# Egress allowlist -- copy to ~/.config/ai-sandbox/allow (user-wide) or to
# ./.ai-sandbox/allow in a repository (checked in, so the policy is reviewable).
#
# One entry per line. '#' starts a comment. Blank lines are ignored.
# In --net allow mode at least one entry is required; an empty list is an error.
#
#   domain            matched by the gate, including subdomains, at CONNECT time
#   domain:port       same, and a direct netfilter rule for that port
#   10.0.0.5:5432     pinned host and port (databases, internal services)
#   10.20.0.0/24      pinned subnet (default ports 80,443 unless :port given)
#   [fd00::5]:8443    pinned ipv6

aipi.reeseapps.com                               # your model gateway
registry.npmjs.org

# typical additions, by kind:
# another gateway or a LAN inference host:
# gateway.internal:8443
# github.com                                     # git push, if you also mount ~/.ssh
# pypi.org
# files.pythonhosted.org
# index.crates.io
# proxy.golang.org