@claxedo/sandbox-manager 0.5.2 → 0.7.0

package/README.md

@@ -99,7 +99,7 @@ Per-provider mechanism (from each provider's official docs):
 | Driver | `secretBrokering` | Mechanism |
 | --- | --- | --- |
 | Daytona | `native` | `daytona.secret.create({name, value, hosts})`; the sandbox env holds an opaque `dtn_secret_…` placeholder and an egress proxy substitutes the real value only for allowlisted hosts ([docs](https://www.daytona.io/docs/en/secrets/)). |
-| Vercel | `native` | Firewall header-transform (`updateNetworkPolicy`): the value is spliced onto egress to the allowlisted hosts as `header`; the sandbox makes an unauthenticated request, egress restricted to brokered hosts ([docs](https://vercel.com/docs/sandbox/concepts/firewall)). |
+| Vercel | `native` | Firewall header-transform (`updateNetworkPolicy`): the value is spliced onto egress to the allowlisted hosts as `header`, so the sandbox makes an unauthenticated request ([docs](https://vercel.com/docs/sandbox/concepts/firewall)). `updateNetworkPolicy` replaces the whole policy, so the driver sends the **union** of the create-time allow-list and the brokered hosts — attaching a credential must not revoke egress the caller was already granted (a mid-run `npm install` would start failing), nor widen it to a brokered host the create-time policy never approved. |
 | Cloudflare | `proxy` | Implemented via the official [Worker-proxy pattern](https://developers.cloudflare.com/sandbox/guides/proxy-requests/): the driver sends the value to the sandbox Worker (API-token-gated, never into the container); the Worker stores it in KV, mints a short-lived per-sandbox JWT, and sets `CLAXEDO_EGRESS_PROXY_URL`/`CLAXEDO_EGRESS_TOKEN`/`CLAXEDO_EGRESS_HOSTS` in the container. The sandbox routes brokered-host egress through the Worker, which validates the JWT and injects the credential as `header` — the raw value never enters the sandbox. The reusable core is `@claxedo/sandbox-manager/drivers/cloudflare-egress` (mint/verify + `handleEgressRequest`). |
 | Modal | `none` | Modal [Secrets](https://modal.com/docs/guide/secrets) are an encrypted by-reference store, but exposed as **readable env vars** inside the sandbox — they cannot satisfy the never-readable contract. |
 | Docker, fetch | `none` | Plaintext env only. |
@@ -120,6 +120,55 @@ never logged, and never captured in a driver snapshot.
 > improves storage hygiene for *readable* credentials but does not hide them
 > from the sandbox.
 
+## Egress containment
+
+`SandboxManagerInput.net` restricts what the sandbox can reach on the network.
+It is a *separate* control from brokered secrets, with a **different** posture,
+and the difference matters:
+
+- **Brokered secrets fail closed.** A driver that cannot broker refuses to
+  provision (`error: "secret_brokering_unsupported"`).
+- **Egress does not.** Only `daytona` (names + CIDRs) and `vercel` (names) can
+  enforce an allowlist. Every other driver declares
+  `metadata.egressControl: "none"`, and for those the manager **withholds** the
+  policy and provisions anyway — the sandbox runs with unrestricted egress.
+
+Withholding rather than passing is deliberate: `exe`, `docker`, `modal` and
+`box` throw when handed a restricted policy, and `cloudflare` and the fetch
+bridge accept one and silently ignore it. Withholding at the manager means the
+throwing drivers never see a policy (their throws stay as their own last line of
+defence) and the silently-dropping ones stop pretending.
+
+The gap is never silent. `createSandboxManager` warns at composition, and again
+each time a policy is withheld:
+
+```text
+[sandbox-manager] SANDBOX EGRESS IS UNRESTRICTED: driver "cloudflare" declares
+egressControl: "none", so workspace ws_1 can reach ANY host on the internet …
+```
+
+Pass `onEgressUnenforced` to route that into telemetry instead of `console.warn`
+— it receives a structured `SandboxEgressUnenforcedEvent`. Overriding the sink
+replaces the console warning, so only do it if the replacement is as visible.
+
+**Reuse and resume reapply the policy.** A restricted policy only reaches a
+provider as *creation* parameters, so a sandbox handed back rather than created
+— reuse in `ensureHost`, resume in `resumeHost` — would otherwise run on the
+policy in force when it was first created, possibly a wider one from an earlier
+caller. Daytona's allow-list is mutable post-create
+(`Sandbox.updateNetworkSettings`), so `daytona` reapplies the requested policy
+on both paths. A client too old to expose that call makes the driver **refuse
+the reuse**: a policy reported as applied but not in force is worse than no
+sandbox. Requesting no containment leaves the existing policy alone rather than
+clearing it — "not requested" is not "please unrestrict".
+
+`driver.metadata.egressControl` is the machine-readable source of truth, and
+`sandboxEgressDisposition(control, net)` is the pure predicate the manager uses,
+so you can ask the same question before composing. One exception stays fail
+closed: a hosts-only driver handed an address-only policy is refused
+(`sandbox_egress_policy_unenforceable`) rather than degraded, because that
+driver *does* enforce egress — it just cannot express that encoding.
+
 > SDK conformance: the Daytona secret API and Vercel network-policy transform
 > shapes follow the providers' official docs and are validated structurally
 > against the pinned SDK types; like all provider calls in this package they

package/dist/checkpoint-manager.d.ts

@@ -0,0 +1,47 @@
+import type { SandboxCheckpointReference, SandboxEnsureResult, SandboxLease, SandboxLeaseStore, SandboxManagerInput, SandboxSnapshotManagerResult, SandboxTargetResult } from ".";
+export type SandboxCheckpointRuntime = {
+    freeze: (policy: "drain" | "interrupt") => Promise<void>;
+    flush: () => Promise<void>;
+    scrub: () => Promise<void>;
+    resume: () => Promise<void>;
+    reconcile: (input: {
+        epoch: number;
+        checkpointId: string;
+    }) => Promise<void>;
+};
+export type SandboxCheckpointCaptureInput = {
+    runtime: SandboxCheckpointRuntime;
+    policy?: "drain" | "interrupt";
+    retentionExpiresAt?: number;
+};
+export type SandboxCheckpointRestoreInput = {
+    runtime: SandboxCheckpointRuntime;
+    checkpointId?: string;
+    ensure?: Omit<SandboxManagerInput, "homeRegion">;
+};
+export type SandboxCheckpointResult = {
+    status: "ready";
+    lease: SandboxLease;
+    checkpoint: SandboxCheckpointReference;
+} | {
+    status: "provisioning";
+    lease: SandboxLease;
+    checkpoint: SandboxCheckpointReference;
+    retryAfterMs: number;
+};
+export declare function captureSandboxCheckpoint(input: {
+    workspaceId: string;
+    request: SandboxCheckpointCaptureInput;
+    leaseStore: SandboxLeaseStore;
+    target: (workspaceId: string) => Promise<SandboxTargetResult>;
+    snapshot: (workspaceId: string) => Promise<SandboxSnapshotManagerResult>;
+    now?: () => number;
+    checkpointId?: () => string;
+}): Promise<SandboxCheckpointResult>;
+export declare function restoreSandboxCheckpoint(input: {
+    workspaceId: string;
+    request: SandboxCheckpointRestoreInput;
+    leaseStore: SandboxLeaseStore;
+    ensure: (workspaceId: string, input: SandboxManagerInput) => Promise<SandboxEnsureResult>;
+    now?: () => number;
+}): Promise<SandboxCheckpointResult>;

package/dist/checkpoint-manager.mjs

@@ -0,0 +1,116 @@
+// src/checkpoint-manager.ts
+async function captureSandboxCheckpoint(input) {
+  const lease = await requireLease(input.leaseStore, input.workspaceId);
+  if (lease.status !== "ready") throw new Error("workspace_checkpoint_lease_not_ready");
+  const persistence = lease.persistence;
+  if (!persistence || persistence.capture === "none") throw new Error("workspace_checkpoint_unsupported");
+  const target = await input.target(input.workspaceId);
+  if (target.status !== "ready") throw new Error(target.reason);
+  await input.request.runtime.freeze(input.request.policy ?? "drain");
+  let capturedSource = false;
+  try {
+    await input.request.runtime.flush();
+    await input.request.runtime.scrub();
+    const captured = persistence.capture === "same-resource" ? { ok: true, snapshotId: target.driverResourceId ?? target.sandboxId } : await input.snapshot(input.workspaceId);
+    if (!captured.ok) throw new Error(captured.reason);
+    capturedSource = true;
+    const capturedAt = (input.now ?? Date.now)();
+    const checkpoint = {
+      id: input.checkpointId?.() ?? `cp_${lease.epoch}_${crypto.randomUUID()}`,
+      providerReference: captured.snapshotId,
+      sourceEpoch: lease.epoch,
+      capturedAt,
+      metadata: {
+        scope: persistence.capture,
+        sourceBehavior: requireCaptureSource(persistence.captureSource),
+        ...input.request.retentionExpiresAt === void 0 ? {} : { retentionExpiresAt: input.request.retentionExpiresAt },
+        restoreMount: requireRestoreMount(persistence.restoreMount)
+      }
+    };
+    const updated = await input.leaseStore.update(input.workspaceId, lease.epoch, {
+      checkpoint,
+      restore: null,
+      ...persistence.captureSource === "stopped" || persistence.captureSource === "deleted" ? { status: "stopped" } : {}
+    });
+    if (!updated) throw new Error("workspace_checkpoint_epoch_fenced");
+    return { status: "ready", lease: updated, checkpoint };
+  } finally {
+    if (!capturedSource || persistence.captureSource === "preserved") {
+      await input.request.runtime.resume();
+    }
+  }
+}
+async function restoreSandboxCheckpoint(input) {
+  const lease = await requireLease(input.leaseStore, input.workspaceId);
+  const checkpoint = lease.checkpoint;
+  if (!checkpoint || input.request.checkpointId && checkpoint.id !== input.request.checkpointId) {
+    throw new Error("workspace_checkpoint_not_found");
+  }
+  if (lease.restore?.state === "ready" && lease.restore.checkpointId === checkpoint.id) {
+    return { status: "ready", lease, checkpoint };
+  }
+  const requestedAt = lease.restore?.checkpointId === checkpoint.id ? lease.restore.requestedAt : (input.now ?? Date.now)();
+  const restoring = lease.restore?.checkpointId === checkpoint.id && lease.restore.state !== "pending" ? lease.restore : {
+    checkpointId: checkpoint.id,
+    sourceEpoch: checkpoint.sourceEpoch,
+    state: "restoring",
+    requestedAt,
+    startedAt: (input.now ?? Date.now)()
+  };
+  const staged = lease.status === "ready" && lease.epoch === checkpoint.sourceEpoch ? await input.leaseStore.update(input.workspaceId, lease.epoch, { status: "stopped", restore: restoring }) : await input.leaseStore.update(input.workspaceId, lease.epoch, { restore: restoring });
+  if (!staged) throw new Error("workspace_restore_epoch_fenced");
+  const result = await input.ensure(input.workspaceId, {
+    homeRegion: staged.homeRegion,
+    ...input.request.ensure,
+    bootSource: checkpoint.metadata.restoreMount === "same-resource" ? { kind: "default" } : { kind: "driver-snapshot", snapshotId: checkpoint.providerReference }
+  });
+  const current = await requireLease(input.leaseStore, input.workspaceId);
+  if (result.status === "provisioning") {
+    return { status: "provisioning", lease: current, checkpoint, retryAfterMs: result.retryAfterMs };
+  }
+  if (result.status !== "ready") {
+    const failedAt = (input.now ?? Date.now)();
+    await input.leaseStore.update(input.workspaceId, current.epoch, {
+      restore: {
+        checkpointId: checkpoint.id,
+        sourceEpoch: checkpoint.sourceEpoch,
+        state: "failed",
+        requestedAt,
+        startedAt: "startedAt" in restoring ? restoring.startedAt : void 0,
+        failedAt,
+        error: result.error ?? "workspace_restore_unavailable"
+      }
+    });
+    throw new Error(result.error ?? "workspace_restore_unavailable");
+  }
+  await input.request.runtime.reconcile({ epoch: result.epoch, checkpointId: checkpoint.id });
+  const ready = await input.leaseStore.update(input.workspaceId, result.epoch, {
+    restore: {
+      checkpointId: checkpoint.id,
+      sourceEpoch: checkpoint.sourceEpoch,
+      state: "ready",
+      requestedAt,
+      startedAt: "startedAt" in restoring && restoring.startedAt !== void 0 ? restoring.startedAt : (input.now ?? Date.now)(),
+      completedAt: (input.now ?? Date.now)()
+    }
+  });
+  if (!ready) throw new Error("workspace_restore_epoch_fenced");
+  return { status: "ready", lease: ready, checkpoint };
+}
+async function requireLease(store, workspaceId) {
+  const lease = await store.get(workspaceId);
+  if (!lease) throw new Error("workspace_checkpoint_lease_missing");
+  return lease;
+}
+function requireCaptureSource(value) {
+  if (value === "preserved" || value === "stopped" || value === "deleted") return value;
+  throw new Error("workspace_checkpoint_capabilities_invalid");
+}
+function requireRestoreMount(value) {
+  if (value === "same-resource" || value === "copy-on-write" || value === "new-resource") return value;
+  throw new Error("workspace_checkpoint_capabilities_invalid");
+}
+export {
+  captureSandboxCheckpoint,
+  restoreSandboxCheckpoint
+};

package/dist/daytona-allow-list.d.ts

@@ -3,3 +3,14 @@
  * Daytona currently accepts at most 10 entries.
  */
 export declare function formatDaytonaAllowList(cidrs: string[]): string;
+/**
+ * Format hostnames for Daytona SDK `domainAllowList` parameter.
+ *
+ * Deliberately does NOT truncate, unlike the CIDR formatter above. Silently
+ * dropping entries from an egress allowlist is the worst of both worlds: the
+ * sandbox stays contained, but it loses reachability the caller believed it
+ * granted and nothing anywhere says so. Daytona documents no cap on
+ * `domainAllowList`; if one exists, an over-long list fails the create call
+ * loudly, which is the outcome we want.
+ */
+export declare function formatDaytonaDomainAllowList(hosts: string[]): string;

package/dist/daytona-allow-list.mjs

@@ -2,6 +2,10 @@
 function formatDaytonaAllowList(cidrs) {
   return cidrs.slice(0, 10).join(",");
 }
+function formatDaytonaDomainAllowList(hosts) {
+  return [...new Set(hosts)].join(",");
+}
 export {
-  formatDaytonaAllowList
+  formatDaytonaAllowList,
+  formatDaytonaDomainAllowList
 };

package/dist/driver-catalog.d.ts

@@ -1,7 +1,10 @@
-import type { SandboxDriverMetadata } from "./index";
-export declare const sandboxDriverIds: readonly ["daytona", "modal", "vercel", "cloudflare", "box", "docker"];
+import { validateSandboxPersistenceCapabilities, type SandboxDriverMetadata } from "./index";
+export declare const sandboxDriverIds: readonly ["exe", "daytona", "modal", "vercel", "cloudflare", "box", "docker"];
 export type SandboxDriverID = (typeof sandboxDriverIds)[number];
 export type SandboxDriverAuth = {
+    exe?: {
+        api_token?: string;
+    };
     daytona?: {
         api_key?: string;
     };
@@ -39,17 +42,18 @@ export type SandboxDriverCatalogEntry = {
         secret?: boolean;
     }>;
 };
+export { validateSandboxPersistenceCapabilities };
 export declare const sandboxDriverCatalog: Record<SandboxDriverID, SandboxDriverCatalogEntry>;
 export declare function isSandboxDriverID(input: string | undefined): input is SandboxDriverID;
-export declare function sandboxDriverId(input: string | undefined, cfg?: SandboxDriverConfig, env?: SandboxDriverEnv): "box" | "cloudflare" | "daytona" | "docker" | "modal" | "vercel" | undefined;
+export declare function sandboxDriverId(input: string | undefined, cfg?: SandboxDriverConfig, env?: SandboxDriverEnv): "box" | "cloudflare" | "daytona" | "docker" | "exe" | "modal" | "vercel" | undefined;
 export declare function defaultSandboxDriverID(cfg?: SandboxDriverConfig, env?: SandboxDriverEnv): SandboxDriverID;
 export declare function sandboxDriverAuth<T extends SandboxDriverID>(cfg: SandboxDriverConfig | undefined, id: T, env?: SandboxDriverEnv): SandboxDriverAuth[T] | undefined;
 export declare function hasSandboxDriverAuth(cfg: SandboxDriverConfig | undefined, id: SandboxDriverID, env?: SandboxDriverEnv): boolean;
 export declare function dockerSandboxDriverEnabled(env?: SandboxDriverEnv): boolean;
 export declare function listSandboxDrivers(cfg?: SandboxDriverConfig, env?: SandboxDriverEnv, managedDriverIds?: ReadonlySet<string>): {
-    default_driver: "box" | "cloudflare" | "daytona" | "docker" | "modal" | "vercel";
+    default_driver: "box" | "cloudflare" | "daytona" | "docker" | "exe" | "modal" | "vercel";
     drivers: {
-        id: "box" | "cloudflare" | "daytona" | "docker" | "modal" | "vercel";
+        id: "box" | "cloudflare" | "daytona" | "docker" | "exe" | "modal" | "vercel";
         label: string;
         fields: {
             key: string;
@@ -62,4 +66,3 @@ export declare function listSandboxDrivers(cfg?: SandboxDriverConfig, env?: Sand
     }[];
 };
 type SandboxDriverEnv = Record<string, string | undefined>;
-export {};

package/dist/driver-catalog.mjs

@@ -1,15 +1,53 @@
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+
+// src/index.ts
+function validateSandboxPersistenceCapabilities(input) {
+  if (input.resume === "replacement-restore" && input.capture === "none") {
+    return { valid: false, reason: "replacement restore requires a capture source" };
+  }
+  if (input.capture === "none" && input.captureSource !== "not-applicable") {
+    return { valid: false, reason: "capture source behavior requires capture support" };
+  }
+  if (input.capture !== "none" && input.captureSource === "not-applicable") {
+    return { valid: false, reason: "capture support requires source behavior" };
+  }
+  if (input.capture === "same-resource" && input.restoreMount !== "same-resource") {
+    return { valid: false, reason: "same-resource capture requires same-resource restore" };
+  }
+  if (input.restoreMount === "copy-on-write" && input.capture !== "directories") {
+    return { valid: false, reason: "copy-on-write restore requires directory capture" };
+  }
+  return { valid: true };
+}
+
 // src/runtime-version.ts
 var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
-var versionCache;
 function workspaceRuntimeVersion() {
-  if (versionCache) return versionCache;
-  const envVersion = process.env.WORKSPACE_RUNTIME_VERSION;
-  if (envVersion) {
-    versionCache = envVersion;
-    return versionCache;
-  }
-  versionCache = DEFAULT_WORKSPACE_RUNTIME_VERSION;
-  return versionCache;
+  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
 
 // src/image-name.ts
@@ -31,8 +69,29 @@ function defaultSandboxImage(version = workspaceRuntimeVersion(), buildId, env =
 }
 
 // src/driver-catalog.ts
-var sandboxDriverIds = ["daytona", "modal", "vercel", "cloudflare", "box", "docker"];
+var sandboxDriverIds = ["exe", "daytona", "modal", "vercel", "cloudflare", "box", "docker"];
 var sandboxDriverCatalog = {
+  exe: {
+    id: "exe",
+    label: "exe.dev",
+    credentialFields: [{ key: "api_token", label: "API Token", secret: true }],
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: true,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
   daytona: {
     id: "daytona",
     label: "Daytona",
@@ -42,7 +101,19 @@ var sandboxDriverCatalog = {
       hostStopBehavior: "suspends-host",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
-      secretBrokering: "native"
+      secretBrokering: "native",
+      // Daytona is the only driver that can filter egress by NAME as well as
+      // by address: `domainAllowList` (names) alongside `networkAllowList`
+      // (CIDRs), with `networkBlockAll` as the deny-all floor.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
     }
   },
   modal: {
@@ -57,7 +128,19 @@ var sandboxDriverCatalog = {
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
-      secretBrokering: "none"
+      secretBrokering: "none",
+      // Modal can cut the network entirely (`blockNetwork`) but cannot express
+      // an allowlist, and its driver throws on a host policy. A blackout is
+      // not containment for a workspace that has to clone and reach a model.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
     }
   },
   vercel: {
@@ -73,7 +156,18 @@ var sandboxDriverCatalog = {
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
-      secretBrokering: "native"
+      secretBrokering: "native",
+      // Vercel's sandbox firewall takes a hostname allow list (or "deny-all"),
+      // never CIDRs.
+      egressControl: "hosts",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "stopped",
+        retention: "explicit",
+        restoreMount: "new-resource"
+      }
     }
   },
   cloudflare: {
@@ -88,7 +182,22 @@ var sandboxDriverCatalog = {
       hostStopBehavior: "not-supported",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
-      secretBrokering: "proxy"
+      secretBrokering: "proxy",
+      // The Cloudflare Sandbox Worker exposes no egress filter: its broker
+      // (drivers/cloudflare-egress.ts) is an OPT-IN proxy the sandbox chooses
+      // to route brokered-credential requests through, not a boundary. The
+      // driver therefore drops `net` entirely — which is exactly why this
+      // must be declared, so the manager refuses instead of provisioning a
+      // sandbox the caller believes is contained.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "directories",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "copy-on-write"
+      }
     }
   },
   box: {
@@ -100,7 +209,16 @@ var sandboxDriverCatalog = {
       hostStopBehavior: "suspends-host",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
-      secretBrokering: "none"
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
     }
   },
   docker: {
@@ -112,7 +230,16 @@ var sandboxDriverCatalog = {
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "same-host",
       targetAccess: "loopback",
-      secretBrokering: "none"
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "same-resource",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
     }
   }
 };
@@ -129,6 +256,7 @@ function defaultSandboxDriverID(cfg, env = process.env) {
 }
 function sandboxDriverAuth(cfg, id, env = process.env) {
   if (id === "daytona") return authDaytona(cfg);
+  if (id === "exe") return authExe(cfg, env);
   if (id === "modal") return authModal(cfg, env);
   if (id === "vercel") return authVercel(cfg, env);
   if (id === "cloudflare") return authCloudflare(cfg, env);
@@ -176,6 +304,10 @@ function authDaytona(cfg) {
   const api_key = clean(cfg?.auth?.daytona?.api_key);
   return api_key ? { api_key } : void 0;
 }
+function authExe(cfg, env) {
+  const api_token = clean(cfg?.auth?.exe?.api_token) ?? clean(env.EXE_DEV_API_TOKEN);
+  return api_token ? { api_token } : void 0;
+}
 function authModal(cfg, env) {
   const token_id = clean(cfg?.auth?.modal?.token_id) ?? clean(env.MODAL_TOKEN_ID);
   const token_secret = clean(cfg?.auth?.modal?.token_secret) ?? clean(env.MODAL_TOKEN_SECRET);
@@ -211,5 +343,6 @@ export {
   sandboxDriverAuth,
   sandboxDriverCatalog,
   sandboxDriverId,
-  sandboxDriverIds
+  sandboxDriverIds,
+  validateSandboxPersistenceCapabilities
 };