threadwire 0.1.23 → 0.1.24

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+- Fix a race in isolated-runtime worker cleanup: Docker's ContainerStop returns
+  HTTP 304 when the owned container exits before the stop call, and
+  ContainerKill returns HTTP 409 when the container exits between the post-stop
+  reinspection and the kill call. `stopAndRemoveWorkerContainer` now recognizes
+  only the endpoint-specific structured status for each call (304 at stop, 409
+  at kill), reinspects the exact container ID, and continues with removal only
+  when the reinspection confirms a terminal state. Genuine stop/kill errors
+  still fail closed, no broad cleanup is performed, and lineage retention
+  behavior is unchanged. Add focused lifecycle tests for 304 stop, 409 kill,
+  304 kill, and genuine error paths.
+
 - Complete every short filesystem write while spooling oversized worker JSONL
   records, preventing truncated or corrupted worker output. Reject stalled,
   invalid, or impossible write counts and clean up the private spool artifact

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadwire",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Stream Codex, Claude, Kimi Code, and OpenCode worker progress to an explicit Telegram destination",
   "keywords": [
     "ai-agent",

package/src/docker-api.js

@@ -3,6 +3,15 @@
 
 import {request as httpRequest} from "node:http"
 
+export class DockerApiError extends Error {
+  /** @param {string} method @param {string} path @param {number} status */
+  constructor(method, path, status) {
+    super(`Docker API ${method} ${path} failed (${status})`)
+    this.name = "DockerApiError"
+    this.status = status
+  }
+}
+
 export class DockerApi {
   /** @param {{host?: string, requestImplementation?: typeof httpRequest}} [options] */
   constructor(options = {}) {
@@ -38,7 +47,7 @@ export class DockerApi {
           const content = combined.toString("utf8")
           const status = response.statusCode ?? 500
           if (status < 200 || status >= 300) {
-            reject(new Error(`Docker API ${method} ${path} failed (${status})`))
+            reject(new DockerApiError(method, path, status))
             return
           }
           if (combined.length === 0) {
@@ -135,7 +144,7 @@ export class DockerApi {
         const status = response.statusCode ?? 500
         if (status < 200 || status >= 300) {
           response.resume()
-          fail(new Error(`Docker API GET /containers/${id}/logs failed (${status})`))
+          fail(new DockerApiError("GET", `/containers/${id}/logs`, status))
           return
         }
         response.on("data", (chunk) => {

package/src/isolated-runtime.js

@@ -6,7 +6,7 @@ import {once} from "node:events"
 import {lstat, realpath} from "node:fs/promises"
 import {createServer} from "node:http"
 import {isAbsolute, join, normalize, relative} from "node:path"
-import {DockerApi} from "./docker-api.js"
+import {DockerApi, DockerApiError} from "./docker-api.js"
 import {buildKimiBindingValidatorSpec, buildKimiRelayContainerSpec, buildWorkerContainerSpec, isDigestImage} from "./isolated-worker.js"
 import {validateRelayWriteProviderArguments} from "./relay-write.js"
 import {codexSessionId, parseCodexEvent} from "./providers/codex.js"
@@ -723,11 +723,19 @@ async function stopAndRemoveWorkerContainer(docker, containerId, requestOptions)
   let inspection = await docker.inspectContainer(containerId, requestOptions)
   if (typeof inspection?.State?.Running !== "boolean") throw new Error("Worker container state unavailable")
   if (inspection.State.Running) {
-    await docker.stopContainer(containerId, WORKER_STOP_GRACE_SECONDS, requestOptions)
+    try {
+      await docker.stopContainer(containerId, WORKER_STOP_GRACE_SECONDS, requestOptions)
+    } catch (error) {
+      if (!isContainerStopAlreadyStoppedError(error)) throw error
+    }
     inspection = await docker.inspectContainer(containerId, requestOptions)
     if (typeof inspection?.State?.Running !== "boolean") throw new Error("Worker container state unavailable")
     if (inspection.State.Running) {
-      await docker.killContainer(containerId, "KILL", requestOptions)
+      try {
+        await docker.killContainer(containerId, "KILL", requestOptions)
+      } catch (error) {
+        if (!isContainerKillConflictError(error)) throw error
+      }
       inspection = await docker.inspectContainer(containerId, requestOptions)
       if (inspection?.State?.Running !== false) throw new ContainerCleanupConfirmationError()
     }
@@ -735,6 +743,14 @@ async function stopAndRemoveWorkerContainer(docker, containerId, requestOptions)
   await docker.removeContainer(containerId, requestOptions)
 }
 
+function isContainerStopAlreadyStoppedError(error) {
+  return error instanceof DockerApiError && error.status === 304
+}
+
+function isContainerKillConflictError(error) {
+  return error instanceof DockerApiError && error.status === 409
+}
+
 class ContainerCleanupConfirmationError extends Error {
   /** @param {{cause?: unknown}} [options] */
   constructor(options = {}) {