pub struct SandboxConfigUserPolicyNetwork {
pub allowed_hosts: Option<Vec<String>>,
pub allow_local_network: Option<bool>,
pub allow_outbound: Option<bool>,
pub blocked_hosts: Option<Vec<String>>,
pub proxy: Option<SandboxConfigUserPolicyNetworkProxy>,
}Expand description
Network rules to merge into the base policy.
Experimental. This type is part of an experimental wire-protocol surface and may change or be removed in future SDK or CLI releases.
Fields§
§allowed_hosts: Option<Vec<String>>Hosts allowed through the built-in sandbox proxy. A non-empty list denies unmatched hosts; an absent or empty list allows all hosts not blocked. Supports exact hostnames, IP addresses, and *.example.com for strict subdomains. Host rules do not override the outbound or local-network toggles.
allow_local_network: Option<bool>Whether traffic to local/loopback addresses is allowed.
allow_outbound: Option<bool>Whether outbound network traffic is allowed at all.
blocked_hosts: Option<Vec<String>>Hosts denied by the built-in sandbox proxy. Deny rules take precedence over allowedHosts. A domain also denies all its subdomains. IP addresses match exactly; *.example.com matches strict subdomains, and * denies every host.
proxy: Option<SandboxConfigUserPolicyNetworkProxy>HTTP(S) proxy for sandboxed traffic. This is the built-in local proxy’s upstream: every sandboxed command reaches it through a loopback listener, so credentials stay in the runtime and never reach the child. On Windows the sandbox also needs local network access, because it reaches that listener over host loopback. Configure credentials in the separate username/password fields. The transient local listener URL is never persisted.