@claxedo/sandbox-manager 0.5.2 → 0.7.0

package/dist/drivers/daytona.mjs

@@ -5,6 +5,9 @@ import { Daytona } from "@daytona/sdk";
 function formatDaytonaAllowList(cidrs) {
   return cidrs.slice(0, 10).join(",");
 }
+function formatDaytonaDomainAllowList(hosts) {
+  return [...new Set(hosts)].join(",");
+}
 
 // src/runtime-env.ts
 function workspaceRuntimeTargetEnv(input) {
@@ -33,11 +36,214 @@ function shell(input) {
 // src/constants.ts
 var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
 
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+
+// src/driver-catalog.ts
+var sandboxDriverCatalog = {
+  exe: {
+    id: "exe",
+    label: "exe.dev",
+    credentialFields: [{ key: "api_token", label: "API Token", secret: true }],
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: true,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  daytona: {
+    id: "daytona",
+    label: "Daytona",
+    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Daytona is the only driver that can filter egress by NAME as well as
+      // by address: `domainAllowList` (names) alongside `networkAllowList`
+      // (CIDRs), with `networkBlockAll` as the deny-all floor.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  modal: {
+    id: "modal",
+    label: "Modal",
+    credentialFields: [
+      { key: "token_id", label: "Token ID", secret: true },
+      { key: "token_secret", label: "Token Secret", secret: true }
+    ],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // Modal can cut the network entirely (`blockNetwork`) but cannot express
+      // an allowlist, and its driver throws on a host policy. A blackout is
+      // not containment for a workspace that has to clone and reach a model.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  vercel: {
+    id: "vercel",
+    label: "Vercel",
+    credentialFields: [
+      { key: "access_token", label: "Access Token", secret: true },
+      { key: "team_id", label: "Team ID" },
+      { key: "project_id", label: "Project ID" }
+    ],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Vercel's sandbox firewall takes a hostname allow list (or "deny-all"),
+      // never CIDRs.
+      egressControl: "hosts",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "stopped",
+        retention: "explicit",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    label: "Cloudflare",
+    credentialFields: [
+      { key: "api_token", label: "API Token", secret: true },
+      { key: "worker_url", label: "Worker URL" }
+    ],
+    metadata: {
+      driverRunsIn: ["worker"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "proxy",
+      // The Cloudflare Sandbox Worker exposes no egress filter: its broker
+      // (drivers/cloudflare-egress.ts) is an OPT-IN proxy the sandbox chooses
+      // to route brokered-credential requests through, not a boundary. The
+      // driver therefore drops `net` entirely — which is exactly why this
+      // must be declared, so the manager refuses instead of provisioning a
+      // sandbox the caller believes is contained.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "directories",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "copy-on-write"
+      }
+    }
+  },
+  box: {
+    id: "box",
+    label: "Box",
+    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  docker: {
+    id: "docker",
+    label: "Docker",
+    credentialFields: [{ key: "image", label: "Image" }],
+    metadata: {
+      driverRunsIn: ["local"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "loopback",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "same-resource",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  }
+};
+
 // src/drivers/daytona.ts
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
 var DEFAULT_WORKSPACE_DIR = "/workspace";
 var DEFAULT_PREVIEW_EXPIRY_S = 3600;
 var DEFAULT_OPERATION_TIMEOUT_S = 60;
+var LIST_PAGE_SIZE = 100;
+var MAX_LIST_PAGES = 100;
 function labelName(workspaceId) {
   return `claxedo-${workspaceId}`;
 }
@@ -65,6 +271,15 @@ function createDefaultClient(options) {
       for await (const sandbox of sdk.list({ labels })) return sandbox;
       return void 0;
     },
+    // Page 1 carries everything; later pages are empty. See DaytonaClientLike.list.
+    async list(labels, page = 1, limit) {
+      if (page > 1) return { items: [] };
+      const items = [];
+      for await (const sandbox of sdk.list({ ...labels ? { labels } : {}, ...limit ? { limit } : {} })) {
+        items.push(sandbox);
+      }
+      return { items };
+    },
     create(params, operation) {
       if (params.image) return sdk.create({ ...params, image: params.image }, operation);
       return sdk.create(params, operation);
@@ -167,12 +382,29 @@ function createDaytonaSandboxDriver(options) {
     }
     return references;
   }
+  async function applyNetworkPolicy(sandbox, input) {
+    const net = network(input);
+    if (Object.keys(net).length === 0) return "applied";
+    if (!sandbox.updateNetworkSettings) {
+      throw new Error(
+        `daytona sandbox client cannot reapply egress policy to existing sandbox ${sandbox.id}: the client does not support updateNetworkSettings, so the requested restricted policy cannot be guaranteed on reuse \u2014 refusing rather than serving the creation-time policy`
+      );
+    }
+    try {
+      await sandbox.updateNetworkSettings(net);
+    } catch (err) {
+      if (transientDriverError(err)) return "retry";
+      throw err;
+    }
+    return "applied";
+  }
   async function ensureHost(input) {
     const hostId = labelName(input.workspaceId);
     const bootSource = input.bootSource?.kind === "image" ? { image: input.bootSource.image } : { snapshot: input.bootSource?.kind === "driver-snapshot" ? input.bootSource.snapshotId : input.snapshot ?? options.baseSnapshot };
     const net = network(input);
     const secrets = await brokeredSecretReferences(input);
-    const sandbox = await findExisting(input.workspaceId) ?? await client.create({
+    const existing = await findExisting(input.workspaceId);
+    const sandbox = existing ?? await client.create({
       name: labelName(input.workspaceId),
       ...bootSource,
       envVars: staticBootEnv(input, hostId, workspaceDirectory(input)),
@@ -188,6 +420,9 @@ function createDaytonaSandboxDriver(options) {
     });
     if (!sandbox) return { provisioning: true, retryAfterMs: 2e3 };
     if (!await ensureStarted(sandbox)) return { provisioning: true, retryAfterMs: 2e3 };
+    if (existing && await applyNetworkPolicy(existing, input) === "retry") {
+      return { provisioning: true, retryAfterMs: 2e3 };
+    }
     return readyTarget(input, sandbox, hostId);
   }
   return {
@@ -197,12 +432,74 @@ function createDaytonaSandboxDriver(options) {
       hostStopBehavior: "suspends-host",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
-      secretBrokering: "native"
+      secretBrokering: "native",
+      egressControl: "hosts-and-cidrs",
+      persistence: sandboxDriverCatalog.daytona.metadata.persistence
     },
     ensureHost,
+    // Provider-state enumeration for `garbageCollect()`.
+    //
+    // Two label sets exist on a sandbox this driver created (`ensureHost`
+    // above): the manager's flat set — `app`, `workspaceId`, `epoch`,
+    // `homeRegion` (built at index.ts `ensureHostInput`) — and the dotted
+    // `claxedo.workspaceId` this driver adds for `findExisting`. Every target
+    // returned here carries `sandbox.labels` **as the provider reports them**,
+    // never labels reconstructed from ensure inputs: GC's ownership check reads
+    // `labels.app` and its identity check reads flat `labels.workspaceId` /
+    // `labels.epoch`, so a synthesized label set would decide the fate of a
+    // sandbox using values that never left this process. (That is the bug in
+    // the `exe` driver's `list()`, which sources labels from a per-process
+    // `Map` — after a restart it reports `labels: undefined` and GC skips
+    // every sandbox as unlabeled. Not fixed here; different owner.)
+    //
+    // The filter is deliberately WIDE: any claxedo ownership marker qualifies.
+    // Narrowing it here would re-create the defect W1 exists to remove — an
+    // orphan the sweep cannot see is an orphan that lives forever — and the
+    // authority on what may be DESTROYED is the manager's `app`-label check,
+    // which skips anything else as `unmanaged_app_label`. Visibility is this
+    // function's job; destruction is not.
+    //
+    // No preview URL is resolved: `getSignedPreviewUrl` is a per-sandbox
+    // round-trip and GC only needs identity, so a sweep over N orphans would
+    // cost N extra API calls to fill a field it then discards.
+    async list() {
+      if (!client.list) {
+        throw new Error("daytona sandbox client does not support listing");
+      }
+      const targets = [];
+      const seen = /* @__PURE__ */ new Set();
+      for (let page = 1; page <= MAX_LIST_PAGES; page++) {
+        const result = await client.list(void 0, page, LIST_PAGE_SIZE);
+        const items = result?.items ?? [];
+        for (const sandbox of items) {
+          const labels = sandbox.labels;
+          const workspaceId = labels?.workspaceId ?? labels?.["claxedo.workspaceId"];
+          if (!workspaceId || seen.has(sandbox.id)) continue;
+          seen.add(sandbox.id);
+          targets.push({
+            workspaceId,
+            sandboxId: sandbox.id,
+            // Identity, not a reachable address — never routed through.
+            url: sandbox.id,
+            // Must equal what `ensureHost` stored on the lease, or a LIVE
+            // sandbox fails GC's identity check and gets destroyed. Both paths
+            // derive it from `labelName(workspaceId)`.
+            hostId: labelName(workspaceId),
+            driverResourceId: sandbox.id,
+            labels,
+            driver: { id: "daytona", resourceId: sandbox.id }
+          });
+        }
+        if (items.length < LIST_PAGE_SIZE) break;
+      }
+      return targets;
+    },
     async resumeHost(input) {
       const sandbox = await sandboxById(input.lease.sandboxId);
       if (!await ensureStarted(sandbox)) return { provisioning: true, retryAfterMs: 2e3 };
+      if (await applyNetworkPolicy(sandbox, input.ensure) === "retry") {
+        return { provisioning: true, retryAfterMs: 2e3 };
+      }
       return readyTarget(input.ensure, sandbox, input.ensure.hostId ?? labelName(input.ensure.workspaceId));
     },
     async touch(target) {
@@ -219,11 +516,22 @@ function createDaytonaSandboxDriver(options) {
         const status = err.response?.status ?? err.status;
         if (status !== 404) throw err;
       });
+    },
+    async snapshot(target) {
+      const sandbox = await sandboxById(target.sandboxId);
+      if (!sandbox._experimental_createSnapshot) {
+        throw new Error("Daytona sandbox client does not support filesystem snapshots");
+      }
+      const snapshotId = `claxedo-${target.workspaceId ?? target.sandboxId}-${Date.now()}`;
+      await sandbox._experimental_createSnapshot(snapshotId, operationTimeout);
+      return { snapshotId };
     }
   };
 }
 function network(input) {
   if (!input.net || input.net.mode === "allow-all") return {};
+  const hosts = input.net.hosts ?? [];
+  if (hosts.length > 0) return { domainAllowList: formatDaytonaDomainAllowList(hosts) };
   const cidrs = input.net.cidrs ?? [];
   if (cidrs.length === 0) return { networkBlockAll: true };
   return { networkAllowList: formatDaytonaAllowList(cidrs) };

package/dist/drivers/docker.mjs

@@ -37,16 +37,8 @@ import { Image, DaytonaNotFoundError } from "@daytona/sdk";
 
 // src/runtime-version.ts
 var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
-var versionCache;
 function workspaceRuntimeVersion() {
-  if (versionCache) return versionCache;
-  const envVersion = process.env.WORKSPACE_RUNTIME_VERSION;
-  if (envVersion) {
-    versionCache = envVersion;
-    return versionCache;
-  }
-  versionCache = DEFAULT_WORKSPACE_RUNTIME_VERSION;
-  return versionCache;
+  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
 
 // src/image-name.ts
@@ -75,6 +67,207 @@ var SANDBOX_IMAGE_REPOSITORY = sandboxImageRepository();
 var SANDBOX_IMAGE = process.env.CLAXEDO_SANDBOX_IMAGE || defaultSandboxImage();
 var SNAPSHOT_NAME = process.env.CLAXEDO_SNAPSHOT_NAME || defaultSnapshotName();
 
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+
+// src/driver-catalog.ts
+var sandboxDriverCatalog = {
+  exe: {
+    id: "exe",
+    label: "exe.dev",
+    credentialFields: [{ key: "api_token", label: "API Token", secret: true }],
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: true,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  daytona: {
+    id: "daytona",
+    label: "Daytona",
+    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Daytona is the only driver that can filter egress by NAME as well as
+      // by address: `domainAllowList` (names) alongside `networkAllowList`
+      // (CIDRs), with `networkBlockAll` as the deny-all floor.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  modal: {
+    id: "modal",
+    label: "Modal",
+    credentialFields: [
+      { key: "token_id", label: "Token ID", secret: true },
+      { key: "token_secret", label: "Token Secret", secret: true }
+    ],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // Modal can cut the network entirely (`blockNetwork`) but cannot express
+      // an allowlist, and its driver throws on a host policy. A blackout is
+      // not containment for a workspace that has to clone and reach a model.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  vercel: {
+    id: "vercel",
+    label: "Vercel",
+    credentialFields: [
+      { key: "access_token", label: "Access Token", secret: true },
+      { key: "team_id", label: "Team ID" },
+      { key: "project_id", label: "Project ID" }
+    ],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Vercel's sandbox firewall takes a hostname allow list (or "deny-all"),
+      // never CIDRs.
+      egressControl: "hosts",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "stopped",
+        retention: "explicit",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    label: "Cloudflare",
+    credentialFields: [
+      { key: "api_token", label: "API Token", secret: true },
+      { key: "worker_url", label: "Worker URL" }
+    ],
+    metadata: {
+      driverRunsIn: ["worker"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "proxy",
+      // The Cloudflare Sandbox Worker exposes no egress filter: its broker
+      // (drivers/cloudflare-egress.ts) is an OPT-IN proxy the sandbox chooses
+      // to route brokered-credential requests through, not a boundary. The
+      // driver therefore drops `net` entirely — which is exactly why this
+      // must be declared, so the manager refuses instead of provisioning a
+      // sandbox the caller believes is contained.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "directories",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "copy-on-write"
+      }
+    }
+  },
+  box: {
+    id: "box",
+    label: "Box",
+    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  docker: {
+    id: "docker",
+    label: "Docker",
+    credentialFields: [{ key: "image", label: "Image" }],
+    metadata: {
+      driverRunsIn: ["local"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "loopback",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "same-resource",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  }
+};
+
 // src/drivers/docker.ts
 var execFileAsync = promisify(execFile);
 var DEFAULT_OPERATION_TIMEOUT_MS = 6e4;
@@ -326,7 +519,9 @@ function createDockerSandboxDriver(options) {
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "same-host",
       targetAccess: "loopback",
-      secretBrokering: "none"
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: sandboxDriverCatalog.docker.metadata.persistence
     },
     ensureHost,
     resumeHost,

package/dist/drivers/exe.d.ts

@@ -0,0 +1,26 @@
+import type { SandboxDriver, SandboxDriverEnsureInput } from "..";
+type ExeVm = {
+    vm_name: string;
+    https_url?: string;
+    ssh_dest?: string;
+    status?: string;
+    /** Provider-side tags, written at create — the durable half of our labels. */
+    tags?: string[];
+};
+export type ExeSandboxDriverOptions = {
+    apiToken: string;
+    endpoint?: string;
+    image?: string;
+    runtimeCommand?: string;
+    workspaceDir?: string;
+    runtimePort?: number;
+    runner?: string;
+    operationTimeoutMs?: number;
+    healthTimeoutMs?: number;
+    healthIntervalMs?: number;
+    fetchImpl?: typeof fetch;
+    env?: (input: SandboxDriverEnsureInput, vm: ExeVm) => Record<string, string> | Promise<Record<string, string>>;
+};
+export declare function exeWorkspaceName(workspaceId: string, epoch: number): string;
+export declare function createExeSandboxDriver(options: ExeSandboxDriverOptions): SandboxDriver;
+export {};