fix(sdk): remove REST tunnel bridge copy

[G4614]

Return the REST CONNECT upgraded stream directly from the Rust SDK instead of inserting an internal duplex copy bridge.

Test plan:

• PATH="$HOME/.cargo/bin:$PATH" cargo test -p boxlite --lib connect_box_network_tunnel_uses_connect_and_streams_both_directions --features rest -- --nocapture
• python3 -m py_compile scripts/test/e2e/cases/test_sdk_tunnel.py scripts/test/e2e/cases/test_node_tunnel.py
• git diff --check
• python -m pytest sdks/python/tests/test_tunnel.py -q
• go test ./pkg/proxy -run TestProxyBidirectionalStreamPreservesHalfCloseResponse -v from apps/common-go
• go test ./pkg/proxy -run "TestBufferedConnForwardsCloseWrite|TestTunnelTarget" -v from apps/proxy
• Manual TLS and hyper-rustls CONNECT half-close probes passed on the debug host
• Cloud Python/Node half-close E2E remains strict xfail because the NLB TLS termination path does not guarantee TCP half-close semantics.

Summary by CodeRabbit

• Bug Fixes

  • Updated network tunnel handling so callers receive the upgraded tunnel stream directly, improving how tunnel traffic is read and written.
  • Adjusted tunnel streaming behavior to align with bidirectional usage expectations.

• Tests

  • Updated the tunnel unit test to validate request/response in both directions using the new returned stream API.
  • Refreshed E2E test xfail explanations for TCP half-close behavior to reflect the current tunnel path characteristics (tests remain xfailed).

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The tunnel client now returns the upgraded HTTP connection through TokioIo<Upgraded> instead of an internally pumped duplex stream. The unit test exercises split bidirectional I/O, while E2E tests update the explanation for retained TCP half-close expected failures.

Changes

Tunnel connection flow

Layer / File(s)	Summary
Rust upgraded tunnel stream src/boxlite/src/rest/client.rs	connect_box_network_tunnel returns upgraded I/O directly, and its unit test validates split-stream ping/pong traffic after writer shutdown.
TCP half-close validation scripts/test/e2e/cases/test_node_tunnel.py, scripts/test/e2e/cases/test_sdk_tunnel.py	Strict xfail markers remain, with reasons updated to reference NLB TLS termination not guaranteeing TCP half-close behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ApiClient
  participant TunnelTestServer
  participant TokioIoUpgraded
  ApiClient->>TunnelTestServer: Send CONNECT request
  TunnelTestServer-->>ApiClient: Return upgraded connection
  ApiClient->>TokioIoUpgraded: Write ping and shut down writer
  TokioIoUpgraded->>TunnelTestServer: Forward ping and EOF
  TunnelTestServer-->>TokioIoUpgraded: Return pong
  TokioIoUpgraded-->>ApiClient: Read pong

Loading

Possibly related PRs

• boxlite-ai/boxlite#991: Changes related REST tunnel plumbing and the returned CONNECT stream.
• boxlite-ai/boxlite#992: Changes REST tunnel-backend integration using the CONNECT-established stream.
• boxlite-ai/boxlite#994: Adds related tunnel TCP half-close coverage.

Suggested reviewers: dorianzheng

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	It lacks the required template headings and a clear Changes section; the verify steps are present, but the summary/changes/risk structure should be explicit.	Reformat the PR body to match the template with Summary, Changes, How to verify, and optional Risks / rollout sections, and add at least one concrete change bullet.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the main change: removing the internal REST tunnel copy bridge.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[G4614]

Closing this draft because POL-103 is an API-layer semantics/documentation question, not a code bug to fix in this form.

[boxlite-agent]

📦 BoxLite review — couldn't complete

claude exited 1

stdout:
{"is_error":true,"duration_api_ms":0,"num_turns":1,"stop_reason":"stop_sequence","session_id":"aea1ce28-b982-43eb-8cc9-3b1ad9de7343","total_cost_usd":0,"usage":{"input_tokens":0,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":0,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":0,"ephemeral_5m_input_tokens":0},"inference_geo":"","iterations":[],"speed":"standard"},"modelUsage":{},"permission_denials":[],"terminal_reason":"api_error","fast_mode_state":"off","subtype":"success","api_error_status":403,"result":"Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access","type":"result","duration_ms":438,"uuid":"96ed60be-d4fa-495e-918b-cd48de9a5f7d"}

stderr:
<empty>

_{powered by BoxLite}

[coderabbitai]

🧹 Nitpick comments (1)

src/boxlite/src/rest/client.rs (1)

358-361: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Document the upgraded-stream ownership and half-close contract.

This crate-visible API now exposes the raw upgraded I/O directly, but provides no usage contract for callers.

Proposed documentation

+    /// Establish an HTTP CONNECT tunnel to `uri`.
+    ///
+    /// Returns the upgraded bidirectional I/O stream. Callers own the stream
+    /// and may shut down its write half while continuing to read peer data.
     pub(crate) async fn connect_box_network_tunnel(

As per coding guidelines, “Write comprehensive docstrings for all public functions and classes.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/boxlite/src/rest/client.rs` around lines 358 - 361, Document
connect_box_network_tunnel, including that it returns ownership of the upgraded
raw I/O stream and callers are responsible for its lifecycle; specify the
expected half-close behavior and any required shutdown handling when either side
finishes communicating.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/boxlite/src/rest/client.rs`:
- Around line 358-361: Document connect_box_network_tunnel, including that it
returns ownership of the upgraded raw I/O stream and callers are responsible for
its lifecycle; specify the expected half-close behavior and any required
shutdown handling when either side finishes communicating.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e7142f45-7817-473c-ae80-b0c6761ecca8

📥 Commits

Reviewing files that changed from the base of the PR and between a5da5b4 and 55823e9.

📒 Files selected for processing (2)

• sdks/go/tunnel.go
• src/boxlite/src/rest/client.rs

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/test/e2e/cases/test_node_tunnel.py`:
- Line 83: Remove the strict xfail from the half-close coverage in
scripts/test/e2e/cases/test_node_tunnel.py:83-83 and
scripts/test/e2e/cases/test_sdk_tunnel.py:229-229, or condition each xfail
exclusively on NLB deployments; preserve the tests as required E2E validation
for other tunnel configurations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 239f1cbd-4bae-4200-ba55-6aa6f1d3f542

📥 Commits

Reviewing files that changed from the base of the PR and between 2ca233e and 889729e.

📒 Files selected for processing (2)

• scripts/test/e2e/cases/test_node_tunnel.py
• scripts/test/e2e/cases/test_sdk_tunnel.py

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Do not retain strict xfails for the fixed half-close coverage. Both tests will fail as XPASS when the tunnel correctly preserves half-close responses, defeating the PR’s required E2E validation.

• scripts/test/e2e/cases/test_node_tunnel.py#L83-L83: remove the strict xfail or scope it only to NLB deployments.
• scripts/test/e2e/cases/test_sdk_tunnel.py#L229-L229: remove the strict xfail or scope it only to NLB deployments.

📍 Affects 2 files

• scripts/test/e2e/cases/test_node_tunnel.py#L83-L83 (this comment)
• scripts/test/e2e/cases/test_sdk_tunnel.py#L229-L229

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/test/e2e/cases/test_node_tunnel.py` at line 83, Remove the strict
xfail from the half-close coverage in
scripts/test/e2e/cases/test_node_tunnel.py:83-83 and
scripts/test/e2e/cases/test_sdk_tunnel.py:229-229, or condition each xfail
exclusively on NLB deployments; preserve the tests as required E2E validation
for other tunnel configurations.