Node.js packages

allowedNpmPackages generates the egress rules a sandbox needs to npm install a specific set of packages, and nothing else. Any npm install for a package you didn't name is blocked, so an agent can pull the dependencies it needs without opening the network wide.

Spread the result into SandboxConfig.egress.

index.ts

import { getOrCreateSandbox, allowedNpmPackages } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("node", {
  image: "node",
  egress: [...allowedNpmPackages("lodash", "zod")],
});

await sandbox.exec(["npm", "install", "lodash", "zod"], { cwd: "/workspace" });

import { getOrCreateSandbox, allowedNpmPackages } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("node", {
  image: "node",
  egress: [...allowedNpmPackages("lodash", "zod")],
});

await sandbox.exec(["npm", "install", "lodash", "zod"], { cwd: "/workspace" });

The helper returns a plain EgressRule[], so you can spread extra allows alongside it:

index.ts

const sandbox = await getOrCreateSandbox("node", {
  image: "node",
  egress: [
    ...allowedNpmPackages("undici"),
    { access: "allow", host: "api.github.com", methods: ["GET"] },
  ],
});

const sandbox = await getOrCreateSandbox("node", {
  image: "node",
  egress: [
    ...allowedNpmPackages("undici"),
    { access: "allow", host: "api.github.com", methods: ["GET"] },
  ],
});

allowedNpmPackages ships in the TypeScript and Python clients. In Go, add the equivalent npm-registry egress rules to SandboxConfig.Egress directly. See also Python packages.

Next: Allow Sandbox