fix(miner-extension): bound the ranked-candidates sync fetch with a timeout

[galuis116]

Summary

• apps/loopover-miner-extension/background.js's syncRankedCandidatesFromMinerUi called fetch with no timeout or AbortController, unlike the established pattern in review-enrichment/src/external-fetch.ts. This sync runs on a 10-minute alarm, so a hung connection (e.g. the local miner-ui process running but unresponsive) would leave that alarm invocation hanging indefinitely instead of failing fast and letting the next scheduled attempt retry.
• Adds a local RANKED_CANDIDATES_FETCH_TIMEOUT_MS = 3000 constant (short, since this is a same-machine localhost call, not a remote round-trip) and wires signal: AbortSignal.timeout(...) into the fetch call.
• The function's existing try/catch already resolves any thrown/aborted fetch to its documented { ok: false, error, minerUiUrl } shape — no new error handling was needed to satisfy the "never throws" contract.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves.

Closes #7007

Validation

• git diff --check
• npm run lint --workspace @loopover/miner-extension (this workspace's own node --check lint/typecheck)
• npm run test --workspace @loopover/miner-extension — 24/24 passing with coverage: 100% statements/lines, 95.79% branches on background.js (identical to the pre-existing baseline; all uncovered lines are unrelated pre-existing branches, not part of this diff)
• npm run actionlint / whole-repo npm run typecheck (not applicable — this is an isolated browser-extension workspace with its own lint/test scripts, unaffected by backend changes)
• npm run test:workers / npm run build:mcp / npm run test:mcp-pack / npm run ui:openapi:check (not applicable to this extension-only change)
• npm audit --audit-level=moderate (no dependency changes)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• This PR only touches apps/loopover-miner-extension/**, which has its own isolated lint/test scripts (run above, both green) and no dependency on the backend build/typecheck pipeline. The whole-repo actionlint/typecheck and MCP/Worker/OpenAPI checks have no surface to exercise for a change scoped to one fetch call in one browser-extension module.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/cookie/CORS/session changes; this is a local-network browser-extension fetch.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/OpenAPI/MCP surface.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — background service-worker logic, no rendered UI.)
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots. (N/A — no visible UI change; this is a background-alarm timeout fix.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-17 20:03:10 UTC}

2 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · unknown

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This is a small, well-targeted fix: it adds a 3s AbortSignal.timeout to the previously-unbounded fetch in syncRankedCandidatesFromMinerUi, following the established timeout pattern elsewhere in the repo (http-retry.js, external-fetch.ts). The existing try/catch already normalizes any AbortError/DOMException into the documented {ok:false, error, minerUiUrl} shape, so no additional error-handling was needed, and the new tests genuinely exercise the real hung-connection path (the hanging fetch mock only rejects on abort, not on its own) rather than fabricating an unreachable scenario. The change is correctly scoped, closes the linked issue #7007, and CI is green.

Nits — 4 non-blocking

• nit: the 3000ms constant is a reasonable but arbitrary choice for a localhost call — consider a brief note on why 3s specifically (vs. e.g. 1s) was chosen, given how fast a same-machine connection should normally resolve.
• nit: background.js:118-121 — the DOMException message/name in the hanging-fetch test ('TimeoutError') isn't asserted against the returned error string, so a future change to AbortSignal.timeout's rejection shape wouldn't be caught by this test alone.
• Consider asserting the returned `error` string in the stalled-connection test (background.test.ts) to confirm the abort reason surfaces meaningfully to the user, not just that ok is false.
• The comment block above RANKED_CANDIDATES_FETCH_TIMEOUT_MS could be trimmed to one line per repo convention elsewhere (e.g. http-retry.js's DEFAULT_MAX_ATTEMPTS) rather than a 4-line block for a single constant.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#7007
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 1962 registered-repo PR(s), 1288 merged, 52 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	galuis116; Gittensor profile; 1962 PR(s), 52 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Review context

• Author: galuis116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 1962 PR(s), 52 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/	desktop	before /	after /	—
/	mobile	before / (mobile)	after / (mobile)	—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review