[Bug] Non-streaming provider responses can hang indefinitely after headers arrive

[404-Page-Found]

Description

The provider timeout only covers establishing the HTTP response, not consuming the response body. fetchWithTimeout() clears its timer as soon as fetch() resolves, but the non-streaming providers then call response.json() with no remaining deadline.

A provider that sends HTTP 200 headers and then stalls without completing the JSON body can therefore leave commit-echo suggest (and model discovery during init) waiting indefinitely.

Location

• src/providers/request.ts:3-24 — timeout is cleared immediately after await fetch().
• src/providers/openai-compatible.ts — complete() and fetchModels() await response.json() after the timeout has been cleared.
• src/providers/anthropic.ts — same pattern in complete().
• src/providers/cohere.ts — same pattern in complete() and fetchModels().

Current code path

const response = await fetchWithTimeout(...);
...
const data = await response.json(); // no deadline remains here

Steps to reproduce

1. Configure a provider that reaches the configured endpoint.
2. Have the endpoint return a successful response with headers but keep the response body open/incomplete.
3. Run a non-streaming command such as commit-echo suggest or trigger model discovery with commit-echo init.
4. Observe that the command does not time out.

This can be reproduced deterministically with a test server that writes the status/headers and then never finishes the JSON body.

Expected behavior

The configured provider timeout should bound both response acquisition and response-body consumption, or there should be a separate body-read deadline.

Actual behavior

The timeout ends at response headers. A stalled JSON body has no timeout and can hang the CLI until the user interrupts it.

Suggested fix

Keep the abort controller alive through body consumption, or provide a helper that reads response.text()/JSON under a deadline. Apply the same policy to model discovery and completion requests, not just SSE streaming.

Impact

A transient upstream/proxy failure can make normal suggest or init invocations hang indefinitely. This is separate from the existing streaming timeout work because the current streaming path has its own body-read handling.

Reviewed against current main at c67ff967a018d5fd4b032f6ef6a4981ac9d76a12.

[404-Page-Found]

Triage

Priority: P1 — user-facing reliability

This is a normal-path failure mode in both suggestion generation and model discovery, and it can block the CLI indefinitely after an otherwise successful HTTP response.

Disposition: Fix soon. Treat as a provider I/O timeout issue, distinct from #265 because #265 covers streaming body reads while this covers non-streaming JSON/body consumption.

Suggested implementation: keep the abort/deadline active through body consumption, or add a bounded response-body helper shared by all non-streaming providers and model fetches. Add a regression test with a response whose headers arrive but whose body never completes.

[404-Page-Found]

Triage update

Confirmed on current main (reviewed at c67ff967a018d5fd4b032f6ef6a4981ac9d76a12).

The timeout gap described here is real: src/providers/request.ts clears its timer as soon as fetch() resolves, so non-streaming response.json() / response.text() consumption is no longer bounded.

Affected paths:

• OpenAI-compatible: complete() and fetchModels()
• Anthropic: complete()
• Cohere: complete() and fetchModels()

A server that returns successful headers and then leaves the JSON body incomplete can therefore leave commit-echo suggest or model discovery during init waiting indefinitely.

Disposition: P1 / fix soon. This is user-facing reliability behavior on normal command paths.

Related issue: distinct from #265. PR #292 fixed the equivalent stalled-body problem for SSE streaming and intentionally left non-streaming body consumption unchanged; #304 is the follow-up for JSON/body reads.

Implementation direction: introduce a shared bounded body-read/JSON helper (or keep a deadline/abort controller alive through body consumption) and apply it consistently to completion and model-discovery requests. Add a regression test with headers delivered first and a response body that never completes.

[404-Page-Found]

Implemented in PR #320: #320

The fix keeps the provider abort controller through body consumption and adds shared timeout-bounded response text/JSON readers. OpenAI-compatible completion/model discovery, Anthropic completion, and Cohere completion/model discovery now bound stalled non-streaming response bodies, with regression tests for headers arriving before an incomplete JSON body.

The full local test suite could not run because this environment cannot reach github.com. The new timeout helper was type-checked with TypeScript and its stalled-body regression was executed locally.