[CHIA-4324] NFT media pipeline 5: download timeout recovery, bounded confirmation previews, buffer cleanup

[jlobue10]

Part 5 of the NFT media pipeline series (#3011 → #3010 → #3029). This PR is meant to be applied after #3029: it is stacked on that branch, so until #3029 merges its diff includes #3029's 7 commits — review only the 3 commits listed below. Each is independent of the others; together they harden the download path that the earlier PRs put in place.

What this PR changes and why

1. Retry timed-out NFT downloads once per session (46ca7ecb9)

Settling download timeouts as permanent cache errors (#3010) fixed the retry-a-stalled-host-on-every-access loop, but overshot: the timeout message is not in the transient-error list, so one slow first byte from a cold gateway — or a briefly offline machine — wrote an error to the -info sidecar that survived restarts. The NFT showed "Preview is not available" forever, until the user cleared the entire NFT cache.

CacheManager now keeps an in-memory timedOutUrls set: a persisted timeout is retried once per app session. Within the session the URL settles after its first timeout (a stalled host still cannot hold a download slot on every gallery visit), but a restart gets a fresh attempt. downloadFile exports isDownloadTimeoutError, which matches both timeout messages it produces (inactivity and overall deadline) by the same prefixes earlier sessions persisted — so existing poisoned caches recover on their own.

2. Bound WalletConnect confirmation-preview resolution with one overall deadline (f68778eb5)

resolveNftPreviewUrl walks three ordered URI lists per NFT (image data URIs, metadata URIs, extensionless data URIs) with a 10 s timeout per fetch and no overall limit. URI lists are on-chain data that nft_add_uri can extend, and the WalletConnect confirmation dialog only opens after parsing settles — so a take_offer referencing NFTs with many dead or slow hosts kept the security dialog off screen for 10 s × URIs × lists, minutes in the worst case, while the request could expire.

All fallbacks for one NFT now share a 20 s budget: nftGetMetadata / nftGetImageDataUrl take a timeoutBudget, each fetch gets the remaining time (capped at its own per-fetch timeout), and the walk stops once the budget is spent. Previews degrade to the placeholder in that case — the dialog itself is never held up by more than the budget. NFTs resolve concurrently, so this bounds the whole parse regardless of how many NFTs an offer references.

3. Drop redundant buffer copies and a dead hook export (72a9b8d58)

The verified-preview path copied every downloaded byte twice for no gain: fetchBuffer re-allocated each response chunk element-by-element via Uint8Array.from before collecting it (Electron's net module delivers fresh Buffers, so retaining them is safe and Buffer.concat already performs the single final copy), and the metadata checksum round-tripped the whole buffer through a latin1 string before hashing — an up-to-10 MB string allocation to produce the digest that hashing the Buffer directly yields.

Also removes the unused useNFTVideoLoop default export: both consumers import the named hooks and derive the effective global-or-per-video state themselves, so the wrapper only added surface that could drift from the real logic.

No user-facing strings or settings are added; no cache migration is needed (cache keys and sidecar formats are unchanged).

Testing

• New CacheManager test: a timeout persisted by one session (Request timed out after …ms of inactivity in the -info sidecar) is retried, and succeeds, in a fresh CacheManager instance against the same cache directory.
• New parseCommandDisplay test: once a slow metadata host consumes the whole budget, the remaining metadata fallbacks are never tried and the walk resolves to the placeholder; the existing resolution tests now also assert that a numeric budget is passed through to every nftGetMetadata / nftGetImageDataUrl call.
• Full gui jest suite green (355 tests); eslint/prettier clean on all touched files.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YKEGodEgVdEuvUM8dza52q

---

Note

Medium Risk
Touches NFT fetch, cache retry, and WalletConnect confirmation-preview timing. Gateway use is opt-in and hash-verified, but it changes which URLs leave the machine and how confirmation dialogs wait on network.

Overview
Adds an opt-in NFT setting to fetch ipfs:// media through https://ipfs.io. Off by default: Electron cannot request the ipfs: scheme, so those URIs are not fetched unless the user enables it. Content is still hash-checked against the on-chain hash; the original URI remains the cache key.

Network call sites (downloadFile, fetchBuffer, fetchJSON, Chromium downloads) go through toFetchableUrl. Gateway-disabled refusals are not persisted as cache errors so turning the option on retries cleanly. Failed in-memory metadata and on-screen hash verification also retry when the toggle flips.

Also hardens the download/preview path: persisted timeouts retry once per session; WalletConnect confirmation previews share a 20s fallback budget so slow URI lists cannot stall the security dialog; fetchBuffer/checksum drop extra copies; unused useNFTVideoLoop default export is removed.

^{Reviewed by Cursor Bugbot for commit 72a9b8d. Bugbot is set up for automated code reviews on this repo. Configure here.}