gowalk-cicd 1.0.134 → 1.0.136

package/CLAUDE.md

@@ -142,6 +142,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   and HTTPS_PROXY variables also name the credential-free loopback relay because
   Crashlytics Buildtools reads them first and rejects authenticated proxy URLs. HTTPS is tunneled
   without TLS interception; no upstream failure may fall back to the destination.
+  Java bypasses the relay only for exact `localhost`, `127.0.0.1` and `[::1]`
+  targets so owned HTTP test fixtures remain local. Never widen that host list;
+  external requests and environment-first clients retain the assigned relay.
   The wrapper disables Gradle daemons and closes its relay when the command ends.
   The relay's idle deadline covers the whole tunnel: traffic in either direction
   keeps downloads/uploads alive. An idle direction alone must never end a transfer.

package/README.md

@@ -517,6 +517,10 @@ The relay authenticates to that exit without putting credentials in JVM options;
 HTTPS remains an end-to-end TLS tunnel. An unavailable proxy fails the request,
 and the relay shuts down with its child command. Gradle daemons are disabled for
 these commands so they cannot retain an expired relay port.
+Java requests to exact `localhost`, `127.0.0.1` and `[::1]` targets stay local for
+HTTP test fixtures. All other Java hosts, including lookalike names such as
+`localhost.example.com`, retain the assigned proxy; environment-first clients
+continue to use the relay.
 
 ### Private git dependencies (Flutter)
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.134
+1.0.136

package/action/scripts/native_bundle.py

@@ -18,6 +18,27 @@ import native_pods_process
 from native_prepare_evidence import report
 
 
+# The Ruby bundle is only one of the things this script can refuse over, but every
+# refusal used to carry the lockfile remediation below. printer-ai run 34374868740
+# failed because CocoaPods could not clone a dependency from github.com, and the
+# receipt told the session to "reconcile dependency locks locally" — locks that were
+# never wrong. A configuration command that fails inside its own child publishes its
+# own receipt and signals; point the reader at those instead (2026-09-09).
+BUNDLE_REMEDIATION = ("Use the app's committed Gemfile and Gemfile.lock with a compatible Ruby/Bundler "
+                      "runtime; reconcile dependency locks locally and retain deployment guards.")
+COMMAND_REMEDIATION = ("The configuration command failed inside its own child, not in the Ruby bundle. "
+                       "Read that child's own receipt and native_prepare_failed signals for the cause, "
+                       "and repair what they name.")
+BUNDLE_CODES = frozenset({
+    "native_gemfile_required", "native_gemfile_commit_required", "native_gemfile_lock_required",
+    "native_gemfile_lock_commit_required", "native_bundle_install_failed", "native_bundle_inputs_changed",
+})
+
+
+def remediation(code: str) -> str:
+    return BUNDLE_REMEDIATION if code in BUNDLE_CODES else COMMAND_REMEDIATION
+
+
 def command(argv: list[str], cwd: Path, log, *, timeout: float = 900) -> int:
     try:
         return native_pods_process.command(argv, cwd, log, timeout=timeout)
@@ -101,8 +122,7 @@ def main(argv: list[str]) -> int:
         answer = run(args.root, args.folder, args.proxy_helper, command_args)
     except (guard.Refused, OSError, subprocess.SubprocessError) as exc:
         code = str(exc) if isinstance(exc, guard.Refused) else "native_bundle_operation_unverified"
-        answer = {"ok": False, "code": code, "next": "Use the app's committed Gemfile and Gemfile.lock with a "
-                  "compatible Ruby/Bundler runtime; reconcile dependency locks locally and retain deployment guards."}
+        answer = {"ok": False, "code": code, "next": remediation(code)}
         if getattr(exc, "diagnostic", ""):
             answer["diagnostic"] = exc.diagnostic
     report(answer, "bundle")

package/action/scripts/native_pods_retry.py

@@ -19,6 +19,15 @@ PARTIAL = re.compile(r"\bcurl(?:\s+18\b|:\s*\(18\))", re.I)
 # downloaded: <url> Response: Timeout was reached". A timeout leaves the successfully
 # fetched specs cached, so the second attempt resumes rather than starting over.
 TIMED_OUT = re.compile(r"Response:\s*Timeout was reached|\bcurl(?:\s+28\b|:\s*\(28\))", re.I)
+# A handshake that dies mid-negotiation names no curl code and no verdict about the
+# peer, so neither pattern above can see it: printer-ai run 34374868740 lost the iOS
+# build to `LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to github.com:443`
+# while CocoaPods cloned a dependency, and 2phone-ios run 34374984763 lost the same
+# step to bundler's `SSL_connect returned=1 ... unexpected eof while reading`
+# (2026-09-09). Both are a connection the exit dropped before either side spoke, which
+# the next attempt usually completes. A CERTIFICATE verdict is a different fact and
+# stays permanent above: TERMINAL still vetoes this class whenever it appears.
+HANDSHAKE = re.compile(r"SSL_ERROR_SYSCALL|unexpected eof while reading", re.I)
 
 
 def interrupted_transfer(body: str) -> bool:
@@ -30,11 +39,17 @@ def timed_out(body: str) -> bool:
     return bool(TIMED_OUT.search(body) and not TERMINAL.search(body))
 
 
+def handshake_reset(body: str) -> bool:
+    return bool(HANDSHAKE.search(body) and not TERMINAL.search(body))
+
+
 def retryable(body: str) -> str:
     """Name the transient class this failure belongs to, or "" when it is not one."""
     if interrupted_transfer(body):
         return "partial_transfer"
-    return "transient_timeout" if timed_out(body) else ""
+    if timed_out(body):
+        return "transient_timeout"
+    return "handshake_reset" if handshake_reset(body) else ""
 
 
 def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 900) -> tuple[int, int]:

package/action/scripts/native_prepare_evidence.py

@@ -10,6 +10,12 @@ SIGNALS = {
     "bundler_version_missing": ("Could not find 'bundler'",),
     "tls_verification": ("certificate verify failed", "CERTIFICATE_VERIFY_FAILED"),
     "connection_timeout": ("Connection timed out", "execution expired", "Read timed out"),
+    # Distinct from tls_verification above: the peer never returned a verdict about its
+    # certificate, the connection died mid-handshake. printer-ai run 34374868740
+    # published signals=[] for `SSL_ERROR_SYSCALL in connection to github.com:443`
+    # (2026-09-09), so the session read an unclassified failure and repaired the wrong
+    # thing. Neither token appears in a certificate verdict.
+    "tls_handshake_reset": ("SSL_ERROR_SYSCALL", "unexpected eof while reading"),
     "dns_resolution": ("Could not resolve host", "getaddrinfo"),
     "partial_transfer": ("curl 18", "curl: (18)"),
     "disk_full": ("No space left on device",),

package/action/scripts/test_native_pods_retry.py

@@ -16,6 +16,16 @@ PARTIAL = "error: RPC failed; curl 18 transfer closed with outstanding read data
 # redaction — the form `retryable` actually sees.
 TIMEOUT = "\n".join(["CDN: trunk URL couldn't be downloaded: [URL redacted] "
                      "Response: Timeout was reached"] * 30)
+# Verbatim from printer-ai Mobile Deploy 34374868740, after the diagnostic's own URL
+# redaction: CocoaPods cloning a dependency when the exit dropped the connection.
+HANDSHAKE = ("Cloning into '[long value redacted]'...\n"
+             "fatal: unable to access '[URL redacted]': LibreSSL SSL_connect: "
+             "SSL_ERROR_SYSCALL in connection to github.com:443")
+# The same fault one layer earlier, from 2phone-ios run 34374984763: bundler fetching
+# specs. It names no curl code and no SSL_ERROR_SYSCALL, only the truncated read.
+BUNDLER_EOF = ("Retrying fetcher due to error (2/2): Bundler::HTTPError Could not fetch specs "
+               "due to underlying error <SSL_connect returned=1 errno=0 state=error: "
+               "unexpected eof while reading>")
 
 
 class RetryTests(unittest.TestCase):
@@ -121,6 +131,43 @@ class RetryTests(unittest.TestCase):
             with self.subTest(body=body):
                 self.assertEqual(native_pods_retry.retryable(body), "")
 
+    def test_dropped_handshake_recovers_within_the_same_deadline(self):
+        for failure in (HANDSHAKE, BUNDLER_EOF):
+            with self.subTest(failure=failure.splitlines()[-1][:40]):
+                (self.root / "attempts.json").unlink(missing_ok=True)
+                self.script([failure])
+                code, result = self.fixture.run_cli()
+                self.assertEqual((code, result["pod_attempts"]), (0, 2))
+                attempts = json.loads((self.root / "attempts.json").read_text())
+                self.assertEqual(len(attempts), 2)
+                for attempt in attempts:
+                    self.assertEqual(attempt["argv"], ["install", "--deployment", "--no-repo-update"])
+                    self.assertTrue(attempt["proxy"].startswith("http://127.0.0.1:"))
+                self.assertEqual((self.root / "Podfile.lock").read_text(), "fixture-lock")
+
+    def test_repeat_dropped_handshake_stops_after_second_attempt(self):
+        self.script([HANDSHAKE, HANDSHAKE, HANDSHAKE])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["code"]), (1, "native_pods_install_failed"))
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 2)
+
+    def test_a_certificate_verdict_beside_a_dropped_handshake_stays_permanent(self):
+        for failure in ("certificate verify failed", "SSL peer shut down incorrectly",
+                        "The requested URL returned error: 403", "curl: (60) unknown trust failure"):
+            with self.subTest(failure=failure):
+                (self.root / "attempts.json").unlink(missing_ok=True)
+                self.script([HANDSHAKE + "\n" + failure])
+                self.assertEqual(self.fixture.run_cli()[0], 1)
+                self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
+
+    def test_a_dropped_handshake_is_its_own_named_class(self):
+        self.assertEqual(native_pods_retry.retryable(HANDSHAKE), "handshake_reset")
+        self.assertEqual(native_pods_retry.retryable(BUNDLER_EOF), "handshake_reset")
+        for body in ("the peer read the file", "eof while reading the manifest",
+                     "connection established", "SSL is configured"):
+            with self.subTest(body=body):
+                self.assertEqual(native_pods_retry.retryable(body), "")
+
     def test_one_deadline_and_no_guess_from_generic_eof(self):
         for body in ("fatal: early EOF", "curl 180 failure", "unknown network error"):
             self.assertFalse(native_pods_retry.interrupted_transfer(body))

package/action/scripts/test_native_prepare_evidence.py

@@ -30,6 +30,32 @@ class EvidenceTests(unittest.TestCase):
                 self.assertEqual(receipt["phase"], phase)
                 self.assertEqual(receipt["signals"], ["pod_version_conflict"])
 
+    def test_a_dropped_handshake_is_named_and_is_not_a_certificate_verdict(self):
+        for diagnostic, expected in [
+            ("fatal: unable to access '[URL redacted]': LibreSSL SSL_connect: "
+             "SSL_ERROR_SYSCALL in connection to github.com:443", ["tls_handshake_reset"]),
+            ("Bundler::HTTPError Could not fetch specs due to underlying error "
+             "<SSL_connect returned=1 errno=0 state=error: unexpected eof while reading>",
+             ["tls_handshake_reset"]),
+            ("SSL_connect returned=1 errno=0 state=error: certificate verify failed",
+             ["tls_verification"]),
+        ]:
+            err = io.StringIO()
+            with self.subTest(diagnostic=diagnostic[:40]), contextlib.redirect_stderr(err):
+                report({"ok": False, "code": "native_pods_install_failed", "diagnostic": diagnostic}, "pods")
+            self.assertEqual(json.loads(err.getvalue().strip().split("::", 2)[2])["signals"], expected)
+
+    def test_a_failed_child_command_is_not_reported_as_a_ruby_bundle_fault(self):
+        self.assertEqual(native_bundle.remediation("native_gemfile_lock_commit_required"),
+                         native_bundle.BUNDLE_REMEDIATION)
+        self.assertEqual(native_bundle.remediation("native_bundle_install_failed"),
+                         native_bundle.BUNDLE_REMEDIATION)
+        for code in ("native_configuration_failed", "native_pods_operation_interrupted",
+                     "native_bundle_operation_unverified", "native_google_proxy_required"):
+            with self.subTest(code=code):
+                self.assertEqual(native_bundle.remediation(code), native_bundle.COMMAND_REMEDIATION)
+                self.assertNotIn("Gemfile", native_bundle.remediation(code))
+
     def test_success_is_silent_and_unknown_failures_cannot_inject_annotations(self):
         err = io.StringIO()
         with contextlib.redirect_stderr(err):

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.134
+1.0.136

package/android-action/scripts/jvm_proxy_relay.py

@@ -149,7 +149,7 @@ def running(proxy: str):
 
 def environment(env: dict, port: int) -> dict:
     # Crashlytics Buildtools prefers HTTP_PROXY to JVM options and rejects URLs
-    # with userinfo. All child clients use the same owned relay; authentication
+    # with userinfo. External child requests use the same owned relay; authentication
     # is added only on its connection to the configured account exit.
     local = f"http://127.0.0.1:{port}"
     for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
@@ -157,7 +157,8 @@ def environment(env: dict, port: int) -> dict:
     env.update(NO_PROXY="", no_proxy="")
     options = (f"-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort={port} "
                f"-Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort={port} "
-               "-Dhttp.nonProxyHosts= -Dhttps.nonProxyHosts= -Djava.net.useSystemProxies=false")
+               "-Dhttp.nonProxyHosts=localhost|127.0.0.1|[::1] "
+               "-Dhttps.nonProxyHosts=localhost|127.0.0.1|[::1] -Djava.net.useSystemProxies=false")
     # Java prints these options at startup; they contain no proxy credentials.
     for name in ("JAVA_TOOL_OPTIONS", "JDK_JAVA_OPTIONS", "_JAVA_OPTIONS", "GRADLE_OPTS"):
         env[name] = (env.get(name, "") + " " + options).strip()

package/android-action/scripts/test_jvm_proxy_loopback.py

@@ -0,0 +1,91 @@
+"""Local HTTP fixtures stay local while every external Java request keeps the assigned relay."""
+from contextlib import contextmanager
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import os
+from pathlib import Path
+import shutil
+import socket
+import subprocess
+import tempfile
+import threading
+import unittest
+
+import jvm_proxy_relay as relay
+from test_jvm_proxy_relay import upstream
+
+
+@contextmanager
+def fixture(ipv6=False):
+    seen = []
+
+    class Handler(BaseHTTPRequestHandler):
+        def do_GET(self):
+            seen.append(self.path)
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(b"owned local fixture")
+
+        def log_message(self, *_):
+            pass
+
+    class Server(ThreadingHTTPServer):
+        address_family = socket.AF_INET6 if ipv6 else socket.AF_INET
+
+    server = Server(("::1" if ipv6 else "127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        yield server.server_port, seen
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=5)
+
+
+def java_probe(port, urls):
+    source = '''import java.net.*;
+public class Probe {
+  public static void main(String[] args) throws Exception {
+    for (var url : args) {
+      var connection = URI.create(url).toURL().openConnection();
+      connection.setConnectTimeout(3000); connection.setReadTimeout(3000);
+      System.out.println(new String(connection.getInputStream().readAllBytes()));
+    }
+  }
+}'''
+    with tempfile.TemporaryDirectory() as directory:
+        path = Path(directory) / "Probe.java"
+        path.write_text(source)
+        env = relay.environment({**os.environ, "JAVA_TOOL_OPTIONS": "-Dhttp.nonProxyHosts=*"}, port)
+        return subprocess.run(["java", str(path), *urls], env=env, capture_output=True, text=True, timeout=20)
+
+
+@unittest.skipUnless(shutil.which("java"), "Java runtime unavailable")
+class LoopbackTests(unittest.TestCase):
+    def test_ipv4_and_localhost_fixtures_bypass_only_the_owned_relay(self):
+        with fixture() as (local, requests), upstream() as (proxy, seen), relay.running(proxy) as port:
+            result = java_probe(port, [f"http://127.0.0.1:{local}/literal", f"http://localhost:{local}/hostname",
+                                       "http://unresolvable.invalid/provider", "http://localhost.invalid/provider"])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout.splitlines(), ["owned local fixture", "owned local fixture",
+                                                      "through pinned proxy", "through pinned proxy"])
+        self.assertEqual(requests, ["/literal", "/hostname"])
+        self.assertEqual([row[1] for row in seen], ["http://unresolvable.invalid/provider",
+                                                   "http://localhost.invalid/provider"])
+        self.assertTrue(all(row[2].startswith("Basic ") for row in seen))
+        self.assertNotIn("fixture-pass", result.stderr)
+
+    def test_ipv6_loopback_fixture_remains_local(self):
+        try:
+            with fixture(ipv6=True) as (local, requests), upstream() as (proxy, seen), relay.running(proxy) as port:
+                result = java_probe(port, [f"http://[::1]:{local}/ipv6", "http://unresolvable.invalid/provider"])
+        except OSError as exc:
+            self.skipTest(f"IPv6 fixture unavailable: {exc.errno}")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout.splitlines(), ["owned local fixture", "through pinned proxy"])
+        self.assertEqual(requests, ["/ipv6"])
+        self.assertEqual([row[1] for row in seen], ["http://unresolvable.invalid/provider"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.134
+1.0.136

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.134",
+  "version": "1.0.136",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {