⏱️ feat: Advertise Workspace Command Timeout Ceiling

packages/code/src/protocol.ts

@@ -712,6 +712,8 @@ export interface BridgeWorkerStatusResponse {
   online: boolean;
   ready: boolean;
   leaseExpiresInMs?: number;
+  /** Server-owned execution ceiling for workspace commands. Omitted by legacy servers. */
+  maxCommandTimeoutMs?: number;
   capabilities?: BridgeWorkerCapabilities;
 }
 

service/src/bridge/index.ts

@@ -21,4 +21,5 @@ export default createBridgeRouter({
   adminToken: env.BRIDGE_TOKEN,
   configuredWorkerId: env.BRIDGE_WORKER_ID,
   allowDynamicWorkers: env.BRIDGE_DYNAMIC_WORKERS,
+  maxCommandTimeoutMs: env.JOB_TIMEOUT,
 });

service/src/bridge/router.test.ts

@@ -10,7 +10,10 @@ import {
   createBridgeIdentity,
   signBridgeRequest,
 } from '../../../packages/code/src/identity';
-import { BRIDGE_PROTOCOL_VERSION } from '../../../packages/code/src/protocol';
+import {
+  BRIDGE_PROTOCOL_VERSION,
+  BRIDGE_WORKSPACE_COMMAND_MAX_TIMEOUT_MS,
+} from '../../../packages/code/src/protocol';
 import { RedisBridgePairingStore } from './pairing';
 import { createBridgeRouter } from './router';
 import { RedisBridgeStore } from './store';
@@ -115,6 +118,55 @@ describe('paired bridge HTTP API', () => {
     expect(unauthorized.status).toBe(401);
   });
 
+  test('advertises the effective server command timeout for command-capable workers', async () => {
+    const store = new RedisBridgeStore(redis);
+    const app = express();
+    app.use(json());
+    app.use(
+      '/v1/bridge',
+      createBridgeRouter({
+        store,
+        pairings: new RedisBridgePairingStore(redis),
+        authMode: 'static',
+        adminToken: 'strong-administrator-bootstrap-token',
+        configuredWorkerId: 'command-worker',
+        maxCommandTimeoutMs: 900_000,
+      }),
+    );
+    server = createServer(app);
+    await new Promise<void>((resolve) => server?.listen(0, '127.0.0.1', resolve));
+    const address = server.address();
+    if (address == null || typeof address === 'string') {
+      throw new Error('Expected TCP listener');
+    }
+    await store.register({
+      protocolVersion: BRIDGE_PROTOCOL_VERSION,
+      workerId: 'command-worker',
+      incarnationId: 'incarnation-00000001',
+      capabilities: {
+        statefulWorkspace: false,
+        sandboxProfile: 'native-srt',
+        runtimes: [],
+        workspaceTools: {
+          protocolVersion: BRIDGE_PROTOCOL_VERSION,
+          operations: ['execute_command'],
+          workspaces: [{ id: 'primary' }],
+        },
+      },
+    });
+
+    const response = await fetch(
+      `http://127.0.0.1:${address.port}/v1/bridge/workers/command-worker/status`,
+      { headers: { Authorization: 'Bearer strong-administrator-bootstrap-token' } },
+    );
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({
+      workerId: 'command-worker',
+      maxCommandTimeoutMs: BRIDGE_WORKSPACE_COMMAND_MAX_TIMEOUT_MS,
+    });
+  });
+
   test('rejects a malformed optional binding for a configured worker', async () => {
     const app = express();
     app.use(json());

service/src/bridge/router.ts

@@ -7,6 +7,7 @@ import type { BridgePrincipalType, BridgeWorkerBinding } from './pairing';
 import type { CodeBridgeAssignment, CodeBridgeSettlement } from './store';
 
 import {
+  BRIDGE_WORKSPACE_COMMAND_MAX_TIMEOUT_MS,
   BRIDGE_PROTOCOL_VERSION,
   isValidBridgeWorkerCapabilities,
   isValidBridgeWorkerId,
@@ -36,6 +37,7 @@ export interface BridgeRouterOptions {
   adminToken: string;
   configuredWorkerId?: string;
   allowDynamicWorkers?: boolean;
+  maxCommandTimeoutMs?: number;
 }
 
 function sameToken(left: string, right: string): boolean {
@@ -132,6 +134,16 @@ function isSettlement(value: unknown): value is CodeBridgeSettlement {
 export function createBridgeRouter(options: BridgeRouterOptions): Router {
   const router = Router();
   if (options.enabled === false) return router;
+  if (
+    options.maxCommandTimeoutMs !== undefined &&
+    (!Number.isSafeInteger(options.maxCommandTimeoutMs) || options.maxCommandTimeoutMs < 1)
+  ) {
+    throw new RangeError('Workspace command timeout must be a positive safe integer');
+  }
+  const maxCommandTimeoutMs =
+    options.maxCommandTimeoutMs == null
+      ? undefined
+      : Math.min(options.maxCommandTimeoutMs, BRIDGE_WORKSPACE_COMMAND_MAX_TIMEOUT_MS);
 
   const configuredWorker = (workerId: string): boolean =>
     options.allowDynamicWorkers === true ||
@@ -324,10 +336,13 @@ export function createBridgeRouter(options: BridgeRouterOptions): Router {
         return;
       }
       const status = await options.store.workerStatus(workerId);
+      const supportsCommands =
+        status.capabilities?.workspaceTools?.operations.includes('execute_command') === true;
       res.json({
         protocolVersion: BRIDGE_PROTOCOL_VERSION,
         workerId,
         ...status,
+        ...(supportsCommands && maxCommandTimeoutMs != null ? { maxCommandTimeoutMs } : {}),
       });
     }),
   );