mirror of
https://github.com/dtzp555-max/olp.git
synced 2026-07-19 09:45:07 +00:00
taodengandClaude Opus 4.7
28642756b5
Live PI231 verification of d0dcd28 surfaced two real-runtime issues:
1. ~/.claude was denyRead, but claude CLI MUST read its own OAuth
credentials file to authenticate. Result: 100% of anthropic requests
on sandboxed PI231 failed with "Not logged in · Please run /login".
Live transcript:
{"event":"fallback_hop_error", "provider":"anthropic",
"error":"Not logged in · Please run /login"}
The cross-tenant risk for ~/.claude was a false security trade-off:
(a) ~/.claude is the spawn's OWN auth, not cross-tenant material
(all OLP clients share the same Anthropic OAuth — the file is
not multi-tenant secret)
(b) Real protection for the model accidentally exfiltrating creds
via tool_use is Phase 6c's --system-prompt suppressing tool
descriptions; sandbox-runtime can only blanket-deny a path, not
distinguish "claude reads creds" from "model emits Read tool"
Fix: remove ~/.claude from denyRead. Keep ~/.olp, ~/.ssh, ~/.config,
~/.codex (all genuinely cross-tenant).
Suite 44a (cat ~/.olp/keys.json MUST fail) unchanged — still proves
the core acceptance.
Suite 44c added (regression guard): in-sandbox cat ~/.claude/.credentials.json
MUST succeed when the file exists.
2. anthropic.mjs::_spawnAndStream called wrapSpawn() unconditionally,
including when a test had set __setSpawnImpl(mockFn). The wrap
rewrites bin to '/bin/sh -c <wrapped-string>' which breaks every HTTP
integration test that asserts on spawn args. Result on PI231 (sandbox
active): 16 production-shape tests failed because their mocks were
never called with the expected bin/args.
Fix: skip wrapSpawn when spawnImpl !== defaultSpawn (mock active).
Mocks don't exec, so isolation is meaningless there anyway. Real-CLI
spawns (production + Suite 44) still get wrapped.
Tests: 813 → 813 (44c is also PI231-gated, skips on Mac with file
absent; the fold-in does not change Mac test count).
Authority:
- @anthropic-ai/sandbox-runtime v0.0.52 — wrapWithSandbox() shell-string
return shape is the proximate cause of (2)
- Live PI231 2026-05-28 transcript: /v1/chat/completions returning
content=null + "Not logged in" from anthropic; OLP_E2E_SANDBOX=1 npm
test showing 16 prior pass tests now fail
- ADR 0014 § 4.1 PR-B acceptance criteria — the negative test (44a)
continues to pass; the false-positive denyRead (~/.claude) is corrected
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>