@opensoha/contracts 0.1.27 → 0.2.0

package/resource/runtime/pod_execution.go

@@ -0,0 +1,199 @@
+package runtime
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+	"unicode"
+	"unicode/utf8"
+
+	contractresource "github.com/opensoha/soha/contracts/resource"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/remotecommand"
+	utilexec "k8s.io/client-go/util/exec"
+)
+
+func InspectPodExecutionTarget(ctx context.Context, client kubernetes.Interface, namespace, name, expectedUID, container string) (contractresource.PodExecutionTarget, error) {
+	var empty contractresource.PodExecutionTarget
+	if client == nil || len(validation.IsDNS1123Label(namespace)) > 0 || len(validation.IsDNS1123Subdomain(name)) > 0 || expectedUID == "" || len(expectedUID) > 256 || strings.IndexFunc(expectedUID, func(r rune) bool { return unicode.IsControl(r) || unicode.IsSpace(r) }) >= 0 {
+		return empty, apierrors.NewBadRequest("valid namespace, Pod name and reviewed UID are required")
+	}
+	pod, err := client.CoreV1().Pods(namespace).Get(ctx, name, metav1.GetOptions{})
+	if err != nil {
+		return empty, err
+	}
+	if pod.Name != name || pod.Namespace != namespace || string(pod.UID) != expectedUID || pod.DeletionTimestamp != nil {
+		return empty, apierrors.NewConflict(schema.GroupResource{Resource: "pods"}, name, fmt.Errorf("pod identity changed or deletion was requested"))
+	}
+	if container == "" {
+		container = pod.Annotations["kubectl.kubernetes.io/default-container"]
+		if container == "" && len(pod.Spec.Containers) == 1 {
+			container = pod.Spec.Containers[0].Name
+		}
+	}
+	found := false
+	for _, item := range append(append([]corev1.Container(nil), pod.Spec.Containers...), pod.Spec.InitContainers...) {
+		if item.Name == container {
+			found = true
+		}
+	}
+	for _, item := range pod.Spec.EphemeralContainers {
+		if item.Name == container {
+			found = true
+		}
+	}
+	if container == "" || !found {
+		return empty, apierrors.NewBadRequest("select one existing Pod container")
+	}
+	return contractresource.PodExecutionTarget{Namespace: namespace, PodName: name, UID: expectedUID, Container: container, CheckedAt: time.Now().UTC()}, nil
+}
+
+type PodExecutorFactory func(namespace, name string, options corev1.PodExecOptions) (remotecommand.Executor, error)
+
+// ExecutePodArgv checks UID before connecting and again after execution.
+// Kubernetes exec has no atomic UID precondition; this function never claims
+// otherwise, and never retries an uncertain command.
+func ExecutePodArgv(ctx context.Context, client kubernetes.Interface, config *rest.Config, namespace, name string, input contractresource.PodArgvInput, factory PodExecutorFactory) (contractresource.PodArgvResult, error) {
+	var result contractresource.PodArgvResult
+	input, err := input.Normalized()
+	if err != nil {
+		return result, apierrors.NewBadRequest(err.Error())
+	}
+	if err := ctx.Err(); err != nil {
+		return result, err
+	}
+	runCtx, cancel := context.WithTimeout(ctx, time.Duration(input.TimeoutSeconds)*time.Second)
+	defer cancel()
+	target, err := InspectPodExecutionTarget(runCtx, client, namespace, name, input.ExpectedUID, input.Container)
+	if err != nil {
+		return result, err
+	}
+	if err := runCtx.Err(); err != nil {
+		return result, err
+	}
+	stdin, _ := base64.StdEncoding.Strict().DecodeString(input.StdinBase64)
+	options := corev1.PodExecOptions{Container: target.Container, Command: input.Argv, Stdin: len(stdin) > 0, Stdout: true, Stderr: true, TTY: false}
+	if factory == nil {
+		if config == nil || client.CoreV1().RESTClient() == nil {
+			return result, apierrors.NewBadRequest("Pod exec transport is unavailable")
+		}
+		factory = func(namespace, name string, options corev1.PodExecOptions) (remotecommand.Executor, error) {
+			request := client.CoreV1().RESTClient().Post().Resource("pods").Name(name).Namespace(namespace).SubResource("exec")
+			request.VersionedParams(&options, scheme.ParameterCodec)
+			return newPodExecutionExecutor(config, name, request.URL())
+		}
+	}
+	executor, err := factory(namespace, name, options)
+	if err != nil {
+		return result, err
+	}
+	budget := &podOutputBudget{maximum: int(input.MaxOutputBytes)}
+	stdout, stderr := &podOutputBuffer{budget: budget}, &podOutputBuffer{budget: budget}
+	streamOptions := remotecommand.StreamOptions{Stdout: stdout, Stderr: stderr}
+	if len(stdin) > 0 {
+		streamOptions.Stdin = bytes.NewReader(stdin)
+	}
+	execErr := executor.StreamWithContext(runCtx, streamOptions)
+	// An explicit API rejection of the upgrade is a denied operation, rather
+	// than a process exit or an unclassified transport failure.
+	if apierrors.IsForbidden(execErr) || apierrors.IsUnauthorized(execErr) || apierrors.IsNotFound(execErr) || apierrors.IsBadRequest(execErr) {
+		return result, execErr
+	}
+	outData, outBytes, outTruncated := stdout.snapshot()
+	errData, errBytes, errTruncated := stderr.snapshot()
+	outValue, outEncoding := encodePodExecutionStream(outData)
+	errValue, errEncoding := encodePodExecutionStream(errData)
+	output := contractresource.PodExecutionOutput{Status: "succeeded", Stdout: outValue, Stderr: errValue, StdoutEncoding: outEncoding, StderrEncoding: errEncoding, StdoutBytes: outBytes, StderrBytes: errBytes, MaxOutputBytes: input.MaxOutputBytes, StdoutTruncated: outTruncated, StderrTruncated: errTruncated, UIDVerifiedBeforeStart: true}
+	var remoteExit utilexec.ExitError
+	switch {
+	case execErr == nil:
+		code := int64(0)
+		output.ExitCode = &code
+	case errors.As(execErr, &remoteExit) && remoteExit.Exited() && remoteExit.ExitStatus() >= 0:
+		code := int64(remoteExit.ExitStatus())
+		if code > 4294967295 {
+			output.Status = "transport_lost"
+			output.ReasonCode = "invalid_exit_status"
+		} else {
+			output.ExitCode = &code
+			output.Status = "failed"
+			output.ReasonCode = "process_exited"
+		}
+	case errors.Is(runCtx.Err(), context.DeadlineExceeded):
+		output.Status = "timed_out"
+		output.ReasonCode = "deadline_exceeded"
+	case errors.Is(runCtx.Err(), context.Canceled):
+		output.Status = "canceled"
+		output.ReasonCode = "request_canceled"
+	default:
+		output.Status = "transport_lost"
+		output.ReasonCode = "transport_lost"
+	}
+	// No new provider read after cancellation/revocation. A normal completion
+	// receives a short final identity check, which can never repeat the command.
+	if runCtx.Err() == nil {
+		verifyCtx, verifyCancel := context.WithTimeout(runCtx, 3*time.Second)
+		defer verifyCancel()
+		_, verifyErr := InspectPodExecutionTarget(verifyCtx, client, namespace, name, input.ExpectedUID, target.Container)
+		if verifyErr != nil {
+			if apierrors.IsConflict(verifyErr) || apierrors.IsNotFound(verifyErr) {
+				output.TargetChanged = true
+				output.ReasonCode = "target_changed_after_execution"
+			} else {
+				output.ReasonCode = "target_verification_unavailable"
+			}
+			output.Status = "unknown"
+		}
+	}
+	result.Target, result.Output = target, output
+	return result, nil
+}
+
+func encodePodExecutionStream(data []byte) (string, string) {
+	if utf8.Valid(data) {
+		return string(data), "utf-8"
+	}
+	return base64.StdEncoding.EncodeToString(data), "base64"
+}
+
+type podOutputBudget struct {
+	mu            sync.Mutex
+	maximum, used int
+}
+type podOutputBuffer struct {
+	budget    *podOutputBudget
+	data      []byte
+	total     int64
+	truncated bool
+}
+
+func (b *podOutputBuffer) Write(data []byte) (int, error) {
+	b.budget.mu.Lock()
+	defer b.budget.mu.Unlock()
+	b.total += int64(len(data))
+	keep := min(len(data), b.budget.maximum-b.budget.used)
+	b.data = append(b.data, data[:keep]...)
+	b.budget.used += keep
+	if keep < len(data) {
+		b.truncated = true
+	}
+	return len(data), nil
+}
+
+func (b *podOutputBuffer) snapshot() ([]byte, int64, bool) {
+	b.budget.mu.Lock()
+	defer b.budget.mu.Unlock()
+	return append([]byte(nil), b.data...), b.total, b.truncated
+}

package/resource/runtime/pod_execution_test.go

@@ -0,0 +1,194 @@
+package runtime
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+
+	contractresource "github.com/opensoha/soha/contracts/resource"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/kubernetes/fake"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/remotecommand"
+	utilexec "k8s.io/client-go/util/exec"
+)
+
+type podExecutorStub struct {
+	run func(context.Context, remotecommand.StreamOptions) error
+}
+
+func (s podExecutorStub) Stream(options remotecommand.StreamOptions) error {
+	return s.run(context.Background(), options)
+}
+func (s podExecutorStub) StreamWithContext(ctx context.Context, options remotecommand.StreamOptions) error {
+	return s.run(ctx, options)
+}
+
+func executionFixturePod() *corev1.Pod {
+	return &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "fixture", Namespace: "test", UID: types.UID("reviewed")}, Spec: corev1.PodSpec{Containers: []corev1.Container{{Name: "main"}}}}
+}
+
+func TestPodArgvPreservesUpgradeHTTPDenialWithoutReadingProviderBody(t *testing.T) {
+	for _, code := range []int{400, 401, 403, 404} {
+		t.Run(http.StatusText(code), func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+				if strings.HasSuffix(request.URL.Path, "/exec") {
+					w.WriteHeader(code)
+					_, _ = io.WriteString(w, strings.Repeat("PRIVATE_PROVIDER_MARKER", 5000))
+					return
+				}
+				w.Header().Set("Content-Type", "application/json")
+				_ = json.NewEncoder(w).Encode(executionFixturePod())
+			}))
+			defer server.Close()
+			config := &rest.Config{Host: server.URL}
+			client, err := kubernetes.NewForConfig(config)
+			if err != nil {
+				t.Fatal(err)
+			}
+			_, err = ExecutePodArgv(t.Context(), client, config, "test", "fixture", contractresource.PodArgvInput{ExpectedUID: "reviewed", Argv: []string{"true"}}, nil)
+			var status apierrors.APIStatus
+			if !errors.As(err, &status) || int(status.Status().Code) != code || strings.Contains(err.Error(), "PRIVATE_PROVIDER_MARKER") {
+				t.Fatalf("upgrade lost its safe HTTP category: %v", err)
+			}
+		})
+	}
+}
+
+func TestPodArgvUsesExactArgumentsAndCombinedOutputBudget(t *testing.T) {
+	pod := executionFixturePod()
+	client := fake.NewClientset(pod)
+	input := contractresource.PodArgvInput{ExpectedUID: "reviewed", Argv: []string{"printf", "; $(literal)\n", ""}, StdinBase64: base64.StdEncoding.EncodeToString([]byte("input")), MaxOutputBytes: 8}
+	calls := 0
+	factory := func(namespace, name string, options corev1.PodExecOptions) (remotecommand.Executor, error) {
+		calls++
+		if namespace != "test" || name != "fixture" || !reflect.DeepEqual(options.Command, input.Argv) || options.Container != "main" || options.TTY || !options.Stdin || !options.Stdout || !options.Stderr {
+			t.Fatalf("changed exec options: %+v", options)
+		}
+		return podExecutorStub{run: func(_ context.Context, streams remotecommand.StreamOptions) error {
+			data, _ := io.ReadAll(streams.Stdin)
+			if string(data) != "input" {
+				t.Fatal("stdin changed")
+			}
+			_, _ = io.WriteString(streams.Stdout, "123456")
+			_, _ = io.WriteString(streams.Stderr, "abcdef")
+			return nil
+		}}, nil
+	}
+	result, err := ExecutePodArgv(t.Context(), client, nil, "test", "fixture", input, factory)
+	if err != nil || calls != 1 || result.Output.Status != "succeeded" || result.Output.ExitCode == nil || *result.Output.ExitCode != 0 || result.Output.Stdout != "123456" || result.Output.Stderr != "ab" || result.Output.StdoutBytes != 6 || result.Output.StderrBytes != 6 || result.Output.StdoutTruncated || !result.Output.StderrTruncated || result.Target.UID != "reviewed" {
+		t.Fatalf("result=%+v err=%v calls=%d", result, err, calls)
+	}
+}
+
+func TestPodArgvRetainsKnownExitCodeButNeverEchoesTransportErrors(t *testing.T) {
+	for _, scenario := range []string{"exit", "transport", "changed", "binary", "canceled"} {
+		t.Run(scenario, func(t *testing.T) {
+			client := fake.NewClientset(executionFixturePod())
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
+			input := contractresource.PodArgvInput{ExpectedUID: "reviewed", Argv: []string{"diagnostic"}, MaxOutputBytes: 1}
+			factory := func(_, _ string, _ corev1.PodExecOptions) (remotecommand.Executor, error) {
+				return podExecutorStub{run: func(_ context.Context, streams remotecommand.StreamOptions) error {
+					switch scenario {
+					case "exit":
+						return utilexec.CodeExitError{Err: errors.New("PRIVATE_VALUE"), Code: 42}
+					case "transport":
+						return errors.New("PRIVATE_VALUE")
+					case "changed":
+						pod, _ := client.CoreV1().Pods("test").Get(t.Context(), "fixture", metav1.GetOptions{})
+						pod.UID = "replacement"
+						_, err := client.CoreV1().Pods("test").Update(t.Context(), pod, metav1.UpdateOptions{})
+						return err
+					case "binary":
+						_, _ = streams.Stdout.Write([]byte{255, 254})
+						return nil
+					case "canceled":
+						cancel()
+						return context.Canceled
+					default:
+						return nil
+					}
+				}}, nil
+			}
+			result, err := ExecutePodArgv(ctx, client, nil, "test", "fixture", input, factory)
+			if err != nil {
+				t.Fatal(err)
+			}
+			raw, _ := json.Marshal(result)
+			if strings.Contains(string(raw), "PRIVATE_VALUE") {
+				t.Fatal("transport error leaked")
+			}
+			switch scenario {
+			case "exit":
+				if result.Output.Status != "failed" || result.Output.ExitCode == nil || *result.Output.ExitCode != 42 {
+					t.Fatalf("exit=%+v", result.Output)
+				}
+			case "transport":
+				if result.Output.Status != "transport_lost" || result.Output.ExitCode != nil {
+					t.Fatalf("transport=%+v", result.Output)
+				}
+			case "changed":
+				if result.Output.Status != "unknown" || !result.Output.TargetChanged {
+					t.Fatalf("target=%+v", result.Output)
+				}
+			case "binary":
+				data, err := contractresource.DecodePodExecutionStream(result.Output.Stdout, result.Output.StdoutEncoding)
+				if err != nil || len(data) != 1 || data[0] != 255 || !result.Output.StdoutTruncated {
+					t.Fatalf("binary=%+v err=%v", result.Output, err)
+				}
+			case "canceled":
+				if result.Output.Status != "canceled" || result.Output.ExitCode != nil || len(client.Actions()) != 1 {
+					t.Fatalf("cancel=%+v actions=%d", result.Output, len(client.Actions()))
+				}
+			}
+		})
+	}
+}
+
+func TestPodArgvRejectsChangedUIDAndAmbiguousContainerBeforeFactory(t *testing.T) {
+	for _, scenario := range []string{"uid", "container", "deleting", "canceled"} {
+		t.Run(scenario, func(t *testing.T) {
+			pod := executionFixturePod()
+			if scenario == "uid" {
+				pod.UID = "replacement"
+			}
+			if scenario == "container" {
+				pod.Spec.Containers = append(pod.Spec.Containers, corev1.Container{Name: "other"})
+			}
+			if scenario == "deleting" {
+				now := metav1.Now()
+				pod.DeletionTimestamp = &now
+			}
+			client := fake.NewClientset(pod)
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
+			if scenario == "canceled" {
+				cancel()
+			}
+			calls := 0
+			factory := func(_, _ string, _ corev1.PodExecOptions) (remotecommand.Executor, error) {
+				calls++
+				return nil, errors.New("must not open exec")
+			}
+			_, err := ExecutePodArgv(ctx, client, nil, "test", "fixture", contractresource.PodArgvInput{ExpectedUID: "reviewed", Argv: []string{"true"}}, factory)
+			if err == nil || calls != 0 {
+				t.Fatalf("err=%v calls=%d", err, calls)
+			}
+			if scenario == "uid" && !apierrors.IsConflict(err) {
+				t.Fatal(err)
+			}
+		})
+	}
+}

package/resource/runtime/pod_execution_transport.go

@@ -0,0 +1,79 @@
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync/atomic"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/remotecommand"
+	"k8s.io/client-go/transport/spdy"
+)
+
+func newPodExecutionExecutor(config *rest.Config, name string, target *url.URL) (remotecommand.Executor, error) {
+	transport, upgrader, err := spdy.RoundTripperFor(config)
+	if err != nil {
+		return nil, err
+	}
+	status := &atomic.Int32{}
+	executor, err := remotecommand.NewSPDYExecutorRejectRedirects(podExecutionStatusTransport{base: transport, status: status}, upgrader, http.MethodPost, target)
+	if err != nil {
+		return nil, err
+	}
+	return podExecutionStatusExecutor{Executor: executor, status: status, name: name}, nil
+}
+
+type podExecutionStatusExecutor struct {
+	remotecommand.Executor
+	status *atomic.Int32
+	name   string
+}
+
+func (executor podExecutionStatusExecutor) Stream(options remotecommand.StreamOptions) error {
+	return executor.StreamWithContext(context.Background(), options)
+}
+
+func (executor podExecutionStatusExecutor) StreamWithContext(ctx context.Context, options remotecommand.StreamOptions) error {
+	err := executor.Executor.StreamWithContext(ctx, options)
+	// Negotiate also stringifies transport errors. Keep the HTTP category in
+	// this attempt's private state, rather than parsing a provider message.
+	if code := executor.status.Load(); code != 0 {
+		return apierrors.NewGenericServerResponse(int(code), http.MethodPost, schema.GroupResource{Resource: "pods/exec"}, executor.name, "Pod exec upgrade rejected", 0, false)
+	}
+	return err
+}
+
+type podExecutionStatusTransport struct {
+	base   http.RoundTripper
+	status *atomic.Int32
+}
+
+func (transport podExecutionStatusTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	response, err := transport.base.RoundTrip(request)
+	if err != nil || response == nil {
+		return response, err
+	}
+	if validPodExecutionUpgrade(response) {
+		return response, nil
+	}
+	// Never read the raw error body: it can be unbounded or contain command
+	// secrets. The original transport still applies authentication and TLS.
+	if response.Body != nil {
+		_ = response.Body.Close()
+	}
+	code := response.StatusCode
+	if code < http.StatusBadRequest {
+		code = http.StatusBadGateway
+	}
+	transport.status.Store(int32(code))
+	return nil, fmt.Errorf("pod exec HTTP upgrade rejected")
+}
+
+func validPodExecutionUpgrade(response *http.Response) bool {
+	return response.StatusCode == http.StatusSwitchingProtocols && strings.Contains(strings.ToLower(response.Header.Get("Connection")), "upgrade") && strings.Contains(strings.ToLower(response.Header.Get("Upgrade")), "spdy/3.1")
+}

package/resource/runtime/pod_terminal.go

@@ -0,0 +1,178 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"io"
+	"sync/atomic"
+	"time"
+
+	contractresource "github.com/opensoha/soha/contracts/resource"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/remotecommand"
+	utilexec "k8s.io/client-go/util/exec"
+)
+
+var errTerminalInputLimit = errors.New("terminal input limit")
+var errTerminalOutputLimit = errors.New("terminal output limit")
+
+// StreamPodTerminal uses a single PTY with merged stdout/stderr. It never
+// retries. Cancellation closes this transport; it does not prove that a remote
+// process has terminated. Callers own stream authorization and durable leases.
+func StreamPodTerminal(ctx context.Context, client kubernetes.Interface, config *rest.Config, namespace, name string, input contractresource.PodTerminalInput, stdin io.ReadCloser, stdout io.Writer, sizes contractresource.NativeTerminalSizeQueue, factory PodExecutorFactory) (contractresource.PodTerminalResult, error) {
+	var result contractresource.PodTerminalResult
+	input, err := input.Normalized()
+	if err != nil {
+		return result, apierrors.NewBadRequest(err.Error())
+	}
+	if stdin == nil || stdout == nil || sizes == nil {
+		return result, apierrors.NewBadRequest("terminal streams are required")
+	}
+	runCtx, cancel := context.WithTimeout(ctx, time.Duration(input.TimeoutSeconds)*time.Second)
+	defer cancel()
+	stopInput := context.AfterFunc(runCtx, func() { _ = stdin.Close() })
+	defer stopInput()
+	target, err := InspectPodExecutionTarget(runCtx, client, namespace, name, input.ExpectedUID, input.Container)
+	if err != nil {
+		return result, err
+	}
+	if err = runCtx.Err(); err != nil {
+		return result, err
+	}
+	options := corev1.PodExecOptions{Container: target.Container, Command: []string{input.Shell}, Stdin: true, Stdout: true, Stderr: false, TTY: true}
+	if factory == nil {
+		if config == nil || client.CoreV1().RESTClient() == nil {
+			return result, apierrors.NewBadRequest("Pod terminal transport is unavailable")
+		}
+		factory = func(namespace, name string, options corev1.PodExecOptions) (remotecommand.Executor, error) {
+			request := client.CoreV1().RESTClient().Post().Resource("pods").Name(name).Namespace(namespace).SubResource("exec")
+			request.VersionedParams(&options, scheme.ParameterCodec)
+			return newPodExecutionExecutor(config, name, request.URL())
+		}
+	}
+	executor, err := factory(namespace, name, options)
+	if err != nil {
+		return result, err
+	}
+	reader := &terminalInputReader{reader: stdin, cancel: cancel}
+	writer := &terminalOutputWriter{writer: stdout, cancel: cancel}
+	execErr := executor.StreamWithContext(runCtx, remotecommand.StreamOptions{Stdin: reader, Stdout: writer, Tty: true, TerminalSizeQueue: terminalSizeQueue{ctx: runCtx, source: sizes}})
+	if apierrors.IsForbidden(execErr) || apierrors.IsUnauthorized(execErr) || apierrors.IsNotFound(execErr) || apierrors.IsBadRequest(execErr) {
+		return result, execErr
+	}
+	result = terminalStreamResult(execErr, runCtx.Err(), reader, writer)
+	if runCtx.Err() == nil {
+		verifyCtx, verifyCancel := context.WithTimeout(runCtx, 3*time.Second)
+		defer verifyCancel()
+		_, verifyErr := InspectPodExecutionTarget(verifyCtx, client, namespace, name, input.ExpectedUID, target.Container)
+		if verifyErr != nil {
+			result.Status, result.ExitCode, result.ReasonCode = "unknown", nil, "target_verification_unavailable"
+			if apierrors.IsConflict(verifyErr) || apierrors.IsNotFound(verifyErr) {
+				result.TargetChanged = true
+				result.ReasonCode = "target_changed"
+			}
+		}
+	}
+	return result, nil
+}
+
+func terminalStreamResult(execErr, ctxErr error, reader *terminalInputReader, writer *terminalOutputWriter) contractresource.PodTerminalResult {
+	result := contractresource.PodTerminalResult{Status: "transport_lost", ReasonCode: "transport_lost", UIDVerifiedBeforeStart: true, InputBytes: reader.count.Load(), OutputBytes: writer.count.Load()}
+	var remoteExit utilexec.ExitError
+	switch {
+	case reader.limited.Load():
+		result.Status, result.ReasonCode = "input_limit", "input_limit"
+	case writer.limited.Load():
+		result.Status, result.ReasonCode = "output_limit", "output_limit"
+	case errors.Is(ctxErr, context.DeadlineExceeded):
+		result.Status, result.ReasonCode = "timed_out", "deadline_exceeded"
+	case errors.Is(ctxErr, context.Canceled):
+		result.Status, result.ReasonCode = "canceled", "request_canceled"
+	case execErr == nil:
+		code := int64(0)
+		result.Status, result.ReasonCode, result.ExitCode = "succeeded", "", &code
+	case errors.As(execErr, &remoteExit) && remoteExit.Exited() && remoteExit.ExitStatus() > 0 && int64(remoteExit.ExitStatus()) <= 4294967295:
+		code := int64(remoteExit.ExitStatus())
+		result.Status, result.ReasonCode, result.ExitCode = "failed", "process_exited", &code
+	}
+	return result
+}
+
+type terminalSizeQueue struct {
+	ctx    context.Context
+	source contractresource.NativeTerminalSizeQueue
+}
+
+func (queue terminalSizeQueue) Next() *remotecommand.TerminalSize {
+	if queue.ctx.Err() != nil {
+		return nil
+	}
+	size := queue.source.Next(queue.ctx)
+	if size == nil || queue.ctx.Err() != nil || size.Width < 1 || size.Height < 1 || size.Width > contractresource.NativeTerminalMaxDimension || size.Height > contractresource.NativeTerminalMaxDimension {
+		return nil
+	}
+	return &remotecommand.TerminalSize{Width: size.Width, Height: size.Height}
+}
+
+type terminalInputReader struct {
+	reader  io.Reader
+	cancel  context.CancelFunc
+	count   atomic.Int64
+	limited atomic.Bool
+}
+
+func (reader *terminalInputReader) Read(data []byte) (int, error) {
+	if len(data) == 0 {
+		return 0, nil
+	}
+	remaining := contractresource.NativePodTerminalMaxInputBytes - reader.count.Load()
+	if int64(len(data)) > remaining {
+		data = data[:remaining]
+	}
+	if len(data) == 0 {
+		if remaining > 0 {
+			return 0, nil
+		}
+		var probe [1]byte
+		n, err := reader.reader.Read(probe[:])
+		if n == 0 {
+			return 0, err
+		}
+		reader.limited.Store(true)
+		reader.cancel()
+		return 0, errTerminalInputLimit
+	}
+	n, err := reader.reader.Read(data)
+	reader.count.Add(int64(n))
+	return n, err
+}
+
+type terminalOutputWriter struct {
+	writer  io.Writer
+	cancel  context.CancelFunc
+	count   atomic.Int64
+	limited atomic.Bool
+}
+
+func (writer *terminalOutputWriter) Write(data []byte) (int, error) {
+	remaining := contractresource.NativePodTerminalMaxOutputBytes - writer.count.Load()
+	keep := min(int64(len(data)), remaining)
+	n, err := writer.writer.Write(data[:keep])
+	writer.count.Add(int64(n))
+	if err != nil {
+		return n, err
+	}
+	if int64(n) != keep {
+		return n, io.ErrShortWrite
+	}
+	if keep < int64(len(data)) {
+		writer.limited.Store(true)
+		writer.cancel()
+		return n, errTerminalOutputLimit
+	}
+	return n, nil
+}