[BadhriDO]

Summary

doctl harness-runtime connections create and auth <provider> wait for browser authorization with no limit. An abandoned or revoked authorization keeps them polling until someone kills the process, which hangs scripts and CI jobs. Both waits now end at the server's expiry, and the connections wait also ends on expired or revoked.
Jira: MARSOHS-2174

Scope

 connections create: poll GetConnection every 2 s
   active                       → success
+  expired | revoked            → exit 1, hint: connections create --actor <actor>
+  expires_at + 30 s            → exit 1, hint: connections get <id>   (15 min if no expires_at)
   Ctrl-C / SIGTERM             → "stopped waiting"
 auth <provider>: poll PollProviderAuth every 2 s
+  expires_at + 30 s            → exit 1, hint: re-run auth <provider>  (15 min if no expires_at)

Blast radius

🔴 Services: doctl (harness-runtime connections create, harness-runtime auth <provider>, the GitHub prompt in harness-runtime create and launch with --gh-repo) · Customers: an authorization that is not completed now exits 1 instead of waiting forever — verify that success, Ctrl-C and --no-wait output are unchanged.

Rollout

• Rollback: revert; the change ships with the next doctl release and holds no state.

Decisions

• Unrecognized statuses keep polling until the deadline, so a status the server adds later cannot end a wait early.
• The 30 s grace absorbs clock skew and lets the next poll report the server's own expired; an expires_at in the past clamps to now. (authWaitDeadline)
• An expired GitHub prompt fails create and launch instead of continuing: the user chose to connect, so a session without access would fail later.

Evidence

The new expired, revoked and deadline tests failed on main (an unexpected extra poll, or a hang until go test -timeout) and pass here; go test ./commands/... ./do/... passes except TestRegistryLogout, which fails the same way on main; a local build was validated against a live environment.

🤖 Generated with Claude Code

[DO-rrao]

lgtm