fix(collect): stream large CUA artifacts and fail on dropped deliverables

[williamloo-scale]

Problem

collect_artifacts reads CUA desktop-VM files with a single cua_get_file call that buffers the whole file as one base64 body in one gateway /step response. That can't carry a large file within one request, and every per-file failure was caught and downgraded to a logger.warning while the step still "succeeded" on the other files — so a large deliverable silently vanished from the result artifact.

Confirmed in prod on run aeh-1790880504327 (file ~/Desktop/sintel_braided_assembly_v2.mp4, ~500MB):

• Collecting 12 artifacts … via controller → Collected 11/12
• Failed to read …/sintel_braided_assembly_v2.mp4 via controller: logged exactly 600s after the read started — the _controller_call timeout=600 firing (httpx ReadTimeout, empty string). A retry attempt died with a 503 from the sandbox /step mid-transfer instead.
• The other seven .mp4s (18–52MB each) collected fine in 1–9s — a size/transport ceiling, not a cap.

Fix (contained, client-side)

1. Stream large files. Files > 16MB are read off the VM in 8MB byte ranges via cua_bash (tail -c +N | head -c M | base64, portable across the Ubuntu and macOS desktop VMs — no GNU dd iflag), decoding each range as it arrives. No single controller call moves the whole file. A short read (sum ≠ wc -c size) fails loudly rather than uploading a truncated artifact. Files ≤16MB keep the existing single-shot path.
2. Fail on dropped deliverables. A genuinely-absent listed file stays a lenient skip (FileNotFoundError); a file that exists but fails to read or upload now fails the step (retryable) instead of being dropped with only a warning. Applies to the controller and the agent / VM-host / sandbox-container paths.
3. A size-probe error is a hard failure, not a missing-file skip. wc -c / stat return -1 only for a genuinely-absent file (stderr "No such file"); a probe that times out or otherwise errors raises, so an existing deliverable is never silently dropped by a flaky size check. The agent-path size check sits inside the guarded block so the provider still closes on failure.

Tests

uv run --extra dev pytest tst/unit/task_step/ → 1385 passed. New/updated coverage in test_collect_artifacts.py: chunked reassembly (incl. base64 76-col wrapping), short-read → fatal, absent → FileNotFoundError vs present-but-failed → fatal, zero-byte file present, single-shot for small files, size-probe transport/wc/stat errors → fatal.

Notes / trade-offs

• Adds one cheap wc -c round-trip per file (to size it before deciding single-shot vs chunked, and to tell absent from present-but-failed). Minor latency for correctness; mirrors the agent-container path, which already stats first.
• Large files are reassembled in memory before upload (not streamed to a temp file) to preserve the existing _controller_get_file -> bytes seam; peak memory ≈ file size, fine for worker sizing.
• The server-side cua_get_file default 90s timeout lives in scaleapi/packages/agentenvhub-sdk; with chunking capping the single-shot path at 16MB it's non-blocking, so a 300s bump there is an optional separate follow-up.

🤖 Generated with Claude Code

Confidence Score: 4/5

The PR is not ready to merge because an existing unreadable file can still be mistaken for a missing one.

Findings

1.  Existing files get skipped ▶

Fix with agent prompt

### Issue 1
src/agent_env/task_step/task_steps/collect_artifacts.py:undefined-198
When `stat` cannot read a file because of a permission or I/O error, it can still say `cannot stat`. `_looks_absent` treats that phrase as proof the file is missing. The collector then skips an existing deliverable instead of failing the step. Match the missing-file error, not the general `stat` prefix.

```suggestion
    return "No such file" in stderr
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR collects large CUA files in 8 MB ranges instead of sending each file in one gateway response. It also makes collection fail when an existing deliverable cannot be sized, read, or uploaded.

• Small files keep the single-call read path; large files are staged locally before upload.
• Missing files are skipped, while failures to collect existing files fail the step.
• Unit tests cover ranged reads, short reads, and missing files versus failed reads.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Size file on VM] --> B{Over 16 MB?}
    B -- No --> C[Download in one call]
    B -- Yes --> D[Read chunks to temp file]
    C --> E[Upload temp file]
    D --> E
    E --> F[Remove temp file]

Loading

_{Reviews (2) · Last reviewed commit: "fix(collect): stream chunks to disk and ..."}