fix(timeout): apply CodeRabbit review fixes to dual timeout

- Math.min for both timeouts so config can lower below the defaults
  (absoluteTimeoutMs = min(configTimeout, AGENT_ABSOLUTE_TIMEOUT),
   idleTimeoutMs = min(AGENT_IDLE_TIMEOUT, absoluteTimeoutMs))
- One-shot kill guard: timeoutHandled boolean prevents double-fire
  when idle and absolute timers both trigger
- Timeout always resolves as error, even when hadStreamingOutput is true
  — hides the timeout from callers; index.ts outputSentToUser guard
  already prevents incorrect cursor rollback in this case
- Update test: 'absolute timeout after output' now asserts error status

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: b1rdmania

src/container-runner.test.ts

@@ -118,7 +118,7 @@ describe('container-runner timeout behavior', () => {
     vi.useRealTimers();
   });
 
-  it('absolute timeout after output resolves as success', async () => {
+  it('absolute timeout after output resolves as error', async () => {
     const onOutput = vi.fn(async () => {});
     const resultPromise = runContainerAgent(
       testGroup,
@@ -146,8 +146,9 @@ describe('container-runner timeout behavior', () => {
     await vi.advanceTimersByTimeAsync(10);
 
     const result = await resultPromise;
-    expect(result.status).toBe('success');
-    expect(result.newSessionId).toBe('session-123');
+    // Timeout always resolves as error — index.ts outputSentToUser guard prevents cursor rollback
+    expect(result.status).toBe('error');
+    expect(result.error).toContain('timed out');
     expect(onOutput).toHaveBeenCalledWith(
       expect.objectContaining({ result: 'Here is my response' }),
     );

src/container-runner.ts

@@ -361,13 +361,13 @@ export async function runContainerAgent(
     let timeoutReason: 'idle' | 'absolute' | null = null;
     let hadStreamingOutput = false;
     const configTimeout = group.containerConfig?.timeout || CONTAINER_TIMEOUT;
-    const idleTimeoutMs = Math.min(
-      AGENT_IDLE_TIMEOUT,
-      Math.max(configTimeout, AGENT_ABSOLUTE_TIMEOUT),
-    );
-    const absoluteTimeoutMs = Math.max(configTimeout, AGENT_ABSOLUTE_TIMEOUT);
+    const absoluteTimeoutMs = Math.min(configTimeout, AGENT_ABSOLUTE_TIMEOUT);
+    const idleTimeoutMs = Math.min(AGENT_IDLE_TIMEOUT, absoluteTimeoutMs);
 
+    let timeoutHandled = false;
     const killOnTimeout = (reason: 'idle' | 'absolute') => {
+      if (timeoutHandled) return;
+      timeoutHandled = true;
       timedOut = true;
       timeoutReason = reason;
       logger.error(
@@ -377,8 +377,15 @@ export async function runContainerAgent(
           : 'Agent absolute timeout — hard ceiling reached, killing process',
       );
       agentProcess.kill('SIGTERM');
+      agentProcess.once('close', () => {
+        // Process already dead, nothing more to do
+      });
       setTimeout(() => {
-        if (!agentProcess.killed) agentProcess.kill('SIGKILL');
+        try {
+          agentProcess.kill('SIGKILL');
+        } catch {
+          // already dead
+        }
       }, 15000);
     };
 
@@ -423,30 +430,25 @@ export async function runContainerAgent(
             ? `idle timeout (${idleTimeoutMs}ms no stdout)`
             : `absolute timeout (${absoluteTimeoutMs}ms ceiling)`;
 
-        if (hadStreamingOutput) {
-          logger.info(
-            { group: group.name, processName, duration, code, timeoutReason },
-            `Agent timed out after output (${timeoutLabel})`,
-          );
-          outputChain.then(() => {
-            resolve({
-              status: 'success',
-              result: null,
-              newSessionId,
-            });
-          });
-          return;
-        }
-
         logger.error(
-          { group: group.name, processName, duration, code, timeoutReason },
-          `Agent timed out with no output (${timeoutLabel})`,
+          {
+            group: group.name,
+            processName,
+            duration,
+            code,
+            timeoutReason,
+            hadStreamingOutput,
+          },
+          `Agent timed out (${timeoutLabel})`,
         );
 
-        resolve({
-          status: 'error',
-          result: null,
-          error: `Agent timed out after ${timeoutMs}ms (${timeoutLabel})`,
+        outputChain.then(() => {
+          resolve({
+            status: 'error',
+            result: null,
+            error: `Agent timed out after ${timeoutMs}ms (${timeoutLabel})`,
+            newSessionId,
+          });
         });
         return;
       }