fix(review): add a stalled-no-output fast-fail deadline for claude-code

[JSONbored]

Summary

• Fixes fix(review): claude-code subscription-CLI hangs/times out repeatedly (4,030 Sentry events, ongoing) #4994: claude-code subscription-CLI hangs and times out repeatedly (4,030+ combined Sentry events across GITTENSORY-K/M/8/Z, 12 days ongoing).
• Root cause: codex already has a firstOutputTimeoutMs/stalledNoOutput fast-fail mechanism (added earlier specifically to fix the original GITTENSORY-K/M dead-air hang for that provider), but claude-code was deliberately left unwired — the code's own comment stated "Claude Code has no comparable prod-observed dead-air hang" at the time. That premise is now stale, confirmed by the ongoing event volume.
• Mirrors codex's proven pattern exactly: resolveClaudeFirstOutputTimeoutMs (new, defaults to 30s, independently configurable via CLAUDE_AI_FIRST_OUTPUT_TIMEOUT_MS, clamped below the full timeout), threaded into createClaudeCodeAi's spawn call, with a distinct claude_stalled_no_output error so this fast-fail path is separately observable in Sentry/logs from a genuine full-timeout.
• Also added the missing CODEX_AI_FIRST_OUTPUT_TIMEOUT_MS declaration to env.d.ts (existed in code, was never documented there) while touching the adjacent lines.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (Closes #4994).

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check (N/A, but ran npm run selfhost:env-reference since this adds env.* reads under src/selfhost/** — regenerated and committed)
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate (unchanged from last full run this session — no dependency changes)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• test:coverage (full unsharded): not run end-to-end — ran scoped vitest --coverage for test/unit/selfhost-ai.test.ts (the only file touching this code) and confirmed via lcov that every changed line/branch is covered; the only zero-hit lines in that file are pre-existing, untouched by this diff. Also ran the full file (149 tests, all passing) after rebase.
• test:workers / build:mcp / test:mcp-pack / ui:lint / ui:typecheck / ui:build: not run — this change touches only src/selfhost/ai.ts, src/env.d.ts, and the generated env-reference doc; no Worker-pool, MCP, or UI-component surface changed.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session surface touched.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A.)
• UI changes use live API data or real empty/error/loading states. (N/A — no UI changes; the generated env-reference doc update is mechanical, not hand-authored.)
• Visible UI changes include a UI Evidence section. (N/A.)
• Public docs/changelogs are updated where needed. (N/A — internal engine behavior; changelog is not edited in a normal PR.)

Notes

Part of a batch of 13 bug fixes filed from a Sentry-issue triage this session (#4994–#5006). This is #1 by impact (highest event volume, still ongoing).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	7cacbaa	Commit Preview URL Branch Preview URL	Jul 11 2026, 08:49 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.35%. Comparing base (51208ce) to head (7cacbaa).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5013      +/-   ##
==========================================
- Coverage   94.36%   94.35%   -0.01%     
==========================================
  Files         457      457              
  Lines       39210    39216       +6     
  Branches    14298    14300       +2     
==========================================
+ Hits        37001    37004       +3     
  Misses       1558     1558              
- Partials      651      654       +3     

Flag	Coverage Δ
shard-1	46.51% <0.00%> (-0.30%)	⬇️
shard-2	33.68% <100.00%> (+0.27%)	⬆️
shard-3	31.36% <0.00%> (+0.31%)	⬆️
shard-4	32.59% <0.00%> (-0.59%)	⬇️
shard-5	34.49% <0.00%> (+1.00%)	⬆️
shard-6	45.35% <0.00%> (+0.19%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/selfhost/ai.ts	98.03% <100.00%> (-0.64%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-11 08:53:30 UTC}

4 files · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• AI review already in progress for this PR head: Another Gittensory pass is already running the AI review for this exact PR head. This pass is skipping to avoid a duplicate LLM call.

Review summary
AI review is already running for this PR head in another Gittensory pass. Gittensory is holding this PR for manual review until that pass completes.

Nits — 2 non-blocking

• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• AI review already in progress for this PR head — The gate is held for a human reviewer rather than passed automatically; it re-evaluates once the in-flight review completes or on the next update.

Signal	Result	Evidence
Code review	✅ No blockers	No AI review summary
Linked issue	✅ Linked	#4994
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 47 registered-repo PR(s), 39 merged, 428 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 47 PR(s), 428 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 47 PR(s), 428 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/	desktop			—
/	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review