Profa 6b69449a4b fix(network): change network policies to opt-in instead of opt-out ...

BREAKING CHANGE: Network policies are now permissive by default

Previously, all agents had restrictive domain whitelisting enabled by
default (blockUnknownDomains: true), which blocked access to:
- Multi-model router's 8+ LLM providers (only Anthropic was allowed)
- Arbitrary websites needed for QE testing purposes

Changes:
- Default policies now use blockUnknownDomains: false (permissive)
- Rate limiting still applies for protection
- Audit logging enabled by default for visibility
- Added LLM_PROVIDER_DOMAINS constant with 15 provider domains
- Added createRestrictivePolicy() for opt-in security when needed
- Added enableRestrictiveModeGlobally() for secure deployments

For security-sensitive deployments, use:
```typescript
// Option 1: Per-agent restrictive policy
const policy = createRestrictivePolicy('qe-test-generator', ['custom.api.com']);
manager.registerPolicy(policy);

// Option 2: Global restrictive mode
enableRestrictiveModeGlobally();
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-01-05 12:41:23 +00:00

..

agent.Dockerfile

fix(network): change network policies to opt-in instead of opt-out

2026-01-05 12:41:23 +00:00

docker-compose.sandbox.yml

fix(network): change network policies to opt-in instead of opt-out

2026-01-05 12:41:23 +00:00