From f8a68008df9bccdef27da2282c987fb01fd4238e Mon Sep 17 00:00:00 2001
From: LorenzoFeng <paradise_c@qq.com>
Date: Tue, 9 Jun 2026 14:11:24 +0800
Subject: [PATCH] fix: add 5min timeout to npm reify to prevent silent
 deadlocks

Arborist reify() called by Npm.add() can deadlock silently when the npm
cache is cold (resolving @latest specifiers). Adding Effect.timeout
surfaces the error instead of hanging indefinitely.

Related: #23143 (@latest triggers full reify with no TTL cache)
---
 packages/core/src/npm.ts | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/npm.ts b/packages/core/src/npm.ts
index 759e0487051f..4c4d21784aa4 100644
--- a/packages/core/src/npm.ts
+++ b/packages/core/src/npm.ts
@@ -103,7 +103,18 @@ export const layer = Layer.effect(
               add,
               dir: input.dir,
             }),
-        }) as Effect.Effect<ArboristTree, InstallFailedError>
+        }).pipe(
+          Effect.timeout("5 minutes"),
+          Effect.catchTag("TimeoutException", () =>
+            Effect.fail(
+              new InstallFailedError({
+                cause: new Error("npm install timed out after 5 minutes"),
+                add,
+                dir: input.dir,
+              })
+            )
+          )
+        ) as Effect.Effect<ArboristTree, InstallFailedError>
       }).pipe(
         Effect.withSpan("Npm.reify", {
           attributes: input,