Cover full DeepSeek response with timeout

The upstream timeout only guarded fetch until headers arrived, so a slow response body could keep the AI proxy open beyond DEEPSEEK_TIMEOUT_MS. The DeepSeek request now races both the fetch and JSON body read against the timeout, aborting and returning deepseek_timeout for slow bodies as well as slow headers.

Constraint: Browser chat fallback depends on bounded server-side upstream latency
Rejected: Keep only AbortController fetch timeout | it did not cover response body consumption in the reproduced slow-body case
Confidence: high
Scope-risk: narrow
Directive: Keep the upstream timeout wrapped around the full response lifecycle, including body parsing
Tested: npm run verify:ai
Tested: npm run verify
Tested: npm audit --omit=dev

Author: worldwonderer

lib/ai/deepseek.js

@@ -110,16 +110,21 @@ function normalizeGeneratedContent(value) {
   return content.length <= 160 ? content : "";
 }
 
+function createDeepSeekTimeoutError() {
+  const error = new Error("DeepSeek request timed out");
+  error.status = 504;
+  error.code = "deepseek_timeout";
+  return error;
+}
+
 export async function createDeepSeekChatCompletion(context) {
   const apiKey = requireApiKey();
   const endpoint = getDeepSeekEndpoint();
   const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), getDeepSeekTimeoutMs());
+  let timeout;
 
-  let response;
-
-  try {
-    response = await fetch(endpoint, {
+  const upstreamRequest = (async () => {
+    const response = await fetch(endpoint, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -139,23 +144,38 @@ export async function createDeepSeekChatCompletion(context) {
       cache: "no-store",
       signal: controller.signal,
     });
+
+    if (!response.ok) {
+      const error = new Error(`DeepSeek request failed with ${response.status}`);
+      error.status = response.status >= 500 ? 502 : response.status;
+      error.code = "deepseek_request_failed";
+      throw error;
+    }
+
+    return response.json();
+  })();
+
+  const timeoutExceeded = new Promise((_, reject) => {
+    timeout = setTimeout(() => {
+      controller.abort();
+      reject(createDeepSeekTimeoutError());
+    }, getDeepSeekTimeoutMs());
+  });
+
+  let data;
+
+  try {
+    data = await Promise.race([upstreamRequest, timeoutExceeded]);
   } catch (error) {
+    if (error.code) throw error;
+
     const wrappedError = new Error(error.name === "AbortError" ? "DeepSeek request timed out" : "DeepSeek request failed");
     wrappedError.status = error.name === "AbortError" ? 504 : 502;
     wrappedError.code = error.name === "AbortError" ? "deepseek_timeout" : "deepseek_request_failed";
     throw wrappedError;
   } finally {
     clearTimeout(timeout);
   }
-
-  if (!response.ok) {
-    const error = new Error(`DeepSeek request failed with ${response.status}`);
-    error.status = response.status >= 500 ? 502 : response.status;
-    error.code = "deepseek_request_failed";
-    throw error;
-  }
-
-  const data = await response.json();
   const rawContent = data?.choices?.[0]?.message?.content;
   const content = normalizeGeneratedContent(rawContent);
 

scripts/verify_ai_integration.mjs

@@ -11,7 +11,7 @@ const originalFetch = globalThis.fetch;
 let captured;
 let nextMockContent = '哈哈，没想到你还挺认真。';
 
-globalThis.fetch = async (url, options) => {
+const mockDeepSeekFetch = async (url, options) => {
   const body = JSON.parse(options.body);
   captured = {
     url,
@@ -31,6 +31,8 @@ globalThis.fetch = async (url, options) => {
   });
 };
 
+globalThis.fetch = mockDeepSeekFetch;
+
 function buildRequest(body, headers = {}) {
   return new Request('http://localhost/api/ai/chat', {
     method: 'POST',
@@ -135,6 +137,27 @@ if (invalidBaseUrlResponse.status !== 500 || invalidBaseUrlData.error !== 'inval
 }
 
 process.env.DEEPSEEK_BASE_URL = 'https://api.deepseek.com';
+process.env.DEEPSEEK_TIMEOUT_MS = '5';
+globalThis.fetch = async () => new Response(new ReadableStream({
+  start(controller) {
+    setTimeout(() => {
+      controller.enqueue(new TextEncoder().encode(JSON.stringify({ choices: [{ message: { content: '慢响应' } }] })));
+      controller.close();
+    }, 50);
+  },
+}), {
+  status: 200,
+  headers: { 'Content-Type': 'application/json' },
+});
+const slowBodyResponse = await POST(buildRequest(validPayload));
+const slowBodyData = await slowBodyResponse.json();
+
+if (slowBodyResponse.status !== 504 || slowBodyData.error !== 'deepseek_timeout') {
+  throw new Error(`slow DeepSeek response bodies should be covered by DEEPSEEK_TIMEOUT_MS: ${JSON.stringify({ status: slowBodyResponse.status, slowBodyData })}`);
+}
+
+process.env.DEEPSEEK_TIMEOUT_MS = '8000';
+globalThis.fetch = mockDeepSeekFetch;
 
 const badRequest = buildRequest({ targetLine: '' });
 const badResponse = await POST(badRequest);