fix(http-stream): wait for in-flight flush before sending final close message#419
Merged
Conversation
… message `_wait_for_id_and_queue()` only checked `_queue` and `_id`, missing the window where `_flush()` has drained the queue but is still awaiting `_send_activity()` calls under `_lock`. During that window `close()` could send the final stream message before the in-flight chunk completed. Fix: also check `_lock.locked()` in the wait predicate. The lock primitive is already used in `close()`'s early-return guard. Closes #418
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Fixes a race where HttpStream.close() could send the final stream message while a _flush() was still in-flight, causing the final activity to arrive before preceding chunks.
Changes:
- Update
_wait_for_id_and_queue()to also wait while the flush lock is held. - Expand the close-timeout warning message to include flush completion.
- Add a regression test ensuring
close()blocks until an in-progress flush completes.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| packages/apps/src/microsoft_teams/apps/http_stream.py | Ensures close() waits for the flush lock to be released before sending the final activity. |
| packages/apps/tests/test_http_stream.py | Adds a test covering the close-vs-flush race by holding the flush lock and asserting close() does not finalize early. |
lilyydu
approved these changes
May 4, 2026
7 tasks
corinagum
added a commit
that referenced
this pull request
May 27, 2026
## Summary Brings `origin/main` into `release` for the **2.0.12** release. **No carve-outs this time** — Quoted Replies (PR #321) is included. `version.json`: `2.0.11` → `2.0.12`. Aligns with teams.ts/teams.net cadence. ## What's in this release (delta from 2.0.11) **Features** - Quoted Replies & new quotes features (#321) — previously held back - SuggestedActionSubmitActivity for `suggestedAction/submit` invoke (#434) - Default targeted replies for targeted inbound messages (#439) - Reactions API marked GA (#427) — already shipped in 2.0.11 actually, ignore if duplicate - Prompt Preview support (#397) - Sample: opt targeted-messages into slash commands (#430) - Sample: a2a-in-teams (#401) - Sample: proactive message update (#405) - Allow custom HTTP client via `AppOptions` (#416) **Security & fixes** - Lock JsonWebToken trust-boundary contract (#432) - Bump starlette 1.0.0 -> 1.1.0 for PYSEC-2026-161 / BadHost (#441) - warn when bot starts without credentials (#435) - fix(apps): support AAD v1 issuers in Entra token validation (#422) - fix(apps): log inbound activities at info, warn on missing Authorization (#425) - fix(http-stream): wait for in-flight flush before sending final close (#419) - Mark reactions API as GA and fix sample remove flow (#427) - Revert serviceUrl allowlist (ADO 5310460) (#415) - Route `app.get_app_graph` + `ctx.*_graph` to sovereign endpoints via `cloud.graph_scope` (#402) **Deprecations / package changes** - Remove ai, openai, mcpplugin, a2a, and devtools packages (#413) - Restore and deprecate devtools package (#410) - Deprecate ai, openai, mcpplugin, a2a packages (#406) - Add agent framework example, remove chatprompt/mcp client samples (#386) **Dependency bumps** - urllib3 2.6.3 → 2.7.0 (#426) - python-multipart 0.0.26 → 0.0.27 (#424) - microsoft-kiota-http 1.9.7 → 1.9.9 (#423) - idna 3.11 → 3.15 (#431) - starlette 1.0.0 → 1.1.0 (#441, security) - /examples/tab/Web: qs, postcss, uuid, follow-redirects bumps ## Quoted Replies inclusion notes - Teams client rendering is in-sync with the wire format as of 2026-05-06. - APX QR rollout completed: Public 2026-04-10, GCCH/DoD/Gallatin 2026-04-14. - Builder methods (`prepend_quote()`, `add_quote()`), `ctx.quote()`, and the quote-aware `ctx.reply()` behavior are all present in this release. - `examples/quoting` is included. ## Conflict resolution The 2.0.11 release branch had the QR-removed shape for four files; took `main`'s (QR-included) version for all of them: - `examples/targeted-messages/src/main.py` - `packages/api/src/microsoft_teams/api/activities/message/message.py` - `packages/apps/src/microsoft_teams/apps/routing/activity_context.py` - `packages/apps/tests/test_activity_context.py` `version.json` conflict resolved to `2.0.12`. ## Test plan - [x] `uv sync` clean - [x] `poe check` (ruff format + lint) — clean - [x] `poe test` — 609 passed - [x] `pyright` — 0 errors, 0 warnings - [ ] Pipeline build + test stages green on `release` after merge - [ ] Publish pipeline run with **Public** → ESRP approval → PyPI - [ ] `pip install microsoft-teams-apps==2.0.12` smoke install --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Aamir Jawaid <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> Co-authored-by: Shanmathi Mayuram Krithivasan <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #418
Summary
HttpStream.close()could send the final stream message while_flush()was still mid-await, causing the final message to arrive before in-flight chunks finished sending.This is the Python parity of microsoft/teams.ts#553 (Bug 2 only — Bug 1 from the TS PR does not affect Python;
close()already callswith_channel_data()beforeadd_stream_final()).Root cause
_wait_for_id_and_queue()polled:This checks the queue and
_idbut not whether_flush()is currently holdingself._lock. After the innerwhile self._queueloop drains the queue,_flush()awaits_send_activity(...)calls under the lock. During those awaits:self._queueis empty (drained)self._idis set (after the first chunk)self._lockis still heldThe predicate becomes false, the wait exits, and
close()proceeds to send the final activity — racing the in-flight chunk.Fix
Add
self._lock.locked()to the wait predicate. The lock primitive is already used inclose()'s early-return guard at line 157, so this is consistent with existing patterns.Test plan
test_close_waits_for_flush_to_complete— holdsstream._lockmanually, assertsclose()does not send the final message until the lock is released.poe checkpasses (ruff format + lint).