airlock-bot 0.2.19 → 0.2.21

package/dist/transport/http-server.js

@@ -0,0 +1,93 @@
+import { randomUUID, timingSafeEqual } from 'crypto';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createAgentServer, connectAgentServer } from './agent-server.js';
+import { childLogger } from '../util/logger.js';
+const log = childLogger('http-server');
+function constantTimeEqual(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+// eslint-disable-next-line @typescript-eslint/require-await
+export async function httpServerPlugin(app, opts) {
+    const { secret } = opts;
+    const sessions = new Map();
+    // Don't parse request bodies — handleRequest reads the raw stream.
+    app.removeAllContentTypeParsers();
+    app.addContentTypeParser('*', (_req, _payload, done) => {
+        done(null);
+    });
+    function checkAgentAuth(request, reply, deps) {
+        const token = deps.agentConfig.token;
+        if (token) {
+            const auth = request.headers.authorization ?? '';
+            if (!constantTimeEqual(auth, `Bearer ${token}`)) {
+                reply.status(401).send({ error: 'Unauthorized' });
+                return false;
+            }
+            return true;
+        }
+        if (secret) {
+            const auth = request.headers.authorization ?? '';
+            if (!constantTimeEqual(auth, `Bearer ${secret}`)) {
+                reply.status(401).send({ error: 'Unauthorized' });
+                return false;
+            }
+        }
+        return true;
+    }
+    async function handleMcpRequest(request, reply) {
+        const { profileId } = request.params;
+        const deps = opts.getDeps(profileId);
+        if (!deps) {
+            return reply.status(404).send({ error: `Unknown agent profile: ${profileId}` });
+        }
+        if (!checkAgentAuth(request, reply, deps))
+            return;
+        const sessionId = request.headers['mcp-session-id'];
+        let transport;
+        if (sessionId) {
+            const session = sessions.get(sessionId);
+            if (!session) {
+                return reply.status(404).send({ error: `Session not found: ${sessionId}` });
+            }
+            if (session.profileId !== profileId) {
+                return reply.status(403).send({ error: 'Session does not belong to this agent' });
+            }
+            transport = session.transport;
+        }
+        else {
+            // New session — create transport + MCP server before the initialize handshake.
+            const ac = new AbortController();
+            transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                onsessioninitialized: (id) => {
+                    sessions.set(id, { transport, ac, profileId });
+                    log.info({ profileId, sessionId: id }, 'HTTP session initialized');
+                },
+                onsessionclosed: (id) => {
+                    sessions.delete(id);
+                    ac.abort();
+                    log.info({ profileId, sessionId: id }, 'HTTP session closed');
+                },
+            });
+            const server = createAgentServer({ ...deps, signal: ac.signal });
+            await connectAgentServer(server, transport);
+            transport.onclose = () => {
+                const id = transport.sessionId;
+                if (id)
+                    sessions.delete(id);
+                ac.abort();
+            };
+        }
+        // Hand off raw Node.js req/res — Fastify must not touch the response after this.
+        reply.hijack();
+        await transport.handleRequest(request.raw, reply.raw);
+    }
+    app.post('/agents/:profileId/mcp', handleMcpRequest);
+    app.get('/agents/:profileId/mcp', handleMcpRequest);
+    app.delete('/agents/:profileId/mcp', handleMcpRequest);
+}
+//# sourceMappingURL=http-server.js.map

package/dist/transport/http-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.js","sourceRoot":"","sources":["../../src/transport/http-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,GAAG,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;AAEvC,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAoB,EACpB,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IAEJ,mEAAmE;IACnE,GAAG,CAAC,2BAA2B,EAAE,CAAC;IAClC,GAAG,CAAC,oBAAoB,CACtB,GAAG,EACH,CAAC,IAAoB,EAAE,QAAiB,EAAE,IAAyB,EAAE,EAAE;QACrE,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,CAAC,CACF,CAAC;IAEF,SAAS,cAAc,CACrB,OAAuB,EACvB,KAAmB,EACnB,IAAqB;QAErB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,KAAK,EAAE,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAClD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,CAAC,EAAE,CAAC;gBACjD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAClD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,KAAmB;QAC1E,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA+B,CAAC;QAE9D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,SAAS,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO;QAElD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QAE1E,IAAI,SAAwC,CAAC;QAE7C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,SAAS,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,+EAA+E;YAC/E,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;YACjC,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;gBACtC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE;oBAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,0BAA0B,CAAC,CAAC;gBACrE,CAAC;gBACD,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE;oBACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACpB,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBAChE,CAAC;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YACjE,MAAM,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAE5C,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC;gBAC/B,IAAI,EAAE;oBAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5B,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;AACzD,CAAC"}

package/dist/types.d.ts

@@ -2,6 +2,7 @@ export interface ToolCall {
     tool: string;
     args: Record<string, unknown>;
     agentId: string;
+    meta?: Record<string, unknown>;
 }
 export interface ToolResult {
     success: boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1D"}

package/examples/gateway.yaml

@@ -31,6 +31,19 @@ providers:
   exec: builtin
   http: builtin
 
+# Optional reusable sandbox presets for policy-wrapped tool variants.
+# See examples/sandbox-presets.yaml for a focused end-to-end example.
+# sandbox_presets:
+#   local_transform:
+#     filesystem:
+#       allow_read: ['.']
+#       allow_write: ['/tmp', '/private/tmp']
+#       deny_read: ['~/.ssh', '~/.aws', '.env']
+#       deny_write: ['.']
+#     network:
+#       allowed_domains: []
+#       denied_domains: []
+
 # Agents
 agents:
   # Helena: full-access developer agent with approval on destructive ops
@@ -61,6 +74,23 @@ agents:
       domain_allowlist:
         - 'api.github.com'
         - '*.sentry.io'
+    # sandbox:
+    #   enabled: true
+    #   presets: ['local_transform']
+    # tool_overrides:
+    #   python/sandboxed:
+    #     alias_of: 'exec/run'
+    #     description: 'Run Python for local transforms only'
+    #   python/full:
+    #     alias_of: 'exec/run'
+    #     description: 'Run Python with broader permissions after approval'
+    #     sandbox:
+    #       filesystem:
+    #         allow_write: ['.', '/tmp', '/private/tmp']
+    #         deny_write: []
+    #       network:
+    #         allowed_domains: ['pypi.org', '*.pythonhosted.org']
+    #         denied_domains: []
 
   # Claude Code: read-only, no approval needed
   claude-code:

package/examples/sandbox-presets.yaml

@@ -0,0 +1,142 @@
+# Sandbox presets + tool variant example.
+#
+# Goal:
+# - give agents a fast-path tool that is broadly allowed because it runs in a
+#   tight sandbox
+# - keep a second full-power variant that still requires approval
+#
+# Run: npx tsx src/index.ts --agent claude-code --config examples/sandbox-presets.yaml
+
+providers:
+  exec: builtin
+
+# Reusable sandbox building blocks.
+# These can be referenced by agents and by individual tool variants.
+sandbox_presets:
+  local_transform:
+    filesystem:
+      # Let the agent read the repo, but only write to temp space.
+      allow_read:
+        - '.'
+      allow_write:
+        - '/tmp'
+        - '/private/tmp'
+      # Additive deny rules protect common secret locations.
+      deny_read:
+        - '~/.ssh'
+        - '~/.aws'
+        - '~/.config/gcloud'
+        - '.env'
+      # Prevent writes back into the repo by default.
+      deny_write:
+        - '.'
+    network:
+      # Empty allowlist means no outbound network.
+      allowed_domains: []
+      denied_domains: []
+
+  github_only:
+    network:
+      allowed_domains:
+        - 'github.com'
+        - '*.github.com'
+        - 'api.github.com'
+      denied_domains: []
+
+agents:
+  claude-code:
+    allow:
+      - 'python/sandboxed'
+      - 'node/sandboxed'
+    ask:
+      - 'python/full'
+      - 'python/github'
+      - 'node/full'
+    deny:
+      - 'exec/run'
+
+    # Agent-level sandbox defaults apply to any tool that resolves through the
+    # sandbox middleware, then tool-specific presets / overrides refine it.
+    sandbox:
+      enabled: true
+      presets:
+        - local_transform
+
+    tool_overrides:
+      # Safe fast path: same underlying capability, but strongly sandboxed.
+      python/sandboxed:
+        alias_of: 'exec/run'
+        description: 'Run Python for local JSON/text transformations only'
+
+      # Full-power variant: same base tool, but leave it approval-gated.
+      python/full:
+        alias_of: 'exec/run'
+        description: 'Run Python with normal permissions after approval'
+        sandbox:
+          filesystem:
+            # Override allow_write so approved runs can modify the repo.
+            allow_write:
+              - '.'
+              - '/tmp'
+              - '/private/tmp'
+            deny_write: []
+          network:
+            # Example broad approved networking.
+            allowed_domains:
+              - 'pypi.org'
+              - '*.pythonhosted.org'
+            denied_domains: []
+
+      # Middle ground: GitHub-only network for scripts that need API access.
+      python/github:
+        alias_of: 'exec/run'
+        description: 'Run Python with GitHub-only network access after approval'
+        sandbox_presets:
+          - github_only
+
+      node/sandboxed:
+        alias_of: 'exec/run'
+        description: 'Run Node.js for local transformations only'
+
+      node/full:
+        alias_of: 'exec/run'
+        description: 'Run Node.js with broader permissions after approval'
+        sandbox:
+          filesystem:
+            allow_write:
+              - '.'
+              - '/tmp'
+              - '/private/tmp'
+            deny_write: []
+          network:
+            allowed_domains:
+              - 'registry.npmjs.org'
+              - '*.npmjs.org'
+            denied_domains: []
+
+    exec:
+      # Example shell policy for the underlying exec provider.
+      # The tool permission still controls whether the tool can be called at all;
+      # these patterns constrain the command strings passed into exec/run.
+      allow:
+        - 'python3 -c *'
+        - 'python -c *'
+        - 'node -e *'
+      ask:
+        - 'python3 *'
+        - 'python *'
+        - 'node *'
+      deny:
+        - 'sudo *'
+        - 'rm -rf *'
+
+approvals:
+  provider:
+    type: stdio
+  timeout_ms: 300000
+  batch_window_ms: 5000
+
+audit:
+  db_path: ':memory:'
+  retention_days: 1
+  redact_fields: []

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "airlock-bot",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "Permissions-aware MCP gateway with human-in-the-loop approval for AI agents",
   "license": "MIT",
   "type": "module",
@@ -40,6 +40,10 @@
     "build": "tsc",
     "dev": "tsx src/index.ts",
     "configure-agent": "tsx scripts/configure-agent.ts",
+    "docs:dev": "vitepress dev docs",
+    "docs:llms": "tsx scripts/generate-llms.ts",
+    "docs:build": "npm run docs:llms && vitepress build docs",
+    "docs:preview": "vitepress preview docs",
     "test": "vitest",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src",
@@ -50,6 +54,7 @@
     "prepublishOnly": "npm run schema && npm run build"
   },
   "dependencies": {
+    "@anthropic-ai/sandbox-runtime": "^0.0.42",
     "@apidevtools/swagger-parser": "^12.1.0",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "ai": "^6.0.116",
@@ -77,6 +82,7 @@
     "tsx": "^4.7.0",
     "typescript": "^5.4.0",
     "typescript-eslint": "^8.57.0",
+    "vitepress": "^1.6.4",
     "vitest": "^3.0.0",
     "zod-to-json-schema": "^3.25.1"
   }

package/schema.json

@@ -132,6 +132,72 @@
           },
           "default": {}
         },
+        "sandbox_presets": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "properties": {
+              "filesystem": {
+                "type": "object",
+                "properties": {
+                  "allow_write": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "default": [
+                      ".",
+                      "/tmp"
+                    ]
+                  },
+                  "deny_read": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "default": []
+                  },
+                  "deny_write": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "default": []
+                  },
+                  "allow_read": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                },
+                "additionalProperties": false
+              },
+              "network": {
+                "type": "object",
+                "properties": {
+                  "allowed_domains": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "default": []
+                  },
+                  "denied_domains": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "default": []
+                  }
+                },
+                "additionalProperties": false
+              }
+            },
+            "additionalProperties": false
+          },
+          "default": {}
+        },
         "clis": {
           "type": "object",
           "additionalProperties": {
@@ -349,9 +415,84 @@
                     "description": {
                       "type": "string"
                     },
-                    "trusted": {
-                      "type": "boolean",
-                      "default": false
+                    "alias_of": {
+                      "type": "string"
+                    },
+                    "sandbox_presets": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      ],
+                      "default": []
+                    },
+                    "sandbox": {
+                      "type": "object",
+                      "properties": {
+                        "filesystem": {
+                          "type": "object",
+                          "properties": {
+                            "allow_write": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": [
+                                ".",
+                                "/tmp"
+                              ]
+                            },
+                            "deny_read": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": []
+                            },
+                            "deny_write": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": []
+                            },
+                            "allow_read": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              }
+                            }
+                          },
+                          "additionalProperties": false
+                        },
+                        "network": {
+                          "type": "object",
+                          "properties": {
+                            "allowed_domains": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": []
+                            },
+                            "denied_domains": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": []
+                            }
+                          },
+                          "additionalProperties": false
+                        }
+                      },
+                      "additionalProperties": false
                     }
                   },
                   "additionalProperties": false
@@ -419,6 +560,155 @@
                 "additionalProperties": false,
                 "default": {}
               },
+              "sandbox": {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "type": "boolean",
+                    "default": false
+                  },
+                  "presets": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      }
+                    ],
+                    "default": []
+                  },
+                  "filesystem": {
+                    "type": "object",
+                    "properties": {
+                      "allow_write": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "default": [
+                          ".",
+                          "/tmp"
+                        ]
+                      },
+                      "deny_read": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "default": []
+                      },
+                      "deny_write": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "default": []
+                      },
+                      "allow_read": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      }
+                    },
+                    "additionalProperties": false,
+                    "default": {}
+                  },
+                  "network": {
+                    "type": "object",
+                    "properties": {
+                      "allowed_domains": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "default": []
+                      },
+                      "denied_domains": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "default": []
+                      }
+                    },
+                    "additionalProperties": false,
+                    "default": {}
+                  },
+                  "overrides": {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "object",
+                      "properties": {
+                        "filesystem": {
+                          "type": "object",
+                          "properties": {
+                            "allow_write": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": [
+                                ".",
+                                "/tmp"
+                              ]
+                            },
+                            "deny_read": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": []
+                            },
+                            "deny_write": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": []
+                            },
+                            "allow_read": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              }
+                            }
+                          },
+                          "additionalProperties": false
+                        },
+                        "network": {
+                          "type": "object",
+                          "properties": {
+                            "allowed_domains": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": []
+                            },
+                            "denied_domains": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "default": []
+                            }
+                          },
+                          "additionalProperties": false
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "default": {}
+                  }
+                },
+                "additionalProperties": false,
+                "default": {}
+              },
               "middleware": {
                 "type": "array",
                 "items": {