@claxedo/sandbox-manager 0.10.2 → 0.10.3

package/dist/drivers/boat-client.d.ts

@@ -18,7 +18,7 @@ export type BoatFetch = (input: string, init?: RequestInit) => Promise<Response>
 /**
  * What Boat's 429 `rate_limited` says about the account's start limit: the
  * window that is used up, its limit, and the starts used of each window. It
- * names no time the window reopens (2026-10-15), so none is kept.
+ * names no time the window reopens, so none is kept.
  */
 export type BoatStartLimit = {
     window: SandboxStartWindow;
@@ -33,10 +33,10 @@ export declare class BoatApiError extends Error {
     readonly status?: number | undefined;
     /** Boat answers 401 or 403 to the API key itself, never to a sandbox it was asked about. */
     readonly providerKeyRefused: boolean;
-    /** Create, fork and resume each count as one start (Boat's own refusal, 2026-10-15). */
+    /** Create, fork and resume each count as one start (Boat's own refusal). */
     readonly providerRateLimited?: SandboxStartLimit;
     readonly startLimit?: BoatStartLimit;
-    /** The state Boat's refusal gives the sandbox it refused, e.g. `archived` on a 400 `stop_failed` (2026-10-17). */
+    /** The state Boat's refusal gives the sandbox it refused, e.g. `archived` on a 400 `stop_failed`. */
     readonly sandboxState?: BoatSandboxState;
     constructor(message: string, code: string, status?: number | undefined, refusal?: {
         startLimit?: BoatStartLimit;
@@ -75,7 +75,7 @@ export declare function createBoatClient(options: BoatClientOptions): {
     }): Promise<void>;
     /**
      * `ttlSeconds` sets the auto-stop deadline to now plus that many seconds; `null` removes it.
-     * Boat's reference example answers `sandbox.info`; the API answers `sandbox.updated` (2026-10-13).
+     * Boat's reference example answers `sandbox.info`; the API answers `sandbox.updated`.
      */
     update(id: string, input: {
         ttlSeconds: number | null;

package/dist/drivers/boat-machine.d.ts

@@ -9,8 +9,8 @@ export declare const REGISTRY_PASSWORD_PATH = ".claxedo-registry-password";
  * and Boat's ~/.ascii/playbook.json) and removes what this machine's boot made
  * (the runtime container and Boat's record and image archive of it, the
  * workspace, the runtime's state, the boot's env). Nothing the runtime wrote
- * into the image's trees was found there (Boat, 2026-10-16: the trees held only
- * the image's own entries after two boots); what else differs on the machine
+ * into the image's trees was found there (the trees held only the image's own
+ * entries after two boots); what else differs on the machine
  * is Boat's own, and a machine created from the template gets its own
  * machine-id, SSH host keys, hostname and no hosted port.
  */
@@ -25,7 +25,7 @@ export declare function holdingBootLock(commandTimeoutSeconds: number, script: s
  * a machine whose trees hold only an older image keeps that image when its
  * runtime is no older than the oldest the control plane serves, so a wake
  * after a deploy does not wait 60–100 s on the new image's pull and seed
- * (staging, 2026-10-21); the workspace then reads as outdated, and the
+ * (staging); the workspace then reads as outdated, and the
  * person's Restart to update asks for the new image with `keepPreviousImage`
  * off. A cold boot has no previous image to keep.
  */
@@ -48,6 +48,10 @@ export type MachineBoot = {
 export declare function bootedImageFile(staged: StagedFiles): string;
 /** The image a preparation booted: the last line it prints, since `docker login` prints before it. */
 export declare function bootedImage(prepareStdout: string): string | undefined;
+/** The last line a preparation prints when its pull gave up on a registry link that kept breaking. */
+export declare const IMAGE_DOWNLOAD_INTERRUPTED = "image_download_interrupted";
+/** Leads the line a boot that could keep the machine's last image prints when it takes the named one instead, with what it found. */
+export declare const KEPT_IMAGE_SKIPPED = "kept_image_skipped:";
 /**
  * The command carries only paths: env arrives through the staged file
  * (mounted read-only, sourced by the entrypoint at every container start so
@@ -70,20 +74,6 @@ export declare function bootedImage(prepareStdout: string): string | undefined;
  * recreated after a stop that was not this driver's; then it removes the
  * image if a seed left it. A failure there leaves nothing serving.
  */
-/**
- * `docker pull` that goes on after the connection under it breaks. Docker ends
- * a pull at the first reset and keeps none of a layer that was still
- * downloading, but keeps every layer it finished, so pulling again continues
- * from those. Boat's link to ghcr resets mid-pull (2 of 8 staging updates on
- * 22 October, `failed to copy: read tcp …: connection reset by peer`). A pull
- * is run again only after such a transport failure and only while each run
- * finishes a layer none before it did, so it ends; any other failure, and a
- * run that finished nothing new, fails with the pull's own output.
- */
-/** The last line a preparation prints when its pull gave up on a registry link that kept breaking. */
-export declare const IMAGE_DOWNLOAD_INTERRUPTED = "image_download_interrupted";
-/** Leads the line a boot that could keep the machine's last image prints when it takes the named one instead, with what it found. */
-export declare const KEPT_IMAGE_SKIPPED = "kept_image_skipped:";
 export declare function machineBootScripts(boot: MachineBoot): {
     prepare: string;
     start: string;

package/dist/drivers/boat-template.mjs

@@ -63,6 +63,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -70,6 +71,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -143,6 +145,10 @@ var WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS = /* @__PURE__ */ new Set([
 function workspaceRuntimeBootSecrets(env) {
   return Object.entries(env).flatMap(([key, value]) => WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS.has(key) ? [] : [value]);
 }
+var REDACTED_VALUE_MIN_LENGTH = 8;
+function redactWorkspaceRuntimeBootSecrets(text, secrets) {
+  return secrets.filter((secret) => secret.length >= REDACTED_VALUE_MIN_LENGTH).reduce((output, secret) => output.split(secret).join("[redacted]"), text);
+}
 function workspaceRuntimeBootEnv(input) {
   assertWorkspaceRuntimeIdentityEnv(input.env);
   const env = {
@@ -194,6 +200,10 @@ var SERVED_WORKSPACE_RUNTIME_FLOOR = {
   image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
 };
 var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
+var SANDBOX_IMAGE_RUNTIME_VERSION_FILE = "opt/workspace-runtime/workspace-runtime-version";
+function servedRuntimeVersionTest(file) {
+  return `version=$(cat ${file} 2>/dev/null) && [ -n "$version" ] && [ "$(printf '%s\\n%s\\n' ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} "$version" | sort -V | head -n 1)" = ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} ]`;
+}
 
 // src/image-name.ts
 function assertSandboxImageReference(image) {
@@ -214,6 +224,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -299,8 +330,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -338,6 +369,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -410,10 +468,10 @@ var BoatApiError = class extends Error {
   }
   /** Boat answers 401 or 403 to the API key itself, never to a sandbox it was asked about. */
   providerKeyRefused;
-  /** Create, fork and resume each count as one start (Boat's own refusal, 2026-10-15). */
+  /** Create, fork and resume each count as one start (Boat's own refusal). */
   providerRateLimited;
   startLimit;
-  /** The state Boat's refusal gives the sandbox it refused, e.g. `archived` on a 400 `stop_failed` (2026-10-17). */
+  /** The state Boat's refusal gives the sandbox it refused, e.g. `archived` on a 400 `stop_failed`. */
   sandboxState;
 };
 function startCount(value) {
@@ -541,7 +599,7 @@ function createBoatClient(options) {
     },
     /**
      * `ttlSeconds` sets the auto-stop deadline to now plus that many seconds; `null` removes it.
-     * Boat's reference example answers `sandbox.info`; the API answers `sandbox.updated` (2026-10-13).
+     * Boat's reference example answers `sandbox.info`; the API answers `sandbox.updated`.
      */
     async update(id, input) {
       const value = sandbox(await api(path(id), ["sandbox.updated", "sandbox.info"], { method: "PATCH", body: input }));
@@ -658,12 +716,11 @@ function bootedImageFile(staged) {
 function bootedImage(prepareStdout) {
   return prepareStdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).pop();
 }
-var VERSION_FILE = "opt/workspace-runtime/workspace-runtime-version";
 var stubLabel = `docker image inspect --format '{{index .Config.Labels "${IMAGE_LABEL}"}}' ${STUB_IMAGE} 2>/dev/null`;
 var treesFunctions = [
   `trees_of() { printf '%s/${PERSISTENT_ROOT}/image-%s' "$(pwd)" "$(printf %s "$1" | sed 's/[^A-Za-z0-9._-]/-/g')"; }`,
   `seeded() { [ -f "$1/${IMAGE_TREES_COMPLETE_MARKER}" ] && [ -f "$1/${STUB_IMAGE_ARCHIVE}" ] && [ -f "$1/${IMAGE_ENV_FILE}" ]; }`,
-  `served() { version=$(cat "$1/${VERSION_FILE}" 2>/dev/null) && [ -n "$version" ] && [ "$(printf '%s\\n%s\\n' ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} "$version" | sort -V | head -n 1)" = ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} ]; }`
+  `served() { ${servedRuntimeVersionTest(`"$1/${SANDBOX_IMAGE_RUNTIME_VERSION_FILE}"`)}; }`
 ].join(" && ");
 var IMAGE_DOWNLOAD_INTERRUPTED = "image_download_interrupted";
 var KEPT_IMAGE_SKIPPED = "kept_image_skipped:";
@@ -685,7 +742,7 @@ function machineBootScripts(boot) {
   const seedStub = `stub=$(mktemp -d) && docker image inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${named} > "$stub/${IMAGE_ENV_FILE}" && workdir=$(docker image inspect --format '{{or .Config.WorkingDir "/"}}' ${named}) && mkdir "$stub/root" ${ROOT_DIRECTORIES.map((directory) => `"$stub/root/${directory}"`).join(" ")} && ${ROOT_LINKS.map((link) => `ln -s usr/${link} "$stub/root/${link}"`).join(" && ")} && chmod 1777 "$stub/root/tmp" && tar --owner=0 --group=0 --numeric-owner -cf "$stub/skeleton.tar" -C "$stub/root" . && docker import --change "WORKDIR $workdir" --change ${shell(`LABEL ${IMAGE_LABEL}=${boot.image}`)} "$stub/skeleton.tar" ${STUB_IMAGE} >/dev/null && docker save -o "$stub/${STUB_IMAGE_ARCHIVE}" ${STUB_IMAGE} && sudo mv "$stub/${IMAGE_ENV_FILE}" "$stub/${STUB_IMAGE_ARCHIVE}" ${trees}/ && rm -rf "$stub"`;
   const seedNamed = `{ docker image inspect ${named} >/dev/null 2>&1 || pull_resuming ${named}; } && { [ -f ${trees}/${IMAGE_TREES_COMPLETE_MARKER} ] || { ${seedTrees}; }; } && ${seedStub}`;
   const keepPrevious = `previous=$(${stubLabel}) && [ -n "$previous" ] && seeded "$(trees_of "$previous")" && served "$(trees_of "$previous")"`;
-  const keptImageSkipped = `echo "${KEPT_IMAGE_SKIPPED} stub=\${previous:-none} seeded=$(seeded "$(trees_of "$previous")" && echo yes || echo no) version=$(cat "$(trees_of "$previous")/${VERSION_FILE}" 2>/dev/null || echo none)" >&2`;
+  const keptImageSkipped = `echo "${KEPT_IMAGE_SKIPPED} stub=\${previous:-none} seeded=$(seeded "$(trees_of "$previous")" && echo yes || echo no) version=$(cat "$(trees_of "$previous")/${SANDBOX_IMAGE_RUNTIME_VERSION_FILE}" 2>/dev/null || echo none)" >&2`;
   const removeImage = `if docker image inspect "$booted" >/dev/null 2>&1; then leftovers=$(docker ps -aq --filter ancestor="$booted") && { [ -z "$leftovers" ] || docker rm -f $leftovers >/dev/null; } && id=$(docker image inspect --format '{{.Id}}' "$booted") && docker rmi "$booted" >/dev/null && sudo rm -f ${BOAT_SAVED_IMAGES}/"\${id#sha256:}".tar; fi`;
   const prepare = [
     `chmod 600 ${boot.staged.env}`,
@@ -724,7 +781,6 @@ var BOOT_TTL_SECONDS = 30 * 60;
 var CONTAINER_STOP_GRACE_SECONDS = 30;
 var HOST_RELAY_NOT_STOPPED = "The sandbox could not stop the localhost relay of this port. Try again.";
 var STDERR_TAIL_CHARS = 600;
-var REDACTED_VALUE_MIN_LENGTH = 8;
 var READY_STATES = /* @__PURE__ */ new Set(["ready", "idle", "running"]);
 var PENDING_STATES = /* @__PURE__ */ new Set(["init", "provisioning", "provisioned", "cloning"]);
 var TRANSIENT_MARKERS = ["transport_failed", "idempotency_in_progress"];
@@ -747,11 +803,8 @@ function archivedOrThrow(err) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function scrubbed(text, secrets) {
-  return secrets.filter((secret) => secret.length >= REDACTED_VALUE_MIN_LENGTH).reduce((output, secret) => output.split(secret).join("[redacted]"), text);
-}
 function scrubbedTail(text, secrets) {
-  return scrubbed(text, secrets).trim().slice(-STDERR_TAIL_CHARS);
+  return redactWorkspaceRuntimeBootSecrets(text, secrets).trim().slice(-STDERR_TAIL_CHARS);
 }
 var BoatDriverError = class extends Error {
   constructor(message) {
@@ -861,7 +914,7 @@ function createBoatSandboxDriver(options) {
         command: `docker inspect --format 'status={{.State.Status}} exit={{.State.ExitCode}} oom={{.State.OOMKilled}}' ${shell(containerName)}; docker logs --tail 20 ${shell(containerName)} 2>&1`,
         timeoutSeconds: 10
       });
-      diagnostic = runtimeBootDiagnostic(scrubbed(`${result.stdout}
+      diagnostic = runtimeBootDiagnostic(redactWorkspaceRuntimeBootSecrets(`${result.stdout}
 ${result.stderr}`, secrets), STDERR_TAIL_CHARS);
     } catch {
       diagnostic = "container diagnostics unavailable";

package/dist/drivers/boat.d.ts

@@ -22,12 +22,7 @@ export type BoatSandboxDriverOptions = {
     workspaceDir?: string;
     nativeHarness?: string;
     controlEnv?: WorkspaceRuntimeControlEnv;
-    /** Container name used for the runtime container inside the sandbox. */
     containerName?: string;
-    /**
-     * Optional `docker login` before the pull, for a private runtime registry.
-     * Omit for public images.
-     */
     registryAuth?: {
         server: string;
         username: string;

package/dist/drivers/boat.mjs

@@ -31,6 +31,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -38,6 +39,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -111,6 +113,10 @@ var WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS = /* @__PURE__ */ new Set([
 function workspaceRuntimeBootSecrets(env) {
   return Object.entries(env).flatMap(([key, value]) => WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS.has(key) ? [] : [value]);
 }
+var REDACTED_VALUE_MIN_LENGTH = 8;
+function redactWorkspaceRuntimeBootSecrets(text, secrets) {
+  return secrets.filter((secret) => secret.length >= REDACTED_VALUE_MIN_LENGTH).reduce((output, secret) => output.split(secret).join("[redacted]"), text);
+}
 function workspaceRuntimeBootEnv(input) {
   assertWorkspaceRuntimeIdentityEnv(input.env);
   const env = {
@@ -162,6 +168,10 @@ var SERVED_WORKSPACE_RUNTIME_FLOOR = {
   image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
 };
 var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
+var SANDBOX_IMAGE_RUNTIME_VERSION_FILE = "opt/workspace-runtime/workspace-runtime-version";
+function servedRuntimeVersionTest(file) {
+  return `version=$(cat ${file} 2>/dev/null) && [ -n "$version" ] && [ "$(printf '%s\\n%s\\n' ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} "$version" | sort -V | head -n 1)" = ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} ]`;
+}
 
 // src/image-name.ts
 function assertSandboxImageReference(image) {
@@ -182,6 +192,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -267,8 +298,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -306,6 +337,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -378,10 +436,10 @@ var BoatApiError = class extends Error {
   }
   /** Boat answers 401 or 403 to the API key itself, never to a sandbox it was asked about. */
   providerKeyRefused;
-  /** Create, fork and resume each count as one start (Boat's own refusal, 2026-10-15). */
+  /** Create, fork and resume each count as one start (Boat's own refusal). */
   providerRateLimited;
   startLimit;
-  /** The state Boat's refusal gives the sandbox it refused, e.g. `archived` on a 400 `stop_failed` (2026-10-17). */
+  /** The state Boat's refusal gives the sandbox it refused, e.g. `archived` on a 400 `stop_failed`. */
   sandboxState;
 };
 function startCount(value) {
@@ -509,7 +567,7 @@ function createBoatClient(options) {
     },
     /**
      * `ttlSeconds` sets the auto-stop deadline to now plus that many seconds; `null` removes it.
-     * Boat's reference example answers `sandbox.info`; the API answers `sandbox.updated` (2026-10-13).
+     * Boat's reference example answers `sandbox.info`; the API answers `sandbox.updated`.
      */
     async update(id, input) {
       const value = sandbox(await api(path(id), ["sandbox.updated", "sandbox.info"], { method: "PATCH", body: input }));
@@ -615,12 +673,11 @@ function bootedImageFile(staged) {
 function bootedImage(prepareStdout) {
   return prepareStdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).pop();
 }
-var VERSION_FILE = "opt/workspace-runtime/workspace-runtime-version";
 var stubLabel = `docker image inspect --format '{{index .Config.Labels "${IMAGE_LABEL}"}}' ${STUB_IMAGE} 2>/dev/null`;
 var treesFunctions = [
   `trees_of() { printf '%s/${PERSISTENT_ROOT}/image-%s' "$(pwd)" "$(printf %s "$1" | sed 's/[^A-Za-z0-9._-]/-/g')"; }`,
   `seeded() { [ -f "$1/${IMAGE_TREES_COMPLETE_MARKER}" ] && [ -f "$1/${STUB_IMAGE_ARCHIVE}" ] && [ -f "$1/${IMAGE_ENV_FILE}" ]; }`,
-  `served() { version=$(cat "$1/${VERSION_FILE}" 2>/dev/null) && [ -n "$version" ] && [ "$(printf '%s\\n%s\\n' ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} "$version" | sort -V | head -n 1)" = ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} ]; }`
+  `served() { ${servedRuntimeVersionTest(`"$1/${SANDBOX_IMAGE_RUNTIME_VERSION_FILE}"`)}; }`
 ].join(" && ");
 var IMAGE_DOWNLOAD_INTERRUPTED = "image_download_interrupted";
 var KEPT_IMAGE_SKIPPED = "kept_image_skipped:";
@@ -642,7 +699,7 @@ function machineBootScripts(boot) {
   const seedStub = `stub=$(mktemp -d) && docker image inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${named} > "$stub/${IMAGE_ENV_FILE}" && workdir=$(docker image inspect --format '{{or .Config.WorkingDir "/"}}' ${named}) && mkdir "$stub/root" ${ROOT_DIRECTORIES.map((directory) => `"$stub/root/${directory}"`).join(" ")} && ${ROOT_LINKS.map((link) => `ln -s usr/${link} "$stub/root/${link}"`).join(" && ")} && chmod 1777 "$stub/root/tmp" && tar --owner=0 --group=0 --numeric-owner -cf "$stub/skeleton.tar" -C "$stub/root" . && docker import --change "WORKDIR $workdir" --change ${shell(`LABEL ${IMAGE_LABEL}=${boot.image}`)} "$stub/skeleton.tar" ${STUB_IMAGE} >/dev/null && docker save -o "$stub/${STUB_IMAGE_ARCHIVE}" ${STUB_IMAGE} && sudo mv "$stub/${IMAGE_ENV_FILE}" "$stub/${STUB_IMAGE_ARCHIVE}" ${trees}/ && rm -rf "$stub"`;
   const seedNamed = `{ docker image inspect ${named} >/dev/null 2>&1 || pull_resuming ${named}; } && { [ -f ${trees}/${IMAGE_TREES_COMPLETE_MARKER} ] || { ${seedTrees}; }; } && ${seedStub}`;
   const keepPrevious = `previous=$(${stubLabel}) && [ -n "$previous" ] && seeded "$(trees_of "$previous")" && served "$(trees_of "$previous")"`;
-  const keptImageSkipped = `echo "${KEPT_IMAGE_SKIPPED} stub=\${previous:-none} seeded=$(seeded "$(trees_of "$previous")" && echo yes || echo no) version=$(cat "$(trees_of "$previous")/${VERSION_FILE}" 2>/dev/null || echo none)" >&2`;
+  const keptImageSkipped = `echo "${KEPT_IMAGE_SKIPPED} stub=\${previous:-none} seeded=$(seeded "$(trees_of "$previous")" && echo yes || echo no) version=$(cat "$(trees_of "$previous")/${SANDBOX_IMAGE_RUNTIME_VERSION_FILE}" 2>/dev/null || echo none)" >&2`;
   const removeImage = `if docker image inspect "$booted" >/dev/null 2>&1; then leftovers=$(docker ps -aq --filter ancestor="$booted") && { [ -z "$leftovers" ] || docker rm -f $leftovers >/dev/null; } && id=$(docker image inspect --format '{{.Id}}' "$booted") && docker rmi "$booted" >/dev/null && sudo rm -f ${BOAT_SAVED_IMAGES}/"\${id#sha256:}".tar; fi`;
   const prepare = [
     `chmod 600 ${boot.staged.env}`,
@@ -697,7 +754,6 @@ var BOOT_TTL_SECONDS = 30 * 60;
 var CONTAINER_STOP_GRACE_SECONDS = 30;
 var HOST_RELAY_NOT_STOPPED = "The sandbox could not stop the localhost relay of this port. Try again.";
 var STDERR_TAIL_CHARS = 600;
-var REDACTED_VALUE_MIN_LENGTH = 8;
 var READY_STATES = /* @__PURE__ */ new Set(["ready", "idle", "running"]);
 var PENDING_STATES = /* @__PURE__ */ new Set(["init", "provisioning", "provisioned", "cloning"]);
 var TRANSIENT_MARKERS = ["transport_failed", "idempotency_in_progress"];
@@ -720,11 +776,8 @@ function archivedOrThrow(err) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function scrubbed(text, secrets) {
-  return secrets.filter((secret) => secret.length >= REDACTED_VALUE_MIN_LENGTH).reduce((output, secret) => output.split(secret).join("[redacted]"), text);
-}
 function scrubbedTail(text, secrets) {
-  return scrubbed(text, secrets).trim().slice(-STDERR_TAIL_CHARS);
+  return redactWorkspaceRuntimeBootSecrets(text, secrets).trim().slice(-STDERR_TAIL_CHARS);
 }
 var BoatDriverError = class extends Error {
   constructor(message) {
@@ -834,7 +887,7 @@ function createBoatSandboxDriver(options) {
         command: `docker inspect --format 'status={{.State.Status}} exit={{.State.ExitCode}} oom={{.State.OOMKilled}}' ${shell(containerName)}; docker logs --tail 20 ${shell(containerName)} 2>&1`,
         timeoutSeconds: 10
       });
-      diagnostic = runtimeBootDiagnostic(scrubbed(`${result.stdout}
+      diagnostic = runtimeBootDiagnostic(redactWorkspaceRuntimeBootSecrets(`${result.stdout}
 ${result.stderr}`, secrets), STDERR_TAIL_CHARS);
     } catch {
       diagnostic = "container diagnostics unavailable";

package/dist/drivers/cloudflare.d.ts

@@ -5,19 +5,16 @@ export type CloudflareSandboxDriverOptions = {
     workerUrl: string;
     /** Bearer token the Worker validates (its `API_TOKEN` secret). */
     apiToken: string;
-    /** Port the workspace-runtime listens on inside the sandbox (exposed publicly). */
+    /** Port the workspace-runtime listens on inside the container, which the Worker's proxy route forwards to. */
     runtimePort?: number;
-    /** Command that launches the workspace-runtime inside the image. */
     runtimeCommand?: string;
-    /** Workspace directory inside the sandbox. */
     workspaceDir?: string;
     /**
      * Static control-plane config injected into every sandbox so the runtime can
-     * verify relay-proxied requests. Never carries per-workspace secrets — those
-     * (if any) belong to the future egress broker.
-   *   relayJwksUrl     → WORKSPACE_RUNTIME_RELAY_JWKS_URL (relay public key for RAT verify)
-   *   relayVerifyPem   → WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM (fallback to JWKS)
-   *   managementJwksUrl → WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL (config apply)
+     * verify relay-proxied requests; never a per-workspace secret.
+     *   relayJwksUrl      → WORKSPACE_RUNTIME_RELAY_JWKS_URL (relay host token keys)
+     *   relayVerifyPem    → WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM (fallback to JWKS)
+     *   managementJwksUrl → WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL (config apply)
      */
     controlEnv?: WorkspaceRuntimeControlEnv;
     /** Default native harness injected as WORKSPACE_RUNTIME_NATIVE_HARNESS, for example "opencode". */
@@ -26,7 +23,6 @@ export type CloudflareSandboxDriverOptions = {
     env?: (input: SandboxDriverEnsureInput, sandbox: {
         id: string;
     }) => Record<string, string> | Promise<Record<string, string>>;
-    /** Injected for tests. */
     fetch?: typeof fetch;
     /** ensure-runtime/HTTP timeout. */
     timeoutMs?: number;

package/dist/drivers/cloudflare.mjs

@@ -12,6 +12,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -50,6 +71,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -57,6 +79,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 function cloudflareWorkerBaseUrl(input) {
@@ -139,8 +162,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -178,6 +201,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -441,10 +491,15 @@ function createCloudflareSandboxDriver(options) {
       };
     });
   }
+  function networkPolicy(input) {
+    if (!input.net || input.net.mode === "allow-all") return void 0;
+    return { hosts: [...new Set(input.net.hosts ?? [])] };
+  }
   async function ensureHost(input) {
     const sandboxId = sandboxIdFor(input.workspaceId);
     const hostId = sandboxId;
     const egress = egressRegistrations(input);
+    const net = networkPolicy(input);
     const response = await call(
       sandboxId,
       "ensure-runtime",
@@ -457,7 +512,8 @@ function createCloudflareSandboxDriver(options) {
         // Not container env — labels are control-plane metadata.
         labels: input.labels,
         ...input.bootSource?.kind === "driver-snapshot" ? { restore: { snapshotId: input.bootSource.snapshotId }, minimumRuntimeVersion: MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION } : {},
-        ...egress ? { egress } : {}
+        ...egress ? { egress } : {},
+        ...net ? { net } : {}
       }
     ).catch((error) => {
       if (error instanceof Error && error.name === "TimeoutError") return void 0;
@@ -477,6 +533,10 @@ function createCloudflareSandboxDriver(options) {
       const reason = `Cloudflare ensure-runtime failed (${status}): ${text(data.error) ?? "no runtime url"}`;
       throw status === 401 || status === 403 ? new SandboxProviderKeyRefusedError(reason) : new Error(reason);
     }
+    if (net && asRecord(data.egress)?.contained !== true) {
+      await call(sandboxId, "stop", { epoch: input.epoch }).catch(() => void 0);
+      throw new Error("Cloudflare sandbox Worker did not confirm egress containment; deploy the current sandbox Worker (scripts/sandbox/cloudflare-worker)");
+    }
     const targetOut = {
       workspaceId: input.workspaceId,
       sandboxId,
@@ -562,7 +622,7 @@ function createCloudflareSandboxDriver(options) {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      egressControl: "none",
+      egressControl: "hosts",
       persistence: sandboxDriverCatalog.cloudflare.metadata.persistence
     },
     ensureHost,