feat(inject): tunnel binary injection races and leaks

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -2,7 +2,7 @@ name: Bug Report
 description: Report a bug to help fix your issue
 title: "[Bug]: "
 labels:
-  - kind/bug
+  - bug
 body:
   - type: checkboxes
     id: preflight

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -2,14 +2,14 @@ name: Feature Request
 description: Suggest an idea or improvement
 title: "[Feature]: "
 labels:
-  - kind/feature
+  - enhancement
 body:
   - type: checkboxes
     id: preflight
     attributes:
       label: Before submitting
       options:
-        - label: I have searched existing issues and discussions to confirm this hasn't been requested
+        - label: I have searched existing feature requests and discussions to confirm this has not been requested
           required: true
 
   - type: textarea
@@ -25,7 +25,7 @@ body:
     id: solution
     attributes:
       label: Proposed solution
-      description: Describe the solution you'd like. Be as specific as possible.
+      description: Describe the solution you would like. Be as specific as possible.
     validations:
       required: true
 

.github/workflows/pr-ci.yml

@@ -221,7 +221,7 @@ jobs:
           GH_ACCESS_TOKEN: ${{ github.token }}
           GH_CREDENTIAL_USERNAME: x-access-token
         run: |
-          ./e2e.test -test.v -ginkgo.v -test.timeout 1500s --ginkgo.label-filter="${{ matrix.label }}"
+          ./e2e.test -test.v -ginkgo.v -test.timeout 1500s -ginkgo.fail-on-empty --ginkgo.label-filter="${{ matrix.label }}"
 
   integration-tests:
     name: Test ${{ matrix.label }}${{ matrix.install-podman && format(' ({0})', matrix.install-podman) || '' }} on ${{ matrix.runner }}
@@ -255,6 +255,12 @@ jobs:
             install-kind: false
             requires-secret: false
 
+          - label: mcp
+            runner: ubuntu-latest
+            free-disk-space: false
+            install-kind: false
+            requires-secret: false
+
           - label: provider
             runner: ubuntu-latest
             free-disk-space: true
@@ -291,7 +297,7 @@ jobs:
             install-kind: false
             requires-secret: false
 
-          - label: features
+          - label: feature
             runner: ubuntu-latest
             free-disk-space: false
             install-kind: false
@@ -333,7 +339,7 @@ jobs:
             install-kind: false
             requires-secret: false
 
-          - label: setup
+          - label: config-apply
             runner: ubuntu-latest
             free-disk-space: false
             install-kind: false
@@ -383,19 +389,85 @@ jobs:
             install-kind: true
             requires-secret: false
 
-          - label: up-provider-podman
+          - label: up-provider-podman-rootless-basic
+            runner: ubuntu-latest
+            free-disk-space: true
+            install-kind: false
+            requires-secret: false
+            install-podman: rootless
+            test-timeout: 600s
+            job-timeout-minutes: 20
+            flake-attempts: 2
+
+          - label: up-provider-podman-rootless-lifecycle
+            runner: ubuntu-latest
+            free-disk-space: true
+            install-kind: false
+            requires-secret: false
+            install-podman: rootless
+            test-timeout: 600s
+            job-timeout-minutes: 20
+            flake-attempts: 2
+
+          - label: up-provider-podman-rootless-config
+            runner: ubuntu-latest
+            free-disk-space: true
+            install-kind: false
+            requires-secret: false
+            install-podman: rootless
+            test-timeout: 600s
+            job-timeout-minutes: 20
+            flake-attempts: 2
+
+          - label: up-provider-podman-rootless-features
             runner: ubuntu-latest
             free-disk-space: true
             install-kind: false
             requires-secret: false
             install-podman: rootless
+            test-timeout: 600s
+            job-timeout-minutes: 20
+            flake-attempts: 2
 
-          - label: up-provider-podman
+          - label: up-provider-podman-rootful-basic
             runner: ubuntu-latest
             free-disk-space: true
             install-kind: false
             requires-secret: false
             install-podman: rootful
+            test-timeout: 600s
+            job-timeout-minutes: 20
+            flake-attempts: 2
+
+          - label: up-provider-podman-rootful-lifecycle
+            runner: ubuntu-latest
+            free-disk-space: true
+            install-kind: false
+            requires-secret: false
+            install-podman: rootful
+            test-timeout: 600s
+            job-timeout-minutes: 20
+            flake-attempts: 2
+
+          - label: up-provider-podman-rootful-config
+            runner: ubuntu-latest
+            free-disk-space: true
+            install-kind: false
+            requires-secret: false
+            install-podman: rootful
+            test-timeout: 600s
+            job-timeout-minutes: 20
+            flake-attempts: 2
+
+          - label: up-provider-podman-rootful-features
+            runner: ubuntu-latest
+            free-disk-space: true
+            install-kind: false
+            requires-secret: false
+            install-podman: rootful
+            test-timeout: 600s
+            job-timeout-minutes: 20
+            flake-attempts: 2
 
           - label: up-provider-docker
             runner: ubuntu-latest
@@ -456,9 +528,10 @@ jobs:
             requires-secret: false
 
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 45
+    timeout-minutes: ${{ matrix.job-timeout-minutes || 45 }}
     steps:
       - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+        background: true
         if: matrix.free-disk-space == true && runner.os == 'Linux' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true')
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -502,7 +575,6 @@ jobs:
           name: e2e-test-${{ steps.os.outputs.runner_os }}
           path: ./e2e/
 
-      # e2e expects executable to have name defined in e2e/framework/framework.go
       - name: setup executable
         if: matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true'
         shell: bash
@@ -624,24 +696,32 @@ jobs:
           path: ${{ runner.temp }}/apt-archives
           key: apt-podman-runc-${{ runner.os }}-v1
 
+      - name: cache apt packages (podman/runc)
+        if: (matrix.install-podman == 'rootless' || matrix.install-podman == 'rootful') && runner.os == 'Linux'
+        run: |
+          for i in $(seq 1 60); do
+            if sudo fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; then
+              echo "waiting for dpkg lock to be released ($i/60)"
+              sleep 2
+            else
+              break
+            fi
+          done
+          mkdir -p "${{ runner.temp }}/apt-archives"
+          sudo apt-get -o Dir::Cache::Archives="${{ runner.temp }}/apt-archives" update
+          sudo apt-get -o Dir::Cache::Archives="${{ runner.temp }}/apt-archives" install -y podman runc
+
+          sudo rm -f "${{ runner.temp }}/apt-archives/lock"
+          sudo rm -rf "${{ runner.temp }}/apt-archives/partial"
+
+          sudo mkdir -p /etc/containers
+          printf '[engine]\nruntime = "runc"\n' | sudo tee /etc/containers/containers.conf
+
       - name: Install Podman (Linux rootless)
         if: matrix.install-podman == 'rootless' && runner.os == 'Linux'
         env:
           APT_CACHE_DIR: ${{ runner.temp }}/apt-archives
         run: |
-          # Cache into a runner-owned dir: /var/cache/apt/archives is root-owned
-          # and actions/cache (running unprivileged) can't write into it on restore.
-          mkdir -p "$APT_CACHE_DIR"
-          sudo apt-get -o Dir::Cache::Archives="$APT_CACHE_DIR" update
-          sudo apt-get -o Dir::Cache::Archives="$APT_CACHE_DIR" install -y podman runc
-
-          # podman defaults to crun, which has been observed to fail with
-          # "OCI runtime error: crun: unknown version specified" on this
-          # runner image. Force runc, which is known-good, and fail fast
-          # with diagnostics if it isn't.
-          mkdir -p ~/.config/containers
-          printf '[engine]\nruntime = "runc"\n' > ~/.config/containers/containers.conf
-
           podman info
           podman run --rm busybox@sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d echo "podman runtime preflight OK"
 
@@ -650,17 +730,6 @@ jobs:
         env:
           APT_CACHE_DIR: ${{ runner.temp }}/apt-archives
         run: |
-          # Cache into a runner-owned dir: /var/cache/apt/archives is root-owned
-          # and actions/cache (running unprivileged) can't write into it on restore.
-          mkdir -p "$APT_CACHE_DIR"
-          sudo apt-get -o Dir::Cache::Archives="$APT_CACHE_DIR" update
-          sudo apt-get -o Dir::Cache::Archives="$APT_CACHE_DIR" install -y podman runc
-
-          # See the rootless step above: force runc over the default crun,
-          # which has been observed to fail on this runner image.
-          sudo mkdir -p /etc/containers
-          printf '[engine]\nruntime = "runc"\n' | sudo tee /etc/containers/containers.conf
-
           sudo systemctl enable --now podman.socket
           if ! timeout 30 bash -c 'until sudo podman info >/dev/null 2>&1; do sleep 1; done'; then
             echo "::error::podman.socket did not become ready within 30s"
@@ -709,19 +778,6 @@ jobs:
           sudo apt-get remove -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
           sudo rm -rf /var/lib/docker /var/lib/containerd /usr/bin/docker /usr/bin/dockerd
 
-      # The snapshot e2e suite pushes/pulls against a local registry:2
-      # fixture at host.docker.internal:15500 (see e2e/tests/snapshot/helper.go),
-      # reachable both from the host CLI and from inside the workspace
-      # container. Plain-HTTP is only safe here because that address is
-      # always local to this runner.
-      #
-      # host.docker.internal is Docker Desktop/OrbStack magic; plain Linux
-      # (this runner) resolves it for neither the host CLI process nor
-      # containers by default. The container side gets it via the fixture
-      # devcontainer.json's "--add-host=host.docker.internal:host-gateway"
-      # runArgs; the host side (the devsy CLI's own push-permission checks,
-      # which run before any container exists) needs an explicit /etc/hosts
-      # entry, since there's no running container to attach a gateway to yet.
       - name: configure insecure registry for snapshot tests (Linux)
         if: matrix.configure-insecure-registry == true && runner.os == 'Linux'
         run: |
@@ -751,6 +807,8 @@ jobs:
           GH_USERNAME: ${{ github.repository_owner }}
           GH_ACCESS_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
           GH_CREDENTIAL_USERNAME: x-access-token
+          TEST_TIMEOUT: ${{ matrix.test-timeout || '1500s' }}
+          FLAKE_ATTEMPTS: ${{ matrix.flake-attempts || '1' }}
         run: |
           if [ "${{ runner.os }}" == "Linux" ]; then
             sudo \
@@ -760,15 +818,15 @@ jobs:
               KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}" \
               ${DOCKER_HOST:+DOCKER_HOST="${DOCKER_HOST}"} \
               PATH="${PATH}" \
-              ./e2e.test -test.v -ginkgo.v -test.timeout 1500s --ginkgo.label-filter="${{ matrix.label }}"
+              ./e2e.test -test.v -ginkgo.v -test.timeout "${TEST_TIMEOUT}" -ginkgo.fail-on-empty -ginkgo.flake-attempts="${FLAKE_ATTEMPTS}" --ginkgo.label-filter="${{ matrix.label }}"
           else
             GH_USERNAME="${GH_USERNAME}" \
               GH_ACCESS_TOKEN="${GH_ACCESS_TOKEN}" \
               GH_CREDENTIAL_USERNAME="${GH_CREDENTIAL_USERNAME}" \
               KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}" \
               PATH="${PATH}" \
               DOCKER_HOST="npipe:////./pipe/podman-machine-default" \
-              ./e2e.test.exe -test.v -ginkgo.v -test.timeout 1500s --ginkgo.label-filter="${{ matrix.label }}"
+              ./e2e.test.exe -test.v -ginkgo.v -test.timeout "${TEST_TIMEOUT}" -ginkgo.fail-on-empty -ginkgo.flake-attempts="${FLAKE_ATTEMPTS}" --ginkgo.label-filter="${{ matrix.label }}"
           fi
 
       - name: verify docker is installed

.golangci-version

@@ -0,0 +1 @@
+v2.12.2

.pre-commit-config.yaml

@@ -37,6 +37,11 @@ repos:
     hooks:
       - id: actionlint
         files: '^\.github/workflows/'
+        # actionlint v1.7.12 does not yet recognize the background/wait/
+        # wait-all/cancel/parallel step keywords GitHub Actions shipped
+        # 2026-06-25 (https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/).
+        # Tracked upstream: https://github.com/rhysd/actionlint/issues/693
+        args: ["-ignore", "unexpected key \"background\" for step"]
   - repo: https://github.com/biomejs/pre-commit
     rev: v2.5.6
     hooks:

Taskfile.yml

@@ -23,24 +23,40 @@ tasks:
 
   cli:lint:
     desc: lint go code using golangci-lint
+    deps: [cli:lint:version]
     cmd: golangci-lint run ./...
 
   cli:lint:ci:
-    desc: lint exactly as CI does (golangci-lint-action only-new-issues -> new-from-patch vs the merge-base with origin/main)
+    desc: lint using golangci-lint with CI parity
+    deps: [cli:lint:version]
     cmds:
+      - golangci-lint config verify
       - git fetch --quiet origin main
       - |
         patch="$(mktemp)"
         trap 'rm -f "$patch"' EXIT
         git diff "$(git merge-base HEAD origin/main)" > "$patch"
         golangci-lint run --new-from-patch="$patch" --new=false ./...
 
+  cli:lint:version:
+    desc: assert the local golangci-lint matches .golangci-version (the version CI uses)
+    cmd: |
+      want="$(sed 's/^v//' .golangci-version | tr -d '[:space:]')"
+      cur="$(golangci-lint --version 2>&1 | sed -n 's/.*version \([0-9][0-9A-Za-z.+-]*\).*/\1/p')"
+      if [ "$cur" != "$want" ]; then
+        echo "golangci-lint version mismatch: local=${cur:-<not found>}, expected=${want}. Install golangci-lint v${want}." >&2
+        exit 1
+      fi
+    silent: true
+
   cli:lint:fix:
     desc: fix lint issues using golangci-lint
+    deps: [cli:lint:version]
     cmd: golangci-lint run --fix ./...
 
   cli:format:
     desc: format go code using golangci-lint formatters
+    deps: [cli:lint:version]
     cmd: golangci-lint fmt ./...
 
   cli:act:lint:

cmd/internal/agent_daemon.go

@@ -229,8 +229,7 @@ func (cmd *DaemonCmd) runShutdownCommand(
 	log.Infof("running shutdown command for workspace %s: %s", workspace.Workspace.ID, shutdown)
 
 	var stdout, stderr bytes.Buffer
-	err = clientimplementation.RunCommand(clientimplementation.RunCommandOptions{
-		Ctx:     ctx,
+	err = clientimplementation.RunCommand(ctx, clientimplementation.RunCommandOptions{
 		Command: workspace.Agent.Exec.Shutdown,
 		Environ: environ,
 		Stdout:  &stdout,