docker/podman exec still report exitCode 0 when the engine CLI is SIGTERM'd (gap in #1511) #1614

Follow-up to #933 / #1511. #1511 makes a signal-killed engine CLI report exitCode 1, but the real docker and podman CLIs catch SIGTERM (docker also SIGINT) and exit 0. So an exec interrupted that way still looks like a success.

Repro

const sb = await createSandbox({ branch: "x", sandbox: docker({ imageName }) }); // or podman()
// ~3 s later, from outside: kill -TERM <pid of the host `docker exec … sh -c "echo partial; sleep 40"`>
const r = await sb.exec("echo partial; sleep 40");
r.exitCode; // 0, stdout "partial\n", after ~3 s

Same with { onLine }. With kill -KILL, exitCode is 1, so #1511 works there.

Outside Sandcastle:

Node sees close(0, null), so the code ?? 1 from #1511 never fires.

Why the test passes: tests/helpers/fakeEngine.ts's fake exec does kill -TERM $$ and dies of the signal; real engines don't.

Suspected code: src/sandboxes/docker.ts:286-340, src/sandboxes/podman.ts:383-435 trust the CLI's exit code.

Possible fixes

• wrap the command so the in-container shell reports its own status as a sentinel (sh -c '<cmd>; echo "__sc_exit=$?" >&2') and treat a missing sentinel as failure;
• or inspect the exec's ExitCode / Running.

At minimum, make the fake engine model a CLI that traps the signal and exits 0.

Severity low–medium: it needs a signal delivered to the engine CLI child alone (a supervisor, a timeout wrapper, an operator kill). Ctrl-C on the process group goes through Sandcastle's shutdown handler and is fine.

This issue was written by an AI agent (Claude Code) during a verification run on ed8e716.