[cloudsmith-iduffy]

Description

cloudsmith download streams the package file with session.get(..., stream=True) and gave no timeout. requests has no default timeout, and our session does not set one. So if the download server accepts the connection and then stops sending, the command waits forever with no error. Every other direct HTTP call in the CLI already passes a timeout.

This PR:

• Gives the file request a (30, 60) second connect and read timeout (DOWNLOAD_TIMEOUT_SECONDS in core/download.py). The CLI has no configurable request-timeout option to reuse, so this is a module constant.
• Turns a read error during the transfer into a clear ClickException, the same as an error on the first request. With a read timeout, requests raises this as ConnectionError from iter_content, not as Timeout, so the wrapper catches RequestException.
• Closes the response on an HTTP error. Before, a 403/404 response kept its pool connection. The session pool has 4 slots and blocks with no pool timeout, so after four failed files on one session (--all-files or --download-all), the fifth download hung. This is a second way for the same function to hang, and the timeout does not stop it.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• The read timeout limits the wait for each socket read, not the full transfer. A large file that keeps sending data is not cut off.
• The session retry policy retries connect timeouts and read timeouts before the response headers arrive (5 retries). A server that accepts the connection and never answers fails after about 6 attempts, so several minutes, not 60 seconds. Once the body starts streaming there is no retry.
• Not changed here: the package search and detail calls in the same command go through the SDK RestClient, which still passes _request_timeout=None. A default timeout there belongs in its own PR.
• Not changed here: a failed download leaves a partial file. A re-run then says "already exists" unless you pass --overwrite.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused changes address the stated failure paths, include regression coverage, and have no identified blocking issues.

No open issues 🎉

What changed in this PR

This PR prevents stalled package downloads from waiting indefinitely and improves error handling in the CLI’s streaming download flow.

Changes:

• Adds 30-second connect and 60-second per-read timeouts.
• Converts streaming request failures into CLI errors and closes HTTP-error responses to release pool connections.
• Adds regression tests and changelog entries for the fixes.

File	Description
cloudsmith_cli/​core/​tests/​test_download.py	Tests timeout configuration, mid-stream failures, and HTTP-error response cleanup.
cloudsmith_cli/​core/​download.py	Adds download timeouts, streaming error handling, and HTTP-error cleanup.
CHANGELOG.md	Documents stalled-download and connection-pool fixes.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the download timeout and response-cleanup changes.

No open issues 🎉

_{Review effort: Balanced}