fix(conformance): cap the sandbox install so a resolver hang is a finding, not a cancelled job

[wmadden-electric]

Summary

npm does not fail when a dependency's peer range names a version no published package satisfies; it backtracks for hours. On 2026-09-11 the @effect/* adapters published 4.0.0-rc.114 ahead of effect itself and every conformance run sat in npm install until someone cancelled it 24 minutes in, with nothing in the log saying why (https://github.com/prisma/prisma-cli/actions/runs/34586396643/job/103242148710).

The sandbox install in packages/cli-conformance/src/tarball-io.ts had no timeout, unlike the bin start next to it. It now runs under a cap, five minutes by default and settable through installTimeoutMs like binTimeoutMs. A kill produces its own finding, install-timed-out, whose detail says what npm is doing and carries the ERESOLVE warnings that name the package to pin. A plain failure keeps the install-failed finding it had. Composer's equivalent check got the same cap in prisma/composer#287.

Testing

• New unit test: a timed-out install yields one install-timed-out finding naming the cap and carrying npm's output, no install-failed, and no bin is started.
• Real io with a two-second cap against the packed @prisma/cli tarball: killed at 2019 ms, timedOut: true, npm's stderr in the output.
• PUBLISH_CHANNEL=dev pnpm check:conformance with the default cap: 5 subjects checked, nothing to report.
• pnpm --filter @repo/cli-conformance test: 65 passed. pnpm typecheck clean. Biome clean on the package.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 34 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

This review ran on the open-source allowance, not this organization's plan, because the pull request author doesn't have an assigned seat. Waiting won't change this — ask an organization admin to assign them a seat, or add seats in Billing if every seat is already assigned, then retry.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: fdbbc3d4-721a-49c5-ab1a-90d029f439bf

📥 Commits

Reviewing files that changed from the base of the PR and between c9d6e05 and 284324d.

📒 Files selected for processing (4)

• packages/cli-conformance/src/checks/tarball.ts
• packages/cli-conformance/src/findings.ts
• packages/cli-conformance/src/tarball-io.ts
• packages/cli-conformance/tests/tarball.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/@prisma/cli@259

npx https://pkg.pr.new/@prisma/cli-engine@259

commit: 284324d