@loicngr/kobo 1.11.36 → 1.11.38

package/dist/server/services/auto-loop-service.js

@@ -2,10 +2,12 @@ import fs from 'node:fs';
 import { buildE2eIterationBlock, buildFinalizationIterationBlock } from '../../shared/auto-loop-prompts.js';
 import { getDb } from '../db/index.js';
 import { slugifyProjectName } from '../utils/project-slug.js';
+import { deferUntilWorkspaceAvailable, isWorkspaceLifecycleBusy } from '../utils/workspace-lifecycle-guard.js';
 import { resolveWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 import * as orchestrator from './agent/orchestrator.js';
 import * as cleanupScriptService from './cleanup-script-service.js';
 import * as lifecycleHookService from './lifecycle-hook-service.js';
+import * as quotaBackoffService from './quota-backoff-service.js';
 import * as settingsService from './settings-service.js';
 import { getSuitePrompts } from './skill-suite-prompts.js';
 import { emit, emitEphemeral } from './websocket-service.js';
@@ -129,7 +131,7 @@ export function onSessionEnded(workspaceId, reason, taskProgressDelta) {
         return;
     // Don't spawn a competing session while paused on canUseTool — the user
     // will resume the deferred turn explicitly.
-    if (row.status === 'awaiting-user')
+    if (row.status === 'awaiting-user' || row.status === 'compacting')
         return;
     // A watchdog denotes Kōbō's own forced recovery from a stuck engine stream.
     // The orchestrator owns its bounded backoff/retry path; counting it as a
@@ -295,7 +297,9 @@ function hasFreeAgentSlot() {
  * free, exactly one starts and the other two keep waiting rather than each
  * re-announcing that they wait.
  */
-export function resumeWaitingWorkspaces() {
+export function resumeWaitingWorkspaces(excluded = new Set()) {
+    if (orchestrator.isShuttingDown())
+        return;
     const db = getDb();
     const rows = db
         .prepare(`SELECT id, status FROM workspaces
@@ -303,13 +307,15 @@ export function resumeWaitingWorkspaces() {
         ORDER BY updated_at ASC`)
         .all();
     for (const row of rows) {
+        if (excluded.has(row.id))
+            continue;
         if (!hasFreeAgentSlot())
             return;
         if (orchestrator.hasController(row.id))
             continue;
         // Same guards as spawnNextIteration's own callers: a quota backoff or a
         // pending question owns the next start of that workspace.
-        if (row.status === 'awaiting-user' || row.status === 'quota')
+        if (row.status === 'awaiting-user' || row.status === 'compacting' || row.status === 'quota')
             continue;
         try {
             spawnNextIteration(row.id);
@@ -320,11 +326,18 @@ export function resumeWaitingWorkspaces() {
     }
 }
 function spawnNextIteration(workspaceId, opts = {}) {
+    // Lifecycle/ready callbacks can outlive timer suspension; preserve their persisted loop intent.
+    if (orchestrator.isShuttingDown())
+        return;
     const row = getRow(workspaceId);
-    if (!row)
+    if (!row || row.archived_at || !row.auto_loop)
+        return;
+    if (deferUntilWorkspaceAvailable(workspaceId, resumeWaitingWorkspaces))
+        return;
+    if (orchestrator.hasController(workspaceId))
         return;
     // Same guard as onSessionEnded — never race a deferred-resume start.
-    if (row.status === 'awaiting-user')
+    if (row.status === 'awaiting-user' || row.status === 'compacting')
         return;
     const task = pickNextTask(workspaceId);
     if (!task) {
@@ -439,7 +452,18 @@ function spawnNextIteration(workspaceId, opts = {}) {
  *   - `status !== 'quota'` (user already manually resumed, or another path
  *     transitioned the workspace)
  */
-export function onQuotaBackoffExpired(workspaceId) {
+const pendingQuotaStops = new Set();
+const QUOTA_STOP_RETRY_MS = 15_000;
+function deferQuotaRetry(workspaceId, pending) {
+    const attempt = pending ?? quotaBackoffService.getPending(workspaceId);
+    quotaBackoffService.arm(workspaceId, QUOTA_STOP_RETRY_MS, {
+        resetsAt: attempt?.resetsAt ?? null,
+        source: attempt?.source ?? 'fallback_ladder',
+        reason: attempt?.reason ?? 'quota',
+        retryCount: attempt?.retryCount ?? 1,
+    });
+}
+export function onQuotaBackoffExpired(workspaceId, pending) {
     const row = getRow(workspaceId);
     if (!row)
         return;
@@ -449,6 +473,36 @@ export function onQuotaBackoffExpired(workspaceId) {
         return;
     if (row.status !== 'quota')
         return;
+    if (pendingQuotaStops.has(workspaceId) || orchestrator.isShuttingDown() || isWorkspaceLifecycleBusy(workspaceId)) {
+        deferQuotaRetry(workspaceId, pending);
+        return;
+    }
+    if (orchestrator.hasController(workspaceId)) {
+        pendingQuotaStops.add(workspaceId);
+        const stopped = orchestrator.stopAgentAndWait(workspaceId, undefined, 'replacement');
+        // The timer already consumed its row. Persist recovery immediately, after the
+        // technical stop's synchronous cancellation, so shutdown/crash during the await loses no intent.
+        deferQuotaRetry(workspaceId, pending);
+        void stopped
+            .then((outcome) => {
+            // Stop, archive, or a manual replacement may have superseded this retry while we awaited the engine.
+            const current = getRow(workspaceId);
+            if (!current || current.archived_at || !current.auto_loop || current.status !== 'quota')
+                return;
+            if (outcome === 'timeout' || outcome === 'failed' || orchestrator.isShuttingDown()) {
+                deferQuotaRetry(workspaceId, pending);
+                return;
+            }
+            updateWorkspaceStatus(workspaceId, 'idle');
+            quotaBackoffService.cancel(workspaceId, 'completed');
+            spawnNextIteration(workspaceId);
+        })
+            .catch((err) => {
+            console.error(`[auto-loop] quota controller stop failed for '${workspaceId}':`, err);
+        })
+            .finally(() => pendingQuotaStops.delete(workspaceId));
+        return;
+    }
     // The timer has consumed its persisted row. Release quota ownership before
     // checking capacity so resumeWaitingWorkspaces can pick this workspace up
     // when a slot frees, even if no agent can start at this instant.

package/dist/server/services/change-source-branch-service.js

@@ -1,3 +1,4 @@
+import { withWorkspaceLifecycleGuard } from '../utils/workspace-lifecycle-guard.js';
 // src/server/services/change-source-branch-service.ts
 import { spawn } from 'node:child_process';
 import * as path from 'node:path';
@@ -44,6 +45,15 @@ const BACKUP_BRANCHES_KEPT = 3;
  * running, unknown base). Returns a status discriminating the outcome.
  */
 export async function changeSourceBranch(workspaceId, newBase) {
+    // Always acquire workspace ownership before the shared repository lock.
+    return withWorkspaceLifecycleGuard(workspaceId, () => {
+        const workspace = getWorkspace(workspaceId);
+        if (!workspace)
+            throw new Error(`Workspace '${workspaceId}' not found`);
+        return withGitRepoLock(workspace.worktreePath, () => changeSourceBranchGuarded(workspaceId, newBase));
+    });
+}
+async function changeSourceBranchGuarded(workspaceId, newBase) {
     const workspace = getWorkspace(workspaceId);
     if (!workspace)
         throw new Error(`Workspace '${workspaceId}' not found`);
@@ -85,16 +95,16 @@ export async function changeSourceBranch(workspaceId, newBase) {
         }
         // A stale index.lock makes every git write fail half-way through, and the
         // raw git message tells the user nothing. Typical origin: a setup/cleanup
-        // script SIGKILLed at its timeout during a commit. The custom-script path
-        // does not go through the repository lock, so the check is immediate here.
+        // script SIGKILLed at its timeout during a commit. Both paths hold the lock.
         gitOps.assertNoIndexLock(worktreePath);
+        gitOps.assertCurrentBranch(worktreePath, workingBranch);
         return runCustomScript(workspace, oldBase, trimmedNew, effective.changeSourceBranchScript);
     }
-    // The whole built-in strategy runs under the repository lock: it fetches,
+    // Both strategies run under the repository lock: it fetches,
     // resets and cherry-picks, all of which touch the COMMON git dir shared by
     // every worktree of the project. A concurrent fetch from the PR watcher
     // during the cherry-pick leaves it aborted mid-way.
-    return withGitRepoLock(worktreePath, () => runBuiltInStrategy(workspaceId, worktreePath, workingBranch, workspace.projectPath, oldBase, trimmedNew));
+    return runBuiltInStrategy(workspaceId, worktreePath, workingBranch, workspace.projectPath, oldBase, trimmedNew);
 }
 /** The built-in cherry-pick strategy. Always called under the repository lock. */
 async function runBuiltInStrategy(workspaceId, worktreePath, workingBranch, projectPath, oldBase, trimmedNew) {
@@ -114,6 +124,10 @@ async function runBuiltInStrategy(workspaceId, worktreePath, workingBranch, proj
     catch {
         // offline / no remote — proceed with local refs
     }
+    assertWorkspaceUnchanged(workspaceId, worktreePath, workingBranch, oldBase);
+    gitOps.assertCurrentBranch(worktreePath, workingBranch);
+    if (getAgentStatus(workspaceId) !== null)
+        throw new Error('Cannot change the source branch while the agent is running');
     if (!gitOps.branchExists(worktreePath, trimmedNew, 'origin')) {
         throw new Error(`Source branch 'origin/${trimmedNew}' does not exist`);
     }
@@ -235,6 +249,12 @@ async function runCustomScript(workspace, oldBase, newBase, script) {
     catch (err) {
         console.warn('[change-source-branch] PR lookup failed, KOBO_PR_NUMBER will be empty:', err);
     }
+    assertWorkspaceUnchanged(workspace.id, workspace.worktreePath, workspace.workingBranch, oldBase);
+    gitOps.assertCurrentBranch(workspace.worktreePath, workspace.workingBranch);
+    if (gitOps.worktreeHasChangesStrict(workspace.worktreePath))
+        return { status: 'dirty', forcePushNeeded: false, commitCount: 0 };
+    if (getAgentStatus(workspace.id) !== null)
+        throw new Error('Cannot change the source branch while the agent is running');
     return new Promise((resolve, reject) => {
         const child = spawn('bash', ['-c', script], {
             cwd: workspace.worktreePath,
@@ -292,3 +312,15 @@ async function runCustomScript(workspace, oldBase, newBase, script) {
         });
     });
 }
+/** Async lookups must not authorize mutations using obsolete workspace metadata. */
+function assertWorkspaceUnchanged(id, worktreePath, branch, sourceBranch) {
+    const current = getWorkspace(id);
+    if (!current ||
+        current.archivedAt ||
+        current.worktreePurgedAt ||
+        current.worktreePath !== worktreePath ||
+        current.workingBranch !== branch ||
+        current.sourceBranch !== sourceBranch) {
+        throw new Error('Workspace changed during source-branch validation; retry the operation');
+    }
+}

package/dist/server/services/cron-service.js

@@ -2,6 +2,7 @@ import { CronExpressionParser } from 'cron-parser';
 import { nanoid } from 'nanoid';
 import { getDb } from '../db/index.js';
 import { slugifyProjectName } from '../utils/project-slug.js';
+import { isWorkspaceLifecycleBusy } from '../utils/workspace-lifecycle-guard.js';
 import { resolveWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 import * as orchestrator from './agent/orchestrator.js';
 import * as settingsService from './settings-service.js';
@@ -15,6 +16,14 @@ export const MIN_DELAY_BETWEEN_FIRES_SECONDS = 60;
 // real fire time hasn't been reached yet.
 const MAX_SETTIMEOUT_MS = 2_000_000_000; // ~23 days, with margin under 2^31-1
 const timers = new Map();
+let suspended = false;
+/** Preserve cron intent and deadlines while the process is shutting down. */
+export function suspendForShutdown() {
+    suspended = true;
+    for (const timer of timers.values())
+        clearTimeout(timer);
+    timers.clear();
+}
 /**
  * Arm a setTimeout that fires `fireOrSkip(id)` when `fireAt` is reached.
  * Replaces any existing timer for this id. Handles long horizons by
@@ -22,6 +31,8 @@ const timers = new Map();
  * days.
  */
 function scheduleAt(id, fireAt) {
+    if (suspended)
+        return;
     const previous = timers.get(id);
     if (previous)
         clearTimeout(previous);
@@ -154,6 +165,8 @@ export function listAll() {
  * unexpected error is logged and the cron is preserved when possible.
  */
 function fireOrSkip(id) {
+    if (suspended)
+        return;
     try {
         timers.delete(id);
         const db = getDb();
@@ -168,6 +181,10 @@ function fireOrSkip(id) {
             cancel(id, wsRow ? 'archive' : 'deleted');
             return;
         }
+        if (isWorkspaceLifecycleBusy(row.workspace_id)) {
+            scheduleAt(id, new Date(Date.now() + 15_000));
+            return;
+        }
         let status = 'skipped-active';
         if (!orchestrator.hasController(row.workspace_id)) {
             try {
@@ -244,6 +261,8 @@ function fireOrSkip(id) {
  * Rows pointing at deleted/archived workspaces are removed without firing.
  */
 export function restoreOnBoot() {
+    suspendForShutdown();
+    suspended = false;
     try {
         // Boot semantics: clear any existing in-memory timers before rearming.
         for (const t of timers.values())

package/dist/server/services/db-backup-service.js

@@ -90,3 +90,33 @@ export async function createPreMigrationBackup(db, dbPath, tag, keepCount = DEFA
         throw err;
     }
 }
+/** Recheck daily-backup eligibility hourly, including on long-running servers. */
+export function startDailyDbBackupScheduler(backup, intervalMs = 60 * 60 * 1000) {
+    let inFlight = null;
+    let stopped = false;
+    const attempt = async () => {
+        try {
+            await backup();
+        }
+        catch (err) {
+            console.error('[kobo] Scheduled DB backup failed:', err);
+        }
+    };
+    const tick = () => {
+        if (stopped || inFlight)
+            return;
+        inFlight = attempt().finally(() => {
+            inFlight = null;
+        });
+    };
+    const timer = setInterval(tick, intervalMs);
+    timer.unref?.();
+    tick();
+    return {
+        async stop() {
+            stopped = true;
+            clearInterval(timer);
+            await inFlight;
+        },
+    };
+}

package/dist/server/services/dev-server-service.js

@@ -1,6 +1,7 @@
 import { execFile, spawn } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
+import { assertWorkspaceLifecycleAvailable } from '../utils/workspace-lifecycle-guard.js';
 import { getProjectSettings } from './settings-service.js';
 import { emitEphemeral } from './websocket-service.js';
 import { getWorkspace, listWorkspaces, updateDevServerStatus } from './workspace-service.js';
@@ -23,9 +24,13 @@ function runCommand(command, args, options = {}) {
 // ── State ──────────────────────────────────────────────────────────────────────
 /** workspaceId -> spawned dev-server process */
 const trackedProcesses = new Map();
+const stoppingProcesses = new Map();
+const generations = new Map();
 /** Test-only: clear the tracked-processes map between tests. */
 export function _resetTrackedProcessesForTests() {
     trackedProcesses.clear();
+    stoppingProcesses.clear();
+    generations.clear();
 }
 // ── Pure helpers ───────────────────────────────────────────────────────────────
 /**
@@ -84,23 +89,29 @@ export function resolveInstance(projectPath, workingBranch) {
     }
     return null;
 }
-function containerBelongsToProject(containerName, projectName) {
-    const name = containerName.toLowerCase();
-    const project = projectName.toLowerCase();
-    return name === project || name.startsWith(`${project}-`) || name.startsWith(`${project}_`);
-}
 // ── Docker helpers ─────────────────────────────────────────────────────────────
 /**
  * List all running Docker container names.
  * Uses execFile so Docker inspection cannot block the Node event loop.
  */
-export async function listRunningContainers() {
+export async function listRunningContainers(projectName) {
     try {
-        const output = await runCommand('docker', ['ps', '--format', '{{.Names}}'], { timeout: 10_000 });
+        const args = projectName
+            ? [
+                'ps',
+                '--filter',
+                `label=com.docker.compose.project=${projectName}`,
+                '--format',
+                '{{.Names}}\t{{.Label "com.docker.compose.project"}}',
+            ]
+            : ['ps', '--format', '{{.Names}}'];
+        const output = await runCommand('docker', args, { timeout: 10_000 });
         return output
             .split('\n')
             .map((s) => s.trim())
-            .filter(Boolean);
+            .filter(Boolean)
+            .filter((line) => !projectName || line.split('\t')[1] === projectName)
+            .map((line) => (projectName ? line.split('\t')[0] : line));
     }
     catch {
         return [];
@@ -128,8 +139,7 @@ export async function getStatus(projectPath, workingBranch, workspaceId) {
             containers: [],
         };
     }
-    const running = await listRunningContainers();
-    const matching = running.filter((name) => containerBelongsToProject(name, config.projectName));
+    const matching = await listRunningContainers(config.projectName);
     if (matching.length > 0) {
         return {
             status: 'running',
@@ -167,6 +177,7 @@ export async function getStatus(projectPath, workingBranch, workspaceId) {
  * Start the dev-server for a workspace.
  */
 export function startDevServer(workspaceId) {
+    assertWorkspaceLifecycleAvailable(workspaceId);
     const workspace = getWorkspace(workspaceId);
     if (!workspace) {
         throw new Error(`Workspace '${workspaceId}' not found`);
@@ -179,6 +190,8 @@ export function startDevServer(workspaceId) {
     // silently overwriting the tracked process — the first process would
     // otherwise become untrackable (never killed by stopDevServer) and its
     // exit handler could later clobber state set by the second process.
+    if (stoppingProcesses.has(workspaceId))
+        throw new Error(`Dev server for workspace '${workspaceId}' is stopping`);
     if (trackedProcesses.has(workspaceId)) {
         throw new Error(`Dev server for workspace '${workspaceId}' is already starting`);
     }
@@ -196,6 +209,8 @@ export function startDevServer(workspaceId) {
         stdio: ['ignore', 'pipe', 'pipe'],
         detached: true,
     });
+    const generation = (generations.get(workspaceId) ?? 0) + 1;
+    generations.set(workspaceId, generation);
     trackedProcesses.set(workspaceId, proc);
     // Log stdout/stderr for debugging
     proc.stdout?.on('data', (data) => {
@@ -205,21 +220,35 @@ export function startDevServer(workspaceId) {
         console.error(`[dev-server:${instanceName}] ${data.toString().trim()}`);
     });
     proc.on('exit', (code) => {
-        trackedProcesses.delete(workspaceId);
-        void getStatus(workspace.projectPath, workspace.workingBranch)
-            .then((currentStatus) => {
-            updateDevServerStatus(workspaceId, currentStatus.status);
-            emitEphemeral(workspaceId, 'devserver:status', currentStatus);
-        })
-            .catch((err) => {
-            console.error(`[dev-server] Failed to refresh status for workspace ${workspaceId}:`, err);
+        // Shell exit does not imply that its background children have stopped.
+        void (async () => {
+            while (trackedProcesses.get(workspaceId) === proc && !stoppingProcesses.has(workspaceId)) {
+                if (proc.pid && (await hasLiveProcessGroup(proc.pid))) {
+                    await pollDelay(250);
+                    continue;
+                }
+                if (trackedProcesses.get(workspaceId) !== proc || stoppingProcesses.has(workspaceId))
+                    return;
+                trackedProcesses.delete(workspaceId);
+                const currentStatus = await getStatus(workspace.projectPath, workspace.workingBranch);
+                if (generations.get(workspaceId) !== generation || stoppingProcesses.has(workspaceId))
+                    return;
+                updateDevServerStatus(workspaceId, currentStatus.status);
+                emitEphemeral(workspaceId, 'devserver:status', currentStatus);
+                return;
+            }
+        })().catch((err) => {
+            console.error(`[dev-server] Failed to confirm process-group exit for workspace ${workspaceId}:`, err);
         });
-        if (code !== 0) {
+        if (code !== 0)
             console.error(`[dev-server] Process exited with code ${code} for workspace ${workspaceId}`);
-        }
     });
     proc.on('error', (err) => {
-        trackedProcesses.delete(workspaceId);
+        if (trackedProcesses.get(workspaceId) !== proc)
+            return;
+        // A signal failure is also an 'error' event; it does not prove process exit.
+        if (!proc.pid)
+            trackedProcesses.delete(workspaceId);
         updateDevServerStatus(workspaceId, 'error');
         console.error(`[dev-server] Process error for workspace ${workspaceId}:`, err);
         emitEphemeral(workspaceId, 'devserver:status', {
@@ -249,6 +278,96 @@ export function startDevServer(workspaceId) {
  * Stop the dev-server for a workspace.
  */
 export async function stopDevServer(workspaceId) {
+    const pending = stoppingProcesses.get(workspaceId);
+    if (pending)
+        return pending;
+    generations.set(workspaceId, (generations.get(workspaceId) ?? 0) + 1);
+    const stopping = stopDevServerOwned(workspaceId);
+    stoppingProcesses.set(workspaceId, stopping);
+    try {
+        return await stopping;
+    }
+    finally {
+        if (stoppingProcesses.get(workspaceId) === stopping)
+            stoppingProcesses.delete(workspaceId);
+    }
+}
+function pollDelay(ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref?.();
+    });
+}
+/** A zombie cannot write files, even if the OS has not reaped its PID yet. */
+async function hasLiveProcessGroup(groupId) {
+    try {
+        process.kill(-groupId, 0);
+    }
+    catch (err) {
+        if (err.code === 'ESRCH')
+            return false;
+        throw err;
+    }
+    const processes = await runCommand('ps', ['-eo', 'pgid=,stat='], { timeout: 1000 });
+    return processes.split('\n').some((line) => {
+        const [group, state] = line.trim().split(/\s+/);
+        return Number(group) === groupId && !!state && !/^[ZX]/.test(state);
+    });
+}
+async function signalGroupAndWait(groupId, signal, timeoutMs) {
+    try {
+        process.kill(-groupId, signal);
+    }
+    catch (err) {
+        if (err.code === 'ESRCH')
+            return true;
+        throw err;
+    }
+    const deadline = Date.now() + timeoutMs;
+    while (await hasLiveProcessGroup(groupId)) {
+        if (Date.now() >= deadline)
+            return false;
+        await pollDelay(50);
+    }
+    return true;
+}
+function signalAndWait(proc, signal, timeoutMs) {
+    if (proc.pid)
+        return signalGroupAndWait(proc.pid, signal, timeoutMs);
+    if (proc.exitCode != null || proc.signalCode != null)
+        return Promise.resolve(true);
+    return new Promise((resolve, reject) => {
+        const finish = (exited) => {
+            clearTimeout(timer);
+            proc.removeListener('exit', onExit);
+            proc.removeListener('error', onError);
+            resolve(exited);
+        };
+        const onExit = () => finish(true);
+        const onError = (err) => {
+            clearTimeout(timer);
+            proc.removeListener('exit', onExit);
+            proc.removeListener('error', onError);
+            reject(err);
+        };
+        const timer = setTimeout(() => finish(false), timeoutMs);
+        proc.once('exit', onExit);
+        proc.once('error', onError);
+        try {
+            if (proc.pid)
+                process.kill(-proc.pid, signal);
+            else
+                proc.kill(signal);
+        }
+        catch (err) {
+            clearTimeout(timer);
+            proc.removeListener('exit', onExit);
+            proc.removeListener('error', onError);
+            reject(err);
+        }
+    });
+}
+async function stopDevServerOwned(workspaceId) {
     const workspace = getWorkspace(workspaceId);
     if (!workspace) {
         throw new Error(`Workspace '${workspaceId}' not found`);
@@ -260,20 +379,15 @@ export async function stopDevServer(workspaceId) {
     // Kill tracked process first (covers Node servers and any spawned process)
     const tracked = trackedProcesses.get(workspaceId);
     if (tracked) {
-        try {
-            if (tracked.pid) {
-                process.kill(-tracked.pid, 'SIGTERM');
-            }
-            else {
-                tracked.kill('SIGTERM');
-            }
-        }
-        catch (err) {
-            console.error('[dev-server] Failed to kill tracked process:', err instanceof Error ? err.message : err);
-        }
-        trackedProcesses.delete(workspaceId);
+        const exited = (await signalAndWait(tracked, 'SIGTERM', 3_000)) || (await signalAndWait(tracked, 'SIGKILL', 1_000));
+        if (!exited)
+            throw new Error('Dev server stop is not confirmed; retry after the process exits');
+        if (trackedProcesses.get(workspaceId) === tracked)
+            trackedProcesses.delete(workspaceId);
     }
     const settings = getProjectSettings(workspace.projectPath);
+    let stopError;
+    let customStopSucceeded = false;
     if (settings?.devServer.stopCommand) {
         try {
             await runCommand('bash', ['-c', settings.devServer.stopCommand], {
@@ -285,9 +399,10 @@ export async function stopDevServer(workspaceId) {
                 },
                 timeout: 30_000,
             });
+            customStopSucceeded = true;
         }
         catch (err) {
-            console.error(`[dev-server] Stop command failed:`, err instanceof Error ? err.message : err);
+            stopError = err;
         }
     }
     // Always try docker compose down with project name if we have one
@@ -295,11 +410,26 @@ export async function stopDevServer(workspaceId) {
     if (config?.projectName) {
         try {
             await runCommand('docker', ['compose', '-p', config.projectName, 'down'], { cwd, timeout: 30_000 });
+            stopError = undefined;
         }
-        catch {
-            // May already be stopped by the custom command — ignore
+        catch (err) {
+            stopError = err;
+            // The custom command may use -f/--env-file absent from the generic fallback.
+            // Only an independent, successful Docker query can confirm it stopped everything.
+            if (customStopSucceeded) {
+                try {
+                    const remaining = await runCommand('docker', ['ps', '--filter', `label=com.docker.compose.project=${config.projectName}`, '--format', '{{.ID}}'], { timeout: 10_000 });
+                    if (!remaining.trim())
+                        stopError = undefined;
+                }
+                catch {
+                    // An unavailable daemon is not confirmation of shutdown.
+                }
+            }
         }
     }
+    if (stopError)
+        throw new Error(`Dev server stop failed: ${stopError instanceof Error ? stopError.message : String(stopError)}`);
     const status = {
         status: 'stopped',
         instanceName,
@@ -338,8 +468,7 @@ export async function getDevServerLogs(workspaceId, tail = 200) {
     if (!config) {
         return 'No dev-server instance found';
     }
-    const running = await listRunningContainers();
-    const matching = running.filter((name) => containerBelongsToProject(name, config.projectName));
+    const matching = await listRunningContainers(config.projectName);
     if (matching.length === 0) {
         return 'No running containers found';
     }