@claxedo/sandbox-manager 0.10.2 → 0.10.4

package/dist/drivers/local-brokering.mjs

@@ -15,11 +15,6 @@ function asRecord(value) {
   return isRecord(value) ? value : void 0;
 }
 var CLAXEDO_TOOL_NAMES = [
-  "task_list",
-  "task_get",
-  "task_create",
-  "task_edit",
-  "task_start",
   "session_create",
   "sessions_list",
   "session_get",
@@ -30,8 +25,6 @@ var CLAXEDO_TOOL_NAMES = [
   "session_rename",
   "session_delete",
   "session_changes",
-  "documents_list",
-  "documents_open",
   "subagent_capabilities",
   "create_subagent",
   "subagent_status",
@@ -55,6 +48,8 @@ var CLAXEDO_TOOL_NAMES = [
   "ui_guide"
 ];
 var CLAXEDO_TOOL_NAME_SET = new Set(CLAXEDO_TOOL_NAMES);
+var PROMPT_ATTACHMENT_MAX_BYTES = 32 * 1024 * 1024;
+var PROMPT_ATTACHMENT_UPLOAD_MAX_BODY_BYTES = Math.ceil(PROMPT_ATTACHMENT_MAX_BYTES / 3) * 4 + 64 * 1024;
 var CREDENTIAL_BROKER_ERRORS = {
   binding_route_required: {
     fault: "harness",
@@ -157,17 +152,17 @@ var AGENT_PRESENTATION_EVENT_TYPES = Object.keys(AGENT_PRESENTATION_EVENT_TYPE_R
 var mode = (id, name, description, level) => ({
   id,
   name,
-  description,
+  ...description ? { description } : {},
   ...level ? { level } : {}
 });
 var CLAUDE_PERMISSION_MODES = {
   modes: [
-    mode("default", "Default", "Standard behavior, prompts for dangerous operations", "ask"),
-    mode("acceptEdits", "Accept edits", "Auto-accept file edit operations"),
-    mode("auto", "Auto", "Use a model classifier to approve/deny permission prompts", "auto"),
-    mode("plan", "Plan", "Planning mode, no actual tool execution"),
-    mode("dontAsk", "Don't ask", "Don't prompt for permissions, deny if not pre-approved"),
-    mode("bypassPermissions", "Bypass permissions", "Bypass all permission checks", "full")
+    mode("default", "Default", "Asks before dangerous operations", "ask"),
+    mode("acceptEdits", "Accept edits"),
+    mode("auto", "Auto", "A model decides which actions to allow", "auto"),
+    mode("plan", "Plan", "Runs no tools"),
+    mode("dontAsk", "Don't ask", "Denies anything not pre-approved"),
+    mode("bypassPermissions", "Bypass permissions", "Runs everything without asking", "full")
   ],
   appliesFrom: "immediate",
   defaultModeId: "auto"
@@ -180,9 +175,18 @@ var CURSOR_PERMISSION_MODES = {
   ],
   appliesFrom: "next-turn"
 };
+var ANTIGRAVITY_PERMISSION_MODES = {
+  modes: [
+    mode("default", "Default", "Ask before edits and commands, per your permission settings.", "ask"),
+    mode("accept-edits", "Accept edits", "Approve file edits in the workspace without asking."),
+    mode("plan", "Plan")
+  ],
+  appliesFrom: "immediate",
+  defaultModeId: "default"
+};
 var CODEX_PERMISSION_MODES = {
   modes: [
-    mode("read-only", "Read only", "Never asks; the sandbox permits reads only, so writes fail", "ask"),
+    mode("read-only", "Read only", "Never asks; writes fail", "ask"),
     mode("workspace-write", "Workspace write", "Runs commands inside the workspace without asking; escalates outside it", "auto"),
     mode("untrusted", "Untrusted", "Only trusted commands run without asking; anything else escalates"),
     mode("full-access", "Full access", "Never asks; full filesystem and network access", "full")
@@ -226,6 +230,15 @@ var AGENT_HARNESS_DEFINITIONS = [
     authSlot: "cursor",
     cloudHost: "workspace-runtime"
   },
+  {
+    key: "antigravity",
+    id: "antigravity",
+    access: "native",
+    label: "Antigravity",
+    authEnv: "GEMINI_API_KEY",
+    authSlot: "google",
+    cloudHost: "workspace-runtime"
+  },
   {
     key: "pi",
     id: "pi",
@@ -246,7 +259,7 @@ var AGENT_HARNESS_DEFINITIONS = [
   }
 ];
 var AGENT_HARNESS_KEYS = AGENT_HARNESS_DEFINITIONS.map((item) => item.key);
-var HARNESS_IDS = ["claude", "codex", "cursor"];
+var HARNESS_IDS = ["claude", "codex", "cursor", "antigravity"];
 var HARNESS_TABLE = {
   claude: {
     label: "Claude Code",
@@ -276,6 +289,15 @@ var HARNESS_TABLE = {
     machineLoginServes: ["cursor-acp"],
     permissionModes: CURSOR_PERMISSION_MODES,
     defaultModelId: "auto"
+  },
+  antigravity: {
+    label: "Antigravity",
+    vendor: "Google",
+    providerIds: ["antigravity", "google"],
+    connectProvider: "antigravity",
+    vendorProvider: "google",
+    machineLoginServes: ["antigravity"],
+    permissionModes: ANTIGRAVITY_PERMISSION_MODES
   }
 };
 function harnessBindingIds(harness) {
@@ -451,6 +473,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -485,6 +528,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -492,6 +536,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -586,8 +631,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -625,6 +670,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,

package/dist/drivers/modal.mjs

@@ -114,6 +114,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -148,6 +169,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -155,6 +177,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -225,8 +248,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -264,6 +287,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -297,10 +347,8 @@ function isRecord(value) {
 function asRecord(value) {
   return isRecord(value) ? value : void 0;
 }
-
-// src/json.ts
-function num(input) {
-  return typeof input === "number" ? input : void 0;
+function asNumber(value) {
+  return typeof value === "number" ? value : void 0;
 }
 
 // src/drivers/transient-error.ts
@@ -313,7 +361,7 @@ function driverErrorSignals(err) {
   return {
     // `response.status` is the axios shape; `statusCode` is what SDK-native
     // error classes expose instead.
-    status: num(nested.status) ?? num(shaped.status) ?? num(shaped.statusCode),
+    status: asNumber(nested.status) ?? asNumber(shaped.status) ?? asNumber(shaped.statusCode),
     text: `${textOf(shaped.code)} ${textOf(shaped.name)} ${textOf(shaped.message)}`.toLowerCase()
   };
 }
@@ -339,9 +387,6 @@ function nameFor(workspaceId) {
   return `claxedo-${workspaceId}`;
 }
 var TRANSIENT_MARKERS = ["timeout", "unavailable", "deadline"];
-function transientDriverError(err) {
-  return isTransientDriverError(err, TRANSIENT_MARKERS);
-}
 function createModalSandboxDriver(options) {
   let defaultClient;
   function resolveClient() {
@@ -439,7 +484,7 @@ function createModalSandboxDriver(options) {
         ...network(input)
       }
     ).catch((err) => {
-      if (transientDriverError(err)) return void 0;
+      if (isTransientDriverError(err, TRANSIENT_MARKERS)) return void 0;
       throw err;
     });
     if (!sandbox) return { provisioning: true, retryAfterMs: TRANSIENT_DRIVER_RETRY_MS };

package/dist/drivers/transient-error.d.ts

@@ -1,4 +1,3 @@
-/** The status and lower-cased text a driver error carries, if it carries any. */
 export declare function driverErrorSignals(err: unknown): {
     status: number | undefined;
     text: string;

package/dist/drivers/vercel.mjs

@@ -101,6 +101,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -135,6 +156,7 @@ var sandboxDriverCredentialFields = {
     { key: "worker_url", label: "Worker URL" }
   ],
   boat: [{ key: "api_key", label: "API Key", secret: true }],
+  agent37: [{ key: "api_key", label: "API Key", secret: true }],
   docker: [{ key: "image", label: "Image" }]
 };
 var sandboxDriverLabels = {
@@ -142,6 +164,7 @@ var sandboxDriverLabels = {
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 
@@ -212,8 +235,8 @@ var sandboxDriverCatalog = {
       hostWatchesIdle: true,
       targetAccess: "relay",
       secretBrokering: "native",
-      // Credential handlers do not restrict unrelated destinations.
-      egressControl: "none",
+      // The sandbox Worker starts the container without internet and routes each allowed host through itself; a Worker that cannot confirm that refuses the start.
+      egressControl: "hosts",
       // A container snapshot holds the whole root filesystem; the platform keeps it 30 days past its last restore and offers no deletion.
       persistence: {
         resume: "replacement-restore",
@@ -251,6 +274,33 @@ var sandboxDriverCatalog = {
       machineClasses: ["small", "default", "large"]
     }
   },
+  agent37: {
+    id: "agent37",
+    label: sandboxDriverLabels.agent37,
+    credentialFields: sandboxDriverCredentialFields.agent37,
+    runtimeNetwork: { controlPlane: "direct", relay: "configured" },
+    runtimeEnv: "callback",
+    preparedImage: true,
+    billing: agent37Billing,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // An instance's network policy lists domains, reached over HTTPS on 443 alone, and IPv4 ranges; private ranges stay blocked whatever it lists.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      },
+      machineClasses: ["small", "default", "large"]
+    }
+  },
   docker: {
     id: "docker",
     label: sandboxDriverLabels.docker,
@@ -284,10 +334,8 @@ function isRecord(value) {
 function asRecord(value) {
   return isRecord(value) ? value : void 0;
 }
-
-// src/json.ts
-function num(input) {
-  return typeof input === "number" ? input : void 0;
+function asNumber(value) {
+  return typeof value === "number" ? value : void 0;
 }
 
 // src/drivers/transient-error.ts
@@ -300,7 +348,7 @@ function driverErrorSignals(err) {
   return {
     // `response.status` is the axios shape; `statusCode` is what SDK-native
     // error classes expose instead.
-    status: num(nested.status) ?? num(shaped.status) ?? num(shaped.statusCode),
+    status: asNumber(nested.status) ?? asNumber(shaped.status) ?? asNumber(shaped.statusCode),
     text: `${textOf(shaped.code)} ${textOf(shaped.name)} ${textOf(shaped.message)}`.toLowerCase()
   };
 }
@@ -329,7 +377,8 @@ var HARNESS_RELEASE_AGE_EXCLUSIONS = `printf '%s\\n' ${[
   "@anthropic-ai/claude-*",
   "@cursor/sdk*",
   "@earendil-works/*",
-  "@openai/codex"
+  "@openai/codex",
+  "@opencode/*"
 ].map((name) => `'min-release-age-exclude[]=${name}'`).join(" ")} >> "$HOME/.npmrc"`;
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
 var DEFAULT_WORKSPACE_DIR = "/workspace";
@@ -351,9 +400,6 @@ function nameFor(workspaceId) {
   return `claxedo-${workspaceId}`;
 }
 var TRANSIENT_MARKERS = ["timeout", "unavailable", "deadline", "pending"];
-function transientDriverError(err) {
-  return isTransientDriverError(err, TRANSIENT_MARKERS);
-}
 function network(input) {
   if (!input.net || input.net.mode === "allow-all") return void 0;
   const hosts = input.net.hosts ?? [];
@@ -488,21 +534,25 @@ function createVercelSandboxDriver(options) {
       await runSetup(builder, "sudo dnf install -y git make gcc-c++ python3 > /dev/null 2>&1");
       await runSetup(builder, [
         HARNESS_RELEASE_AGE_EXCLUSIONS,
-        "npm i -g --min-release-age=2 tsx@4.22.3 opencode-ai@1.15.10 @anthropic-ai/claude-code@2.1.285 @openai/codex@0.159.2",
+        "npm i -g --min-release-age=2 tsx@4.22.3 @anthropic-ai/claude-code@2.1.323 @openai/codex@0.165.0",
+        "sudo mkdir -p /etc/codex",
+        "printf 'check_for_update_on_startup = false\\n' | sudo tee /etc/codex/config.toml > /dev/null",
         "curl https://cursor.com/install -fsS | bash",
         "curl -fsSL https://ampcode.com/install.sh | bash",
         "curl -fsSL https://app.factory.ai/cli | sh",
+        "curl -fsSL https://antigravity.google/cli/install.sh | bash",
         "sudo ln -sf $HOME/.local/bin/agent /usr/local/bin/agent",
         "sudo ln -sf $HOME/.local/bin/cursor-agent /usr/local/bin/cursor-agent",
         "sudo ln -sf $HOME/.local/bin/amp /usr/local/bin/amp",
         "sudo ln -sf $HOME/.local/bin/droid /usr/local/bin/droid",
-        "command -v opencode",
+        "sudo ln -sf $HOME/.local/bin/agy /usr/local/bin/agy",
         "command -v claude",
         "command -v codex",
         "command -v agent",
         "command -v cursor-agent",
         "command -v amp",
-        "command -v droid"
+        "command -v droid",
+        "command -v agy"
       ].join(" && "));
       await runSetup(builder, [
         `sudo mkdir -p ${shell(RUNTIME_DIR)}`,
@@ -578,7 +628,7 @@ function createVercelSandboxDriver(options) {
       env,
       ...createPolicy ? { networkPolicy: createPolicy } : {}
     }).catch((err) => {
-      if (transientDriverError(err)) return void 0;
+      if (isTransientDriverError(err, TRANSIENT_MARKERS)) return void 0;
       throw err;
     });
     if (!sandbox) return { provisioning: true, retryAfterMs: TRANSIENT_DRIVER_RETRY_MS };

package/dist/egress-policy.d.ts

@@ -8,26 +8,32 @@ export declare function sandboxNetworkPolicyWithBrokeredHosts(policy: SandboxNet
 /** @see SandboxDriverMetadata.egressControl */
 export type SandboxEgressControl = "none" | "hosts" | "hosts-and-cidrs";
 /**
- * What the manager does with a caller's `net` for a given driver: enforce
- * where the driver can, and say so loudly rather than refuse where it cannot.
+ * What a start does with a restricted policy on a driver that cannot contain
+ * egress: `"refuse"` the start, or `"allow"` the sandbox to run with the policy
+ * withheld and the gap reported. Refusing is the default; allowing is the
+ * workspace owner's explicit, auditable decision.
+ */
+export type SandboxUncontainedEgress = "refuse" | "allow";
+/**
+ * What the manager does with a caller's `net` for a given driver.
  *
  *  - `"enforce"` — the driver gets the policy verbatim and contains the
  *    sandbox. Also the answer when the caller asked for no containment
  *    (absent / `allow-all`), which is nothing to enforce.
- *  - `"withhold"` — the driver declares `egressControl: "none"`, so there is no
- *    containment to be had. The policy is NOT handed down: half the `"none"`
- *    drivers throw on a restricted policy (docker, modal, boat) and the
- *    other half silently drop it (cloudflare, the fetch bridge). Withholding at
- *    the manager means the throwing drivers never see one — their throws stay
- *    in place as their own last line of defence — and the silently-dropping
- *    ones stop pretending. The sandbox comes up with UNRESTRICTED egress, which
- *    is a real exposure, so the manager warns (see `onEgressUnenforced`).
- *  - `"refuse"` — the driver HAS egress control but cannot express this
- *    particular policy's encoding (a hosts-only driver handed an address-only
- *    allowlist). Deliberately still fail-closed: this is a composition mistake
- *    on an otherwise-enforcing driver, and degrading it to "withhold" would
- *    weaken the enforcing path. `hostedSandboxNetworkPolicy` only ever emits
- *    hosts, so no production path reaches it.
+ *  - `"withhold"` — the driver declares `egressControl: "none"` and the
+ *    start allows uncontained egress. The policy is NOT handed down: the
+ *    `"none"` drivers throw on a restricted policy (docker, modal, boat), so
+ *    withholding at the manager keeps their throws as their own last line of
+ *    defence. The sandbox comes up with UNRESTRICTED egress, which is a real
+ *    exposure, so the manager warns (see `onEgressUnenforced`).
+ *  - `"refuse"` — either the driver declares `egressControl: "none"` and the
+ *    start does not allow uncontained egress (`sandbox_egress_uncontained`,
+ *    the default), or the driver HAS egress control but cannot express this
+ *    particular policy's encoding (`sandbox_egress_policy_unenforceable`: a
+ *    hosts-only driver handed an address-only allowlist). The second is a
+ *    composition mistake on an otherwise-enforcing driver; degrading it to
+ *    "withhold" would weaken the enforcing path, and `hostedSandboxNetworkPolicy`
+ *    only ever emits hosts, so no production path reaches it.
  *
  * Pure, like `validateSandboxPersistenceCapabilities`, so the manager, the
  * composition layer, and tests can all ask the same question.
@@ -39,22 +45,18 @@ export type SandboxEgressDisposition = {
     reason: "sandbox_egress_uncontained";
 } | {
     action: "refuse";
-    reason: "sandbox_egress_policy_unenforceable";
+    reason: "sandbox_egress_uncontained" | "sandbox_egress_policy_unenforceable";
 };
 /** @see SandboxEgressDisposition */
-export declare function sandboxEgressDisposition(control: SandboxEgressControl, net: SandboxNetworkPolicy | undefined): SandboxEgressDisposition;
+export declare function sandboxEgressDisposition(control: SandboxEgressControl, net: SandboxNetworkPolicy | undefined, uncontained?: SandboxUncontainedEgress): SandboxEgressDisposition;
 /**
- * Emitted whenever a restricted egress policy is withheld because the composed
- * driver declares no egress control: an unrestricted sandbox that nobody was
- * told about is the exposure, so the degrade is never silent.
- *
- * Two phases, because a per-create line is easy to miss in request logs:
- *  - `"composition"` — once per `createSandboxManager` per driver, at boot.
- *  - `"ensure"` — every time a caller's policy is actually withheld, naming the
- *    workspace and the allowlist that did not take effect.
+ * Emitted the first time per driver per isolate that a start which allows
+ * uncontained egress has its restricted policy withheld because the driver
+ * declares no egress control: an unrestricted sandbox that nobody was told
+ * about is the exposure, so the degrade is never silent. A start that refuses
+ * uncontained egress emits none: it never runs.
  */
 export type SandboxEgressUnenforcedEvent = {
-    phase: "composition" | "ensure";
     reason: "sandbox_egress_uncontained";
     /** `SandboxDriver.id` of the composed driver. */
     driver: string;
@@ -62,12 +64,11 @@ export type SandboxEgressUnenforcedEvent = {
     egressControl: SandboxEgressControl;
     /** Ready-to-log sentence. Sinks that only forward text can use this alone. */
     message: string;
-    /** Present on `"ensure"`. */
-    workspaceId?: string;
-    /** The start's placement labels. Present on `"ensure"`. */
+    workspaceId: string;
+    /** The start's placement labels. */
     labels?: Record<string, string>;
-    /** The allowlist the caller asked for and did NOT get. Present on `"ensure"`. */
-    requested?: SandboxNetworkPolicy;
+    /** The allowlist the caller asked for and did NOT get. */
+    requested: SandboxNetworkPolicy;
 };
 /**
  * A credential the SANDBOX must be able to USE for outbound requests but must

package/dist/egress-warnings.d.ts

@@ -1,11 +1,8 @@
 import type { SandboxEgressControl, SandboxEgressUnenforcedEvent, SandboxNetworkPolicy } from "./egress-policy";
 /**
- * The two halves of the warning that a driver runs sandboxes with unrestricted
- * egress. The composition half is raised here, once per driver per isolate: a
- * per-create line lands in request logs and is easy to miss, this one lands
- * wherever the process starts, so an operator learns of it BEFORE the first
- * workspace exists. `withheld` is the start half, raised once per driver per
- * isolate from the first start whose policy the driver could not enforce.
+ * The warning that a start runs with unrestricted egress, raised once per
+ * driver per isolate from the first start whose policy the driver could not
+ * enforce. A refused start raises none: its refusal is that start's own answer.
  */
 export declare function createEgressWarnings(input: {
     driver: {
@@ -20,3 +17,4 @@ export declare function createEgressWarnings(input: {
         requested: SandboxNetworkPolicy;
     }): void;
 };
+export type EgressWarnings = ReturnType<typeof createEgressWarnings>;