@senpi/runtime 3.0.100 → 3.0.101

package/dist/scanners/external/scaffold/scaffold.py

@@ -13,6 +13,7 @@ on error/timeout/malformed/failed-persist — transactional discard wins on fail
 """
 
 import inspect
+import math
 import os
 import time
 import threading
@@ -38,6 +39,35 @@ from .state_manager import StateManager
 from .ulid import new_ulid
 
 
+def _read_call_timeout_seconds(senpi_mcp_mod: Any) -> float:
+    """The per-call MCP bound from the launch env, or the documented default.
+
+    `SENPI_MCP_CALL_TIMEOUT_SECONDS` is operator-set on the runtime box and
+    reaches the scaffold child through the supervisor's inherited env. A value
+    that is not a positive finite number must not take the scanner down at
+    launch — it falls back to the default and says so (`senpi_mcp_config_invalid`),
+    the same "loud, not fatal" shape as a malformed launch config field.
+    """
+    variable = senpi_mcp_mod.CALL_TIMEOUT_ENV_VAR
+    default = senpi_mcp_mod.DEFAULT_CALL_TIMEOUT_SECONDS
+    raw = os.environ.get(variable)
+    if raw is None:
+        return default
+    try:
+        seconds = float(raw)
+    except ValueError:
+        seconds = math.nan
+    if not senpi_mcp_mod.is_valid_call_timeout(seconds):
+        log_event(
+            "senpi_mcp_config_invalid",
+            variable=variable,
+            value=raw[:100],
+            fallback_seconds=default,
+        )
+        return default
+    return seconds
+
+
 def _build_senpi_mcp() -> Any:
     """Construct the MCP client when creds are present; else return None.
 
@@ -45,7 +75,8 @@ def _build_senpi_mcp() -> Any:
     the launcher regardless of how the operator supplied them. With neither set,
     return None so the no-creds path does not crash — the client is loud at FIRST
     USE (see scaffold.senpi_mcp). Reference the class through the module attribute
-    so a test stub patched onto scaffold.senpi_mcp is honored.
+    so a test stub patched onto scaffold.senpi_mcp is honored. The per-call bound
+    comes from SENPI_MCP_CALL_TIMEOUT_SECONDS (see _read_call_timeout_seconds).
     """
     api_key = os.environ.get("SENPI_AUTH_TOKEN") or os.environ.get("SENPI_API_KEY") or None
     mcp_url = os.environ.get("SENPI_MCP_URL") or None
@@ -63,6 +94,7 @@ def _build_senpi_mcp() -> Any:
         api_key=api_key,
         mcp_url=mcp_url,
         write_allowlist=senpi_mcp_mod.PRODUCER_WRITE_ALLOWLIST,
+        call_timeout_seconds=_read_call_timeout_seconds(senpi_mcp_mod),
     )
 
 

package/dist/scanners/external/scaffold/senpi_mcp.py

@@ -30,9 +30,22 @@ report `ok` with zero candidates. The session is therefore now REBUILT: a
 transport-level failure (closed/broken stream, connection reset, broken pipe,
 httpx transport error) discards the dead session and the NEXT call opens and
 initialises a fresh one. The failing call still fails — there is no retry
-inside a call (bounding a call is a separate ticket) — the point is that the
-failure is no longer permanent. The failure is logged once as
-`senpi_mcp_error` with `session_rebuilt: true`.
+inside a call — the point is that the failure is no longer permanent. The
+failure is logged once as `senpi_mcp_error` with `session_rebuilt: true`.
+
+AMENDMENT, second half (same RCA): B5 also locked "no per-call timeout".
+`call_tool` blocked on the loop's future with no bound, so one stalled
+`POST /mcp` hung a call until Kong severed the stream at 60 s, and a handful of
+such calls consumed the whole 300 s tick budget (`scaffold_tick_timeout`).
+EVERY call is now BOUNDED — session open included — by
+`call_timeout_seconds` (launch env `SENPI_MCP_CALL_TIMEOUT_SECONDS`, default
+`DEFAULT_CALL_TIMEOUT_SECONDS`, well under the 60 s ceiling so the scaffold,
+not the proxy, is what gives up). A call that outlives the bound raises
+`SenpiMcpTimeoutError` (a `TimeoutError`) and is treated exactly like a
+transport failure: the abandoned session is discarded — the server may still
+write to that stream — and the next call opens a fresh one. It is logged as
+`senpi_mcp_error` with `error_type: TimeoutError`, `timeout_seconds` and
+`elapsed_ms` so a stall is distinguishable from a severed stream in ClickStack.
 
 Response normalization MATCHES producer.mjs `createSenpiToolClient`:
     1. isError truthy            -> RAISE with the error text (never a silent None).
@@ -82,9 +95,11 @@ connection (streamable-http is request/response, no protocol goodbye).
 from __future__ import annotations
 
 import asyncio
+import concurrent.futures
 import json
 import math
 import threading
+import time
 from typing import Any, Iterable, Optional
 
 from .loop_primitives import log_event
@@ -388,9 +403,11 @@ def _cast_market_numerics(name: str, payload: Any, args: Optional[dict] = None)
 # three when the SDK's streams are closed or broken under a session; httpx's
 # `TransportError` is the base of every connect/read/write/protocol/timeout
 # failure on the POST itself. OSError covers ConnectionError and its subclasses
-# (reset, refused, aborted), BrokenPipeError and — deliberately — TimeoutError:
-# a call that timed out at the socket, or under a future per-call bound, has
-# left the session in an unknown state and the next call must not inherit it.
+# (reset, refused, aborted), BrokenPipeError and — deliberately — TimeoutError,
+# which is what the per-call bound raises (`SenpiMcpTimeoutError`): a call that
+# timed out at the socket or under the bound has left the session in an unknown
+# state (the server may still write to the abandoned stream) and the next call
+# must not inherit it.
 # Our own pre-connect raises (PermissionError for a blocked mutation tool,
 # RuntimeError for missing creds) happen before any session is held, so they
 # never reach this classification.
@@ -411,6 +428,42 @@ def _is_transport_error(exc: BaseException) -> bool:
     return any(klass.__name__ in _TRANSPORT_ERROR_NAMES for klass in type(exc).__mro__)
 
 
+# --------------------------------------------------------------------------
+# Per-call bound — the scaffold gives up before the proxy does.
+# --------------------------------------------------------------------------
+#
+# Kong severs a stalled `POST /mcp` at 60.000 s; a tick has 300 s. 30 s is
+# comfortably under the ceiling — a stall is visible as OUR timeout, not as a
+# severed stream — and still leaves ten sequential calls inside one tick. The
+# bound covers the whole call: opening the session (initialize) when there is
+# none, plus the tool call itself.
+DEFAULT_CALL_TIMEOUT_SECONDS: float = 30.0
+
+# Launch-env knob for the bound, read by scaffold._build_senpi_mcp.
+CALL_TIMEOUT_ENV_VAR = "SENPI_MCP_CALL_TIMEOUT_SECONDS"
+
+
+def is_valid_call_timeout(seconds: Any) -> bool:
+    """A usable bound: a positive, finite number (bools are not numbers here).
+
+    Shared by the constructor (which rejects anything else) and the launch-env
+    reader in scaffold.py (which falls back to the default instead).
+    """
+    if isinstance(seconds, bool) or not isinstance(seconds, (int, float)):
+        return False
+    return math.isfinite(seconds) and seconds > 0
+
+
+class SenpiMcpTimeoutError(TimeoutError):
+    """A `call_tool` outlived the client's per-call bound.
+
+    A `TimeoutError` so authored `scan()` code can `except TimeoutError`; a
+    distinct class so the scaffold's own bound is tellable from a socket
+    timeout. Classified as a transport failure: the session it happened on is
+    discarded and the next call opens a fresh one.
+    """
+
+
 class _McpSession:
     """One live MCP session: the SDK session plus the handles that end it.
 
@@ -449,9 +502,18 @@ class SenpiMcpClient:
         api_key: Optional[str] = None,
         mcp_url: Optional[str] = None,
         write_allowlist: Iterable[str] = (),
+        call_timeout_seconds: Optional[float] = None,
     ) -> None:
         self._api_key = api_key
         self._mcp_url = mcp_url
+        if call_timeout_seconds is None:
+            call_timeout_seconds = DEFAULT_CALL_TIMEOUT_SECONDS
+        if not is_valid_call_timeout(call_timeout_seconds):
+            raise ValueError(
+                "senpi_mcp: call_timeout_seconds must be a positive number, "
+                f"got {call_timeout_seconds!r}"
+            )
+        self._call_timeout = float(call_timeout_seconds)
         # Mutation tools the operator has explicitly permitted. EMPTY by default
         # → every MUTATION_TOOLS entry is blocked (read-only producer boundary).
         self._write_allowlist: frozenset[str] = frozenset(write_allowlist)
@@ -466,6 +528,11 @@ class SenpiMcpClient:
 
     # -- public sync surface ----------------------------------------------
 
+    @property
+    def call_timeout_seconds(self) -> float:
+        """The bound every `call_tool` fails within (session open included)."""
+        return self._call_timeout
+
     def call_tool(self, name: str, args: Optional[dict] = None) -> Any:
         """Invoke an MCP tool synchronously; return the unwrapped result.
 
@@ -479,8 +546,16 @@ class SenpiMcpClient:
         A transport-level failure (see `_is_transport_error`) additionally
         discards the session it happened on, so the NEXT call opens a fresh one
         instead of failing forever; its log event carries `session_rebuilt: true`.
+
+        The whole call — opening a session when there is none, then the tool
+        call — must finish within `call_timeout_seconds`, else it raises
+        `SenpiMcpTimeoutError` (logged with `error_type: TimeoutError` and the
+        elapsed ms) and the abandoned session is discarded like any other
+        transport failure.
         """
         used: Optional[_McpSession] = None
+        started = time.monotonic()
+        deadline = started + self._call_timeout
         try:
             # Read-only producer boundary, enforced PRE-CONNECT (no transport
             # opened for a blocked write). A mutation tool passes only if its exact
@@ -495,31 +570,38 @@ class SenpiMcpClient:
                     "not reachable by authored producer code)."
                 )
 
-            used = self._ensure_connected()
-            result = self._run(used.session.call_tool(name, arguments=args))
+            used = self._ensure_connected(name, deadline)
+            result = self._run(used.session.call_tool(name, arguments=args), name, deadline)
             return _cast_market_numerics(name, self._unwrap(name, result), args)
         except Exception as exc:
             # Catch every failure — mutation block, missing creds, the lazy
-            # `import mcp`, transport errors, tool `isError` — log it, then re-raise
-            # to the author's scan(). Scoped to Exception so a tick timeout
-            # (_TickTimeout, a BaseException) still unwinds the tick untouched.
+            # `import mcp`, transport errors, timeouts, tool `isError` — log it,
+            # then re-raise to the author's scan(). Scoped to Exception so a tick
+            # timeout (_TickTimeout, a BaseException) still unwinds the tick untouched.
             rebuilt = used is not None and _is_transport_error(exc) and self._discard(used)
+            timed_out = isinstance(exc, SenpiMcpTimeoutError)
             log_event(
                 "senpi_mcp_error",
                 tool=name,
-                error_type=type(exc).__name__,
+                # The fleet fingerprint for the bound is the builtin category,
+                # not the scaffold subclass: ClickStack queries `TimeoutError`.
+                error_type="TimeoutError" if timed_out else type(exc).__name__,
                 error=str(exc)[:500],
+                elapsed_ms=round((time.monotonic() - started) * 1000, 1),
+                **({"timeout_seconds": self._call_timeout} if timed_out else {}),
                 **({"session_rebuilt": True} if rebuilt else {}),
             )
             raise
 
     # -- persistent session lifecycle -------------------------------------
 
-    def _ensure_connected(self) -> _McpSession:
+    def _ensure_connected(self, name: str, deadline: float) -> _McpSession:
         """Return the live session, opening one when there is none.
 
         A session whose lifetime task has ended on its own (the transport died
         between calls) counts as absent and is replaced here, before the call.
+        Opening counts against the call's `deadline`: a stalled initialize
+        raises `SenpiMcpTimeoutError` like a stalled tool call would.
         """
         current = self._current
         if current is not None and current.alive:
@@ -555,7 +637,7 @@ class SenpiMcpClient:
                 )
                 self._thread.start()
 
-            self._current = self._run(self._open_session())
+            self._current = self._run(self._open_session(), name, deadline)
             return self._current
 
     def _discard(self, dead: _McpSession) -> bool:
@@ -579,12 +661,19 @@ class SenpiMcpClient:
 
         A failure while opening propagates to the caller; the lifetime task has
         already unwound whatever it had entered, so nothing is left half-built.
+        A cancelled open (the caller's bound ran out while initialize stalled)
+        cancels the lifetime task too, which unwinds the transport from inside
+        the task that entered it — a stalled open never leaks a session.
         """
         loop = asyncio.get_running_loop()
         ready: "asyncio.Future[Any]" = loop.create_future()
         close_requested = asyncio.Event()
         lifetime = loop.create_task(self._session_lifetime(ready, close_requested))
-        session = await ready
+        try:
+            session = await ready
+        except asyncio.CancelledError:
+            lifetime.cancel()
+            raise
         return _McpSession(session, lifetime, close_requested)
 
     async def _session_lifetime(self, ready: "asyncio.Future[Any]", close_requested: asyncio.Event) -> None:
@@ -619,10 +708,25 @@ class SenpiMcpClient:
             if not isinstance(exc, Exception):
                 raise
 
-    def _run(self, coro: Any) -> Any:
-        """Drive a coroutine to completion on the persistent loop, blocking."""
+    def _run(self, coro: Any, name: str, deadline: float) -> Any:
+        """Drive a coroutine on the persistent loop, blocking until `deadline`.
+
+        Past the deadline the loop-side task is cancelled and
+        `SenpiMcpTimeoutError` is raised. If the task finished in the instant
+        between the deadline and the cancel, its outcome is taken as-is — the
+        call made it, by a hair — so a completed open never leaks its session.
+        """
         future = asyncio.run_coroutine_threadsafe(coro, self._loop)
-        return future.result()
+        try:
+            return future.result(timeout=max(0.0, deadline - time.monotonic()))
+        except concurrent.futures.TimeoutError:
+            if not future.cancel():
+                return future.result()
+            raise SenpiMcpTimeoutError(
+                f'senpi_mcp: tool "{name}" did not complete within '
+                f"{self._call_timeout:g}s ({CALL_TIMEOUT_ENV_VAR}); the session (or "
+                "the pending open) is discarded and the next call opens a fresh one"
+            ) from None
 
     # -- response normalization (matches producer.mjs createSenpiToolClient) --
 

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "runtime",
   "name": "Senpi Runtime",
   "description": "Senpi runtime plugin for OpenClaw. Orchestrates scanners, LLM-based trade decisions, and a DSL trailing stop-loss exit engine.",
-  "version": "3.0.100",
+  "version": "3.0.101",
   "commandAliases": [
     {
       "name": "senpi"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senpi/runtime",
-  "version": "3.0.100",
+  "version": "3.0.101",
   "description": "Senpi runtime plugin for OpenClaw",
   "type": "module",
   "main": "dist/index.js",