fix: sandbox cancelation

Author: kasin-it

AGENTS.md

@@ -0,0 +1,70 @@
+# CLAUDE.md
+
+Behavioral guidelines to reduce common LLM coding mistakes. Merge with project-specific instructions as needed.
+
+**Tradeoff:** These guidelines bias toward caution over speed. For trivial tasks, use judgment.
+
+## 1. Think Before Coding
+
+**Don't assume. Don't hide confusion. Surface tradeoffs.**
+
+Before implementing:
+
+- State your assumptions explicitly. If uncertain, ask.
+- If multiple interpretations exist, present them - don't pick silently.
+- If a simpler approach exists, say so. Push back when warranted.
+- If something is unclear, stop. Name what's confusing. Ask.
+
+## 2. Simplicity First
+
+**Minimum code that solves the problem. Nothing speculative.**
+
+- No features beyond what was asked.
+- No abstractions for single-use code.
+- No "flexibility" or "configurability" that wasn't requested.
+- No error handling for impossible scenarios.
+- If you write 200 lines and it could be 50, rewrite it.
+
+Ask yourself: "Would a senior engineer say this is overcomplicated?" If yes, simplify.
+
+## 3. Surgical Changes
+
+**Touch only what you must. Clean up only your own mess.**
+
+When editing existing code:
+
+- Don't "improve" adjacent code, comments, or formatting.
+- Don't refactor things that aren't broken.
+- Match existing style, even if you'd do it differently.
+- If you notice unrelated dead code, mention it - don't delete it.
+
+When your changes create orphans:
+
+- Remove imports/variables/functions that YOUR changes made unused.
+- Don't remove pre-existing dead code unless asked.
+
+The test: Every changed line should trace directly to the user's request.
+
+## 4. Goal-Driven Execution
+
+**Define success criteria. Loop until verified.**
+
+Transform tasks into verifiable goals:
+
+- "Add validation" → "Write tests for invalid inputs, then make them pass"
+- "Fix the bug" → "Write a test that reproduces it, then make it pass"
+- "Refactor X" → "Ensure tests pass before and after"
+
+For multi-step tasks, state a brief plan:
+
+```
+1. [Step] → verify: [check]
+2. [Step] → verify: [check]
+3. [Step] → verify: [check]
+```
+
+Strong success criteria let you loop independently. Weak criteria ("make it work") require constant clarification.
+
+---
+
+**These guidelines are working if:** fewer unnecessary changes in diffs, fewer rewrites due to overcomplication, and clarifying questions come before implementation rather than after mistakes.

src/lib/cancel-run.test.ts

@@ -2,9 +2,13 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 import type { RunRegistryAdapter } from "../adapters/run-registry/types.js";
 
 const mockGetRun = vi.fn();
+const mockStopTicketSandboxes = vi.fn();
 vi.mock("workflow/api", () => ({
   getRun: (...args: any[]) => mockGetRun(...args),
 }));
+vi.mock("../sandbox/stop-ticket-sandboxes.js", () => ({
+  stopTicketSandboxes: (...args: any[]) => mockStopTicketSandboxes(...args),
+}));
 
 function makeRegistry(overrides: Partial<RunRegistryAdapter> = {}): RunRegistryAdapter {
   return {
@@ -21,7 +25,10 @@ function makeRegistry(overrides: Partial<RunRegistryAdapter> = {}): RunRegistryA
 }
 
 describe("cancelRun", () => {
-  beforeEach(() => vi.clearAllMocks());
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockStopTicketSandboxes.mockResolvedValue(0);
+  });
 
   it("cancels the run and unregisters", async () => {
     const mockCancel = vi.fn().mockResolvedValue(undefined);
@@ -34,6 +41,7 @@ describe("cancelRun", () => {
     expect(result).toBe(true);
     expect(mockGetRun).toHaveBeenCalledWith("run_abc");
     expect(mockCancel).toHaveBeenCalled();
+    expect(mockStopTicketSandboxes).toHaveBeenCalledWith("PROJ-1");
     expect(registry.unregister).toHaveBeenCalledWith("PROJ-1");
   });
 
@@ -47,6 +55,7 @@ describe("cancelRun", () => {
     const result = await cancelRun("PROJ-1", "run_abc", registry);
 
     expect(result).toBe(false);
+    expect(mockStopTicketSandboxes).toHaveBeenCalledWith("PROJ-1");
     expect(registry.unregister).toHaveBeenCalledWith("PROJ-1");
   });
 
@@ -63,5 +72,6 @@ describe("cancelRun", () => {
 
     expect(result).toBe(false);
     expect(unregister).toHaveBeenCalledTimes(2);
+    expect(mockStopTicketSandboxes).toHaveBeenCalledTimes(2);
   });
 });

src/lib/cancel-run.ts

@@ -1,6 +1,7 @@
 import { getRun } from "workflow/api";
 import { logger } from "./logger.js";
 import type { RunRegistryAdapter } from "../adapters/run-registry/types.js";
+import { stopTicketSandboxes } from "../sandbox/stop-ticket-sandboxes.js";
 
 /**
  * Cancel a workflow run and unregister it from the registry.
@@ -24,6 +25,7 @@ export async function cancelRun(
     );
   }
 
+  await stopTicketSandboxes(ticketKey).catch(() => {});
   await runRegistry.unregister(ticketKey).catch(() => {});
   return cancelled;
 }

src/lib/dispatch.test.ts

@@ -21,11 +21,15 @@ vi.mock("../workflows/agent.js", () => ({
 }));
 
 const mockSandboxList = vi.fn();
+const mockStopTicketSandboxes = vi.fn();
 vi.mock("@vercel/sandbox", () => ({
   Sandbox: {
     list: (...args: any[]) => mockSandboxList(...args),
   },
 }));
+vi.mock("../sandbox/stop-ticket-sandboxes.js", () => ({
+  stopTicketSandboxes: (...args: any[]) => mockStopTicketSandboxes(...args),
+}));
 
 function makeTicket(overrides: Partial<TicketContent> = {}): TicketContent {
   return {
@@ -103,6 +107,7 @@ describe("dispatchTicket", () => {
       json: { sandboxes: [] },
     });
     mockStart.mockResolvedValue({ runId: "run_123" });
+    mockStopTicketSandboxes.mockResolvedValue(0);
   });
 
   it("dispatches agentWorkflow for a ticket in configured project + AI column", async () => {
@@ -205,6 +210,7 @@ describe("dispatchTicket", () => {
     expect(mockStart).toHaveBeenCalled();
     expect(mockGetRun).toHaveBeenCalledWith("run_123");
     expect(mockCancel).toHaveBeenCalled();
+    expect(mockStopTicketSandboxes).toHaveBeenCalledWith("PROJ-42");
     expect(adapters.runRegistry.register).not.toHaveBeenCalled();
   });
 
@@ -272,6 +278,7 @@ describe("failed-ticket safeguard full loop", () => {
     vi.clearAllMocks();
     mockSandboxList.mockResolvedValue({ json: { sandboxes: [] } });
     mockStart.mockResolvedValue({ runId: "run_123" });
+    mockStopTicketSandboxes.mockResolvedValue(0);
   });
 
   it("mark → skip → clear → redispatch", async () => {

src/lib/dispatch.ts

@@ -3,6 +3,7 @@ import { env } from "../../env.js";
 import { agentWorkflow } from "../workflows/agent.js";
 import { logger } from "./logger.js";
 import type { Adapters } from "./adapters.js";
+import { stopTicketSandboxes } from "../sandbox/stop-ticket-sandboxes.js";
 
 const CLAIMING_PREFIX = "claiming:";
 
@@ -140,6 +141,7 @@ async function abortWorkflow(runId: string, ticketKey: string): Promise<void> {
     const run = getRun(runId);
     await run.cancel();
   } catch {}
+  await stopTicketSandboxes(ticketKey).catch(() => {});
 }
 
 function extractProjectKey(ticketIdentifier: string): string | null {

src/sandbox/stop-ticket-sandboxes.test.ts

@@ -0,0 +1,69 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockList = vi.fn();
+const mockGet = vi.fn();
+
+vi.mock("@vercel/sandbox", () => ({
+  Sandbox: {
+    list: (...args: any[]) => mockList(...args),
+    get: (...args: any[]) => mockGet(...args),
+  },
+}));
+
+vi.mock("./credentials.js", () => ({
+  getSandboxCredentials: vi.fn(() => ({})),
+}));
+
+function makeSandbox(branch: string, status: "running" | "stopped" = "running") {
+  return {
+    status,
+    runCommand: vi.fn().mockResolvedValue({
+      exitCode: 0,
+      stdout: async () => branch,
+    }),
+    stop: vi.fn().mockResolvedValue(undefined),
+  };
+}
+
+describe("stopTicketSandboxes", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("stops running sandboxes on the ticket branch", async () => {
+    const matching = makeSandbox("blazebot/proj-42");
+    const other = makeSandbox("blazebot/proj-99");
+
+    mockList.mockResolvedValue({
+      json: {
+        sandboxes: [
+          { id: "sbx-1", status: "running" },
+          { id: "sbx-2", status: "running" },
+        ],
+      },
+    });
+
+    mockGet.mockImplementation(async ({ sandboxId }: { sandboxId: string }) => {
+      if (sandboxId === "sbx-1") return matching;
+      if (sandboxId === "sbx-2") return other;
+      throw new Error(`unexpected sandbox id: ${sandboxId}`);
+    });
+
+    const { stopTicketSandboxes } = await import("./stop-ticket-sandboxes.js");
+    const stopped = await stopTicketSandboxes("PROJ-42");
+
+    expect(stopped).toBe(1);
+    expect(matching.stop).toHaveBeenCalledTimes(1);
+    expect(other.stop).not.toHaveBeenCalled();
+  });
+
+  it("returns 0 when sandbox listing fails", async () => {
+    mockList.mockRejectedValue(new Error("sandbox api down"));
+
+    const { stopTicketSandboxes } = await import("./stop-ticket-sandboxes.js");
+    const stopped = await stopTicketSandboxes("PROJ-42");
+
+    expect(stopped).toBe(0);
+    expect(mockGet).not.toHaveBeenCalled();
+  });
+});

src/sandbox/stop-ticket-sandboxes.ts

@@ -0,0 +1,85 @@
+import { logger } from "../lib/logger.js";
+import { getSandboxCredentials } from "./credentials.js";
+
+const BRANCH_PREFIX = "blazebot/";
+
+/**
+ * Best-effort cleanup for leaked sandboxes after ticket cancellation.
+ * Finds running sandboxes whose checked-out branch matches the ticket branch
+ * and requests stop on each match.
+ */
+export async function stopTicketSandboxes(ticketKey: string): Promise<number> {
+  const normalizedTicket = ticketKey.trim().toLowerCase();
+  if (!normalizedTicket) return 0;
+
+  const expectedBranch = `${BRANCH_PREFIX}${normalizedTicket}`;
+
+  try {
+    const { Sandbox } = await import("@vercel/sandbox");
+    const credentials = getSandboxCredentials();
+    const { json } = await Sandbox.list({ ...credentials, limit: 100 });
+    const running = json.sandboxes.filter((sandbox) => sandbox.status === "running");
+
+    let stopped = 0;
+    for (const entry of running) {
+      try {
+        const sandbox = await Sandbox.get({
+          ...credentials,
+          sandboxId: entry.id,
+        });
+        if (sandbox.status !== "running") continue;
+
+        const branch = await getSandboxBranch(sandbox);
+        if (branch !== expectedBranch) continue;
+
+        await sandbox.stop();
+        stopped++;
+      } catch (err) {
+        logger.warn(
+          {
+            ticketKey,
+            sandboxId: entry.id,
+            error: (err as Error).message,
+          },
+          "cancel_run_sandbox_stop_failed",
+        );
+      }
+    }
+
+    if (stopped > 0) {
+      logger.info(
+        { ticketKey, expectedBranch, stopped },
+        "cancel_run_stopped_ticket_sandboxes",
+      );
+    }
+    return stopped;
+  } catch (err) {
+    logger.warn(
+      { ticketKey, expectedBranch, error: (err as Error).message },
+      "cancel_run_sandbox_discovery_failed",
+    );
+    return 0;
+  }
+}
+
+async function getSandboxBranch(sandbox: {
+  runCommand: (
+    params: {
+      cmd: string;
+      args: string[];
+      cwd: string;
+    },
+  ) => Promise<{ exitCode: number; stdout: () => Promise<string> }>;
+}): Promise<string | null> {
+  try {
+    const result = await sandbox.runCommand({
+      cmd: "git",
+      args: ["rev-parse", "--abbrev-ref", "HEAD"],
+      cwd: "/vercel/sandbox",
+    });
+    if (result.exitCode !== 0) return null;
+    return (await result.stdout()).trim();
+  } catch {
+    return null;
+  }
+}