Close D2 auth swap, unowned cleanup, and restart gaps

- Read Codex auth through one no-follow descriptor instead of lstat,
  realpath, then open, so the path cannot be swapped to another host file.
- Retain staged credentials and fail when the agent container name is held
  by another invocation, instead of treating it as cleaned up.
- Require Docker's default no-restart policy before start.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mchwang

agents/container/profile.ts

@@ -60,7 +60,11 @@ const removeOwnedDirectories = (directories: readonly string[]) => {
 const readCapturedFile = (path: string, kind: string): { identity: FileIdentity; content: Buffer } => {
   let fd: number | undefined;
   try {
-    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try { fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW); }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ELOOP') throw new Error(`${kind} must be a direct regular file, not a link.`);
+      throw error;
+    }
     const before = fstatSync(fd);
     const maximum = 1024 * 1024;
     if (!before.isFile() || before.nlink !== 1 || before.size > maximum)
@@ -150,9 +154,8 @@ export function createContainerProfile(options: ProfileOptions): ContainerProfil
   if (!/^codeboost-work-[0-9a-f-]+$/.test(filesystems.workVolume)
     || !/^codeboost-metadata-[0-9a-f-]+$/.test(filesystems.metadataVolume)
     || !/^codeboost-keeper-[0-9a-f-]+$/.test(filesystems.keeper)) throw new Error('Task filesystem identity is invalid.');
-  if (options.codexAuthFile && !lstatSync(options.codexAuthFile).isFile())
-    throw new Error('Codex auth must be a direct regular file, not a link.');
-  const sourceAuth = options.codexAuthFile ? readCapturedFile(realpathSync(options.codexAuthFile), 'Codex auth') : undefined;
+  // Read through one no-follow descriptor so the path cannot be swapped between check and open.
+  const sourceAuth = options.codexAuthFile ? readCapturedFile(options.codexAuthFile, 'Codex auth') : undefined;
   const cleanupDirectories: string[] = [];
   let codexAuthFile: string | undefined, authIdentity: FileIdentity | undefined;
   try {

agents/container/run.ts

@@ -54,10 +54,8 @@ const removeContainerOrThrow = (profile: ContainerProfile) => {
     return;
   }
   const inspected = JSON.parse(before.stdout || '[]')[0] as { Config?: { Labels?: Record<string, string> } } | undefined;
-  if (inspected?.Config?.Labels?.['io.codeboost.invocation'] !== profile.ownershipId) {
-    disposeContainerProfile(profile);
-    return;
-  }
+  if (inspected?.Config?.Labels?.['io.codeboost.invocation'] !== profile.ownershipId)
+    throw new Error('Agent container name is held by another invocation; staged credentials were retained.');
   const result = spawnSync('docker', ['rm', '--force', profile.name], {
     encoding: 'utf8', timeout: remaining(), env: dockerEnvironment(), stdio: ['ignore', 'pipe', 'pipe'],
   });
@@ -87,6 +85,7 @@ type Inspect = {
     Ulimits: unknown[] | null; CpuCount: number;
     CpuPercent: number; IOMaximumBandwidth: number; IOMaximumIOps: number; DeviceCgroupRules: unknown[] | null;
     StorageOpt?: Record<string, string> | null; CgroupParent: string;
+    RestartPolicy?: { Name?: string; MaximumRetryCount?: number } | null;
     Devices: unknown[] | null; DeviceRequests: unknown[] | null; Tmpfs: Record<string, string> | null;
     Mounts: Array<{ Type: string; Source: string; Target: string; ReadOnly: boolean }> | null };
   Mounts: Array<{ Type: string; Name?: string; Source: string; Destination: string; RW: boolean }>;
@@ -129,7 +128,8 @@ export function validateContainer(container: string, profile: ContainerProfile,
     || host.BlkioWeightDevice?.length || host.BlkioDeviceReadBps?.length || host.BlkioDeviceWriteBps?.length
     || host.BlkioDeviceReadIOps?.length || host.BlkioDeviceWriteIOps?.length || host.Ulimits?.length
     || host.CpuCount !== 0 || host.CpuPercent !== 0 || host.IOMaximumBandwidth !== 0 || host.IOMaximumIOps !== 0
-    || host.DeviceCgroupRules !== null || host.StorageOpt != null || host.CgroupParent !== '')
+    || host.DeviceCgroupRules !== null || host.StorageOpt != null || host.CgroupParent !== ''
+    || !['', 'no'].includes(host.RestartPolicy?.Name ?? '') || (host.RestartPolicy?.MaximumRetryCount ?? 0) !== 0)
     throw new Error('Container daemon configuration is missing required lockdown.');
   const tmpfs = host.Tmpfs ?? {};
   const expectedTmpfs = new Map([

test/agent-container.test.ts

@@ -1,6 +1,6 @@
 import { execFileSync, spawnSync } from 'node:child_process';
 import { randomBytes, randomUUID } from 'node:crypto';
-import { chmodSync, mkdtempSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
@@ -264,12 +264,28 @@ describe('real Docker agent isolation', () => {
       inputDirectory: data.input, command: ['true'], codexAuthFile: data.fakeAuth, imageId });
     profiles.push(first, duplicate);
     docker(...first.args); containers.add(first.name);
-    expect(() => createValidatedContainer(duplicate)).toThrow();
+    expect(() => createValidatedContainer(duplicate)).toThrow('Container creation failed and cleanup did not settle.');
+    expect(existsSync(duplicate.codexAuthFile!)).toBe(true);
     const state = JSON.parse(docker('container', 'inspect', first.name))[0] as { State: { Status: string } };
     expect(state.State.Status).toBe('created');
     docker('rm', '--force', first.name); containers.delete(first.name);
   }, 60_000);
 
+  it('refuses a Codex auth path that is a link without resolving it', () => {
+    const data = fixture(), link = join(data.root, 'auth-link.json');
+    symlinkSync(data.fakeAuth, link);
+    expect(() => profile(data, 'planning', ['true'], { codexAuthFile: link })).toThrow('not a link');
+  }, 60_000);
+
+  it('rejects a restart policy that could relaunch the agent after it exits', () => {
+    const data = fixture(), valid = profile(data, 'planning', ['true']);
+    const imageIndex = valid.args.indexOf(imageId);
+    docker(...valid.args.slice(0, imageIndex), '--restart=always', ...valid.args.slice(imageIndex));
+    containers.add(valid.name);
+    expect(() => validateContainer(valid.name, valid)).toThrow('lockdown');
+    docker('rm', '--force', valid.name); containers.delete(valid.name);
+  }, 60_000);
+
   it('rejects added capabilities and conflicting or duplicate filesystem options', () => {
     const data = fixture(), valid = profile(data, 'planning', ['true']);
     const imageIndex = valid.args.indexOf(imageId);