embeddedci 2.4.0__tar.gz → 2.6.0__tar.gz

{embeddedci-2.4.0 → embeddedci-2.6.0}/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog — `embeddedci`
 
+## 2.6.0
+
+- Cloud: the tunnel WebSocket sends the session token as an `Authorization: Bearer` header (and
+  the lease as `X-Benchpod-Lease`) instead of `?token=` in the URL, so the token stays out of
+  access logs. A tunnel error message never shows the token.
+- Cloud: a client-side upload over `embeddedci:<device>` (`replay()` of a waveform, SPI PSRAM
+  staging) goes out in frames of at most 1 KiB, paced to 128 KiB/s. It used to be one WebSocket
+  frame, which the pod drops without an error above about 1.5 KB. The upload also skips the
+  `{"ack":N}` progress lines the pod sends on a cloud tunnel instead of taking the first one as
+  the completion.
+- `PowerStatus.pod`: the pod's own 5 V draw, on boards that measure it (INA226 at 0x41, the
+  v3r1 analog and v3r2 digital boards). `PowerStatus.total_current` adds the DUT's internal rail
+  to it, which is what the USB input delivers. Both are `None` on other boards and on firmware
+  up to 3.5.1.
+- `Capabilities.pod_current`: the board has that monitor. Parsed from the pod's `status` and the
+  server's `cap.pod_current`.
+
+## 2.5.0
+
+- `Capabilities.can`: the pod has classic CAN on CAN+/CAN- (`open_can`). Parsed from the pod's
+  `status` and the server's `cap.can`. False on firmware before 3.5.1, which has CAN but does not
+  announce it. Firmware 3.5.1 announces it.
+- `flash()` with `target_power` waits for the target to answer on every connect attempt, not only
+  the first, so a retry after a target that answered too early (a NUCLEO's ST-LINK still holding
+  it) waits for it to settle as well.
+- `CanReadResult.overflow` is documented as what the pod reports: frames dropped since the last
+  `can_config` (a running total), not since the last read.
+
 ## 2.4.0
 
 - **Breaking:** the 4-20 mA measurement terminal (J8) is now `"current_in"` as an ADC source

{embeddedci-2.4.0 → embeddedci-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: embeddedci
-Version: 2.4.0
+Version: 2.6.0
 Summary: BenchPod SDK and pytest plugin for EmbeddedCI hardware-in-the-loop testing
 Project-URL: Homepage, https://embeddedci.com
 Project-URL: Repository, https://github.com/embeddedci-com/embeddedci-python

{embeddedci-2.4.0 → embeddedci-2.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "embeddedci"
-version = "2.4.0"
+version = "2.6.0"
 description = "BenchPod SDK and pytest plugin for EmbeddedCI hardware-in-the-loop testing"
 readme = "README.md"
 requires-python = ">=3.10"

{embeddedci-2.4.0 → embeddedci-2.6.0}/src/embeddedci/benchpod/can.py

@@ -77,7 +77,8 @@ class CanReadResult:
     """Frames drained from the pod's RX ring by one ``BenchPod.can_read``."""
 
     frames: List[CanFrame] = field(default_factory=list)
-    #: Frames the pod dropped because its RX ring was full since the last read.
+    #: Frames the pod dropped because its RX ring was full, counted since the last
+    #: ``can_config`` (a running total, not reset by reads).
     overflow: int = 0
 
     @classmethod

{embeddedci-2.4.0 → embeddedci-2.6.0}/src/embeddedci/benchpod/capabilities.py

@@ -168,6 +168,11 @@ class Capabilities:
     calibrate: bool = False
     #: The pod can hold a current on its 4-20 mA output (J9): :meth:`BenchPod.current_out`.
     current_out: bool = False
+    #: Classic CAN on the pod's CAN+/CAN- terminals: :meth:`BenchPod.open_can`. Firmware older
+    #: than the flag still has CAN on every v2/v3 pod; it just doesn't say so.
+    can: bool = False
+    #: The board measures the pod's own 5 V current: :attr:`PowerStatus.pod`.
+    pod_current: bool = False
 
     #: LA I/O-bank voltage the pod currently reports (mV), if known.
     la_vccio_mv: int = 0
@@ -247,6 +252,8 @@ class Capabilities:
                 ("spi_stream", "spi_stream"),
                 ("calibrate", "calibrate"),
                 ("current_out", "current_out"),
+                ("can", "can"),
+                ("pod_current", "pod_current"),
             ):
                 if name in names and hasattr(c, attr):
                     setattr(c, attr, True)
@@ -298,6 +305,7 @@ class Capabilities:
             ("nrst_pin", "cap.nrst_pin"), ("usb_cc", "cap.usb_cc"),
             ("spi_master", "cap.spi_master"), ("spi_stream", "cap.spi_stream"),
             ("calibrate", "cap.calibrate"), ("current_out", "cap.current_out"),
+            ("can", "cap.can"), ("pod_current", "cap.pod_current"),
         ):
             b = _as_bool(params, key)
             if b is not None:

{embeddedci-2.4.0 → embeddedci-2.6.0}/src/embeddedci/benchpod/flash.py

@@ -217,7 +217,9 @@ def flash(
     for attempt in range(attempts):
         pod_link = transport.dap_start(
             swclk, swdio, packet_size=_DAP_MAX_PACKET, packet_count=_DAP_PACKET_COUNT,
-            wait_ms=TARGET_ANSWER_WAIT_MS if (target_power is not None and attempt == 0) else None)
+            # Every attempt, not just the first: a retry after a target that answered too early
+            # (a NUCLEO's ST-LINK still holding it) must wait for it to settle as well.
+            wait_ms=TARGET_ANSWER_WAIT_MS if target_power is not None else None)
         try:
             result = _run_bridge(bin_path, args, pod_link, timeout=timeout)
         finally:

{embeddedci-2.4.0 → embeddedci-2.6.0}/src/embeddedci/benchpod/state.py

@@ -111,6 +111,12 @@ class PowerStatus:
 
     internal: RailPower
     external: RailPower
+    #: The pod's own 5 V draw, on boards that measure it (``Capabilities.pod_current``); ``None``
+    #: otherwise. The DUT's internal rail bypasses this monitor.
+    pod: Optional[RailPower] = None
+    #: Pod + DUT internal rail in amps: what the USB input delivers. ``None`` unless the pod
+    #: reported it (both monitors read).
+    total_current: Optional[float] = None
     raw: Dict[str, Any] = _raw()
 
     def rail(self, efuse: "Efuse | int") -> RailPower:
@@ -127,7 +133,10 @@ class PowerStatus:
                              bus_voltage=(_opt_int(r, "bus_mv") or 0) / 1000.0,
                              current=(_opt_int(r, "current_ua") or 0) / 1e6)
 
-        return cls(internal=one("internal"), external=one("external"), raw=d)
+        pod = one("pod") if isinstance(d.get("pod"), Mapping) else None
+        total_ua = _opt_int(_d(d.get("pod")), "total_ua")
+        return cls(internal=one("internal"), external=one("external"), pod=pod,
+                   total_current=None if total_ua is None else total_ua / 1e6, raw=d)
 
 
 @dataclass(frozen=True)

{embeddedci-2.4.0 → embeddedci-2.6.0}/src/embeddedci/benchpod/transport/cloud.py

@@ -30,6 +30,17 @@ _EDGE_ERRORS = {502, 503, 504, 520, 521, 522, 523, 524}
 #: Renew a minted session token this many seconds before it expires.
 _RENEW_MARGIN = 120.0
 
+#: Largest raw payload of one client->pod WebSocket frame. The server forwards each client frame
+#: as one ``tunnel.data`` message (base64url plus a ~70-byte JSON envelope) and the pod copies that
+#: message into a 2048-byte buffer (firmware BP_CLOUD_RX_MAX): a frame over about 1.5 KB raw is
+#: dropped without an error. 1024 raw bytes is 1366 base64 characters, well inside the limit.
+TUNNEL_FRAME_MAX = 1024
+#: Rate cap for one large client upload (``load_bin`` for replay/SPI staging), the same backstop the
+#: server's own DAC upload uses (benchpodUploadBytesPerSec): the pod acknowledges TCP eagerly, so
+#: without pacing a fast burst overruns its 16 KB receive buffer or the server's per-pod inbox
+#: and the tunnel ends.
+TUNNEL_UPLOAD_BYTES_PER_SEC = 128 * 1024
+
 
 def _server_error(detail: str) -> str:
     """The ``error`` field of a server JSON error body, else the raw text."""
@@ -67,6 +78,14 @@ def _transient(code: int, detail: str) -> bool:
     return False
 
 
+def _redact(text: str, secrets: "tuple[str, ...]") -> str:
+    """``text`` with every secret (a session token, say) replaced, for error messages."""
+    for secret in secrets:
+        if secret:
+            text = text.replace(secret, "[redacted]").replace(quote(secret, safe=""), "[redacted]")
+    return text
+
+
 def _repeatable(req: dict) -> bool:
     # An edge error does not prove the pod never ran the command, so never repeat one that
     # acts on the target: a CAN frame, a reset pulse or a step-pulse train would happen twice.
@@ -88,7 +107,12 @@ class _WsTunnelSocket:
     treat a dropped tunnel the same as a closed socket.
     """
 
-    def __init__(self, url: str, timeout: float) -> None:
+    #: Clock and sleep used for upload pacing (tests swap them).
+    _clock = staticmethod(time.monotonic)
+    _sleep = staticmethod(time.sleep)
+
+    def __init__(self, url: str, timeout: float, headers: "list[str] | None" = None,
+                 secrets: "tuple[str, ...]" = ()) -> None:
         try:
             import websocket  # websocket-client (optional extra: embeddedci[cloud])
         except ImportError as exc:  # pragma: no cover - exercised only without the extra
@@ -100,13 +124,17 @@ class _WsTunnelSocket:
             # default Python/websocket-client signature (HTTP 403, error 1010).
             self._ws = websocket.create_connection(
                 url, timeout=timeout, enable_multithread=True,
-                header=[f"User-Agent: {USER_AGENT}"],
+                header=[f"User-Agent: {USER_AGENT}", *(headers or [])],
             )
         except Exception as exc:
-            err = TransportError(f"could not open cloud tunnel: {exc}")
+            text = str(exc)
+            safe = _redact(text, secrets)
+            err = TransportError(f"could not open cloud tunnel: {safe}")
             # websocket-client's WebSocketBadStatusException carries the HTTP status of the upgrade.
             err.status = getattr(exc, "status_code", None)  # type: ignore[attr-defined]
             err.body = getattr(exc, "resp_body", None)  # type: ignore[attr-defined]
+            if safe != text:  # the original would show the token in a traceback
+                raise err from None
             raise err from exc
         self._buf = bytearray()
         self._closed = False
@@ -137,7 +165,17 @@ class _WsTunnelSocket:
         return take
 
     def sendall(self, data: bytes) -> None:
-        self._ws.send_binary(bytes(data))
+        """Send ``data`` as WebSocket binary frames of at most :data:`TUNNEL_FRAME_MAX` bytes, in
+        order. A write larger than one frame (a ``load_bin`` upload) is paced to
+        :data:`TUNNEL_UPLOAD_BYTES_PER_SEC`; small writes (commands, DAP packets) go out at once."""
+        view = memoryview(bytes(data))
+        start = self._clock()
+        for off in range(0, len(view), TUNNEL_FRAME_MAX):
+            if off:
+                behind = start + off / TUNNEL_UPLOAD_BYTES_PER_SEC - self._clock()
+                if behind > 0:
+                    self._sleep(behind)
+            self._ws.send_binary(bytes(view[off:off + TUNNEL_FRAME_MAX]))
 
     def shutdown(self, _how) -> None:
         return None
@@ -212,6 +250,8 @@ class CloudTransport(TcpTransport):
         return True
 
     def _ws_url(self) -> str:
+        """The tunnel URL. It carries no credentials: those go in :meth:`_ws_headers`, so the
+        token never reaches an access log or an error message."""
         base = self.api_base
         if base.startswith("https://"):
             ws_base = "wss://" + base[len("https://"):]
@@ -219,22 +259,29 @@ class CloudTransport(TcpTransport):
             ws_base = "ws://" + base[len("http://"):]
         else:
             ws_base = base
-        token = self._session_token()
-        url = (
-            f"{ws_base}/api/cloud/devices/ws"
-            f"?device={quote(self.device_name, safe='')}&token={quote(token, safe='')}"
-        )
+        return f"{ws_base}/api/cloud/devices/ws?device={quote(self.device_name, safe='')}"
+
+    def _ws_headers(self, token: str) -> "list[str]":
+        """Headers for the tunnel's WebSocket upgrade: the session token as a Bearer header
+        (the server's requireGithubActionToken reads it before the ``?token=`` fallback) and the
+        lease, if any."""
+        headers = [f"Authorization: Bearer {token}"]
         if self.lease_id:
-            url += f"&lease_id={quote(self.lease_id, safe='')}"
-        return url
+            headers.append(f"X-Benchpod-Lease: {self.lease_id}")
+        return headers
+
+    def _open_tunnel(self) -> _WsTunnelSocket:
+        token = self._session_token()
+        return _WsTunnelSocket(self._ws_url(), self.timeout, headers=self._ws_headers(token),
+                               secrets=(token,))
 
     def _dial(self) -> _WsTunnelSocket:  # type: ignore[override]
         try:
-            sock = _WsTunnelSocket(self._ws_url(), self.timeout)
+            sock = self._open_tunnel()
         except TransportError as exc:
             status = getattr(exc, "status", None)
             if status == 401 and self._invalidate_token():
-                sock = _WsTunnelSocket(self._ws_url(), self.timeout)
+                sock = self._open_tunnel()
             else:
                 body = getattr(exc, "body", None) or b""
                 if isinstance(body, bytes):

{embeddedci-2.4.0 → embeddedci-2.6.0}/src/embeddedci/benchpod/transport/tcp.py

@@ -108,6 +108,20 @@ class TcpTransport(Transport):
                 raise TransportError("connection closed before a full reply line")
             buf.extend(chunk)
 
+    @classmethod
+    def _recv_load_bin_done(cls, sock: socket.socket, buf: bytearray) -> bytes:
+        """Read the ``load_bin`` completion line, skipping the ``{"ack":N}`` progress lines the
+        pod interleaves on a cloud tunnel (firmware sends them only there, for flow control)."""
+        while True:
+            line = cls._recv_line(sock, buf)
+            try:
+                obj = json.loads(line)
+            except ValueError:
+                return line
+            if isinstance(obj, dict) and "ack" in obj and "status" not in obj:
+                continue
+            return line
+
     @staticmethod
     def _recv_line_exact(sock: socket.socket) -> bytes:
         """Read one line a byte at a time, leaving everything after ``\\n``.
@@ -215,7 +229,7 @@ class TcpTransport(Transport):
             sock.sendall(encode_request(begin))
             raise_for_status(parse_reply(self._recv_line(sock, buf)), cmd="load_bin")
             sock.sendall(bytes(data))
-            raise_for_status(parse_reply(self._recv_line(sock, buf)), cmd="load_bin")
+            raise_for_status(parse_reply(self._recv_load_bin_done(sock, buf)), cmd="load_bin")
             sock.sendall(encode_request(replay))
             reply = parse_reply(self._recv_line(sock, buf))
             raise_for_status(reply, cmd=replay.get("cmd", "replay"))
@@ -236,7 +250,7 @@ class TcpTransport(Transport):
             sock.sendall(encode_request({"cmd": "load_bin", "total": len(data), "psram": True}))
             raise_for_status(parse_reply(self._recv_line(sock, buf)), cmd="load_bin")
             sock.sendall(bytes(data))
-            reply = parse_reply(self._recv_line(sock, buf))
+            reply = parse_reply(self._recv_load_bin_done(sock, buf))
             raise_for_status(reply, cmd="load_bin")
             total = reply.data.get("total") if isinstance(reply.data, dict) else None
             return int(total) if total is not None else len(data)

{embeddedci-2.4.0 → embeddedci-2.6.0}/tests/api_surface.json

@@ -230,6 +230,8 @@
       "spi_stream",
       "calibrate",
       "current_out",
+      "can",
+      "pod_current",
       "la_vccio_mv",
       "safe_mode",
       "safe_reason",
@@ -620,6 +622,8 @@
     "__fields__": [
       "internal",
       "external",
+      "pod",
+      "total_current",
       "raw"
     ],
     "from_reply": "(cls, reply: 'Any') -> \"'PowerStatus'\"",

{embeddedci-2.4.0 → embeddedci-2.6.0}/tests/e2e/test_e2e_rev3.py

@@ -183,8 +183,14 @@ def test_usb_cc_report_is_self_consistent(v3):
     assert cc.orientation == ("cc1" if cc.cc1_voltage >= cc.cc2_voltage else "cc2"), cc
     expected = "default" if live < 0.66 else "1.5A" if live < 1.23 else "3.0A"
     assert cc.advertised == expected, cc
-    # the other line sits at our own Rd (~0 V) or a cable's Ra, well under the live one
-    assert min(cc.cc1_voltage, cc.cc2_voltage) < live / 2, cc
+    # Two separate channels were read (a mix-up that sampled one channel twice would make them
+    # equal). With a compliant cable the other line sits near 0 V (our own Rd) or at a cable's
+    # Ra; some docks and cables put Rp on both lines (pod .220's bench reads 0.30 V / 0.41 V),
+    # which is the setup, not the firmware: the report must still pick the higher line, above.
+    other = min(cc.cc1_voltage, cc.cc2_voltage)
+    assert live - other > 0.03, cc
+    if other >= 0.2:
+        print(f"note: this cable/host drives both CC lines ({cc.cc1_voltage} V / {cc.cc2_voltage} V)")
 
 
 def test_usb_cc_sees_the_attached_cable(v3):

{embeddedci-2.4.0 → embeddedci-2.6.0}/tests/test_can.py

@@ -298,3 +298,12 @@ def test_assert_periodic_flags_too_few(bp, pod):
         can.write(0x100, [0])
         with pytest.raises(AssertionError):
             can.assert_periodic(0x100, period=0.1, min_count=3, duration=0.05)
+
+
+def test_can_capability_flag_from_status_and_cloud_parameters():
+    from embeddedci.benchpod.capabilities import Capabilities
+
+    assert Capabilities.from_status({"caps": ["la", "can"]}).can
+    assert not Capabilities.from_status({"caps": ["la"]}).can  # older firmware: not announced
+    assert Capabilities.from_parameters({"cap.can": "true"}).can
+    assert not Capabilities.from_parameters({}).can

{embeddedci-2.4.0 → embeddedci-2.6.0}/tests/test_client_v2.py

@@ -8,6 +8,7 @@ import pytest
 
 from embeddedci import benchpod
 from embeddedci.benchpod import BenchPod, BenchPodError
+from embeddedci.benchpod.capabilities import Capabilities
 from embeddedci.benchpod.state import (
     AdcReading,
     AnalogPathState,
@@ -152,6 +153,27 @@ def test_target_status_and_power_status_are_typed():
     assert ps.rail(1).bus_voltage == pytest.approx(5.012)
     assert ps.internal.current == pytest.approx(0.1234)
     assert not ps.external.ok
+    assert ps.pod is None and ps.total_current is None
+
+
+def test_power_status_pod_draw():
+    bp, _ = _bp({
+        "power_status": {"internal": {"ok": True, "bus_mv": 5012, "current_ua": 123400},
+                         "external": {"ok": False, "bus_mv": 0, "current_ua": 0},
+                         "pod": {"ok": True, "bus_mv": 4950, "current_ua": 312000,
+                                 "total_ua": 435400}},
+    })
+    ps = bp.power_status()
+    assert ps.pod is not None and ps.pod.ok
+    assert ps.pod.current == pytest.approx(0.312) and ps.pod.bus_voltage == pytest.approx(4.95)
+    assert ps.total_current == pytest.approx(0.4354)
+
+
+def test_pod_current_capability():
+    assert Capabilities.from_status({"caps": ["la", "pod_current"]}).pod_current
+    assert not Capabilities.from_status({"caps": ["la"]}).pod_current
+    assert Capabilities.from_parameters({"cap.pod_current": "true"}).pod_current
+    assert not Capabilities.from_parameters({"cap.pod_current": "false"}).pod_current
 
 
 def test_reset_line():

{embeddedci-2.4.0 → embeddedci-2.6.0}/tests/test_cloud.py

@@ -38,9 +38,52 @@ def test_resolve_and_open_cloud_transport():
 def test_cloud_ws_url():
     t = CloudTransport("dev-a", api_base="https://example.test", token="abc")
     url = t._ws_url()
-    assert url.startswith("wss://example.test/api/cloud/devices/ws?")
-    assert "device=dev-a" in url
-    assert "token=abc" in url
+    assert url == "wss://example.test/api/cloud/devices/ws?device=dev-a"
+
+
+def _fake_websocket_module(monkeypatch, fail=None):
+    """Install a fake ``websocket`` module; returns the list of create_connection calls."""
+    import sys
+    import types
+
+    calls = []
+
+    def create_connection(url, **kwargs):
+        calls.append((url, kwargs))
+        if fail is not None:
+            raise fail
+        return _FakeWS([])
+
+    monkeypatch.setitem(sys.modules, "websocket",
+                        types.SimpleNamespace(create_connection=create_connection))
+    return calls
+
+
+def test_tunnel_sends_the_token_as_a_bearer_header_not_in_the_url(monkeypatch):
+    calls = _fake_websocket_module(monkeypatch)
+    t = CloudTransport("dev-a", api_base="https://example.test", token="sekrit-tok")
+    t.lease_id = "lease-1"
+    t._dial()
+    (url, kwargs), = calls
+    assert url == "wss://example.test/api/cloud/devices/ws?device=dev-a"
+    assert "sekrit-tok" not in url and "lease" not in url
+    assert "Authorization: Bearer sekrit-tok" in kwargs["header"]
+    assert "X-Benchpod-Lease: lease-1" in kwargs["header"]
+    assert any(h.startswith("User-Agent: ") for h in kwargs["header"])
+
+
+def test_tunnel_error_never_shows_the_token(monkeypatch):
+    from embeddedci.benchpod.errors import TransportError
+
+    # An exception text that echoes the request (as a proxy or a debug build might).
+    _fake_websocket_module(monkeypatch, fail=OSError(
+        "handshake failed: Authorization: Bearer sekrit/tok+1 url=?token=sekrit%2Ftok%2B1"))
+    t = CloudTransport("dev-a", api_base="https://example.test", token="sekrit/tok+1")
+    with pytest.raises(TransportError) as info:
+        t._dial()
+    assert "sekrit" not in str(info.value)
+    assert "[redacted]" in str(info.value)
+    assert info.value.__cause__ is None  # the unredacted original is not chained
 
 
 # -- OIDC minting: the three distinct error reasons -------------------------
@@ -187,6 +230,8 @@ class _FakeWS:
 
     def send_binary(self, data):
         self.last = data
+        self.frames = getattr(self, "frames", [])
+        self.frames.append(bytes(data))
 
     def settimeout(self, _t):
         pass
@@ -207,6 +252,77 @@ def test_ws_tunnel_socket_buffers_and_eofs():
     assert sock.recv(5) == b""  # EOF
 
 
+def _sending_socket(monkeypatch):
+    """A tunnel socket over a fake WS with a fake clock: sleeps advance it."""
+    from embeddedci.benchpod.transport import cloud
+
+    clock = [100.0]
+    sleeps = []
+
+    def sleep(s):
+        sleeps.append(s)
+        clock[0] += s
+
+    monkeypatch.setattr(cloud._WsTunnelSocket, "_clock", staticmethod(lambda: clock[0]))
+    monkeypatch.setattr(cloud._WsTunnelSocket, "_sleep", staticmethod(sleep))
+    sock = _WsTunnelSocket.__new__(_WsTunnelSocket)
+    sock._ws = _FakeWS([])
+    sock._buf = bytearray()
+    sock._closed = False
+    return sock, sleeps
+
+
+def test_ws_tunnel_socket_splits_a_large_upload_into_small_frames_in_order(monkeypatch):
+    from embeddedci.benchpod.transport import cloud
+
+    sock, sleeps = _sending_socket(monkeypatch)
+    payload = bytes(i * 7 % 251 for i in range(10 * 1024))
+    sock.sendall(payload)
+    frames = sock._ws.frames
+    assert [len(f) for f in frames] == [1024] * 10
+    assert all(len(f) <= cloud.TUNNEL_FRAME_MAX for f in frames)
+    assert b"".join(frames) == payload
+    # base64url of one frame plus the server's tunnel.data envelope fits the pod's 2048-byte buffer.
+    import base64
+    import json
+    env = json.dumps({"type": "tunnel.data", "tunnel_id": "x" * 36,
+                      "data_b64": base64.urlsafe_b64encode(frames[0]).decode().rstrip("=")})
+    assert len(env) < 1600
+    # Paced to the upload rate: 10 KiB at 128 KiB/s takes about 70 ms after the first frame.
+    assert len(sleeps) == 9
+    assert sum(sleeps) == pytest.approx(9 * 1024 / cloud.TUNNEL_UPLOAD_BYTES_PER_SEC)
+
+
+def test_ws_tunnel_socket_sends_a_small_write_as_one_frame_without_waiting(monkeypatch):
+    sock, sleeps = _sending_socket(monkeypatch)
+    sock.sendall(b'{"cmd":"ping"}\n')
+    sock.sendall(bytearray(b"x" * 1024))
+    sock.sendall(b"y" * 1025)
+    assert [len(f) for f in sock._ws.frames] == [15, 1024, 1024, 1]
+    assert sleeps == [pytest.approx(1024 / (128 * 1024))]
+
+
+def test_cloud_load_replay_skips_the_tunnel_ack_lines(monkeypatch):
+    """Over a cloud tunnel the pod interleaves {"ack":N} progress lines during load_bin; the
+    completion line, not the first ack, ends the upload."""
+    sock, _ = _sending_socket(monkeypatch)
+    sock._ws = _FakeWS([
+        b'{"status":"ok","data":{"ready":20000}}\n',
+        b'{"ack":8192}\n{"ack":16384}\n',
+        b'{"status":"ok","data":{"total":20000}}\n',
+        b'{"status":"ok","data":{"replaying":true}}\n',
+    ])
+    t = CloudTransport("dev-a", api_base="https://example.test", token="abc")
+    monkeypatch.setattr(t, "_dial", lambda: sock)
+    data = t.load_replay(data=b"\x00" * 20000, replay={"cmd": "replay"}, psram=True)
+    assert data == {"replaying": True}
+    frames = sock._ws.frames
+    import json
+    assert json.loads(frames[0])["cmd"] == "load_bin"
+    assert json.loads(frames[-1]) == {"cmd": "replay"}
+    assert b"".join(frames[1:-1]) == b"\x00" * 20000
+
+
 def _edge_error(code, body):
     import io
     import urllib.error
@@ -397,8 +513,8 @@ def test_tunnel_renews_a_rejected_token(monkeypatch):
         def settimeout(self, t):
             pass
 
-    def fake_socket(url, timeout):
-        urls.append(url)
+    def fake_socket(url, timeout, headers=None, secrets=()):
+        urls.append(headers[0])
         if len(urls) == 1:
             err = TransportError("could not open cloud tunnel: Handshake status 401")
             err.status = 401
@@ -408,7 +524,7 @@ def test_tunnel_renews_a_rejected_token(monkeypatch):
     monkeypatch.setattr(cloud, "_WsTunnelSocket", fake_socket)
     t = CloudTransport("dev-a", api_base="https://example.test", user_token=lambda: "u")
     t._dial()
-    assert "token=tok1" in urls[0] and "token=tok2" in urls[1]
+    assert urls == ["Authorization: Bearer tok1", "Authorization: Bearer tok2"]
 
 
 @pytest.mark.parametrize("user_token, expected", [(lambda: "user-jwt", "Bearer user-jwt"), (None, "Bearer sess")])