Files
OpenShell/docs
Shiju 6a6401b9c3 fix(cli): backpressure sandbox uploads (#4448)
* fix(cli): backpressure sandbox uploads

Stream archive uploads over a bounded SSH subsystem whose credit follows extraction stdin progress. Preserve the existing input budget and tar destination semantics, validate completion, and clean up cancelled transfers. Add protocol, lifecycle, and large-upload regression coverage without changing russh.

Signed-off-by: Shiju <shiju@nvidia.com>

* fix(cli): preserve upload cancellation and errors

Keep cancellation active through upload setup and retry delays, and
terminate cancelled SSH probes. Preserve protocol failures through output
completion and report captured diagnostics on early extraction failure.
Remove redundant upload validation and extend the affected regressions.

Signed-off-by: Shiju <shiju@nvidia.com>

* refactor(cli): carry upload credit over SSH streams

Replace the framed upload protocol with SSH's own streams. The client
sends one JSON plan line, the raw archive and EOF. The supervisor's
stdout carries only cumulative totals of bytes written to extraction
stdin, extraction output goes to stderr, and the exit status reports
the result. Extraction starts inline through the ordinary exec path.

This removes the frame codec, SHA-256 digests, the CLI sha2 dependency
and the supervisor upload state machine while keeping the 1 MiB credit
window, the 4 MiB input guard, cancellation and error reporting. A
failed archive now stops SSH before closing stdin, so EOF never marks a
truncated archive complete.

Signed-off-by: Shiju <shiju@nvidia.com>

* fix(cli): isolate upload SSH connections and pin credit cadence

- Apply the forward multiplexing overrides to the upload ssh command, so
  a user ControlMaster cannot carry an upload over another session's
  master connection.
- Kill ssh before closing its stdin when a transfer fails locally, and
  include ssh stderr in transport errors.
- Share ACK_INTERVAL_BYTES from core. Assert at compile time that CLI
  chunks fit the credit left after an ack and that the window stays
  below the supervisor's pending-input guard.
- Log the real reason when the supervisor rejects an upload.
- Test that a single-packet upload reports its final total.

Signed-off-by: Shiju <shiju@nvidia.com>

* test(cli): assert upload ssh opens the subsystem without a TTY

Signed-off-by: Shiju <shiju@nvidia.com>

---------

Signed-off-by: Shiju <shiju@nvidia.com>
2026-10-13 14:55:45 +00:00
..