[mldangelo-oai]

Summary

A macOS SDK shard reached the 30-second case timeout while validating an npm archive. The test had already extracted the archive, installed it with npm, and checked the installed files. A controlled reproduction reached the same point with each individual command taking less than 30 seconds. Failing macOS job

Changes

Run native tar, the offline npm install, and the package validator concurrently for the 15 archive representations. All three read the same finished archive. The test waits for every reader before inspecting the results and removing the temporary directory. It checks each tool’s exit status and the installed bytes as before.

Testing

• Added delays around the real commands in a local reproduction. The original case timed out after five of six assertions. The concurrent case passed all six in about 17 seconds under the same 30-second limit.
• Forced each reader to fail early. The test reported the failure, the remaining readers retained access to the archive, and the fixture was removed after they exited. An unexpected validator success also failed the test.
• A deliberately stalled validator still failed at 30 seconds. A 500 ms explicit test timeout still stopped the case at 500 ms.
• The full archive test file passed all 60 cases and 231 assertions on Linux with Bun 1.3.14. A positive and negative pair also passed with bsdtar.
• SDK build:ci, types, format, and git diff --check passed.
• After merging the newer package manifest from main, all 15 fixture archives contained four additional dist files. The full 60 cases and 231 assertions passed with both GNU tar 1.35 and bsdtar 3.5.3. Each tar implementation produced the same installed bytes and validator decisions on the newer base and the PR. Package manifest change

Risk and rollout

This changes execution order inside one SDK test. Each representation has its own temporary directory, native extraction directory, and npm cache. The existing per-command and per-test deadlines continue to enforce the selected limits.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T21:14:52.189586Z	1054329	New commits
🔒 Security Review	✅ Completed 2026-10-25T21:15:03.240004Z	1054329	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

No blocking findings in this owner-level merge-safety pass on b479c46. Thank you for running the independent archive checks together while preserving their assertions, deadlines, and the wait for all readers before fixture cleanup.

All 60 archive tests (231 assertions) passed with Bun 1.3.14; build:ci, type checks and formatting also passed. The test run used process-scoped NODE_NO_WARNINGS=1 for an unrelated experimental Node warning on stderr. macOS timing was not reproduced locally, and hosted SDK checks were still running at inspection.