mirror of
https://github.com/dtzp555-max/olp.git
synced 2026-07-21 21:15:10 +00:00
feat(sandbox): Phase 7 Solution 1 implementation + opus 4.8 (#68)
Implements ADR 0014 Amendment 1 (4-layer Solution 1) + ADR 0002 Amendment 9 (Provider ISOLATION contract) + opus 4.8 model. Fresh-context opus reviewer APPROVE_WITH_MINOR; 2 nit fold-ins applied. 813 unit tests pass. Known deferred coverage: Suite 44 PI231 E2E tests are placeholders under describe.skip pending Task #9 (PI231 prod-target validation). The load-bearing negative test ('in-sandbox cat ~/.olp/keys.json MUST fail') will be validated when Task #9 runs against the merged code. PR-B outer-bwrap superseded; archive at phase-7-pr-b-outer-bwrap-snapshot branch.
This commit is contained in:
dtzp555-max
+164
-40
@@ -77,11 +77,12 @@ import { homedir } from 'node:os';
|
||||
import * as https from 'node:https';
|
||||
import * as http from 'node:http';
|
||||
import { ProviderError } from './base.mjs';
|
||||
// Phase 7 PR-B (ADR 0014 § PR-B): sandbox spawn wrap.
|
||||
// wrapSpawn() is transparent (returns inputs unchanged) when sandbox is inactive.
|
||||
// Authority: @anthropic-ai/sandbox-runtime v0.0.52, ADR 0014 § PR-B,
|
||||
// ADR 0009 Amendment 1 § unchanged spawn args — only the spawn execution is wrapped.
|
||||
import { wrapSpawn } from '../sandbox/manager.mjs';
|
||||
// Phase 7 Solution 1 (ADR 0014 Amendment 1): wrapSpawn() removed from manager.mjs.
|
||||
// Isolation is composed by server.mjs via prepareIsolatedEnvironment() before
|
||||
// provider.spawn() is called (Task #8). The anthropic ISOLATION block (Task #6)
|
||||
// declares per-provider primitives; _spawnAndStream() applies isolationCtx
|
||||
// (envOverrides, hardenedArgs, wrapForLayer3) on top of its own env-cleanup + args.
|
||||
// No sandbox/manager.mjs import needed in this plugin.
|
||||
|
||||
// ── Binary resolution ─────────────────────────────────────────────────────
|
||||
// OLP_CLAUDE_BIN env takes priority, then falls back to 'claude' from PATH.
|
||||
@@ -868,7 +869,7 @@ function buildSpawnEnv() {
|
||||
// stop chunk; proc.on('close') is the safety net if `result` is never emitted.
|
||||
//
|
||||
// OCP server.mjs:542: const proc = spawn(CLAUDE, cliArgs, { env, stdio: [...] });
|
||||
async function* _spawnAndStream(irRequest, authContext, spawnImpl) {
|
||||
async function* _spawnAndStream(irRequest, authContext, spawnImpl, isolationCtx) {
|
||||
const auth = authContext ?? readAuthArtifact();
|
||||
if (!auth?.accessToken) {
|
||||
throw new ProviderError(
|
||||
@@ -915,44 +916,54 @@ async function* _spawnAndStream(irRequest, authContext, spawnImpl) {
|
||||
// ADR 0009 Amendment 1: system prompt extracted from IR messages,
|
||||
// prepended with OLP_SYSTEM_PROMPT_WRAPPER, passed via --system-prompt.
|
||||
const systemPrompt = extractSystemPrompt(irRequest);
|
||||
const args = buildCliArgs(irRequest.model, systemPrompt);
|
||||
const baseArgs = buildCliArgs(irRequest.model, systemPrompt);
|
||||
|
||||
// stdin: serialized user/assistant/tool messages (system skipped — goes via --system-prompt)
|
||||
const prompt = irToAnthropic(irRequest);
|
||||
|
||||
// Phase 7 PR-B (ADR 0014 § PR-B): wrap spawn in sandbox-runtime if active.
|
||||
// wrapSpawn() is transparent when sandbox is inactive (returns inputs unchanged).
|
||||
// Per-spawn ephemeral cwd (UUID) is created inside wrapSpawn to prevent cross-
|
||||
// request contamination. Allowed domains are the Anthropic API domains only.
|
||||
//
|
||||
// ADR 0009 Amendment 1 § unchanged spawn args: only the spawn execution is
|
||||
// wrapped — bin/args/env/NDJSON parsing are all unchanged from pre-PR-B.
|
||||
//
|
||||
// 2026-05-28 PR-B fold-in: skip sandbox wrap when a custom spawnImpl is in
|
||||
// use (test mode — __setSpawnImpl was called). Test mocks do not actually
|
||||
// exec a binary, so sandbox isolation provides no protection there; the
|
||||
// wrap only obscures the original bin/args from the mock's assertions and
|
||||
// breaks every HTTP integration test that uses __setSpawnImpl + asserts
|
||||
// on spawn args. wrapSpawn is for real-CLI spawns; Suite 44 exercises that
|
||||
// path directly without going through this provider.
|
||||
//
|
||||
// Authority: @anthropic-ai/sandbox-runtime v0.0.52 wrapWithSandbox() API,
|
||||
// ADR 0014 § PR-B, spike-anthropic.mjs (PI231 2026-05-28).
|
||||
const usingMockSpawn = spawnImpl !== defaultSpawn;
|
||||
const wrapped = usingMockSpawn
|
||||
? { bin, args, env, cwd: undefined, sandboxed: false }
|
||||
: await wrapSpawn({
|
||||
bin,
|
||||
args,
|
||||
env,
|
||||
cwd: undefined, // let manager assign ephemeral cwd
|
||||
allowedDomains: ['api.anthropic.com', 'statsig.anthropic.com'],
|
||||
});
|
||||
// Task #8 — Phase 7 Solution 1: apply isolation context from orchestrator.
|
||||
// isolationCtx is provided by server.mjs (prepareIsolatedEnvironment) when
|
||||
// present. Three layers compose here:
|
||||
// Layer 1 (env): envOverrides have final precedence over buildSpawnEnv output.
|
||||
// Layer 4 (args): hardenedArgs transforms the final args array.
|
||||
// Layer 3 (wrap): wrapForLayer3 optionally wraps the command string via
|
||||
// sandbox-runtime (identity when inactive or hasInnerSandbox=true).
|
||||
// When isolationCtx is absent (legacy callers / tests), behavior is unchanged.
|
||||
// Authority: ADR 0014 Amendment 1 § A1.2 + ADR 0002 Amendment 9 § Backward compat.
|
||||
const envOverrides = isolationCtx?.envOverrides ?? {};
|
||||
const finalEnv = Object.keys(envOverrides).length > 0 ? { ...env, ...envOverrides } : env;
|
||||
|
||||
const hardenedArgs = isolationCtx?.hardenedArgs ?? ((a) => a);
|
||||
const args = hardenedArgs(baseArgs);
|
||||
|
||||
// Layer 3: wrapForLayer3 is async; returns the command string to spawn.
|
||||
// When sandbox-runtime is active and hasInnerSandbox=false for this provider,
|
||||
// the result is a wrapped shell invocation (/bin/sh -c <bwrap-args...> <cmd>).
|
||||
// When inactive (or hasInnerSandbox=true), it is an identity: returns bin unchanged.
|
||||
const wrapForLayer3 = isolationCtx?.wrapForLayer3 ?? (async (c) => c);
|
||||
const wrappedBin = await wrapForLayer3(bin);
|
||||
// If Layer 3 wrapping changed the bin (returns a '/bin/sh -c ...' style string),
|
||||
// pass the entire wrapped command as a shell-execute string; otherwise use bin/args
|
||||
// directly to avoid an unnecessary shell layer.
|
||||
let finalBin, finalArgs;
|
||||
if (wrappedBin !== bin) {
|
||||
// Layer 3 active: wrappedBin is the full shell command string. Invoke via sh -c.
|
||||
finalBin = '/bin/sh';
|
||||
finalArgs = ['-c', wrappedBin];
|
||||
} else {
|
||||
// Layer 3 inactive (identity): use bin + args directly.
|
||||
finalBin = bin;
|
||||
finalArgs = args;
|
||||
}
|
||||
|
||||
// ADR 0009 Amendment 1 § unchanged spawn args: NDJSON parsing unchanged.
|
||||
// Authority: ADR 0014 Amendment 1 § A1.2.3 (Layer 3 is orchestrator responsibility,
|
||||
// not provider responsibility); ADR 0002 Amendment 9 § Backward compatibility
|
||||
// (spawn() method is not changed; orchestrator composes above it).
|
||||
|
||||
// OCP server.mjs:542: spawn(CLAUDE, cliArgs, { env, stdio: ["pipe", "pipe", "pipe"] })
|
||||
const proc = spawnImpl(wrapped.bin, wrapped.args, {
|
||||
env: wrapped.env,
|
||||
...(wrapped.cwd ? { cwd: wrapped.cwd } : {}),
|
||||
const proc = spawnImpl(finalBin, finalArgs, {
|
||||
env: finalEnv,
|
||||
stdio: ['pipe', 'pipe', 'pipe'],
|
||||
});
|
||||
|
||||
@@ -1144,8 +1155,14 @@ async function* _spawnAndStream(irRequest, authContext, spawnImpl) {
|
||||
// Tests set `anthropic._spawnImpl = mockSpawn` before calling `anthropic.spawn()`.
|
||||
let _spawnImpl = defaultSpawn;
|
||||
|
||||
export async function* spawn(irRequest, authContext) {
|
||||
yield* _spawnAndStream(irRequest, authContext, _spawnImpl);
|
||||
// Task #8 — Phase 7 Solution 1: isolationCtx is an optional third argument.
|
||||
// When present (from server.mjs prepareIsolatedEnvironment call), it carries
|
||||
// { envOverrides, hardenedArgs, wrapForLayer3, cleanup } — the orchestrator
|
||||
// composes these on top of the provider's own env-cleanup + args composition.
|
||||
// When absent (legacy callers, tests that don't pass it), behavior is identical
|
||||
// to the pre-Task-#8 path. Authority: ADR 0014 Amendment 1 § A1.2.
|
||||
export async function* spawn(irRequest, authContext, isolationCtx) {
|
||||
yield* _spawnAndStream(irRequest, authContext, _spawnImpl, isolationCtx);
|
||||
}
|
||||
|
||||
// Test hook: allows tests to inject a mock spawn without importing child_process.
|
||||
@@ -1603,3 +1620,110 @@ const anthropic = {
|
||||
};
|
||||
|
||||
export default anthropic;
|
||||
|
||||
// ── Provider ISOLATION contract ───────────────────────────────────────────
|
||||
// ADR 0002 Amendment 9 (2026-05-29) — Provider ISOLATION Contract for
|
||||
// Multi-Tenant Spawn Isolation. Specifies the isolation primitives the
|
||||
// lib/sandbox/manager.mjs orchestrator composes on every uncached spawn
|
||||
// of this provider.
|
||||
//
|
||||
// Authority citations (ALIGNMENT.md Rule 1 — Cite First):
|
||||
// @anthropic-ai/claude-code v2.1.152
|
||||
// § --system-prompt — full system-prompt replacement suppresses env-block
|
||||
// injection, tool descriptions (Bash, Read, Write, Edit), and all other
|
||||
// tool surfaces that Claude Code injects by default. Verified live on
|
||||
// PI231 (arm64 Debian Bookworm) at docs/spikes/2026-05-29-ephemeral-home.md.
|
||||
// § HOME env override — claude CLI v2.1.152 honours HOME completely; all
|
||||
// state writes ($HOME/.claude.json, $HOME/.claude/*) redirect to the
|
||||
// ephemeral root. Auth reads from $HOME/.claude/.credentials.json.
|
||||
// Verified at docs/spikes/2026-05-29-ephemeral-home.md (✅ PASS).
|
||||
// ADR 0009 Amendment 1 (Phase 6c) — the --system-prompt flag that achieves
|
||||
// tool suppression is injected by the spawn() method; it is the enforcement
|
||||
// mechanism crossTenantReadProtection='tool-suppression' cites.
|
||||
// ADR 0014 Amendment 1 (2026-05-29) — supersedes outer-bwrap PR-B with the
|
||||
// per-spawn ephemeral-home + per-provider ISOLATION architecture that this
|
||||
// block participates in. §A1.2 defines the four-layer model; §A1.3 names
|
||||
// this contract surface.
|
||||
// ADR 0002 Amendment 9 (2026-05-29) — specifies the ISOLATION contract shape,
|
||||
// field-level semantics, validation rules, and the anthropic concrete
|
||||
// instance this block implements.
|
||||
// cc-mem incident memory:
|
||||
// ~/.cc-rules/memory/projects/olp/incident_2026_05_27_spawn_cli_security.md
|
||||
// § 6.1 — empirical evidence that --system-prompt suppression is effective:
|
||||
// the model in a stream-json spawn without --tools cannot emit tool_use
|
||||
// blocks because the default Claude Code tool descriptions are absent.
|
||||
// This is the primary empirical basis for crossTenantReadProtection:
|
||||
// 'tool-suppression' in the absence of OS-level bwrap isolation.
|
||||
//
|
||||
// isolation rationale: Anthropic Claude reaches OLP via stream-json transport
|
||||
// without a tool surface (ADR 0009 Amendment 1's --system-prompt injection
|
||||
// suppresses env-block, file tools, Bash, and Read/Write/Edit). The model has
|
||||
// no documented mechanism to read files during the spawn. Cross-tenant read
|
||||
// protection is achieved at the prompt-engineering / CLI-flag layer. The OS-
|
||||
// level isolation primitives (HOME redirect + ephemeral credential mount) add
|
||||
// defense in depth against future CLI changes that might re-introduce a tool
|
||||
// surface. (cf. ADR 0014 Amendment 1 § A1.2.4 — Layer 4 tool hardening)
|
||||
|
||||
export const ISOLATION = {
|
||||
// Returns the env-var overrides that steer claude CLI to use the per-spawn
|
||||
// ephemeral home rather than the server process's real $HOME.
|
||||
// HOME is the POSIX-conventional lookup root; claude v2.1.152 reads
|
||||
// $HOME/.claude/.credentials.json for OAuth and writes session state to
|
||||
// $HOME/.claude.json and $HOME/.claude/*. Redirecting HOME is the
|
||||
// documented and verified mechanism (docs/spikes/2026-05-29-ephemeral-home.md).
|
||||
// CLAUDE_CONFIG_DIR is NOT honored as of v2.1.152 — do not use it.
|
||||
// keyId / reqId are received for signature consistency but unused here.
|
||||
ephemeralEnvOverrides: ({ ephemeralRoot, keyId: _keyId, reqId: _reqId }) => ({
|
||||
HOME: ephemeralRoot,
|
||||
}),
|
||||
|
||||
// Credential files to symlink from the operator's real home into the
|
||||
// ephemeral home so that claude CLI can authenticate without being given
|
||||
// access to the full ~/.claude/ directory.
|
||||
// srcAbsPath MUST be absolute (ADR 0002 Amendment 9 § 2 validation rule).
|
||||
// Authority: anthropic.auth.path above — ~/.claude/.credentials.json is
|
||||
// the documented OAuth artifact for @anthropic-ai/claude-code v2.1.152.
|
||||
credentialMounts: [
|
||||
[join(homedir(), '.claude', '.credentials.json'), '.claude/.credentials.json'],
|
||||
],
|
||||
|
||||
// Directories that must be pre-created (mkdir -p) under ephemeralRoot before
|
||||
// credentialMounts are processed. The CLI expects $HOME/.claude/ to exist;
|
||||
// absent the directory the auth-file symlink's parent would be missing.
|
||||
requiredHomePaths: [
|
||||
'.claude',
|
||||
// No additional mandatory pre-existing subdirs observed as of v2.1.152.
|
||||
// If future CLI versions add a mandatory subdir (e.g. .claude/logs),
|
||||
// add it here with an observed-behavior comment per ADR 0002 Amendment 9
|
||||
// § 3 ("speculative directories are a Rule 2 violation").
|
||||
],
|
||||
|
||||
// claude CLI (stream-json transport) does NOT spawn its own bwrap or
|
||||
// sandbox-exec boundary during normal OLP use. The Layer 3 outer
|
||||
// sandbox-runtime wrap (ADR 0014 Amendment 1 § A1.2.3) is therefore
|
||||
// applicable for this provider and must NOT be skipped.
|
||||
// Authority: @anthropic-ai/claude-code v2.1.152 stream-json path verified
|
||||
// at docs/spikes/2026-05-29-ephemeral-home.md — no nested sandbox observed.
|
||||
hasInnerSandbox: false,
|
||||
|
||||
// ADR 0009 Amendment 1's --system-prompt injection (Phase 6c) replaces the
|
||||
// entire system prompt and eliminates the default tool surface (Bash, Read,
|
||||
// Write, Edit, computer-use blocks) that claude would otherwise expose.
|
||||
// Empirical evidence: incident memory § 6.1 confirms suppression is effective
|
||||
// in stream-json mode. OS-level isolation (Layers 1-3) adds defense in depth.
|
||||
crossTenantReadProtection: 'tool-suppression',
|
||||
|
||||
// With tool-suppression active and no inner sandbox, the model cannot read
|
||||
// arbitrary files; the ephemeral-home + credential-mount isolation (Layers
|
||||
// 1-2) provides per-request HOME isolation. This combination is rated
|
||||
// suitable for a shared-OS-user deployment (all OLP keys on one OS user).
|
||||
// Authority: ADR 0014 Amendment 1 § A1.2 four-layer model + ADR 0006
|
||||
// risk-tier framework.
|
||||
recommendedDeploymentTier: 'shared-os-user',
|
||||
|
||||
// toolHardeningArgs omitted — the existing spawn() method's args already
|
||||
// encode the --system-prompt tool-suppression mechanism (ADR 0009 Amendment
|
||||
// 1). No additional CLI flags are needed at the orchestrator level.
|
||||
// Per ADR 0002 Amendment 9 § 7: absence means the orchestrator passes args
|
||||
// through unchanged from spawn().
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user