Bind adapters and proxy checks to invocation

Author: mchwang

agents/container/profile.ts

@@ -108,11 +108,11 @@ const captureInput = (directory: string): InputCapture => {
 };
 
 /** Internal authenticity and host-file revalidation used at every launch boundary. */
-export function assertContainerProfile(profile: ContainerProfile): void {
+export function assertContainerProfile(profile: ContainerProfile, timeoutMs = 30_000): void {
   const expected = identities.get(profile);
   if (!expected) throw new Error('Container profile was not created by the trusted profile builder.');
   assertTaskFilesystems(expected.filesystems, expected.clone);
-  assertVendorNetwork(expected.network, expected.invocation, profile.name);
+  assertVendorNetwork(expected.network, expected.invocation, profile.name, timeoutMs);
   assertPhasePolicy(expected.policy, expected.invocation);
   const actual = captureInput(expected.inputDirectory);
   if (actual.inputDirectory !== expected.inputDirectory || !sameFile(actual.schema, expected.schema))
@@ -150,7 +150,7 @@ export function createContainerProfile(options: ProfileOptions): ContainerProfil
   assertTaskFilesystems(filesystems, invocation.clone);
   assertVendorNetwork(options.network, invocation);
   assertPhasePolicy(options.policy, invocation);
-  const command = assertAgentCommand(options.command, options.policy);
+  const command = assertAgentCommand(options.command, options.policy, invocation.vendor);
   const sourceInput = captureInput(options.inputDirectory);
   if (invocation.vendor === 'codex' && (!options.codexAuthFile || options.claudeToken))
     throw new Error('Codex requires only its auth file.');

agents/container/run.ts

@@ -96,7 +96,7 @@ type Inspect = {
 /** Validate daemon-resolved configuration before starting an agent. */
 export function validateContainer(container: string, profile: ContainerProfile, timeoutMs = 30_000): void {
   const remaining = createDeadline(timeoutMs);
-  assertContainerProfile(profile);
+  assertContainerProfile(profile, remaining());
   const inspect = JSON.parse(docker(['container', 'inspect', container], { timeoutMs: remaining() }))[0] as Inspect | undefined;
   if (!inspect) throw new Error('Docker did not return the created container.');
   const image = JSON.parse(docker(['image', 'inspect', profile.expectedImage], { timeoutMs: remaining() }))[0] as
@@ -230,7 +230,7 @@ export function validateContainer(container: string, profile: ContainerProfile,
     throw new Error('Credential profiles must not be combined or redirected.');
   if (profile.vendor === 'claude' && (names.includes('CODEX_HOME') || !names.includes('CLAUDE_CODE_OAUTH_TOKEN')))
     throw new Error('Credential profiles must not be combined.');
-  assertContainerProfile(profile);
+  assertContainerProfile(profile, remaining());
   remaining();
 }
 
@@ -239,10 +239,10 @@ export function createValidatedContainer(profile: ContainerProfile, timeoutMs =
   const remaining = createDeadline(timeoutMs);
   try {
     validateSecrets(profile, secrets);
-    assertContainerProfile(profile);
+    assertContainerProfile(profile, remaining());
     docker(profile.args, { timeoutMs: remaining(), secrets });
     validateContainer(profile.name, profile, remaining());
-    assertContainerProfile(profile);
+    assertContainerProfile(profile, remaining());
     remaining();
     return profile.name;
   } catch (error) {
@@ -258,7 +258,7 @@ export function runContainer(profile: ContainerProfile, timeoutMs = 60_000,
   const container = createValidatedContainer(profile, remaining(), secrets);
   let failure: unknown;
   try {
-    assertContainerProfile(profile);
+    assertContainerProfile(profile, remaining());
     const output = docker(['start', '--attach', container], { timeoutMs: remaining(), secrets });
     remaining();
     return output;

agents/network/network.ts

@@ -52,19 +52,22 @@ const remove = (args: readonly string[], inspect: readonly string[], remaining:
   if (!absent(check)) throw new Error(`Failed to confirm removal of ${kind}.`);
 };
 
-export function assertVendorNetwork(network: VendorNetwork, invocation?: InvocationInput, agentName?: string): void {
+const validateVendorNetwork = (network: VendorNetwork, invocation: InvocationInput | undefined,
+  agentName: string | undefined, remaining: () => number): void => {
   const identity = identities.get(network);
   if (!identity) throw new Error('Vendor network was not created by the trusted network builder.');
   if (invocation && (identity.invocation !== invocation || network.vendor !== invocation.vendor))
     throw new Error('Vendor network does not belong to this invocation.');
   assertBuiltAgentImage(identity.imageId);
-  const inspect = JSON.parse(docker(['container', 'inspect', network.proxyContainer], 30_000))[0] as
+  const inspect = JSON.parse(docker(['container', 'inspect', network.proxyContainer], remaining()))[0] as
     { State?: { Running?: boolean }; Config?: { Image?: string; User?: string; Labels?: Record<string, string>; Env?: string[];
       Entrypoint?: string[] | null; Cmd?: string[] | null };
       HostConfig?: { ReadonlyRootfs?: boolean; Privileged?: boolean; CapDrop?: string[]; CapAdd?: string[] | null;
-        SecurityOpt?: string[]; Memory?: number; MemorySwap?: number; NanoCpus?: number; PidsLimit?: number };
+        SecurityOpt?: string[]; Memory?: number; MemorySwap?: number; NanoCpus?: number; PidsLimit?: number;
+        NetworkMode?: string; PidMode?: string; IpcMode?: string; UTSMode?: string; UsernsMode?: string;
+        CgroupnsMode?: string; Devices?: unknown[] | null; DeviceRequests?: unknown[] | null };
       NetworkSettings?: { Networks?: Record<string, unknown> }; Mounts?: unknown[] } | undefined;
-  const inspectedNetwork = JSON.parse(docker(['network', 'inspect', network.name], 30_000))[0] as
+  const inspectedNetwork = JSON.parse(docker(['network', 'inspect', network.name], remaining()))[0] as
     { Internal?: boolean; Driver?: string; Labels?: Record<string, string>; IPAM?: { Config?: Array<{ Subnet?: string }> };
       Containers?: Record<string, { Name?: string }> } | undefined;
   const networks = Object.keys(inspect?.NetworkSettings?.Networks ?? {}).sort();
@@ -77,6 +80,10 @@ export function assertVendorNetwork(network: VendorNetwork, invocation?: Invocat
     || !['no-new-privileges', 'no-new-privileges:true'].includes(inspect.HostConfig.SecurityOpt[0] ?? '')
     || inspect.HostConfig.PidsLimit !== 64 || inspect.HostConfig.Memory !== 64 * 1024 * 1024
     || inspect.HostConfig.MemorySwap !== 64 * 1024 * 1024 || inspect.HostConfig.NanoCpus !== 250_000_000
+    || inspect.HostConfig.NetworkMode !== network.name || inspect.HostConfig.PidMode !== ''
+    || inspect.HostConfig.IpcMode !== 'private' || inspect.HostConfig.UTSMode !== ''
+    || inspect.HostConfig.UsernsMode !== '' || inspect.HostConfig.CgroupnsMode !== 'private'
+    || (inspect.HostConfig.Devices?.length ?? 0) !== 0 || (inspect.HostConfig.DeviceRequests?.length ?? 0) !== 0
     || JSON.stringify(networks) !== JSON.stringify(['bridge', network.name].sort()) || inspect.Mounts?.length
     || inspect.Config?.Entrypoint?.[0] !== 'node'
     || JSON.stringify(inspect.Config?.Cmd) !== JSON.stringify(['/usr/local/lib/codeboost-egress-proxy.mjs'])
@@ -87,6 +94,12 @@ export function assertVendorNetwork(network: VendorNetwork, invocation?: Invocat
     || inspectedNetwork.IPAM?.Config?.length !== 1 || inspectedNetwork.IPAM.Config[0]?.Subnet !== identity.subnet
     || !endpoints.includes(network.proxyContainer) || endpoints.some(name => !name || !allowedEndpoints.includes(name)))
     throw new Error('Vendor network or proxy changed after allocation.');
+  remaining();
+};
+
+export function assertVendorNetwork(network: VendorNetwork, invocation?: InvocationInput, agentName?: string,
+  timeoutMs = 30_000): void {
+  validateVendorNetwork(network, invocation, agentName, deadline(timeoutMs));
 }
 
 export function createVendorNetwork(invocation: InvocationInput, imageId: string,
@@ -118,7 +131,7 @@ export function createVendorNetwork(invocation: InvocationInput, imageId: string
     ].join('')], remaining());
     const network = Object.freeze({ name, proxyContainer, proxyUrl: 'http://codeboost-proxy:3128', vendor });
     identities.set(network, Object.freeze({ allocationId, imageId, invocation, subnet }));
-    assertVendorNetwork(network, invocation);
+    validateVendorNetwork(network, invocation, undefined, remaining);
     remaining();
     return network;
   } catch (error) {

agents/policy.ts

@@ -12,17 +12,20 @@ export interface PhasePolicy {
 export interface AgentCommand { readonly argv: readonly string[] }
 interface PolicyIdentity { readonly invocation: InvocationInput }
 const identities = new WeakMap<PhasePolicy, PolicyIdentity>();
-const commands = new WeakMap<AgentCommand, PhasePolicy>();
+const commands = new WeakMap<AgentCommand, { readonly policy: PhasePolicy; readonly vendor: InvocationInput['vendor'] }>();
 
 const command = (policy: PhasePolicy, argv: readonly string[]): AgentCommand => {
   assertPhasePolicy(policy);
   const value = Object.freeze({ argv: Object.freeze([...argv]) });
-  commands.set(value, policy);
+  commands.set(value, Object.freeze({ policy, vendor: assertPhasePolicy(policy).vendor }));
   return value;
 };
 
-export function assertAgentCommand(value: AgentCommand, policy: PhasePolicy): readonly string[] {
-  if (commands.get(value) !== policy) throw new Error('Container command was not generated for this phase policy.');
+export function assertAgentCommand(value: AgentCommand, policy: PhasePolicy,
+  vendor?: InvocationInput['vendor']): readonly string[] {
+  const identity = commands.get(value);
+  if (identity?.policy !== policy || (vendor && identity.vendor !== vendor))
+    throw new Error('Container command was not generated for this phase policy and vendor.');
   return value.argv;
 }
 
@@ -59,7 +62,7 @@ export function dispatchApprovedCommand<T>(policy: PhasePolicy, argv: readonly s
 
 export function createClaudeCommand(policy: PhasePolicy, prompt: string): AgentCommand {
   if (!prompt || prompt.includes('\0')) throw new Error('Claude prompt must be nonempty and contain no NUL.');
-  assertPhasePolicy(policy);
+  if (assertPhasePolicy(policy).vendor !== 'claude') throw new Error('Claude command requires a Claude invocation policy.');
   const writable = policy.worktree === 'read-write';
   const allowed = writable ? 'Read,Glob,Grep,Edit,Write' : 'Read,Glob,Grep';
   return command(policy, ['claude', '--print', prompt, '--output-format', 'json', '--restricted', '--strict-mcp-config',
@@ -69,7 +72,7 @@ export function createClaudeCommand(policy: PhasePolicy, prompt: string): AgentC
 }
 
 export function codexBaseArguments(policy: PhasePolicy): readonly string[] {
-  assertPhasePolicy(policy);
+  if (assertPhasePolicy(policy).vendor !== 'codex') throw new Error('Codex command requires a Codex invocation policy.');
   return Object.freeze(['codex', '--strict-config', '--config', 'web_search="disabled"',
     '--config', 'mcp_servers={}', '--config', 'features.shell_tool=false', '--ask-for-approval', 'never']);
 }

test/agent-container.test.ts

@@ -182,7 +182,7 @@ describe('real Docker agent isolation', () => {
       imageId: AGENT_IMAGE })).toThrow('immutable built image ID');
     chmodSync(data.input, 0o755); writeFileSync(join(data.input, 'extra.json'), '{}'); chmodSync(data.input, 0o555);
     expect(() => profile(data, 'planning', 'noop')).toThrow('only one bounded');
-  });
+  }, 60_000);
 
   it('rejects unexpected host mounts and unbounded task volumes after Docker resolves them', () => {
     const data = fixture(), valid = profile(data, 'planning', 'noop');

test/agent-network.test.ts

@@ -51,6 +51,7 @@ describe('vendor-only egress', () => {
 
   it('rejects a copied network capability', () => {
     expect(() => createVendorNetwork(invocation, imageId, 0)).toThrow('positive integer');
+    expect(() => assertVendorNetwork(network, invocation, undefined, 0)).toThrow('positive integer');
     expect(() => removeVendorNetwork({ ...network })).toThrow('trusted network builder');
     const otherInvocation = captureInvocation({ ...invocation, attemptId: 'other-network-probe',
       deadline: Date.now() + 60_000 });
@@ -73,4 +74,23 @@ describe('vendor-only egress', () => {
       removeVendorNetwork(other);
     }
   }, 60_000);
+
+  it('rejects a proxy replaced with a host namespace before launch', () => {
+    const replacementInvocation = captureInvocation({ ...invocation, attemptId: 'mutated-proxy-probe',
+      deadline: Date.now() + 60_000 });
+    const replacement = createVendorNetwork(replacementInvocation, imageId);
+    const inspected = JSON.parse(docker('container', 'inspect', replacement.proxyContainer))[0] as
+      { Config: { Labels: Record<string, string> } };
+    const allocation = inspected.Config.Labels['io.codeboost.egress'];
+    try {
+      docker('rm', '--force', replacement.proxyContainer);
+      docker('run', '--detach', '--name', replacement.proxyContainer, '--read-only', '--user', '10001:10001',
+        '--cap-drop=ALL', '--security-opt=no-new-privileges', '--pids-limit=64', '--memory=64m', '--memory-swap=64m',
+        '--cpus=.25', '--pid=host', '--network', replacement.name, '--network-alias', 'codeboost-proxy',
+        '--label', `io.codeboost.egress=${allocation}`, '--env', `CODEBOOST_ALLOWED_HOSTS=${VENDOR_HOSTS.claude.join(',')}`,
+        '--entrypoint', 'node', imageId, '/usr/local/lib/codeboost-egress-proxy.mjs');
+      docker('network', 'connect', 'bridge', replacement.proxyContainer);
+      expect(() => assertVendorNetwork(replacement, replacementInvocation)).toThrow('network or proxy changed');
+    } finally { removeVendorNetwork(replacement); }
+  }, 60_000);
 });

test/agent-policy.test.ts

@@ -3,9 +3,9 @@ import { captureInvocation, type InvocationInput, type Phase } from '../agents/c
 import { assertAgentCommand, assertAgentTool, codexBaseArguments, createClaudeCommand, createCodexCommand,
   createPhasePolicy, dispatchApprovedCommand } from '../agents/policy.ts';
 
-const request = (phase: Phase): InvocationInput => captureInvocation({
+const request = (phase: Phase, vendor: 'claude' | 'codex' = 'claude'): InvocationInput => captureInvocation({
   clone: { id: 'clone-1', taskId: 'task-1', directory: '/tmp/task', head: 'a'.repeat(40) },
-  vendor: 'claude', phase, approvedArgv: ['planning', 'questions'].includes(phase) ? [] : [['npm', 'test']],
+  vendor, phase, approvedArgv: ['planning', 'questions'].includes(phase) ? [] : [['npm', 'test']],
   deadline: 2000, attemptId: `attempt-${phase}`,
   context: { snapshotId: 's', planId: 'p', planRevision: 1, assignmentId: 'a', referencedCodeHash: 'c', stateVersion: 1 },
 }, 1000);
@@ -45,10 +45,14 @@ describe('agent phase policy', () => {
     expect(claude).toContain('Read,Glob,Grep');
     expect(claude).toContain('Bash,WebFetch,WebSearch,NotebookEdit');
     expect(claude).not.toContain('Edit');
-    expect(codexBaseArguments(readonly)).toEqual(['codex', '--strict-config', '--config', 'web_search="disabled"',
+    const codexPolicy = createPhasePolicy(request('planning', 'codex'));
+    expect(codexBaseArguments(codexPolicy)).toEqual(['codex', '--strict-config', '--config', 'web_search="disabled"',
       '--config', 'mcp_servers={}', '--config', 'features.shell_tool=false', '--ask-for-approval', 'never']);
-    const codex = createCodexCommand(readonly, 'Inspect the schema.');
+    const codex = createCodexCommand(codexPolicy, 'Inspect the schema.');
     expect(codex.argv).toContain('features.shell_tool=false');
-    expect(() => assertAgentCommand({ argv: codex.argv }, readonly)).toThrow('not generated');
+    expect(() => assertAgentCommand({ argv: codex.argv }, codexPolicy)).toThrow('not generated');
+    expect(() => assertAgentCommand(codex, codexPolicy, 'claude')).toThrow('vendor');
+    expect(() => createClaudeCommand(codexPolicy, 'Wrong vendor.')).toThrow('Claude invocation');
+    expect(() => createCodexCommand(readonly, 'Wrong vendor.')).toThrow('Codex invocation');
   });
 });