{"record":{"id":"799ea954409f439d","repo":"vercel/ai","slug":"cannot-set-the-network-policy-because-the-current","errorCode":null,"errorMessage":"Cannot set the network policy because the current Vercel Sandbox policy contains request transformations whose redacted values cannot be preserved safely. Replace them explicitly with setRequestTransformations() or rehydrate them with addRequestTransformations() first.","messagePattern":"Cannot set the network policy because the current Vercel Sandbox policy contains request transformations whose redacted values cannot be preserved safely\\. Replace them explicitly with setRequestTransformations\\(\\) or rehydrate them with addRequestTransformations\\(\\) first\\.","errorType":"exception","errorClass":"HarnessCapabilityUnsupportedError","httpStatus":null,"severity":"error","filePath":"packages/sandbox-vercel/src/vercel-network-policy-manager.ts","lineNumber":68,"sourceCode":" * that structure through `sandbox.update()`.\n */\nexport class VercelNetworkPolicyManager {\n  readonly #sandbox: Sandbox;\n  #state: ManagedPolicyState | undefined;\n  #mutationQueue: Promise<void> = Promise.resolve();\n\n  constructor({ sandbox }: { sandbox: Sandbox }) {\n    this.#sandbox = sandbox;\n  }\n\n  setNetworkPolicy(policy: HarnessV1NetworkPolicy): Promise<void> {\n    return this.#enqueueMutation(async () => {\n      const inspection = this.#inspectPolicy();\n      if (\n        this.#state == null &&\n        inspection.requestTransformationHosts.length > 0\n      ) {\n        throw createPolicyConflictError(\n          'Cannot set the network policy because the current Vercel Sandbox policy contains request transformations whose redacted values cannot be preserved safely. Replace them explicitly with setRequestTransformations() or rehydrate them with addRequestTransformations() first.',\n        );\n      }\n\n      await this.#applyState({\n        accessPolicy: toNetworkAccessPolicy(policy),\n        requestTransformations:\n          this.#state?.requestTransformations.map(cloneRequestTransformation) ??\n          [],\n        forwardRules: inspection.forwardRules.map(cloneForwardRule),\n        currentPolicy: inspection.currentPolicy,\n      });\n    });\n  }\n\n  setRequestTransformations(\n    transformations: ReadonlyArray<HarnessV1RequestTransformation>,\n  ): Promise<void> {","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/sandbox-vercel/src/vercel-network-policy-manager.ts#L50-L86","documentation":"Vercel NetworkPolicyManager owns the sandbox's full network policy. When the manager has no private state yet (#state == null) and the live policy read back from Vercel contains request transformations (whose header values Vercel redacts), calling setNetworkPolicy would silently destroy those transformations. To prevent data loss, it throws HarnessCapabilityUnsupportedError (via createPolicyConflictError).","triggerScenarios":"Calling setNetworkPolicy() on a fresh VercelNetworkPolicyManager (before any setRequestTransformations/addRequestTransformations succeeded) when sandbox.currentSession().networkPolicy already contains rules with request transformations — typically a policy created outside this manager, or a resumed session.","commonSituations":"Resuming a sandbox whose policy was configured in a previous run with header-rewriting transformations; another process or direct @vercel/sandbox update() calls set transformations; app startup calls setNetworkPolicy before re-establishing transformations.","solutions":["Call setRequestTransformations() with the explicit full set of transformations you want before/instead of relying on preservation, then call setNetworkPolicy().","Or rehydrate the existing transformations via addRequestTransformations() so the manager attributes and stores them, then call setNetworkPolicy().","If the existing transformations are unwanted, overwrite the whole policy through setRequestTransformations([]) first to clear them, then set the network policy.","Avoid mutating the sandbox network policy directly with @vercel/sandbox APIs; route all policy changes through the manager so #state stays authoritative."],"exampleFix":"// before\nawait manager.setNetworkPolicy({ mode: 'custom', allowedHosts: ['api.example.com'] });\n// after\nawait manager.setRequestTransformations([]); // explicitly own/replace transformations\nawait manager.setNetworkPolicy({ mode: 'custom', allowedHosts: ['api.example.com'] });","handlingStrategy":"validation","validationCode":"// before calling setNetworkPolicy on a fresh manager\nconst existing = sandbox.currentSession().networkPolicy;\nconst hasTransformations =\n  existing != null && existing !== 'allow-all' && existing !== 'deny-all' &&\n  (existing.rules ?? []).some((r: any) => (r.requestTransformations ?? []).length > 0);\nif (hasTransformations) {\n  // rehydrate or replace transformations first\n  await manager.setRequestTransformations([]); // or the adopted set\n}\nawait manager.setNetworkPolicy(policy);","typeGuard":"function policyHasRequestTransformations(p: unknown): boolean {\n  if (p == null || typeof p !== 'object') return false;\n  const rules = (p as any).rules;\n  return Array.isArray(rules) && rules.some((r: any) => Array.isArray(r?.requestTransformations) && r.requestTransformations.length > 0);\n}","tryCatchPattern":"try {\n  await manager.setNetworkPolicy(policy);\n} catch (error) {\n  if (error instanceof HarnessCapabilityUnsupportedError) {\n    // transformations exist that we don't own; declare them explicitly then retry once\n    await manager.setRequestTransformations([]);\n    await manager.setNetworkPolicy(policy);\n  } else throw error;\n}","preventionTips":["Route every policy mutation through VercelNetworkPolicyManager; never call sandbox.update() with a hand-built policy.","On session resume, rehydrate transformations via addRequestTransformations() before changing access policy.","Inspect sandbox.currentSession().networkPolicy at startup to detect pre-existing transformation rules.","Always call setRequestTransformations() (even with []) before your first setNetworkPolicy() when transformations may exist."],"tags":["vercel-sandbox","network-policy","request-transformation","conflict"],"backgroundTag":"policy-conflict-redacted-values","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}