fix: add deadlines to OAuth and ngrok fetches

[Gautam Sharma (GautamSharma99)]

Summary

Fixes #541.

OAuth discovery, dynamic client registration, authorization-code exchange, token refresh, ChatGPT OAuth exchange, and ngrok tunnel discovery previously called fetch() without a deadline. A server that accepted a connection but never completed its response could therefore hang authentication and startup indefinitely.

Changes

• Added fetchWithAuthTimeout, a shared auth-network helper that:
  • supplies an abort signal to every request;
  • races the request against a hard deadline, including fetch implementations that ignore abort;
  • combines caller cancellation with the helper signal;
  • clears its timer on completion and returns an actionable operation-specific timeout error;
  • performs no automatic retries, avoiding unsafe replay of registration/token POSTs.
• Applied the helper to both OAuth metadata discovery candidates, dynamic client registration, authorization-code exchange, refresh-token exchange, and ChatGPT token exchange.
• Added a short 2-second per-request deadline for local ngrok API polling.
• Updated ngrok polling to pass the remaining 15-second discovery budget into each request and cap the sleep interval, so a stalled request cannot extend the advertised overall window.
• Added hanging-fetch and caller-cancellation regression tests plus a metadata-discovery timeout test.
• Added a patch changeset.

Behavior and safety

Transient provider failures are surfaced to the existing auth error paths instead of being retried implicitly. The timeout message identifies the operation and tells the user to check connectivity and retry. Existing endpoint validation, redirect handling, and token response validation remain unchanged.

Validation

• pnpm run lint:check
• pnpm run typecheck
• pnpm exec prettier --check (changed files)
• pnpm test — 68 files, 794 tests passed

[changeset-bot]

🦋 Changeset detected

Latest commit: 58c0573

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
openwiki	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR