gowalk-cicd 1.0.119 → 1.0.121

package/CLAUDE.md

@@ -145,6 +145,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   The wrapper disables Gradle daemons and closes its relay when the command ends.
   The relay's idle deadline covers the whole tunnel: traffic in either direction
   keeps downloads/uploads alive. An idle direction alone must never end a transfer.
+  A clean directional EOF forwards a half-close when the transport supports it and
+  leaves the opposite stream alive until completion, error or the shared idle deadline.
+  Never cancel an unfinished reply or upload merely because the other pump completed.
 - Flutter bootstrap is part of that boundary: before the Flutter setup action,
   `play_store_proxy.py --bootstrap-env` validates the Google account pin and writes
   both proxy/bypass spellings to the private job environment without console output.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.119
+1.0.121

package/action/scripts/mobile_release.cjs

@@ -66,8 +66,19 @@ async function phase(action, platform) {
   if (!id) return; // Existing consumers without release-intent wiring keep their original behavior.
   const record = await api.request('GET', `/deployments/${id}`);
   const expected = owner(platform, record.payload?.fingerprint);
+  // An EARLIER attempt of this same run owns the record legitimately. `admit`
+  // only re-runs when it failed, so "re-run failed jobs" — the ordinary way to
+  // recover a release that died in transport — leaves the record stamped with
+  // attempt 1 while the platform job runs as attempt 2. Demanding an exact
+  // match made that recovery impossible: obd-scanner's Android leg built for
+  // twenty-six minutes, then refused at the upload intent (2026-09-09).
+  // Upload-once does not rest on this number. It rests on the status check
+  // below, which admits `begin-upload` only from `building`; a record whose
+  // upload already began or finished is refused there, on any attempt.
+  const attempt = record.payload?.run_attempt;
   if (record.payload?.schema !== SCHEMA || record.payload.run_id !== expected.run_id ||
-      record.payload.run_attempt !== expected.run_attempt || record.sha !== expected.source_sha ||
+      !Number.isSafeInteger(attempt) || attempt > expected.run_attempt ||
+      record.sha !== expected.source_sha ||
       record.payload.platform !== platform) throw Error('mobile_release_phase_owner_mismatch');
   const statuses = await api.request('GET', `/deployments/${id}/statuses?per_page=1`);
   const required = action === 'begin-upload' ? 'building' : 'uploading';

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.119
+1.0.121

package/android-action/scripts/jvm_proxy_relay.py

@@ -68,6 +68,19 @@ class Relay:
             activity[0] = self.loop.time()
             writer.write(data)
             await writer.drain()
+        if writer.can_write_eof():
+            writer.write_eof()
+            await writer.drain()
+
+    async def _wait_for_streams(self, pumps):
+        pending, idle = set(pumps[:2]), pumps[2]
+        while pending:
+            done, _ = await asyncio.wait([*pending, idle], return_when=asyncio.FIRST_COMPLETED)
+            if idle in done:
+                return
+            for task in done:
+                task.result()
+            pending.difference_update(done)
 
     async def _idle(self, activity):
         while remaining := max(0.0, activity[0] + IDLE_TIMEOUT - self.loop.time()):
@@ -91,7 +104,9 @@ class Relay:
             pumps = [asyncio.create_task(self._pump(reader, upstream, activity)),
                      asyncio.create_task(self._pump(upstream_reader, writer, activity)),
                      asyncio.create_task(self._idle(activity))]
-            await asyncio.wait(pumps, return_when=asyncio.FIRST_COMPLETED)
+            # A clean directional EOF still permits the other side to finish.
+            # Errors or the shared idle deadline continue to close the tunnel.
+            await self._wait_for_streams(pumps)
         except (OSError, ValueError, IndexError, asyncio.TimeoutError,
                 asyncio.IncompleteReadError, asyncio.LimitOverrunError):
             # Once bytes flow, the stream is the client's protocol (usually TLS): a
@@ -102,15 +117,18 @@ class Relay:
         finally:
             for task in pumps:
                 task.cancel()
+            # Cleanup itself can be cancelled while awaiting a pump or writer.
+            # Close both transports before the first cancellable cleanup await.
+            connections = [connection for connection in (writer, upstream) if connection]
+            for connection in connections:
+                connection.close()
             if pumps:
                 await asyncio.gather(*pumps, return_exceptions=True)
-            for connection in (writer, upstream):
-                if connection:
-                    connection.close()
-                    try:
-                        await connection.wait_closed()
-                    except OSError:
-                        pass
+            for connection in connections:
+                try:
+                    await connection.wait_closed()
+                except OSError:
+                    pass
 
 
 @contextmanager

package/android-action/scripts/test_relay_half_close.py

@@ -0,0 +1,148 @@
+"""Owned socket regressions for complete replies and uploads after directional EOF."""
+import asyncio
+from contextlib import contextmanager
+import socket
+import threading
+import time
+import unittest
+from unittest import mock
+
+import jvm_proxy_relay as relay
+
+
+def read_all(connection):
+    chunks = []
+    while chunk := connection.recv(65536):
+        chunks.append(chunk)
+    return b"".join(chunks)
+
+
+@contextmanager
+def endpoint(mode, payload):
+    listener = socket.socket()
+    listener.bind(("127.0.0.1", 0))
+    listener.listen(1)
+    listener.settimeout(3)
+    received, failures, finished = [], [], threading.Event()
+
+    def serve():
+        try:
+            with listener.accept()[0] as connection:
+                connection.settimeout(3)
+                header = b""
+                while not header.endswith(b"\r\n\r\n"):
+                    chunk = connection.recv(1)
+                    if not chunk:
+                        raise ConnectionError("incomplete CONNECT header")
+                    header += chunk
+                connection.sendall(b"HTTP/1.1 200 Connection established\r\n\r\n")
+                if mode == "download":
+                    received.append(read_all(connection))
+                connection.sendall(payload)
+                connection.shutdown(socket.SHUT_WR)
+                if mode == "upload":
+                    received.append(read_all(connection))
+        except OSError as exc:
+            failures.append(type(exc).__name__)
+        finally:
+            listener.close()
+            finished.set()
+
+    thread = threading.Thread(target=serve)
+    thread.start()
+    try:
+        yield f"http://127.0.0.1:{listener.getsockname()[1]}", received, finished
+    finally:
+        thread.join(timeout=5)
+        listener.close()
+        assert not thread.is_alive(), "owned upstream did not finish"
+        assert not failures, failures
+
+
+@contextmanager
+def connect(port):
+    with socket.create_connection(("127.0.0.1", port), timeout=3) as connection:
+        connection.sendall(b"CONNECT unresolvable.invalid:443 HTTP/1.1\r\nHost: ignored\r\n\r\n")
+        header = b""
+        while not header.endswith(b"\r\n\r\n"):
+            chunk = connection.recv(1)
+            if not chunk:
+                raise ConnectionError("incomplete CONNECT response")
+            header += chunk
+        assert header.startswith(b"HTTP/1.1 200 "), header
+        yield connection
+
+
+class HalfCloseTests(unittest.TestCase):
+    def test_client_half_close_preserves_complete_delayed_reply(self):
+        for size in (81920, 4 * 1024 * 1024):
+            payload = bytes(range(256)) * (size // 256)
+            with self.subTest(size=size), endpoint("download", payload) as (proxy, received, finished):
+                with relay.running(proxy) as port, connect(port) as client:
+                    client.sendall(b"complete request")
+                    client.shutdown(socket.SHUT_WR)
+                    time.sleep(0.05)  # Let the larger response encounter socket backpressure.
+                    self.assertEqual(read_all(client), payload)
+                    self.assertTrue(finished.wait(2))
+            self.assertEqual(received, [b"complete request"])
+
+    def test_upstream_half_close_preserves_remaining_upload(self):
+        payload = bytes(range(256)) * 4096
+        with endpoint("upload", b"response finished") as (proxy, received, finished):
+            with relay.running(proxy) as port, connect(port) as client:
+                self.assertEqual(read_all(client), b"response finished")
+                client.sendall(payload)
+                client.shutdown(socket.SHUT_WR)
+                self.assertTrue(finished.wait(2))
+        self.assertEqual(received, [payload])
+
+    def test_idle_half_closed_tunnel_still_expires_and_cleans_up(self):
+        with endpoint("upload", b"finished") as (proxy, received, finished):
+            with mock.patch.object(relay, "IDLE_TIMEOUT", 0.1), relay.running(proxy) as port:
+                with connect(port) as client:
+                    self.assertEqual(read_all(client), b"finished")
+                    self.assertTrue(finished.wait(2))
+                    self.assertEqual(received, [b""])
+        with self.assertRaises(OSError):
+            socket.create_connection(("127.0.0.1", port), timeout=0.1)
+
+
+class SecureTransportTests(unittest.IsolatedAsyncioTestCase):
+    async def test_transport_without_half_close_support_is_not_closed_by_upload_eof(self):
+        instance = relay.Relay.__new__(relay.Relay)
+        instance.loop = asyncio.get_running_loop()
+        reader = mock.Mock(read=mock.AsyncMock(side_effect=[b"complete request", b""]))
+        writer = mock.Mock(drain=mock.AsyncMock())
+        writer.can_write_eof.return_value = False
+        await instance._pump(reader, writer, [instance.loop.time()])
+        writer.write.assert_called_once_with(b"complete request")
+        writer.write_eof.assert_not_called()
+        writer.close.assert_not_called()
+
+    async def test_cancellation_during_cleanup_closes_both_connections(self):
+        gather = asyncio.gather
+        for phase in ("pumps", "writer"):
+            with self.subTest(phase=phase):
+                closing = asyncio.Event()
+
+                async def wait_for_close(*_args, **_kwargs):
+                    closing.set()
+                    await asyncio.Future()
+
+                instance = relay.Relay.__new__(relay.Relay)
+                instance.loop = asyncio.get_running_loop()
+                reader = mock.Mock(readuntil=mock.AsyncMock(return_value=b"CONNECT ignored:443 HTTP/1.1\r\n\r\n"))
+                upstream_reader = mock.Mock(readuntil=mock.AsyncMock(return_value=b"HTTP/1.1 200 OK\r\n\r\n"))
+                writer = mock.Mock(drain=mock.AsyncMock(), wait_closed=mock.AsyncMock(side_effect=wait_for_close))
+                upstream_writer = mock.Mock(wait_closed=mock.AsyncMock())
+                instance._upstream = mock.AsyncMock(return_value=(upstream_reader, upstream_writer))
+                instance._wait_for_streams = mock.AsyncMock()
+                cleanup = wait_for_close if phase == "pumps" else gather
+                with mock.patch.object(relay.asyncio, "gather", side_effect=cleanup):
+                    handler = asyncio.create_task(instance._handle(reader, writer))
+                    await asyncio.wait_for(closing.wait(), timeout=2)
+                    handler.cancel()
+                    with self.assertRaises(asyncio.CancelledError):
+                        await handler
+                writer.close.assert_called_once()
+                upstream_writer.close.assert_called_once()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.119
+1.0.121

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.119",
+  "version": "1.0.121",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {