@erichll/pi-sandbox 0.15.3 → 0.17.0

package/src/index.ts

@@ -3,7 +3,6 @@ import type {
   ExtensionAPI,
   ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
-import { fileURLToPath } from "node:url";
 import {
   createBashToolDefinition,
   createLocalBashOperations,
@@ -35,14 +34,12 @@ import type {
 import { validateSubagentModel } from "./subagent.ts";
 import { Type } from "typebox";
 import {
-  createExternalWorkerSupervisor,
-  type ExternalWorkerSupervisor,
-} from "./external-supervisor.ts";
-import {
-  createExternalRunsView,
-  externalRunsViewEnabledWhen,
-  type ExternalRunsView,
-} from "./external-runs-view.ts";
+  loadPiSubagentsNativeRuntime,
+  nativeSubagentCallBlockReason,
+  PI_SANDBOX_ACKNOWLEDGEMENT,
+  terminalChildrenHaveSandboxAcknowledgement,
+  type CapabilityCeilingHandle,
+} from "./pi-subagents-native.ts";
 
 const EXTENSION_NAME = "pi-sandbox";
 const registrations = new WeakMap<ExtensionAPI, Promise<void>>();
@@ -54,12 +51,19 @@ export type PiSandboxExtensionOptions = {
   sandbox?: Pick<SandboxCommandOptions, "broker" | "platform">;
   /** Test/embedding override. Normal extension loading uses trusted global config. */
   hostIPC?: HostIPCConfig;
+  /** Test/embedding override. Normal extension loading uses trusted global config. */
+  allowedNativeAgents?: readonly string[];
 };
 
 function sessionId(ctx: ExtensionContext): string {
   return ctx.sessionManager.getSessionId();
 }
 
+function piSubagentsSessionId(ctx: ExtensionContext): string {
+  const getSessionFile = (ctx.sessionManager as { getSessionFile?: () => string | null | undefined }).getSessionFile;
+  return getSessionFile?.call(ctx.sessionManager) ?? ctx.sessionManager.getSessionId();
+}
+
 function isPiSubagentsSource(
   sourceInfo: ReturnType<ExtensionAPI["getAllTools"]>[number]["sourceInfo"],
 ): boolean {
@@ -91,55 +95,11 @@ function externalSubagentDiagnostic(pi: ExtensionAPI): {
   }
   return {
     message:
-      "pi-subagents orchestration active; pi-sandbox protects Bash execution. External workers are not yet wrapped in an outer Sandbox Runtime sandbox.",
+      "pi-subagents protected native-background mode active; child writes are restricted to sandboxed Bash. This is a tool boundary, not outer worker process isolation.",
     level: "info",
   };
 }
 
-const EXTERNAL_WORKER_LAUNCHER = fileURLToPath(
-  new URL("./external-worker-launcher.mjs", import.meta.url),
-);
-
-type ExternalWorkerIsolation = {
-  restore(): void;
-};
-
-function enableExternalWorkerIsolation(
-  supervisor: ExternalWorkerSupervisor,
-): ExternalWorkerIsolation {
-  if (process.platform !== "linux" && process.platform !== "darwin") {
-    throw new Error(`external worker isolation is unavailable on ${process.platform}`);
-  }
-  if (process.env.PI_SUBAGENT_PI_BINARY) {
-    throw new Error(
-      "external worker isolation refuses to replace an existing PI_SUBAGENT_PI_BINARY wrapper",
-    );
-  }
-  const entry = process.argv[1];
-  if (!entry) {
-    throw new Error("external worker isolation cannot determine the real Pi CLI entrypoint");
-  }
-  const injected = {
-    PI_SUBAGENT_PI_BINARY: EXTERNAL_WORKER_LAUNCHER,
-    PI_SANDBOX_EXTERNAL_REAL_PI_BINARY: process.execPath,
-    PI_SANDBOX_EXTERNAL_REAL_PI_PREFIX: JSON.stringify([entry]),
-    PI_SANDBOX_EXTERNAL_ALLOW_READ: [
-      process.cwd(),
-      process.env.PI_CODING_AGENT_DIR,
-    ].filter((value): value is string => Boolean(value)).join(":"),
-    PI_SANDBOX_EXTERNAL_SUPERVISOR_SOCKET: supervisor.socketPath,
-    PI_SANDBOX_EXTERNAL_SUPERVISOR_CAPABILITY: supervisor.capability,
-  };
-  Object.assign(process.env, injected);
-  return {
-    restore() {
-      for (const [key, value] of Object.entries(injected)) {
-        if (process.env[key] === value) delete process.env[key];
-      }
-    },
-  };
-}
-
 function humanApproval(ctx: ExtensionContext): HumanApproval {
   return async (request, reason, signal) => {
     if (!ctx.hasUI) return "deny";
@@ -261,11 +221,19 @@ async function performRegistration(
   const config = loadPiSandboxConfig();
   const subagentProvider =
     options.subagentProvider ?? config.subagents.provider;
-  const externalWorkerIsolation = config.subagents.externalWorkerIsolation;
-  const externalRunsViewEnabled = externalRunsViewEnabledWhen(
-    subagentProvider,
-    externalWorkerIsolation,
-  );
+  const isNativeSubagentChild = process.env.PI_SUBAGENT_CHILD === "1";
+  const protectExternalOrchestration =
+    subagentProvider === "pi-subagents" && !isNativeSubagentChild;
+  const allowedNativeAgents = options.allowedNativeAgents ??
+    config.subagents.allowedNativeAgents;
+  if (protectExternalOrchestration && !allowedNativeAgents?.length) {
+    throw new Error(
+      `${EXTENSION_NAME}: pi-subagents protected mode requires allowedNativeAgents`,
+    );
+  }
+  const nativeRuntime = protectExternalOrchestration
+    ? await loadPiSubagentsNativeRuntime(allowedNativeAgents!)
+    : undefined;
   const additionalAllowRead = config.filesystem.additionalAllowRead;
   const network = config.network;
   const hostIPC = options.hostIPC ?? config.hostIPC;
@@ -279,10 +247,8 @@ async function performRegistration(
         }))
       : undefined;
   const cwd = process.cwd();
-  let isolation: ExternalWorkerIsolation | undefined;
-  let supervisor: ExternalWorkerSupervisor | undefined;
-  let fleetView: ExternalRunsView | undefined;
-  let externalIsolationFailure: string | undefined;
+  let capabilityCeiling: CapabilityCeilingHandle | undefined;
+  let validatedNativeAgents: string[] = [];
   const localBash = createBashToolDefinition(cwd);
 
   pi.registerTool({
@@ -560,93 +526,91 @@ async function performRegistration(
     currentTurn = event.turnIndex;
   });
 
-  // pi-subagents owns the public tool, so a failed wrapper bootstrap cannot
-  // be fixed by replacing that tool. Block at Pi's pre-execution boundary:
-  // enforce must never degrade into a host worker launch.
-  pi.on("tool_call", (event) => {
+  pi.on("tool_call", (event, ctx) => {
+    if (event.toolName === "subagent" && protectExternalOrchestration) {
+      const reason = nativeSubagentCallBlockReason(event.input);
+      if (reason) {
+        return { block: true, reason: `${EXTENSION_NAME}: ${reason}` };
+      }
+      if (event.input.action === undefined) {
+        try {
+          validatedNativeAgents = nativeRuntime!.validateAllowedAgents(
+            ctx.cwd,
+            ctx.model?.provider,
+          );
+          capabilityCeiling?.dispose();
+          capabilityCeiling = nativeRuntime!.registerCeiling(
+            piSubagentsSessionId(ctx),
+            validatedNativeAgents,
+          );
+        } catch (error) {
+          return {
+            block: true,
+            reason: `${EXTENSION_NAME}: protected launch validation failed: ${error instanceof Error ? error.message : String(error)}`,
+          };
+        }
+      }
+    }
+    return undefined;
+  });
+
+  pi.on("tool_result", (event) => {
     if (
+      protectExternalOrchestration &&
       event.toolName === "subagent" &&
-      subagentProvider === "pi-subagents" &&
-      externalWorkerIsolation === "enforce" &&
-      !isolation
+      (event.input.action === "status" || event.input.action === "debug.run") &&
+      !event.isError &&
+      !terminalChildrenHaveSandboxAcknowledgement(event.details)
     ) {
       return {
-        block: true,
-        reason: `${EXTENSION_NAME}: external worker isolation is unavailable; refusing host worker launch${externalIsolationFailure ? `: ${externalIsolationFailure}` : ""}`,
+        content: [{
+          type: "text",
+          text: `${EXTENSION_NAME}: child result did not acknowledge ${PI_SANDBOX_ACKNOWLEDGEMENT}; protected execution proof is missing`,
+        }],
+        isError: true,
       };
     }
     return undefined;
   });
 
   pi.on("session_start", async (_event, ctx) => {
-    // A new session may replace a prior supervisor ownership; drop the old
-    // session's FleetView registrations before reconstructing.
-    fleetView?.close();
-    fleetView = undefined;
-    if (
-      subagentProvider === "pi-subagents" &&
-      externalWorkerIsolation === "enforce"
-    ) {
-      try {
-        isolation?.restore();
-        await supervisor?.close();
-        supervisor = undefined;
-        if (externalRunsViewEnabled) {
-          fleetView = await createExternalRunsView(sessionId(ctx));
-        }
-        supervisor = await createExternalWorkerSupervisor(
-          (worker) => ({
-            broker: getBoundaryBroker(),
-            command: "external pi-subagents worker network request",
-            cwd: worker.cwd,
-            sessionId: sessionId(ctx),
-            scopeKey: `${sessionId(ctx)}:turn:${currentTurn}`,
-            agentName: `pi-subagents-worker:${worker.id}`,
-            humanApproval: humanApproval(ctx),
-          }),
-          {
-            // Observability-only: never influences allow/deny, and a failure
-            // here must not stop the supervisor from answering approval RPCs
-            // or make the worker launch on the host.
-            registered: (worker) => fleetView?.registered(worker),
-            unregistered: (worker) => fleetView?.unregistered(worker.id),
-          },
-          network,
-        );
-        isolation = enableExternalWorkerIsolation(supervisor);
-        externalIsolationFailure = undefined;
-      } catch (error) {
-        const message = `${EXTENSION_NAME}: external worker isolation unavailable; child launches will fail closed: ${error instanceof Error ? error.message : String(error)}`;
-        externalIsolationFailure = message;
-        isolation?.restore();
-        isolation = undefined;
-        await supervisor?.close();
-        supervisor = undefined;
-        fleetView?.close();
-        fleetView = undefined;
-        console.error(message);
-        if (ctx.hasUI) ctx.ui.notify(message, "warning");
+    if (isNativeSubagentChild) {
+      pi.events?.emit("subagent:acknowledge-extension", {
+        id: PI_SANDBOX_ACKNOWLEDGEMENT,
+      });
+    }
+    capabilityCeiling?.dispose();
+    capabilityCeiling = undefined;
+    if (protectExternalOrchestration) {
+      validatedNativeAgents = nativeRuntime!.validateAllowedAgents(
+        ctx.cwd,
+        ctx.model?.provider,
+      );
+      capabilityCeiling = nativeRuntime!.registerCeiling(
+        piSubagentsSessionId(ctx),
+        validatedNativeAgents,
+      );
+      const ownership = externalSubagentDiagnostic(pi);
+      if (ownership.level === "warning") {
+        capabilityCeiling.dispose();
+        capabilityCeiling = undefined;
+        throw new Error(`${EXTENSION_NAME}: ${ownership.message}`);
       }
     }
     if (ctx.hasUI) {
-      if (subagentProvider === "pi-subagents") {
+      if (protectExternalOrchestration) {
         const diagnostic = externalSubagentDiagnostic(pi);
-        ctx.ui.notify(
-          externalWorkerIsolation === "enforce" && isolation
-            ? "pi-subagents orchestration active; external worker process trees require outer Sandbox Runtime isolation."
-            : diagnostic.message,
-          externalWorkerIsolation === "enforce" && isolation
-            ? "info"
-            : diagnostic.level,
-        );
-      } else if (subagentProvider === "builtin") {
+        ctx.ui.notify(diagnostic.message, diagnostic.level);
+      } else if (subagentProvider === "builtin" && !isNativeSubagentChild) {
         ctx.ui.notify(
           "pi-sandbox subagent provider: builtin; worker process trees use the outer Sandbox Runtime sandbox",
           "info",
         );
       } else {
         ctx.ui.notify(
-          "pi-sandbox subagent provider: off; pi-sandbox protects Bash execution only",
+          isNativeSubagentChild
+            ? "pi-sandbox active in native subagent child; writes are restricted to sandboxed Bash"
+            : "pi-sandbox subagent provider: off; pi-sandbox protects Bash execution only",
           "info",
         );
       }
@@ -671,12 +635,8 @@ async function performRegistration(
   });
 
   pi.on("session_shutdown", async () => {
-    isolation?.restore();
-    isolation = undefined;
-    fleetView?.close();
-    fleetView = undefined;
-    await supervisor?.close();
-    supervisor = undefined;
+    capabilityCeiling?.dispose();
+    capabilityCeiling = undefined;
     await subagents?.shutdown();
   });
 }

package/src/pi-subagents-native.ts

@@ -0,0 +1,266 @@
+import { readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createJiti } from "jiti";
+
+/**
+ * Compatible pi-subagents line: 0.65.x. Patch updates (e.g. 0.65.1) are accepted;
+ * any minor or major bump fails closed until this adapter is revalidated against
+ * the new internal layout. The exports/ceiling checks below are the real
+ * compatibility gate; this range only guards against blind accept-on-drift.
+ */
+export const PI_SUBAGENTS_COMPAT_RANGE = ">=0.65.0 <0.66.0";
+export const NATIVE_CHILD_TOOLS = ["bash", "read", "grep", "find", "ls"] as const;
+export const PI_SANDBOX_ACKNOWLEDGEMENT = "@erichll:pi-sandbox";
+
+type Agent = {
+  name: string;
+  localName?: string;
+  runner?: { type?: unknown };
+  disabled?: boolean;
+  extensions?: string[];
+  extensionsFromDefault?: boolean;
+  allowNestedSubagents?: boolean;
+};
+
+type DiscoveryModule = {
+  discoverAgents(cwd: string, scope: "both", preferredProvider?: string): {
+    agents: Agent[];
+  };
+  resolveAgentName(name: string, agents: Agent[]): {
+    agent?: Agent;
+    error?: string;
+  };
+};
+
+type ConfigModule = {
+  loadConfig(): { scheduledRuns?: { enabled?: boolean } };
+};
+
+export type CapabilityCeilingHandle = { dispose(): void };
+type CeilingModule = {
+  SUBAGENT_CAPABILITY_CEILING_VERSION: unknown;
+  registerSubagentCapabilityCeiling(options: {
+    sessionId: string;
+    source: string;
+    ceiling: {
+      allowedAgents: readonly string[];
+      allowedTools: readonly string[];
+    };
+  }): CapabilityCeilingHandle;
+};
+
+export type PiSubagentsNativeRuntime = {
+  validateAllowedAgents(
+    cwd: string,
+    preferredProvider?: string,
+  ): string[];
+  registerCeiling(sessionId: string, allowedAgents: readonly string[]): CapabilityCeilingHandle;
+};
+
+function requiredFunction(
+  value: unknown,
+  name: string,
+): asserts value is (...args: never[]) => unknown {
+  if (typeof value !== "function") {
+    throw new Error(`pi-subagents 0.65.x compatibility failure: missing ${name}`);
+  }
+}
+
+/**
+ * Accept only versions inside PI_SUBAGENTS_COMPAT_RANGE (0.65.x, including
+ * prerelease suffixes like 0.65.2-beta.1) without pulling in a semver runtime.
+ */
+export function isCompatiblePiSubagentsVersion(version: unknown): boolean {
+  if (typeof version !== "string") return false;
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(version);
+  if (!match) return false;
+  return Number(match[1] ?? "") === 0 && Number(match[2] ?? "") === 65;
+}
+
+/** Load the public ceiling API and the 0.65.x discovery/config internals.
+ * This intentionally fails closed on package version, export, or layout drift.
+ */
+export async function loadPiSubagentsNativeRuntime(
+  configuredAgents: readonly string[],
+): Promise<PiSubagentsNativeRuntime> {
+  const entry = fileURLToPath(import.meta.resolve("pi-subagents"));
+  const root = dirname(entry);
+  const packageJson = JSON.parse(
+    await readFile(join(root, "package.json"), "utf8"),
+  ) as { version?: unknown; exports?: Record<string, unknown> };
+  if (!isCompatiblePiSubagentsVersion(packageJson.version)) {
+    throw new Error(
+      `pi-subagents protected mode requires ${PI_SUBAGENTS_COMPAT_RANGE}; found ${String(packageJson.version)}`,
+    );
+  }
+  if (packageJson.exports?.["./capability-ceiling"] !== "./src/api/capability-ceiling.ts") {
+    throw new Error(
+      "pi-subagents 0.65.x compatibility failure: capability-ceiling export changed",
+    );
+  }
+
+  const jiti = createJiti(import.meta.url, {
+    interopDefault: false,
+    fsCache: false,
+  });
+  const [ceiling, discovery, config] = await Promise.all([
+    jiti.import(pathToFileURL(join(root, "src/api/capability-ceiling.ts")).href) as Promise<CeilingModule>,
+    jiti.import(pathToFileURL(join(root, "src/agents/agents.ts")).href) as Promise<DiscoveryModule>,
+    jiti.import(pathToFileURL(join(root, "src/extension/config.ts")).href) as Promise<ConfigModule>,
+  ]).catch((error) => {
+    throw new Error(
+      `pi-subagents 0.65.x compatibility failure: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  });
+  if (ceiling.SUBAGENT_CAPABILITY_CEILING_VERSION !== 1) {
+    throw new Error("pi-subagents 0.65.x compatibility failure: unsupported capability ceiling version");
+  }
+  requiredFunction(ceiling.registerSubagentCapabilityCeiling, "registerSubagentCapabilityCeiling");
+  requiredFunction(discovery.discoverAgents, "discoverAgents");
+  requiredFunction(discovery.resolveAgentName, "resolveAgentName");
+  requiredFunction(config.loadConfig, "loadConfig");
+
+  const validateAllowedAgents = (
+    cwd: string,
+    preferredProvider?: string,
+  ): string[] => {
+    const upstreamConfig = config.loadConfig();
+    if (upstreamConfig.scheduledRuns?.enabled !== false) {
+      throw new Error(
+        "pi-subagents protected mode requires scheduledRuns.enabled=false in the pi-subagents config",
+      );
+    }
+    const discovered = discovery.discoverAgents(cwd, "both", preferredProvider);
+    const canonical: string[] = [];
+    for (const requested of configuredAgents) {
+      const resolved = discovery.resolveAgentName(requested, discovered.agents);
+      if (resolved.error) throw new Error(resolved.error);
+      if (!resolved.agent) {
+        throw new Error(`pi-subagents protected mode cannot resolve allowed agent '${requested}'`);
+      }
+      const agent = resolved.agent;
+      if (agent.name !== requested) {
+        throw new Error(
+          `pi-subagents protected mode requires canonical agent names; '${requested}' resolves to '${agent.name}'`,
+        );
+      }
+      if (agent.disabled === true) {
+        throw new Error(`pi-subagents protected mode rejects disabled agent '${requested}'`);
+      }
+      if (agent.runner !== undefined && agent.runner.type !== "pi") {
+        throw new Error(
+          `pi-subagents protected mode rejects runner '${String(agent.runner.type)}' for agent '${requested}'`,
+        );
+      }
+      if (agent.extensions !== undefined && agent.extensionsFromDefault !== true) {
+        throw new Error(
+          `pi-subagents protected mode requires ambient extensions for agent '${requested}'; remove its explicit extensions override`,
+        );
+      }
+      if (agent.allowNestedSubagents === true) {
+        throw new Error(
+          `pi-subagents protected mode rejects allowNestedSubagents for agent '${requested}'`,
+        );
+      }
+      canonical.push(agent.name);
+    }
+    return canonical;
+  };
+
+  // Validate once while constructing the adapter as an internal-structure gate.
+  if (configuredAgents.length === 0) {
+    throw new Error("pi-subagents protected mode requires at least one allowed agent");
+  }
+  return {
+    validateAllowedAgents,
+    registerCeiling(sessionId, allowedAgents) {
+      return ceiling.registerSubagentCapabilityCeiling({
+        sessionId,
+        source: PI_SANDBOX_ACKNOWLEDGEMENT,
+        ceiling: { allowedAgents, allowedTools: NATIVE_CHILD_TOOLS },
+      });
+    },
+  };
+}
+
+export function nativeSubagentCallBlockReason(
+  input: Record<string, unknown>,
+): string | undefined {
+  const action = typeof input.action === "string" ? input.action.trim() : undefined;
+  if (action?.startsWith("schedule.")) {
+    return "scheduled subagent operations are disabled in protected mode";
+  }
+  const forbiddenActions = new Set([
+    "create", "update", "delete", "eject", "enable", "disable", "reset",
+    "refine", "refine.rollback", "watchdog.configure", "grant-spawn-budget",
+    "mission.create", "mission.update", "mission.resolve-decision",
+    "mission.attach-run", "mission.close", "inspector.open", "inspector.close",
+    "project.open", "project.close", "worktree.discard", "worktree.cleanup",
+    "lane.recordMerge", "lane.recordSupersession",
+  ]);
+  if (action && forbiddenActions.has(action)) {
+    return `subagent management action '${action}' is disabled in protected mode`;
+  }
+  if (action === "resume") {
+    return "subagent resume may launch a child and is disabled in protected mode";
+  }
+  if (action !== undefined) return undefined;
+  if (input.workflow !== undefined) {
+    return "extension-owned named workflows are disabled in protected mode";
+  }
+  const isDirect = typeof input.agent === "string" && input.agent.trim() !== "";
+  if (input.workflowScript !== undefined || input.workflowScriptPath !== undefined) {
+    return "workflowScript and workflowScriptPath are disabled because pi-subagents 0.65.x disables ambient extensions for their native children";
+  }
+  if (!isDirect) {
+    return "protected mode supports only direct agent launches";
+  }
+  if (input.async !== true) {
+    return "protected mode requires every child launch to set async: true explicitly";
+  }
+  return undefined;
+}
+
+export function hasSandboxAcknowledgement(value: unknown): boolean {
+  if (!value || typeof value !== "object") return false;
+  const record = value as Record<string, unknown>;
+  const acknowledgement = record.runtimeAcknowledgedExtensions;
+  if (
+    acknowledgement && typeof acknowledgement === "object" &&
+    Array.isArray((acknowledgement as { ids?: unknown }).ids) &&
+    (acknowledgement as { ids: unknown[] }).ids.includes(PI_SANDBOX_ACKNOWLEDGEMENT)
+  ) return true;
+  return Object.values(record).some((child) =>
+    Array.isArray(child)
+      ? child.some(hasSandboxAcknowledgement)
+      : hasSandboxAcknowledgement(child)
+  );
+}
+
+export function terminalChildrenHaveSandboxAcknowledgement(value: unknown): boolean {
+  let foundTerminalChild = false;
+  let missing = false;
+  const visit = (candidate: unknown): void => {
+    if (missing || !candidate || typeof candidate !== "object") return;
+    if (Array.isArray(candidate)) {
+      for (const item of candidate) visit(item);
+      return;
+    }
+    const record = candidate as Record<string, unknown>;
+    const state = record.state ?? record.status;
+    if (
+      typeof record.agent === "string" &&
+      ["completed", "failed", "stopped", "timed_out", "interrupted"].includes(String(state))
+    ) {
+      foundTerminalChild = true;
+      if (!hasSandboxAcknowledgement({
+        runtimeAcknowledgedExtensions: record.runtimeAcknowledgedExtensions,
+      })) missing = true;
+      return;
+    }
+    for (const child of Object.values(record)) visit(child);
+  };
+  visit(value);
+  return !foundTerminalChild || !missing;
+}

package/src/external-network-policy.d.mts

@@ -1,8 +0,0 @@
-export type ExternalNetworkPolicy = {
-  allowedDomains: string[];
-  deniedDomains: string[];
-};
-
-export function decodeExternalNetworkPolicy(
-  value: unknown,
-): ExternalNetworkPolicy;

package/src/external-network-policy.mjs

@@ -1,27 +0,0 @@
-import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
-
-/**
- * Decode the supervisor-owned network policy delivered during registration.
- * Any missing, extra, or malformed data becomes a deny-all policy so a broken
- * transport can never widen an external worker's access.
- */
-export function decodeExternalNetworkPolicy(value) {
-  if (
-    !value ||
-    typeof value !== "object" ||
-    Array.isArray(value) ||
-    Object.keys(value).some(
-      (key) => key !== "allowedDomains" && key !== "deniedDomains",
-    )
-  ) {
-    return { allowedDomains: [], deniedDomains: ["*"] };
-  }
-  const result = NetworkConfigSchema.safeParse(value);
-  if (!result.success) {
-    return { allowedDomains: [], deniedDomains: ["*"] };
-  }
-  return {
-    allowedDomains: [...result.data.allowedDomains],
-    deniedDomains: [...result.data.deniedDomains],
-  };
-}