Summary
runAgent() (src/server/api/gitagent.ts) awaits the model stream with no
deadline and no AbortSignal, so a stalled Lyzr response never resolves and
never throws. The request — and, via the run engine, the journey stage — hangs
indefinitely, and the server-side call leaks.
Evidence
src/server/api/gitagent.ts
- L279-289 —
query({ … }) is called with no timeout/abort.
- L283 —
replaceBuiltinTools: true (single-shot, no tools).
- L284 —
maxTurns: 1.
- L295 — the response is consumed with an unbounded
for await (const msg of result).
- L214-241 —
opts exposes no signal / timeoutMs, so callers can't bound it either.
SDK @open-gitagent/gitagent/dist
sdk.js:62 — query()'s AbortController defaults to a fresh one and is only
fired by a manual generator.abort() (sdk.js:522). There is no wall-clock
timer. runAgent never calls .abort() and sets no timer.
Why the existing runtime.timeout does NOT cover this
Every agent.yaml declares runtime: { timeout: 180 }, which looks like it
bounds a run — it does not. That value is only used as the built-in CLI/sandbox
tools' per-command timeout, and only when built-in tools are enabled:
- SDK
sdk.js:135-137
if (!options.replaceBuiltinTools) {
tools = createBuiltinTools({ dir, timeout: loaded.manifest.runtime.timeout, ... });
}
Summary
runAgent()(src/server/api/gitagent.ts) awaits the model stream with nodeadline and no
AbortSignal, so a stalled Lyzr response never resolves andnever throws. The request — and, via the run engine, the journey stage — hangs
indefinitely, and the server-side call leaks.
Evidence
src/server/api/gitagent.tsquery({ … })is called with no timeout/abort.replaceBuiltinTools: true(single-shot, no tools).maxTurns: 1.for await (const msg of result).optsexposes nosignal/timeoutMs, so callers can't bound it either.SDK
@open-gitagent/gitagent/distsdk.js:62—query()'s AbortController defaults to a fresh one and is onlyfired by a manual
generator.abort()(sdk.js:522). There is no wall-clocktimer.
runAgentnever calls.abort()and sets no timer.Why the existing
runtime.timeoutdoes NOT cover thisEvery
agent.yamldeclaresruntime: { timeout: 180 }, which looks like itbounds a run — it does not. That value is only used as the built-in CLI/sandbox
tools' per-command timeout, and only when built-in tools are enabled:
sdk.js:135-137