8ae177..2cf6ce3 100755
--- a/.devcontainer/claude-sandbox/init-firewall.sh
+++ b/.devcontainer/claude-sandbox/init-firewall.sh
@@ -63,7 +63,6 @@ for domain in \
     "registry.npmjs.org" \
     "api.anthropic.com" \
     "sentry.io" \
-    "statsig.anthropic.com" \
     "statsig.com" \
     "marketplace.visualstudio.com" \
     "vscode.blob.core.windows.net" \
@@ -74,8 +73,8 @@ for domain in \
     echo "Resolving $domain..."
     ips=$(dig +noall +answer A "$domain" | awk '$4 == "A" {print $5}')
     if [ -z "$ips" ]; then
-        echo "ERROR: Failed to resolve $domain"
-        exit 1
+        echo "WARN: Failed to resolve $domain — skipping"
+        continue
     fi
 
     while read -r ip; do
diff --git a/claude-bun/.devcontainer/init-firewall.sh b/claude-bun/.devcontainer/init-firewall.sh
index e788801..6adde5d 100644
--- a/claude-bun/.devcontainer/init-firewall.sh
+++ b/claude-bun/.devcontainer/init-firewall.sh
@@ -60,7 +60,7 @@ while read -r cidr; do
         exit 1
     fi
     echo "Adding GitHub range $cidr"
-    ipset add allowed-domains "$cidr"
+    ipset add -exist allowed-domains "$cidr"
 done < <(echo "$gh_ranges" | jq -r '(.web + .api + .git)[]' | aggregate -q)
 
 # Resolve and add other allowed domains
@@ -68,7 +68,6 @@ for domain in \
     "registry.npmjs.org" \
     "api.anthropic.com" \
     "sentry.io" \
-    "statsig.anthropic.com" \
     "statsig.com" \
     "marketplace.visualstudio.com" \
     "vscode.blob.core.windows.net" \
@@ -76,8 +75,8 @@ for domain in \
     echo "Resolving $domain..."
     ips=$(dig +noall +answer A "$domain" | awk '$4 == "A" {print $5}')
     if [ -z "$ips" ]; then
-        echo "ERROR: Failed to resolve $domain"
-        exit 1
+        echo "WARN: Failed to resolve $domain — skipping"
+        continue
     fi
 
     while read -r ip; do
@@ -86,7 +85,7 @@ for domain in \
             exit 1
         fi
         echo "Adding $ip for $domain"
-        ipset add allowed-domains "$ip"
+        ipset add -exist allowed-domains "$ip"
     done < <(echo "$ips")
 done