[deep-report] Harden HTTP server timeouts (bootstrap GitHub App + MCP server) against slow-client resource exhaustion

[github-actions]

Description

Two production HTTP servers lack read/write timeouts. pkg/cli/bootstrap_profile_github_app.go:211 creates an http.Server with no ReadHeaderTimeout, ReadTimeout, or WriteTimeout, so a slow client can hold a goroutine indefinitely (Slowloris-style). The MCP HTTP server has ReadHeaderTimeout but still lacks WriteTimeout and IdleTimeout. Flagged in the 2026-07-23 Repository Quality report.

Expected Impact

Misbehaving/slow clients can no longer pin server goroutines open indefinitely; bounded connection lifetimes improve reliability of the bootstrap OAuth flow and the MCP server.

Suggested Agent

Copilot SWE Agent.

Estimated Effort

Quick (< 1 hour) — add explicit timeout fields to both http.Server structs.

Data Source

DeepReport Intelligence analysis 2026-07-23; Repository Quality report #47586.

Generated by 🔬 Deep Report · age00 · 242.8 AIC · ⌖ 11.4 AIC · ⊞ 10.3K · ◷

• expires on Jul 25, 2026, 7:32 AM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.08 AIC · ⌖ 18.5 AIC · ⊞ 8.6K · ◷

[copilot-swe-agent]

The agent encountered an error and was unable to start working on this issue: The service is temporarily unavailable. Please try again later. (Request id: 1829:141B37:1436918:469B50A:6A63C0D4)