Skip to content

fix(util): bound npm installs with a configurable timeout - #41936

Open
Robin1987China wants to merge 1 commit into
anomalyco:v2from
Robin1987China:npm-install-timeout
Open

fix(util): bound npm installs with a configurable timeout#41936
Robin1987China wants to merge 1 commit into
anomalyco:v2from
Robin1987China:npm-install-timeout

Conversation

@Robin1987China

@Robin1987China Robin1987China commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Issue for this PR

Closes #41934

Type of change

  • Bug fix

What does this PR do?

Npm.reify (Arborist) currently runs with no timeout and no retry. With a cold cache and a slow or wedged registry, the install can hang indefinitely, blocking whatever path awaits the plugin/package load (PluginSupervisor.load waits on npm.add, and startup config dependency installs wait on Npm.install). This is the same unguarded-install mechanism as V1 issues #31463 (open) and #33905 (closed as a mis-triage, left untracked).

This PR bounds every reify with Effect.timeout, defaulting to npm's own fetch-timeout default (300s) and configurable via OPENCODE_NPM_INSTALL_TIMEOUT. Timeouts surface as InstallFailedError with the package and install directory, and a diagnostic log is emitted on any install failure.

How did you verify your code works?

  • Added packages/util/test/npm.test.ts:
    • registry that never responds -> InstallFailedError after the configured timeout
    • file: dependency install still succeeds (no regression on the normal path)
  • bun test (packages/util) — 9 pass
  • tsgo --noEmit (packages/util) — clean

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

@github-actions

github-actions Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

  1. Open an issue describing the bug/feature (if one doesn't exist)
  2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

@Robin1987China Robin1987China mentioned this pull request Aug 12, 2026
Open
@liudongyan13701205717-source

liudongyan13701205717-source commented Aug 12, 2026

Copy link
Copy Markdown

Friendly heads-up on the pr-standards bot comment: this PR's description does link an issue — Closes #41934 (opened 2026-08-12T03:15Z by the same author, just ~4 minutes before this PR at 03:19Z). The bot's "no linked issue" check appears to have run in the race window before the PR's issue reference was picked up.

#41934 exists, is open, and describes exactly this fix (unguarded Npm.reify/Arborist install with no timeout). No action needed from the author — the reference is already there. Requesting maintainers re-run the check / mark this as having a valid linked issue so the PR isn't auto-closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

contributor needs:issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Robin1987China @liudongyan13701205717-source