fix(security): harden sandbox browser network defaults

src/config/config.sandbox-docker.test.ts

@@ -177,4 +177,46 @@ describe("sandbox browser binds config", () => {
     });
     expect(resolved.binds).toBeUndefined();
   });
+
+  it("defaults browser network to dedicated sandbox network", () => {
+    const resolved = resolveSandboxBrowserConfig({
+      scope: "agent",
+      globalBrowser: {},
+      agentBrowser: {},
+    });
+    expect(resolved.network).toBe("openclaw-sandbox-browser");
+  });
+
+  it("prefers agent browser network over global browser network", () => {
+    const resolved = resolveSandboxBrowserConfig({
+      scope: "agent",
+      globalBrowser: { network: "openclaw-sandbox-browser-global" },
+      agentBrowser: { network: "openclaw-sandbox-browser-agent" },
+    });
+    expect(resolved.network).toBe("openclaw-sandbox-browser-agent");
+  });
+
+  it("merges cdpSourceRange with agent override", () => {
+    const resolved = resolveSandboxBrowserConfig({
+      scope: "agent",
+      globalBrowser: { cdpSourceRange: "172.21.0.1/32" },
+      agentBrowser: { cdpSourceRange: "172.22.0.1/32" },
+    });
+    expect(resolved.cdpSourceRange).toBe("172.22.0.1/32");
+  });
+
+  it("rejects host network mode in sandbox.browser config", () => {
+    const res = validateConfigObject({
+      agents: {
+        defaults: {
+          sandbox: {
+            browser: {
+              network: "host",
+            },
+          },
+        },
+      },
+    });
+    expect(res.ok).toBe(false);
+  });
 });