From a94be88427fc44cec2e6b63ef075106f0ada8124 Mon Sep 17 00:00:00 2001
From: Gregor MacLennan <gmaclennan@awana.digital>
Date: Tue, 14 Apr 2026 21:09:11 +0100
Subject: [PATCH] fix: faster connection timeout

---
 src/lib/secret-stream-fetch.ts | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/lib/secret-stream-fetch.ts b/src/lib/secret-stream-fetch.ts
index 3c8c775..b193c80 100644
--- a/src/lib/secret-stream-fetch.ts
+++ b/src/lib/secret-stream-fetch.ts
@@ -3,6 +3,8 @@ import { fetch as secretStreamFetchOrig } from 'secret-stream-http'
 import { errors } from './errors.js'
 import { isArrayReadonly } from './utils.js'
 
+const CONNECTION_TIMEOUT_MS = 5000 // 5s
+
 /**
  * A wrapper around secret-stream-http's fetch that tries multiple URLs until one works.
  * This is useful when the server has multiple IPs for different network interfaces.
@@ -21,15 +23,24 @@ export async function secretStreamFetch(
 	// not all of them may be on the same network as us, so try each URL until
 	// one works
 	for (const url of urls) {
+		const controller = new AbortController()
+		const timeout = setTimeout(() => {
+			controller.abort()
+		}, CONNECTION_TIMEOUT_MS)
+		const signal = options?.signal
+			? AbortSignal.any([options.signal, controller.signal])
+			: controller.signal
 		try {
-			response = (await secretStreamFetchOrig(
-				url,
-				options,
-			)) as unknown as Response // Subtle difference bewteen Undici fetch Response and whatwg Response
+			response = (await secretStreamFetchOrig(url, {
+				...options,
+				signal,
+			})) as unknown as Response // Subtle difference bewteen Undici fetch Response and whatwg Response
 			break // Exit loop on successful fetch
 		} catch (err) {
 			error = err
 			// Ignore errors and try the next URL
+		} finally {
+			clearTimeout(timeout)
 		}
 	}
 	if (!response) {