runon can now copy files back from the build server. With the optional return_paths argument, up to 64 workdir-relative files (10 MiB in total) are verified by size and SHA-256 and moved into place; the result lists each path as returned or not returned with the reason.
Security and recovery
Received bytes are staged in the task's private control folder and placed through file handles, so a project command cannot swap a staging file for a symlink or make placement follow one. Symlink or non-regular destinations are refused and left untouched.
On another filesystem, a verified file is written to a recorded temp name, fsynced through the destination folder's handle, then renamed over the destination, so a stop mid-copy leaves no partial file and existing files are replaced atomically.
Restart during gap recovery rewinds an unfinished return to its first chunk and removes recorded staging files.
An exact replay of the last accepted chunk is accepted once; a gap before a zero-byte manifest is skipped only when the manifest's expired entries account for it, otherwise ordinary gap recovery re-attaches.
Other changes
Submits for runners without the exec-remote-return/v2 capability and windows demands are refused before anything is submitted.
Files copied back are dropped from the server's changed-files list in the completion report.
Bumps cortexkit-exec-remote-types to 0.2.10, vendors its chunked-return test vectors, and regenerates the bash tool schemas and tool-provider catalog.
Background runon replies at registration and copies files back only after the runner releases them.
Confidence Score: 5/5
The PR appears safe to merge, with a non-blocking false lost-output warning during partial expired-file recovery.
Adds return_paths to runon so verified files can be copied back into the project.
Bash callers can ask runon to bring back named files.
Remote runs verify requested files before placing them in the project.
All five supplied previous threads were unnumbered and manually resolved by ualtinok without explanatory replies. They therefore have no numbered previous-finding entries.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[runon with return_paths] --> B[Check paths and runner support]
B --> C[Run remotely]
C --> D[Stage file chunks privately]
D --> E[Verify size and SHA-256]
E --> F[Place verified files atomically]
F --> G[Save and report each file's result]
File expiry misreports lost output ▶