feat(llm-proxy): microVM guests reach their models through the node relay, holding no key

A microVM guest still received its backend's real key (as ANTHROPIC_AUTH_TOKEN or CLAUDE_CODE_OAUTH_TOKEN). Guest→provider traffic is TLS end to end through the node's CONNECT proxy, so nothing on that path can swap a credential. fcagent already pipes 127.0.0.1:11434 → vsock 9003 in EVERY guest (built for the local-model backend), so no rootfs rebuild is needed: - node 0.5.0: local_model::target_for sends that pipe to the node's own model (local backend, unchanged) or, when vm_create carries `model_relay`, to the server's LLM proxy — tailnet (100.64/10) ip:port only, so no message can point a node at the internet. The guard test is restated for the new invariant: the guest still never chooses where the pipe goes. Advertises `model_relay`. - server: llm_proxy::microvm_relay relays only when the proxy is on, CLAWMATES_LLM_PROXY_NODE_ADDR is set, the backend has a route, and the node reports model_relay — an older node keeps the old path rather than a guest whose model calls go nowhere. The guest then gets the mission token and ANTHROPIC_BASE_URL=http://127.0.0.1:11434/<route>, nothing else. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-23 14:20:40 -05:00
parent a428d7cf11
commit af70c5416e
11 changed files with 206 additions and 27 deletions
@@ -1817,9 +1817,12 @@ async fn launch_microvm_phase(
                std::fs::create_dir_all(&repo)
                    .map_err(|e| format!("create empty workspace {}: {e}", repo.display()))?;
            }
+            let model_relay =
+                crate::llm_proxy::microvm_relay(&pool2, node, backend.as_deref()).await;
            crate::microvm_executor::run_phase_in_vm(
                &hub,
                crate::microvm_executor::VmPhase {
+                    model_relay,
                    task_policy: Some(&task_policy),
                    // Attribution for live output: this is the run a browser
                    // subscribes to for this phase.