@claxedo/sandbox-manager 0.10.2 → 0.10.3

package/dist/drivers/docker.mjs

@@ -138,6 +138,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -172,6 +193,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -179,6 +201,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -249,8 +272,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -288,6 +311,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,

package/dist/drivers/local-brokering.mjs

@@ -15,11 +15,6 @@ function asRecord(value) {
   return isRecord(value) ? value : void 0;
 }
 var CLAXEDO_TOOL_NAMES = [
-  "task_list",
-  "task_get",
-  "task_create",
-  "task_edit",
-  "task_start",
   "session_create",
   "sessions_list",
   "session_get",
@@ -30,8 +25,6 @@ var CLAXEDO_TOOL_NAMES = [
   "session_rename",
   "session_delete",
   "session_changes",
-  "documents_list",
-  "documents_open",
   "subagent_capabilities",
   "create_subagent",
   "subagent_status",
@@ -157,17 +150,17 @@ var AGENT_PRESENTATION_EVENT_TYPES = Object.keys(AGENT_PRESENTATION_EVENT_TYPE_R
 var mode = (id, name, description, level) => ({
   id,
   name,
-  description,
+  ...description ? { description } : {},
   ...level ? { level } : {}
 });
 var CLAUDE_PERMISSION_MODES = {
   modes: [
-    mode("default", "Default", "Standard behavior, prompts for dangerous operations", "ask"),
-    mode("acceptEdits", "Accept edits", "Auto-accept file edit operations"),
-    mode("auto", "Auto", "Use a model classifier to approve/deny permission prompts", "auto"),
-    mode("plan", "Plan", "Planning mode, no actual tool execution"),
-    mode("dontAsk", "Don't ask", "Don't prompt for permissions, deny if not pre-approved"),
-    mode("bypassPermissions", "Bypass permissions", "Bypass all permission checks", "full")
+    mode("default", "Default", "Asks before dangerous operations", "ask"),
+    mode("acceptEdits", "Accept edits"),
+    mode("auto", "Auto", "A model decides which actions to allow", "auto"),
+    mode("plan", "Plan", "Runs no tools"),
+    mode("dontAsk", "Don't ask", "Denies anything not pre-approved"),
+    mode("bypassPermissions", "Bypass permissions", "Runs everything without asking", "full")
   ],
   appliesFrom: "immediate",
   defaultModeId: "auto"
@@ -180,9 +173,18 @@ var CURSOR_PERMISSION_MODES = {
   ],
   appliesFrom: "next-turn"
 };
+var ANTIGRAVITY_PERMISSION_MODES = {
+  modes: [
+    mode("default", "Default", "Ask before edits and commands, per your permission settings.", "ask"),
+    mode("accept-edits", "Accept edits", "Approve file edits in the workspace without asking."),
+    mode("plan", "Plan")
+  ],
+  appliesFrom: "immediate",
+  defaultModeId: "default"
+};
 var CODEX_PERMISSION_MODES = {
   modes: [
-    mode("read-only", "Read only", "Never asks; the sandbox permits reads only, so writes fail", "ask"),
+    mode("read-only", "Read only", "Never asks; writes fail", "ask"),
     mode("workspace-write", "Workspace write", "Runs commands inside the workspace without asking; escalates outside it", "auto"),
     mode("untrusted", "Untrusted", "Only trusted commands run without asking; anything else escalates"),
     mode("full-access", "Full access", "Never asks; full filesystem and network access", "full")
@@ -226,6 +228,15 @@ var AGENT_HARNESS_DEFINITIONS = [
     authSlot: "cursor",
     cloudHost: "workspace-runtime"
   },
+  {
+    key: "antigravity",
+    id: "antigravity",
+    access: "native",
+    label: "Antigravity",
+    authEnv: "GEMINI_API_KEY",
+    authSlot: "google",
+    cloudHost: "workspace-runtime"
+  },
   {
     key: "pi",
     id: "pi",
@@ -246,7 +257,7 @@ var AGENT_HARNESS_DEFINITIONS = [
   }
 ];
 var AGENT_HARNESS_KEYS = AGENT_HARNESS_DEFINITIONS.map((item) => item.key);
-var HARNESS_IDS = ["claude", "codex", "cursor"];
+var HARNESS_IDS = ["claude", "codex", "cursor", "antigravity"];
 var HARNESS_TABLE = {
   claude: {
     label: "Claude Code",
@@ -276,6 +287,15 @@ var HARNESS_TABLE = {
     machineLoginServes: ["cursor-acp"],
     permissionModes: CURSOR_PERMISSION_MODES,
     defaultModelId: "auto"
+  },
+  antigravity: {
+    label: "Antigravity",
+    vendor: "Google",
+    providerIds: ["antigravity", "google"],
+    connectProvider: "antigravity",
+    vendorProvider: "google",
+    machineLoginServes: ["antigravity"],
+    permissionModes: ANTIGRAVITY_PERMISSION_MODES
   }
 };
 function harnessBindingIds(harness) {
@@ -451,6 +471,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -485,6 +526,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -492,6 +534,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -586,8 +629,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -625,6 +668,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,

package/dist/drivers/modal.mjs

@@ -114,6 +114,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -148,6 +169,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -155,6 +177,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -225,8 +248,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -264,6 +287,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,

package/dist/drivers/transient-error.d.ts

@@ -1,4 +1,3 @@
-/** The status and lower-cased text a driver error carries, if it carries any. */
 export declare function driverErrorSignals(err: unknown): {
     status: number | undefined;
     text: string;

package/dist/drivers/vercel.mjs

@@ -101,6 +101,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -135,6 +156,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -142,6 +164,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -212,8 +235,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -251,6 +274,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -492,17 +542,20 @@ function createVercelSandboxDriver(options) {
         "curl https://cursor.com/install -fsS | bash",
         "curl -fsSL https://ampcode.com/install.sh | bash",
         "curl -fsSL https://app.factory.ai/cli | sh",
+        "curl -fsSL https://antigravity.google/cli/install.sh | bash",
         "sudo ln -sf $HOME/.local/bin/agent /usr/local/bin/agent",
         "sudo ln -sf $HOME/.local/bin/cursor-agent /usr/local/bin/cursor-agent",
         "sudo ln -sf $HOME/.local/bin/amp /usr/local/bin/amp",
         "sudo ln -sf $HOME/.local/bin/droid /usr/local/bin/droid",
+        "sudo ln -sf $HOME/.local/bin/agy /usr/local/bin/agy",
         "command -v opencode",
         "command -v claude",
         "command -v codex",
         "command -v agent",
         "command -v cursor-agent",
         "command -v amp",
-        "command -v droid"
+        "command -v droid",
+        "command -v agy"
       ].join(" && "));
       await runSetup(builder, [
         `sudo mkdir -p ${shell(RUNTIME_DIR)}`,

package/dist/egress-policy.d.ts

@@ -8,26 +8,32 @@ export declare function sandboxNetworkPolicyWithBrokeredHosts(policy: SandboxNet
 /** @see SandboxDriverMetadata.egressControl */
 export type SandboxEgressControl = "none" | "hosts" | "hosts-and-cidrs";
 /**
- * What the manager does with a caller's `net` for a given driver: enforce
- * where the driver can, and say so loudly rather than refuse where it cannot.
+ * What a start does with a restricted policy on a driver that cannot contain
+ * egress: `"refuse"` the start, or `"allow"` the sandbox to run with the policy
+ * withheld and the gap reported. Refusing is the default; allowing is the
+ * workspace owner's explicit, auditable decision.
+ */
+export type SandboxUncontainedEgress = "refuse" | "allow";
+/**
+ * What the manager does with a caller's `net` for a given driver.
  *
  *  - `"enforce"` — the driver gets the policy verbatim and contains the
  *    sandbox. Also the answer when the caller asked for no containment
  *    (absent / `allow-all`), which is nothing to enforce.
- *  - `"withhold"` — the driver declares `egressControl: "none"`, so there is no
- *    containment to be had. The policy is NOT handed down: half the `"none"`
- *    drivers throw on a restricted policy (docker, modal, boat) and the
- *    other half silently drop it (cloudflare, the fetch bridge). Withholding at
- *    the manager means the throwing drivers never see one — their throws stay
- *    in place as their own last line of defence — and the silently-dropping
- *    ones stop pretending. The sandbox comes up with UNRESTRICTED egress, which
- *    is a real exposure, so the manager warns (see `onEgressUnenforced`).
- *  - `"refuse"` — the driver HAS egress control but cannot express this
- *    particular policy's encoding (a hosts-only driver handed an address-only
- *    allowlist). Deliberately still fail-closed: this is a composition mistake
- *    on an otherwise-enforcing driver, and degrading it to "withhold" would
- *    weaken the enforcing path. `hostedSandboxNetworkPolicy` only ever emits
- *    hosts, so no production path reaches it.
+ *  - `"withhold"` — the driver declares `egressControl: "none"` and the
+ *    start allows uncontained egress. The policy is NOT handed down: the
+ *    `"none"` drivers throw on a restricted policy (docker, modal, boat), so
+ *    withholding at the manager keeps their throws as their own last line of
+ *    defence. The sandbox comes up with UNRESTRICTED egress, which is a real
+ *    exposure, so the manager warns (see `onEgressUnenforced`).
+ *  - `"refuse"` — either the driver declares `egressControl: "none"` and the
+ *    start does not allow uncontained egress (`sandbox_egress_uncontained`,
+ *    the default), or the driver HAS egress control but cannot express this
+ *    particular policy's encoding (`sandbox_egress_policy_unenforceable`: a
+ *    hosts-only driver handed an address-only allowlist). The second is a
+ *    composition mistake on an otherwise-enforcing driver; degrading it to
+ *    "withhold" would weaken the enforcing path, and `hostedSandboxNetworkPolicy`
+ *    only ever emits hosts, so no production path reaches it.
  *
  * Pure, like `validateSandboxPersistenceCapabilities`, so the manager, the
  * composition layer, and tests can all ask the same question.
@@ -39,22 +45,18 @@ export type SandboxEgressDisposition = {
     reason: "sandbox_egress_uncontained";
 } | {
     action: "refuse";
-    reason: "sandbox_egress_policy_unenforceable";
+    reason: "sandbox_egress_uncontained" | "sandbox_egress_policy_unenforceable";
 };
 /** @see SandboxEgressDisposition */
-export declare function sandboxEgressDisposition(control: SandboxEgressControl, net: SandboxNetworkPolicy | undefined): SandboxEgressDisposition;
+export declare function sandboxEgressDisposition(control: SandboxEgressControl, net: SandboxNetworkPolicy | undefined, uncontained?: SandboxUncontainedEgress): SandboxEgressDisposition;
 /**
- * Emitted whenever a restricted egress policy is withheld because the composed
- * driver declares no egress control: an unrestricted sandbox that nobody was
- * told about is the exposure, so the degrade is never silent.
- *
- * Two phases, because a per-create line is easy to miss in request logs:
- *  - `"composition"` — once per `createSandboxManager` per driver, at boot.
- *  - `"ensure"` — every time a caller's policy is actually withheld, naming the
- *    workspace and the allowlist that did not take effect.
+ * Emitted the first time per driver per isolate that a start which allows
+ * uncontained egress has its restricted policy withheld because the driver
+ * declares no egress control: an unrestricted sandbox that nobody was told
+ * about is the exposure, so the degrade is never silent. A start that refuses
+ * uncontained egress emits none: it never runs.
  */
 export type SandboxEgressUnenforcedEvent = {
-    phase: "composition" | "ensure";
     reason: "sandbox_egress_uncontained";
     /** `SandboxDriver.id` of the composed driver. */
     driver: string;
@@ -62,12 +64,11 @@ export type SandboxEgressUnenforcedEvent = {
     egressControl: SandboxEgressControl;
     /** Ready-to-log sentence. Sinks that only forward text can use this alone. */
     message: string;
-    /** Present on `"ensure"`. */
-    workspaceId?: string;
-    /** The start's placement labels. Present on `"ensure"`. */
+    workspaceId: string;
+    /** The start's placement labels. */
     labels?: Record<string, string>;
-    /** The allowlist the caller asked for and did NOT get. Present on `"ensure"`. */
-    requested?: SandboxNetworkPolicy;
+    /** The allowlist the caller asked for and did NOT get. */
+    requested: SandboxNetworkPolicy;
 };
 /**
  * A credential the SANDBOX must be able to USE for outbound requests but must

package/dist/egress-warnings.d.ts

@@ -1,11 +1,8 @@
 import type { SandboxEgressControl, SandboxEgressUnenforcedEvent, SandboxNetworkPolicy } from "./egress-policy";
 /**
- * The two halves of the warning that a driver runs sandboxes with unrestricted
- * egress. The composition half is raised here, once per driver per isolate: a
- * per-create line lands in request logs and is easy to miss, this one lands
- * wherever the process starts, so an operator learns of it BEFORE the first
- * workspace exists. `withheld` is the start half, raised once per driver per
- * isolate from the first start whose policy the driver could not enforce.
+ * The warning that a start runs with unrestricted egress, raised once per
+ * driver per isolate from the first start whose policy the driver could not
+ * enforce. A refused start raises none: its refusal is that start's own answer.
  */
 export declare function createEgressWarnings(input: {
     driver: {
@@ -20,3 +17,4 @@ export declare function createEgressWarnings(input: {
         requested: SandboxNetworkPolicy;
     }): void;
 };
+export type EgressWarnings = ReturnType<typeof createEgressWarnings>;