fix(macos): restore Homebrew sandbox callbacks - #2739

🌿 Preview your docs: https://nvidia-preview-pr-2739.docs.buildwithfern.com/openshell

Agent-driven review found the following, emphasis mine. I did not try to reproduce it, though.

P1 — Reusing the primary listener exposes HTTP routes to sandboxes

Sandbox JWT authorization protects gRPC methods, but it does not protect the primary HTTP router. That router includes WebSocket, authentication, and unauthenticated sandbox-service proxy routes (http.rs:180-187). A sandbox can therefore set a service-routing Host header and reach another sandbox’s exposed service through the gateway without authorization. Health and reflection also become reachable.

This removes the isolation that callback-only listeners provided. The PR should preserve callback restrictions on sandbox traffic or add equivalent HTTP-route enforcement before reusing the primary socket.

Agent-driven review found the following, emphasis mine. I did not try to reproduce it, though.

P1 — Reusing the primary listener exposes HTTP routes to sandboxes

OpenShell/crates/openshell-server/src/gateway_listener.rs

Lines 156 to 158 in 5445a1a

	if existing.scope == GatewayListenerScope::Primary {
	return;
	}

discards the callback scope whenever the primary listener covers the callback address. Consequently, sandbox-originated connections receive GatewayListenerScope::Primary.
Sandbox JWT authorization protects gRPC methods, but it does not protect the primary HTTP router. That router includes WebSocket, authentication, and unauthenticated sandbox-service proxy routes (http.rs:180-187). A sandbox can therefore set a service-routing Host header and reach another sandbox’s exposed service through the gateway without authorization. Health and reflection also become reachable.

This removes the isolation that callback-only listeners provided. The PR should preserve callback restrictions on sandbox traffic or add equivalent HTTP-route enforcement before reusing the primary socket.

Sandboxed workloads still won't be able to access the gateway so I don't think it's valid.