mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-16 09:38:41 +00:00
99c926b7bb
* fix: bound MCP server bring-up timeouts and exclude externalized tool outputs from delivery verification Two related robustness fixes: 1. MCP server bring-up was unbounded. tool_call_timeout only covered session.call_tool(); tool discovery (subprocess spawn + initialize + tools/list) and persistent stdio session initialization could hang forever, blocking agent construction (and on the Gateway event loop, the whole process). Add a per-server session_init_timeout (default DEFAULT_MCP_SESSION_INIT_TIMEOUT = 60s, null disables) that bounds both discovery and pooled-session initialization. The session pool's existing cancellation handling tears down a session stuck mid-creation in its own task. 2. ToolOutputBudgetMiddleware externalizes oversized tool outputs into outputs/.tool-results/ (configurable tool_output.storage_subdir). The workspace-change scanner and run delivery verification counted those files as produced artifacts, so any run that externalized a tool output without also presenting a real artifact failed with "Artifact delivery incomplete". Exclude TOOL_RESULTS_DIRNAME via a shared constant (mirroring BROWSER_FRAMES_DIRNAME) and thread the configured storage_subdir through snapshot capture so both workspace-changes events and delivery verification stay clean. * review: enforce single-segment tool_output.storage_subdir; document discovery-timeout cleanup Address review feedback: 1. A custom tool_output.storage_subdir with a path separator (e.g. cache/tool-results) silently no-oped the workspace-scanner exclusion: os.walk yields one-segment dirnames, so a nested value never matched and its files were counted as produced artifacts again. ToolOutputConfig now validates storage_subdir as a single directory name (rejects separators, .., absolute, empty) with tests, so the exclusion is always sound. 2. The discovery-timeout path now documents why cancellation is safe, mirroring the session-init note: discovery runs inside the adapter's nested async context managers, and stdio_client's finally terminates the process tree (SIGTERM->SIGKILL on POSIX, process-tree on Windows), so a timed-out npx subprocess and its children are reaped rather than accumulating. * review: log session-init timeouts and align API response model default with runtime config Address second-round review feedback: 1. A session-init timeout raised TimeoutError without any log, unlike the discovery timeout which logs a WARNING. Wrap the bounded get_session in a try/except that logs the timeout (server name + seconds) and re-raises, so operators can diagnose tool-call failures caused by hung MCP sessions. 2. McpServerConfigResponse.session_init_timeout defaulted to None while McpServerConfig defaults to 60s: a server created via PUT /api/mcp/config without the field was persisted with null (no timeout) while the same server created in the config file got 60s. Align the response-model default to DEFAULT_MCP_SESSION_INIT_TIMEOUT so API-created and file-created servers behave the same; an explicit null still opts out. * review: narrow the discovery-timeout handler to the bounded wait_for path The except TimeoutError clause covered both the bounded wait_for branch and the bare discovery branch. With session_init_timeout opted out (None), a TimeoutError raised by discovery itself would hit the %.1f format with None: logging raises TypeError internally, the WARNING is silently dropped, and a --- Logging error --- traceback goes to stderr. Narrow the handler to wrap only the wait_for call, where the branch condition guarantees the timeout value is not None. A discovery-internal TimeoutError on the opted-out path now falls through to the generic failure handler and is reported as 'tool discovery failed' with exc_info. Covered by a regression test that asserts the skip is reported without any broken format.
41 lines
2.2 KiB
Python
41 lines
2.2 KiB
Python
"""Shared runtime protocol constants."""
|
|
|
|
DEFAULT_SKILLS_CONTAINER_PATH = "/mnt/skills"
|
|
|
|
# Hidden subdirectory (under a thread's outputs dir) that holds the browser
|
|
# tools' per-step screenshots. These are transient live-progress frames, not
|
|
# deliverables, so the workspace-changes scanner excludes this directory. Both
|
|
# the browser tools (which write here) and the scanner (which ignores it) import
|
|
# this single source of truth so the name cannot drift between them.
|
|
BROWSER_FRAMES_DIRNAME = ".browser-frames"
|
|
|
|
# Default subdirectory (under a thread's outputs dir) where the tool-output
|
|
# budget middleware persists oversized tool outputs. These are process
|
|
# feedback the model reads back via ``read_file`` (the budget preview carries
|
|
# the reference), not deliverables, so the workspace-changes scanner excludes
|
|
# this directory and run delivery verification never counts it as a produced
|
|
# artifact. Both the budget middleware's default ``storage_subdir`` and the
|
|
# scanner import this single source of truth so the name cannot drift between
|
|
# them; a custom configured ``storage_subdir`` is threaded through the
|
|
# snapshot capture as an extra excluded dir name.
|
|
TOOL_RESULTS_DIRNAME = ".tool-results"
|
|
|
|
# Default timeout (seconds) for MCP server bring-up: tool discovery (subprocess
|
|
# spawn + initialize + tools/list) and persistent-session initialization. A hung
|
|
# stdio server (e.g. npx blocked on a package download or a server that never
|
|
# answers initialize) would otherwise block agent construction forever — and on
|
|
# the Gateway event loop, the whole process. Per-server override is
|
|
# ``mcpServers.<name>.session_init_timeout``; ``None`` disables the timeout.
|
|
DEFAULT_MCP_SESSION_INIT_TIMEOUT = 60.0
|
|
|
|
# Persisted run-event envelope limits. Runtime definitions and the ORM both
|
|
# import these from this dependency-free module so lower layers never need to
|
|
# initialize deerflow.runtime just to validate storage constraints.
|
|
RUN_EVENT_TYPE_MAX_LENGTH = 32
|
|
RUN_EVENT_CATEGORY_MAX_LENGTH = 16
|
|
|
|
# Workspace changes are produced below the runtime layer, so their persisted
|
|
# event identity also lives here rather than in the runtime event catalog.
|
|
WORKSPACE_CHANGES_EVENT_TYPE = "workspace_changes"
|
|
WORKSPACE_CHANGES_EVENT_CATEGORY = "workspace"
|