@pnpm/error 1100.1.3 → 1100.2.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @pnpm/error
 
+## 1100.2.0
+
+### Minor Changes
+
+- When the registry stops sending data for longer than `fetchTimeout`, pnpm now reports that the metadata or tarball request timed out. Previously the error did not mention the timeout [#3646](https://github.com/pnpm/pnpm/issues/3646).
+
+## 1100.1.4
+
+### Patch Changes
+
+- Fetch and tarball errors no longer print the secrets of the URL they name. Inline `user:pass@` credentials and the query string or fragment of a signed URL are hidden, so a failed install or `pnpm add <url>` cannot leak them into terminal scrollback or CI logs.
+
 ## 1100.1.3
 
 ### Patch Changes

package/lib/index.d.ts

@@ -28,18 +28,16 @@ export declare class FetchError extends PnpmError {
     constructor(request: FetchErrorRequest, response: FetchErrorResponse, hint?: string);
 }
 /**
- * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
- * text, e.g. `GET https://user:pass@host/pkg: …` → `GET https://host/pkg: …`.
- * A registry configured as `https://user:pass@host/` would otherwise leak its
- * embedded basic-auth credentials into every error message that interpolates
- * the request URL (terminal output, CI logs). `FetchError` already hides the
- * auth *header*; this covers credentials carried in the URL itself.
- *
- * Implemented as a single forward scan rather than a regex: `text` is
- * uncontrolled (it interpolates the request URL), so a backtracking pattern is
- * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
- * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
+ * undici fails a timed-out request with a bare `fetch failed` or `terminated`
+ * and keeps the timeout only in the error's `cause` chain.
  */
+export declare function isFetchTimeoutError(error: unknown): boolean;
+export declare class FetchTimeoutError extends PnpmError {
+    constructor(code: string, url: string, timeout: number | undefined, opts: {
+        attempts?: number;
+        cause: unknown;
+    });
+}
 export declare function redactUrlCredentials(text: string): string;
 /**
  * Make untrusted, URL-bearing text safe to print or log: redact inline

package/lib/index.js

@@ -22,7 +22,7 @@ export class FetchError extends PnpmError {
         if (request.authHeaderValue) {
             _request.authHeaderValue = hideAuthInformation(request.authHeaderValue);
         }
-        const message = `GET ${redactUrlCredentials(request.url)}: ${response.statusText} - ${response.status}`;
+        const message = `GET ${redactUrlSecrets(request.url)}: ${response.statusText} - ${response.status}`;
         // NOTE: For security reasons, some registries respond with 404 on authentication errors as well.
         // So we print authorization info on 404 errors as well.
         if (response.status === 401 || response.status === 403 || response.status === 404) {
@@ -39,6 +39,34 @@ export class FetchError extends PnpmError {
         this.response = response;
     }
 }
+/**
+ * undici codes for a request that made no progress for `fetchTimeout`: no
+ * response head, or a body that stopped arriving.
+ */
+const FETCH_TIMEOUT_ERROR_CODES = new Set(['UND_ERR_HEADERS_TIMEOUT', 'UND_ERR_BODY_TIMEOUT']);
+/**
+ * undici fails a timed-out request with a bare `fetch failed` or `terminated`
+ * and keeps the timeout only in the error's `cause` chain.
+ */
+export function isFetchTimeoutError(error) {
+    let current = error;
+    for (let depth = 0; depth < 8 && current != null && typeof current === 'object'; depth++) {
+        const { code, cause } = current;
+        if (typeof code === 'string' && FETCH_TIMEOUT_ERROR_CODES.has(code))
+            return true;
+        current = cause;
+    }
+    return false;
+}
+export class FetchTimeoutError extends PnpmError {
+    constructor(code, url, timeout, opts) {
+        const reason = timeout == null ? 'waiting for data' : `no data received for ${timeout}ms`;
+        super(code, `GET ${redactUrlForDisplay(url)}: timed out, ${reason}`, {
+            ...opts,
+            hint: 'The registry stopped responding. If it is just slow, increase the fetchTimeout setting.',
+        });
+    }
+}
 /**
  * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
  * text, e.g. `GET https://user:pass@host/pkg: …` → `GET https://host/pkg: …`.
@@ -52,6 +80,32 @@ export class FetchError extends PnpmError {
  * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
  * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
  */
+/**
+ * A request URL made safe to print: its `user:pass@` userinfo and control
+ * characters redacted ({@link redactAndSanitize}), then everything from the
+ * query or fragment onwards dropped — a signed tarball or registry URL
+ * carries a reusable token there, which credential redaction alone keeps.
+ *
+ * `[hidden]` when the cut would leave credential material behind. A password
+ * containing `?` or `#` defeats the userinfo scan — it reads the `?` as the
+ * end of the authority and leaves the whole `user:pa?ss@host` in place — so
+ * cutting there would publish the password's prefix. The authority is
+ * therefore checked before the cut, not after: any `@` still in front of the
+ * path means the userinfo survived.
+ *
+ * Cuts rather than re-rendering through `URL`, unlike
+ * {@link redactUrlForDisplay}: that round-trip normalizes the spelling
+ * (`https://host` gains a trailing slash, percent-escapes change case), and
+ * an error message should echo the URL the request was given.
+ */
+function redactUrlSecrets(url) {
+    const sanitized = redactAndSanitize(url);
+    const schemeEnd = sanitized.indexOf('://');
+    const afterScheme = schemeEnd === -1 ? sanitized : sanitized.slice(schemeEnd + '://'.length);
+    if (afterScheme.split('/')[0].includes('@'))
+        return '[hidden]';
+    return sanitized.split(/[?#]/)[0];
+}
 export function redactUrlCredentials(text) {
     let result = '';
     let cursor = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/error",
-  "version": "1100.1.3",
+  "version": "1100.2.0",
   "description": "An error class for pnpm errors",
   "keywords": [
     "pnpm",
@@ -32,7 +32,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/error": "1100.1.3"
+    "@pnpm/error": "1100.2.0"
   },
   "engines": {
     "node": ">=22.13"