daemon: seed repo volume via CopyToContainer (host-path bind bug → empty workspace); web: spawn poll reads fresh session list

.playwright-mcp/console-2026-08-18T14-24-41-868Z.log

@@ -0,0 +1,2 @@
+[  629625ms] [ERROR] Failed to load resource: the server responded with a status of 409 (Conflict) @ http://tailalarm:8686/api/sessions/d2142e72-e30f-4cbb-88b4-f1d9d0aa8e50/prompt:0
+[  694902ms] [ERROR] Failed to load resource: the server responded with a status of 409 (Conflict) @ http://tailalarm:8686/api/sessions/d2142e72-e30f-4cbb-88b4-f1d9d0aa8e50/prompt:0

daemon/docker.go

@@ -424,37 +424,32 @@ func (s *Spawner) ensureRepoVolume(ctx context.Context, name string) (bool, erro
 	return true, nil
 }
 
-// seedVolume copies the cloned repo into the fresh named volume via a
+// seedVolume populates the fresh named volume with the cloned repo by
-// one-shot container from the worker image (no extra images needed).
+// streaming a tar of the clone into a paused container via the docker API
+// (CopyToContainer). No bind mounts: bind sources are HOST paths, but the
+// clone lives inside the daemon container's filesystem.
 func (s *Spawner) seedVolume(ctx context.Context, slug, repoVolume string) error {
 	repoDir := filepath.Join(s.reposDir, slug)
 	cfg := &container.Config{
 		Image: imageRefWorker,
-		Cmd:   []string{"sh", "-c", "cp -a /src/. " + workspaceMount + "/"},
+		Cmd:   []string{"true"}, // never started; created only as a volume mount point
 	}
 	hostCfg := &container.HostConfig{
-		Binds: []string{
+		Binds: []string{repoVolume + ":" + workspaceMount},
-			repoVolume + ":" + workspaceMount,
-			repoDir + ":/src:ro",
-		},
 	}
 	created, err := s.cli.ContainerCreate(ctx, cfg, hostCfg, nil, nil, "lvmh-seed-"+slug)
 	if err != nil {
 		return err
 	}
 	defer s.removeContainer(context.Background(), created.ID)
-	if err := s.cli.ContainerStart(ctx, created.ID, container.StartOptions{}); err != nil {
+	var buf bytes.Buffer
-		return err
+	if err := tarDir(&buf, repoDir); err != nil {
+		return fmt.Errorf("tar clone: %w", err)
 	}
-	waitCh, errCh := s.cli.ContainerWait(ctx, created.ID, container.WaitConditionNotRunning)
+	if err := s.cli.CopyToContainer(ctx, created.ID, workspaceMount, &buf, container.CopyToContainerOptions{}); err != nil {
-	select {
+		return fmt.Errorf("copy into volume: %w", err)
-	case <-waitCh:
-		return nil
-	case err := <-errCh:
-		return err
-	case <-ctx.Done():
-		return ctx.Err()
 	}
+	return nil
 }
 
 func (s *Spawner) removeContainer(ctx context.Context, id string) {

daemon/docker_test.go

@@ -44,11 +44,12 @@ type recordedCreate struct {
 type fakeDocker struct {
 	mu sync.Mutex
 
-	calls  []dockerCall
+	calls    []dockerCall
-	images int             // entries served by GET /images/json
+	images   int             // entries served by GET /images/json
-	volume map[string]bool // existing volumes
+	volume   map[string]bool // existing volumes
-	nextID int
+	nextID   int
-	create []recordedCreate
+	create   []recordedCreate
+	archives []int // sizes of accepted CopyToContainer tar streams
 
 	failBuild        bool
 	failBuildHTTP    bool
@@ -57,6 +58,8 @@ type fakeDocker struct {
 	failStop         bool
 	failWait         bool
 	failVolumeCreate bool
+	failArchive      bool
+	archiveHang      bool
 	waitHang         bool
 
 	unknown []string
@@ -241,6 +244,20 @@ func (f *fakeDocker) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		writeJSONNow(w, http.StatusOK, `{"StatusCode":0,"Error":null}`)
+	case call.Method == http.MethodPut && strings.HasSuffix(call.Path, "/archive"):
+		// CopyToContainer: accept the tar stream and record its size.
+		if f.archiveHang {
+			<-r.Context().Done()
+			return
+		}
+		if f.failArchive {
+			writeJSONNow(w, http.StatusInternalServerError, `{"message":"archive failed"}`)
+			return
+		}
+		f.mu.Lock()
+		f.archives = append(f.archives, len(body))
+		f.mu.Unlock()
+		w.WriteHeader(http.StatusOK)
 	case call.Method == http.MethodDelete && strings.HasPrefix(call.Path, "/containers/"):
 		w.WriteHeader(http.StatusNoContent)
 	default:
@@ -273,11 +290,13 @@ func useFakeGit(t *testing.T, mode string) string {
 		"  noisy) printf '%s\\n' \"" + strings.Repeat("x", 600) + "\"; exit 1;;\n" +
 		"  silent) exit 1;;\n" +
 		"esac\n" +
+		"# clone: create a real worktree so seeding (tarDir) has files to copy\n" +
+		"if [ \"$1\" = clone ]; then d=$(eval \"echo \\${$#}\"); mkdir -p \"$d\" && printf 'fake-repo\n' > \"$d/README.md\"; fi\n" +
 		"exit 0\n"
 	if err := os.WriteFile(filepath.Join(dir, "git"), []byte(script), 0o755); err != nil {
 		t.Fatalf("write fake git: %v", err)
 	}
-	t.Setenv("PATH", dir)
+	t.Setenv("PATH", dir+":"+os.Getenv("PATH"))
 	t.Setenv("FAKE_GIT_MODE", mode)
 	return logPath
 }

daemon/spawner_test.go

@@ -13,6 +13,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -89,16 +90,20 @@ func TestSpawnerStartHappyPath(t *testing.T) {
 		t.Fatalf("network = %q", c.HostConfig.NetworkMode)
 	}
 
-	// fresh repo volume seeded from the clone via a one-shot container
+	// fresh repo volume seeded from the clone via CopyToContainer (tar)
 	seed := f.createsByName("lvmh-seed-")
 	if len(seed) != 1 {
 		t.Fatalf("seed containers = %+v", seed)
 	}
-	if seed[0].Image != imageRefWorker || len(seed[0].Cmd) == 0 || !strings.Contains(seed[0].Cmd[len(seed[0].Cmd)-1], workspaceMount) {
+	if seed[0].Image != imageRefWorker {
 		t.Fatalf("seed create = %+v", seed[0])
 	}
-	if !strings.HasPrefix(seed[0].HostConfig.Binds[1], sp.reposDir) {
+	wantSeedBinds := []string{"lvmh-repo-group-project:" + workspaceMount}
-		t.Fatalf("seed binds = %v, want clone dir mounted at /src", seed[0].HostConfig.Binds)
+	if !reflect.DeepEqual(seed[0].HostConfig.Binds, wantSeedBinds) {
+		t.Fatalf("seed binds = %v, want %v (no host-path binds)", seed[0].HostConfig.Binds, wantSeedBinds)
+	}
+	if len(f.archives) != 1 || f.archives[0] == 0 {
+		t.Fatalf("CopyToContainer archives = %v, want one non-empty tar", f.archives)
 	}
 
 	// no build expected (fake daemon already has the image)
@@ -204,11 +209,11 @@ func TestSpawnerRunJobErrorStates(t *testing.T) {
 			wantMsg: "volume create failed",
 		},
 		{
-			name: "seed-wait-fails",
+			name: "seed-copy-fails",
 			setup: func(t *testing.T, f *fakeDocker) {
-				f.failWait = true
+				f.failArchive = true
 			},
-			wantMsg: "wait failed",
+			wantMsg: "copy into volume",
 		},
 	}
 	for _, tc := range cases {
@@ -315,17 +320,23 @@ func TestSpawnerRemoveSession(t *testing.T) {
 	f.assertNoUnknown(t)
 }
 
-func TestSpawnerSeedVolumeWaitContextCancel(t *testing.T) {
+func TestSpawnerSeedVolumeCancel(t *testing.T) {
 	useFakeGit(t, fakeGitModeOK)
 	f := newFakeDocker()
-	f.waitHang = true // server never answers wait
+	f.archiveHang = true // server never answers the archive PUT
 	sp, _ := newTestSpawner(t, f)
+	if err := os.MkdirAll(filepath.Join(sp.reposDir, "group-project"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(sp.reposDir, "group-project", "README.md"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	done := make(chan error, 1)
 	go func() { done <- sp.seedVolume(ctx, "group-project", "lvmh-repo-group-project") }()
-	waitFor(t, 5*time.Second, func() bool { return f.hasCallSuffix(http.MethodPost, "/wait") })
+	waitFor(t, 5*time.Second, func() bool { return f.hasCallSuffix(http.MethodPut, "/archive") })
 	cancel()
 	select {
 	case err := <-done:

web/src/SpawnView.test.tsx

@@ -203,11 +203,29 @@ describe("SpawnView spawn+poll", () => {
 
 	it("spawns, polls until online, then navigates to the chat", async () => {
 		const posts: Array<[string, RequestInit | undefined]> = [];
+		let sessionsOnline = false; // flipped after the first poll tick
 		mockFetchJson((url, init) => {
 			if (init?.method === "POST" && url.endsWith("/api/spawn")) {
 				posts.push([url, init]);
 				return { sessionId: "new-1", containerId: "abc123def456" };
 			}
+			if (url.endsWith("/api/sessions"))
+				return sessionsOnline
+					? [
+							{
+								id: "new-1",
+								name: "spawned",
+								cwd: "/w",
+								model: "m",
+								provider: "p",
+								agent: true,
+								repo: "g/proj",
+								startedAt: 1,
+								online: true,
+								lastEventAt: 1,
+							},
+						]
+					: [];
 			if (url.endsWith("/api/spawn/status")) return [];
 			if (url.endsWith("/api/gitlab/status"))
 				return { connected: true, baseUrl: "https://gl", username: "alice" };
@@ -239,20 +257,7 @@ describe("SpawnView spawn+poll", () => {
 		expect(screen.queryByTestId("chat-route")).toBeNull();
 
 		// session comes online -> next tick navigates
-		store.sessions = [
+		sessionsOnline = true;
-			{
-				id: "new-1",
-				name: "spawned",
-				cwd: "/w",
-				model: "m",
-				provider: "p",
-				agent: true,
-				repo: "g/proj",
-				startedAt: 1,
-				online: true,
-				lastEventAt: 1,
-			},
-		];
 		await act(async () => {
 			vi.advanceTimersByTime(1500);
 		});

web/src/SpawnView.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useRef, useState } from "react";
 import { useNavigate } from "react-router-dom";
-import type { GitlabStatus, Repo, SpawnJob, SpawnResponse } from "./protocol";
+import type { GitlabStatus, Repo, SessionListItem, SpawnJob, SpawnResponse } from "./protocol";
 import { Route } from "./protocol";
 import { errMessage, fetchJson } from "./api";
 import type { SessionsStore } from "./store";
@@ -115,9 +115,9 @@ export default function SpawnView({ store, pushToast }: Props) {
       }
       void (async () => {
         try {
-          await fetchJson<SpawnJob[]>(Route.SpawnStatus).catch(() => undefined);
+          const list = await fetchJson<SessionListItem[]>(Route.Sessions);
+          const s = list.find((x) => x.id === sessionId);
           await store.refresh();
-          const s = store.sessions.find((x) => x.id === sessionId);
           if (s !== undefined && s.online) {
             if (timerRef.current !== null) window.clearInterval(timerRef.current);
             timerRef.current = null;