@limrun/api 0.30.0 → 0.31.1

package/src/resources/xcode-instances-helpers.ts

@@ -4,6 +4,7 @@ import crypto from 'crypto';
 
 import { XcodeInstances as GeneratedXcodeInstances, type XcodeInstance } from './xcode-instances';
 import { type IosInstance } from './ios-instances';
+import { parseTopLevelIpaDigest } from '../rbe-bep';
 import { exec, type ExecChildProcess, type ExecRequest } from '../exec-client';
 import {
   syncFolder as syncFolderImpl,
@@ -13,7 +14,11 @@ import {
 import { createIgnoreFn } from '../folder-sync-ignore';
 import { nodeProxyTransport } from '../internal/proxy-transport';
 import { directInstanceHttpError } from '../internal/direct-instance-errors';
+import { LimrunError } from '../core/error';
 import { validateBuildSettings } from '../build-settings';
+import { startTcpTunnel, type Tunnel } from '../tunnel';
+
+export type { Tunnel } from '../tunnel';
 
 export type LogLevel = 'none' | 'error' | 'warn' | 'info' | 'debug';
 
@@ -138,6 +143,64 @@ export type SimulatorAttachResult = {
   installError?: string;
 };
 
+/**
+ * Status of the instance's embedded Bazel Remote Build Execution stack, as
+ * reported by limbuild's /rbe endpoints.
+ */
+export type RbeStatus = {
+  state: 'stopped' | 'starting' | 'running' | 'failed';
+  /** Loopback port of the RBE gRPC frontend inside the instance, when running. */
+  frontendPort?: number;
+  /**
+   * The Xcode version key remote actions must declare via
+   * XCODE_VERSION_OVERRIDE (e.g. 26.4.0.17E192), when running. Clients
+   * generate their xcode_version_config from it.
+   */
+  xcodeVersion?: string;
+  error?: string;
+};
+
+/** Default local TCP port the RBE tunnel listens on. */
+export const DEFAULT_RBE_TUNNEL_PORT = 8980;
+
+export type RbeStartOptions = {
+  /** Max size of the content-addressable store (CAS), in bytes. */
+  casMaxBytes?: number;
+  /** Max size of the action cache (AC), in bytes. */
+  acMaxBytes?: number;
+  /** Number of concurrent build actions the embedded worker runs. */
+  workerConcurrency?: number;
+};
+
+export type RbeTunnelOptions = {
+  /** Local port to listen on. Defaults to DEFAULT_RBE_TUNNEL_PORT (8980). */
+  port?: number;
+  /** Local address to listen on. Defaults to 127.0.0.1. */
+  host?: string;
+  logLevel?: LogLevel;
+};
+
+/** Content-addressed digest of a build artifact in the instance's RBE cache. */
+type RbeArtifactDigest = {
+  /** Lowercase hex SHA-256 of the blob (matches --digest_function=sha256). */
+  hash: string;
+  /** Size of the blob in bytes. */
+  sizeBytes: number;
+};
+
+export type RbeInstallResult = {
+  /** True when the app was synced and installed on the attached simulator. */
+  installed: boolean;
+  /** CFBundleIdentifier of the installed app, as reported by the simulator. */
+  bundleId?: string;
+  /** The .app bundle name discovered inside the .ipa (Payload/<appName>.app). */
+  appName?: string;
+  /** Differential-sync duration in milliseconds. */
+  syncDurationMs?: number;
+  /** Simulator install duration in milliseconds. */
+  installDurationMs?: number;
+};
+
 export type XcodeClient = {
   /**
    * Sync source code to the xcode instance. In watch mode, keeps syncing on changes.
@@ -157,7 +220,9 @@ export type XcodeClient = {
 
   /**
    * Attach a simulator to this xcode instance.
-   * After attaching, builds will auto-install on the simulator.
+   * After attaching, the latest xcodebuild build (if any) is installed on the
+   * simulator. RBE builds are not auto-installed on attach — install them
+   * explicitly with `installRbeBuildFromBep` while a simulator is attached.
    */
   attachSimulator: (
     simulator: IosInstance | { apiUrl: string; token: string },
@@ -167,6 +232,52 @@ export type XcodeClient = {
    * Return the currently attached simulator and latest installable build state.
    */
   getSimulator: () => Promise<SimulatorStatus>;
+
+  /**
+   * Start the instance's embedded Bazel Remote Build Execution stack.
+   * Idempotent: returns the running status when already up.
+   */
+  startRbe: (opts?: RbeStartOptions) => Promise<RbeStatus>;
+
+  /** Return the current RBE stack status. */
+  getRbe: () => Promise<RbeStatus>;
+
+  /** Stop the RBE stack. */
+  stopRbe: () => Promise<RbeStatus>;
+
+  /**
+   * Install a Bazel RBE build on the attached simulator, server-side, from its
+   * build event log (BEP). Parses the top-level `.ipa`'s CAS digest for `target`
+   * out of `bep` (the contents of `--build_event_json_file`); the instance fetches
+   * the blob from its embedded cache, unpacks the .app, and pushes it to the
+   * attached simulator via the differential-sync path — no client round-trip.
+   * Requires a running RBE stack and an attached simulator (installed=false when
+   * none is attached — attach one and call again). Throws a descriptive error if
+   * the target/.ipa is absent, was downloaded locally, or was built with a
+   * non-SHA256 digest (e.g. BLAKE3) the instance cache can't resolve. `ipaName` is
+   * the `.ipa` file name Bazel reported.
+   */
+  installRbeBuildFromBep: (opts: {
+    bep: string;
+    target: string;
+  }) => Promise<RbeInstallResult & { ipaName: string }>;
+
+  /**
+   * Open a local TCP listener bridged to the instance's RBE gRPC frontend
+   * over a multiplexed websocket. Point bazel at it with
+   * --remote_executor=grpc://127.0.0.1:<port>.
+   */
+  startRbeTunnel: (opts?: RbeTunnelOptions) => Promise<Tunnel>;
+
+  /**
+   * Create a new iOS simulator instance and attach it to this xcode instance.
+   * Deletes the simulator if attach fails so it is never leaked. Returns the new
+   * simulator's instance id (record it for teardown) and the instance itself.
+   */
+  attachNewSimulator: () => Promise<{ iosInstanceId: string; simulator: IosInstance }>;
+
+  /** Best-effort delete of a simulator instance. Never throws; returns success. */
+  deleteSimulator: (iosInstanceId: string) => Promise<boolean>;
 };
 
 export type XcodeCreateClientParams =
@@ -221,6 +332,57 @@ async function fetchSandboxInfo(apiUrl: string, token: string): Promise<{ homeDi
   };
 }
 
+/**
+ * Derives the websocket URL of limbuild's /rbe/tunnel endpoint from the
+ * instance apiUrl, mirroring deriveReverseTunnelUrl in ios-client.ts.
+ */
+export function deriveRbeTunnelUrl(apiUrl: string): string {
+  const url = new URL(apiUrl);
+  if (url.protocol === 'https:') {
+    url.protocol = 'wss:';
+  } else if (url.protocol === 'http:') {
+    url.protocol = 'ws:';
+  } else {
+    throw new Error(`Unsupported apiUrl protocol for rbe tunnel: ${url.protocol}`);
+  }
+  url.pathname = `${url.pathname.replace(/\/+$/, '')}/rbe/tunnel`;
+  url.search = '';
+  url.hash = '';
+  // The tunnel layer (startMultiplexedTcpTunnel) appends mode=multiplexed to
+  // the URL itself, so we don't set it here.
+  return url.toString();
+}
+
+/**
+ * Raised when an `/rbe` request returns 404. limbuild's `/rbe` routes only
+ * exist on builds with remote-execution support, so a 404 there means RBE is
+ * unavailable on this instance (an older limbuild, or the wrong environment) —
+ * NOT that the instance is missing. Kept distinct from NotFoundError so the CLI
+ * does not mistake it for a vanished instance and spin up replacements.
+ */
+export class RbeUnsupportedError extends LimrunError {
+  constructor(operation: string) {
+    super(
+      `Remote build execution is not available on this Xcode instance (${operation} returned 404). ` +
+        'Its limbuild may predate RBE support, or you may be targeting the wrong environment ' +
+        '(for example production instead of staging).',
+    );
+    this.name = 'RbeUnsupportedError';
+  }
+}
+
+/**
+ * Reads an `/rbe` JSON response, mapping a 404 to RbeUnsupportedError (a route
+ * 404 means RBE is not supported here, never a missing instance).
+ */
+async function readRbeResponse<T>(res: Response, operation: string): Promise<T> {
+  if (res.status === 404) {
+    await res.text().catch(() => undefined);
+    throw new RbeUnsupportedError(operation);
+  }
+  return readJsonResponse<T>(res, operation);
+}
+
 async function readJsonResponse<T>(res: Response, operation: string): Promise<T> {
   const text = await res.text();
   if (!res.ok) {
@@ -255,6 +417,84 @@ export class XcodeInstances extends GeneratedXcodeInstances {
       return sandboxInfoPromise;
     };
 
+    // Shared local closures. The methods below live in an object literal over
+    // these closures (not `this`), so anything reused across methods is defined
+    // here once and called from each method.
+    const postRbeInstall = async (
+      ipaDigest: RbeArtifactDigest,
+      target?: string,
+    ): Promise<RbeInstallResult> => {
+      const res = await nodeProxyTransport.fetch(`${apiUrl}/rbe/install`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${token}`,
+        },
+        body: JSON.stringify({ ipaDigest, ...(target ? { target } : {}) }),
+      });
+      return readRbeResponse<RbeInstallResult>(res, 'POST /rbe/install');
+    };
+
+    const installFromBep = async (
+      bep: string,
+      target: string,
+    ): Promise<RbeInstallResult & { ipaName: string }> => {
+      const digest = parseTopLevelIpaDigest(bep, target); // throws BLAKE3 / no-ipa errors
+      const result = await postRbeInstall({ hash: digest.hash, sizeBytes: digest.sizeBytes }, target);
+      return { ...result, ipaName: digest.ipaName };
+    };
+
+    const attachSimulatorImpl = async (
+      simulator: IosInstance | { apiUrl: string; token: string },
+    ): Promise<SimulatorAttachResult> => {
+      let simApiUrl: string;
+      let simToken: string;
+      if ('status' in simulator) {
+        if (!simulator.status.apiUrl) {
+          throw new Error('Simulator instance not ready: apiUrl is not available');
+        }
+        simApiUrl = simulator.status.apiUrl;
+        simToken = simulator.status.token;
+      } else {
+        simApiUrl = simulator.apiUrl;
+        simToken = simulator.token;
+      }
+      const res = await nodeProxyTransport.fetch(`${apiUrl}/simulator`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${token}`,
+        },
+        body: JSON.stringify({ apiUrl: simApiUrl, token: simToken }),
+      });
+      return readJsonResponse<SimulatorAttachResult>(res, 'POST /simulator');
+    };
+
+    const deleteSimulatorImpl = async (iosInstanceId: string): Promise<boolean> => {
+      try {
+        await client.iosInstances.delete(iosInstanceId);
+        return true;
+      } catch {
+        return false;
+      }
+    };
+
+    const attachNewSimulatorImpl = async (): Promise<{
+      iosInstanceId: string;
+      simulator: IosInstance;
+    }> => {
+      const simulator = await client.iosInstances.create({ wait: true });
+      // The sim exists from here; if attach fails, delete it so we never leak an
+      // orphan the caller can't reap.
+      try {
+        await attachSimulatorImpl(simulator);
+      } catch (err) {
+        await deleteSimulatorImpl(simulator.metadata.id);
+        throw err;
+      }
+      return { iosInstanceId: simulator.metadata.id, simulator };
+    };
+
     return {
       async sync(localCodePath: string, opts?: SyncOptions): Promise<SyncResult> {
         const resolvedPath = path.resolve(localCodePath);
@@ -375,31 +615,56 @@ export class XcodeInstances extends GeneratedXcodeInstances {
         return readJsonResponse<SimulatorStatus>(res, 'GET /simulator');
       },
 
-      async attachSimulator(
-        simulator: IosInstance | { apiUrl: string; token: string },
-      ): Promise<SimulatorAttachResult> {
-        let simApiUrl: string;
-        let simToken: string;
-        if ('status' in simulator) {
-          if (!simulator.status.apiUrl) {
-            throw new Error('Simulator instance not ready: apiUrl is not available');
-          }
-          simApiUrl = simulator.status.apiUrl;
-          simToken = simulator.status.token;
-        } else {
-          simApiUrl = simulator.apiUrl;
-          simToken = simulator.token;
-        }
+      attachSimulator: attachSimulatorImpl,
+      attachNewSimulator: attachNewSimulatorImpl,
+      deleteSimulator: deleteSimulatorImpl,
 
-        const res = await nodeProxyTransport.fetch(`${apiUrl}/simulator`, {
+      async startRbe(opts?: RbeStartOptions): Promise<RbeStatus> {
+        const res = await nodeProxyTransport.fetch(`${apiUrl}/rbe`, {
           method: 'POST',
           headers: {
             'Content-Type': 'application/json',
             Authorization: `Bearer ${token}`,
           },
-          body: JSON.stringify({ apiUrl: simApiUrl, token: simToken }),
+          body: JSON.stringify(opts ?? {}),
         });
-        return readJsonResponse<SimulatorAttachResult>(res, 'POST /simulator');
+        return readRbeResponse<RbeStatus>(res, 'POST /rbe');
+      },
+
+      async getRbe(): Promise<RbeStatus> {
+        const res = await nodeProxyTransport.fetch(`${apiUrl}/rbe`, {
+          method: 'GET',
+          headers: {
+            Authorization: `Bearer ${token}`,
+          },
+        });
+        return readRbeResponse<RbeStatus>(res, 'GET /rbe');
+      },
+
+      async stopRbe(): Promise<RbeStatus> {
+        const res = await nodeProxyTransport.fetch(`${apiUrl}/rbe`, {
+          method: 'DELETE',
+          headers: {
+            Authorization: `Bearer ${token}`,
+          },
+        });
+        return readRbeResponse<RbeStatus>(res, 'DELETE /rbe');
+      },
+
+      installRbeBuildFromBep: (opts: { bep: string; target: string }) =>
+        installFromBep(opts.bep, opts.target),
+
+      async startRbeTunnel(opts?: RbeTunnelOptions): Promise<Tunnel> {
+        return startTcpTunnel(
+          deriveRbeTunnelUrl(apiUrl),
+          token,
+          opts?.host ?? '127.0.0.1',
+          opts?.port ?? DEFAULT_RBE_TUNNEL_PORT,
+          {
+            mode: 'multiplexed',
+            logLevel: opts?.logLevel ?? params.logLevel ?? 'info',
+          },
+        );
       },
     };
   }

package/src/tunnel.ts

@@ -899,8 +899,19 @@ async function startMultiplexedTcpTunnel(
     let ws: WebSocket | undefined;
     let pingInterval: NodeJS.Timeout | undefined;
     let intentionalDisconnect = false;
+    // True once the initial connect has succeeded. Initial-connect failures
+    // reject the outer promise (no reconnect); only post-establishment drops
+    // reconnect, keeping the local listener open so long builds survive a blip.
+    let established = false;
     let connectionState: TunnelConnectionState = 'connecting';
 
+    const maxReconnectAttempts = options?.maxReconnectAttempts ?? 6;
+    const reconnectDelay = options?.reconnectDelay ?? 1000;
+    const maxReconnectDelay = options?.maxReconnectDelay ?? 30000;
+    let reconnectAttempts = 0;
+    let reconnectTimeout: NodeJS.Timeout | undefined;
+    let lastError: string | undefined;
+
     const stateChangeCallbacks: Set<TunnelConnectionStateCallback> = new Set();
 
     const updateConnectionState = (newState: TunnelConnectionState): void => {
@@ -943,6 +954,10 @@ async function startMultiplexedTcpTunnel(
 
     const close = () => {
       intentionalDisconnect = true;
+      if (reconnectTimeout) {
+        clearTimeout(reconnectTimeout);
+        reconnectTimeout = undefined;
+      }
       cleanupWebSocket();
       closeAllConnections();
       updateConnectionState('disconnected');
@@ -951,6 +966,37 @@ async function startMultiplexedTcpTunnel(
       }
     };
 
+    // Single reconnect scheduler. Only ws.on('close') drives it (after the
+    // tunnel is established), so there is no double-scheduling race; the
+    // `reconnectTimeout` guard is belt-and-suspenders. Mirrors the singleton
+    // tunnel's backoff, but tears down per-connection streams on each drop
+    // since a multiplexed connId cannot be resumed across a WS reconnect.
+    const scheduleReconnect = (): void => {
+      if (intentionalDisconnect || reconnectTimeout) {
+        return;
+      }
+      if (isNonRetryableError(lastError ?? '')) {
+        logger.error(`Closing multiplexed tunnel (non-retryable error): ${lastError}`);
+        close();
+        return;
+      }
+      if (reconnectAttempts >= maxReconnectAttempts) {
+        logger.error(`Max reconnection attempts (${maxReconnectAttempts}) reached. Closing tunnel.`);
+        close();
+        return;
+      }
+      const currentDelay = Math.min(reconnectDelay * Math.pow(2, reconnectAttempts), maxReconnectDelay);
+      reconnectAttempts++;
+      updateConnectionState('reconnecting');
+      logger.debug(`Scheduling reconnection attempt ${reconnectAttempts} in ${currentDelay}ms...`);
+      reconnectTimeout = setTimeout(() => {
+        reconnectTimeout = undefined;
+        // On failure the new ws's own 'close' handler schedules the next
+        // attempt, so here we only swallow the rejection.
+        setupWebSocket().catch(() => {});
+      }, currentDelay);
+    };
+
     // Send close signal for a connection (header-only packet)
     const sendCloseSignal = (connId: number) => {
       if (ws && ws.readyState === WebSocket.OPEN) {
@@ -992,6 +1038,7 @@ async function startMultiplexedTcpTunnel(
 
         ws.on('error', (err: any) => {
           const errMessage = err.message || String(err);
+          lastError = errMessage;
           logger.error('WebSocket error:', errMessage, err.code || '');
           rejectWs(err);
         });
@@ -1001,17 +1048,28 @@ async function startMultiplexedTcpTunnel(
             clearInterval(pingInterval);
             pingInterval = undefined;
           }
-
-          updateConnectionState('disconnected');
           logger.debug(`WebSocket disconnected (code=${code}, reason=${reason.toString()})`);
 
-          // Close all TCP connections when WebSocket closes
+          // Per-connection streams cannot survive a WS drop (their remote peers
+          // are gone), so tear them down; bazel's own gRPC retries re-establish
+          // channels once the WS is back.
           closeAllConnections();
+
+          // Before establishment, the listening handler's catch rejects + closes
+          // (no reconnect). After establishment, a non-intentional drop reconnects
+          // (keeping the listener open) instead of killing the tunnel.
+          if (!established || intentionalDisconnect) {
+            updateConnectionState('disconnected');
+            return;
+          }
+          scheduleReconnect();
         });
 
         ws.on('open', () => {
           const socket = ws as WebSocket;
           logger.debug('WebSocket connected');
+          reconnectAttempts = 0;
+          lastError = undefined;
           updateConnectionState('connected');
 
           pingInterval = setInterval(() => {
@@ -1090,6 +1148,7 @@ async function startMultiplexedTcpTunnel(
       // Start WebSocket connection and wait for it to be ready
       try {
         await setupWebSocket();
+        established = true;
         logger.debug('WebSocket ready, tunnel fully initialized');
         resolve({
           address,

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.30.0'; // x-release-please-version
+export const VERSION = '0.31.1'; // x-release-please-version

package/tunnel.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.mts","sourceRoot":"","sources":["src/tunnel.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;AAEjG;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAEnF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAErD,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB;;OAEG;IACH,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;IAChD;;;OAGG;IACH,uBAAuB,EAAE,CAAC,QAAQ,EAAE,6BAA6B,KAAK,MAAM,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;IAChD,uBAAuB,EAAE,CAAC,QAAQ,EAAE,6BAA6B,KAAK,MAAM,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CA+XxB;AAymBD,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,OAOxD,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAIrF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAK7D"}
+{"version":3,"file":"tunnel.d.mts","sourceRoot":"","sources":["src/tunnel.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;AAEjG;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAEnF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAErD,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB;;OAEG;IACH,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;IAChD;;;OAGG;IACH,uBAAuB,EAAE,CAAC,QAAQ,EAAE,6BAA6B,KAAK,MAAM,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;IAChD,uBAAuB,EAAE,CAAC,QAAQ,EAAE,6BAA6B,KAAK,MAAM,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CA+XxB;AAoqBD,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,OAOxD,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAIrF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAK7D"}

package/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["src/tunnel.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;AAEjG;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAEnF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAErD,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB;;OAEG;IACH,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;IAChD;;;OAGG;IACH,uBAAuB,EAAE,CAAC,QAAQ,EAAE,6BAA6B,KAAK,MAAM,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;IAChD,uBAAuB,EAAE,CAAC,QAAQ,EAAE,6BAA6B,KAAK,MAAM,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CA+XxB;AAymBD,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,OAOxD,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAIrF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAK7D"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["src/tunnel.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;AAEjG;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAEnF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAErD,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB;;OAEG;IACH,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;IAChD;;;OAGG;IACH,uBAAuB,EAAE,CAAC,QAAQ,EAAE,6BAA6B,KAAK,MAAM,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;IAChD,uBAAuB,EAAE,CAAC,QAAQ,EAAE,6BAA6B,KAAK,MAAM,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CA+XxB;AAoqBD,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,OAOxD,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAIrF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAK7D"}

package/tunnel.js

@@ -690,7 +690,17 @@ async function startMultiplexedTcpTunnel(remoteURL, token, hostname, port, optio
         let ws;
         let pingInterval;
         let intentionalDisconnect = false;
+        // True once the initial connect has succeeded. Initial-connect failures
+        // reject the outer promise (no reconnect); only post-establishment drops
+        // reconnect, keeping the local listener open so long builds survive a blip.
+        let established = false;
         let connectionState = 'connecting';
+        const maxReconnectAttempts = options?.maxReconnectAttempts ?? 6;
+        const reconnectDelay = options?.reconnectDelay ?? 1000;
+        const maxReconnectDelay = options?.maxReconnectDelay ?? 30000;
+        let reconnectAttempts = 0;
+        let reconnectTimeout;
+        let lastError;
         const stateChangeCallbacks = new Set();
         const updateConnectionState = (newState) => {
             if (connectionState !== newState) {
@@ -730,6 +740,10 @@ async function startMultiplexedTcpTunnel(remoteURL, token, hostname, port, optio
         };
         const close = () => {
             intentionalDisconnect = true;
+            if (reconnectTimeout) {
+                clearTimeout(reconnectTimeout);
+                reconnectTimeout = undefined;
+            }
             cleanupWebSocket();
             closeAllConnections();
             updateConnectionState('disconnected');
@@ -737,6 +751,36 @@ async function startMultiplexedTcpTunnel(remoteURL, token, hostname, port, optio
                 server.close();
             }
         };
+        // Single reconnect scheduler. Only ws.on('close') drives it (after the
+        // tunnel is established), so there is no double-scheduling race; the
+        // `reconnectTimeout` guard is belt-and-suspenders. Mirrors the singleton
+        // tunnel's backoff, but tears down per-connection streams on each drop
+        // since a multiplexed connId cannot be resumed across a WS reconnect.
+        const scheduleReconnect = () => {
+            if (intentionalDisconnect || reconnectTimeout) {
+                return;
+            }
+            if ((0, exports.isNonRetryableError)(lastError ?? '')) {
+                logger.error(`Closing multiplexed tunnel (non-retryable error): ${lastError}`);
+                close();
+                return;
+            }
+            if (reconnectAttempts >= maxReconnectAttempts) {
+                logger.error(`Max reconnection attempts (${maxReconnectAttempts}) reached. Closing tunnel.`);
+                close();
+                return;
+            }
+            const currentDelay = Math.min(reconnectDelay * Math.pow(2, reconnectAttempts), maxReconnectDelay);
+            reconnectAttempts++;
+            updateConnectionState('reconnecting');
+            logger.debug(`Scheduling reconnection attempt ${reconnectAttempts} in ${currentDelay}ms...`);
+            reconnectTimeout = setTimeout(() => {
+                reconnectTimeout = undefined;
+                // On failure the new ws's own 'close' handler schedules the next
+                // attempt, so here we only swallow the rejection.
+                setupWebSocket().catch(() => { });
+            }, currentDelay);
+        };
         // Send close signal for a connection (header-only packet)
         const sendCloseSignal = (connId) => {
             if (ws && ws.readyState === ws_1.WebSocket.OPEN) {
@@ -772,6 +816,7 @@ async function startMultiplexedTcpTunnel(remoteURL, token, hostname, port, optio
                 });
                 ws.on('error', (err) => {
                     const errMessage = err.message || String(err);
+                    lastError = errMessage;
                     logger.error('WebSocket error:', errMessage, err.code || '');
                     rejectWs(err);
                 });
@@ -780,14 +825,25 @@ async function startMultiplexedTcpTunnel(remoteURL, token, hostname, port, optio
                         clearInterval(pingInterval);
                         pingInterval = undefined;
                     }
-                    updateConnectionState('disconnected');
                     logger.debug(`WebSocket disconnected (code=${code}, reason=${reason.toString()})`);
-                    // Close all TCP connections when WebSocket closes
+                    // Per-connection streams cannot survive a WS drop (their remote peers
+                    // are gone), so tear them down; bazel's own gRPC retries re-establish
+                    // channels once the WS is back.
                     closeAllConnections();
+                    // Before establishment, the listening handler's catch rejects + closes
+                    // (no reconnect). After establishment, a non-intentional drop reconnects
+                    // (keeping the listener open) instead of killing the tunnel.
+                    if (!established || intentionalDisconnect) {
+                        updateConnectionState('disconnected');
+                        return;
+                    }
+                    scheduleReconnect();
                 });
                 ws.on('open', () => {
                     const socket = ws;
                     logger.debug('WebSocket connected');
+                    reconnectAttempts = 0;
+                    lastError = undefined;
                     updateConnectionState('connected');
                     pingInterval = setInterval(() => {
                         if (socket.readyState === ws_1.WebSocket.OPEN) {
@@ -852,6 +908,7 @@ async function startMultiplexedTcpTunnel(remoteURL, token, hostname, port, optio
             // Start WebSocket connection and wait for it to be ready
             try {
                 await setupWebSocket();
+                established = true;
                 logger.debug('WebSocket ready, tunnel fully initialized');
                 resolve({
                     address,