fix(sei-tendermint): default HTTP write timeout to 30s on CometBFT RPC server (SEI-10199)

[amir-deris]

Summary

• WriteTimeout on the CometBFT JSON-RPC HTTP server was 0 (disabled), allowing clients to hold connections open indefinitely and exhaust server memory (SEI-10199).
• Default WriteTimeout is now 30s, enforced as a hard backstop across all handlers.
• Exposed as timeout-write in RPCConfig and the generated config.toml so operators can tune or disable it (0s).
• Instead of silently bumping WriteTimeout at runtime, ValidateBasic now returns a descriptive error when timeout-write is positive but not greater than timeout-broadcast-tx-commit, making misconfiguration explicit at startup.

Changes

File	Change
sei-tendermint/rpc/jsonrpc/server/http_server.go	WriteTimeout: 0 → 30s in DefaultConfig()
sei-tendermint/config/config.go	Added TimeoutWrite field to RPCConfig; default 30s; validated non-negative and greater than TimeoutBroadcastTxCommit
sei-tendermint/internal/rpc/core/env.go	Assigns conf.RPC.TimeoutWrite directly; removes silent runtime bump
sei-tendermint/cmd/tendermint/commands/light.go	Same — assigns TimeoutWrite directly
sei-tendermint/internal/inspect/rpc/rpc.go	Same — assigns TimeoutWrite directly
sei-tendermint/config/toml.go	Added timeout-write template entry
sei-tendermint/config/config_test.go	Extended TestRPCConfigValidateBasic to cover TimeoutWrite negative and cross-field cases

Risk

broadcast_tx_commit waits at most ~400ms on Sei — well within 30s. Setting timeout-write = "0s" restores the previous behaviour. If timeout-write is set to a value ≤ timeout-broadcast-tx-commit, node startup will fail with a descriptive error rather than silently adjusting the value.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Defaulting a global HTTP write timeout changes behavior for all RPC endpoints (including long-lived connections), and operators who raise timeout-broadcast-tx-commit must set timeout-write accordingly or startup validation fails.

Overview
Adds an explicit timeout-write RPC setting (default 30s) and wires it through the main node RPC server, light client proxy, and inspect RPC instead of leaving HTTP WriteTimeout at 0 (unlimited).

The JSON-RPC server DefaultConfig() now defaults WriteTimeout to 30s. Runtime logic that auto-bumped write timeout above timeout-broadcast-tx-commit is removed; that relationship is enforced in ValidateBasic when timeout-write is non-zero (0 still disables the limit). Generated config.toml documents the new knob, with tests for negative values and the cross-field rule.

^{Reviewed by Cursor Bugbot for commit 0d6f6f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jun 8, 2026, 8:53 PM

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 58.34%. Comparing base (b709a64) to head (0d6f6f4).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
sei-tendermint/cmd/tendermint/commands/light.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3558      +/-   ##
==========================================
- Coverage   59.19%   58.34%   -0.85%     
==========================================
  Files        2223     2148      -75     
  Lines      183570   174950    -8620     
==========================================
- Hits       108661   102083    -6578     
+ Misses      65115    63796    -1319     
+ Partials     9794     9071     -723     

Flag	Coverage Δ
sei-chain-pr	50.85% <90.90%> (?)
sei-db	70.41% <ø> (ø)
sei-db-state-db	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
sei-tendermint/config/config.go	73.51% <100.00%> (+0.34%)	⬆️
sei-tendermint/config/toml.go	55.00% <ø> (ø)
sei-tendermint/internal/inspect/rpc/rpc.go	61.53% <100.00%> (+2.44%)	⬆️
sei-tendermint/internal/rpc/core/env.go	78.23% <100.00%> (+1.04%)	⬆️
sei-tendermint/rpc/jsonrpc/server/http_server.go	70.58% <100.00%> (+2.61%)	⬆️
sei-tendermint/cmd/tendermint/commands/light.go	42.75% <0.00%> (+0.29%)	⬆️

... and 109 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d19bf5e. Configure here.}

[amir-deris]

@claude review

[bdchatham]

nit: I would just return an error with a descriptive message. This prevents any sort of magic going on under the hood and makes it very clear to a user when their setup needs to be corrected