[rafamolina1]

Summary

An oversized upload that the middleware rejects still left curl with an empty reply. The proxy had already written the HTTP rejection, but copy_bidirectional returned the upload's BrokenPipe and dropped that queued response. The request stayed blocked; only the response was lost.

Related Issue

Closes #5132

Changes

• Replace the RelayReady relay in complete_network_open with a same-task copy of both directions.
• Keep half-close on a clean EOF, with no deadline on a live connection.
• After an upload failure, stop reading the body and allow one second for a response already in the reverse buffer to flush.
• Stop immediately on a response-direction failure and do not drain the unread upload.
• Cover the real complete_network_open path: queued rejection with an unread body, traffic in both directions, half-close, an idle pair, and a response error.

Release Notes

A sandbox upload rejected before it is forwarded now receives the HTTP rejection the supervisor already prepared, instead of an empty reply.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo fmt --all -- --check, the SPDX header check on the touched files, and cargo clippy --locked -p openshell-sandbox-backend --all-targets -- -D warnings pass. cargo test -p openshell-sandbox-backend network_relay passes all five relay tests. The Nomos curl lab from the issue was not run.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @rafamolina1.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[rafamolina1]

I have read the DCO document and I hereby sign the DCO.

[rafamolina1]

I have read the DCO document and I hereby sign the DCO.