@tangle-network/agent-app 0.44.40 → 0.44.41

package/dist/chat-routes/index.js

@@ -97,7 +97,7 @@ import {
   flattenHistory,
   readSandboxBinaryBytes,
   statSandboxFileSize
-} from "../chunk-JYHMNFFU.js";
+} from "../chunk-HUBACCOP.js";
 import "../chunk-LWSJK546.js";
 import "../chunk-CQZSAR77.js";
 import "../chunk-ICOHEZK6.js";

package/dist/{chunk-JYHMNFFU.js → chunk-HUBACCOP.js}

@@ -1411,6 +1411,7 @@ async function peekWorkspaceSandbox(shell, options) {
   return { status: "running", box: match };
 }
 async function finalizeExistingBox(shell, client, box, stage, name, workspaceId, userId, harness, scope) {
+  await reconcileExistingBoxEgress(box, shell.egressPolicy, stage, name);
   const written = await materializeDeferredFilesForExistingBox(
     shell,
     client,
@@ -1433,6 +1434,40 @@ async function finalizeExistingBox(shell, client, box, stage, name, workspaceId,
   }
   return finalBox;
 }
+function normalizedEgressPolicy(policy) {
+  if (policy.mode !== "strict") return policy.mode;
+  const allowDomains = [...new Set(
+    (policy.allowDomains ?? []).map((domain) => domain.trim().toLowerCase()).filter(Boolean)
+  )].sort();
+  return JSON.stringify({
+    mode: policy.mode,
+    allowDomains,
+    includeImplicitDomains: policy.includeImplicitDomains !== false
+  });
+}
+async function reconcileExistingBoxEgress(box, desired, stage, name) {
+  if (!desired) return;
+  let current;
+  try {
+    current = await box.egress.get();
+  } catch (cause) {
+    const error = cause instanceof Error ? cause : new Error(String(cause));
+    throw new Error(`egress policy read failed on ${stage} box ${name}: ${error.message}`, {
+      cause: error
+    });
+  }
+  const matchingPolicy = normalizedEgressPolicy(current.policy) === normalizedEgressPolicy(desired);
+  const effectiveSource = desired.mode !== "open" || current.source !== "platform";
+  if (matchingPolicy && effectiveSource) return;
+  try {
+    await box.egress.update(desired);
+  } catch (cause) {
+    const error = cause instanceof Error ? cause : new Error(String(cause));
+    throw new Error(`egress policy update failed on ${stage} box ${name}: ${error.message}`, {
+      cause: error
+    });
+  }
+}
 async function ensureWorkspaceSandbox(shell, options) {
   const { workspaceId, userId, harness, forceNew, onProgress, billingOwnerId } = options;
   const resolved = await resolveWorkspaceSandboxClient(shell, workspaceId, userId);
@@ -1565,6 +1600,7 @@ async function ensureWorkspaceSandbox(shell, options) {
     backend: { type: harness, profile, ...model ? { model } : {} },
     ...storage ? { storage } : {},
     ...restore ? restore : {},
+    ...shell.egressPolicy ? { egressPolicy: shell.egressPolicy } : {},
     ...shell.webTerminalEnabled ? { webTerminalEnabled: true } : {},
     maxLifetimeSeconds: resources.maxLifetimeSeconds,
     idleTimeoutSeconds: resources.idleTimeoutSeconds,
@@ -1978,4 +2014,4 @@ export {
   isTerminalPromptEvent,
   detectInteractiveQuestion
 };
-//# sourceMappingURL=chunk-JYHMNFFU.js.map
+//# sourceMappingURL=chunk-HUBACCOP.js.map