[8rulerstar]

What

Deleting a connection now removes its host's grant from egress_destinations when no other connection uses that host. host:huggingface.co (BUILT_IN) is never removed, and a loopback connection has nothing to remove.

Why

Listed as a Known gap in docs/architecture/egress.md: after the delete, Settings › Network stopped showing the host, but its grant stayed enabled, so the next connection to that host was allowed without asking.

Fixes #1956

Changes

• modules/egress/service.py: forget_if_unused(). The host set it shares with list_destinations() moved into _connection_hosts().
• modules/llm/connections/router.py: delete_connection() calls it in the same transaction.
• tests/integration/llm/test_egress.py: four tests (shared host, last connection, loopback, huggingface.co). The last-connection test fails before the fix.
• docs/architecture/egress.md: remove the Known gap line and describe the new behaviour.

How I tried it

• uv run pytest -m integration: 303 passed. uv run pytest -m unit: 3049 passed.
• uv run ruff check .: clean. python scripts/check_docs.py: 0 problems.

Changing a connection's base_url to another host through PUT leaves the old grant behind in the same way; I kept that out of this PR.

High-level PR Summary

This PR fixes an egress control gap where deleting a connection would leave its host's network access grant orphaned and enabled. Now when the last connection to a host is removed, its egress grant is also withdrawn (unless it's the built-in host:huggingface.co or a loopback connection), ensuring users are prompted again when reconnecting to that host.

⏱️ Estimated Review Time: 5-15 minutes

💡 Review Order Suggestion

Order	File Path
1	docs/architecture/egress.md
2	surfsense_local/backend/modules/egress/service.py
3	surfsense_local/backend/modules/llm/connections/router.py
4	surfsense_local/backend/tests/integration/llm/test_egress.py

[vercel]

@8rulerstar is attempting to deploy a commit to the Rohan Verma's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 30d81e8d-88ef-4014-8da9-2909f89b3f64

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}