anomalyco / anomalyco/opencode

webfetch accepts timeout: 0 and negative values

Open
#47,459 0 comments 0 reactions 1 assignee View on GitHub

@neriousy is already working on this.

Since Sep 5, 2026.

Dominant language
TypeScript
Stars
209k
Forks
27.5k
PR merge metrics
PR metrics pending

Description

Description

webfetch's timeout is a bare Schema.optional(Schema.Number), so 0 and negative values are accepted.

packages/opencode/src/tool/webfetch.ts:

timeout: Schema.optional(Schema.Number).annotate({ description: "Optional timeout in seconds (max 120)" }),
...
const timeout = Math.min((params.timeout ?? DEFAULT_TIMEOUT / 1000) * 1000, MAX_TIMEOUT)

Math.min clamps the ceiling but nothing clamps the floor. timeout: 0 produces a 0 ms deadline that aborts the request immediately; a negative value produces a negative duration.

The description says "max 120" but the schema does not express it either, so the bound the model is told about is not in the JSON Schema it receives — it is only enforced by the silent Math.min clamp afterwards.

The v2 tool declares the bound properly (packages/core/src/tool/webfetch.ts):

const Timeout = Schema.Number.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(MAX_TIMEOUT_SECONDS))

Applying the same check to v1 puts exclusiveMinimum: 0 and maximum: 120 in the tool's wire schema, so an out-of-range value is a validation error the model can see and correct rather than a silently clamped or zero deadline.

Split out of #45229 / #45235 on review feedback, to keep the body-timeout fix reviewable on its own.

Steps to reproduce

Call webfetch with timeout: 0 against any URL — the request is aborted immediately rather than using the 30 second default or reporting an invalid argument.

Operating System

Windows 11 (platform independent)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.