@claxedo/sandbox-manager 0.10.2 → 0.10.4

package/dist/hosted-network-policy.d.ts

@@ -1,67 +1,17 @@
-/**
- * The egress allowlist a HOSTED, multi-tenant sandbox is provisioned with.
- *
- * A hosted sandbox runs agent-authored code on the operator's infrastructure,
- * next to other tenants' sandboxes, holding a checkout of the user's private
- * repository and (via `SandboxBrokeredSecret`) the ability to spend the
- * operator's model credits. The default for that shape of workload is
- * restrictive, not allow-all: the interesting attack is not "the agent
- * downloads a package", it is "the agent POSTs the repository to a host the
- * attacker controls". An allowlist is what makes that fail.
- *
- * Every entry below has to earn its place, so the list is assembled from three
- * sources of truth rather than from taste:
- *
- *   1. DERIVED PER REQUEST — the control plane the sandbox reports back to and
- *      the git host it clones from. These differ per deployment and per
- *      workspace, so they are inputs, not constants.
- *   2. MODEL PROVIDERS — the endpoints an agent harness must reach to do any
- *      work at all. Taken from the harness→provider mapping the credential
- *      layer already maintains (`PROVIDER_TO_GROUP` /`DEFAULT_ALLOWLIST` in
- *      claxedo-server's `network/types.ts`), narrowed to the API hostnames.
- *   3. PACKAGE REGISTRIES — an agent that cannot install a dependency cannot
- *      edit a real repository. Same source, again narrowed.
- *
- * What is deliberately NOT here, despite being in that same default list:
- * general-purpose object storage and CDN wildcards (`*.workers.dev`,
- * `r2.cloudflarestorage.com`, `storage.googleapis.com`,
- * `*.blob.core.windows.net`, `*.amazonaws.com`). Every one of those is a
- * bucket an attacker can create in their own account, so allowlisting them
- * hands back exactly the exfiltration channel the policy exists to close. A
- * deployment that genuinely needs one adds it through `extraHosts` as an
- * explicit, auditable decision.
- *
- * This module is data + string handling only, so it runs unchanged inside the
- * hosted Worker (no DNS, no node builtins). That matters: name-based policy is
- * the only kind the Worker can compute, which is why `egressControl` treats
- * name filtering as the capability that qualifies a driver for hosted use.
- */
 import type { SandboxSource } from "./contract";
 import type { SandboxNetworkPolicy } from "./egress-policy";
-/**
- * Model-provider endpoints. Derived from the harness→provider groups in
- * claxedo-server `network/types.ts` (`PROVIDER_TO_GROUP`): claude-sdk →
- * anthropic, codex-app-server/cursor-sdk → openai,
- * google → google_ai; plus the aggregator and catalog endpoints the engine
- * itself fetches at startup.
- */
 export declare const SANDBOX_MODEL_PROVIDER_HOSTS: readonly ["api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com", "openrouter.ai", "models.dev", "opencode.ai"];
 /**
- * Package registries. Narrowed from the npm / pypi / rust / golang groups of
- * `DEFAULT_ALLOWLIST` to the hostnames a package install actually contacts —
- * the wildcard CDN entries in those groups are excluded on purpose (see the
- * module comment).
+ * Object-storage and CDN wildcards (`*.workers.dev`, `*.amazonaws.com`,
+ * `storage.googleapis.com`) stay out: each is a bucket an attacker can create
+ * in their own account, which reopens the exfiltration channel the allowlist
+ * closes. A deployment that needs one adds it through `extraHosts`.
  */
 export declare const SANDBOX_PACKAGE_REGISTRY_HOSTS: readonly ["registry.npmjs.org", "nodejs.org", "pypi.org", "files.pythonhosted.org", "crates.io", "static.crates.io", "index.crates.io", "proxy.golang.org", "sum.golang.org"];
-/** The deployment-independent floor: providers + registries. */
 export declare const SANDBOX_BASELINE_EGRESS_HOSTS: readonly ["api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com", "openrouter.ai", "models.dev", "opencode.ai", "registry.npmjs.org", "nodejs.org", "pypi.org", "files.pythonhosted.org", "crates.io", "static.crates.io", "index.crates.io", "proxy.golang.org", "sum.golang.org"];
 /**
- * The git host this workspace clones from.
- *
- * Scoped to the ONE repository host in the request rather than to a forge
- * allowlist, matching how `githubCloneSecret` scopes the clone
- * credential it brokers (`hosts: ["github.com"]`) — the credential and the
- * network policy should describe the same reachable surface.
+ * The one repository host the request clones from, matching the hosts the
+ * brokered clone credential is scoped to.
  *
  * The host is caller-selected, so only a public spelling earns an allowlist
  * entry: `169.254.169.254` or `localhost` named as a repoUrl would otherwise
@@ -78,17 +28,13 @@ export type HostedSandboxNetworkPolicyInput = {
      * plus register/heartbeat. URLs or bare hostnames; blanks are ignored.
      */
     controlPlane: Array<string | undefined>;
-    /** Workspace source — its git host is allowed, nothing else on that forge. */
+    /** Its git host is allowed, nothing else on that forge. */
     source?: SandboxSource;
-    /** Operator escape hatch for deployment-specific hosts. */
     extraHosts?: readonly string[];
 };
 /**
- * Build the restricted policy for a hosted sandbox.
- *
- * Always `mode: "restricted"`. There is no input that makes this return
- * allow-all — a hosted sandbox with an empty or unresolvable control-plane URL
- * is a misconfiguration, and answering it with "then allow everything" is how
- * the gap this closes came to exist in the first place.
+ * Always `mode: "restricted"`: a hosted sandbox with an empty or unresolvable
+ * control-plane URL is a misconfiguration, never a reason to allow everything.
+ * Name-based only (no DNS), so it also runs inside the Worker.
  */
 export declare function hostedSandboxNetworkPolicy(input: HostedSandboxNetworkPolicyInput): SandboxNetworkPolicy;

package/dist/hosted-network-policy.mjs

@@ -221,7 +221,7 @@ var SANDBOX_MODEL_PROVIDER_HOSTS = [
   "api.openai.com",
   "generativelanguage.googleapis.com",
   "openrouter.ai",
-  // Model catalog + engine config, fetched on runner startup.
+  // The model catalog and engine config a runner fetches at startup.
   "models.dev",
   "opencode.ai"
 ];

package/dist/image-name.d.ts

@@ -13,5 +13,4 @@ export declare function sandboxImageRepository(env?: SandboxImageEnv): string;
 export declare function defaultSandboxImage(version?: string, buildId?: string, env?: SandboxImageEnv, options?: {
     agentPlugins?: boolean;
 }): string;
-/** Whether an image's tag names a build that carries the Agent Plugins runtime entry. */
 export declare function sandboxImageCarriesAgentPlugins(image: string): boolean;

package/dist/index.mjs

@@ -83,9 +83,9 @@ function sandboxNetworkPolicyWithBrokeredHosts(policy, secrets) {
     ...hosts.length ? { hosts } : {}
   };
 }
-function sandboxEgressDisposition(control, net) {
+function sandboxEgressDisposition(control, net, uncontained = "refuse") {
   if (!net || net.mode === "allow-all") return { action: "enforce" };
-  if (control === "none") return { action: "withhold", reason: "sandbox_egress_uncontained" };
+  if (control === "none") return { action: uncontained === "allow" ? "withhold" : "refuse", reason: "sandbox_egress_uncontained" };
   const hosts = net.hosts?.length ?? 0;
   const cidrs = net.cidrs?.length ?? 0;
   if (hosts === 0 && cidrs === 0) return { action: "enforce" };
@@ -110,6 +110,27 @@ var boatBilling = {
     large: { size: "large", vcpu: 8, memoryGb: 16, usdPerHour: 0.072 }
   }
 };
+var AGENT37_USD_PER_MONTH = { vcpu: 0.8, memoryGb: 0.7, diskGb: 0.09 };
+var AGENT37_MONTH_HOURS = 730;
+var agent37MachineShapes = {
+  small: { cpu: 2, memory: 4, disk: 10 },
+  default: { cpu: 4, memory: 8, disk: 20 },
+  large: { cpu: 4, memory: 16, disk: 40 }
+};
+function agent37Rate(shape) {
+  const usdPerMonth = shape.cpu * AGENT37_USD_PER_MONTH.vcpu + shape.memory * AGENT37_USD_PER_MONTH.memoryGb + shape.disk * AGENT37_USD_PER_MONTH.diskGb;
+  return { size: `${shape.cpu} vCPU / ${shape.memory} GB`, vcpu: shape.cpu, memoryGb: shape.memory, usdPerHour: usdPerMonth / AGENT37_MONTH_HOURS };
+}
+var agent37Billing = {
+  source: { url: "https://www.agent37.com/docs/agents-api/billing", readOn: "2026-11-11" },
+  meter: "Agent37 meters an instance per minute at a monthly rate over 730 hours: $0.80 per vCPU, $0.70 per GB of memory and $0.09 per GB of disk while it runs, and the disk alone while it is stopped.",
+  rates: {
+    small: agent37Rate(agent37MachineShapes.small),
+    default: agent37Rate(agent37MachineShapes.default),
+    large: agent37Rate(agent37MachineShapes.large)
+  },
+  excludes: `the disk of a stopped instance, billed at $${AGENT37_USD_PER_MONTH.diskGb} per GB a month until the instance is deleted`
+};
 var CLOUDFLARE_USD_PER_GIB_SECOND_MEMORY = 25e-7;
 var CLOUDFLARE_USD_PER_GB_SECOND_DISK = 7e-8;
 var CLOUDFLARE_USD_PER_VCPU_SECOND_ACTIVE = 2e-5;
@@ -318,12 +339,13 @@ var sandboxCheckpointUnusableCauses = ["expired", "runtime_modified", "not_resto
 function isSandboxCheckpointUnusableCause(value) {
   return sandboxCheckpointUnusableCauses.some((cause) => cause === value);
 }
-var sandboxDriverIds = ["modal", "vercel", "cloudflare", "boat", "docker"];
+var sandboxDriverIds = ["modal", "vercel", "cloudflare", "boat", "agent37", "docker"];
 var sandboxDriverLabels = {
   modal: "Modal",
   vercel: "Vercel",
   cloudflare: "Cloudflare",
   boat: "Boat",
+  agent37: "Agent37",
   docker: "Docker"
 };
 function isSandboxDriverID(input) {
@@ -434,6 +456,13 @@ function sandboxDriverLabel(driver) {
 }
 var PROVIDER_KEY_REFUSED = "provider_key_refused:";
 var PROVIDER_FAILED = "provider_failed:";
+var EGRESS_UNCONTAINED = "sandbox_egress_uncontained:";
+function sandboxEgressUncontainedError(driver) {
+  return `${EGRESS_UNCONTAINED}${driver}`;
+}
+function uncontainedEgressReason(provider) {
+  return `${provider} cannot contain a sandbox's network; an org admin can allow unrestricted internet for ${provider} machines in Settings \u2192 Sandbox providers.`;
+}
 function sandboxProviderKeyRefusedError(driver, message) {
   return `${PROVIDER_KEY_REFUSED}${driver}: ${message}`;
 }
@@ -524,10 +553,8 @@ function sandboxRuntimeBootFailure(error) {
   return workspaceRuntimeBootReason(diagnostic) ?? diagnostic;
 }
 var SANDBOX_RUNTIME_UNHEALTHY = "runtime_unhealthy";
-var SANDBOX_RETRY_CAP_EXCEEDED = "runtime_retry_cap_exceeded";
 var CODED_REASONS = /* @__PURE__ */ new Map([
   [SANDBOX_RUNTIME_UNHEALTHY, "The workspace machine stopped answering."],
-  [SANDBOX_RETRY_CAP_EXCEEDED, "Several tries in a row failed; try again later."],
   [SANDBOX_UPDATE_DOWNLOAD_INTERRUPTED, "The update couldn't finish downloading; your workspace is still running. Try again."]
 ]);
 function firstLine(text) {
@@ -542,6 +569,8 @@ function sandboxStartFailureReason(error) {
   if (keyRefused !== void 0) return `${sandboxDriverLabel(keyRefused)} refused the sandbox provider key; fix it in Settings \u2192 Sandbox providers.`;
   const failed = codedDriver(error, PROVIDER_FAILED);
   if (failed !== void 0) return `${sandboxDriverLabel(failed)} returned an error.`;
+  const uncontained = codedDriver(error, EGRESS_UNCONTAINED);
+  if (uncontained !== void 0) return uncontainedEgressReason(sandboxDriverLabel(uncontained));
   return CODED_REASONS.get(error) ?? firstLine(error);
 }
 var LEASE_ENDED_ERRORS = /* @__PURE__ */ new Set(["runtime_lease_changed", "runtime_lease_stopped", "runtime_lease_destroyed"]);
@@ -587,6 +616,11 @@ var PUBLIC_API_ERRORS = {
   org_invitation_invalid: { family: "access", status: 409, message: "Invitation is invalid or unavailable" },
   org_invitation_pending: { family: "access", status: 409, message: "An invitation to this address is already pending" },
   org_invitation_rate_limited: { family: "access", status: 429, message: "Organization invitation limit exceeded" },
+  org_limit_reached: { family: "access", status: 403, message: "An account owns at most 3 organizations" },
+  org_creation_rate_limited: { family: "access", status: 429, message: "Organization creation limit exceeded" },
+  project_limit_reached: { family: "access", status: 402, message: "Free accounts have 3 projects. Get Cloud or Self-host for unlimited projects." },
+  seats_full: { family: "access", status: 402, message: "Add teammate seats to invite more people." },
+  email_verification_required: { family: "access", status: 403, message: "A verified email address is required" },
   org_invitation_email_mismatch: { family: "access", status: 403, message: "Sign in with the invited verified email address" },
   org_invitation_delivery_unavailable: { family: "access", status: 503, message: "Invitation delivery is unavailable" },
   team_not_found: { family: "access", status: 404, message: "Team not found" },
@@ -596,6 +630,12 @@ var PUBLIC_API_ERRORS = {
   project_member_not_found: { family: "access", status: 404, message: "Project member not found" },
   project_member_owner_immutable: { family: "access", status: 409, message: "The project owner's access cannot be changed" },
   resource_conflict: { family: "access", status: 409, message: "Organization or team authority changed concurrently" },
+  org_not_deletable: { family: "access", status: 409, message: "A personal organization goes with its account, and a deployment's with the deployment" },
+  org_has_workspaces: { family: "access", status: 409, message: "Delete the organization's workspaces first" },
+  account_owns_workspaces: { family: "access", status: 409, message: "Delete your workspaces first" },
+  account_founds_organization: { family: "access", status: 409, message: "Delete the organizations you founded first" },
+  account_has_cloud_subscription: { family: "access", status: 409, message: "Cancel Cloud before deleting this account" },
+  recent_sign_in_required: { family: "access", status: 403, message: "Sign in again to confirm this deletion" },
   session_not_found: { family: "session_share", status: 404, message: "This session is not on the control plane, so it cannot be shared from People yet." },
   session_share_admin_required: { family: "session_share", status: 403, message: "Only the person who started this session can manage its People." },
   session_share_target_required: { family: "session_share", status: 400, message: "A session is shared with exactly one person" },
@@ -799,7 +839,7 @@ var SANDBOX_MODEL_PROVIDER_HOSTS = [
   "api.openai.com",
   "generativelanguage.googleapis.com",
   "openrouter.ai",
-  // Model catalog + engine config, fetched on runner startup.
+  // The model catalog and engine config a runner fetches at startup.
   "models.dev",
   "opencode.ai"
 ];
@@ -893,7 +933,7 @@ function leaseHostId(driver, workspaceId, lease, managerInput) {
   return managerInput?.hostId ?? lease.hostId ?? sandboxId(driver.id, workspaceId);
 }
 function ensureHostInput(input) {
-  const egress = sandboxEgressDisposition(input.driver.metadata.egressControl, input.managerInput?.net);
+  const egress = sandboxEgressDisposition(input.driver.metadata.egressControl, input.managerInput?.net, input.managerInput?.uncontainedEgress);
   const labels = {
     app: input.appLabel,
     workspaceId: input.workspaceId,
@@ -921,10 +961,10 @@ function ensureHostInput(input) {
     ...input.managerInput?.updateImage ? { updateImage: true } : {},
     ...input.lease.machineClass ?? input.managerInput?.machineClass ? { machineClass: input.lease.machineClass ?? input.managerInput?.machineClass } : {},
     exposure: input.managerInput?.exposure ?? (input.driver.metadata.targetAccess === "loopback" ? { kind: "loopback" } : { kind: "relay" }),
-    // Withheld, never downgraded: `undefined` here is the same shape a caller
-    // that asked for no containment produces, so the throwing drivers take
-    // their allow-all path and their throws stay intact for anyone who hands
-    // them a policy directly.
+    // Withheld where the start allows it, never downgraded: `undefined`
+    // here is the same shape a caller that asked for no containment produces,
+    // so the throwing drivers take their allow-all path and their throws stay
+    // intact for anyone who hands them a policy directly.
     ...egress.action === "enforce" && input.managerInput?.net ? { net: sandboxNetworkPolicyWithBrokeredHosts(input.managerInput.net, input.managerInput.secrets) } : {},
     snapshot: input.managerInput?.snapshot
   };
@@ -932,11 +972,8 @@ function ensureHostInput(input) {
 
 // src/egress-warnings.ts
 function egressUnenforcedMessage(input) {
-  const scope = input.workspaceId ? `workspace ${input.workspaceId}` : "every sandbox it provisions";
-  const withheld = input.requested ? ` The requested allowlist (${(input.requested.hosts ?? []).length} host(s), ${(input.requested.cidrs ?? []).length} cidr(s)) was withheld, not applied.` : "";
-  return `[sandbox-manager] SANDBOX EGRESS IS UNRESTRICTED: driver "${input.driver}" declares egressControl: "none", so ${scope} can reach ANY host on the internet, including attacker-controlled buckets \u2014 agent-authored code inside the sandbox has an unmonitored exfiltration path.${withheld} Select a driver that can enforce egress (vercel) to close it. See public-docs/sandbox-egress.md.`;
+  return `[sandbox-manager] SANDBOX EGRESS IS UNRESTRICTED: driver "${input.driver}" declares egressControl: "none" and this start allows uncontained egress, so workspace ${input.workspaceId} can reach ANY host on the internet, including attacker-controlled buckets \u2014 agent-authored code inside the sandbox has an unmonitored exfiltration path. The requested allowlist (${(input.requested.hosts ?? []).length} host(s), ${(input.requested.cidrs ?? []).length} cidr(s)) was withheld, not applied. Select a driver that can enforce egress (cloudflare, vercel), or stop allowing uncontained egress so such starts are refused. See public-docs/sandbox-egress.md.`;
 }
-var compositionEgressWarnings = /* @__PURE__ */ new Set();
 var ensureEgressWarnings = /* @__PURE__ */ new Set();
 function defaultEgressUnenforcedSink(event) {
   console.warn(event.message);
@@ -945,26 +982,15 @@ function createEgressWarnings(input) {
   const { id, egressControl } = input.driver;
   const sink = input.sink ?? defaultEgressUnenforcedSink;
   const key = `${id}|${egressControl}`;
-  if (egressControl === "none" && !compositionEgressWarnings.has(key)) {
-    compositionEgressWarnings.add(key);
-    sink({
-      phase: "composition",
-      reason: "sandbox_egress_uncontained",
-      driver: id,
-      egressControl,
-      message: egressUnenforcedMessage({ phase: "composition", driver: id })
-    });
-  }
   return {
     withheld(start) {
       if (ensureEgressWarnings.has(key)) return;
       ensureEgressWarnings.add(key);
       sink({
-        phase: "ensure",
         reason: "sandbox_egress_uncontained",
         driver: id,
         egressControl,
-        message: egressUnenforcedMessage({ phase: "ensure", driver: id, workspaceId: start.workspaceId, requested: start.requested }),
+        message: egressUnenforcedMessage({ driver: id, workspaceId: start.workspaceId, requested: start.requested }),
         workspaceId: start.workspaceId,
         ...start.labels ? { labels: start.labels } : {},
         requested: start.requested
@@ -973,6 +999,51 @@ function createEgressWarnings(input) {
   };
 }
 
+// src/runtime-env.ts
+var WORKSPACE_RUNTIME_IDENTITY_ENV_KEYS = [
+  "WORKSPACE_RUNTIME_WORKSPACE_ID",
+  "WORKSPACE_RUNTIME_HOST_ID",
+  "WORKSPACE_RUNTIME_RELAY_WORKSPACE_IDS"
+];
+function workspaceRuntimeIdentityEnvConflicts(env) {
+  if (!env) return [];
+  return WORKSPACE_RUNTIME_IDENTITY_ENV_KEYS.filter((key) => env[key] !== void 0);
+}
+var WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS = /* @__PURE__ */ new Set([
+  ...WORKSPACE_RUNTIME_IDENTITY_ENV_KEYS,
+  "WORKSPACE_RUNTIME_DIRECTORY",
+  "WORKSPACE_RUNTIME_PORT",
+  "WORKSPACE_RUNTIME_HOST",
+  "WORKSPACE_RUNTIME_SOURCE_KIND",
+  "WORKSPACE_RUNTIME_GIT_REPO_URL",
+  "WORKSPACE_RUNTIME_GIT_BRANCH",
+  "WORKSPACE_RUNTIME_NATIVE_HARNESS",
+  "WORKSPACE_RUNTIME_RELAY_JWKS_URL",
+  "WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL",
+  "WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL"
+]);
+
+// src/start-admission.ts
+function refusedStart(input) {
+  const { driver, workspaceId, start } = input;
+  const egress = sandboxEgressDisposition(driver.metadata.egressControl, start.net, start.uncontainedEgress);
+  if (egress.action === "withhold" && start.net) {
+    input.egressWarnings.withheld({ workspaceId, ...start.labels ? { labels: start.labels } : {}, requested: start.net });
+  }
+  if (egress.action === "refuse") {
+    const error = egress.reason === "sandbox_egress_uncontained" ? sandboxEgressUncontainedError(driver.id) : egress.reason;
+    return { status: "unavailable", error, homeRegion: start.homeRegion };
+  }
+  const identityConflicts = workspaceRuntimeIdentityEnvConflicts(start.env);
+  if (identityConflicts.length) {
+    return { status: "unavailable", error: `sandbox env cannot set runtime identity: ${identityConflicts.join(", ")}`, homeRegion: start.homeRegion };
+  }
+  if (start.machineClass && !driver.metadata.machineClasses?.includes(start.machineClass)) {
+    return { status: "unavailable", error: `sandbox_machine_class_unsupported: ${driver.id} has no ${start.machineClass} machines`, homeRegion: start.homeRegion };
+  }
+  return void 0;
+}
+
 // src/garbage-collect.ts
 async function sweepSandboxes(input) {
   const { driver, leaseStore, appLabel } = input;
@@ -1176,30 +1247,6 @@ async function startSandboxFresh(input) {
   return { ok: true, status };
 }
 
-// src/runtime-env.ts
-var WORKSPACE_RUNTIME_IDENTITY_ENV_KEYS = [
-  "WORKSPACE_RUNTIME_WORKSPACE_ID",
-  "WORKSPACE_RUNTIME_HOST_ID",
-  "WORKSPACE_RUNTIME_RELAY_WORKSPACE_IDS"
-];
-function workspaceRuntimeIdentityEnvConflicts(env) {
-  if (!env) return [];
-  return WORKSPACE_RUNTIME_IDENTITY_ENV_KEYS.filter((key) => env[key] !== void 0);
-}
-var WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS = /* @__PURE__ */ new Set([
-  ...WORKSPACE_RUNTIME_IDENTITY_ENV_KEYS,
-  "WORKSPACE_RUNTIME_DIRECTORY",
-  "WORKSPACE_RUNTIME_PORT",
-  "WORKSPACE_RUNTIME_HOST",
-  "WORKSPACE_RUNTIME_SOURCE_KIND",
-  "WORKSPACE_RUNTIME_GIT_REPO_URL",
-  "WORKSPACE_RUNTIME_GIT_BRANCH",
-  "WORKSPACE_RUNTIME_NATIVE_HARNESS",
-  "WORKSPACE_RUNTIME_RELAY_JWKS_URL",
-  "WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL",
-  "WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL"
-]);
-
 // src/manager.ts
 var DEFAULT_APP_LABEL = "claxedo";
 function createSandboxManager(options) {
@@ -1494,14 +1541,6 @@ function createSandboxManager(options) {
         ...existing.retryCount >= maxRetryCount ? { exhausted: true } : {}
       };
     }
-    if (existing.status === "unavailable" && existing.retryCount >= maxRetryCount && existing.nextRetryAt === void 0 && sandboxProviderRateLimit(existing.lastError) !== "day") {
-      return {
-        status: "unavailable",
-        error: existing.lastError ?? SANDBOX_RETRY_CAP_EXCEEDED,
-        epoch: existing.epoch,
-        homeRegion: existing.homeRegion
-      };
-    }
     return void 0;
   }
   function continues(lease) {
@@ -1511,24 +1550,8 @@ function createSandboxManager(options) {
     return lease.sandboxId ? lease.nextRetryAt !== void 0 || stale : lease.nextRetryAt !== void 0 && !stale;
   }
   async function admit(workspaceId, input) {
-    const egress = sandboxEgressDisposition(options.driver.metadata.egressControl, input.net);
-    if (egress.action === "withhold" && input.net) {
-      egressWarnings.withheld({ workspaceId, ...input.labels ? { labels: input.labels } : {}, requested: input.net });
-    }
-    if (egress.action === "refuse") {
-      return { status: "unavailable", error: egress.reason, homeRegion: input.homeRegion };
-    }
-    const identityConflicts = workspaceRuntimeIdentityEnvConflicts(input.env);
-    if (identityConflicts.length) {
-      return {
-        status: "unavailable",
-        error: `sandbox env cannot set runtime identity: ${identityConflicts.join(", ")}`,
-        homeRegion: input.homeRegion
-      };
-    }
-    if (input.machineClass && !options.driver.metadata.machineClasses?.includes(input.machineClass)) {
-      return { status: "unavailable", error: `sandbox_machine_class_unsupported: ${options.driver.id} has no ${input.machineClass} machines`, homeRegion: input.homeRegion };
-    }
+    const refused = refusedStart({ driver: options.driver, workspaceId, start: input, egressWarnings });
+    if (refused) return refused;
     const existing = await options.leaseStore.get(workspaceId);
     const wait = waiting(existing);
     if (wait) return wait;
@@ -1724,7 +1747,6 @@ export {
   SANDBOX_IMAGE_LABEL,
   SANDBOX_MODEL_PROVIDER_HOSTS,
   SANDBOX_PACKAGE_REGISTRY_HOSTS,
-  SANDBOX_RETRY_CAP_EXCEEDED,
   SANDBOX_RUNTIME_UNHEALTHY,
   SANDBOX_START_WINDOWS,
   SANDBOX_UPDATE_DOWNLOAD_INTERRUPTED,
@@ -1735,6 +1757,8 @@ export {
   SandboxProviderRateLimitedError,
   SandboxRuntimeBootError,
   SandboxStartRefusedError,
+  agent37Billing,
+  agent37MachineShapes,
   applySandboxLeaseFailure,
   applySandboxLeasePatch,
   applySandboxProvisionedTarget,
@@ -1763,6 +1787,7 @@ export {
   sandboxCheckpointUnusableCauses,
   sandboxCheckpointUnusableError,
   sandboxEgressDisposition,
+  sandboxEgressUncontainedError,
   sandboxHostGoneError,
   sandboxLeaseEndedUnderStart,
   sandboxLeaseFailure,

package/dist/json.d.ts

@@ -1,13 +1 @@
-/**
- * Reading untrusted JSON: driver API responses, CLI output, stored records.
- *
- * Drivers all face the same problem — a provider hands back `any`, and the code
- * needs a few named fields out of it. Narrowing through these keeps the check
- * and the type in the same place, instead of each site asserting a shape it
- * never verified. The object check is `@claxedo/helpers/guards`, re-exported
- * under the names the drivers use.
- */
-export { asRecord as record, isRecord } from "@claxedo/helpers/guards";
-/** A non-empty string, or undefined — the shape almost every provider field wants. */
-export declare function text(input: unknown): string | undefined;
-export declare function num(input: unknown): number | undefined;
+export { asNumber as num, asRecord as record, isRecord, nonEmptyString as text } from "@claxedo/helpers/guards";

package/dist/lease-failure.d.ts

@@ -91,6 +91,8 @@ export declare class SandboxStartRefusedError extends Error implements SandboxSt
     readonly startRefused: true;
     constructor(reason: string);
 }
+/** The error a start answers when `driver` declares no egress control and the start does not allow uncontained egress. */
+export declare function sandboxEgressUncontainedError(driver: string): string;
 /** The error a lease keeps when `driver`'s provider refused its key; the driver's message stays for the operator. */
 export declare function sandboxProviderKeyRefusedError(driver: string, message: string): string;
 /** The error a lease keeps when `driver` failed at its provider; the driver's message, which names hosts, requests and provider codes, stays for the operator. */
@@ -144,7 +146,7 @@ export declare function workspaceRuntimeBootReason(diagnostic: string): string |
 /**
  * What a driver keeps of a runtime's log within `maxChars`. A Node stack
  * under the boot-failure line is longer than the bound a driver puts on the
- * tail (600 chars on Boat, 2026-10-15 staging), so a tail alone keeps the
+ * tail (600 chars on Boat), so a tail alone keeps the
  * frames and loses the one line that names the reason.
  */
 export declare function runtimeBootDiagnostic(log: string, maxChars: number): string;
@@ -156,8 +158,6 @@ export declare function runtimeBootDiagnostic(log: string, maxChars: number): st
 export declare function sandboxRuntimeBootFailure(error: string | undefined): string | undefined;
 /** The error a lease keeps when the runtime it serves stopped answering its health reports. */
 export declare const SANDBOX_RUNTIME_UNHEALTHY = "runtime_unhealthy";
-/** The error a capped lease answers when it kept none of its own. */
-export declare const SANDBOX_RETRY_CAP_EXCEEDED = "runtime_retry_cap_exceeded";
 /**
  * The one line a person is told for a start step's error: the runtime's own
  * reason for a boot that failed, the provider's refusal in Claxedo's words,

package/dist/lease-types.d.ts

@@ -6,16 +6,7 @@ export type SandboxLeaseRow = {
     home_region?: string;
     epoch: number;
     status: SandboxLeaseRowStatus;
-    /**
-     * The id the driver was registered with, which is any string: the manager
-     * dispatches on whatever a composition registers (`stores/d1.test.ts`
-     * provisions one called `"test-provider"`), and every other type this value
-     * flows between — `SandboxLease["driver"]`, `SandboxLeaseAcquireInput["driver"]`,
-     * `SandboxTarget["driver"]["id"]` — is already `string`. Typing the row as the
-     * closed `SandboxDriverID` made it the odd one out and forced every store to
-     * assert into it. Narrow with `isSandboxDriverID` where a CATALOG entry is
-     * needed, which is the only place the closed set is the right question.
-     */
+    /** Any string: the manager dispatches on whatever a composition registers. Narrow with `isSandboxDriverID` where a catalog entry is needed. */
     driver: string;
     driver_resource_id: string | null;
     driver_snapshot_id: string | null;

package/dist/runtime-env.d.ts

@@ -1,4 +1,3 @@
-import type { SandboxDriverID } from "@claxedo/sandbox-contract";
 export type WorkspaceRuntimeControlEnv = {
     relayJwksUrl?: string;
     relayVerifyPem?: string;
@@ -8,6 +7,12 @@ export type WorkspaceRuntimeControlEnv = {
 export declare function workspaceRuntimeIdentityEnvConflicts(env: Record<string, string> | undefined): string[];
 export declare function assertWorkspaceRuntimeIdentityEnv(env: Record<string, string> | undefined): void;
 export declare function workspaceRuntimeBootSecrets(env: Record<string, string>): string[];
+/**
+ * `text` with every boot secret in it replaced. Redact before bounding the
+ * text, so a secret the bound would cut in half is already gone. Values
+ * shorter than the floor (ports, flags) are left readable.
+ */
+export declare function redactWorkspaceRuntimeBootSecrets(text: string, secrets: readonly string[]): string;
 export declare function workspaceRuntimeBootEnv(input: Parameters<typeof workspaceRuntimeTargetEnv>[0] & Parameters<typeof workspaceRuntimeSourceEnv>[0] & {
     env?: Record<string, string>;
     nativeHarness?: string;
@@ -29,9 +34,3 @@ export declare function workspaceRuntimeSourceEnv(input: {
         kind: "empty";
     };
 }): Record<string, string>;
-export declare function workspaceRuntimeServiceExposureEnv(input: {
-    driver: SandboxDriverID;
-    source: "driver-service-url";
-    access: "private" | "public" | "driver-authenticated" | "unknown";
-    note?: string;
-}): Record<string, string>;

package/dist/runtime-env.mjs

@@ -31,6 +31,10 @@ var WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS = /* @__PURE__ */ new Set([
 function workspaceRuntimeBootSecrets(env) {
   return Object.entries(env).flatMap(([key, value]) => WORKSPACE_RUNTIME_PUBLIC_ENV_KEYS.has(key) ? [] : [value]);
 }
+var REDACTED_VALUE_MIN_LENGTH = 8;
+function redactWorkspaceRuntimeBootSecrets(text, secrets) {
+  return secrets.filter((secret) => secret.length >= REDACTED_VALUE_MIN_LENGTH).reduce((output, secret) => output.split(secret).join("[redacted]"), text);
+}
 function workspaceRuntimeBootEnv(input) {
   assertWorkspaceRuntimeIdentityEnv(input.env);
   const env = {
@@ -62,21 +66,12 @@ function workspaceRuntimeSourceEnv(input) {
     ...input.source.branch ? { WORKSPACE_RUNTIME_GIT_BRANCH: input.source.branch } : {}
   };
 }
-function workspaceRuntimeServiceExposureEnv(input) {
-  return {
-    ...input.driver === "docker" ? { WORKSPACE_RUNTIME_HOST: "0.0.0.0" } : {},
-    WORKSPACE_RUNTIME_SERVICE_EXPOSURE_SOURCE: input.source,
-    WORKSPACE_RUNTIME_SERVICE_EXPOSURE_ACCESS: input.access,
-    WORKSPACE_RUNTIME_SERVICE_EXPOSURE_DRIVER: input.driver,
-    ...input.note ? { WORKSPACE_RUNTIME_SERVICE_EXPOSURE_NOTE: input.note } : {}
-  };
-}
 export {
   assertWorkspaceRuntimeIdentityEnv,
+  redactWorkspaceRuntimeBootSecrets,
   workspaceRuntimeBootEnv,
   workspaceRuntimeBootSecrets,
   workspaceRuntimeIdentityEnvConflicts,
-  workspaceRuntimeServiceExposureEnv,
   workspaceRuntimeSourceEnv,
   workspaceRuntimeTargetEnv
 };

package/dist/runtime-version.d.ts

@@ -22,3 +22,7 @@ export declare const SERVED_WORKSPACE_RUNTIME_FLOOR: {
     readonly image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8";
 };
 export declare const MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION: "0.10.1";
+/** Where the sandbox image keeps the version of the runtime it ships, from the image's root. */
+export declare const SANDBOX_IMAGE_RUNTIME_VERSION_FILE = "opt/workspace-runtime/workspace-runtime-version";
+/** A shell test that passes when the runtime version in `file`, a shell word, is one this control plane serves. */
+export declare function servedRuntimeVersionTest(file: string): string;

package/dist/runtime-version.mjs

@@ -8,8 +8,14 @@ var SERVED_WORKSPACE_RUNTIME_FLOOR = {
   image: "ghcr.io/kyashrathore/claxedo-sandbox:workspace-runtime-0-10-1-40706b7356-agent-plugins-v8"
 };
 var MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION = SERVED_WORKSPACE_RUNTIME_FLOOR.version;
+var SANDBOX_IMAGE_RUNTIME_VERSION_FILE = "opt/workspace-runtime/workspace-runtime-version";
+function servedRuntimeVersionTest(file) {
+  return `version=$(cat ${file} 2>/dev/null) && [ -n "$version" ] && [ "$(printf '%s\\n%s\\n' ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} "$version" | sort -V | head -n 1)" = ${MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION} ]`;
+}
 export {
   MINIMUM_SERVED_WORKSPACE_RUNTIME_VERSION,
+  SANDBOX_IMAGE_RUNTIME_VERSION_FILE,
   SERVED_WORKSPACE_RUNTIME_FLOOR,
+  servedRuntimeVersionTest,
   workspaceRuntimeVersion
 };

package/dist/start-admission.d.ts

@@ -0,0 +1,32 @@
+import type { SandboxDriver, SandboxEnsureResult, SandboxManagerInput } from "./contract";
+import type { EgressWarnings } from "./egress-warnings";
+export type SandboxStartRefusal = Extract<SandboxEnsureResult, {
+    status: "unavailable";
+}>;
+/**
+ * The composition's standing answers to a start's input, decided BEFORE a
+ * lease is touched: none of them is a provisioning failure, so none may burn a
+ * lease epoch or enter retry backoff, and each repeats until the composition
+ * or the input changes.
+ *
+ * Egress: a caller that hands over a restricted policy is stating that this
+ * sandbox must not reach the open internet. That is honoured where the driver
+ * can honour it. Where it cannot, the start is refused, unless the start
+ * allows uncontained egress: then the sandbox runs with the policy withheld
+ * (`ensureHostInput` never hands it down) and the gap is reported here, once
+ * per driver per isolate. `sandbox_egress_policy_unenforceable` is refused too,
+ * and deliberately so: that driver DOES enforce egress, it just cannot express
+ * this policy's encoding, and degrading an enforcing driver to "unrestricted"
+ * would weaken the path that does enforce.
+ *
+ * Identity: caller env restating the identity the driver's target reports,
+ * which `recordTarget` persists, would boot the runtime bound to a hostId the
+ * lease never authorized; the driver rejects it again at compose time for
+ * callers that reach it directly.
+ */
+export declare function refusedStart(input: {
+    driver: SandboxDriver;
+    workspaceId: string;
+    start: SandboxManagerInput;
+    egressWarnings: EgressWarnings;
+}): SandboxStartRefusal | undefined;