fix(reference-implementation): stop consent-handoff restart test from hanging node --test

[tnunamak]

A single test file hanging forever stalls every CI run and every developer's local test run that includes it, since node --test (Node's built-in test runner) never returns control once it starts. reference-implementation/test/security-consent-token-handoff.test.ts has this problem in its "an exchange code survives a SQLite-backed server restart" subtest. The file tests a consent flow where the authorization server (AS) hands the user's browser a short-lived, single-use "exchange code" — a string it later trades back for the real access token, so the token itself never has to sit in a URL or a page the browser rendered. That subtest checks the code still works after the AS restarts. All 15 assertions in the file pass, but the process never exits, and node --test eventually reports "Promise resolution is still pending but the event loop has already resolved."

The cause is a node:test runner defect, not a bug in the consent-flow code. The subtest simulates the AS restart by calling startServer() twice against the same on-disk SQLite file, closing the first server before starting the second. Doing that — two real, WAL-mode (write-ahead-log) SQLite file opens inside one node:test process — confuses the runner's own "has everything finished" bookkeeping. It is not a resource leak: process._getActiveHandles() (Node's list of everything still keeping the process alive — open sockets, timers, servers) and process.report.getReport().libuv (the same list from libuv, the lower-level event-loop library Node is built on) both report empty at the moment the process hangs. I have not filed or found an upstream Node issue matching this exactly, so treat "runner defect" as this investigation's best explanation, not a confirmed Node bug report.

The fix moves both servers into their own separate OS process each, via a new fixture script (test/fixtures/consent-handoff-restart-server-fixture.ts) spawned twice from the test — closer to a real restart anyway, since that's a new process, not the same process reopening a file. Two spawn details matter: the child's stderr must be piped rather than shared with the parent's real file descriptor (sharing it reintroduces the hang even with process isolation), and the child needs --import tsx explicitly, because its imports resolve into @pdpp/polyfill-connectors, a package from this same repo's own packages/ directory that npm workspaces (npm's monorepo feature, which symlinks local packages into node_modules instead of copying them) makes available under node_modules — and Node's built-in TypeScript loader refuses to strip types from anything under node_modules, so it needs tsx's loader instead.

Added security-consent-token-handoff-clean-exit.test.ts: it spawns the target file and asserts it exits within 45 seconds, verified to fail against the pre-fix file and pass against this fix, catching a future regression of this exact pattern.

Note: reference-implementation/'s CI gates (typecheck reference implementation, test reference implementation) carry pre-existing, already-tracked failures unrelated to this change — see issue #45. This PR does not touch or fix any of that; it should not make either gate's result any worse than main's current state.

Assisted-by: AI

[tnunamak]

Rebase onto current main was blocked before the first signed commit: GPG opened interactive pinentry; cancellation caused signing to fail. The batch stopped under the requested GPG rule. This PR was not rebased. Head: 0173f2f → 0173f2f (unchanged). No new CI ran; existing checks show 7 success, 4 failure, 1 skipped. Needs work: unlock GPG and retry the rebase/CI verification.

Assisted-by: AI

[tnunamak]

Locally rebased onto main bac5526 with no conflicts: 0173f2f → 173a8ba6d77bf981207412889116e0871a2e14b9. Original patches are unchanged (range-diff and stable patch-ID comparison).

PARKED: unattended GPG signing failed with “No pinentry”. Rewritten commits have Tim’s identity and DCO but remain unsigned locally under the owner’s fallback policy; nothing was pushed. The remote head and its old hosted CI results are unchanged; no fresh hosted checks ran.

Preservation check passed: the consent-handoff test exited naturally with code 0, 15 tests passed; the separate guard also passed. Ready for owner review of local evidence; hosted checks remain pending.

Assisted-by: AI

[tnunamak]

Rebased onto current main (bac55262f) and force-pushed. The original three commits are unchanged in content — git range-diff shows only trailer ordering differs.

Three follow-up commits are added. The clean-exit guard is the test asserting that test/security-consent-token-handoff.test.ts terminates on its own rather than hanging forever. It now requires a real process exit and fails against the pre-fix file; previously it passed even against a child process that never exited, so it was not gating the defect it exists to catch. Its 45 s timer is also cleared once the child exits, so a passing run finishes promptly instead of waiting the budget out.

The third commit drops reformat hunks unrelated to the fix: a formatter had rewritten the whole test file, and those changes are now excluded, taking that file's diff from 1641 lines to 182.

The guard was checked in both directions locally on Linux — red against the pre-fix file, green against the fix. It has not been run on any other platform, and no hosted CI result for the rebased head is in yet.

Assisted-by: AI