ENG-1461: Show a clear error when the build log streamer connection is refused#3837
Open
mitchell-as wants to merge 1 commit into
Open
ENG-1461: Show a clear error when the build log streamer connection is refused#3837mitchell-as wants to merge 1 commit into
mitchell-as wants to merge 1 commit into
Conversation
Detect a refused build-log-streamer stream as a distinct StreamDeniedError rather than an opaque build failure. Both deny shapes from the ENG-1457 gate-policy spike are handled: a hard 401/403 on the Upgrade (a Connect dial error) and a server soft-close (Upgrade accepted, then closed with no frames). Because the stream is the only source of artifact download URIs for an in-progress build, a denial there can't complete the install, so the runtime now reports a clear authentication/authorization message instead of a raw error. Genuine build failures and network errors are still surfaced, and an already-built checkout never opens the stream, so it is unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mitchell-as
changed the title
mitchell-as
changed the title
mitchell-as
requested review from
MDrakos and
Copilot
and removed request for
MDrakos
There was a problem hiding this comment.
Pull request overview
This PR improves the State Tool’s handling of build-log streaming failures by distinguishing authentication/authorization denials from genuine build failures or transient network issues, and surfacing clearer, actionable errors to the user.
Changes:
- Introduces a typed
StreamDeniedErrorin the build-log streamer client and helperIsStreamDenieddetection. - Detects and reclassifies “soft-close with no frames” websocket behavior as a stream denial.
- Adds targeted tests covering upgrade-denial statuses and the soft-close denial shape.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/runtime/setup.go | Maps stream-denial errors to clearer, user-actionable localized errors (unauthenticated vs unauthorized). |
| pkg/runtime/internal/buildlog/buildlog.go | Propagates denial errors distinctly and detects soft-close-without-frames as denial. |
| pkg/runtime/internal/buildlog/buildlog_denial_test.go | Adds regression test for soft-close-with-no-frames denial behavior. |
| pkg/platform/api/buildlogstream/streamer.go | Adds StreamDeniedError and returns it on 401/403 websocket upgrade denials. |
| pkg/platform/api/buildlogstream/streamer_test.go | Adds tests for denial classification, including 401/403 and non-auth handshake failures. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Collaborator
Author
|
Test failures are unrelated to this PR. I'm unsure how exactly to test this, as we don't reject unauthenticated clients at the moment. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://activestatef.atlassian.net/browse/ENG-1461
When you check out or install a project that still has to build, the State Tool opens a live connection to follow the build. The build server is going to start refusing that connection for callers it can't authenticate, and today being refused fails the whole command with an unhelpful error.
This teaches the State Tool to tell "you were refused" apart from a real build failure or a network hiccup, and to respond with something useful: sign in with
state auth, or, if you're already signed in, check that your account has access to the project.Based on version/0-48-1-RC3 rather than master; it reaches master through the normal release flow.
🤖 Generated with Claude Code