[XXPermanentXX]

Summary

• Keep native fetch in both Node and Bun, with runtime-specific transport options. Override Undici header/body timeouts per request in Node and use Bun's native timeout option. Keep the release Bun version pinned to 1.3.14.
• Apply --timeout consistently at the application layer: JSON requests retain a total deadline; raw/streaming responses use a header deadline followed by a body idle window. Pause idle accounting during consumer processing and backpressure.
• Abort the request-owned controller when a response body is explicitly cancelled or an SSE consumer exits early, releasing the underlying connection and cleaning up listeners, timers, and readers.
• Explicitly cancel unused response bodies in Sandbox pause, instance deletion, and template deletion.
• Add regression coverage for Node, Bun source execution, and compiled binaries. Verify that the server observes response closure while the client process is still running.

The lifecycle handling follows the request-owned controller cleanup pattern used by Qwen Code RestSseTransport.

Validation

• pnpm test --maxWorkers=4: 2,943 passed, 194 skipped.
• pnpm -r --filter './packages/*' build: passed.
• pnpm exec vp check: 0 errors and 3 existing warnings in unchanged files.
• Independent review exercised cancellation and cleanup under Node 24, Bun 1.3.14 source execution, and a compiled macOS ARM64 binary. Scenarios included pending reads, different cancellation reasons, all three Sandbox command paths, and 65 consecutive early SSE exits.
• Local 320-second header-wait and body-stall checks verified requests beyond the previous 300-second transport limit.

Validation boundaries and known observations

• Validation used local mock services, without production accounts or real Sandbox resources. Other operating systems and architectures still require CI or platform-specific validation.
• Intermittent SIGKILL events were observed when launching newly compiled macOS binaries. A deployment SIGINT test also triggered its watchdog under default concurrency. Three independent review reruns passed all 246 test executions without reproducing either event in those runs. Their root causes remain undetermined; this PR does not assume an environmental cause or claim to resolve these observations.
• This change covers the core HTTP layer and related response-release paths. Other direct fetch paths, including Console, OpenAPI, and MCP, are outside this unification scope.