gowalk-cicd 1.0.120 → 1.0.122

package/CLAUDE.md

@@ -145,6 +145,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   The wrapper disables Gradle daemons and closes its relay when the command ends.
   The relay's idle deadline covers the whole tunnel: traffic in either direction
   keeps downloads/uploads alive. An idle direction alone must never end a transfer.
+  A clean directional EOF forwards a half-close when the transport supports it and
+  leaves the opposite stream alive until completion, error or the shared idle deadline.
+  Never cancel an unfinished reply or upload merely because the other pump completed.
 - Flutter bootstrap is part of that boundary: before the Flutter setup action,
   `play_store_proxy.py --bootstrap-env` validates the Google account pin and writes
   both proxy/bypass spellings to the private job environment without console output.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.120
+1.0.122

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.120
+1.0.122

package/android-action/scripts/jvm_proxy_relay.py

@@ -68,6 +68,19 @@ class Relay:
             activity[0] = self.loop.time()
             writer.write(data)
             await writer.drain()
+        if writer.can_write_eof():
+            writer.write_eof()
+            await writer.drain()
+
+    async def _wait_for_streams(self, pumps):
+        pending, idle = set(pumps[:2]), pumps[2]
+        while pending:
+            done, _ = await asyncio.wait([*pending, idle], return_when=asyncio.FIRST_COMPLETED)
+            if idle in done:
+                return
+            for task in done:
+                task.result()
+            pending.difference_update(done)
 
     async def _idle(self, activity):
         while remaining := max(0.0, activity[0] + IDLE_TIMEOUT - self.loop.time()):
@@ -91,7 +104,9 @@ class Relay:
             pumps = [asyncio.create_task(self._pump(reader, upstream, activity)),
                      asyncio.create_task(self._pump(upstream_reader, writer, activity)),
                      asyncio.create_task(self._idle(activity))]
-            await asyncio.wait(pumps, return_when=asyncio.FIRST_COMPLETED)
+            # A clean directional EOF still permits the other side to finish.
+            # Errors or the shared idle deadline continue to close the tunnel.
+            await self._wait_for_streams(pumps)
         except (OSError, ValueError, IndexError, asyncio.TimeoutError,
                 asyncio.IncompleteReadError, asyncio.LimitOverrunError):
             # Once bytes flow, the stream is the client's protocol (usually TLS): a
@@ -102,15 +117,18 @@ class Relay:
         finally:
             for task in pumps:
                 task.cancel()
+            # Cleanup itself can be cancelled while awaiting a pump or writer.
+            # Close both transports before the first cancellable cleanup await.
+            connections = [connection for connection in (writer, upstream) if connection]
+            for connection in connections:
+                connection.close()
             if pumps:
                 await asyncio.gather(*pumps, return_exceptions=True)
-            for connection in (writer, upstream):
-                if connection:
-                    connection.close()
-                    try:
-                        await connection.wait_closed()
-                    except OSError:
-                        pass
+            for connection in connections:
+                try:
+                    await connection.wait_closed()
+                except OSError:
+                    pass
 
 
 @contextmanager

package/android-action/scripts/play_preflight_transport.py

@@ -88,7 +88,16 @@ def call(phase: str, operation, *, retry: bool = False, edit_id: str | None = No
         else:
             if not retry or getattr(result, "status_code", None) not in RETRY_STATUSES:
                 if accepted is not None and result.status_code not in accepted:
-                    fail(phase, "provider_refused", attempt, status=result.status_code, edit_id=edit_id)
+                    # A transient upstream status is not a refusal, even where the
+                    # phase may not replay it: `edit_create` never repeats an
+                    # ambiguous insert, so a 503 there ends the build — and calling
+                    # that "provider_refused" sent the next session hunting for a
+                    # configuration Google never objected to (Foundy, 2026-09-09,
+                    # run 34345638488). The remedy for one is to dispatch again;
+                    # for the other it is to change something first.
+                    code = ("provider_unavailable" if result.status_code in RETRY_STATUSES
+                            else "provider_refused")
+                    fail(phase, code, attempt, status=result.status_code, edit_id=edit_id)
                 return result
             if attempt == limit:
                 fail(phase, "provider_unavailable", attempt, status=result.status_code, edit_id=edit_id)

package/android-action/scripts/test_play_preflight_transport.py

@@ -63,6 +63,26 @@ class PreflightTransportTests(unittest.TestCase):
         self.assertIn('"edit_id": "123"', str(caught.exception))
         self.assertEqual(operation.call_count, 3)
 
+    def test_a_transient_status_is_unavailable_even_where_the_phase_cannot_replay(self):
+        """`edit_create` must not repeat an ambiguous insert, but naming its 503 a
+        refusal told the next session to go and fix a configuration Google never
+        objected to. The status decides the word; the retry policy is unchanged."""
+        operation = mock.Mock(return_value=mock.Mock(status_code=503))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, accepted=(200, 404), retry_connect=True)
+        self.assertIn('"code": "provider_unavailable"', str(caught.exception))
+        self.assertIn('"status": 503', str(caught.exception))
+        self.assertIn('"attempts": 1', str(caught.exception))
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+
+    def test_a_real_refusal_keeps_its_own_word(self):
+        operation = mock.Mock(return_value=mock.Mock(status_code=403))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, accepted=(200, 404), retry_connect=True)
+        self.assertIn('"code": "provider_refused"', str(caught.exception))
+        self.assertIn('"status": 403', str(caught.exception))
+
     def test_refusal_after_retry_records_the_actual_attempt_in_a_safe_annotation(self):
         operation = mock.Mock(side_effect=[mock.Mock(status_code=503), mock.Mock(status_code=403)])
         with self.assertRaises(SystemExit) as caught:

package/android-action/scripts/test_relay_half_close.py

@@ -0,0 +1,148 @@
+"""Owned socket regressions for complete replies and uploads after directional EOF."""
+import asyncio
+from contextlib import contextmanager
+import socket
+import threading
+import time
+import unittest
+from unittest import mock
+
+import jvm_proxy_relay as relay
+
+
+def read_all(connection):
+    chunks = []
+    while chunk := connection.recv(65536):
+        chunks.append(chunk)
+    return b"".join(chunks)
+
+
+@contextmanager
+def endpoint(mode, payload):
+    listener = socket.socket()
+    listener.bind(("127.0.0.1", 0))
+    listener.listen(1)
+    listener.settimeout(3)
+    received, failures, finished = [], [], threading.Event()
+
+    def serve():
+        try:
+            with listener.accept()[0] as connection:
+                connection.settimeout(3)
+                header = b""
+                while not header.endswith(b"\r\n\r\n"):
+                    chunk = connection.recv(1)
+                    if not chunk:
+                        raise ConnectionError("incomplete CONNECT header")
+                    header += chunk
+                connection.sendall(b"HTTP/1.1 200 Connection established\r\n\r\n")
+                if mode == "download":
+                    received.append(read_all(connection))
+                connection.sendall(payload)
+                connection.shutdown(socket.SHUT_WR)
+                if mode == "upload":
+                    received.append(read_all(connection))
+        except OSError as exc:
+            failures.append(type(exc).__name__)
+        finally:
+            listener.close()
+            finished.set()
+
+    thread = threading.Thread(target=serve)
+    thread.start()
+    try:
+        yield f"http://127.0.0.1:{listener.getsockname()[1]}", received, finished
+    finally:
+        thread.join(timeout=5)
+        listener.close()
+        assert not thread.is_alive(), "owned upstream did not finish"
+        assert not failures, failures
+
+
+@contextmanager
+def connect(port):
+    with socket.create_connection(("127.0.0.1", port), timeout=3) as connection:
+        connection.sendall(b"CONNECT unresolvable.invalid:443 HTTP/1.1\r\nHost: ignored\r\n\r\n")
+        header = b""
+        while not header.endswith(b"\r\n\r\n"):
+            chunk = connection.recv(1)
+            if not chunk:
+                raise ConnectionError("incomplete CONNECT response")
+            header += chunk
+        assert header.startswith(b"HTTP/1.1 200 "), header
+        yield connection
+
+
+class HalfCloseTests(unittest.TestCase):
+    def test_client_half_close_preserves_complete_delayed_reply(self):
+        for size in (81920, 4 * 1024 * 1024):
+            payload = bytes(range(256)) * (size // 256)
+            with self.subTest(size=size), endpoint("download", payload) as (proxy, received, finished):
+                with relay.running(proxy) as port, connect(port) as client:
+                    client.sendall(b"complete request")
+                    client.shutdown(socket.SHUT_WR)
+                    time.sleep(0.05)  # Let the larger response encounter socket backpressure.
+                    self.assertEqual(read_all(client), payload)
+                    self.assertTrue(finished.wait(2))
+            self.assertEqual(received, [b"complete request"])
+
+    def test_upstream_half_close_preserves_remaining_upload(self):
+        payload = bytes(range(256)) * 4096
+        with endpoint("upload", b"response finished") as (proxy, received, finished):
+            with relay.running(proxy) as port, connect(port) as client:
+                self.assertEqual(read_all(client), b"response finished")
+                client.sendall(payload)
+                client.shutdown(socket.SHUT_WR)
+                self.assertTrue(finished.wait(2))
+        self.assertEqual(received, [payload])
+
+    def test_idle_half_closed_tunnel_still_expires_and_cleans_up(self):
+        with endpoint("upload", b"finished") as (proxy, received, finished):
+            with mock.patch.object(relay, "IDLE_TIMEOUT", 0.1), relay.running(proxy) as port:
+                with connect(port) as client:
+                    self.assertEqual(read_all(client), b"finished")
+                    self.assertTrue(finished.wait(2))
+                    self.assertEqual(received, [b""])
+        with self.assertRaises(OSError):
+            socket.create_connection(("127.0.0.1", port), timeout=0.1)
+
+
+class SecureTransportTests(unittest.IsolatedAsyncioTestCase):
+    async def test_transport_without_half_close_support_is_not_closed_by_upload_eof(self):
+        instance = relay.Relay.__new__(relay.Relay)
+        instance.loop = asyncio.get_running_loop()
+        reader = mock.Mock(read=mock.AsyncMock(side_effect=[b"complete request", b""]))
+        writer = mock.Mock(drain=mock.AsyncMock())
+        writer.can_write_eof.return_value = False
+        await instance._pump(reader, writer, [instance.loop.time()])
+        writer.write.assert_called_once_with(b"complete request")
+        writer.write_eof.assert_not_called()
+        writer.close.assert_not_called()
+
+    async def test_cancellation_during_cleanup_closes_both_connections(self):
+        gather = asyncio.gather
+        for phase in ("pumps", "writer"):
+            with self.subTest(phase=phase):
+                closing = asyncio.Event()
+
+                async def wait_for_close(*_args, **_kwargs):
+                    closing.set()
+                    await asyncio.Future()
+
+                instance = relay.Relay.__new__(relay.Relay)
+                instance.loop = asyncio.get_running_loop()
+                reader = mock.Mock(readuntil=mock.AsyncMock(return_value=b"CONNECT ignored:443 HTTP/1.1\r\n\r\n"))
+                upstream_reader = mock.Mock(readuntil=mock.AsyncMock(return_value=b"HTTP/1.1 200 OK\r\n\r\n"))
+                writer = mock.Mock(drain=mock.AsyncMock(), wait_closed=mock.AsyncMock(side_effect=wait_for_close))
+                upstream_writer = mock.Mock(wait_closed=mock.AsyncMock())
+                instance._upstream = mock.AsyncMock(return_value=(upstream_reader, upstream_writer))
+                instance._wait_for_streams = mock.AsyncMock()
+                cleanup = wait_for_close if phase == "pumps" else gather
+                with mock.patch.object(relay.asyncio, "gather", side_effect=cleanup):
+                    handler = asyncio.create_task(instance._handle(reader, writer))
+                    await asyncio.wait_for(closing.wait(), timeout=2)
+                    handler.cancel()
+                    with self.assertRaises(asyncio.CancelledError):
+                        await handler
+                writer.close.assert_called_once()
+                upstream_writer.close.assert_called_once()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.120
+1.0.122

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.120",
+  "version": "1.0.122",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {