fix: keep CI SSH uploads below provider limits

scripts/ci-install-visibility-contract-test.ts

@@ -46,6 +46,13 @@ assertCondition(
   "ci dispatch submit must use bounded backend-core fetch timeout",
 );
 
+assertCondition(
+  source.includes("const hostSshBase64UploadChunkChars = 3000")
+    && source.includes("chunks(encoded, hostSshBase64UploadChunkChars)")
+    && source.includes("provider-gateway rejects long host.ssh commands"),
+  "ci host.ssh base64 upload must stay below provider command length limits",
+);
+
 assertCondition(
   source.includes("runSshCommandCapture(config, `${target.providerId}:k3s`, [\"script\"], script)")
     && source.includes("base64 -d > \\\"$tmp\\\" <<'UNIDESK_CI_MANIFEST_B64'")
@@ -81,6 +88,7 @@ console.log(JSON.stringify({
     "ci install defaults to async job mode with status follow-up",
     "ci install job status exposes stage progress events",
     "ci dispatch submit uses bounded backend-core fetch timeout",
+    "ci host.ssh base64 upload stays below provider command length limits",
     "ci manifest apply embeds YAML through k3s route script with byte visibility",
     "ci prewarm failure exposes concise root/containerd recovery",
     "ci help documents manifest refresh boundaries",

scripts/ci-publish-backend-core-preflight-contract-test.ts

@@ -61,6 +61,7 @@ function readyTransport(kind: "remote-frontend" | "local-docker" = "remote-front
           taskId: "task-ci-runner",
           status: "succeeded",
           stdout: [
+            "d601_native_k3s_guard=pass kubeconfig=/etc/rancher/k3s/k3s.yaml context=default server=https://127.0.0.1:6443 node=d601",
             "provider_host_ssh=ok",
             "kubectl=ok",
             "docker=ok",
@@ -184,6 +185,7 @@ const remoteInfraBlockedTransport: PublishPreflightTransport = {
       taskId: "task-ci-runner",
       status: "succeeded",
       stdout: [
+        "d601_native_k3s_guard=pass kubeconfig=/etc/rancher/k3s/k3s.yaml context=default server=https://127.0.0.1:6443 node=d601",
         "provider_host_ssh=ok",
         "kubectl=ok",
         "docker=ok",

scripts/src/ci.ts

@@ -548,6 +548,8 @@ function chunks(value: string, size: number): string[] {
   return result;
 }
 
+const hostSshBase64UploadChunkChars = 3000;
+
 function asRecord(value: unknown): Record<string, unknown> | null {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : null;
 }
@@ -970,7 +972,9 @@ async function uploadRemoteBase64(path: string, encoded: string, target = ciTarg
     "chmod 600 \"$target\"",
   ].join("\n"), 20_000, 10_000, true, target);
   if (!init.ok) return init;
-  for (const chunk of chunks(encoded, 6_000)) {
+  // D601 provider-gateway rejects long host.ssh commands; keep each append
+  // envelope comfortably below the transport limit.
+  for (const chunk of chunks(encoded, hostSshBase64UploadChunkChars)) {
     const append = await dispatchSsh([
       "set -euo pipefail",
       `target=${shellQuote(path)}`,