Python packages

allowedPythonPackages generates the egress rules a sandbox needs to pip install a specific set of packages, and nothing else. Any pip install for a package you didn't name is blocked by the egress policy, so an agent can install what it needs without opening the network wide.

Spread the result into SandboxConfig.egress.

index.ts

import { getOrCreateSandbox, allowedPythonPackages } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("py", {
  image: "python",
  egress: [...allowedPythonPackages("numpy", "pandas", "matplotlib")],
});

await sandbox.exec(["pip", "install", "numpy", "pandas", "matplotlib"], { cwd: "/workspace" });

import { getOrCreateSandbox, allowedPythonPackages } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("py", {
  image: "python",
  egress: [...allowedPythonPackages("numpy", "pandas", "matplotlib")],
});

await sandbox.exec(["pip", "install", "numpy", "pandas", "matplotlib"], { cwd: "/workspace" });

Combine it with your own rules, the helper returns a plain EgressRule[], so you can spread additional allows alongside it:

index.ts

const sandbox = await getOrCreateSandbox("py", {
  image: "python",
  egress: [
    ...allowedPythonPackages("httpx"),
    { access: "allow", host: "api.github.com", methods: ["GET"] },
  ],
});

const sandbox = await getOrCreateSandbox("py", {
  image: "python",
  egress: [
    ...allowedPythonPackages("httpx"),
    { access: "allow", host: "api.github.com", methods: ["GET"] },
  ],
});

allowedPythonPackages ships in the TypeScript and Python clients. In Go, add the equivalent PyPI egress rules to SandboxConfig.Egress directly. See also Node.js packages.

Next: Node.js packages