Stop active TinyFish requests when dataset runs are cancelled#151
Open
dunkeln wants to merge 1 commit into
Open
Stop active TinyFish requests when dataset runs are cancelled#151dunkeln wants to merge 1 commit into
dunkeln wants to merge 1 commit into
Conversation
Stopping a dataset aborted agent generation but left active TinyFish HTTP calls running until their timeout, wasting time and potentially consuming provider credits. Scope web tools to their authorized dataset and combine the workflow signal with the existing request timeout. User stops now propagate AbortError while provider timeouts remain recoverable tool errors. This does not change workflow status handling, retry behavior, or TinyFish response contracts. Co-authored-by: Codex <codex@openai.com>
Contributor
📝 WalkthroughWalkthroughWeb tools are now constructed per dataset instead of exported as static instances. Their requests combine dataset workflow cancellation with fetch timeouts and rethrow workflow stop reasons. The investigate, populate, and refresh agents build these tools with their authorized dataset IDs while retaining existing tool bindings. Module documentation now describes explicit signal propagation to workflow steps, agents, and TinyFish requests. Sequence Diagram(s)sequenceDiagram
participant Agent
participant buildWebTools
participant WebRequest
Agent->>buildWebTools: build tools with authorizedDatasetId
buildWebTools->>WebRequest: issue request with combined abort signal
Agent->>WebRequest: stop workflow when cancellation is triggered
WebRequest-->>Agent: rethrow workflow abort reason
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dunkeln
marked this pull request as ready for review
July 25, 2026 22:47
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/src/mastra/tools/web-tools.ts`:
- Around line 181-185: Update buildWebTools in
backend/src/mastra/tools/web-tools.ts to accept authContext and pass it to both
buildSearchWebTool and buildFetchPageTool so each closure can perform audit
logging and CAPABILITY_VIOLATION tracking. Update the existing buildWebTools
calls in backend/src/mastra/agents/investigate.ts (line 70),
backend/src/mastra/agents/populate.ts (line 52), and
backend/src/mastra/agents/refresh.ts (line 65) to pass their existing
authContext.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d1bbc1b2-2aa6-4474-a161-34098f4c1714
📒 Files selected for processing (5)
backend/src/abort-registry.tsbackend/src/mastra/agents/investigate.tsbackend/src/mastra/agents/populate.tsbackend/src/mastra/agents/refresh.tsbackend/src/mastra/tools/web-tools.ts
Comment on lines
+181
to
+185
| export function buildWebTools(datasetId: string) { | ||
| return { | ||
| searchWebTool: buildSearchWebTool(datasetId), | ||
| fetchPageTool: buildFetchPageTool(datasetId), | ||
| }; |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Capture authContext in the web-tool closures.
buildWebTools() accepts only a dataset ID, so these tools cannot perform the required user/run audit logging or CAPABILITY_VIOLATION tracking.
backend/src/mastra/tools/web-tools.ts#L181-L185: acceptauthContextand pass it into both tool factories so each execution closes over it.backend/src/mastra/agents/investigate.ts#L70-L70: pass the existingauthContexttobuildWebTools.backend/src/mastra/agents/populate.ts#L52-L52: pass the existingauthContexttobuildWebTools.backend/src/mastra/agents/refresh.ts#L65-L65: pass the existingauthContexttobuildWebTools.
As per coding guidelines, “Capture authContext (Clerk userId + workflow run id) in tools for security audit logging and CAPABILITY_VIOLATION PostHog event tracking.”
📍 Affects 4 files
backend/src/mastra/tools/web-tools.ts#L181-L185(this comment)backend/src/mastra/agents/investigate.ts#L70-L70backend/src/mastra/agents/populate.ts#L52-L52backend/src/mastra/agents/refresh.ts#L65-L65
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/src/mastra/tools/web-tools.ts` around lines 181 - 185, Update
buildWebTools in backend/src/mastra/tools/web-tools.ts to accept authContext and
pass it to both buildSearchWebTool and buildFetchPageTool so each closure can
perform audit logging and CAPABILITY_VIOLATION tracking. Update the existing
buildWebTools calls in backend/src/mastra/agents/investigate.ts (line 70),
backend/src/mastra/agents/populate.ts (line 52), and
backend/src/mastra/agents/refresh.ts (line 65) to pass their existing
authContext.
Source: Coding guidelines
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Why
The stop routes abort the dataset controller and agent generation, but TinyFish requests previously used independent timeout controllers. An in-flight search or fetch could therefore continue after the user stopped the run, consuming time and potentially provider credits.
Impact
Stopping a building or refreshing dataset now also terminates its active TinyFish HTTP request. Concurrent datasets remain isolated because each tool closure captures its authorized dataset ID.
Verification
Not changed
This does not alter workflow status transitions, retry behavior, TinyFish response contracts, or model configuration.