@link-assistant/hive-mind 2.13.5 → 2.14.0

package/src/git-push-guard.lib.mjs

@@ -0,0 +1,230 @@
+/**
+ * Blocking destructive git pushes from inside a routed task (issue #2164, R13).
+ *
+ * The issue asks that agents lose the *physical ability* to destroy data:
+ * "immediately apply block of all delete operations or history changes like git
+ * reset and so on detected up on git push". A `git reset` is harmless on its
+ * own — nothing is lost until the rewritten history reaches the remote — so the
+ * point where the damage becomes real, and therefore the point worth guarding,
+ * is the push.
+ *
+ * Three layers were planned for R13. This module is layer 2:
+ *
+ *   1. Branch protection on the remote (`src/protect-branch.mjs`) — server-side
+ *      and unbypassable, but only covers branches somebody protected.
+ *   2. This `pre-push` hook — covers every branch and every remote in the task
+ *      container, costs nothing, and is defeated by `git push --no-verify`.
+ *   3. The router's git transport (`/git/…`), which routed tasks now push
+ *      through. It is unbypassable for the same reason the model traffic is —
+ *      the task holds no other credential — and it refuses branch deletions
+ *      outright (measured: `git push origin :refs/heads/x` → HTTP 403).
+ *
+ * Layer 3 originally covered deletions but not force pushes: the router decided
+ * by looking for a `force-ref-updates` capability that git never sends, so a
+ * non-fast-forward push was relayed unchanged (measured in
+ * `experiments/issue-2164/probe-git-transport.sh`, reported upstream as
+ * link-assistant/router#272). That was fixed in link-assistant/router#273 and
+ * ships from 0.110.0, which is at or below the pin — the router now asks
+ * GitHub's compare API whether the proposed tip is ahead of the current one and
+ * fails closed when it cannot tell.
+ *
+ * So this hook is no longer the only thing standing between an agent and a
+ * rewritten branch. It is still worth keeping: it is the layer that applies to
+ * every remote rather than only the routed one, it costs nothing, and it stops
+ * the push locally instead of after a round trip. It remains defeated by
+ * `--no-verify`, so it is a speed bump and the docs say so.
+ *
+ * The hook is delivered by mounting a host directory read-only into the task
+ * container and pointing git at it with `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_0`
+ * (git >= 2.31). Env vars rather than `git config --global` because the task's
+ * `~/.gitconfig` is bind-mounted from the *host*: writing to it would reconfigure
+ * the operator's own machine.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2164
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+/** Only `pre-push` is provided; git silently skips hook names that do not exist. */
+export const GIT_PUSH_GUARD_HOOK_NAME = 'pre-push';
+
+/** Operator escape hatch, propagated from an explicit `solve` opt-in (see `hasForcePushOptIn`). */
+export const GIT_PUSH_GUARD_ESCAPE_ENV = 'HIVE_MIND_ALLOW_DESTRUCTIVE_PUSH';
+
+/** Where the hook directory is mounted inside a Docker-isolated task. */
+export const GIT_PUSH_GUARD_CONTAINER_DIR = '/home/box/.hive-mind/git-hooks';
+
+/**
+ * The hook itself.
+ *
+ * git feeds `<local ref> <local sha> <remote ref> <remote sha>` on stdin, one
+ * line per ref being updated, and a non-zero exit aborts the whole push. Two
+ * things are refused:
+ *
+ *   - an all-zero *local* sha, which is how `git push --delete`, `git push
+ *     :branch` and `--mirror`/`--prune` deletions present themselves;
+ *   - an update where the remote's current commit is not an ancestor of what we
+ *     are about to send, i.e. a force push discarding commits that exist only on
+ *     the remote — the shape a `git reset --hard` + `push --force` takes.
+ *
+ * A remote sha we do not have locally is refused too: it cannot be proven to be
+ * an ancestor, and the honest answer to "would this destroy something?" is
+ * "unknown". Everything else — ordinary fast-forward pushes, new branches, new
+ * tags — passes untouched.
+ *
+ * POSIX sh, no bashisms: the isolation image's /bin/sh is dash.
+ */
+export const PRE_PUSH_GUARD_SCRIPT = `#!/bin/sh
+# Hive Mind push guard (issue #2164). Refuses branch/tag deletions and
+# history-rewriting (non-fast-forward) pushes from inside an isolated task.
+# Generated file - edit src/git-push-guard.lib.mjs instead.
+set -u
+
+remote_name="\${1:-}"
+remote_url="\${2:-}"
+allow="\${${GIT_PUSH_GUARD_ESCAPE_ENV}:-}"
+status=0
+
+is_zero_sha() {
+  [ -n "$1" ] || return 0
+  case "$1" in
+    *[!0]*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+refuse() {
+  status=1
+  echo "🛑 Hive Mind push guard: refused to $1" >&2
+  echo "   remote: \${remote_name} \${remote_url}" >&2
+  echo "   ref:    $2" >&2
+}
+
+while read -r local_ref local_sha remote_ref remote_sha; do
+  [ -n "\${remote_ref:-}" ] || continue
+  if is_zero_sha "\${local_sha:-}"; then
+    refuse "delete a remote ref" "\${remote_ref}"
+    continue
+  fi
+  is_zero_sha "\${remote_sha:-}" && continue
+  if ! git cat-file -e "\${remote_sha}^{commit}" 2>/dev/null; then
+    refuse "overwrite a remote commit this clone does not have (\${remote_sha})" "\${remote_ref}"
+    continue
+  fi
+  if ! git merge-base --is-ancestor "\${remote_sha}" "\${local_sha}" 2>/dev/null; then
+    refuse "rewrite history (the remote's \${remote_sha} is not an ancestor of \${local_sha})" "\${remote_ref}"
+  fi
+done
+
+if [ "\${status}" -ne 0 ]; then
+  case "\${allow}" in
+    1 | true | TRUE | yes | YES)
+      echo "⚠️  ${GIT_PUSH_GUARD_ESCAPE_ENV} is set, so the push is allowed anyway." >&2
+      exit 0
+      ;;
+  esac
+  echo "" >&2
+  echo "Destructive pushes are blocked for routed tasks (--use-router, issue #2164)." >&2
+  echo "Nothing was sent. Push a new commit instead, or ask a human operator to run it." >&2
+fi
+
+exit "\${status}"
+`;
+
+/**
+ * Host directory holding the generated hook.
+ *
+ * Deliberately NOT the bot state directory: that holds the router's signing
+ * secret, and this directory is mounted into every routed task.
+ */
+export function resolveGitPushGuardHostDir({ env = process.env, homeDir = os.homedir() } = {}) {
+  const explicit = String(env.HIVE_MIND_GIT_HOOKS_DIR || '').trim();
+  return explicit || path.join(homeDir, '.hive-mind', 'git-hooks');
+}
+
+/**
+ * Write the hook to the host, ready to be mounted.
+ *
+ * Rewritten on every launch so an upgrade cannot leave a stale hook behind.
+ * Never throws: a task that cannot get its guard is still a task worth running
+ * (the caller warns), because the remaining layers — branch protection — are
+ * the ones that were never bypassable anyway.
+ *
+ * @returns {{installed: boolean, dir: string, hookPath: string, error: string|null}}
+ */
+export function installGitPushGuard({ env = process.env, homeDir = os.homedir(), fsImpl = fs } = {}) {
+  const dir = resolveGitPushGuardHostDir({ env, homeDir });
+  const hookPath = path.join(dir, GIT_PUSH_GUARD_HOOK_NAME);
+  try {
+    fsImpl.mkdirSync(dir, { recursive: true });
+    fsImpl.writeFileSync(hookPath, PRE_PUSH_GUARD_SCRIPT, { mode: 0o755 });
+    // writeFileSync only applies `mode` when it creates the file, so an existing
+    // hook keeps whatever permissions it had — including non-executable ones,
+    // which git ignores silently.
+    fsImpl.chmodSync(hookPath, 0o755);
+    return { installed: true, dir, hookPath, error: null };
+  } catch (error) {
+    return { installed: false, dir, hookPath, error: error?.message || String(error) };
+  }
+}
+
+/**
+ * Turn `[key, value]` pairs into git's `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`
+ * environment form (git >= 2.31).
+ *
+ * A routed task needs several such settings — the hook path here, plus the URL
+ * rewrite and CA that send git through the router (issue #2164) — and they share
+ * one counter, so building them separately would have each overwrite the other.
+ * The order is preserved because git applies these last-to-win, which is what
+ * lets `credential.helper=` clear an inherited helper list.
+ *
+ * @param {Array<[string, string]>} entries
+ * @returns {Record<string,string>}
+ */
+export function buildGitConfigEnv(entries = []) {
+  const usable = entries.filter(entry => Array.isArray(entry) && entry[0]);
+  if (usable.length === 0) return {};
+  const taskEnv = { GIT_CONFIG_COUNT: String(usable.length) };
+  usable.forEach(([key, value], index) => {
+    taskEnv[`GIT_CONFIG_KEY_${index}`] = key;
+    taskEnv[`GIT_CONFIG_VALUE_${index}`] = value ?? '';
+  });
+  return taskEnv;
+}
+
+/**
+ * Environment that points git at the mounted hook for every repository in the
+ * container, without writing to the bind-mounted `~/.gitconfig`.
+ *
+ * `extraConfig` carries any other settings the same task needs, so all of them
+ * end up under one `GIT_CONFIG_COUNT`.
+ */
+export function buildGitPushGuardEnv({ hooksPath = GIT_PUSH_GUARD_CONTAINER_DIR, allowDestructive = false, extraConfig = [] } = {}) {
+  const entries = [...(hooksPath ? [['core.hooksPath', hooksPath]] : []), ...extraConfig];
+  const taskEnv = buildGitConfigEnv(entries);
+  if (Object.keys(taskEnv).length === 0) return {};
+  if (allowDestructive) taskEnv[GIT_PUSH_GUARD_ESCAPE_ENV] = '1';
+  return taskEnv;
+}
+
+/**
+ * Read the existing fork-divergence opt-in out of a raw argument vector.
+ *
+ * `--allow-fork-divergence-resolution-using-force-push-with-lease` already means
+ * "this operator accepts a force push", and Hive Mind performs one itself in
+ * `solve.fork-sync.lib.mjs`. Blocking that would break a documented workflow, so
+ * the opt-in is propagated into the container rather than overridden.
+ *
+ * @param {string[]} args
+ */
+export function hasForcePushOptIn(args) {
+  const list = Array.isArray(args) ? args : [];
+  return list.some(arg => {
+    const value = String(arg ?? '');
+    return value === '--allow-fork-divergence-resolution-using-force-push-with-lease' || value === '--allow-fork-divergence-resolution-using-force-push-with-lease=true';
+  });
+}
+
+export default { buildGitConfigEnv, buildGitPushGuardEnv, hasForcePushOptIn, installGitPushGuard, resolveGitPushGuardHostDir, GIT_PUSH_GUARD_CONTAINER_DIR, PRE_PUSH_GUARD_SCRIPT };

package/src/isolation-runner.lib.mjs

@@ -26,6 +26,9 @@ import { acquireFormalAiSidecarForTask, attachFormalAiTaskContainer, releaseForm
 // importing this runner and creating a cycle. Re-exported here because callers
 // and tests have always reached them through the isolation runner. See #2154.
 import { getDockerIsolationImage } from './hive-mind-image.lib.mjs';
+import { buildRouterGitConfigEntries, buildRouterTaskEnv, getRouterSuppressedCredentialPaths, hasUseRouterFlag, isRouterEnabled, resolveRouterBaseUrl, resolveRouterGitHubRouting } from './router-isolation.lib.mjs';
+import { acquireRouterForTask, attachRouterTaskContainer, registerFormalAiWithRouter, releaseRouterForTask } from './router-task-isolation.lib.mjs';
+import { buildGitConfigEnv, GIT_PUSH_GUARD_CONTAINER_DIR, GIT_PUSH_GUARD_ESCAPE_ENV, hasForcePushOptIn, installGitPushGuard } from './git-push-guard.lib.mjs';
 export { getDockerIsolationImage, resolveDockerIsolationImageTag } from './hive-mind-image.lib.mjs';
 let commandStreamDollarPromise = null;
 async function getCommandStreamDollar() {
@@ -114,21 +117,31 @@ export function resolveHostDockerSock({ env = process.env } = {}) {
  * commit. See issue #1939. Tool credentials are deliberately scoped: Codex
  * sessions do not receive Claude files and Claude sessions do not receive Codex
  * files.
+ *
+ * Issue #2164 (EXPERIMENTAL): with `useRouter` the vendor credential mounts are
+ * withheld entirely, so the task never holds the subscription — it reaches the
+ * `hive-mind-router` sidecar with its own scoped token instead. Git identity is
+ * still mounted, because it carries no secret and `solve` aborts without it
+ * (issue #1939). The gh config is only withheld when `ghRouted` says gh has
+ * somewhere else to go; otherwise the task would lose GitHub access entirely.
  */
-export function getDockerIsolationAuthMounts({ tool = 'claude', env = process.env, homeDir = os.homedir(), existsSync = fs.existsSync } = {}) {
+export function getDockerIsolationAuthMounts({ tool = 'claude', env = process.env, homeDir = os.homedir(), existsSync = fs.existsSync, useRouter = false, ghRouted = false } = {}) {
   const mounts = [];
   const normalizedTool = normalizeTool(tool);
-  maybeAddMount(mounts, env.GH_CONFIG_DIR || path.join(homeDir, '.config', 'gh'), path.join(DOCKER_CONTAINER_HOME, '.config', 'gh'), existsSync);
+  const suppressed = useRouter ? new Set(getRouterSuppressedCredentialPaths({ tool: normalizedTool, ghRouted })) : new Set();
+  if (!suppressed.has('.config/gh')) {
+    maybeAddMount(mounts, env.GH_CONFIG_DIR || path.join(homeDir, '.config', 'gh'), path.join(DOCKER_CONTAINER_HOME, '.config', 'gh'), existsSync);
+  }
   // Git identity (tool-agnostic, required for commits). Honor the same env vars git itself reads for an alternate global config location (GIT_CONFIG_GLOBAL) and the XDG base dir, falling back to the conventional `~/.gitconfig` and `~/.config/git`. Missing host paths are skipped, so a container image that already bakes a git identity is left untouched. See issue #1939.
   maybeAddMount(mounts, env.GIT_CONFIG_GLOBAL || path.join(homeDir, '.gitconfig'), path.join(DOCKER_CONTAINER_HOME, '.gitconfig'), existsSync);
   maybeAddMount(mounts, env.XDG_CONFIG_HOME ? path.join(env.XDG_CONFIG_HOME, 'git') : path.join(homeDir, '.config', 'git'), path.join(DOCKER_CONTAINER_HOME, '.config', 'git'), existsSync);
   if (normalizedTool === 'codex') {
-    maybeAddMount(mounts, path.join(homeDir, '.codex'), path.join(DOCKER_CONTAINER_HOME, '.codex'), existsSync);
+    if (!suppressed.has('.codex')) maybeAddMount(mounts, path.join(homeDir, '.codex'), path.join(DOCKER_CONTAINER_HOME, '.codex'), existsSync);
     // Issue #2074: Codex also discovers persistent user Agent Skills from ~/.agents/skills. Propagate that standard location alongside .codex so direct and Docker-isolated solver sessions expose the same capabilities.
-    maybeAddMount(mounts, path.join(homeDir, '.agents'), path.join(DOCKER_CONTAINER_HOME, '.agents'), existsSync);
+    if (!suppressed.has('.agents')) maybeAddMount(mounts, path.join(homeDir, '.agents'), path.join(DOCKER_CONTAINER_HOME, '.agents'), existsSync);
   } else if (normalizedTool === 'claude') {
-    maybeAddMount(mounts, path.join(homeDir, '.claude'), path.join(DOCKER_CONTAINER_HOME, '.claude'), existsSync);
-    maybeAddMount(mounts, path.join(homeDir, '.claude.json'), path.join(DOCKER_CONTAINER_HOME, '.claude.json'), existsSync);
+    if (!suppressed.has('.claude')) maybeAddMount(mounts, path.join(homeDir, '.claude'), path.join(DOCKER_CONTAINER_HOME, '.claude'), existsSync);
+    if (!suppressed.has('.claude.json')) maybeAddMount(mounts, path.join(homeDir, '.claude.json'), path.join(DOCKER_CONTAINER_HOME, '.claude.json'), existsSync);
   }
   return mounts;
 }
@@ -191,7 +204,18 @@ export async function resolveFormalAiIsolationEnv(env = process.env, { lookup =
  * reused instead of re-downloaded — no `--pull` plumbing required (issue #1879).
  */
 export function buildDockerIsolationStartArgs(command, args = [], options = {}) {
-  const { sessionId, tool = 'claude', env = process.env, homeDir = os.homedir(), existsSync = fs.existsSync } = options;
+  const { sessionId, tool = 'claude', env = process.env, homeDir = os.homedir(), existsSync = fs.existsSync, useRouter = false, routerToken = null, installGuard = installGitPushGuard } = options;
+  // Issue #2164 (EXPERIMENTAL): router isolation replaces the credential mounts
+  // with a scoped token pointing at the `hive-mind-router` sidecar. It only
+  // engages when a token was actually issued; without one the task would have
+  // neither credentials nor a route, so we fail open to the default mounts
+  // rather than launching an agent that cannot reach any model.
+  const routerActive = isRouterEnabled({ useRouter, env }) && Boolean(routerToken);
+  const routerEndpoint = routerActive ? resolveRouterBaseUrl({ env }) : { baseUrl: null, external: false };
+  const routerBaseUrl = routerEndpoint.baseUrl;
+  const routerGitHub = routerActive ? resolveRouterGitHubRouting({ env, external: Boolean(routerEndpoint.external) }) : { mode: 'off', ghHost: null };
+  const routerEnv = routerActive && routerBaseUrl ? buildRouterTaskEnv({ tool, baseUrl: routerBaseUrl, token: routerToken, githubMode: routerGitHub.mode, ghHost: routerGitHub.ghHost, homeDir: DOCKER_CONTAINER_HOME }) : {};
+  const routerWired = Object.keys(routerEnv).length > 0;
   const image = getDockerIsolationImage({ env });
   const startArgs = ['--isolated', 'docker', '--image', image];
   if (shouldRunPrivilegedDockerIsolation(image, env)) {
@@ -205,8 +229,33 @@ export function buildDockerIsolationStartArgs(command, args = [], options = {})
   if (env.HIVE_MIND_FORMAL_AI_BASE_URL) {
     startArgs.push('-e', `HIVE_MIND_FORMAL_AI_BASE_URL=${env.HIVE_MIND_FORMAL_AI_BASE_URL}`);
   }
-  for (const mount of getDockerIsolationAuthMounts({ tool, env, homeDir, existsSync })) {
-    startArgs.push('--volume', `${mount.source}:${mount.target}`);
+  for (const [name, value] of Object.entries(routerEnv)) {
+    startArgs.push('-e', `${name}=${value}`);
+  }
+  const mounts = getDockerIsolationAuthMounts({ tool, env, homeDir, existsSync, useRouter: routerWired, ghRouted: routerWired && routerGitHub.mode !== 'off' });
+  // Issue #2164 (R13): a routed task also loses the ability to destroy remote
+  // history by accident. The hook lives on the host and is mounted read-only, so
+  // the task cannot edit the rule it is being held to; git is pointed at it with
+  // GIT_CONFIG_* rather than `git config --global`, because the container's
+  // ~/.gitconfig is the operator's own file. This is one layer of three (see
+  // git-push-guard.lib.mjs) and `--no-verify` still gets past it.
+  if (routerWired) {
+    // One `GIT_CONFIG_COUNT` covers both the hook and the router's git
+    // transport: git shares the counter across all of them, so they have to be
+    // built together or the second would silently replace the first.
+    const gitConfigEntries = buildRouterGitConfigEntries({ baseUrl: routerBaseUrl, token: routerToken, githubMode: routerGitHub.mode });
+    const guard = installGuard({ env, homeDir });
+    if (guard.installed) {
+      mounts.push({ source: guard.dir, target: GIT_PUSH_GUARD_CONTAINER_DIR, readOnly: true });
+      gitConfigEntries.unshift(['core.hooksPath', GIT_PUSH_GUARD_CONTAINER_DIR]);
+      if (hasForcePushOptIn(args)) startArgs.push('-e', `${GIT_PUSH_GUARD_ESCAPE_ENV}=1`);
+    }
+    for (const [name, value] of Object.entries(buildGitConfigEnv(gitConfigEntries))) {
+      startArgs.push('-e', `${name}=${value}`);
+    }
+  }
+  for (const mount of mounts) {
+    startArgs.push('--volume', `${mount.source}:${mount.target}${mount.readOnly ? ':ro' : ''}`);
   }
   const taskCommand = buildShellCommand(command, args);
   startArgs.push('--detached', '--session', sessionId, '--', buildDockerStartGatedCommand(taskCommand, sessionId));
@@ -354,6 +403,25 @@ export async function executeWithIsolation(command, args, options = {}) {
   const hostEnv = options.env || process.env;
   const { sidecar, error: sidecarError } = await acquireFormalAiSidecarForTask({ backend, args, model: options.model ?? null, tool: options.tool ?? null, sessionId, env: hostEnv, verbose });
   if (sidecarError) return failLaunch(sidecarError);
+  // Issue #2164 (EXPERIMENTAL): --use-router replaces the task's credential
+  // mounts with a token scoped to it alone. Like the Formal AI lease this is
+  // taken before the container exists, because the token is part of the
+  // environment the container is created with — and like it, it fails closed.
+  const { router, error: routerError } = await acquireRouterForTask({ backend, useRouter: options.useRouter === true || hasUseRouterFlag(args), model: options.model ?? null, tool: options.tool ?? 'claude', githubRepo: options.githubRepo ?? null, sessionId, env: hostEnv, verbose });
+  if (routerError) {
+    await releaseFormalAiSidecarForTask({ sidecar, sessionId, env: hostEnv, verbose });
+    return failLaunch(routerError);
+  }
+  // R11: when both sidecars are up, the router is taught to serve `formal-ai`
+  // itself, so that model is mediated and audited like every other one. Done
+  // before the container is created because the provider has to exist by the
+  // time the task issues its first request.
+  const formalAiRoutingError = await registerFormalAiWithRouter({ router, sidecar, verbose });
+  if (formalAiRoutingError) {
+    await releaseRouterForTask({ router, sessionId, env: hostEnv, verbose });
+    await releaseFormalAiSidecarForTask({ sidecar, sessionId, env: hostEnv, verbose });
+    return failLaunch(formalAiRoutingError);
+  }
   const taskEnv = sidecar ? { ...hostEnv, HIVE_MIND_FORMAL_AI_BASE_URL: sidecar.baseUrl } : hostEnv;
   const effectiveOptions =
     backend === 'docker'
@@ -362,7 +430,7 @@ export async function executeWithIsolation(command, args, options = {}) {
           env: await resolveFormalAiIsolationEnv(taskEnv),
         }
       : options;
-  const startCommandArgs = buildStartCommandArgs(command, args, { ...effectiveOptions, sessionId });
+  const startCommandArgs = buildStartCommandArgs(command, args, { ...effectiveOptions, sessionId, useRouter: Boolean(router), routerToken: router?.token ?? null });
   if (verbose) {
     console.log(`[VERBOSE] isolation-runner: ${[binPath, ...startCommandArgs].map(shellQuote).join(' ')}`);
     if (backend === 'docker') {
@@ -386,6 +454,7 @@ export async function executeWithIsolation(command, args, options = {}) {
   }
   let containerFilesystemStartBytes = null;
   let formalAiAttachError = null;
+  let routerAttachError = null;
   if (result.success && backend === 'docker') {
     try {
       containerFilesystemStartBytes = await getDockerContainerWritableLayerSize(sessionId, verbose);
@@ -398,10 +467,17 @@ export async function executeWithIsolation(command, args, options = {}) {
       // start sequence, and doing it here keeps the attach fail-closed on any
       // installed version instead of silently one-network on older parsers.
       formalAiAttachError = await attachFormalAiTaskContainer({ sidecar, sessionId, verbose });
+      routerAttachError = await attachRouterTaskContainer({ router, sessionId, env: hostEnv, verbose });
     } finally {
       await releaseDockerContainerStartGate(sessionId, verbose);
     }
   }
+  if (router && (!result.success || formalAiAttachError || routerAttachError)) {
+    // Fail closed for the same reason the acquire does: a task that cannot
+    // reach the router must not be left running with no route to a model.
+    if (routerAttachError) await removeDockerContainer(sessionId, verbose);
+    await releaseRouterForTask({ router, sessionId, env: hostEnv, verbose });
+  }
   if (sidecar && (!result.success || formalAiAttachError)) {
     // Fail closed: without the internal network the task cannot reach Formal
     // AI, and issue #2146 forbids falling back to another model.
@@ -411,6 +487,10 @@ export async function executeWithIsolation(command, args, options = {}) {
       return failLaunch(`Formal AI task container could not be attached to the internal Formal AI network, so the task was stopped instead of falling back to another model (issue #2146): ${formalAiAttachError}`, { output: result.output });
     }
   }
+  if (routerAttachError) {
+    if (sidecar) await releaseFormalAiSidecarForTask({ sidecar, sessionId, env: hostEnv, verbose });
+    return failLaunch(`The task container could not be joined to the router (internal network, CA trust or api.github.com interception), so it was stopped rather than run without a route to any model (issue #2164): ${routerAttachError}`, { output: result.output });
+  }
   // Issue #1939: capture the freshly-launched docker session's reported status
   // and the live container state together, so the next iteration has the data to
   // diagnose a premature "executed/-1" status (problem #1) or a surprise image