@claxedo/sandbox-manager 0.6.0 → 0.9.0

package/dist/drivers/daytona.mjs

@@ -1,12 +1,25 @@
-// src/drivers/daytona.ts
-import { Daytona } from "@daytona/sdk";
-
 // src/daytona-allow-list.ts
 function formatDaytonaAllowList(cidrs) {
   return cidrs.slice(0, 10).join(",");
 }
+function formatDaytonaDomainAllowList(hosts) {
+  return [...new Set(hosts)].join(",");
+}
 
 // src/runtime-env.ts
+function workspaceRuntimeBootEnv(input) {
+  const env = {
+    ...workspaceRuntimeTargetEnv(input),
+    ...workspaceRuntimeSourceEnv(input),
+    ...input.env
+  };
+  if (input.runner) env.WORKSPACE_RUNTIME_RUNNER = input.runner;
+  if (input.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = input.controlEnv.relayJwksUrl;
+  if (input.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = input.controlEnv.relayVerifyPem;
+  if (input.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = input.controlEnv.managementJwksUrl;
+  if (input.controlEnv?.sessionAuthorityUrl) env.WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL = input.controlEnv.sessionAuthorityUrl;
+  return env;
+}
 function workspaceRuntimeTargetEnv(input) {
   return {
     WORKSPACE_RUNTIME_WORKSPACE_ID: input.workspaceId,
@@ -33,26 +46,298 @@ function shell(input) {
 // src/constants.ts
 var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
 
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+
+// ../sandbox-contract/dist/index.mjs
+var sandboxDriverCredentialFields = {
+  exe: [{ key: "api_token", label: "API Token", secret: true }],
+  daytona: [{ key: "api_key", label: "API Key", secret: true }],
+  modal: [
+    { key: "token_id", label: "Token ID", secret: true },
+    { key: "token_secret", label: "Token Secret", secret: true }
+  ],
+  vercel: [
+    { key: "access_token", label: "Access Token", secret: true },
+    { key: "team_id", label: "Team ID" },
+    { key: "project_id", label: "Project ID" }
+  ],
+  cloudflare: [
+    { key: "api_token", label: "API Token", secret: true },
+    { key: "worker_url", label: "Worker URL" }
+  ],
+  box: [{ key: "api_key", label: "API Key", secret: true }],
+  docker: [{ key: "image", label: "Image" }]
+};
+var sandboxDriverLabels = {
+  exe: "exe.dev",
+  daytona: "Daytona",
+  modal: "Modal",
+  vercel: "Vercel",
+  cloudflare: "Cloudflare",
+  box: "Box",
+  docker: "Docker"
+};
+
+// src/driver-catalog.ts
+var sandboxDriverCatalog = {
+  exe: {
+    id: "exe",
+    label: sandboxDriverLabels.exe,
+    credentialFields: sandboxDriverCredentialFields.exe,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: true,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  daytona: {
+    id: "daytona",
+    label: sandboxDriverLabels.daytona,
+    credentialFields: sandboxDriverCredentialFields.daytona,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // The driver translates names to domainAllowList, or addresses to networkAllowList.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  modal: {
+    id: "modal",
+    label: sandboxDriverLabels.modal,
+    credentialFields: sandboxDriverCredentialFields.modal,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // The driver does not install Modal's domain allowlist or alpha sidecar.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  vercel: {
+    id: "vercel",
+    label: sandboxDriverLabels.vercel,
+    credentialFields: sandboxDriverCredentialFields.vercel,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // The driver translates hosts only; the SDK's subnet rules are not wired to net.cidrs.
+      egressControl: "hosts",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "stopped",
+        retention: "explicit",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    label: sandboxDriverLabels.cloudflare,
+    credentialFields: sandboxDriverCredentialFields.cloudflare,
+    metadata: {
+      driverRunsIn: ["worker"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Credential handlers do not restrict unrelated destinations.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "directories",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "copy-on-write"
+      }
+    }
+  },
+  box: {
+    id: "box",
+    label: sandboxDriverLabels.box,
+    credentialFields: sandboxDriverCredentialFields.box,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  docker: {
+    id: "docker",
+    label: sandboxDriverLabels.docker,
+    credentialFields: sandboxDriverCredentialFields.docker,
+    metadata: {
+      driverRunsIn: ["local"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "loopback",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "same-resource",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  }
+};
+
+// ../claxedo-helpers/dist/guards.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/json.ts
+function num(input) {
+  return typeof input === "number" ? input : void 0;
+}
+
+// src/drivers/transient-error.ts
+function textOf(input) {
+  return typeof input === "string" ? input : "";
+}
+function driverErrorSignals(err) {
+  const shaped = isRecord(err) ? err : {};
+  const nested = isRecord(shaped.response) ? shaped.response : {};
+  return {
+    status: num(nested.status) ?? num(shaped.status),
+    text: `${textOf(shaped.code)} ${textOf(shaped.name)} ${textOf(shaped.message)}`.toLowerCase()
+  };
+}
+function isTransientDriverError(err, markers) {
+  const { status, text } = driverErrorSignals(err);
+  if (status !== void 0 && status >= 500) return true;
+  return markers.some((marker) => text.includes(marker));
+}
+
 // src/drivers/daytona.ts
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
 var DEFAULT_WORKSPACE_DIR = "/workspace";
 var DEFAULT_PREVIEW_EXPIRY_S = 3600;
 var DEFAULT_OPERATION_TIMEOUT_S = 60;
+var LIST_PAGE_SIZE = 100;
+var SECRET_LIST_PAGE_SIZE = 200;
+var SENTINEL_SECRET_ENV = "CLAXEDO_BROKERED_SECRET_SLOT";
+var REVOKED_SECRET_VALUE = "claxedo-revoked";
+var MAX_LIST_PAGES = 100;
 function labelName(workspaceId) {
   return `claxedo-${workspaceId}`;
 }
+function encodeSecretSegment(value) {
+  return encodeURIComponent(value).replace(/[-_.!~*'()]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%/g, "_");
+}
+function workspaceSecretPrefix(workspaceId) {
+  return `claxedo-${encodeSecretSegment(workspaceId)}-`;
+}
 function daytonaSecretName(workspaceId, secretName) {
-  const safe = (value) => value.replace(/[^a-zA-Z0-9_-]+/g, "-");
-  return `claxedo-${safe(workspaceId)}-${safe(secretName)}`;
+  return `${workspaceSecretPrefix(workspaceId)}${encodeSecretSegment(secretName)}`;
 }
+function daytonaSecretEnvName(workspaceId, secretName) {
+  try {
+    return decodeURIComponent(secretName.slice(workspaceSecretPrefix(workspaceId).length).replace(/_/g, "%"));
+  } catch {
+    return void 0;
+  }
+}
+async function listWorkspaceSecrets(secrets, workspaceId) {
+  const prefix = workspaceSecretPrefix(workspaceId);
+  const held = /* @__PURE__ */ new Map();
+  let cursor;
+  for (let page = 0; page < MAX_LIST_PAGES; page++) {
+    const result = await secrets.list({ name: prefix, limit: SECRET_LIST_PAGE_SIZE, ...cursor ? { cursor } : {} });
+    for (const secret of result.items ?? []) {
+      if (secret.name.startsWith(prefix)) held.set(secret.name, secret);
+    }
+    cursor = result.nextCursor ?? void 0;
+    if (!cursor) break;
+  }
+  return held;
+}
+async function withdrawSecret(secrets, secret, options) {
+  await secrets.update(secret.id, { value: REVOKED_SECRET_VALUE, hosts: [] });
+  if (options.delete) await secrets.delete(secret.id);
+}
+var TRANSIENT_MARKERS = ["timeout", "pending", "starting"];
 function transientDriverError(err) {
-  const shaped = err;
-  const status = shaped.response?.status ?? shaped.status;
-  if (typeof status === "number" && status >= 500) return true;
-  const text = `${shaped.name ?? ""} ${shaped.message ?? ""}`.toLowerCase();
-  return text.includes("timeout") || text.includes("pending") || text.includes("starting");
+  return isTransientDriverError(err, TRANSIENT_MARKERS);
 }
-function createDefaultClient(options) {
+async function createDefaultClient(options) {
+  const { Daytona } = await import("@daytona/sdk");
   const sdk = new Daytona({
     apiKey: options.apiKey,
     ...options.apiUrl ? { apiUrl: options.apiUrl } : {},
@@ -65,42 +350,50 @@ function createDefaultClient(options) {
       for await (const sandbox of sdk.list({ labels })) return sandbox;
       return void 0;
     },
+    // Page 1 carries everything; later pages are empty. See DaytonaClientLike.list.
+    async list(labels, page = 1, limit) {
+      if (page > 1) return { items: [] };
+      const items = [];
+      for await (const sandbox of sdk.list({ ...labels ? { labels } : {}, ...limit ? { limit } : {} })) {
+        items.push(sandbox);
+      }
+      return { items };
+    },
     create(params, operation) {
       if (params.image) return sdk.create({ ...params, image: params.image }, operation);
       return sdk.create(params, operation);
     },
     get: (sandboxIdOrName) => sdk.get(sandboxIdOrName),
-    async upsertSecret({ name, value, hosts }) {
-      await sdk.secret.create({ name, value, hosts });
-    }
+    secret: sdk.secret
   };
 }
 function createDaytonaSandboxDriver(options) {
-  const client = options.client ?? createDefaultClient(options);
+  let defaultClient;
+  function resolveClient() {
+    if (options.client) return options.client;
+    defaultClient ??= createDefaultClient(options);
+    return defaultClient;
+  }
   const runtimePort = options.runtimePort ?? DEFAULT_WORKSPACE_RUNTIME_PORT;
   const runtimeCommand = options.runtimeCommand ?? DEFAULT_RUNTIME_COMMAND;
   const workspaceDir = options.workspaceDir ?? DEFAULT_WORKSPACE_DIR;
   const previewExpiry = options.previewExpirySeconds ?? DEFAULT_PREVIEW_EXPIRY_S;
   const operationTimeout = options.operationTimeoutSeconds ?? DEFAULT_OPERATION_TIMEOUT_S;
+  const warn = options.warn ?? ((message) => console.warn(message));
   function workspaceDirectory(input) {
     return input.workspaceRoot ?? workspaceDir;
   }
   function staticBootEnv(input, hostId, directory) {
-    const env = {
-      ...workspaceRuntimeTargetEnv({
-        workspaceId: input.workspaceId,
-        hostId,
-        directory,
-        port: runtimePort
-      }),
-      ...workspaceRuntimeSourceEnv({ source: input.source }),
-      ...input.env
-    };
-    if (options.runner) env.WORKSPACE_RUNTIME_RUNNER = options.runner;
-    if (options.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = options.controlEnv.relayJwksUrl;
-    if (options.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = options.controlEnv.relayVerifyPem;
-    if (options.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = options.controlEnv.managementJwksUrl;
-    return env;
+    return workspaceRuntimeBootEnv({
+      workspaceId: input.workspaceId,
+      hostId,
+      directory,
+      port: runtimePort,
+      source: input.source,
+      env: input.env,
+      runner: options.runner,
+      controlEnv: options.controlEnv
+    });
   }
   async function bootEnv(input, sandbox, hostId) {
     return {
@@ -109,13 +402,14 @@ function createDaytonaSandboxDriver(options) {
     };
   }
   async function findExisting(workspaceId) {
+    const client = await resolveClient();
     const labels = { "claxedo.workspaceId": workspaceId };
     if (client.findByLabels) return client.findByLabels(labels).catch(() => void 0);
     const result = await client.list?.(labels, 1, 1).catch(() => void 0);
     return result?.items?.[0];
   }
   async function sandboxById(sandboxId) {
-    return client.get(sandboxId);
+    return (await resolveClient()).get(sandboxId);
   }
   async function previewUrl(sandbox) {
     const signed = await sandbox.getSignedPreviewUrl(runtimePort, previewExpiry).catch(() => void 0);
@@ -151,32 +445,98 @@ function createDaytonaSandboxDriver(options) {
     };
     return target;
   }
-  async function brokeredSecretReferences(input) {
-    if (!input.secrets?.length) return {};
-    if (!client.upsertSecret) {
+  async function brokeredSecretService() {
+    const secrets = (await resolveClient()).secret;
+    if (!secrets) {
       throw new Error("daytona sandbox client does not support secret brokering");
     }
+    return secrets;
+  }
+  async function reconcileBrokeredSecrets(input, options2) {
+    const secrets = await brokeredSecretService();
+    const existing = await listWorkspaceSecrets(secrets, input.workspaceId);
     const references = {};
-    for (const secret of input.secrets) {
+    const desired = /* @__PURE__ */ new Set();
+    const sentinel = daytonaSecretName(input.workspaceId, SENTINEL_SECRET_ENV);
+    desired.add(sentinel);
+    references[SENTINEL_SECRET_ENV] = sentinel;
+    if (!existing.has(sentinel)) await secrets.create({ name: sentinel, value: "", hosts: [] });
+    for (const secret of input.secrets ?? []) {
       if (secret.hosts.length === 0) {
         throw new Error(`daytona brokered secret "${secret.name}" requires at least one host in its egress allowlist`);
       }
-      const secretName = daytonaSecretName(input.workspaceId, secret.name);
-      await client.upsertSecret({ name: secretName, value: secret.value, hosts: secret.hosts });
-      references[secret.name] = secretName;
+      const name = daytonaSecretName(input.workspaceId, secret.name);
+      desired.add(name);
+      references[secret.name] = name;
+      const current = existing.get(name);
+      if (current) await secrets.update(current.id, { value: secret.value, hosts: secret.hosts });
+      else await secrets.create({ name, value: secret.value, hosts: secret.hosts });
+    }
+    if (options2.withdraw) {
+      for (const [name, secret] of existing) {
+        if (desired.has(name)) continue;
+        await withdrawSecret(secrets, secret, { delete: false });
+        if (!options2.mountWithdrawn) continue;
+        const envName = daytonaSecretEnvName(input.workspaceId, name);
+        if (!envName) {
+          warn(
+            `[sandbox-manager] daytona org secret ${name} matches workspace ${input.workspaceId}'s prefix but was not minted by this driver; it was emptied and left unmounted`
+          );
+          continue;
+        }
+        desired.add(name);
+        references[envName] = name;
+      }
+    }
+    const mountedNamesChanged = existing.size !== desired.size || [...desired].some((name) => !existing.has(name));
+    return { references, mountedNamesChanged };
+  }
+  function mayBeRunning(sandbox) {
+    return !sandbox.state || sandbox.state === "started";
+  }
+  async function restartForMountedSecrets(sandbox, workspaceId) {
+    warn(
+      `[sandbox-manager] restarting daytona sandbox ${sandbox.id} (workspace ${workspaceId}): the set of brokered secret names changed and mounted env vars only reach processes spawned after the change`
+    );
+    await sandbox.stop(operationTimeout);
+    await sandbox.start(operationTimeout);
+  }
+  async function applyBrokeredSecrets(sandbox, plan, workspaceId) {
+    await sandbox.updateSecrets(plan.references);
+    if (plan.mountedNamesChanged && mayBeRunning(sandbox)) {
+      await restartForMountedSecrets(sandbox, workspaceId);
+    }
+  }
+  async function applyNetworkPolicy(sandbox, input) {
+    const net = network(input);
+    if (Object.keys(net).length === 0) return "applied";
+    if (!sandbox.updateNetworkSettings) {
+      throw new Error(
+        `daytona sandbox client cannot reapply egress policy to existing sandbox ${sandbox.id}: the client does not support updateNetworkSettings, so the requested restricted policy cannot be guaranteed on reuse \u2014 refusing rather than serving the creation-time policy`
+      );
+    }
+    try {
+      await sandbox.updateNetworkSettings(net);
+    } catch (err) {
+      if (transientDriverError(err)) return "retry";
+      throw err;
     }
-    return references;
+    return "applied";
   }
   async function ensureHost(input) {
     const hostId = labelName(input.workspaceId);
     const bootSource = input.bootSource?.kind === "image" ? { image: input.bootSource.image } : { snapshot: input.bootSource?.kind === "driver-snapshot" ? input.bootSource.snapshotId : input.snapshot ?? options.baseSnapshot };
     const net = network(input);
-    const secrets = await brokeredSecretReferences(input);
-    const sandbox = await findExisting(input.workspaceId) ?? await client.create({
+    const existing = await findExisting(input.workspaceId);
+    const plan = existing && input.secrets === void 0 ? void 0 : await reconcileBrokeredSecrets(input, {
+      withdraw: input.secrets !== void 0,
+      mountWithdrawn: Boolean(existing)
+    });
+    const sandbox = existing ?? await (await resolveClient()).create({
       name: labelName(input.workspaceId),
       ...bootSource,
       envVars: staticBootEnv(input, hostId, workspaceDirectory(input)),
-      ...Object.keys(secrets).length ? { secrets } : {},
+      ...plan ? { secrets: plan.references } : {},
       labels: { ...input.labels, "claxedo.workspaceId": input.workspaceId },
       public: false,
       ...net,
@@ -187,7 +547,11 @@ function createDaytonaSandboxDriver(options) {
       throw err;
     });
     if (!sandbox) return { provisioning: true, retryAfterMs: 2e3 };
+    if (existing && plan) await applyBrokeredSecrets(existing, plan, input.workspaceId);
     if (!await ensureStarted(sandbox)) return { provisioning: true, retryAfterMs: 2e3 };
+    if (existing && await applyNetworkPolicy(existing, input) === "retry") {
+      return { provisioning: true, retryAfterMs: 2e3 };
+    }
     return readyTarget(input, sandbox, hostId);
   }
   return {
@@ -197,12 +561,79 @@ function createDaytonaSandboxDriver(options) {
       hostStopBehavior: "suspends-host",
       hostResumeBehavior: "same-host",
       targetAccess: "relay",
-      secretBrokering: "native"
+      secretBrokering: "native",
+      egressControl: "hosts-and-cidrs",
+      persistence: sandboxDriverCatalog.daytona.metadata.persistence
     },
     ensureHost,
+    // Provider-state enumeration for `garbageCollect()`.
+    //
+    // Two label sets exist on a sandbox this driver created (`ensureHost`
+    // above): the manager's flat set — `app`, `workspaceId`, `epoch`,
+    // `homeRegion` (built at index.ts `ensureHostInput`) — and the dotted
+    // `claxedo.workspaceId` this driver adds for `findExisting`. Every target
+    // returned here carries `sandbox.labels` **as the provider reports them**,
+    // never labels reconstructed from ensure inputs: GC's ownership check reads
+    // `labels.app` and its identity check reads flat `labels.workspaceId` /
+    // `labels.epoch`, so a synthesized label set would decide the fate of a
+    // sandbox using values that never left this process. (That is the bug in
+    // the `exe` driver's `list()`, which sources labels from a per-process
+    // `Map` — after a restart it reports `labels: undefined` and GC skips
+    // every sandbox as unlabeled. Not fixed here; different owner.)
+    //
+    // The filter is deliberately WIDE: any claxedo ownership marker qualifies.
+    // Narrowing it here would re-create the defect W1 exists to remove — an
+    // orphan the sweep cannot see is an orphan that lives forever — and the
+    // authority on what may be DESTROYED is the manager's `app`-label check,
+    // which skips anything else as `unmanaged_app_label`. Visibility is this
+    // function's job; destruction is not.
+    //
+    // No preview URL is resolved: `getSignedPreviewUrl` is a per-sandbox
+    // round-trip and GC only needs identity, so a sweep over N orphans would
+    // cost N extra API calls to fill a field it then discards.
+    async list() {
+      const client = await resolveClient();
+      if (!client.list) {
+        throw new Error("daytona sandbox client does not support listing");
+      }
+      const targets = [];
+      const seen = /* @__PURE__ */ new Set();
+      for (let page = 1; page <= MAX_LIST_PAGES; page++) {
+        const result = await client.list(void 0, page, LIST_PAGE_SIZE);
+        const items = result?.items ?? [];
+        for (const sandbox of items) {
+          const labels = sandbox.labels;
+          const workspaceId = labels?.workspaceId ?? labels?.["claxedo.workspaceId"];
+          if (!workspaceId || seen.has(sandbox.id)) continue;
+          seen.add(sandbox.id);
+          targets.push({
+            workspaceId,
+            sandboxId: sandbox.id,
+            // Identity, not a reachable address — never routed through.
+            url: sandbox.id,
+            // Must equal what `ensureHost` stored on the lease, or a LIVE
+            // sandbox fails GC's identity check and gets destroyed. Both paths
+            // derive it from `labelName(workspaceId)`.
+            hostId: labelName(workspaceId),
+            driverResourceId: sandbox.id,
+            labels,
+            driver: { id: "daytona", resourceId: sandbox.id }
+          });
+        }
+        if (items.length < LIST_PAGE_SIZE) break;
+      }
+      return targets;
+    },
     async resumeHost(input) {
       const sandbox = await sandboxById(input.lease.sandboxId);
+      if (input.ensure.secrets !== void 0) {
+        const plan = await reconcileBrokeredSecrets(input.ensure, { withdraw: true, mountWithdrawn: true });
+        await applyBrokeredSecrets(sandbox, plan, input.ensure.workspaceId);
+      }
       if (!await ensureStarted(sandbox)) return { provisioning: true, retryAfterMs: 2e3 };
+      if (await applyNetworkPolicy(sandbox, input.ensure) === "retry") {
+        return { provisioning: true, retryAfterMs: 2e3 };
+      }
       return readyTarget(input.ensure, sandbox, input.ensure.hostId ?? labelName(input.ensure.workspaceId));
     },
     async touch(target) {
@@ -216,14 +647,33 @@ function createDaytonaSandboxDriver(options) {
     },
     async destroy(target) {
       await sandboxById(target.sandboxId).then((sandbox) => sandbox.delete(operationTimeout)).catch((err) => {
-        const status = err.response?.status ?? err.status;
-        if (status !== 404) throw err;
+        if (driverErrorSignals(err).status !== 404) throw err;
       });
+      if (!target.workspaceId) {
+        throw new Error(
+          `daytona deleted sandbox ${target.sandboxId} but cannot withdraw its brokered secrets: the destroy target names no workspace`
+        );
+      }
+      const secrets = await brokeredSecretService();
+      for (const secret of (await listWorkspaceSecrets(secrets, target.workspaceId)).values()) {
+        await withdrawSecret(secrets, secret, { delete: true });
+      }
+    },
+    async snapshot(target) {
+      const sandbox = await sandboxById(target.sandboxId);
+      if (!sandbox._experimental_createSnapshot) {
+        throw new Error("Daytona sandbox client does not support filesystem snapshots");
+      }
+      const snapshotId = `claxedo-${target.workspaceId ?? target.sandboxId}-${Date.now()}`;
+      await sandbox._experimental_createSnapshot(snapshotId, operationTimeout);
+      return { snapshotId };
     }
   };
 }
 function network(input) {
   if (!input.net || input.net.mode === "allow-all") return {};
+  const hosts = input.net.hosts ?? [];
+  if (hosts.length > 0) return { domainAllowList: formatDaytonaDomainAllowList(hosts) };
   const cidrs = input.net.cidrs ?? [];
   if (cidrs.length === 0) return { networkBlockAll: true };
   return { networkAllowList: formatDaytonaAllowList(cidrs) };