Worker: bound output capture, upload fan-out, precondition scripts and orphaned action directories

[amankrx]

What and why

Four places where a worker had no bound. An action's stdout or stderr was captured in memory without limit; past max_captured_output_bytes the rest now spills to a file under the action directory, with the head kept for the log; the spill handle sits outside the open-file budget, since it lives as long as the child's stream. Output uploads fanned out one task per file; one semaphore of 64 permits, taken around each file from open to upload, now bounds the whole output tree, so nested directories cannot multiply it. A precondition script that hung held the action forever; it is now refused as backpressure after precondition_timeout_ms (default 30 s). Action directories left behind by a crash were never removed; a sweep on orphan_sweep_interval_s now clears them, detached so it outlives its spawn handle. The sweep skips symlinks rather than following them, takes the same cleanup mark a retry of the operation waits on before it removes anything, and a directory it cannot remove is logged and counted while the rest are still swept. The failed-command log line cuts its stdout and stderr excerpt by bytes, so a multibyte character on the boundary no longer panics.

How was this verified?

running_actions_manager_test covers the capture spilling past the cap and the spill file uploading whole, a 256-file tree uploading through a gated store with never more than 64 files open (258 without the shared bound), and the orphan sweep removing a stale directory, leaving a live one, and leaving a symlink and its target alone (that one fails without the change); local_worker_test covers the hanging precondition script timing out, and the excerpt helper is tested on a cut through a multibyte character and on bytes that were never text. On a test cluster a target that printed 2 GiB to stderr no longer took the worker down, and a build with 3,000 outputs uploaded without the file-descriptor spike. The two captured-output uploads are boxed: inlined, the debug test binary overflowed its thread stack. The sweep carrying on past a directory it cannot remove is reviewed but not unit-tested: the removal helper repairs permissions before deleting, so a stuck directory cannot be staged without root.

Risk

One default changes: a precondition script now has 30 s where it had forever, and a deployment with slower scripts should set precondition_timeout_ms. The other knobs are off or unbounded unless set. Spill files live under the action directory and go with it.

AI assistance

An agent drafted the change and I reviewed every line.

---

This change is 

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nativelink	Ready	Preview	Sep 29, 2026 5:17am UTC
nativelink-aidm	Ready	Preview	Sep 29, 2026 5:17am UTC