fix: land the timeout-audit review fixes for the merged #63

crates/app-server/src/chat_completions.rs

@@ -390,6 +390,13 @@ pub(crate) async fn chat_completions_handler(
     // Build upstream request. The shared platform builder sets no timeouts,
     // so the proxy would hang forever on an accept-and-stall upstream;
     // bound both the connect and the whole non-streaming round trip.
+    //
+    // `config` (the read guard) is dropped here on purpose: everything it
+    // feeds is resolved by now, and holding it across the upstream round
+    // trip (up to UPSTREAM_TOTAL_TIMEOUT) would block config writes and,
+    // through the write-preferring lock, every later resolve for that
+    // whole window.
+    drop(config);
     let upstream_req = codewhale_release::platform_http_client_builder()
         .connect_timeout(UPSTREAM_CONNECT_TIMEOUT)
         .timeout(UPSTREAM_TOTAL_TIMEOUT)

crates/cli/src/update.rs

@@ -32,9 +32,9 @@ const GITHUB_RELEASE_DOWNLOAD_BASE_URL: &str =
 const UPDATE_HTTP_ATTEMPTS: usize = 3;
 const UPDATE_HTTP_RETRY_DELAY_MS: u64 = 100;
 /// Ceiling for one asset download. Release binaries are tens of megabytes
-/// and some of the networks this exists for are slow: 600s covers a full
-/// 60 MiB at ~100 KiB/s (the same download budget the audit gives skill
-/// tarballs; the old 300s needed an implausible >1.6 Mbps to finish).
+/// and some of the networks this exists for are slow: 600s covers ~58 MiB
+/// at ~100 KiB/s (the same download budget the audit gives skill tarballs;
+/// the old 300s needed an implausible >1.6 Mbps to finish).
 const UPDATE_DOWNLOAD_TIMEOUT: Duration = Duration::from_secs(600);
 /// Ceiling for one checksum-manifest probe. The manifest is a few hundred
 /// bytes, so this is only a backstop against a source that accepts the

crates/core/src/lib.rs

@@ -43,7 +43,19 @@ use uuid::Uuid;
 /// Per-tool dispatch budget for the headless runtime. 30 minutes: tools
 /// legitimately run long (builds, test suites, MCP-backed calls), and this
 /// wrapper is a runaway backstop, not an expected duration — the previous
-/// 300s value cut off healthy in-flight tool work.
+/// 300s value cut off healthy in-flight tool work. Part of the 1800s family
+/// (TUI client envelope, vision request envelope, model stream cap
+/// `STREAM_MAX_DURATION_SECS`, dynamic-tool result wait, sub-agent tool
+/// timeout, MCP execute timeout, the mirrors in app-server and the MCP stdio
+/// proxy, the background-task wall clock `TaskExecutionLimits::wall_time`,
+/// the sub-agent `default_wall_time_secs`, and the fleet `builder` role
+/// preset) that comments keep in sync; this comment anchors the family
+/// roster — there is no shared constant across the crates yet.
+///
+/// Several family members are configurable defaults rather than constants
+/// (`STREAM_MAX_DURATION_SECS`, the MCP `execute_timeout`, and the sub-agent
+/// `default_wall_time_secs`): a family-wide bump changes their defaults, not
+/// their ceilings, and user overrides survive it.
 fn tool_dispatch_timeout() -> Duration {
     if cfg!(test) {
         Duration::from_millis(50)

crates/mcp/src/stdio_client.rs

@@ -757,6 +757,12 @@ struct Connection {
 
 impl Connection {
     fn send(&mut self, message: &Value) -> Result<()> {
+        // Known unbounded leg (deliberate, disclosed debt): the write below
+        // is blocking std I/O while the connection mutex is held, so a
+        // server that never drains its stdin can park this leg past every
+        // budget — unlike the read leg, which `request_with_timeout`
+        // bounds. Fixing it needs an async or threaded writer and is
+        // tracked as follow-up scale, not silently assumed safe.
         let stdin = self
             .stdin
             .as_ref()
@@ -899,6 +905,26 @@ impl Drop for Connection {
     }
 }
 
+#[cfg(test)]
+mod budget_pins {
+    // The engine-side stdio proxy has no behavioral timeout tests (the
+    // budgets are compile-time constants), so pin the wiring values: a
+    // drift here silently re-bounds every MCP `tools/call` the engine
+    // proxy carries. CALL_TOOL_TIMEOUT must mirror the TUI pool's default
+    // execute timeout (1800s), and the generic request budget must stay
+    // separate and much shorter.
+    use super::{CALL_TOOL_TIMEOUT, HANDSHAKE_TIMEOUT, REQUEST_TIMEOUT};
+    use std::time::Duration;
+
+    #[test]
+    fn call_tool_budget_mirrors_the_pool_default_and_stays_separate() {
+        assert_eq!(CALL_TOOL_TIMEOUT, Duration::from_secs(1800));
+        assert_eq!(REQUEST_TIMEOUT, Duration::from_secs(120));
+        assert!(CALL_TOOL_TIMEOUT > REQUEST_TIMEOUT);
+        assert_eq!(HANDSHAKE_TIMEOUT, Duration::from_secs(30));
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use std::collections::HashMap;