test: preserve Windows CI timeouts in isolated tests

sdk/typescript/scripts/run-windows-ci-tests.mjs

@@ -2,6 +2,9 @@ import { spawn } from "node:child_process";
 import { readdir } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
+// Native Windows credential and document checks can exceed 30 seconds.
+// The workflow still bounds each complete shard to ten minutes.
+const testTimeoutMs = "120000";
 const testsDirectory = new URL("../tests-ts/", import.meta.url);
 const packageDirectory = fileURLToPath(new URL("../", import.meta.url));
 const tests = (await readdir(testsDirectory))
@@ -71,13 +74,19 @@ const results = await Promise.all(
             ": " +
             paths.join(" "),
         );
-        // Native Windows credential and document checks can exceed 30 seconds.
-        // The workflow still bounds each complete shard to ten minutes.
-        const child = spawn("bun", ["test", "--timeout", "120000", ...paths], {
-          cwd: packageDirectory,
-          stdio: "inherit",
-          windowsHide: true,
-        });
+        const child = spawn(
+          "bun",
+          ["test", "--timeout", testTimeoutMs, ...paths],
+          {
+            cwd: packageDirectory,
+            env: {
+              ...process.env,
+              CODEX_SECURITY_TEST_TIMEOUT_MS: testTimeoutMs,
+            },
+            stdio: "inherit",
+            windowsHide: true,
+          },
+        );
         child.once("error", reject);
         child.once("close", (code) => {
           resolve(code ?? 1);

sdk/typescript/tests-ts/skeleton.test.ts

@@ -1,4 +1,7 @@
-import { readFile } from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+import { mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { describe, expect, test } from "bun:test";
 import { parse } from "smol-toml";
 import {
@@ -114,6 +117,42 @@ describe("TypeScript package skeleton", () => {
     expect(ciWorkflow).not.toContain("--timeout 60000");
   });
 
+  test("preserves the configured timeout in isolated test subprocesses", async () => {
+    const directory = await realpath(
+      await mkdtemp(join(tmpdir(), "codex-security-test-timeout-")),
+    );
+    const fixture = join(directory, "isolated.test.ts");
+    const helper = new URL("./support/test-subprocess.ts", import.meta.url)
+      .href;
+    await writeFile(
+      fixture,
+      `import { test } from "bun:test";
+import { runTestInSubprocess } from ${JSON.stringify(helper)};
+test("isolated timeout", async () => {
+  if (runTestInSubprocess(import.meta.path, "isolated timeout")) return;
+  await Bun.sleep(1_000);
+});
+`,
+    );
+
+    try {
+      const result = spawnSync(
+        process.execPath,
+        ["test", "--timeout", "30000", fixture],
+        {
+          encoding: "utf8",
+          env: { ...process.env, CODEX_SECURITY_TEST_TIMEOUT_MS: "100" },
+          timeout: 30_000,
+          windowsHide: true,
+        },
+      );
+      expect(result.status, result.stderr || result.error?.message).toBe(1);
+      expect(result.stderr).toContain("this test timed out after 100ms");
+    } finally {
+      await rm(directory, { recursive: true, force: true });
+    }
+  });
+
   test("builds packages without a preinstalled package manager and provides a production audit", async () => {
     const packageJson = JSON.parse(
       await readFile(new URL("../package.json", import.meta.url), "utf8"),

sdk/typescript/tests-ts/support/test-subprocess.ts

@@ -5,11 +5,12 @@ import { expect } from "bun:test";
 export function runTestInSubprocess(file: string, name: string): boolean {
   const identity = `${file}::${name}`;
   if (process.env["CODEX_SECURITY_ISOLATED_TEST"] === identity) return false;
+  const timeout = process.env["CODEX_SECURITY_TEST_TIMEOUT_MS"] ?? "30000";
   const pattern = `${name.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}$`;
 
   const result = spawnSync(
     process.execPath,
-    ["test", "--timeout", "30000", "--test-name-pattern", pattern, file],
+    ["test", "--timeout", timeout, "--test-name-pattern", pattern, file],
     {
       cwd: fileURLToPath(new URL("../../", import.meta.url)),
       encoding: "utf8",