feat(supervisor-middleware): add in-process egress middleware

Cargo.toml

@@ -74,6 +74,7 @@ serde_yml = "0.0.12"
 toml = "0.8"
 apollo-parser = "0.8.5"
 tower-mcp-types = "0.12.0"
+regex = "1"
 
 # HTTP client
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots"] }

crates/openshell-cli/src/policy_update.rs

@@ -65,6 +65,7 @@ pub fn build_policy_update_plan(
                     ..Default::default()
                 })
                 .collect(),
+            middleware: Vec::new(),
         };
         merge_operations.push(PolicyMergeOperation {
             operation: Some(policy_merge_operation::Operation::AddRule(AddNetworkRule {

crates/openshell-core/src/proto/mod.rs

@@ -79,8 +79,22 @@ pub mod inference {
     }
 }
 
+#[allow(
+    clippy::all,
+    clippy::pedantic,
+    clippy::nursery,
+    unused_qualifications,
+    rust_2018_idioms
+)]
+pub mod middleware {
+    pub mod v1 {
+        include!(concat!(env!("OUT_DIR"), "/openshell.middleware.v1.rs"));
+    }
+}
+
 pub use datamodel::v1::*;
 pub use inference::v1::*;
+pub use middleware::v1::*;
 pub use openshell::*;
 pub use sandbox::v1::*;
 pub use test::ObjectForTest;

crates/openshell-policy/Cargo.toml

@@ -12,6 +12,7 @@ repository.workspace = true
 
 [dependencies]
 openshell-core = { path = "../openshell-core", default-features = false }
+prost-types = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 serde_yml = { workspace = true }

crates/openshell-policy/src/compose.rs

@@ -115,6 +115,7 @@ mod tests {
                 ..Default::default()
             }],
             binaries: Vec::new(),
+            middleware: Vec::new(),
         }
     }