fix: time out well-known agent-skills upstream fetch

src/__tests__/agent-skills-discovery-route.test.ts

@@ -1,5 +1,11 @@
-import { describe, expect, it } from "vitest";
-import { proxyAgentSkillsDiscoveryResponse } from "../routes/$owner/skills/$slug/[.]well-known/agent-skills/index[.]json";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  AGENT_SKILLS_DISCOVERY_TIMEOUT_MS,
+  fetchAgentSkillsDiscovery,
+  proxyAgentSkillsDiscoveryResponse,
+} from "../routes/$owner/skills/$slug/[.]well-known/agent-skills/index[.]json";
+
+process.env.VITE_CONVEX_URL = process.env.VITE_CONVEX_URL ?? "https://example.convex.cloud";
 
 describe("Agent Skills discovery route", () => {
   it("does not forward stale compression or transport headers", async () => {
@@ -41,4 +47,88 @@ describe("Agent Skills discovery route", () => {
     expect(response.headers.get("Cache-Control")).toBe("public, max-age=60");
     expect(response.headers.get("Content-Type")).toBe("application/json; charset=utf-8");
   });
+
+  describe("upstream discovery fetch deadline", () => {
+    afterEach(() => {
+      vi.unstubAllGlobals();
+      vi.restoreAllMocks();
+      vi.useRealTimers();
+    });
+
+    it("passes an abort signal on GET and HEAD upstream fetches", async () => {
+      const timeoutSpy = vi.spyOn(AbortSignal, "timeout").mockImplementation(() => {
+        return new AbortController().signal;
+      });
+      const fetchMock = vi.fn(async () => {
+        return new Response('{"skills":[]}', {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        });
+      });
+      vi.stubGlobal("fetch", fetchMock);
+
+      await fetchAgentSkillsDiscovery("openclaw", "demo", "GET");
+      await fetchAgentSkillsDiscovery("openclaw", "demo", "HEAD");
+
+      expect(timeoutSpy).toHaveBeenCalledWith(AGENT_SKILLS_DISCOVERY_TIMEOUT_MS);
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(fetchMock).toHaveBeenNthCalledWith(
+        1,
+        expect.any(URL),
+        expect.objectContaining({
+          method: "GET",
+          headers: { Accept: "application/json" },
+          signal: expect.any(AbortSignal),
+        }),
+      );
+      expect(fetchMock).toHaveBeenNthCalledWith(
+        2,
+        expect.any(URL),
+        expect.objectContaining({
+          method: "HEAD",
+          headers: { Accept: "application/json" },
+          signal: expect.any(AbortSignal),
+        }),
+      );
+    });
+
+    it("aborts a hanging upstream fetch after the discovery timeout", async () => {
+      vi.useFakeTimers();
+      const timeoutSpy = vi.spyOn(AbortSignal, "timeout").mockImplementation((ms: number) => {
+        const controller = new AbortController();
+        setTimeout(() => {
+          controller.abort(
+            Object.assign(new Error("The operation was aborted"), { name: "AbortError" }),
+          );
+        }, ms);
+        return controller.signal;
+      });
+      let usedSignal: AbortSignal | undefined;
+      vi.stubGlobal(
+        "fetch",
+        vi.fn((_url: URL, init?: RequestInit) => {
+          usedSignal = init?.signal ?? undefined;
+          return new Promise<Response>((_resolve, reject) => {
+            init?.signal?.addEventListener("abort", () => {
+              reject(Object.assign(new Error("The operation was aborted"), { name: "AbortError" }));
+            });
+          });
+        }),
+      );
+
+      const pending = fetchAgentSkillsDiscovery("openclaw", "demo", "GET");
+      const aborted = expect(pending).rejects.toMatchObject({ name: "AbortError" });
+      await Promise.resolve();
+      expect(usedSignal).toBeInstanceOf(AbortSignal);
+      expect(usedSignal?.aborted).toBe(false);
+
+      await vi.advanceTimersByTimeAsync(AGENT_SKILLS_DISCOVERY_TIMEOUT_MS - 1);
+      expect(usedSignal?.aborted).toBe(false);
+
+      await vi.advanceTimersByTimeAsync(1);
+      await aborted;
+      expect(usedSignal?.aborted).toBe(true);
+      expect(timeoutSpy).toHaveBeenCalledWith(AGENT_SKILLS_DISCOVERY_TIMEOUT_MS);
+    });
+  });
 });

src/routes/$owner/skills/$slug/[.]well-known/agent-skills/index[.]json.ts

@@ -1,6 +1,8 @@
 import { createFileRoute } from "@tanstack/react-router";
 import { publicApiUrl } from "../../../../../../lib/publicApiUrl";
 
+export const AGENT_SKILLS_DISCOVERY_TIMEOUT_MS = 10_000;
+
 export const Route = createFileRoute("/$owner/skills/$slug/.well-known/agent-skills/index.json")({
   server: {
     handlers: {
@@ -10,13 +12,18 @@ export const Route = createFileRoute("/$owner/skills/$slug/.well-known/agent-ski
   },
 });
 
-async function fetchAgentSkillsDiscovery(owner: string, slug: string, method: "GET" | "HEAD") {
+export async function fetchAgentSkillsDiscovery(
+  owner: string,
+  slug: string,
+  method: "GET" | "HEAD",
+) {
   const upstream = publicApiUrl(
     `/api/v1/agent-skills/${encodeURIComponent(owner)}/${encodeURIComponent(slug)}/index.json`,
   );
   const response = await fetch(upstream, {
     method,
     headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(AGENT_SKILLS_DISCOVERY_TIMEOUT_MS),
   });
   return proxyAgentSkillsDiscoveryResponse(response, method === "GET");
 }