codex-copilot-dx 0.6.15 → 0.6.19

package/src/auth.mjs

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
+import { atomicWriteFilePairSync, atomicWriteFileSync } from "./atomic-file.mjs";
 import {
   githubIdentityMatchesExpected,
   githubTokenFingerprint,
@@ -15,6 +16,11 @@ const CLIENT_ID = "Iv1.b507a08c87ecfe98"; // Public GitHub Copilot client ID.
 const SCOPE = "read:user";
 const GITHUB_API = "https://api.github.com";
 const COPILOT_TOKEN_URL = `${GITHUB_API}/copilot_internal/v2/token`;
+const ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
+const DEFAULT_DEVICE_EXPIRES_SECONDS = 900;
+const DEFAULT_DEVICE_CODE_TIMEOUT_MS = 30 * 1000;
+const MAX_DEVICE_FLOW_JSON_BYTES = 64 * 1024;
 const DISABLE_TOKEN_DISCOVERY_VALUES = new Set(["1", "true", "yes"]);
 const MAX_AUTH_JSON_BYTES = 1024 * 1024;
 
@@ -48,7 +54,196 @@ export function interpretPoll(data) {
   }
 }
 
-function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
+function abortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+function sleep(ms, { signal } = {}) {
+  if (signal?.aborted) return Promise.reject(abortError(signal));
+  return new Promise((resolve, reject) => {
+    const cleanup = () => signal?.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+      clearTimeout(timer);
+      cleanup();
+      reject(abortError(signal));
+    };
+    const timer = setTimeout(() => {
+      cleanup();
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+function awaitWithSignal(operation, signal) {
+  if (signal?.aborted) return Promise.reject(abortError(signal));
+  return new Promise((resolve, reject) => {
+    const cleanup = () => signal?.removeEventListener("abort", onAbort);
+    const finish = (callback, value) => {
+      cleanup();
+      callback(value);
+    };
+    const onAbort = () => finish(reject, abortError(signal));
+    signal?.addEventListener("abort", onAbort, { once: true });
+    Promise.resolve()
+      .then(operation)
+      .then((value) => finish(resolve, value), (error) => finish(reject, error));
+  });
+}
+
+async function discardBoundedResponseBody(response) {
+  const transport = await import("./http-transport.mjs");
+  return transport.discardBoundedResponseBody(response);
+}
+
+async function readDeviceFlowJson(response, signal, label) {
+  if (typeof response?.body?.getReader === "function") {
+    const transport = await import("./http-transport.mjs");
+    const text = await awaitWithSignal(() => transport.readBoundedResponseText(response, {
+      maxBytes: MAX_DEVICE_FLOW_JSON_BYTES,
+      label,
+    }), signal);
+    return JSON.parse(text);
+  }
+  return awaitWithSignal(() => response.json(), signal);
+}
+
+function cancelResponseBody(response) {
+  try { Promise.resolve(response?.body?.cancel?.()).catch(() => {}); } catch {}
+}
+
+function deviceCodeTimeoutError(timeoutMs) {
+  const error = new Error(`Device code request timed out after ${timeoutMs}ms`);
+  error.code = "CCDX_DEVICE_CODE_TIMEOUT";
+  return error;
+}
+
+export async function requestGithubDeviceCode({
+  fetchImpl = fetch,
+  signal,
+  timeoutMs = DEFAULT_DEVICE_CODE_TIMEOUT_MS,
+} = {}) {
+  const parsedTimeout = Number(timeoutMs);
+  const deadlineMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0
+    ? parsedTimeout
+    : DEFAULT_DEVICE_CODE_TIMEOUT_MS;
+  const controller = new AbortController();
+  let response;
+  const onCallerAbort = () => controller.abort(signal.reason);
+  signal?.addEventListener("abort", onCallerAbort, { once: true });
+  if (signal?.aborted) onCallerAbort();
+  const timer = setTimeout(() => controller.abort(deviceCodeTimeoutError(deadlineMs)), deadlineMs);
+  try {
+    response = await awaitWithSignal(() => fetchImpl("https://github.com/login/device/code", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),
+      signal: controller.signal,
+    }), controller.signal);
+    if (!response.ok) {
+      await awaitWithSignal(() => discardBoundedResponseBody(response), controller.signal);
+      return { response, data: null, jsonError: null };
+    }
+    try {
+      const data = await readDeviceFlowJson(response, controller.signal, "Device code response");
+      return { response, data, jsonError: null };
+    } catch (error) {
+      if (controller.signal.aborted) throw error;
+      return { response, data: null, jsonError: error };
+    }
+  } catch (error) {
+    cancelResponseBody(response);
+    if (signal?.aborted) throw abortError(signal);
+    if (controller.signal.aborted) throw abortError(controller.signal);
+    throw error;
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onCallerAbort);
+  }
+}
+
+export async function pollGithubDeviceFlow({
+  deviceCode,
+  interval,
+  expiresIn,
+  fetchImpl = fetch,
+  signal,
+  sleepImpl = sleep,
+  now = Date.now,
+} = {}) {
+  const parsedInterval = Number(interval);
+  const parsedExpires = Number(expiresIn);
+  let waitMs = (Number.isFinite(parsedInterval) && parsedInterval > 0
+    ? parsedInterval
+    : DEFAULT_DEVICE_INTERVAL_SECONDS) * 1000;
+  const expiresMs = (Number.isFinite(parsedExpires) && parsedExpires > 0
+    ? parsedExpires
+    : DEFAULT_DEVICE_EXPIRES_SECONDS) * 1000;
+  const deadline = now() + expiresMs;
+
+  while (true) {
+    const remainingMs = deadline - now();
+    if (remainingMs <= 0) return { state: "expired" };
+    await sleepImpl(Math.min(waitMs, remainingMs), { signal });
+    if (signal?.aborted) throw abortError(signal);
+    if (now() >= deadline) return { state: "expired" };
+
+    const pollController = new AbortController();
+    let deadlineExpired = false;
+    const onCallerAbort = () => pollController.abort(signal.reason);
+    signal?.addEventListener("abort", onCallerAbort, { once: true });
+    if (signal?.aborted) onCallerAbort();
+    const deadlineTimer = setTimeout(() => {
+      deadlineExpired = true;
+      pollController.abort();
+    }, Math.max(1, deadline - now()));
+    let result;
+    let pollResponse;
+    try {
+      pollResponse = await fetchImpl(ACCESS_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({
+          client_id: CLIENT_ID,
+          device_code: deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }),
+        signal: pollController.signal,
+      });
+      if (now() >= deadline) {
+        await awaitWithSignal(() => discardBoundedResponseBody(pollResponse), pollController.signal);
+        return { state: "expired" };
+      }
+      if (!pollResponse.ok) {
+        await awaitWithSignal(() => discardBoundedResponseBody(pollResponse), pollController.signal);
+        if (now() >= deadline) return { state: "expired" };
+        continue;
+      }
+      result = interpretPoll(await readDeviceFlowJson(
+        pollResponse,
+        pollController.signal,
+        "Device Flow poll response",
+      ));
+      if (now() >= deadline) return { state: "expired" };
+    } catch (error) {
+      cancelResponseBody(pollResponse);
+      if (signal?.aborted) throw abortError(signal);
+      if (deadlineExpired || now() >= deadline) return { state: "expired" };
+      throw error;
+    } finally {
+      clearTimeout(deadlineTimer);
+      signal?.removeEventListener("abort", onCallerAbort);
+    }
+    if (result.state === "slow") {
+      waitMs += 5000;
+      continue;
+    }
+    if (result.state !== "wait") return result;
+  }
+}
 
 function expandHome(filePath, home = os.homedir()) {
   if (!filePath) return "";
@@ -465,6 +660,9 @@ export async function ensureAuth({
   signal,
   log = console.log,
   openAndCopyFn = openAndCopy,
+  deviceCodeTimeoutMs = DEFAULT_DEVICE_CODE_TIMEOUT_MS,
+  sleepImpl = sleep,
+  now = Date.now,
 } = {}) {
   const GITHUB_TOKEN_PATH = githubTokenPath(home);
   if (fs.existsSync(GITHUB_TOKEN_PATH)) {
@@ -490,74 +688,89 @@ export async function ensureAuth({
 
     // Request a device code while holding the auth lock so concurrent starts do not
     // trigger multiple browser/device-flow sessions for the same local token.
-    const codeResp = await fetchImpl("https://github.com/login/device/code", {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),
+    const codeResult = await requestGithubDeviceCode({
+      fetchImpl,
       signal,
+      timeoutMs: deviceCodeTimeoutMs,
     });
-    if (!codeResp.ok) throw new Error(`device code request failed: ${codeResp.status}`);
-    const { device_code, user_code, verification_uri, interval } = await codeResp.json();
+    const codeResp = codeResult.response;
+    if (!codeResp.ok) {
+      throw new Error(`device code request failed: ${codeResp.status}`);
+    }
+    if (codeResult.jsonError) throw codeResult.jsonError;
+    const {
+      device_code,
+      user_code,
+      verification_uri,
+      interval,
+      expires_in,
+    } = codeResult.data;
 
     // Prompt the user.
     log(`\n${status("info", `Open ${verification_uri}`)}\n${status("info", `Enter code: ${user_code}`)}\n`);
     openAndCopyFn(user_code, verification_uri);
 
-    // Poll until GitHub completes the device flow.
-    let waitMs = (interval || 5) * 1000;
-    while (true) {
-      await sleep(waitMs);
-      const pollResp = await fetchImpl("https://github.com/login/oauth/access_token", {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
-        body: JSON.stringify({
-          client_id: CLIENT_ID,
-          device_code,
-          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        }),
-        signal,
-      });
-      if (!pollResp.ok) {
-        // Treat transient network/server errors as pending and retry.
-        continue;
-      }
-      const data = await pollResp.json();
-      const r = interpretPoll(data);
-      if (r.state === "done") {
-        const identity = await fetchGithubIdentity(r.token, { fetchImpl, signal });
-        writeToken(r.token, home, identity.ok ? identity : null);
-        log(status("ok", "Login successful"));
-        return;
-      }
-      if (r.state === "slow") { waitMs += 5000; continue; }
-      if (r.state === "fail") throw new Error(`Login failed: ${r.error}`);
-      // wait: continue polling.
+    const result = await pollGithubDeviceFlow({
+      deviceCode: device_code,
+      interval,
+      expiresIn: expires_in,
+      fetchImpl,
+      signal,
+      sleepImpl,
+      now,
+    });
+    if (result.state === "done") {
+      const identity = await fetchGithubIdentity(result.token, { fetchImpl, signal });
+      writeToken(result.token, home, identity.ok ? identity : null);
+      log(status("ok", "Login successful"));
+      return;
     }
+    if (result.state === "expired") throw new Error("Login failed: device code expired");
+    throw new Error(`Login failed: ${result.error}`);
   }, tokenLockOptions(env));
 }
 
-export function writeGithubTokenMetadata(identity, home = os.homedir(), token = "") {
+function githubTokenMetadataData(identity, token, now = () => new Date()) {
   const normalized = normalizeGithubIdentity(identity);
-  if (!normalized) return false;
-  const filePath = githubTokenMetadataPath(home);
-  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
-  fs.writeFileSync(filePath, `${JSON.stringify({
+  if (!normalized) return null;
+  const timestamp = now();
+  const updatedAt = timestamp instanceof Date ? timestamp.toISOString() : new Date(timestamp).toISOString();
+  return `${JSON.stringify({
     ...normalized,
     token_fingerprint: githubTokenFingerprint(token),
-    updated_at: new Date().toISOString(),
-  }, null, 2)}\n`, { mode: 0o600 });
+    updated_at: updatedAt,
+  }, null, 2)}\n`;
+}
+
+export function writeGithubTokenMetadata(identity, home = os.homedir(), token = "", {
+  now = () => new Date(),
+  writeFile = atomicWriteFileSync,
+} = {}) {
+  const metadata = githubTokenMetadataData(identity, token, now);
+  if (metadata === null) return false;
+  const filePath = githubTokenMetadataPath(home);
+  const directory = path.dirname(filePath);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  fs.chmodSync(directory, 0o700);
+  writeFile(filePath, metadata, { mode: 0o600, preserveMode: false });
   fs.chmodSync(filePath, 0o600);
   return true;
 }
 
-export function writeToken(token, home = os.homedir(), identity = null) {
+export function writeToken(token, home = os.homedir(), identity = null, {
+  now = () => new Date(),
+  writeFile = atomicWriteFileSync,
+  unlinkFile = fs.unlinkSync,
+} = {}) {
   const GITHUB_TOKEN_PATH = githubTokenPath(home);
-  fs.mkdirSync(path.dirname(GITHUB_TOKEN_PATH), { recursive: true });
-  fs.writeFileSync(GITHUB_TOKEN_PATH, token, { mode: 0o600 });
-  fs.chmodSync(GITHUB_TOKEN_PATH, 0o600);
-  if (normalizeGithubIdentity(identity)) {
-    writeGithubTokenMetadata(identity, home, token);
-  } else {
-    try { fs.unlinkSync(githubTokenMetadataPath(home)); } catch (e) { if (e?.code !== "ENOENT") throw e; }
-  }
+  const directory = path.dirname(GITHUB_TOKEN_PATH);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  fs.chmodSync(directory, 0o700);
+  atomicWriteFilePairSync(
+    GITHUB_TOKEN_PATH,
+    token,
+    githubTokenMetadataPath(home),
+    githubTokenMetadataData(identity, token, now),
+    { mode: 0o600, writeFile, unlinkFile },
+  );
 }

package/src/cli-auth.mjs

@@ -3,7 +3,8 @@ import { spawn } from "node:child_process";
 import {
   discoverGithubToken,
   fetchGithubIdentity,
-  interpretPoll,
+  pollGithubDeviceFlow,
+  requestGithubDeviceCode,
   sourceDescription,
   validateGithubToken,
 } from "./auth.mjs";
@@ -20,6 +21,10 @@ import {
   githubTokenFingerprint,
   normalizeGithubIdentity,
 } from "./github-identity.mjs";
+import {
+  MAX_UPSTREAM_MODEL_CATALOG_BYTES,
+  readBoundedResponseText,
+} from "./http-transport.mjs";
 import { saveModelCache } from "./model-cache.mjs";
 import { isClaudeCopilotModel } from "./models.mjs";
 import { profileRouting } from "./profile-routing.mjs";
@@ -31,36 +36,7 @@ import {
   terminalCell,
 } from "./cli-table.mjs";
 
-const CLIENT_ID = "Iv1.b507a08c87ecfe98";
-const SCOPE = "read:user";
-const DEVICE_CODE_URL = "https://github.com/login/device/code";
-const ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
-const DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
-const DEFAULT_DEVICE_EXPIRES_SECONDS = 900;
-
-function abortError(signal) {
-  if (signal?.reason instanceof Error) return signal.reason;
-  const error = new Error("The operation was aborted");
-  error.name = "AbortError";
-  return error;
-}
-
-function sleep(ms, { signal } = {}) {
-  if (signal?.aborted) return Promise.reject(abortError(signal));
-  return new Promise((resolve, reject) => {
-    const cleanup = () => signal?.removeEventListener("abort", onAbort);
-    const onAbort = () => {
-      clearTimeout(timer);
-      cleanup();
-      reject(abortError(signal));
-    };
-    const timer = setTimeout(() => {
-      cleanup();
-      resolve();
-    }, ms);
-    signal?.addEventListener("abort", onAbort, { once: true });
-  });
-}
+const DEFAULT_COPILOT_CATALOG_TIMEOUT_MS = 30 * 1000;
 
 function openAndCopy(userCode, verificationUri) {
   if (process.platform !== "darwin") return;
@@ -80,13 +56,50 @@ function responseDetail(value) {
   return String(value || "").replace(/\s+/g, " ").trim().slice(0, 240);
 }
 
-async function jsonResponse(response, label) {
-  if (!response.ok) throw new Error(`${label} failed with HTTP ${response.status}`);
-  try {
-    return await response.json();
-  } catch {
-    throw new Error(`${label} returned invalid JSON`);
+function abortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+function cancelResponseBody(response) {
+  try { Promise.resolve(response?.body?.cancel?.()).catch(() => {}); } catch {}
+}
+
+function fetchWithSignal(operation, signal) {
+  if (signal?.aborted) return Promise.reject(abortError(signal));
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (callback, value) => {
+      if (settled) return false;
+      settled = true;
+      signal?.removeEventListener("abort", onAbort);
+      callback(value);
+      return true;
+    };
+    const onAbort = () => finish(reject, abortError(signal));
+    signal?.addEventListener("abort", onAbort, { once: true });
+    Promise.resolve()
+      .then(operation)
+      .then((response) => {
+        if (!finish(resolve, response)) cancelResponseBody(response);
+      }, (error) => finish(reject, error));
+  });
+}
+
+function catalogTimeoutError(label, timeoutMs) {
+  const error = new Error(`${label} model catalog timed out after ${timeoutMs}ms`);
+  error.code = "CCDX_COPILOT_CATALOG_TIMEOUT";
+  return error;
+}
+
+async function jsonResponse({ response, data, jsonError }, label) {
+  if (!response.ok) {
+    throw new Error(`${label} failed with HTTP ${response.status}`);
   }
+  if (jsonError) throw new Error(`${label} returned invalid JSON`);
+  return data;
 }
 
 export async function requestDeviceFlowToken({
@@ -94,16 +107,16 @@ export async function requestDeviceFlowToken({
   signal,
   log = console.log,
   openAndCopyFn = openAndCopy,
-  sleepImpl = sleep,
+  deviceCodeTimeoutMs,
+  sleepImpl,
   now = Date.now,
 } = {}) {
-  const codeResponse = await fetchImpl(DEVICE_CODE_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),
+  const codeResult = await requestGithubDeviceCode({
+    fetchImpl,
     signal,
+    timeoutMs: deviceCodeTimeoutMs,
   });
-  const code = await jsonResponse(codeResponse, "Device code request");
+  const code = await jsonResponse(codeResult, "Device code request");
   if (!code.device_code || !code.user_code || !code.verification_uri) {
     throw new Error("Device code response is missing required fields");
   }
@@ -111,32 +124,18 @@ export async function requestDeviceFlowToken({
   log(`\n${status("info", `Open ${code.verification_uri}`)}\n${status("info", `Enter Claude account code: ${code.user_code}`)}\n`);
   openAndCopyFn(code.user_code, code.verification_uri);
 
-  let waitMs = (Number(code.interval) || DEFAULT_DEVICE_INTERVAL_SECONDS) * 1000;
-  const expiresMs = (Number(code.expires_in) || DEFAULT_DEVICE_EXPIRES_SECONDS) * 1000;
-  const deadline = now() + expiresMs;
-
-  while (now() < deadline) {
-    await sleepImpl(waitMs, { signal });
-    const pollResponse = await fetchImpl(ACCESS_TOKEN_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify({
-        client_id: CLIENT_ID,
-        device_code: code.device_code,
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      }),
-      signal,
-    });
-    if (!pollResponse.ok) continue;
-    const result = interpretPoll(await pollResponse.json());
-    if (result.state === "done") return result.token;
-    if (result.state === "slow") {
-      waitMs += 5000;
-      continue;
-    }
-    if (result.state === "fail") throw new Error(`Claude login failed: ${result.error}`);
-  }
-  throw new Error("Claude login failed: device code expired");
+  const result = await pollGithubDeviceFlow({
+    deviceCode: code.device_code,
+    interval: code.interval,
+    expiresIn: code.expires_in,
+    fetchImpl,
+    signal,
+    sleepImpl,
+    now,
+  });
+  if (result.state === "done") return result.token;
+  if (result.state === "expired") throw new Error("Claude login failed: device code expired");
+  throw new Error(`Claude login failed: ${result.error}`);
 }
 
 async function codexIdentity({ home, fetchImpl, signal }) {
@@ -166,33 +165,58 @@ async function fetchCopilotCatalog(tokenData, {
   signal,
   vscodeVersion = FALLBACK_VSCODE_VERSION,
   label = "Copilot",
+  timeoutMs = DEFAULT_COPILOT_CATALOG_TIMEOUT_MS,
 } = {}) {
-  const apiBase = tokenData?.endpoints?.api || DEFAULT_API_BASE;
-  const headers = buildHeaders({
-    token: tokenData.token,
-    version: vscodeVersion,
-    initiator: "user",
-    vision: false,
-  });
-  const modelResponse = await fetchImpl(`${apiBase}/models`, {
-    headers,
-    redirect: "error",
-    signal,
-  });
-  const modelText = await modelResponse.text();
-  if (!modelResponse.ok) {
-    const detail = responseDetail(modelText);
-    throw new Error(`${label} model catalog failed with HTTP ${modelResponse.status}${detail ? `: ${detail}` : ""}`);
-  }
-
-  let catalog;
+  const parsedTimeout = Number(timeoutMs);
+  const deadlineMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0
+    ? parsedTimeout
+    : DEFAULT_COPILOT_CATALOG_TIMEOUT_MS;
+  const controller = new AbortController();
+  const onCallerAbort = () => controller.abort(signal?.reason);
+  signal?.addEventListener("abort", onCallerAbort, { once: true });
+  if (signal?.aborted) onCallerAbort();
+  const timer = setTimeout(() => controller.abort(catalogTimeoutError(label, deadlineMs)), deadlineMs);
+  let modelResponse;
   try {
-    catalog = JSON.parse(modelText);
-  } catch {
-    throw new Error(`${label} model catalog returned invalid JSON`);
+    const apiBase = tokenData?.endpoints?.api || DEFAULT_API_BASE;
+    const headers = buildHeaders({
+      token: tokenData.token,
+      version: vscodeVersion,
+      initiator: "user",
+      vision: false,
+    });
+    modelResponse = await fetchWithSignal(() => fetchImpl(`${apiBase}/models`, {
+      headers,
+      redirect: "error",
+      signal: controller.signal,
+    }), controller.signal);
+    const modelText = await readBoundedResponseText(modelResponse, {
+      maxBytes: MAX_UPSTREAM_MODEL_CATALOG_BYTES,
+      label: `${label} model catalog`,
+      signal: controller.signal,
+    });
+    if (!modelResponse.ok) {
+      const detail = responseDetail(modelText);
+      throw new Error(`${label} model catalog failed with HTTP ${modelResponse.status}${detail ? `: ${detail}` : ""}`);
+    }
+
+    let catalog;
+    try {
+      catalog = JSON.parse(modelText);
+    } catch {
+      throw new Error(`${label} model catalog returned invalid JSON`);
+    }
+    catalogModels(catalog);
+    return { catalog, apiBase };
+  } catch (error) {
+    if (signal?.aborted) throw abortError(signal);
+    if (controller.signal.aborted) throw abortError(controller.signal);
+    throw error;
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onCallerAbort);
+    if (controller.signal.aborted) cancelResponseBody(modelResponse);
   }
-  catalogModels(catalog);
-  return { catalog, apiBase };
 }
 
 export async function validateClaudeCandidate(githubToken, {
@@ -201,6 +225,7 @@ export async function validateClaudeCandidate(githubToken, {
   fetchImpl = fetch,
   signal,
   vscodeVersion = FALLBACK_VSCODE_VERSION,
+  catalogTimeoutMs,
 } = {}) {
   const validation = await validateGithubToken(githubToken, { fetchImpl, signal });
   if (!validation.ok) {
@@ -225,6 +250,7 @@ export async function validateClaudeCandidate(githubToken, {
     signal,
     vscodeVersion,
     label: "Claude account",
+    timeoutMs: catalogTimeoutMs,
   });
   const models = claudeModels(catalog);
   if (!models.length) {
@@ -249,7 +275,9 @@ export async function authorizeClaudeProfile({
   signal,
   log = console.log,
   openAndCopyFn = openAndCopy,
-  sleepImpl = sleep,
+  deviceCodeTimeoutMs,
+  catalogTimeoutMs,
+  sleepImpl,
   now = Date.now,
   saveModelCacheFn = saveModelCache,
 } = {}) {
@@ -302,6 +330,7 @@ export async function authorizeClaudeProfile({
         signal,
         log,
         openAndCopyFn,
+        deviceCodeTimeoutMs,
         sleepImpl,
         now,
       });
@@ -311,6 +340,7 @@ export async function authorizeClaudeProfile({
       expectedLogin,
       fetchImpl,
       signal,
+      catalogTimeoutMs,
     });
     await withAuthProfileLock(AUTH_PROFILE_CODEX, () => {
       const currentCodex = readAuthProfileCredentials(AUTH_PROFILE_CODEX, { home });