Bound the PDM site probe through utils::process (#1067)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #1067. This is slice 1, pdm_site; the npm_dir git exchange stays for a later slice.

Summary

The macOS PDM site-config probe now runs through utils::process::output_within, the bounded spawn every other crawler probe has used since #886. Its own tokio::time::timeout + kill_on_drop deadline and its private 5 s budget are deleted. A new guard test fails when production code outside utils::process adds a kill_on_drop spawn.

Why

• Issue #1067; register row C48 (register/20-audit-core.md, "partly fixed (Bound crawler and tool probes through one spawn deadline (#845) #886); pdm_site and the npm_dir git exchange keep hand-rolled deadlines").
• Leverage: B 0, U 1 (the guard pins the rule so the npm_dir slice can't drift), D 1 (one of the two remaining hand-rolled spawn deadlines removed, net −16 production lines), S 0, R L.
• This was the only open refactor slice whose files no open PR changes. npm_dir.rs and utils/process.rs are both changed by Redact credentials from logged URLs, VEX product ids and hosted Composer locks #1026, so this PR touches neither.

What changed

• crawlers/python_crawler/pdm_site.rs:
  • probe_runtime_site_dir builds a std::process::Command and runs output_within(command, timeout) on the blocking pool (utils::fs::run_blocking), the same pattern utils::pipenv and vendor::pypi_hatch use.
  • runtime_probe_command returns that std command and no longer sets stdio or kill_on_drop, because output_within nulls stdin and stderr itself.
  • The output check moved into runtime_site_dir(&Output): at most 4 KiB, exit 0, exactly one JSON string holding an absolute path.
• tests/child_deadline_guard.rs (new): scans the production part of every src/**/*.rs file (above its first #[cfg(test)] module, CRLF-normalized) for kill_on_drop(, outside utils/process.rs. A PENDING list (vendor/npm_dir.rs) fails on new and stale entries. A second test plants a site in a temp tree to prove that the guard fires and ignores test modules.

Deleted

• Production: +21 / −37 in pdm_site.rs: the local PROBE_TIMEOUT, the tokio::time::timeout + kill_on_drop read loop (read_runtime_site_dir) and the stdio setup.
• Tests: +27 / −21 in pdm_site.rs's test module, plus +107 for the new guard file.

Behavior

For a probe that answers in time, nothing changes: the same argv (-E -B -c), private temp cwd, scrubbed PYTHON* environment, null stdin and stderr, 4 KiB limit and JSON check.

There are two changes:

• A hung probe is now killed at the shared utils::process::PROBE_TIMEOUT (10 s) instead of a private 5 s. This was the drift Route the remaining hand-rolled child-process deadlines through utils::process #1067 names.
• Oversized output is now rejected after the child exits instead of when the 4,097th byte arrives. The answer is the same (None), still within the deadline.

This code is compiled only on macOS (#[cfg(target_os = "macos")] mod pdm_site).

Test evidence

• pdm_site is macOS-only, and cross-checking for aarch64-apple-darwin fails here on ring's C build (no Apple toolchain). So I temporarily compiled the module under #[cfg(unix)] on Linux, and did not commit that change. Its code uses only unix APIs. With that change:
  • cargo test -p socket-patch-core --lib pdm_site: 8 passed, including the rewritten probe_timeout_kills_its_child (the child records its pid, execs sleep 30, and is dead and reaped when the probe returns after the 500 ms budget), probe_bounds_and_validates_output_and_process_status (including the oversized-output case) and the env-scrub and private-cwd tests.
  • cargo clippy --workspace --all-features -- -D warnings passed.
• cargo test -p socket-patch-core --test child_deadline_guard: 2 passed. Red→green: with main's pdm_site.rs restored, the guard fails with spawn these children through utils::process::output_within …: ["crawlers/python_crawler/pdm_site.rs"].
• rustfmt --check is clean on both touched files. main's copy of pdm_site.rs was already clean.
• macOS CI legs run off the PR path since Skip draft PRs and run macOS legs off the PR path #1093, so they exercise this module only after merge.

Risk

Low. One macOS-only probe on scan's PDM config path, plus one test file. The worst case is a hung PDM interpreter delaying scan by 10 s instead of 5 s.

🤖 Generated with Claude Code

---

Note

Low Risk
macOS-only PDM config probing plus test-only guard; main risk is hung interpreters taking up to the shared 10s probe budget instead of 5s.

Overview
The macOS PDM site-config probe no longer uses a local tokio::time::timeout + kill_on_drop read loop. It builds a std::process::Command and runs utils::process::output_within on the blocking pool (same pattern as other crawler probes), with stdout validation moved to runtime_site_dir(&Output) (4 KiB cap, success exit, single JSON absolute path).

Behavior deltas: hung probes now honor the caller’s timeout budget via output_within (including the shared PROBE_TIMEOUT (10s) at the top level, replacing a private 5s constant); oversized stdout is rejected after the child exits instead of mid-stream (still None).

Adds tests/child_deadline_guard.rs: scans production src/**/*.rs (above #[cfg(test)]) for kill_on_drop( outside utils/process.rs, with vendor/npm_dir.rs on a PENDING allowlist until migrated.

^{Reviewed by Cursor Bugbot for commit 7ec4ec7. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7ec4ec7. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: 7ec4ec745488cfa64b748a8191d1e7a7a852b572
• CI: 362/362 check runs green (success/skipped/neutral) on this head, mergeable, no conflicts.
• Bugbot: reviewed this head (Cursor Bugbot check: success), no unresolved review threads.
• Changelog: untouched.

Nothing specific flagged for the reviewer beyond the PR description.

---

Generated by Claude Code