Follow-up from the 2026-07-23 code review. Sibling to #51 (which scopes timeouts to the media downloader).
The Mastodon API clients are built with reqwest::Client::new() / ClientBuilder::new().build() and no request or connect timeout:
src/mastodon/instance.rs — app registration (register_client_app) and account verificationsrc/mastodon/fetcher.rs — the incremental status fetch loopsrc/cli/mastodon/code.rs — OAuth token exchange
A hung or slow instance therefore stalls link / verify / fetch indefinitely with no signal — the same failure mode as the downloader, but on the API side and not covered by #51. This matters most for the unattended homelab backup loop, where a dead instance should fail fast, not hang.
Suggested fix
Build the API clients with .timeout(..) and .connect_timeout(..) (ideally a single shared, configured Client), and consider a small retry/backoff for transient errors. Fold in with #51 if a shared HTTP-client helper is introduced.
Severity: medium.
Follow-up from the 2026-07-23 code review. Sibling to #51 (which scopes timeouts to the media downloader).
The Mastodon API clients are built with
reqwest::Client::new()/ClientBuilder::new().build()and no request or connect timeout:src/mastodon/instance.rs— app registration (register_client_app) and account verificationsrc/mastodon/fetcher.rs— the incremental status fetch loopsrc/cli/mastodon/code.rs— OAuth token exchangeA hung or slow instance therefore stalls
link/verify/fetchindefinitely with no signal — the same failure mode as the downloader, but on the API side and not covered by #51. This matters most for the unattended homelab backup loop, where a dead instance should fail fast, not hang.Suggested fix
Build the API clients with
.timeout(..)and.connect_timeout(..)(ideally a single shared, configuredClient), and consider a small retry/backoff for transient errors. Fold in with #51 if a shared HTTP-client helper is introduced.Severity: medium.