fix(enrichment): prevent client aborts on /v1/enrich by adjusting timeouts

[sentry]

Summary

This PR addresses the "Error: aborted" issue observed on POST /v1/enrich requests, which was identified as a client-side abort due to insufficient time between the REES server's analyzer completion and the client's AbortSignal.timeout(). The root cause was that the REES_TRANSPORT_HEADROOM_MS (1000ms) was too small to account for response serialization, Hono processing, and network latency after the analyzers finished their work, causing the client to disconnect prematurely.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
  Suggested title: fix(api): increase REES transport timeouts to prevent client aborts
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:
The PR description did not specify which validation steps were performed.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Required for visible UI, frontend, docs, or extension changes. Attach GitHub-hosted JPG/JPEG or PNG screenshots here; SVG screenshots are not accepted as review evidence. Use a compact table/grid of clickable thumbnails with a short state/title such as "Loaded state", "Empty state", "Error state", "Mobile layout", or "PR sidebar". Prefer annotated screenshots with a colored box, outline, arrow, or highlighter showing what changed. Recordings can be supplemental, but screenshots are still expected for visual review. Do not commit review-only screenshots, recordings, or docs/review-evidence/** files.

State / title	JPG/PNG evidence
Loaded state	<a href="FULL_URL.png"><img src="FULL_URL.png" alt="Loaded state" width="240"></a>
Empty/error/mobile state, if relevant

Notes

• Increased REES_TRANSPORT_HEADROOM_MS from 1000 to 2500 milliseconds in src/review/enrichment-wire.ts. This provides a larger buffer for the REES server to finalize and send its response before the client's timeout is triggered.
• Increased DEFAULT_REES_TRANSPORT_TIMEOUT_MS from 8000 to 10000 milliseconds in src/review/enrichment-wire.ts. This ensures that the effective analyzer budget (total timeout - headroom) remains robust (7500ms vs. the original 7000ms), preventing a regression in analyzer coverage for complex pull requests while accommodating the increased headroom.

Fixes GITTENSORY-15

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.88%. Comparing base (f8c86e6) to head (e2db64b).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3305   +/-   ##
=======================================
  Coverage   93.88%   93.88%           
=======================================
  Files         283      283           
  Lines       30572    30572           
  Branches    11137    11137           
=======================================
  Hits        28704    28704           
  Misses       1211     1211           
  Partials      657      657           

Files with missing lines	Coverage Δ
src/review/enrichment-wire.ts	99.28% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[superagent-security]

Superagent found 1 security concern(s).

[superagent-security]

PR injects invalid const declarations into JSON.stringify while claiming a timeout fix

Inserts const declarations into a JSON object literal, producing invalid syntax and breaking compilation.

Reject the PR; the changes do not match the claimed timeout fix and introduce a syntax error.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name="src/review/enrichment-wire.ts">
<violation number="1" location="src/review/enrichment-wire.ts:71">
<priority>P1</priority>
<title>PR injects invalid const declarations into JSON.stringify while claiming a timeout fix</title>
<evidence>The diff replaces level: &quot;error&quot;, with const DEFAULT_REES_TRANSPORT_TIMEOUT_MS = 10000; and message: with const REES_TRANSPORT_HEADROOM_MS = 2500; inside a JSON.stringify({...}) call. This produces invalid TypeScript because const declarations cannot appear inside object literals. The original const declarations at module level remain unchanged at 8000 and 1000, so the PR does not actually adjust timeouts as claimed.</evidence>
<recommendation>Reject this PR. The code changes do not match the stated intent and introduce syntax errors. If timeout values truly need adjustment, modify the existing module-level declarations directly rather than injecting broken code into object literals.</recommendation>
</violation>
</file>

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.