Budget remote artifact upload and preserve safe failure diagnostics

server/src/services/native-runtime/native-session-executor.test.ts

@@ -366,6 +366,7 @@ import {
   semanticProviderPlanMarkdown,
   sha256DirectoryTree,
   stageRemoteRunnerDirectory,
+  stageRemoteRunnerFile,
   steerNativeSession,
   syncRemoteRunnerDirectoryOut,
   verifyNativeHarnessBackup,
@@ -2465,6 +2466,23 @@ describe("remote provider checkpoint snapshots", () => {
 });
 
 describe("remote provider checkpoint restores", () => {
+  it("budgets artifact upload time and retains redacted staging diagnostics", async () => {
+    const root = await mkdtemp(join(tmpdir(), "paperclip-runner-file-"));
+    const sourcePath = join(root, "runner");
+    await writeFile(sourcePath, "fixture binary");
+    const execute = vi.fn(async () => ({ exitCode: 255, timedOut: true,
+      stdout: "", stderr: "Host key verification failed; Bearer abcdefghijkl" }));
+    try {
+      const stage = stageRemoteRunnerFile({
+        target: { kind: "remote", transport: "computer" } as never,
+        runner: { execute } as never, sourcePath, targetPath: "/private/runner", mode: 0o700,
+      });
+      await expect(stage).rejects.toThrow("exit=255 timedOut=true Host key verification failed");
+      await expect(stage).rejects.not.toThrow("abcdefghijkl");
+      expect(execute).toHaveBeenCalledWith(expect.objectContaining({ timeoutMs: 180_000 }));
+    } finally { await rm(root, { recursive: true, force: true }); }
+  });
+
   it.each([{ sizeMiB: 0, corrupt: false }, { sizeMiB: 65, corrupt: false }, { sizeMiB: 0, corrupt: true }])("stages a $sizeMiB MiB provider pack through a command-only computer runner (corrupt=$corrupt)", async ({ sizeMiB, corrupt }) => {
     const root = await mkdtemp(join(tmpdir(), "paperclip-computer-pack-"));
     const sourcePath = join(root, "source");

server/src/services/native-runtime/native-session-executor.ts

@@ -10249,7 +10249,7 @@ export function assertRemoteRunnerBuildMetadata(
   }
 }
 
-async function stageRemoteRunnerFile(input: {
+export async function stageRemoteRunnerFile(input: {
   target: Extract<AdapterExecutionTarget, { kind: "remote" }>;
   runner: CommandManagedRuntimeRunner;
   sourcePath: string;
@@ -10284,9 +10284,10 @@ async function stageRemoteRunnerFile(input: {
     args: ["-c", script],
     stdin: bytes.toString("base64"),
     bypassSession: true,
+    timeoutMs: 180_000,
   });
   if (result.exitCode !== 0 || result.timedOut) {
-    throw new Error("runner_remote_staging_failed");
+    throw new Error(`runner_remote_staging_failed: exit=${result.exitCode} timedOut=${result.timedOut}${result.stderr.trim() ? ` ${redactSensitiveText(result.stderr).trim().slice(-512)}` : ""}`);
   }
 }
 
@@ -10365,7 +10366,7 @@ export async function stageRemoteRunnerDirectory(input: {
       bypassSession: true, timeoutMs: 180_000,
     });
     if (result.exitCode !== 0 || result.timedOut) {
-      throw new Error("runner_remote_directory_staging_failed");
+      throw new Error(`runner_remote_directory_staging_failed: exit=${result.exitCode} timedOut=${result.timedOut}${result.stderr.trim() ? ` ${redactSensitiveText(result.stderr).trim().slice(-512)}` : ""}`);
     }
   };
   const pending: Promise<void>[] = [];
@@ -12587,7 +12588,7 @@ async function createRunnerdBackendWithinSessionClaim(
         timeoutMs: 10_000,
       });
       if (created.exitCode !== 0 || created.timedOut) {
-        throw new Error("runner_remote_directory_staging_failed");
+        throw new Error(`runner_remote_directory_staging_failed: exit=${result.exitCode} timedOut=${result.timedOut}${result.stderr.trim() ? ` ${redactSensitiveText(result.stderr).trim().slice(-512)}` : ""}`);
       }
 
       // Codex launch credentials are intentionally excluded from failover