toph/claudebox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
80 commits 1 branch 1 tag 574 KiB
Commit graph

80 commits

This branch
This branch
All branches
Author SHA1 Message Date
Christopher Mühl
071ccc92ac docs(05-01): create execution summary 2026-04-13 09:57:38 +00:00
Christopher Mühl
4baf576810 fix: add /bin/sh symlink to sandbox so hooks can exec sh 
Claude Code hooks invoke /bin/sh which doesn't exist in the bwrap
sandbox. Symlink bash to /bin/sh alongside the existing /usr/bin/env
symlink so all hook-based tooling (GSD statusline, project hooks)
works correctly inside claudebox.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-13 09:55:40 +00:00
Christopher Mühl
6eb3b464f5 feat(05-01): register INST-01 through INST-04 requirements 
- Add Instance Isolation section after Authentication Passthrough
- INST-01: per-project isolated conversation history (no cross-contamination)
- INST-02: git worktrees share instance state via --git-common-dir
- INST-03: concurrent sessions safe (Claude Code manages own concurrency, D-13)
- INST-04: --gc removes stale instance dirs for missing project roots
- Add traceability rows mapping INST-01..04 to Phase 5
- Update coverage count from 2 to 6 v2 requirements
 2026-04-13 09:01:22 +00:00
Christopher Mühl
c5e8cca867 feat(05-01): rewrite mount architecture with per-project instance isolation 
- Replace --bind ~/.claudebox + --symlink with direct --bind ~/.claude ~/.claude
- Add compute_canonical_root() function using git rev-parse --git-common-dir
- Add per-project INSTANCE_DIR via sha256sum[:16] of canonical git root
- Overlay projects/ with per-project hash dir for isolated conversation history
- Overlay history.jsonl and SANDBOX.md as file-level bind mounts
- Update credential mount target from ~/.claudebox to ~/.claude
- Add CLAUDE_JSON_FILE (~/.claude.json) detection and conditional bind mount
- Remove stale CLAUDE.md injection logic (D-06: user's real CLAUDE.md used)
- Update dry-run block and print_audit to reflect new mount layout
- Update SANDBOX.md heredoc to remove ~/.claudebox reference
 2026-04-13 09:00:53 +00:00
Christopher Mühl
8e5063a29d fix(05): revise plans based on checker feedback 2026-04-13 08:52:28 +00:00
Christopher Mühl
dd064aa858 docs(05): create phase plan — mount rewrite + per-project isolation + GC 2026-04-13 08:47:04 +00:00
Christopher Mühl
a040aaa58a docs(05): research phase domain — per-project instance isolation 2026-04-13 08:41:04 +00:00
Christopher Mühl
597cb0588b docs(state): record phase 5 context session 2026-04-10 16:23:27 +00:00
Christopher Mühl
af9f1848eb docs(05): capture phase context (assumptions mode) 2026-04-10 16:23:13 +00:00
Christopher Mühl
ee70f08909 fix(planning): restore v2.0 state after executor regression in 6465da8 
Commit 6465da8 (phase 04-01 executor) was made from a stale worktree
predating v1.0 completion (ee686a3), accidentally reverting:
  - ROADMAP.md from v2.0 (phases 4-7) back to pre-v1.0 structure
  - STATE.md from milestone v2.0/active back to v1.0/executing
  - Deleted .planning/milestones/ (v1.0 archive files)

This commit restores the correct state:
  - ROADMAP.md: v2.0 structure with v1.0 archived + phase 04 marked complete
  - STATE.md: milestone v2.0, phase 04 complete (1/4 phases, 25%)
  - milestones/: v1.0-ROADMAP.md + v1.0-REQUIREMENTS.md restored
  - MILESTONES.md + RETROSPECTIVE.md: restored from v1.0 completion
  - phases/01-03/: staged deletions of v1.0 phase artifacts (cleaned up)
  - v1.0-MILESTONE-AUDIT.md: audit report documenting the corruption

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-10 12:44:41 +00:00
Christopher Mühl
d106d1be5c fix: replace tilde with \$HOME in printf label (SC2088) 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-10 12:26:35 +00:00
Christopher Mühl
f40959c74f docs(phase-04): complete phase execution — credential passthrough + audit redesign 2026-04-10 09:33:55 +00:00
Christopher Mühl
aa3c57a417 docs(04): add phase verification — all must-haves passed 2026-04-10 09:33:46 +00:00
Christopher Mühl
de4549c3f2 fix(04): revert credentials to read-write mount per plan D-02; add AUTH-01/AUTH-02 to requirements 2026-04-10 09:32:14 +00:00
Christopher Mühl
390812625d docs(04): add code review fix report 2026-04-10 09:28:11 +00:00
Christopher Mühl
0922b752a5 fix(04): WR-02 add stride-3 guard and safe arithmetic in dry-run ENV_ARGS loop 2026-04-10 09:27:39 +00:00
Christopher Mühl
adb9dd117d fix(04): CR-01 CR-02 WR-01 fix credential path and use read-only bind mount 2026-04-10 09:27:18 +00:00
Christopher Mühl
112f604856 docs(04): add code review report 2026-04-10 09:25:49 +00:00
Christopher Mühl
20fbd3f7d3 docs(04-01): complete credential mount and audit redesign plan 
- Add 04-01-SUMMARY.md with task details, decisions, deviations, threat flags
 2026-04-10 09:22:02 +00:00
Christopher Mühl
def8e67126 feat(04-01): rewrite print_audit to unified env list with Mounts and Network sections 
- Replace three-section audit with single unified list using [~]/[>]/[+] prefixes
- [~] green = sandbox-generated, [>] yellow = host allowlisted, [+] cyan = extra
- Prefixes are readable without color (accessibility requirement)
- PATH retains multiline indented display
- Add Mounts section: CWD, ~/.claude, and conditional credentials bind
- Add Network section: 'full (host network)' as Phase 6 placeholder
- All output to stderr, mask_value called for all env var values
 2026-04-10 09:21:15 +00:00
Christopher Mühl
6465da8583 feat(04-01): add credential file mount for OAuth passthrough 
- Add CREDS_FILE/CREDS_MOUNT detection after mkdir ~/.claudebox
- Conditional --bind in exec bwrap via BWRAP_ARGS array
- Mirror conditional bind in --dry-run display block
- Read-write mount (not ro-bind) for OAuth token refresh
- Silent skip when credentials file absent (no error/warning)
- Refactor exec bwrap to BWRAP_ARGS array for conditional mount support
 2026-04-10 09:20:18 +00:00
Christopher Mühl
40e40e3f30 docs(04): create phase 4 plan — credential mount and audit redesign 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-10 09:11:05 +00:00
Christopher Mühl
41bd51ed42 docs(04): capture phase context and discussion log 2026-04-10 09:06:17 +00:00
Christopher Mühl
4852696b95 docs: create milestone v2.0 roadmap (4 phases) 2026-04-10 08:56:58 +00:00
Christopher Mühl
7d4bf28c07 docs: define milestone v2.0 requirements 2026-04-10 08:52:20 +00:00
Christopher Mühl
b2ece43a03 docs: complete v2.0 project research 2026-04-10 08:45:25 +00:00
Christopher Mühl
3dfcb40e31 docs: start milestone v2.0 Network Isolation & Profiles 2026-04-10 08:30:13 +00:00
Christopher Mühl
ee686a36eb chore: complete v1.0 MVP milestone 
Archive milestone artifacts, evolve PROJECT.md, reorganize ROADMAP.md,
write retrospective. Requirements archived to milestones/v1.0-REQUIREMENTS.md.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-10 08:05:53 +00:00
Christopher Mühl
778216ead9
docs(quick-260410-d4u): on non-nixos hosts, bwrap fails because /etc/static does not exist 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-10 09:46:51 +02:00
Christopher Mühl
97c10f8fd4
fix(260410-d4u): conditionally mount /etc/static only on NixOS 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-10 09:29:11 +02:00
Christopher Mühl
1ccaf20eb4
docs: fix remote URL and add flake usage to README 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-09 22:04:41 +02:00
Christopher Mühl
7430e9d64c
docs: add README 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-09 22:03:20 +02:00
Christopher Mühl
e4d47b997b
docs: plant seed — mount real ~/.claude instead of separate ~/.claudebox 2026-04-09 21:52:27 +02:00
Christopher Mühl
e43d33602d
fix: symlink ~/.claude to ~/.claudebox instead of renaming mount 
Both paths now resolve inside the sandbox, so hook paths
and settings referencing ~/.claude work without fixups.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-09 21:44:54 +02:00
Christopher Mühl
d4cfa7a537
docs(phase-03): evolve PROJECT.md after phase completion 2026-04-09 21:24:47 +02:00
Christopher Mühl
f5b77428a5
docs(phase-03): complete phase execution 2026-04-09 21:24:22 +02:00
Christopher Mühl
9a7fba2219
docs(03): add code review report 2026-04-09 21:21:53 +02:00
Christopher Mühl
a36956236a
chore: merge executor worktree (worktree-agent-a9a8ae0c) 2026-04-09 21:19:46 +02:00
Christopher Mühl
7864f5d00d
docs(03-01): complete sandbox-aware prompting plan 2026-04-09 21:19:28 +02:00
Christopher Mühl
27d9db44a0
feat(03-01): add SANDBOX.md generation and CLAUDE.md import check 2026-04-09 21:18:10 +02:00
Christopher Mühl
2f737d1f3a
docs(03): create phase plan 2026-04-09 21:13:18 +02:00
Christopher Mühl
351dcc5c8b
docs(03): research sandbox-aware prompting 2026-04-09 21:05:52 +02:00
Christopher Mühl
2ee1588408
docs(state): record phase 3 context session 2026-04-09 20:59:46 +02:00
Christopher Mühl
8e900862f9
docs(03): capture phase context 2026-04-09 20:59:38 +02:00
Christopher Mühl
a15d4b11d8
docs: plant seed — Go rewrite of claudebox.sh 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-09 17:47:08 +02:00
Christopher Mühl
8555fd5c83
docs: plant seed — eBPF network session logging 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-09 17:44:44 +02:00
Christopher Mühl
88dda3a777
docs(02): mark phase complete 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-09 17:43:28 +02:00
Christopher Mühl
c83129953f
test(02): persist human verification items as UAT 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-09 17:28:18 +02:00
Christopher Mühl
caabd59ae2
docs(02): add code review report 2026-04-09 17:25:30 +02:00
Christopher Mühl
64cb190b5d
docs(02-02): complete env audit display plan 2026-04-09 17:22:39 +02:00