fix: sweep wave 3 — the execFileSync family gets timeouts (90 sites, 17 files)

The tripwire's regex covered spawnSync/execSync/Bun.spawnSync but not
execFileSync — an entire blocking sync-spawn API family that could
reintroduce the shard-wedge class undetected (ship review army). Same
mechanical recipe as waves 1-2: timeout: 30_000 default, 120_000 for slow
ops, shared wrappers fixed once, string-needle sites skipped with reasons.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-31 05:37:58 +00:00
co-authored by Claude Fable 5
parent 008ddb3697
commit e4954aaebb
17 changed files with 92 additions and 78 deletions
+1
View File
@@ -38,6 +38,7 @@ const BANNED_PATTERNS: Array<{ name: string; regex: RegExp }> = [
// tripwire-exempt: grep-needle STRING for this invariant, not a process spawn
{ name: 'spawnSync("gbrain", ...)', regex: /spawnSync\s*\(\s*["']gbrain["']/g },
{ name: 'spawn("gbrain", ...)', regex: /\bspawn\s*\(\s*["']gbrain["']/g },
// tripwire-exempt: grep-needle STRING for this invariant, not a process spawn
{ name: 'execFileSync("gbrain", ...)', regex: /execFileSync\s*\(\s*["']gbrain["']/g },
// tripwire-exempt: grep-needle STRING for this invariant, not a process spawn
{ name: 'execSync("...gbrain...")', regex: /execSync\s*\(\s*["'`][^"'`]*\bgbrain\b/g },