[skevetter]

Summary

• Preserve non-log stderr from nested container-tunnel processes with the redacting passthrough writer.
• Share the internal-process stderr close/drain path across host and container tunnel subprocesses, flushing fallback output after parser drain.
• Add mixed-stream coverage for structured logs, machine error envelopes, plain stderr, final-line drain, and duplicate suppression.
• Prove startup-silence error envelopes trigger the existing whole-command SSH retry and succeed on the next attempt.

Validation

• go test ./pkg/log/... ./pkg/tunnel/... ./e2e/framework/... ./pkg/agent/...
• go vet ./pkg/tunnel/... ./pkg/agent/...
• task cli:lint:ci
• task cli:build:dev
• CodeRabbit local review: no findings
• Rootful Podman E2E shard unavailable on this host: podman is not installed.

No watchdog timeout, lifecycle behavior, or inner SSH exec retry changes.

Summary by CodeRabbit

• Bug Fixes
  • Tunnel setup now preserves error and plain-text output while filtering structured log messages. Final output lines are also flushed reliably.
• Tests
  • Added coverage for SSH retry behavior when the first attempt returns a startup-silence error and a later attempt succeeds. This helps verify that transient startup failures do not prevent a successful retry.

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	38e7d11
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6abb56817a8830000823ff37

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 09874069-c3c6-431d-8a37-ccc6831a29f3

📥 Commits

Reviewing files that changed from the base of the PR and between 59f51ce and 38e7d11.

📒 Files selected for processing (3)

• e2e/framework/retry_test.go
• pkg/tunnel/container.go
• pkg/tunnel/container_test.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

The tunnel setup paths now share stderr stream cleanup through internalProcessStderr. Tests cover stream output and cleanup. An SSH retry test covers a JSON-wrapped startup-silence error followed by success.

Changes

Tunnel stderr handling

Layer / File(s)	Summary
Tunnel stderr stream setup and validation pkg/tunnel/container.go, pkg/tunnel/container_test.go	internalProcessStderr closes the JSON-stream writer, waits for the stream to drain, and closes the fallback writer. Both tunnel setup paths use the helper. Tests cover structured-log filtering, error and plain-text output, final unterminated lines, and fallback closure.

SSH retry test

Layer / File(s)	Summary
Startup-silence retry coverage e2e/framework/retry_test.go	The test checks that a JSON-wrapped startup-silence error on the first SSH call is followed by a successful second call.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 38e7d

The change preserves inner CLI stderr while retaining structured-log handling and orderly cleanup. No actionable merge-blocking risk is identified; merge after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 38e7d

Error output now reaches the user's terminal instead of being discarded, with existing secret masking retained. No introduced security defect was established, but live-container failure behavior was not fully validated.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed exposure is diagnostic output from the existing container tunnel session to the invoking process's stderr and registered output sinks. The matching head-to-parent delta does not add a caller, change session identity, or grant additional execution authority.

Trust Boundaries and Controls

• observed — Fallback output is redacted before either output destination receives it. Streaming redaction retains potential secret prefixes across writes, and cleanup flushes the remaining state after parser completion. The inspected CLI configuration does not establish the proposed custom-redactor bypass.

Resilience and Maintainability Implications

• observed — Each tunnel invocation creates its own parser and fallback and installs one deferred cleanup. Container-session startup errors return through that defer. The existing parser also closes its reader after scanning ends, preventing subsequent pipe writes from waiting on an abandoned reader.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preserving inner CLI errors across the container tunnel.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	38e7d11
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6abb5681fc5ddd0008e6c4c5

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.