ssh: actionable error when binary upload is reset by network proxy

When `databricks ssh connect` uploads the CLI binary to the workspace,
a network intermediary (corporate egress proxy, VPN, firewall/WAF) may
close the HTTP/2 stream mid-upload, surfacing as a cryptic
`stream error: stream ID N; NO_ERROR; received from peer`.

Detect this transport-level reset and wrap the error with a hint that
the connection was closed by an intermediary and the user should try
from a network without such restrictions.

Co-authored-by: Isaac

Author: anton-107

experimental/ssh/internal/client/releases.go

@@ -15,6 +15,7 @@ import (
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go"
+	"golang.org/x/net/http2"
 )
 
 type releaseProvider func(ctx context.Context, architecture, version, releasesDir string) (io.ReadCloser, error)
@@ -65,6 +66,14 @@ func uploadReleases(ctx context.Context, workspaceFiler filer.Filer, getRelease
 		// producing the filerRoot/remoteSubFolder/*archive-contents* structure, with 'databricks' binary inside.
 		err = workspaceFiler.Write(ctx, remoteArchivePath, releaseReader, filer.OverwriteIfExists, filer.CreateParentDirectories)
 		if err != nil {
+			if isStreamResetError(err) {
+				return fmt.Errorf("failed to upload file %s to workspace: %w\n\n"+
+					"The connection was closed before the upload finished. "+
+					"This is usually caused by a network intermediary (corporate egress proxy, VPN, or firewall/WAF) "+
+					"enforcing a request-body size limit on POSTs to *.cloud.databricks.com. "+
+					"Try running this command from a network without such restrictions.",
+					remoteArchivePath, err)
+			}
 			return fmt.Errorf("failed to upload file %s to workspace: %w", remoteArchivePath, err)
 		}
 		log.Infof(ctx, "Successfully uploaded %s to workspace", remoteBinaryPath)
@@ -73,6 +82,18 @@ func uploadReleases(ctx context.Context, workspaceFiler filer.Filer, getRelease
 	return nil
 }
 
+// isStreamResetError reports whether err looks like an HTTP/2 stream reset from
+// the server, which typically means an edge proxy or the workspace-files import
+// endpoint rejected the request body (e.g. body-size limit).
+func isStreamResetError(err error) bool {
+	var se http2.StreamError
+	if errors.As(err, &se) {
+		return true
+	}
+	msg := err.Error()
+	return strings.Contains(msg, "stream error") && strings.Contains(msg, "stream ID")
+}
+
 func getReleaseName(architecture, version string) string {
 	if strings.Contains(version, "dev") {
 		return fmt.Sprintf("databricks_cli_linux_%s.zip", architecture)

experimental/ssh/internal/client/releases_test.go

@@ -0,0 +1,50 @@
+package client
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/http2"
+)
+
+func TestIsStreamResetError(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "http2 stream error type",
+			err:  http2.StreamError{StreamID: 15, Code: http2.ErrCodeNo},
+			want: true,
+		},
+		{
+			name: "wrapped http2 stream error type",
+			err:  fmt.Errorf("post failed: %w", http2.StreamError{StreamID: 15, Code: http2.ErrCodeNo}),
+			want: true,
+		},
+		{
+			name: "string match from peer reset (Go HTTP/2 client format)",
+			err:  errors.New(`Post "https://example/api/2.0/workspace-files/import-file/...": stream error: stream ID 15; NO_ERROR; received from peer`),
+			want: true,
+		},
+		{
+			name: "unrelated error",
+			err:  errors.New("connection refused"),
+			want: false,
+		},
+		{
+			name: "API error message",
+			err:  errors.New("RESOURCE_DOES_NOT_EXIST: path does not exist"),
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isStreamResetError(tt.err))
+		})
+	}
+}