fix(gateway): bound explicit restart deferral

VACInc · VACInc · commit ba9a6ec64c8c · 2026-04-29T09:34:18.000-04:00
diff --git a/src/agents/tools/gateway-tool.test.ts b/src/agents/tools/gateway-tool.test.ts
@@ -138,6 +138,7 @@ describe("gateway tool restart continuation", () => {
     );
     expect(scheduleGatewaySigusr1RestartMock).toHaveBeenCalledWith({
       delayMs: 250,
+      deferralTimeoutMs: 30_000,
       reason: "continue after reboot",
       emitHooks: expect.objectContaining({
         beforeEmit: expect.any(Function),
diff --git a/src/agents/tools/gateway-tool.ts b/src/agents/tools/gateway-tool.ts
@@ -24,6 +24,7 @@ import { isOpenClawOwnerOnlyCoreToolName } from "./owner-only-tools.js";
 const log = createSubsystemLogger("gateway-tool");
 
 const DEFAULT_UPDATE_TIMEOUT_MS = 20 * 60_000;
+const EXPLICIT_RESTART_DEFERRAL_TIMEOUT_MS = 30_000;
 // Security: the agent-facing `gateway` tool is owner-only, but per SECURITY.md the model/agent
 // itself is not a trusted principal. `assertGatewayConfigMutationAllowed` is the explicit
 // model -> operator trust-boundary control on `config.apply`/`config.patch`, so the runtime
@@ -411,6 +412,7 @@ export function createGatewayTool(opts?: {
         let sentinelPath: string | null = null;
         const scheduled = scheduleGatewaySigusr1Restart({
           delayMs,
+          deferralTimeoutMs: EXPLICIT_RESTART_DEFERRAL_TIMEOUT_MS,
           reason,
           emitHooks: {
             beforeEmit: async () => {
diff --git a/src/auto-reply/reply/commands-session.ts b/src/auto-reply/reply/commands-session.ts
@@ -37,6 +37,8 @@ import { persistSessionEntry } from "./commands-session-store.js";
 import type { CommandHandler, HandleCommandsParams } from "./commands-types.js";
 import { resolveConversationBindingContextFromAcpCommand } from "./conversation-binding-input.js";
 
+const EXPLICIT_RESTART_DEFERRAL_TIMEOUT_MS = 30_000;
+
 const SESSION_COMMAND_PREFIX = "/session";
 const SESSION_DURATION_OFF_VALUES = new Set(["off", "disable", "disabled", "none", "0"]);
 const SESSION_ACTION_IDLE = "idle";
@@ -680,6 +682,7 @@ export const handleRestartCommand: CommandHandler = async (params, allowTextComm
   if (hasSigusr1Listener) {
     let sentinelPath: string | null = null;
     scheduleGatewaySigusr1Restart({
+      deferralTimeoutMs: EXPLICIT_RESTART_DEFERRAL_TIMEOUT_MS,
       reason: "/restart",
       emitHooks: sentinelPayload
         ? {
diff --git a/src/infra/infra-runtime.test.ts b/src/infra/infra-runtime.test.ts
@@ -540,6 +540,24 @@ describe("infra runtime", () => {
       }
     });
 
+    it("emits SIGUSR1 after per-request deferral timeout even without runtime timeout", async () => {
+      const emitSpy = vi.spyOn(process, "emit");
+      const handler = () => {};
+      process.on("SIGUSR1", handler);
+      try {
+        setPreRestartDeferralCheck(() => 5);
+        scheduleGatewaySigusr1Restart({ delayMs: 0, deferralTimeoutMs: 1_000 });
+
+        await vi.advanceTimersByTimeAsync(0);
+        expect(emitSpy).not.toHaveBeenCalledWith("SIGUSR1");
+
+        await vi.advanceTimersByTimeAsync(1_000);
+        expect(emitSpy).toHaveBeenCalledWith("SIGUSR1");
+      } finally {
+        process.removeListener("SIGUSR1", handler);
+      }
+    });
+
     it("emits SIGUSR1 if deferral check throws", async () => {
       const emitSpy = vi.spyOn(process, "emit");
       const handler = () => {};
diff --git a/src/infra/restart.ts b/src/infra/restart.ts
@@ -655,6 +655,7 @@ export type ScheduledRestart = {
 
 export function scheduleGatewaySigusr1Restart(opts?: {
   delayMs?: number;
+  deferralTimeoutMs?: number;
   reason?: string;
   audit?: RestartAuditInfo;
   emitHooks?: RestartEmitHooks;
@@ -738,9 +739,15 @@ export function scheduleGatewaySigusr1Restart(opts?: {
         return;
       }
       const cfg = getRuntimeConfig();
+      const deferralTimeoutMs =
+        typeof opts?.deferralTimeoutMs === "number" &&
+        Number.isFinite(opts.deferralTimeoutMs) &&
+        opts.deferralTimeoutMs > 0
+          ? Math.floor(opts.deferralTimeoutMs)
+          : cfg.gateway?.reload?.deferralTimeoutMs;
       deferGatewayRestartUntilIdle({
         getPendingCount: pendingCheck,
-        maxWaitMs: resolveGatewayRestartDeferralTimeoutMs(cfg.gateway?.reload?.deferralTimeoutMs),
+        maxWaitMs: resolveGatewayRestartDeferralTimeoutMs(deferralTimeoutMs),
         reason: scheduledReason,
       });
     },
