feat(tlsbridge): bound the runtime SkipSet (TTL + size cap); drop residual MITM comment

- SkipSet was an unbounded map. With scope/CIDR removed, all eligible egress
  flows through the bridge, so a flood of distinct SNIs each rejecting the
  forged leaf could grow it without bound. Add a 10m TTL (self-healing: a
  transiently-pinned/rotated client gets re-attempted) and a 4096 cap with
  oldest-expiry eviction on the cold Add path. Contains stays an RLock read
  (expired entries read as absent; Add reclaims them). Tests cover TTL expiry
  and the size bound.
- main.go: drop a residual '(MITM)' in a comment (rename completed elsewhere).

Defers (per reviewer): caching upstream-verify success per host is a pure
optimization that trades verify-freshness for fewer probes — left for Phase 2.

Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/tlsbridge/decision.go

@@ -2,6 +2,7 @@ package tlsbridge
 
 import (
 	"sync"
+	"time"
 )
 
 type Verdict int
@@ -66,21 +67,59 @@ func looksLikeTLSRecord(b []byte) bool {
 	return b[0] == 0x16 && b[1] == 0x03 && b[2] >= 0x01 && b[2] <= 0x04
 }
 
+const (
+	// skipTTL bounds how long an auto-skipped host stays skipped before the
+	// bridge re-attempts interception (self-healing: a transiently-pinned or
+	// rotated client gets another chance). skipMax caps the set so a flood of
+	// distinct SNIs (each rejecting the forged leaf) cannot grow it unbounded —
+	// since scope removal routes ALL eligible egress through here.
+	skipTTL = 10 * time.Minute
+	skipMax = 4096
+)
+
 // SkipSet is the runtime auto-skip set (hosts whose minted leaf the client
-// rejected). Concurrent-safe; augments the static skip list.
+// rejected). Concurrent-safe; augments the static skip list. Entries expire
+// after skipTTL and the set is bounded to skipMax (oldest-expiry eviction).
 type SkipSet struct {
-	mu sync.RWMutex
-	m  map[string]bool
+	mu  sync.RWMutex
+	ttl time.Duration
+	max int
+	m   map[string]time.Time // host -> expiry
+}
+
+func NewSkipSet() *SkipSet {
+	return &SkipSet{ttl: skipTTL, max: skipMax, m: map[string]time.Time{}}
 }
 
-func NewSkipSet() *SkipSet { return &SkipSet{m: map[string]bool{}} }
 func (s *SkipSet) Add(host string) {
 	s.mu.Lock()
-	s.m[host] = true
-	s.mu.Unlock()
+	defer s.mu.Unlock()
+	now := time.Now()
+	if len(s.m) >= s.max {
+		// Purge expired entries; if still full, drop the earliest-expiring one.
+		// Add is cold (only fires when a minted leaf is rejected), so an O(n)
+		// sweep here is cheap.
+		var oldestK string
+		var oldestT time.Time
+		for k, exp := range s.m {
+			if !exp.After(now) {
+				delete(s.m, k)
+				continue
+			}
+			if oldestK == "" || exp.Before(oldestT) {
+				oldestK, oldestT = k, exp
+			}
+		}
+		if len(s.m) >= s.max && oldestK != "" {
+			delete(s.m, oldestK)
+		}
+	}
+	s.m[host] = now.Add(s.ttl)
 }
+
 func (s *SkipSet) Contains(host string) bool {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	return s.m[host]
+	exp, ok := s.m[host]
+	return ok && time.Now().Before(exp) // expired entries read as absent; Add reclaims them
 }

authbridge/authlib/tlsbridge/decision_test.go

@@ -1,6 +1,9 @@
 package tlsbridge
 
-import "testing"
+import (
+	"testing"
+	"time"
+)
 
 func TestDecision_Classify(t *testing.T) {
 	d := NewDecision(DecisionOpts{
@@ -55,6 +58,30 @@ func TestSkipSet_AutoSkip(t *testing.T) {
 	}
 }
 
+func TestSkipSet_TTLExpires(t *testing.T) {
+	s := NewSkipSet()
+	s.ttl = 20 * time.Millisecond // same-package test can tighten the TTL
+	s.Add("h")
+	if !s.Contains("h") {
+		t.Fatal("should contain immediately after Add")
+	}
+	time.Sleep(40 * time.Millisecond)
+	if s.Contains("h") {
+		t.Error("entry should have expired (self-healing re-attempt)")
+	}
+}
+
+func TestSkipSet_Bounded(t *testing.T) {
+	s := NewSkipSet()
+	s.max = 2 // cap small; a flood of distinct SNIs must not grow it unbounded
+	s.Add("a")
+	s.Add("b")
+	s.Add("c")
+	if len(s.m) > 2 {
+		t.Errorf("SkipSet grew past max: len=%d, want <=2", len(s.m))
+	}
+}
+
 func TestDecision_HandlesPort(t *testing.T) {
 	// Default set when Ports is nil.
 	d := NewDecision(DecisionOpts{})

authbridge/cmd/authbridge-proxy/main.go

@@ -249,7 +249,7 @@ func main() {
 	}
 
 	// TLS bridge: when enabled, the forward proxy terminates agent outbound
-	// TLS (MITM) so the outbound pipeline sees decrypted HTTPS. Constructed
+	// TLS so the outbound pipeline sees decrypted HTTPS. Constructed
 	// here and set on fpSrv below (mirroring fpSrv.SkipHosts / fpSrv.Shared).
 	// A nil *Engine leaves today's blind-tunnel behavior intact.
 	var bridge *tlsbridge.Engine