Fix Docker volume leak on SIGTERM, SIGHUP, and concurrent cleanup

[cegofrhs]

Summary

• Add SIGTERM and SIGHUP signal handlers — closing a terminal (SIGHUP) or kill <pid> (SIGTERM) previously terminated the process without running cleanup, leaving orphaned gcl-*-build and gcl-*-tmp Docker volumes
• Consolidate signal/error cleanup into a guarded cleanupAndExit() — eliminates the race condition where Ctrl+C triggered cleanup from both the SIGINT handler and the error catch block concurrently, with process.exit() from the winner killing the loser mid-flight before docker volume rm
• Add re-entry guard on Job.cleanupResources() — concurrent callers now share the same cleanup promise instead of racing on docker rm vs docker volume rm ordering

Test plan

• tsc --noEmit passes (no new errors in src/)
• bun run lint passes
• bun run build passes
• bun test tests/test-cases/artifacts-docker/ passes (exercises Docker volume creation/cleanup)
• bun test tests/test-cases/list-case/ passes
• bun test tests/test-cases/preview/ passes
• Manual: run a Docker job, press Ctrl+C, verify no orphaned gcl-* volumes remain
• Manual: run a Docker job, close the terminal, verify no orphaned gcl-* volumes remain

---

Summary by cubic

Stops leaking Docker volumes by running a single, guarded cleanup on SIGINT, SIGTERM, SIGHUP, and error exits. Prevents orphaned gcl-* volumes and avoids hangs from concurrent cleanup or cleanup failures.

• Bug Fixes
  • Route SIGINT, SIGTERM, and SIGHUP to one cleanupAndExit with exit codes 130, 143, 129; first caller's exit code wins.
  • Share a cleanup promise in Job.cleanupResources to prevent concurrent cleanup and docker rm vs docker volume rm races.
  • Use the same cleanup for error exits; keep SIGUSR2 for nodemon-only cleanup and no-op if termination cleanup is in flight.
  • Always call process.exit via .finally() so signals don't hang if cleanup throws.

^{Written for commit b4a527f. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/index.ts">

<violation number="1" location="src/index.ts:21">
P2: cleanupAndExit caches a rejected promise and never calls process.exit when cleanupJobResources fails, so a failed cleanup can leave the process running and future signals become no-ops.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Add one-off context when rerunning by tagging @cubic-dev-ai with guidance or docs links (including llms.txt)
• Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[firecow]

Nice fix — the core change is solid and well-scoped. A few minor suggestions below.

(Correction from earlier: point 3 about clearTimeout only running on the first call was wrong — it's before the re-entry guard and runs every time. Point 5 about a cleanup timeout is out of scope for this PR.)

[firecow]

Tested locally — all CI checks pass, both manual signal tests (SIGINT and SIGHUP) confirmed no orphaned Docker volumes.