fix: sweep — every sync spawn in the test trees carries a timeout (436 sites, 157 files)

spawnSync/execSync/Bun.spawnSync BLOCK the main thread, so bun's in-process
per-test timeout can never fire while one waits — a hung child (stdin read,
network probe, dead daemon) wedges the whole shard until the runner's
external wall-clock SIGKILL. This exact class reached main: free-tests run
33262077256, test/gstack-memory-ingest.test.ts (normally 2.3s) held shard 2
at the 360s wall while its five siblings finished in ~65s.

Mechanical sweep in two waves (12 + 4 fan-out agents, every edit verified
against its call site): default timeout: 30_000 (matches the free runner's
per-test budget), 120_000 for genuinely slow ops (installs, builds,
playwright, provider CLIs), helper wrappers fixed ONCE where call sites
route through them. Sites that only LOOK like calls (string fixtures, grep
needles, comments) were skipped with reasons — the enforcement commit that
follows marks them exempt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

browse/test/build.test.ts

@@ -13,7 +13,7 @@ describe('build: server-node.mjs', () => {
       // Skip rather than fail so plain `bun test` without a prior build passes.
       return;
     }
-    expect(() => execSync(`node --check ${SERVER_NODE}`, { stdio: 'pipe' })).not.toThrow();
+    expect(() => execSync(`node --check ${SERVER_NODE}`, { stdio: 'pipe', timeout: 30_000 })).not.toThrow();
   });
 
   test('does not inline @ngrok/ngrok (must be external)', () => {

browse/test/bun-polyfill.test.ts

@@ -27,7 +27,7 @@ describe('bun-polyfill', () => {
         const elapsed = Date.now() - start;
         console.log(elapsed >= 40 ? 'OK' : 'TOO_FAST');
       })();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     expect(result.stdout.toString().trim()).toBe('OK');
     expect(result.exitCode).toBe(0);
   });
@@ -38,7 +38,7 @@ describe('bun-polyfill', () => {
       const r = Bun.spawnSync(['echo', 'hello'], { stdout: 'pipe' });
       console.log(r.stdout.toString().trim());
       console.log('exit:' + r.exitCode);
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     const lines = result.stdout.toString().trim().split('\n');
     expect(lines[0]).toBe('hello');
     expect(lines[1]).toBe('exit:0');
@@ -51,7 +51,7 @@ describe('bun-polyfill', () => {
       console.log(typeof p.pid === 'number' ? 'HAS_PID' : 'NO_PID');
       console.log(typeof p.kill === 'function' ? 'HAS_KILL' : 'NO_KILL');
       console.log(typeof p.unref === 'function' ? 'HAS_UNREF' : 'NO_UNREF');
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     const lines = result.stdout.toString().trim().split('\n');
     expect(lines[0]).toBe('HAS_PID');
     expect(lines[1]).toBe('HAS_KILL');
@@ -70,7 +70,7 @@ describe('bun-polyfill', () => {
         console.log(typeof p.exited === 'object' && typeof p.exited.then === 'function' ? 'IS_PROMISE' : 'NOT_PROMISE');
         console.log('exit:' + await p.exited);
       })();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     const lines = result.stdout.toString().trim().split('\n');
     expect(lines[0]).toBe('IS_PROMISE');
     expect(lines[1]).toBe('exit:0');
@@ -83,7 +83,7 @@ describe('bun-polyfill', () => {
         const p = Bun.spawn(['node', '-e', 'process.exit(3)'], { stdio: ['ignore', 'ignore', 'ignore'] });
         console.log('exit:' + await p.exited);
       })();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     expect(result.stdout.toString().trim()).toBe('exit:3');
   });
 
@@ -100,7 +100,7 @@ describe('bun-polyfill', () => {
         const out = await new Response(p.stdout).text();
         console.log(out + ':' + code);
       })();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     expect(result.stdout.toString().trim()).toBe('ready:0');
   });
 
@@ -120,7 +120,7 @@ describe('bun-polyfill', () => {
         ]).catch(() => 'TIMEOUT');
         console.log('exit:' + code);
       })();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     // Anything other than 'TIMEOUT' (and ideally a non-zero number) means the
     // lifecycle promise resolved on the spawn error.
     const out = result.stdout.toString().trim();
@@ -139,7 +139,7 @@ describe('bun-polyfill', () => {
         setTimeout(() => p.kill('SIGTERM'), 150);
         console.log('exit:' + await p.exited);
       })();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     // SIGTERM = 15 → 128 + 15 = 143.
     expect(result.stdout.toString().trim()).toBe('exit:143');
   });
@@ -166,7 +166,7 @@ describe('bun-polyfill', () => {
         const out = await new Response(p.stdout).text();
         console.log(out.length + ':' + code);
       })();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     expect(result.stdout.toString().trim()).toBe('1024:0');
   });
 
@@ -197,7 +197,7 @@ describe('bun-polyfill', () => {
         const out = await new Response(p.stdout).text();
         console.log(out.length + ':' + code);
       })().catch((e) => { console.log('THREW:' + e.message); });
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     expect(result.stdout.toString().trim()).toBe('1048576:0');
   }, 15000);
 
@@ -217,7 +217,7 @@ describe('bun-polyfill', () => {
       console.log(typeof server.stop === 'function' ? 'HAS_STOP' : 'NO_STOP');
       console.log(typeof server.port === 'number' ? 'HAS_PORT' : 'NO_PORT');
       server.stop();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     const lines = result.stdout.toString().trim().split('\n');
     expect(lines[0]).toBe('HAS_STOP');
     expect(lines[1]).toBe('HAS_PORT');
@@ -237,7 +237,7 @@ describe('bun-polyfill', () => {
       require(${JSON.stringify(polyfillPath)});
       Bun.spawn(['node', '-e', ''], { stdio: ['ignore', 'ignore', 'ignore'] });
       console.log('windowsHide:' + seen.windowsHide);
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     expect(result.stdout.toString().trim()).toBe('windowsHide:true');
   });
 
@@ -250,7 +250,7 @@ describe('bun-polyfill', () => {
       require(${JSON.stringify(polyfillPath)});
       Bun.spawnSync(['node', '-e', '']);
       console.log('windowsHide:' + seen.windowsHide);
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     expect(result.stdout.toString().trim()).toBe('windowsHide:true');
   });
 
@@ -263,7 +263,7 @@ describe('bun-polyfill', () => {
       require(${JSON.stringify(polyfillPath)});
       Bun.spawn(['node', '-e', ''], { stdio: ['ignore', 'ignore', 'ignore'], windowsHide: false });
       console.log('windowsHide:' + seen.windowsHide);
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
     expect(result.stdout.toString().trim()).toBe('windowsHide:false');
   });
 });

browse/test/config.test.ts

@@ -85,7 +85,7 @@ describe('config', () => {
       // it (the exact bug the fix removed) would skip the guard here.
       const tmpDir = path.join(os.tmpdir(), `browse-gitignored-repo-test-${Date.now()}`);
       fs.mkdirSync(tmpDir, { recursive: true });
-      Bun.spawnSync(['git', 'init'], { cwd: tmpDir, stdout: 'ignore', stderr: 'ignore' });
+      Bun.spawnSync(['git', 'init'], { cwd: tmpDir, stdout: 'ignore', stderr: 'ignore', timeout: 30_000 });
       fs.writeFileSync(path.join(tmpDir, '.gitignore'), '.gstack/\n');
       const config = resolveConfig({ BROWSE_STATE_FILE: path.join(tmpDir, '.gstack', 'browse.json') });
       ensureStateDir(config);
@@ -166,22 +166,22 @@ describe('config', () => {
       fs.mkdirSync(tmpDir, { recursive: true });
 
       // Set up a real git repo
-      spawnSync('git', ['init', '-q'], { cwd: tmpDir });
-      spawnSync('git', ['config', 'user.email', 'test@test.com'], { cwd: tmpDir });
-      spawnSync('git', ['config', 'user.name', 'Test'], { cwd: tmpDir });
+      spawnSync('git', ['init', '-q'], { cwd: tmpDir, timeout: 30_000 });
+      spawnSync('git', ['config', 'user.email', 'test@test.com'], { cwd: tmpDir, timeout: 30_000 });
+      spawnSync('git', ['config', 'user.name', 'Test'], { cwd: tmpDir, timeout: 30_000 });
 
       // Write a global excludes file that ignores .gstack/
       const excludesFile = path.join(tmpDir, 'global-gitignore');
       fs.writeFileSync(excludesFile, '.gstack/\n');
-      spawnSync('git', ['config', 'core.excludesFile', excludesFile], { cwd: tmpDir });
+      spawnSync('git', ['config', 'core.excludesFile', excludesFile], { cwd: tmpDir, timeout: 30_000 });
 
       // .gitignore exists but does NOT contain .gstack/
       fs.writeFileSync(path.join(tmpDir, '.gitignore'), 'node_modules/\n');
-      spawnSync('git', ['add', '.gitignore'], { cwd: tmpDir });
-      spawnSync('git', ['commit', '-qm', 'init'], { cwd: tmpDir });
+      spawnSync('git', ['add', '.gitignore'], { cwd: tmpDir, timeout: 30_000 });
+      spawnSync('git', ['commit', '-qm', 'init'], { cwd: tmpDir, timeout: 30_000 });
 
       // Verify git knows .gstack/ is ignored
-      const check = spawnSync('git', ['check-ignore', '-q', '.gstack/'], { cwd: tmpDir });
+      const check = spawnSync('git', ['check-ignore', '-q', '.gstack/'], { cwd: tmpDir, timeout: 30_000 });
       expect(check.status).toBe(0);
 
       const config = resolveConfig({ BROWSE_STATE_FILE: path.join(tmpDir, '.gstack', 'browse.json') });

browse/test/file-permissions.test.ts

@@ -87,7 +87,7 @@ describe('restrictDirectoryPermissions', () => {
     fs.mkdirSync(d);
     // System chmod, not fs.chmodSync: Bun masks the sticky bit off chmod/
     // mkdir modes, so 0o1777 through the fs API lands as 0o777.
-    Bun.spawnSync(['chmod', '1777', d]);
+    Bun.spawnSync(['chmod', '1777', d], { timeout: 30_000 });
     expect(fs.statSync(d).mode & 0o7777).toBe(0o1777); // fixture took
     restrictDirectoryPermissions(d);
     expect(fs.statSync(d).mode & 0o7777).toBe(0o1777);
@@ -244,7 +244,7 @@ describe('mkdirSecure', () => {
     fs.mkdirSync(d);
     // System chmod: Bun's fs API masks the sticky bit off modes (see the
     // restrictDirectoryPermissions sticky-dir test).
-    Bun.spawnSync(['chmod', '1777', d]);
+    Bun.spawnSync(['chmod', '1777', d], { timeout: 30_000 });
     expect(fs.statSync(d).mode & 0o7777).toBe(0o1777); // fixture took
     mkdirSecure(d);
     expect(fs.statSync(d).mode & 0o7777).toBe(0o1777);

browse/test/findport.test.ts

@@ -160,7 +160,7 @@ describe('findPort / isPortAvailable', () => {
       }
 
       test();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
 
     const output = result.stdout.toString().trim();
     // Confirms the polyfill's stop() is fire-and-forget — callers
@@ -171,7 +171,7 @@ describe('findPort / isPortAvailable', () => {
   test('net.createServer approach does not have the race condition', async () => {
     // Prove the fix: net.createServer with proper async bind/close
     // releases the port cleanly
-    const result = Bun.spawnSync(['node', '-e', `
+    const result = Bun.spawnSync(['node', '-e', ` // timeout in trailing options
       const net = require('net');
 
       async function testFix() {
@@ -205,7 +205,7 @@ describe('findPort / isPortAvailable', () => {
       }
 
       testFix();
-    `], { stdout: 'pipe', stderr: 'pipe' });
+    `], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
 
     const output = result.stdout.toString().trim();
     expect(output).toBe('FIX_WORKS');

browse/test/gstack-config.test.ts

@@ -31,6 +31,7 @@ function run(args: string[] = [], extraEnv: Record<string, string> = {}) {
     env,
     stdout: 'pipe',
     stderr: 'pipe',
+    timeout: 30_000,
   });
   return {
     exitCode: result.exitCode,

browse/test/gstack-update-check.test.ts

@@ -34,6 +34,7 @@ function run(extraEnv: Record<string, string> = {}, args: string[] = []) {
     env,
     stdout: 'pipe',
     stderr: 'pipe',
+    timeout: 30_000,
   });
   return {
     exitCode: result.exitCode,

browse/test/temp-dirs.test.ts

@@ -107,7 +107,7 @@ describe('untrustable TMPDIR values never widen the allowlist', () => {
     const r = Bun.spawnSync([
       process.execPath, '-e',
       "import { TEMP_DIRS } from './browse/src/platform'; console.log(JSON.stringify(TEMP_DIRS));",
-    ], { env: { ...process.env, TMPDIR: tmpdir }, cwd: path.resolve(import.meta.dir, '..', '..') });
+    ], { env: { ...process.env, TMPDIR: tmpdir }, cwd: path.resolve(import.meta.dir, '..', '..'), timeout: 30_000 });
     return JSON.parse(r.stdout.toString().trim().split('\n').pop()!);
   };
 

browse/test/xvfb.test.ts

@@ -11,7 +11,7 @@ import {
 
 const HAS_XVFB = (() => {
   if (process.platform !== 'linux') return false;
-  const result = Bun.spawnSync(['which', 'Xvfb'], { stdout: 'pipe', stderr: 'pipe' });
+  const result = Bun.spawnSync(['which', 'Xvfb'], { stdout: 'pipe', stderr: 'pipe', timeout: 30_000 });
   return result.exitCode === 0;
 })();