feat(sandbox): Phase 7 PR-B — anthropic.mjs spawn wrapped in sandbox-runtime

Wraps the claude CLI spawn in @anthropic-ai/sandbox-runtime per ADR 0014
§ PR-B. Achieves multi-tenant filesystem + network isolation: the spawned
claude subprocess can no longer read ~/.olp/keys.json, ~/.claude/.credentials.json,
~/.ssh/, or any other per-client OAuth material. Only api.anthropic.com and
statsig.anthropic.com are reachable; only /tmp/olp-spawn/<uuid>/ is writable
per spawn (ephemeral, UUID-scoped to prevent cross-request contamination).

## Authority citations

- @anthropic-ai/sandbox-runtime v0.0.52
  https://github.com/anthropic-experimental/sandbox-runtime
  dist/sandbox/sandbox-manager.js — SandboxManager.initialize(), wrapWithSandbox()
  dist/sandbox/sandbox-utils.js  — getDefaultWritePaths()
- 2026-05-28 spike report at /tmp/sandbox-spike/report.md on PI231:
  spike-anthropic.mjs (wrapWithSandbox call signature + NDJSON proof),
  spike-deny.mjs (cat ~/.olp/keys.json MUST fail)
- OLP ADR 0014 § 2.1 PR-B, § 4.1 PR-B acceptance criteria
- OLP ADR 0009 Amendment 1 § Caveats #3 (sandbox is cloud prerequisite)
- OLP ALIGNMENT.md Rule 1 — provider plugin authority citation
- cc-mem incident 2026-05-27 § 3 (multi-tenant OAuth token exposure via
  prompt injection)

## Files changed

- lib/sandbox/manager.mjs (new): bootstrap + spawn-wrap layer.
  Exports: bootstrapSandbox(), isSandboxActive(), wrapSpawn(),
  __resetSandboxManagerForTests(). Config-at-boot model (one
  SandboxManager.initialize() at server start; per-request wrapWithSandbox()
  reads from already-initialized state). Transparent pass-through when inactive.

- lib/providers/anthropic.mjs: spawn site wrapped via wrapSpawn({
  bin, args, env, allowedDomains: ['api.anthropic.com','statsig.anthropic.com']
  }). ADR 0009 Amendment 1 spawn args unchanged — only execution is wrapped.

- server.mjs: bootstrapSandbox() called before server.listen(); startup banner
  logs sandbox.active state. /health.sandbox now includes active:boolean field
  (distinguishes "deps present" from "SandboxManager initialized and wrapping").

- test-features.mjs: Suite 43 (8 tests — manager unit: bootstrap state, idempotency,
  isSandboxActive, wrapSpawn passthrough, /health.active field) + Suite 44
  (2 PI231-gated tests: 44a security negative test + 44b positive echo test,
  skipped by default, run with OLP_E2E_SANDBOX=1 npm test).

- CHANGELOG.md, docs/adr/0014-sandbox-runtime-integration.md: PR-B status
  updated; ADR table + /health JSON example updated with active field.

## Test count

805 (pre-PR-B) → 813 (+8 Suite 43; Suite 44 skipped on macOS, runs on PI231)
All 813 pass on macOS dev machine. 0 regressions.

## PI231 validation (required before merge — Suite 44)

After apt-get install bubblewrap socat (ripgrep already present) + server restart:

1. curl /health → confirm sandbox.available=true AND sandbox.active=true
2. Real anthropic request → confirm stream-json still works end-to-end
3. OLP_E2E_SANDBOX=1 npm test → confirm Suite 44a (cat ~/.olp/keys.json MUST fail)
   and Suite 44b (echo SANDBOX_PROOF succeeds)

Reviewer: must SSH PI231, run Suite 44, and confirm the ADR 0014 § 4.1 criteria.
This commit is ready to push; do NOT push before Suite 44 transcript is captured.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/providers/anthropic.mjs

@@ -77,6 +77,11 @@ import { homedir } from 'node:os';
 import * as https from 'node:https';
 import * as http from 'node:http';
 import { ProviderError } from './base.mjs';
+// Phase 7 PR-B (ADR 0014 § PR-B): sandbox spawn wrap.
+// wrapSpawn() is transparent (returns inputs unchanged) when sandbox is inactive.
+// Authority: @anthropic-ai/sandbox-runtime v0.0.52, ADR 0014 § PR-B,
+//   ADR 0009 Amendment 1 § unchanged spawn args — only the spawn execution is wrapped.
+import { wrapSpawn } from '../sandbox/manager.mjs';
 
 // ── Binary resolution ─────────────────────────────────────────────────────
 // OLP_CLAUDE_BIN env takes priority, then falls back to 'claude' from PATH.
@@ -915,8 +920,30 @@ async function* _spawnAndStream(irRequest, authContext, spawnImpl) {
   // stdin: serialized user/assistant/tool messages (system skipped — goes via --system-prompt)
   const prompt = irToAnthropic(irRequest);
 
+  // Phase 7 PR-B (ADR 0014 § PR-B): wrap spawn in sandbox-runtime if active.
+  // wrapSpawn() is transparent when sandbox is inactive (returns inputs unchanged).
+  // Per-spawn ephemeral cwd (UUID) is created inside wrapSpawn to prevent cross-
+  // request contamination. Allowed domains are the Anthropic API domains only.
+  //
+  // ADR 0009 Amendment 1 § unchanged spawn args: only the spawn execution is
+  // wrapped — bin/args/env/NDJSON parsing are all unchanged from pre-PR-B.
+  //
+  // Authority: @anthropic-ai/sandbox-runtime v0.0.52 wrapWithSandbox() API,
+  //   ADR 0014 § PR-B, spike-anthropic.mjs (PI231 2026-05-28).
+  const wrapped = await wrapSpawn({
+    bin,
+    args,
+    env,
+    cwd: undefined, // let manager assign ephemeral cwd
+    allowedDomains: ['api.anthropic.com', 'statsig.anthropic.com'],
+  });
+
   // OCP server.mjs:542: spawn(CLAUDE, cliArgs, { env, stdio: ["pipe", "pipe", "pipe"] })
-  const proc = spawnImpl(bin, args, { env, stdio: ['pipe', 'pipe', 'pipe'] });
+  const proc = spawnImpl(wrapped.bin, wrapped.args, {
+    env: wrapped.env,
+    ...(wrapped.cwd ? { cwd: wrapped.cwd } : {}),
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
 
   // OCP server.mjs:586-587: proc.stdin.write(prompt); proc.stdin.end();
   proc.stdin.write(prompt);