feat: Allow sandbox-SDK user-land control over HTTP requests from the sandbox

[cramforce]

Summary

Add two new packages that allow JS callers to intercept and control all outbound HTTP and HTTPS requests from inside a Vercel Sandbox. A Go-based HTTP proxy runs inside the sandbox VM, tunneling requests over WebSocket to TypeScript callbacks where they can be inspected, modified, or blocked.

• @vercel/http-proxy-server — Go binary (HTTP proxy + WS server + TLS MITM)
• @vercel/http-proxy-tunnel — TypeScript client (WsProxy class)

Usage

Basic: intercept all requests (HTTP and HTTPS)

import { Sandbox } from "@vercel/sandbox";
import { createWsProxy } from "@vercel/http-proxy-tunnel";

const sandbox = await Sandbox.create({ ports: [5000] });
const proxy = createWsProxy();
await proxy.attach(sandbox, { wsPort: 5000 });

const handle = await proxy.handle((request) => {
  // Works for both http:// and https:// URLs
  console.log(`${request.method} ${request.url}`);
  return new Response("blocked", { status: 403 });
});

await sandbox.runCommand({
  cmd: "curl",
  args: ["-s", "https://example.com"],
  env: { ...handle.env },
});

HTTPS interception with real fetching

The proxy does TLS MITM — it generates a CA cert at startup, installs it in the sandbox trust store, and terminates TLS on CONNECT. The JS handler sees the full decrypted URL and can fetch on behalf of the sandbox:

const sandbox = await Sandbox.create({
  ports: [5000],
  networkPolicy: "deny-all", // no direct internet access
});
const proxy = createWsProxy();
await proxy.attach(sandbox, { wsPort: 5000 });

const handle = await proxy.handle(async (req) => {
  // req.url is "https://vercel.com/robots.txt" — fully decrypted
  // The handler runs OUTSIDE the sandbox, so it CAN fetch
  return fetch(req.url);
});

const result = await sandbox.runCommand({
  cmd: "curl",
  args: ["-s", "https://vercel.com/robots.txt"],
  env: { ...handle.env },
});
// result.stdout() contains the actual robots.txt content

Per-command security policies

const allowList = await proxy.handle(async (req) => {
  const url = new URL(req.url);
  if (url.hostname === "registry.npmjs.org") {
    return fetch(req.url);
  }
  return new Response("Forbidden", { status: 403 });
});

const allowAll = await proxy.handle((req) => fetch(req.url));

// Untrusted code can only reach npm
await sandbox.runCommand({
  cmd: "node", args: ["untrusted.js"],
  env: { ...allowList.env },
});

// Trusted code has full access
await sandbox.runCommand({
  cmd: "node", args: ["trusted.js"],
  env: { ...allowAll.env },
});

HTTPS CONNECT allow/deny

The optional connectHandler controls whether HTTPS connections are allowed before MITM begins:

const handle = await proxy.handle(
  async (req) => fetch(req.url),
  (host) => host.endsWith(".github.com"), // only MITM GitHub
);

Multiple independent clients sharing one sandbox

const proxyA = createWsProxy();
await proxyA.attach(sandbox, { wsPort: 5000 }); // starts server

const proxyB = createWsProxy();
await proxyB.attach(sandbox, { wsPort: 5000 }); // reuses existing server

const handleA = await proxyA.handle(() => new Response("from A"));
const handleB = await proxyB.handle(() => new Response("from B"));

const [a, b] = await Promise.all([
  sandbox.runCommand({ cmd: "curl", args: ["-s", "http://x.com"],
    env: { ...handleA.env } }),
  sandbox.runCommand({ cmd: "curl", args: ["-s", "http://x.com"],
    env: { ...handleB.env } }),
]);
// a.stdout() === "from A", b.stdout() === "from B"

ProxyHandle object

proxy.handle() returns a ProxyHandle with:

• handle.url — the raw proxy URL string
• handle.env — ready-made env record (HTTP_PROXY, http_proxy, HTTPS_PROXY, https_proxy)
• handle.toString() — returns URL for string coercion

Architecture

• Session routing via HTTP proxy auth (http://<sessionId>:x@localhost:<port>)
• JSON protocol over WebSocket (request/response with base64 bodies)
• HTTPS MITM: in-memory CA + per-hostname leaf certs, auto-installed in sandbox trust store
• Multi-client: Go hub tracks session-to-client mappings via register/unregister with ack
• Server reuse: config persisted so multiple clients share one proxy

Test plan

• 25 Go unit tests (protocol, hub, proxy server, MITM, session extraction)
• 8 TypeScript process tests (spawn binary, WS client, HTTP/HTTPS proxy)
• 8 sandbox integration tests (real Sandbox, deny-all + HTTPS fetch, multi-client)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sandbox	Error	Open in v0	Mar 27, 2026 9:00pm
sandbox-cli	Ready	Preview, Comment, Open in v0	Mar 27, 2026 9:00pm
sandbox-sdk	Ready	Preview, Comment, Open in v0	Mar 27, 2026 9:00pm
sandbox-sdk-ai-example	Ready	Preview, Comment, Open in v0	Mar 27, 2026 9:00pm
workflow-code-runner	Error	Open in v0	Mar 27, 2026 9:00pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​google/​uuid@​v1.6.0

View full report

[vercel]

Missing "DOM" in tsconfig.json lib array causes typecheck failure: error TS2304: Cannot find name 'BodyInit'