fix physical iOS bridge reliability

ios-qa/daemon/test/proxy-classify.test.ts

@@ -5,7 +5,9 @@
 // mutate state, restore state."
 
 import { describe, test, expect } from 'bun:test';
-import { classifyRoute } from '../src/proxy';
+import { classifyRoute, proxyToDevice } from '../src/proxy';
+import { createServer } from 'http';
+import type { IncomingMessage } from 'http';
 
 describe('classifyRoute', () => {
   test('healthz, screenshot, elements, snapshot are observe-tier', () => {
@@ -45,3 +47,77 @@ describe('classifyRoute', () => {
     expect(classifyRoute('GET', '/auth/sessions').allowed).toBe(false); // loopback-only
   });
 });
+
+describe('proxyToDevice failure bounds and bundle assertions', () => {
+  test('a suspended/non-responsive app returns a bounded 504', async () => {
+    const server = createServer(() => {
+      // Deliberately keep the connection open without headers or a body. This
+      // is the observable shape of a CoreDevice route to a suspended app.
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const addr = server.address();
+    const port = typeof addr === 'object' && addr ? addr.port : 0;
+    const started = Date.now();
+    try {
+      const result = await proxyToDevice({
+        inbound: {
+          method: 'GET',
+          url: '/screenshot',
+          headers: { 'content-type': 'application/json' },
+        } as IncomingMessage,
+        body: Buffer.alloc(0),
+        tunnel: {
+          udid: 'CORE-1',
+          ipv6Addr: '127.0.0.1',
+          port,
+          bootTokenRotated: 'rotated-token',
+        },
+        sessionId: null,
+        timeoutMs: 40,
+      });
+      expect(result.status).toBe(504);
+      expect(JSON.parse(result.body.toString())).toEqual({ error: 'upstream_timeout' });
+      expect(Date.now() - started).toBeLessThan(1_000);
+    } finally {
+      server.closeAllConnections?.();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+
+  test('coordinate actions carry the expected active bundle assertion', async () => {
+    let expectedBundleHeader: string | undefined;
+    const server = createServer((req, res) => {
+      expectedBundleHeader = req.headers['x-gstack-expected-bundle-id'] as string | undefined;
+      req.resume();
+      req.on('end', () => {
+        res.writeHead(200, { 'content-type': 'application/json' });
+        res.end(JSON.stringify({ ok: true }));
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const addr = server.address();
+    const port = typeof addr === 'object' && addr ? addr.port : 0;
+    try {
+      const result = await proxyToDevice({
+        inbound: {
+          method: 'POST',
+          url: '/tap',
+          headers: { 'content-type': 'application/json' },
+        } as IncomingMessage,
+        body: Buffer.from('{"x":10,"y":20}'),
+        tunnel: {
+          udid: 'CORE-1',
+          bundleId: 'com.gstack.fixture',
+          ipv6Addr: '127.0.0.1',
+          port,
+          bootTokenRotated: 'rotated-token',
+        },
+        sessionId: 'session-1',
+      });
+      expect(result.status).toBe(200);
+      expect(expectedBundleHeader).toBe('com.gstack.fixture');
+    } finally {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+});