[WRONG BRANCH] fix(images): restore connect deadline for provider-returned artifact downloads

[luvs01]

Motivation

• A recent change made connectTimeoutMs opt-in in the pinned HTTP transport, leaving provider-returned image and video downloads without a TCP/TLS connect deadline and creating an availability regression.

Description

• Add a DOWNLOAD_CONNECT_TIMEOUT_MS = 10_000 default for artifact downloads and expose connectTimeoutMs in the pinnedHttpsGet options so callers can override it.
• Forward connectTimeoutMs from pinnedHttpsGet into pinnedHttpGet so provider-returned image/video fetches install a 10s connection-establishment deadline by default.
• Keep the shared pinned HTTP transport behavior unchanged (the transport remains opt-in for other callers).
• Add a focused regression test that mocks a hanging socket and verifies the artifact transport installs and fires the default connect deadline.

Testing

• Ran bun test tests/images/pinned-https-get.test.ts and the new/updated tests passed.
• Ran bun run typecheck (tsc --noEmit) and it succeeded.
• Ran the full suite with bun run test and test execution completed without failures.
• Ran bun run privacy:scan and the privacy scan passed.

---

Codex Task

Summary by CodeRabbit

• Bug Fixes

  • Added a 10-second connection timeout for secure image downloads.
  • Downloads now fail promptly when a connection cannot be established.

• Enhancements

  • Added an optional connection-timeout setting for download requests while preserving existing timeout behavior.

• Tests

  • Added coverage verifying the default connection deadline and timeout error handling.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 88170da0-c90c-4335-89d0-472ca606ce3c

📥 Commits

Reviewing files that changed from the base of the PR and between 6d881db and c8525b9.

📒 Files selected for processing (2)

• src/images/artifacts.ts
• tests/images/pinned-https-get.test.ts

---

📝 Walkthrough

Walkthrough

pinnedHttpsGet now supports a configurable connection timeout, defaults to 10 seconds, forwards it to pinnedHttpGet, and tests timeout rejection while a socket remains connecting.

Changes

Pinned download connection timeout

Layer / File(s)	Summary
Connection timeout contract and wiring src/images/artifacts.ts	pinnedHttpsGet exposes connectTimeoutMs, defaults it to DOWNLOAD_CONNECT_TIMEOUT_MS at 10 seconds, and forwards it to pinnedHttpGet.
Default timeout validation tests/images/pinned-https-get.test.ts	The test mocks a connecting socket, verifies the 10,000 ms timer, triggers it, and asserts the connect-timeout rejection.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: ingwannu, lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the image-download connection deadline restoration, which matches the main change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/propose-fix-for-missing-connect-timeout

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c8525b9565

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Arm the deadline for Bun TLS handshakes

When a peer accepts TCP but never completes TLS, forwarding this value does not restore the deadline on the supported Bun 1.3.14 runtime: Bun emits the ClientRequest socket with socket.connecting === false, so pinnedHttpRequest skips creating its connect timer and the artifact download waits for the 60-second idle timeout instead. I reproduced this with a local TCP listener that accepts without speaking TLS; update the shared transport to keep HTTPS connections timed until secureConnect without gating on socket.connecting, and cover that actual socket state rather than forcing connecting: true in the mock.

AGENTS.md reference: src/AGENTS.md:L7-L9

Useful? React with 👍 / 👎.