feat(sandboxes): egress policy allowlist/denylist for VM sandboxes

[DamianB-BitFlipper]

Summary

Adds the SDK and CLI surface for the VM sandbox domain-aware egress policy (platform side: PrimeIntellect-ai/platform#3532). VM sandboxes can now be created with, and live-updated to, a hostname/CIDR allowlist or denylist.

This is an intentionally breaking release: the network_access boolean is removed from the SDK models and the CLI. Existing clients that still send network_access=true keep working — the platform silently ignores the field — so nothing breaks for callers that never touched the feature; only VM sandboxes accept the new lists.

SDK (prime-sandboxes)

• network_allowlist / network_denylist on CreateSandboxRequest and the Sandbox response — VM-only, mutually exclusive, with a client-side canonicalization mirror (rejects schemes/ports/paths/bare */IPv6/misplaced wildcards) and a 256-entry cap. network_access removed from Sandbox, CreateSandboxRequest, and UpdateSandboxRequest.
• Sync + async get_egress_policy(sandbox_id) and update_egress_policy(sandbox_id, *, allowlist=None, denylist=None), returning EgressPolicyStatus (policy + desired/applied generation + applied). New models exported from the package.

CLI (prime)

• prime sandbox create: repeatable --network-allow / --network-deny with local conflict + --vm-required validation, replacing --network-access/--no-network-access.
• prime sandbox get-egress-policy and prime sandbox update-egress-policy with --allow/--deny and --allow-all/--deny-all (the two empty-list states). Details view renders the policy instead of the removed boolean.

Testing

• 20 new SDK tests (test_egress_policy.py) covering field validation, mutual exclusion, entry canonicalization/rejection, the rule-count cap, response parsing, and that the removed boolean is gone but old-server networkAccess payloads are ignored.
• Full prime-sandboxes and prime suites match their pre-existing-failure baselines; CLI --help verified for all new flags/commands.

🤖 Generated with Claude Code

---

Note

Medium Risk
Intentionally breaking SDK/CLI API (network_access removal) plus changes to VM network egress configuration; misconfigured allow/deny lists could block or expose traffic incorrectly.

Overview
Breaking change: network_access is removed from SDK models and the CLI; VM sandboxes use optional network_allowlist / network_denylist instead (mutually exclusive, VM-only, with client-side entry validation and a 256-rule cap).

The SDK adds SandboxEgressPolicy and EgressPolicyStatus, and sync/async get_network / set_network on /sandbox/{id}/egress-policy (full replacement; ["*"] maps to allow-all / deny-all empty-list semantics). Responses can still carry legacy networkAccess without breaking parsing.

CLI: prime sandbox create gains repeatable --network-allow / --network-deny (requires --vm); details/JSON show the lists and hide internal vmEgressPolicy from advanced configs. New prime sandbox network shows or replaces rules with --allow / --deny and warns when policy is not yet applied.

^{Reviewed by Cursor Bugbot for commit 7178a85. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae065ecf83

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7178a85. Configure here.}