@botbuddy/cli 1.13.0 → 1.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.13.0",
+  "version": "1.13.1",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/wait.mjs

@@ -399,6 +399,14 @@ function makeConnect(opts) {
     // the agent (and its locks) aren't reaped during a long wait.
     if (opts.heartbeat) url.searchParams.set("heartbeat", "1");
 
+    // BOT-1565: abort the fetch itself on idle. A silently half-open SSE body
+    // already has an `iterator.next()` pending, and `iterator.return()` queues
+    // BEHIND that read — it cannot cancel it until bytes/EOF eventually arrive,
+    // so it would leave the response locked and the socket open while we
+    // reconnect, leaking a connection per stall (Codex P2). Aborting the fetch's
+    // signal tears the stalled socket down immediately, then the read rejects and
+    // the stream ends so runWaitLoop reconnects.
+    const ac = new AbortController();
     const res = await fetch(url, {
       headers: {
         Authorization: `Bearer ${opts.token}`,
@@ -407,12 +415,13 @@ function makeConnect(opts) {
         // BOT-741: never let a proxy gzip-buffer an SSE stream.
         "Accept-Encoding": "identity",
       },
+      signal: ac.signal,
     });
     if (res.status === 401) return errorStream("unauthorized");
     if (res.status === 403) return errorStream("forbidden");
     if (!res.ok || !res.body) throw new Error(`relay responded ${res.status}`);
 
-    return sseFrameStream(res.body);
+    return sseFrameStream(res.body, { onIdle: () => ac.abort() });
   };
 }
 
@@ -468,14 +477,68 @@ function makeFeedLagProbe(opts) {
   };
 }
 
-async function* sseFrameStream(body) {
+// BOT-1565: a silently half-open SSE socket (a network blip, or a gateway/edge
+// connection-lifetime ceiling ~45–51 min) delivers no bytes AND no end-of-stream,
+// so a bare `for await` here would block forever and never reconnect. Meanwhile
+// the relay's last_seen_at keepalive stops bumping and the wait reaper abandons
+// the still-parked wait after its grace → /waits goes blank (BOT-1565). Guard
+// every read with an IDLE watchdog: the relay sends a keepalive comment every
+// ~30s (EVENT_STREAM_KEEPALIVE_MS), and every chunk (comment or frame) resets
+// the timer, so a healthy-but-quiet connection never trips it. If NOTHING
+// arrives for idleMs the connection is presumed dead: end the stream so
+// runWaitLoop reconnects from the cursor, which re-bumps wait_sessions.last_seen_at
+// (and, with --heartbeat, agents.last_heartbeat) before the reaper's grace.
+// 70s ≈ 2.3 missed keepalives — long enough to never false-trip on jitter, short
+// enough that the reconnect lands inside the 90s last_seen reap window.
+export const DEFAULT_SSE_IDLE_TIMEOUT_MS = 70_000;
+
+function sseIdleTimeoutMs() {
+  const raw = Number(process.env.BOTBUDDY_WAIT_IDLE_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_SSE_IDLE_TIMEOUT_MS;
+}
+
+const SSE_IDLE = Symbol("sse_idle");
+
+export async function* sseFrameStream(body, { idleMs = sseIdleTimeoutMs(), onIdle = null } = {}) {
   const decoder = new TextDecoder();
   let buf = "";
-  for await (const chunk of body) {
-    buf += decoder.decode(chunk, { stream: true });
-    const { frames, rest } = parseSseFrames(buf);
-    buf = rest;
-    for (const f of frames) yield f;
+  const iterator = body[Symbol.asyncIterator]();
+  try {
+    while (true) {
+      const nextP = iterator.next();
+      let timer;
+      const idle = new Promise((resolve) => { timer = setTimeout(() => resolve(SSE_IDLE), idleMs); });
+      let result;
+      try {
+        result = await Promise.race([nextP, idle]);
+      } finally {
+        clearTimeout(timer);
+      }
+      if (result === SSE_IDLE) {
+        // Presumed dead. onIdle() aborts the underlying fetch (makeConnect wires
+        // it to the request's AbortController) — the ONLY thing that actually
+        // tears a stalled socket down, since iterator.return() would queue behind
+        // the pending read and never fire until bytes/EOF arrive (Codex P2). The
+        // abort settles the pending read (rejects with AbortError); swallow it so
+        // it isn't an unhandled rejection, then end the stream to force a reconnect.
+        nextP.then(() => {}, () => {});
+        if (onIdle) onIdle();
+        return;
+      }
+      const { value: chunk, done } = result;
+      if (done) return;
+      buf += decoder.decode(chunk, { stream: true });
+      const { frames, rest } = parseSseFrames(buf);
+      buf = rest;
+      for (const f of frames) yield f;
+    }
+  } finally {
+    // Belt-and-braces release for the non-idle early-stop path (the consumer
+    // stopped iterating, e.g. runWaitLoop matched). On the idle path the fetch
+    // has already been aborted above, so the body is torn down regardless; this
+    // return() then resolves promptly instead of queuing behind a live read.
+    // Fire-and-forget + swallow: never let teardown block the generator's exit.
+    Promise.resolve(iterator.return?.()).then(() => {}, () => {});
   }
 }