fix(tools): disarm Bun's fetch idle timer instead of passing a numeric deadline

icecrasher321 · claude · icecrasher321 · commit d8509ffbe90a · 2026-08-11T11:24:56.000-07:00
Bun 1.3.14 ignores a positive numeric `timeout` on fetch and honors only the
boolean/zero form, so passing the plan deadline through changed nothing and
internal tool calls still died at the 300s default. Verified against the pinned
runtime: `{ timeout: 1000 }` does not abort a request that takes 3s to answer,
and `BUN_CONFIG_HTTP_IDLE_TIMEOUT` has no effect either — both are `main`-only.

The caller on this path already arms an AbortController with the plan timeout,
so the transport timer is disarmed rather than re-negotiated, leaving one
enforcement point instead of two that disagree.

Co-Authored-By: Claude Opus 5 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/apps/sim/lib/core/utils/fetch-deadline.test.ts b/apps/sim/lib/core/utils/fetch-deadline.test.ts
@@ -2,37 +2,30 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import { isTransportTimeoutError, withFetchDeadline } from '@/lib/core/utils/fetch-deadline'
+import { isTransportTimeoutError, withCallerOwnedDeadline } from '@/lib/core/utils/fetch-deadline'
 
-describe('withFetchDeadline', () => {
-  it('states the caller deadline as the transport deadline', () => {
-    expect(withFetchDeadline({ method: 'POST' }, 3_000_000).timeout).toBe(3_000_000)
+describe('withCallerOwnedDeadline', () => {
+  /*
+   * The pinned Bun ignores a positive numeric `timeout` and honors only the
+   * boolean/zero form, so anything other than `false` here silently leaves the
+   * 300s default in force — which is the outage this module exists to prevent.
+   */
+  it('disarms the transport timer rather than negotiating a value', () => {
+    expect(withCallerOwnedDeadline({}).timeout).toBe(false)
   })
 
   it('preserves the init the caller already built', () => {
     const signal = new AbortController().signal
-    const init = withFetchDeadline({ method: 'POST', body: 'x', signal }, 1000)
+    const init = withCallerOwnedDeadline({ method: 'POST', body: 'x', signal })
     expect(init.method).toBe('POST')
     expect(init.body).toBe('x')
     expect(init.signal).toBe(signal)
   })
 
-  it('rounds a fractional deadline up rather than down', () => {
-    expect(withFetchDeadline({}, 1500.2).timeout).toBe(1501)
-  })
-
-  /*
-   * The bug this module exists for: an absent application deadline must disable
-   * the transport timer, never fall back to the runtime's 300s default.
-   */
-  it.each([
-    ['undefined', undefined],
-    ['zero', 0],
-    ['negative', -1],
-    ['Infinity', Number.POSITIVE_INFINITY],
-    ['NaN', Number.NaN],
-  ])('disables the transport timer when the deadline is %s', (_label, deadline) => {
-    expect(withFetchDeadline({}, deadline as number | undefined).timeout).toBe(false)
+  it('does not mutate the caller’s init', () => {
+    const original: RequestInit = { method: 'POST' }
+    withCallerOwnedDeadline(original)
+    expect('timeout' in original).toBe(false)
   })
 })
 
diff --git a/apps/sim/lib/core/utils/fetch-deadline.ts b/apps/sim/lib/core/utils/fetch-deadline.ts
@@ -1,49 +1,54 @@
 /**
  * Keeps the transport deadline from undercutting the application deadline.
  *
- * Bun's HTTP client arms an idle timer defaulting to 300s. It re-arms on writes
- * and body-phase reads, but *not* on response-header reads — so it is an
- * absolute deadline for the peer to begin answering. An `AbortSignal` cannot
- * raise it, which makes it invisible to every caller that believes it owns the
- * deadline: a request whose peer legitimately works before it replies dies at
- * five minutes no matter what timeout was computed for it.
+ * Bun's HTTP client arms an idle timer defaulting to 300s. It is not raised by
+ * an `AbortSignal`, and it does not re-arm while awaiting response headers, so
+ * it acts as an absolute deadline for the peer to begin answering. Any request
+ * whose peer legitimately works before it replies dies at five minutes no
+ * matter what deadline the caller computed for it.
  *
  * This bit production. Workflow function blocks are bounded by a plan deadline
  * (50 minutes on enterprise), but the executor's call into the internal
  * function route inherited Bun's default instead, so every sandbox run longer
  * than five minutes failed with a bare `fetch failed` that read as user-code
  * failure rather than a transport cap.
  *
+ * The timer is therefore disarmed rather than re-negotiated: callers on this
+ * path already own an in-process deadline (an `AbortController` armed with the
+ * plan timeout), and a second, shorter, invisible deadline underneath it is
+ * exactly the bug. Disarming leaves one enforcement point instead of two that
+ * disagree.
+ *
+ * Note the pinned runtime accepts only the boolean/zero form. Bun 1.3.14
+ * ignores a positive numeric `timeout` — verified against the pinned version by
+ * observing that `{ timeout: 1000 }` does not abort a request that takes 3s to
+ * answer — so passing the deadline as a number silently changes nothing. The
+ * numeric idle-deadline form exists only on Bun's `main`. Do not "improve" this
+ * to pass the deadline through until the pinned version supports it, and
+ * re-verify with that probe if you do.
+ *
  * Node's undici has no equivalent default and ignores the option, so this is
  * safe on both runtimes.
  */
 
 /**
  * `RequestInit` plus Bun's idle-timeout control, which the DOM lib does not
- * declare. `false` disables the timer entirely; a positive number is the idle
- * deadline in milliseconds.
+ * declare. `false` disarms the timer; `true` or omitted keeps the default.
  */
 export interface DeadlineRequestInit extends RequestInit {
   timeout?: number | boolean
 }
 
 /**
- * Applies `deadlineMs` as the transport idle deadline alongside whatever
- * `AbortSignal` the caller already set, so both layers express one number.
+ * Disarms the transport idle timer so the caller's own deadline is the only one
+ * in force.
  *
- * Pass the same deadline the caller enforces in-process. A non-finite or
- * non-positive deadline means "no application bound", which disables the
- * transport timer rather than silently falling back to Bun's 300s default —
- * falling back is what produced the bug this exists to prevent.
+ * Only use this where the caller genuinely enforces a deadline in-process —
+ * an `AbortSignal` wired to a timer or an execution budget. Without one, a
+ * request to a peer that never answers would hang until the socket dies.
  */
-export function withFetchDeadline(
-  init: RequestInit,
-  deadlineMs: number | undefined
-): DeadlineRequestInit {
-  if (deadlineMs === undefined || !Number.isFinite(deadlineMs) || deadlineMs <= 0) {
-    return { ...init, timeout: false }
-  }
-  return { ...init, timeout: Math.ceil(deadlineMs) }
+export function withCallerOwnedDeadline(init: RequestInit): DeadlineRequestInit {
+  return { ...init, timeout: false }
 }
 
 /**
diff --git a/apps/sim/tools/index.ts b/apps/sim/tools/index.ts
@@ -24,7 +24,7 @@ import {
   validateUrlWithDNS,
 } from '@/lib/core/security/input-validation.server'
 import { PlatformEvents } from '@/lib/core/telemetry'
-import { isTransportTimeoutError, withFetchDeadline } from '@/lib/core/utils/fetch-deadline'
+import { isTransportTimeoutError, withCallerOwnedDeadline } from '@/lib/core/utils/fetch-deadline'
 import { HttpError } from '@/lib/core/utils/http-error'
 import { generateRequestId } from '@/lib/core/utils/request'
 import {
@@ -2444,17 +2444,19 @@ async function executeToolRequest(
 
           const attemptStartedAt = Date.now()
           try {
+            /*
+             * `controller` above is armed with `timeout`, so the plan deadline is
+             * already enforced in-process; the transport timer is disarmed so its
+             * 300s default cannot undercut it.
+             */
             const internalResponse = await fetch(
               fullUrl,
-              withFetchDeadline(
-                {
-                  method: requestParams.method,
-                  headers: headers,
-                  body: requestParams.body,
-                  signal: controller.signal,
-                },
-                timeout
-              )
+              withCallerOwnedDeadline({
+                method: requestParams.method,
+                headers: headers,
+                body: requestParams.body,
+                signal: controller.signal,
+              })
             )
             if (
               nullBodyStatuses.has(internalResponse.status) ||
