fix(sandbox): self-exit on failed init and lock in error-key handling

Author: manast

src/classes/child-pool.ts

@@ -71,7 +71,12 @@ export class ChildPool {
       // be released back into the free pool, otherwise it becomes a "zombie"
       // that is reused for every subsequent job and fails them instantly.
       // Kill and remove it so a fresh child is forked on the next retain.
-      this.kill(child, 'SIGKILL').catch(() => {});
+      // The child also exits itself after a failed init (see ChildProcessor),
+      // so this is normally a no-op; log any kill failure instead of silently
+      // swallowing it so a lingering child would not go unnoticed.
+      this.kill(child, 'SIGKILL').catch(killErr => {
+        console.error('Failed to kill child after init error:', killErr);
+      });
       throw err;
     }
   }

src/classes/child-processor.ts

@@ -52,10 +52,18 @@ export class ChildProcessor {
       }
     } catch (err) {
       this.status = ChildStatus.Errored;
-      return this.send({
+      await this.send({
         cmd: ParentCommand.InitFailed,
         err: errorToJSON(err),
       });
+      // A child that failed to initialize cannot recover, and because the open
+      // IPC channel keeps its event loop alive it would never exit on its own.
+      // Exit explicitly (after the InitFailed message has been flushed) so the
+      // parent can never reuse a half-initialized "zombie" child. This is a
+      // belt-and-braces measure: ChildPool also kills the child, but exiting
+      // here guarantees termination even if the parent-side kill were to fail.
+      // In a worker thread this stops only the current worker, not the process.
+      process.exit(process.exitCode || 0);
     }
 
     const origProcessor = processor;

tests/sandboxed_process.test.ts

@@ -1,6 +1,7 @@
 import { pathToFileURL } from 'url';
 import { default as IORedis } from 'ioredis';
 import { after } from 'lodash';
+import { EventEmitter } from 'events';
 import {
   describe,
   beforeEach,
@@ -20,8 +21,15 @@ import {
   UNRECOVERABLE_ERROR,
   Worker,
 } from '../src/classes';
+import sandbox from '../src/classes/sandbox';
+import { ParentCommand } from '../src/enums';
 
-import { delay, randomUUID, removeAllQueueData } from '../src/utils';
+import {
+  delay,
+  errorToJSON,
+  randomUUID,
+  removeAllQueueData,
+} from '../src/utils';
 import { existsSync, unlinkSync, writeFileSync } from 'fs';
 const { stdout, stderr } = require('test-console');
 
@@ -229,6 +237,45 @@ describe('Sandboxed process using worker threads', () => {
   });
 });
 
+describe('Sandbox error message handling', () => {
+  // A child that refuses a Start (e.g. 'cannot start a not idling child
+  // process') reports the reason via ParentCommand.Error, whose payload is
+  // carried under the `err` key — unlike ParentCommand.Failed which uses
+  // `value`. The sandbox message handler must read from either key so the
+  // reason is never lost as an empty-message error. This guards the
+  // `msg.value ?? msg.err` fix independently of the child lifecycle, since the
+  // refusal path is otherwise hard to reach once init-failed children exit.
+  it('propagates the reason when ParentCommand.Error uses the `err` key', async () => {
+    const reason = 'cannot start a not idling child process';
+
+    const fakeChild: any = new EventEmitter();
+    fakeChild.exitCode = null;
+    fakeChild.signalCode = null;
+    fakeChild.processFile = 'fake-process-file';
+    fakeChild.pid = 1;
+    fakeChild.send = () => {
+      // Simulate the child refusing the Start command and reporting the reason
+      // under `err` (ParentCommand.Error), not `value` (ParentCommand.Failed).
+      queueMicrotask(() => {
+        fakeChild.emit('message', {
+          cmd: ParentCommand.Error,
+          err: errorToJSON(new Error(reason)),
+        });
+      });
+    };
+
+    const fakeChildPool: any = {
+      retain: async () => fakeChild,
+      release: () => {},
+    };
+
+    const processFn = sandbox('fake-process-file', fakeChildPool);
+    const fakeJob: any = { asJSONSandbox: () => ({}) };
+
+    await expect(processFn(fakeJob)).rejects.toThrow(reason);
+  });
+});
+
 function sandboxProcessTests(
   { useWorkerThreads } = { useWorkerThreads: false },
 ) {