feat(kiloclaw): add optional Pipelock proxy sidecar#2814
Open
luckyPipewrench wants to merge 3 commits intoKilo-Org:mainfrom
Open
feat(kiloclaw): add optional Pipelock proxy sidecar#2814luckyPipewrench wants to merge 3 commits intoKilo-Org:mainfrom
luckyPipewrench wants to merge 3 commits intoKilo-Org:mainfrom
Conversation
Adds an opt-in Pipelock integration for KiloClaw VM images. When KILOCLAW_PIPELOCK_ENABLED=1 is set, the controller generates a per-VM TLS interception CA, writes a managed Pipelock config, and starts Pipelock under the existing process supervisor before OpenClaw. The OpenClaw child receives proxy environment variables that route env-aware HTTP/HTTPS fetches through the local forward proxy on 127.0.0.1:8888 for DLP, prompt-injection, SSRF, and response scanning. When the flag is unset, KiloClaw startup and generated OpenClaw config are byte-for-byte unchanged. Capability separation is enforced at the env-var boundary: the Pipelock sidecar runs with an explicit allowlist environment so it cannot inherit agent secrets or proxy env vars (which would recurse). Agent-side traffic gets the proxy plus a combined CA bundle for non-Node tools that replace their trust roots. Fail-closed: any failure in CA generation, config write, supervisor spawn, or readiness leaves the controller in degraded mode without starting OpenClaw. Readiness requires Pipelock to report status=healthy with forward_proxy_enabled, tls_interception_enabled, and response_scan_enabled all true, and kill_switch_active not active. Out of scope (deliberate): - VM-level egress containment (iptables OWNER, netns, seccomp) - Worker-side per-instance enablement plumbing - Dashboard toggle, billing, receipts UI License: Pipelock is Apache 2.0; the Linux binary is pulled from a pinned upstream release with SHA256 verification.
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Contributor
Code Review SummaryStatus: 2 Issues Found | Recommendation: Address before merge Overview
Fix these issues in Kilo Cloud Issue Details (click to expand)WARNING
Other Observations (not in diff)None. Files Reviewed (9 files)
Reviewed by gpt-5.4-20260305 · 618,403 tokens |
…nd CA bundles Addresses two warnings from the kilo-code-bot review on PR Kilo-Org#2814. 1. `pipelock tls init` was synchronously inheriting the controller's full process.env (decrypted agent secrets like KILOCODE_API_KEY, gateway tokens, and channel tokens by the time Phase 7 runs). The supervisor-spawn case already used the scrubbed allowlist via getPipelockChildEnv; this closes the same gap on the synchronous CA-generation exec. 2. getOpenClawProxyEnv was clobbering pre-existing customer NO_PROXY, SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and similar settings. NO_PROXY is now merged so customer bypass entries (internal services) survive. For CA bundles, ensurePipelockCaBundle now reads any pre-existing customer-provided CA paths from the env and concatenates their content into the combined bundle, so customer trust roots survive when the agent child env is pointed at our combined bundle. ensurePipelockCa and ensurePipelockCaBundle now take env as their first parameter; index.ts call sites updated accordingly. Tests cover env scrubbing on tls init, customer bundle merge with de-duplication and self-reference skipping, and NO_PROXY merge with both upper- and lower-case variants.
|
💯 🚀 Pipelock configurations/Helm chart-based support has been merged into our Sure repo for weeks now, and this would allow us to extend Kilo Claw offers to our users at sure.am without additional headaches. Currently demo site users don't have the benefit of kicking the tires of "external AI" via OpenClaw (we support it, but currently show only the direct-to-OpenAI-compatible LLM calls in our site. I would feel more comfortable deploying Sure + Kilo Claw if we could also demonstrate out commitment to data security by having this "on" by default in our bundle. |
Resolves Dockerfile conflict by keeping the Pipelock install stanza and taking main's renamed custom plugins comment. Folds in follow-up review fixes: NODE_EXTRA_CA_CERTS now points at the combined CA bundle so customer Node trust roots survive, and NO_PROXY merge collects entries from both NO_PROXY and no_proxy with whitespace trim and de-duplication.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an opt-in Pipelock integration for KiloClaw VMs. Set
KILOCLAW_PIPELOCK_ENABLED=1on an instance and the controller generates a per-VM TLS interception CA, writes a managed Pipelock config, and starts Pipelock under the existing process supervisor before OpenClaw. The OpenClaw child gets proxy environment variables that route env-aware HTTP/HTTPS traffic through127.0.0.1:8888for DLP, prompt-injection, SSRF, and response scanning.When the flag is unset, KiloClaw startup and generated OpenClaw config are byte-for-byte unchanged.
The integration is controller-only. A Worker-side toggle that lets users enable Pipelock per-instance from the dashboard would be a small follow-up if you want per-instance control; until then, the flag is set globally on the Worker for all instances or none.
A new Phase 7 in the controller startup runs CA generation, CA bundle build, config write, supervisor spawn, and a strict readiness gate before Phase 8 starts OpenClaw. Capability separation is enforced at the env-var boundary: the Pipelock sidecar gets an explicit allowlist environment so it cannot inherit agent secrets or proxy env vars (the latter would loop the proxy through itself). Failures in CA generation, config write, supervisor spawn, or readiness leave the controller in degraded mode without ever starting OpenClaw. Readiness requires Pipelock to report
status=healthywithforward_proxy_enabled,tls_interception_enabled, andresponse_scan_enabledall true, andkill_switch_activenot active.V1 enforces traffic routing at the env-var layer. VM-level egress containment (iptables
OWNER, network namespace, seccomp) would harden this further against a malicious agent and is documented as a recommended follow-up inservices/kiloclaw/docs/pipelock.md.No Pipelock license key is required. The features used here (forward proxy, TLS interception, DLP, prompt-injection scanning, SSRF, SSE response scanning) are all in Pipelock's free single-agent tier.
Verification
debian:bookworm-slim(Kilo's runtime base) and verified pipelock v2.3.0 installs to/usr/local/binwith the SHA256 pin matching the upstreamchecksums.txtfor the v2.3.0 tagpipelock check --configagainst the controller-generated YAML; v2.3.0 accepts every field includingresponse_scanning.sse_streaming.enabledensurePipelockCa+ensurePipelockCaBundle+ensurePipelockConfigchain end-to-end against the real pipelock v2.3.0 binary; verified file modes (0o600on the CA key and config), bundle contents (system roots plus per-VM CA), and idempotency on repeat invocationpipelock run --configand confirmed the controller'swaitForPipelockReadypasses against the live/healthresponse; confirmed the forward proxy responds toCONNECT example.com:443withHTTP/1.1 200The pipelock-specific image layer was built and verified. The rest of the KiloClaw image (chromium, ffmpeg, openclaw toolchain) is unchanged by this PR.
Visual Changes
N/A
Reviewer Notes
controller/src/pipelock.ts(PIPELOCK_ENV_ALLOWLIST). Every entry is a deliberate concession. Push back on any that feels too permissive.controller/src/index.tsand the three degraded-state labels (pipelock-init,pipelock-start,pipelock-listen). Each path has a test instart-controller-degraded.test.ts.controller/src/pipelock.ts(waitForPipelockReady+isPipelockHealthReady). Three feature flags plus kill-switch-not-active. Stricter than a TCP poll so a stray listener on:8888cannot unblock OpenClaw.docs/pipelock.md"Enforcement boundary" section for the V1 application-level vs follow-up VM-level distinction.