@redwoodjs/agent-ci 0.7.0 → 0.7.1

package/dist/cli.js

@@ -245,6 +245,9 @@ async function run() {
 // One workflow = --all with a single entry.
 async function runWorkflows(options) {
     const { workflowPaths, sha, pauseOnFailure, noMatrix = false } = options;
+    // Suppress EventEmitter MaxListenersExceeded warnings when running many
+    // parallel jobs (each job adds SIGINT/SIGTERM listeners).
+    process.setMaxListeners(0);
     // Create the run state store — single source of truth for all progress
     const runId = `run-${Date.now()}`;
     const storeFilePath = path.join(getWorkingDirectory(), "runs", runId, "run-state.json");
@@ -322,6 +325,15 @@ async function runWorkflows(options) {
             }
         }, 80);
     }
+    // Top-level signal handler: exit the process after per-job handlers have
+    // cleaned up their containers. All listeners fire synchronously in
+    // registration order, so we defer the exit to let per-job handlers
+    // (registered later in local-job.ts) run first.
+    const exitOnSignal = () => {
+        setTimeout(() => process.exit(1), 0);
+    };
+    process.on("SIGINT", exitOnSignal);
+    process.on("SIGTERM", exitOnSignal);
     try {
         const allResults = [];
         if (workflowPaths.length === 1) {
@@ -347,6 +359,11 @@ async function runWorkflows(options) {
             catch { }
             const warmModulesDir = path.resolve(getWorkingDirectory(), "cache", "warm-modules", repoSlug, lockfileHash);
             const warm = isWarmNodeModules(warmModulesDir);
+            // Pre-allocate unique run numbers so parallel workflows don't collide.
+            // Each workflow gets its own baseRunNum (e.g. 306, 307, 308) so their
+            // job suffixes (-j1, -j2, -j3) never produce duplicate container names.
+            const baseRunNum = getNextLogNum("agent-ci");
+            const runNums = workflowPaths.map((_, i) => baseRunNum + i);
             if (!warm && workflowPaths.length > 1) {
                 // Cold cache — run first workflow serially to populate warm modules,
                 // then launch the rest in parallel.
@@ -356,11 +373,17 @@ async function runWorkflows(options) {
                     pauseOnFailure,
                     noMatrix,
                     store,
+                    baseRunNum: runNums[0],
                 });
                 allResults.push(...firstResults);
-                const settled = await Promise.allSettled(workflowPaths
-                    .slice(1)
-                    .map((wf) => handleWorkflow({ workflowPath: wf, sha, pauseOnFailure, noMatrix, store })));
+                const settled = await Promise.allSettled(workflowPaths.slice(1).map((wf, i) => handleWorkflow({
+                    workflowPath: wf,
+                    sha,
+                    pauseOnFailure,
+                    noMatrix,
+                    store,
+                    baseRunNum: runNums[i + 1],
+                })));
                 for (const s of settled) {
                     if (s.status === "fulfilled") {
                         allResults.push(...s.value);
@@ -371,7 +394,14 @@ async function runWorkflows(options) {
                 }
             }
             else {
-                const settled = await Promise.allSettled(workflowPaths.map((wf) => handleWorkflow({ workflowPath: wf, sha, pauseOnFailure, noMatrix, store })));
+                const settled = await Promise.allSettled(workflowPaths.map((wf, i) => handleWorkflow({
+                    workflowPath: wf,
+                    sha,
+                    pauseOnFailure,
+                    noMatrix,
+                    store,
+                    baseRunNum: runNums[i],
+                })));
                 for (const s of settled) {
                     if (s.status === "fulfilled") {
                         allResults.push(...s.value);
@@ -386,6 +416,8 @@ async function runWorkflows(options) {
         return allResults;
     }
     finally {
+        process.removeListener("SIGINT", exitOnSignal);
+        process.removeListener("SIGTERM", exitOnSignal);
         if (renderInterval) {
             clearInterval(renderInterval);
         }
@@ -496,7 +528,7 @@ async function handleWorkflow(options) {
         const warmModulesDir = path.resolve(getWorkingDirectory(), "cache", "warm-modules", repoSlug, lockfileHash);
         let warm = isWarmNodeModules(warmModulesDir);
         // Naming convention: agent-ci-<N>[-j<idx>][-m<shardIdx>]
-        const baseRunNum = getNextLogNum("agent-ci");
+        const baseRunNum = options.baseRunNum ?? getNextLogNum("agent-ci");
         let globalIdx = 0;
         const buildJob = (ej) => {
             const secrets = loadMachineSecrets(repoRoot);
@@ -703,8 +735,8 @@ async function handleWorkflow(options) {
         return allResults;
     }
     catch (error) {
-        console.error(`[Agent CI] Failed to trigger run: ${error.message}`);
-        return [];
+        console.error(`[Agent CI] Failed to run workflow ${path.basename(workflowPath)}: ${error.message}`);
+        throw error;
     }
 }
 // ─── Utilities ────────────────────────────────────────────────────────────────

package/dist/docker/container-config.js

@@ -11,6 +11,7 @@ export function buildContainerEnv(opts) {
         `GITHUB_API_URL=${dockerApiUrl}`,
         `GITHUB_SERVER_URL=${repoUrl}`,
         `GITHUB_REPOSITORY=${githubRepo}`,
+        `AGENT_CI_LOCAL=true`,
         `AGENT_CI_LOCAL_SYNC=true`,
         `AGENT_CI_HEAD_SHA=${headSha || "HEAD"}`,
         `AGENT_CI_DTU_HOST=${dtuHost}`,

package/dist/docker/container-config.test.js

@@ -1,4 +1,4 @@
-import { describe, it, expect, afterEach, vi } from "vitest";
+import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
 import fs from "node:fs";
 afterEach(() => {
     vi.restoreAllMocks();
@@ -19,6 +19,7 @@ describe("buildContainerEnv", () => {
         });
         expect(env).toContain("RUNNER_NAME=runner-1");
         expect(env).toContain("GITHUB_REPOSITORY=org/repo");
+        expect(env).toContain("AGENT_CI_LOCAL=true");
         expect(env).toContain("AGENT_CI_HEAD_SHA=abc123");
         expect(env).toContain("FORCE_COLOR=1");
         // Should NOT include root-mode vars for standard container
@@ -183,6 +184,10 @@ describe("resolveDockerApiUrl", () => {
 });
 describe("resolveDtuHost", () => {
     const originalBridgeGateway = process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY;
+    const originalDtuHost = process.env.AGENT_CI_DTU_HOST;
+    beforeEach(() => {
+        delete process.env.AGENT_CI_DTU_HOST;
+    });
     afterEach(() => {
         if (originalBridgeGateway === undefined) {
             delete process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY;
@@ -190,8 +195,15 @@ describe("resolveDtuHost", () => {
         else {
             process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY = originalBridgeGateway;
         }
+        if (originalDtuHost === undefined) {
+            delete process.env.AGENT_CI_DTU_HOST;
+        }
+        else {
+            process.env.AGENT_CI_DTU_HOST = originalDtuHost;
+        }
     });
     it("uses host alias when available outside Docker", async () => {
+        delete process.env.AGENT_CI_DTU_HOST;
         const { resolveDtuHost } = await import("./container-config.js");
         const originalExistsSync = fs.existsSync;
         vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
@@ -203,6 +215,7 @@ describe("resolveDtuHost", () => {
         await expect(resolveDtuHost()).resolves.toBe("host.docker.internal");
     });
     it("uses configured bridge gateway outside Docker when provided", async () => {
+        delete process.env.AGENT_CI_DTU_HOST;
         const { resolveDtuHost } = await import("./container-config.js");
         const originalExistsSync = fs.existsSync;
         vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
@@ -215,6 +228,7 @@ describe("resolveDtuHost", () => {
         await expect(resolveDtuHost()).resolves.toBe("10.10.0.1");
     });
     it("uses host alias outside Docker when no gateway override is configured", async () => {
+        delete process.env.AGENT_CI_DTU_HOST;
         const { resolveDtuHost } = await import("./container-config.js");
         const originalExistsSync = fs.existsSync;
         vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {

package/dist/docker/repro-126.test.js

@@ -0,0 +1,72 @@
+/**
+ * Reproduction for https://github.com/redwoodjs/agent-ci/issues/126
+ *
+ * When running inside Docker (via agent-ci), AGENT_CI_DTU_HOST is set in the
+ * container environment. The resolveDtuHost tests delete it, but this test
+ * verifies the mock and env var interaction actually works in that scenario.
+ */
+import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
+import fs from "node:fs";
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe("issue-126 reproduction: resolveDtuHost inside Docker", () => {
+    const originalBridgeGateway = process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY;
+    const originalDtuHost = process.env.AGENT_CI_DTU_HOST;
+    beforeEach(() => {
+        delete process.env.AGENT_CI_DTU_HOST;
+    });
+    afterEach(() => {
+        if (originalBridgeGateway === undefined) {
+            delete process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY;
+        }
+        else {
+            process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY = originalBridgeGateway;
+        }
+        if (originalDtuHost === undefined) {
+            delete process.env.AGENT_CI_DTU_HOST;
+        }
+        else {
+            process.env.AGENT_CI_DTU_HOST = originalDtuHost;
+        }
+    });
+    it("reports environment state", async () => {
+        console.log("--- issue-126 repro diagnostics ---");
+        console.log("/.dockerenv exists:", fs.existsSync("/.dockerenv"));
+        console.log("AGENT_CI_DTU_HOST:", process.env.AGENT_CI_DTU_HOST ?? "(unset)");
+        console.log("AGENT_CI_DOCKER_BRIDGE_GATEWAY:", process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY ?? "(unset)");
+        expect(true).toBe(true);
+    });
+    it("mock fs.existsSync intercepts /.dockerenv check", async () => {
+        const realResult = fs.existsSync("/.dockerenv");
+        console.log("Real fs.existsSync('/.dockerenv'):", realResult);
+        const originalExistsSync = fs.existsSync;
+        vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
+            if (filePath === "/.dockerenv") {
+                return false;
+            }
+            return originalExistsSync(filePath);
+        });
+        const mockedResult = fs.existsSync("/.dockerenv");
+        console.log("Mocked fs.existsSync('/.dockerenv'):", mockedResult);
+        expect(mockedResult).toBe(false);
+    });
+    it("resolveDtuHost uses bridge gateway when mock is active (the failing test)", async () => {
+        // Simulate agent-ci Docker env: AGENT_CI_DTU_HOST was set but we deleted it
+        delete process.env.AGENT_CI_DTU_HOST;
+        const { resolveDtuHost } = await import("./container-config.js");
+        const originalExistsSync = fs.existsSync;
+        vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
+            if (filePath === "/.dockerenv") {
+                return false;
+            }
+            return originalExistsSync(filePath);
+        });
+        process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY = "10.10.0.1";
+        // This is the assertion that was failing: expected '10.10.0.1' but got 'host.docker.internal'
+        const result = await resolveDtuHost();
+        console.log("resolveDtuHost() returned:", result);
+        console.log("Expected: 10.10.0.1");
+        expect(result).toBe("10.10.0.1");
+    });
+});

package/dist/docker/shutdown.js

@@ -43,14 +43,31 @@ export function killRunnerContainers(runnerName) {
 }
 /**
  * Remove orphaned Docker resources left behind by previous runs:
- *   1. `agent-ci-net-*` networks with no connected containers
- *   2. Dangling volumes (anonymous volumes from service containers like MySQL)
+ *   1. Stopped `agent-ci-*` containers (runners + sidecars)
+ *   2. `agent-ci-net-*` networks with no connected containers
+ *   3. Dangling volumes (anonymous volumes from service containers like MySQL)
+ *
+ * Stopped containers must be removed first so their network references are
+ * released, allowing the network prune in step 2 to reclaim address pool capacity.
  *
  * Call this proactively before creating new resources to prevent Docker from
  * exhausting its address pool ("all predefined address pools have been fully subnetted").
  */
 export function pruneOrphanedDockerResources() {
-    // 1. Remove orphaned agent-ci-net-* networks
+    // 1. Remove stopped agent-ci-* containers (runners + sidecars) so their
+    //    network references are released before we try to prune networks.
+    try {
+        const stoppedIds = execSync(`docker ps -aq --filter "name=agent-ci-" --filter "status=exited"`, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+        if (stoppedIds) {
+            execSync(`docker rm -f ${stoppedIds.split("\n").join(" ")}`, {
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+        }
+    }
+    catch {
+        // Docker not reachable or no stopped containers — skip
+    }
+    // 2. Remove orphaned agent-ci-net-* networks
     try {
         const nets = execSync(`docker network ls -q --filter "name=agent-ci-net-"`, {
             encoding: "utf8",
@@ -74,7 +91,7 @@ export function pruneOrphanedDockerResources() {
     catch {
         // Docker not reachable — skip
     }
-    // 2. Remove dangling volumes (anonymous volumes from service containers)
+    // 3. Remove dangling volumes (anonymous volumes from service containers)
     try {
         execSync(`docker volume prune -f`, {
             stdio: ["pipe", "pipe", "pipe"],

package/dist/output/logger.js

@@ -31,15 +31,44 @@ export function getNextLogNum(prefix) {
     });
     return nums.length > 0 ? Math.max(...nums) + 1 : 1;
 }
+/**
+ * Atomically allocate a numbered run directory under `runs/`.
+ * Uses mkdirSync without `recursive` so that EEXIST signals a
+ * collision — the caller just increments and retries.
+ */
+function allocateRunDir(prefix) {
+    const runsDir = getRunsDir();
+    let num = getNextLogNum(prefix);
+    for (;;) {
+        const name = `${prefix}-${num}`;
+        const runDir = path.join(runsDir, name);
+        try {
+            fs.mkdirSync(runDir); // atomic — fails with EEXIST on collision
+            return { num, name, runDir };
+        }
+        catch (err) {
+            if (err.code === "EEXIST") {
+                num++;
+                continue;
+            }
+            throw err;
+        }
+    }
+}
 export function createLogContext(prefix, preferredName) {
     ensureLogDirs();
-    let num = 0;
-    let name = preferredName;
-    if (!name) {
-        num = getNextLogNum(prefix);
-        name = `${prefix}-${num}`;
+    let num;
+    let name;
+    let runDir;
+    if (preferredName) {
+        num = 0;
+        name = preferredName;
+        runDir = path.join(getRunsDir(), name);
+        fs.mkdirSync(runDir, { recursive: true });
+    }
+    else {
+        ({ num, name, runDir } = allocateRunDir(prefix));
     }
-    const runDir = path.join(getRunsDir(), name);
     const logDir = path.join(runDir, "logs");
     fs.mkdirSync(logDir, { recursive: true });
     return {

package/dist/output/logger.test.js

@@ -78,5 +78,45 @@ describe("Logger utilities", () => {
             const second = createLogContext("agent-ci");
             expect(second.num).toBe(first.num + 1);
         });
+        it("skips over a directory that already exists (race condition)", async () => {
+            const { setWorkingDirectory } = await import("./working-directory.js");
+            const { createLogContext } = await import("./logger.js");
+            setWorkingDirectory(tmpDir);
+            // Pre-create runs/agent-ci-1 to simulate another process winning the race
+            fs.mkdirSync(path.join(tmpDir, "runs", "agent-ci-1"), { recursive: true });
+            const ctx = createLogContext("agent-ci");
+            // Should have skipped 1 and landed on 2
+            expect(ctx.num).toBe(2);
+            expect(ctx.name).toBe("agent-ci-2");
+            expect(fs.existsSync(ctx.runDir)).toBe(true);
+        });
+        it("handles multiple consecutive collisions", async () => {
+            const { setWorkingDirectory } = await import("./working-directory.js");
+            const { createLogContext } = await import("./logger.js");
+            setWorkingDirectory(tmpDir);
+            // Pre-create 1, 2, and 3 to simulate several concurrent processes
+            fs.mkdirSync(path.join(tmpDir, "runs", "agent-ci-1"), { recursive: true });
+            fs.mkdirSync(path.join(tmpDir, "runs", "agent-ci-2"), { recursive: true });
+            fs.mkdirSync(path.join(tmpDir, "runs", "agent-ci-3"), { recursive: true });
+            const ctx = createLogContext("agent-ci");
+            expect(ctx.num).toBe(4);
+            expect(ctx.name).toBe("agent-ci-4");
+            expect(fs.existsSync(ctx.runDir)).toBe(true);
+        });
+        it("concurrent calls each get a unique directory", async () => {
+            const { setWorkingDirectory } = await import("./working-directory.js");
+            const { createLogContext } = await import("./logger.js");
+            setWorkingDirectory(tmpDir);
+            // Call createLogContext many times synchronously — each should get a unique dir
+            const results = Array.from({ length: 10 }, () => createLogContext("agent-ci"));
+            const names = results.map((r) => r.name);
+            const uniqueNames = new Set(names);
+            expect(uniqueNames.size).toBe(10);
+            // All directories should exist
+            for (const r of results) {
+                expect(fs.existsSync(r.runDir)).toBe(true);
+                expect(fs.existsSync(r.logDir)).toBe(true);
+            }
+        });
     });
 });

package/dist/runner/local-job.js

@@ -16,7 +16,7 @@ import { computeFakeSha, writeGitShim } from "./git-shim.js";
 import { prepareWorkspace } from "./workspace.js";
 import { createRunDirectories } from "./directory-setup.js";
 import { buildContainerEnv, buildContainerBinds, buildContainerCmd, resolveDtuHost, resolveDockerApiUrl, resolveDockerExtraHosts, } from "../docker/container-config.js";
-import { buildJobResult } from "./result-builder.js";
+import { buildJobResult, isJobSuccessful } from "./result-builder.js";
 import { wrapJobSteps, appendOutputCaptureStep } from "./step-wrapper.js";
 import { syncWorkspaceForRetry } from "./sync.js";
 // ─── Docker setup ─────────────────────────────────────────────────────────────
@@ -158,6 +158,9 @@ export async function executeLocalJob(job, options) {
     // Open debug stream to capture raw container output
     const debugStream = fs.createWriteStream(debugLogPath);
     // Signal handler: ensure cleanup runs even when killed.
+    // Do NOT call process.exit() here — multiple jobs register handlers concurrently,
+    // and an early exit would prevent other jobs' handlers from cleaning up their containers.
+    // killRunnerContainers already handles the runner, its svc-* sidecars, and the network.
     const signalCleanup = () => {
         killRunnerContainers(containerName);
         for (const d of [dirs.containerWorkDir, dirs.shimsDir, dirs.signalsDir, dirs.diagDir]) {
@@ -166,10 +169,13 @@ export async function executeLocalJob(job, options) {
             }
             catch { }
         }
-        process.exit(1);
     };
-    process.once("SIGINT", signalCleanup);
-    process.once("SIGTERM", signalCleanup);
+    process.on("SIGINT", signalCleanup);
+    process.on("SIGTERM", signalCleanup);
+    // Hoisted for cleanup in `finally` — assigned inside the try block.
+    let container = null;
+    let serviceCtx;
+    const hostRunnerDir = path.resolve(runDir, "runner");
     try {
         // 1. Seed the job to Local DTU
         const [githubOwner, githubRepoName] = (job.githubRepo || "").split("/");
@@ -183,6 +189,10 @@ export async function executeLocalJob(job, options) {
             : job.repository;
         const wrappedSteps = pauseOnFailure ? wrapJobSteps(job.steps ?? [], true) : job.steps;
         const seededSteps = appendOutputCaptureStep(wrappedSteps ?? []);
+        // Pin runnerName so the job goes to the runner-specific pool, not the
+        // shared generic pool where a runner from another concurrent workflow
+        // could steal it (see issue #103).
+        job.runnerName = containerName;
         t0 = Date.now();
         const seedResponse = await fetch(`${dtuUrl}/_dtu/seed`, {
             method: "POST",
@@ -249,7 +259,6 @@ export async function executeLocalJob(job, options) {
             // Ignore - container doesn't exist
         }
         // ── Service containers ────────────────────────────────────────────────────
-        let serviceCtx;
         if (job.services && job.services.length > 0) {
             const svcStart = Date.now();
             debugRunner(`Starting ${job.services.length} service container(s)...`);
@@ -262,7 +271,6 @@ export async function executeLocalJob(job, options) {
         // ── Direct container injection ─────────────────────────────────────────────
         const hostWorkDir = dirs.containerWorkDir;
         const hostRunnerSeedDir = path.resolve(getWorkingDirectory(), "runner");
-        const hostRunnerDir = path.resolve(runDir, "runner");
         const useDirectContainer = !!job.container;
         const containerImage = useDirectContainer ? job.container.image : IMAGE;
         if (useDirectContainer) {
@@ -420,7 +428,7 @@ export async function executeLocalJob(job, options) {
         });
         const extraHosts = resolveDockerExtraHosts(dtuHost);
         t0 = Date.now();
-        const container = await docker.createContainer({
+        container = await docker.createContainer({
             Image: containerImage,
             name: containerName,
             Env: containerEnv,
@@ -706,7 +714,7 @@ export async function executeLocalJob(job, options) {
             waitResult = await container.wait();
         }
         const containerExitCode = waitResult.StatusCode;
-        const jobSucceeded = lastFailedStep === null && containerExitCode === 0;
+        const jobSucceeded = isJobSuccessful({ lastFailedStep, containerExitCode, isBooting });
         // Update store with final exit code on failure
         if (!jobSucceeded) {
             store?.updateJob(containerName, {
@@ -714,28 +722,6 @@ export async function executeLocalJob(job, options) {
             });
         }
         await new Promise((resolve) => debugStream.end(resolve));
-        // Cleanup
-        try {
-            await container.remove({ force: true });
-        }
-        catch {
-            /* already removed */
-        }
-        if (serviceCtx) {
-            await cleanupServiceContainers(docker, serviceCtx, (line) => debugRunner(line));
-        }
-        if (fs.existsSync(dirs.shimsDir)) {
-            fs.rmSync(dirs.shimsDir, { recursive: true, force: true });
-        }
-        if (!pauseOnFailure && fs.existsSync(dirs.signalsDir)) {
-            fs.rmSync(dirs.signalsDir, { recursive: true, force: true });
-        }
-        if (fs.existsSync(dirs.diagDir)) {
-            fs.rmSync(dirs.diagDir, { recursive: true, force: true });
-        }
-        if (fs.existsSync(hostRunnerDir)) {
-            fs.rmSync(hostRunnerDir, { recursive: true, force: true });
-        }
         // Read step outputs captured by the DTU server via the runner's outputs API
         let stepOutputs = {};
         if (jobSucceeded) {
@@ -758,7 +744,6 @@ export async function executeLocalJob(job, options) {
                 // processes haven't fully released file handles yet.
             }
         }
-        await ephemeralDtu?.close().catch(() => { });
         return buildJobResult({
             containerName,
             job,
@@ -773,6 +758,29 @@ export async function executeLocalJob(job, options) {
         });
     }
     finally {
+        // Cleanup: always runs even when errors occur mid-run.
+        try {
+            await container?.remove({ force: true });
+        }
+        catch {
+            /* already removed */
+        }
+        if (serviceCtx) {
+            await cleanupServiceContainers(docker, serviceCtx, (line) => debugRunner(line));
+        }
+        if (fs.existsSync(dirs.shimsDir)) {
+            fs.rmSync(dirs.shimsDir, { recursive: true, force: true });
+        }
+        if (!pauseOnFailure && fs.existsSync(dirs.signalsDir)) {
+            fs.rmSync(dirs.signalsDir, { recursive: true, force: true });
+        }
+        if (fs.existsSync(dirs.diagDir)) {
+            fs.rmSync(dirs.diagDir, { recursive: true, force: true });
+        }
+        if (fs.existsSync(hostRunnerDir)) {
+            fs.rmSync(hostRunnerDir, { recursive: true, force: true });
+        }
+        await ephemeralDtu?.close().catch(() => { });
         process.removeListener("SIGINT", signalCleanup);
         process.removeListener("SIGTERM", signalCleanup);
     }

package/dist/runner/result-builder.js

@@ -189,6 +189,18 @@ export function resolveJobOutputs(outputDefs, stepOutputs) {
     }
     return result;
 }
+// ─── Job success determination ────────────────────────────────────────────────
+/**
+ * Determine whether a job succeeded based on container exit state and
+ * whether the runner ever contacted the DTU.
+ *
+ * `isBooting` stays `true` when the runner never sent any timeline entries —
+ * it started but couldn't reach the DTU or crashed before executing any steps.
+ * That must be treated as a failure regardless of exit code.
+ */
+export function isJobSuccessful(opts) {
+    return opts.lastFailedStep === null && opts.containerExitCode === 0 && !opts.isBooting;
+}
 /**
  * Build the structured `JobResult` from container exit state and timeline data.
  */

package/dist/runner/result-builder.test.js

@@ -113,6 +113,27 @@ describe("extractFailureDetails", () => {
         expect(details).toEqual({});
     });
 });
+// ── isJobSuccessful ──────────────────────────────────────────────────────────
+describe("isJobSuccessful", () => {
+    it("succeeds when no failed step, exit code 0, and not booting", async () => {
+        const { isJobSuccessful } = await import("./result-builder.js");
+        expect(isJobSuccessful({ lastFailedStep: null, containerExitCode: 0, isBooting: false })).toBe(true);
+    });
+    it("fails when a step failed", async () => {
+        const { isJobSuccessful } = await import("./result-builder.js");
+        expect(isJobSuccessful({ lastFailedStep: "Build", containerExitCode: 0, isBooting: false })).toBe(false);
+    });
+    it("fails when container exit code is non-zero", async () => {
+        const { isJobSuccessful } = await import("./result-builder.js");
+        expect(isJobSuccessful({ lastFailedStep: null, containerExitCode: 1, isBooting: false })).toBe(false);
+    });
+    it("fails when runner never contacted DTU (isBooting=true)", async () => {
+        const { isJobSuccessful } = await import("./result-builder.js");
+        // This is the bug from #102: container exits 0 with no failed steps,
+        // but the runner never sent any timeline entries (isBooting stayed true).
+        expect(isJobSuccessful({ lastFailedStep: null, containerExitCode: 0, isBooting: true })).toBe(false);
+    });
+});
 // ── buildJobResult ────────────────────────────────────────────────────────────
 describe("buildJobResult", () => {
     let tmpDir;

package/dist/workflow/workflow-parser.js

@@ -574,7 +574,24 @@ export function isWorkflowRelevant(template, branch, changedFiles) {
             return true;
         }
     }
-    // 2. Check push
+    // 2. Check pull_request_target (same logic as pull_request)
+    if (events.pull_request_target) {
+        const prt = events.pull_request_target;
+        let branchMatches = false;
+        if (!prt.branches && !prt["branches-ignore"]) {
+            branchMatches = true;
+        }
+        else if (prt.branches) {
+            branchMatches = prt.branches.some((pattern) => minimatch("main", pattern));
+        }
+        else if (prt["branches-ignore"]) {
+            branchMatches = !prt["branches-ignore"].some((pattern) => minimatch("main", pattern));
+        }
+        if (branchMatches && matchesPaths(prt, changedFiles)) {
+            return true;
+        }
+    }
+    // 3. Check push
     if (events.push) {
         const push = events.push;
         let branchMatches = false;

package/dist/workflow/workflow-parser.test.js

@@ -639,6 +639,27 @@ describe("isWorkflowRelevant", () => {
         });
         expect(isWorkflowRelevant(template, "feature", ["cli/src/cli.ts"])).toBe(true);
     });
+    // ── pull_request_target ─────────────────────────────────────────────────
+    function prtTemplate(config = {}) {
+        return { events: { pull_request_target: config } };
+    }
+    it("matches pull_request_target with no filters", () => {
+        expect(isWorkflowRelevant(prtTemplate(), "feature")).toBe(true);
+    });
+    it("matches pull_request_target when branch filter includes main", () => {
+        expect(isWorkflowRelevant(prtTemplate({ branches: ["main"] }), "feature")).toBe(true);
+    });
+    it("skips pull_request_target when branch filter excludes main", () => {
+        expect(isWorkflowRelevant(prtTemplate({ branches: ["develop"] }), "feature")).toBe(false);
+    });
+    it("matches pull_request_target with paths filter when files match", () => {
+        const template = prtTemplate({ paths: ["src/**"] });
+        expect(isWorkflowRelevant(template, "feature", ["src/index.ts"])).toBe(true);
+    });
+    it("skips pull_request_target with paths filter when no files match", () => {
+        const template = prtTemplate({ paths: ["src/**"] });
+        expect(isWorkflowRelevant(template, "feature", ["README.md"])).toBe(false);
+    });
 });
 // ─── fromJSON / toJSON ────────────────────────────────────────────────────────
 describe("expandExpressions — fromJSON", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redwoodjs/agent-ci",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Local GitHub Actions runner — pause on failure, ~0ms cache, official runner binary. Built for AI coding agents.",
   "keywords": [
     "act-alternative",
@@ -40,7 +40,7 @@
     "log-update": "^7.2.0",
     "minimatch": "^10.2.1",
     "yaml": "^2.8.2",
-    "dtu-github-actions": "0.7.0"
+    "dtu-github-actions": "0.7.1"
   },
   "devDependencies": {
     "@types/dockerode": "^3.3.34",