@officexapp/vidfarm-devcli 0.21.36 → 0.21.37

package/dist/src/devcli/local-frontend-server.js

@@ -235,6 +235,24 @@ function serveAsset(res, pathname) {
     return true;
 }
 // ── reverse proxy to the cloud host ─────────────────────────────────────────
+/** How long to wait for upstream RESPONSE HEADERS before giving up (504). */
+const PROXY_HEADERS_TIMEOUT_MS = 30_000;
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Stream a finished render file. Same rule as the proxy pipe: a disk read
+ *  error (file deleted mid-download, bad sector) must fail THIS response, not
+ *  raise an uncaught 'error' that takes the whole serve process down. */
+function pipeFile(res, filePath) {
+    const stream = createReadStream(filePath);
+    stream.on("error", (error) => {
+        console.warn(`[vidfarm] serve: could not stream ${filePath} (${errorText(error)})`);
+        res.destroy();
+    });
+    res.on("close", () => stream.destroy());
+    res.on("error", () => stream.destroy());
+    stream.pipe(res);
+}
 // Hop-by-hop headers are stripped so we forward a clean request/response.
 const HOP_BY_HOP = new Set([
     "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
@@ -267,15 +285,40 @@ async function proxyToCloud(req, res, host, pathWithSearch, auth, bodyOverride)
     const method = req.method ?? "GET";
     const body = method === "GET" || method === "HEAD" ? undefined : (bodyOverride ?? await readBody(req));
     let upstream;
+    // Bound the wait for RESPONSE HEADERS only. A cloud route that never answers
+    // used to hang the browser forever with no error — the page shell paints from
+    // disk, then a data call spins for good. The BODY stays unbounded on purpose:
+    // proxied SSE (/api/v1/editor-chat) and media downloads are long-lived by
+    // design, so a body deadline would cut healthy streams.
+    const headersAbort = new AbortController();
+    const headersTimer = setTimeout(() => headersAbort.abort(), PROXY_HEADERS_TIMEOUT_MS);
     try {
-        upstream = await fetch(target, { method, headers, body: body, redirect: "manual" });
+        upstream = await fetch(target, {
+            method,
+            headers,
+            body: body,
+            redirect: "manual",
+            signal: headersAbort.signal
+        });
     }
     catch (error) {
-        res.statusCode = 502;
+        const timedOut = headersAbort.signal.aborted;
+        res.statusCode = timedOut ? 504 : 502;
         res.setHeader("content-type", "application/json");
-        res.end(JSON.stringify({ error: "upstream_unreachable", detail: error instanceof Error ? error.message : String(error), host }));
+        res.end(JSON.stringify({
+            error: timedOut ? "upstream_timeout" : "upstream_unreachable",
+            detail: timedOut
+                ? `${host} sent no response headers within ${PROXY_HEADERS_TIMEOUT_MS / 1000}s`
+                : error instanceof Error ? error.message : String(error),
+            host
+        }));
         return;
     }
+    finally {
+        // Headers are in (or the request failed) — from here the body streams for
+        // as long as it needs to.
+        clearTimeout(headersTimer);
+    }
     res.statusCode = upstream.status;
     upstream.headers.forEach((value, key) => {
         if (HOP_BY_HOP.has(key.toLowerCase()))
@@ -287,7 +330,30 @@ async function proxyToCloud(req, res, host, pathWithSearch, auth, bodyOverride)
     res.setHeader("x-vidfarm-upstream", host);
     if (upstream.body) {
         // Stream the response (covers SSE from /api/v1/editor-chat too).
-        Readable.fromWeb(upstream.body).pipe(res);
+        //
+        // An upstream body can break AFTER the headers arrive: a CloudFront/Lambda
+        // connection reset, or undici's own body timeout on a proxied stream that
+        // idles. That surfaces as an 'error' on this stream — and an UNHANDLED
+        // 'error' is an uncaught exception, which killed the entire serve process.
+        // The visible symptom was the reported one: the editor page paints, the
+        // server dies mid-load, and every remaining request hangs forever. So both
+        // ends of the pipe get error handling, and each end tears the other down.
+        const stream = Readable.fromWeb(upstream.body);
+        stream.on("error", (error) => {
+            console.warn(`[vidfarm] serve: upstream stream broke for ${pathWithSearch} (${errorText(error)})`);
+            // Headers are already on the wire, so there is no status left to send —
+            // cut the response so the browser reports a failed request instead of
+            // waiting on a body that will never arrive.
+            res.destroy();
+        });
+        // The browser navigating away or cancelling must not leave us pulling the
+        // upstream body forever.
+        res.on("close", () => stream.destroy());
+        res.on("error", (error) => {
+            console.warn(`[vidfarm] serve: client stream broke for ${pathWithSearch} (${errorText(error)})`);
+            stream.destroy();
+        });
+        stream.pipe(res);
     }
     else {
         res.end();
@@ -709,8 +775,28 @@ function renderLoginRequiredPage(pathname) {
 </html>
 `;
 }
+// Last-resort net. Every known stream path now handles its own errors, but a
+// local dev server must never disappear on a stray async throw — the user sees
+// only a page that stopped loading, with no clue the server is gone. Log it
+// loudly and stay up; this process is a stateless proxy plus a static file
+// server, so there is no shared state left corrupt by a failed request.
+let crashGuardInstalled = false;
+function installServeCrashGuard() {
+    if (crashGuardInstalled)
+        return;
+    crashGuardInstalled = true;
+    process.on("uncaughtException", (error) => {
+        console.error(`[vidfarm] serve: recovered from an uncaught error — ${errorText(error)}`);
+        if (error instanceof Error && error.stack)
+            console.error(error.stack);
+    });
+    process.on("unhandledRejection", (reason) => {
+        console.error(`[vidfarm] serve: recovered from an unhandled rejection — ${errorText(reason)}`);
+    });
+}
 export function startLocalFrontendServer(opts) {
     const host = opts.host.replace(/\/+$/, "");
+    installServeCrashGuard();
     const server = createServer((req, res) => {
         void handleRequest(req, res, host, opts.auth).catch((error) => {
             if (!res.headersSent) {
@@ -816,7 +902,7 @@ async function handleRequest(req, res, host, auth) {
         res.setHeader("content-type", "video/mp4");
         res.setHeader("content-length", String(statSync(record.outputPath).size));
         res.setHeader("content-disposition", `inline; filename="vidfarm-${path.basename(record.outputPath)}"`);
-        createReadStream(record.outputPath).pipe(res);
+        pipeFile(res, record.outputPath);
         return;
     }
     // 3b. Studio-contract render endpoints (the sealed StudioApp's Export
@@ -909,7 +995,7 @@ async function handleRequest(req, res, host, auth) {
             res.setHeader("content-type", STUDIO_RENDER_MIME[path.extname(job.outputPath)] ?? "video/mp4");
             res.setHeader("content-length", String(statSync(job.outputPath).size));
             res.setHeader("content-disposition", `inline; filename="${filename}"`);
-            createReadStream(job.outputPath).pipe(res);
+            pipeFile(res, job.outputPath);
             return;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@officexapp/vidfarm-devcli",
-  "version": "0.21.36",
+  "version": "0.21.37",
   "description": "Local bridge for the Vidfarm Trackpad Editor. `vidfarm serve <template_id>` boots the FULL editor on localhost (disk-backed records/storage, free in-process render); edit composition.html on disk (Claude Code, Codex, etc.) and the browser live-morphs it.",
   "type": "module",
   "bin": {