fix(server): stalled OAuth token requests no longer block credential calls

[t3dotgg]

OAuth token and device-authorization requests in the server had no timeout. If the token endpoint stalled, even after it sent headers, a token refresh hung forever while it held the credential lock. Every later credential call (getExisting, hasCredential, get, store) then waited behind it.

Fix

CliTokenManager now puts a 10s timeout over each token request and over the initial device-authorization request. The timeout covers the request and the response-body read. Callers already turn these errors into CloudCliCredentialRefreshError or CloudCliAuthorizationError, so error handling does not change. Waits for the user (the browser callback and device-code polling) keep their existing limits.

Proof

• Reproduced on main with a real local HTTP server, in two modes: no response, and 200 headers then a stalled body. Device authorization and refresh stayed pending for more than 12s, and hasCredential stayed blocked behind the refresh. With the fix, all of them settle. This repro script is not committed.
• Two new tests in CliTokenManager.test.ts use TestClock and a response whose body never finishes. One checks that a stalled refresh fails and releases the lock. One checks that a stalled device-authorization request fails. Both hang without the fix and pass with it. The full file passes (10/10).
• Server typecheck, lint, and format pass on the changed files.

The diagnosis came from #14136.

Reviewed with sol-loop: 1 round with GPT-6.1 Sol.

Model and harness: Claude Opus 5.5 in Claude Code via T3 Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR changes production OAuth token and device-authorization behavior by introducing request and response-body timeouts, while adding focused regression tests. The scope is small and clear, but authentication-related runtime changes warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Team
• Run ID: b0e2c76e-a670-4844-90d2-2c479f79db5c

📥 Commits

Reviewing files that changed from the base of the PR and between 614b432 and 315850c.

📒 Files selected for processing: 2

• apps/server/src/cloud/CliTokenManager.test.ts
• apps/server/src/cloud/CliTokenManager.ts

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

📝 Walkthrough

OAuth token exchange and device authorization requests now time out after 10 seconds, including response-body parsing. Tests cover stalled responses, refresh failure, and credential lock release.

Changes: OAuth request timeouts

Layer / File(s)	Summary
Bound OAuth requests and test stalled responses apps/server/src/cloud/CliTokenManager.ts, apps/server/src/cloud/CliTokenManager.test.ts	Token exchange and device authorization requests time out after 10 seconds. Tests use a response body that does not complete. The refresh test checks for CloudCliCredentialRefreshError and confirms the credential remains available after the refresh fiber fails. The device-authorization test checks for a timeout cause.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 31585

Stalled OAuth requests now fail after 10 seconds instead of holding the credential lock, and no merge-blocking risk remains.

Pre-merge checks: 4

Passed checks: 4 passed

Check name	Status	Explanation
Description check		The description explains the problem, fix, timeout scope, verification steps, observed results, issue reference, and tool checks. It uses "## Fix" and "## Proof" instead of the template headings and d…
Title check		The title clearly and concisely describes the main change: preventing stalled OAuth token requests from blocking credential calls. It uses an appropriate conventional commit format.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	4.9 KiB	5.0 KiB	+23 B (+0.5%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+23 B (+1.9%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.8 KiB	20.9 KiB	+41 B (+0.2%)	29.3 KiB	✅
Codex	Live turn messages	1	2	+1 (+100.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−7 B (−0.1%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−7 B (−0.6%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 614b432 · PR result: 315850c · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.