@claxedo/sandbox-manager 0.6.0 → 0.9.0

package/dist/drivers/vercel.mjs

@@ -1,7 +1,54 @@
-// src/drivers/vercel.ts
-import { Sandbox } from "@vercel/sandbox";
+// src/constants.ts
+var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
+
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+
+// src/index.ts
+function brokeredSecretPlaceholder(name) {
+  return `claxedo-broker:${name}`;
+}
+function brokeredPlaceholderEnv(secrets) {
+  return Object.fromEntries((secrets ?? []).map((secret) => [secret.name, brokeredSecretPlaceholder(secret.name)]));
+}
 
 // src/runtime-env.ts
+function workspaceRuntimeBootEnv(input) {
+  const env = {
+    ...workspaceRuntimeTargetEnv(input),
+    ...workspaceRuntimeSourceEnv(input),
+    ...input.env
+  };
+  if (input.runner) env.WORKSPACE_RUNTIME_RUNNER = input.runner;
+  if (input.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = input.controlEnv.relayJwksUrl;
+  if (input.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = input.controlEnv.relayVerifyPem;
+  if (input.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = input.controlEnv.managementJwksUrl;
+  if (input.controlEnv?.sessionAuthorityUrl) env.WORKSPACE_RUNTIME_SESSION_AUTHORITY_URL = input.controlEnv.sessionAuthorityUrl;
+  return env;
+}
 function workspaceRuntimeTargetEnv(input) {
   return {
     WORKSPACE_RUNTIME_WORKSPACE_ID: input.workspaceId,
@@ -22,16 +69,8 @@ function workspaceRuntimeSourceEnv(input) {
 
 // src/runtime-version.ts
 var DEFAULT_WORKSPACE_RUNTIME_VERSION = "0.5.2";
-var versionCache;
 function workspaceRuntimeVersion() {
-  if (versionCache) return versionCache;
-  const envVersion = process.env.WORKSPACE_RUNTIME_VERSION;
-  if (envVersion) {
-    versionCache = envVersion;
-    return versionCache;
-  }
-  versionCache = DEFAULT_WORKSPACE_RUNTIME_VERSION;
-  return versionCache;
+  return process.env.WORKSPACE_RUNTIME_VERSION || DEFAULT_WORKSPACE_RUNTIME_VERSION;
 }
 
 // src/command.ts
@@ -39,12 +78,225 @@ function shell(input) {
   return `'${input.replace(/'/g, `'"'"'`)}'`;
 }
 
-// src/constants.ts
-var DEFAULT_WORKSPACE_RUNTIME_PORT = 2593;
-
 // src/defaults.ts
 var RUNTIME_DIR = "/opt/workspace-runtime";
 
+// ../sandbox-contract/dist/index.mjs
+var sandboxDriverCredentialFields = {
+  exe: [{ key: "api_token", label: "API Token", secret: true }],
+  daytona: [{ key: "api_key", label: "API Key", secret: true }],
+  modal: [
+    { key: "token_id", label: "Token ID", secret: true },
+    { key: "token_secret", label: "Token Secret", secret: true }
+  ],
+  vercel: [
+    { key: "access_token", label: "Access Token", secret: true },
+    { key: "team_id", label: "Team ID" },
+    { key: "project_id", label: "Project ID" }
+  ],
+  cloudflare: [
+    { key: "api_token", label: "API Token", secret: true },
+    { key: "worker_url", label: "Worker URL" }
+  ],
+  box: [{ key: "api_key", label: "API Key", secret: true }],
+  docker: [{ key: "image", label: "Image" }]
+};
+var sandboxDriverLabels = {
+  exe: "exe.dev",
+  daytona: "Daytona",
+  modal: "Modal",
+  vercel: "Vercel",
+  cloudflare: "Cloudflare",
+  box: "Box",
+  docker: "Docker"
+};
+
+// src/driver-catalog.ts
+var sandboxDriverCatalog = {
+  exe: {
+    id: "exe",
+    label: sandboxDriverLabels.exe,
+    credentialFields: sandboxDriverCredentialFields.exe,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: true,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  daytona: {
+    id: "daytona",
+    label: sandboxDriverLabels.daytona,
+    credentialFields: sandboxDriverCredentialFields.daytona,
+    metadata: {
+      driverRunsIn: ["worker", "node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // The driver translates names to domainAllowList, or addresses to networkAllowList.
+      egressControl: "hosts-and-cidrs",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  modal: {
+    id: "modal",
+    label: sandboxDriverLabels.modal,
+    credentialFields: sandboxDriverCredentialFields.modal,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      // The driver does not install Modal's domain allowlist or alpha sidecar.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  vercel: {
+    id: "vercel",
+    label: sandboxDriverLabels.vercel,
+    credentialFields: sandboxDriverCredentialFields.vercel,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "replacement-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // The driver translates hosts only; the SDK's subnet rules are not wired to net.cidrs.
+      egressControl: "hosts",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "filesystem",
+        clone: false,
+        captureSource: "stopped",
+        retention: "explicit",
+        restoreMount: "new-resource"
+      }
+    }
+  },
+  cloudflare: {
+    id: "cloudflare",
+    label: sandboxDriverLabels.cloudflare,
+    credentialFields: sandboxDriverCredentialFields.cloudflare,
+    metadata: {
+      driverRunsIn: ["worker"],
+      hostStopBehavior: "not-supported",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "native",
+      // Credential handlers do not restrict unrelated destinations.
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "directories",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "copy-on-write"
+      }
+    }
+  },
+  box: {
+    id: "box",
+    label: sandboxDriverLabels.box,
+    credentialFields: sandboxDriverCredentialFields.box,
+    metadata: {
+      driverRunsIn: ["node"],
+      hostStopBehavior: "suspends-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "relay",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "same-sandbox",
+        capture: "none",
+        clone: false,
+        captureSource: "not-applicable",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  },
+  docker: {
+    id: "docker",
+    label: sandboxDriverLabels.docker,
+    credentialFields: sandboxDriverCredentialFields.docker,
+    metadata: {
+      driverRunsIn: ["local"],
+      hostStopBehavior: "terminates-host",
+      hostResumeBehavior: "same-host",
+      targetAccess: "loopback",
+      secretBrokering: "none",
+      egressControl: "none",
+      persistence: {
+        resume: "replacement-restore",
+        capture: "same-resource",
+        clone: false,
+        captureSource: "preserved",
+        retention: "provider-managed",
+        restoreMount: "same-resource"
+      }
+    }
+  }
+};
+
+// ../claxedo-helpers/dist/guards.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRecord(value) {
+  return isRecord(value) ? value : void 0;
+}
+
+// src/json.ts
+function num(input) {
+  return typeof input === "number" ? input : void 0;
+}
+
+// src/drivers/transient-error.ts
+function textOf(input) {
+  return typeof input === "string" ? input : "";
+}
+function driverErrorSignals(err) {
+  const shaped = isRecord(err) ? err : {};
+  const nested = isRecord(shaped.response) ? shaped.response : {};
+  return {
+    status: num(nested.status) ?? num(shaped.status),
+    text: `${textOf(shaped.code)} ${textOf(shaped.name)} ${textOf(shaped.message)}`.toLowerCase()
+  };
+}
+function isTransientDriverError(err, markers) {
+  const { status, text } = driverErrorSignals(err);
+  if (status !== void 0 && status >= 500) return true;
+  return markers.some((marker) => text.includes(marker));
+}
+
 // src/drivers/vercel.ts
 var DEFAULT_RUNTIME = "node22";
 var DEFAULT_RUNTIME_COMMAND = "/usr/local/bin/workspace-runtime";
@@ -53,20 +305,22 @@ var DEFAULT_TIMEOUT_MS = 30 * 60 * 1e3;
 var DEFAULT_SNAPSHOT_BUILD_TIMEOUT_MS = 10 * 60 * 1e3;
 var DEFAULT_OPERATION_TIMEOUT_MS = 6e4;
 var DEFAULT_KEEP_ALIVE_MS = 5 * 60 * 1e3;
-var EXPECTED_RUNTIME_VERSION = workspaceRuntimeVersion();
-var RUNTIME_PKG = `@claxedo/workspace-runtime@${EXPECTED_RUNTIME_VERSION}`;
+function runtimePackage(version) {
+  return `@claxedo/workspace-runtime@${version}`;
+}
 var SNAPSHOT_CACHE_TTL_MS = 60 * 60 * 1e3;
 var snapshotCache = /* @__PURE__ */ new Map();
 var snapshotCacheState = /* @__PURE__ */ new WeakMap();
+function isVercelSandboxFactory(value) {
+  const row = asRecord(value);
+  return typeof row?.create === "function" && typeof row.get === "function";
+}
 function nameFor(workspaceId) {
   return `claxedo-${workspaceId}`;
 }
+var TRANSIENT_MARKERS = ["timeout", "unavailable", "deadline", "pending"];
 function transientDriverError(err) {
-  const shaped = err;
-  const status = shaped.response?.status ?? shaped.status;
-  if (typeof status === "number" && status >= 500) return true;
-  const text = `${shaped.code ?? ""} ${shaped.name ?? ""} ${shaped.message ?? ""}`.toLowerCase();
-  return text.includes("timeout") || text.includes("unavailable") || text.includes("deadline") || text.includes("pending");
+  return isTransientDriverError(err, TRANSIENT_MARKERS);
 }
 function network(input) {
   if (!input.net || input.net.mode === "allow-all") return void 0;
@@ -74,23 +328,53 @@ function network(input) {
   if (hosts.length === 0) return "deny-all";
   return { allow: hosts };
 }
-function vercelBrokeredNetworkPolicy(secrets) {
+function vercelBrokeredNetworkPolicy(secrets, base) {
   const allow = {};
+  for (const [host, rules] of baseAllowEntries(base)) allow[host] = [...rules];
   for (const secret of secrets) {
     if (!secret.header) {
       throw new Error(
         `vercel brokered secret "${secret.name}" requires a header \u2014 the firewall injects the value as an HTTP header on egress`
       );
     }
+    if (secret.hosts.length === 0) {
+      throw new Error(`vercel brokered secret "${secret.name}" requires at least one host in its egress allowlist`);
+    }
+    const value = secret.scheme ? `${secret.scheme} ${secret.value}` : secret.value;
+    const methods = [...secret.methods ?? []];
+    const pathPrefixes = [...secret.pathPrefixes ?? []];
     for (const host of secret.hosts) {
-      ;
-      (allow[host] ??= []).push({ transform: [{ headers: { [secret.header]: secret.value } }] });
+      const rules = allow[host] ??= [];
+      for (const prefix of methods.length ? pathPrefixes : []) {
+        rules.push({
+          match: { path: { startsWith: prefix }, method: methods },
+          transform: [{ headers: { [secret.header]: value } }]
+        });
+      }
     }
   }
-  return { allow };
+  const subnets = typeof base === "object" && base?.subnets ? { subnets: base.subnets } : {};
+  return { allow, ...subnets };
+}
+function baseAllowEntries(base) {
+  if (base === void 0 || base === "allow-all") return [["*", []]];
+  if (base === "deny-all") return [];
+  if (Array.isArray(base.allow)) return base.allow.map((host) => [host, []]);
+  return Object.entries(base.allow ?? {});
 }
 function createVercelSandboxDriver(options) {
-  const sandboxFactory = options.sandbox ?? Sandbox;
+  let defaultFactory;
+  function resolveFactory() {
+    if (options.sandbox) return options.sandbox;
+    defaultFactory ??= import("@vercel/sandbox").then((sdk) => {
+      const factory = sdk.Sandbox;
+      if (!isVercelSandboxFactory(factory)) {
+        throw new Error("@vercel/sandbox does not expose the factory surface this driver uses");
+      }
+      return factory;
+    });
+    return defaultFactory;
+  }
   const runtime = options.runtime ?? DEFAULT_RUNTIME;
   const runtimePort = options.runtimePort ?? DEFAULT_WORKSPACE_RUNTIME_PORT;
   const runtimeCommand = options.runtimeCommand ?? DEFAULT_RUNTIME_COMMAND;
@@ -117,22 +401,17 @@ function createVercelSandboxDriver(options) {
     };
   }
   function bootEnv(input, hostId) {
-    const env = {
-      ...workspaceRuntimeTargetEnv({
-        workspaceId: input.workspaceId,
-        hostId,
-        directory: workspaceDirectory(input),
-        port: runtimePort,
-        host: "0.0.0.0"
-      }),
-      ...workspaceRuntimeSourceEnv({ source: input.source }),
-      ...input.env
-    };
-    if (options.runner) env.WORKSPACE_RUNTIME_RUNNER = options.runner;
-    if (options.controlEnv?.relayJwksUrl) env.WORKSPACE_RUNTIME_RELAY_JWKS_URL = options.controlEnv.relayJwksUrl;
-    if (options.controlEnv?.relayVerifyPem) env.WORKSPACE_RUNTIME_RELAY_HOST_VERIFY_PEM = options.controlEnv.relayVerifyPem;
-    if (options.controlEnv?.managementJwksUrl) env.WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL = options.controlEnv.managementJwksUrl;
-    return env;
+    return workspaceRuntimeBootEnv({
+      workspaceId: input.workspaceId,
+      hostId,
+      directory: workspaceDirectory(input),
+      port: runtimePort,
+      host: "0.0.0.0",
+      source: input.source,
+      env: input.env,
+      runner: options.runner,
+      controlEnv: options.controlEnv
+    });
   }
   async function runSetup(sandbox, command) {
     await sandbox.runCommand("bash", ["-c", command], {
@@ -141,7 +420,8 @@ function createVercelSandboxDriver(options) {
   }
   async function ensureSnapshot() {
     if (options.baseSnapshotId) return options.baseSnapshotId;
-    const cacheKey = `${options.teamId}:${options.projectId}:${runtime}:${EXPECTED_RUNTIME_VERSION}`;
+    const expectedRuntimeVersion = workspaceRuntimeVersion();
+    const cacheKey = `${options.teamId}:${options.projectId}:${runtime}:${expectedRuntimeVersion}`;
     const hit = cache.get(cacheKey);
     const expiresAt = cacheState.expires.get(cacheKey);
     if (hit && expiresAt === void 0) {
@@ -152,7 +432,7 @@ function createVercelSandboxDriver(options) {
     const running = cacheState.builds.get(cacheKey);
     if (running) return running;
     const build = (async () => {
-      const builder = await sandboxFactory.create({
+      const builder = await (await resolveFactory()).create({
         ...credentials(),
         runtime,
         ports: [runtimePort],
@@ -183,17 +463,11 @@ function createVercelSandboxDriver(options) {
         `sudo chown $(whoami) ${shell(RUNTIME_DIR)}`,
         `cd ${shell(RUNTIME_DIR)}`,
         "npm init -y",
-        `npm install ${RUNTIME_PKG} --min-release-age=2`,
-        `node -e "const fs=require('fs');const actual=JSON.parse(fs.readFileSync('${RUNTIME_DIR}/node_modules/@claxedo/workspace-runtime/package.json','utf8')).version;if(actual!=='${EXPECTED_RUNTIME_VERSION}'){throw new Error('workspace-runtime snapshot package version mismatch: expected ${EXPECTED_RUNTIME_VERSION}, got '+actual)}"`,
+        `npm install ${runtimePackage(expectedRuntimeVersion)} --min-release-age=2`,
+        `node -e "const fs=require('fs');const actual=JSON.parse(fs.readFileSync('${RUNTIME_DIR}/node_modules/@claxedo/workspace-runtime/package.json','utf8')).version;if(actual!=='${expectedRuntimeVersion}'){throw new Error('workspace-runtime snapshot package version mismatch: expected ${expectedRuntimeVersion}, got '+actual)}"`,
         "test -x node_modules/.bin/workspace-runtime",
-        "test -x node_modules/.bin/claude-agent-acp",
-        "test -x node_modules/.bin/codex-acp",
         `sudo ln -sf ${RUNTIME_DIR}/node_modules/.bin/workspace-runtime /usr/local/bin/workspace-runtime`,
-        `sudo ln -sf ${RUNTIME_DIR}/node_modules/.bin/claude-agent-acp /usr/local/bin/claude-agent-acp`,
-        `sudo ln -sf ${RUNTIME_DIR}/node_modules/.bin/codex-acp /usr/local/bin/codex-acp`,
-        "command -v workspace-runtime",
-        "command -v claude-agent-acp",
-        "command -v codex-acp"
+        "command -v workspace-runtime"
       ].join(" && "));
       const snapshot = await builder.snapshot({
         expiration: 0,
@@ -247,22 +521,26 @@ function createVercelSandboxDriver(options) {
     const hostId = input.hostId ?? nameFor(input.workspaceId);
     const env = {
       ...bootEnv(input, hostId),
-      ...await options.env?.(input, { id: hostId })
+      ...await options.env?.(input, { id: hostId }),
+      // Last, so no caller-supplied variable of the same name can stand in for
+      // a placeholder the firewall transform overwrites.
+      ...brokeredPlaceholderEnv(input.secrets)
     };
-    const sandbox = await sandboxFactory.create({
+    const createPolicy = network(input);
+    const sandbox = await (await resolveFactory()).create({
       ...credentials(),
       source: await source(input),
       ports: [runtimePort],
       timeout: timeoutMs,
       env,
-      ...network(input) ? { networkPolicy: network(input) } : {}
+      ...createPolicy ? { networkPolicy: createPolicy } : {}
     }).catch((err) => {
       if (transientDriverError(err)) return void 0;
       throw err;
     });
     if (!sandbox) return { provisioning: true, retryAfterMs: 2e3 };
     if (input.secrets?.length) {
-      await sandbox.updateNetworkPolicy(vercelBrokeredNetworkPolicy(input.secrets), {
+      await sandbox.updateNetworkPolicy(vercelBrokeredNetworkPolicy(input.secrets, createPolicy), {
         signal: AbortSignal.timeout(operationTimeoutMs)
       });
     }
@@ -270,7 +548,7 @@ function createVercelSandboxDriver(options) {
     return readyTarget(input, sandbox, hostId);
   }
   async function sandboxById(target) {
-    return sandboxFactory.get({
+    return (await resolveFactory()).get({
       ...credentials(),
       sandboxId: target.sandboxId
     });
@@ -282,7 +560,9 @@ function createVercelSandboxDriver(options) {
       hostStopBehavior: "terminates-host",
       hostResumeBehavior: "replacement-host",
       targetAccess: "relay",
-      secretBrokering: "native"
+      secretBrokering: "native",
+      egressControl: "hosts",
+      persistence: sandboxDriverCatalog.vercel.metadata.persistence
     },
     ensureHost,
     resumeHost: (input) => ensureHost(input.ensure),

package/dist/hosted-network-policy.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The egress allowlist a HOSTED, multi-tenant sandbox is provisioned with.
+ *
+ * A hosted sandbox runs agent-authored code on the operator's infrastructure,
+ * next to other tenants' sandboxes, holding a checkout of the user's private
+ * repository and (via `SandboxBrokeredSecret`) the ability to spend the
+ * operator's model credits. The default for that shape of workload is
+ * restrictive, not allow-all: the interesting attack is not "the agent
+ * downloads a package", it is "the agent POSTs the repository to a host the
+ * attacker controls". An allowlist is what makes that fail.
+ *
+ * Every entry below has to earn its place, so the list is assembled from three
+ * sources of truth rather than from taste:
+ *
+ *   1. DERIVED PER REQUEST — the control plane the sandbox reports back to and
+ *      the git host it clones from. These differ per deployment and per
+ *      workspace, so they are inputs, not constants.
+ *   2. MODEL PROVIDERS — the endpoints an agent harness must reach to do any
+ *      work at all. Taken from the harness→provider mapping the credential
+ *      layer already maintains (`PROVIDER_TO_GROUP` /`DEFAULT_ALLOWLIST` in
+ *      claxedo-server's `network/types.ts`), narrowed to the API hostnames.
+ *   3. PACKAGE REGISTRIES — an agent that cannot install a dependency cannot
+ *      edit a real repository. Same source, again narrowed.
+ *
+ * What is deliberately NOT here, despite being in that same default list:
+ * general-purpose object storage and CDN wildcards (`*.workers.dev`,
+ * `r2.cloudflarestorage.com`, `storage.googleapis.com`,
+ * `*.blob.core.windows.net`, `*.amazonaws.com`). Every one of those is a
+ * bucket an attacker can create in their own account, so allowlisting them
+ * hands back exactly the exfiltration channel the policy exists to close. A
+ * deployment that genuinely needs one adds it through `extraHosts` as an
+ * explicit, auditable decision.
+ *
+ * This module is data + string handling only, so it runs unchanged inside the
+ * hosted Worker (no DNS, no node builtins). That matters: name-based policy is
+ * the only kind the Worker can compute, which is why `egressControl` treats
+ * name filtering as the capability that qualifies a driver for hosted use.
+ */
+import type { SandboxNetworkPolicy, SandboxSource } from ".";
+/**
+ * Model-provider endpoints. Derived from the harness→provider groups in
+ * claxedo-server `network/types.ts` (`PROVIDER_TO_GROUP`): claude-sdk →
+ * anthropic, codex-app-server/cursor-sdk → openai,
+ * google → google_ai; plus the aggregator and catalog endpoints the engine
+ * itself fetches at startup.
+ */
+export declare const SANDBOX_MODEL_PROVIDER_HOSTS: readonly ["api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com", "openrouter.ai", "models.dev", "opencode.ai"];
+/**
+ * Package registries. Narrowed from the npm / pypi / rust / golang groups of
+ * `DEFAULT_ALLOWLIST` to the hostnames a package install actually contacts —
+ * the wildcard CDN entries in those groups are excluded on purpose (see the
+ * module comment).
+ */
+export declare const SANDBOX_PACKAGE_REGISTRY_HOSTS: readonly ["registry.npmjs.org", "nodejs.org", "pypi.org", "files.pythonhosted.org", "crates.io", "static.crates.io", "index.crates.io", "proxy.golang.org", "sum.golang.org"];
+/** The deployment-independent floor: providers + registries. */
+export declare const SANDBOX_BASELINE_EGRESS_HOSTS: readonly ["api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com", "openrouter.ai", "models.dev", "opencode.ai", "registry.npmjs.org", "nodejs.org", "pypi.org", "files.pythonhosted.org", "crates.io", "static.crates.io", "index.crates.io", "proxy.golang.org", "sum.golang.org"];
+/**
+ * The git host this workspace clones from.
+ *
+ * Scoped to the ONE repository host in the request rather than to a forge
+ * allowlist, matching how `authenticatedGitHubCloneSource` scopes the clone
+ * credential it brokers (`hosts: ["github.com"]`) — the credential and the
+ * network policy should describe the same reachable surface.
+ */
+export declare function sandboxSourceHost(source: SandboxSource | undefined): string | undefined;
+export type HostedSandboxNetworkPolicyInput = {
+    /**
+     * Control-plane and relay endpoints the runtime reports back to: the relay
+     * it tunnels through and fetches `WORKSPACE_RUNTIME_RELAY_JWKS_URL` from,
+     * and the control-plane origin serving `WORKSPACE_RUNTIME_MANAGEMENT_JWKS_URL`
+     * plus register/heartbeat. URLs or bare hostnames; blanks are ignored.
+     */
+    controlPlane: Array<string | undefined>;
+    /** Workspace source — its git host is allowed, nothing else on that forge. */
+    source?: SandboxSource;
+    /** Operator escape hatch for deployment-specific hosts. */
+    extraHosts?: readonly string[];
+};
+/**
+ * Build the restricted policy for a hosted sandbox.
+ *
+ * Always `mode: "restricted"`. There is no input that makes this return
+ * allow-all — a hosted sandbox with an empty or unresolvable control-plane URL
+ * is a misconfiguration, and answering it with "then allow everything" is how
+ * the gap this closes came to exist in the first place.
+ */
+export declare function hostedSandboxNetworkPolicy(input: HostedSandboxNetworkPolicyInput): SandboxNetworkPolicy;

package/dist/hosted-network-policy.mjs

@@ -0,0 +1,61 @@
+// src/hosted-network-policy.ts
+var SANDBOX_MODEL_PROVIDER_HOSTS = [
+  "api.anthropic.com",
+  "api.openai.com",
+  "generativelanguage.googleapis.com",
+  "openrouter.ai",
+  // Model catalog + engine config, fetched on runner startup.
+  "models.dev",
+  "opencode.ai"
+];
+var SANDBOX_PACKAGE_REGISTRY_HOSTS = [
+  "registry.npmjs.org",
+  "nodejs.org",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org"
+];
+var SANDBOX_BASELINE_EGRESS_HOSTS = [
+  ...SANDBOX_MODEL_PROVIDER_HOSTS,
+  ...SANDBOX_PACKAGE_REGISTRY_HOSTS
+];
+function hostOf(value) {
+  const raw = value?.trim();
+  if (!raw) return void 0;
+  try {
+    const host = new URL(raw).hostname.trim().toLowerCase();
+    return host ? host : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sandboxSourceHost(source) {
+  if (!source || source.kind !== "git") return void 0;
+  return hostOf(source.repoUrl);
+}
+function hostedSandboxNetworkPolicy(input) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (const entry of input.controlPlane) {
+    const host = hostOf(entry) ?? entry?.trim().toLowerCase();
+    if (host) hosts.add(host);
+  }
+  const sourceHost = sandboxSourceHost(input.source);
+  if (sourceHost) hosts.add(sourceHost);
+  for (const host of SANDBOX_BASELINE_EGRESS_HOSTS) hosts.add(host);
+  for (const host of input.extraHosts ?? []) {
+    const trimmed = host.trim().toLowerCase();
+    if (trimmed) hosts.add(trimmed);
+  }
+  return { mode: "restricted", hosts: [...hosts] };
+}
+export {
+  SANDBOX_BASELINE_EGRESS_HOSTS,
+  SANDBOX_MODEL_PROVIDER_HOSTS,
+  SANDBOX_PACKAGE_REGISTRY_HOSTS,
+  hostedSandboxNetworkPolicy,
+  sandboxSourceHost
+};