@youtyan/code-viewer 0.2.5 → 0.2.6

package/dist/code-viewer.js

@@ -1458,6 +1458,9 @@ var init_git = __esm(() => {
     "vendor",
     ".cache",
     "coverage",
+    "tmp",
+    "log",
+    "storage",
     "DerivedData",
     "Pods",
     "bin",
@@ -3681,14 +3684,23 @@ function startWorktreeUpdateWatch(options) {
   const setTimer = options.setTimeoutFn || setTimeout;
   const clearTimer = options.clearTimeoutFn || clearTimeout;
   const debounceMs = options.debounceMs ?? 250;
+  const maxWatchedDirectories = Math.max(1, Math.floor(options.maxWatchedDirectories ?? DEFAULT_WORKTREE_WATCH_DIRECTORY_LIMIT));
   const watchers = new Map;
   const signatures = new Map;
   const initialScanAsync = options.initialScanMode === "async" || (!options.watch || options.watch === nodeWatch) && !options.readdirSync;
   const initialScanQueue = [];
   let initialScanTimer = null;
+  const pendingPathInspections = new Map;
+  let pathInspectionTimer = null;
   let timer = null;
   const pendingChangedPaths = new Set;
+  let watchLimitReported = false;
   const ignored = (path) => isSkippableSearchPath(normalizeRelativePath(path), options.omitDirNames, options.excludeNames);
+  const directoryRelativePath = (dir) => normalizeRelativePath(relative(options.root, dir));
+  const ignoredDirectory = (dir) => {
+    const rel = directoryRelativePath(dir);
+    return Boolean(rel && ignored(rel));
+  };
   const scheduleUpdate = (changedPath) => {
     if (changedPath)
       pendingChangedPaths.add(changedPath);
@@ -3701,6 +3713,12 @@ function startWorktreeUpdateWatch(options) {
       options.onUpdate(paths);
     }, debounceMs);
   };
+  const reportWatchLimit = () => {
+    if (watchLimitReported)
+      return;
+    watchLimitReported = true;
+    options.onError?.(new Error(`worktree watcher cap reached (${maxWatchedDirectories}); subsequent changes may be missed`));
+  };
   const closeSubtree = (dir) => {
     for (const [watchedDir, watcher] of [...watchers]) {
       if (watchedDir !== dir && !watchedDir.startsWith(`${dir}/`))
@@ -3717,7 +3735,12 @@ function startWorktreeUpdateWatch(options) {
       clearTimer(initialScanTimer);
       initialScanTimer = null;
     }
+    if (pathInspectionTimer) {
+      clearTimer(pathInspectionTimer);
+      pathInspectionTimer = null;
+    }
     initialScanQueue.length = 0;
+    pendingPathInspections.clear();
     for (const watcher of [...watchers.values()]) {
       try {
         watcher.close?.();
@@ -3738,27 +3761,82 @@ function startWorktreeUpdateWatch(options) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      children.push(join7(dir, entry.name));
+      const child = join7(dir, entry.name);
+      if (ignoredDirectory(child))
+        continue;
+      children.push(child);
     }
     return children;
   };
   const processInitialScanQueue = () => {
     initialScanTimer = null;
+    if (watchers.size >= maxWatchedDirectories) {
+      reportWatchLimit();
+      initialScanQueue.length = 0;
+      return;
+    }
     const next = initialScanQueue.shift();
     if (next)
       watchDirectory(next, true);
+    if (watchers.size >= maxWatchedDirectories) {
+      reportWatchLimit();
+      initialScanQueue.length = 0;
+    }
     if (initialScanQueue.length)
       initialScanTimer = setTimer(processInitialScanQueue, 50);
   };
   const queueInitialChildren = (dir) => {
-    initialScanQueue.push(...readChildDirectories(dir));
+    const remaining = maxWatchedDirectories - watchers.size;
+    if (remaining <= 0) {
+      reportWatchLimit();
+      return;
+    }
+    const children = readChildDirectories(dir);
+    if (children.length > remaining)
+      reportWatchLimit();
+    initialScanQueue.push(...children.slice(0, remaining));
     if (!initialScanTimer)
       initialScanTimer = setTimer(processInitialScanQueue, 5000);
   };
+  const processChangedPath = (changed, fullChangedPath) => {
+    const known = watchers.has(fullChangedPath);
+    if (isDirectory(fullChangedPath)) {
+      if (known) {
+        const signature = directorySignature(fullChangedPath);
+        if (signature && signature !== signatures.get(fullChangedPath)) {
+          closeSubtree(fullChangedPath);
+          watchDirectory(fullChangedPath, initialScanAsync);
+        }
+        scheduleUpdate(changed);
+        return;
+      }
+      watchDirectory(fullChangedPath, initialScanAsync);
+    } else if (known) {
+      closeSubtree(fullChangedPath);
+    }
+    scheduleUpdate(changed);
+  };
+  const processPathInspections = () => {
+    pathInspectionTimer = null;
+    const entries = [...pendingPathInspections];
+    pendingPathInspections.clear();
+    for (const [changed, fullChangedPath] of entries) {
+      processChangedPath(changed, fullChangedPath);
+    }
+  };
+  const queuePathInspection = (changed, fullChangedPath) => {
+    pendingPathInspections.set(changed, fullChangedPath);
+    if (!pathInspectionTimer)
+      pathInspectionTimer = setTimer(processPathInspections, 25);
+  };
   const watchDirectory = (dir, initialScan = false) => {
     if (watchers.has(dir))
       return;
-    const rel = normalizeRelativePath(relative(options.root, dir));
+    if (watchers.size >= maxWatchedDirectories) {
+      reportWatchLimit();
+      return;
+    }
+    const rel = directoryRelativePath(dir);
     if (rel && ignored(rel))
       return;
     try {
@@ -3773,22 +3851,11 @@ function startWorktreeUpdateWatch(options) {
         const fullChangedPath = join7(options.root, changed);
         if (!isInsideRoot(options.root, fullChangedPath))
           return;
-        const known = watchers.has(fullChangedPath);
-        if (isDirectory(fullChangedPath)) {
-          if (known) {
-            const signature2 = directorySignature(fullChangedPath);
-            if (signature2 && signature2 !== signatures.get(fullChangedPath)) {
-              closeSubtree(fullChangedPath);
-              watchDirectory(fullChangedPath);
-            }
-            scheduleUpdate(changed);
-            return;
-          }
-          watchDirectory(fullChangedPath);
-        } else if (known) {
-          closeSubtree(fullChangedPath);
+        if (initialScanAsync) {
+          queuePathInspection(changed, fullChangedPath);
+          return;
         }
-        scheduleUpdate(changed);
+        processChangedPath(changed, fullChangedPath);
       }) || {};
       watchers.set(dir, watcher);
       const signature = directorySignature(dir);
@@ -3814,12 +3881,17 @@ function startWorktreeUpdateWatch(options) {
       queueInitialChildren(dir);
       return;
     }
+    if (watchers.size >= maxWatchedDirectories) {
+      reportWatchLimit();
+      return;
+    }
     for (const child of readChildDirectories(dir))
       watchDirectory(child);
   };
   watchDirectory(options.root, true);
   return { started: watchers.size > 0, close: closeAll };
 }
+var DEFAULT_WORKTREE_WATCH_DIRECTORY_LIMIT = 256;
 var init_worktree_watcher = __esm(() => {
   init_search();
 });
@@ -5855,7 +5927,7 @@ function parseComposeEnv(serviceBlock, composeDirEnv = {}) {
   }
   return env;
 }
-function parseComposePortMappings(serviceBlock) {
+function parseComposePortMappings(serviceBlock, composeDirEnv = {}) {
   const portsMatch = serviceBlock.match(/^[ \t]+ports:\s*\n((?:[ \t]+- [^\n]+\n?)*)/m);
   if (!portsMatch)
     return [];
@@ -5865,26 +5937,45 @@ function parseComposePortMappings(serviceBlock) {
     const trimmed = line.trim();
     if (!trimmed.startsWith("-"))
       continue;
-    const value = trimmed.slice(1).trim().replace(/^["']|["']$/g, "").split(/\s+#/)[0].split("/")[0].trim();
+    const value = resolveEnvValue(trimmed.slice(1).trim().replace(/^["']|["']$/g, "").split(/\s+#/)[0].split("/")[0].trim(), composeDirEnv);
     if (!value || value.includes("target:"))
       continue;
     const parts = value.split(":");
     const container = parts.pop()?.trim() || "";
     const host = parts.pop()?.trim() || "";
-    if (!/^\d+$/.test(container))
+    const containerPorts = expandPortRange(container);
+    const hostPorts = host ? expandPortRange(host) : [];
+    if (!containerPorts)
       continue;
-    if (host && !/^\d+$/.test(host))
+    if (host && (!hostPorts || hostPorts.length !== containerPorts.length)) {
       continue;
-    mappings.push({ host, container });
+    }
+    for (let i = 0;i < containerPorts.length; i++) {
+      mappings.push({
+        host: hostPorts ? (hostPorts[i] ?? "").toString() : "",
+        container: containerPorts[i].toString()
+      });
+    }
   }
   return mappings;
 }
-function parseComposePorts(serviceBlock) {
-  const first = parseComposePortMappings(serviceBlock).find((m) => m.host);
+function expandPortRange(value) {
+  const match = value.match(/^(\d+)(?:-(\d+))?$/);
+  if (!match)
+    return null;
+  const start = Number(match[1]);
+  const end = Number(match[2] || match[1]);
+  if (!Number.isInteger(start) || !Number.isInteger(end) || start < 1 || end > 65535 || end < start) {
+    return null;
+  }
+  return Array.from({ length: end - start + 1 }, (_, idx) => start + idx);
+}
+function parseComposePorts(serviceBlock, composeDirEnv = {}) {
+  const first = parseComposePortMappings(serviceBlock, composeDirEnv).find((m) => m.host);
   return first?.host || null;
 }
-function parseComposeHostPortForContainer(serviceBlock, containerPort) {
-  const found = parseComposePortMappings(serviceBlock).find((m) => m.container === containerPort && m.host);
+function parseComposeHostPortForContainer(serviceBlock, containerPort, composeDirEnv = {}) {
+  const found = parseComposePortMappings(serviceBlock, composeDirEnv).find((m) => m.container === containerPort && m.host);
   return found?.host || null;
 }
 function parseComposeContainerPort(serviceBlock) {
@@ -5935,7 +6026,7 @@ function parseComposeContent(content, filepath, composeDir, cwd, composeDirEnv,
       continue;
     const defaultPort = defaultPortFor(kind, image, env);
     const serviceContainerPort = kind === "s3" ? defaultPort : containerPort || defaultPort;
-    const publishedHostPort = parseComposeHostPortForContainer(svcBlock, serviceContainerPort) || parseComposeHostPortForContainer(svcBlock, defaultPort) || parseComposePorts(svcBlock);
+    const publishedHostPort = parseComposeHostPortForContainer(svcBlock, serviceContainerPort, composeDirEnv) || parseComposeHostPortForContainer(svcBlock, defaultPort, composeDirEnv) || parseComposePorts(svcBlock, composeDirEnv);
     const hostPort = kind === "s3" ? publishedHostPort || undefined : publishedHostPort || defaultPort;
     const imageLabel = image ?? `build:${kind}`;
     const id = isRoot ? `docker:${svc.name}` : `docker:${svc.name}@${encodeURIComponent(relDirSlash)}`;
@@ -6672,6 +6763,37 @@ function textError(message, status) {
     }
   });
 }
+function waitForCallerAbort(promise, signal, message) {
+  if (!signal)
+    return promise;
+  if (signal.aborted)
+    return Promise.reject(abortError(message));
+  return new Promise((resolve2, reject) => {
+    let settled = false;
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      reject(abortError(message));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then((value) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      resolve2(value);
+    }, (err) => {
+      if (settled)
+        return;
+      settled = true;
+      cleanup();
+      reject(err);
+    });
+  });
+}
 async function resolveDockerExplorerAsync(cwd, dbParam, kind, cache, openFn, omitDirNames, signal) {
   if (!dbParam)
     return textError("missing db parameter", 400);
@@ -6681,10 +6803,26 @@ async function resolveDockerExplorerAsync(cwd, dbParam, kind, cache, openFn, omi
   const parsed = parseDockerDbId(dbParam);
   if (!parsed)
     return textError("invalid docker db id", 400);
-  const info = await findDockerServiceByDbIdAsync(cwd, dbParam, kind, omitDirNames, signal);
+  let info;
+  try {
+    info = await findDockerServiceByDbIdAsync(cwd, dbParam, kind, omitDirNames, signal);
+  } catch (err) {
+    if (isAbortLikeError(err, signal)) {
+      return textError(`${kind} lookup aborted`, 503);
+    }
+    throw err;
+  }
   if (!info)
     return textError(`${kind} service not found`, 404);
-  const explorer = await cache.getOrOpenAsync(dbParam, () => openFn(info));
+  let explorer;
+  try {
+    explorer = await waitForCallerAbort(cache.getOrOpenAsync(dbParam, () => openFn(info)), signal, `${kind} open aborted`);
+  } catch (err) {
+    if (isAbortLikeError(err, signal)) {
+      return textError(`${kind} open aborted`, 503);
+    }
+    throw err;
+  }
   return { dbId: dbParam, explorer };
 }
 async function dispatchRoutes(req, url, routes, sideEffectAllowed, wrap = (res) => res, handleRouteError) {
@@ -7591,6 +7729,31 @@ function s3ObjectName(key) {
 // web-src/server/database/adapters/s3.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash4, createHmac } from "node:crypto";
+function createS3RequestDeadline() {
+  const timeoutMs = s3RequestTimeoutMs;
+  return {
+    expiresAt: Date.now() + timeoutMs,
+    timeoutMs
+  };
+}
+function createS3DockerCurlDeadline() {
+  const timeoutMs = s3DockerCurlTimeoutMs;
+  return {
+    expiresAt: Date.now() + timeoutMs,
+    timeoutMs
+  };
+}
+function createS3TransportDeadline(config) {
+  return config.dockerContainerName ? createS3DockerCurlDeadline() : createS3RequestDeadline();
+}
+function s3TimeoutError(deadline) {
+  return new S3HttpError(503, `S3 request timed out after ${deadline?.timeoutMs ?? s3RequestTimeoutMs}ms`);
+}
+function remainingS3TimeoutMs(deadline) {
+  if (!deadline)
+    return s3RequestTimeoutMs;
+  return Math.max(0, deadline.expiresAt - Date.now());
+}
 function hmac(key, value) {
   return createHmac("sha256", key).update(value, "utf8").digest();
 }
@@ -7725,13 +7888,139 @@ function dockerCurlCommand(opts) {
     input: Buffer.from(curlHeaderConfig(opts.headers), "utf8")
   };
 }
+function guardedS3Transport(signal, operation, deadline) {
+  if (signal?.aborted) {
+    return Promise.reject(new S3HttpError(503, "S3 HTTP transport aborted"));
+  }
+  const timeoutMs = remainingS3TimeoutMs(deadline);
+  if (timeoutMs <= 0) {
+    return Promise.reject(s3TimeoutError(deadline));
+  }
+  const controller = new AbortController;
+  let timedOut = false;
+  let settled = false;
+  let timer;
+  let cleanupParent = () => {};
+  const abort = (err, reject) => {
+    if (settled)
+      return;
+    settled = true;
+    controller.abort(err);
+    reject(err);
+  };
+  const guarded = new Promise((resolve2, reject) => {
+    const onParentAbort = () => abort(new S3HttpError(503, "S3 HTTP transport aborted"), reject);
+    if (signal) {
+      signal.addEventListener("abort", onParentAbort, { once: true });
+      cleanupParent = () => signal.removeEventListener("abort", onParentAbort);
+    }
+    timer = setTimeout(() => {
+      timedOut = true;
+      abort(s3TimeoutError(deadline), reject);
+    }, timeoutMs);
+    operation(controller.signal).then((value) => {
+      if (settled)
+        return;
+      settled = true;
+      resolve2(value);
+    }, (err) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timedOut) {
+        reject(s3TimeoutError(deadline));
+      } else if (signal?.aborted) {
+        reject(new S3HttpError(503, "S3 HTTP transport aborted"));
+      } else {
+        reject(err);
+      }
+    });
+  });
+  return guarded.finally(() => {
+    if (timer)
+      clearTimeout(timer);
+    cleanupParent();
+  });
+}
+async function readStreamChunkWithTimeout(reader, signal, deadline) {
+  return guardedS3Transport(signal, (transportSignal) => {
+    const cancelRead = () => {
+      reader.cancel(transportSignal.reason).catch(() => {});
+    };
+    if (transportSignal.aborted) {
+      cancelRead();
+    } else {
+      transportSignal.addEventListener("abort", cancelRead, { once: true });
+    }
+    return reader.read().finally(() => {
+      transportSignal.removeEventListener("abort", cancelRead);
+    });
+  }, deadline);
+}
+async function readResponseBytesWithTimeout(res, signal, deadline) {
+  if (!res.body)
+    return new Uint8Array;
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (;; ) {
+      const { done, value } = await readStreamChunkWithTimeout(reader, signal, deadline);
+      if (done)
+        break;
+      if (!value?.byteLength)
+        continue;
+      chunks.push(value);
+      total += value.byteLength;
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {}
+  }
+  if (chunks.length === 1)
+    return chunks[0];
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+async function readResponseTextWithTimeout(res, signal, deadline) {
+  return new TextDecoder("utf-8", { fatal: false }).decode(await readResponseBytesWithTimeout(res, signal, deadline));
+}
+function timeoutReadableStream(body, signal) {
+  if (!body)
+    return null;
+  const reader = body.getReader();
+  return new ReadableStream({
+    async pull(controller) {
+      try {
+        const { done, value } = await readStreamChunkWithTimeout(reader, signal);
+        if (done) {
+          controller.close();
+          return;
+        }
+        if (value)
+          controller.enqueue(value);
+      } catch (error) {
+        controller.error(error);
+      }
+    },
+    cancel(reason) {
+      return reader.cancel(reason);
+    }
+  });
+}
 async function dockerCurlFetch(opts) {
   const { args, input } = dockerCurlCommand(opts);
   if (spawnSyncImplIsTestOverride) {
     const proc2 = spawnSyncImpl3("docker", args, {
       encoding: "buffer",
       input,
-      timeout: 30000,
+      timeout: s3DockerCurlTimeoutMs,
       stdio: ["pipe", "pipe", "pipe"]
     });
     if ((proc2.status ?? 1) !== 0) {
@@ -7747,10 +8036,10 @@ async function dockerCurlFetch(opts) {
     command: "docker",
     args,
     input,
-    timeoutMs: 30000,
+    timeoutMs: s3DockerCurlTimeoutMs,
     signal: opts.signal,
     abortMessage: "S3 HTTP transport aborted",
-    timeoutMessage: "docker exec curl timed out"
+    timeoutMessage: `docker exec curl timed out after ${s3DockerCurlTimeoutMs}ms`
   });
   if (proc.code !== 0) {
     const stderr = new TextDecoder().decode(proc.stderr).replace(/\s+/g, " ").trim();
@@ -7824,73 +8113,77 @@ function parseObjects(xml) {
   };
 }
 function createS3Adapter(config) {
-  async function signedFetch(opts) {
-    const endpoint = new URL(config.endpoint);
-    const { dateStamp, amzDate: requestDate } = amzDate();
-    const path = buildPath(opts.bucket, opts.key);
-    const query = canonicalQuery(opts.query);
-    const url = `${config.endpoint.replace(/\/$/, "")}${path}${query ? `?${query}` : ""}`;
-    const headers = {
-      host: endpoint.host,
-      "x-amz-content-sha256": EMPTY_SHA256,
-      "x-amz-date": requestDate,
-      ...config.sessionToken ? { "x-amz-security-token": config.sessionToken } : {},
-      ...opts.headers || {}
-    };
-    const signedNames = signedHeadersString(headers);
-    const canonicalRequest = [
-      opts.method,
-      path,
-      query,
-      canonicalHeaders(headers),
-      signedNames,
-      EMPTY_SHA256
-    ].join(`
+  async function signedFetch(opts, deadline = createS3TransportDeadline(config)) {
+    return guardedS3Transport(opts.signal, (transportSignal) => {
+      const endpoint = new URL(config.endpoint);
+      const { dateStamp, amzDate: requestDate } = amzDate();
+      const path = buildPath(opts.bucket, opts.key);
+      const query = canonicalQuery(opts.query);
+      const url = `${config.endpoint.replace(/\/$/, "")}${path}${query ? `?${query}` : ""}`;
+      const headers = {
+        host: endpoint.host,
+        "x-amz-content-sha256": EMPTY_SHA256,
+        "x-amz-date": requestDate,
+        ...config.sessionToken ? { "x-amz-security-token": config.sessionToken } : {},
+        ...opts.headers || {}
+      };
+      const signedNames = signedHeadersString(headers);
+      const canonicalRequest = [
+        opts.method,
+        path,
+        query,
+        canonicalHeaders(headers),
+        signedNames,
+        EMPTY_SHA256
+      ].join(`
 `);
-    const scope = `${dateStamp}/${config.region}/s3/aws4_request`;
-    const stringToSign = [
-      "AWS4-HMAC-SHA256",
-      requestDate,
-      scope,
-      sha256(canonicalRequest)
-    ].join(`
+      const scope = `${dateStamp}/${config.region}/s3/aws4_request`;
+      const stringToSign = [
+        "AWS4-HMAC-SHA256",
+        requestDate,
+        scope,
+        sha256(canonicalRequest)
+      ].join(`
 `);
-    const signature = createHmac("sha256", signingKey(config.secretAccessKey, dateStamp, config.region)).update(stringToSign, "utf8").digest("hex");
-    const requestHeaders = new Headers;
-    for (const [key, value] of Object.entries(headers)) {
-      if (key !== "host")
-        requestHeaders.set(key, value);
-    }
-    requestHeaders.set("Authorization", `AWS4-HMAC-SHA256 Credential=${config.accessKeyId}/${scope}, SignedHeaders=${signedNames}, Signature=${signature}`);
-    if (config.dockerContainerName) {
-      if (opts.method === "GET" && opts.key && !opts.headers?.range && !opts.headers?.Range) {
-        throw new S3HttpError(503, "S3 raw streaming requires a published host port or a ranged request");
+      const signature = createHmac("sha256", signingKey(config.secretAccessKey, dateStamp, config.region)).update(stringToSign, "utf8").digest("hex");
+      const requestHeaders = new Headers;
+      for (const [key, value] of Object.entries(headers)) {
+        if (key !== "host")
+          requestHeaders.set(key, value);
       }
-      return dockerCurlFetch({
-        containerName: config.dockerContainerName,
+      requestHeaders.set("Authorization", `AWS4-HMAC-SHA256 Credential=${config.accessKeyId}/${scope}, SignedHeaders=${signedNames}, Signature=${signature}`);
+      if (config.dockerContainerName) {
+        if (opts.method === "GET" && opts.key && !opts.headers?.range && !opts.headers?.Range) {
+          throw new S3HttpError(503, "S3 raw streaming requires a published host port or a ranged request");
+        }
+        return dockerCurlFetch({
+          containerName: config.dockerContainerName,
+          method: opts.method,
+          url,
+          headers: requestHeaders,
+          signal: transportSignal
+        });
+      }
+      return fetch(url, {
         method: opts.method,
-        url,
         headers: requestHeaders,
-        signal: opts.signal
+        signal: transportSignal
       });
-    }
-    return fetch(url, {
-      method: opts.method,
-      headers: requestHeaders,
-      signal: opts.signal
-    });
+    }, deadline);
   }
-  async function textOrThrow(res) {
-    const text = await res.text();
+  async function textOrThrow(res, signal, deadline) {
+    const text = await readResponseTextWithTimeout(res, signal, deadline);
     if (!res.ok)
       throw sanitizeS3Error(res.status, text);
     return text;
   }
   async function listBuckets(signal) {
-    const xml = await textOrThrow(await signedFetch({ method: "GET", signal }));
+    const deadline = createS3TransportDeadline(config);
+    const xml = await textOrThrow(await signedFetch({ method: "GET", signal }, deadline), signal, deadline);
     return parseBuckets(xml);
   }
   async function listObjects(opts) {
+    const deadline = createS3TransportDeadline(config);
     const xml = await textOrThrow(await signedFetch({
       method: "GET",
       bucket: opts.bucket,
@@ -7901,32 +8194,34 @@ function createS3Adapter(config) {
         ...opts.continuationToken ? { "continuation-token": opts.continuationToken } : {}
       },
       signal: opts.signal
-    }));
+    }, deadline), opts.signal, deadline);
     return parseObjects(xml);
   }
   async function headObject(opts) {
+    const deadline = createS3TransportDeadline(config);
     const res = await signedFetch({
       method: "HEAD",
       bucket: opts.bucket,
       key: opts.key,
       signal: opts.signal
-    });
+    }, deadline);
     if (!res.ok)
-      throw sanitizeS3Error(res.status, await res.text());
+      throw sanitizeS3Error(res.status, await readResponseTextWithTimeout(res, opts.signal, deadline));
     return headFromObjectResponse(opts.bucket, opts.key, res);
   }
   async function getObjectText(opts) {
     const maxBytes = Math.min(1024 * 1024, Math.max(1, opts.maxBytes ?? 512 * 1024));
+    const deadline = createS3TransportDeadline(config);
     const res = await signedFetch({
       method: "GET",
       bucket: opts.bucket,
       key: opts.key,
       headers: { range: `bytes=0-${maxBytes - 1}` },
       signal: opts.signal
-    });
+    }, deadline);
     if (!res.ok && res.status !== 206)
-      throw sanitizeS3Error(res.status, await res.text());
-    const bytes = new Uint8Array(await res.arrayBuffer());
+      throw sanitizeS3Error(res.status, await readResponseTextWithTimeout(res, opts.signal, deadline));
+    const bytes = await readResponseBytesWithTimeout(res, opts.signal, deadline);
     const head = headFromObjectResponse(opts.bucket, opts.key, res);
     const fullSize = head.sizeBytes;
     return {
@@ -7936,17 +8231,18 @@ function createS3Adapter(config) {
     };
   }
   async function getObjectResponse(opts) {
+    const deadline = createS3TransportDeadline(config);
     const res = await signedFetch({
       method: opts.method,
       bucket: opts.bucket,
       key: opts.key,
       headers: opts.range ? { range: opts.range } : undefined,
       signal: opts.signal
-    });
+    }, deadline);
     if (!res.ok && res.status !== 206) {
-      throw sanitizeS3Error(res.status, await res.text());
+      throw sanitizeS3Error(res.status, await readResponseTextWithTimeout(res, opts.signal, deadline));
     }
-    return new Response(opts.method === "HEAD" ? null : res.body, {
+    return new Response(opts.method === "HEAD" ? null : timeoutReadableStream(res.body, opts.signal), {
       status: res.status,
       headers: rawObjectHeaders(opts.key, res)
     });
@@ -7966,6 +8262,9 @@ async function s3ConfigFromDockerInfoAsync(info, signal) {
   const image = info.image?.toLowerCase() || "";
   const minioDefault = image.includes("minio");
   const env = info.env;
+  if (!info.hostPort && minioDefault) {
+    throw new S3HttpError(503, 'MinIO S3 browsing requires a published host port. Add a compose port mapping like "9000:9000" for the MinIO API.');
+  }
   const dockerContainerName = info.hostPort ? undefined : await resolveRunningComposeContainerNameOrThrowAsync(info.serviceName, info.composeDir, signal);
   return {
     endpoint: info.hostPort ? `http://localhost:${info.hostPort}` : `http://127.0.0.1:${info.containerPort}`,
@@ -7982,7 +8281,7 @@ async function openS3ExplorerAsync(info, signal) {
 function isS3HttpError(err) {
   return err instanceof S3HttpError;
 }
-var spawnSyncImpl3, spawnSyncImplIsTestOverride = false, S3HttpError, EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+var spawnSyncImpl3, spawnSyncImplIsTestOverride = false, S3HttpError, EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", DEFAULT_S3_REQUEST_TIMEOUT_MS = 5000, DEFAULT_S3_DOCKER_CURL_TIMEOUT_MS = 30000, s3RequestTimeoutMs, s3DockerCurlTimeoutMs;
 var init_s3 = __esm(() => {
   init_raw_file_headers();
   init_docker_utils();
@@ -7995,6 +8294,8 @@ var init_s3 = __esm(() => {
       this.status = status;
     }
   };
+  s3RequestTimeoutMs = DEFAULT_S3_REQUEST_TIMEOUT_MS;
+  s3DockerCurlTimeoutMs = DEFAULT_S3_DOCKER_CURL_TIMEOUT_MS;
 });
 
 // web-src/server/database/handle-s3.ts
@@ -10889,6 +11190,13 @@ function handleSettings() {
     }
   });
 }
+function worktreeWatchDirectoryLimitFromEnv() {
+  const raw = process.env.CODE_VIEWER_WORKTREE_WATCH_LIMIT;
+  if (!raw)
+    return DEFAULT_WORKTREE_WATCH_DIRECTORY_LIMIT;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : DEFAULT_WORKTREE_WATCH_DIRECTORY_LIMIT;
+}
 function handleFiles2(url) {
   const target = url.searchParams.get("ref") || url.searchParams.get("target") || "worktree";
   if (target !== "worktree" && !verifyTreeRef(target, cwd))
@@ -12237,6 +12545,7 @@ data: ok
     excludeNames: scopeExcludeNames,
     watch,
     initialScanMode: "async",
+    maxWatchedDirectories: worktreeWatchDirectoryLimitFromEnv(),
     onUpdate: triggerUpdate,
     onError: (error) => {
       const message = error instanceof Error ? error.message : String(error);