SMOODEV-2513: Land the connect-timeout fan-out across all five ports

[brentrager]

Consolidates #88 (Rust), #89 (Go), #90 (Python), #91 (.NET) and #92 (TypeScript) — open since 2026-07-10 — onto current main. I assessed each: the work is sound, it had just gone stale against traceparent injection (#95) and the redaction fix (#98), both of which touch the same single-request site. One consolidated PR rather than five sequential rebases; the five originals are closed pointing here.

The gap is real

Without a connect timeout, a SYN to a dead pod IP still lingering in a ClusterIP's iptables burns the whole-request budget before retry can try a live endpoint. Measured on this machine:

$ node -e "fetch('http://10.255.255.1/', {signal: AbortSignal.timeout(20000)}).catch(e => …)"
no-dispatcher failed after 10553 ms: UND_ERR_CONNECT_TIMEOUT

10.5s — undici's own default — where the client's whole-request timeout was supposed to be the ceiling. Bounded at 500ms it fails in ~1s. Slow-but-alive handlers are unaffected; the knob is off by default in every port.

port	entry point	mechanism
TypeScript	connectTimeoutMs / FetchBuilder.withConnectTimeout	undici Agent dispatcher (Node only)
Python	TimeoutOptions(connect_timeout_ms=…)	httpx.Timeout(connect=…)
Rust	FetchOptions::connect_timeout_ms / with_connect_timeout	reqwest::ClientBuilder::connect_timeout
Go	ClientBuilder.WithConnectTimeout	cloned default transport, dialer Timeout
.NET	SmooFetchOptions.ConnectTimeout / WithConnectTimeout	SocketsHttpHandler.ConnectTimeout

Two changes from the original PRs

1. undici is an optional peer dependency, not a runtime dependency. #92 put it in dependencies, which would have added a full HTTP stack to every consumer's tree — including browser bundles — for an opt-in, Node-only feature, in the same week we are evicting runtime deps (#101). It now follows the @opentelemetry/api pattern this package already uses: devDependency for our own tests, optional peerDependency for consumers, lazy await import() at the call site.

2. A requested connect timeout with undici absent now throws, with an actionable message, instead of silently continuing unbounded. A timeout that quietly isn't applied is the exact failure this feature exists to prevent. (Browsers still no-op, because no such knob exists there — that one is documented on the option.)

Spec C — shared corpus

All five regression tests read their knobs from the committed spec/connect-timeout-corpus.json:

{ "blackHoleUrl": "http://10.255.255.1:80/anything",
  "connectTimeoutMs": 500, "wholeRequestTimeoutMs": 5000, "maxElapsedMs": 3000 }

The behavior under test is timing, not an input/output mapping, so what has to stay in lockstep is the thresholds — raise the ceiling in one language only and that port silently stops catching the regression the other four still catch. Rust binds it with include_str!; .NET copies it next to the test assembly via the csproj; Go/Python/TS read it by path. The TS suite carries a positive control (maxElapsedMs > connectTimeoutMs, wholeRequestTimeoutMs > maxElapsedMs) so a corpus that failed to load reads red rather than trivially green.

Verification (all local, all five)

	result
vitest run src/fetch.connect-timeout.spec.ts	4 passed
cargo test --test connect_timeout_tests	1 passed
go test -run TestConnectTimeout ./...	2 passed
uv run poe test	131 passed
dotnet test --filter ConnectTimeout	1 passed

Plus oxfmt/oxlint/tsc, ruff check + format, cargo fmt --check + clippy --all-targets -D warnings, go vet + gofmt, dotnet format --verify-no-changes — all clean.

Closes #88, closes #89, closes #90, closes #91, closes #92.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

[changeset-bot]

🦋 Changeset detected

Latest commit: fb2bfb7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@smooai/fetch	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR