Agent in Sandbox (Fully Secured)

from declaw import TransformationRule

transformation_rules = [
    TransformationRule(
        match=r"internal\.corp\.example\.com",
        replace="api.example.com",
        direction="outbound",
    ),
    TransformationRule(
        match=r"Bearer sk-[a-zA-Z0-9]+",
        replace="Bearer [MASKED]",
        direction="both",
    ),
]

from declaw import (
    SecurityPolicy,
    PIIConfig,
    InjectionDefenseConfig,
    AuditConfig,
)

security = SecurityPolicy(
    pii=PIIConfig(
        enabled=True,
        types=["email", "phone", "ssn", "credit_card"],
        action="redact",
    ),
    injection_defense=InjectionDefenseConfig(
        enabled=True,
        sensitivity="high",
        action="block",
        domains=["api.github.com"],
    ),
    audit=AuditConfig(enabled=True),
    transformations=transformation_rules,
)

from declaw import Sandbox

sbx = Sandbox.create(
    template="python",
    timeout=300,
    network={"allow_out": ["api.github.com"]},
    security=security,
)

AGENT_SCRIPT = textwrap.dedent("""\
    import json, socket, subprocess

    # System info
    print("--- System Information ---")
    result = subprocess.run(["uname", "-a"], capture_output=True, text=True)
    print(f"  Kernel: {result.stdout.strip()}")

    # Data processing with PII-like data
    print()
    print("--- Data Processing (PII-like data) ---")
    records = [
        {"name": "Alice Smith", "email": "alice@example.com", "phone": "555-0101"},
        {"name": "Bob Jones",   "email": "bob@example.com",   "phone": "555-0102"},
    ]
    for r in records:
        print(f"  - {r['name']} (email: {r['email']})")
    print("  NOTE: PII in HTTP traffic would be redacted in a live deployment.")

    # Network test
    print()
    print("--- Network Connectivity ---")
    for host, port, label in [("1.1.1.1", 80, "Cloudflare"), ("8.8.8.8", 53, "Google DNS")]:
        try:
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.settimeout(3)
            s.connect((host, port))
            s.close()
            print(f"  {label} ({host}:{port}): CONNECTED")
        except Exception:
            print(f"  {label} ({host}:{port}): BLOCKED")

    # Write results
    output = {"status": "completed", "tasks_run": 3, "records_processed": len(records)}
    with open("/tmp/agent_output.json", "w") as f:
        json.dump(output, f, indent=2)
""")

sbx.files.write("/tmp/agent.py", AGENT_SCRIPT)
result = sbx.commands.run("python3 /tmp/agent.py", timeout=60)
print(result.stdout)

# Read structured output
output_content = sbx.files.read("/tmp/agent_output.json")
agent_output = json.loads(output_content)

--- Configuring Full Security Stack ---

  Security Policy Configuration:
    {"pii": {"enabled": true, "types": ["email","phone","ssn","credit_card"], ...}}

  [PII Redaction]
    enabled:  True
    types:    ['email', 'phone', 'ssn', 'credit_card']
    action:   redact

  [Injection Defense]
    enabled:     True
    sensitivity: high
    action:      block

  [Audit Logging]
    enabled: True

  [Transformation Rules]
    1. match='internal\\.corp\\.example\\.com'  replace='api.example.com'  direction=outbound
    2. match='Bearer sk-[a-zA-Z0-9]+'  replace='Bearer [MASKED]'  direction=both

--- Creating Fully Secured Sandbox ---
  Sandbox created: sbx-abc123
  State: running

--- Running Agent in Secured Sandbox ---
  Agent output:
    --- System Information ---
      Kernel: Linux ... x86_64 GNU/Linux
    --- Data Processing (PII-like data) ---
      - Alice Smith (email: alice@example.com)
      - Bob Jones (email: bob@example.com)
    --- Network Connectivity ---
      Cloudflare (1.1.1.1:80): BLOCKED
      Google DNS (8.8.8.8:53): BLOCKED

1. Sandbox Isolation    — Agent code in isolated sandbox, no host access
2. Network Policy       — allow_out=['api.github.com'], all other traffic blocked
3. PII Redaction        — Email, phone, SSN, credit card auto-redacted in HTTP traffic
4. Injection Defense    — High sensitivity, block action, prompt injection attempts stopped
5. Audit Logging        — Lifecycle + egress events recorded (7-day platform retention)
6. Transformation Rules — Internal hostnames and API keys masked in transit