@wardby/cli 0.2.0 → 0.3.0

package/dist/providers/executor/types.d.ts

@@ -51,5 +51,27 @@ export interface Executor {
      * the LLM pricing tables' unknown-model throw.
      */
     resolveCodingWorkerImage?(selector: CodingImageSelector): string;
+    /**
+     * Claude Code's tool-runner image (the container that runs its commands) for the agent's
+     * toolchain, resolved and persisted at dispatch alongside the worker image; null for Codex, whose
+     * one worker image carries the toolchain. Throws, like resolveCodingWorkerImage, on a toolchain
+     * with no image.
+     */
+    resolveCodingToolImage?(selector: CodingImageSelector): string | null;
+    /**
+     * Coding-run services (docs/coding-services.md): the raw text of the
+     * repository's .wardby/services.yaml at `baseRef`, or null when it has none.
+     * Called by dispatch before its transaction (it is a network call). An
+     * executor without it gives coding runs no services.
+     */
+    readCodingServiceDeclaration?(input: {
+        repository: string;
+        baseRef: string;
+    }): Promise<string | null>;
+    /**
+     * Whether this executor can start coding-run services for a run of `provider`: its job launcher
+     * says so (Kubernetes and Docker, for Codex and Claude Code).
+     */
+    supportsCodingServices?(provider: CodingProvider): boolean;
 }
 import type { CodingProvider } from "../../coding/provider.js";

package/dist/providers/jobs/claude-tool-setup.d.ts

@@ -0,0 +1,23 @@
+import type { JobSpec } from "./types.js";
+/**
+ * The tool runner's parseToolSetup bounds (src/claude-tool-runner/command.mjs; a test keeps them
+ * equal). A setup past any of them would stop the tool runner before it reports ready, so the
+ * launcher refuses to build one instead.
+ */
+export declare const CLAUDE_TOOL_SETUP_LIMITS: {
+    readonly maxEnvEntries: 1024;
+    readonly maxEnvValueBytes: 4096;
+    readonly maxFiles: 8;
+    readonly maxFileBytes: number;
+    readonly maxSetupBytes: number;
+};
+export interface ClaudeToolSetup {
+    schemaVersion: 1;
+    env: Record<string, string>;
+    files: {
+        path: string;
+        content: string;
+        mode: number;
+    }[];
+}
+export declare function claudeToolSetup(spec: JobSpec, capability: string): string;

package/dist/providers/jobs/claude-tool-setup.js

@@ -0,0 +1,50 @@
+/**
+ * What Claude Code's tool runner (the credential-free container that runs commands in the
+ * repository) needs from the trusted launcher: the package-registry settings every Codex shell
+ * gets, built from the run's registry-only token (deriveRegistryToken, never the capability), and
+ * the run's service test variables. Delivered as CLAUDE_TOOL_SETUP_ENV: a Kubernetes Secret key, or
+ * `docker create --env NAME` with the value in the CLI's own environment.
+ */
+import { serviceEnvironment } from "../../coding-worker/driver.js";
+import { registryWorkerSetup } from "../../coding/registry/worker-config.js";
+import { CODING_PROXY_ALIAS, CODING_PROXY_PORT } from "./docker-isolation.js";
+/** Where the tool runner mounts the repository; the registry's config files live under its .cache. */
+const TOOL_WORKSPACE = "/workspace";
+/**
+ * The tool runner's parseToolSetup bounds (src/claude-tool-runner/command.mjs; a test keeps them
+ * equal). A setup past any of them would stop the tool runner before it reports ready, so the
+ * launcher refuses to build one instead.
+ */
+export const CLAUDE_TOOL_SETUP_LIMITS = {
+    maxEnvEntries: 1024,
+    maxEnvValueBytes: 4096,
+    maxFiles: 8,
+    maxFileBytes: 16 * 1024,
+    maxSetupBytes: 96 * 1024,
+};
+export function claudeToolSetup(spec, capability) {
+    if (spec.provider !== "claude-code")
+        throw new Error("claude_tool_setup_provider");
+    const registry = registryWorkerSetup({
+        proxyBaseUrl: `http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`,
+        capability,
+        cacheRoot: `${TOOL_WORKSPACE}/.cache`,
+    });
+    const setup = {
+        schemaVersion: 1,
+        // Same precedence as the Codex driver: the registry's own settings win over a service's.
+        env: { ...serviceEnvironment(spec.services), ...registry.env },
+        files: registry.files,
+    };
+    const raw = JSON.stringify(setup);
+    const limits = CLAUDE_TOOL_SETUP_LIMITS;
+    const entries = Object.values(setup.env);
+    if (entries.length > limits.maxEnvEntries ||
+        entries.some((value) => Buffer.byteLength(value) > limits.maxEnvValueBytes) ||
+        setup.files.length > limits.maxFiles ||
+        setup.files.some((file) => Buffer.byteLength(file.content) > limits.maxFileBytes) ||
+        Buffer.byteLength(raw) > limits.maxSetupBytes) {
+        throw new Error("claude_tool_setup_too_large");
+    }
+    return raw;
+}

package/dist/providers/jobs/collect-prune.d.ts

@@ -0,0 +1,7 @@
+import { type CollectExclusions } from "../../coding/collect-exclude.js";
+/**
+ * Deletes every excluded path from a staging copy of a workspace before it is
+ * validated. Walks with lstat and never descends through a symlink; `rm` removes
+ * a symlink itself, not its target.
+ */
+export declare function pruneCollectExcluded(root: string, exclusions: CollectExclusions): Promise<void>;

package/dist/providers/jobs/collect-prune.js

@@ -0,0 +1,27 @@
+import { lstat, opendir, rm } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { isCollectExcluded } from "../../coding/collect-exclude.js";
+/**
+ * Deletes every excluded path from a staging copy of a workspace before it is
+ * validated. Walks with lstat and never descends through a symlink; `rm` removes
+ * a symlink itself, not its target.
+ */
+export async function pruneCollectExcluded(root, exclusions) {
+    const visit = async (directory) => {
+        const handle = await opendir(directory);
+        const children = [];
+        for await (const entry of handle)
+            children.push(join(directory, entry.name));
+        for (const child of children) {
+            const relativePath = relative(root, child).split(sep).join("/");
+            if (isCollectExcluded(relativePath, exclusions)) {
+                await rm(child, { recursive: true, force: true });
+                continue;
+            }
+            const metadata = await lstat(child);
+            if (metadata.isDirectory() && !metadata.isSymbolicLink())
+                await visit(child);
+        }
+    };
+    await visit(root);
+}

package/dist/providers/jobs/docker-isolation.d.ts

@@ -1,8 +1,22 @@
+import type { CodingProvider } from "../../coding/provider.js";
 import type { JobSpec } from "./types.js";
 export declare const CODING_WORKER_UID = 10001;
 export declare const CODING_WORKER_GID = 10001;
+/**
+ * The network keeper (a run with services only): owns the run's network namespace so each
+ * service and the worker can share it with `--network container:`, as a pod's containers do.
+ */
+export declare const NETWORK_KEEPER_PIDS_LIMIT = 32;
+export declare const NETWORK_KEEPER_MEMORY_MB = 64;
+/** Idles until stopped, on the worker image's own `node` (every worker image ships it for the storage keeper). */
+export declare const NETWORK_KEEPER_SCRIPT = "process.once('SIGTERM', () => process.exit(0)); setInterval(() => {}, 2147483647);";
 export declare const CODING_PROXY_ALIAS = "wardby-proxy";
 export declare const CODING_PROXY_PORT = 8787;
+/**
+ * The one variable Claude's tool runner receives: its package-registry and service settings as JSON
+ * (claude-tool-setup.ts). Never the run capability.
+ */
+export declare const CLAUDE_TOOL_SETUP_ENV = "WARDBY_TOOL_SETUP";
 /**
  * The proxy's deny port. Nothing is served here (see coding-proxy/deny-port.ts);
  * it is the enforcement witness — the one destination a run's NetworkPolicy must
@@ -25,6 +39,7 @@ export interface DockerIsolationNames {
     keeperContainer: string;
     workerContainer: string;
     toolContainer: string;
+    networkKeeperContainer: string;
 }
 export interface DockerIsolationPlan {
     names: DockerIsolationNames;
@@ -35,6 +50,8 @@ export interface DockerIsolationPlan {
     keeperCreateArgs: string[];
     workerCreateArgs: string[];
     toolCreateArgs?: string[];
+    /** Present only for a run with services (docs/coding-services.md). */
+    networkKeeperCreateArgs?: string[];
     proxyNetworkConnectArgs: string[];
 }
 export interface DockerHostInfo {
@@ -70,11 +87,14 @@ export interface DockerVolumeInspection {
     Options?: Record<string, string>;
 }
 export interface DockerContainerInspection {
+    Id?: string;
     Config?: {
         Env?: string[];
         User?: string;
         Image?: string;
         Labels?: Record<string, string>;
+        Entrypoint?: string[] | null;
+        Cmd?: string[] | null;
     };
     HostConfig?: {
         AutoRemove?: boolean;
@@ -140,18 +160,42 @@ export interface DockerContainerInspection {
         Ports?: Record<string, unknown>;
     };
 }
+/**
+ * Which runs the Docker launcher starts services for: Codex and Claude Code. The container that runs
+ * the run's commands (Codex's worker, Claude Code's tool runner) joins the network keeper's
+ * namespace and reaches the services on 127.0.0.1; Claude Code's agent stays on the run network.
+ */
+export declare function dockerSupportsServicesFor(provider: CodingProvider): boolean;
 /** A registry digest reference (`[host[:port]/]path@sha256:<64 hex>`); no local image IDs, no tags. */
 export declare function isRepositoryDigest(image: string): boolean;
 /** Accepts a registry digest or Docker's content-addressed local image ID. */
 export declare function isImmutableDockerImage(image: string): boolean;
+/** The opaque per-run token in every Docker object name; never the run ID itself. */
+export declare function isolationToken(runId: string): string;
 export declare function isolationNames(runId: string): DockerIsolationNames;
+/** The fixed isolation labels every run object carries (docker-services.ts builds with them). */
+export declare function isolationLabelArgs(runId: string): string[];
+export declare function hasIsolationLabels(labels: Record<string, string> | undefined, runId: string): boolean;
 export declare function buildIsolationNetworkCreateArgs(runId: string): string[];
 export declare function buildStorageVolumeCreateArgs(spec: JobSpec): string[];
 export declare function buildKeeperCreateArgs(spec: JobSpec): string[];
+export declare function buildNetworkKeeperCreateArgs(spec: JobSpec): string[];
 export declare function buildWorkerCreateArgs(spec: JobSpec, proxyPort?: number): string[];
+export declare function claudeToolLimits(spec: JobSpec): {
+    cpus: number;
+    memoryMb: number;
+    pids: number;
+};
 /** The Claude agent sees the task/result and socket, never the repository workspace. */
 export declare function buildClaudeAgentCreateArgs(spec: JobSpec, proxyPort?: number): string[];
-/** The tool runner receives only the checkout and socket; it never joins the proxy network. */
+/**
+ * The tool runner receives only the checkout and its own storage subpath; it shares the run's
+ * proxy network with the agent (one room) but holds no capability, so the proxy grants it only
+ * registry access via its own WARDBY_TOOL_SETUP value. For a run with services it joins the network
+ * keeper's namespace instead, which is on that same run network: it reaches the proxy by its alias
+ * and the services on 127.0.0.1, and nothing else. It talks to the agent over the Unix socket in
+ * their shared `tool` storage subpath, which does not depend on either container's network.
+ */
 export declare function buildClaudeToolRunnerCreateArgs(spec: JobSpec): string[];
 export declare function buildProxyNetworkConnectArgs(runId: string, proxyContainer: string): string[];
 export declare function buildDockerIsolationPlan(spec: JobSpec, proxyContainer: string): DockerIsolationPlan;
@@ -160,7 +204,8 @@ export declare function assertIsolationNetworkInspection(network: DockerNetworkI
 export declare function assertIsolationNetworkParticipants(network: DockerNetworkInspection, expectedContainerNames: string[]): void;
 export declare function assertStorageVolumeInspection(volume: DockerVolumeInspection, spec: JobSpec): void;
 export declare function assertKeeperContainerInspection(container: DockerContainerInspection, spec: JobSpec): void;
+export declare function assertNetworkKeeperContainerInspection(container: DockerContainerInspection, spec: JobSpec): void;
 export declare function assertProxyContainerInspection(container: DockerContainerInspection, runId: string): void;
-export declare function assertWorkerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string): void;
+export declare function assertWorkerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string, networkKeeperId?: string): void;
 export declare function assertClaudeAgentContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string): void;
-export declare function assertClaudeToolRunnerContainerInspection(container: DockerContainerInspection, spec: JobSpec): void;
+export declare function assertClaudeToolRunnerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedSetup: string, networkKeeperId?: string): void;

package/dist/providers/jobs/docker-isolation.js

@@ -3,8 +3,23 @@ export const CODING_WORKER_UID = 10001;
 export const CODING_WORKER_GID = 10001;
 // The keeper needs headroom for runc's short-lived exec process plus Node's threads.
 const KEEPER_PIDS_LIMIT = 32;
+/**
+ * The network keeper (a run with services only): owns the run's network namespace so each
+ * service and the worker can share it with `--network container:`, as a pod's containers do.
+ */
+export const NETWORK_KEEPER_PIDS_LIMIT = 32;
+export const NETWORK_KEEPER_MEMORY_MB = 64;
+/** `--cpus 0.1`, as Docker reports it. */
+const NETWORK_KEEPER_NANO_CPUS = 100_000_000;
+/** Idles until stopped, on the worker image's own `node` (every worker image ships it for the storage keeper). */
+export const NETWORK_KEEPER_SCRIPT = "process.once('SIGTERM', () => process.exit(0)); setInterval(() => {}, 2147483647);";
 export const CODING_PROXY_ALIAS = "wardby-proxy";
 export const CODING_PROXY_PORT = 8787;
+/**
+ * The one variable Claude's tool runner receives: its package-registry and service settings as JSON
+ * (claude-tool-setup.ts). Never the run capability.
+ */
+export const CLAUDE_TOOL_SETUP_ENV = "WARDBY_TOOL_SETUP";
 /**
  * The proxy's deny port. Nothing is served here (see coding-proxy/deny-port.ts);
  * it is the enforcement witness — the one destination a run's NetworkPolicy must
@@ -50,6 +65,14 @@ function assertIntegerRange(value, min, max) {
     if (!Number.isSafeInteger(value) || value < min || value > max)
         throw isolationError();
 }
+/**
+ * Which runs the Docker launcher starts services for: Codex and Claude Code. The container that runs
+ * the run's commands (Codex's worker, Claude Code's tool runner) joins the network keeper's
+ * namespace and reaches the services on 127.0.0.1; Claude Code's agent stays on the run network.
+ */
+export function dockerSupportsServicesFor(provider) {
+    return provider === "codex" || provider === "claude-code";
+}
 function validateSpec(spec) {
     if (spec.kind !== "coding-agent" || !/^[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,199}$/.test(spec.runId)) {
         throw isolationError();
@@ -61,12 +84,18 @@ function validateSpec(spec) {
     if (spec.provider === "claude-code") {
         if (!spec.toolImage || !isImmutableDockerImage(spec.toolImage))
             throw isolationError();
-        if (spec.limits.cpus < 0.35 || spec.limits.memoryMb < 256 || spec.limits.pids < 32)
+        if (spec.limits.cpus < 0.35 || spec.limits.memoryMb < 256 || spec.limits.pids < CLAUDE_MIN_PIDS)
             throw isolationError();
     }
     else if (spec.toolImage !== undefined) {
         throw isolationError();
     }
+    if (spec.services !== undefined) {
+        // docker-services.ts re-validates every entry against the catalog schema. Both providers' shells
+        // share the network keeper's namespace: Codex's worker, and Claude Code's tool runner.
+        if (spec.services.length === 0)
+            throw isolationError();
+    }
     assertFiniteRange(spec.limits.cpus, 0.1, 32);
     assertIntegerRange(spec.limits.memoryMb, 128, 65_536);
     assertIntegerRange(spec.limits.pids, 16, 4_096);
@@ -85,21 +114,33 @@ function validateDockerObject(value) {
     if (!DOCKER_OBJECT.test(value))
         throw isolationError();
 }
-export function isolationNames(runId) {
+/** The opaque per-run token in every Docker object name; never the run ID itself. */
+export function isolationToken(runId) {
     if (!/^[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,199}$/.test(runId))
         throw isolationError();
-    const token = runHash(runId).slice(0, 20);
+    return runHash(runId).slice(0, 20);
+}
+export function isolationNames(runId) {
+    const token = isolationToken(runId);
     return {
         network: `wardby-net-${token}`,
         storageVolume: `wardby-storage-${token}`,
         keeperContainer: `wardby-keeper-${token}`,
         workerContainer: `wardby-worker-${token}`,
         toolContainer: `wardby-tools-${token}`,
+        networkKeeperContainer: `wardby-netns-${token}`,
     };
 }
 function labels(runId) {
     return ["--label", LABEL_MANAGED, "--label", LABEL_COMPONENT, "--label", `io.wardby.run-sha256=${runHash(runId)}`];
 }
+/** The fixed isolation labels every run object carries (docker-services.ts builds with them). */
+export function isolationLabelArgs(runId) {
+    return labels(runId);
+}
+export function hasIsolationLabels(labels, runId) {
+    return hasResourceLabels(labels, runId);
+}
 function storageMountOptions(spec) {
     const inodes = Math.max(4_096, Math.min(262_144, spec.limits.diskMb * 256));
     return `size=${spec.limits.diskMb}m,nr_inodes=${inodes},uid=${CODING_WORKER_UID},gid=${CODING_WORKER_GID},mode=0700,nosuid,nodev`;
@@ -192,6 +233,68 @@ export function buildKeeperCreateArgs(spec) {
         "/opt/wardby/coding-worker/keeper.js",
     ];
 }
+export function buildNetworkKeeperCreateArgs(spec) {
+    validateSpec(spec);
+    if (spec.services === undefined)
+        throw isolationError();
+    const names = isolationNames(spec.runId);
+    return [
+        "container",
+        "create",
+        "--name",
+        names.networkKeeperContainer,
+        "--pull",
+        "never",
+        "--user",
+        `${CODING_WORKER_UID}:${CODING_WORKER_GID}`,
+        "--network",
+        names.network,
+        "--read-only",
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges=true",
+        "--security-opt",
+        "seccomp=builtin",
+        "--init",
+        "--cgroupns",
+        "private",
+        "--ipc",
+        "none",
+        "--cpus",
+        "0.1",
+        "--memory",
+        `${NETWORK_KEEPER_MEMORY_MB}m`,
+        "--memory-swap",
+        `${NETWORK_KEEPER_MEMORY_MB}m`,
+        "--memory-swappiness",
+        "0",
+        "--pids-limit",
+        String(NETWORK_KEEPER_PIDS_LIMIT),
+        "--restart",
+        "no",
+        "--log-driver",
+        "local",
+        "--log-opt",
+        "max-size=1m",
+        "--log-opt",
+        "max-file=2",
+        ...labels(spec.runId),
+        "--entrypoint",
+        "node",
+        spec.image,
+        "-e",
+        NETWORK_KEEPER_SCRIPT,
+    ];
+}
+/**
+ * The network of the container that runs the run's commands (Codex's worker, Claude Code's tool
+ * runner): the run network, or the network keeper's namespace for a run with services.
+ */
+function workerNetworkMode(spec) {
+    const names = isolationNames(spec.runId);
+    return spec.services === undefined ? names.network : `container:${names.networkKeeperContainer}`;
+}
 export function buildWorkerCreateArgs(spec, proxyPort = CODING_PROXY_PORT) {
     validateSpec(spec);
     assertIntegerRange(proxyPort, 1, 65_535);
@@ -207,7 +310,7 @@ export function buildWorkerCreateArgs(spec, proxyPort = CODING_PROXY_PORT) {
         "--user",
         `${CODING_WORKER_UID}:${CODING_WORKER_GID}`,
         "--network",
-        names.network,
+        workerNetworkMode(spec),
         "--read-only",
         "--cap-drop",
         "ALL",
@@ -262,11 +365,15 @@ export function buildWorkerCreateArgs(spec, proxyPort = CODING_PROXY_PORT) {
         spec.image,
     ];
 }
-function claudeToolLimits(spec) {
+/** The tool runner's shell + npm shim (two Node processes) + npm peak near 30 PIDs; 64 leaves headroom. */
+const CLAUDE_TOOL_PIDS = 64;
+/** A Claude run must leave its agent at least 32 PIDs after the tool runner's share. */
+const CLAUDE_MIN_PIDS = CLAUDE_TOOL_PIDS + 32;
+export function claudeToolLimits(spec) {
     return {
         cpus: 0.25,
         memoryMb: Math.min(512, Math.max(128, Math.floor(spec.limits.memoryMb / 3))),
-        pids: 16,
+        pids: CLAUDE_TOOL_PIDS,
     };
 }
 function claudeAgentLimits(spec) {
@@ -351,7 +458,14 @@ export function buildClaudeAgentCreateArgs(spec, proxyPort = CODING_PROXY_PORT)
         spec.image,
     ];
 }
-/** The tool runner receives only the checkout and socket; it never joins the proxy network. */
+/**
+ * The tool runner receives only the checkout and its own storage subpath; it shares the run's
+ * proxy network with the agent (one room) but holds no capability, so the proxy grants it only
+ * registry access via its own WARDBY_TOOL_SETUP value. For a run with services it joins the network
+ * keeper's namespace instead, which is on that same run network: it reaches the proxy by its alias
+ * and the services on 127.0.0.1, and nothing else. It talks to the agent over the Unix socket in
+ * their shared `tool` storage subpath, which does not depend on either container's network.
+ */
 export function buildClaudeToolRunnerCreateArgs(spec) {
     validateSpec(spec);
     if (spec.provider !== "claude-code" || !spec.toolImage)
@@ -368,8 +482,11 @@ export function buildClaudeToolRunnerCreateArgs(spec) {
         "never",
         "--user",
         `${CODING_WORKER_UID}:${CODING_WORKER_GID}`,
+        // One room (docs/coding-worker-isolation.md): the run's proxy network, like the agent, so npm and
+        // pip reach the registry. It holds no capability, so the proxy refuses it anything else. With
+        // services: the network keeper's namespace on that network, so the services answer on 127.0.0.1.
         "--network",
-        "none",
+        workerNetworkMode(spec),
         "--read-only",
         "--cap-drop",
         "ALL",
@@ -402,6 +519,9 @@ export function buildClaudeToolRunnerCreateArgs(spec) {
         `type=volume,src=${names.storageVolume},dst=${WORKER_PATHS.workspace},volume-subpath=workspace,volume-nocopy`,
         "--mount",
         `type=volume,src=${names.storageVolume},dst=${WORKER_PATHS.tool},volume-subpath=tool,volume-nocopy`,
+        // By name only: the value (claude-tool-setup.ts) is in the docker CLI's environment, never argv.
+        "--env",
+        CLAUDE_TOOL_SETUP_ENV,
         "--restart",
         "no",
         "--stop-signal",
@@ -434,6 +554,7 @@ export function buildDockerIsolationPlan(spec, proxyContainer) {
         keeperCreateArgs: buildKeeperCreateArgs(spec),
         workerCreateArgs: spec.provider === "claude-code" ? buildClaudeAgentCreateArgs(spec) : buildWorkerCreateArgs(spec),
         ...(spec.provider === "claude-code" ? { toolCreateArgs: buildClaudeToolRunnerCreateArgs(spec) } : {}),
+        ...(spec.services !== undefined ? { networkKeeperCreateArgs: buildNetworkKeeperCreateArgs(spec) } : {}),
         proxyNetworkConnectArgs: buildProxyNetworkConnectArgs(spec.runId, proxyContainer),
     };
 }
@@ -520,6 +641,77 @@ export function assertKeeperContainerInspection(container, spec) {
         throw isolationError();
     }
 }
+export function assertNetworkKeeperContainerInspection(container, spec) {
+    validateSpec(spec);
+    if (spec.services === undefined)
+        throw isolationError();
+    const names = isolationNames(spec.runId);
+    const host = container.HostConfig;
+    const security = host?.SecurityOpt ?? [];
+    if (container.Config?.User !== `${CODING_WORKER_UID}:${CODING_WORKER_GID}` ||
+        container.Config?.Image !== spec.image ||
+        !hasResourceLabels(container.Config.Labels, spec.runId) ||
+        host?.NetworkMode !== names.network ||
+        host.ReadonlyRootfs !== true ||
+        host.Privileged !== false ||
+        (host.Binds?.length ?? 0) !== 0 ||
+        (host.CapAdd?.length ?? 0) !== 0 ||
+        !host.CapDrop?.includes("ALL") ||
+        !security.includes("no-new-privileges=true") ||
+        !security.includes("seccomp=builtin") ||
+        host.PidsLimit !== NETWORK_KEEPER_PIDS_LIMIT ||
+        host.Memory !== NETWORK_KEEPER_MEMORY_MB * 1024 * 1024 ||
+        host.MemorySwap !== host.Memory ||
+        // cgroup v2 hosts may report this as null after accepting the explicit
+        // no-swappiness request; MemorySwap still attests that swap is disabled.
+        (host.MemorySwappiness !== 0 && host.MemorySwappiness !== null) ||
+        host.NanoCpus !== NETWORK_KEEPER_NANO_CPUS ||
+        host.CgroupnsMode !== "private" ||
+        host.IpcMode !== "none" ||
+        host.PidMode !== "" ||
+        host.Init !== true ||
+        host.RestartPolicy?.Name !== "no" ||
+        host.LogConfig?.Type !== "local" ||
+        host.LogConfig.Config?.["max-size"] !== "1m" ||
+        host.LogConfig.Config?.["max-file"] !== "2" ||
+        (host.Devices?.length ?? 0) !== 0 ||
+        (host.DeviceRequests?.length ?? 0) !== 0 ||
+        (host.GroupAdd?.length ?? 0) !== 0 ||
+        // The worker and services take their DNS and port view from this container.
+        (host.Dns?.length ?? 0) !== 0 ||
+        (host.DnsOptions?.length ?? 0) !== 0 ||
+        (host.DnsSearch?.length ?? 0) !== 0 ||
+        (host.ExtraHosts?.length ?? 0) !== 0 ||
+        Object.keys(host.PortBindings ?? {}).length !== 0 ||
+        host.PublishAllPorts !== false ||
+        Object.keys(container.NetworkSettings?.Ports ?? {}).length !== 0 ||
+        (host.Mounts?.length ?? 0) !== 0 ||
+        (container.Mounts?.length ?? 0) !== 0 ||
+        Object.keys(container.NetworkSettings?.Networks ?? {}).join(",") !== names.network ||
+        // Exactly the idle script buildNetworkKeeperCreateArgs runs, never the image's own entrypoint.
+        JSON.stringify(container.Config.Entrypoint ?? null) !== JSON.stringify(["node"]) ||
+        JSON.stringify(container.Config.Cmd ?? null) !== JSON.stringify(["-e", NETWORK_KEEPER_SCRIPT])) {
+        throw isolationError();
+    }
+}
+/**
+ * The worker (Codex) or tool runner (Claude Code) of a run without services is on the run network
+ * only. With services it is in the network keeper's namespace: Docker reports `container:<name>`
+ * before start and `container:<id>` after, and lists no networks of its own.
+ */
+function workerNetworkAttested(container, spec, networkKeeperId) {
+    const names = isolationNames(spec.runId);
+    const mode = container.HostConfig?.NetworkMode;
+    const networks = Object.keys(container.NetworkSettings?.Networks ?? {});
+    if (spec.services === undefined) {
+        return mode === names.network && networks.length === 1 && networks[0] === names.network;
+    }
+    const shared = [
+        `container:${names.networkKeeperContainer}`,
+        ...(networkKeeperId ? [`container:${networkKeeperId}`] : []),
+    ];
+    return mode !== undefined && shared.includes(mode) && networks.length === 0;
+}
 export function assertProxyContainerInspection(container, runId) {
     const internalNetwork = isolationNames(runId).network;
     const networks = container.NetworkSettings?.Networks ?? {};
@@ -571,11 +763,10 @@ function assertExactWorkerMounts(container, names) {
         }
     }
 }
-export function assertWorkerContainerInspection(container, spec, expectedCapability) {
+export function assertWorkerContainerInspection(container, spec, expectedCapability, networkKeeperId) {
     validateSpec(spec);
     const names = isolationNames(spec.runId);
     const host = container.HostConfig;
-    const networks = Object.keys(container.NetworkSettings?.Networks ?? {});
     const security = host?.SecurityOpt ?? [];
     const wardbyEnvironment = (container.Config?.Env ?? []).filter((value) => value.startsWith("WARDBY_"));
     if (container.Config?.User !== `${CODING_WORKER_UID}:${CODING_WORKER_GID}` ||
@@ -594,7 +785,7 @@ export function assertWorkerContainerInspection(container, spec, expectedCapabil
         host.PidsLimit !== spec.limits.pids ||
         host.NanoCpus !== Math.round(spec.limits.cpus * 1_000_000_000) ||
         host.ShmSize !== 16 * 1024 * 1024 ||
-        host.NetworkMode !== names.network ||
+        !workerNetworkAttested(container, spec, networkKeeperId) ||
         host.PidMode !== "" ||
         host.RestartPolicy?.Name !== "no" ||
         host.LogConfig?.Type !== "local" ||
@@ -611,9 +802,7 @@ export function assertWorkerContainerInspection(container, spec, expectedCapabil
         (host.GroupAdd?.length ?? 0) !== 0 ||
         Object.keys(host.PortBindings ?? {}).length !== 0 ||
         host.PublishAllPorts !== false ||
-        Object.keys(container.NetworkSettings?.Ports ?? {}).length !== 0 ||
-        networks.length !== 1 ||
-        networks[0] !== names.network) {
+        Object.keys(container.NetworkSettings?.Ports ?? {}).length !== 0) {
         throw isolationError();
     }
     if (wardbyEnvironment.length !== 2 ||
@@ -645,7 +834,7 @@ function assertExactMountSet(container, names, expected) {
             throw isolationError();
     }
 }
-function assertClaudeContainerBaseline(container, image, network, spec, limits) {
+function assertClaudeContainerBaseline(container, image, spec, limits) {
     const host = container.HostConfig;
     const security = host?.SecurityOpt ?? [];
     if (container.Config?.User !== `${CODING_WORKER_UID}:${CODING_WORKER_GID}` ||
@@ -667,7 +856,6 @@ function assertClaudeContainerBaseline(container, image, network, spec, limits)
         host.PidsLimit !== limits.pids ||
         host.NanoCpus !== Math.round(limits.cpus * 1_000_000_000) ||
         host.ShmSize !== 16 * 1024 * 1024 ||
-        host.NetworkMode !== network ||
         host.PidMode !== "" ||
         host.RestartPolicy?.Name !== "no" ||
         host.LogConfig?.Type !== "local" ||
@@ -693,7 +881,7 @@ export function assertClaudeAgentContainerInspection(container, spec, expectedCa
     if (spec.provider !== "claude-code")
         throw isolationError();
     const names = isolationNames(spec.runId);
-    assertClaudeContainerBaseline(container, spec.image, names.network, spec, claudeAgentLimits(spec));
+    assertClaudeContainerBaseline(container, spec.image, spec, claudeAgentLimits(spec));
     const environment = (container.Config?.Env ?? []).filter((value) => value.startsWith("WARDBY_"));
     if (environment.length !== 2 ||
         !environment.includes(`WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`) ||
@@ -704,18 +892,21 @@ export function assertClaudeAgentContainerInspection(container, spec, expectedCa
         { path: WORKER_PATHS.output, writable: true, subpath: "output" },
         { path: WORKER_PATHS.tool, writable: true, subpath: "tool" },
     ]);
-    if (Object.keys(container.NetworkSettings?.Networks ?? {}).join(",") !== names.network)
+    // The agent holds the capability: always on the run network only, never in the keeper's namespace.
+    if (container.HostConfig?.NetworkMode !== names.network ||
+        Object.keys(container.NetworkSettings?.Networks ?? {}).join(",") !== names.network)
         throw isolationError();
 }
-export function assertClaudeToolRunnerContainerInspection(container, spec) {
+export function assertClaudeToolRunnerContainerInspection(container, spec, expectedSetup, networkKeeperId) {
     validateSpec(spec);
     if (spec.provider !== "claude-code" || !spec.toolImage)
         throw isolationError();
     const names = isolationNames(spec.runId);
-    assertClaudeContainerBaseline(container, spec.toolImage, "none", spec, claudeToolLimits(spec));
-    if ((container.Config?.Env ?? []).some((value) => value.startsWith("WARDBY_")))
+    assertClaudeContainerBaseline(container, spec.toolImage, spec, claudeToolLimits(spec));
+    const environment = (container.Config?.Env ?? []).filter((value) => value.startsWith("WARDBY_"));
+    if (environment.length !== 1 || environment[0] !== `${CLAUDE_TOOL_SETUP_ENV}=${expectedSetup}`)
         throw isolationError();
-    if (Object.keys(container.NetworkSettings?.Networks ?? {}).join(",") !== "none")
+    if (!workerNetworkAttested(container, spec, networkKeeperId))
         throw isolationError();
     assertExactMountSet(container, names, [
         { path: WORKER_PATHS.workspace, writable: true, subpath: "workspace" },