fix(tunnel): surface agent command failure instead of masking it

[skevetter]

Summary

Fixes a misleading error surfaced during workspace up: when the in-container agent failed a stage after sending its result over the tunnel (e.g. a failed git clone), the CLI reported

start workspace: save workspace result: workspace <id> no longer exists

instead of the real cause. The "no longer exists" message is a downstream symptom — the agent's failure-cleanup had already removed the workspace directory, and up then tripped over the missing directory while saving the result.

Root cause

ClassifyTunnelErrors discarded the tunnel (agent command) error whenever the handler side completed cleanly:

if handlerErr == nil {
    return nil   // agent command error thrown away
}

In the SSH/local path (docker/podman), the agent sends its result over gRPC and then may fail a later stage. The handler (result receiver) sees a clean completion, so handlerErr == nil and the agent's real exit error (tunnelErr) was dropped. ExecuteCommand then returned (result, nil), up proceeded to SaveWorkspaceResult, found the directory already removed by the agent's cleanup, and reported the misleading message.

Fix

Surface a permanent tunnel error when the handler returns nil, reusing the existing ClassifyError so normal shutdown/EOF completions still resolve to nil:

if handlerErr == nil {
    if ClassifyError(tunnelErr) == ErrorPermanent {
        return fmt.Errorf("agent command: %w", tunnelErr)
    }
    return nil
}

Before / after

Reproduced on a real Fedora host with rootless podman by cloning an unresolvable repo:

• Before: start workspace: save workspace result: workspace notfound-devsy-sh no longer exists
• After: start workspace: tunnel to container: agent command: run agent command failed: exit status 128 ...

Notes

• The proxy path already surfaced the agent error correctly; only the SSH/local path had the masking bug.
• Two cosmetic issues remain on this error path and are intentionally left for follow-up: the agent's generic "Command failed with exit code N" line is captured into the message tail (rather than the causal line), and the failure-cleanup path emits a secondary credential-helper warning. The primary confusion — the wrong root cause — is resolved here.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	519e1a6
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a5156ccebbaaf00085f6eef

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5b742d31-6907-42bc-a5e2-793a8cc0e471

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	519e1a6
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a5156cc6d8c1600080261f2