@aerol-ai/aerolvm-sdk 0.5.2 → 0.5.3

package/dist/internal/client.js

@@ -610,6 +610,10 @@ function toApiCreateOptions(options) {
         env: options.env,
         os_user: options.osUser,
         network_block_all: options.networkBlockAll,
+        network_allow_out: options.networkAllowOut,
+        network_deny_out: options.networkDenyOut,
+        allow_public_traffic: options.allowPublicTraffic,
+        mask_request_host: options.maskRequestHost,
         network_bytes_in_limit: options.networkBytesInLimit,
         network_bytes_out_limit: options.networkBytesOutLimit,
         registry: options.registry,

package/dist/types.d.ts

@@ -137,6 +137,32 @@ export interface CreateOptions {
     env?: Record<string, string>;
     osUser?: string;
     networkBlockAll?: boolean;
+    /**
+     * Egress allowlist of CIDRs. When set, the sandbox may reach only these
+     * destinations; all other outbound traffic is dropped by the host firewall.
+     * Mutually exclusive with `networkDenyOut`. For a full block use
+     * `networkBlockAll` instead.
+     */
+    networkAllowOut?: string[];
+    /**
+     * Egress blocklist of CIDRs. When set, the sandbox may reach anything except
+     * these destinations. Mutually exclusive with `networkAllowOut`.
+     */
+    networkDenyOut?: string[];
+    /**
+     * Whether the sandbox may be exposed to the public internet. Defaults to
+     * true; set `false` to make `exposePort` fail — the sandbox stays reachable
+     * only via the toolbox proxy and SSH gateway, not a public URL.
+     */
+    allowPublicTraffic?: boolean;
+    /**
+     * Rewrite the upstream `Host` header on ingress to exposed HTTP ports to this
+     * value. Frameworks that validate the Host (Vite `allowedHosts`,
+     * webpack-dev-server, Django `ALLOWED_HOSTS`) reject the per-sandbox public
+     * hostname; set this to a value they accept (e.g. `"localhost"`). Empty/unset
+     * passes the host through unchanged. HTTP-only; TCP/TLS exposures ignore it.
+     */
+    maskRequestHost?: string;
     /**
      * Cap on bytes the sandbox may receive from outside the container before its
      * ingress is dropped via per-IP iptables rule. `0` (default) is unlimited.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aerol-ai/aerolvm-sdk",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -21,7 +21,7 @@
     "test": "tsc -p tsconfig.test.json --outDir dist-test && node --test dist-test/*.test.js dist-test/internal/*.test.js"
   },
   "devDependencies": {
-    "@types/node": "^25.9.2",
+    "@types/node": "^25.9.3",
     "typescript": "^6.0.3",
     "tsx": "^4.22.4"
   }