harden macOS networking port

proxy_chain_manager/privacy_lan.py

@@ -16,6 +16,7 @@ from __future__ import annotations
 import json
 import logging
 import subprocess
+import sys
 from dataclasses import dataclass, field
 
 import winreg
@@ -164,6 +165,12 @@ def _restart_dnscache() -> None:
 
 def lan_status() -> dict[str, str]:
     """Human-readable current state. Returned even when not Admin."""
+    if sys.platform == "darwin":
+        return {
+            "netbios": "not applicable on macOS",
+            "llmnr": "not applicable on macOS",
+            "mdns": "managed by mDNSResponder",
+        }
     nb = _list_netbios_via_wmic()
     if nb:
         disabled = sum(1 for v in nb.values() if v == 2)
@@ -193,6 +200,8 @@ def engage_lan_lockdown() -> tuple[LanSnapshot | None, list[str]]:
     snapshot is None when the operation was refused (not Admin, etc.).
     """
     logs: list[str] = []
+    if sys.platform == "darwin":
+        return None, ["LAN lockdown is not applied on macOS; mDNSResponder is a core system service."]
     if not is_admin():
         return None, ["LAN privacy lockdown skipped — needs Administrator."]
 
@@ -227,6 +236,8 @@ def engage_lan_lockdown() -> tuple[LanSnapshot | None, list[str]]:
 
 def restore_lan(snap: LanSnapshot | None) -> list[str]:
     """Roll back to the snapshot captured by engage_lan_lockdown."""
+    if sys.platform == "darwin":
+        return []
     if snap is None or not is_admin():
         return []
     logs: list[str] = []