[agent] Filed by the scheduled architecture audit routine (CLI and core). Register: C48.

Kind: bug. Source: new finding; register C48.

Problem

utils::process has no bounded way to run a child process. The shared probe runners, SystemCommandRunner and GlobalProbeRunner, go through run_resolved, which calls command.output() with no deadline. These probes use it:

• gem env gemdir / gem env gempath (ruby_crawler.rs L547–L553).`` It runs on a local scan of any Bundler project, from the project fallback.
• python3|python|py --version and the site query (python_crawler.rs L22–L34, L1608–L1619).``
• npm root -g, the yarn, pnpm and bun global probes (npm_crawler.rs L1596–L1607), and `composer global config home` ([`composer_crawler.rs` L374](https://github.com/SocketDev/socket-patch/blob/045d7ec783d788bf3c5a1310724b51e09fb6505d/crates/socket-patch-core/src/crawlers/composer_crawler.rs#L374)).``

Every other production spawn hand-rolls its own tokio::time::timeout + kill_on_drop(true), with four different budgets:

So a probe that can't answer is bounded in vendored Pipenv/Hatch and self-update, and unbounded in the crawlers that most commands run.

Proof (debug build on 045d7ec, run twice)

A Bundler project (Gemfile + Gemfile.lock naming rack 2.2.8, nothing installed) and a gem shim on PATH that never answers (exec sleep 3600, the shape of a stuck rbenv/asdf shim or a Ruby waiting on a network-mounted gem home). The API URL points at a closed local port, so a healthy run ends right after the crawl.

The shim log shows that both gem env gemdir and gem env gempath were spawned and neither answered. The scan never reached the API call, and --json printed nothing, so a CI job sits until its own job timeout and reports no reason.

Symptoms

None filed. This is the process-spawn counterpart of #570 (HTTP calls had no timeout, fixed by #581).

Impact

Medium. Any wedged toolchain shim (a version manager prompting for an install, a Ruby or Python waiting on NFS, a corporate wrapper waiting on a license server) hangs scan (verified above) with no diagnostic, and by reading also the other commands that crawl through the same probes (apply, vex, rollback, get). The four per-site budgets will keep drifting, and each new probe has to remember kill_on_drop.

Proposed change

• Add one primitive in utils/process.rs: async fn run_bounded(program: &Path, args, cwd: Option<&Path>, budget: Duration) -> ProbeOutcome. It uses tokio::process, null stdin, kill_on_drop(true), captured stdout and dropped stderr. ProbeOutcome distinguishes Ok(stdout), Failed, NotFound and TimedOut. Add one PROBE_TIMEOUT constant (10 s, matching three of the four sites), plus an env override if the contract wants one.
• Make CommandRunner::run async, with run_resolved built on run_bounded. Callers keep their mock runners. A TimedOut probe answers "no information", as a failed one does today, and logs one --debug line naming the tool and the budget.
• Route pipenv::installed_major, pypi_hatch::require_environment_context_support (after Fix vendored Hatch running a planted hatch (#613) #617 lands its resolve_tool change) and the npm_dir git exchange through it, with their own budgets as arguments. sanity_exec keeps its retry loop around run_bounded. Deleted: the four inline timeout + kill_on_drop blocks.

Size and scope

utils/process.rs (+80), the four timeout sites (−40), and the probe callers in the npm, ruby, python and composer crawlers. Making the trait async there is mechanical, and the ruby and python callers drop their run_blocking wrappers. Estimated ~300 changed production lines. Out of scope: what the probes ask, and resolve_tool itself.

Acceptance criteria

• No production Command::output()/wait() remains outside utils::process (an architecture_tests grep guard, like the one PR Read NuGet and Cargo crawler project files through the FIFO-safe reader (#592) #602 adds for crawler reads).
• Regression test (Unix): a gem shim that sleeps on PATH, with a test-only budget override; scan --json returns within the budget, scans the project, and kills the shim.
• Unit tests for run_bounded: timeout, nonzero exit, missing program, and a child that is killed on drop.
• The existing process.rs, pipenv, pypi_hatch, npm_dir gitignore and self-update sanity_exec tests stay green.

Dependencies

Touches vendor/pypi_hatch.rs after PR #617 (#613). Independent of the HTTP retry work (#676).