@claxedo/sandbox-manager 0.10.1 → 0.10.3

package/dist/drivers/vercel.mjs

@@ -73,6 +73,11 @@ var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
 function workspaceRuntimeVersion() {
   return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
+var SERVED_WORKSPACE_RUNTIME_FLOOR = {
+  version: "0.10.1",
+  image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
+};
+var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
 
 // src/command.ts
 function shell(input) {
@@ -96,6 +101,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -130,6 +156,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -137,6 +164,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -207,8 +235,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -246,6 +274,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -487,17 +542,20 @@ function createVercelSandboxDriver(options) {
         "curl https://cursor.com/install -fsS | bash",
         "curl -fsSL https://ampcode.com/install.sh | bash",
         "curl -fsSL https://app.factory.ai/cli | sh",
+        "curl -fsSL https://antigravity.google/cli/install.sh | bash",
         "sudo ln -sf $HOME/.local/bin/agent /usr/local/bin/agent",
         "sudo ln -sf $HOME/.local/bin/cursor-agent /usr/local/bin/cursor-agent",
         "sudo ln -sf $HOME/.local/bin/amp /usr/local/bin/amp",
         "sudo ln -sf $HOME/.local/bin/droid /usr/local/bin/droid",
+        "sudo ln -sf $HOME/.local/bin/agy /usr/local/bin/agy",
         "command -v opencode",
         "command -v claude",
         "command -v codex",
         "command -v agent",
         "command -v cursor-agent",
         "command -v amp",
-        "command -v droid"
+        "command -v droid",
+        "command -v agy"
       ].join(" && "));
       await runSetup(builder, [
         `sudo mkdir -p ${shell(RUNTIME_DIR)}`,

package/dist/egress-policy.d.ts

@@ -8,26 +8,32 @@ export declare function sandboxNetworkPolicyWithBrokeredHosts(policy: SandboxNet
 /** @see SandboxDriverMetadata.egressControl */
 export type SandboxEgressControl = "none" | "hosts" | "hosts-and-cidrs";
 /**
- * What the manager does with a caller's `net` for a given driver: enforce
- * where the driver can, and say so loudly rather than refuse where it cannot.
+ * What a start does with a restricted policy on a driver that cannot contain
+ * egress: `"refuse"` the start, or `"allow"` the sandbox to run with the policy
+ * withheld and the gap reported. Refusing is the default; allowing is the
+ * workspace owner's explicit, auditable decision.
+ */
+export type SandboxUncontainedEgress = "refuse" | "allow";
+/**
+ * What the manager does with a caller's `net` for a given driver.
  *
  *  - `"enforce"` — the driver gets the policy verbatim and contains the
  *    sandbox. Also the answer when the caller asked for no containment
  *    (absent / `allow-all`), which is nothing to enforce.
- *  - `"withhold"` — the driver declares `egressControl: "none"`, so there is no
- *    containment to be had. The policy is NOT handed down: half the `"none"`
- *    drivers throw on a restricted policy (docker, modal, boat) and the
- *    other half silently drop it (cloudflare, the fetch bridge). Withholding at
- *    the manager means the throwing drivers never see one — their throws stay
- *    in place as their own last line of defence — and the silently-dropping
- *    ones stop pretending. The sandbox comes up with UNRESTRICTED egress, which
- *    is a real exposure, so the manager warns (see `onEgressUnenforced`).
- *  - `"refuse"` — the driver HAS egress control but cannot express this
- *    particular policy's encoding (a hosts-only driver handed an address-only
- *    allowlist). Deliberately still fail-closed: this is a composition mistake
- *    on an otherwise-enforcing driver, and degrading it to "withhold" would
- *    weaken the enforcing path. `hostedSandboxNetworkPolicy` only ever emits
- *    hosts, so no production path reaches it.
+ *  - `"withhold"` — the driver declares `egressControl: "none"` and the
+ *    start allows uncontained egress. The policy is NOT handed down: the
+ *    `"none"` drivers throw on a restricted policy (docker, modal, boat), so
+ *    withholding at the manager keeps their throws as their own last line of
+ *    defence. The sandbox comes up with UNRESTRICTED egress, which is a real
+ *    exposure, so the manager warns (see `onEgressUnenforced`).
+ *  - `"refuse"` — either the driver declares `egressControl: "none"` and the
+ *    start does not allow uncontained egress (`sandbox_egress_uncontained`,
+ *    the default), or the driver HAS egress control but cannot express this
+ *    particular policy's encoding (`sandbox_egress_policy_unenforceable`: a
+ *    hosts-only driver handed an address-only allowlist). The second is a
+ *    composition mistake on an otherwise-enforcing driver; degrading it to
+ *    "withhold" would weaken the enforcing path, and `hostedSandboxNetworkPolicy`
+ *    only ever emits hosts, so no production path reaches it.
  *
  * Pure, like `validateSandboxPersistenceCapabilities`, so the manager, the
  * composition layer, and tests can all ask the same question.
@@ -39,22 +45,18 @@ export type SandboxEgressDisposition = {
     reason: "sandbox_egress_uncontained";
 } | {
     action: "refuse";
-    reason: "sandbox_egress_policy_unenforceable";
+    reason: "sandbox_egress_uncontained" | "sandbox_egress_policy_unenforceable";
 };
 /** @see SandboxEgressDisposition */
-export declare function sandboxEgressDisposition(control: SandboxEgressControl, net: SandboxNetworkPolicy | undefined): SandboxEgressDisposition;
+export declare function sandboxEgressDisposition(control: SandboxEgressControl, net: SandboxNetworkPolicy | undefined, uncontained?: SandboxUncontainedEgress): SandboxEgressDisposition;
 /**
- * Emitted whenever a restricted egress policy is withheld because the composed
- * driver declares no egress control: an unrestricted sandbox that nobody was
- * told about is the exposure, so the degrade is never silent.
- *
- * Two phases, because a per-create line is easy to miss in request logs:
- *  - `"composition"` — once per `createSandboxManager` per driver, at boot.
- *  - `"ensure"` — every time a caller's policy is actually withheld, naming the
- *    workspace and the allowlist that did not take effect.
+ * Emitted the first time per driver per isolate that a start which allows
+ * uncontained egress has its restricted policy withheld because the driver
+ * declares no egress control: an unrestricted sandbox that nobody was told
+ * about is the exposure, so the degrade is never silent. A start that refuses
+ * uncontained egress emits none: it never runs.
  */
 export type SandboxEgressUnenforcedEvent = {
-    phase: "composition" | "ensure";
     reason: "sandbox_egress_uncontained";
     /** `SandboxDriver.id` of the composed driver. */
     driver: string;
@@ -62,12 +64,11 @@ export type SandboxEgressUnenforcedEvent = {
     egressControl: SandboxEgressControl;
     /** Ready-to-log sentence. Sinks that only forward text can use this alone. */
     message: string;
-    /** Present on `"ensure"`. */
-    workspaceId?: string;
-    /** The start's placement labels. Present on `"ensure"`. */
+    workspaceId: string;
+    /** The start's placement labels. */
     labels?: Record<string, string>;
-    /** The allowlist the caller asked for and did NOT get. Present on `"ensure"`. */
-    requested?: SandboxNetworkPolicy;
+    /** The allowlist the caller asked for and did NOT get. */
+    requested: SandboxNetworkPolicy;
 };
 /**
  * A credential the SANDBOX must be able to USE for outbound requests but must

package/dist/egress-warnings.d.ts

@@ -1,11 +1,8 @@
 import type { SandboxEgressControl, SandboxEgressUnenforcedEvent, SandboxNetworkPolicy } from "./egress-policy";
 /**
- * The two halves of the warning that a driver runs sandboxes with unrestricted
- * egress. The composition half is raised here, once per driver per isolate: a
- * per-create line lands in request logs and is easy to miss, this one lands
- * wherever the process starts, so an operator learns of it BEFORE the first
- * workspace exists. `withheld` is the start half, raised once per driver per
- * isolate from the first start whose policy the driver could not enforce.
+ * The warning that a start runs with unrestricted egress, raised once per
+ * driver per isolate from the first start whose policy the driver could not
+ * enforce. A refused start raises none: its refusal is that start's own answer.
  */
 export declare function createEgressWarnings(input: {
     driver: {
@@ -20,3 +17,4 @@ export declare function createEgressWarnings(input: {
         requested: SandboxNetworkPolicy;
     }): void;
 };
+export type EgressWarnings = ReturnType<typeof createEgressWarnings>;

package/dist/hosted-network-policy.d.ts

@@ -1,67 +1,17 @@
-/**
- * The egress allowlist a HOSTED, multi-tenant sandbox is provisioned with.
- *
- * A hosted sandbox runs agent-authored code on the operator's infrastructure,
- * next to other tenants' sandboxes, holding a checkout of the user's private
- * repository and (via `SandboxBrokeredSecret`) the ability to spend the
- * operator's model credits. The default for that shape of workload is
- * restrictive, not allow-all: the interesting attack is not "the agent
- * downloads a package", it is "the agent POSTs the repository to a host the
- * attacker controls". An allowlist is what makes that fail.
- *
- * Every entry below has to earn its place, so the list is assembled from three
- * sources of truth rather than from taste:
- *
- *   1. DERIVED PER REQUEST — the control plane the sandbox reports back to and
- *      the git host it clones from. These differ per deployment and per
- *      workspace, so they are inputs, not constants.
- *   2. MODEL PROVIDERS — the endpoints an agent harness must reach to do any
- *      work at all. Taken from the harness→provider mapping the credential
- *      layer already maintains (`PROVIDER_TO_GROUP` /`DEFAULT_ALLOWLIST` in
- *      claxedo-server's `network/types.ts`), narrowed to the API hostnames.
- *   3. PACKAGE REGISTRIES — an agent that cannot install a dependency cannot
- *      edit a real repository. Same source, again narrowed.
- *
- * What is deliberately NOT here, despite being in that same default list:
- * general-purpose object storage and CDN wildcards (`*.workers.dev`,
- * `r2.cloudflarestorage.com`, `storage.googleapis.com`,
- * `*.blob.core.windows.net`, `*.amazonaws.com`). Every one of those is a
- * bucket an attacker can create in their own account, so allowlisting them
- * hands back exactly the exfiltration channel the policy exists to close. A
- * deployment that genuinely needs one adds it through `extraHosts` as an
- * explicit, auditable decision.
- *
- * This module is data + string handling only, so it runs unchanged inside the
- * hosted Worker (no DNS, no node builtins). That matters: name-based policy is
- * the only kind the Worker can compute, which is why `egressControl` treats
- * name filtering as the capability that qualifies a driver for hosted use.
- */
 import type { SandboxSource } from "./contract";
 import type { SandboxNetworkPolicy } from "./egress-policy";
-/**
- * Model-provider endpoints. Derived from the harness→provider groups in
- * claxedo-server `network/types.ts` (`PROVIDER_TO_GROUP`): claude-sdk →
- * anthropic, codex-app-server/cursor-sdk → openai,
- * google → google_ai; plus the aggregator and catalog endpoints the engine
- * itself fetches at startup.
- */
 export declare const SANDBOX_MODEL_PROVIDER_HOSTS: readonly ["api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com", "openrouter.ai", "models.dev", "opencode.ai"];
 /**
- * Package registries. Narrowed from the npm / pypi / rust / golang groups of
- * `DEFAULT_ALLOWLIST` to the hostnames a package install actually contacts —
- * the wildcard CDN entries in those groups are excluded on purpose (see the
- * module comment).
+ * Object-storage and CDN wildcards (`*.workers.dev`, `*.amazonaws.com`,
+ * `storage.googleapis.com`) stay out: each is a bucket an attacker can create
+ * in their own account, which reopens the exfiltration channel the allowlist
+ * closes. A deployment that needs one adds it through `extraHosts`.
  */
 export declare const SANDBOX_PACKAGE_REGISTRY_HOSTS: readonly ["registry.npmjs.org", "nodejs.org", "pypi.org", "files.pythonhosted.org", "crates.io", "static.crates.io", "index.crates.io", "proxy.golang.org", "sum.golang.org"];
-/** The deployment-independent floor: providers + registries. */
 export declare const SANDBOX_BASELINE_EGRESS_HOSTS: readonly ["api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com", "openrouter.ai", "models.dev", "opencode.ai", "registry.npmjs.org", "nodejs.org", "pypi.org", "files.pythonhosted.org", "crates.io", "static.crates.io", "index.crates.io", "proxy.golang.org", "sum.golang.org"];
 /**
- * The git host this workspace clones from.
- *
- * Scoped to the ONE repository host in the request rather than to a forge
- * allowlist, matching how `githubCloneSecret` scopes the clone
- * credential it brokers (`hosts: ["github.com"]`) — the credential and the
- * network policy should describe the same reachable surface.
+ * The one repository host the request clones from, matching the hosts the
+ * brokered clone credential is scoped to.
  *
  * The host is caller-selected, so only a public spelling earns an allowlist
  * entry: `169.254.169.254` or `localhost` named as a repoUrl would otherwise
@@ -78,17 +28,13 @@ export type HostedSandboxNetworkPolicyInput = {
      * plus register/heartbeat. URLs or bare hostnames; blanks are ignored.
      */
     controlPlane: Array<string | undefined>;
-    /** Workspace source — its git host is allowed, nothing else on that forge. */
+    /** Its git host is allowed, nothing else on that forge. */
     source?: SandboxSource;
-    /** Operator escape hatch for deployment-specific hosts. */
     extraHosts?: readonly string[];
 };
 /**
- * Build the restricted policy for a hosted sandbox.
- *
- * Always `mode: "restricted"`. There is no input that makes this return
- * allow-all — a hosted sandbox with an empty or unresolvable control-plane URL
- * is a misconfiguration, and answering it with "then allow everything" is how
- * the gap this closes came to exist in the first place.
+ * Always `mode: "restricted"`: a hosted sandbox with an empty or unresolvable
+ * control-plane URL is a misconfiguration, never a reason to allow everything.
+ * Name-based only (no DNS), so it also runs inside the Worker.
  */
 export declare function hostedSandboxNetworkPolicy(input: HostedSandboxNetworkPolicyInput): SandboxNetworkPolicy;

package/dist/hosted-network-policy.mjs

@@ -221,7 +221,7 @@ var SANDBOX_MODEL_PROVIDER_HOSTS = [
   "api.openai.com",
   "generativelanguage.googleapis.com",
   "openrouter.ai",
-  // Model catalog + engine config, fetched on runner startup.
+  // The model catalog and engine config a runner fetches at startup.
   "models.dev",
   "opencode.ai"
 ];

package/dist/image-name.d.ts

@@ -13,5 +13,4 @@ export declare function sandboxImageRepository(env?: SandboxImageEnv): string;
 export declare function defaultSandboxImage(version?: string, buildId?: string, env?: SandboxImageEnv, options?: {
     agentPlugins?: boolean;
 }): string;
-/** Whether an image's tag names a build that carries the Agent Plugins runtime entry. */
 export declare function sandboxImageCarriesAgentPlugins(image: string): boolean;

package/dist/image-name.mjs

@@ -3,6 +3,11 @@ var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
 function workspaceRuntimeVersion() {
   return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
+var SERVED_WORKSPACE_RUNTIME_FLOOR = {
+  version: "0.10.1",
+  image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
+};
+var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
 
 // src/image-name.ts
 var SNAPSHOT_SCHEMA_VERSION = 8;

package/dist/image.d.ts

@@ -1,4 +1,5 @@
 export { RUNTIME_DIR, WORKSPACE_RUNTIME_PORT, WORKSPACE_DIR } from "./defaults";
 export { SNAPSHOT_SCHEMA_VERSION, snapshotVersion, assertSandboxImageReference, defaultSandboxImage, } from "./image-name";
+export { SERVED_WORKSPACE_RUNTIME_FLOOR } from "./runtime-version";
 export declare const SANDBOX_IMAGE_REPOSITORY: string;
 export declare const SANDBOX_IMAGE: string;

package/dist/image.mjs

@@ -11,6 +11,11 @@ var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
 function workspaceRuntimeVersion() {
   return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
+var SERVED_WORKSPACE_RUNTIME_FLOOR = {
+  version: "0.10.1",
+  image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
+};
+var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
 
 // src/image-name.ts
 var SNAPSHOT_SCHEMA_VERSION = 8;
@@ -45,6 +50,7 @@ export {
   RUNTIME_DIR,
   SANDBOX_IMAGE,
   SANDBOX_IMAGE_REPOSITORY,
+  SERVED_WORKSPACE_RUNTIME_FLOOR,
   SNAPSHOT_SCHEMA_VERSION,
   WORKSPACE_DIR,
   WORKSPACE_RUNTIME_PORT,