@blaxel/core 0.2.87-preview.167 → 0.2.87-preview.168

package/dist/cjs/common/h2fetch.js

@@ -17,14 +17,21 @@ const sessionsWithListenerBudget = new WeakSet();
  * When `settings.maxConcurrentH2Requests` is `0`/unset the gate is a no-op
  * (current default behavior: unlimited concurrency).
  */
-// Safety timeout for a held slot. A request that never resolves (no response,
-// no error, no abort) would otherwise hold its slot forever and starve every
-// queued request for the same domain. After this window we release the slot
-// and let the underlying request continue or reject on its own; we never
-// cancel the in-flight request here, we only stop it from blocking the queue.
-// Kept deliberately conservative (well above any realistic part-upload time)
-// so it does not interfere with legitimately slow but healthy requests.
-const H2_SLOT_TIMEOUT_MS = 120_000;
+// Last-resort leak guard for a held slot. The slot is now released on the real
+// stream terminal (end / error / abort / cancel / pre-response reject), which
+// always fires, so this timer is a pure backstop for the one residual case: a
+// request that never opens a stream AND never settles (no response, no error,
+// no abort) — it must not pin a slot forever and starve the per-domain queue.
+//
+// When it fires it ONLY frees the queue slot. It NEVER aborts or cancels the
+// underlying request or its response stream: `release` does not touch `req` or
+// the body stream, so a long-lived streaming response keeps flowing. Raised
+// well beyond any legitimate stream lifetime so it cannot interfere with a
+// healthy long-open stream (process.streamLogs / execWithStreaming / port
+// proxy). RESIDUAL: a stream that outlives this backstop would have its slot
+// freed early (the queue could then admit one extra stream); acceptable as a
+// pure backstop, since the slot is otherwise tied to the true stream terminal.
+const H2_SLOT_TIMEOUT_MS = 1_800_000; // 30 minutes
 const h2GatesByDomain = new Map();
 function getH2Gate(domain) {
     let gate = h2GatesByDomain.get(domain);
@@ -35,10 +42,14 @@ function getH2Gate(domain) {
     return gate;
 }
 /**
- * Acquire an in-flight slot for `domain`. Resolves with a release function
- * that is idempotent and FIFO-fair: releasing wakes the longest-waiting
- * queued caller for the same domain. A safety timer also releases the slot
- * if the caller never does, preventing per-domain starvation.
+ * Acquire an OPEN-STREAM slot for `domain`. Resolves with a release function
+ * that is idempotent and FIFO-fair: releasing wakes the longest-waiting queued
+ * caller for the same domain. The slot is held for the lifetime of an OPEN H2
+ * stream — the send path releases it on the stream terminal — so the gate
+ * bounds true concurrent streams on the one shared session, not merely requests
+ * awaiting headers (ENG-2678). A backstop timer releases the slot if a request
+ * neither opens a stream nor ever settles, preventing per-domain starvation;
+ * it never aborts the underlying request (see `H2_SLOT_TIMEOUT_MS`).
  */
 async function acquireH2Slot(domain) {
     const max = settings_js_1.settings.maxConcurrentH2Requests; // 0/undefined = unlimited
@@ -100,6 +111,12 @@ function createH2Fetch(session) {
  */
 function createPoolBackedH2Fetch(pool, domain) {
     return async (input) => {
+        // Acquire the slot here, but hand its release to the send path: it is held
+        // for the OPEN-STREAM lifetime and freed on the stream terminal. Paths that
+        // never open a stream on the shared session (fetch fallbacks go over a
+        // different connection) release it immediately so they do not count against
+        // the open-stream budget. `rel` is idempotent, so the explicit releases
+        // below are safe even though the send path may also release.
         const rel = await acquireH2Slot(domain);
         try {
             const session = await pool.get(domain);
@@ -110,6 +127,7 @@ function createPoolBackedH2Fetch(pool, domain) {
                         onH2RequestCreated: () => {
                             h2RequestCreated = true;
                         },
+                        releaseSlot: rel,
                     });
                 }
                 catch (err) {
@@ -119,14 +137,23 @@ function createPoolBackedH2Fetch(pool, domain) {
                     throw err;
                 }
             }
+            // No usable session: this fetch does not open a stream on the shared
+            // session, so free the slot before falling back.
+            rel();
             return await globalThis.fetch(input);
         }
-        finally {
+        catch (err) {
+            // Pre-send throw (e.g. pool.get() or Request body read): release the slot
+            // so a failed request never pins it. Idempotent if already released.
             rel();
+            throw err;
         }
     };
 }
 async function h2RequestDirectFromPool(pool, domain, url, init) {
+    // See createPoolBackedH2Fetch: the slot is held for the OPEN-STREAM lifetime
+    // and released by the send path on the stream terminal; non-stream fallbacks
+    // release it immediately. `rel` is idempotent.
     const rel = await acquireH2Slot(domain);
     try {
         const session = await pool.get(domain);
@@ -137,6 +164,7 @@ async function h2RequestDirectFromPool(pool, domain, url, init) {
                     onH2RequestCreated: () => {
                         h2RequestCreated = true;
                     },
+                    releaseSlot: rel,
                 });
             }
             catch (err) {
@@ -146,10 +174,13 @@ async function h2RequestDirectFromPool(pool, domain, url, init) {
                 throw err;
             }
         }
+        // No usable session: fetch over a different connection, no stream opened.
+        rel();
         return await globalThis.fetch(url, init);
     }
-    finally {
+    catch (err) {
         rel();
+        throw err;
     }
 }
 /**
@@ -161,6 +192,9 @@ function h2RequestDirect(session, url, init) {
 }
 function h2RequestDirectInternal(session, url, init, options) {
     if (session.closed || session.destroyed) {
+        // Pre-flight fallback (session unusable): no stream opens on the shared
+        // session, so free any held slot before going over globalThis.fetch.
+        options?.releaseSlot?.();
         return globalThis.fetch(url, init);
     }
     const parsed = new URL(url);
@@ -200,7 +234,9 @@ function h2RequestDirectInternal(session, url, init, options) {
         else {
             // FormData, ReadableStream, Blob, etc. can't be serialized to Buffer
             // for manual H2 framing — fall back to regular fetch (pre-flight,
-            // nothing has been sent on the wire yet).
+            // nothing has been sent on the wire yet). No stream opens on the shared
+            // session, so free any held slot before falling back.
+            options?.releaseSlot?.();
             return globalThis.fetch(url, init);
         }
         if (!h2Headers["content-length"]) {
@@ -244,13 +280,19 @@ function _h2Send(session, h2Headers, body, signal, fallbackUrl, fallbackInit, op
         let streamClosed = false;
         let req = null;
         let releaseSessionRef = () => { };
+        // The per-domain open-stream slot (idempotent; no-op for the non-pool
+        // transports). Held for the OPEN-STREAM lifetime and released alongside the
+        // session ref from cleanupActiveRequest() on every terminal path.
+        const releaseSlot = options?.releaseSlot ?? (() => { });
         let abort = null;
         try {
             req = session.request(h2Headers);
         }
         catch {
             // Pre-flight fallback: session.request() threw synchronously, so no
-            // H2 frames were sent. Safe to retry over globalThis.fetch.
+            // H2 frames were sent. No stream opened on the shared session, so free
+            // the slot before retrying over globalThis.fetch.
+            releaseSlot();
             globalThis.fetch(fallbackUrl, fallbackInit).then(resolve, reject);
             return;
         }
@@ -265,7 +307,13 @@ function _h2Send(session, h2Headers, body, signal, fallbackUrl, fallbackInit, op
         const cleanupActiveRequest = () => {
             if (abort)
                 signal?.removeEventListener("abort", abort);
+            // Slot and session-ref share the OPEN-STREAM lifetime but stay
+            // independent and each idempotent (PM-2160). Every terminal path funnels
+            // through here exactly once: pre-response reject (close/goaway/error),
+            // abort-before-response, abort-during-stream, stream end, stream error,
+            // and ReadableStream cancel — so the slot is freed once on each.
             releaseSessionRef();
+            releaseSlot();
         };
         const rejectBeforeResponse = (err) => {
             if (settled)

package/dist/cjs/common/settings.js

@@ -11,8 +11,8 @@ const index_js_1 = require("../authentication/index.js");
 const env_js_1 = require("../common/env.js");
 const node_js_1 = require("../common/node.js");
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.2.87-preview.167";
-const BUILD_COMMIT = "deb13a8059a0b1841c255ea2f5fb5461304d32ef";
+const BUILD_VERSION = "0.2.87-preview.168";
+const BUILD_COMMIT = "bd5fddf1656456ae916681fa617df50fb584f997";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-04-16";
 // Cache for config.yaml tracking value