[chaliy]

What changed

The four timeout aborts host work and permits reuse cases in
crates/bashkit-js/__test__/runtime-functions.spec.ts get a timeout budget
sized for the slowest lane we ship instead of 2s, and assert their two failure
modes apart. js.yml now runs the runtime-callback suite on the Rosetta
x86_64-apple-darwin lane, which previously ran only at release time.

No library behaviour changes — test and CI coverage only.

Why

Publish JS for tag v0.20.1 failed, and release-js is gated on its test
jobs, so both npm packages are still on 0.19.0 while crates.io and PyPI are
on 0.20.1. v0.20.1 was cut specifically to unblock npm after #2776; this is what
is still holding it.

Two of fifteen test jobs failed, both on x86_64-apple-darwin (node 22.23.4 and
24.22.1), three cases each:

runtime-functions › Bash: typescript timeout aborts host work and permits reuse
runtime-functions › BashTool: python timeout aborts host work and permits reuse
runtime-functions › BashTool: typescript timeout aborts host work and permits reuse

  __test__/runtime-functions.spec.ts:191
   190:       await delay(0);
   191:       t.true(aborted);
  Value is not `true`:
  false

publish-js.yml builds x86_64-apple-darwin but runs it on macos-latest,
which is arm64. x64 Node, the x64 binding and the embedded Wasm runtimes
therefore all execute translated under Rosetta 2 — the only translated lane
in the matrix, and the only failing one. Every native lane passed.

The budget covers more than the hang. timeoutMs starts at execute, so it
also covers interpreter start-up on first use in the process and scheduling
latency while the rest of the suite runs concurrently. Only the remainder is the
hang these cases mean to cancel. When it expires first, the run is cancelled
before the host callback is ever dispatched, the handler never registers an
abort listener, and aborted stays false. The run still exits non-zero, so
the preceding assertion passes and the failure surfaces one line later as a bare
Value is not `true` .

The same job's timings show 2s was simply too small there:

case (same job, same binding)	wall time
Bash: python host functions — first embedded-runtime call	3.7s
BashTool: python host functions	3.8s
Bash: python timeout aborts… — the one variant that passed	4.7s for a 2s timeout

The first runtime call alone cost 3.7s, already past the entire 2s budget.

Before / After

Both directions were verified on the new lane rather than argued.

At 2s (budget temporarily reverted on this branch, commit since reverted),
the new lane reproduces the release failure — and the new assertion names the
cause outright instead of leaving a bare false:

✘ [fail]: Bash: typescript timeout aborts host work and permits reuse
          host callback never ran; the timeout fired first
✘ [fail]: BashTool: typescript timeout aborts host work and permits reuse
          host callback never ran; the timeout fired first
✔ Bash: python timeout aborts host work and permits reuse (3s)
✔ BashTool: python timeout aborts host work and permits reuse (3s)

2 tests failed

entered is false, so the run really is cancelled before the interpreter
dispatches the callback — the root cause, not an abort-delivery race. Note the
same split as the release failure: some variants pass, some lose the race.

At 20s, the whole JS workflow is green, Rosetta lane included:

success  Runtime callbacks (macos-latest x86_64 (Rosetta))
success  Runtime callbacks (macos-latest)
success  Runtime callbacks (windows-latest)
success  node 20 / 22.23.4 / 24.22.1 / latest, bun latest+canary, deno 2.x+canary
success  JS Check

Locally runtime-functions.spec.ts is 75/75 green; the file goes from ~5s to
~22s wall, because the cases wait out the full timeout by design. ava runs them
concurrently, so the cost is one timeout rather than four.

One limit worth stating: the failure does not reproduce on Linux. A first
embedded-runtime call costs 1–3ms natively versus 3.7s translated, so the
budget is never close to exhausted here, and probing down to timeoutMs: 1
still entered and aborted the handler. The Rosetta lane is what actually
exercises this, which is the main reason for adding it.

Risk

• Low. Test and CI configuration only; no change to shipped library code, to
  the abort contract, or to any published artifact.
• The suite gains a macOS job, which adds CI time; it runs concurrently with the
  existing matrix entries. It earns that cost: it is demonstrably the only lane
  in CI that catches this.
• The timeout path keeps its coverage, and the split assertions mean a future
  regression cannot pass vacuously.
• The lane's first run died in the cross-build with clang: error: unable to execute command: Segmentation fault: 11 linking libc's build script. The
  Rust cache is now scoped per target so a restored arm64 target/ cannot reach
  the x64 build, and MACOSX_DEPLOYMENT_TARGET matches publish-js.yml; it has
  built cleanly on all three runs since.

Not fixed here

Publish Web for v0.20.1 failed separately and is not addressed by this PR:

npm error 404 The requested resource '@everruns/bashkit-wasm@0.20.1'
could not be found or you do not have permission to access it.

@everruns/bashkit-wasm exists and is published through 0.19.0, and
scripts/publish_npm.py already passes --access public, so this is npm
masking an authorization failure as a 404 — the NPM_TOKEN secret needs
rotating. That requires repository-secret access and cannot be fixed in code.
Both publish workflows read the same secrets.NPM_TOKEN, so getting this PR
green is necessary but probably not sufficient to publish npm; the token
likely needs rotating before the next release tag.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	b4d9e70	Commit Preview URL Branch Preview URL	Oct 26 2026, 10:11 AM