fix: add AbortSignal timeouts to public-API adapter fetches

clis/producthunt/utils.js

@@ -27,7 +27,13 @@ export async function fetchFeed(category) {
     const url = category
         ? `https://www.producthunt.com/feed?category=${encodeURIComponent(category)}`
         : 'https://www.producthunt.com/feed';
-    const resp = await fetch(url, { headers: { 'User-Agent': UA } });
+    let resp;
+    try {
+        resp = await fetch(url, { headers: { 'User-Agent': UA }, signal: AbortSignal.timeout(10000) });
+    }
+    catch {
+        return [];
+    }
     if (!resp.ok)
         return [];
     const xml = await resp.text();

clis/sinablog/search.js

@@ -18,6 +18,7 @@ async function searchSinaBlog(keyword, limit) {
             'User-Agent': 'Mozilla/5.0',
             Accept: 'application/json',
         },
+        signal: AbortSignal.timeout(5000),
     });
     if (!resp.ok)
         throw new Error(`Sina blog search failed: HTTP ${resp.status}`);

clis/sinablog/utils.js

@@ -96,7 +96,7 @@ export async function loadSinaBlogHot(page, limit) {
           url: item.url,
         };
         try {
-          const resp = await fetch(item.url, { credentials: 'include' });
+          const resp = await fetch(item.url, { credentials: 'include', signal: AbortSignal.timeout(5000) });
           if (resp.ok) {
             const html = await resp.text();
             const doc = new DOMParser().parseFromString(html, 'text/html');

clis/spotify/spotify.js

@@ -50,6 +50,7 @@ async function refreshAccessToken(refreshToken) {
             Authorization: 'Basic ' + Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString('base64'),
         },
         body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken }),
+        signal: AbortSignal.timeout(10000),
     });
     if (!res.ok) {
         const err = await res.json().catch(() => ({}));
@@ -82,6 +83,7 @@ async function api(method, path, body) {
         method,
         headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
         body: body ? JSON.stringify(body) : undefined,
+        signal: AbortSignal.timeout(10000),
     });
     if (res.status === 204 || res.status === 202)
         return null;
@@ -133,6 +135,7 @@ cli({
                             Authorization: 'Basic ' + Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString('base64'),
                         },
                         body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: REDIRECT_URI }),
+                        signal: AbortSignal.timeout(10000),
                     });
                     if (!tokenRes.ok) {
                         const err = await tokenRes.json().catch(() => ({}));

clis/substack/search.js

@@ -21,7 +21,7 @@ async function searchPosts(keyword, limit) {
     url.searchParams.set('query', keyword);
     url.searchParams.set('page', '0');
     url.searchParams.set('includePlatformResults', 'true');
-    const resp = await fetch(url, { headers: headers() });
+    const resp = await fetch(url, { headers: headers(), signal: AbortSignal.timeout(8000) });
     if (!resp.ok)
         throw new CommandExecutionError(`Substack post search failed: HTTP ${resp.status}`);
     const data = await resp.json();
@@ -39,7 +39,7 @@ async function searchPublications(keyword, limit) {
     const url = new URL('https://substack.com/api/v1/profile/search');
     url.searchParams.set('query', keyword);
     url.searchParams.set('page', '0');
-    const resp = await fetch(url, { headers: headers() });
+    const resp = await fetch(url, { headers: headers(), signal: AbortSignal.timeout(8000) });
     if (!resp.ok)
         throw new CommandExecutionError(`Substack publication search failed: HTTP ${resp.status}`);
     const data = await resp.json();

clis/yahoo-finance/quote.js

@@ -23,7 +23,7 @@ cli({
         // Strategy 1: v8 chart API
         try {
           const chartUrl = 'https://query1.finance.yahoo.com/v8/finance/chart/' + encodeURIComponent(sym) + '?interval=1d&range=1d';
-          const resp = await fetch(chartUrl);
+          const resp = await fetch(chartUrl, { signal: AbortSignal.timeout(5000) });
           if (resp.ok) {
             const d = await resp.json();
             const chart = d?.chart?.result?.[0];