Bug Description

Preview URLs generated by exposePort() contain underscores in the hostname, which violates DNS hostname requirements (RFC 952/1123). This causes DNS resolution to fail.

Example

Generated URL:

https://5173-project-daf8601c-5910-472c-a1fc-4577fc0b18c4-iu94fhoxsc_a5klf.preview.forgeagent.app

The token portion iu94fhoxsc_a5klf contains an underscore (_).

Root Cause

In packages/sandbox/src/sandbox.ts, the generatePortToken() method uses base64url encoding:

return base64
  .replace(/\+/g, '-')
  .replace(/\//g, '_')  // <-- This introduces underscores
  .replace(/=/g, '')
  .toLowerCase();

While base64url is safe for URLs, the resulting string is used in DNS hostnames where underscores are not allowed.

RFC References

• RFC 952 specifies hostnames can only contain alphanumeric characters (a-z, A-Z, 0-9) and hyphens (-)
• RFC 1123 relaxed some requirements but still prohibits underscores in hostnames

Suggested Fix

Replace underscores with another valid character (e.g., hyphen or remove entirely):

return base64
  .replace(/\+/g, '-')
  .replace(/\//g, '-')  // Use hyphen instead of underscore
  .replace(/=/g, '')
  .toLowerCase();

Or use a different encoding scheme that only produces DNS-valid characters.

Environment

• SDK Version: 0.5.3
• Production deployment with custom domain and wildcard DNS

Impact

All preview URLs that happen to have a / character in their base64 token will fail DNS resolution, making the preview feature unusable for those sandboxes.