dsh-unlag 1.9.114 → 1.9.116

package/index.js

@@ -100,15 +100,19 @@ const MAX_STARTUP_ROW_CHARS = 8192
  * The largest one startup script may be before a check refuses it. The app serves a whole profile as
  * a few bundles, and those grow with every installed plugin: one profile's largest bundle measured
  * 8.7 MB, which a smaller bound refused as if it were an attack and left the page unrebuildable.
- * A body past this bound is a mistake or an attempt to make a check read (and compile) an unbounded
- * amount of text inside the process that owns every running turn.
+ * Compiling a body costs several times its size in memory before it is thrown away, and up to three
+ * checks may run at once, so the bound is set close to what a profile actually serves: this one
+ * measured 15.7 MB across three bundles, its largest 9.2 MB. A body past 24 MB is not a profile
+ * this app ships with, and reading one would let a request make the process that owns every running
+ * turn hold text no page boots from.
  */
-const MAX_SCRIPT_BYTES = 64 * 1024 * 1024
+const MAX_SCRIPT_BYTES = 24 * 1024 * 1024
 /**
- * The same bound for one whole startup list, so a list of large bodies cannot add up either. Only
- * the compile happens under it: what a check keeps per body is the ids it names, never its text.
+ * The same bound for one whole startup list, so a list of large bodies cannot add up either. Two
+ * measured profiles' worth: what a check keeps per body is the ids it names, never its text, so
+ * the whole list's transient text is what this bounds.
  */
-const MAX_TOTAL_SCRIPT_BYTES = 128 * 1024 * 1024
+const MAX_TOTAL_SCRIPT_BYTES = 48 * 1024 * 1024
 /**
  * How large the request that carries the list may be. The list itself is bounded (64 addresses of at
  * most 8 KB, plus JSON escaping), so a bound below that would refuse a sound startup list from a
@@ -1710,11 +1714,14 @@ export async function verifyStartupRows(graph, fetchBody, rows, budgetMs = MAX_V
     for (const id of item.ids) if (served.has(id)) listed.add(id)
     for (const id of item.ids) if (!served.has(id)) leftOut.add(id)
     let response = null
-    try {
-      response = await fetchBody(item.url)
-    } catch (error) {
-      return { status: 'blocked', reason: 'network', detail: `${item.url}: ${String(error?.message ?? error)}` }
+    const read = await withDeadline(() => fetchBody(item.url), budgetMs - (Date.now() - began))
+    if (read.timedOut === true) {
+      return { status: 'blocked', reason: 'slow', detail: `${item.url} did not answer within the time this check waits` }
+    }
+    if ('error' in read) {
+      return { status: 'blocked', reason: 'network', detail: `${item.url}: ${String(read.error?.message ?? read.error)}` }
     }
+    response = read.value
     // Reading the answer is the same kind of step as fetching it: a response whose status or body
     // cannot be read is one this check cannot approve, and saying which script failed beats
     // abandoning the whole list without a name in the reason.
@@ -1822,6 +1829,27 @@ export async function verifyStartup(clientModules, rows) {
   return verifyStartupRows(graph, (url) => readStartupScript(clientModules, url), rows)
 }
 
+/** The sentinel a read that ran past its time resolves to: a value, never an error. */
+const LATE = Symbol('late')
+
+/**
+ * One read the check will not wait past. The budget is counted between rows already; a single
+ * address that never answers would otherwise hold the press past the moment the page stops waiting
+ * for it, and the page would be told the check timed out with nothing naming what hung. Racing the
+ * read keeps the reason the check's own, and the read itself is left to finish with its bytes
+ * dropped, so nothing is left half-read.
+ */
+async function withDeadline(work, ms) {
+  let timer = null
+  const late = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(LATE), Math.max(0, ms))
+  })
+  const settled = Promise.resolve().then(work).then((value) => ({ value }), (error) => ({ error }))
+  const answer = await Promise.race([settled, late])
+  if (timer !== null) clearTimeout(timer)
+  return answer === LATE ? { timedOut: true } : answer
+}
+
 /** What one press is told when the update it waits for did not answer in time. */
 const STILL_APPLYING = Object.freeze({ status: 'applying', warnings: [], pending: [], restartReason: null, failedEntries: [] });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.9.114",
+  "version": "1.9.116",
   "type": "module",
   "description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
   "license": "MIT",