vrr/wirenboard-agent-vm
2
0
Fork 0
mirror of https://github.com/wirenboard/agent-vm.git synced 2026-07-09 16:00:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
mirror of https://github.com/wirenboard/agent-vm - link from https://habr.com/ru/companies/pt/articles/1043680/
101 commits 36 branches 24 tags 1.2 MiB
Find a file
Evgeny Boger 8e262c03fb Phase 4: file-backed secrets + OAuth refresh interception 
In-VM agent's OAuth refresh attempts now trigger a host-side rotation
via a microsandbox TLS-intercept request-interceptor hook. The hook
spawns the host claude/codex CLI to do the real refresh, then
synthesizes a placeholder response. Combined with switching from
SecretValue::Static to SecretValue::File (which the patched msb
re-reads on every connection), long sessions survive token rotation
without manual intervention.

Pieces:

- vendor/microsandbox submodule pointer bumped to include the
  interceptor extension (commit cf00a11 on agent-vm-secret-file).
- msb_install.rs: cargo build --release -p microsandbox-cli --bin msb
  from vendor/, point MSB_PATH at the result so the patched binary is
  what runs the VM. The user's ~/.microsandbox/bin/msb is untouched.
- intercept_hook.rs: hidden `agent-vm _intercept-hook` subcommand.
  Reads the OAuth refresh request from stdin, spawns the host CLI to
  rotate the host credential file the normal way, re-reads the host
  file, rewrites <state>/tokens/<provider> so the next non-refresh
  request gets the new bearer via SecretValue::File, synthesizes an
  OAuth response with placeholder tokens, writes to stdout.
- secrets.rs: switched from Static(token) to File(<state>/tokens/…).
- run.rs: registers the interceptor with two rules
  (platform.claude.com/v1/oauth/token and auth.openai.com/oauth/token).
- ARCHITECTURE.md gets a Phase 4 section covering the two-layer
  refresh flow, the msb/cli build-target gotcha (~30 min debugging
  lesson: vendor/microsandbox/target/release/microsandbox is a
  5-line shim, not the real binary), and the deliberate
  non-features (no proactive expiry timer, no global msb install,
  no concurrent-refresh single-flight).

Smoke verified end-to-end on the nested-VM test host: in-VM
`curl POST https://platform.claude.com/v1/oauth/token` returns
HTTP 200 with a fresh OAuth JSON response containing the
placeholder tokens, expires_in derived from the just-rotated host
expiresAt. The host claude -p ran and updated the host file as a
side effect.
2026-05-17 23:38:40 +03:00
crates/agent-vm Phase 4: file-backed secrets + OAuth refresh interception 2026-05-17 23:38:40 +03:00
images fix(image): restore the apt cache cleanup lines that the last commit dropped 2026-05-17 19:26:03 +03:00
vendor Phase 4: file-backed secrets + OAuth refresh interception 2026-05-17 23:38:40 +03:00
.gitignore Phase 0: scaffold microsandbox-based rewrite 2026-05-17 17:05:07 +03:00
.gitmodules Phase 0: scaffold microsandbox-based rewrite 2026-05-17 17:05:07 +03:00
ARCHITECTURE.md Phase 4: file-backed secrets + OAuth refresh interception 2026-05-17 23:38:40 +03:00
Cargo.lock Phase 3: host-rooted Claude/Codex credentials never enter the VM 2026-05-17 21:21:28 +03:00
Cargo.toml Phase 0: scaffold microsandbox-based rewrite 2026-05-17 17:05:07 +03:00
LICENSE first commit 2026-01-28 01:15:09 +01:00
PLAN.md Phase 4: file-backed secrets + OAuth refresh interception 2026-05-17 23:38:40 +03:00
README.md Phase 4: file-backed secrets + OAuth refresh interception 2026-05-17 23:38:40 +03:00

README.md

agent-vm (microsandbox rewrite)

Work-in-progress rewrite of agent-vm on top of microsandbox. The goal is sub-second cold-start microVMs for AI coding agents (Claude Code, Codex CLI, OpenCode) with host-rooted credentials and no in-VM proxy.

This is a long-running rewrite. The current state lives on rewrite-microsandbox. The original agent-vm continues to live on main until v1 of the rewrite ships.

Where to look

  • PLAN.md — phased roadmap, what's in/out of v1.
  • ARCHITECTURE.md — running record of design decisions, filled in as each phase lands.

Status

  • Phase 0 (scaffolding): done.
  • Phase 1 (base OCI image + agent-vm setup): done.
  • Phase 2 (launcher MVP — claude/codex/opencode/shell): done; live API smoke deferred to Phase 3.
  • Phase 2.x (RUST_LOG, host-path mounting, pull progress bar, agent-vm pull + update-available banner, registry auto-recovery): done.
  • Phase 3 (host-rooted secrets via microsandbox TLS intercept): done. Real Claude/Codex tokens stay on the host; the in-VM agent only sees placeholders. See ARCHITECTURE.md "Phase 3" for the two-layer placeholder dance.
  • Phase 4 (token-refresh semantics: rebuilt msb, file-backed secrets, OAuth-endpoint interception): done. Long sessions survive host token rotation without manual intervention.
  • Phase 5 (fast-launch via detached mode): deferred — see PLAN.md; snapshots don't help launch time, detached mode is a product-shape decision.
  • Phase 6 (distribution + polish + docs): pending.

Building

git submodule update --init vendor/microsandbox
cargo build -p agent-vm

Building the base image

./target/debug/agent-vm setup        # build + verify in a throwaway sandbox
./target/debug/agent-vm setup --no-verify

Requires Docker on the host. A registry:2 container named agent-vm-registry will be created on first run and bound to 127.0.0.1:5000.

Running an agent

cd your/project
agent-vm claude        # or codex / opencode / shell
agent-vm claude -- -p "fix the lint errors"  # forward args to the agent

# Smoke / scripted use:
agent-vm shell -- -c 'ls /workspace && claude --version'

The first arg after the subcommand is treated as input to the agent. Use -- if any forwarded arg starts with - (otherwise clap will try to claim it). Project state lives in ~/.local/state/agent-vm/<hash>/ and survives between launches. Phase 2 supports auth via the ANTHROPIC_API_KEY / OPENAI_API_KEY env vars only; the OAuth-refresh path lands in Phase 3.

Actually running a sandbox requires the microsandbox runtime prerequisites (Linux with KVM, or macOS Apple Silicon). See microsandbox's README.