vercel/ai · error · HarnessCapabilityUnsupportedError

Cannot set the network policy because the current Vercel San

Error message

Cannot set the network policy because the current Vercel Sandbox policy contains request transformations whose redacted values cannot be preserved safely. Replace them explicitly with setRequestTransformations() or rehydrate them with addRequestTransformations() first.

What it means

Vercel NetworkPolicyManager owns the sandbox's full network policy. When the manager has no private state yet (#state == null) and the live policy read back from Vercel contains request transformations (whose header values Vercel redacts), calling setNetworkPolicy would silently destroy those transformations. To prevent data loss, it throws HarnessCapabilityUnsupportedError (via createPolicyConflictError).

Source

Thrown at packages/sandbox-vercel/src/vercel-network-policy-manager.ts:68

 * that structure through `sandbox.update()`.
 */
export class VercelNetworkPolicyManager {
  readonly #sandbox: Sandbox;
  #state: ManagedPolicyState | undefined;
  #mutationQueue: Promise<void> = Promise.resolve();

  constructor({ sandbox }: { sandbox: Sandbox }) {
    this.#sandbox = sandbox;
  }

  setNetworkPolicy(policy: HarnessV1NetworkPolicy): Promise<void> {
    return this.#enqueueMutation(async () => {
      const inspection = this.#inspectPolicy();
      if (
        this.#state == null &&
        inspection.requestTransformationHosts.length > 0
      ) {
        throw createPolicyConflictError(
          'Cannot set the network policy because the current Vercel Sandbox policy contains request transformations whose redacted values cannot be preserved safely. Replace them explicitly with setRequestTransformations() or rehydrate them with addRequestTransformations() first.',
        );
      }

      await this.#applyState({
        accessPolicy: toNetworkAccessPolicy(policy),
        requestTransformations:
          this.#state?.requestTransformations.map(cloneRequestTransformation) ??
          [],
        forwardRules: inspection.forwardRules.map(cloneForwardRule),
        currentPolicy: inspection.currentPolicy,
      });
    });
  }

  setRequestTransformations(
    transformations: ReadonlyArray<HarnessV1RequestTransformation>,
  ): Promise<void> {

View on GitHub (pinned to 69428b1f8b)

Solutions

1. Call setRequestTransformations() with the explicit full set of transformations you want before/instead of relying on preservation, then call setNetworkPolicy().
2. Or rehydrate the existing transformations via addRequestTransformations() so the manager attributes and stores them, then call setNetworkPolicy().
3. If the existing transformations are unwanted, overwrite the whole policy through setRequestTransformations([]) first to clear them, then set the network policy.
4. Avoid mutating the sandbox network policy directly with @vercel/sandbox APIs; route all policy changes through the manager so #state stays authoritative.

Example fix

// before
await manager.setNetworkPolicy({ mode: 'custom', allowedHosts: ['api.example.com'] });
// after
await manager.setRequestTransformations([]); // explicitly own/replace transformations
await manager.setNetworkPolicy({ mode: 'custom', allowedHosts: ['api.example.com'] });

// before calling setNetworkPolicy on a fresh manager
const existing = sandbox.currentSession().networkPolicy;
const hasTransformations =
  existing != null && existing !== 'allow-all' && existing !== 'deny-all' &&
  (existing.rules ?? []).some((r: any) => (r.requestTransformations ?? []).length > 0);
if (hasTransformations) {
  // rehydrate or replace transformations first
  await manager.setRequestTransformations([]); // or the adopted set
}
await manager.setNetworkPolicy(policy);

function policyHasRequestTransformations(p: unknown): boolean {
  if (p == null || typeof p !== 'object') return false;
  const rules = (p as any).rules;
  return Array.isArray(rules) && rules.some((r: any) => Array.isArray(r?.requestTransformations) && r.requestTransformations.length > 0);
}

try {
  await manager.setNetworkPolicy(policy);
} catch (error) {
  if (error instanceof HarnessCapabilityUnsupportedError) {
    // transformations exist that we don't own; declare them explicitly then retry once
    await manager.setRequestTransformations([]);
    await manager.setNetworkPolicy(policy);
  } else throw error;
}

When it happens

Trigger: Calling setNetworkPolicy() on a fresh VercelNetworkPolicyManager (before any setRequestTransformations/addRequestTransformations succeeded) when sandbox.currentSession().networkPolicy already contains rules with request transformations — typically a policy created outside this manager, or a resumed session.

Common situations: Resuming a sandbox whose policy was configured in a previous run with header-rewriting transformations; another process or direct @vercel/sandbox update() calls set transformations; app startup calls setNetworkPolicy before re-establishing transformations.

Related errors

• Cannot add request transformations because the current Verce
• Custom network policy requires at least one of allowedHosts,
• Cannot write harness skill '${skillName}': ${skillDir} alrea

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/799ea954409f439d. Report an issue: GitHub.