@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/src/runner-manager.ts

@@ -22,7 +22,6 @@ import {
   type InjectedSinks,
   type WorkflowBundleOption,
 } from "@temporalio/worker";
-import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
 import { DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS, DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS, DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./config.js";
 // Boot marks mirror the static runner's segment names where the work is the
@@ -32,6 +31,7 @@ import { markBoot } from "./shared/cold-start-timing.js";
 import type { WorkerActivities } from "./worker.js";
 import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
 import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
+import { assertLlmBackendsPreflight } from "./preflight.js";
 import { createRunnerTokenCoordinator } from "./runner-token-coordinator.js";
 // Per-task-queue in-flight activity tracking lives in ./in-flight.ts so the
 // activity interceptor (no manager-closure handle) and unit tests can reach it.
@@ -237,6 +237,8 @@ export async function createStigmerRunnerManager(
   const runnerTokenRef = { current: options.stigmerToken ?? null };
   const baseConfig = mapManagerOptionsToConfig(options, tokenRef, runnerTokenRef);
 
+  assertLlmBackendsPreflight(baseConfig.proxyEndpoint);
+
   // Install the Cursor SDK interceptors BEFORE resolving Temporal coordinates.
   // Coordinate discovery dials the control plane via StigmerClient, which loads
   // @connectrpc/connect-node and snapshots the node:http2 ESM facade on first
@@ -291,8 +293,10 @@ export async function createStigmerRunnerManager(
   // Resolve the runner bootstrap after the http2 patch is in place (discovery
   // dials the control plane through connect-node). An explicit address wins;
   // otherwise a token triggers control-plane discovery; otherwise localhost.
-  // Must happen before createAllActivities so runtime activities that dial
-  // Temporal (e.g. emit-event) see the resolved address too.
+  // Must happen before createAllActivities so the activities' Config carries
+  // the resolved coordinates. Only the worker connection dials Temporal — no
+  // activity does (emit-event, the last one, now routes signals through the
+  // server's SendSignal lane; see oss#517).
   const bootstrap = await resolveRunnerBootstrap({
     explicitAddress: options.temporalAddress,
     explicitNamespace: options.temporalNamespace,
@@ -351,7 +355,24 @@ export async function createStigmerRunnerManager(
       `[runner-manager] Artifact store: could not resolve config for boot log: ${err}`,
     );
   }
-  const payloadCodec = await createPayloadCodec(config);
+  const { createPayloadCodecs } = await import("./payload-codecs.js");
+  // Server-managed payload-encryption keys (cloud desktop runners) ride the
+  // bootstrap response; an env-configured key still wins inside the loader.
+  // A cloud server that mints runner tokens but returns no key predates key
+  // management — payloads then rest plaintext in cloud Temporal history, which
+  // deserves a diagnosable warning rather than silence.
+  const payloadCodecs = await createPayloadCodecs(config, bootstrap.payloadEncryption);
+  if (
+    !bootstrap.payloadEncryption &&
+    bootstrap.runnerAccessToken &&
+    !process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY
+  ) {
+    console.warn(
+      "[runner-manager] Server minted a runner token but returned no payload " +
+        "encryption key; Temporal payloads will be plaintext (server predates " +
+        "runner key management?)",
+    );
+  }
 
   const connection = await NativeConnection.connect({
     address: config.temporalAddress,
@@ -396,9 +417,7 @@ export async function createStigmerRunnerManager(
       activities,
       workflowBundle,
       maxConcurrentActivityTaskExecutions: config.maxConcurrentActivities,
-      dataConverter: payloadCodec
-        ? { payloadCodecs: [payloadCodec] }
-        : undefined,
+      dataConverter: payloadCodecs?.length ? { payloadCodecs } : undefined,
       sinks: interceptorConfig.sinks,
       interceptors: interceptorConfig.interceptors,
     });
@@ -739,25 +758,6 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
   };
 }
 
-async function createPayloadCodec(
-  config: Config,
-): Promise<PayloadCodec | undefined> {
-  const { loadClaimcheckConfig, ClaimcheckPayloadCodec } = await import(
-    "./claimcheck/index.js"
-  );
-  const claimcheckConfig = loadClaimcheckConfig();
-  if (!claimcheckConfig.enabled) {
-    return undefined;
-  }
-
-  const { loadArtifactStorageConfig, createArtifactStorage } = await import(
-    "./shared/artifact-storage.js"
-  );
-  const storageConfig = loadArtifactStorageConfig(config);
-  const storage = createArtifactStorage(storageConfig);
-  return new ClaimcheckPayloadCodec(storage, claimcheckConfig);
-}
-
 interface InterceptorConfig {
   sinks: InjectedSinks<any>;
   interceptors: Record<string, any>;

package/src/runner.ts

@@ -15,11 +15,11 @@
 import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir, tmpdir } from "node:os";
-import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
 import { DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS, DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS, DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./config.js";
 import type { WorkerActivities } from "./worker.js";
 import { resolveRunnerBootstrap } from "./bootstrap.js";
+import { assertLlmBackendsPreflight } from "./preflight.js";
 import { markBoot, emitRunnerBootTiming } from "./shared/cold-start-timing.js";
 
 /**
@@ -197,6 +197,8 @@ export async function createStigmerRunner(
 
   const baseConfig = mapOptionsToConfig(options);
 
+  assertLlmBackendsPreflight(baseConfig.proxyEndpoint);
+
   // Install the Cursor SDK interceptors BEFORE resolving Temporal coordinates.
   // Coordinate discovery dials the control plane via StigmerClient, which loads
   // @connectrpc/connect-node and snapshots the node:http2 ESM facade on first
@@ -235,8 +237,9 @@ export async function createStigmerRunner(
   // Resolve Temporal coordinates after the http2 patch is in place (discovery
   // dials the control plane through connect-node). Explicit address wins;
   // otherwise a token triggers control-plane discovery; otherwise localhost.
-  // Activities that dial Temporal at runtime (e.g. emit-event) read
-  // config.temporalAddress, so this must precede their creation.
+  // Only the worker connection consumes these coordinates — no activity dials
+  // Temporal directly (emit-event, the last one, now routes signals through
+  // the server's SendSignal lane; see oss#517).
   //
   // The static runner brings its own already-proxy-valid token (harness/CLI),
   // so it does not consume the minted runner token from the bootstrap response;
@@ -302,10 +305,14 @@ export async function createStigmerRunner(
     );
   }
 
-  const payloadCodec = await createPayloadCodec(config);
+  const { createPayloadCodecs } = await import("./payload-codecs.js");
+  // Server-managed keys from the bootstrap response apply here too (a CLI
+  // daemon with a cloud token is desktop-class); cloud sandboxes are
+  // unaffected — their env-injected platform key wins inside the loader.
+  const payloadCodecs = await createPayloadCodecs(config, coordinates.payloadEncryption);
 
   const { startWorker } = await import("./worker.js");
-  const worker = await startWorker({ config, activities, payloadCodec });
+  const worker = await startWorker({ config, activities, payloadCodecs });
   markBoot("worker_created");
 
   return {
@@ -455,28 +462,6 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
   };
 }
 
-async function createPayloadCodec(config: Config): Promise<PayloadCodec | undefined> {
-  const { loadClaimcheckConfig, ClaimcheckPayloadCodec } = await import("./claimcheck/index.js");
-  const claimcheckConfig = loadClaimcheckConfig();
-  if (!claimcheckConfig.enabled) {
-    return undefined;
-  }
-
-  const { loadArtifactStorageConfig, createArtifactStorage } = await import(
-    "./shared/artifact-storage.js"
-  );
-  const storageConfig = loadArtifactStorageConfig(config);
-  const storage = createArtifactStorage(storageConfig);
-
-  console.log(
-    `[runner] Claimcheck enabled (threshold=${claimcheckConfig.thresholdBytes}B, ` +
-      `compression=${claimcheckConfig.compressionEnabled}, ` +
-      `storage=${storageConfig.type})`,
-  );
-
-  return new ClaimcheckPayloadCodec(storage, claimcheckConfig);
-}
-
 function resolveDefaultWorkspaceDir(): string {
   try {
     const dir = join(homedir(), ".stigmer", "workspaces", "runner");

package/src/shared/__tests__/approval-policy.test.ts

@@ -19,7 +19,6 @@ import {
 } from "../approval-policy.js";
 import type { ToolApprovalCategory } from "../tool-kind.js";
 import type { ResolvedMcpServer } from "../mcp-resolver.js";
-import type { ToolApprovalOverride } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { ApprovalAction, ApprovalPolicySource } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
@@ -83,6 +82,9 @@ function makeServer(
   slug: string,
   toolApprovals: Array<{ toolName: string; message?: string }>,
   pinnedToolApprovals: Array<{ toolName: string; message?: string }> = [],
+  // Layer-3 overrides ride the server they were declared on (issue #349) —
+  // there is no cross-server override input to the merge anymore.
+  toolApprovalOverrides: Array<{ toolName: string; requiresApproval: boolean; message?: string }> = [],
 ): ResolvedMcpServer {
   return {
     slug,
@@ -95,6 +97,11 @@ function makeServer(
       toolName: a.toolName,
       message: a.message ?? "",
     })) as any[],
+    toolApprovalOverrides: toolApprovalOverrides.map(o => ({
+      toolName: o.toolName,
+      requiresApproval: o.requiresApproval,
+      message: o.message ?? "",
+    })) as any[],
     discoveredCapabilitiesEmpty: false,
   };
 }
@@ -102,7 +109,7 @@ function makeServer(
 describe("mergeApprovalPolicies", () => {
   it("returns empty map under a global lease (spec.auto_approve_all)", () => {
     const servers = [makeServer("github", [{ toolName: "push" }])];
-    const result = mergeApprovalPolicies(servers, [], leases({ global: true }));
+    const result = mergeApprovalPolicies(servers, leases({ global: true }));
     expect(result.size).toBe(0);
   });
 
@@ -111,7 +118,7 @@ describe("mergeApprovalPolicies", () => {
       makeServer("github", [{ toolName: "push" }]),
       makeServer("database", [{ toolName: "drop_table" }]),
     ];
-    const result = mergeApprovalPolicies(servers, [], leases({ servers: ["github"] }));
+    const result = mergeApprovalPolicies(servers, leases({ servers: ["github"] }));
     expect(result.has("github/push")).toBe(false);
     expect(result.has("database/drop_table")).toBe(true);
   });
@@ -122,7 +129,7 @@ describe("mergeApprovalPolicies", () => {
         { toolName: "create_issue", message: "Create issue?" },
       ]),
     ];
-    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
+    const result = mergeApprovalPolicies(servers, NO_LEASES);
 
     expect(result.size).toBe(1);
     const policy = result.get("github/create_issue")!;
@@ -139,7 +146,7 @@ describe("mergeApprovalPolicies", () => {
         [{ toolName: "push", message: "pinned message" }],
       ),
     ];
-    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
+    const result = mergeApprovalPolicies(servers, NO_LEASES);
 
     const policy = result.get("github/push")!;
     expect(policy.approvalMessage).toBe("pinned message");
@@ -147,34 +154,74 @@ describe("mergeApprovalPolicies", () => {
 
   it("agent overrides can disable approval", () => {
     const servers = [
-      makeServer("github", [{ toolName: "push" }]),
+      makeServer("github", [{ toolName: "push" }], [], [
+        { toolName: "push", requiresApproval: false },
+      ]),
     ];
-    const overrides: ToolApprovalOverride[] = [{
-      toolName: "push",
-      requiresApproval: false,
-      message: "",
-    }] as any[];
 
-    const result = mergeApprovalPolicies(servers, overrides, NO_LEASES);
+    const result = mergeApprovalPolicies(servers, NO_LEASES);
     expect(result.size).toBe(0);
   });
 
   it("agent overrides can add new approval requirement", () => {
-    const servers = [makeServer("github", [])];
-    const overrides: ToolApprovalOverride[] = [{
-      toolName: "delete_repo",
-      requiresApproval: true,
-      message: "Really delete?",
-    }] as any[];
-
-    const result = mergeApprovalPolicies(servers, overrides, NO_LEASES);
+    const servers = [
+      makeServer("github", [], [], [
+        { toolName: "delete_repo", requiresApproval: true, message: "Really delete?" },
+      ]),
+    ];
+
+    const result = mergeApprovalPolicies(servers, NO_LEASES);
     expect(result.has("github/delete_repo")).toBe(true);
   });
 
+  describe("override scoping (issue #349 — no cross-server leak)", () => {
+    it("a disable override on one server leaves a same-named classifier-gated tool on another server gated", () => {
+      // The dangerous direction: before #349 this override silently
+      // un-gated database/delete_item too (authorization widening).
+      const servers = [
+        makeServer("github", [{ toolName: "delete_item" }], [], [
+          { toolName: "delete_item", requiresApproval: false },
+        ]),
+        makeServer("database", [{ toolName: "delete_item" }]),
+      ];
+      const result = mergeApprovalPolicies(servers, NO_LEASES);
+      expect(result.has("github/delete_item")).toBe(false);
+      const other = result.get("database/delete_item")!;
+      expect(other.requiresApproval).toBe(true);
+      expect(other.source).toBe("classifier_default");
+    });
+
+    it("an enable override on one server adds no gate for a same-named tool on another server", () => {
+      const servers = [
+        makeServer("github", [], [], [
+          { toolName: "send_message", requiresApproval: true },
+        ]),
+        makeServer("slack", []),
+      ];
+      const result = mergeApprovalPolicies(servers, NO_LEASES);
+      expect(result.has("github/send_message")).toBe(true);
+      expect(result.has("slack/send_message")).toBe(false);
+    });
+
+    it("a message override on one server does not re-message a same-named gate on another server", () => {
+      const servers = [
+        makeServer("github", [{ toolName: "push", message: "github classifier" }], [], [
+          { toolName: "push", requiresApproval: true, message: "github override" },
+        ]),
+        makeServer("gitlab", [{ toolName: "push", message: "gitlab classifier" }]),
+      ];
+      const result = mergeApprovalPolicies(servers, NO_LEASES);
+      expect(result.get("github/push")!.approvalMessage).toBe("github override");
+      const other = result.get("gitlab/push")!;
+      expect(other.approvalMessage).toBe("gitlab classifier");
+      expect(other.source).toBe("classifier_default");
+    });
+  });
+
   describe("provenance (source stamping)", () => {
     it("stamps classifier_default for a layer-1 tool approval", () => {
       const servers = [makeServer("github", [{ toolName: "create_issue" }])];
-      const result = mergeApprovalPolicies(servers, [], NO_LEASES);
+      const result = mergeApprovalPolicies(servers, NO_LEASES);
       expect(result.get("github/create_issue")!.source).toBe("classifier_default");
     });
 
@@ -182,31 +229,27 @@ describe("mergeApprovalPolicies", () => {
       const servers = [
         makeServer("github", [{ toolName: "push" }], [{ toolName: "push" }]),
       ];
-      const result = mergeApprovalPolicies(servers, [], NO_LEASES);
+      const result = mergeApprovalPolicies(servers, NO_LEASES);
       expect(result.get("github/push")!.source).toBe("pinned_override");
     });
 
     it("stamps agent_override when a per-agent override adds a gate", () => {
-      const servers = [makeServer("github", [])];
-      const overrides: ToolApprovalOverride[] = [{
-        toolName: "delete_repo",
-        requiresApproval: true,
-        message: "Really delete?",
-      }] as any[];
-      const result = mergeApprovalPolicies(servers, overrides, NO_LEASES);
+      const servers = [
+        makeServer("github", [], [], [
+          { toolName: "delete_repo", requiresApproval: true, message: "Really delete?" },
+        ]),
+      ];
+      const result = mergeApprovalPolicies(servers, NO_LEASES);
       expect(result.get("github/delete_repo")!.source).toBe("agent_override");
     });
 
     it("stamps agent_override when it overrides a classifier/pinned entry", () => {
       const servers = [
-        makeServer("github", [{ toolName: "push", message: "classifier" }]),
+        makeServer("github", [{ toolName: "push", message: "classifier" }], [], [
+          { toolName: "push", requiresApproval: true, message: "agent says gate" },
+        ]),
       ];
-      const overrides: ToolApprovalOverride[] = [{
-        toolName: "push",
-        requiresApproval: true,
-        message: "agent says gate",
-      }] as any[];
-      const result = mergeApprovalPolicies(servers, overrides, NO_LEASES);
+      const result = mergeApprovalPolicies(servers, NO_LEASES);
       const policy = result.get("github/push")!;
       expect(policy.source).toBe("agent_override");
       expect(policy.approvalMessage).toBe("agent says gate");
@@ -217,7 +260,7 @@ describe("mergeApprovalPolicies", () => {
     const servers = [
       makeServer("github", [{ toolName: "" }]),
     ];
-    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
+    const result = mergeApprovalPolicies(servers, NO_LEASES);
     expect(result.size).toBe(0);
   });
 
@@ -225,7 +268,7 @@ describe("mergeApprovalPolicies", () => {
     const servers = [
       makeServer("github", [{ toolName: "push" }]),
     ];
-    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
+    const result = mergeApprovalPolicies(servers, NO_LEASES);
     expect(result.get("github/push")!.approvalMessage).toContain("Execute tool: push");
   });
 
@@ -234,7 +277,7 @@ describe("mergeApprovalPolicies", () => {
       makeServer("github", [{ toolName: "push" }]),
       makeServer("database", [{ toolName: "drop_table" }]),
     ];
-    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
+    const result = mergeApprovalPolicies(servers, NO_LEASES);
     expect(result.size).toBe(2);
     expect(result.has("github/push")).toBe(true);
     expect(result.has("database/drop_table")).toBe(true);

package/src/shared/__tests__/artifact-storage.test.ts

@@ -294,7 +294,13 @@ describe("ProxyArtifactStorage", () => {
       return new Response("server error", { status: 500 });
     }) as typeof fetch;
 
-    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+    // 500 is retryable, so this persistent failure exhausts the budget —
+    // delayFn injected to skip the real ~7.75 s of backoff (#468). The
+    // degrade contract under test (budget exhaustion still throws the
+    // caller-visible error) is unchanged.
+    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok", {
+      delayFn: async () => {},
+    });
     await expect(
       storage.upload("key", Buffer.from("x")),
     ).rejects.toThrow("Presigned upload failed (HTTP 500)");
@@ -411,11 +417,148 @@ describe("ProxyArtifactStorage", () => {
 
   it("exists throws on an unexpected object status (a fault, not an existence answer)", async () => {
     mockProxyFetch(() => new Response("boom", { status: 500 }));
-    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+    // Persistent 500 exhausts the retry budget; delayFn skips the real
+    // backoff (#468). The fault-not-an-answer contract is unchanged.
+    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok", {
+      delayFn: async () => {},
+    });
     await expect(storage.exists("key")).rejects.toThrow(
       /Artifact existence check failed \(HTTP 500\) for key 'key'/,
     );
   });
+
+  // The bounded-backoff adoption (stigmer/stigmer#468). Classification policy
+  // is covered by shared/__tests__/http-retry.test.ts; these cases pin the
+  // loop's behavior at this client's call sites: transient failures recover
+  // (each of these fails on pre-#468 code, which threw on the first error),
+  // deterministic failures never retry, and a hung request is aborted at the
+  // per-request bound instead of stalling forever.
+  describe("retry behavior (#468)", () => {
+    let recordedDelays: number[];
+
+    beforeEach(() => {
+      recordedDelays = [];
+    });
+
+    function makeStorage() {
+      return new ProxyArtifactStorage("https://proxy.example.com", "tok", {
+        delayFn: async (ms) => {
+          recordedDelays.push(ms);
+        },
+      });
+    }
+
+    it("upload recovers from a transient presign failure", async () => {
+      let presignCalls = 0;
+      const fetchSpy = vi.fn(async (input: string | URL | Request) => {
+        const url = typeof input === "string" ? input : input.toString();
+        if (url.includes("presigned-upload-url")) {
+          presignCalls++;
+          if (presignCalls === 1) {
+            return new Response("bad gateway", { status: 502 });
+          }
+          return new Response(JSON.stringify({ url: "https://r2.example.com/put" }), { status: 200 });
+        }
+        return new Response("", { status: 200 });
+      });
+      globalThis.fetch = fetchSpy as unknown as typeof fetch;
+
+      const key = await makeStorage().upload("artifacts/e/f.txt", Buffer.from("x"));
+
+      expect(key).toBe("artifacts/e/f.txt");
+      expect(presignCalls).toBe(2);
+      expect(recordedDelays).toEqual([250]);
+    });
+
+    it("upload recovers from a transient R2 PUT failure, re-sending identical bytes", async () => {
+      const putBodies: string[] = [];
+      let putCalls = 0;
+      globalThis.fetch = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+        const url = typeof input === "string" ? input : input.toString();
+        if (url.includes("presigned-upload-url")) {
+          return new Response(JSON.stringify({ url: "https://r2.example.com/put" }), { status: 200 });
+        }
+        putCalls++;
+        putBodies.push(String(init?.body));
+        if (putCalls === 1) {
+          return new Response("unavailable", { status: 503 });
+        }
+        return new Response("", { status: 200 });
+      }) as typeof fetch;
+
+      await makeStorage().upload("k", Buffer.from("same-bytes"));
+
+      expect(putCalls).toBe(2);
+      expect(putBodies[0]).toBe(putBodies[1]);
+      expect(recordedDelays).toEqual([250]);
+    });
+
+    it("download recovers from a transient network failure on the R2 GET", async () => {
+      let getCalls = 0;
+      globalThis.fetch = vi.fn(async (input: string | URL | Request) => {
+        const url = typeof input === "string" ? input : input.toString();
+        if (url.includes("presigned-download-url")) {
+          return new Response(JSON.stringify({ url: "https://r2.example.com/dl" }), { status: 200 });
+        }
+        getCalls++;
+        if (getCalls === 1) {
+          // undici's network-failure shape (retryable).
+          throw new TypeError("fetch failed");
+        }
+        return new Response(Buffer.from("payload"), { status: 200 });
+      }) as typeof fetch;
+
+      const got = await makeStorage().download("k");
+
+      expect(got.toString()).toBe("payload");
+      expect(getCalls).toBe(2);
+      expect(recordedDelays).toEqual([250]);
+    });
+
+    it("never retries a deterministic presign refusal (403)", async () => {
+      const fetchSpy = vi.fn(async () => new Response("forbidden", { status: 403 }));
+      globalThis.fetch = fetchSpy as unknown as typeof fetch;
+
+      await expect(makeStorage().upload("k", Buffer.from("x"))).rejects.toThrow(
+        "Failed to get presigned upload URL (HTTP 403)",
+      );
+      expect(fetchSpy).toHaveBeenCalledTimes(1);
+      expect(recordedDelays).toEqual([]);
+    });
+
+    it("aborts a hung request at the per-request bound and retries it", async () => {
+      let calls = 0;
+      globalThis.fetch = vi.fn((input: string | URL | Request, init?: RequestInit) => {
+        calls++;
+        if (calls === 1) {
+          // Hang until the AbortSignal.timeout fires, then reject the way
+          // undici does — proving the bound converts a stall into a
+          // retryable attempt instead of waiting forever.
+          return new Promise<Response>((_, reject) => {
+            init?.signal?.addEventListener("abort", () =>
+              reject(init.signal!.reason as Error),
+            );
+          });
+        }
+        return Promise.resolve(
+          new Response(JSON.stringify({ url: "https://r2.example.com/dl" }), { status: 200 }),
+        );
+      }) as typeof fetch;
+
+      const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok", {
+        requestTimeoutMs: 20,
+        delayFn: async (ms) => {
+          recordedDelays.push(ms);
+        },
+      });
+
+      const url = await storage.getDownloadUrl("k");
+
+      expect(url).toBe("https://r2.example.com/dl");
+      expect(calls).toBe(2);
+      expect(recordedDelays).toEqual([250]);
+    });
+  });
 });
 
 // ── Factory ──────────────────────────────────────────────────────────