@sema-agent/server 5.8.0 → 5.9.0

package/dist/leader/diffup.js

@@ -15,6 +15,7 @@
  * pullDiff stays as the compat path for static (leader-owned) envs — M2 降兼容.
  */
 import { safeRev } from "./diffout.js";
+import { OBJECT_STORE_IO_TIMEOUT_MS } from "../plugins/blob-backend.js";
 const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
 /** The staged upload script. `repoDir`/`workDir` are deployment config; `baseSha` is interpolated into a
  *  shell line, so it is re-validated HERE (fail-closed) — callers should already have applied diffout's
@@ -52,7 +53,9 @@ export async function fetchUploadedDiff(getUrl, opts = {}) {
     const f = opts.fetchImpl ?? fetch;
     let res;
     try {
-        res = await f(getUrl);
+        // C6(2026-08-03):abort 上界(半开 MinIO 此前把 leader merge 阶段挂满 undici ~300s,钉死整个
+        // fanout)。maxBytes 检查仍在 text() 缓冲之后=已知残留(流式读上界另案),本修只收超时轴。
+        res = await f(getUrl, { signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
     }
     catch (e) {
         return { ok: false, error: `diff fetch failed: ${e instanceof Error ? e.message.replaceAll(getUrl, "<presigned-url>") : "network error"}` };

package/dist/plugins/blob-backend.d.ts

@@ -102,6 +102,11 @@ export interface MinioBlobBackendConfig {
  * under a hash it doesn't match) — treated as ABSENT (undefined), NEVER returning wrong bytes. This mirrors the
  * importManifest content-address check the SQL stores already do.
  */
+/** 鲁棒性批2 C2/C3/C6(2026-08-03):S3 兼容端点 IO 的统一 abort 上界(fleet-client C1 定常量形
+ *  先例)。半开端点此前各挂 undici 默认 ~300s headersTimeout——blob GET 钉死 restore/session-import
+ *  同步路径,SendUserFile 工具调用永不返回。120s 对慢链路 ~64MiB 单 PUT/GET 仍宽裕(presignTtlSec
+ *  注释同口径),远小于病形。send-user-file 与 leader/diffup 同 import 此常量。 */
+export declare const OBJECT_STORE_IO_TIMEOUT_MS = 120000;
 export declare class MinioBlobBackend implements BlobBackend {
     private readonly cfg;
     private readonly keyPrefix;

package/dist/plugins/blob-backend.js

@@ -222,6 +222,11 @@ async function sqlDeleteIndexRowsPastGrace(dialect, pool, hashes) {
  * under a hash it doesn't match) — treated as ABSENT (undefined), NEVER returning wrong bytes. This mirrors the
  * importManifest content-address check the SQL stores already do.
  */
+/** 鲁棒性批2 C2/C3/C6(2026-08-03):S3 兼容端点 IO 的统一 abort 上界(fleet-client C1 定常量形
+ *  先例)。半开端点此前各挂 undici 默认 ~300s headersTimeout——blob GET 钉死 restore/session-import
+ *  同步路径,SendUserFile 工具调用永不返回。120s 对慢链路 ~64MiB 单 PUT/GET 仍宽裕(presignTtlSec
+ *  注释同口径),远小于病形。send-user-file 与 leader/diffup 同 import 此常量。 */
+export const OBJECT_STORE_IO_TIMEOUT_MS = 120_000;
 export class MinioBlobBackend {
     cfg;
     keyPrefix;
@@ -268,7 +273,9 @@ export class MinioBlobBackend {
      *  catches a corrupted PUT at the next getBlob sha-check (fail-closed); the one-time migration script DOES read-back. */
     async putBlob(hash, bytes) {
         const url = this.presign(hash, "PUT");
-        const res = await fetch(url, { method: "PUT", body: bytes });
+        // C2(2026-08-03):走注入座(此前直用全局 fetch=测试桩接不进的站点)+ abort 上界(半开端点
+        // 此前挂 undici ~300s;120s 对慢链路大对象仍宽裕,presignTtlSec 注释同口径)。六站点同批。
+        const res = await (this.cfg.fetchImpl ?? fetch)(url, { method: "PUT", body: bytes, signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
         if (!res.ok) {
             const detail = await res.text().catch(() => "");
             throw new Error(`MinioBlobBackend.putBlob ${hash}: HTTP ${res.status} ${detail.slice(0, 200)}`);
@@ -295,7 +302,7 @@ export class MinioBlobBackend {
         const url = this.presign(hash, "GET");
         let res;
         try {
-            res = await fetch(url, { method: "GET" });
+            res = await (this.cfg.fetchImpl ?? fetch)(url, { method: "GET", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
         }
         catch (err) {
             throw new Error(`MinioBlobBackend.getBlob ${hash}: transient fetch failure: ${err.message}`);
@@ -323,7 +330,7 @@ export class MinioBlobBackend {
         const present = new Set();
         await mapBounded(distinct, MINIO_OP_CONCURRENCY, async (hash) => {
             try {
-                const res = await fetch(this.presign(hash, "HEAD"), { method: "HEAD" });
+                const res = await (this.cfg.fetchImpl ?? fetch)(this.presign(hash, "HEAD"), { method: "HEAD", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
                 if (res.ok)
                     present.add(hash);
             }
@@ -360,7 +367,7 @@ export class MinioBlobBackend {
                 ...(this.cfg.region ? { region: this.cfg.region } : {}),
                 expiresSec: this.ttl,
             });
-            const res = await f(url, { method: "GET" });
+            const res = await f(url, { method: "GET", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
             if (!res.ok)
                 throw new Error(`listObjects: MinIO ${res.status}`);
             const xml = await res.text();
@@ -384,7 +391,7 @@ export class MinioBlobBackend {
      *  put 会 PUT 同键 ⇒ 刷新 LastModified,所以「删前再 HEAD 一次」能看见「刚刚被重新引用」的对象。 */
     async headObject(hash) {
         const f = this.cfg.fetchImpl ?? fetch;
-        const res = await f(this.presign(hash, "HEAD"), { method: "HEAD" });
+        const res = await f(this.presign(hash, "HEAD"), { method: "HEAD", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
         if (!res.ok)
             return undefined;
         const lm = res.headers.get("last-modified");
@@ -417,7 +424,7 @@ export class MinioBlobBackend {
         let okCount = 0;
         await mapBounded(toDelete, MINIO_OP_CONCURRENCY, async (hash) => {
             try {
-                const res = await (this.cfg.fetchImpl ?? fetch)(this.presign(hash, "DELETE"), { method: "DELETE" });
+                const res = await (this.cfg.fetchImpl ?? fetch)(this.presign(hash, "DELETE"), { method: "DELETE", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
                 // 🔴 复审 F4:统计**真实**删除数——index-less(附件)分支此前恒返回入参长度,MinIO 完全不可写
                 // 时指标/日志照报「清理成功」。2xx/404(已不在)都算删成功;其余=失败,不计数。
                 if (res.ok || res.status === 404)

package/dist/plugins/send-user-file.d.ts

@@ -116,5 +116,7 @@ export declare function createSendUserFileIssuer(cfg: SendUserFileConfig, deps?:
     /** Injectable object delete (tests). Default = signed DELETE against the INTERNAL endpoint. */
     remove?: (bucket: string, key: string) => Promise<void>;
     now?: () => Date;
+    /** C3(2026-08-03)测试座:默认实现的六个 S3 fetch 站点走此座——signal 在场性自此可钉。 */
+    fetchImpl?: typeof fetch;
 }): SendUserFileIssuer;
 //# sourceMappingURL=send-user-file.d.ts.map

package/dist/plugins/send-user-file.js

@@ -26,6 +26,7 @@
 import { createHmac } from "node:crypto";
 import { uuidv7 } from "@sema-agent/core";
 import { presignS3CopyUrl, presignS3Url } from "./s3-presign.js";
+import { OBJECT_STORE_IO_TIMEOUT_MS } from "./blob-backend.js";
 /** SigV4 physical ceiling (AWS: X-Amz-Expires max 604800s = 7 days). */
 export const PRESIGN_MAX_TTL_SEC = 604_800;
 /**
@@ -80,6 +81,10 @@ export function sanitizeSendFileName(name) {
     return clean.length > 0 ? clean : "file";
 }
 export function createSendUserFileIssuer(cfg, deps) {
+    // C3:六站点统一 abort 上界(半开 S3 端点此前把用户可见的工具调用挂满 undici ~300s,
+    // reclaim 也挂住 ⇒ staging 孤儿+误报「reclaim FAILED」)。上界常量与 blob-backend 同源。
+    const f = deps?.fetchImpl ?? fetch;
+    const bounded = () => ({ signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
     const upload = deps?.upload ??
         (async (bucket, key, bytes) => {
             const url = presignS3Url({
@@ -93,7 +98,7 @@ export function createSendUserFileIssuer(cfg, deps) {
                 expiresSec: 600,
                 ...(deps?.now !== undefined ? { now: deps.now() } : {}),
             });
-            const res = await fetch(url, { method: "PUT", body: Buffer.from(bytes) });
+            const res = await f(url, { method: "PUT", body: Buffer.from(bytes), ...bounded() });
             if (!res.ok)
                 throw new Error(`SendUserFile upload failed: ${res.status} ${res.statusText} (bucket=${bucket})`);
         });
@@ -196,7 +201,7 @@ export function createSendUserFileIssuer(cfg, deps) {
             // TRUE outcome so error messages never claim "reclaimed" for a delete that itself failed (F2 posture).
             const reclaim = async (b, k) => {
                 try {
-                    const r = await fetch(sign("DELETE", b, k), { method: "DELETE" });
+                    const r = await f(sign("DELETE", b, k), { method: "DELETE", ...bounded() });
                     return r.ok || r.status === 404; // S3 DELETE is idempotent — a missing key IS reclaimed
                 }
                 catch {
@@ -208,7 +213,7 @@ export function createSendUserFileIssuer(cfg, deps) {
             // (fail before copying a huge object). Advisory only for size — the authoritative reading is ④.
             let head;
             try {
-                head = await fetch(sign("HEAD", stagingBucket, stagingKey), { method: "HEAD" });
+                head = await f(sign("HEAD", stagingBucket, stagingKey), { method: "HEAD", ...bounded() });
             }
             catch (e) {
                 const r = await reclaim(stagingBucket, stagingKey);
@@ -245,7 +250,7 @@ export function createSendUserFileIssuer(cfg, deps) {
                 ...(deps?.now !== undefined ? { now: deps.now() } : {}),
             });
             try {
-                const res = await fetch(copy.url, { method: "PUT", headers: copy.headers });
+                const res = await f(copy.url, { method: "PUT", headers: copy.headers, ...bounded() });
                 const body = await res.text().catch(() => "");
                 if (!res.ok || !body.includes("CopyObjectResult"))
                     throw new Error(`copy returned ${res.status}`);
@@ -263,7 +268,7 @@ export function createSendUserFileIssuer(cfg, deps) {
             // staging between ① and ②, swapping in different bytes).
             let fin;
             try {
-                fin = await fetch(sign("HEAD", bucket, key), { method: "HEAD" });
+                fin = await f(sign("HEAD", bucket, key), { method: "HEAD", ...bounded() });
             }
             catch (e) {
                 const r = await reclaim(bucket, key);
@@ -322,7 +327,7 @@ export function createSendUserFileIssuer(cfg, deps) {
             expiresSec: 60,
             ...(deps?.now !== undefined ? { now: deps.now() } : {}),
         });
-        const res = await fetch(url, { method: "DELETE" });
+        const res = await f(url, { method: "DELETE", ...bounded() });
         if (!res.ok && res.status !== 404)
             throw new Error(`SendUserFile object delete failed: ${res.status} ${res.statusText} (bucket=${bucket})`);
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "5.8.0",
+  "version": "5.9.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",