fix: add error accumulation, timeouts, and size validation to MavenNexusClassSource

- Accumulate all errors instead of silently swallowing exceptions (lines 89-90)
- Add configurable connect timeout (10s default) and read timeout (30s default)
- Add MAX_JAR_SIZE validation (100MB) before downloading
- Add MAX_CLASS_SIZE validation (10MB) when reading class entries
- Improve error messages with detailed failure information from all artifacts
- Add connectTimeout() and readTimeout() builder methods

Silent exception swallowing made debugging impossible - all failures looked
the same. Now provides detailed error message showing exactly what failed.

Fixes #59

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: Flossy

src/main/java/org/flossware/classloader/MavenNexusClassSource.java

@@ -27,35 +27,65 @@
  * ConcurrentHashMap to support concurrent class loading operations.</p>
  */
 public class MavenNexusClassSource implements ClassSource {
+    private static final long MAX_JAR_SIZE = 100 * 1024 * 1024; // 100MB default max JAR size
+    private static final long MAX_CLASS_SIZE = 10 * 1024 * 1024; // 10MB default max class size
+    private static final int DEFAULT_CONNECT_TIMEOUT = 10000; // 10 seconds
+    private static final int DEFAULT_READ_TIMEOUT = 30000; // 30 seconds
+
     private final String nexusUrl;
     private final String repository;
     private final List<MavenArtifact> artifacts;
     private final AuthConfig authConfig;
     private final Map<String, byte[]> classCache;
+    private final int connectTimeout;
+    private final int readTimeout;
 
     /**
-     * Creates a Maven Nexus class source with full configuration.
+     * Creates a Maven Nexus class source with full configuration including timeouts.
      *
      * @param nexusUrl The Nexus server URL
      * @param repository The Maven repository name
      * @param artifacts The list of Maven artifacts to load classes from
      * @param authConfig The authentication configuration
+     * @param connectTimeout Connection timeout in milliseconds
+     * @param readTimeout Read timeout in milliseconds
      * @throws NullPointerException if nexusUrl, repository, or artifacts is null
-     * @throws IllegalArgumentException if artifacts list is empty
+     * @throws IllegalArgumentException if artifacts list is empty or timeouts are negative
      */
-    public MavenNexusClassSource(String nexusUrl, String repository, List<MavenArtifact> artifacts, AuthConfig authConfig) {
+    public MavenNexusClassSource(String nexusUrl, String repository, List<MavenArtifact> artifacts,
+                                AuthConfig authConfig, int connectTimeout, int readTimeout) {
         Objects.requireNonNull(nexusUrl, "nexusUrl cannot be null");
         Objects.requireNonNull(artifacts, "artifacts cannot be null");
 
         if (artifacts.isEmpty()) {
             throw new IllegalArgumentException("At least one Maven artifact must be specified");
         }
+        if (connectTimeout < 0) {
+            throw new IllegalArgumentException("connectTimeout must be >= 0");
+        }
+        if (readTimeout < 0) {
+            throw new IllegalArgumentException("readTimeout must be >= 0");
+        }
 
         this.nexusUrl = nexusUrl.endsWith("/") ? nexusUrl : nexusUrl + "/";
         this.repository = Objects.requireNonNull(repository, "repository cannot be null");
         this.artifacts = new ArrayList<>(artifacts);
         this.authConfig = authConfig != null ? authConfig : AuthConfig.none();
         this.classCache = new ConcurrentHashMap<>();
+        this.connectTimeout = connectTimeout;
+        this.readTimeout = readTimeout;
+    }
+
+    /**
+     * Creates a Maven Nexus class source with default timeouts.
+     *
+     * @param nexusUrl The Nexus server URL
+     * @param repository The Maven repository name
+     * @param artifacts The list of Maven artifacts to load classes from
+     * @param authConfig The authentication configuration
+     */
+    public MavenNexusClassSource(String nexusUrl, String repository, List<MavenArtifact> artifacts, AuthConfig authConfig) {
+        this(nexusUrl, repository, artifacts, authConfig, DEFAULT_CONNECT_TIMEOUT, DEFAULT_READ_TIMEOUT);
     }
 
     /**
@@ -79,6 +109,7 @@ public byte[] loadClassData(String className) throws IOException {
         }
 
         String classFileName = ClassNameUtil.toClassFilePath(className);
+        List<String> errorMessages = new ArrayList<>();
 
         for (MavenArtifact artifact : artifacts) {
             try {
@@ -87,10 +118,19 @@ public byte[] loadClassData(String className) throws IOException {
                 classCache.put(cacheKey, classData);
                 return classData;
             } catch (IOException e) {
+                // Accumulate errors instead of silently swallowing
+                String errorMsg = String.format("Artifact %s - %s",
+                    artifact.toString(), e.getMessage());
+                errorMessages.add(errorMsg);
             }
         }
 
-        throw new IOException("Class not found in any configured Maven artifacts: " + className);
+        // Throw with ALL error details
+        String allErrors = String.join("\n  - ", errorMessages);
+        throw new IOException(
+            "Class not found in any of " + artifacts.size() + " configured Maven artifacts: " +
+            className + "\nAttempted artifacts:\n  - " + allErrors
+        );
     }
 
     @Override
@@ -116,12 +156,22 @@ private String buildJarUrl(MavenArtifact artifact) {
     private byte[] extractClassFromJar(String jarUrl, String classFileName) throws IOException {
         URL url = new URL(jarUrl);
         HttpURLConnection connection = (HttpURLConnection) url.openConnection();
+        connection.setConnectTimeout(connectTimeout);
+        connection.setReadTimeout(readTimeout);
         configureAuthentication(connection);
         connection.setRequestMethod("GET");
 
         int responseCode = connection.getResponseCode();
         if (responseCode != HttpURLConnection.HTTP_OK) {
-            throw new IOException("HTTP error code: " + responseCode + " for JAR URL: " + jarUrl);
+            throw new IOException("HTTP " + responseCode + " for JAR: " + jarUrl);
+        }
+
+        // Check JAR size before downloading
+        long contentLength = connection.getContentLengthLong();
+        if (contentLength > MAX_JAR_SIZE) {
+            throw new IOException(
+                "JAR too large: " + contentLength + " bytes (max " + MAX_JAR_SIZE + ")"
+            );
         }
 
         try (InputStream in = connection.getInputStream();
@@ -130,18 +180,34 @@ private byte[] extractClassFromJar(String jarUrl, String classFileName) throws I
             JarEntry entry;
             while ((entry = jarIn.getNextJarEntry()) != null) {
                 if (entry.getName().equals(classFileName) && !entry.isDirectory()) {
+                    long size = entry.getSize();
+
+                    if (size > MAX_CLASS_SIZE) {
+                        throw new IOException(
+                            "Class too large: " + size + " bytes (max " + MAX_CLASS_SIZE + ")"
+                        );
+                    }
+
+                    // Read with size enforcement
                     ByteArrayOutputStream out = new ByteArrayOutputStream();
                     byte[] buffer = new byte[DEFAULT_BUFFER_SIZE];
+                    long totalRead = 0;
                     int bytesRead;
+
                     while ((bytesRead = jarIn.read(buffer)) != -1) {
+                        totalRead += bytesRead;
+                        if (totalRead > MAX_CLASS_SIZE) {
+                            throw new IOException("Class exceeded size limit: " + totalRead);
+                        }
                         out.write(buffer, 0, bytesRead);
                     }
+
                     return out.toByteArray();
                 }
             }
         }
 
-        throw new IOException("Class file not found in JAR: " + classFileName);
+        throw new IOException("Class not found in JAR: " + classFileName + " (URL: " + jarUrl + ")");
     }
 
     private void configureAuthentication(HttpURLConnection connection) {
@@ -182,6 +248,8 @@ public static class Builder {
         private String repository;
         private final List<MavenArtifact> artifacts = new ArrayList<>();
         private AuthConfig authConfig = AuthConfig.none();
+        private int connectTimeout = DEFAULT_CONNECT_TIMEOUT;
+        private int readTimeout = DEFAULT_READ_TIMEOUT;
 
         public Builder nexusUrl(String nexusUrl) {
             this.nexusUrl = Objects.requireNonNull(nexusUrl, "nexusUrl cannot be null");
@@ -211,10 +279,27 @@ public Builder auth(AuthConfig authConfig) {
             return this;
         }
 
+        public Builder connectTimeout(int timeoutMs) {
+            if (timeoutMs < 0) {
+                throw new IllegalArgumentException("connectTimeout must be >= 0");
+            }
+            this.connectTimeout = timeoutMs;
+            return this;
+        }
+
+        public Builder readTimeout(int timeoutMs) {
+            if (timeoutMs < 0) {
+                throw new IllegalArgumentException("readTimeout must be >= 0");
+            }
+            this.readTimeout = timeoutMs;
+            return this;
+        }
+
         public MavenNexusClassSource build() {
             Objects.requireNonNull(nexusUrl, "nexusUrl must be set");
             Objects.requireNonNull(repository, "repository must be set");
-            return new MavenNexusClassSource(nexusUrl, repository, artifacts, authConfig);
+            return new MavenNexusClassSource(nexusUrl, repository, artifacts, authConfig,
+                                            connectTimeout, readTimeout);
         }
     }
 }