Add the credential-injecting proxy for Claude and Codex (#411)

[hbrodin]

Keeps the model API keys out of the guest (#411). Adds an opt-in
[proxy] mode: coop runs a small host-side reverse proxy (coop-proxy, a
new binary shipped in the same tarball) for the lifetime of a remote-mode
VM. The guest is pointed at it and holds only a per-instance capability
token; the real credential stays on the host and is injected onto requests
upstream. A prompt-injected or rogue agent can no longer read a usable key.

Covers the two model APIs plus per-VM overrides and a jailed proxy
process. GitHub (#73) is separate follow-up work, not in this PR.

What it does

• Claude Code ([proxy.anthropic]) — pointed at the proxy via
  ANTHROPIC_BASE_URL; supports an API key (x-api-key) or a Claude
  setup-token (Authorization: Bearer).
• Codex ([proxy.openai]) — pointed at the proxy via a
  [model_providers.coop_local] block (Responses API) with the capability
  token as the provider bearer. In proxy mode ~/.codex/auth.json is no
  longer staged onto the guest disk; Codex subscription is out of scope —
  use an API key.
• The raw ANTHROPIC_API_KEY / OPENAI_API_KEY is no longer forwarded.
  Credential resolution fails closed — a bad credential aborts the boot.
  coop model <vm> local takes precedence and tears the proxy down.
• The proxy verifies the capability token (constant-time), strips it,
  injects the real credential, pins the upstream Host (closing SSRF),
  and streams to the fixed upstream over TLS against a pinned root set. It
  binds host loopback and is reverse-tunnelled (ssh -R) into the guest,
  so it works on both backends (Firecracker and Lima).
• Per-VM credential overrides — coop proxy setup [--openai] --vm <name> stores an override in that instance's state; resolution is
  override → default → off. coop proxy status shows what each VM
  resolves to, redacted. coop proxy setup is a wizard that stores the
  credential in a secret backend and writes the [proxy.*] block.

The jailed proxy process (slice 3)

coop-proxy holds the real credential and terminates guest-originated
connections, so it is confined to bound the blast radius of an exploit —
it cannot write files, exec programs, or reach any host beyond :443/:53.

• Linux — self-applies Landlock (ABI v4) before serving; fails closed
  on a kernel that cannot fully enforce it (host kernel ≥6.7).
• macOS — wrapped in sandbox-exec with a Seatbelt profile.
• Fail-closed launch: if confinement cannot be established the proxy exits
  before binding and the VM start aborts. coop-proxy --jail-selftest
  asserts the restrictions and runs in the integration suite.

The jail is port-scoped, not host-scoped (upstream identity is enforced by
the proxy's TLS verification), and does not restrict UDP on Linux — see
docs/trust-model.md.

Testing

• Unit tests for header rewrite/token gate/route selection, proxy-mode
  guest config, per-VM resolution, wire config, and the fail-closed launch.
• coop-proxy end-to-end gate tests (gate.rs).
• Integration suite (tests/integration.sh::test_proxy) passes on both
  backends: Lima (macOS) and Firecracker (Linux), including the jail
  self-test.

🤖 Generated with Claude Code

[hbrodin]

15 finding(s) posted inline. Special-focus verdict on the two things called out for this review:

• Testing sufficiency: the pure/logic layer is unusually well covered (config parse, port/range math, wire-JSON shapes, header rewrite/strip/inject, resolution precedence, key-suppression crown-jewel unit + integration, jail self-test). The gaps are concentrated at three boundaries: the TLS trust boundary (tautological test, no bad-cert rejection), the coop update sibling swap (replace_sibling_proxy has zero coverage), and two in-scope pure helpers whose edge branches slip past their tests (read_capability_token empty-trim, codex_proxy_config trailing-slash) — the last two are genuine .cargo/mutants.toml regressions since the file keeps them in scope while the tests don't kill their mutants. See the inline comments.
• Conflicting features: the proxy ↔ coop model <vm> local interaction is coherent and mutually exclusive by construction — local_endpoint yields Some only in Local mode, start_agent_proxy only in Remote mode, and switching to local re-bootstraps → start_agent_proxy calls stop_provider to reap the stale proxy; proxy::stop fires on stop/destroy/purge. No structural conflict. The one real gap is teardown-on-failure asymmetry (see the bootstrap_claude P2 inline): a failed boot orphans the credential-holding Anthropic proxy, and the coop model … remote re-bootstrap path (commands/model.rs::apply_to_running, not in this diff) has no outer proxy::stop on error either.

Additional findings on files not in this diff (can't anchor inline)

• docs/commands.md — the exhaustive command reference has no coop proxy entry (grep proxy docs/commands.md is empty). New top-level command ↔ command reference is a required sync edge; docs/credential-proxy.md covers the feature but the command reference itself is missing it.
• docs/configuration.md — the exhaustive config reference has no [proxy] section, though config.example.toml was updated. New config field ↔ config reference is a required sync edge; the two have drifted.
• src/commands/model.rs::apply_to_running — bootstrap_agents is called with no cleanup on error; a coop model <vm> remote switch that starts a proxy then fails a later step leaks it (same theme as the bootstrap_claude P2). The switch-to-local case is safe (start_agent_proxy tears down when mode != Remote).

Minor (not posted inline)

• Two inline comments narrate the PR's own delivery process — // … (unchanged from slice 1) (src/proxy.rs, also on persists_token) and // … (issue #411 slice 2) (src/backend.rs test). The rationale is fine; the "slice N" reference belongs in git history.

What was verified clean

Security core invariants all held: SSRF closed (upstream host/port/scheme fixed host-side, origin_form discards absolute-form authority), TLS verification has no bypass, capability token is CSPRNG + constant-time compared with both credential slots stripped, Landlock & !from_read + explicit AccessFs::Execute handling is correct and fail-closed, secrets ride stdin only, file modes right (0600 literal / 0644 cmd:). External-crate API usage verified correct against pinned versions. deny.toml license exceptions verified correct against the pinned crates; CI/release/install cross-file sync (cmake, musl-gcc, ARM64 native runner, --workspace, sibling binary) is correct; secret_store rename and atomic_replace refactor are straggler-free.

Coverage

Ran: review-correctness, review-security, review-design, review-conventions, review-tests, review-docs, review-comments, review-api-usage. None skipped — the diff touches every domain.

[hbrodin]

Pushed 464e1ee, d7884ca, 7158736 addressing the review.

Non-anchorable summary findings:

• docs/commands.md / docs/configuration.md — added the missing proxy command entry and [proxy] config section (7158736).
• commands/model.rs::apply_to_running — the symmetric teardown guard now lives inside bootstrap_claude/bootstrap_codex, so a failure during bootstrap tears the proxy down on every caller (including apply_to_running). A failure in apply_to_running after a clean bootstrap intentionally leaves the proxy running.

Left as-is with rationale (see inline replies): kill_pid_file pid-reuse (low severity, guest-uninfluenced, robust fix is Linux-only) and the --anthropic flag (documented + conflicts_with guard). The proxy accept-bound / idle-timeout hardening is filed as follow-up.

[hbrodin]

/my-review pass

Ran all 8 review-* agents over origin/main...HEAD (b3cf4db), primed to skip the 15 already-resolved findings and focus on the review-response commits. 4 new findings, all fixed in b3cf4db:

• api-usage — coop-proxy uses tokio::sync::Semaphore directly but dropping client-legacy removed the crate-controlled provenance of tokio/sync (it compiled only via transitive enablement). Declared sync in the tokio feature list.
• tests — the env_forward raw-key suppression branch was untested (config + guest_env paths were covered). Added proxy_mode_suppresses_anthropic_key_from_env_forward with a serialized process-env guard.
• comments — client_config_builds_with_pinned_roots had a tautological Arc::strong_count assert with an overstated comment; trimmed to the .unwrap() construction check and pointed at rejects_untrusted_upstream_cert for the real verification.
• conventions — the §13 [[licenses.exceptions]] example omitted the shipped webpki-roots (CDLA-Permissive-2.0) exception; added it.

No findings from review-correctness, review-security, review-design, or review-docs. Coverage: all 8 agents ran, none skipped (the diff touches every domain).

Gates green: cargo fmt --check, cargo clippy --all-targets --all-features -D warnings, cargo test (1057 lib + coop-proxy + gate), cargo deny check, taplo format --check. Integration suite (test_proxy, both backends) not run in this environment.