Repository navigation
Live checks for the Trial sandbox #1009
Description
Parent
What to build
These are Day shift checks on the thirdshift host, made before the sandbox is built on them. They're for a human because they need the real subscriptions and logins.
- Does each Harness log in, refresh and save its login inside bwrap, with only its login file bound? Claude uses a
claude setup-tokentoken in its environment instead. - Does each Harness work through
HTTPS_PROXYover a relay to a Unix socket? Which hosts does each provider need? - How do you turn each Harness's web search off?
- Does a fresh home turn each Harness's memory off?
- Does interruption still reach the Harness through bwrap's process namespace?
- How much memory does a Trial really use beside two building Runs?
The results go in the sandbox research note.
Progress (2026-10-21)
The checks that need no real login are done, with test processes, fake credentials and fresh homes. Their results are in section 10 of the sandbox research note (#1045).
- Done:
- Interruption reaches the Harness through bwrap's process namespace, by thirdshift's own stop path, with and without
--new-session, and nothing outlives the sandbox. - A fresh home turns memory off for all six Harnesses: each keeps its memory under its home.
HTTPS_PROXYover the relay works, and all six Harnesses honour it. OpenCode needsNO_PROXY=127.0.0.1,localhost. The hosts each contacted with a fake credential are recorded.- Web search off: the switches for Claude, Codex, Grok, Muse and OpenCode are recorded.
- Interruption reaches the Harness through bwrap's process namespace, by thirdshift's own stop path, with and without
- Still open, since these need the real logins:
- each Harness logging in, refreshing and saving its login inside bwrap, with only its login file bound, and Claude with a
claude setup-tokentoken (Turn on lingering and save Claude's setup token #1011); - the hosts used with a real subscription login, such as Codex's ChatGPT login and refresh, and agy's API host;
- agy's web search, which has no switch in its help or settings;
- a Trial's memory beside two building Runs. A snapshot of the sessions running now is recorded.
- each Harness logging in, refreshing and saving its login inside bwrap, with only its login file bound, and Claude with a
Acceptance criteria
- Each question is answered for all six Harnesses where it applies, and recorded in the sandbox research note.
Activity
JacobStephens2 commentedon Oct 21, 2026
I ran the checks that need no real login. They used test processes, fake credentials and fresh homes, so no real login was bound or read. The results are in section 10 of the sandbox research note, in #1045.
Answered:
Interruption: thirdshift's stop path walks the process tree and signals every group it finds. Done that way, SIGTERM and SIGINT both reach a process inside bwrap's PID namespace, with and without
--new-session. Killing the outer bwrap leaves nothing running inside.Memory: all six Harnesses keep their state under their home, so a fresh home per Trial starts each with no memory. That includes Codex's
memories_1.sqlite, and agy'sbrainandimplicit.HTTPS_PROXY: the relay works, and all six honour it.NO_PROXY=127.0.0.1,localhostto reach its own local server, and must be given a provider, or it falls back to a free model.Web search off:
--disallowedTools WebSearch WebFetch;-c web_search="disabled";--disable-web-search;--disable-web-tools;OPENCODE_CONFIG_CONTENTwithwebfetchandwebsearchdenied.Production sessions pass none of these today. Only release summaries do.
Still open, because these need your real logins:
google_searchgrounding runs at Google, so a proxy can't stop it;I didn't bind real logins, because a Codex refresh that fails inside a sandbox can leave production holding a used refresh token. #1012 waits on these checks, and #1013 and #1015 wait on #1012.
JacobStephens2 commentedon Oct 23, 2026
Progress (2026-10-23)
I ran the checks that need real logins on the
thirdshifthost. Each Harness ran in bwrap with:Nothing but inodes, sizes and modification times was recorded from the logins. The results are in section 11 of the sandbox research note, in #1179.
claude.setup_token, and the same outside the sandbox. The saved token is 76 characters, most likely half of a wrapped paste. Waiting on the token being saved again.search_webstill ran withread_url(*)andexecute_url(*)denied, and with thestrictpreset. agy rejectssearch_webas a deny entry. The search goes through agy's API host, so a proxy can't stop it either.New for #1012:
auth.jsongot a new inode when its login was renewed, so a renewal inside the sandbox can't be saved through a single-file bind.opencode.db, beside its sessions, and no longer readsOPENCODE_AUTH_CONTENT. A Trial needs the key through the config's{env:…}substitution, or a database of its own throughOPENCODE_DB.codex-code-mode-host.This stays open until Claude passes with a working setup token.
JacobStephens2 commentedon Oct 23, 2026
Progress (2026-10-23, later)
CLAUDE_CODE_OAUTH_TOKEN. Its hosts were:api.anthropic.com;http-intake.logs.us5.datadoghq.com, its telemetry.All four questions are now answered for all six Harnesses, in #1179, which closes this issue when it merges. One thing is still to be seen: a Codex refresh inside the sandbox. None was due, since its access token expires on 2026-10-24 at 20:27. Codex's source writes in place, and an in-place write through a single-file bind was confirmed with a test file.
Merge pull request #1179 from JacobStephens2/issue-1009-live-checks