Own vendor networks on profile failure and bound network cleanup

- Claim the vendor network before any fallible profile work and remove it
  if creation fails, aggregating cleanup errors.
- Reserve cleanup time inside createVendorNetwork's deadline so failure
  cleanup cannot overrun the caller's timeoutMs.
- Compare the live Claude marker exactly, tolerating only one wrapping
  pair of backticks or quotes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mchwang

agents/container/profile.ts

@@ -158,22 +158,24 @@ export function createContainerProfile(options: ProfileOptions): ContainerProfil
   assertTaskFilesystems(filesystems, invocation.clone);
   assertVendorNetwork(options.network, invocation);
   if (claimedNetworks.has(options.network)) throw new Error('Vendor network already belongs to another container profile.');
-  assertPhasePolicy(options.policy, invocation);
-  const command = assertAgentCommand(options.command, options.policy, invocation.vendor);
-  const sourceInput = captureInput(options.inputDirectory);
-  if (invocation.vendor === 'codex' && (!options.codexAuthFile || options.claudeToken))
-    throw new Error('Codex requires only its auth file.');
-  if (invocation.vendor === 'claude' && (!options.claudeToken || options.codexAuthFile))
-    throw new Error('Claude requires only its OAuth token.');
-  if (options.claudeToken?.includes('\0')) throw new Error('Claude OAuth token is malformed.');
-  if (!/^codeboost-work-[0-9a-f-]+$/.test(filesystems.workVolume)
-    || !/^codeboost-metadata-[0-9a-f-]+$/.test(filesystems.metadataVolume)
-    || !/^codeboost-keeper-[0-9a-f-]+$/.test(filesystems.keeper)) throw new Error('Task filesystem identity is invalid.');
-  // Read through one no-follow descriptor so the path cannot be swapped between check and open.
-  const sourceAuth = options.codexAuthFile ? readCapturedFile(options.codexAuthFile, 'Codex auth') : undefined;
+  // Own the network from here on, so any later failure removes it rather than leaking it.
+  claimedNetworks.add(options.network);
   const cleanupDirectories: string[] = [];
   let codexAuthFile: string | undefined, authIdentity: FileIdentity | undefined;
   try {
+    assertPhasePolicy(options.policy, invocation);
+    const command = assertAgentCommand(options.command, options.policy, invocation.vendor);
+    const sourceInput = captureInput(options.inputDirectory);
+    if (invocation.vendor === 'codex' && (!options.codexAuthFile || options.claudeToken))
+      throw new Error('Codex requires only its auth file.');
+    if (invocation.vendor === 'claude' && (!options.claudeToken || options.codexAuthFile))
+      throw new Error('Claude requires only its OAuth token.');
+    if (options.claudeToken?.includes('\0')) throw new Error('Claude OAuth token is malformed.');
+    if (!/^codeboost-work-[0-9a-f-]+$/.test(filesystems.workVolume)
+      || !/^codeboost-metadata-[0-9a-f-]+$/.test(filesystems.metadataVolume)
+      || !/^codeboost-keeper-[0-9a-f-]+$/.test(filesystems.keeper)) throw new Error('Task filesystem identity is invalid.');
+    // Read through one no-follow descriptor so the path cannot be swapped between check and open.
+    const sourceAuth = options.codexAuthFile ? readCapturedFile(options.codexAuthFile, 'Codex auth') : undefined;
     const inputDirectory = mkdtempSync(join(tmpdir(), 'codeboost-input-'));
     cleanupDirectories.push(inputDirectory);
     writeFileSync(join(inputDirectory, 'schema.json'), sourceInput.content,
@@ -224,11 +226,12 @@ export function createContainerProfile(options: ProfileOptions): ContainerProfil
       auth: authIdentity,
       cleanupDirectories: Object.freeze([...cleanupDirectories]), filesystems, clone: invocation.clone,
       network: options.network, policy: options.policy, invocation }));
-    claimedNetworks.add(options.network);
     return profile;
   } catch (error) {
-    try { removeOwnedDirectories(cleanupDirectories); }
-    catch (cleanupError) { throw new AggregateError([error, cleanupError], 'Profile creation and cleanup both failed.'); }
+    const failures: unknown[] = [];
+    try { removeOwnedDirectories(cleanupDirectories); } catch (cleanupError) { failures.push(cleanupError); }
+    try { removeVendorNetwork(options.network); } catch (cleanupError) { failures.push(cleanupError); }
+    if (failures.length) throw new AggregateError([error, ...failures], 'Profile creation and cleanup both failed.');
     throw error;
   }
 }

agents/network/network.ts

@@ -119,7 +119,9 @@ export function createVendorNetwork(invocation: InvocationInput, imageId: string
   timeoutMs = 60_000): VendorNetwork {
   assertBuiltAgentImage(imageId);
   const vendor = invocation.vendor;
-  const remaining = deadline(timeoutMs), allocationId = randomUUID();
+  // Setup runs inside the caller's budget minus a cleanup reserve, so failure cleanup cannot overrun timeoutMs.
+  const overall = deadline(timeoutMs), cleanupReserve = Math.min(10_000, Math.floor(timeoutMs / 3));
+  const remaining = deadline(Math.max(1, timeoutMs - cleanupReserve)), allocationId = randomUUID();
   const name = `codeboost-egress-${vendor}-${randomUUID()}`;
   const proxyContainer = `codeboost-proxy-${vendor}-${randomUUID()}`;
   const subnetSeed = randomUUID().replaceAll('-', '');
@@ -155,9 +157,9 @@ export function createVendorNetwork(invocation: InvocationInput, imageId: string
   } catch (error) {
     const failures: unknown[] = [];
     if (proxyPlanned) try { remove(['rm', '--force', proxyContainer], ['container', 'inspect', proxyContainer],
-      deadline(30_000), 'vendor proxy', allocationId); } catch (cleanupError) { failures.push(cleanupError); }
+      overall, 'vendor proxy', allocationId); } catch (cleanupError) { failures.push(cleanupError); }
     if (networkPlanned) try { remove(['network', 'rm', name], ['network', 'inspect', name],
-      deadline(30_000), 'vendor network', allocationId); } catch (cleanupError) { failures.push(cleanupError); }
+      overall, 'vendor network', allocationId); } catch (cleanupError) { failures.push(cleanupError); }
     if (failures.length) throw new AggregateError([error, ...failures], 'Vendor network creation and cleanup failed.');
     throw error;
   }

test/agent-container.test.ts

@@ -317,6 +317,14 @@ describe('real Docker agent isolation', () => {
     expect(result.stderr).toContain('seccomp syscall filter must be enforced');
   }, 60_000);
 
+  it('removes the claimed vendor network when profile creation fails after the claim', () => {
+    const data = fixture();
+    expect(() => profile(data, 'planning', 'noop', { codexAuthFile: join(data.root, 'missing-auth.json') })).toThrow();
+    const orphan = vendorNetworks.at(-1)!;
+    expect(spawnSync('docker', ['network', 'inspect', orphan.name], { stdio: 'ignore' }).status).not.toBe(0);
+    expect(spawnSync('docker', ['container', 'inspect', orphan.proxyContainer], { stdio: 'ignore' }).status).not.toBe(0);
+  }, 60_000);
+
   it('refuses a Codex auth path that is a link without resolving it', () => {
     const data = fixture(), link = join(data.root, 'auth-link.json');
     symlinkSync(data.fakeAuth, link);
@@ -452,7 +460,9 @@ describe('real Docker agent isolation', () => {
       docker('rm', '--force', authProfile.name); containers.delete(authProfile.name);
       const envelope = JSON.parse(output) as { result?: string; is_error?: boolean };
       expect(envelope.is_error).not.toBe(true);
-      expect(envelope.result).toContain('codeboost-schema-marker');
+      // Tolerate one wrapping pair of backticks or quotes, but nothing else around the value.
+      const value = envelope.result?.trim().replace(/^(`+|"|')([^]*)\1$/, '$2').trim();
+      expect(value).toBe('codeboost-schema-marker');
     }, 6 * 60_000);
   }
 });

test/agent-network.test.ts

@@ -1,5 +1,8 @@
 import { execFileSync, spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { buildAgentImage } from '../agents/container/image.ts';
 import { assertVendorNetwork, createVendorNetwork, removeVendorNetwork, VENDOR_HOSTS,
@@ -27,6 +30,19 @@ beforeAll(() => {
 afterAll(() => removeVendorNetwork(network), 60_000);
 
 describe('vendor-only egress', () => {
+  it('keeps failed allocation and its cleanup inside the caller deadline', () => {
+    const shim = mkdtempSync(join(tmpdir(), 'docker-shim-'));
+    const realDocker = execFileSync('sh', ['-c', 'command -v docker'], { encoding: 'utf8' }).trim();
+    // Every network operation hangs, so both setup and cleanup can only end by deadline.
+    writeFileSync(join(shim, 'docker'), ['#!/bin/sh', 'if [ "$1" = network ]; then exec sleep 30; fi',
+      `exec '${realDocker}' "$@"`].join('\n'), { mode: 0o755 });
+    const path = process.env.PATH, started = performance.now();
+    process.env.PATH = `${shim}:${path}`;
+    try { expect(() => createVendorNetwork(invocation, imageId, 3_000)).toThrow(); }
+    finally { process.env.PATH = path; rmSync(shim, { recursive: true, force: true }); }
+    expect(performance.now() - started).toBeLessThan(6_000);
+  }, 60_000);
+
   it('pins the host list with each vendor profile', () => {
     expect(VENDOR_HOSTS).toEqual({ claude: ['api.anthropic.com'], codex: ['api.openai.com', 'chatgpt.com'] });
     expect(Object.isFrozen(VENDOR_HOSTS.claude)).toBe(true);