fix(sandboxes): honor the configured request deadline

Author: shawnwu-kong

docs/sandboxes.md

@@ -56,7 +56,9 @@ volcano cloud sandboxes executions cancel <sandbox-id> <execution-id> --generati
 ```
 
 Platform errors and unknown/pending command outcomes exit 1. Ctrl-C or the overall
-`--timeout` stops the client request, not necessarily the server command. The
+`--timeout` stops the client request, not necessarily the server command. It
+defaults to 10 minutes and accepts positive durations up to 24 hours. It controls
+the overall command request or log stream, including response-body reads. The
 request key is printed to stderr before mutations; retain it alongside operation
 IDs when investigating a disconnect. The CLI never retries writes. Do not create
 a new request key and replay an uncertain command. Use an existing key only with

internal/cmd/sandboxes/sandboxes_test.go

@@ -10,6 +10,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
@@ -22,6 +23,39 @@ import (
 
 const projectID = "22222222-2222-4222-8222-222222222222"
 
+type deadlineDoer func(*http.Request) (*http.Response, error)
+
+func (d deadlineDoer) Do(r *http.Request) (*http.Response, error) { return d(r) }
+
+func TestOverallTimeoutReachesRequest(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		args []string
+		want time.Duration
+	}{
+		{"default", []string{"list"}, 10 * time.Minute},
+		{"longer than transport fallback", []string{"list", "--timeout", "5m"}, 5 * time.Minute},
+		{"shorter than transport fallback", []string{"list", "--timeout", "30s"}, 30 * time.Second},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			hits := 0
+			deps := cliruntime.Deps{ConfigLoader: func() (*config.Config, error) {
+				return &config.Config{UserToken: "platform-token", IgnoreEnv: true, CurrentProject: &config.ProjectConfig{ID: projectID}}, nil
+			}, HTTPClient: deadlineDoer(func(r *http.Request) (*http.Response, error) {
+				hits++
+				deadline, ok := r.Context().Deadline()
+				assert.True(t, ok)
+				assert.WithinDuration(t, time.Now().Add(tc.want), deadline, time.Second)
+				return &http.Response{StatusCode: http.StatusOK, Header: http.Header{"X-Volcano-Sandbox-Version": []string{sandbox.Version}}, Body: io.NopCloser(bytes.NewBufferString(`{"items":[]}`))}, nil
+			})}
+			t.Setenv("VOLCANO_SANDBOX_URL", "https://sandbox.example")
+			_, _, err := execute(t, New(deps), tc.args...)
+			require.NoError(t, err)
+			assert.Equal(t, 1, hits)
+		})
+	}
+}
+
 func fixture(t *testing.T, handler http.HandlerFunc) cliruntime.Deps {
 	t.Helper()
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

internal/sandbox/client.go

@@ -88,10 +88,14 @@ func (e *Error) Error() string {
 	return fmt.Sprintf("sandbox %s (HTTP %d, operation %s)", e.Code, e.Status, e.OperationID)
 }
 
-// Do performs a bounded request without replaying unknown outcomes.
+// Do honors the caller's deadline without replaying unknown outcomes. Calls
+// without a deadline use a bounded fallback; CLI commands set their own timeout.
 func (c *Client) Do(ctx context.Context, input Request) (Response, error) {
-	ctx, cancel := context.WithTimeout(ctx, 65*time.Second)
-	defer cancel()
+	if _, ok := ctx.Deadline(); !ok {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, 65*time.Second)
+		defer cancel()
+	}
 	response, err := c.send(ctx, input)
 	if err != nil {
 		return Response{}, err

internal/sandbox/client_test.go

@@ -14,6 +14,54 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+type requestDoer func(*http.Request) (*http.Response, error)
+
+func (d requestDoer) Do(r *http.Request) (*http.Response, error) { return d(r) }
+
+func TestRequestHonorsCallerDeadline(t *testing.T) {
+	for _, duration := range []time.Duration{30 * time.Second, 5 * time.Minute, 10 * time.Minute} {
+		t.Run(duration.String(), func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(t.Context(), duration)
+			defer cancel()
+			want, _ := ctx.Deadline()
+			hits := 0
+			client, err := New("https://sandbox.example", "secret", "p1", requestDoer(func(r *http.Request) (*http.Response, error) {
+				hits++
+				got, ok := r.Context().Deadline()
+				assert.True(t, ok)
+				assert.Equal(t, want, got)
+				cancel()
+				return nil, r.Context().Err()
+			}))
+			require.NoError(t, err)
+			_, err = client.Do(ctx, Request{Method: http.MethodPost, Path: "/one-shot"})
+			require.ErrorIs(t, err, context.Canceled)
+			assert.Equal(t, 1, hits)
+		})
+	}
+}
+
+func TestRequestWithoutDeadlineRetainsBoundedFallback(t *testing.T) {
+	var requestDone <-chan struct{}
+	start := time.Now()
+	client, err := New("https://sandbox.example", "secret", "p1", requestDoer(func(r *http.Request) (*http.Response, error) {
+		requestDone = r.Context().Done()
+		deadline, ok := r.Context().Deadline()
+		assert.True(t, ok)
+		assert.WithinDuration(t, start.Add(65*time.Second), deadline, time.Second)
+		return &http.Response{StatusCode: http.StatusNoContent, Header: http.Header{"X-Volcano-Sandbox-Version": []string{Version}}, Body: http.NoBody}, nil
+	}))
+	require.NoError(t, err)
+	_, err = client.Do(context.Background(), Request{Method: http.MethodGet, Path: "/capabilities"})
+	require.NoError(t, err)
+	require.NotNil(t, requestDone)
+	select {
+	case <-requestDone:
+	default:
+		t.Fatal("fallback deadline was not released after the response")
+	}
+}
+
 func TestRequestPinsContractIdentityAndNeverReplays(t *testing.T) {
 	for _, status := range []int{200, 401, 403, 409, 429, 501, 503} {
 		t.Run(http.StatusText(status), func(t *testing.T) {