Omar SobhandClaude Fable 5
4f253bec93
- SandboxSpec gains an egress flag (default false — the kernel suite
still proves zero-network for agent sandboxes). Egress-enabled
containers exist ONLY for the browser: no credentials, no broker
route, bridge network with host-gateway alias for local test pages
- images/agent-browser: Alpine Chromium, uid 10001, setuid bits
stripped — same non-root hardening as agent-base
- browser.goto tool: headless chromium --dump-dom in the agent's
browser container; HTML stripped to readable text (4k cap) and
returned with output_taint=web; viewport screenshot captured,
base64'd out of the container, stored in the blob store
- Taint semantics tightened: the step that PRODUCED untrusted output
now carries its own taint (recorded before the step row), not just
later steps — chat.inbox test updated to the stricter §15 reading
- GET /api/claws/{id}/browser/viewport.png serves the latest capture;
BrowserApp polls it and renders the live viewport (spec §7.1),
keeping the empty state until the agent has browsed
- Proven end to end with REAL Chromium against a REAL local page:
content 'Revenue up 14 percent' returned tainted web; the gated
email.send that follows carries 'web' in its approval taint_sources
(untrusted content can never quietly reach outward); screenshot
verified by PNG magic bytes
152 Rust tests + 63 frontend + 27 Playwright journeys.
Co-Authored-By: Claude Fable 5 <[email protected]>
16 lines
622 B
Docker
16 lines
622 B
Docker
# Browser container for the browser.goto tool: headless Chromium, same
|
|
# non-root hardening as agent-base. This container HAS network egress —
|
|
# it holds no credentials and no broker route; everything it returns is
|
|
# tainted `web` (§15: data, never instructions).
|
|
FROM alpine:3.21
|
|
|
|
RUN apk add --no-cache chromium font-noto \
|
|
&& addgroup -g 10001 agent \
|
|
&& adduser -D -u 10001 -G agent agent \
|
|
# No setuid/setgid binaries: privilege escalation surface to zero.
|
|
&& find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null || true
|
|
|
|
USER 10001:10001
|
|
WORKDIR /home/agent
|
|
CMD ["sleep", "infinity"]
|