@claxedo/sandbox-manager 0.5.2 → 0.7.0

package/dist/drivers/modal.mjs

@@ -33,16 +33,8 @@ import { Image, DaytonaNotFoundError } from "@daytona/sdk";
 
 // src/runtime-version.ts
 var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
-var versionCache;
 function workspaceRuntimeVersion() {
-  if (versionCache) return versionCache;
-  const envVersion = process.env.WORKSPACE_RUNTIME_VERSION;
-  if (envVersion) {
-    versionCache = envVersion;
-    return versionCache;
-  }
-  versionCache = DEFAULT_WORKSPACE_RUNTIME_VERSION;
-  return versionCache;
+  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
 
 // src/image-name.ts
@@ -71,6 +63,207 @@ var SANDBOX_IMAGE_REPOSITORY = sandboxImageRepository();
 var SANDBOX_IMAGE = process.env.CLAXEDO_SANDBOX_IMAGE || defaultSandboxImage();
 var SNAPSHOT_NAME = process.env.CLAXEDO_SNAPSHOT_NAME || defaultSnapshotName();
 
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+
+// src/driver-catalog.ts
+var sandboxDriverCatalog = {
+  exe: {
+    id: "exe",
+    label: "exe.dev",
+    credentialFields: [{ key: "api_token", label: "API Token", secret: true }],
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: true,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  daytona: {
+    id: "daytona",
+    label: "Daytona",
+    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Daytona is the only driver that can filter egress by NAME as well as
+      // by address: `domainAllowList` (names) alongside `networkAllowList`
+      // (CIDRs), with `networkBlockAll` as the deny-all floor.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  modal: {
+    id: "modal",
+    label: "Modal",
+    credentialFields: [
+      { key: "token_id", label: "Token ID", secret: true },
+      { key: "token_secret", label: "Token Secret", secret: true }
+    ],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // Modal can cut the network entirely (`blockNetwork`) but cannot express
+      // an allowlist, and its driver throws on a host policy. A blackout is
+      // not containment for a workspace that has to clone and reach a model.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  vercel: {
+    id: "vercel",
+    label: "Vercel",
+    credentialFields: [
+      { key: "access_token", label: "Access Token", secret: true },
+      { key: "team_id", label: "Team ID" },
+      { key: "project_id", label: "Project ID" }
+    ],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Vercel's sandbox firewall takes a hostname allow list (or "deny-all"),
+      // never CIDRs.
+      egressControl: "hosts",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "stopped",
+        retention: "explicit",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    label: "Cloudflare",
+    credentialFields: [
+      { key: "api_token", label: "API Token", secret: true },
+      { key: "worker_url", label: "Worker URL" }
+    ],
+    metadata: {
+      driverRunsIn: ["worker"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "proxy",
+      // The Cloudflare Sandbox Worker exposes no egress filter: its broker
+      // (drivers/cloudflare-egress.ts) is an OPT-IN proxy the sandbox chooses
+      // to route brokered-credential requests through, not a boundary. The
+      // driver therefore drops `net` entirely — which is exactly why this
+      // must be declared, so the manager refuses instead of provisioning a
+      // sandbox the caller believes is contained.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "directories",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "copy-on-write"
+      }
+    }
+  },
+  box: {
+    id: "box",
+    label: "Box",
+    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  docker: {
+    id: "docker",
+    label: "Docker",
+    credentialFields: [{ key: "image", label: "Image" }],
+    metadata: {
+      driverRunsIn: ["local"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "loopback",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "same-resource",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  }
+};
+
 // src/drivers/modal.ts
 var DEFAULT_APP_NAME = "claxedo";
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
@@ -192,7 +385,9 @@ function createModalSandboxDriver(options) {
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
-      secretBrokering: "none"
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: sandboxDriverCatalog.modal.metadata.persistence
     },
     ensureHost,
     resumeHost: (input) => ensureHost(input.ensure),

package/dist/drivers/vercel.d.ts

@@ -101,10 +101,29 @@ export type VercelSandboxDriverOptions = {
  * a header on outbound requests to the allowlisted hosts, so the raw value
  * never enters the sandbox (see @claxedo/sandbox-manager SandboxBrokeredSecret
  * and https://vercel.com/docs/sandbox/concepts/firewall — credentials
- * brokering). The resulting policy is deny-all-except-brokered-hosts, which is
- * the secure default: a sandbox holding a brokered credential should only be
- * able to reach the host that credential is for.
+ * brokering).
+ *
+ * The result is the UNION of `base` — the create-time allow-list — and the
+ * brokered hosts, never a replacement. Replacing it is wrong in both
+ * directions. It BREAKS egress the caller was granted: `updateNetworkPolicy`
+ * overwrites the whole policy, so a sandbox created with git and the npm
+ * registry allowed loses both the instant a brokered secret is attached, and
+ * the agent's next `npm install` fails mid-run. And it can silently WIDEN
+ * egress: a brokered host that was not in the create-time list becomes
+ * reachable, so a policy nobody approved is installed as a side effect of
+ * attaching a credential. A union changes exactly one thing — it adds the
+ * brokered hosts, which is the smallest edit that makes the credential usable.
+ *
+ * `base` is the create-time `NetworkPolicy` exactly as passed to `create`, and
+ * it is REQUIRED even though `undefined` is a legal value: `undefined` means
+ * "no policy was requested", so the merge keeps egress unrestricted, expressed
+ * as the `"*"` wildcard the record form needs for the header transforms to ride
+ * alongside it. That is the opposite of what this function used to return with
+ * no base at all (deny-all-except-brokered-hosts), so an optional parameter
+ * would let an existing caller keep compiling while its egress silently WIDENS.
+ * Spelling the base out forces that decision to be made once, visibly. A
+ * `"deny-all"` base contributes nothing, leaving deny-all-except-brokered-hosts.
  */
-export declare function vercelBrokeredNetworkPolicy(secrets: SandboxBrokeredSecret[]): NetworkPolicy;
+export declare function vercelBrokeredNetworkPolicy(secrets: SandboxBrokeredSecret[], base: NetworkPolicy | undefined): NetworkPolicy;
 export declare function createVercelSandboxDriver(options: VercelSandboxDriverOptions): SandboxDriver;
 export {};

package/dist/drivers/vercel.mjs

@@ -22,16 +22,8 @@ function workspaceRuntimeSourceEnv(input) {
 
 // src/runtime-version.ts
 var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
-var versionCache;
 function workspaceRuntimeVersion() {
-  if (versionCache) return versionCache;
-  const envVersion = process.env.WORKSPACE_RUNTIME_VERSION;
-  if (envVersion) {
-    versionCache = envVersion;
-    return versionCache;
-  }
-  versionCache = DEFAULT_WORKSPACE_RUNTIME_VERSION;
-  return versionCache;
+  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
 
 // src/command.ts
@@ -45,6 +37,207 @@ var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
 // src/defaults.ts
 var RUNTIME_DIR = "/opt/workspace-runtime";
 
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+
+// src/driver-catalog.ts
+var sandboxDriverCatalog = {
+  exe: {
+    id: "exe",
+    label: "exe.dev",
+    credentialFields: [{ key: "api_token", label: "API Token", secret: true }],
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: true,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  daytona: {
+    id: "daytona",
+    label: "Daytona",
+    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Daytona is the only driver that can filter egress by NAME as well as
+      // by address: `domainAllowList` (names) alongside `networkAllowList`
+      // (CIDRs), with `networkBlockAll` as the deny-all floor.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  modal: {
+    id: "modal",
+    label: "Modal",
+    credentialFields: [
+      { key: "token_id", label: "Token ID", secret: true },
+      { key: "token_secret", label: "Token Secret", secret: true }
+    ],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // Modal can cut the network entirely (`blockNetwork`) but cannot express
+      // an allowlist, and its driver throws on a host policy. A blackout is
+      // not containment for a workspace that has to clone and reach a model.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  vercel: {
+    id: "vercel",
+    label: "Vercel",
+    credentialFields: [
+      { key: "access_token", label: "Access Token", secret: true },
+      { key: "team_id", label: "Team ID" },
+      { key: "project_id", label: "Project ID" }
+    ],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Vercel's sandbox firewall takes a hostname allow list (or "deny-all"),
+      // never CIDRs.
+      egressControl: "hosts",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "stopped",
+        retention: "explicit",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    label: "Cloudflare",
+    credentialFields: [
+      { key: "api_token", label: "API Token", secret: true },
+      { key: "worker_url", label: "Worker URL" }
+    ],
+    metadata: {
+      driverRunsIn: ["worker"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "proxy",
+      // The Cloudflare Sandbox Worker exposes no egress filter: its broker
+      // (drivers/cloudflare-egress.ts) is an OPT-IN proxy the sandbox chooses
+      // to route brokered-credential requests through, not a boundary. The
+      // driver therefore drops `net` entirely — which is exactly why this
+      // must be declared, so the manager refuses instead of provisioning a
+      // sandbox the caller believes is contained.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "directories",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "copy-on-write"
+      }
+    }
+  },
+  box: {
+    id: "box",
+    label: "Box",
+    credentialFields: [{ key: "api_key", label: "API Key", secret: true }],
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  docker: {
+    id: "docker",
+    label: "Docker",
+    credentialFields: [{ key: "image", label: "Image" }],
+    metadata: {
+      driverRunsIn: ["local"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "loopback",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "same-resource",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  }
+};
+
 // src/drivers/vercel.ts
 var DEFAULT_RUNTIME = "node22";
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
@@ -53,8 +246,9 @@ var DEFAULT_TIMEOUT_MS = 30 * 60 * 1e3;
 var DEFAULT_SNAPSHOT_BUILD_TIMEOUT_MS = 10 * 60 * 1e3;
 var DEFAULT_OPERATION_TIMEOUT_MS = 6e4;
 var DEFAULT_KEEP_ALIVE_MS = 5 * 60 * 1e3;
-var EXPECTED_RUNTIME_VERSION = workspaceRuntimeVersion();
-var RUNTIME_PKG = `@claxedo/workspace-runtime@${EXPECTED_RUNTIME_VERSION}`;
+function runtimePackage(version) {
+  return `@claxedo/workspace-runtime@${version}`;
+}
 var SNAPSHOT_CACHE_TTL_MS = 60 * 60 * 1e3;
 var snapshotCache = /* @__PURE__ */ new Map();
 var snapshotCacheState = /* @__PURE__ */ new WeakMap();
@@ -74,8 +268,9 @@ function network(input) {
   if (hosts.length === 0) return "deny-all";
   return { allow: hosts };
 }
-function vercelBrokeredNetworkPolicy(secrets) {
+function vercelBrokeredNetworkPolicy(secrets, base) {
   const allow = {};
+  for (const [host, rules] of baseAllowEntries(base)) allow[host] = [...rules];
   for (const secret of secrets) {
     if (!secret.header) {
       throw new Error(
@@ -87,7 +282,14 @@ function vercelBrokeredNetworkPolicy(secrets) {
       (allow[host] ??= []).push({ transform: [{ headers: { [secret.header]: secret.value } }] });
     }
   }
-  return { allow };
+  const subnets = typeof base === "object" && base?.subnets ? { subnets: base.subnets } : {};
+  return { allow, ...subnets };
+}
+function baseAllowEntries(base) {
+  if (base === void 0 || base === "allow-all") return [["*", []]];
+  if (base === "deny-all") return [];
+  if (Array.isArray(base.allow)) return base.allow.map((host) => [host, []]);
+  return Object.entries(base.allow ?? {});
 }
 function createVercelSandboxDriver(options) {
   const sandboxFactory = options.sandbox ?? Sandbox;
@@ -141,7 +343,8 @@ function createVercelSandboxDriver(options) {
   }
   async function ensureSnapshot() {
     if (options.baseSnapshotId) return options.baseSnapshotId;
-    const cacheKey = `${options.teamId}:${options.projectId}:${runtime}:${EXPECTED_RUNTIME_VERSION}`;
+    const expectedRuntimeVersion = workspaceRuntimeVersion();
+    const cacheKey = `${options.teamId}:${options.projectId}:${runtime}:${expectedRuntimeVersion}`;
     const hit = cache.get(cacheKey);
     const expiresAt = cacheState.expires.get(cacheKey);
     if (hit && expiresAt === void 0) {
@@ -183,8 +386,8 @@ function createVercelSandboxDriver(options) {
         `sudo chown $(whoami) ${shell(RUNTIME_DIR)}`,
         `cd ${shell(RUNTIME_DIR)}`,
         "npm init -y",
-        `npm install ${RUNTIME_PKG} --min-release-age=2`,
-        `node -e "const fs=require('fs');const actual=JSON.parse(fs.readFileSync('${RUNTIME_DIR}/node_modules/@claxedo/workspace-runtime/package.json','utf8')).version;if(actual!=='${EXPECTED_RUNTIME_VERSION}'){throw new Error('workspace-runtime snapshot package version mismatch: expected ${EXPECTED_RUNTIME_VERSION}, got '+actual)}"`,
+        `npm install ${runtimePackage(expectedRuntimeVersion)} --min-release-age=2`,
+        `node -e "const fs=require('fs');const actual=JSON.parse(fs.readFileSync('${RUNTIME_DIR}/node_modules/@claxedo/workspace-runtime/package.json','utf8')).version;if(actual!=='${expectedRuntimeVersion}'){throw new Error('workspace-runtime snapshot package version mismatch: expected ${expectedRuntimeVersion}, got '+actual)}"`,
         "test -x node_modules/.bin/workspace-runtime",
         "test -x node_modules/.bin/claude-agent-acp",
         "test -x node_modules/.bin/codex-acp",
@@ -249,20 +452,21 @@ function createVercelSandboxDriver(options) {
       ...bootEnv(input, hostId),
       ...await options.env?.(input, { id: hostId })
     };
+    const createPolicy = network(input);
     const sandbox = await sandboxFactory.create({
       ...credentials(),
       source: await source(input),
       ports: [runtimePort],
       timeout: timeoutMs,
       env,
-      ...network(input) ? { networkPolicy: network(input) } : {}
+      ...createPolicy ? { networkPolicy: createPolicy } : {}
     }).catch((err) => {
       if (transientDriverError(err)) return void 0;
       throw err;
     });
     if (!sandbox) return { provisioning: true, retryAfterMs: 2e3 };
     if (input.secrets?.length) {
-      await sandbox.updateNetworkPolicy(vercelBrokeredNetworkPolicy(input.secrets), {
+      await sandbox.updateNetworkPolicy(vercelBrokeredNetworkPolicy(input.secrets, createPolicy), {
         signal: AbortSignal.timeout(operationTimeoutMs)
       });
     }
@@ -282,7 +486,9 @@ function createVercelSandboxDriver(options) {
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
-      secretBrokering: "native"
+      secretBrokering: "native",
+      egressControl: "hosts",
+      persistence: sandboxDriverCatalog.vercel.metadata.persistence
     },
     ensureHost,
     resumeHost: (input) => ensureHost(input.ensure),

package/dist/hosted-network-policy.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The egress allowlist a HOSTED, multi-tenant sandbox is provisioned with.
+ *
+ * A hosted sandbox runs agent-authored code on the operator's infrastructure,
+ * next to other tenants' sandboxes, holding a checkout of the user's private
+ * repository and (via `SandboxBrokeredSecret`) the ability to spend the
+ * operator's model credits. The default for that shape of workload is
+ * restrictive, not allow-all: the interesting attack is not "the agent
+ * downloads a package", it is "the agent POSTs the repository to a host the
+ * attacker controls". An allowlist is what makes that fail.
+ *
+ * Every entry below has to earn its place, so the list is assembled from three
+ * sources of truth rather than from taste:
+ *
+ *   1. DERIVED PER REQUEST — the control plane the sandbox reports back to and
+ *      the git host it clones from. These differ per deployment and per
+ *      workspace, so they are inputs, not constants.
+ *   2. MODEL PROVIDERS — the endpoints an agent harness must reach to do any
+ *      work at all. Taken from the harness→provider mapping the credential
+ *      layer already maintains (`PROVIDER_TO_GROUP` /`DEFAULT_ALLOWLIST` in
+ *      claxedo-server's `network/types.ts`), narrowed to the API hostnames.
+ *   3. PACKAGE REGISTRIES — an agent that cannot install a dependency cannot
+ *      edit a real repository. Same source, again narrowed.
+ *
+ * What is deliberately NOT here, despite being in that same default list:
+ * general-purpose object storage and CDN wildcards (`*.workers.dev`,
+ * `r2.cloudflarestorage.com`, `storage.googleapis.com`,
+ * `*.blob.core.windows.net`, `*.amazonaws.com`). Every one of those is a
+ * bucket an attacker can create in their own account, so allowlisting them
+ * hands back exactly the exfiltration channel the policy exists to close. A
+ * deployment that genuinely needs one adds it through `extraHosts` as an
+ * explicit, auditable decision.
+ *
+ * This module is data + string handling only, so it runs unchanged inside the
+ * hosted Worker (no DNS, no node builtins). That matters: name-based policy is
+ * the only kind the Worker can compute, which is why `egressControl` treats
+ * name filtering as the capability that qualifies a driver for hosted use.
+ */
+import type { SandboxNetworkPolicy, SandboxSource } from ".";
+/**
+ * Model-provider endpoints. Derived from the harness→provider groups in
+ * claxedo-server `network/types.ts` (`PROVIDER_TO_GROUP`): claude-acp and
+ * claude-sdk → anthropic, codex-acp/codex-app-server/cursor-acp → openai,
+ * google → google_ai; plus the aggregator and catalog endpoints the engine
+ * itself fetches at startup.
+ */
+export declare const SANDBOX_MODEL_PROVIDER_HOSTS: readonly ["api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com", "openrouter.ai", "models.dev", "opencode.ai"];
+/**
+ * Package registries. Narrowed from the npm / pypi / rust / golang groups of
+ * `DEFAULT_ALLOWLIST` to the hostnames a package install actually contacts —
+ * the wildcard CDN entries in those groups are excluded on purpose (see the
+ * module comment).
+ */
+export declare const SANDBOX_PACKAGE_REGISTRY_HOSTS: readonly ["registry.npmjs.org", "nodejs.org", "pypi.org", "files.pythonhosted.org", "crates.io", "static.crates.io", "index.crates.io", "proxy.golang.org", "sum.golang.org"];
+/** The deployment-independent floor: providers + registries. */
+export declare const SANDBOX_BASELINE_EGRESS_HOSTS: readonly ["api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com", "openrouter.ai", "models.dev", "opencode.ai", "registry.npmjs.org", "nodejs.org", "pypi.org", "files.pythonhosted.org", "crates.io", "static.crates.io", "index.crates.io", "proxy.golang.org", "sum.golang.org"];
+/**
+ * The git host this workspace clones from.
+ *
+ * Scoped to the ONE repository host in the request rather than to a forge
+ * allowlist, matching how `authenticatedGitHubCloneSource` scopes the clone
+ * credential it brokers (`hosts: ["github.com"]`) — the credential and the
+ * network policy should describe the same reachable surface.
+ */
+export declare function sandboxSourceHost(source: SandboxSource | undefined): string | undefined;
+export type HostedSandboxNetworkPolicyInput = {
+    /**
+     * Control-plane and relay endpoints the runtime reports back to: the relay
+     * it tunnels through and fetches `WORKSPACE_RUNTIME_RELAY_JWKS_URL` from,
+     * and the control-plane origin serving `WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL`
+     * plus register/heartbeat. URLs or bare hostnames; blanks are ignored.
+     */
+    controlPlane: Array<string | undefined>;
+    /** Workspace source — its git host is allowed, nothing else on that forge. */
+    source?: SandboxSource;
+    /** Operator escape hatch for deployment-specific hosts. */
+    extraHosts?: readonly string[];
+};
+/**
+ * Build the restricted policy for a hosted sandbox.
+ *
+ * Always `mode: "restricted"`. There is no input that makes this return
+ * allow-all — a hosted sandbox with an empty or unresolvable control-plane URL
+ * is a misconfiguration, and answering it with "then allow everything" is how
+ * the gap this closes came to exist in the first place.
+ */
+export declare function hostedSandboxNetworkPolicy(input: HostedSandboxNetworkPolicyInput): SandboxNetworkPolicy;