fix: bound sidecar control-channel fetches with timeouts

controlRequest had no abort signal: a stale port (something accepting
but never responding, e.g. a hung opencode holding the port after the
bridge closed) would hang Cursor's MCP discovery on tools/list, and
tools/call could block forever.

tools/list gets 5s (loopback list is instant; discovery degrades to an
empty tool list on timeout) and tools/call gets 5 minutes (plugin tools
can legitimately run long). New test spawns the sidecar against a
never-responding server and asserts tools/list answers [] fast.

Author: justin-carper

src/sidecar/plugin-tools-mcp.mjs

@@ -36,14 +36,18 @@ function logErr(message, extra) {
   }
 }
 
-async function controlRequest(path, body) {
+async function controlRequest(path, body, timeoutMs) {
   const res = await fetch(`http://127.0.0.1:${CONTROL_PORT}${path}`, {
     method: body ? "POST" : "GET",
     headers: {
       "content-type": "application/json",
       authorization: `Bearer ${TOKEN}`,
     },
     body: body ? JSON.stringify(body) : undefined,
+    // A stale/hung port must not hang Cursor's MCP discovery (tools/list) or
+    // block a tool call forever. Loopback list is instant; calls get a
+    // generous ceiling because plugin tools can legitimately run for minutes.
+    signal: AbortSignal.timeout(timeoutMs),
   });
   const text = await res.text();
   let json;
@@ -61,7 +65,7 @@ async function controlRequest(path, body) {
 
 async function listTools() {
   try {
-    const data = await controlRequest("/tools");
+    const data = await controlRequest("/tools", undefined, 5_000);
     return data?.tools ?? [];
   } catch (err) {
     logErr("tools/list failed", { error: String(err) });
@@ -71,7 +75,7 @@ async function listTools() {
 
 async function callTool(name, args) {
   try {
-    const data = await controlRequest("/call", { id: name, args: args ?? {} });
+    const data = await controlRequest("/call", { id: name, args: args ?? {} }, 300_000);
     if (data?.ok === false) {
       return {
         isError: true,

test/plugin-tools-bridge.test.ts

@@ -442,6 +442,58 @@ describe("plugin-tools bridge", () => {
 			await bridge.close();
 		}
 	});
+
+	it("tools/list fails fast against a hung control port", { timeout: 20_000 }, async () => {
+		// A control port that accepts connections but never responds (stale
+		// server) must not hang Cursor's MCP discovery — listTools aborts after
+		// its 5s budget and degrades to an empty tool list.
+		const { createServer } = await import("node:http");
+		const hung = createServer(() => {
+			// never respond
+		});
+		await new Promise<void>((resolve) =>
+			hung.listen(0, "127.0.0.1", () => resolve()),
+		);
+		const address = hung.address();
+		const port = typeof address === "object" && address ? address.port : 0;
+		try {
+			const child = spawn(
+				process.execPath,
+				["src/sidecar/plugin-tools-mcp.mjs"],
+				{
+					env: {
+						...process.env,
+						OPENCODE_PLUGIN_TOOLS_PORT: String(port),
+						OPENCODE_PLUGIN_TOOLS_TOKEN: "t",
+					},
+					stdio: ["pipe", "pipe", "pipe"],
+				},
+			);
+			const started = Date.now();
+			const reply = await new Promise<string>((resolve, reject) => {
+				let buf = "";
+				child.stdout!.on("data", (chunk: Buffer) => {
+					buf += chunk.toString();
+					const line = buf.split("\n").find((l) => l.trim());
+					if (line) resolve(line);
+				});
+				child.once("error", reject);
+				child.once("exit", () => reject(new Error("child exited")));
+				child.stdin!.write(
+					JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }) + "\n",
+				);
+			});
+			const elapsed = Date.now() - started;
+			const parsed = JSON.parse(reply) as { result?: { tools?: unknown[] } };
+			expect(parsed.result?.tools).toEqual([]);
+			// 5s budget + slack — anything under 10s proves we did not hang.
+			expect(elapsed).toBeLessThan(10_000);
+			child.kill();
+		} finally {
+			await new Promise<void>((resolve) => hung.close(() => resolve()));
+			hung.closeAllConnections?.();
+		}
+	});
 });
 
 // --- full plugin wiring: config hook merges the bridge into mcpServers ---