@capybara-hq/kernel 0.1.0-rc.21 → 0.1.0-rc.22

package/dist/local-devices/local-device-provider.js

@@ -7,9 +7,14 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+import { minTier, ToolError, UNSANDBOXED_NOT_ALLOWED_MESSAGE, } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
+import { ApiError } from "../errors.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KERNEL_LOGGER } from "../infra/tokens.js";
 import { deviceNotFound, SandboxService } from "../sandbox/sandbox.service.js";
+import { TIER_OPEN_GRANT_KEY, UNATTENDED_UNSANDBOXED_ERROR } from "../schedules/unattended.js";
+import { grantsWithin, NetworkGrants, relayer } from "./network-grants.js";
 import { deviceOffline, LocalDeviceRelay } from "./relay.js";
 import { DeviceTargets, sameRoots } from "./targets.js";
 /** Extra time the machine gets beyond a command's own timeout (spawn, output, the trip back). */
@@ -25,6 +30,16 @@ export const FRAME_ENVELOPE_BYTES = 64 * 1024;
 /** The most raw bytes whose base64 plus {@link FRAME_ENVELOPE_BYTES} fit in `maxFrameBytes`. */
 export const maxReadBytes = (maxFrameBytes) => Math.max(0, Math.floor((maxFrameBytes - FRAME_ENVELOPE_BYTES) / 4) * 3);
 const NAME_PREFIX = "cap-device-";
+/**
+ * The tool error of a device that runs commands without a sandbox the org does not allow (§4.3);
+ * also what a machine answers when it refuses such a command itself.
+ */
+export const UNSANDBOXED_NOT_ALLOWED_ERROR = UNSANDBOXED_NOT_ALLOWED_MESSAGE;
+/**
+ * The relay's error for a machine that refused a command with {@link UNSANDBOXED_NOT_ALLOWED_MESSAGE}
+ * (a `policy` error: the relay prefixes the machine's message, `relay.ts`).
+ */
+const MACHINE_UNSANDBOXED_REFUSAL = `Refused by the machine's local policy: ${UNSANDBOXED_NOT_ALLOWED_MESSAGE}`;
 /** The device id of a `cap-device-<deviceId>` name; undefined for any other name. */
 export const deviceIdOfName = (name) => name.startsWith(NAME_PREFIX) && name.length > NAME_PREFIX.length
     ? name.slice(NAME_PREFIX.length)
@@ -46,13 +61,17 @@ let LocalDeviceProvider = class LocalDeviceProvider {
     targets;
     sandbox;
     config;
+    grants;
+    log;
     concurrentExec = true;
     sessionIsolation = false;
-    constructor(relay, targets, sandbox, config) {
+    constructor(relay, targets, sandbox, config, grants, log) {
         this.relay = relay;
         this.targets = targets;
         this.sandbox = sandbox;
         this.config = config;
+        this.grants = grants;
+        this.log = log;
     }
     async createFileSystem(args) {
         args.signal.throwIfAborted();
@@ -103,13 +122,36 @@ let LocalDeviceProvider = class LocalDeviceProvider {
     async killTagged(h, tags, signal) {
         await this.relay.call(h.id, "killTagged", { tags }, { deadlineMs: OP_DEADLINE_MS, signal });
     }
+    /**
+     * Runs the command on the machine with the org's limits now (ruling R27) and, for a command of a
+     * run, the hosts the kernel allows that run on this device beyond the local policy (network
+     * ask-to-allow spec §6.3; only those the org's limits admit, sent only when there are some). The device's report of refused hosts is re-layered
+     * against the limits this exec carried: the kernel never takes the device's word that the org
+     * allows a host (spec §4.1).
+     *
+     * The limits are the device's **ceiling** (sandbox dev tiers spec §4.2): `limits.tier` is the
+     * highest tier the org allows, its network that tier's, `defaultTier` the org's default (the
+     * device runs at `min(local tier ?? defaultTier, tier)`) and `devHosts` the dev hosts. A run of
+     * a scheduled task without a person and without the task's `tier:open` grant is capped at `dev`
+     * (spec §11.4). Before relaying, a machine that last reported running commands without a sandbox
+     * is refused when the org does not allow it, or for such a run (`device.unsandboxed_not_allowed`,
+     * spec §4.3). The kernel knows the local policy only from the last hello or policy op, so the
+     * same decision also travels in `limits.allowUnsandboxed` and the machine enforces it itself;
+     * its refusal ({@link UNSANDBOXED_NOT_ALLOWED_MESSAGE}) becomes the same error.
+     */
     async exec(h, args) {
         const { signal, ...rest } = args;
         signal.throwIfAborted();
-        const limits = await this.currentLimits(h.id);
+        const runId = rest.actor?.runId;
+        const { orgId, limits, cap } = await this.currentLimits(h.id, runId);
+        // the run's grants for this device, cut to what the org allows now
+        const grants = runId !== undefined
+            ? grantsWithin(await this.grants.forExec({ orgId, runId, deviceId: h.id }), limits)
+            : undefined;
         signal.throwIfAborted();
+        let result;
         try {
-            return await this.relay.call(h.id, "exec", { ...rest, limits }, { deadlineMs: args.timeoutMs + EXEC_DEADLINE_MARGIN_MS, signal });
+            result = await this.relay.call(h.id, "exec", { ...rest, limits, ...(grants !== undefined && { grants }) }, { deadlineMs: args.timeoutMs + EXEC_DEADLINE_MARGIN_MS, signal });
         }
         catch (e) {
             // the contract: an exec aborted after it was sent resolves with exitCode null (the relay
@@ -117,8 +159,19 @@ let LocalDeviceProvider = class LocalDeviceProvider {
             if (signal.aborted && e === signal.reason) {
                 return { exitCode: null, stdout: "", stderr: "", truncated: false, timedOut: false };
             }
+            // the machine refused to run it unsandboxed (its local policy changed since it reported)
+            if (e instanceof ToolError && e.message === MACHINE_UNSANDBOXED_REFUSAL) {
+                this.log.warn("the machine refused a command without a sandbox", {
+                    deviceId: h.id,
+                    reason: cap !== undefined ? "unattended" : "not_allowed",
+                });
+                throw await this.unsandboxedRefusal(h.id, cap);
+            }
             throw e;
         }
+        if (result.network?.blocked === undefined)
+            return result;
+        return { ...result, network: { blocked: relayer(result.network.blocked, limits) } };
     }
     async readFile(h, path, opts) {
         // the answer must fit one frame: a larger file comes back truncated (Deliver: too large)
@@ -133,12 +186,59 @@ let LocalDeviceProvider = class LocalDeviceProvider {
     async stat(h, path, signal) {
         return this.relay.call(h.id, "stat", { path }, { deadlineMs: OP_DEADLINE_MS, signal });
     }
-    /** The org's effective limits now (ruling R27); a deleted device is not found. */
-    async currentLimits(deviceId) {
+    /**
+     * The device's org and the limits of one exec now (ruling R27): the ceiling, capped at `dev` for
+     * an unattended run without the `tier:open` grant (`cap`, set only when the platform and the org
+     * would otherwise allow an unsandboxed command); `allowUnsandboxed` whether this command may run
+     * without a sandbox. A deleted device is not found. Refuses an unsandboxed machine the org does
+     * not allow (or such a run), see {@link exec}.
+     */
+    async currentLimits(deviceId, runId) {
         const orgId = await this.targets.orgOf(deviceId);
         if (orgId === null)
             throw deviceNotFound();
-        return this.sandbox.orgLimits(orgId);
+        const [policy, unattended, unsandboxed] = await Promise.all([
+            this.sandbox.devicePolicy({ orgId, deviceId }),
+            runId === undefined ? null : this.grants.unattendedTier({ runId, deviceId }),
+            this.grants.unsandboxed(deviceId),
+        ]);
+        const capped = unattended !== null && !unattended.openGranted;
+        // what an unsandboxed refusal reports: the run's missing grant only when it alone refused
+        const cap = capped && policy.allowUnsandboxed ? { taskRunId: unattended.taskRunId } : undefined;
+        if (unsandboxed && (!policy.allowUnsandboxed || capped)) {
+            this.log.warn("command refused on a device that runs without a sandbox", {
+                deviceId,
+                reason: policy.allowUnsandboxed ? "unattended" : "not_allowed",
+            });
+            throw await this.unsandboxedRefusal(deviceId, cap);
+        }
+        const tier = capped ? minTier(policy.ceiling, "dev") : policy.ceiling;
+        const limits = await this.sandbox.deviceLimits({ orgId, deviceId }, { policy, tier });
+        return {
+            orgId,
+            limits: {
+                ...limits,
+                defaultTier: minTier(policy.defaultTier, tier),
+                // the platform and the org allow it (which needs an open ceiling) and no cap applies
+                allowUnsandboxed: policy.allowUnsandboxed && !capped,
+            },
+            cap,
+        };
+    }
+    /**
+     * The `device.unsandboxed_not_allowed` error (spec §4.3); for an unattended run refused only for
+     * its missing `tier:open` grant, the run's text, with the missing grant recorded on the task run.
+     */
+    async unsandboxedRefusal(deviceId, cap) {
+        if (cap === undefined) {
+            return new ApiError("device.unsandboxed_not_allowed", UNSANDBOXED_NOT_ALLOWED_ERROR);
+        }
+        await this.grants
+            .recordMissing(cap.taskRunId, TIER_OPEN_GRANT_KEY)
+            .catch((err) => this.log.warn("cannot record a missing task grant", { deviceId, err }));
+        return new ApiError("device.unsandboxed_not_allowed", UNATTENDED_UNSANDBOXED_ERROR, [
+            { reason: "unattended" },
+        ]);
     }
 };
 LocalDeviceProvider = __decorate([
@@ -146,6 +246,8 @@ LocalDeviceProvider = __decorate([
     __param(0, Inject(LocalDeviceRelay)),
     __param(1, Inject(DeviceTargets)),
     __param(2, Inject(SandboxService)),
-    __param(3, Inject(KernelConfigService))
+    __param(3, Inject(KernelConfigService)),
+    __param(4, Inject(NetworkGrants)),
+    __param(5, Inject(KERNEL_LOGGER))
 ], LocalDeviceProvider);
 export { LocalDeviceProvider };

package/dist/local-devices/local-devices.module.d.ts

@@ -4,7 +4,8 @@ import { LocalDeviceProvider } from "./local-device-provider.js";
 /**
  * Connected machines (environments spec §6, §13): the caller side of the device relay and the
  * kernel-internal `@local` sandbox provider, registered with {@link SandboxProviders} on init, and
- * the machines and their credentials ({@link MachinesService}).
+ * the machines and their credentials ({@link MachinesService}), changes to a device's network
+ * policy ({@link DevicePolicyService}) and the run grants sent with each exec ({@link NetworkGrants}).
  * Imported on every role: any replica may run a sandbox operation on a local device
  * (the socket itself is held by the gateway role).
  */

package/dist/local-devices/local-devices.module.js

@@ -10,14 +10,17 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Inject, Module } from "@nestjs/common";
 import { LOCAL_PROVIDER, SandboxProviders } from "../sandbox/providers.js";
 import { SandboxModule } from "../sandbox/sandbox.module.js";
+import { DevicePolicyService } from "./device-policy.service.js";
 import { LocalDeviceProvider } from "./local-device-provider.js";
 import { MachinesService } from "./machines.js";
+import { NetworkGrants } from "./network-grants.js";
 import { LocalDeviceRelay } from "./relay.js";
 import { DeviceTargets } from "./targets.js";
 /**
  * Connected machines (environments spec §6, §13): the caller side of the device relay and the
  * kernel-internal `@local` sandbox provider, registered with {@link SandboxProviders} on init, and
- * the machines and their credentials ({@link MachinesService}).
+ * the machines and their credentials ({@link MachinesService}), changes to a device's network
+ * policy ({@link DevicePolicyService}) and the run grants sent with each exec ({@link NetworkGrants}).
  * Imported on every role: any replica may run a sandbox operation on a local device
  * (the socket itself is held by the gateway role).
  */
@@ -35,8 +38,21 @@ let LocalDevicesModule = class LocalDevicesModule {
 LocalDevicesModule = __decorate([
     Module({
         imports: [SandboxModule],
-        providers: [DeviceTargets, LocalDeviceRelay, LocalDeviceProvider, MachinesService],
-        exports: [LocalDeviceRelay, LocalDeviceProvider, MachinesService],
+        providers: [
+            DeviceTargets,
+            LocalDeviceRelay,
+            LocalDeviceProvider,
+            MachinesService,
+            DevicePolicyService,
+            NetworkGrants,
+        ],
+        exports: [
+            LocalDeviceRelay,
+            LocalDeviceProvider,
+            MachinesService,
+            DevicePolicyService,
+            NetworkGrants,
+        ],
     }),
     __param(0, Inject(SandboxProviders)),
     __param(1, Inject(LocalDeviceProvider))

package/dist/local-devices/machines.d.ts

@@ -1,4 +1,4 @@
-import type { DeviceHello, DeviceStopArgs, ExtensionContext } from "@capybara-hq/plugin-sdk";
+import type { DeviceFeature, DeviceHello, DeviceLocalPolicySummary, DeviceStopArgs, ExtensionContext } from "@capybara-hq/plugin-sdk";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
@@ -23,6 +23,10 @@ export interface ActiveMachine {
     programVersion: string | null;
     lastSeenAt: Date | null;
     createdAt: Date;
+    /** The features its program reported in its last hello (known ones only). */
+    features: DeviceFeature[];
+    /** Its local network policy as last reported (hello or `policy` op); null when unknown. */
+    localPolicy: DeviceLocalPolicySummary | null;
 }
 /**
  * Connected machines and their credentials (environments spec §13.2). One active machine per
@@ -83,9 +87,16 @@ export declare class MachinesService {
      * {@link issue} already counted the reset) but serves another directory or mode (other roots,
      * ruling R23), the device's files are other files: `fs_resets` moves on (maintainer
      * decision 2026-11-08), so conversations get the files-reset notice. A previous machine that
-     * never said hello has no known roots: nothing to compare.
+     * never said hello has no known roots: nothing to compare. The reported features (known ones
+     * only) and local policy summary (null when absent or malformed) replace the stored ones, so a
+     * program downgraded to one without them is no longer sent what it cannot do. A summary the
+     * kernel cannot read (`hello.policy` dropped by the frame parser) is kept as its isolation
+     * alone, read from `rawPolicy` (the frame's raw `policy`; {@link isolationOf}: anything but
+     * `sandbox` is `none`), so it never hides that commands run without a sandbox. A reported
+     * isolation that differs from the stored one (none stored counts as `sandbox`) is audited
+     * `device.isolation_reported` (sandbox dev tiers spec §10.4), once per change.
      */
-    recordHello(machineId: string, hello: DeviceHello): Promise<void>;
+    recordHello(machineId: string, hello: DeviceHello, rawPolicy?: unknown): Promise<void>;
     /** Marks the machine seen (a ping); writes at most once every 60 seconds. */
     touch(machineId: string): Promise<void>;
     /**

package/dist/local-devices/machines.js

@@ -20,6 +20,7 @@ import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
 import { LOCAL_PROVIDER } from "../sandbox/providers.js";
 import { deviceNotFound } from "../sandbox/sandbox.service.js";
 import { deviceRevokedTopic } from "./keys.js";
+import { deviceFeaturesOf, isolationOf, localPolicyOf } from "./policy-summary.js";
 import { LocalDeviceRelay } from "./relay.js";
 /** The machine credential's prefix (`cap_dev_` plus 32 random bytes, base64url). */
 export const MACHINE_CREDENTIAL_PREFIX = "cap_dev_";
@@ -154,12 +155,29 @@ let MachinesService = class MachinesService {
      * {@link issue} already counted the reset) but serves another directory or mode (other roots,
      * ruling R23), the device's files are other files: `fs_resets` moves on (maintainer
      * decision 2026-11-08), so conversations get the files-reset notice. A previous machine that
-     * never said hello has no known roots: nothing to compare.
+     * never said hello has no known roots: nothing to compare. The reported features (known ones
+     * only) and local policy summary (null when absent or malformed) replace the stored ones, so a
+     * program downgraded to one without them is no longer sent what it cannot do. A summary the
+     * kernel cannot read (`hello.policy` dropped by the frame parser) is kept as its isolation
+     * alone, read from `rawPolicy` (the frame's raw `policy`; {@link isolationOf}: anything but
+     * `sandbox` is `none`), so it never hides that commands run without a sandbox. A reported
+     * isolation that differs from the stored one (none stored counts as `sandbox`) is audited
+     * `device.isolation_reported` (sandbox dev tiers spec §10.4), once per change.
      */
-    async recordHello(machineId, hello) {
+    async recordHello(machineId, hello, rawPolicy = hello.policy) {
         const self = await this.db
             .selectFrom("device_machines")
-            .select(["device_id", "name", "os", "arch", "roots", "created_at"])
+            .select([
+            "device_id",
+            "org_id",
+            "account_id",
+            "name",
+            "os",
+            "arch",
+            "roots",
+            "created_at",
+            "local_policy",
+        ])
             .where("id", "=", machineId)
             .where("revoked_at", "is", null)
             .forUpdate()
@@ -189,6 +207,19 @@ let MachinesService = class MachinesService {
                     .execute();
             }
         }
+        const summary = localPolicyOf(hello.policy);
+        const isolation = summary?.isolation ?? isolationOf(rawPolicy);
+        const policy = summary ?? (isolation === null ? null : { isolation });
+        const before = isolationOf(self.local_policy) ?? "sandbox";
+        if (isolation !== null && isolation !== before) {
+            await audit(this.db.db, {
+                actorAccountId: self.account_id,
+                orgId: self.org_id,
+                action: "device.isolation_reported",
+                target: self.device_id,
+                detail: { machineId, isolation, previous: before },
+            });
+        }
         await this.db
             .updateTable("device_machines")
             .set({
@@ -198,6 +229,8 @@ let MachinesService = class MachinesService {
             mode: hello.mode,
             roots: JSON.stringify(hello.roots),
             session_isolation: hello.sessionIsolation,
+            features: deviceFeaturesOf(hello.features),
+            local_policy: jsonOrNull(policy),
             last_seen_at: sql `now()`,
         })
             .where("id", "=", machineId)
@@ -302,6 +335,8 @@ let MachinesService = class MachinesService {
             "program_version",
             "last_seen_at",
             "created_at",
+            "features",
+            "local_policy",
         ])
             .where("device_id", "=", deviceId)
             .where("revoked_at", "is", null)
@@ -317,6 +352,8 @@ let MachinesService = class MachinesService {
                 programVersion: r.program_version,
                 lastSeenAt: r.last_seen_at,
                 createdAt: r.created_at,
+                features: deviceFeaturesOf(r.features),
+                localPolicy: localPolicyOf(r.local_policy),
             }
             : null;
     }
@@ -360,6 +397,7 @@ MachinesService = __decorate([
     __param(4, Inject(KERNEL_LOGGER))
 ], MachinesService);
 export { MachinesService };
+const jsonOrNull = (v) => (v === null ? null : JSON.stringify(v));
 /** Two machine rows (or a login) name the same machine: same name, OS and arch. */
 function sameMachine(a, b) {
     return a.name === b.name && a.os === b.os && a.arch === b.arch;

package/dist/local-devices/network-grants.d.ts

@@ -0,0 +1,104 @@
+import { type DeviceExecGrants, type NetworkBlockedHost, type SandboxLimits } from "@capybara-hq/plugin-sdk";
+import { KernelDb } from "../infra/database/kernel-db.js";
+/** The most hosts one exec's grants carry (the device protocol's limit). */
+export declare const MAX_GRANT_HOSTS = 100;
+/** What a run tree's network asks add up to (network ask-to-allow spec §6.8). */
+export interface NetworkRunState {
+    /** Hosts allowed for the rest of the run tree (「这次允许」). */
+    granted: Set<string>;
+    /** Hosts refused in the run tree (denied, expired, skipped, cancelled, or unchecked): never asked again. */
+    refused: Set<string>;
+    /** Network asks of this run (the per-run cap counts them). */
+    asks: number;
+    /** A network ask of the run tree is still pending (at most one at a time). */
+    pending: boolean;
+    /**
+     * Hosts the scheduled task the run serves approves on this device (spec §8.1; unattended runs
+     * only, read only with a `deviceId`): never asked about nor recorded as missing. Absent: none.
+     */
+    taskGranted?: Set<string>;
+}
+/**
+ * Network hosts the kernel allows a run beyond a device's local policy (network ask-to-allow spec
+ * §6.3): the hosts of the run tree's approved `network` asks with scope `once` (「这次允许」), read
+ * from PG for every exec, so a grant decided on one replica reaches a command on any other. A run
+ * tree is the runs of one budget window (`runs.budget_run_id` lineage): a sub-agent's run sees the
+ * root's grants, another run tree never does. The hosts a decision allowed are its
+ * `detail.grantedHosts`; a decision without them grants nothing. In an unattended run of a
+ * scheduled task, the task's `network:<host>` grants (spec §8.1) join them.
+ */
+export declare class NetworkGrants {
+    private readonly db;
+    constructor(db: KernelDb);
+    /**
+     * Hosts allowed for this exec on `deviceId`: the run tree's once-approved network asks in
+     * `orgId` about that device, while the tree's root run has not ended (a grant ends with its run;
+     * a later run of the same budget window does not inherit it), with the root run as their source
+     * and the latest decider as its account; and in an unattended run of a scheduled task, the
+     * task's network grants (spec §8.1) when the device is its creator's, with the task as their
+     * source and the creator as its account. Both together are one grant: the hosts of both, the
+     * task as the source. Undefined when none. The device applies them only when its owner allows
+     * remote grants and only within the org's limits.
+     */
+    forExec(input: {
+        orgId: string;
+        runId: string;
+        deviceId: string;
+    }): Promise<DeviceExecGrants | undefined>;
+    /**
+     * The run tree's network asks (spec §6.8): what was granted and refused, the run's asks, a
+     * pending ask. With `deviceId`, granted and refused count only the asks about that device (a
+     * host allowed on one device is not allowed on another); the cap and the pending ask count all.
+     */
+    runState(runId: string, deviceId?: string): Promise<NetworkRunState>;
+    /** The run tree's once-approved hosts as exec grants (source: the root run). */
+    private runGrants;
+    /**
+     * A scheduled task's network grants for an unattended run (spec §8.1): the task's
+     * `network:<host>` grants when the run serves a task run that is no trial run and no person
+     * joined (`taskGrantsRunOf`, inherited by its sub-agents), the task is of `orgId` (when given)
+     * and `deviceId` is a live device of the task's org owned by the task's creator (a creator
+     * approves domains for their own devices only). Exact valid hosts only.
+     */
+    private taskGrants;
+    /**
+     * The tier rule of an unattended run on `deviceId` (sandbox dev tiers spec §11.4), read fresh:
+     * null for an attended run; otherwise the task run and whether the task grants `tier:open` on
+     * this device (`unattendedTierOf`).
+     */
+    unattendedTier(input: {
+        runId: string;
+        deviceId: string;
+    }): Promise<{
+        taskRunId: string;
+        openGranted: boolean;
+    } | null>;
+    /** Records `key` in the task run's `missing_grants` (once). */
+    recordMissing(taskRunId: string, key: string): Promise<void>;
+    /**
+     * Whether the device's active machine runs commands without a sandbox
+     * (`device_machines.local_policy.isolation`, read fresh at each exec, spec §4.3), read from the
+     * stored JSON's isolation field alone ({@link isolationOf}). Fails closed for a program that
+     * applies tiers (feature `tiers`, which always sends a summary): no summary or any isolation but
+     * `sandbox` counts as unsandboxed. False without a machine, or for an older program without
+     * tiers (it has no unsandboxed mode).
+     */
+    unsandboxed(deviceId: string): Promise<boolean>;
+    /** The runs of the tree whose budget run is `root`. */
+    private treeOf;
+}
+/** Whether the org's effective egress lets a command reach `host`. */
+export declare function orgAllows(host: string, limits: Pick<SandboxLimits, "egress" | "allowHosts">): boolean;
+/**
+ * The kernel's own layer for a device's report (spec §4.1 item 3): it trusts the device's word that
+ * a host was refused, never its word that the org allows it. A host the device calls `device` that
+ * the org's effective egress (`limits`, read for this exec) does not allow becomes `org`; one that
+ * is no valid host name becomes `address`. Other layers are kept.
+ */
+export declare function relayer(blocked: NetworkBlockedHost[], limits: Pick<SandboxLimits, "egress" | "allowHosts">): NetworkBlockedHost[];
+/**
+ * `grants` cut to the hosts the org's effective egress (`limits`, read for this exec) admits, or
+ * undefined when none is left. The device intersects them with the limits too; the kernel does
+ * it first so a grant never reaches a device beyond what the org allows.
+ */
+export declare function grantsWithin(grants: DeviceExecGrants | undefined, limits: Pick<SandboxLimits, "egress" | "allowHosts">): DeviceExecGrants | undefined;