[WRONG BRANCH] Enforce absolute first-byte/header deadline for pinned HTTP requests

[luvs01]

Motivation

• Prevent a slow-header availability hang where legacy callers that only supply idleTimeoutMs relied on a resettable socket idle timeout and could be kept open by an attacker dripping partial response headers.

Description

• Always start the absolute first-byte/header timer after TCP/TLS socket connect (both when the socket is already connected and when the socket emits its connected event).
• Preserve the legacy req.setTimeout(legacyIdleTimeoutMs) behavior so callers that rely on the idle socket timeout keep their existing compatibility semantics.
• Add a regression test tests/pinned-http.test.ts that spins a local server which drips an unterminated header to verify the request now fails with a timeout instead of hanging indefinitely.
• Modified files: src/lib/pinned-http.ts and added tests/pinned-http.test.ts.

Testing

• Ran bun test tests/pinned-http.test.ts tests/images/pinned-https-get.test.ts and the focused tests passed.
• Ran bun run typecheck and bun run privacy:scan and both succeeded.
• A full bun run test was attempted but produced unrelated environment-sensitive failures and timeouts, so verification relied on the focused tests and typecheck/privacy scan above.

---

Codex Task

Summary by CodeRabbit

• Bug Fixes

  • Enforced response-header timeouts consistently, including when connections are already established or use legacy timeout settings.
  • Requests now time out when a server continuously sends incomplete response headers.

• Tests

  • Added coverage for response-header timeout behavior with slowly streaming server responses.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: da26c34f-9625-459d-a5d6-c41d3bd1ff8a

📥 Commits

Reviewing files that changed from the base of the PR and between d9de895 and db6114d.

📒 Files selected for processing (2)

• src/lib/pinned-http.ts
• tests/pinned-http.test.ts

Included review availability: Your plan includes up to 3 reviews per rolling hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The pinned HTTP client now starts first-byte timeout tracking for legacy and non-legacy socket configurations. A Bun integration test verifies timeout enforcement during incomplete response headers.

Changes

HTTP timeout enforcement

Layer / File(s)	Summary
First-byte timeout tracking src/lib/pinned-http.ts	The first-byte timeout now starts for already connected sockets and newly connected sockets, including legacy idle-timeout configurations.
Timeout integration validation tests/pinned-http.test.ts	A Bun test uses a local TCP server that slowly sends incomplete response headers, then verifies that pinnedHttpGet rejects after idleTimeoutMs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to db611

The PR adds an absolute first-byte/header timeout while preserving legacy idle-timeout behavior; no actionable merge-blocking risk remains at the current head.

Suggested reviewers: wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: enforcing an absolute first-byte/header deadline for pinned HTTP requests.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/propose-fix-for-slow-header-dos-vulnerability

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: db6114db0a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve zero as the disabled legacy timeout

When a caller passes idleTimeoutMs: 0 to disable the legacy socket timeout, firstByteTimeoutMs also becomes zero and this unconditional call schedules an immediate JavaScript timer. Consequently, any response whose headers arrive on a later turn is rejected with first_byte_timeout; before this commit, req.setTimeout(0) and response.setTimeout(0) disabled the timeout and the same request succeeded. Preserve the established zero-timeout behavior by skipping the absolute timer when the inherited legacy value is zero (or otherwise normalize disabled legacy timeouts).

AGENTS.md reference: src/AGENTS.md:L10-L10

Useful? React with 👍 / 👎.