[colbymchenry]

Summary

Moves the test suite to Vitest 4 and leaves the repo with one Vite stack. ui/ already built the viewer with Vite 7 and vite-plugin-svelte 6, while Vitest 2 kept Vite 5.4, plugin 4 and an older esbuild at the root. This is what remained of #1667 after its security half landed as #2869. Vitest 5 can follow.

After this lands, --minWorkers is gone. Vitest 4 stops at startup with CACError: Unknown option --minWorkers; use --maxWorkers=N alone. Nothing in the repo passes the flag, but anyone's local scripts might.

A synchronous test can now time out. Since Vitest 3 a test or hook that outlasts its limit fails even if it ran to the end. Under Vitest 2 the timer couldn't fire until the body returned, so a body blocked in spawnSync never timed out. This config raises the defaults to 30 s and 60 s for that reason.

• Tests run as test.projects in vitest.config.mts, and vitest.workspace.mts goes away. engine extends the base (env, global setup, home sandbox). ui stands alone with the Svelte plugin, jsdom and the browser conditions.
• The WASM flags move to test.execArgv. Vitest 4 ignores poolOptions.forks.execArgv with only a deprecation line, and the Windows: vitest pool worker killed by a V8 compiler-zone OOM, invisible in the JSON report #1779 worker death comes back.
• git-index-currency.test.ts injects its failures through the mocks' own vi.fn. Under Vitest 4 a spy on a mocked module is that vi.fn, so the captured "real" function recursed, and restoreAllMocks no longer resets one.
• devEngines sets Node 22.12 as the floor for working in the repo. engines, what users run, doesn't change.

From the contributor, and what we changed

The toolchain move, the config, devEngines and the test rewrite are @danusha2345's. On top:

• The lockfile is regenerated from main's, not taken from the PR. The PR's would have silently undone chore(deps): security updates for devalue and postcss; drop unused @types/better-sqlite3 #3044 and fix(gitignore): rules leave out the files git does; update ignore to 7.0.14 #3050, and restored the @types/better-sqlite3 that chore(deps): security updates for devalue and postcss; drop unused @types/better-sqlite3 #3044 dropped:

Package	main	PR's lock	This PR
devalue	5.9.4	5.9.1	5.9.4
postcss	8.5.32	8.5.26	8.5.32
ignore	7.0.14	7.0.5	7.0.14
rollup	4.57.1	4.63.1	4.57.1
vite	5.4.21 + 7.3.6	7.3.6	7.3.6
vitest	2.1.9	4.1.11	4.1.11

ui/'s packages hoist to the root at the versions it already built with. All 45 added lock entries match the npm registry's tarball and integrity, none outside registry.npmjs.org.

• testTimeout and hookTimeout rise to 30 s and 60 s, for the change above:

Synchronous body past its limit	Vitest 2.1.9	Vitest 4.1.11
Test blocking 6 s (limit 5 s)	passes	fails, Test timed out in 5000ms
Hook blocking 11 s (limit 10 s)	passes	fails, Hook timed out in 10000ms, and its tests skip

The first full run here lost frontload-hook (eleven spawnSync calls in one test) to this, and the contributor's run lost two bundle-launcher listings the same way. 31 tests passed 4 s on a quiet machine, so on a loaded one they would all flake. A real hang now takes up to 30 s to report rather than 5 s.

• A new guard test (__tests__/vitest-worker-flags.test.ts) reads the WASM flags from the worker's own command line. The config can stop reaching workers with no failure, as it did here, and a Vitest 5 move could repeat that.
• CONTRIBUTING.md and AGENTS.md state the new floor and the projects setup, and two test files name TestProject, which replaced the removed GlobalSetupContext type.
• Left out as out of scope: a trailing blank line removed from ui/src/lib/trail-codec.ts.

Validation

Windows 11, Node 22.22.0, npm 10.9.4.

What ships is unchanged:

Output	Compared with main
npm ci --omit=dev, the bundle's step	193 files, byte-identical
npm run build:lib	171 files, byte-identical
dist/viewer	46 files: 43 byte-identical, 3 identical once Svelte's scope hashes are masked

Those hashes come from the checkout path: main built in two folders differs in exactly the same way.

Every test is kept. At cd04b21, vitest list finds 9,719 tests in 822 files on main (9,701 engine, 18 ui), and those plus the new guard here, each in the same project, none run twice. Four upgrade.test.ts titles print differently because Vitest 4 formats %A in it.each names; they're the same tests.

npm ci on the Node range. Only 22.22.0 is installed here, so the others come from running npm's own checkDevEngines and engine check against the lock, with no download:

Node	devEngines	EBADENGINE, main	EBADENGINE, this PR
20.0.0	stops, EBADDEVENGINES	7	7
20.19.0	stops	0	0
22.5.0, 22.11.0	stops	3	3
22.12.0, 22.22.0	passes	0	0
24.0.0, 24.11.0, 25.0.0	passes	0	0

So nothing gets noisier anywhere in the range, and below 22.12 npm ci and npm run now stop rather than warn. Node 20 couldn't run from source already (node:sqlite), and Vite 7 rejects 22.5 to 22.11. On the real 22.22.0, npm ci logs the one deprecation main logs. The release runs on Node 22, and its npm install --package-lock-only sync changes only the version fields.

Audit: the dev tree goes from 10 findings with 2 critical to 7 with none critical. Production stays at 0.

Red to green: main's git-index-currency fails 7 of 13 under Vitest 4, and putting the flags back under poolOptions turns the guard red.

Full suite on 19684dea, one rebase back (Vitest 4.1.11, Windows 11, Node 22.22, CODEGRAPH_KERNEL_EXPECT=1, CODEGRAPH_NO_DAEMON unset, 2 workers): 839 files, 9,874 passed (2 of them it.fails expected failures), 0 failed, 87 skipped, the same 87 as Vitest 2.

This head is that commit rebased onto 274b43c4. The rebase conflicted only in CHANGELOG.md, and the tree differs from the tested commit by main's one Python commit plus that keep-both. On this head vitest-worker-flags, git-index-currency, test-home-sandbox, ui-package, foundation, python-outside-bases and python-generic-bases pass, 111 tests with the kernel expected.

Speed: about the same as Vitest 2.

Workers	Vitest 2.1.9	Vitest 4.1.11
4	703 s	649 s
2	1,361 s	1,313 s

After this lands, rebase and run npm ci. On a Vitest 2 install this commit fails ui-package.test.ts (the .svelte files aren't compiled) and loses the WASM flags, which the new guard names: expected [...] to include '--liftoff-only'.

Lands #1667 by @danusha2345

🤖 Generated with Claude Code