From 587e64a27f1616a577c276802dd124b7d3b4a2c6 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 13 Oct 2026 16:07:07 -0500 Subject: [PATCH] research: row 96 stand-in-key test of CLIProxyAPI for role sessions (#1590) Packet under agents/researcher/work/i1-proxy-test: private-netns harness, stand-in upstream, report, evidence. Stand-in keys only; running proxy untouched. Co-Authored-By: Claude Sonnet 5.5 --- .../researcher/work/i1-proxy-test/REPORT.md | 274 ++++ .../researcher/work/i1-proxy-test/analyze.mjs | 129 ++ .../i1-proxy-test/candidate-manifest.sha256 | 168 +++ .../researcher/work/i1-proxy-test/cleanup.sh | 46 + .../work/i1-proxy-test/config.template.yaml | 43 + .../docs/config.example.v8.0.27.yaml | 1234 +++++++++++++++++ .../docs/management-api-v8.0.27.md | 163 +++ .../work/i1-proxy-test/docs/proxy-help.txt | 56 + agents/researcher/work/i1-proxy-test/inner.sh | 222 +++ .../work/i1-proxy-test/out/S2-claude-A.rc | 1 + .../work/i1-proxy-test/out/S2-claude-A.stderr | 0 .../work/i1-proxy-test/out/S2-claude-A.stdout | 2 + .../out/S2-claude-A.upstream.jsonl | 2 + .../work/i1-proxy-test/out/S2-pi-A.rc | 1 + .../work/i1-proxy-test/out/S2-pi-A.stderr | 1 + .../work/i1-proxy-test/out/S2-pi-A.stdout | 1 + .../i1-proxy-test/out/S2-pi-A.upstream.jsonl | 2 + .../work/i1-proxy-test/out/S2-pi-env-A.rc | 1 + .../work/i1-proxy-test/out/S2-pi-env-A.stderr | 2 + .../work/i1-proxy-test/out/S2-pi-env-A.stdout | 0 .../out/S2-pi-env-A.upstream.jsonl | 0 .../work/i1-proxy-test/out/S3-claude-B.rc | 1 + .../work/i1-proxy-test/out/S3-claude-B.stderr | 0 .../work/i1-proxy-test/out/S3-claude-B.stdout | 1 + .../out/S3-claude-B.upstream.jsonl | 1 + .../i1-proxy-test/out/S4-claude-A-revoked.rc | 1 + .../out/S4-claude-A-revoked.stderr | 0 .../out/S4-claude-A-revoked.stdout | 0 .../out/S4-claude-A-revoked.upstream.jsonl | 0 .../i1-proxy-test/out/S4-claude-B-after.rc | 1 + .../out/S4-claude-B-after.stderr | 0 .../out/S4-claude-B-after.stdout | 1 + .../out/S4-claude-B-after.upstream.jsonl | 1 + .../work/i1-proxy-test/out/S4-pi-A-revoked.rc | 1 + .../i1-proxy-test/out/S4-pi-A-revoked.stderr | 2 + .../i1-proxy-test/out/S4-pi-A-revoked.stdout | 0 .../out/S4-pi-A-revoked.upstream.jsonl | 0 .../i1-proxy-test/out/S5-claude-missing.rc | 1 + .../out/S5-claude-missing.stderr | 0 .../out/S5-claude-missing.stdout | 1 + .../out/S5-claude-missing.upstream.jsonl | 0 .../i1-proxy-test/out/S5-claude-unknown.rc | 1 + .../out/S5-claude-unknown.stderr | 0 .../out/S5-claude-unknown.stdout | 1 + .../out/S5-claude-unknown.upstream.jsonl | 0 .../work/i1-proxy-test/out/S5-pi-missing.rc | 1 + .../i1-proxy-test/out/S5-pi-missing.stderr | 6 + .../i1-proxy-test/out/S5-pi-missing.stdout | 0 .../out/S5-pi-missing.upstream.jsonl | 0 .../work/i1-proxy-test/out/S5-pi-unknown.rc | 1 + .../i1-proxy-test/out/S5-pi-unknown.stderr | 2 + .../i1-proxy-test/out/S5-pi-unknown.stdout | 0 .../out/S5-pi-unknown.upstream.jsonl | 0 .../out/S6-claude-B-upstream-down.rc | 1 + .../out/S6-claude-B-upstream-down.stderr | 0 .../out/S6-claude-B-upstream-down.stdout | 0 .../S6-claude-B-upstream-down.upstream.jsonl | 0 .../out/S6-pi-B-upstream-down.rc | 1 + .../out/S6-pi-B-upstream-down.stderr | 2 + .../out/S6-pi-B-upstream-down.stdout | 0 .../out/S6-pi-B-upstream-down.upstream.jsonl | 0 .../work/i1-proxy-test/out/analysis.txt | 119 ++ .../i1-proxy-test/out/config.after-issue.yaml | 38 + .../out/config.after-revoke.yaml | 72 + .../i1-proxy-test/out/config.after-start.yaml | 36 + .../i1-proxy-test/out/config.as-written.yaml | 43 + .../work/i1-proxy-test/out/host-activity.txt | 4 + .../i1-proxy-test/out/host-guard.after.txt | 8 + .../i1-proxy-test/out/host-guard.before.txt | 8 + .../work/i1-proxy-test/out/host-guard.diff | 0 .../work/i1-proxy-test/out/host-guard.txt | 10 + .../work/i1-proxy-test/out/key-A.txt | 1 + .../work/i1-proxy-test/out/key-B.txt | 1 + .../out/logs-endpoint.final.json | 1 + .../work/i1-proxy-test/out/mgmt-calls.log | 9 + .../work/i1-proxy-test/out/probes.log | 9 + .../api-hello-2026-10-13T155741-1.log | 26 + .../api-hello-2026-10-13T155756-2.log | 26 + .../api-hello-2026-10-13T155757-3.log | 26 + .../api-hello-2026-10-13T155937-4.log | 26 + .../api-hello-2026-10-13T155938-1.log | 26 + .../api-hello-2026-10-13T160239-2.log | 26 + .../api-hello-2026-10-13T160240-3.log | 26 + .../i1-proxy-test/out/proxy-logs/main.log | 817 +++++++++++ ...v1-messages-2026-10-13T155740-226dc6e1.log | 64 + ...v1-messages-2026-10-13T155740-4d08fb40.log | 64 + ...v1-messages-2026-10-13T155741-77dd3d79.log | 140 ++ ...v1-messages-2026-10-13T155741-edc3cbeb.log | 140 ++ ...v1-messages-2026-10-13T155756-28646971.log | 135 ++ ...v1-messages-2026-10-13T155756-5c9d09ac.log | 30 + ...v1-messages-2026-10-13T155756-7d3d5117.log | 146 ++ ...v1-messages-2026-10-13T155756-e06c4e7a.log | 135 ++ ...v1-messages-2026-10-13T155757-3ebfe5fe.log | 42 + ...v1-messages-2026-10-13T155757-55c485a0.log | 42 + ...v1-messages-2026-10-13T155757-b537f217.log | 64 + ...v1-messages-2026-10-13T155759-3c332ae4.log | 42 + ...v1-messages-2026-10-13T155801-a39de9f2.log | 42 + ...v1-messages-2026-10-13T155806-42a5df1f.log | 42 + ...v1-messages-2026-10-13T155815-56206dd3.log | 42 + ...v1-messages-2026-10-13T155831-54eb4702.log | 42 + ...v1-messages-2026-10-13T155909-6a7e5158.log | 42 + ...v1-messages-2026-10-13T155937-9ce43f01.log | 146 ++ ...v1-messages-2026-10-13T155937-c5e90c32.log | 41 + ...v1-messages-2026-10-13T155938-000680b9.log | 29 + ...v1-messages-2026-10-13T155938-3e65ed72.log | 30 + ...v1-messages-2026-10-13T155938-56a17d37.log | 30 + ...v1-messages-2026-10-13T155938-c5b576c8.log | 42 + ...v1-messages-2026-10-13T155938-e6f50339.log | 64 + ...v1-messages-2026-10-13T155939-297451ab.log | 42 + ...v1-messages-2026-10-13T155940-62bc3d1f.log | 42 + ...v1-messages-2026-10-13T155943-a20a6541.log | 42 + ...v1-messages-2026-10-13T155947-270670d4.log | 42 + ...v1-messages-2026-10-13T155955-41163905.log | 42 + ...v1-messages-2026-10-13T160013-34b30b11.log | 42 + ...v1-messages-2026-10-13T160049-c266012d.log | 42 + ...v1-messages-2026-10-13T160126-bb34b220.log | 42 + ...v1-messages-2026-10-13T160202-86769890.log | 42 + ...v1-messages-2026-10-13T160239-44d3fe12.log | 41 + ...v1-messages-2026-10-13T160239-e1c39c58.log | 42 + ...v1-messages-2026-10-13T160240-4aefd81f.log | 88 ++ ...v1-messages-2026-10-13T160240-eaf1c665.log | 61 + ...v1-messages-2026-10-13T160241-49a241d8.log | 88 ++ ...v1-messages-2026-10-13T160242-722f4e46.log | 88 ++ ...v1-messages-2026-10-13T160244-4653f804.log | 88 ++ ...v1-messages-2026-10-13T160249-cdd40ca9.log | 88 ++ ...v1-messages-2026-10-13T160259-05297f34.log | 88 ++ ...v1-messages-2026-10-13T160315-513819ae.log | 88 ++ ...v1-messages-2026-10-13T160348-cfb7ac32.log | 88 ++ ...v1-messages-2026-10-13T160421-c4bf5062.log | 83 ++ ...v1-messages-2026-10-13T160425-91e21a9d.log | 83 ++ ...v1-messages-2026-10-13T160429-d855c755.log | 83 ++ ...v1-messages-2026-10-13T160437-1d8ef141.log | 83 ++ ...v1-messages-2026-10-13T160437-4b068ca8.log | 61 + ...v1-messages-2026-10-13T160437-5eadf774.log | 61 + ...v1-messages-2026-10-13T160437-efd563be.log | 61 + .../work/i1-proxy-test/out/proxy.out.txt | 8 + .../out/queue-read-semantics.txt | 3 + .../i1-proxy-test/out/run-all.console.txt | 49 + .../researcher/work/i1-proxy-test/out/run.log | 31 + .../work/i1-proxy-test/out/upstream.all.jsonl | 10 + .../work/i1-proxy-test/out/upstream.out.txt | 1 + .../out/usage-api-keys.after-S2.json | 1 + .../out/usage-api-keys.after-S4.json | 1 + .../out/usage-api-keys.final.json | 1 + .../out/usage-queue.S1-A-immediately.json | 1 + .../out/usage-queue.S1-B-immediately.json | 1 + .../out/usage-queue.S2-claude-A.json | 1 + .../out/usage-queue.S2-pi-A.json | 1 + .../out/usage-queue.S2-pi-env-A.json | 1 + .../out/usage-queue.S3-claude-B.json | 1 + .../out/usage-queue.S4-A-after-revoke.json | 1 + .../out/usage-queue.S4-B-after-revoke.json | 1 + .../out/usage-queue.S4-claude-A-revoked.json | 1 + .../out/usage-queue.S4-claude-B-after.json | 1 + .../out/usage-queue.S4-pi-A-revoked.json | 1 + .../out/usage-queue.S4b-A-after-restart.json | 1 + .../out/usage-queue.S4b-B-after-restart.json | 1 + .../out/usage-queue.S5-claude-missing.json | 1 + .../out/usage-queue.S5-claude-unknown.json | 1 + .../out/usage-queue.S5-missing.json | 1 + .../out/usage-queue.S5-pi-missing.json | 1 + .../out/usage-queue.S5-pi-unknown.json | 1 + .../out/usage-queue.S5-unknown.json | 1 + .../out/usage-queue.S6-B-upstream-down.json | 1 + ...usage-queue.S6-claude-B-upstream-down.json | 1 + .../usage-queue.S6-pi-B-upstream-down.json | 1 + .../i1-proxy-test/out/usage-queue.final.json | 1 + .../researcher/work/i1-proxy-test/run-all.sh | 67 + .../work/i1-proxy-test/stand-in-upstream.mjs | 146 ++ 169 files changed, 7452 insertions(+) create mode 100644 agents/researcher/work/i1-proxy-test/REPORT.md create mode 100644 agents/researcher/work/i1-proxy-test/analyze.mjs create mode 100644 agents/researcher/work/i1-proxy-test/candidate-manifest.sha256 create mode 100755 agents/researcher/work/i1-proxy-test/cleanup.sh create mode 100644 agents/researcher/work/i1-proxy-test/config.template.yaml create mode 100644 agents/researcher/work/i1-proxy-test/docs/config.example.v8.0.27.yaml create mode 100644 agents/researcher/work/i1-proxy-test/docs/management-api-v8.0.27.md create mode 100644 agents/researcher/work/i1-proxy-test/docs/proxy-help.txt create mode 100755 agents/researcher/work/i1-proxy-test/inner.sh create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-claude-A.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-claude-A.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-claude-A.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-claude-A.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-pi-A.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-pi-A.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-pi-A.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-pi-A.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-pi-env-A.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-pi-env-A.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-pi-env-A.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S2-pi-env-A.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S3-claude-B.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S3-claude-B.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S3-claude-B.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S3-claude-B.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-claude-A-revoked.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-claude-A-revoked.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-claude-A-revoked.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-claude-A-revoked.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-claude-B-after.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-claude-B-after.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-claude-B-after.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-claude-B-after.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-pi-A-revoked.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-pi-A-revoked.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-pi-A-revoked.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S4-pi-A-revoked.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-claude-missing.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-claude-missing.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-claude-missing.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-claude-missing.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-claude-unknown.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-claude-unknown.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-claude-unknown.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-claude-unknown.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-pi-missing.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-pi-missing.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-pi-missing.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-pi-missing.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-pi-unknown.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-pi-unknown.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-pi-unknown.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S5-pi-unknown.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S6-claude-B-upstream-down.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S6-claude-B-upstream-down.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S6-claude-B-upstream-down.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S6-claude-B-upstream-down.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/S6-pi-B-upstream-down.rc create mode 100644 agents/researcher/work/i1-proxy-test/out/S6-pi-B-upstream-down.stderr create mode 100644 agents/researcher/work/i1-proxy-test/out/S6-pi-B-upstream-down.stdout create mode 100644 agents/researcher/work/i1-proxy-test/out/S6-pi-B-upstream-down.upstream.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/analysis.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/config.after-issue.yaml create mode 100644 agents/researcher/work/i1-proxy-test/out/config.after-revoke.yaml create mode 100644 agents/researcher/work/i1-proxy-test/out/config.after-start.yaml create mode 100644 agents/researcher/work/i1-proxy-test/out/config.as-written.yaml create mode 100644 agents/researcher/work/i1-proxy-test/out/host-activity.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/host-guard.after.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/host-guard.before.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/host-guard.diff create mode 100644 agents/researcher/work/i1-proxy-test/out/host-guard.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/key-A.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/key-B.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/logs-endpoint.final.json create mode 100644 agents/researcher/work/i1-proxy-test/out/mgmt-calls.log create mode 100644 agents/researcher/work/i1-proxy-test/out/probes.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/api-hello-2026-10-13T155741-1.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/api-hello-2026-10-13T155756-2.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/api-hello-2026-10-13T155757-3.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/api-hello-2026-10-13T155937-4.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/api-hello-2026-10-13T155938-1.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/api-hello-2026-10-13T160239-2.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/api-hello-2026-10-13T160240-3.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/main.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155740-226dc6e1.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155740-4d08fb40.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155741-77dd3d79.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155741-edc3cbeb.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155756-28646971.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155756-5c9d09ac.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155756-7d3d5117.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155756-e06c4e7a.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155757-3ebfe5fe.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155757-55c485a0.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155757-b537f217.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155759-3c332ae4.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155801-a39de9f2.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155806-42a5df1f.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155815-56206dd3.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155831-54eb4702.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155909-6a7e5158.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155937-9ce43f01.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155937-c5e90c32.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155938-000680b9.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155938-3e65ed72.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155938-56a17d37.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155938-c5b576c8.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155938-e6f50339.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155939-297451ab.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155940-62bc3d1f.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155943-a20a6541.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155947-270670d4.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T155955-41163905.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160013-34b30b11.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160049-c266012d.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160126-bb34b220.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160202-86769890.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160239-44d3fe12.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160239-e1c39c58.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160240-4aefd81f.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160240-eaf1c665.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160241-49a241d8.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160242-722f4e46.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160244-4653f804.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160249-cdd40ca9.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160259-05297f34.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160315-513819ae.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160348-cfb7ac32.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160421-c4bf5062.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160425-91e21a9d.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160429-d855c755.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160437-1d8ef141.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160437-4b068ca8.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160437-5eadf774.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy-logs/v1-messages-2026-10-13T160437-efd563be.log create mode 100644 agents/researcher/work/i1-proxy-test/out/proxy.out.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/queue-read-semantics.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/run-all.console.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/run.log create mode 100644 agents/researcher/work/i1-proxy-test/out/upstream.all.jsonl create mode 100644 agents/researcher/work/i1-proxy-test/out/upstream.out.txt create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-api-keys.after-S2.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-api-keys.after-S4.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-api-keys.final.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S1-A-immediately.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S1-B-immediately.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S2-claude-A.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S2-pi-A.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S2-pi-env-A.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S3-claude-B.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S4-A-after-revoke.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S4-B-after-revoke.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S4-claude-A-revoked.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S4-claude-B-after.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S4-pi-A-revoked.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S4b-A-after-restart.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S4b-B-after-restart.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S5-claude-missing.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S5-claude-unknown.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S5-missing.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S5-pi-missing.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S5-pi-unknown.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S5-unknown.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S6-B-upstream-down.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S6-claude-B-upstream-down.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.S6-pi-B-upstream-down.json create mode 100644 agents/researcher/work/i1-proxy-test/out/usage-queue.final.json create mode 100755 agents/researcher/work/i1-proxy-test/run-all.sh create mode 100644 agents/researcher/work/i1-proxy-test/stand-in-upstream.mjs diff --git a/agents/researcher/work/i1-proxy-test/REPORT.md b/agents/researcher/work/i1-proxy-test/REPORT.md new file mode 100644 index 000000000..5afa80f56 --- /dev/null +++ b/agents/researcher/work/i1-proxy-test/REPORT.md @@ -0,0 +1,274 @@ +# Row 96 (#1590): stand-in-key test of CLIProxyAPI for role sessions + +Author: Researcher seat. Brief: `docs/plans/2026-10-12_local-model-proxy.md` § "Stand-in-key +test of CLIProxyAPI for role sessions". Reviewer: Dewey. +Evidence for every claim is in `out/`. The numbers below come from the final run +(`out/run.log`, started 2026-10-13T20:57:40Z). + +## Verdict in short + +- A second CLIProxyAPI process carries both pinned clients (Claude Code 2.1.296, pi 0.85.1) + through a streamed turn and a tool round trip, using only stand-in keys. +- Claude Code works with `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` as the session + allowlist stands. **Pi does not: it ignores `ANTHROPIC_BASE_URL`.** It needs a + `models.json` in the session's `HOME` (details in "Pi finding"). +- Per-agent keys work from the command line: issue = 1 PUT, revoke = 1 DELETE, no restart, + effective on the next request. Keys survive a proxy restart. +- The upstream sees only the proxy's own key. The client key never leaves the proxy. +- What does not hold or is weak: attribution by client key (queue-only, 60 s window, plaintext + keys), the revoke call's key in the access log, silent multi-minute retry in Claude Code + on 401, and every management write rewriting the whole config file. See "What doesn't hold". + +## Bounds kept + +- No real credential, no spend, no request off the machine. Everything runs inside + `unshare -rn`: a private network namespace with only `lo`. The test processes cannot reach + the live proxy on 127.0.0.1:8317 or anything else. `out/run.log` line 3 lists the listeners + visible inside the namespace (18317, 18400 only). +- The running proxy was not called, restarted or configured. Its management key and config + content were never read. `run-all.sh` records before/after: pid 113963, start time, argv, + the 8317 listener, and `stat` (mtime, size) of its config. All identical + (`out/host-guard.before.txt`, `.after.txt`, `.diff` empty, `host-guard.txt`). +- Files under the live proxy's data directory (`core-start-output.log`, `usage.db`) did change + during the run. Those belong to the live proxy serving other clients (2 to 6 established + connections to 8317 from other host processes at the time). The test cannot touch them from + inside the namespace. They are listed as informational in `out/host-activity.txt`, not in the + verdict, because they would change whatever the test does. +- Nothing left behind: `cleanup.sh` ran, `out/host-guard.txt` says "left behind outside out/: 0". + +## Proxy version, config fields, endpoints + +`cli-proxy-api -h` and the startup line: **CLIProxyAPI 8.0.27, commit bf934162, built +2026-10-12T16:37:54Z** (`out/run.log` line 4; flags in `docs/proxy-help.txt`). +Started as `cli-proxy-api -config state/config.yaml -local-model` under `env -i HOME=… PATH=…`. + +Config fields used, from `docs/config.example.v8.0.27.yaml` (the example config shipped +with 8.0.27; the line numbers are in that file): + +| Field | Line | Used for | +|---|---|---| +| `config-version` | 10 | `8` | +| `server.host` / `port` | 24 | 127.0.0.1:18317 | +| `management.secret-key` | 89 | made-up key; an empty value disables management | +| `management.allow-remote` | 84 | `false` | +| `management.disable-control-panel` | 92 | `true` (no WebUI) | +| `access.api-keys` | 106, 108 | client keys the proxy accepts | +| `routing.retry.request-retry` | 149, 194 | `0` (no hidden proxy retries) | +| `oauth.auth-dir` | 884 | inside the packet, so request logs land there | +| `observability.logs.debug` / `logging-to-file` / `request-log` / `logs-max-total-size-mb` | 1114 to 1131 | per-request logs; size cap 200 MB | +| `observability.usage.usage-statistics-enabled` | 1133, 1135 | `true` | +| `observability.usage.redis-usage-queue-retention-seconds` | 1140 | default 60 (not set) | +| `api-keys.claude[]` (`name`, `base-url`, `keys[].api-key`) | ~650 to 720 | the proxy's own upstream: the stand-in server and its made-up key | + +Management endpoints used, from `docs/management-api-v8.0.27.md`. Auth is +`Authorization: Bearer ` (or `X-Management-Key`): + +| Endpoint | Used for | +|---|---| +| `GET/PUT /v8/management/config/access/api-keys` | list, replace the client-key list | +| `DELETE /v0/management/api-keys?value=` | remove one client key | +| `GET /v8/management/observability/usage/api-keys` | usage counters | +| `GET /v8/management/observability/usage/queue` | per-request usage events | +| `GET /v8/management/observability/logs` | log lines | + +Also noted in the doc and not used: `PATCH` on the `access/api-keys` path, and +`/observability/logs/requests/`. I did not test whether a v8 DELETE exists; the v0 one worked. + +## Stand-in upstream + +`stand-in-upstream.mjs`: HTTP on 127.0.0.1:18400, accepts only +`standin-upstream-key-0001` (`Authorization: Bearer` or `x-api-key`), records every request +as JSONL (`out/upstream.all.jsonl`), answers like the Messages API: SSE stream in three chunks, +a `Read` tool call when the prompt contains `TOOL-TEST`, and `ROUNDTRIP-OK: ` +when the history ends in the matching `tool_result`. It also answers `count_tokens` and +`/v1/models`. + +## Client runs + +Both clients ran through the repo's real adapters (`adapters/claude/adapter.sh`, +`adapters/pi/adapter.sh`) under `env -i` with only the session allowlist +(`packages/seat/src/session.mjs` `ENV_ALLOW`: `HOME`, `ANTHROPIC_API_KEY`, +`ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_BASE_URL`, `MOSAIC_CLAUDE_BIN`, …) plus the adapter's +`MOSAIC_*` inputs. Claude ran with `"}}}`, +no `/v1` suffix. `HOME` is on the allowlist, so a per-session `HOME` containing that file +works with `ANTHROPIC_API_KEY` carrying the client key. `inner.sh` kind `pi` does exactly this +(`state/home-