[Fix] Sandbox tasks cannot connect or stop on LAN-hosted deployments

.docker/caddy/Caddyfile

@@ -50,8 +50,8 @@
 
 	handle @local_sandbox {
 		rewrite * {re.local_sandbox.2}
-		reverse_proxy host.docker.internal:18081 {
-			header_up Host {re.local_sandbox.1}-sandbox-server.roomotepreview.localhost:18081
+		reverse_proxy host.docker.internal:{$ROOMOTE_PREVIEW_PROXY_PORT:18081} {
+			header_up Host {re.local_sandbox.1}-sandbox-server.{$ROOMOTE_PREVIEW_DOMAIN:roomotepreview.localhost}:{$ROOMOTE_PREVIEW_PROXY_PORT:18081}
 			lb_try_duration 10s
 			lb_try_interval 250ms
 		}

SELF_HOSTING.md

@@ -238,6 +238,12 @@ the last upgrade without touching the database; the pre-upgrade bundle plus
 application and schema versions are visible under Settings -> Deployment ->
 Diagnostics.
 
+Use `roomote upgrade` instead of updating application image references alone.
+The upgrade refreshes the release's Compose and Caddy configuration together;
+mixing newer application images with an older Caddyfile can leave routes used
+by the new controller unavailable until the deployment configuration is also
+updated.
+
 `roomote upgrade` prunes old Roomote images after a successful upgrade. It
 keeps the current release plus the newest local Roomote image tags for a total
 of `ROOMOTE_IMAGE_RETENTION_RELEASES` retained tags (default `3`); set that

apps/controller/src/compute-providers/spawn-docker-worker.ts

@@ -5,6 +5,7 @@ import {
   TaskPayloadKind,
   NonRetryableSpawnError,
   getPrimaryPortFromConfig,
+  isLocalPreviewDomain,
   portNameToSlug,
   SANDBOX_SERVER_NAMED_PORT,
   TaskRunErrorCode,
@@ -804,6 +805,22 @@ export function buildDockerSandboxServerUrl(params: {
     return undefined;
   }
 
+  const localPreviewDomain = (() => {
+    try {
+      return isLocalPreviewDomain(
+        params.previewProxyBaseUrl
+          ? new URL(params.previewProxyBaseUrl).hostname
+          : null,
+      );
+    } catch {
+      return false;
+    }
+  })();
+
+  if (params.publicAppUrl && (!params.network || localPreviewDomain)) {
+    return `${params.publicAppUrl.replace(/\/+$/, '')}/_roomote-sandbox/${params.taskId}`;
+  }
+
   if (params.network && params.previewProxyBaseUrl) {
     return buildPreviewProxyUrl(
       params.taskId,
@@ -813,10 +830,6 @@ export function buildDockerSandboxServerUrl(params: {
     );
   }
 
-  if (!params.network && params.publicAppUrl) {
-    return `${params.publicAppUrl.replace(/\/+$/, '')}/_roomote-sandbox/${params.taskId}`;
-  }
-
   return undefined;
 }
 

apps/web/src/app/(sandbox)/task/[taskId]/prompt-input/PromptInput.tsx

@@ -61,6 +61,7 @@ import { TaskStatus } from './TaskStatus';
 
 const DRAFT_SAVE_DEBOUNCE_MS = 1_000;
 const KEEPALIVE_TOUCH_THROTTLE_MS = 10_000;
+const SANDBOX_CANCEL_TIMEOUT_MS = 10_000;
 
 export interface PromptInputHandle {
   focus: () => void;
@@ -120,6 +121,7 @@ export const PromptInput = forwardRef<PromptInputHandle, PromptInputProps>(
     const steeringQueuedMessageRef = useRef(false);
     const textareaRef = useRef<HTMLTextAreaElement | null>(null);
     const runId = taskRun?.id;
+    const taskId = taskRun?.taskId;
 
     const draftSaveTimerRef = useRef<ReturnType<typeof setTimeout> | null>(
       null,
@@ -357,18 +359,49 @@ export const PromptInput = forwardRef<PromptInputHandle, PromptInputProps>(
       cancellingRef.current = true;
 
       try {
-        await client?.commands.cancelTask.mutate({
-          cancelledBy: {
-            ...(cancelledByName ? { name: cancelledByName } : {}),
-            source: 'web',
-          },
+        if (client) {
+          try {
+            // A dead transport does not always reject quickly (it can hang
+            // for minutes on an unresponsive upstream), so bound the live
+            // cancellation before falling back to the web API.
+            await Promise.race([
+              client.commands.cancelTask.mutate({
+                cancelledBy: {
+                  ...(cancelledByName ? { name: cancelledByName } : {}),
+                  source: 'web',
+                },
+              }),
+              new Promise((_, reject) =>
+                setTimeout(
+                  () => reject(new Error('sandbox cancelTask timed out')),
+                  SANDBOX_CANCEL_TIMEOUT_MS,
+                ),
+              ),
+            ]);
+            return;
+          } catch (error) {
+            console.error('[sandbox] cancelTask error:', error);
+          }
+        }
+
+        if (!taskId) {
+          return;
+        }
+
+        const result = await trpcClient.taskRuns.cancel.mutate({
+          taskId,
+          runId,
         });
+
+        if (!result.success) {
+          throw new Error(result.error);
+        }
       } catch (err) {
-        console.error('[sandbox] cancelTask error:', err);
+        console.error('[sandbox] cancelTask fallback error:', err);
       } finally {
         cancellingRef.current = false;
       }
-    }, [client, cancelledByName]);
+    }, [client, cancelledByName, runId, taskId, trpcClient]);
 
     const handleSubmit = useCallback(
       async (message: PromptInputMessage) => {

apps/web/src/app/(sandbox)/task/[taskId]/prompt-input/useOptimisticPromptSubmission.ts

@@ -4,6 +4,7 @@ import { useCallback } from 'react';
 import { useQueryClient } from '@tanstack/react-query';
 
 import type { TaskMessageEnvelope } from '@/types';
+import { generateClientUuid } from '@/lib/client-uuid';
 import { useTRPC } from '@/trpc/client';
 
 import {
@@ -68,7 +69,7 @@ export function useOptimisticPromptSubmission() {
       images,
       location,
     }: StartOptimisticPromptSubmissionInput) => {
-      const clientMessageId = globalThis.crypto.randomUUID();
+      const clientMessageId = generateClientUuid();
       const optimisticPrompt = createOptimisticPromptArtifacts({
         taskId,
         prompt,