From c1ae9681f03f2734d87b14f8eebf6767e58300de Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 28 Oct 2026 07:45:32 +0000
Subject: [PATCH 1/6] Drop the microsandbox network interims and accept
 *.suffix in the cap

Create and restore both turn off strict hostname enforcement and DNS rebind
protection, so the private pre-resolution and the restore address pins go.
The cap accepts *.example.com for subdomains, enforced as a suffix allow
behind an apex deny.
---
 .../src/features/sandbox/NetworkSettings.tsx  |   2 +-
 apps/web/src/i18n/locales/zh-CN/sandbox.ts    |   2 +-
 contracts/agents-api/environments.md          |   7 +-
 contracts/agents-api/index.md                 |   2 +-
 contracts/agents-api/sandbox-deployment.md    |   8 +-
 contracts/agents-api/zh/environments.md       |   9 +-
 contracts/agents-api/zh/index.md              |   4 +-
 contracts/agents-api/zh/sandbox-deployment.md |  10 +-
 deploy/node/node_spec.py                      |   2 +-
 docs/sandbox-provider.md                      |   6 +-
 docs/zh/sandbox-provider.md                   |   8 +-
 .../agents-client/src/deployment-contract.ts  |   2 +-
 .../core/internal/execution/network_egress.go |  15 +-
 .../internal/execution/network_egress_test.go |  15 ++
 services/core/internal/sandbox/network.go     |  27 ++-
 .../core/internal/sandbox/network_test.go     |  14 +-
 .../core/internal/sandbox/sandbox_provider.go |   6 +-
 .../sandbox/testdata/deployment-contract.json |   4 +-
 .../tools/microsandbox-provider/README.md     |   2 +-
 .../tools/microsandbox-provider/backend.go    |   7 +-
 .../tools/microsandbox-provider/bootstrap.go  |   2 +-
 .../tools/microsandbox-provider/network.go    | 186 ++++++------------
 .../microsandbox-provider/network_test.go     | 123 ++++--------
 .../tools/microsandbox-provider/snapshot.go   |   5 +-
 24 files changed, 205 insertions(+), 263 deletions(-)

diff --git a/apps/web/src/features/sandbox/NetworkSettings.tsx b/apps/web/src/features/sandbox/NetworkSettings.tsx
index eea68a5cc..91a31e0cc 100644
--- a/apps/web/src/features/sandbox/NetworkSettings.tsx
+++ b/apps/web/src/features/sandbox/NetworkSettings.tsx
@@ -55,7 +55,7 @@ export function NetworkForm({ deployment, disabled, onSave }: { deployment: Sand
         </div>
       </div>
       <div className="settings-row">
-        <div className="settings-row-label"><label htmlFor="sandbox-network-domains">{t("Extra allowed domains")}</label><HelpTip id="sandbox-network-domains-help">{support.private_domains ? t("One host name per line, such as gitlab.example.com, up to {{count}}. Sandboxes can reach these names, including names on your private network. Wildcards are not accepted.", { count: maxDomains }) : t("{{provider}} sandboxes run in the provider's cloud and cannot reach your private network.", { provider })}</HelpTip></div>
+        <div className="settings-row-label"><label htmlFor="sandbox-network-domains">{t("Extra allowed domains")}</label><HelpTip id="sandbox-network-domains-help">{support.private_domains ? t("One host name per line, such as gitlab.example.com, up to {{count}}. Sandboxes can reach these names, including names on your private network. *.example.com allows its subdomains, not example.com itself.", { count: maxDomains }) : t("{{provider}} sandboxes run in the provider's cloud and cannot reach your private network.", { provider })}</HelpTip></div>
         <div className="settings-row-control field">
           <textarea id="sandbox-network-domains" className="network-domains" rows={4} spellCheck={false} autoCapitalize="none" value={text ?? current.domains.join("\n")} disabled={disabled || !support.private_domains} aria-invalid={issues.length > 0} aria-describedby="sandbox-network-domains-help" onChange={(event) => setText(event.target.value)} />
           {issues.map((issue, index) => <span className="field-error" key={index}>{message(issue)}</span>)}
diff --git a/apps/web/src/i18n/locales/zh-CN/sandbox.ts b/apps/web/src/i18n/locales/zh-CN/sandbox.ts
index 9507ed708..cfdd6814f 100644
--- a/apps/web/src/i18n/locales/zh-CN/sandbox.ts
+++ b/apps/web/src/i18n/locales/zh-CN/sandbox.ts
@@ -6,7 +6,7 @@ export const sandbox = {
   "When off, sandboxes reach only the domains listed below.": "关闭后，沙箱只能访问下方列出的域名。",
   "{{provider}} cannot restrict outbound traffic, so sandboxes always reach the public internet.": "{{provider}} 无法限制出站流量，沙箱始终可以访问公网。",
   "Extra allowed domains": "额外允许的域名",
-  "One host name per line, such as gitlab.example.com, up to {{count}}. Sandboxes can reach these names, including names on your private network. Wildcards are not accepted.": "每行一个主机名，例如 gitlab.example.com，最多 {{count}} 个。沙箱可以访问这些域名，包括内网域名。不支持通配符。",
+  "One host name per line, such as gitlab.example.com, up to {{count}}. Sandboxes can reach these names, including names on your private network. *.example.com allows its subdomains, not example.com itself.": "每行一个主机名，例如 gitlab.example.com，最多 {{count}} 个。沙箱可以访问这些域名，包括内网域名。*.example.com 放行其子域名，不含 example.com 本身。",
   "{{provider}} sandboxes run in the provider's cloud and cannot reach your private network.": "{{provider}} 的沙箱运行在提供商的云端，无法访问你的内网。",
   "Add at most {{count}} domains.": "最多添加 {{count}} 个域名。",
   "{{domain}} is listed twice.": "{{domain}} 重复了。",
diff --git a/contracts/agents-api/environments.md b/contracts/agents-api/environments.md
index f24774dbb..850f0fbdf 100644
--- a/contracts/agents-api/environments.md
+++ b/contracts/agents-api/environments.md
@@ -306,13 +306,12 @@ Core may start a hosted Environment from the result of an earlier preparation in
 A hosted Session's effective `network` narrows the deployment's [network cap](./sandbox-deployment.md#network), and the policy holds for the sandbox's whole life, including package installation and setup commands:
 
 - `enabled`: the sandbox reaches what the cap allows.
-- `disabled`: the sandbox reaches only Core, the Session's model provider and the host's DNS server on port 53. The model provider stays reachable on its `base_url` port at public addresses; a private model provider host is reachable only when the cap lists its exact name in the extra domains. Package installation and setup commands that need the network fail as ordinary setup errors.
-- `restricted`: the sandbox reaches the listed domains, Core and the model provider (on the same terms as `disabled`). A domain is allowed on public addresses when the cap allows the public internet, and on its resolved addresses when it is one of the cap's extra domains. Any other domain is rejected at Session creation with `sandbox_network_outside_cap`, whose `param` is that `allowed_domains` entry. If the cap shrinks later, the sandbox attempt fails with the same error.
+- `disabled`: the sandbox reaches only Core, the Session's model provider and the host's DNS server on port 53. The model provider stays reachable on its `base_url` port at public addresses; a private model provider host is reachable only when the cap's extra domains cover its name. Package installation and setup commands that need the network fail as ordinary setup errors.
+- `restricted`: the sandbox reaches the listed domains, Core and the model provider (on the same terms as `disabled`). A domain is allowed on public addresses when the cap allows the public internet, and on its resolved addresses when the cap's extra domains cover it, by name or through a `*.` entry. Any other domain is rejected at Session creation with `sandbox_network_outside_cap`, whose `param` is that `allowed_domains` entry. If the cap shrinks later, the sandbox attempt fails with the same error.
 
 Limits ([adapter rules](../../docs/sandbox-provider.md#network-egress)):
 
-- A model provider host that the cap lists is reachable like a listed domain, not only on its port.
-- On microsandbox, once a sandbox without public internet (`disabled`, `restricted`, or `enabled` under a cap without it) has resumed, a domain allowed on public addresses, the model provider included, is reachable only at the addresses its name had at resume, except over plain HTTP; other sites on those addresses are reachable too.
+- A model provider host that the cap lists, by name or through a `*.` entry, is reachable like a listed domain, not only on its port.
 - On E2B, a restricted domain is reachable only on ports 80 and 443, and a model provider on another port is reachable on every port of its public addresses.
 
 `disabled` and `restricted` return `sandbox_network_unsupported` when the deployment's sandbox Provider cannot restrict egress. A `self_hosted` Environment accepts only `enabled`, because Core cannot enforce a policy on a machine it does not run.
diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
index 65ff8e77f..a1e9105ad 100644
--- a/contracts/agents-api/index.md
+++ b/contracts/agents-api/index.md
@@ -160,7 +160,7 @@ Each item is Core's deliberate or native behavior where the official service beh
 
 - Hosted workspace admission is limited by the [tenant capacity policy](../../docs/configuration.md#tenant-capacity) and the [input reservation deadline](./environments.md#reservations).
 - MiniMax Code does not declare `retained_native_history`, so it cannot run on microsandbox, which keeps every Environment on workspace storage; Core rejects the Session ([Harness capabilities](./harness-capabilities.md)).
-- The model provider's port stays reachable at public addresses from the sandbox because the Harness runs there, and a private model provider host only when the network cap lists its name; under `disabled` the host's DNS server stays reachable on port 53; MCP connections from the Environment follow the deployment's [network cap](./sandbox-deployment.md#network). After a microsandbox sandbox without public internet resumes, other sites on the addresses of its allowed domains are reachable too ([limits](./environments.md#restricted-network)). E2B sandboxes cannot reach private networks, and `169.254.169.254` answers inside an E2B sandbox under every cap.
+- The model provider's port stays reachable at public addresses from the sandbox because the Harness runs there, and a private model provider host only when the network cap lists its name; under `disabled` the host's DNS server stays reachable on port 53; MCP connections from the Environment follow the deployment's [network cap](./sandbox-deployment.md#network). E2B sandboxes cannot reach private networks, and `169.254.169.254` answers inside an E2B sandbox under every cap.
 - `disabled` and `restricted` networking run on hosted Environments whose sandbox Provider can restrict egress, within the deployment's network cap; `self_hosted` Environments accept only `enabled` ([network policy](./environments.md#restricted-network)). The official API accepts an `allowed_domains` entry with a leading dot, such as `.example.com`, with unspecified meaning; Core rejects it.
 - `packages.system` other than null or an empty list is rejected; system packages must be preinstalled.
 - `Environment.files` lists the files recorded at Session creation; files created later through the Environment files API do not appear.
diff --git a/contracts/agents-api/sandbox-deployment.md b/contracts/agents-api/sandbox-deployment.md
index 03576eb99..3e6d45499 100644
--- a/contracts/agents-api/sandbox-deployment.md
+++ b/contracts/agents-api/sandbox-deployment.md
@@ -63,14 +63,14 @@ Select the filesystem configuration before the microsandbox deployment. Selectin
 
 ### Network
 
-`network` caps what every sandbox of the deployment may reach when its Environment's `network.access` is `enabled` or omitted. The connection to Core and the Session's model provider port on public addresses are always reachable, because the Harness runs inside the sandbox. To reach a model provider at a private address, list its exact host name in `domains`. MCP connections from the Environment follow the cap like any other traffic.
+`network` caps what every sandbox of the deployment may reach when its Environment's `network.access` is `enabled` or omitted. The connection to Core and the Session's model provider port on public addresses are always reachable, because the Harness runs inside the sandbox. To reach a model provider at a private address, list its host name, or a `*.` entry that covers it, in `domains`. MCP connections from the Environment follow the cap like any other traffic.
 
 | Field | Accepted value |
 | --- | --- |
-| `public` | Boolean. `true` allows public addresses; `false` allows only Core, the model provider and `domains` ([microsandbox limit after a resume](./environments.md#restricted-network)) |
-| `domains` | At most 100 exact host names of at most 253 characters, in lowercase letters, digits, hyphens and dots, whose last label starts with a letter. Wildcards, IP literals, ports and URLs are rejected. Core stores them lowercase, deduplicated and sorted. Every address a name resolves to is allowed, private addresses included |
+| `public` | Boolean. `true` allows public addresses; `false` allows only Core, the model provider and `domains` |
+| `domains` | At most 100 entries of at most 253 characters, each an exact host name or `*.` and a host name, in lowercase letters, digits, hyphens and dots, whose last label starts with a letter. `*.example.com` covers the subdomains of `example.com` at any depth but not `example.com` itself, which needs its own entry; other wildcards, IP literals, ports and URLs are rejected. Core stores them lowercase, deduplicated and sorted. Every address a name resolves to is allowed, private addresses included |
 
-The default is `{"public": true, "domains": []}`. Under every cap, loopback, link-local and cloud-metadata addresses and all other private addresses stay blocked, except that E2B cannot block the metadata address 169.254.169.254 and its sandboxes cannot reach private networks at all. Addresses are resolved when a sandbox starts and when it resumes, so a name whose answer changes in between is not followed. A sandbox keeps the cap of the generation that created it.
+The default is `{"public": true, "domains": []}`. Under every cap, loopback, link-local and cloud-metadata addresses and all other private addresses stay blocked, except that E2B cannot block the metadata address 169.254.169.254 and its sandboxes cannot reach private networks at all. On microsandbox, a plain-text (non-TLS) connection to a subdomain that shares an address with the apex that the sandbox also resolved is refused. A sandbox keeps the cap of the generation that created it.
 
 Each Provider declares what it enforces ([Sandbox Provider protocol](../../docs/sandbox-provider.md#network-egress)): microsandbox supports both fields, E2B supports `public: false` but not `domains` because E2B sandboxes cannot reach private networks. A cap the selected Provider does not declare returns 400 `invalid_sandbox_configuration` with `param` `network.public` or `network.domains`.
 
diff --git a/contracts/agents-api/zh/environments.md b/contracts/agents-api/zh/environments.md
index 37a657ad0..463da0641 100644
--- a/contracts/agents-api/zh/environments.md
+++ b/contracts/agents-api/zh/environments.md
@@ -1,7 +1,7 @@
 ---
 title: "Environment 与模板"
 source: contracts/agents-api/environments.md
-source_hash: 4175f4a847bf337d1b5c233a56e054218588408429107afa59fbadfc46bfab1e
+source_hash: b0587966b17ac30e6626b3ba094005de114fc04c0190a7adc96830f92acb11c3
 ---
 
 Environment 是 Session 的执行资源，包括 Harness 运行所在的机器、工作区以及已完成准备的能力。Session 通过其 `environment` 配置创建 Environment；不存在独立的 create 调用。Environment 模板是 Session 创建时解析的可复用准备配置。本契约涵盖这两类资源、两种放置方式、输入接纳、能力准备、Skills、Plugins 和 MCP 连接来源。
@@ -308,13 +308,12 @@ Core 可以用同一 Project 中较早一次准备的结果启动托管 Environm
 托管 Session 的有效 `network` 在部署的[网络上限](sandbox-deployment.md#network)内收窄，并且该策略在沙箱的整个生命周期内生效，包括包安装和设置命令：
 
 - `enabled`：沙箱可访问上限允许的范围。
-- `disabled`：沙箱只能访问 Core、Session 的模型提供商和主机 53 端口上的 DNS 服务器。模型提供商仅在公开地址上的 `base_url` 端口可达；私有的模型提供商主机只有在上限的额外域名列出其精确名称时才可达。需要网络的包安装和设置命令按普通设置错误失败。
-- `restricted`：沙箱可访问所列域名、Core 和模型提供商（条件同 `disabled`）。上限允许公网时，域名在公开地址上被允许；域名属于上限的额外域名时，在其解析出的地址上被允许。其他域名在创建 Session 时被拒绝，错误码为 `sandbox_network_outside_cap`，`param` 指向该 `allowed_domains` 条目。上限之后缩小时，沙箱尝试以同一错误失败。
+- `disabled`：沙箱只能访问 Core、Session 的模型提供商和主机 53 端口上的 DNS 服务器。模型提供商仅在公开地址上的 `base_url` 端口可达；私有的模型提供商主机只有在上限的额外域名覆盖其名称时才可达。需要网络的包安装和设置命令按普通设置错误失败。
+- `restricted`：沙箱可访问所列域名、Core 和模型提供商（条件同 `disabled`）。上限允许公网时，域名在公开地址上被允许；上限的额外域名按名称或 `*.` 条目覆盖该域名时，在其解析出的地址上被允许。其他域名在创建 Session 时被拒绝，错误码为 `sandbox_network_outside_cap`，`param` 指向该 `allowed_domains` 条目。上限之后缩小时，沙箱尝试以同一错误失败。
 
 限制（[适配器规则](../../../docs/zh/sandbox-provider.md#network-egress)）：
 
-- 上限列出的模型提供商主机与所列域名一样可达，不限于其端口。
-- 在 microsandbox 上，不能访问公网的沙箱（`disabled`、`restricted`，或上限不允许公网时的 `enabled`）恢复后，在公网地址上放行的域名（包括模型提供商）除明文 HTTP 外只能经其名称在恢复时的地址访问；同一地址上的其他站点也可访问。
+- 上限按名称或 `*.` 条目列出的模型提供商主机与所列域名一样可达，不限于其端口。
 - 在 E2B 上，受限域名只能通过 80 和 443 端口访问；模型提供商使用其他端口时，其公网地址的所有端口均可达。
 
 部署的沙箱 Provider 无法限制出站时，`disabled` 和 `restricted` 返回 `sandbox_network_unsupported`。`self_hosted` Environment 只接受 `enabled`，因为 Core 无法在不由它运行的机器上强制策略。
diff --git a/contracts/agents-api/zh/index.md b/contracts/agents-api/zh/index.md
index 8c165ba68..16d3715d9 100644
--- a/contracts/agents-api/zh/index.md
+++ b/contracts/agents-api/zh/index.md
@@ -1,7 +1,7 @@
 ---
 title: "OpenAI 兼容性"
 source: contracts/agents-api/index.md
-source_hash: e40f743525e7a4a41df4dfd1dbcacfc187bf5bb169652613d48031fe3fa850ef
+source_hash: 0cf1499e96991dcf395556149664fee7659d17db35c8cee0853e399d6c57d807
 ---
 
 Core 实现下方固定版本的 OpenAI Agents API。本台账列出各项资源的覆盖情况、相对于官方服务的所有差异以及已知缺口。
@@ -163,7 +163,7 @@ Core 自身字段位于 `x_agents_core` 中（[Core extensions](../../../docs/zh
 
 - Hosted 工作区准入受[租户容量策略](../../../docs/zh/configuration.md#tenant-capacity)及既有[输入预留截止时间](environments.md#reservations)限制。
 - MiniMax Code 未声明 `retained_native_history`，因此无法在 microsandbox 上运行（其每个 Environment 都使用工作区存储）；Core 会拒绝该 Session（[Harness 能力](./harness-capabilities.md)）。
-- 模型提供商在公开地址上的端口从沙箱内始终可达，因为 Harness 运行在那里，私有的模型提供商主机只有在网络上限列出其名称时才可达；`disabled` 下主机 53 端口上的 DNS 服务器仍可达；Environment 中的 MCP 连接遵循部署的[网络上限](sandbox-deployment.md#network)。不能访问公网的 microsandbox 沙箱恢复后，与其放行域名同一地址上的其他站点也可访问（[限制](environments.md#restricted-network)）。E2B 沙箱无法访问私有网络，且在任何上限下 `169.254.169.254` 都会在 E2B 沙箱内应答。
+- 模型提供商在公开地址上的端口从沙箱内始终可达，因为 Harness 运行在那里，私有的模型提供商主机只有在网络上限列出其名称时才可达；`disabled` 下主机 53 端口上的 DNS 服务器仍可达；Environment 中的 MCP 连接遵循部署的[网络上限](sandbox-deployment.md#network)。E2B 沙箱无法访问私有网络，且在任何上限下 `169.254.169.254` 都会在 E2B 沙箱内应答。
 - `disabled` 和 `restricted` 网络在沙箱 Provider 能限制出站的托管 Environment 上运行，并受部署网络上限约束；`self_hosted` Environment 只接受 `enabled`。官方 API 接受带前导点的 `allowed_domains` 条目（如 `.example.com`），含义未规定，Core 拒绝它（[restricted network policy](environments.md#restricted-network)）。
 - 除 null 或空列表以外的 `packages.system` 都会被拒绝；系统软件包必须预先安装。
 - `Environment.files` 列出 Session 创建时记录的文件；之后通过 Environment files API 创建的文件不会出现。
diff --git a/contracts/agents-api/zh/sandbox-deployment.md b/contracts/agents-api/zh/sandbox-deployment.md
index 492702dfe..b90b40996 100644
--- a/contracts/agents-api/zh/sandbox-deployment.md
+++ b/contracts/agents-api/zh/sandbox-deployment.md
@@ -1,7 +1,7 @@
 ---
 title: "沙箱部署"
 source: contracts/agents-api/sandbox-deployment.md
-source_hash: 0d245fcadbcc3b56f82a596c2bb1fd294e3e278b394f92aebe08e3d43efc45b9
+source_hash: a69bd56121ccce58f25e5853f65596fc514508834dbf999ed373d7b294c2ffc8
 ---
 
 沙箱部署为 Core 管理的 `openai_hosted` 执行选择沙箱提供商和每个沙箱的资源。PostgreSQL 为每个安装维护一个当前有效选择；Web 和 Core API 写入同一配置。节点文件保存其已安装副本和特定于主机的路径，且不能覆盖其资源。Runtime 不属于该选择：每个节点运行其所属安装验证过的 Runtime。该选择独立于 Harness。部署可以保持未配置状态，没有节点；此时它拒绝托管准入。
@@ -66,14 +66,14 @@ microsandbox 会配置 CPU、内存和托管根磁盘，并在挂载于 `/enviro
 
 ### 网络 {#network}
 
-当 Environment 的 `network.access` 为 `enabled` 或省略时，`network` 限定该部署的每个沙箱最多能访问什么。到 Core 的连接和 Session 的模型提供商在公开地址上的端口始终可达，因为 Harness 运行在沙箱内。要访问私有地址上的模型提供商，请把其精确主机名列入 `domains`。Environment 中的 MCP 连接与其他流量一样遵循该上限。
+当 Environment 的 `network.access` 为 `enabled` 或省略时，`network` 限定该部署的每个沙箱最多能访问什么。到 Core 的连接和 Session 的模型提供商在公开地址上的端口始终可达，因为 Harness 运行在沙箱内。要访问私有地址上的模型提供商，请把其主机名或覆盖它的 `*.` 条目列入 `domains`。Environment 中的 MCP 连接与其他流量一样遵循该上限。
 
 | 字段 | 可接受的值 |
 | --- | --- |
-| `public` | 布尔值。`true` 允许公开地址；`false` 只允许 Core、模型提供商和 `domains`（[microsandbox 恢复后的限制](environments.md#restricted-network)） |
-| `domains` | 最多 100 个精确主机名，每个不超过 253 个字符，由小写字母、数字、连字符和点组成，且最后一个标签以字母开头。通配符、IP 字面量、端口和 URL 会被拒绝。Core 以小写、去重并排序的形式存储。名称解析出的每个地址都被允许，包括私有地址 |
+| `public` | 布尔值。`true` 允许公开地址；`false` 只允许 Core、模型提供商和 `domains` |
+| `domains` | 最多 100 个条目，每个不超过 253 个字符，为精确主机名或 `*.` 加主机名，由小写字母、数字、连字符和点组成，且最后一个标签以字母开头。`*.example.com` 覆盖 `example.com` 任意层级的子域名，但不含 `example.com` 本身，后者需要单独条目；其他通配符、IP 字面量、端口和 URL 会被拒绝。Core 以小写、去重并排序的形式存储。名称解析出的每个地址都被允许，包括私有地址 |
 
-默认值为 `{"public": true, "domains": []}`。无论哪种上限，回环、链路本地、云元数据地址以及其他所有私有地址始终被阻止，但 E2B 无法阻止元数据地址 169.254.169.254，且 E2B 沙箱根本无法访问私有网络。地址在沙箱启动和恢复时解析，因此两次解析之间应答变化的名称不会被跟随。沙箱保留创建它的代次的上限。
+默认值为 `{"public": true, "domains": []}`。无论哪种上限，回环、链路本地、云元数据地址以及其他所有私有地址始终被阻止，但 E2B 无法阻止元数据地址 169.254.169.254，且 E2B 沙箱根本无法访问私有网络。在 microsandbox 上，对与沙箱同时解析过的顶级域共享同一地址的子域名发起的明文（非 TLS）连接会被拒绝。沙箱保留创建它的代次的上限。
 
 每个 Provider 声明自己能强制执行什么（[Sandbox Provider 协议](../../../docs/zh/sandbox-provider.md#network-egress)）：microsandbox 支持两个字段，E2B 支持 `public: false` 但不支持 `domains`，因为 E2B 沙箱无法访问私有网络。所选 Provider 未声明的上限会返回 400 `invalid_sandbox_configuration`，`param` 为 `network.public` 或 `network.domains`。
 
diff --git a/deploy/node/node_spec.py b/deploy/node/node_spec.py
index 0a560fff1..609b0dc4d 100644
--- a/deploy/node/node_spec.py
+++ b/deploy/node/node_spec.py
@@ -24,7 +24,7 @@ class UnrecordedIdentity(SpecificationError):
 
 # BEGIN GENERATED DEPLOYMENT CONTRACT
 # Generated from sandbox/deployment_contract.go; do not edit.
-_CONTRACT = json.loads("{\"workspace_fields\":[\"attachment\",\"user_xattr\",\"capacity_quota\"],\"resources\":[{\"name\":\"cpus\",\"min\":1,\"max\":255,\"omit_zero\":false},{\"name\":\"memory_mib\",\"min\":512,\"max\":1048576,\"omit_zero\":false},{\"name\":\"root_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true},{\"name\":\"environment_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true}],\"network\":{\"max_domains\":100,\"max_domain_length\":253,\"domain_pattern\":\"^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\\\.)*[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$\"},\"providers\":{\"e2b\":{\"mode\":\"direct\",\"disk\":false,\"default_resources\":null,\"network\":{\"restrict\":true,\"private_domains\":false}},\"microsandbox\":{\"mode\":\"nodes\",\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true},\"disk\":true,\"default_resources\":{\"cpus\":2,\"memory_mib\":4096,\"root_disk_mib\":8192},\"network\":{\"restrict\":true,\"private_domains\":true}}},\"minimum_disk\":1024}")
+_CONTRACT = json.loads("{\"workspace_fields\":[\"attachment\",\"user_xattr\",\"capacity_quota\"],\"resources\":[{\"name\":\"cpus\",\"min\":1,\"max\":255,\"omit_zero\":false},{\"name\":\"memory_mib\",\"min\":512,\"max\":1048576,\"omit_zero\":false},{\"name\":\"root_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true},{\"name\":\"environment_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true}],\"network\":{\"max_domains\":100,\"max_domain_length\":253,\"domain_pattern\":\"^(?:\\\\*\\\\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\\\.)*[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$\"},\"providers\":{\"e2b\":{\"mode\":\"direct\",\"disk\":false,\"default_resources\":null,\"network\":{\"restrict\":true,\"private_domains\":false}},\"microsandbox\":{\"mode\":\"nodes\",\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true},\"disk\":true,\"default_resources\":{\"cpus\":2,\"memory_mib\":4096,\"root_disk_mib\":8192},\"network\":{\"restrict\":true,\"private_domains\":true}}},\"minimum_disk\":1024}")
 # END GENERATED DEPLOYMENT CONTRACT
 
 
diff --git a/docs/sandbox-provider.md b/docs/sandbox-provider.md
index 3264e51d1..0dbe474f6 100644
--- a/docs/sandbox-provider.md
+++ b/docs/sandbox-provider.md
@@ -198,13 +198,13 @@ A Provider declares `DeploymentPolicy.Network`: `Restrict` means it can refuse p
 Core sends the same `Egress` in `Bootstrap` and in every `ResumeRequest`, derived from the allocation's deployment generation, its Session's frozen Environment `network` policy and its frozen model provider. `disabled` leaves only `Endpoints`; `restricted` clears `Public` and lists the allowed domains in `PrivateDomains` when the cap names them and in `Domains` otherwise ([policy](../contracts/agents-api/environments.md#restricted-network)):
 
 - `Public`: public addresses are allowed.
-- `PrivateDomains`: exact host names whose resolved addresses, private ones included, are allowed.
+- `PrivateDomains`: exact host names, or `*.example.com` for its subdomains but not `example.com` itself, whose resolved addresses, private ones included, are allowed.
 - `Domains`: exact host names allowed on public addresses only; a private answer stays blocked. They carry a `restricted` Environment's `allowed_domains` when the cap allows the public internet.
 - `Endpoints`: `host:port` entries (`net.JoinHostPort` form) for the model provider's `base_url`, with the port from the URL or 443 for https and 80 for http, omitted when the host is loopback. The Harness runs in the sandbox and calls it directly. An entry allows that TCP port on public addresses only, never a private address. When the cap lists the model host's name in its extra domains, Core also adds that name to `PrivateDomains`, so a private model host keeps working under every policy.
 
-The Provider enforces exactly this on top of the always-allowed connection to Core, and blocks loopback, link-local, cloud-metadata and every private address that `Egress` does not name, except that E2B cannot block the metadata address 169.254.169.254. It resolves names with its host's DNS when it creates and when it resumes, and cannot follow later changes of an answer. A name that does not resolve gets no rule. MCP traffic has no entry: it follows `Public`, `PrivateDomains` and `Domains`.
+The Provider enforces exactly this on top of the always-allowed connection to Core, and blocks loopback, link-local, cloud-metadata and every private address that `Egress` does not name, except that E2B cannot block the metadata address 169.254.169.254. It resolves the Core host with its host's DNS when it creates and when it resumes. MCP traffic has no entry: it follows `Public`, `PrivateDomains` and `Domains`.
 
-microsandbox applies the rules with first-match order, default deny, and host DNS reachable; it allows the resolved private addresses without a port so that DNS rebind protection passes them. Its restore cannot turn strict hostname enforcement off, under which a domain allow passes only plaintext protocols where the client speaks first, such as HTTP, so a restored sandbox that is not `Public` also allows the public addresses each name of `Domains`, `PrivateDomains` and `Endpoints` resolves to at restore, on the same ports. E2B declares `Restrict` only: `Public` adds a deny list for loopback, private and link-local ranges, and not `Public` denies all IPv4 and IPv6 traffic except the Core host, `Endpoints` and `Domains`. E2B matches a host name only on ports 80 and 443, so the adapter also allows the global IPv4 addresses of the Core host and of each Endpoint on any other port. An IP literal is allowed only as a global address range of one address, and a private literal gets no rule.
+microsandbox applies the rules with first-match order, default deny, and host DNS reachable, on create and restore alike, with strict hostname enforcement and DNS rebind protection off. A name becomes a port-less domain allow that the sandbox's own DNS answers resolve, private addresses included. A `*.example.com` entry becomes the suffix allow `.example.com`, which would also match `example.com`, so the adapter first denies `example.com` unless this `Egress` allows it by name; a plain-text connection to a subdomain that shares an address with a resolved apex is therefore refused. E2B declares `Restrict` only: `Public` adds a deny list for loopback, private and link-local ranges, and not `Public` denies all IPv4 and IPv6 traffic except the Core host, `Endpoints` and `Domains`. E2B matches a host name only on ports 80 and 443, so the adapter also allows the global IPv4 addresses of the Core host and of each Endpoint on any other port. An IP literal is allowed only as a global address range of one address, and a private literal gets no rule.
 
 ## Checkpoint lifecycle
 
diff --git a/docs/zh/sandbox-provider.md b/docs/zh/sandbox-provider.md
index 583887f14..05de8ed31 100644
--- a/docs/zh/sandbox-provider.md
+++ b/docs/zh/sandbox-provider.md
@@ -1,7 +1,7 @@
 ---
 title: "沙箱提供商协议"
 source: docs/sandbox-provider.md
-source_hash: f6f2e826a7857ca1c7bc5a6c58dcacfb044aa1627abf1b42f4b5ac4d2cd06d62
+source_hash: 3dbc7425670beb1cbd82821b52020585526ec7d112616d85580f5835b6cf4ac9
 ---
 
 沙箱提供商协议连接 Core 与为 Core 管理的（`openai_hosted`）Environment 提供计算资源的 adapter，并由该 adapter 运行启动 Runtime daemon 的有界引导流程。本页面向 adapter 作者：说明提供商必须实现什么，以及可以依赖 Core 做什么。microsandbox 和 E2B 实现了该协议。
@@ -200,13 +200,13 @@ Provider 声明 `DeploymentPolicy.Network`：`Restrict` 表示能拒绝公开地
 Core 在 `Bootstrap` 和每个 `ResumeRequest` 中发送同一个 `Egress`，它由分配所属的部署代次和 Session 冻结的 Environment `network` 策略和冻结的模型提供商推导而来。`disabled` 只留下 `Endpoints`；`restricted` 清除 `Public`，上限列出的域名放入 `PrivateDomains`，其余放入 `Domains`（[策略](../../contracts/agents-api/zh/environments.md#restricted-network)）：
 
 - `Public`：允许公开地址。
-- `PrivateDomains`：精确主机名，其解析出的地址（包括私有地址）都被允许。
+- `PrivateDomains`：精确主机名，或 `*.example.com`（覆盖其子域名，不含 `example.com` 本身），其解析出的地址（包括私有地址）都被允许。
 - `Domains`：只在公开地址上被允许的精确主机名，私有应答仍被阻止。上限允许公网时，它们承载 `restricted` Environment 的 `allowed_domains`。
 - `Endpoints`：模型提供商 `base_url` 的 `host:port` 条目（`net.JoinHostPort` 形式），端口取自 URL，https 默认 443，http 默认 80，主机为回环时省略。Harness 运行在沙箱内，直接调用它。条目只允许该 TCP 端口在公开地址上的访问，绝不包括私有地址。上限的额外域名列出了模型主机名时，Core 还会把该名称加入 `PrivateDomains`，使私有模型主机在任何策略下都能工作。
 
-Provider 在始终允许到 Core 的连接之上严格执行这些内容，并阻止回环、链路本地、云元数据以及 `Egress` 未列出的所有私有地址，但 E2B 无法阻止元数据地址 169.254.169.254。它在创建和恢复时用主机 DNS 解析名称，无法跟随之后应答的变化。无法解析的名称没有规则。MCP 流量没有条目：它遵循 `Public`、`PrivateDomains` 和 `Domains`。
+Provider 在始终允许到 Core 的连接之上严格执行这些内容，并阻止回环、链路本地、云元数据以及 `Egress` 未列出的所有私有地址，但 E2B 无法阻止元数据地址 169.254.169.254。它在创建和恢复时用主机 DNS 解析 Core 主机。MCP 流量没有条目：它遵循 `Public`、`PrivateDomains` 和 `Domains`。
 
-microsandbox 按首条匹配的顺序、默认拒绝并保持主机 DNS 可达来应用规则；它不带端口地允许解析出的私有地址，使 DNS rebind 保护放行它们。它的恢复无法关闭严格主机名校验，而该校验下域名放行规则只放行由客户端先发数据的明文协议（如 HTTP），因此非 `Public` 的沙箱恢复后，还会在相同端口上允许 `Domains`、`PrivateDomains` 和 `Endpoints` 中每个名称在恢复时解析出的公网地址。E2B 只声明 `Restrict`：`Public` 时加入回环、私有和链路本地网段的拒绝列表，非 `Public` 时拒绝除 Core 主机、`Endpoints` 和 `Domains` 之外的全部 IPv4 和 IPv6 流量。E2B 只在 80 和 443 端口匹配主机名，因此 adapter 还会为 Core 主机和每个 Endpoint 在其他端口上允许其全球 IPv4 地址。IP 字面量只作为单地址的全球地址范围被允许，私有字面量没有规则。
+microsandbox 按首条匹配的顺序、默认拒绝并保持主机 DNS 可达来应用规则，创建与恢复相同，并关闭严格主机名校验和 DNS rebind 保护。名称成为不带端口的域名放行规则，沙箱自己的 DNS 应答解析出的地址（包括私有地址）都被放行。`*.example.com` 条目成为后缀放行规则 `.example.com`，它同样会匹配 `example.com`，因此 adapter 先拒绝 `example.com`，除非该 `Egress` 按名称放行了它；所以对与已解析的顶级域共享同一地址的子域名发起的明文连接会被拒绝。E2B 只声明 `Restrict`：`Public` 时加入回环、私有和链路本地网段的拒绝列表，非 `Public` 时拒绝除 Core 主机、`Endpoints` 和 `Domains` 之外的全部 IPv4 和 IPv6 流量。E2B 只在 80 和 443 端口匹配主机名，因此 adapter 还会为 Core 主机和每个 Endpoint 在其他端口上允许其全球 IPv4 地址。IP 字面量只作为单地址的全球地址范围被允许，私有字面量没有规则。
 
 ## 检查点生命周期 {#checkpoint-lifecycle}
 
diff --git a/packages/agents-client/src/deployment-contract.ts b/packages/agents-client/src/deployment-contract.ts
index c74a8787f..f13885a66 100644
--- a/packages/agents-client/src/deployment-contract.ts
+++ b/packages/agents-client/src/deployment-contract.ts
@@ -1,3 +1,3 @@
 // Code generated by services/core/cmd/specification-contract from sandbox/deployment_contract.go; DO NOT EDIT.
 
-export const deploymentContract = {"workspace_fields":["attachment","user_xattr","capacity_quota"],"resources":[{"name":"cpus","min":1,"max":255,"omit_zero":false},{"name":"memory_mib","min":512,"max":1048576,"omit_zero":false},{"name":"root_disk_mib","min":0,"max":4294967295,"omit_zero":true},{"name":"environment_disk_mib","min":0,"max":4294967295,"omit_zero":true}],"network":{"max_domains":100,"max_domain_length":253,"domain_pattern":"^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"providers":{"e2b":{"mode":"direct","disk":false,"default_resources":null,"network":{"restrict":true,"private_domains":false},"setup":{"label":"E2B","summary":{"en":"Runs sandboxes in a hosted E2B-compatible cloud: no machines to manage, billed by the service.","zh-CN":"沙箱运行在托管的 E2B 兼容云端：无需管理机器，由服务方计费。"},"recommended":false,"fields":[{"name":"api_key","secret":true,"optional":false,"discovered":false,"label":{"en":"API key","zh-CN":"API 密钥"},"help":{"en":"","zh-CN":""}},{"name":"template","secret":false,"optional":false,"discovered":true,"label":{"en":"Template build","zh-CN":"模板构建"},"help":{"en":"Core validates the exact ready build again when you save.","zh-CN":"保存时 Core 会再次校验这个已就绪的构建。"}},{"name":"api_url","secret":false,"optional":true,"discovered":false,"label":{"en":"Sandbox API URL","zh-CN":"沙箱 API 地址"},"help":{"en":"The selected service supplies a default. You can edit it for a compatible endpoint.","zh-CN":"所选服务会提供默认值，兼容的端点可以自行修改。"}},{"name":"domain","secret":false,"optional":true,"discovered":false,"label":{"en":"Sandbox data-plane domain","zh-CN":"沙箱数据面域名"},"help":{"en":"","zh-CN":""}}],"presets":[{"label":"SandBase Sandbox","values":{"api_url":"https://sandbox.sandbase.ai","domain":"sandbox.sandbase.ai"},"credential_url":"https://www.sandbase.ai/console/keys"},{"label":"E2B","values":{"api_url":"https://api.e2b.app","domain":"e2b.app"},"credential_url":"https://e2b.dev/dashboard?tab=api-keys"}],"credential":"required","public_origin":"required","discovery":true}},"microsandbox":{"mode":"nodes","workspace":{"attachment":"host_directory","user_xattr":true},"disk":true,"default_resources":{"cpus":2,"memory_mib":4096,"root_disk_mib":8192},"network":{"restrict":true,"private_domains":true},"setup":{"label":"microsandbox","summary":{"en":"Runs each sandbox as a lightweight virtual machine: stronger isolation and a root disk size limit, with each sandbox's /environment on workspace storage, but the host needs KVM.","zh-CN":"每个沙箱是一个轻量虚拟机：隔离更强，能限制根盘大小，每个沙箱的 /environment 位于工作区存储上，但主机需要支持 KVM。"},"recommended":true,"fields":[],"presets":[],"credential":"not_required","public_origin":"not_required","discovery":false}}},"minimum_disk":1024} as const;
+export const deploymentContract = {"workspace_fields":["attachment","user_xattr","capacity_quota"],"resources":[{"name":"cpus","min":1,"max":255,"omit_zero":false},{"name":"memory_mib","min":512,"max":1048576,"omit_zero":false},{"name":"root_disk_mib","min":0,"max":4294967295,"omit_zero":true},{"name":"environment_disk_mib","min":0,"max":4294967295,"omit_zero":true}],"network":{"max_domains":100,"max_domain_length":253,"domain_pattern":"^(?:\\*\\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"providers":{"e2b":{"mode":"direct","disk":false,"default_resources":null,"network":{"restrict":true,"private_domains":false},"setup":{"label":"E2B","summary":{"en":"Runs sandboxes in a hosted E2B-compatible cloud: no machines to manage, billed by the service.","zh-CN":"沙箱运行在托管的 E2B 兼容云端：无需管理机器，由服务方计费。"},"recommended":false,"fields":[{"name":"api_key","secret":true,"optional":false,"discovered":false,"label":{"en":"API key","zh-CN":"API 密钥"},"help":{"en":"","zh-CN":""}},{"name":"template","secret":false,"optional":false,"discovered":true,"label":{"en":"Template build","zh-CN":"模板构建"},"help":{"en":"Core validates the exact ready build again when you save.","zh-CN":"保存时 Core 会再次校验这个已就绪的构建。"}},{"name":"api_url","secret":false,"optional":true,"discovered":false,"label":{"en":"Sandbox API URL","zh-CN":"沙箱 API 地址"},"help":{"en":"The selected service supplies a default. You can edit it for a compatible endpoint.","zh-CN":"所选服务会提供默认值，兼容的端点可以自行修改。"}},{"name":"domain","secret":false,"optional":true,"discovered":false,"label":{"en":"Sandbox data-plane domain","zh-CN":"沙箱数据面域名"},"help":{"en":"","zh-CN":""}}],"presets":[{"label":"SandBase Sandbox","values":{"api_url":"https://sandbox.sandbase.ai","domain":"sandbox.sandbase.ai"},"credential_url":"https://www.sandbase.ai/console/keys"},{"label":"E2B","values":{"api_url":"https://api.e2b.app","domain":"e2b.app"},"credential_url":"https://e2b.dev/dashboard?tab=api-keys"}],"credential":"required","public_origin":"required","discovery":true}},"microsandbox":{"mode":"nodes","workspace":{"attachment":"host_directory","user_xattr":true},"disk":true,"default_resources":{"cpus":2,"memory_mib":4096,"root_disk_mib":8192},"network":{"restrict":true,"private_domains":true},"setup":{"label":"microsandbox","summary":{"en":"Runs each sandbox as a lightweight virtual machine: stronger isolation and a root disk size limit, with each sandbox's /environment on workspace storage, but the host needs KVM.","zh-CN":"每个沙箱是一个轻量虚拟机：隔离更强，能限制根盘大小，每个沙箱的 /environment 位于工作区存储上，但主机需要支持 KVM。"},"recommended":true,"fields":[],"presets":[],"credential":"not_required","public_origin":"not_required","discovery":false}}},"minimum_disk":1024} as const;
diff --git a/services/core/internal/execution/network_egress.go b/services/core/internal/execution/network_egress.go
index d374677a8..815f831e8 100644
--- a/services/core/internal/execution/network_egress.go
+++ b/services/core/internal/execution/network_egress.go
@@ -57,7 +57,7 @@ func admitNetwork(support sandbox.NetworkSupport, network sandbox.Network, polic
 // egressFor applies the cap and the Environment policy. The Harness runs inside
 // the sandbox, so the port of the Session's model provider is always reachable
 // on public addresses; a loopback host is the sandbox itself and needs no
-// entry. A model host the cap lists by name also joins PrivateDomains, so a
+// entry. A model host the cap covers, by name or "*.suffix", also joins PrivateDomains as its exact name, so a
 // private model host keeps working under every policy. A nil policy equals
 // enabled.
 func egressFor(network sandbox.Network, policy *v1.EnvironmentNetworkInput, modelBaseURL string) (sandbox.Egress, error) {
@@ -67,7 +67,7 @@ func egressFor(network sandbox.Network, policy *v1.EnvironmentNetworkInput, mode
 		for i, domain := range policy.AllowedDomains {
 			name := strings.ToLower(domain)
 			switch {
-			case slices.Contains(network.Domains, name):
+			case inCap(network.Domains, name):
 				egress.PrivateDomains = append(egress.PrivateDomains, name)
 			case network.Public:
 				egress.Domains = append(egress.Domains, name)
@@ -87,7 +87,7 @@ func egressFor(network sandbox.Network, policy *v1.EnvironmentNetworkInput, mode
 			if _, _, err := sandbox.SplitEndpoint(endpoint); err == nil {
 				egress.Endpoints = append(egress.Endpoints, endpoint)
 			}
-			if slices.Contains(network.Domains, host) {
+			if inCap(network.Domains, host) {
 				egress.PrivateDomains = append(egress.PrivateDomains, host)
 			}
 		}
@@ -99,6 +99,15 @@ func egressFor(network sandbox.Network, policy *v1.EnvironmentNetworkInput, mode
 	return egress, nil
 }
 
+// inCap reports whether the cap lists name exactly or as a subdomain through a
+// "*.suffix" entry; the suffix itself is not covered.
+func inCap(domains []string, name string) bool {
+	return slices.ContainsFunc(domains, func(d string) bool {
+		suffix, wild := strings.CutPrefix(d, "*.")
+		return d == name || wild && strings.HasSuffix(name, "."+suffix)
+	})
+}
+
 func loopbackHost(host string) bool {
 	if host == "localhost" || strings.HasSuffix(host, ".localhost") {
 		return true
diff --git a/services/core/internal/execution/network_egress_test.go b/services/core/internal/execution/network_egress_test.go
index 742597fb6..7b319b44b 100644
--- a/services/core/internal/execution/network_egress_test.go
+++ b/services/core/internal/execution/network_egress_test.go
@@ -77,6 +77,21 @@ func TestEnvironmentPolicyNarrowsTheCap(t *testing.T) {
 	}
 }
 
+// "*.suffix" covers subdomains only, never the suffix itself; names it covers
+// reach PrivateDomains as exact names.
+func TestSuffixCapCoversSubdomainsOnly(t *testing.T) {
+	cap := sandbox.Network{Public: false, Domains: []string{"*.corp.example"}}
+	restricted := &v1.EnvironmentNetworkInput{Access: "restricted", AllowedDomains: []string{"git.corp.example", "a.b.corp.example"}}
+	got, err := egressFor(cap, restricted, "http://llm.corp.example:8000")
+	if want := []string{"a.b.corp.example", "git.corp.example", "llm.corp.example"}; err != nil || !reflect.DeepEqual(got.PrivateDomains, want) {
+		t.Fatalf("covered: %+v %v", got, err)
+	}
+	var typed *sandbox.ConfigurationError
+	if _, err = egressFor(cap, &v1.EnvironmentNetworkInput{Access: "restricted", AllowedDomains: []string{"corp.example"}}, ""); !errors.As(err, &typed) || typed.Code != "sandbox_network_outside_cap" {
+		t.Fatalf("apex: %v", err)
+	}
+}
+
 func TestAdmissionNeedsProviderSupport(t *testing.T) {
 	var typed *sandbox.ConfigurationError
 	for _, policy := range []*v1.EnvironmentNetworkInput{{Access: "disabled"}, {Access: "restricted", AllowedDomains: []string{"pypi.org"}}} {
diff --git a/services/core/internal/sandbox/network.go b/services/core/internal/sandbox/network.go
index f57d530c4..1cc478f0c 100644
--- a/services/core/internal/sandbox/network.go
+++ b/services/core/internal/sandbox/network.go
@@ -16,11 +16,16 @@ import (
 const (
 	maxNetworkDomains = 100
 	maxDomainLength   = 253
-	// domainPattern is the exact-host rule shared with the Environment network field.
-	domainPattern = agentnetwork.HostPattern
 )
 
-var domainRule = regexp.MustCompile(domainPattern)
+// domainPattern is the cap's rule: an exact host name as the Environment
+// network field accepts, or "*." and a host name for its subdomains.
+var domainPattern = `^(?:\*\.)?` + agentnetwork.HostPattern[1:]
+
+var (
+	domainRule = regexp.MustCompile(agentnetwork.HostPattern)
+	capRule    = regexp.MustCompile(domainPattern)
+)
 
 // networkRule is the generated projection of the network format rule.
 type networkRule struct {
@@ -32,8 +37,9 @@ type networkRule struct {
 var networkContract = networkRule{maxNetworkDomains, maxDomainLength, domainPattern}
 
 // Network is the deployment's egress cap: what its sandboxes may reach at most.
-// Domains are exact host names whose resolved addresses are allowed, private
-// ones included. Every other private, loopback and link-local address stays
+// Domains are exact host names, or "*.example.com" for its subdomains but not
+// example.com itself, whose resolved addresses are allowed, private ones
+// included. Every other private, loopback and link-local address stays
 // blocked, and the connection to Core is always allowed.
 type Network struct {
 	Public  bool     `json:"public" binding:"required"`
@@ -61,8 +67,8 @@ func (n Network) ValidatePolicy(provider string, support NetworkSupport) error {
 		return &ValidationError{Param: "network.domains", Message: fmt.Sprintf("%s: network.domains accepts at most %d domains", ErrInvalid, maxNetworkDomains)}
 	}
 	for _, d := range n.Domains {
-		if len(d) > maxDomainLength || !domainRule.MatchString(d) {
-			return &ValidationError{Param: "network.domains", Message: fmt.Sprintf("%s: %q is not an exact host name", ErrInvalid, d)}
+		if len(d) > maxDomainLength || !capRule.MatchString(d) {
+			return &ValidationError{Param: "network.domains", Message: fmt.Sprintf("%s: %q is not a host name or *.suffix", ErrInvalid, d)}
 		}
 	}
 	if !n.Public && !support.Restrict {
@@ -75,14 +81,15 @@ func (n Network) ValidatePolicy(provider string, support NetworkSupport) error {
 }
 
 // Validate checks an Egress a Provider receives: exact host names for
-// PrivateDomains and Domains and host:port entries for Endpoints.
+// Domains, "*." entries only in PrivateDomains, and host:port entries for
+// Endpoints.
 func (e Egress) Validate() error {
-	for _, names := range [][]string{e.PrivateDomains, e.Domains} {
+	for i, names := range [][]string{e.PrivateDomains, e.Domains} {
 		if len(names) > maxNetworkDomains {
 			return ErrInvalid
 		}
 		for _, d := range names {
-			if !ValidDomain(d) {
+			if !ValidDomain(d) && !(i == 0 && capRule.MatchString(d)) {
 				return ErrInvalid
 			}
 		}
diff --git a/services/core/internal/sandbox/network_test.go b/services/core/internal/sandbox/network_test.go
index 53fad7e80..e0c196d1b 100644
--- a/services/core/internal/sandbox/network_test.go
+++ b/services/core/internal/sandbox/network_test.go
@@ -15,7 +15,9 @@ func TestNetworkIsValidatedAgainstTheProviderDeclaration(t *testing.T) {
 		{"closed without support", Network{Domains: []string{}}, none, "network.public"},
 		{"domains", Network{Public: true, Domains: []string{"gitlab.example.com"}}, full, ""},
 		{"domains without support", Network{Public: true, Domains: []string{"gitlab.example.com"}}, closed, "network.domains"},
-		{"wildcard", Network{Public: true, Domains: []string{"*.example.com"}}, full, "network.domains"},
+		{"suffix", Network{Public: true, Domains: []string{"*.example.com"}}, full, ""},
+		{"inner wildcard", Network{Public: true, Domains: []string{"a.*.example.com"}}, full, "network.domains"},
+		{"bare wildcard", Network{Public: true, Domains: []string{"*"}}, full, "network.domains"},
 		{"address", Network{Public: true, Domains: []string{"10.0.0.1"}}, full, "network.domains"},
 	} {
 		err := tc.network.ValidatePolicy("test", tc.support)
@@ -35,3 +37,13 @@ func asValidation(err error, target **ValidationError) bool {
 	*target = v
 	return ok
 }
+
+// A "*." entry is a cap and PrivateDomains entry only; restricted names stay exact.
+func TestEgressAcceptsSuffixOnlyInPrivateDomains(t *testing.T) {
+	if err := (Egress{PrivateDomains: []string{"*.example.com"}, Domains: []string{"pypi.org"}}).Validate(); err != nil {
+		t.Fatal(err)
+	}
+	if (Egress{Domains: []string{"*.example.com"}}).Validate() == nil {
+		t.Fatal("suffix accepted in Domains")
+	}
+}
diff --git a/services/core/internal/sandbox/sandbox_provider.go b/services/core/internal/sandbox/sandbox_provider.go
index e036a000e..7e3b006c2 100644
--- a/services/core/internal/sandbox/sandbox_provider.go
+++ b/services/core/internal/sandbox/sandbox_provider.go
@@ -77,8 +77,10 @@ type Bootstrap struct {
 type Egress struct {
 	// Public allows every public address.
 	Public bool `json:"public"`
-	// PrivateDomains are exact host names the Provider resolves with the host's
-	// DNS; every address they resolve to is allowed, private ones included.
+	// PrivateDomains are exact host names, or "*.example.com" for its
+	// subdomains but not example.com itself, that the Provider resolves with
+	// the host's DNS; every address they resolve to is allowed, private ones
+	// included.
 	PrivateDomains []string `json:"private_domains"`
 	// Domains are exact host names the Provider allows on public addresses
 	// only; a private answer for them stays blocked.
diff --git a/services/core/internal/sandbox/testdata/deployment-contract.json b/services/core/internal/sandbox/testdata/deployment-contract.json
index eba213c34..4e03d1834 100644
--- a/services/core/internal/sandbox/testdata/deployment-contract.json
+++ b/services/core/internal/sandbox/testdata/deployment-contract.json
@@ -398,7 +398,7 @@
     "digest": "bfedd8252478cfeb7e927ccd9aab6e812e0a35405046db3cf023fe62a869de04"
   },
   {
-    "name": "network-wildcard-rejected",
+    "name": "network-inner-wildcard-rejected",
     "provider": "microsandbox",
     "specification": {
       "resources": {
@@ -415,7 +415,7 @@
       "network": {
         "public": true,
         "domains": [
-          "*.example.com"
+          "a.*.example.com"
         ]
       }
     },
diff --git a/services/core/tools/microsandbox-provider/README.md b/services/core/tools/microsandbox-provider/README.md
index 24ffb8814..0a157f8f6 100644
--- a/services/core/tools/microsandbox-provider/README.md
+++ b/services/core/tools/microsandbox-provider/README.md
@@ -20,7 +20,7 @@ The checkpoint root is a separate adapter-owned directory, mode 0700, with a pri
 
 ## Create and bootstrap
 
-Create names the VM from a hash of the installation and allocation reference plus the compute generation; a name never serves another incarnation. It creates the VM with the saved CPUs and memory as both initial and maximum, a managed root disk of `root_disk_mib`, the explicitly resolved workspace directory mounted at `/environment`, user 1000:1000, working directory `/` and the node's network policy ([`bootstrap.go`](bootstrap.go)). The resource checks run before bootstrap. Creation disables the SDK's strict hostname policy enforcement, so domain allows match by the guest's DNS answer and the TLS server name without TLS interception. Restore accepts only the policy and cannot disable it, so a restored sandbox that is not public also allows the public addresses each allowed name resolves to at restore, ahead of its domain allow ([`network.go`](network.go)).
+Create names the VM from a hash of the installation and allocation reference plus the compute generation; a name never serves another incarnation. It creates the VM with the saved CPUs and memory as both initial and maximum, a managed root disk of `root_disk_mib`, the explicitly resolved workspace directory mounted at `/environment`, user 1000:1000, working directory `/` and the node's network policy ([`bootstrap.go`](bootstrap.go)). The resource checks run before bootstrap. Create and restore both turn off strict hostname enforcement and DNS rebind protection, so domain allows match by the guest's DNS answer and the TLS server name without TLS interception ([`network.go`](network.go)).
 
 Workspace, staging and outputs share the `/environment` filesystem, which keeps the Runtime's cross-device and link checks intact; the layered root filesystem can report different device IDs for a directory and its upper-layer files, so it holds no workspace data. The filesystem provider owns the directory; sandbox removal never deletes it. The binding and resource rules belong to [Workspace filesystem protocol](../../../../docs/workspace-provider.md#attachment). The [Runtime bootstrap](../../../../docs/runtime-bootstrap.md) owns the Runtime directory layout.
 
diff --git a/services/core/tools/microsandbox-provider/backend.go b/services/core/tools/microsandbox-provider/backend.go
index 5d34afe42..d22621f32 100644
--- a/services/core/tools/microsandbox-provider/backend.go
+++ b/services/core/tools/microsandbox-provider/backend.go
@@ -115,10 +115,9 @@ func (b backend) kill(ctx context.Context, c wire.Compute) error {
 }
 
 // network builds the allocation's network policy for create or restore from
-// its Egress with the node host's DNS. Names that do not resolve are reported
-// to the node's log.
-func (b backend) network(ctx context.Context, egress sandbox.Egress, restore bool) (*sdk.NetworkConfig, error) {
-	return egressNetwork(ctx, b.q.Config.CoreURL, egress, restore, hostResolver, os.Stderr)
+// its Egress. Entries it cannot enforce are reported to the node's log.
+func (b backend) network(ctx context.Context, egress sandbox.Egress) (*sdk.NetworkConfig, error) {
+	return egressNetwork(ctx, b.q.Config.CoreURL, egress, os.Stderr)
 }
 
 func (b backend) resumeCompute(ctx context.Context, c wire.Compute) (wire.State, error) {
diff --git a/services/core/tools/microsandbox-provider/bootstrap.go b/services/core/tools/microsandbox-provider/bootstrap.go
index ef5f8ca17..e8d2f0daa 100644
--- a/services/core/tools/microsandbox-provider/bootstrap.go
+++ b/services/core/tools/microsandbox-provider/bootstrap.go
@@ -52,7 +52,7 @@ func (b backend) create(ctx context.Context) (wire.Response, error) {
 	for key, value := range workspaceLabels(b.q.Workspace) {
 		labels[key] = value
 	}
-	network, e := b.network(ctx, bootstrap.Egress, false)
+	network, e := b.network(ctx, bootstrap.Egress)
 	if e != nil {
 		return wire.Response{}, e
 	}
diff --git a/services/core/tools/microsandbox-provider/network.go b/services/core/tools/microsandbox-provider/network.go
index 6d957d89b..972a3256c 100644
--- a/services/core/tools/microsandbox-provider/network.go
+++ b/services/core/tools/microsandbox-provider/network.go
@@ -9,56 +9,42 @@ import (
 	"net/url"
 	"slices"
 	"strconv"
-	"sync"
+	"strings"
 	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	sdk "github.com/superradcompany/microsandbox/sdk/go"
 )
 
-// resolver looks a host name up with the node host's DNS.
-type resolver func(ctx context.Context, host string) ([]netip.Addr, error)
-
-func hostResolver(ctx context.Context, host string) ([]netip.Addr, error) {
-	return net.DefaultResolver.LookupNetIP(ctx, "ip", host)
-}
-
 var carrierGradeNAT = netip.MustParsePrefix("100.64.0.0/10")
 
 func isPrivate(a netip.Addr) bool { return a.IsPrivate() || carrierGradeNAT.Contains(a) }
 
-// resolveTimeout bounds all lookups of one egressNetwork call together.
+// resolveTimeout bounds the lookup of Core's address.
 const resolveTimeout = 5 * time.Second
 
-// egressNetwork builds one allocation's network policy; Create and Resume call
-// it with the same Egress, and restore tells which. Rules are first match with
+// egressNetwork builds one allocation's network policy; Create and Resume use
+// the same rules, with strict hostname enforcement and DNS rebind protection
+// off (restore sets the same two options itself). Rules are first match with
 // default deny:
 //  1. host DNS
 //  2. deny loopback, link-local and metadata
 //  3. each address of the Core host, on its port
-//  4. each private address that a PrivateDomains name resolves to, without
-//     port, because only a port-less address allow lets the guest's DNS answer
-//     pass rebind protection, which stays at its default; Endpoints never
-//     yield private addresses
-//  5. deny every other private address
-//  6. unless Public, a tcp allow on its port for each Endpoint (domain, or a
-//     public IP literal), and a port-less domain allow for each PrivateDomains
-//     and Domains name; only public answers reach a domain allow, since rule 5
-//     and rebind protection already refuse private ones; on restore the same
-//     allows for the public addresses these names resolve to now come first,
-//     since a domain allow that matches an address first refuses it
-//  7. public addresses, when Public
-//
-// Strict hostname enforcement accepts a domain allow over TLS only with TLS
-// interception, so create turns it off. Restore cannot (the SDK takes only the
-// policy there) and the domain allows of rule 6 no longer pass HTTPS, hence the
-// address allows, which miss later DNS changes. They go once restore can turn
-// strict enforcement off.
+//  4. a port-less domain allow for each exact PrivateDomains name; a
+//     port-less allow also lets the guest's DNS answer pass for private
+//     addresses
+//  5. public addresses, when Public
+//  6. for each "*.apex" PrivateDomains entry, deny the apex unless the apex is
+//     allowed by name in this Egress, then allow the suffix ".apex". A suffix
+//     rule matches the apex too but "*.apex" does not, and TLS flows are
+//     matched by SNI, so the deny is exact for HTTPS
+//  7. deny every other private address
+//  8. unless Public, a tcp allow on its port for each Endpoint (domain, or a
+//     public IP literal) and a port-less domain allow for each Domains name
 //
-// Core, PrivateDomains and, on restore, the rule 6 names are resolved together
-// under one deadline. A name that does not resolve gets no address rule and is
-// reported to report.
-func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, restore bool, resolve resolver, report io.Writer) (*sdk.NetworkConfig, error) {
+// A plain-text connection to a subdomain that shares an address with a
+// resolved apex is refused, since only the address is known there.
+func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, report io.Writer) (*sdk.NetworkConfig, error) {
 	core, err := url.Parse(coreURL)
 	if err != nil || core.Hostname() == "" {
 		return nil, sandbox.ErrInvalid
@@ -70,53 +56,13 @@ func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, r
 	if _, err := strconv.ParseUint(port, 10, 16); err != nil {
 		return nil, sandbox.ErrInvalid
 	}
-	names := slices.Concat(egress.PrivateDomains, egress.Domains)
-	slices.Sort(names)
-	names = slices.Compact(names)
-	pin := restore && !egress.Public
-	lookups := slices.Clone(egress.PrivateDomains)
-	if pin {
-		lookups = slices.Concat(names, endpointDomains(egress.Endpoints))
-	}
-	slices.Sort(lookups)
-	lookups = slices.Compact(lookups)
-
-	ctx, cancel := context.WithTimeout(ctx, resolveTimeout)
-	defer cancel()
-	var wg sync.WaitGroup
-	var coreAddresses []netip.Addr
-	var coreErr error
-	wg.Go(func() { coreAddresses, coreErr = addresses(ctx, core.Hostname(), resolve) })
-	found := make([][]netip.Addr, len(lookups))
-	failed := make([]error, len(lookups))
-	for i, name := range lookups {
-		wg.Go(func() { found[i], failed[i] = addresses(ctx, name, resolve) })
-	}
-	wg.Wait()
-	if coreErr != nil {
-		return nil, coreErr
-	}
-	var private []string
-	public := map[string][]string{}
-	for i, name := range lookups {
-		if failed[i] != nil {
-			fmt.Fprintf(report, "unresolved %s\n", name)
-			continue
-		}
-		for _, a := range found[i] {
-			if isPrivate(a) {
-				if slices.Contains(egress.PrivateDomains, name) {
-					private = append(private, a.String())
-				}
-			} else if pin && a.IsGlobalUnicast() {
-				public[name] = append(public[name], a.String())
-			}
-		}
+	coreAddresses, err := addresses(ctx, core.Hostname())
+	if err != nil {
+		return nil, err
 	}
-	slices.Sort(private)
-	private = slices.Compact(private)
 
-	n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny, DisableStrict: !restore}
+	off := false
+	n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny, DisableStrict: true, DNS: &sdk.DNSConfig{RebindProtection: &off}}
 	allow := func(destination, protocol, port string) {
 		n.Rules = append(n.Rules, sdk.PolicyRule{Action: sdk.PolicyActionAllow, Direction: sdk.PolicyDirectionEgress, Destination: destination, Protocol: sdk.PolicyProtocol(protocol), Port: port})
 	}
@@ -131,64 +77,60 @@ func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, r
 	for _, a := range coreAddresses {
 		allow(a.String(), "tcp", port)
 	}
-	for _, a := range private {
-		allow(a, "", "")
-	}
-	deny("private")
-	if !egress.Public {
-		var domains [][2]string
-		for _, endpoint := range egress.Endpoints {
-			host, p, err := sandbox.SplitEndpoint(endpoint)
-			if err != nil {
-				fmt.Fprintf(report, "unsupported %s\n", endpoint)
-			} else if a, err := netip.ParseAddr(host); err == nil {
-				if a = a.Unmap(); !isPrivate(a) {
-					allow(a.String(), "tcp", strconv.Itoa(p))
-				}
-			} else if sandbox.ValidDomain(host) {
-				for _, a := range public[host] {
-					allow(a, "tcp", strconv.Itoa(p))
-				}
-				domains = append(domains, [2]string{host, strconv.Itoa(p)})
-			} else {
-				fmt.Fprintf(report, "unsupported %s\n", endpoint)
-			}
-		}
-		for _, name := range names {
-			for _, a := range public[name] {
-				allow(a, "", "")
-			}
-		}
-		for _, d := range domains {
-			allow(d[0], "tcp", d[1])
-		}
-		for _, name := range names {
+	named := slices.Clone(egress.Domains)
+	var suffixes []string
+	for _, name := range egress.PrivateDomains {
+		if apex, ok := strings.CutPrefix(name, "*."); ok {
+			suffixes = append(suffixes, apex)
+		} else {
+			named = append(named, name)
 			allow(name, "", "")
 		}
 	}
+	var endpoints [][2]string
+	for _, endpoint := range egress.Endpoints {
+		host, p, err := sandbox.SplitEndpoint(endpoint)
+		ip, ipErr := netip.ParseAddr(host)
+		switch {
+		case err != nil || (ipErr != nil && !sandbox.ValidDomain(host)):
+			fmt.Fprintf(report, "unsupported %s\n", endpoint)
+		case ipErr == nil && isPrivate(ip.Unmap()):
+		default:
+			named = append(named, host)
+			endpoints = append(endpoints, [2]string{host, strconv.Itoa(p)})
+		}
+	}
 	if egress.Public {
 		allow("public", "", "")
 	}
-	return n, nil
-}
-
-// endpointDomains returns the host names of the Endpoints that name one.
-func endpointDomains(endpoints []string) []string {
-	var hosts []string
-	for _, endpoint := range endpoints {
-		if host, _, err := sandbox.SplitEndpoint(endpoint); err == nil && sandbox.ValidDomain(host) {
-			hosts = append(hosts, host)
+	for _, apex := range suffixes {
+		if !slices.Contains(named, apex) {
+			deny(apex)
 		}
 	}
-	return hosts
+	for _, apex := range suffixes {
+		allow("."+apex, "", "")
+	}
+	deny("private")
+	if !egress.Public {
+		for _, e := range endpoints {
+			allow(e[0], "tcp", e[1])
+		}
+		for _, name := range egress.Domains {
+			allow(name, "", "")
+		}
+	}
+	return n, nil
 }
 
 // addresses returns the sorted, unmapped addresses of a host name or literal.
-func addresses(ctx context.Context, host string, resolve resolver) ([]netip.Addr, error) {
+func addresses(ctx context.Context, host string) ([]netip.Addr, error) {
 	if a, err := netip.ParseAddr(host); err == nil {
 		return []netip.Addr{a.Unmap()}, nil
 	}
-	found, err := resolve(ctx, host)
+	ctx, cancel := context.WithTimeout(ctx, resolveTimeout)
+	defer cancel()
+	found, err := net.DefaultResolver.LookupNetIP(ctx, "ip", host)
 	if err != nil || len(found) == 0 {
 		return nil, fmt.Errorf("host did not resolve")
 	}
diff --git a/services/core/tools/microsandbox-provider/network_test.go b/services/core/tools/microsandbox-provider/network_test.go
index d5d2696b5..4e0c6afdf 100644
--- a/services/core/tools/microsandbox-provider/network_test.go
+++ b/services/core/tools/microsandbox-provider/network_test.go
@@ -3,42 +3,23 @@ package main
 import (
 	"bytes"
 	"context"
-	"errors"
 	"fmt"
-	"net/netip"
 	"strings"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
-func fixedDNS(table map[string][]string) resolver {
-	return func(_ context.Context, host string) ([]netip.Addr, error) {
-		answers, ok := table[host]
-		if !ok {
-			return nil, errors.New("no such host")
-		}
-		var out []netip.Addr
-		for _, a := range answers {
-			out = append(out, netip.MustParseAddr(a))
-		}
-		return out, nil
-	}
-}
-
-func rules(t *testing.T, egress sandbox.Egress, dns map[string][]string) (string, string) {
-	return policy(t, egress, false, dns)
-}
-
-func policy(t *testing.T, egress sandbox.Egress, restore bool, dns map[string][]string) (string, string) {
+func rules(t *testing.T, egress sandbox.Egress) (string, string) {
 	t.Helper()
 	var report bytes.Buffer
-	n, err := egressNetwork(context.Background(), "https://core.example.com:24443", egress, restore, fixedDNS(dns), &report)
+	n, err := egressNetwork(context.Background(), "https://172.29.144.1:24443", egress, &report)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if n.DefaultEgress != "deny" || n.DefaultIngress != "deny" || n.DisableStrict == restore || n.DNS != nil {
-		t.Fatalf("defaults or DNS options changed: %+v", n)
+	// Create and restore run with these options off.
+	if n.DefaultEgress != "deny" || n.DefaultIngress != "deny" || !n.DisableStrict || n.DNS == nil || *n.DNS.RebindProtection {
+		t.Fatalf("defaults or options changed: %+v", n)
 	}
 	var lines []string
 	for _, r := range n.Rules {
@@ -47,80 +28,56 @@ func policy(t *testing.T, egress sandbox.Egress, restore bool, dns map[string][]
 	return strings.Join(lines, "\n"), report.String()
 }
 
-func TestDefaultPolicyRules(t *testing.T) {
-	got, _ := rules(t, sandbox.Egress{Public: true, Endpoints: []string{"api.openai.com:443"}}, map[string][]string{
-		"core.example.com": {"172.29.144.1"}})
-	want := `allow host udp 53
+const head = `allow host udp 53
 allow host tcp 53
 deny loopback  
 deny link-local  
 deny metadata  
 allow 172.29.144.1 tcp 24443
-deny private  
-allow public  `
-	if got != want {
+`
+
+func TestDefaultPolicyRules(t *testing.T) {
+	got, _ := rules(t, sandbox.Egress{Public: true, Endpoints: []string{"api.openai.com:443"}})
+	if want := head + "allow public  \ndeny private  "; got != want {
 		t.Fatalf("rules:\n%s", got)
 	}
 }
 
-// Only PrivateDomains names yield port-less private allows; an Endpoint is
-// limited to its port and sits after "deny private".
-func TestEndpointIsPortLimitedAndNeverPrivate(t *testing.T) {
-	got, report := rules(t, sandbox.Egress{PrivateDomains: []string{"gitlab.example.com", "gone.example.com"}, Domains: []string{"pypi.org"},
-		Endpoints: []string{"models.example.com:8443", "203.0.113.9:8000", "10.1.2.3:8000"}}, map[string][]string{
-		"core.example.com": {"172.29.144.1"}, "gitlab.example.com": {"10.74.2.81", "8.8.8.8"}, "models.example.com": {"10.9.9.9"}})
-	want := `allow host udp 53
-allow host tcp 53
-deny loopback  
-deny link-local  
-deny metadata  
-allow 172.29.144.1 tcp 24443
-allow 10.74.2.81  
+// Exact cap names are port-less allows before "deny private"; an Endpoint is
+// limited to its port, a private IP literal is dropped, a bad one is reported.
+func TestNotPublicRules(t *testing.T) {
+	got, report := rules(t, sandbox.Egress{PrivateDomains: []string{"gitlab.example.com"}, Domains: []string{"pypi.org"},
+		Endpoints: []string{"models.example.com:8443", "203.0.113.9:8000", "10.1.2.3:8000", "bad host:1"}})
+	want := head + `allow gitlab.example.com  
 deny private  
-allow 203.0.113.9 tcp 8000
 allow models.example.com tcp 8443
-allow gitlab.example.com  
-allow gone.example.com  
+allow 203.0.113.9 tcp 8000
 allow pypi.org  `
-	if got != want {
-		t.Fatalf("rules:\n%s", got)
-	}
-	if report != "unresolved gone.example.com\n" {
-		t.Fatalf("report %q", report)
+	if got != want || report != "unsupported bad host:1\n" {
+		t.Fatalf("rules:\n%s\nreport %q", got, report)
 	}
 }
 
-// Restore keeps strict hostname enforcement, so the public addresses the names
-// resolve to are allowed ahead of every domain allow; private answers of a
-// Domains name or an Endpoint stay blocked.
-func TestRestorePinsPublicAddresses(t *testing.T) {
-	egress := sandbox.Egress{PrivateDomains: []string{"gitlab.example.com"}, Domains: []string{"pypi.org", "gone.example.com"},
-		Endpoints: []string{"models.example.com:8443"}}
-	dns := map[string][]string{"core.example.com": {"172.29.144.1"}, "gitlab.example.com": {"10.74.2.81", "8.8.8.8"},
-		"pypi.org": {"151.101.0.223", "10.1.1.1"}, "models.example.com": {"10.9.9.9", "2606:4700::1"}}
-	got, report := policy(t, egress, true, dns)
-	want := `allow host udp 53
-allow host tcp 53
-deny loopback  
-deny link-local  
-deny metadata  
-allow 172.29.144.1 tcp 24443
-allow 10.74.2.81  
-deny private  
-allow 2606:4700::1 tcp 8443
-allow 8.8.8.8  
-allow 151.101.0.223  
-allow models.example.com tcp 8443
-allow gitlab.example.com  
-allow gone.example.com  
-allow pypi.org  `
-	if got != want {
-		t.Fatalf("rules:\n%s", got)
-	}
-	if report != "unresolved gone.example.com\n" {
-		t.Fatalf("report %q", report)
+// A suffix rule matches the apex too, so each "*.apex" entry denies the apex
+// first unless this Egress allows the apex by name; public comes before it.
+func TestSuffixRules(t *testing.T) {
+	cases := []struct {
+		name   string
+		egress sandbox.Egress
+		want   string
+	}{
+		{"restricted", sandbox.Egress{Domains: []string{"example.com"}, PrivateDomains: []string{"*.corp.example", "git.corp.example"}},
+			head + "allow git.corp.example  \ndeny corp.example  \nallow .corp.example  \ndeny private  \nallow example.com  "},
+		{"enabled", sandbox.Egress{Public: true, PrivateDomains: []string{"*.corp.example", "git.corp.example", "llm.corp.example"}, Endpoints: []string{"api.minimaxi.com:443"}},
+			head + "allow git.corp.example  \nallow llm.corp.example  \nallow public  \ndeny corp.example  \nallow .corp.example  \ndeny private  "},
+		{"apex listed", sandbox.Egress{PrivateDomains: []string{"*.corp.example", "corp.example"}},
+			head + "allow corp.example  \nallow .corp.example  \ndeny private  "},
+		{"apex is a model host", sandbox.Egress{PrivateDomains: []string{"*.corp.example"}, Endpoints: []string{"corp.example:8000"}},
+			head + "allow .corp.example  \ndeny private  \nallow corp.example tcp 8000"},
 	}
-	if got, _ := policy(t, sandbox.Egress{Public: true, Domains: []string{"pypi.org"}}, true, dns); strings.Contains(got, "151.101.0.223") {
-		t.Fatalf("public egress pinned addresses:\n%s", got)
+	for _, tc := range cases {
+		if got, _ := rules(t, tc.egress); got != tc.want {
+			t.Fatalf("%s:\n%s", tc.name, got)
+		}
 	}
 }
diff --git a/services/core/tools/microsandbox-provider/snapshot.go b/services/core/tools/microsandbox-provider/snapshot.go
index 4ea6205b4..e326bc408 100644
--- a/services/core/tools/microsandbox-provider/snapshot.go
+++ b/services/core/tools/microsandbox-provider/snapshot.go
@@ -341,11 +341,12 @@ func (b backend) resume(ctx context.Context, q wire.ResumeRequest) (wire.State,
 	if q.ObserveOnly || q.Target.ID != "" {
 		return wire.State{}, wire.ErrUnconfirmed
 	}
-	network, e := b.network(ctx, q.Egress, true)
+	network, e := b.network(ctx, q.Egress)
 	if e != nil {
 		return wire.State{}, b.closeUndispatchedRestore(q, e)
 	}
-	restore := sdk.RestoreConfig{NetworkPolicy: network, ExternalMountPolicy: sdk.ExternalMountStrict,
+	off := false
+	restore := sdk.RestoreConfig{NetworkPolicy: network, Strict: &off, DNSRebindProtection: &off, ExternalMountPolicy: sdk.ExternalMountStrict,
 		Volumes: map[string]sdk.MountConfig{"/environment": sdk.Mount.Bind(b.q.Workspace.Path, sdk.MountOptions{})}}
 	if err := b.closeExpiredRestore(q); err != nil {
 		return wire.State{}, err

From c2dc9ab234bfdf1cba991a2dd31ae055b4a7e5b6 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 28 Oct 2026 07:48:48 +0000
Subject: [PATCH 2/6] Tighten the suffix notes and test the Web rule

State the plain-text limit once (sandbox-deployment), note why an Endpoint at
a suffix apex skips the apex deny, and test that the Web accepts *.suffix.
---
 .../src/features/sandbox/NetworkSettings.test.tsx |  4 ++--
 docs/sandbox-provider.md                          |  2 +-
 docs/zh/sandbox-provider.md                       |  4 ++--
 .../core/internal/execution/network_egress.go     |  6 +++---
 .../core/tools/microsandbox-provider/network.go   | 15 ++++++++-------
 5 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/apps/web/src/features/sandbox/NetworkSettings.test.tsx b/apps/web/src/features/sandbox/NetworkSettings.test.tsx
index a94afc2c1..f4b06f46c 100644
--- a/apps/web/src/features/sandbox/NetworkSettings.test.tsx
+++ b/apps/web/src/features/sandbox/NetworkSettings.test.tsx
@@ -8,8 +8,8 @@ const deployment = (provider: "microsandbox" | "e2b") => ({ provider, specificat
 
 describe("network policy", () => {
   it("validates domains with the generated rule", () => {
-    expect(domainIssues(parseDomains("gitlab.example.com\n\n a.b-c.example \nGit.Example.com"))).toEqual([]);
-    expect(domainIssues(["*.example.com", "-x.com", "a.com", "a.com", "a".repeat(254)]).map((issue) => issue.problem)).toEqual(["invalid", "invalid", "duplicate", "too_long"]);
+    expect(domainIssues(parseDomains("gitlab.example.com\n\n a.b-c.example \nGit.Example.com\n*.corp.example"))).toEqual([]);
+    expect(domainIssues(["a.*.example.com", "-x.com", "a.com", "a.com", "a".repeat(254)]).map((issue) => issue.problem)).toEqual(["invalid", "invalid", "duplicate", "too_long"]);
     expect(domainIssues(Array.from({ length: 101 }, (_, index) => `h${index}.example.com`))).toEqual([{ problem: "too_many" }]);
   });
 
diff --git a/docs/sandbox-provider.md b/docs/sandbox-provider.md
index 0dbe474f6..27786160f 100644
--- a/docs/sandbox-provider.md
+++ b/docs/sandbox-provider.md
@@ -204,7 +204,7 @@ Core sends the same `Egress` in `Bootstrap` and in every `ResumeRequest`, derive
 
 The Provider enforces exactly this on top of the always-allowed connection to Core, and blocks loopback, link-local, cloud-metadata and every private address that `Egress` does not name, except that E2B cannot block the metadata address 169.254.169.254. It resolves the Core host with its host's DNS when it creates and when it resumes. MCP traffic has no entry: it follows `Public`, `PrivateDomains` and `Domains`.
 
-microsandbox applies the rules with first-match order, default deny, and host DNS reachable, on create and restore alike, with strict hostname enforcement and DNS rebind protection off. A name becomes a port-less domain allow that the sandbox's own DNS answers resolve, private addresses included. A `*.example.com` entry becomes the suffix allow `.example.com`, which would also match `example.com`, so the adapter first denies `example.com` unless this `Egress` allows it by name; a plain-text connection to a subdomain that shares an address with a resolved apex is therefore refused. E2B declares `Restrict` only: `Public` adds a deny list for loopback, private and link-local ranges, and not `Public` denies all IPv4 and IPv6 traffic except the Core host, `Endpoints` and `Domains`. E2B matches a host name only on ports 80 and 443, so the adapter also allows the global IPv4 addresses of the Core host and of each Endpoint on any other port. An IP literal is allowed only as a global address range of one address, and a private literal gets no rule.
+microsandbox applies the rules with first-match order, default deny, and host DNS reachable, on create and restore alike, with strict hostname enforcement and DNS rebind protection off. A name becomes a port-less domain allow that the sandbox's own DNS answers resolve, private addresses included. A `*.example.com` entry becomes the suffix allow `.example.com`, which would also match `example.com`, so the adapter first denies `example.com` unless this `Egress` names it. E2B declares `Restrict` only: `Public` adds a deny list for loopback, private and link-local ranges, and not `Public` denies all IPv4 and IPv6 traffic except the Core host, `Endpoints` and `Domains`. E2B matches a host name only on ports 80 and 443, so the adapter also allows the global IPv4 addresses of the Core host and of each Endpoint on any other port. An IP literal is allowed only as a global address range of one address, and a private literal gets no rule.
 
 ## Checkpoint lifecycle
 
diff --git a/docs/zh/sandbox-provider.md b/docs/zh/sandbox-provider.md
index 05de8ed31..2db8b9257 100644
--- a/docs/zh/sandbox-provider.md
+++ b/docs/zh/sandbox-provider.md
@@ -1,7 +1,7 @@
 ---
 title: "沙箱提供商协议"
 source: docs/sandbox-provider.md
-source_hash: 3dbc7425670beb1cbd82821b52020585526ec7d112616d85580f5835b6cf4ac9
+source_hash: 228915769ce795bd38417f229d972ccafbf7280628cf3280c0f9bfddf4405537
 ---
 
 沙箱提供商协议连接 Core 与为 Core 管理的（`openai_hosted`）Environment 提供计算资源的 adapter，并由该 adapter 运行启动 Runtime daemon 的有界引导流程。本页面向 adapter 作者：说明提供商必须实现什么，以及可以依赖 Core 做什么。microsandbox 和 E2B 实现了该协议。
@@ -206,7 +206,7 @@ Core 在 `Bootstrap` 和每个 `ResumeRequest` 中发送同一个 `Egress`，它
 
 Provider 在始终允许到 Core 的连接之上严格执行这些内容，并阻止回环、链路本地、云元数据以及 `Egress` 未列出的所有私有地址，但 E2B 无法阻止元数据地址 169.254.169.254。它在创建和恢复时用主机 DNS 解析 Core 主机。MCP 流量没有条目：它遵循 `Public`、`PrivateDomains` 和 `Domains`。
 
-microsandbox 按首条匹配的顺序、默认拒绝并保持主机 DNS 可达来应用规则，创建与恢复相同，并关闭严格主机名校验和 DNS rebind 保护。名称成为不带端口的域名放行规则，沙箱自己的 DNS 应答解析出的地址（包括私有地址）都被放行。`*.example.com` 条目成为后缀放行规则 `.example.com`，它同样会匹配 `example.com`，因此 adapter 先拒绝 `example.com`，除非该 `Egress` 按名称放行了它；所以对与已解析的顶级域共享同一地址的子域名发起的明文连接会被拒绝。E2B 只声明 `Restrict`：`Public` 时加入回环、私有和链路本地网段的拒绝列表，非 `Public` 时拒绝除 Core 主机、`Endpoints` 和 `Domains` 之外的全部 IPv4 和 IPv6 流量。E2B 只在 80 和 443 端口匹配主机名，因此 adapter 还会为 Core 主机和每个 Endpoint 在其他端口上允许其全球 IPv4 地址。IP 字面量只作为单地址的全球地址范围被允许，私有字面量没有规则。
+microsandbox 按首条匹配的顺序、默认拒绝并保持主机 DNS 可达来应用规则，创建与恢复相同，并关闭严格主机名校验和 DNS rebind 保护。名称成为不带端口的域名放行规则，沙箱自己的 DNS 应答解析出的地址（包括私有地址）都被放行。`*.example.com` 条目成为后缀放行规则 `.example.com`，它同样会匹配 `example.com`，因此 adapter 先拒绝 `example.com`，除非该 `Egress` 中出现了这个名称。E2B 只声明 `Restrict`：`Public` 时加入回环、私有和链路本地网段的拒绝列表，非 `Public` 时拒绝除 Core 主机、`Endpoints` 和 `Domains` 之外的全部 IPv4 和 IPv6 流量。E2B 只在 80 和 443 端口匹配主机名，因此 adapter 还会为 Core 主机和每个 Endpoint 在其他端口上允许其全球 IPv4 地址。IP 字面量只作为单地址的全球地址范围被允许，私有字面量没有规则。
 
 ## 检查点生命周期 {#checkpoint-lifecycle}
 
diff --git a/services/core/internal/execution/network_egress.go b/services/core/internal/execution/network_egress.go
index 815f831e8..8899ef704 100644
--- a/services/core/internal/execution/network_egress.go
+++ b/services/core/internal/execution/network_egress.go
@@ -57,9 +57,9 @@ func admitNetwork(support sandbox.NetworkSupport, network sandbox.Network, polic
 // egressFor applies the cap and the Environment policy. The Harness runs inside
 // the sandbox, so the port of the Session's model provider is always reachable
 // on public addresses; a loopback host is the sandbox itself and needs no
-// entry. A model host the cap covers, by name or "*.suffix", also joins PrivateDomains as its exact name, so a
-// private model host keeps working under every policy. A nil policy equals
-// enabled.
+// entry. A model host the cap covers, by name or "*.suffix", also joins
+// PrivateDomains as its exact name, so a private model host keeps working
+// under every policy. A nil policy equals enabled.
 func egressFor(network sandbox.Network, policy *v1.EnvironmentNetworkInput, modelBaseURL string) (sandbox.Egress, error) {
 	egress := sandbox.Egress{Public: network.Public, PrivateDomains: append([]string{}, network.Domains...), Domains: []string{}, Endpoints: []string{}}
 	if policy != nil && policy.Access != "enabled" {
diff --git a/services/core/tools/microsandbox-provider/network.go b/services/core/tools/microsandbox-provider/network.go
index 972a3256c..1f669ceb9 100644
--- a/services/core/tools/microsandbox-provider/network.go
+++ b/services/core/tools/microsandbox-provider/network.go
@@ -30,14 +30,15 @@ const resolveTimeout = 5 * time.Second
 //  1. host DNS
 //  2. deny loopback, link-local and metadata
 //  3. each address of the Core host, on its port
-//  4. a port-less domain allow for each exact PrivateDomains name; a
-//     port-less allow also lets the guest's DNS answer pass for private
-//     addresses
+//  4. a port-less domain allow for each exact PrivateDomains name, private
+//     addresses included
 //  5. public addresses, when Public
-//  6. for each "*.apex" PrivateDomains entry, deny the apex unless the apex is
-//     allowed by name in this Egress, then allow the suffix ".apex". A suffix
-//     rule matches the apex too but "*.apex" does not, and TLS flows are
-//     matched by SNI, so the deny is exact for HTTPS
+//  6. for each "*.apex" PrivateDomains entry, deny the apex unless this Egress
+//     names it, then allow the suffix ".apex". A suffix rule matches the apex
+//     too but "*.apex" does not, and TLS flows are matched by SNI, so the deny
+//     is exact for HTTPS. An Endpoint at the apex skips the deny, since it
+//     would come before the Endpoint's allow; the suffix allow then admits
+//     that model host on every port
 //  7. deny every other private address
 //  8. unless Public, a tcp allow on its port for each Endpoint (domain, or a
 //     public IP literal) and a port-less domain allow for each Domains name

From 89a23ac0610b961fbd93074dc6eafb535f53530a Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 28 Oct 2026 08:11:28 +0000
Subject: [PATCH 3/6] Keep the restore policy rules-only and route sandbox DNS
 through the node

Restore accepts only rules and defaults, so create sets the strict and
rebind options itself. With rebind protection off, a guest-chosen resolver
could bind a cap name to any private address: deny DNS to every server
but the host, and the rest of the host (its loopback).
---
 docs/getting-started/nodes.md                 |  2 +-
 docs/getting-started/troubleshooting.md       |  4 +--
 docs/zh/getting-started/nodes.md              |  4 +--
 docs/zh/getting-started/troubleshooting.md    |  6 ++---
 .../tools/microsandbox-provider/bootstrap.go  |  2 ++
 .../tools/microsandbox-provider/network.go    | 27 ++++++++++---------
 .../microsandbox-provider/network_test.go     | 11 +++++---
 7 files changed, 32 insertions(+), 24 deletions(-)

diff --git a/docs/getting-started/nodes.md b/docs/getting-started/nodes.md
index b39353238..80cb1e19e 100644
--- a/docs/getting-started/nodes.md
+++ b/docs/getting-started/nodes.md
@@ -71,7 +71,7 @@ The node service keeps the proxy settings of the latest run, so it reaches Core
 Root only prepares the account, the group and the unit; everything else runs as `oac-node`, in its own session without a terminal. The installer never installs KVM or packages, never changes device permissions, sudoers, firewall or SELinux settings, and never touches other accounts. The node connects out to Core; Core needs no SSH access to the host.
 
 > [!WARNING]
-> microsandbox sandboxes reach a private address only through a name in the network cap's `domains`; see [Sandboxes cannot reach a private endpoint](./troubleshooting.md#sandboxes-cannot-reach-a-private-endpoint). Until the upstream DNS fix ships, a node's Core URL host must be an IP address or a name with public addresses: a name that resolves to a private address is dropped by DNS rebind protection.
+> microsandbox sandboxes reach a private address only through a name in the network cap's `domains`; see [Sandboxes cannot reach a private endpoint](./troubleshooting.md#sandboxes-cannot-reach-a-private-endpoint).
 
 **One Core per host.** Nodes share the `oac-node` account, so a host serves one Core; a command from a second Core is refused.
 
diff --git a/docs/getting-started/troubleshooting.md b/docs/getting-started/troubleshooting.md
index 01b958370..a7a8ba7fb 100644
--- a/docs/getting-started/troubleshooting.md
+++ b/docs/getting-started/troubleshooting.md
@@ -40,9 +40,9 @@ Add node shows no command: see [Before you add a node](./nodes.md#before-you-add
 
 ### Sandboxes cannot reach a private endpoint
 
-A microsandbox sandbox reaches a private address only for the names in the deployment's [network cap](../../contracts/agents-api/sandbox-deployment.md#network) `domains`. Any other name that resolves to a private address does not resolve in the sandbox, because DNS rebind protection discards the answer, and a Turn that depends on it fails once the Harness stops retrying. This includes an MCP server at a private address.
+A microsandbox sandbox reaches a private address only for the names in the deployment's [network cap](../../contracts/agents-api/sandbox-deployment.md#network) `domains`. A connection to any other private address is refused, and a Turn that depends on it fails once the Harness stops retrying. This includes an MCP server at a private address.
 
-Add the server's exact host name to the domains in **Settings** → **Sandbox and scheduling** → **Network**. The node resolves those names with the nameservers in the host's `/etc/resolv.conf` when a sandbox starts and when it resumes. A name that does not resolve there gets no rule, and the node logs `sandbox network names without an address` with the names.
+Add the server's host name, or a `*.` entry that covers it, to the domains in **Settings** → **Sandbox and scheduling** → **Network**. Sandboxes resolve names only through the nameservers in the node host's `/etc/resolv.conf`; DNS to any other server is refused.
 
 ### Connection failures
 
diff --git a/docs/zh/getting-started/nodes.md b/docs/zh/getting-started/nodes.md
index 80dd4f247..f18465286 100644
--- a/docs/zh/getting-started/nodes.md
+++ b/docs/zh/getting-started/nodes.md
@@ -1,7 +1,7 @@
 ---
 title: "添加和管理节点"
 source: docs/getting-started/nodes.md
-source_hash: 1395a1edece41b37e8c10fc11c2e3658c796972fd83d14e2bb20fc7a11edc84d
+source_hash: cb146086d2a7a4f30b96f53afea066519bfd8635bac4f16794ab27dda9e32207
 ---
 
 节点是一台 Linux 主机，为 Core 托管 Session 运行沙箱。本指南面向在沙箱提供商（参阅[选择沙箱提供商](./sandbox-backends.md)）为 microsandbox 时添加、修改和移除节点的运维人员；E2B 不需要节点。
@@ -74,7 +74,7 @@ root 只准备账号、组和服务单元；其他操作都以 `oac-node` 在没
 
 > [!CAUTION]
 > [!WARNING]
-> microsandbox 沙箱只能通过网络上限 `domains` 中的名称访问私有地址；参见[沙箱无法访问私有端点](./troubleshooting.md#sandboxes-cannot-reach-a-private-endpoint)。在上游 DNS 修复发布之前，节点的 Core URL 主机必须是 IP 地址，或解析为公开地址的名称：解析为私有地址的名称会被 DNS rebind 保护丢弃。
+> microsandbox 沙箱只能通过网络上限 `domains` 中的名称访问私有地址；参见[沙箱无法访问私有端点](./troubleshooting.md#sandboxes-cannot-reach-a-private-endpoint)。
 
 **每台主机只服务一个 Core。** 节点共享 `oac-node` 账号，因此主机只服务一个 Core；第二个 Core 的命令会被拒绝。
 
diff --git a/docs/zh/getting-started/troubleshooting.md b/docs/zh/getting-started/troubleshooting.md
index 2645ab75e..29977739d 100644
--- a/docs/zh/getting-started/troubleshooting.md
+++ b/docs/zh/getting-started/troubleshooting.md
@@ -1,7 +1,7 @@
 ---
 title: "故障排查"
 source: docs/getting-started/troubleshooting.md
-source_hash: f1d90aac721b527b49e1f214d54997918f3bb437aa0af1d5dc33304584819813
+source_hash: 3a47ff39350a3e901e2def4c567fd7d0967c5f9100bc9ca7ceb682cce86dc333
 ---
 
 按症状查找安装、访问、节点和 Session 问题的原因与解决方法。本页面向 Core 安装的运维人员。
@@ -42,9 +42,9 @@ source_hash: f1d90aac721b527b49e1f214d54997918f3bb437aa0af1d5dc33304584819813
 
 ### 沙箱无法访问私有端点 {#sandboxes-cannot-reach-a-private-endpoint}
 
-microsandbox 沙箱只能访问部署[网络上限](../../../contracts/agents-api/zh/sandbox-deployment.md#network) `domains` 中的名称所对应的私有地址。任何其他解析为私有地址的名称在沙箱内都无法解析，因为 DNS rebind 保护会丢弃该应答，依赖它的 Turn 会在 Harness 停止重试后失败，私有地址上的 MCP 服务器也是如此。
+microsandbox 沙箱只能访问部署[网络上限](../../../contracts/agents-api/zh/sandbox-deployment.md#network) `domains` 中的名称所对应的私有地址。访问其他私有地址的连接会被拒绝，依赖它的 Turn 会在 Harness 停止重试后失败，私有地址上的 MCP 服务器也是如此。
 
-在 **设置** → **沙箱与调度** → **网络** 中把该服务器的精确主机名加入域名列表。节点在沙箱启动和恢复时，用主机 `/etc/resolv.conf` 中的域名服务器解析这些名称。无法解析的名称没有规则，节点会记录 `sandbox network names without an address` 并列出这些名称。
+在 **设置** → **沙箱与调度** → **网络** 中把该服务器的主机名，或覆盖它的 `*.` 条目，加入域名列表。沙箱只通过节点主机 `/etc/resolv.conf` 中的域名服务器解析名称，发往其他 DNS 服务器的请求会被拒绝。
 
 ### 连接失败 {#connection-failures}
 
diff --git a/services/core/tools/microsandbox-provider/bootstrap.go b/services/core/tools/microsandbox-provider/bootstrap.go
index e8d2f0daa..f8a3355ae 100644
--- a/services/core/tools/microsandbox-provider/bootstrap.go
+++ b/services/core/tools/microsandbox-provider/bootstrap.go
@@ -56,6 +56,8 @@ func (b backend) create(ctx context.Context) (wire.Response, error) {
 	if e != nil {
 		return wire.Response{}, e
 	}
+	off := false
+	network.DisableStrict, network.DNS = true, &sdk.DNSConfig{RebindProtection: &off}
 	live, e := sdk.CreateSandbox(ctx, c.Name,
 		// Every compatible node holds the pinned image; nothing is ever pulled.
 		sdk.WithImage(b.q.Config.Image), sdk.WithPullPolicy(sdk.PullPolicyNever), sdk.WithMemory(b.q.Config.MemoryMiB), sdk.WithCPUs(b.q.Config.CPUs),
diff --git a/services/core/tools/microsandbox-provider/network.go b/services/core/tools/microsandbox-provider/network.go
index 1f669ceb9..a4bd6bbd2 100644
--- a/services/core/tools/microsandbox-provider/network.go
+++ b/services/core/tools/microsandbox-provider/network.go
@@ -23,12 +23,13 @@ func isPrivate(a netip.Addr) bool { return a.IsPrivate() || carrierGradeNAT.Cont
 // resolveTimeout bounds the lookup of Core's address.
 const resolveTimeout = 5 * time.Second
 
-// egressNetwork builds one allocation's network policy; Create and Resume use
-// the same rules, with strict hostname enforcement and DNS rebind protection
-// off (restore sets the same two options itself). Rules are first match with
-// default deny:
+// egressNetwork builds one allocation's network policy, rules and defaults
+// only, the part that Create and Resume share (restore accepts nothing else);
+// both turn strict hostname enforcement and DNS rebind protection off through
+// their own options. Rules are first match with default deny:
 //  1. host DNS
-//  2. deny loopback, link-local and metadata
+//  2. deny loopback, link-local, metadata and the rest of the host, and DNS
+//     to any other server, so only the host's answers bind names to addresses
 //  3. each address of the Core host, on its port
 //  4. a port-less domain allow for each exact PrivateDomains name, private
 //     addresses included
@@ -62,19 +63,19 @@ func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, r
 		return nil, err
 	}
 
-	off := false
-	n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny, DisableStrict: true, DNS: &sdk.DNSConfig{RebindProtection: &off}}
-	allow := func(destination, protocol, port string) {
-		n.Rules = append(n.Rules, sdk.PolicyRule{Action: sdk.PolicyActionAllow, Direction: sdk.PolicyDirectionEgress, Destination: destination, Protocol: sdk.PolicyProtocol(protocol), Port: port})
-	}
-	deny := func(destination string) {
-		n.Rules = append(n.Rules, sdk.PolicyRule{Action: sdk.PolicyActionDeny, Direction: sdk.PolicyDirectionEgress, Destination: destination})
+	n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny}
+	rule := func(action sdk.PolicyAction, destination, protocol, port string) {
+		n.Rules = append(n.Rules, sdk.PolicyRule{Action: action, Direction: sdk.PolicyDirectionEgress, Destination: destination, Protocol: sdk.PolicyProtocol(protocol), Port: port})
 	}
+	allow := func(destination, protocol, port string) { rule(sdk.PolicyActionAllow, destination, protocol, port) }
+	deny := func(destination string) { rule(sdk.PolicyActionDeny, destination, "", "") }
 	allow("host", "udp", "53")
 	allow("host", "tcp", "53")
-	for _, group := range []string{"loopback", "link-local", "metadata"} {
+	for _, group := range []string{"loopback", "link-local", "metadata", "host"} {
 		deny(group)
 	}
+	rule(sdk.PolicyActionDeny, "*", "udp", "53")
+	rule(sdk.PolicyActionDeny, "*", "tcp", "53")
 	for _, a := range coreAddresses {
 		allow(a.String(), "tcp", port)
 	}
diff --git a/services/core/tools/microsandbox-provider/network_test.go b/services/core/tools/microsandbox-provider/network_test.go
index 4e0c6afdf..3ca77e94b 100644
--- a/services/core/tools/microsandbox-provider/network_test.go
+++ b/services/core/tools/microsandbox-provider/network_test.go
@@ -4,10 +4,12 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"reflect"
 	"strings"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
+	sdk "github.com/superradcompany/microsandbox/sdk/go"
 )
 
 func rules(t *testing.T, egress sandbox.Egress) (string, string) {
@@ -17,9 +19,9 @@ func rules(t *testing.T, egress sandbox.Egress) (string, string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	// Create and restore run with these options off.
-	if n.DefaultEgress != "deny" || n.DefaultIngress != "deny" || !n.DisableStrict || n.DNS == nil || *n.DNS.RebindProtection {
-		t.Fatalf("defaults or options changed: %+v", n)
+	// Restore takes the config as is and accepts only rules and defaults.
+	if want := (sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny, Rules: n.Rules}); !reflect.DeepEqual(*n, want) {
+		t.Fatalf("config carries more than rules and defaults: %+v", n)
 	}
 	var lines []string
 	for _, r := range n.Rules {
@@ -33,6 +35,9 @@ allow host tcp 53
 deny loopback  
 deny link-local  
 deny metadata  
+deny host  
+deny * udp 53
+deny * tcp 53
 allow 172.29.144.1 tcp 24443
 `
 

From 22eb98823c29c5741cdb5d47c912d18f2bc21157 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 28 Oct 2026 08:40:47 +0000
Subject: [PATCH 4/6] Allow cap *.domain as a subdomain-only rule on the fork
 runtime

The fork release oac-v0.7.11-2 adds a subdomain destination that never
matches the apex, through SNI, the DNS cache binding and DNS queries, and
publishes the runtime archive next to the FFI. The adapter maps each cap
*.apex entry to it, so the apex deny and the plain-text limit go.
---
 contracts/agents-api/index.md                 |  2 +-
 contracts/agents-api/sandbox-deployment.md    |  2 +-
 contracts/agents-api/zh/index.md              |  4 +--
 contracts/agents-api/zh/sandbox-deployment.md |  4 +--
 docs/maintainers.md                           |  6 ++--
 docs/sandbox-provider.md                      |  4 +--
 docs/zh/maintainers.md                        |  8 ++---
 docs/zh/sandbox-provider.md                   |  6 ++--
 scripts/build-core-distribution.sh            |  6 ++--
 scripts/build-microsandbox-provider.py        |  4 +--
 scripts/build-microsandbox-provider.test.py   |  6 ++--
 scripts/core-distribution-manifest.py         |  4 +--
 .../core/tools/microsandbox-provider/go.mod   |  2 +-
 .../core/tools/microsandbox-provider/go.sum   |  4 +--
 .../tools/microsandbox-provider/network.go    | 35 ++++---------------
 .../microsandbox-provider/network_test.go     | 32 +++--------------
 16 files changed, 44 insertions(+), 85 deletions(-)

diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
index a1e9105ad..4646b5c7e 100644
--- a/contracts/agents-api/index.md
+++ b/contracts/agents-api/index.md
@@ -160,7 +160,7 @@ Each item is Core's deliberate or native behavior where the official service beh
 
 - Hosted workspace admission is limited by the [tenant capacity policy](../../docs/configuration.md#tenant-capacity) and the [input reservation deadline](./environments.md#reservations).
 - MiniMax Code does not declare `retained_native_history`, so it cannot run on microsandbox, which keeps every Environment on workspace storage; Core rejects the Session ([Harness capabilities](./harness-capabilities.md)).
-- The model provider's port stays reachable at public addresses from the sandbox because the Harness runs there, and a private model provider host only when the network cap lists its name; under `disabled` the host's DNS server stays reachable on port 53; MCP connections from the Environment follow the deployment's [network cap](./sandbox-deployment.md#network). E2B sandboxes cannot reach private networks, and `169.254.169.254` answers inside an E2B sandbox under every cap.
+- The model provider's port stays reachable at public addresses from the sandbox because the Harness runs there, and a private model provider host only when the network cap lists its name or a `*.` entry that covers it; under `disabled` the host's DNS server stays reachable on port 53; MCP connections from the Environment follow the deployment's [network cap](./sandbox-deployment.md#network). E2B sandboxes cannot reach private networks, and `169.254.169.254` answers inside an E2B sandbox under every cap.
 - `disabled` and `restricted` networking run on hosted Environments whose sandbox Provider can restrict egress, within the deployment's network cap; `self_hosted` Environments accept only `enabled` ([network policy](./environments.md#restricted-network)). The official API accepts an `allowed_domains` entry with a leading dot, such as `.example.com`, with unspecified meaning; Core rejects it.
 - `packages.system` other than null or an empty list is rejected; system packages must be preinstalled.
 - `Environment.files` lists the files recorded at Session creation; files created later through the Environment files API do not appear.
diff --git a/contracts/agents-api/sandbox-deployment.md b/contracts/agents-api/sandbox-deployment.md
index 3e6d45499..89c39e8dc 100644
--- a/contracts/agents-api/sandbox-deployment.md
+++ b/contracts/agents-api/sandbox-deployment.md
@@ -70,7 +70,7 @@ Select the filesystem configuration before the microsandbox deployment. Selectin
 | `public` | Boolean. `true` allows public addresses; `false` allows only Core, the model provider and `domains` |
 | `domains` | At most 100 entries of at most 253 characters, each an exact host name or `*.` and a host name, in lowercase letters, digits, hyphens and dots, whose last label starts with a letter. `*.example.com` covers the subdomains of `example.com` at any depth but not `example.com` itself, which needs its own entry; other wildcards, IP literals, ports and URLs are rejected. Core stores them lowercase, deduplicated and sorted. Every address a name resolves to is allowed, private addresses included |
 
-The default is `{"public": true, "domains": []}`. Under every cap, loopback, link-local and cloud-metadata addresses and all other private addresses stay blocked, except that E2B cannot block the metadata address 169.254.169.254 and its sandboxes cannot reach private networks at all. On microsandbox, a plain-text (non-TLS) connection to a subdomain that shares an address with the apex that the sandbox also resolved is refused. A sandbox keeps the cap of the generation that created it.
+The default is `{"public": true, "domains": []}`. Under every cap, loopback, link-local and cloud-metadata addresses and all other private addresses stay blocked, except that E2B cannot block the metadata address 169.254.169.254 and its sandboxes cannot reach private networks at all. A sandbox keeps the cap of the generation that created it.
 
 Each Provider declares what it enforces ([Sandbox Provider protocol](../../docs/sandbox-provider.md#network-egress)): microsandbox supports both fields, E2B supports `public: false` but not `domains` because E2B sandboxes cannot reach private networks. A cap the selected Provider does not declare returns 400 `invalid_sandbox_configuration` with `param` `network.public` or `network.domains`.
 
diff --git a/contracts/agents-api/zh/index.md b/contracts/agents-api/zh/index.md
index 16d3715d9..9ef32d857 100644
--- a/contracts/agents-api/zh/index.md
+++ b/contracts/agents-api/zh/index.md
@@ -1,7 +1,7 @@
 ---
 title: "OpenAI 兼容性"
 source: contracts/agents-api/index.md
-source_hash: 0cf1499e96991dcf395556149664fee7659d17db35c8cee0853e399d6c57d807
+source_hash: bd7dc591ce52a44b12c19d86054cf56ce0f163038361617660203c4f139022ce
 ---
 
 Core 实现下方固定版本的 OpenAI Agents API。本台账列出各项资源的覆盖情况、相对于官方服务的所有差异以及已知缺口。
@@ -163,7 +163,7 @@ Core 自身字段位于 `x_agents_core` 中（[Core extensions](../../../docs/zh
 
 - Hosted 工作区准入受[租户容量策略](../../../docs/zh/configuration.md#tenant-capacity)及既有[输入预留截止时间](environments.md#reservations)限制。
 - MiniMax Code 未声明 `retained_native_history`，因此无法在 microsandbox 上运行（其每个 Environment 都使用工作区存储）；Core 会拒绝该 Session（[Harness 能力](./harness-capabilities.md)）。
-- 模型提供商在公开地址上的端口从沙箱内始终可达，因为 Harness 运行在那里，私有的模型提供商主机只有在网络上限列出其名称时才可达；`disabled` 下主机 53 端口上的 DNS 服务器仍可达；Environment 中的 MCP 连接遵循部署的[网络上限](sandbox-deployment.md#network)。E2B 沙箱无法访问私有网络，且在任何上限下 `169.254.169.254` 都会在 E2B 沙箱内应答。
+- 模型提供商在公开地址上的端口从沙箱内始终可达，因为 Harness 运行在那里，私有的模型提供商主机只有在网络上限列出其名称或覆盖它的 `*.` 条目时才可达；`disabled` 下主机 53 端口上的 DNS 服务器仍可达；Environment 中的 MCP 连接遵循部署的[网络上限](sandbox-deployment.md#network)。E2B 沙箱无法访问私有网络，且在任何上限下 `169.254.169.254` 都会在 E2B 沙箱内应答。
 - `disabled` 和 `restricted` 网络在沙箱 Provider 能限制出站的托管 Environment 上运行，并受部署网络上限约束；`self_hosted` Environment 只接受 `enabled`。官方 API 接受带前导点的 `allowed_domains` 条目（如 `.example.com`），含义未规定，Core 拒绝它（[restricted network policy](environments.md#restricted-network)）。
 - 除 null 或空列表以外的 `packages.system` 都会被拒绝；系统软件包必须预先安装。
 - `Environment.files` 列出 Session 创建时记录的文件；之后通过 Environment files API 创建的文件不会出现。
diff --git a/contracts/agents-api/zh/sandbox-deployment.md b/contracts/agents-api/zh/sandbox-deployment.md
index b90b40996..435230e75 100644
--- a/contracts/agents-api/zh/sandbox-deployment.md
+++ b/contracts/agents-api/zh/sandbox-deployment.md
@@ -1,7 +1,7 @@
 ---
 title: "沙箱部署"
 source: contracts/agents-api/sandbox-deployment.md
-source_hash: a69bd56121ccce58f25e5853f65596fc514508834dbf999ed373d7b294c2ffc8
+source_hash: 596b694775fdf0635e42978f23ce2bc6a26e149583a8a590621daa103f746143
 ---
 
 沙箱部署为 Core 管理的 `openai_hosted` 执行选择沙箱提供商和每个沙箱的资源。PostgreSQL 为每个安装维护一个当前有效选择；Web 和 Core API 写入同一配置。节点文件保存其已安装副本和特定于主机的路径，且不能覆盖其资源。Runtime 不属于该选择：每个节点运行其所属安装验证过的 Runtime。该选择独立于 Harness。部署可以保持未配置状态，没有节点；此时它拒绝托管准入。
@@ -73,7 +73,7 @@ microsandbox 会配置 CPU、内存和托管根磁盘，并在挂载于 `/enviro
 | `public` | 布尔值。`true` 允许公开地址；`false` 只允许 Core、模型提供商和 `domains` |
 | `domains` | 最多 100 个条目，每个不超过 253 个字符，为精确主机名或 `*.` 加主机名，由小写字母、数字、连字符和点组成，且最后一个标签以字母开头。`*.example.com` 覆盖 `example.com` 任意层级的子域名，但不含 `example.com` 本身，后者需要单独条目；其他通配符、IP 字面量、端口和 URL 会被拒绝。Core 以小写、去重并排序的形式存储。名称解析出的每个地址都被允许，包括私有地址 |
 
-默认值为 `{"public": true, "domains": []}`。无论哪种上限，回环、链路本地、云元数据地址以及其他所有私有地址始终被阻止，但 E2B 无法阻止元数据地址 169.254.169.254，且 E2B 沙箱根本无法访问私有网络。在 microsandbox 上，对与沙箱同时解析过的顶级域共享同一地址的子域名发起的明文（非 TLS）连接会被拒绝。沙箱保留创建它的代次的上限。
+默认值为 `{"public": true, "domains": []}`。无论哪种上限，回环、链路本地、云元数据地址以及其他所有私有地址始终被阻止，但 E2B 无法阻止元数据地址 169.254.169.254，且 E2B 沙箱根本无法访问私有网络。沙箱保留创建它的代次的上限。
 
 每个 Provider 声明自己能强制执行什么（[Sandbox Provider 协议](../../../docs/zh/sandbox-provider.md#network-egress)）：microsandbox 支持两个字段，E2B 支持 `public: false` 但不支持 `domains`，因为 E2B 沙箱无法访问私有网络。所选 Provider 未声明的上限会返回 400 `invalid_sandbox_configuration`，`param` 为 `network.public` 或 `network.domains`。
 
diff --git a/docs/maintainers.md b/docs/maintainers.md
index b1eaaf775..dd6222724 100644
--- a/docs/maintainers.md
+++ b/docs/maintainers.md
@@ -33,7 +33,7 @@ make build-core-distribution
 | `OAC_NATIVE_INSTALLER_BUILD_DIR` | Native installer catalog directory; see [Native installers](#native-installers) |
 | `CORE_DISTRIBUTION_BUILD_DIR` | Output directory under `~/.oac`. Default: `~/.oac/build/core-distribution` |
 | `CORE_DISTRIBUTION_BUILD_NETWORK` | Docker build network: `default`, `host` or `none` |
-| `CORE_DISTRIBUTION_MICROSANDBOX_ARCHIVE` | Cached microsandbox release archive. Default: `~/.oac/cache/microsandbox-v0.7.11-linux-x86_64.tar.gz`, downloaded when missing |
+| `CORE_DISTRIBUTION_MICROSANDBOX_ARCHIVE` | Cached microsandbox release archive. Default: `~/.oac/cache/microsandbox-oac-v0.7.11-2-linux-x86_64.tar.gz`, downloaded when missing |
 | `CORE_DISTRIBUTION_DATABASE_IMAGE` | PostgreSQL 16 image; the default is the linux/amd64 manifest of the index in `deploy/compose/database-image.txt` |
 
 The build reuses the Core, Web, Runtime, SDK and helper builders. The manifest records the commit and its source tree, image config and OCI manifest digests, the Runtime OCI manifest digest, the microsandbox runtime and firmware hashes, and the size and SHA-256 of every Runtime and node artifact; native installers carry only their SHA-256 in the [catalog](#native-installers). Output is the control archive and its `.sha256`, the optional offline archive, and the versioned Runtime, node and native installer assets. Nothing is published. Rebuilding into a directory that already holds this commit's distribution is refused.
@@ -114,9 +114,9 @@ make check-microsandbox-provider
 
 The helper is written to `~/.oac/build/microsandbox-provider/oac-microsandbox-provider`. Its separate Go module pins the microsandbox SDK from the fork described below. Both commands and the distribution build use `scripts/build-microsandbox-provider.py`: it stages the module dependencies, verifies the checksum of the fork's FFI release, fills the SDK's empty release bundle and builds with that FFI embedded. No vendored binary is committed. Use this entry point rather than invoking `go build` directly; never build production with the SDK's `microsandbox_ffi_path` tag. Core itself stays a CGO-disabled build. The helper needs glibc and runs only on nodes.
 
-**microsandbox runtime.** The distribution uses the official [v0.7.11 release](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.11) archive `microsandbox-linux-x86_64.tar.gz`, SHA256 `5fc2206fbe35b471743bd5af15e3931cd2439a0c8b8e6ef08a493ddabcdc1b4c` (`RUNTIME_ARCHIVE_SHA256` in `scripts/core-distribution-manifest.py`). The build verifies the checksum before extracting `msb` and `libkrunfw.so.5.6.1` and records both files' hashes. The helper checks those hashes on every call and never installs or upgrades them.
+**microsandbox runtime.** The distribution uses the archive `microsandbox-linux-x86_64.tar.gz` of the fork release [oac-v0.7.11-2](https://github.com/SaladDay/microsandbox/releases/tag/oac-v0.7.11-2), SHA256 `9ca514e58d7156954537210d2e673c07b091ed5137775b8952ecfd2e96d85638` (`RUNTIME_ARCHIVE_SHA256` in `scripts/core-distribution-manifest.py`). The build verifies the checksum before extracting `msb` and `libkrunfw.so.5.6.1` and records both files' hashes. The helper checks those hashes on every call and never installs or upgrades them.
 
-**microsandbox fork.** The SDK and its FFI come from the `oac` branch of [SaladDay/microsandbox](https://github.com/SaladDay/microsandbox/tree/oac): an upstream release tag plus a short queue of patches, listed by `git log v0.7.11..oac`. Each patch is also proposed upstream and dropped once an upstream release carries it. Pushing a tag `oac-v<upstream version>-<n>` builds the Linux amd64 FFI in the same manylinux 2.28 container as upstream releases and attaches it, with its SHA256, to a release of that tag. To move to a new tag, point the SDK `replace` in `services/core/tools/microsandbox-provider/go.mod` at the tagged commit and update `FFI_URL` and `FFI_SHA256` in `scripts/build-microsandbox-provider.py`. The runtime stays the official release of the same upstream version.
+**microsandbox fork.** The SDK, its FFI and the `msb` runtime come from the `oac` branch of [SaladDay/microsandbox](https://github.com/SaladDay/microsandbox/tree/oac): an upstream release tag plus a short queue of patches, listed by `git log v0.7.11..oac`. Each patch is also proposed upstream and dropped once an upstream release carries it. Pushing a tag `oac-v<upstream version>-<n>` builds the Linux amd64 FFI and the runtime archive in the same manylinux 2.28 container as upstream releases, with the official `libkrunfw` of the same upstream version instead of a kernel build, and attaches them, with their SHA256 files, to a release of that tag (`.github/workflows/oac-release.yml`). To move to a new tag, point the SDK `replace` in `services/core/tools/microsandbox-provider/go.mod` at the tagged commit, update `FFI_URL` and `FFI_SHA256` in `scripts/build-microsandbox-provider.py`, `msb_tag` in `scripts/build-core-distribution.sh` and `RUNTIME_ARCHIVE_SHA256`.
 
 ### Standalone Core builds
 
diff --git a/docs/sandbox-provider.md b/docs/sandbox-provider.md
index 27786160f..d9eeab8fc 100644
--- a/docs/sandbox-provider.md
+++ b/docs/sandbox-provider.md
@@ -200,11 +200,11 @@ Core sends the same `Egress` in `Bootstrap` and in every `ResumeRequest`, derive
 - `Public`: public addresses are allowed.
 - `PrivateDomains`: exact host names, or `*.example.com` for its subdomains but not `example.com` itself, whose resolved addresses, private ones included, are allowed.
 - `Domains`: exact host names allowed on public addresses only; a private answer stays blocked. They carry a `restricted` Environment's `allowed_domains` when the cap allows the public internet.
-- `Endpoints`: `host:port` entries (`net.JoinHostPort` form) for the model provider's `base_url`, with the port from the URL or 443 for https and 80 for http, omitted when the host is loopback. The Harness runs in the sandbox and calls it directly. An entry allows that TCP port on public addresses only, never a private address. When the cap lists the model host's name in its extra domains, Core also adds that name to `PrivateDomains`, so a private model host keeps working under every policy.
+- `Endpoints`: `host:port` entries (`net.JoinHostPort` form) for the model provider's `base_url`, with the port from the URL or 443 for https and 80 for http, omitted when the host is loopback. The Harness runs in the sandbox and calls it directly. An entry allows that TCP port on public addresses only, never a private address. When the cap's extra domains list the model host's name or a `*.` entry that covers it, Core also adds that name to `PrivateDomains`, so a private model host keeps working under every policy.
 
 The Provider enforces exactly this on top of the always-allowed connection to Core, and blocks loopback, link-local, cloud-metadata and every private address that `Egress` does not name, except that E2B cannot block the metadata address 169.254.169.254. It resolves the Core host with its host's DNS when it creates and when it resumes. MCP traffic has no entry: it follows `Public`, `PrivateDomains` and `Domains`.
 
-microsandbox applies the rules with first-match order, default deny, and host DNS reachable, on create and restore alike, with strict hostname enforcement and DNS rebind protection off. A name becomes a port-less domain allow that the sandbox's own DNS answers resolve, private addresses included. A `*.example.com` entry becomes the suffix allow `.example.com`, which would also match `example.com`, so the adapter first denies `example.com` unless this `Egress` names it. E2B declares `Restrict` only: `Public` adds a deny list for loopback, private and link-local ranges, and not `Public` denies all IPv4 and IPv6 traffic except the Core host, `Endpoints` and `Domains`. E2B matches a host name only on ports 80 and 443, so the adapter also allows the global IPv4 addresses of the Core host and of each Endpoint on any other port. An IP literal is allowed only as a global address range of one address, and a private literal gets no rule.
+microsandbox applies the rules with first-match order and default deny, on create and restore alike, with strict hostname enforcement and DNS rebind protection off. The sandbox reaches only the host's DNS server: DNS to any other server and every other host port are refused, so only the host's answers bind names to addresses. A name becomes a port-less domain allow for the addresses those answers resolve, private ones included, and a `*.example.com` entry a subdomain allow that never matches `example.com`. E2B declares `Restrict` only: `Public` adds a deny list for loopback, private and link-local ranges, and not `Public` denies all IPv4 and IPv6 traffic except the Core host, `Endpoints` and `Domains`. E2B matches a host name only on ports 80 and 443, so the adapter also allows the global IPv4 addresses of the Core host and of each Endpoint on any other port. An IP literal is allowed only as a global address range of one address, and a private literal gets no rule.
 
 ## Checkpoint lifecycle
 
diff --git a/docs/zh/maintainers.md b/docs/zh/maintainers.md
index dba81803a..6a82b2272 100644
--- a/docs/zh/maintainers.md
+++ b/docs/zh/maintainers.md
@@ -1,7 +1,7 @@
 ---
 title: "构建并发布 OpenAgentCore"
 source: docs/maintainers.md
-source_hash: 7a78188dee1e8010194c3aef618b33027f1fb1fd2401b4d80c9b21beea85d34b
+source_hash: 501bab94d8cffb809a9a0ae43537db1d707de5bf368e749ab36e9c0db56b0c33
 ---
 
 本指南面向负责构建和发布 OpenAgentCore 的维护者。要安装 Core 和 Web，请按 [安装 Core 和 Web](getting-started/install.md) 操作。安装程序代码遵循的规则见 [部署](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) 和 [节点安装程序](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md)；必需检查见 [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks)。
@@ -35,7 +35,7 @@ make build-core-distribution
 | `OAC_NATIVE_INSTALLER_BUILD_DIR` | 原生安装程序目录；请参阅[原生安装程序](#native-installers) |
 | `CORE_DISTRIBUTION_BUILD_DIR` | `~/.oac` 下的输出目录。默认值：`~/.oac/build/core-distribution` |
 | `CORE_DISTRIBUTION_BUILD_NETWORK` | Docker 构建网络：`default`、`host` 或 `none` |
-| `CORE_DISTRIBUTION_MICROSANDBOX_ARCHIVE` | 已缓存的 microsandbox 发布归档。默认值：`~/.oac/cache/microsandbox-v0.7.11-linux-x86_64.tar.gz`，缺失时下载 |
+| `CORE_DISTRIBUTION_MICROSANDBOX_ARCHIVE` | 已缓存的 microsandbox 发布归档。默认值：`~/.oac/cache/microsandbox-oac-v0.7.11-2-linux-x86_64.tar.gz`，缺失时下载 |
 | `CORE_DISTRIBUTION_DATABASE_IMAGE` | PostgreSQL 16 镜像；默认值为 `deploy/compose/database-image.txt` 中索引的 linux/amd64 清单 |
 
 构建过程会复用 Core、Web、Runtime、SDK 和辅助程序构建器。清单会记录提交及其源代码树、镜像配置及 OCI 清单摘要、Runtime OCI 清单摘要、microsandbox 运行时和固件哈希，以及每个 Runtime 和节点构件的大小与 SHA-256；原生安装程序在[目录](#native-installers)中仅记录其 SHA-256。输出包括控制归档及其 `.sha256`、可选的离线归档，以及带版本号的 Runtime、节点和原生安装程序资源。此过程不会发布任何内容。如果目标目录中已包含此提交的分发包，重建会拒绝执行。
@@ -116,9 +116,9 @@ make check-microsandbox-provider
 
 该辅助程序会写入 `~/.oac/build/microsandbox-provider/oac-microsandbox-provider`。其独立的 Go 模块固定来自下文所述 fork 的 microsandbox SDK。上述两个命令与分发构建均使用 `scripts/build-microsandbox-provider.py`：它暂存模块依赖，验证 fork 的 FFI 发行文件校验和，填充 SDK 的空发行包，并构建嵌入该 FFI 的程序。仓库不提交 vendored 二进制文件。请使用此入口，而非直接调用 `go build`；构建生产版本时，绝不能使用该 SDK 的 `microsandbox_ffi_path` 标签。Core 本身仍采用禁用 CGO 的构建。该辅助程序需要 glibc，并且只能在节点上运行。
 
-**microsandbox 运行时。** 分发包使用官方的 [v0.7.11 release](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.11) 归档 `microsandbox-linux-x86_64.tar.gz`，SHA256 为 `5fc2206fbe35b471743bd5af15e3931cd2439a0c8b8e6ef08a493ddabcdc1b4c`（即 `scripts/core-distribution-manifest.py` 中的 `RUNTIME_ARCHIVE_SHA256`）。构建过程会先验证校验和，再解压 `msb` 和 `libkrunfw.so.5.6.1`，并记录这两个文件的哈希。辅助程序会在每次调用时检查这些哈希，并且绝不安装或升级它们。
+**microsandbox 运行时。** 分发包使用 fork 发布 [oac-v0.7.11-2](https://github.com/SaladDay/microsandbox/releases/tag/oac-v0.7.11-2) 的归档 `microsandbox-linux-x86_64.tar.gz`，SHA256 为 `9ca514e58d7156954537210d2e673c07b091ed5137775b8952ecfd2e96d85638`（即 `scripts/core-distribution-manifest.py` 中的 `RUNTIME_ARCHIVE_SHA256`）。构建过程会先验证校验和，再解压 `msb` 和 `libkrunfw.so.5.6.1`，并记录这两个文件的哈希。辅助程序会在每次调用时检查这些哈希，并且绝不安装或升级它们。
 
-**microsandbox fork。** SDK 及其 FFI 来自 [SaladDay/microsandbox](https://github.com/SaladDay/microsandbox/tree/oac) 的 `oac` 分支：一个上游发布标签加上一小队补丁，补丁列表见 `git log v0.7.11..oac`。每个补丁同时向上游提交，上游发布包含它之后就从队列中删除。推送 `oac-v<upstream version>-<n>` 标签会在与上游发布相同的 manylinux 2.28 容器中构建 Linux amd64 FFI，并连同其 SHA256 附加到该标签的 release。要换到新标签，把 `services/core/tools/microsandbox-provider/go.mod` 中 SDK 的 `replace` 指向该标签的提交，并更新 `scripts/build-microsandbox-provider.py` 中的 `FFI_URL` 和 `FFI_SHA256`。运行时仍使用同一上游版本的官方发布。
+**microsandbox fork。** SDK、其 FFI 和 `msb` 运行时来自 [SaladDay/microsandbox](https://github.com/SaladDay/microsandbox/tree/oac) 的 `oac` 分支：一个上游发布标签加上一小队补丁，补丁列表见 `git log v0.7.11..oac`。每个补丁同时向上游提交，上游发布包含它之后就从队列中删除。推送 `oac-v<upstream version>-<n>` 标签会在与上游发布相同的 manylinux 2.28 容器中构建 Linux amd64 FFI 和运行时归档，其中 `libkrunfw` 使用同一上游版本的官方文件而不构建内核，并把它们连同 SHA256 文件附加到该标签的 release（`.github/workflows/oac-release.yml`）。要换到新标签，把 `services/core/tools/microsandbox-provider/go.mod` 中 SDK 的 `replace` 指向该标签的提交，并更新 `scripts/build-microsandbox-provider.py` 中的 `FFI_URL` 和 `FFI_SHA256`、`scripts/build-core-distribution.sh` 中的 `msb_tag` 以及 `RUNTIME_ARCHIVE_SHA256`。
 
 ### 独立 Core 构建 {#standalone-core-builds}
 
diff --git a/docs/zh/sandbox-provider.md b/docs/zh/sandbox-provider.md
index 2db8b9257..ef7baeafc 100644
--- a/docs/zh/sandbox-provider.md
+++ b/docs/zh/sandbox-provider.md
@@ -1,7 +1,7 @@
 ---
 title: "沙箱提供商协议"
 source: docs/sandbox-provider.md
-source_hash: 228915769ce795bd38417f229d972ccafbf7280628cf3280c0f9bfddf4405537
+source_hash: 01003cc3061eefaf705bb376e73f6a66e4e6416821157947bb6445474b74cc61
 ---
 
 沙箱提供商协议连接 Core 与为 Core 管理的（`openai_hosted`）Environment 提供计算资源的 adapter，并由该 adapter 运行启动 Runtime daemon 的有界引导流程。本页面向 adapter 作者：说明提供商必须实现什么，以及可以依赖 Core 做什么。microsandbox 和 E2B 实现了该协议。
@@ -202,11 +202,11 @@ Core 在 `Bootstrap` 和每个 `ResumeRequest` 中发送同一个 `Egress`，它
 - `Public`：允许公开地址。
 - `PrivateDomains`：精确主机名，或 `*.example.com`（覆盖其子域名，不含 `example.com` 本身），其解析出的地址（包括私有地址）都被允许。
 - `Domains`：只在公开地址上被允许的精确主机名，私有应答仍被阻止。上限允许公网时，它们承载 `restricted` Environment 的 `allowed_domains`。
-- `Endpoints`：模型提供商 `base_url` 的 `host:port` 条目（`net.JoinHostPort` 形式），端口取自 URL，https 默认 443，http 默认 80，主机为回环时省略。Harness 运行在沙箱内，直接调用它。条目只允许该 TCP 端口在公开地址上的访问，绝不包括私有地址。上限的额外域名列出了模型主机名时，Core 还会把该名称加入 `PrivateDomains`，使私有模型主机在任何策略下都能工作。
+- `Endpoints`：模型提供商 `base_url` 的 `host:port` 条目（`net.JoinHostPort` 形式），端口取自 URL，https 默认 443，http 默认 80，主机为回环时省略。Harness 运行在沙箱内，直接调用它。条目只允许该 TCP 端口在公开地址上的访问，绝不包括私有地址。上限的额外域名列出了模型主机名或覆盖它的 `*.` 条目时，Core 还会把该名称加入 `PrivateDomains`，使私有模型主机在任何策略下都能工作。
 
 Provider 在始终允许到 Core 的连接之上严格执行这些内容，并阻止回环、链路本地、云元数据以及 `Egress` 未列出的所有私有地址，但 E2B 无法阻止元数据地址 169.254.169.254。它在创建和恢复时用主机 DNS 解析 Core 主机。MCP 流量没有条目：它遵循 `Public`、`PrivateDomains` 和 `Domains`。
 
-microsandbox 按首条匹配的顺序、默认拒绝并保持主机 DNS 可达来应用规则，创建与恢复相同，并关闭严格主机名校验和 DNS rebind 保护。名称成为不带端口的域名放行规则，沙箱自己的 DNS 应答解析出的地址（包括私有地址）都被放行。`*.example.com` 条目成为后缀放行规则 `.example.com`，它同样会匹配 `example.com`，因此 adapter 先拒绝 `example.com`，除非该 `Egress` 中出现了这个名称。E2B 只声明 `Restrict`：`Public` 时加入回环、私有和链路本地网段的拒绝列表，非 `Public` 时拒绝除 Core 主机、`Endpoints` 和 `Domains` 之外的全部 IPv4 和 IPv6 流量。E2B 只在 80 和 443 端口匹配主机名，因此 adapter 还会为 Core 主机和每个 Endpoint 在其他端口上允许其全球 IPv4 地址。IP 字面量只作为单地址的全球地址范围被允许，私有字面量没有规则。
+microsandbox 按首条匹配的顺序和默认拒绝来应用规则，创建与恢复相同，并关闭严格主机名校验和 DNS rebind 保护。沙箱只能访问主机的 DNS 服务器：发往其他服务器的 DNS 和主机的其他端口都被拒绝，因此只有主机的应答能把名称绑定到地址。名称成为不带端口的域名放行规则，放行这些应答解析出的地址（包括私有地址）；`*.example.com` 条目成为子域名放行规则，永远不匹配 `example.com`。E2B 只声明 `Restrict`：`Public` 时加入回环、私有和链路本地网段的拒绝列表，非 `Public` 时拒绝除 Core 主机、`Endpoints` 和 `Domains` 之外的全部 IPv4 和 IPv6 流量。E2B 只在 80 和 443 端口匹配主机名，因此 adapter 还会为 Core 主机和每个 Endpoint 在其他端口上允许其全球 IPv4 地址。IP 字面量只作为单地址的全球地址范围被允许，私有字面量没有规则。
 
 ## 检查点生命周期 {#checkpoint-lifecycle}
 
diff --git a/scripts/build-core-distribution.sh b/scripts/build-core-distribution.sh
index 4b51abb58..e62fd91d8 100755
--- a/scripts/build-core-distribution.sh
+++ b/scripts/build-core-distribution.sh
@@ -119,11 +119,13 @@ cp deploy/compose/compose.yaml "$bundle/compose.yaml.template"
 OAC_DEV_BUILD_REVISION="$revision" scripts/build-core-image-context.sh "$stage/core"
 cp "$stage/core/bin/oac" "$bundle/oac"
 python3 scripts/build-microsandbox-provider.py build "$stage/core/bin/oac-microsandbox-provider"
-msb_archive="${CORE_DISTRIBUTION_MICROSANDBOX_ARCHIVE:-$runtime_root/cache/microsandbox-v0.7.11-linux-x86_64.tar.gz}"
+# The fork release that also provides the FFI (docs/maintainers.md).
+msb_tag=oac-v0.7.11-2
+msb_archive="${CORE_DISTRIBUTION_MICROSANDBOX_ARCHIVE:-$runtime_root/cache/microsandbox-$msb_tag-linux-x86_64.tar.gz}"
 if [[ ! -f "$msb_archive" ]]; then
   mkdir -p "$(dirname "$msb_archive")"
   curl --fail --location --proto '=https' --tlsv1.2 \
-    https://github.com/superradcompany/microsandbox/releases/download/v0.7.11/microsandbox-linux-x86_64.tar.gz \
+    "https://github.com/SaladDay/microsandbox/releases/download/$msb_tag/microsandbox-linux-x86_64.tar.gz" \
     --output "$stage/microsandbox.download"
   python3 scripts/core-distribution-manifest.py extract-runtime "$stage/microsandbox.download" "$stage/core/microsandbox"
   mv "$stage/microsandbox.download" "$msb_archive"
diff --git a/scripts/build-microsandbox-provider.py b/scripts/build-microsandbox-provider.py
index 045361a37..ef6367d92 100644
--- a/scripts/build-microsandbox-provider.py
+++ b/scripts/build-microsandbox-provider.py
@@ -14,8 +14,8 @@
 # The SDK source (go.mod replace) and this FFI come from the same tag of the fork; see docs/maintainers.md.
 SDK_FORK = "github.com/SaladDay/microsandbox/sdk/go"
 FFI_FILE = "libmicrosandbox_go_ffi-linux-amd64.so"
-FFI_URL = "https://github.com/SaladDay/microsandbox/releases/download/oac-v0.7.11-1/" + FFI_FILE
-FFI_SHA256 = "e489ea93cab3b9c8ea9e8b53a5c0b4fe0e54a66be34b7b2638fb360b1d574642"
+FFI_URL = "https://github.com/SaladDay/microsandbox/releases/download/oac-v0.7.11-2/" + FFI_FILE
+FFI_SHA256 = "c04e6256ee24335e2de4635361d5ae53674573818859113474020274d1fd0a29"
 
 
 def verify_ffi(path):
diff --git a/scripts/build-microsandbox-provider.test.py b/scripts/build-microsandbox-provider.test.py
index d53f80ccd..3c7328207 100644
--- a/scripts/build-microsandbox-provider.test.py
+++ b/scripts/build-microsandbox-provider.test.py
@@ -11,11 +11,11 @@
 spec.loader.exec_module(build)
 
 
-class OfficialBundleTests(unittest.TestCase):
+class FFIBundleTests(unittest.TestCase):
     def test_only_verified_payload_replaces_empty_sentinel(self):
         with tempfile.TemporaryDirectory() as directory:
             source, destination = Path(directory) / "ffi", Path(directory) / "sentinel"
-            source.write_bytes(b"official ffi")
+            source.write_bytes(b"ffi")
             destination.touch()
             with patch.object(build, "FFI_SHA256", hashlib.sha256(source.read_bytes()).hexdigest()):
                 build.install_ffi(source, destination)
@@ -35,7 +35,7 @@ def test_corrupt_payload_does_not_replace_sentinel(self):
     def test_symlink_sentinel_is_rejected(self):
         with tempfile.TemporaryDirectory() as directory:
             source, destination, outside = (Path(directory) / name for name in ("ffi", "sentinel", "outside"))
-            source.write_bytes(b"official ffi")
+            source.write_bytes(b"ffi")
             outside.touch()
             destination.symlink_to(outside)
             with patch.object(build, "FFI_SHA256", hashlib.sha256(source.read_bytes()).hexdigest()):
diff --git a/scripts/core-distribution-manifest.py b/scripts/core-distribution-manifest.py
index 8124d2500..650584472 100644
--- a/scripts/core-distribution-manifest.py
+++ b/scripts/core-distribution-manifest.py
@@ -17,7 +17,7 @@
 import zipapp
 
 
-RUNTIME_ARCHIVE_SHA256 = "5fc2206fbe35b471743bd5af15e3931cd2439a0c8b8e6ef08a493ddabcdc1b4c"
+RUNTIME_ARCHIVE_SHA256 = "9ca514e58d7156954537210d2e673c07b091ed5137775b8952ecfd2e96d85638"
 DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
 sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1] / "deploy/node"))
 import provider_assets
@@ -210,7 +210,7 @@ def verify_runtime(image, daemon, source):
 
 def extract_runtime(archive, destination):
     if sha256(archive) != RUNTIME_ARCHIVE_SHA256:
-        raise ValueError("microsandbox v0.7.11 release checksum mismatch")
+        raise ValueError("microsandbox runtime archive checksum mismatch")
     destination = pathlib.Path(destination)
     destination.mkdir(parents=True, exist_ok=True)
     with tarfile.open(archive, "r:gz") as bundle:
diff --git a/services/core/tools/microsandbox-provider/go.mod b/services/core/tools/microsandbox-provider/go.mod
index 52678be60..f7fafe054 100644
--- a/services/core/tools/microsandbox-provider/go.mod
+++ b/services/core/tools/microsandbox-provider/go.mod
@@ -14,4 +14,4 @@ require golang.org/x/sync v0.22.0 // indirect
 replace github.com/MiniMax-AI/OpenAgentCore => ../../../..
 
 // The SDK is upstream v0.7.11 plus the fork's patch queue (docs/maintainers.md).
-replace github.com/superradcompany/microsandbox/sdk/go => github.com/SaladDay/microsandbox/sdk/go v0.0.0-20261028065500-fc39b5b503f0
+replace github.com/superradcompany/microsandbox/sdk/go => github.com/SaladDay/microsandbox/sdk/go v0.0.0-20261028082216-9f2992795029
diff --git a/services/core/tools/microsandbox-provider/go.sum b/services/core/tools/microsandbox-provider/go.sum
index 5d86672d7..4eb3e4df0 100644
--- a/services/core/tools/microsandbox-provider/go.sum
+++ b/services/core/tools/microsandbox-provider/go.sum
@@ -1,5 +1,5 @@
-github.com/SaladDay/microsandbox/sdk/go v0.0.0-20261028065500-fc39b5b503f0 h1:FOLB4tEDMEO0uCnJrD6FmdS0+a4rk+nv09dzk1F3FLY=
-github.com/SaladDay/microsandbox/sdk/go v0.0.0-20261028065500-fc39b5b503f0/go.mod h1:p7Tm/p9zkO7sHO3N8A1fiTVeLB2w/fQoKdYlpN/5neA=
+github.com/SaladDay/microsandbox/sdk/go v0.0.0-20261028082216-9f2992795029 h1:VlTlfpZiUKEvmCgORHoK75sLtQEVjeFAtRkcb7P3ZFU=
+github.com/SaladDay/microsandbox/sdk/go v0.0.0-20261028082216-9f2992795029/go.mod h1:p7Tm/p9zkO7sHO3N8A1fiTVeLB2w/fQoKdYlpN/5neA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
diff --git a/services/core/tools/microsandbox-provider/network.go b/services/core/tools/microsandbox-provider/network.go
index a4bd6bbd2..8038ea062 100644
--- a/services/core/tools/microsandbox-provider/network.go
+++ b/services/core/tools/microsandbox-provider/network.go
@@ -31,21 +31,13 @@ const resolveTimeout = 5 * time.Second
 //  2. deny loopback, link-local, metadata and the rest of the host, and DNS
 //     to any other server, so only the host's answers bind names to addresses
 //  3. each address of the Core host, on its port
-//  4. a port-less domain allow for each exact PrivateDomains name, private
-//     addresses included
+//  4. a port-less allow for each PrivateDomains entry, private addresses
+//     included: the exact name, or for "*.apex" every name below the apex,
+//     never the apex itself
 //  5. public addresses, when Public
-//  6. for each "*.apex" PrivateDomains entry, deny the apex unless this Egress
-//     names it, then allow the suffix ".apex". A suffix rule matches the apex
-//     too but "*.apex" does not, and TLS flows are matched by SNI, so the deny
-//     is exact for HTTPS. An Endpoint at the apex skips the deny, since it
-//     would come before the Endpoint's allow; the suffix allow then admits
-//     that model host on every port
-//  7. deny every other private address
-//  8. unless Public, a tcp allow on its port for each Endpoint (domain, or a
+//  6. deny every other private address
+//  7. unless Public, a tcp allow on its port for each Endpoint (domain, or a
 //     public IP literal) and a port-less domain allow for each Domains name
-//
-// A plain-text connection to a subdomain that shares an address with a
-// resolved apex is refused, since only the address is known there.
 func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, report io.Writer) (*sdk.NetworkConfig, error) {
 	core, err := url.Parse(coreURL)
 	if err != nil || core.Hostname() == "" {
@@ -79,15 +71,11 @@ func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, r
 	for _, a := range coreAddresses {
 		allow(a.String(), "tcp", port)
 	}
-	named := slices.Clone(egress.Domains)
-	var suffixes []string
 	for _, name := range egress.PrivateDomains {
 		if apex, ok := strings.CutPrefix(name, "*."); ok {
-			suffixes = append(suffixes, apex)
-		} else {
-			named = append(named, name)
-			allow(name, "", "")
+			name = "subdomain=" + apex
 		}
+		allow(name, "", "")
 	}
 	var endpoints [][2]string
 	for _, endpoint := range egress.Endpoints {
@@ -98,21 +86,12 @@ func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, r
 			fmt.Fprintf(report, "unsupported %s\n", endpoint)
 		case ipErr == nil && isPrivate(ip.Unmap()):
 		default:
-			named = append(named, host)
 			endpoints = append(endpoints, [2]string{host, strconv.Itoa(p)})
 		}
 	}
 	if egress.Public {
 		allow("public", "", "")
 	}
-	for _, apex := range suffixes {
-		if !slices.Contains(named, apex) {
-			deny(apex)
-		}
-	}
-	for _, apex := range suffixes {
-		allow("."+apex, "", "")
-	}
 	deny("private")
 	if !egress.Public {
 		for _, e := range endpoints {
diff --git a/services/core/tools/microsandbox-provider/network_test.go b/services/core/tools/microsandbox-provider/network_test.go
index 3ca77e94b..f66468690 100644
--- a/services/core/tools/microsandbox-provider/network_test.go
+++ b/services/core/tools/microsandbox-provider/network_test.go
@@ -48,12 +48,14 @@ func TestDefaultPolicyRules(t *testing.T) {
 	}
 }
 
-// Exact cap names are port-less allows before "deny private"; an Endpoint is
-// limited to its port, a private IP literal is dropped, a bad one is reported.
+// Cap names are port-less allows before "deny private", "*.apex" as every
+// name below the apex; an Endpoint is limited to its port, a private IP
+// literal is dropped, a bad one is reported.
 func TestNotPublicRules(t *testing.T) {
-	got, report := rules(t, sandbox.Egress{PrivateDomains: []string{"gitlab.example.com"}, Domains: []string{"pypi.org"},
+	got, report := rules(t, sandbox.Egress{PrivateDomains: []string{"gitlab.example.com", "*.corp.example"}, Domains: []string{"pypi.org"},
 		Endpoints: []string{"models.example.com:8443", "203.0.113.9:8000", "10.1.2.3:8000", "bad host:1"}})
 	want := head + `allow gitlab.example.com  
+allow subdomain=corp.example  
 deny private  
 allow models.example.com tcp 8443
 allow 203.0.113.9 tcp 8000
@@ -62,27 +64,3 @@ allow pypi.org  `
 		t.Fatalf("rules:\n%s\nreport %q", got, report)
 	}
 }
-
-// A suffix rule matches the apex too, so each "*.apex" entry denies the apex
-// first unless this Egress allows the apex by name; public comes before it.
-func TestSuffixRules(t *testing.T) {
-	cases := []struct {
-		name   string
-		egress sandbox.Egress
-		want   string
-	}{
-		{"restricted", sandbox.Egress{Domains: []string{"example.com"}, PrivateDomains: []string{"*.corp.example", "git.corp.example"}},
-			head + "allow git.corp.example  \ndeny corp.example  \nallow .corp.example  \ndeny private  \nallow example.com  "},
-		{"enabled", sandbox.Egress{Public: true, PrivateDomains: []string{"*.corp.example", "git.corp.example", "llm.corp.example"}, Endpoints: []string{"api.minimaxi.com:443"}},
-			head + "allow git.corp.example  \nallow llm.corp.example  \nallow public  \ndeny corp.example  \nallow .corp.example  \ndeny private  "},
-		{"apex listed", sandbox.Egress{PrivateDomains: []string{"*.corp.example", "corp.example"}},
-			head + "allow corp.example  \nallow .corp.example  \ndeny private  "},
-		{"apex is a model host", sandbox.Egress{PrivateDomains: []string{"*.corp.example"}, Endpoints: []string{"corp.example:8000"}},
-			head + "allow .corp.example  \ndeny private  \nallow corp.example tcp 8000"},
-	}
-	for _, tc := range cases {
-		if got, _ := rules(t, tc.egress); got != tc.want {
-			t.Fatalf("%s:\n%s", tc.name, got)
-		}
-	}
-}

From 09cf7e94571779df766bcf4a19128c361e678947 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 28 Oct 2026 12:23:31 +0000
Subject: [PATCH 5/6] Reject top-level wildcards in the cap and keep the fork
 tag in one place

*.com would allow every .com name on any address it resolves to; the cap
now requires at least two labels after *., as wildcard certificates do.
The helper no longer reports unresolved names, so its stderr parsing keeps
only unsupported endpoints. The distribution build reads the fork tag from
the provider build script.
---
 .../features/sandbox/NetworkSettings.test.tsx |  2 +-
 contracts/agents-api/sandbox-deployment.md    |  2 +-
 contracts/agents-api/zh/sandbox-deployment.md |  4 +--
 deploy/node/node_spec.py                      |  2 +-
 docs/maintainers.md                           |  2 +-
 docs/zh/maintainers.md                        |  4 +--
 .../agents-client/src/deployment-contract.ts  |  2 +-
 scripts/build-core-distribution.sh            |  3 +--
 scripts/build-microsandbox-provider.py        | 10 ++++---
 .../internal/sandbox/microsandbox/process.go  | 12 ++++-----
 services/core/internal/sandbox/network.go     |  7 ++---
 .../sandbox/testdata/deployment-contract.json | 26 +++++++++++++++++++
 12 files changed, 53 insertions(+), 23 deletions(-)

diff --git a/apps/web/src/features/sandbox/NetworkSettings.test.tsx b/apps/web/src/features/sandbox/NetworkSettings.test.tsx
index f4b06f46c..c71e392b8 100644
--- a/apps/web/src/features/sandbox/NetworkSettings.test.tsx
+++ b/apps/web/src/features/sandbox/NetworkSettings.test.tsx
@@ -9,7 +9,7 @@ const deployment = (provider: "microsandbox" | "e2b") => ({ provider, specificat
 describe("network policy", () => {
   it("validates domains with the generated rule", () => {
     expect(domainIssues(parseDomains("gitlab.example.com\n\n a.b-c.example \nGit.Example.com\n*.corp.example"))).toEqual([]);
-    expect(domainIssues(["a.*.example.com", "-x.com", "a.com", "a.com", "a".repeat(254)]).map((issue) => issue.problem)).toEqual(["invalid", "invalid", "duplicate", "too_long"]);
+    expect(domainIssues(["a.*.example.com", "*.com", "-x.com", "a.com", "a.com", "a".repeat(254)]).map((issue) => issue.problem)).toEqual(["invalid", "invalid", "invalid", "duplicate", "too_long"]);
     expect(domainIssues(Array.from({ length: 101 }, (_, index) => `h${index}.example.com`))).toEqual([{ problem: "too_many" }]);
   });
 
diff --git a/contracts/agents-api/sandbox-deployment.md b/contracts/agents-api/sandbox-deployment.md
index 89c39e8dc..becba735a 100644
--- a/contracts/agents-api/sandbox-deployment.md
+++ b/contracts/agents-api/sandbox-deployment.md
@@ -68,7 +68,7 @@ Select the filesystem configuration before the microsandbox deployment. Selectin
 | Field | Accepted value |
 | --- | --- |
 | `public` | Boolean. `true` allows public addresses; `false` allows only Core, the model provider and `domains` |
-| `domains` | At most 100 entries of at most 253 characters, each an exact host name or `*.` and a host name, in lowercase letters, digits, hyphens and dots, whose last label starts with a letter. `*.example.com` covers the subdomains of `example.com` at any depth but not `example.com` itself, which needs its own entry; other wildcards, IP literals, ports and URLs are rejected. Core stores them lowercase, deduplicated and sorted. Every address a name resolves to is allowed, private addresses included |
+| `domains` | At most 100 entries of at most 253 characters, each an exact host name or `*.` and a host name of at least two labels, in lowercase letters, digits, hyphens and dots, whose last label starts with a letter. `*.example.com` covers the subdomains of `example.com` at any depth but not `example.com` itself, which needs its own entry; other wildcards, IP literals, ports and URLs are rejected. Core stores them lowercase, deduplicated and sorted. Every address a name resolves to is allowed, private addresses included |
 
 The default is `{"public": true, "domains": []}`. Under every cap, loopback, link-local and cloud-metadata addresses and all other private addresses stay blocked, except that E2B cannot block the metadata address 169.254.169.254 and its sandboxes cannot reach private networks at all. A sandbox keeps the cap of the generation that created it.
 
diff --git a/contracts/agents-api/zh/sandbox-deployment.md b/contracts/agents-api/zh/sandbox-deployment.md
index 435230e75..9e0b2f1d5 100644
--- a/contracts/agents-api/zh/sandbox-deployment.md
+++ b/contracts/agents-api/zh/sandbox-deployment.md
@@ -1,7 +1,7 @@
 ---
 title: "沙箱部署"
 source: contracts/agents-api/sandbox-deployment.md
-source_hash: 596b694775fdf0635e42978f23ce2bc6a26e149583a8a590621daa103f746143
+source_hash: b1624463cdd34795eb6af871e2ef51792f349d73c3fa69623fa55fa063c8f435
 ---
 
 沙箱部署为 Core 管理的 `openai_hosted` 执行选择沙箱提供商和每个沙箱的资源。PostgreSQL 为每个安装维护一个当前有效选择；Web 和 Core API 写入同一配置。节点文件保存其已安装副本和特定于主机的路径，且不能覆盖其资源。Runtime 不属于该选择：每个节点运行其所属安装验证过的 Runtime。该选择独立于 Harness。部署可以保持未配置状态，没有节点；此时它拒绝托管准入。
@@ -71,7 +71,7 @@ microsandbox 会配置 CPU、内存和托管根磁盘，并在挂载于 `/enviro
 | 字段 | 可接受的值 |
 | --- | --- |
 | `public` | 布尔值。`true` 允许公开地址；`false` 只允许 Core、模型提供商和 `domains` |
-| `domains` | 最多 100 个条目，每个不超过 253 个字符，为精确主机名或 `*.` 加主机名，由小写字母、数字、连字符和点组成，且最后一个标签以字母开头。`*.example.com` 覆盖 `example.com` 任意层级的子域名，但不含 `example.com` 本身，后者需要单独条目；其他通配符、IP 字面量、端口和 URL 会被拒绝。Core 以小写、去重并排序的形式存储。名称解析出的每个地址都被允许，包括私有地址 |
+| `domains` | 最多 100 个条目，每个不超过 253 个字符，为精确主机名或 `*.` 加至少两个标签的主机名，由小写字母、数字、连字符和点组成，且最后一个标签以字母开头。`*.example.com` 覆盖 `example.com` 任意层级的子域名，但不含 `example.com` 本身，后者需要单独条目；其他通配符、IP 字面量、端口和 URL 会被拒绝。Core 以小写、去重并排序的形式存储。名称解析出的每个地址都被允许，包括私有地址 |
 
 默认值为 `{"public": true, "domains": []}`。无论哪种上限，回环、链路本地、云元数据地址以及其他所有私有地址始终被阻止，但 E2B 无法阻止元数据地址 169.254.169.254，且 E2B 沙箱根本无法访问私有网络。沙箱保留创建它的代次的上限。
 
diff --git a/deploy/node/node_spec.py b/deploy/node/node_spec.py
index 609b0dc4d..d030c901a 100644
--- a/deploy/node/node_spec.py
+++ b/deploy/node/node_spec.py
@@ -24,7 +24,7 @@ class UnrecordedIdentity(SpecificationError):
 
 # BEGIN GENERATED DEPLOYMENT CONTRACT
 # Generated from sandbox/deployment_contract.go; do not edit.
-_CONTRACT = json.loads("{\"workspace_fields\":[\"attachment\",\"user_xattr\",\"capacity_quota\"],\"resources\":[{\"name\":\"cpus\",\"min\":1,\"max\":255,\"omit_zero\":false},{\"name\":\"memory_mib\",\"min\":512,\"max\":1048576,\"omit_zero\":false},{\"name\":\"root_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true},{\"name\":\"environment_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true}],\"network\":{\"max_domains\":100,\"max_domain_length\":253,\"domain_pattern\":\"^(?:\\\\*\\\\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\\\.)*[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$\"},\"providers\":{\"e2b\":{\"mode\":\"direct\",\"disk\":false,\"default_resources\":null,\"network\":{\"restrict\":true,\"private_domains\":false}},\"microsandbox\":{\"mode\":\"nodes\",\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true},\"disk\":true,\"default_resources\":{\"cpus\":2,\"memory_mib\":4096,\"root_disk_mib\":8192},\"network\":{\"restrict\":true,\"private_domains\":true}}},\"minimum_disk\":1024}")
+_CONTRACT = json.loads("{\"workspace_fields\":[\"attachment\",\"user_xattr\",\"capacity_quota\"],\"resources\":[{\"name\":\"cpus\",\"min\":1,\"max\":255,\"omit_zero\":false},{\"name\":\"memory_mib\",\"min\":512,\"max\":1048576,\"omit_zero\":false},{\"name\":\"root_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true},{\"name\":\"environment_disk_mib\",\"min\":0,\"max\":4294967295,\"omit_zero\":true}],\"network\":{\"max_domains\":100,\"max_domain_length\":253,\"domain_pattern\":\"^(?:\\\\*\\\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\\\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\\\.)*[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$\"},\"providers\":{\"e2b\":{\"mode\":\"direct\",\"disk\":false,\"default_resources\":null,\"network\":{\"restrict\":true,\"private_domains\":false}},\"microsandbox\":{\"mode\":\"nodes\",\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true},\"disk\":true,\"default_resources\":{\"cpus\":2,\"memory_mib\":4096,\"root_disk_mib\":8192},\"network\":{\"restrict\":true,\"private_domains\":true}}},\"minimum_disk\":1024}")
 # END GENERATED DEPLOYMENT CONTRACT
 
 
diff --git a/docs/maintainers.md b/docs/maintainers.md
index dd6222724..cfae5a5f3 100644
--- a/docs/maintainers.md
+++ b/docs/maintainers.md
@@ -116,7 +116,7 @@ The helper is written to `~/.oac/build/microsandbox-provider/oac-microsandbox-pr
 
 **microsandbox runtime.** The distribution uses the archive `microsandbox-linux-x86_64.tar.gz` of the fork release [oac-v0.7.11-2](https://github.com/SaladDay/microsandbox/releases/tag/oac-v0.7.11-2), SHA256 `9ca514e58d7156954537210d2e673c07b091ed5137775b8952ecfd2e96d85638` (`RUNTIME_ARCHIVE_SHA256` in `scripts/core-distribution-manifest.py`). The build verifies the checksum before extracting `msb` and `libkrunfw.so.5.6.1` and records both files' hashes. The helper checks those hashes on every call and never installs or upgrades them.
 
-**microsandbox fork.** The SDK, its FFI and the `msb` runtime come from the `oac` branch of [SaladDay/microsandbox](https://github.com/SaladDay/microsandbox/tree/oac): an upstream release tag plus a short queue of patches, listed by `git log v0.7.11..oac`. Each patch is also proposed upstream and dropped once an upstream release carries it. Pushing a tag `oac-v<upstream version>-<n>` builds the Linux amd64 FFI and the runtime archive in the same manylinux 2.28 container as upstream releases, with the official `libkrunfw` of the same upstream version instead of a kernel build, and attaches them, with their SHA256 files, to a release of that tag (`.github/workflows/oac-release.yml`). To move to a new tag, point the SDK `replace` in `services/core/tools/microsandbox-provider/go.mod` at the tagged commit, update `FFI_URL` and `FFI_SHA256` in `scripts/build-microsandbox-provider.py`, `msb_tag` in `scripts/build-core-distribution.sh` and `RUNTIME_ARCHIVE_SHA256`.
+**microsandbox fork.** The SDK, its FFI and the `msb` runtime come from the `oac` branch of [SaladDay/microsandbox](https://github.com/SaladDay/microsandbox/tree/oac): an upstream release tag plus a short queue of patches, listed by `git log v0.7.11..oac`. Each patch is also proposed upstream and dropped once an upstream release carries it. Pushing a tag `oac-v<upstream version>-<n>` builds the Linux amd64 FFI and the runtime archive in the same manylinux 2.28 container as upstream releases, with the official `libkrunfw` of the same upstream version instead of a kernel build, and attaches them, with their SHA256 files, to a release of that tag (`.github/workflows/oac-release.yml`). To move to a new tag, point the SDK `replace` in `services/core/tools/microsandbox-provider/go.mod` at the tagged commit, update `FORK_TAG` and `FFI_SHA256` in `scripts/build-microsandbox-provider.py` and `RUNTIME_ARCHIVE_SHA256`.
 
 ### Standalone Core builds
 
diff --git a/docs/zh/maintainers.md b/docs/zh/maintainers.md
index 6a82b2272..c3b994c47 100644
--- a/docs/zh/maintainers.md
+++ b/docs/zh/maintainers.md
@@ -1,7 +1,7 @@
 ---
 title: "构建并发布 OpenAgentCore"
 source: docs/maintainers.md
-source_hash: 501bab94d8cffb809a9a0ae43537db1d707de5bf368e749ab36e9c0db56b0c33
+source_hash: af77ec1c4a27d4742497068cee88195f07e9fb38e48bed89b9120e21e1a726b4
 ---
 
 本指南面向负责构建和发布 OpenAgentCore 的维护者。要安装 Core 和 Web，请按 [安装 Core 和 Web](getting-started/install.md) 操作。安装程序代码遵循的规则见 [部署](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) 和 [节点安装程序](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md)；必需检查见 [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks)。
@@ -118,7 +118,7 @@ make check-microsandbox-provider
 
 **microsandbox 运行时。** 分发包使用 fork 发布 [oac-v0.7.11-2](https://github.com/SaladDay/microsandbox/releases/tag/oac-v0.7.11-2) 的归档 `microsandbox-linux-x86_64.tar.gz`，SHA256 为 `9ca514e58d7156954537210d2e673c07b091ed5137775b8952ecfd2e96d85638`（即 `scripts/core-distribution-manifest.py` 中的 `RUNTIME_ARCHIVE_SHA256`）。构建过程会先验证校验和，再解压 `msb` 和 `libkrunfw.so.5.6.1`，并记录这两个文件的哈希。辅助程序会在每次调用时检查这些哈希，并且绝不安装或升级它们。
 
-**microsandbox fork。** SDK、其 FFI 和 `msb` 运行时来自 [SaladDay/microsandbox](https://github.com/SaladDay/microsandbox/tree/oac) 的 `oac` 分支：一个上游发布标签加上一小队补丁，补丁列表见 `git log v0.7.11..oac`。每个补丁同时向上游提交，上游发布包含它之后就从队列中删除。推送 `oac-v<upstream version>-<n>` 标签会在与上游发布相同的 manylinux 2.28 容器中构建 Linux amd64 FFI 和运行时归档，其中 `libkrunfw` 使用同一上游版本的官方文件而不构建内核，并把它们连同 SHA256 文件附加到该标签的 release（`.github/workflows/oac-release.yml`）。要换到新标签，把 `services/core/tools/microsandbox-provider/go.mod` 中 SDK 的 `replace` 指向该标签的提交，并更新 `scripts/build-microsandbox-provider.py` 中的 `FFI_URL` 和 `FFI_SHA256`、`scripts/build-core-distribution.sh` 中的 `msb_tag` 以及 `RUNTIME_ARCHIVE_SHA256`。
+**microsandbox fork。** SDK、其 FFI 和 `msb` 运行时来自 [SaladDay/microsandbox](https://github.com/SaladDay/microsandbox/tree/oac) 的 `oac` 分支：一个上游发布标签加上一小队补丁，补丁列表见 `git log v0.7.11..oac`。每个补丁同时向上游提交，上游发布包含它之后就从队列中删除。推送 `oac-v<upstream version>-<n>` 标签会在与上游发布相同的 manylinux 2.28 容器中构建 Linux amd64 FFI 和运行时归档，其中 `libkrunfw` 使用同一上游版本的官方文件而不构建内核，并把它们连同 SHA256 文件附加到该标签的 release（`.github/workflows/oac-release.yml`）。要换到新标签，把 `services/core/tools/microsandbox-provider/go.mod` 中 SDK 的 `replace` 指向该标签的提交，并更新 `scripts/build-microsandbox-provider.py` 中的 `FORK_TAG` 和 `FFI_SHA256` 以及 `RUNTIME_ARCHIVE_SHA256`。
 
 ### 独立 Core 构建 {#standalone-core-builds}
 
diff --git a/packages/agents-client/src/deployment-contract.ts b/packages/agents-client/src/deployment-contract.ts
index f13885a66..aa20bcd37 100644
--- a/packages/agents-client/src/deployment-contract.ts
+++ b/packages/agents-client/src/deployment-contract.ts
@@ -1,3 +1,3 @@
 // Code generated by services/core/cmd/specification-contract from sandbox/deployment_contract.go; DO NOT EDIT.
 
-export const deploymentContract = {"workspace_fields":["attachment","user_xattr","capacity_quota"],"resources":[{"name":"cpus","min":1,"max":255,"omit_zero":false},{"name":"memory_mib","min":512,"max":1048576,"omit_zero":false},{"name":"root_disk_mib","min":0,"max":4294967295,"omit_zero":true},{"name":"environment_disk_mib","min":0,"max":4294967295,"omit_zero":true}],"network":{"max_domains":100,"max_domain_length":253,"domain_pattern":"^(?:\\*\\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"providers":{"e2b":{"mode":"direct","disk":false,"default_resources":null,"network":{"restrict":true,"private_domains":false},"setup":{"label":"E2B","summary":{"en":"Runs sandboxes in a hosted E2B-compatible cloud: no machines to manage, billed by the service.","zh-CN":"沙箱运行在托管的 E2B 兼容云端：无需管理机器，由服务方计费。"},"recommended":false,"fields":[{"name":"api_key","secret":true,"optional":false,"discovered":false,"label":{"en":"API key","zh-CN":"API 密钥"},"help":{"en":"","zh-CN":""}},{"name":"template","secret":false,"optional":false,"discovered":true,"label":{"en":"Template build","zh-CN":"模板构建"},"help":{"en":"Core validates the exact ready build again when you save.","zh-CN":"保存时 Core 会再次校验这个已就绪的构建。"}},{"name":"api_url","secret":false,"optional":true,"discovered":false,"label":{"en":"Sandbox API URL","zh-CN":"沙箱 API 地址"},"help":{"en":"The selected service supplies a default. You can edit it for a compatible endpoint.","zh-CN":"所选服务会提供默认值，兼容的端点可以自行修改。"}},{"name":"domain","secret":false,"optional":true,"discovered":false,"label":{"en":"Sandbox data-plane domain","zh-CN":"沙箱数据面域名"},"help":{"en":"","zh-CN":""}}],"presets":[{"label":"SandBase Sandbox","values":{"api_url":"https://sandbox.sandbase.ai","domain":"sandbox.sandbase.ai"},"credential_url":"https://www.sandbase.ai/console/keys"},{"label":"E2B","values":{"api_url":"https://api.e2b.app","domain":"e2b.app"},"credential_url":"https://e2b.dev/dashboard?tab=api-keys"}],"credential":"required","public_origin":"required","discovery":true}},"microsandbox":{"mode":"nodes","workspace":{"attachment":"host_directory","user_xattr":true},"disk":true,"default_resources":{"cpus":2,"memory_mib":4096,"root_disk_mib":8192},"network":{"restrict":true,"private_domains":true},"setup":{"label":"microsandbox","summary":{"en":"Runs each sandbox as a lightweight virtual machine: stronger isolation and a root disk size limit, with each sandbox's /environment on workspace storage, but the host needs KVM.","zh-CN":"每个沙箱是一个轻量虚拟机：隔离更强，能限制根盘大小，每个沙箱的 /environment 位于工作区存储上，但主机需要支持 KVM。"},"recommended":true,"fields":[],"presets":[],"credential":"not_required","public_origin":"not_required","discovery":false}}},"minimum_disk":1024} as const;
+export const deploymentContract = {"workspace_fields":["attachment","user_xattr","capacity_quota"],"resources":[{"name":"cpus","min":1,"max":255,"omit_zero":false},{"name":"memory_mib","min":512,"max":1048576,"omit_zero":false},{"name":"root_disk_mib","min":0,"max":4294967295,"omit_zero":true},{"name":"environment_disk_mib","min":0,"max":4294967295,"omit_zero":true}],"network":{"max_domains":100,"max_domain_length":253,"domain_pattern":"^(?:\\*\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"providers":{"e2b":{"mode":"direct","disk":false,"default_resources":null,"network":{"restrict":true,"private_domains":false},"setup":{"label":"E2B","summary":{"en":"Runs sandboxes in a hosted E2B-compatible cloud: no machines to manage, billed by the service.","zh-CN":"沙箱运行在托管的 E2B 兼容云端：无需管理机器，由服务方计费。"},"recommended":false,"fields":[{"name":"api_key","secret":true,"optional":false,"discovered":false,"label":{"en":"API key","zh-CN":"API 密钥"},"help":{"en":"","zh-CN":""}},{"name":"template","secret":false,"optional":false,"discovered":true,"label":{"en":"Template build","zh-CN":"模板构建"},"help":{"en":"Core validates the exact ready build again when you save.","zh-CN":"保存时 Core 会再次校验这个已就绪的构建。"}},{"name":"api_url","secret":false,"optional":true,"discovered":false,"label":{"en":"Sandbox API URL","zh-CN":"沙箱 API 地址"},"help":{"en":"The selected service supplies a default. You can edit it for a compatible endpoint.","zh-CN":"所选服务会提供默认值，兼容的端点可以自行修改。"}},{"name":"domain","secret":false,"optional":true,"discovered":false,"label":{"en":"Sandbox data-plane domain","zh-CN":"沙箱数据面域名"},"help":{"en":"","zh-CN":""}}],"presets":[{"label":"SandBase Sandbox","values":{"api_url":"https://sandbox.sandbase.ai","domain":"sandbox.sandbase.ai"},"credential_url":"https://www.sandbase.ai/console/keys"},{"label":"E2B","values":{"api_url":"https://api.e2b.app","domain":"e2b.app"},"credential_url":"https://e2b.dev/dashboard?tab=api-keys"}],"credential":"required","public_origin":"required","discovery":true}},"microsandbox":{"mode":"nodes","workspace":{"attachment":"host_directory","user_xattr":true},"disk":true,"default_resources":{"cpus":2,"memory_mib":4096,"root_disk_mib":8192},"network":{"restrict":true,"private_domains":true},"setup":{"label":"microsandbox","summary":{"en":"Runs each sandbox as a lightweight virtual machine: stronger isolation and a root disk size limit, with each sandbox's /environment on workspace storage, but the host needs KVM.","zh-CN":"每个沙箱是一个轻量虚拟机：隔离更强，能限制根盘大小，每个沙箱的 /environment 位于工作区存储上，但主机需要支持 KVM。"},"recommended":true,"fields":[],"presets":[],"credential":"not_required","public_origin":"not_required","discovery":false}}},"minimum_disk":1024} as const;
diff --git a/scripts/build-core-distribution.sh b/scripts/build-core-distribution.sh
index e62fd91d8..a56e1ad57 100755
--- a/scripts/build-core-distribution.sh
+++ b/scripts/build-core-distribution.sh
@@ -119,8 +119,7 @@ cp deploy/compose/compose.yaml "$bundle/compose.yaml.template"
 OAC_DEV_BUILD_REVISION="$revision" scripts/build-core-image-context.sh "$stage/core"
 cp "$stage/core/bin/oac" "$bundle/oac"
 python3 scripts/build-microsandbox-provider.py build "$stage/core/bin/oac-microsandbox-provider"
-# The fork release that also provides the FFI (docs/maintainers.md).
-msb_tag=oac-v0.7.11-2
+msb_tag="$(python3 scripts/build-microsandbox-provider.py tag)"
 msb_archive="${CORE_DISTRIBUTION_MICROSANDBOX_ARCHIVE:-$runtime_root/cache/microsandbox-$msb_tag-linux-x86_64.tar.gz}"
 if [[ ! -f "$msb_archive" ]]; then
   mkdir -p "$(dirname "$msb_archive")"
diff --git a/scripts/build-microsandbox-provider.py b/scripts/build-microsandbox-provider.py
index ef6367d92..5c869e03c 100644
--- a/scripts/build-microsandbox-provider.py
+++ b/scripts/build-microsandbox-provider.py
@@ -11,10 +11,11 @@
 import tempfile
 
 SDK_MODULE = "github.com/superradcompany/microsandbox/sdk/go"
-# The SDK source (go.mod replace) and this FFI come from the same tag of the fork; see docs/maintainers.md.
+# The SDK source (go.mod replace), this FFI and the runtime archive come from this tag of the fork; see docs/maintainers.md.
+FORK_TAG = "oac-v0.7.11-2"
 SDK_FORK = "github.com/SaladDay/microsandbox/sdk/go"
 FFI_FILE = "libmicrosandbox_go_ffi-linux-amd64.so"
-FFI_URL = "https://github.com/SaladDay/microsandbox/releases/download/oac-v0.7.11-2/" + FFI_FILE
+FFI_URL = f"https://github.com/SaladDay/microsandbox/releases/download/{FORK_TAG}/{FFI_FILE}"
 FFI_SHA256 = "c04e6256ee24335e2de4635361d5ae53674573818859113474020274d1fd0a29"
 
 
@@ -36,9 +37,12 @@ def install_ffi(source, destination):
 
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("operation", choices=("build", "test"))
+    parser.add_argument("operation", choices=("build", "test", "tag"))
     parser.add_argument("output", nargs="?", type=Path)
     args = parser.parse_args()
+    if args.operation == "tag":
+        print(FORK_TAG)
+        return
     if (args.operation == "build") != (args.output is not None):
         parser.error("build requires an absolute output path; test takes no output")
     if args.output is not None and not args.output.is_absolute():
diff --git a/services/core/internal/sandbox/microsandbox/process.go b/services/core/internal/sandbox/microsandbox/process.go
index c622cc2aa..d90cf02be 100644
--- a/services/core/internal/sandbox/microsandbox/process.go
+++ b/services/core/internal/sandbox/microsandbox/process.go
@@ -70,15 +70,15 @@ func (p *ProcessCaller) Call(ctx context.Context, q Request) (Response, error) {
 			return Response{}, errors.New("helper result unconfirmed")
 		}
 	}
-	// The helper reports host names it could not resolve or support as "unresolved <name>" and "unsupported <name>" lines.
-	var names []string
+	// The helper reports Endpoints it cannot turn into a rule as "unsupported <endpoint>" lines.
+	var unsupported []string
 	for _, line := range strings.Split(stderr.String(), "\n") {
-		if strings.HasPrefix(line, "unresolved ") || strings.HasPrefix(line, "unsupported ") {
-			names = append(names, line)
+		if strings.HasPrefix(line, "unsupported ") {
+			unsupported = append(unsupported, line)
 		}
 	}
-	if len(names) > 0 {
-		log.Bg().Warn("sandbox network names without an address", "operation", q.Operation, "names", strings.Join(names, "; "))
+	if len(unsupported) > 0 {
+		log.Bg().Warn("sandbox network endpoints without a rule", "operation", q.Operation, "endpoints", strings.Join(unsupported, "; "))
 	}
 	var out Response
 	decoder := json.NewDecoder(bytes.NewReader(stdout.Bytes()))
diff --git a/services/core/internal/sandbox/network.go b/services/core/internal/sandbox/network.go
index 1cc478f0c..f12e11d5d 100644
--- a/services/core/internal/sandbox/network.go
+++ b/services/core/internal/sandbox/network.go
@@ -19,8 +19,9 @@ const (
 )
 
 // domainPattern is the cap's rule: an exact host name as the Environment
-// network field accepts, or "*." and a host name for its subdomains.
-var domainPattern = `^(?:\*\.)?` + agentnetwork.HostPattern[1:]
+// network field accepts, or "*." and a host name of at least two labels for
+// its subdomains, never a whole top-level domain.
+var domainPattern = `^(?:\*\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)?` + strings.TrimPrefix(agentnetwork.HostPattern, "^")
 
 var (
 	domainRule = regexp.MustCompile(agentnetwork.HostPattern)
@@ -89,7 +90,7 @@ func (e Egress) Validate() error {
 			return ErrInvalid
 		}
 		for _, d := range names {
-			if !ValidDomain(d) && !(i == 0 && capRule.MatchString(d)) {
+			if !ValidDomain(d) && !(i == 0 && len(d) <= maxDomainLength && capRule.MatchString(d)) {
 				return ErrInvalid
 			}
 		}
diff --git a/services/core/internal/sandbox/testdata/deployment-contract.json b/services/core/internal/sandbox/testdata/deployment-contract.json
index 4e03d1834..0d93bd3a1 100644
--- a/services/core/internal/sandbox/testdata/deployment-contract.json
+++ b/services/core/internal/sandbox/testdata/deployment-contract.json
@@ -423,6 +423,32 @@
     "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024,\"environment_disk_mib\":4294967295},\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true,\"capacity_quota\":true}}",
     "digest": "a0f5348e68e36ff01ffcef3e6c71c5eddfd429f34b440a4b3bb273b8f9eeac94"
   },
+  {
+    "name": "network-tld-wildcard-rejected",
+    "provider": "microsandbox",
+    "specification": {
+      "resources": {
+        "cpus": 255,
+        "memory_mib": 1048576,
+        "root_disk_mib": 1024,
+        "environment_disk_mib": 4294967295
+      },
+      "workspace": {
+        "attachment": "host_directory",
+        "user_xattr": true,
+        "capacity_quota": true
+      },
+      "network": {
+        "public": true,
+        "domains": [
+          "*.com"
+        ]
+      }
+    },
+    "valid": false,
+    "canonical": "{\"provider\":\"microsandbox\",\"resources\":{\"cpus\":255,\"memory_mib\":1048576,\"root_disk_mib\":1024,\"environment_disk_mib\":4294967295},\"workspace\":{\"attachment\":\"host_directory\",\"user_xattr\":true,\"capacity_quota\":true}}",
+    "digest": "a0f5348e68e36ff01ffcef3e6c71c5eddfd429f34b440a4b3bb273b8f9eeac94"
+  },
   {
     "name": "network-ip-literal-rejected",
     "provider": "microsandbox",

From 32eb17f4f330b43f449980d9aa038514f1e82de1 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 28 Oct 2026 13:11:32 +0000
Subject: [PATCH 6/6] Accept cap subdomain wildcards in the Web network
 acceptance test

*.example.com is now a valid cap entry; *.com is the invalid one.
---
 apps/web/e2e/sandbox-lifecycle.spec.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/web/e2e/sandbox-lifecycle.spec.ts b/apps/web/e2e/sandbox-lifecycle.spec.ts
index 019da63b6..3e8d7430d 100644
--- a/apps/web/e2e/sandbox-lifecycle.spec.ts
+++ b/apps/web/e2e/sandbox-lifecycle.spec.ts
@@ -70,14 +70,14 @@ test("edits the sandbox network cap for new sandboxes", async ({ page, request }
   const area = page.getByRole("region", { name: "Network" });
   const domains = area.getByLabel("Extra allowed domains");
   await expect(area.getByRole("switch", { name: "Allow public internet" })).toBeChecked();
-  await domains.fill("Git.example.com\n*.example.com");
-  await expect(area.getByText("*.example.com is not a valid host name.")).toBeVisible();
+  await domains.fill("Git.example.com\n*.com");
+  await expect(area.getByText("*.com is not a valid host name.")).toBeVisible();
   await expect(area.getByRole("button", { name: "Save", exact: true })).toBeDisabled();
-  await domains.fill("gitlab.example.com");
+  await domains.fill("gitlab.example.com\n*.corp.example");
   await area.getByRole("switch", { name: "Allow public internet" }).uncheck();
   const response = page.waitForResponse((response) => response.request().method() === "PUT" && response.url().endsWith("/sandbox/deployment"));
   await area.getByRole("button", { name: "Save", exact: true }).click();
-  expect((await response).request().postDataJSON().network).toEqual({ public: false, domains: ["gitlab.example.com"] });
+  expect((await response).request().postDataJSON().network).toEqual({ public: false, domains: ["gitlab.example.com", "*.corp.example"] });
   await expect(page.getByText("New sandboxes will run with this policy")).toBeVisible();
 });