Wraps the claude CLI spawn in @anthropic-ai/sandbox-runtime per ADR 0014
§ PR-B. Achieves multi-tenant filesystem + network isolation: the spawned
claude subprocess can no longer read ~/.olp/keys.json, ~/.claude/.credentials.json,
~/.ssh/, or any other per-client OAuth material. Only api.anthropic.com and
statsig.anthropic.com are reachable; only /tmp/olp-spawn/<uuid>/ is writable
per spawn (ephemeral, UUID-scoped to prevent cross-request contamination).
## Authority citations
- @anthropic-ai/sandbox-runtime v0.0.52
https://github.com/anthropic-experimental/sandbox-runtime
dist/sandbox/sandbox-manager.js — SandboxManager.initialize(), wrapWithSandbox()
dist/sandbox/sandbox-utils.js — getDefaultWritePaths()
- 2026-05-28 spike report at /tmp/sandbox-spike/report.md on PI231:
spike-anthropic.mjs (wrapWithSandbox call signature + NDJSON proof),
spike-deny.mjs (cat ~/.olp/keys.json MUST fail)
- OLP ADR 0014 § 2.1 PR-B, § 4.1 PR-B acceptance criteria
- OLP ADR 0009 Amendment 1 § Caveats #3 (sandbox is cloud prerequisite)
- OLP ALIGNMENT.md Rule 1 — provider plugin authority citation
- cc-mem incident 2026-05-27 § 3 (multi-tenant OAuth token exposure via
prompt injection)
## Files changed
- lib/sandbox/manager.mjs (new): bootstrap + spawn-wrap layer.
Exports: bootstrapSandbox(), isSandboxActive(), wrapSpawn(),
__resetSandboxManagerForTests(). Config-at-boot model (one
SandboxManager.initialize() at server start; per-request wrapWithSandbox()
reads from already-initialized state). Transparent pass-through when inactive.
- lib/providers/anthropic.mjs: spawn site wrapped via wrapSpawn({
bin, args, env, allowedDomains: ['api.anthropic.com','statsig.anthropic.com']
}). ADR 0009 Amendment 1 spawn args unchanged — only execution is wrapped.
- server.mjs: bootstrapSandbox() called before server.listen(); startup banner
logs sandbox.active state. /health.sandbox now includes active:boolean field
(distinguishes "deps present" from "SandboxManager initialized and wrapping").
- test-features.mjs: Suite 43 (8 tests — manager unit: bootstrap state, idempotency,
isSandboxActive, wrapSpawn passthrough, /health.active field) + Suite 44
(2 PI231-gated tests: 44a security negative test + 44b positive echo test,
skipped by default, run with OLP_E2E_SANDBOX=1 npm test).
- CHANGELOG.md, docs/adr/0014-sandbox-runtime-integration.md: PR-B status
updated; ADR table + /health JSON example updated with active field.
## Test count
805 (pre-PR-B) → 813 (+8 Suite 43; Suite 44 skipped on macOS, runs on PI231)
All 813 pass on macOS dev machine. 0 regressions.
## PI231 validation (required before merge — Suite 44)
After apt-get install bubblewrap socat (ripgrep already present) + server restart:
1. curl /health → confirm sandbox.available=true AND sandbox.active=true
2. Real anthropic request → confirm stream-json still works end-to-end
3. OLP_E2E_SANDBOX=1 npm test → confirm Suite 44a (cat ~/.olp/keys.json MUST fail)
and Suite 44b (echo SANDBOX_PROOF succeeds)
Reviewer: must SSH PI231, run Suite 44, and confirm the ADR 0014 § 4.1 criteria.
This commit is ready to push; do NOT push before Suite 44 transcript is captured.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
taodengandClaude Sonnet 4.6