Findings

• [Major] Preferences read failure is silently downgraded to "no timeout" — this violates the "no silent fallbacks" constraint and can leave long-running LLM calls unbounded instead of surfacing a contextual error to users, evidence apps/desktop/src/main/generation-ipc.ts:48
  Suggested fix:

  try {
    timeoutSec = await readTimeoutSec();
  } catch (err) {
    throw new CodesignError(
      `Failed to read generation timeout preference: ${err instanceof Error ? err.message : String(err)}`,
      'PREFERENCES_READ_FAILED',
    );
  }

Summary

• Review mode: initial
• 1 issue found in the new timeout wiring: a silent fallback on preferences-read errors.
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md (missing in this checkout), so constraint validation used CLAUDE.md + changed code.

Testing

• Not run (automation)
• Suggested: add an IPC-level test asserting codesign:v1:generate rejects with contextual CodesignError when preferences read fails during timeout arming.

open-codesign Bot

Findings

• [Major] Timer overflow can turn a large timeout into near-immediate abort — setTimeout in Node caps delay to a 32-bit signed int; when generationTimeoutSec * 1000 exceeds that limit, the callback runs almost immediately, unexpectedly cancelling valid in-flight generations. Evidence apps/desktop/src/main/generation-ipc.ts:65
  Suggested fix:

  const timeoutMs = timeoutSec * 1000;
  const MAX_TIMEOUT_MS = 2_147_483_647;
  if (timeoutMs > MAX_TIMEOUT_MS) {
    throw new CodesignError(
      `generationTimeoutSec is too large (${timeoutSec}). Max supported is ${Math.floor(MAX_TIMEOUT_MS / 1000)} seconds.`,
      'PREFERENCES_READ_FAIL',
    );
  }
  
  const handle = setTimeout(() => {
    // existing timeout abort logic
  }, timeoutMs);

Summary

• Review mode: follow-up after new commits
• 1 issue found in the newly added timeout arming path: oversized timeout values can overflow timer delay and cancel requests immediately.
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md.

Testing

• Not run (automation)
• Suggested: add a Vitest case where readTimeoutSec returns a value above 2_147_483 and assert a contextual CodesignError is thrown before scheduling.

open-codesign Bot

Findings

• No actionable issues found in the added/modified lines of this update.

Summary

• Review mode: follow-up after new commits
• Re-reviewed the latest head diff and follow-up compare context; no new correctness/security/constraint violations attributable to this patch were found.
• Residual risk/testing gap: timeout behavior is covered at helper-unit level, but there is still no end-to-end IPC/UI test asserting that GENERATION_TIMEOUT is surfaced to the user path.
• Not found in repo/docs: docs/VISION.md, docs/PRINCIPLES.md.

Testing

• Not run (automation)

open-codesign Bot