fix(sandboxes): key the build trigger by attempt, not by spec

Cursor Bugbot. The Trigger.dev idempotency key was the content address alone, so a
second attempt at the same spec was deduped against the first: the SDK returns the
finished run instead of starting one, and the row that `ensureSandboxImage` just
flipped to `pending` sits there with no worker. Nothing can re-claim a `pending`
row until it goes stale, so a retry inside the 5-minute TTL did nothing for the
next half hour.

That silently disabled every repair path — save-to-retry, which the docs name
explicitly, and both the resolution and create-time rebuilds.

The key's own comment already said it exists "to collapse concurrent saves of the
same spec into one build, not to suppress a retry after one failed". The conditional
update above it is what actually collapses concurrent saves: only one caller gets a
row back, so only one ever reaches the trigger. Keying by the claim's `updatedAt`
keeps that property and makes each genuine attempt distinct, while a duplicate
delivery of one attempt still collapses.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/execution/remote-sandbox/image-registry.test.ts

@@ -67,6 +67,7 @@ import {
   ensureSandboxImage,
   FAILED_BUILD_RETRY_COOLDOWN_MS,
   releaseSandboxImage,
+  sandboxBuildIdempotencyKey,
 } from '@/lib/execution/remote-sandbox/image-registry'
 
 const READY_IMAGE = {
@@ -404,3 +405,34 @@ describe('ensureSandboxImage failed-build cooldown', () => {
     expect(branch).not.toContain('failed')
   })
 })
+
+/**
+ * The claim already collapses concurrent saves, so the trigger key only has to
+ * distinguish attempts. Keyed by spec alone it suppressed the next legitimate one
+ * instead — Trigger.dev returns the finished run, the row stays `pending` with no
+ * worker, and nothing can re-claim it until it goes stale.
+ */
+describe('sandboxBuildIdempotencyKey', () => {
+  it('differs between two attempts at the same spec', () => {
+    const first = sandboxBuildIdempotencyKey('e2b', 'hash-1', new Date(1_000))
+    const second = sandboxBuildIdempotencyKey('e2b', 'hash-1', new Date(2_000))
+
+    expect(first).not.toBe(second)
+  })
+
+  it('still collapses a duplicate delivery of one attempt', () => {
+    const attemptAt = new Date(1_000)
+
+    expect(sandboxBuildIdempotencyKey('e2b', 'hash-1', attemptAt)).toBe(
+      sandboxBuildIdempotencyKey('e2b', 'hash-1', attemptAt)
+    )
+  })
+
+  it('keeps providers apart for the same content address', () => {
+    const attemptAt = new Date(1_000)
+
+    expect(sandboxBuildIdempotencyKey('e2b', 'hash-1', attemptAt)).not.toBe(
+      sandboxBuildIdempotencyKey('daytona', 'hash-1', attemptAt)
+    )
+  })
+})

apps/sim/lib/execution/remote-sandbox/image-registry.ts

@@ -43,8 +43,12 @@ export interface SandboxImageBuildPayload {
  * so two workspaces declaring identical dependencies share the key as well as
  * the resulting image.
  */
-export function sandboxBuildIdempotencyKey(provider: string, specHash: string): string {
-  return `sandbox-image-${provider}-${specHash}`
+export function sandboxBuildIdempotencyKey(
+  provider: string,
+  specHash: string,
+  attemptAt: Date
+): string {
+  return `sandbox-image-${provider}-${specHash}-${attemptAt.getTime()}`
 }
 
 /**
@@ -151,16 +155,23 @@ export async function ensureSandboxImage(
         )
       ),
     })
-    .returning({ id: sandboxImage.id, status: sandboxImage.status })
+    .returning({
+      id: sandboxImage.id,
+      status: sandboxImage.status,
+      updatedAt: sandboxImage.updatedAt,
+    })
 
   // No row returned means the conflict target matched but `setWhere` rejected the
   // update — an existing `ready`, `pending`, or `building` row. Nothing to do.
   if (inserted.length === 0) return
 
-  await enqueueSandboxImageBuild({ provider: provider.id, specHash })
+  await enqueueSandboxImageBuild({ provider: provider.id, specHash }, inserted[0].updatedAt)
 }
 
-async function enqueueSandboxImageBuild(payload: SandboxImageBuildPayload): Promise<void> {
+async function enqueueSandboxImageBuild(
+  payload: SandboxImageBuildPayload,
+  attemptAt: Date
+): Promise<void> {
   if (!isTriggerDevEnabled) {
     runDetached('sandbox-image-build', () => runSandboxImageBuild(payload))
     return
@@ -172,10 +183,14 @@ async function enqueueSandboxImageBuild(payload: SandboxImageBuildPayload): Prom
     import('@/lib/core/async-jobs/region'),
   ])
   await tasks.trigger<typeof sandboxImageBuildTask>('sandbox-image-build', payload, {
-    idempotencyKey: sandboxBuildIdempotencyKey(payload.provider, payload.specHash),
-    // Short TTL on purpose: the key exists to collapse concurrent saves of the
-    // same spec into one build, not to suppress a retry after one failed. The
-    // default 30-day window would make a transient failure permanent.
+    // Keyed by the claim, not by the spec alone. Concurrent saves are already
+    // collapsed by the conditional update above — only one caller gets a row back,
+    // so only one reaches here. A spec-only key would instead suppress the *next*
+    // legitimate attempt: Trigger.dev returns the finished run rather than starting
+    // one, leaving the row `pending` with no worker and unclaimable until it goes
+    // stale. That is half an hour of a save-to-retry doing nothing.
+    idempotencyKey: sandboxBuildIdempotencyKey(payload.provider, payload.specHash, attemptAt),
+    // Still short, so even a duplicate delivery of one attempt cannot linger.
     idempotencyKeyTTL: '5m',
     tags: [`sandboxSpec:${payload.specHash}`],
     region: await resolveTriggerRegion(),