@claxedo/sandbox-manager 0.10.1 → 0.10.3

package/dist/drivers/cloudflare.mjs

@@ -12,6 +12,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -31,7 +52,7 @@ var cloudflareBilling = {
 };
 
 // ../sandbox-contract/dist/index.mjs
-var sandboxCheckpointUnusableCauses = ["expired", "runtime_outdated", "runtime_modified", "not_restorable"];
+var sandboxCheckpointUnusableCauses = ["expired", "runtime_modified", "not_restorable"];
 function isSandboxCheckpointUnusableCause(value) {
   return sandboxCheckpointUnusableCauses.some((cause) => cause === value);
 }
@@ -50,6 +71,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -57,6 +79,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 function cloudflareWorkerBaseUrl(input) {
@@ -139,8 +162,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -178,6 +201,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -311,7 +361,11 @@ function workspaceRuntimeSourceEnv(input) {
 }
 
 // src/runtime-version.ts
-var MINIMUM_RESTORABLE_WORKSPACE_RUNTIME_VERSION = "0.5.2";
+var SERVED_WORKSPACE_RUNTIME_FLOOR = {
+  version: "0.10.1",
+  image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
+};
+var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
 
 // src/drivers/cloudflare.ts
 function registryEntries(input) {
@@ -437,10 +491,15 @@ function createCloudflareSandboxDriver(options) {
       };
     });
   }
+  function networkPolicy(input) {
+    if (!input.net || input.net.mode === "allow-all") return void 0;
+    return { hosts: [...new Set(input.net.hosts ?? [])] };
+  }
   async function ensureHost(input) {
     const sandboxId = sandboxIdFor(input.workspaceId);
     const hostId = sandboxId;
     const egress = egressRegistrations(input);
+    const net = networkPolicy(input);
     const response = await call(
       sandboxId,
       "ensure-runtime",
@@ -452,8 +511,9 @@ function createCloudflareSandboxDriver(options) {
         // what makes this driver's `list()` (and therefore GC) possible at all.
         // Not container env — labels are control-plane metadata.
         labels: input.labels,
-        ...input.bootSource?.kind === "driver-snapshot" ? { restore: { snapshotId: input.bootSource.snapshotId }, minimumRuntimeVersion: MINIMUM_RESTORABLE_WORKSPACE_RUNTIME_VERSION } : {},
-        ...egress ? { egress } : {}
+        ...input.bootSource?.kind === "driver-snapshot" ? { restore: { snapshotId: input.bootSource.snapshotId }, minimumRuntimeVersion: MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION } : {},
+        ...egress ? { egress } : {},
+        ...net ? { net } : {}
       }
     ).catch((error) => {
       if (error instanceof Error && error.name === "TimeoutError") return void 0;
@@ -473,6 +533,10 @@ function createCloudflareSandboxDriver(options) {
       const reason = `Cloudflare ensure-runtime failed (${status}): ${text(data.error) ?? "no runtime url"}`;
       throw status === 401 || status === 403 ? new SandboxProviderKeyRefusedError(reason) : new Error(reason);
     }
+    if (net && asRecord(data.egress)?.contained !== true) {
+      await call(sandboxId, "stop", { epoch: input.epoch }).catch(() => void 0);
+      throw new Error("Cloudflare sandbox Worker did not confirm egress containment; deploy the current sandbox Worker (scripts/sandbox/cloudflare-worker)");
+    }
     const targetOut = {
       workspaceId: input.workspaceId,
       sandboxId,
@@ -558,7 +622,7 @@ function createCloudflareSandboxDriver(options) {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      egressControl: "none",
+      egressControl: "hosts",
       persistence: sandboxDriverCatalog.cloudflare.metadata.persistence
     },
     ensureHost,

package/dist/drivers/docker.mjs

@@ -91,6 +91,11 @@ var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
 function workspaceRuntimeVersion() {
   return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
+var SERVED_WORKSPACE_RUNTIME_FLOOR = {
+  version: "0.10.1",
+  image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
+};
+var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
 
 // src/image-name.ts
 var SNAPSHOT_SCHEMA_VERSION = 8;
@@ -133,6 +138,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -167,6 +193,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -174,6 +201,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -244,8 +272,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -283,6 +311,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,

package/dist/drivers/local-brokering.d.ts

@@ -1,9 +1,21 @@
 import type { SandboxDriver } from "../contract";
 import { localBrokeringTestDriverCatalogEntry } from "../driver-catalog";
+/**
+ * A published runtime image to run instead of `executable`: Docker on the host
+ * network, with the paths the runtime reads mounted where they are, and no
+ * sandbox-exec network policy, so it runs on Linux. The version-skew suite
+ * runs the control plane against the oldest image it still serves this way.
+ */
+export type LocalBrokeringContainer = {
+    image: string;
+    command: string;
+    mounts: readonly string[];
+};
 export type LocalBrokeringDriverOptions = {
     root: string;
     executable: string;
     args: string[];
+    container?: LocalBrokeringContainer;
     allowedOrigins: readonly string[];
     directOrigins: readonly string[];
     upstreams?: Readonly<Record<string, string>>;

package/dist/drivers/local-brokering.mjs

@@ -15,11 +15,6 @@ function asRecord(value) {
   return isRecord(value) ? value : void 0;
 }
 var CLAXEDO_TOOL_NAMES = [
-  "task_list",
-  "task_get",
-  "task_create",
-  "task_edit",
-  "task_start",
   "session_create",
   "sessions_list",
   "session_get",
@@ -30,8 +25,6 @@ var CLAXEDO_TOOL_NAMES = [
   "session_rename",
   "session_delete",
   "session_changes",
-  "documents_list",
-  "documents_open",
   "subagent_capabilities",
   "create_subagent",
   "subagent_status",
@@ -157,17 +150,17 @@ var AGENT_PRESENTATION_EVENT_TYPES = Object.keys(AGENT_PRESENTATION_EVENT_TYPE_R
 var mode = (id, name, description, level) => ({
   id,
   name,
-  description,
+  ...description ? { description } : {},
   ...level ? { level } : {}
 });
 var CLAUDE_PERMISSION_MODES = {
   modes: [
-    mode("default", "Default", "Standard behavior, prompts for dangerous operations", "ask"),
-    mode("acceptEdits", "Accept edits", "Auto-accept file edit operations"),
-    mode("auto", "Auto", "Use a model classifier to approve/deny permission prompts", "auto"),
-    mode("plan", "Plan", "Planning mode, no actual tool execution"),
-    mode("dontAsk", "Don't ask", "Don't prompt for permissions, deny if not pre-approved"),
-    mode("bypassPermissions", "Bypass permissions", "Bypass all permission checks", "full")
+    mode("default", "Default", "Asks before dangerous operations", "ask"),
+    mode("acceptEdits", "Accept edits"),
+    mode("auto", "Auto", "A model decides which actions to allow", "auto"),
+    mode("plan", "Plan", "Runs no tools"),
+    mode("dontAsk", "Don't ask", "Denies anything not pre-approved"),
+    mode("bypassPermissions", "Bypass permissions", "Runs everything without asking", "full")
   ],
   appliesFrom: "immediate",
   defaultModeId: "auto"
@@ -180,9 +173,18 @@ var CURSOR_PERMISSION_MODES = {
   ],
   appliesFrom: "next-turn"
 };
+var ANTIGRAVITY_PERMISSION_MODES = {
+  modes: [
+    mode("default", "Default", "Ask before edits and commands, per your permission settings.", "ask"),
+    mode("accept-edits", "Accept edits", "Approve file edits in the workspace without asking."),
+    mode("plan", "Plan")
+  ],
+  appliesFrom: "immediate",
+  defaultModeId: "default"
+};
 var CODEX_PERMISSION_MODES = {
   modes: [
-    mode("read-only", "Read only", "Never asks; the sandbox permits reads only, so writes fail", "ask"),
+    mode("read-only", "Read only", "Never asks; writes fail", "ask"),
     mode("workspace-write", "Workspace write", "Runs commands inside the workspace without asking; escalates outside it", "auto"),
     mode("untrusted", "Untrusted", "Only trusted commands run without asking; anything else escalates"),
     mode("full-access", "Full access", "Never asks; full filesystem and network access", "full")
@@ -226,6 +228,15 @@ var AGENT_HARNESS_DEFINITIONS = [
     authSlot: "cursor",
     cloudHost: "workspace-runtime"
   },
+  {
+    key: "antigravity",
+    id: "antigravity",
+    access: "native",
+    label: "Antigravity",
+    authEnv: "GEMINI_API_KEY",
+    authSlot: "google",
+    cloudHost: "workspace-runtime"
+  },
   {
     key: "pi",
     id: "pi",
@@ -246,7 +257,7 @@ var AGENT_HARNESS_DEFINITIONS = [
   }
 ];
 var AGENT_HARNESS_KEYS = AGENT_HARNESS_DEFINITIONS.map((item) => item.key);
-var HARNESS_IDS = ["claude", "codex", "cursor"];
+var HARNESS_IDS = ["claude", "codex", "cursor", "antigravity"];
 var HARNESS_TABLE = {
   claude: {
     label: "Claude Code",
@@ -276,6 +287,15 @@ var HARNESS_TABLE = {
     machineLoginServes: ["cursor-acp"],
     permissionModes: CURSOR_PERMISSION_MODES,
     defaultModelId: "auto"
+  },
+  antigravity: {
+    label: "Antigravity",
+    vendor: "Google",
+    providerIds: ["antigravity", "google"],
+    connectProvider: "antigravity",
+    vendorProvider: "google",
+    machineLoginServes: ["antigravity"],
+    permissionModes: ANTIGRAVITY_PERMISSION_MODES
   }
 };
 function harnessBindingIds(harness) {
@@ -451,6 +471,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -485,6 +526,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -492,6 +534,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -586,8 +629,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -625,6 +668,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -793,6 +863,7 @@ ${lines}` : ""}`);
 }
 async function closeHost(host) {
   const child = host.child;
+  if (host.container) execFileSync("docker", ["rm", "-f", host.container], { stdio: "ignore" });
   if (child && child.exitCode === null) {
     child.kill("SIGTERM");
     await new Promise((resolve) => child.once("exit", () => resolve()));
@@ -802,8 +873,14 @@ async function closeHost(host) {
   await new Promise((resolve) => host.proxy.close(() => resolve()));
   await fs.rm(host.directory, { recursive: true, force: true });
 }
+function containerRun(container, name, input) {
+  const user = `${process.getuid?.() ?? 0}:${process.getgid?.() ?? 0}`;
+  const mounts = [.../* @__PURE__ */ new Set([input.root, ...container.mounts])].flatMap((mount) => ["-v", `${mount}:${mount}`]);
+  const env = Object.keys(input.env).filter((key) => key !== "PATH").flatMap((key) => ["-e", key]);
+  return { name, args: ["run", "--rm", "--name", name, "--network", "host", "--user", user, ...mounts, ...env, "-w", input.workspace, "--entrypoint", container.command, container.image] };
+}
 function createLocalBrokeringSandboxDriver(options) {
-  if (process.platform !== "darwin") throw new Error("local brokering test driver requires macOS sandbox-exec network policy");
+  if (process.platform !== "darwin" && !options.container) throw new Error("local brokering test driver requires macOS sandbox-exec network policy, or a runtime container");
   const authority = createTestAuthority(options.root);
   const hosts = /* @__PURE__ */ new Map();
   const allowedOrigins = new Set(options.allowedOrigins.map((origin) => new URL(origin).origin));
@@ -976,11 +1053,9 @@ function createLocalBrokeringSandboxDriver(options) {
       const log = openSync(logFile, "w", 384);
       let child;
       try {
-        child = spawn("/usr/bin/sandbox-exec", ["-p", networkPolicy, options.executable, ...options.args], {
-          cwd: workspace,
-          env,
-          stdio: ["ignore", log, log]
-        });
+        const container = options.container ? containerRun(options.container, `claxedo-local-${target.sandboxId}`, { root: options.root, workspace, env }) : void 0;
+        if (container) host.container = container.name;
+        child = container ? spawn("docker", container.args, { env: { ...process.env, ...env }, stdio: ["ignore", log, log] }) : spawn("/usr/bin/sandbox-exec", ["-p", networkPolicy, options.executable, ...options.args], { cwd: workspace, env, stdio: ["ignore", log, log] });
       } finally {
         closeSync(log);
       }

package/dist/drivers/modal.mjs

@@ -73,6 +73,11 @@ var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
 function workspaceRuntimeVersion() {
   return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
+var SERVED_WORKSPACE_RUNTIME_FLOOR = {
+  version: "0.10.1",
+  image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
+};
+var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
 
 // src/image-name.ts
 var SNAPSHOT_SCHEMA_VERSION = 8;
@@ -109,6 +114,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -143,6 +169,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -150,6 +177,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -220,8 +248,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -259,6 +287,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,

package/dist/drivers/transient-error.d.ts

@@ -1,4 +1,3 @@
-/** The status and lower-cased text a driver error carries, if it carries any. */
 export declare function driverErrorSignals(err: unknown): {
     status: number | undefined;
     text: string;