Out of curiosity, I was looking at some of the other plugins (like github-copilot, etc.) and noticed they also make custom fetch calls during their specific OAuth or authentication flows.

Since these custom authentication fetches aren't wrapped by the new main provider timeout, are they still vulnerable to infinite socket hangs if their respective APIs stall during login? Should we consider abstracting this timeoutController logic so it can be easily applied to all custom provider token/auth fetches?

@niStee Good catch. I think you’re right.

The new provider timeout protects the actual provider request path, including custom fetch once it’s invoked by the wrapper, but direct auth/token fetch calls inside plugins are outside that protection. So a stalled OAuth/token endpoint can still hang unless that specific call receives/uses a signal or creates its own timeout.

I’d prefer not to broaden this PR too much beyond the Codex timeout bug, but a shared helper for bounded auth fetches makes sense. I can either extract that helper here, or keep this focused and follow up with a small PR applying it across the custom auth flows.