@gobing-ai/knowledge-kit 0.0.19 → 0.0.22

package/plugins/generations/image-gen/src/providers/azure.ts

@@ -1,6 +1,7 @@
 import { extname } from 'node:path';
 import { readBytes } from '../bytes';
 import { extractImageFromResponse, getOpenAISize, type OpenAIImageResponse } from './openai';
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -77,6 +78,7 @@ export function validateReferenceImages(referenceImages: readonly string[]): voi
 
 export const createAzure: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     // Azure's own env-precedence for a default model: explicit deployment, then the base URL,
     // then the frozen 'gpt-image-2' (matches the baoyu getDefaultModel chain; spec facts unchanged).
@@ -135,17 +137,19 @@ export const createAzure: ProviderFactory = (options?: ProviderOptions): ImagePr
                         method: 'POST',
                         headers: { 'api-key': apiKey },
                         body: form,
+                        signal: AbortSignal.timeout(timeoutMs),
                     });
                     if (!res.ok) throw new Error(`Azure OpenAI edits API error: ${await res.text()}`);
-                    return extractImageFromResponse((await res.json()) as OpenAIImageResponse, fetchFn);
+                    return extractImageFromResponse((await res.json()) as OpenAIImageResponse, fetchFn, timeoutMs);
                 }
                 const res = await fetchFn(buildURL(endpoint, deployment, '/images/generations', env), {
                     method: 'POST',
                     headers: { 'content-type': 'application/json', 'api-key': apiKey },
                     body: JSON.stringify({ prompt: req.prompt, size, n: 1, quality: getAzureQuality(req.quality) }),
+                    signal: AbortSignal.timeout(timeoutMs),
                 });
                 if (!res.ok) throw new Error(`Azure OpenAI API error: ${await res.text()}`);
-                return extractImageFromResponse((await res.json()) as OpenAIImageResponse, fetchFn);
+                return extractImageFromResponse((await res.json()) as OpenAIImageResponse, fetchFn, timeoutMs);
             })();
             return { bytes, extension: 'png', provider: 'azure', model: req.model };
         },

package/plugins/generations/image-gen/src/providers/dashscope.ts

@@ -1,6 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { echoError } from '@gobing-ai/ts-utils';
 import { refToDataUri } from './refs';
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -389,7 +390,11 @@ interface DashScopeResponse {
     };
 }
 
-async function extractImageFromResponse(result: DashScopeResponse, fetchFn: typeof fetch): Promise<Uint8Array> {
+async function extractImageFromResponse(
+    result: DashScopeResponse,
+    fetchFn: typeof fetch,
+    timeoutMs: number = PROVIDER_REQUEST_TIMEOUT_MS,
+): Promise<Uint8Array> {
     let imageData: string | null = null;
     if (result.output?.result_image !== undefined) {
         imageData = result.output.result_image;
@@ -403,7 +408,7 @@ async function extractImageFromResponse(result: DashScopeResponse, fetchFn: type
     }
     if (imageData === null) throw new Error('No image in response');
     if (imageData.startsWith('http://') || imageData.startsWith('https://')) {
-        const imgRes = await fetchFn(imageData);
+        const imgRes = await fetchFn(imageData, { signal: AbortSignal.timeout(timeoutMs) });
         if (!imgRes.ok) throw new Error('Failed to download image');
         return new Uint8Array(await imgRes.arrayBuffer());
     }
@@ -412,6 +417,7 @@ async function extractImageFromResponse(result: DashScopeResponse, fetchFn: type
 
 export const createDashscope: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     const readEnv = (key: string): string => env[key] ?? '';
     const supportsRef = (model: string): boolean => model.includes('wan2.7');
@@ -476,9 +482,10 @@ export const createDashscope: ProviderFactory = (options?: ProviderOptions): Ima
                 method: 'POST',
                 headers: { 'content-type': 'application/json', authorization: `Bearer ${apiKey}` },
                 body: JSON.stringify(body),
+                signal: AbortSignal.timeout(timeoutMs),
             });
             if (!res.ok) throw new Error(`DashScope API error (${res.status}): ${await res.text()}`);
-            const bytes = await extractImageFromResponse((await res.json()) as DashScopeResponse, fetchFn);
+            const bytes = await extractImageFromResponse((await res.json()) as DashScopeResponse, fetchFn, timeoutMs);
             return { bytes, extension: 'png', provider: 'dashscope', model: req.model };
         },
     };

package/plugins/generations/image-gen/src/providers/google.ts

@@ -1,7 +1,12 @@
 import { Buffer } from 'node:buffer';
 import { execFileSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNodeFileSystem } from '@gobing-ai/ts-runtime';
 import { readBytes } from '../bytes';
 import { mimeForPath } from './refs';
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -112,6 +117,25 @@ function getHttpProxy(readEnv: (key: string) => string): string | null {
     );
 }
 
+/**
+ * curl config-file quoting: backslash-escape `\` and `"` inside a double-quoted value.
+ * curl's config parser is not a shell, but it does honour these two escapes.
+ */
+const curlQuote = (s: string): string => `"${s.replace(/[\\"]/g, '\\$&')}"`;
+
+/** Replaces every secret with `***`; empty entries are skipped so `''` cannot mangle the text. */
+const redact = (s: string, secrets: string[]): string =>
+    secrets.filter((x) => x !== '').reduce((acc, x) => acc.replaceAll(x, '***'), s);
+
+/** Decoded password from a proxy URL, or '' when the URL carries none or does not parse. */
+function proxyPassword(proxy: string): string {
+    try {
+        return decodeURIComponent(new URL(proxy).password);
+    } catch {
+        return '';
+    }
+}
+
 interface GeminiResponse {
     candidates?: Array<{ content?: { parts?: Array<{ inlineData?: { data?: string } }> } }>;
 }
@@ -123,6 +147,7 @@ interface ImagenResponse {
 
 export const createGoogle: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     const readEnv = (key: string): string => env[key] ?? '';
     const refModels = [
@@ -143,35 +168,50 @@ export const createGoogle: ProviderFactory = (options?: ProviderOptions): ImageP
         const proxy = getHttpProxy(readEnv);
         // Bun's fetch drops long-lived proxied sockets; upstream works around it with curl (0115 port).
         if (proxy !== null && options?.fetch === undefined) {
-            const result = (() => {
-                try {
-                    return execFileSync(
-                        'curl',
-                        [
-                            '-s',
-                            '--connect-timeout',
-                            '30',
-                            '--max-time',
-                            '300',
-                            '-x',
-                            proxy,
-                            url,
-                            '-H',
-                            'Content-Type: application/json',
-                            '-H',
-                            `x-goog-api-key: ${apiKey}`,
-                            '-d',
-                            '@-',
-                        ],
-                        { input: JSON.stringify(body), encoding: 'utf8', timeout: 310_000 },
-                    );
-                } catch (error: unknown) {
-                    const e = error as { message?: string; stderr?: string | Buffer };
-                    const details =
-                        (typeof e.stderr === 'string' ? e.stderr.trim() : '') || e.message || 'curl request failed';
-                    throw new Error(`Google API request failed via curl: ${details}`);
-                }
-            })();
+            // Secrets stay out of argv: curl reads the proxy and the API key from a config file
+            // (`-K <path>`), and the request body arrives on stdin (`-d @-`). `execFileSync` embeds the
+            // full argv in `error.message`, so `-x <proxy>` / `-H 'x-goog-api-key: …'` would leak both
+            // the key and the proxy password into logs. `-sS` (not `-s`) keeps curl's own diagnostic on
+            // stderr, so `details` no longer falls back to that argv-bearing message.
+            //
+            // File IO goes through the `@gobing-ai/ts-runtime` seam (`no-direct-fs-io`): the seam is
+            // text-only with no `mode` argument, and the file lives in `os.tmpdir()`, which is a
+            // per-user directory (0700 on macOS).
+            const configPath = join(tmpdir(), `kk-image-gen-${randomUUID()}.curlrc`);
+            const config = `proxy = ${curlQuote(proxy)}\nheader = ${curlQuote(`x-goog-api-key: ${apiKey}`)}\n`;
+            const fileSystem = createNodeFileSystem();
+            await fileSystem.writeFile(configPath, config);
+            let result: string;
+            try {
+                result = execFileSync(
+                    'curl',
+                    [
+                        '-sS',
+                        '--connect-timeout',
+                        '30',
+                        '--max-time',
+                        '300',
+                        '-K',
+                        configPath,
+                        '-H',
+                        'Content-Type: application/json',
+                        '-d',
+                        '@-',
+                        url,
+                    ],
+                    { input: JSON.stringify(body), encoding: 'utf8', timeout: 310_000 },
+                );
+            } catch (error: unknown) {
+                const e = error as { message?: string; stderr?: string | Buffer };
+                const details =
+                    (typeof e.stderr === 'string' ? e.stderr.trim() : '') || e.message || 'curl request failed';
+                // Redact the raw `user:pass@host` form as well as the decoded password.
+                throw new Error(
+                    `Google API request failed via curl: ${redact(details, [apiKey, proxyPassword(proxy), proxy])}`,
+                );
+            } finally {
+                await fileSystem.deleteFile(configPath);
+            }
             const parsed = JSON.parse(result) as T & { error?: { code?: string; message?: string } };
             if (parsed.error !== undefined) {
                 throw new Error(`Google API error (${parsed.error.code}): ${parsed.error.message}`);
@@ -182,6 +222,7 @@ export const createGoogle: ProviderFactory = (options?: ProviderOptions): ImageP
             method: 'POST',
             headers: { 'content-type': 'application/json', 'x-goog-api-key': apiKey },
             body: JSON.stringify(body),
+            signal: AbortSignal.timeout(timeoutMs),
         });
         if (!res.ok) {
             const err = await res.text();

package/plugins/generations/image-gen/src/providers/huggingface.ts

@@ -1,3 +1,4 @@
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -25,6 +26,7 @@ export const buildPayload = (
 
 export const createHuggingface: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     const readEnv = (key: string): string => env[key] ?? '';
 
@@ -44,6 +46,7 @@ export const createHuggingface: ProviderFactory = (options?: ProviderOptions): I
                 method: 'POST',
                 headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
                 body: JSON.stringify(buildPayload(req)),
+                signal: AbortSignal.timeout(timeoutMs),
             });
             if (!res.ok) {
                 const text = (await res.text()).slice(0, 200);

package/plugins/generations/image-gen/src/providers/jimeng.ts

@@ -1,4 +1,5 @@
 import * as crypto from 'node:crypto';
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -142,6 +143,7 @@ interface JimengTaskResponse {
 
 export const createJimeng: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     const readEnv = (key: string): string => env[key] ?? '';
 
@@ -170,7 +172,12 @@ export const createJimeng: ProviderFactory = (options?: ProviderOptions): ImageP
             'cv',
             endpoint.canonicalUri,
         );
-        return fetchFn(endpoint.url, { method: 'POST', headers: { ...headers, authorization }, body });
+        return fetchFn(endpoint.url, {
+            method: 'POST',
+            headers: { ...headers, authorization },
+            body,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
     }
 
     async function submitTask(
@@ -214,7 +221,7 @@ export const createJimeng: ProviderFactory = (options?: ProviderOptions): ImageP
                 }
                 if (status === 'done' && image_urls !== undefined && image_urls.length > 0) {
                     const url = image_urls[0] as string;
-                    const imgRes = await fetchFn(url);
+                    const imgRes = await fetchFn(url, { signal: AbortSignal.timeout(timeoutMs) });
                     if (!imgRes.ok) throw new Error(`Failed to download image from ${url}`);
                     return new Uint8Array(await imgRes.arrayBuffer());
                 }

package/plugins/generations/image-gen/src/providers/minimax.ts

@@ -1,6 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { readBytes } from '../bytes';
 import { mimeForPath } from './refs';
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -117,6 +118,7 @@ export async function buildSubjectReference(referenceImages: string[]): Promise<
 export async function extractImageFromResponse(
     result: MinimaxResponse,
     fetchFn: typeof fetch = fetch,
+    timeoutMs: number = PROVIDER_REQUEST_TIMEOUT_MS,
 ): Promise<Uint8Array> {
     const baseResp = result.base_resp;
     if (baseResp?.status_code !== undefined && baseResp.status_code !== 0) {
@@ -126,7 +128,7 @@ export async function extractImageFromResponse(
     if (base64Image !== undefined) return Uint8Array.from(Buffer.from(base64Image, 'base64'));
     const url = result.data?.image_urls?.[0];
     if (url !== undefined) {
-        const response = await fetchFn(url);
+        const response = await fetchFn(url, { signal: AbortSignal.timeout(timeoutMs) });
         if (!response.ok) throw new Error(`Failed to download image from MiniMax: ${response.status}`);
         return new Uint8Array(await response.arrayBuffer());
     }
@@ -135,6 +137,7 @@ export async function extractImageFromResponse(
 
 export const createMinimax: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     const readEnv = (key: string): string => env[key] ?? '';
 
@@ -160,11 +163,16 @@ export const createMinimax: ProviderFactory = (options?: ProviderOptions): Image
                 method: 'POST',
                 headers: { 'content-type': 'application/json', authorization: `Bearer ${apiKey}` },
                 body: JSON.stringify(body),
+                signal: AbortSignal.timeout(timeoutMs),
             });
             if (!response.ok) {
                 throw new Error(`MiniMax API error (${response.status}): ${await response.text()}`);
             }
-            const bytes = await extractImageFromResponse((await response.json()) as MinimaxResponse, fetchFn);
+            const bytes = await extractImageFromResponse(
+                (await response.json()) as MinimaxResponse,
+                fetchFn,
+                timeoutMs,
+            );
             return { bytes, extension: 'jpg', provider: 'minimax', model: req.model };
         },
     };

package/plugins/generations/image-gen/src/providers/openai.ts

@@ -1,6 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { basename } from 'node:path';
 import { readBytes } from '../bytes';
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -207,13 +208,14 @@ export function getMimeType(filename: string): string {
 export async function extractImageFromResponse(
     result: OpenAIImageResponse,
     fetchFn: typeof fetch = fetch,
+    timeoutMs: number = PROVIDER_REQUEST_TIMEOUT_MS,
 ): Promise<Uint8Array> {
     const img = result.data[0];
     if (img?.b64_json !== undefined && img.b64_json !== '') {
         return Uint8Array.from(Buffer.from(img.b64_json, 'base64'));
     }
     if (img?.url !== undefined) {
-        const imgRes = await fetchFn(img.url);
+        const imgRes = await fetchFn(img.url, { signal: AbortSignal.timeout(timeoutMs) });
         if (!imgRes.ok) throw new Error('Failed to download image');
         return new Uint8Array(await imgRes.arrayBuffer());
     }
@@ -222,6 +224,7 @@ export async function extractImageFromResponse(
 
 export const createOpenai: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     const readEnv = (key: string): string => env[key] ?? '';
     const supportsRef = (model: string): boolean => model.includes('gpt-image');
@@ -255,6 +258,7 @@ export const createOpenai: ProviderFactory = (options?: ProviderOptions): ImageP
                     method: 'POST',
                     headers: { 'content-type': 'application/json', authorization: `Bearer ${apiKey}` },
                     body: JSON.stringify({ model: req.model, messages: [{ role: 'user', content: req.prompt }] }),
+                    signal: AbortSignal.timeout(timeoutMs),
                 });
                 if (!chatRes.ok) throw new Error(`OpenAI API error: ${await chatRes.text()}`);
                 const content =
@@ -301,17 +305,19 @@ export const createOpenai: ProviderFactory = (options?: ProviderOptions): ImageP
                         method: 'POST',
                         headers: { authorization: `Bearer ${apiKey}` },
                         body: form,
+                        signal: AbortSignal.timeout(timeoutMs),
                     });
                     if (!res.ok) throw new Error(`OpenAI edits API error: ${await res.text()}`);
-                    return extractImageFromResponse((await res.json()) as OpenAIImageResponse, fetchFn);
+                    return extractImageFromResponse((await res.json()) as OpenAIImageResponse, fetchFn, timeoutMs);
                 }
                 const res = await fetchFn(`${baseURL}/images/generations`, {
                     method: 'POST',
                     headers: { 'content-type': 'application/json', authorization: `Bearer ${apiKey}` },
                     body: JSON.stringify(buildOpenAIGenerationsBody(req.prompt, req.model, args)),
+                    signal: AbortSignal.timeout(timeoutMs),
                 });
                 if (!res.ok) throw new Error(`OpenAI API error: ${await res.text()}`);
-                return extractImageFromResponse((await res.json()) as OpenAIImageResponse, fetchFn);
+                return extractImageFromResponse((await res.json()) as OpenAIImageResponse, fetchFn, timeoutMs);
             })();
             return { bytes, extension: 'png', provider: 'openai', model: req.model };
         },

package/plugins/generations/image-gen/src/providers/openrouter.ts

@@ -1,5 +1,6 @@
 import { Buffer } from 'node:buffer';
 import { refToDataUri } from './refs';
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -137,11 +138,15 @@ function decodeDataUrl(value: string): Uint8Array | null {
     return Uint8Array.from(Buffer.from(match[1] as string, 'base64'));
 }
 
-async function downloadImage(value: string, fetchFn: typeof fetch): Promise<Uint8Array> {
+async function downloadImage(
+    value: string,
+    fetchFn: typeof fetch,
+    timeoutMs: number = PROVIDER_REQUEST_TIMEOUT_MS,
+): Promise<Uint8Array> {
     const inline = decodeDataUrl(value);
     if (inline !== null) return inline;
     if (value.startsWith('http://') || value.startsWith('https://')) {
-        const response = await fetchFn(value);
+        const response = await fetchFn(value, { signal: AbortSignal.timeout(timeoutMs) });
         if (!response.ok) throw new Error(`Failed to download OpenRouter image: ${response.status}`);
         return new Uint8Array(await response.arrayBuffer());
     }
@@ -151,12 +156,13 @@ async function downloadImage(value: string, fetchFn: typeof fetch): Promise<Uint
 export async function extractImageFromResponse(
     result: OpenRouterResponse,
     fetchFn: typeof fetch = fetch,
+    timeoutMs: number = PROVIDER_REQUEST_TIMEOUT_MS,
 ): Promise<Uint8Array> {
     const choice = result.choices?.[0];
     const message = choice?.message;
     for (const image of message?.images ?? []) {
         const imageUrl = extractImageUrl(image);
-        if (imageUrl !== null) return downloadImage(imageUrl, fetchFn);
+        if (imageUrl !== null) return downloadImage(imageUrl, fetchFn, timeoutMs);
     }
     if (Array.isArray(message?.content)) {
         for (const item of message.content) {
@@ -211,6 +217,7 @@ export function buildRequestBody(
 
 export const createOpenrouter: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     const readEnv = (key: string): string => env[key] ?? '';
 
@@ -246,11 +253,16 @@ export const createOpenrouter: ProviderFactory = (options?: ProviderOptions): Im
                 method: 'POST',
                 headers,
                 body: JSON.stringify(body),
+                signal: AbortSignal.timeout(timeoutMs),
             });
             if (!response.ok) {
                 throw new Error(`OpenRouter API error (${response.status}): ${await response.text()}`);
             }
-            const bytes = await extractImageFromResponse((await response.json()) as OpenRouterResponse, fetchFn);
+            const bytes = await extractImageFromResponse(
+                (await response.json()) as OpenRouterResponse,
+                fetchFn,
+                timeoutMs,
+            );
             return { bytes, extension: 'png', provider: 'openrouter', model: req.model };
         },
     };

package/plugins/generations/image-gen/src/providers/replicate.ts

@@ -1,5 +1,6 @@
 import { refToDataUri } from './refs';
 import { extensionFromUrl } from './seedream';
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -208,10 +209,11 @@ export function extractOutputUrl(prediction: PredictionResponse): string {
 export const createReplicate: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
     const env = options?.env ?? process.env;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const readEnv = (key: string): string => env[key] ?? '';
 
     async function downloadImage(url: string): Promise<Uint8Array> {
-        const res = await fetchFn(url);
+        const res = await fetchFn(url, { signal: AbortSignal.timeout(timeoutMs) });
         if (!res.ok) throw new Error(`Failed to download image from Replicate: ${res.status}`);
         return new Uint8Array(await res.arrayBuffer());
     }
@@ -219,7 +221,10 @@ export const createReplicate: ProviderFactory = (options?: ProviderOptions): Ima
     async function pollPrediction(apiToken: string, getUrl: string): Promise<PredictionResponse> {
         const start = Date.now();
         while (Date.now() - start < MAX_POLL_MS) {
-            const res = await fetchFn(getUrl, { headers: { authorization: `Bearer ${apiToken}` } });
+            const res = await fetchFn(getUrl, {
+                headers: { authorization: `Bearer ${apiToken}` },
+                signal: AbortSignal.timeout(timeoutMs),
+            });
             if (!res.ok) throw new Error(`Replicate poll error (${res.status}): ${await res.text()}`);
             const prediction = (await res.json()) as PredictionResponse;
             if (prediction.status === 'succeeded') return prediction;
@@ -260,7 +265,12 @@ export const createReplicate: ProviderFactory = (options?: ProviderOptions): Ima
                 Prefer: `wait=${SYNC_WAIT_SECONDS}`,
             };
             let prediction = (await (
-                await fetchFn(url, { method: 'POST', headers, body: JSON.stringify(body) })
+                await fetchFn(url, {
+                    method: 'POST',
+                    headers,
+                    body: JSON.stringify(body),
+                    signal: AbortSignal.timeout(timeoutMs),
+                })
             ).json()) as PredictionResponse;
             if (prediction.status !== 'succeeded') {
                 if (prediction.urls?.get === undefined)

package/plugins/generations/image-gen/src/providers/seedream.ts

@@ -1,5 +1,6 @@
 import { Buffer } from 'node:buffer';
 import { readBytes } from '../bytes';
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -36,6 +37,7 @@ export function extensionFromUrl(url: string): string {
 
 export const createSeedream: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     const readEnv = (key: string): string => env[key] ?? '';
     const supportsRef = (model: string): boolean => REF_MODEL_FRAGMENTS.some((fragment) => model.includes(fragment));
@@ -80,6 +82,7 @@ export const createSeedream: ProviderFactory = (options?: ProviderOptions): Imag
                 method: 'POST',
                 headers: { authorization: `Bearer ${apiKey}`, 'content-type': 'application/json' },
                 body: JSON.stringify(body),
+                signal: AbortSignal.timeout(timeoutMs),
             });
             const text = await resp.text();
             if (!resp.ok) {
@@ -107,7 +110,7 @@ export const createSeedream: ProviderFactory = (options?: ProviderOptions): Imag
                 };
             }
             if (image.url !== undefined) {
-                const r = await fetchFn(image.url);
+                const r = await fetchFn(image.url, { signal: AbortSignal.timeout(timeoutMs) });
                 if (!r.ok) {
                     throw new Error(`seedream fetch URL HTTP ${r.status}`);
                 }

package/plugins/generations/image-gen/src/providers/timeouts.ts

@@ -0,0 +1,14 @@
+/**
+ * Per-request HTTP timeout shared by every image-gen provider.
+ *
+ * This lives in a leaf module (no imports) rather than in `types.ts` because `types.ts` builds the
+ * `PROVIDERS` registry from value imports of each adapter, which would make `types.ts ⇄ <adapter>`
+ * a runtime import cycle: a consumer that imported an adapter first (e.g. the google helper tests)
+ * would evaluate `types.ts` while the adapter was still initialising and hit a TDZ error on the
+ * registry's `create` reference. `types.ts` re-exports this constant, so importing it from there
+ * still works.
+ *
+ * Bun's `fetch` — like WHATWG fetch — has no overall request deadline unless a `signal` is passed,
+ * so a stalled peer would hang the workflow step until someone killed the run (R5).
+ */
+export const PROVIDER_REQUEST_TIMEOUT_MS = 300_000;

package/plugins/generations/image-gen/src/providers/types.ts

@@ -70,10 +70,20 @@ export interface ImageProvider {
 }
 
 /** Injection seam for tests — mirrors `VoiceboxClientOptions.fetch` (voice-gen). */
+/**
+ * Default per-request timeout for every image-gen provider HTTP call. Defined in `./timeouts` (a
+ * leaf module) and re-exported here so `types.ts` stays the public surface; see that file for why
+ * it cannot be declared inline (import cycle → TDZ). Overridable per call via
+ * `ProviderOptions.timeoutMs` (tests).
+ */
+export { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
+
 export interface ProviderOptions {
     fetch?: typeof fetch;
     /** Environment consulted instead of process.env (tests). */
     env?: Record<string, string | undefined>;
+    /** Per-request timeout override (tests). Defaults to {@link PROVIDER_REQUEST_TIMEOUT_MS}. */
+    timeoutMs?: number;
 }
 
 export type ProviderFactory = (options?: ProviderOptions) => ImageProvider;

package/plugins/generations/image-gen/src/providers/zai.ts

@@ -1,3 +1,4 @@
+import { PROVIDER_REQUEST_TIMEOUT_MS } from './timeouts';
 import type { ImageProvider, ImageRequest, ImageResult, ProviderFactory, ProviderOptions } from './types';
 
 /**
@@ -180,6 +181,7 @@ interface ZaiResponse {
 
 export const createZai: ProviderFactory = (options?: ProviderOptions): ImageProvider => {
     const fetchFn = options?.fetch ?? fetch;
+    const timeoutMs = options?.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS;
     const env = options?.env ?? process.env;
     const readEnv = (key: string): string => env[key] ?? '';
 
@@ -220,11 +222,12 @@ export const createZai: ProviderFactory = (options?: ProviderOptions): ImageProv
                     quality: req.quality === 'normal' ? 'standard' : 'hd',
                     size,
                 }),
+                signal: AbortSignal.timeout(timeoutMs),
             });
             if (!response.ok) throw new Error(`Z.AI API error (${response.status}): ${await response.text()}`);
             const url = ((await response.json()) as ZaiResponse).data?.[0]?.url;
             if (url === undefined) throw new Error('No image URL in Z.AI response');
-            const imageResponse = await fetchFn(url);
+            const imageResponse = await fetchFn(url, { signal: AbortSignal.timeout(timeoutMs) });
             if (!imageResponse.ok) throw new Error(`Failed to download image from Z.AI: ${imageResponse.status}`);
             return {
                 bytes: new Uint8Array(await imageResponse.arrayBuffer()),

package/plugins/generations/news-report-gen/dist/index.js

@@ -21781,6 +21781,22 @@ var ResultSchema = exports_external.object({
   error: exports_external.string().optional(),
   metadata: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
 });
+var TargetOutcomeSchema = exports_external.object({
+  target: exports_external.string(),
+  ok: exports_external.boolean(),
+  status: exports_external.enum(["published", "failed", "skipped"]),
+  url: exports_external.string().optional(),
+  id: exports_external.string().optional(),
+  error: exports_external.string().optional(),
+  durationMs: exports_external.number().optional(),
+  metadata: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
+});
+var AggregateResultSchema = exports_external.object({
+  ok: exports_external.boolean(),
+  summary: exports_external.object({ total: exports_external.number(), succeeded: exports_external.number(), failed: exports_external.number(), skipped: exports_external.number() }),
+  targets: exports_external.array(TargetOutcomeSchema),
+  metadata: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
+});
 var DocListSchema = exports_external.array(DocSchema);
 var omniVoiceGenContentSchema = ContentSchema.extend({
   format: exports_external.literal("audio"),
@@ -21809,14 +21825,15 @@ var PluginKindSchema = exports_external.enum(PLUGIN_KINDS);
 // ../../packages/kk-core/src/manifest.ts
 init_zod();
 var OperationIOSchema = exports_external.enum(["doc-list", "markdown"]);
-var PluginManifestSchema = exports_external.object({
+var PluginOperationSchema = exports_external.object({ input: OperationIOSchema, output: OperationIOSchema });
+var PluginManifestSchema = exports_external.looseObject({
   name: exports_external.string().min(1),
   kind: PluginKindSchema,
   entry: exports_external.string().min(1),
   version: exports_external.string().optional(),
   description: exports_external.string().optional(),
-  operations: exports_external.record(exports_external.string(), exports_external.object({ input: OperationIOSchema, output: OperationIOSchema })).optional()
-}).passthrough();
+  operations: exports_external.record(exports_external.string(), PluginOperationSchema).optional()
+});
 // ../../node_modules/.bun/@gobing-ai+ts-runtime@0.4.39/node_modules/@gobing-ai/ts-runtime/dist/index.js
 init_file_system_node();
 init_config();