@takara-ai/miru-code 1.4.0 → 1.5.2

package/src/embeddings/openai.ts

@@ -1,9 +1,10 @@
 import { mapPool, resolveWorkerConcurrency } from "../concurrency.ts";
 import { envFirstString, envOptionalInt, resolveEmbeddingApiKey } from "../env.ts";
+import { createSageMakerClient, resolveSageMakerConfig } from "./sagemaker.ts";
 
 export const DEFAULT_EMBEDDING_MODEL = "ds1-miru-int8";
 export const DEFAULT_EMBEDDING_BASE_URL = "https://infer.takara.ai/v1";
-const DEFAULT_BATCH_SIZE = 32;
+const DEFAULT_BATCH_SIZE = 360;
 const DEFAULT_MAX_EMBED_CHARS = 1300;
 const WINDOW_OVERLAP_CHARS = 120;
 
@@ -29,20 +30,40 @@ export interface EmbeddingBackend {
   readonly dimensions: number;
   embedDocuments(texts: string[]): Promise<Float32Array[]>;
   embedQuery(text: string): Promise<Float32Array>;
+  /**
+   * Embed already-windowed strings with no further splitting into windows.
+   * Callers should pass at most one API batch (`resolveEmbeddingBatchSize()`).
+   * Falls back to `embedDocuments` when omitted (test mocks).
+   */
+  embedInputs?(texts: string[]): Promise<Float32Array[]>;
 }
 
-export function resolveEmbeddingModel(): string {
+/** SageMaker self-hosted mode has no configurable model name — the endpoint owns that choice. */
+export function sageMakerModelId(endpointName: string): string {
+  return `sagemaker:${endpointName}`;
+}
+
+/** Takara model name, ignoring SageMaker config — for code that talks to Takara specifically. */
+export function resolveTakaraEmbeddingModel(): string {
   return envFirstString(
     ["MIRU_OPENAI_EMBEDDING_MODEL", "OPENAI_EMBEDDING_MODEL"],
     DEFAULT_EMBEDDING_MODEL,
   );
 }
 
+export function resolveEmbeddingModel(): string {
+  const sageMaker = resolveSageMakerConfig();
+  if (sageMaker) {
+    return sageMakerModelId(sageMaker.endpointName);
+  }
+  return resolveTakaraEmbeddingModel();
+}
+
 export function resolveMaxEmbedChars(): number {
   return envOptionalInt(["MIRU_MAX_EMBED_CHARS"], 256) ?? DEFAULT_MAX_EMBED_CHARS;
 }
 
-function splitIntoWindows(text: string, maxChars: number): string[] {
+export function splitIntoWindows(text: string, maxChars: number): string[] {
   if (text.length <= maxChars) {
     return [text];
   }
@@ -81,6 +102,128 @@ export function sanitizeEmbeddingInput(text: string): string {
   return out;
 }
 
+/** One embedding API input tied back to its source document/chunk. */
+export interface EmbeddingWindowJob {
+  docIndex: number;
+  text: string;
+}
+
+export function appendEmbeddingWindowJobs(
+  jobs: EmbeddingWindowJob[],
+  docIndex: number,
+  text: string,
+  maxChars: number,
+): void {
+  for (const windowText of splitIntoWindows(text, maxChars).map(sanitizeEmbeddingInput)) {
+    jobs.push({ docIndex, text: windowText });
+  }
+}
+
+export function buildEmbeddingWindowJobs(
+  texts: string[],
+  maxChars: number,
+): { jobs: EmbeddingWindowJob[]; buckets: Float32Array[][] } {
+  const jobs: EmbeddingWindowJob[] = [];
+  const buckets: Float32Array[][] = texts.map(() => []);
+  for (let docIndex = 0; docIndex < texts.length; docIndex++) {
+    const text = texts[docIndex];
+    if (text === undefined) {
+      continue;
+    }
+    appendEmbeddingWindowJobs(jobs, docIndex, text, maxChars);
+  }
+  return { jobs, buckets };
+}
+
+export function batchEmbeddingWindowJobs(
+  jobs: EmbeddingWindowJob[],
+  batchSize: number,
+): EmbeddingWindowJob[][] {
+  const batches: EmbeddingWindowJob[][] = [];
+  for (let i = 0; i < jobs.length; i += batchSize) {
+    batches.push(jobs.slice(i, i + batchSize));
+  }
+  return batches;
+}
+
+export function assignEmbeddingWindowVectors(
+  jobs: EmbeddingWindowJob[],
+  vectors: Float32Array[],
+  buckets: Float32Array[][],
+): void {
+  for (let i = 0; i < jobs.length; i++) {
+    const job = jobs[i];
+    const vector = vectors[i];
+    if (job === undefined || vector === undefined) {
+      continue;
+    }
+    const bucket = buckets[job.docIndex];
+    if (bucket) {
+      bucket.push(vector);
+    }
+  }
+}
+
+function normalize(vec: Float32Array): Float32Array {
+  let norm = 0;
+  for (let i = 0; i < vec.length; i++) {
+    const value = vec[i] ?? 0;
+    norm += value * value;
+  }
+  norm = Math.sqrt(norm);
+  if (norm === 0) {
+    return vec;
+  }
+  const out = new Float32Array(vec.length);
+  for (let i = 0; i < vec.length; i++) {
+    out[i] = (vec[i] ?? 0) / norm;
+  }
+  return out;
+}
+
+export function poolWindowVectors(vectors: Float32Array[]): Float32Array {
+  if (vectors.length === 0) {
+    throw new Error("Embedding API returned no vectors");
+  }
+  const first = vectors[0];
+  if (!first) {
+    throw new Error("Embedding API returned no vectors");
+  }
+  if (vectors.length === 1) {
+    return normalize(first);
+  }
+  const pooled = new Float32Array(first.length);
+  for (const vec of vectors) {
+    for (let i = 0; i < pooled.length; i++) {
+      pooled[i] += vec[i] ?? 0;
+    }
+  }
+  for (let i = 0; i < pooled.length; i++) {
+    pooled[i] /= vectors.length;
+  }
+  return normalize(pooled);
+}
+
+export function poolEmbeddingWindowBuckets(buckets: Float32Array[][]): Float32Array[] {
+  return buckets.map((vectors, index) => {
+    if (vectors.length === 0) {
+      throw new Error(`Missing embedding vectors for document ${index}`);
+    }
+    return poolWindowVectors(vectors);
+  });
+}
+
+/** Prefer embedInputs when available; fall back for test mocks. */
+export async function embedTextsWithBackend(
+  embeddings: EmbeddingBackend,
+  texts: string[],
+): Promise<Float32Array[]> {
+  if (embeddings.embedInputs) {
+    return embeddings.embedInputs(texts);
+  }
+  return embeddings.embedDocuments(texts);
+}
+
 const TRANSIENT_EMBED_STATUSES = new Set([429, 500, 502, 503, 504]);
 const MAX_TRANSIENT_EMBED_RETRIES = 4;
 
@@ -127,16 +270,16 @@ export function resolveEmbeddingBaseUrl(): string {
   ).replace(/\/$/, "");
 }
 
-interface Int8Embedding {
+export interface Int8Embedding {
   dtype: "i8";
   values: number[];
   scale: number;
   zero_point: number;
 }
 
-type EmbeddingPayload = number[] | Int8Embedding;
+export type EmbeddingPayload = number[] | Int8Embedding;
 
-interface EmbeddingResponseItem {
+export interface EmbeddingResponseItem {
   index: number;
   embedding: EmbeddingPayload;
 }
@@ -170,11 +313,11 @@ export function dequantizeEmbedding(embedding: EmbeddingPayload): Float32Array {
   throw new Error("Embedding API returned unsupported embedding format");
 }
 
-interface EmbeddingResponse {
+export interface EmbeddingResponse {
   data: EmbeddingResponseItem[];
 }
 
-interface EmbeddingClient {
+export interface EmbeddingClient {
   createEmbeddings(
     input: string[] | string,
     model: string,
@@ -182,12 +325,20 @@ interface EmbeddingClient {
   ): Promise<EmbeddingResponse>;
 }
 
+/** Shown for 401/403 — API often returns "unauthorized" which is unhelpful. */
+export const EMBEDDING_AUTH_ERROR_MESSAGE =
+  "Not authorized. Check your API key and/or token balance.";
+
 class EmbeddingApiError extends Error {
   readonly status: number;
   readonly body: string;
 
   constructor(status: number, body: string) {
-    super(`Embedding API error ${status}: ${body.slice(0, 500)}`);
+    const message =
+      status === 401 || status === 403
+        ? EMBEDDING_AUTH_ERROR_MESSAGE
+        : `Embedding API error ${status}: ${body.slice(0, 500)}`;
+    super(message);
     this.name = "EmbeddingApiError";
     this.status = status;
     this.body = body;
@@ -266,56 +417,38 @@ export class OpenAIEmbeddingBackend implements EmbeddingBackend {
     };
   }
 
-  async embedDocuments(texts: string[]): Promise<Float32Array[]> {
+  /** Embed pre-windowed inputs; issues a single API request (may 413-split). */
+  async embedInputs(texts: string[]): Promise<Float32Array[]> {
     if (texts.length === 0) {
       return [];
     }
-
-    interface WindowJob {
-      docIndex: number;
-      text: string;
+    const vectors = await this.embedBatchRawWithRetry(texts.map(sanitizeEmbeddingInput));
+    for (const vec of vectors) {
+      if (this.dimensions === 0 && vec.length > 0) {
+        this.dimensions = vec.length;
+      }
     }
+    return vectors;
+  }
 
-    const jobs: WindowJob[] = [];
-    const windowVectors: Float32Array[][] = texts.map(() => []);
-
-    for (let docIndex = 0; docIndex < texts.length; docIndex++) {
-      const text = texts[docIndex];
-      if (text === undefined) {
-        continue;
-      }
-      const windows = splitIntoWindows(text, this.maxEmbedChars).map(sanitizeEmbeddingInput);
-      for (const text of windows) {
-        jobs.push({ docIndex, text });
-      }
+  async embedDocuments(texts: string[]): Promise<Float32Array[]> {
+    if (texts.length === 0) {
+      return [];
     }
 
+    const { jobs, buckets } = buildEmbeddingWindowJobs(texts, this.maxEmbedChars);
     if (jobs.length === 0) {
       return texts.map(() => new Float32Array(0));
     }
 
-    const batches: WindowJob[][] = [];
-    for (let i = 0; i < jobs.length; i += this.batchSize) {
-      batches.push(jobs.slice(i, i + this.batchSize));
-    }
-
+    const batches = batchEmbeddingWindowJobs(jobs, this.batchSize);
     const concurrency = resolveWorkerConcurrency();
     await mapPool(batches, concurrency, async (batch) => {
-      const vectors = await this.embedBatchRawWithRetry(batch.map((job) => job.text));
-      for (let i = 0; i < batch.length; i++) {
-        const job = batch[i];
-        const vector = vectors[i];
-        if (job === undefined || vector === undefined) {
-          continue;
-        }
-        const bucket = windowVectors[job.docIndex];
-        if (bucket) {
-          bucket.push(vector);
-        }
-      }
+      const vectors = await this.embedInputs(batch.map((job) => job.text));
+      assignEmbeddingWindowVectors(batch, vectors, buckets);
     });
 
-    const out = windowVectors.map((vectors) => poolWindowVectors(vectors));
+    const out = poolEmbeddingWindowBuckets(buckets);
     for (const vec of out) {
       if (this.dimensions === 0 && vec.length > 0) {
         this.dimensions = vec.length;
@@ -461,49 +594,26 @@ function vectorsFromResponse(data: EmbeddingResponseItem[], expected: number): F
   });
 }
 
-function poolWindowVectors(vectors: Float32Array[]): Float32Array {
-  if (vectors.length === 0) {
-    throw new Error("Embedding API returned no vectors");
-  }
-  const first = vectors[0];
-  if (!first) {
-    throw new Error("Embedding API returned no vectors");
-  }
-  if (vectors.length === 1) {
-    return normalize(first);
-  }
-  const pooled = new Float32Array(first.length);
-  for (const vec of vectors) {
-    for (let i = 0; i < pooled.length; i++) {
-      pooled[i] += vec[i] ?? 0;
-    }
-  }
-  for (let i = 0; i < pooled.length; i++) {
-    pooled[i] /= vectors.length;
-  }
-  return normalize(pooled);
-}
-
-function normalize(vec: Float32Array): Float32Array {
-  let norm = 0;
-  for (let i = 0; i < vec.length; i++) {
-    const value = vec[i] ?? 0;
-    norm += value * value;
-  }
-  norm = Math.sqrt(norm);
-  if (norm === 0) {
-    return vec;
-  }
-  const out = new Float32Array(vec.length);
-  for (let i = 0; i < vec.length; i++) {
-    out[i] = (vec[i] ?? 0) / norm;
-  }
-  return out;
-}
-
 let defaultBackend: OpenAIEmbeddingBackend | null = null;
+let sageMakerBackend: OpenAIEmbeddingBackend | null = null;
 
 export function getEmbeddingBackend(model?: string): OpenAIEmbeddingBackend {
+  // Self-hosted mode: an endpoint ARN/name overrides Takara entirely, ignoring any
+  // explicit `model` override since the deployed endpoint is the only model available.
+  // Cached separately from the Takara singleton so the two never shadow each other.
+  const sageMaker = resolveSageMakerConfig();
+  if (sageMaker) {
+    if (!sageMakerBackend) {
+      const sageMakerModel = sageMakerModelId(sageMaker.endpointName);
+      sageMakerBackend = new OpenAIEmbeddingBackend({
+        model: sageMakerModel,
+        client: createSageMakerClient(sageMaker),
+        dimensions: resolveEmbeddingDimensions(sageMakerModel),
+      });
+    }
+    return sageMakerBackend;
+  }
+
   if (model) {
     return new OpenAIEmbeddingBackend({
       model,

package/src/embeddings/sagemaker.ts

@@ -0,0 +1,268 @@
+import type { InvokeEndpointCommandOutput } from "@aws-sdk/client-sagemaker-runtime";
+import type { EmbeddingClient, EmbeddingPayload, EmbeddingResponse } from "./openai.ts";
+
+type SageMakerRuntimeModule = typeof import("@aws-sdk/client-sagemaker-runtime");
+
+/** Lazily loaded so Takara-only MCP/CLI processes never pay the AWS SDK startup cost. */
+let sageMakerRuntimePromise: Promise<SageMakerRuntimeModule> | null = null;
+
+function loadSageMakerRuntime(): Promise<SageMakerRuntimeModule> {
+  sageMakerRuntimePromise ??= import("@aws-sdk/client-sagemaker-runtime");
+  return sageMakerRuntimePromise;
+}
+
+/** arn:aws:sagemaker:<region>:<account-id>:endpoint/<endpoint-name> (also covers aws-cn/aws-us-gov). */
+const ENDPOINT_ARN_PATTERN = /^arn:aws[a-z0-9-]*:sagemaker:([a-z0-9-]+):(\d{12}):endpoint\/(.+)$/;
+
+export interface SageMakerEmbeddingConfig {
+  endpointName: string;
+  region: string;
+  normalize: boolean;
+  truncate: boolean;
+  truncationDirection: "Left" | "Right";
+  promptName?: string;
+}
+
+export function parseSageMakerEndpointArn(arn: string): {
+  region: string;
+  accountId: string;
+  endpointName: string;
+} {
+  const match = ENDPOINT_ARN_PATTERN.exec(arn.trim());
+  if (!match) {
+    throw new Error(
+      `Invalid SageMaker endpoint ARN: "${arn}". Expected format ` +
+        "arn:aws:sagemaker:<region>:<account-id>:endpoint/<endpoint-name>.",
+    );
+  }
+  const [, region, accountId, endpointName] = match;
+  if (!region || !accountId || !endpointName) {
+    throw new Error(`Invalid SageMaker endpoint ARN: "${arn}".`);
+  }
+  return { region, accountId, endpointName };
+}
+
+function envBool(name: string, fallback: boolean): boolean {
+  const raw = process.env[name]?.trim().toLowerCase();
+  if (!raw) {
+    return fallback;
+  }
+  return !["false", "0", "no"].includes(raw);
+}
+
+function resolveTruncationDirection(): "Left" | "Right" {
+  return process.env.MIRU_SAGEMAKER_TRUNCATION_DIRECTION?.trim() === "Left" ? "Left" : "Right";
+}
+
+/**
+ * Reads MIRU_SAGEMAKER_ENDPOINT_ARN (or MIRU_SAGEMAKER_ENDPOINT_NAME + a region) to enable
+ * self-hosted mode. AWS credentials are resolved by the SDK's default provider chain
+ * (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN, AWS_PROFILE, or an IAM role) —
+ * there is nothing Miru-specific to configure for auth.
+ */
+export function resolveSageMakerConfig(): SageMakerEmbeddingConfig | null {
+  const arn = process.env.MIRU_SAGEMAKER_ENDPOINT_ARN?.trim();
+  const explicitName = process.env.MIRU_SAGEMAKER_ENDPOINT_NAME?.trim();
+
+  let endpointName: string;
+  let region: string;
+
+  if (arn) {
+    const parsed = parseSageMakerEndpointArn(arn);
+    endpointName = parsed.endpointName;
+    region = parsed.region;
+  } else if (explicitName) {
+    endpointName = explicitName;
+    const explicitRegion =
+      process.env.MIRU_SAGEMAKER_REGION?.trim() ||
+      process.env.AWS_REGION?.trim() ||
+      process.env.AWS_DEFAULT_REGION?.trim();
+    if (!explicitRegion) {
+      throw new Error(
+        "MIRU_SAGEMAKER_ENDPOINT_NAME is set but no AWS region was found. Set " +
+          "MIRU_SAGEMAKER_REGION, AWS_REGION, or AWS_DEFAULT_REGION.",
+      );
+    }
+    region = explicitRegion;
+  } else {
+    return null;
+  }
+
+  return {
+    endpointName,
+    region,
+    normalize: envBool("MIRU_SAGEMAKER_NORMALIZE", true),
+    truncate: envBool("MIRU_SAGEMAKER_TRUNCATE", true),
+    truncationDirection: resolveTruncationDirection(),
+    promptName: process.env.MIRU_SAGEMAKER_PROMPT_NAME?.trim() || undefined,
+  };
+}
+
+export function isSageMakerConfigured(): boolean {
+  return resolveSageMakerConfig() != null;
+}
+
+/** Shown for credential/permission failures — mirrors EMBEDDING_AUTH_ERROR_MESSAGE for the AWS path. */
+export const SAGEMAKER_AUTH_ERROR_MESSAGE =
+  "Not authorized to invoke this SageMaker endpoint. Check your AWS credentials " +
+  "(AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN or AWS_PROFILE) and that the " +
+  "identity has sagemaker:InvokeEndpoint permission on the endpoint.";
+
+const AUTH_EXCEPTION_NAMES = new Set([
+  "AccessDeniedException",
+  "UnrecognizedClientException",
+  "ExpiredTokenException",
+  "CredentialsProviderError",
+]);
+
+class SageMakerInvokeError extends Error {
+  readonly status: number;
+
+  constructor(status: number, message: string) {
+    super(message);
+    this.name = "SageMakerInvokeError";
+    this.status = status;
+  }
+}
+
+function toInvokeError(err: unknown): SageMakerInvokeError {
+  const awsErr = err as {
+    name?: string;
+    message?: string;
+    $metadata?: { httpStatusCode?: number };
+    OriginalStatusCode?: string | number;
+    OriginalMessage?: string;
+  };
+
+  if (awsErr?.name && AUTH_EXCEPTION_NAMES.has(awsErr.name)) {
+    return new SageMakerInvokeError(403, SAGEMAKER_AUTH_ERROR_MESSAGE);
+  }
+
+  // ModelError wraps the embedding container's real status/message (e.g. 424 when the
+  // deployed model isn't an embedding model) behind SageMaker's own 424 response.
+  const originalStatus =
+    awsErr?.OriginalStatusCode != null ? Number(awsErr.OriginalStatusCode) : undefined;
+  const status =
+    originalStatus != null && Number.isFinite(originalStatus)
+      ? originalStatus
+      : (awsErr?.$metadata?.httpStatusCode ?? 500);
+  const message = awsErr?.OriginalMessage ?? awsErr?.message ?? String(err);
+
+  if (status === 424) {
+    return new SageMakerInvokeError(
+      424,
+      `SageMaker endpoint returned 424 — the deployed model is not an embedding model (${message}).`,
+    );
+  }
+  return new SageMakerInvokeError(status, `SageMaker endpoint error ${status}: ${message}`);
+}
+
+function extractEmbeddings(parsed: unknown): EmbeddingPayload[] {
+  if (Array.isArray(parsed)) {
+    return parsed as EmbeddingPayload[];
+  }
+  if (parsed && typeof parsed === "object") {
+    const obj = parsed as {
+      embeddings?: EmbeddingPayload[];
+      data?: Array<{ embedding: EmbeddingPayload }>;
+    };
+    if (Array.isArray(obj.embeddings)) {
+      return obj.embeddings;
+    }
+    if (Array.isArray(obj.data)) {
+      return obj.data.map((item) => item.embedding);
+    }
+  }
+  throw new Error("SageMaker endpoint returned an unrecognized embedding payload shape");
+}
+
+/** Builds the TEI-style /embed request body this schema expects (`inputs`, not `input`). */
+function buildRequestBody(
+  config: SageMakerEmbeddingConfig,
+  input: string[] | string,
+  dimensions?: number,
+): Record<string, unknown> {
+  const body: Record<string, unknown> = {
+    inputs: input,
+    normalize: config.normalize,
+    truncate: config.truncate,
+    truncation_direction: config.truncationDirection,
+  };
+  if (dimensions != null) {
+    body.dimensions = dimensions;
+  }
+  if (config.promptName) {
+    body.prompt_name = config.promptName;
+  }
+  return body;
+}
+
+export function createSageMakerClient(config: SageMakerEmbeddingConfig): EmbeddingClient {
+  let client: InstanceType<SageMakerRuntimeModule["SageMakerRuntimeClient"]> | null = null;
+
+  return {
+    async createEmbeddings(
+      input: string[] | string,
+      _model: string,
+      dimensions?: number,
+    ): Promise<EmbeddingResponse> {
+      const { InvokeEndpointCommand, SageMakerRuntimeClient } = await loadSageMakerRuntime();
+      client ??= new SageMakerRuntimeClient({ region: config.region });
+
+      const body = buildRequestBody(config, input, dimensions);
+
+      let response: InvokeEndpointCommandOutput;
+      try {
+        response = await client.send(
+          new InvokeEndpointCommand({
+            EndpointName: config.endpointName,
+            ContentType: "application/json",
+            Accept: "application/json",
+            Body: new TextEncoder().encode(JSON.stringify(body)),
+          }),
+        );
+      } catch (err) {
+        throw toInvokeError(err);
+      }
+
+      if (!response.Body) {
+        throw new Error("SageMaker endpoint returned an empty response body");
+      }
+
+      let parsed: unknown;
+      try {
+        parsed = JSON.parse(new TextDecoder().decode(response.Body));
+      } catch {
+        throw new Error("SageMaker endpoint returned invalid JSON");
+      }
+
+      const embeddings = extractEmbeddings(parsed);
+      return { data: embeddings.map((embedding, index) => ({ index, embedding })) };
+    },
+  };
+}
+
+export interface ValidateSageMakerResult {
+  valid: boolean;
+  status?: number;
+  message: string;
+}
+
+/** Real InvokeEndpoint round trip, used by `miru setup --sagemaker` to confirm auth + shape. */
+export async function validateSageMakerConnection(
+  config: SageMakerEmbeddingConfig,
+): Promise<ValidateSageMakerResult> {
+  try {
+    const client = createSageMakerClient(config);
+    const response = await client.createEmbeddings("miru setup validation", "sagemaker-setup");
+    const embedding = response.data[0]?.embedding;
+    if (!embedding) {
+      return { valid: false, message: "SageMaker endpoint returned an empty response." };
+    }
+    return { valid: true, message: "SageMaker endpoint responded successfully." };
+  } catch (err) {
+    const status = (err as { status?: number }).status;
+    const message = err instanceof Error ? err.message : String(err);
+    return { valid: false, status, message };
+  }
+}

package/src/embeddings/validate.ts

@@ -1,4 +1,5 @@
 import {
+  EMBEDDING_AUTH_ERROR_MESSAGE,
   embeddingDimensions,
   resolveEmbeddingBaseUrl,
   resolveEmbeddingDimensions,
@@ -54,7 +55,7 @@ export async function validateEmbeddingApiKey(options: {
       return {
         valid: false,
         status: response.status,
-        message: "Invalid API key (authentication failed).",
+        message: EMBEDDING_AUTH_ERROR_MESSAGE,
       };
     }
     return {

package/src/git.ts

@@ -20,22 +20,17 @@ export async function cloneGitRepository(url: string, ref?: string | null): Prom
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",
+      timeout: timeoutSec * 1000,
     });
   } catch {
     await rm(dir, { recursive: true, force: true });
     throw new Error("git is not installed or not on PATH");
   }
 
-  let timedOut = false;
-  const timer = setTimeout(() => {
-    timedOut = true;
-    proc.kill();
-  }, timeoutSec * 1000);
-
   const code = await proc.exited;
-  clearTimeout(timer);
 
-  if (timedOut) {
+  // Prefer signalCode over killed — Bun may set killed=true after a normal exit.
+  if (proc.signalCode != null) {
     await rm(dir, { recursive: true, force: true });
     throw new Error(`git clone timed out for ${url} (limit: ${timeoutSec}s)`);
   }