# Whitelisted domains for the Claude Code sandbox firewall
# One domain per line. Lines starting with # are comments.

# npm ecosystem
registry.npmjs.org
npmjs.org
npm.org

# Python ecosystem
pypi.org
files.pythonhosted.org
pypi.python.org
pythonhosted.org
bootstrap.pypa.io

# Container registries
docker.io
registry-1.docker.io
production.cloudflare.docker.com
ghcr.io
gcr.io
quay.io

# CDNs (commonly used by npm packages)
unpkg.com
cdn.jsdelivr.net
cdnjs.cloudflare.com

# GitHub (beyond the /meta IPs)
raw.githubusercontent.com
objects.githubusercontent.com
codeload.github.com
gist.githubusercontent.com

# Rust ecosystem
crates.io
static.crates.io

# Go ecosystem
proxy.golang.org
sum.golang.org

# NOTE: Claude's telemetry/auth hosts (api.anthropic.com, statsig.anthropic.com,
# statsig.com, sentry.io) are deliberately NOT here. The cage reaches the model
# only through the host proxy -- the key never enters the cage -- so the API host
# is not needed inside, and statsig.anthropic.com (which doesn't resolve off
# Anthropic's network) printed a resolve WARNING on every start. An isolation
# cage should not phone telemetry home. If you run a harness that genuinely needs
# a direct host, add it per-cage with `ltd --allow-domains-file`.

# VS Code
marketplace.visualstudio.com
vscode.blob.core.windows.net
update.code.visualstudio.com

# ============================================================================
# PATH TO PROXY-ONLY EGRESS (package registries can be removed)
# ============================================================================
# The package-registry entries above (npm, Python, container, Rust, Go
# ecosystems -- e.g. registry.npmjs.org, pypi.org, files.pythonhosted.org,
# crates.io, proxy.golang.org, docker.io, ghcr.io) are only needed because the
# in-cage agent may fetch harness packages at runtime.
#
# Once the TRUSTED nightly cooldown cache (scripts/refresh-harness-cache.sh)
# reliably pre-fetches every harness package on the HOST and the cage consumes
# it via the read-only harness-cache mount, the agent no longer needs to reach
# these registries itself. At that point those registry domains can be DELETED
# from this file, leaving only the model proxy reachable -- i.e. proxy-only
# egress (pair with LTD_EGRESS_PROXY_ONLY + LTD_PROXY_HOST in init-firewall.sh).
#
# Do NOT delete them yet: removing a registry before the cache covers its
# packages will make uv/npm installs fail closed inside the cage.
# ============================================================================
