feat(sandbox): headless gate, credential proxy, and adapter binary mapping - #42
Merged
Conversation
PR #35 landed container sandbox isolation but it could not be turned on here: the desktop stack is mandatory, `--storage-opt size=` is rejected by `podman --remote`, in-sandbox commits have no git identity, provider credentials are hard-rejected with no proxy to route them through, and the runtime binary is pinned to `docker` with no way to select podman. - `T3_SANDBOX_DESKTOP=disabled` provisions headless: no desktop start, no automation target, no desktop recovery. The preview sidecar still runs. - `T3_SANDBOX_CONTAINER_STORAGE_QUOTA=disabled` omits the storage-opt pair. - `T3_SANDBOX_GIT_USER_NAME`/`_EMAIL` configure the clone's local identity. - New thread-scoped credential proxy sidecar holds the real secret on the internal network; the workspace container only ever sees the proxy URL and an opaque per-thread token. The fail-closed throw is unchanged. - Host provider binary paths map to the in-image command name on sandbox exec. - `T3_SANDBOX_RUNTIME` selects the deployment's container runtime. Every new variable defaults to existing behavior. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The previous commit added ANTHROPIC_AUTH_TOKEN to the provider env allowlist but not to the persistent-credential deny set, so with no proxy bound a host copy passed the allowlist, met no deletion step, and failed to trip the fail-closed guard. That key is the bearer credential Claude Code reads and exactly what `claude setup-token` mints, making it the variable most likely to hold a real long-lived secret on a host configured for this feature. Adding it to the regex alone is not enough: the guard ran on the merged environment, so the proxy's own injected token would trip it. The guard now runs on host-derived env before proxy values are merged, which makes the opaque per-thread token exempt by construction rather than by omission from a deny list. Persistent keys are now dropped unconditionally when a proxy is bound, so an openai-only binding cannot pass through a host Anthropic token. The test that asserted the forwarded token encoded the hole as correct; it now asserts the unbound case throws. Added coverage for the unbound and bound-but-openai-only paths. Verified by mutation: reverting the regex fails exactly the three new deny tests, and moving the guard back after the merge fails the two injection tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-actions
Bot
added
vouch:trusted
Owner
Author
|
@coderabbitai review |
Owner
Author
|
@codex review |
Thread transfer impact✅ Thread transfer remains within every enforced ceiling.
Baseline: unavailable · PR result: Scenario and decoded snapshot size10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.
Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part 2 of 3 for per-thread sandbox isolation (headless-first). Server-side changes that make sandboxed threads actually usable without desktop/WebRTC streaming, and let provider CLIs authenticate inside the container without ever handing it a real credential.
T3_SANDBOX_DESKTOP=disabled): provisioning and reconciliation skip desktop start/recovery entirely; only the preview sidecar starts.SandboxCredentialProxy: real provider credentials are pushed to a per-thread sidecar overpodman exec -i(never inrun --env, never mounted into the workspace container); the workspace gets a short-lived per-thread token and a proxy base URL instead.SandboxProviderProcess: env allowlist plus a deny path that strips every persistent credential key whenever a proxy binding is active, so the real token can't leak through even if it were requested.sandboxConfig.runtimenow falls back to a deployment default (T3_SANDBOX_RUNTIME) instead of hardcodingdocker, since nothing populates the per-thread field.--storage-opt size=support over podman-remote) and git identity applied inside the container after the thread-branch switch.Merges independently of the bridge and host PRs (no file overlap), but the feature only comes alive once all three are in, images are built, and the host is bootstrapped.
Test plan
apps/server/src/sandbox/— 112/112 passing across 7 files.claude-opus-5 via Claude Code