"""Fail closed for outbound sockets in the local server process.

This is an application-process guard, not a system firewall or a production
sandbox. No external integrations exist in this prototype.
"""
import sys


def deny_network(event, args):
    if event in ('socket.connect', 'socket.getaddrinfo', 'socket.gethostbyname', 'socket.gethostbyaddr'):
        raise PermissionError('External connections are disabled in the local SHS prototype.')


def install_guard():
    sys.addaudithook(deny_network)