fix(http): add 30s connect timeout to prevent indefinite hangs

HttpMcpClient.connect() previously had no timeout, so unresponsive
OAuth discovery endpoints or slow MCP servers could hang forever.

- Add 30s default timeout (configurable via SUPER_MCP_CONNECT_TIMEOUT_MS)
- Apply to primary connect, SSE fallback, and finishOAuth reconnect
- Clean up timer on success, swallow late rejections on timeout

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Author: harryblam

src/clients/httpClient.ts

@@ -25,6 +25,11 @@ export interface HttpMcpClientOptions {
   oauthProvider?: SimpleOAuthProvider;
 }
 
+// Default timeout for connect() to prevent hanging on unresponsive OAuth
+// discovery endpoints or slow MCP servers. Covers the full transport
+// negotiation + OAuth token refresh cycle.
+const CONNECT_TIMEOUT_MS = 30_000;
+
 export class HttpMcpClient implements McpClient {
   private client: Client;
   private transport?: SSEClientTransport | StreamableHTTPClientTransport;
@@ -136,7 +141,7 @@ export class HttpMcpClient implements McpClient {
     this.transport = this.createTransport();
 
     try {
-      await this.client.connect(this.transport);
+      await this.connectWithTimeout(this.client, this.transport);
       this.isConnected = true;
 
       logger.info("Successfully connected to MCP server", {
@@ -183,7 +188,7 @@ export class HttpMcpClient implements McpClient {
 
           // Create SSE transport and connect
           this.transport = this.createTransport();
-          await this.client.connect(this.transport);
+          await this.connectWithTimeout(this.client, this.transport);
           this.isConnected = true;
 
           logger.info("Successfully connected to MCP server using SSE fallback", {
@@ -245,6 +250,27 @@ export class HttpMcpClient implements McpClient {
     }
   }
 
+  private async connectWithTimeout(
+    client: Client,
+    transport: SSEClientTransport | StreamableHTTPClientTransport
+  ): Promise<void> {
+    const timeoutMs = Number(process.env.SUPER_MCP_CONNECT_TIMEOUT_MS) || CONNECT_TIMEOUT_MS;
+    let timer: ReturnType<typeof setTimeout>;
+    const timeout = new Promise<never>((_, reject) => {
+      timer = setTimeout(
+        () => reject(new Error(`Connection timed out after ${timeoutMs}ms for package '${this.packageId}'`)),
+        timeoutMs
+      );
+    });
+    const connectPromise = client.connect(transport);
+    try {
+      await Promise.race([connectPromise, timeout]);
+    } finally {
+      clearTimeout(timer!);
+      connectPromise.catch(() => {});
+    }
+  }
+
   private createTransport(): SSEClientTransport | StreamableHTTPClientTransport {
     const url = new URL(this.config.base_url!);
     const options = this.getTransportOptions();
@@ -488,7 +514,7 @@ export class HttpMcpClient implements McpClient {
 
         this.transport = this.createTransport();
 
-        await this.client.connect(this.transport);
+        await this.connectWithTimeout(this.client, this.transport);
         this.isConnected = true;
         logger.info("Client connected successfully with OAuth tokens", { package_id: this.packageId });
       } catch (error) {