feat(network policy): support header injections

[robherley]

Extends network policies to support transformers, with the current ability to inject custom headers.

const sbx = await Sandbox.create({
  networkPolicy: {
    allow: {
      "httpbin.org": [{
        transform: [{ headers: { "authorization": "Bearer my-secret-token" } }],
      }],
      "*": [{
        transform: [{ headers: { "x-foo": "bar" } }],
      }],
    },
  },
});

const f = async (url: string) => {
  const cmd = await sbx.runCommand("curl", ["-is", url]);
  console.log(await cmd.output());
};

await f("https://httpbin.org/get")
await f("https://echo.free.beeceptor.com")

Result

HTTP/2 200 
access-control-allow-credentials: true
access-control-allow-origin: *
content-type: application/json
date: Fri, 20 Feb 2026 01:30:13 GMT
server: gunicorn/19.9.0
content-length: 372

{
  "args": {}, 
  "headers": {
    "Accept": "*/*", 
    "Accept-Encoding": "gzip", 
    "Authorization": "Bearer my-secret-token", 
    "Host": "httpbin.org", 
    "Transfer-Encoding": "chunked", 
    "User-Agent": "curl/8.15.0", 
    "X-Amzn-Trace-Id": "Root=1-6997b925-09eebe6f0730a9a3158e8b26"
  }, 
  "origin": "98.81.124.221", 
  "url": "https://httpbin.org/get"
}

HTTP/2 200 
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000
content-type: application/json
date: Fri, 20 Feb 2026 01:30:14 GMT
vary: Accept-Encoding
via: 1.1 Caddy

{
  "method": "GET",
  "protocol": "https",
  "host": "echo.free.beeceptor.com",
  "path": "/",
  "ip": "98.81.124.221:63596",
  "headers": {
    "Host": "echo.free.beeceptor.com",
    "User-Agent": "curl/8.15.0",
    "Accept": "*/*",
    "Accept-Encoding": "gzip",
    "Via": "2.0 Caddy",
    "X-Foo": "bar"
  },
  "parsedQueryParams": {}
}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sandbox-cli	Ready	Preview, Comment	Feb 20, 2026 7:37pm
sandbox-sdk	Ready	Preview, Comment	Feb 20, 2026 7:37pm
sandbox-sdk-ai-example	Ready	Preview, Comment	Feb 20, 2026 7:37pm