Fixes the review findings on the work-budget change:
- unify the measured npm time range to 137-205 s in the note's problem
statement, which had carried the older 153-190 s range
- correct the peer-edge share to about three quarters (1874 of 2524),
which the sentence had called two thirds
- state the ratchet threshold as the packages-times-edges product, about
12% in packages and edges together
- derive NPM_HANG_GUARD_MS from MAX_RESOLUTION_WORK_UNITS so a raised
budget cannot shrink the guard's headroom, and state the guard's
guarantee as covering a runner four times slower than the measured host
- name the cost side of the hang guard in the note's consequences
The Dependency layout lane failed whenever the npm child process exceeded
a hardcoded 300 s deadline. That deadline measured the runner rather than
the graph: the same layout resolves in 137-205 s on an idle developer host
and exceeded 300 s on CI while the placement assertion reported no error,
so the failure carried no information about what had grown.
The gate now bounds the verified graph by resolution work units,
dshPackagesPerVersion * checkedDshEdges against MAX_RESOLUTION_WORK_UNITS,
and keeps the wall clock only as a hang guard derived from that budget.
Growth fails with the graph's own measured counts on any runner.
The resolution cost itself is unchanged. Measurement attributed 99.3% of
it to npm's peer-conflict placement, and cache reuse, graph splitting and
the placement flags were measured and rejected.
run-gates.spec.ts clears DSH_COVERAGE_PARTITIONS and DSH_COVERAGE_MAX_WORKERS
before each case, so the coverage gates it builds take their shape from the
case, not from a partitioned lane that exports the variables to every child.
The ci-unit case derives its two gates from the `test` package script's
segments. The serial-reference note keeps only the lane fact; the mechanism
fact about inline-project inheritance is owned by the fix that changes it.
The unit-darwin job ran the whole unit inventory at Vitest's 5000 ms default
on a shared 3-vCPU macos-latest runner; the first two master runs after #5292
each timed out a different set of cases that pass in under a second on a quiet
host. Every other whole-inventory lane raises the budget through
DSH_COVERAGE_TEST_TIMEOUT_MS=90000.
The job now sets that variable and runs `pnpm run check:ci:unit`, a run-gates
aggregate that is `pnpm run test` (native build, then `vitest run`) through the
path that consumes it. ci-unit receives no CI worker settings, so the inventory
inherits the environment `pnpm run test` finds: on a 3-CPU host the defaults
would inject DSH_COVERAGE_PARTITIONS=2, which run-gates.spec.ts reads as a
partitioned coverage lane.
Fixes#5325
Five cases in scripts/oxlint-contract.spec.ts spawned oxlint or the
repository lint entrypoint on vitest's 5000 ms default while their nine
siblings carried the 90_000 ceiling from the Windows spawn-budget
alignment. The first darwin parity run on master (Sandbox run
36332053320) ran the file 2.2x slower than the passing run and timed out
`prints only the final diagnostics when a fix retry still fails` at
6309 ms. Give the five cases the same per-case ceiling and record the
decision in an Agent Note.
Fixes#2581
Related to #2677
The install registry picker used MenuSurface and overrode the theme-owned
menu material tokens, which the shared-menu-material gate rejects. Return
the picker to a fieldset (its native group role) and paint an opaque
bg-layer-2 surface so the form controls stay readable without touching
menu tokens. This also restores the group's radios to the accessible tree.
Align plugin-install-registry.e2e and its snapshots with the PR's visible
text: registry option names drop the parentheses around the host, the
custom address field is no longer disabled, and the custom hint spells out
http(s) and ~/.npmrc.
Hold the manual-refresh spinner to a 400ms minimum so a fast read does not
flash it, clearing to idle (or the failure toast) only after the minimum,
and dropping a refresh that settles after disposal.
Prune the retired no-unknown-casts baseline entry for browser-plugin.client.spec.
Reading Git's path text verbatim to keep trailing whitespace duplicated the
line-terminator helper that scripts/change-scope.ts already owns, which the
duplication gate rejects. Canonicalizing the fixture-side common directory
with realpathSync.native removes the text parsing entirely: short names,
junctions, and directory symlinks all collapse onto the physical directory
the installer resolves, and the injected path stays exact.
Drops the trailing-space case: with no text trimming left in the
derivation, that path already matched the installer before this change, so
the case could not fail and proved nothing.
git() trims its output, which also drops a worktree directory's own
trailing whitespace; the installer removes only the line terminator. Derive
the expected lock path through gitPath()/stripGitLineTerminator(), which
applies the installer's exact rule, so the same-string claim holds for
every path.
Adds the trailing-space injection case (skipped on Windows, which cannot
create such a directory); it fails with the same probe ENOENT under the
trimming derivation.
The five lock-access cases only diverged on a host whose temp directory
already carried a short name or directory alias. Route one case through an
aliased worktree root (a junction on Windows, a directory symlink
elsewhere) so the installer's resolved common directory necessarily differs
from the path this spec composes; the case fails with the same probe ENOENT
under the previous derivation on every platform.
The alias case shares the injection body through
expectInjectedLockAccessFailure, so the five existing case names and their
assertions are unchanged.
The lock-access cases injected a filesystem failure on a path this spec
predicted from the mkdtemp fixture directory. The installer resolves its
common directory against Git's own top-level path instead, and the host
spells that path differently: Git canonicalizes Windows 8.3 short names
and the macOS /var symlink. When the spellings diverged the injection
never fired, so the probe file was never written and all five cases
failed with ENOENT at the probe read - the signature seen in the Windows
coverage lane.
Resolving the relative common directory against Git's top-level, as the
installer does, makes the expected path identical to the one the
installer touches on every platform. The five cases fail deterministically
on macOS before this change and pass after it.
The overlay alternative now says only its insert form fails to override a shipped
row, since an id-targeted --patch overlay does set one. The composed assertion
compares the overridden row's package name with the shipped layer's name instead of
asserting a string.
Cross-link the archived decision the opt-in note supersedes, state the Loader's one
entry per id and last-declaration-wins behavior in the overlay and extraction
alternatives, scope the missing-row warning to profiles that mount no Plugins page,
and move the switch-on-but-ineffective case to the list-order paragraph. Assert one
top-level composed row per id and correct the stale assembled-remote comment.
Archive the reversed 2026-09-24-web-default-schedule-composition triplet and name
the four bundles in the optional-bundles note. Rewrite the opt-in note's Problem to
the state at the branch base and state why the bundle switches time-context on with
schedule. Record the missing-row warnings, the bundle list order, and the bundle
detail page's empty state in the bundle README. Pin the composed Schedule rows in
scripts/optional-bundles.spec.ts and move the cli dependency entry into order.
A denial this backend cannot explain — the confined child cannot open an object it
was granted, or provisioning itself fails with Win32 5 — reached the user as a bare
"Access is denied". The README documented both causes but shipped no way to tell
them apart.
Add the `diagnose-windows-sandbox-acl` skill. Its script reads unless a repair switch
is passed, and classifies the failing path and its ancestors before anything
changes; its two repair modes are the only supported ACL edits. `-Fix` removes a
foreign package-SID allow ACE, and `-GrantFullControl` supplies the
WRITE_DAC/WRITE_OWNER pair the mandatory-label write needs without ever changing an
owner. Both require `-AllowRoot`, refuse a target outside it, and refuse to run
together.
`dsh-sandbox-local` registers the skill on Windows through `ctx.inject(['skills'],
...)`, so the skill registry stays optional and the sandbox never depends on it. The
assets ship in this package's `files` list, which the workspace-constraints gate now
pins alongside the runner and emitted-type entries.
Tests cover the script's verdicts (foreign ACE, healthy object, inert capability
SID, inert DENY ACE), its surgical removal, the grant's owner invariant, and both
refusals; the catalog spec covers registration and disposal.
turtle1999