@oh-my-pi/pi-ai 16.3.0 → 16.3.3

package/src/providers/anthropic.ts

@@ -329,15 +329,26 @@ const ANTHROPIC_PROVIDER_SESSION_STATE_KEY = "anthropic-messages";
 type AnthropicProviderSessionState = ProviderSessionState & {
 	strictToolsDisabled: boolean;
 	fastModeDisabled: boolean;
+	/**
+	 * Runtime-learned: this endpoint returned `400 Invalid signature in
+	 * thinking block` for a replayed unsigned thinking block, so it must be
+	 * treated as a signing proxy from now on. All subsequent requests demote
+	 * unsigned thinking to text for this (baseUrl, modelId), same behavior as
+	 * an explicit `compat.replayUnsignedThinking: false`. Cleared on session
+	 * close.
+	 */
+	replayUnsignedThinkingDisabled: boolean;
 };
 
 function createAnthropicProviderSessionState(): AnthropicProviderSessionState {
 	const state: AnthropicProviderSessionState = {
 		strictToolsDisabled: false,
 		fastModeDisabled: false,
+		replayUnsignedThinkingDisabled: false,
 		close: () => {
 			state.strictToolsDisabled = false;
 			state.fastModeDisabled = false;
+			state.replayUnsignedThinkingDisabled = false;
 		},
 	};
 	return state;
@@ -1644,6 +1655,32 @@ function calculateFallbackTurnCost(
 	return true;
 }
 
+/**
+ * Detects the Anthropic `400 Invalid `signature` in `thinking` block` failure
+ * a signing proxy returns when a stripped/unsigned prior thinking block is
+ * replayed as `signature: ""`. Exported for the compat tests.
+ */
+const INVALID_THINKING_SIGNATURE_PATTERN = /invalid\s+`?signature`?\s+in\s+`?thinking`?(?:\s+block)?/i;
+export function isInvalidThinkingSignatureError(message: string): boolean {
+	return INVALID_THINKING_SIGNATURE_PATTERN.test(message);
+}
+
+/**
+ * Prepend a pointed remediation to Anthropic's `Invalid signature in thinking
+ * block` 400 when the model looks like an unmarked custom signing proxy
+ * (opaque baseUrl, `spec.reasoning: true`, no explicit
+ * `compat.replayUnsignedThinking` override). The default is native replay for
+ * the 3p reasoning majority (#2005); this hint turns the misconfigured-proxy
+ * case into a one-line fix instead of a silent retry loop (#4297).
+ */
+export function maybeAddReplayUnsignedThinkingHint(model: Model<"anthropic-messages">, message: string): string {
+	if (!isInvalidThinkingSignatureError(message)) return message;
+	if (model.compat.officialEndpoint) return message;
+	if (model.compatConfig?.replayUnsignedThinking !== undefined) return message;
+	const hint = `Provider "${model.provider}" looks like an Anthropic-compatible signing proxy: it rejected a replayed unsigned thinking block. Set \`compat.replayUnsignedThinking: false\` under \`providers.${model.provider}\` in your models.yml and retry. See https://github.com/can1357/oh-my-pi/issues/4297.`;
+	return `${hint}\n\n${message}`;
+}
+
 const streamAnthropicOnce = (
 	model: Model<"anthropic-messages">,
 	context: Context,
@@ -1698,6 +1735,7 @@ const streamAnthropicOnce = (
 			let disableStrictTools =
 				(providerSessionState?.strictToolsDisabled ?? false) || (model.compat?.disableStrictTools ?? false);
 			let dropFastMode = providerSessionState?.fastModeDisabled ?? false;
+			let forceDemoteUnsignedThinking = providerSessionState?.replayUnsignedThinkingDisabled ?? false;
 			const mergedCallerHeaders = mergeHeaders(model.headers, options?.headers);
 			const umansGatewayWebSearchHeader = getUmansWebSearchHeader(model, mergedCallerHeaders);
 
@@ -1808,6 +1846,7 @@ const streamAnthropicOnce = (
 					options,
 					disableStrictTools,
 					umansGatewayWebSearchHeader !== undefined,
+					forceDemoteUnsignedThinking,
 				);
 				if (disableStrictTools) {
 					dropAnthropicStrictTools(nextParams);
@@ -2377,6 +2416,39 @@ const streamAnthropicOnce = (
 						firstTokenTime = undefined;
 						continue;
 					}
+					if (
+						!forceDemoteUnsignedThinking &&
+						firstTokenTime === undefined &&
+						!streamedReplayUnsafeContent &&
+						isInvalidThinkingSignatureError(
+							streamFailure instanceof Error ? streamFailure.message : String(streamFailure),
+						)
+					) {
+						logger.warn(
+							"anthropic: signing proxy detected (Invalid signature in thinking block), demoting unsigned thinking and retrying",
+							{
+								provider: model.provider,
+								model: model.id,
+								baseUrl,
+								error: streamFailure instanceof Error ? streamFailure.message : String(streamFailure),
+							},
+						);
+						if (providerSessionState) {
+							providerSessionState.replayUnsignedThinkingDisabled = true;
+						}
+						forceDemoteUnsignedThinking = true;
+						params = await prepareParams();
+						providerRetryAttempt = 0;
+						output.content.length = 0;
+						output.model = model.id;
+						output.responseId = undefined;
+						output.errorMessage = undefined;
+						output.providerPayload = undefined;
+						output.usage = createEmptyUsage(copilotDynamicHeaders?.premiumRequests);
+						output.stopReason = "stop";
+						firstTokenTime = undefined;
+						continue;
+					}
 					if (
 						!dropFastMode &&
 						model.provider === "anthropic" &&
@@ -2453,6 +2525,9 @@ const streamAnthropicOnce = (
 			if (dropFastMode && model.provider === "anthropic" && options?.serviceTier === "priority") {
 				output.disabledFeatures = [...(output.disabledFeatures ?? []), "priority"];
 			}
+			if (forceDemoteUnsignedThinking && model.compat.replayUnsignedThinking) {
+				output.disabledFeatures = [...(output.disabledFeatures ?? []), "unsigned-thinking-replay"];
+			}
 			stream.push({ type: "done", reason: output.stopReason, message: output });
 			stream.end();
 		} catch (error) {
@@ -2468,7 +2543,7 @@ const streamAnthropicOnce = (
 			output.stopReason = result.stopReason;
 			output.errorStatus = result.status;
 			output.errorId = result.id;
-			output.errorMessage = result.message;
+			output.errorMessage = maybeAddReplayUnsignedThinkingHint(model, result.message);
 			output.duration = performance.now() - startTime;
 			if (firstTokenTime) output.ttft = firstTokenTime - startTime;
 			stream.push({ type: "error", reason: output.stopReason, error: output });
@@ -3025,7 +3100,16 @@ function buildParams(
 	options?: AnthropicOptions,
 	disableStrictTools = false,
 	useUmansGatewayWebSearch = false,
+	forceDemoteUnsignedThinking = false,
 ): MessageCreateParamsStreaming {
+	// A session-scoped auto-demote (learned from a live signing 400) clones the
+	// resolved compat with `replayUnsignedThinking: false` so every subsequent
+	// downstream read (convertAnthropicMessages, transformMessages) sees the
+	// demoted default without mutating the shared `model` reference.
+	const effectiveModel =
+		forceDemoteUnsignedThinking && model.compat.replayUnsignedThinking
+			? { ...model, compat: { ...model.compat, replayUnsignedThinking: false } }
+			: model;
 	const { cacheControl } = getCacheControl(model, options?.cacheRetention, isOAuthToken);
 
 	// Pre-compute system blocks so they occupy the right slot in the serialized body.
@@ -3151,7 +3235,7 @@ function buildParams(
 	// metadata → max_tokens → thinking → context_management → output_config → stream.
 	const params: MessageCreateParamsStreaming = {
 		model: options?.requestModelId ?? model.requestModelId ?? model.id,
-		messages: convertAnthropicMessages(context.messages, model, isOAuthToken, {
+		messages: convertAnthropicMessages(context.messages, effectiveModel, isOAuthToken, {
 			serverSideFallbackEnabled: !!options?.fallbacks?.length,
 		}),
 		...(systemBlocks && { system: systemBlocks }),

package/src/providers/azure-openai-responses.ts

@@ -376,7 +376,7 @@ function buildParams(
 		}
 	}
 
-	applyResponsesReasoningParams(params, model, options, messages);
+	applyResponsesReasoningParams(params, model, options);
 
 	return params;
 }

package/src/providers/cursor.ts

@@ -133,6 +133,7 @@ import type {
 import { normalizeSystemPrompts } from "../utils";
 import {
 	clearStreamingPartialJson,
+	kCursorExecResolved,
 	kStreamingBlockIndex,
 	kStreamingBlockKind,
 	kStreamingLastParseLen,
@@ -147,6 +148,8 @@ import { toolWireSchema } from "../utils/schema/wire";
 export const CURSOR_API_URL = "https://api2.cursor.sh";
 export const CURSOR_CLIENT_VERSION = "cli-2026.01.09-231024f";
 
+const CURSOR_PROXY_TUNNEL_TIMEOUT_MS = 30_000;
+
 const conversationStateCache = new Map<string, ConversationStateStructure>();
 const conversationBlobStores = new Map<string, Map<string, Uint8Array>>();
 
@@ -392,7 +395,10 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 
 			const proxyUrl = shouldBypassProxy(new URL(baseUrl)) ? undefined : getProxyForProvider(model.provider);
 			if (proxyUrl) {
-				const tlsSocket = await connectProxiedSocket(proxyUrl, baseUrl);
+				const tlsSocket = await connectProxiedSocket(proxyUrl, baseUrl, {
+					signal: options?.signal,
+					timeoutMs: CURSOR_PROXY_TUNNEL_TIMEOUT_MS,
+				});
 				h2Client = http2.connect(baseUrl, {
 					createConnection: () => tlsSocket,
 				});
@@ -628,7 +634,8 @@ export type ToolCallState = ToolCall & {
 	[kStreamingBlockIndex]: number;
 	[kStreamingPartialJson]?: string;
 	[kStreamingLastParseLen]?: number;
-	[kStreamingBlockKind]: "mcp" | "todo";
+	[kStreamingBlockKind]: "mcp" | "todo" | "cursor-exec";
+	[kCursorExecResolved]?: true;
 };
 
 export interface BlockState {
@@ -674,6 +681,9 @@ async function handleServerMessage(
 			execHandlers,
 			onToolResult,
 			requestContextTools,
+			output,
+			stream,
+			state,
 		);
 	} else if (msgCase === "conversationCheckpointUpdate") {
 		handleConversationCheckpointUpdate(msg.message.value, output, usageState, onConversationCheckpoint);
@@ -1030,6 +1040,9 @@ async function handleExecServerMessage(
 	execHandlers: CursorExecHandlers | undefined,
 	onToolResult: CursorToolResultHandler | undefined,
 	requestContextTools: McpToolDefinition[],
+	output: AssistantMessage,
+	stream: AssistantMessageEventStream,
+	state: BlockState,
 ): Promise<void> {
 	const execCase = execMsg.message.case;
 	log("exec", "dispatch", { execCase, execId: execMsg.execId, hasHandlers: !!execHandlers });
@@ -1064,6 +1077,8 @@ async function handleExecServerMessage(
 	switch (execCase) {
 		case "readArgs": {
 			const args = execMsg.message.value;
+			if (!args.toolCallId) args.toolCallId = crypto.randomUUID();
+			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "read", { path: args.path });
 			const { execResult } = await resolveExecHandler(
 				args,
 				execHandlers?.read?.bind(execHandlers),
@@ -1077,6 +1092,11 @@ async function handleExecServerMessage(
 		}
 		case "lsArgs": {
 			const args = execMsg.message.value;
+			if (!args.toolCallId) args.toolCallId = crypto.randomUUID();
+			// Bridge maps `ls` onto the coding-agent `read` tool (see
+			// `CursorExecHandlers.ls` in `pi-coding-agent/src/cursor.ts`); mirror
+			// that here so the synthesized block matches the toolResult's `toolName`.
+			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "read", { path: args.path });
 			const { execResult } = await resolveExecHandler(
 				args,
 				execHandlers?.ls?.bind(execHandlers),
@@ -1090,6 +1110,16 @@ async function handleExecServerMessage(
 		}
 		case "grepArgs": {
 			const args = execMsg.message.value;
+			if (!args.toolCallId) args.toolCallId = crypto.randomUUID();
+			// Mirror the coding-agent bridge's arg mapping so live UI (from
+			// `tool_execution_start`) and rebuilt transcript (from this block)
+			// display identical args.
+			const searchPath = args.glob ? `${args.path || "."}/${args.glob}` : args.path || ".";
+			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "grep", {
+				pattern: args.pattern,
+				path: searchPath,
+				case: args.caseInsensitive === true ? false : undefined,
+			});
 			const { execResult } = await resolveExecHandler(
 				args,
 				execHandlers?.grep?.bind(execHandlers),
@@ -1103,6 +1133,13 @@ async function handleExecServerMessage(
 		}
 		case "writeArgs": {
 			const args = execMsg.message.value;
+			if (!args.toolCallId) args.toolCallId = crypto.randomUUID();
+			// Match the bridge: prefer `fileText`, fall back to decoded `fileBytes`.
+			const content = args.fileText ?? new TextDecoder().decode(args.fileBytes ?? new Uint8Array());
+			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "write", {
+				path: args.path,
+				content,
+			});
 			const { execResult } = await resolveExecHandler(
 				args,
 				execHandlers?.write?.bind(execHandlers),
@@ -1125,6 +1162,8 @@ async function handleExecServerMessage(
 		}
 		case "deleteArgs": {
 			const args = execMsg.message.value;
+			if (!args.toolCallId) args.toolCallId = crypto.randomUUID();
+			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "delete", { path: args.path });
 			const { execResult } = await resolveExecHandler(
 				args,
 				execHandlers?.delete?.bind(execHandlers),
@@ -1138,7 +1177,16 @@ async function handleExecServerMessage(
 		}
 		case "shellArgs": {
 			const args = execMsg.message.value;
+			if (!args.toolCallId) args.toolCallId = crypto.randomUUID();
 			const normalizedArgs: ShellArgs = { ...args, workingDirectory: args.workingDirectory || process.cwd() };
+			// Match the bridge (`CursorExecHandlers.shell`): map `workingDirectory`
+			// → `cwd`, drop non-positive timeouts.
+			const shellTimeout = args.timeout && args.timeout > 0 ? args.timeout : undefined;
+			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "bash", {
+				command: args.command,
+				cwd: args.workingDirectory || undefined,
+				timeout: shellTimeout,
+			});
 			const { execResult } = await resolveExecHandler(
 				args,
 				execHandlers?.shell?.bind(execHandlers),
@@ -1153,6 +1201,13 @@ async function handleExecServerMessage(
 		}
 		case "shellStreamArgs": {
 			const args = execMsg.message.value;
+			if (!args.toolCallId) args.toolCallId = crypto.randomUUID();
+			const shellStreamTimeout = args.timeout && args.timeout > 0 ? args.timeout : undefined;
+			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "bash", {
+				command: args.command,
+				cwd: args.workingDirectory || undefined,
+				timeout: shellStreamTimeout,
+			});
 			await handleShellStreamArgs(args, execMsg, h2Request, execHandlers, onToolResult);
 			return;
 		}
@@ -1200,6 +1255,13 @@ async function handleExecServerMessage(
 		}
 		case "diagnosticsArgs": {
 			const args = execMsg.message.value;
+			if (!args.toolCallId) args.toolCallId = crypto.randomUUID();
+			// Bridge maps `diagnostics` onto the coding-agent `lsp` tool with
+			// `action: "diagnostics"` and `file: path`.
+			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "lsp", {
+				action: "diagnostics",
+				file: args.path,
+			});
 			const { execResult } = await resolveExecHandler(
 				args,
 				execHandlers?.diagnostics?.bind(execHandlers),
@@ -2016,6 +2078,50 @@ function endCurrentThinkingBlock(
 	state.setThinkingBlock(null);
 }
 
+/**
+ * Synthesize a completed `toolCall` content block for a Cursor exec-channel
+ * native tool (`shell`, `read`, `write`, `grep`, `ls`, `delete`, `diagnostics`).
+ *
+ * Args arrive complete on the exec message, so the block opens and closes in
+ * one step — no partial-JSON streaming path. Without this the persisted
+ * assistant message carries only text/thinking blocks, and on replay the
+ * following `toolResult` messages have no matching `toolCall.id` in
+ * `renderSessionContext`, so they render as header-less `⎿` lines beneath the
+ * last text block instead of proper tool components (issue #4348).
+ *
+ * The block is stamped with {@link kCursorExecResolved} so the shared
+ * `agent-loop.ts` execution pass skips it — Cursor's server-driven exec
+ * channel already ran the tool via the bridge and buffered the result, so
+ * treating this block as runnable would re-execute the same side-effecting
+ * tool a second time.
+ *
+ * Exported for tests to exercise ordering with adjacent text/thinking blocks.
+ */
+export function synthesizeCursorExecToolCall(
+	output: AssistantMessage,
+	stream: AssistantMessageEventStream,
+	state: BlockState,
+	toolCallId: string,
+	toolName: string,
+	args: Record<string, unknown>,
+): void {
+	endCurrentTextBlock(output, stream, state);
+	endCurrentThinkingBlock(output, stream, state);
+	const block: ToolCallState = {
+		type: "toolCall",
+		id: toolCallId,
+		name: toolName,
+		arguments: args,
+		[kStreamingBlockIndex]: output.content.length,
+		[kStreamingBlockKind]: "cursor-exec",
+		[kCursorExecResolved]: true,
+	};
+	output.content.push(block);
+	const idx = output.content.length - 1;
+	stream.push({ type: "toolcall_start", contentIndex: idx, partial: output });
+	stream.push({ type: "toolcall_end", contentIndex: idx, toolCall: block, partial: output });
+}
+
 /** Exported for tests: drives one Cursor interaction update through the streaming state machine. */
 export function processInteractionUpdate(
 	update: any,

package/src/providers/devin.ts

@@ -69,6 +69,15 @@ const DEVIN_DEFAULT_STOP_PATTERNS = ["<|user|>", "<|bot|>", "<|context_request|>
 /** Connect streaming framing: flag byte bit 0x01 = gzip payload, 0x02 = end-of-stream JSON trailers. */
 const CONNECT_COMPRESSED_FLAG = 0x01;
 const CONNECT_END_STREAM_FLAG = 0x02;
+/**
+ * Hard upper bound on a single Connect frame payload. The 4-byte length prefix
+ * is otherwise attacker-controlled (up to `2**32 - 1`), so a malicious or buggy
+ * peer could force {@link streamDevin}'s reader to buffer gigabytes via
+ * `Buffer.concat` before the idle-timeout wrapper aborts. Well above any
+ * legitimate Cascade response but tight enough that a corrupt length prefix
+ * fails fast instead of consuming memory.
+ */
+const MAX_CONNECT_FRAME_PAYLOAD = 16 * 1024 * 1024;
 
 export const streamDevin: StreamFunction<"devin-agent"> = (
 	model: Model<"devin-agent">,
@@ -201,6 +210,12 @@ export const streamDevin: StreamFunction<"devin-agent"> = (
 				while (pending.length >= 5) {
 					const flag = pending[0];
 					const len = pending.readUInt32BE(1);
+					if (len > MAX_CONNECT_FRAME_PAYLOAD) {
+						throw new AIError.ProviderResponseError(
+							`Devin Connect frame length ${len} exceeds ${MAX_CONNECT_FRAME_PAYLOAD}-byte cap`,
+							{ provider: model.provider, kind: "envelope" },
+						);
+					}
 					if (pending.length < 5 + len) break;
 					const payload = pending.subarray(5, 5 + len);
 					pending = pending.subarray(5 + len);

package/src/providers/gitlab-duo-workflow.ts

@@ -47,6 +47,20 @@ const GITLAB_DUO_WORKFLOW_CLIENT_TYPE = "node-websocket";
  * run reconnects once on the same `workflowID` (server-side resume).
  */
 const GITLAB_DUO_WORKFLOW_IDLE_TIMEOUT_MS = 90_000;
+/**
+ * Absolute deadline (ms) for each REST setup fetch (`ensureGitLabDuoWorkflowSettings`,
+ * `discoverGitLabDuoWorkflowProject`, `resolveGitLabDuoWorkflowNumericProjectId`,
+ * `requestGitLabDuoWorkflowDirectAccess`, `createGitLabDuoWorkflow`,
+ * `fetchGitLabDuoWorkflowAvailableModels`, `stopGitLabDuoWorkflow`).
+ *
+ * `streamGitLabDuoWorkflow` pushes its `start` event before these calls run and the
+ * `gitlab-duo-agent` bypass in `streamSimple` skips the `register-builtins`
+ * `iterateWithIdleTimeout` wrapper, so a stalled setup fetch would otherwise leave
+ * the stream with no terminal event. 30s covers healthy p99 for every REST endpoint
+ * the workflow touches while still surfacing a real stall as a provider error;
+ * matches the OAuth `TOKEN_REQUEST_TIMEOUT_MS` used by sibling GitLab flows.
+ */
+const GITLAB_DUO_WORKFLOW_REST_TIMEOUT_MS = 30_000;
 /**
  * How many times a single stream may restart on a FRESH workflow after the server
  * reports its per-workflow step (graph-recursion) limit. Long OMP tool-call loops
@@ -913,6 +927,19 @@ export function gitLabDuoWorkflowErrorText(error: unknown): string {
 	return error instanceof Error ? error.message : String(error);
 }
 
+// Absolute-deadline signal for one REST setup fetch (`fetch`, `direct_access`, etc.).
+// The caller's abort signal — when present — is folded in with `AbortSignal.any`, so
+// either the request being cancelled OR the local timeout aborts the fetch. Called
+// per-fetch so each REST call gets its OWN fresh budget; a shared timeout would race
+// several fetches on the same clock and starve the later ones after the first spent
+// the whole budget. The workflow's `start` event already streamed before any of
+// these calls run, so an unbounded fetch would leave the assistant stream with no
+// terminal event — see {@link GITLAB_DUO_WORKFLOW_REST_TIMEOUT_MS}.
+function gitLabDuoWorkflowRestSignal(callerSignal?: AbortSignal): AbortSignal {
+	const timeoutSignal = AbortSignal.timeout(GITLAB_DUO_WORKFLOW_REST_TIMEOUT_MS);
+	return callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;
+}
+
 async function readGitLabDuoWorkflowResponseErrorMessage(response: Response): Promise<string | undefined> {
 	try {
 		const payload: unknown = await response.json();
@@ -1074,7 +1101,7 @@ async function runGitLabDuoWorkflow(
 			// success or 4xx). A transient network error / 5xx returns false so a later
 			// turn retries instead of permanently skipping the PUT on a namespace whose
 			// flags are still off.
-			if (await ensureGitLabDuoWorkflowSettings(fetchImpl, baseUrl, apiKey, restNamespaceId)) {
+			if (await ensureGitLabDuoWorkflowSettings(fetchImpl, baseUrl, apiKey, restNamespaceId, options.signal)) {
 				markGitLabDuoWorkflowSettingsEnsured(apiKey, baseUrl, options.cwd);
 			}
 		}
@@ -1089,7 +1116,7 @@ async function runGitLabDuoWorkflow(
 			!configuredProjectPath && !configuredProjectId && isGitLabDuoWorkflowInlineFlow(workflowDefinition)
 				? namespaceSelection.projectPath
 					? { path: namespaceSelection.projectPath }
-					: await discoverGitLabDuoWorkflowProject(fetchImpl, baseUrl, apiKey, restNamespaceId)
+					: await discoverGitLabDuoWorkflowProject(fetchImpl, baseUrl, apiKey, restNamespaceId, options.signal)
 				: undefined;
 		if (discoveredProject) {
 			traceGitLabDuoWorkflow("project.discover", {
@@ -1111,7 +1138,7 @@ async function runGitLabDuoWorkflow(
 		const webSocketProjectId =
 			projectId ??
 			(projectPath
-				? await resolveGitLabDuoWorkflowNumericProjectId(fetchImpl, baseUrl, apiKey, projectPath)
+				? await resolveGitLabDuoWorkflowNumericProjectId(fetchImpl, baseUrl, apiKey, projectPath, options.signal)
 				: undefined);
 		const workflowConnection: GitLabDuoWorkflowDirectAccessConnection = options.workflowToken
 			? { token: options.workflowToken, headers: {}, serviceEndpoint: false }
@@ -1122,6 +1149,7 @@ async function runGitLabDuoWorkflow(
 					rootNamespaceId,
 					restProjectId,
 					workflowDefinition,
+					options.signal,
 				);
 		const workflowId =
 			options.workflowId ??
@@ -1135,7 +1163,13 @@ async function runGitLabDuoWorkflow(
 				workflowDefinition,
 				options.signal,
 			));
-		const availableModels = await fetchGitLabDuoWorkflowAvailableModels(fetchImpl, baseUrl, apiKey, rootNamespaceId);
+		const availableModels = await fetchGitLabDuoWorkflowAvailableModels(
+			fetchImpl,
+			baseUrl,
+			apiKey,
+			rootNamespaceId,
+			options.signal,
+		);
 		const selectedModelIdentifier = selectGitLabDuoWorkflowModelRef(model.id, availableModels);
 		// A `toolChoice: "none"` side-request (e.g. handoff keeps live tool definitions
 		// in the cache prefix but disables tool use) must not advertise the tools to
@@ -1466,6 +1500,7 @@ async function fetchGitLabDuoWorkflowAvailableModels(
 	baseUrl: string,
 	apiKey: string,
 	rootNamespaceId: string,
+	signal?: AbortSignal,
 ): Promise<GitLabAvailableModelsPayload | undefined> {
 	try {
 		const response = await fetchImpl(gitLabApiUrl(baseUrl, "/api/graphql"), {
@@ -1478,12 +1513,16 @@ async function fetchGitLabDuoWorkflowAvailableModels(
 				query: GITLAB_DUO_WORKFLOW_AVAILABLE_MODELS_QUERY,
 				variables: { rootNamespaceId: toGitLabGraphQLNamespaceId(rootNamespaceId) },
 			}),
+			signal: gitLabDuoWorkflowRestSignal(signal),
 		});
 		if (!response.ok) return undefined;
 		const payload: unknown = await response.json();
 		const models = getRecord(getRecord(payload, "data"), "aiChatAvailableModels");
 		return parseGitLabAvailableModelsPayload(models);
 	} catch {
+		// Timeout (AbortSignal.timeout) surfaces as an AbortError here; matches the pre-fix
+		// transient-network behavior (undefined -> caller falls back to defaults), so a
+		// stalled models fetch degrades rather than hanging the whole stream.
 		return undefined;
 	}
 }
@@ -1513,6 +1552,7 @@ async function resolveGitLabDuoWorkflowNumericProjectId(
 	baseUrl: string,
 	apiKey: string,
 	projectPath: string,
+	signal?: AbortSignal,
 ): Promise<string | undefined> {
 	try {
 		const response = await fetchImpl(gitLabApiUrl(baseUrl, `/api/v4/projects/${encodeURIComponent(projectPath)}`), {
@@ -1521,11 +1561,15 @@ async function resolveGitLabDuoWorkflowNumericProjectId(
 				Authorization: `Bearer ${apiKey}`,
 				"content-type": "application/json",
 			},
+			signal: gitLabDuoWorkflowRestSignal(signal),
 		});
 		if (!response.ok) return undefined;
 		const payload: unknown = await response.json();
 		return getRecordString(payload, "id");
 	} catch {
+		// Timeout / abort behaves like a transient network fault: undefined leaves the
+		// caller to fall back to the workflow's namespace-only routing rather than block
+		// the stream on a hanging project lookup.
 		return undefined;
 	}
 }
@@ -1549,6 +1593,7 @@ async function discoverGitLabDuoWorkflowProject(
 	baseUrl: string,
 	apiKey: string,
 	restNamespaceId: string,
+	signal?: AbortSignal,
 ): Promise<GitLabDuoWorkflowDiscoveredProject | undefined> {
 	const query = "per_page=1&min_access_level=30&order_by=last_activity_at&sort=desc";
 	const endpoints = [
@@ -1563,6 +1608,7 @@ async function discoverGitLabDuoWorkflowProject(
 					Authorization: `Bearer ${apiKey}`,
 					"content-type": "application/json",
 				},
+				signal: gitLabDuoWorkflowRestSignal(signal),
 			});
 			if (!response.ok) continue;
 			const payload: unknown = await response.json();
@@ -1570,7 +1616,10 @@ async function discoverGitLabDuoWorkflowProject(
 			const id = getRecordString(first, "id");
 			const path = getRecordString(first, "path_with_namespace");
 			if (id && path) return { id, path };
-		} catch {}
+		} catch {
+			// Timeout/abort on one endpoint: fall through to the next fallback rather than
+			// aborting discovery. Each endpoint gets its own fresh REST budget.
+		}
 	}
 	return undefined;
 }
@@ -1582,7 +1631,12 @@ async function requestGitLabDuoWorkflowDirectAccess(
 	rootNamespaceId: string,
 	projectId?: string,
 	workflowDefinition: GitLabDuoWorkflowDefinition = GITLAB_DUO_WORKFLOW_DEFINITION,
+	signal?: AbortSignal,
 ): Promise<GitLabDuoWorkflowDirectAccessConnection> {
+	// A timeout here throws `AbortError`/`TimeoutError` (per `AbortSignal.timeout`),
+	// which surfaces through the outer `streamGitLabDuoWorkflow` catch as a real
+	// stream `error` event — matching the existing HTTP-error path rather than the
+	// swallowed best-effort helpers (settings ensure / project discovery / models).
 	const response = await fetchImpl(gitLabApiUrl(baseUrl, "/api/v4/ai/duo_workflows/direct_access"), {
 		method: "POST",
 		headers: {
@@ -1590,6 +1644,7 @@ async function requestGitLabDuoWorkflowDirectAccess(
 			"content-type": "application/json",
 		},
 		body: JSON.stringify(buildGitLabDuoWorkflowDirectAccessBody(rootNamespaceId, projectId, workflowDefinition)),
+		signal: gitLabDuoWorkflowRestSignal(signal),
 	});
 	traceGitLabDuoWorkflow("direct_access.response", {
 		status: response.status,
@@ -1654,7 +1709,7 @@ async function createGitLabDuoWorkflow(
 			"content-type": "application/json",
 		},
 		body: JSON.stringify(body),
-		signal,
+		signal: gitLabDuoWorkflowRestSignal(signal),
 	});
 	traceGitLabDuoWorkflow("workflow.create.response", {
 		status: response.status,
@@ -1686,14 +1741,30 @@ async function stopGitLabDuoWorkflow(
 	apiKey: string,
 	workflowId: string,
 ): Promise<void> {
-	await fetchImpl(gitLabApiUrl(baseUrl, `/api/v4/ai/duo_workflows/workflows/${encodeURIComponent(workflowId)}`), {
-		method: "PATCH",
-		headers: {
-			Authorization: `Bearer ${apiKey}`,
-			"content-type": "application/json",
-		},
-		body: JSON.stringify(buildGitLabDuoWorkflowStopBody()),
-	});
+	// Stop rides a FRESH timeout signal, deliberately decoupled from `options.signal`
+	// (see the `finally` block in `runGitLabDuoWorkflow`): a run cancelled by the
+	// caller must still fire the server-side stop, but a stalled PATCH here would
+	// otherwise leave the `runGitLabDuoWorkflow` promise unresolved forever — the
+	// bounded budget keeps cleanup best-effort in both directions.
+	try {
+		await fetchImpl(gitLabApiUrl(baseUrl, `/api/v4/ai/duo_workflows/workflows/${encodeURIComponent(workflowId)}`), {
+			method: "PATCH",
+			headers: {
+				Authorization: `Bearer ${apiKey}`,
+				"content-type": "application/json",
+			},
+			body: JSON.stringify(buildGitLabDuoWorkflowStopBody()),
+			signal: gitLabDuoWorkflowRestSignal(),
+		});
+	} catch (error) {
+		// Server-side stop is best-effort: a timeout / network fault must not reject
+		// the caller (the local stream already emitted its terminal event). Trace and
+		// swallow so the enclosing `finally` never surfaces a spurious rejection.
+		traceGitLabDuoWorkflow("workflow.stop_error", {
+			workflowId,
+			error: gitLabDuoWorkflowErrorText(error),
+		});
+	}
 }
 
 // Body the group PUT carries to turn on exactly the three flags the inline MCP-only
@@ -1721,6 +1792,7 @@ async function ensureGitLabDuoWorkflowSettings(
 	baseUrl: string,
 	apiKey: string,
 	restNamespaceId: string,
+	signal?: AbortSignal,
 ): Promise<boolean> {
 	// Returns whether the attempt was DEFINITIVE (so the caller may stop retrying):
 	// any HTTP response — 2xx (flags now on) or 4xx (insufficient rights / no such
@@ -1735,6 +1807,7 @@ async function ensureGitLabDuoWorkflowSettings(
 				"content-type": "application/json",
 			},
 			body: JSON.stringify(buildGitLabDuoWorkflowSettingsBody()),
+			signal: gitLabDuoWorkflowRestSignal(signal),
 		});
 		traceGitLabDuoWorkflow("settings.ensure", { status: response.status, ok: response.ok });
 		return response.status < 500;