fix: bound diagnostics provider health checks

[kang-heewon]

Fixes #701.

Summary

DiagnosticsCollector.getReport() now bounds each provider health check with a collector default timeout and optional per-provider override. Timed-out providers are reported as degraded components with a timeout message, and providers receive an optional AbortSignal so cooperative checks can stop work after the report has moved on.

변경 사항

• Added collector-level diagnostics provider timeout configuration with a 5s default.
• Added per-provider timeout overrides on registerProvider().
• Passed an optional AbortSignal to DiagnosticsProvider.getHealth() and abort timed-out checks.
• Preserved existing rejected-provider degraded handling while making timeout failures degraded instead of hanging the whole report.
• Added fake-timer regressions for bounded reports, degraded timeout components, abort delivery, and per-provider overrides.
• Added a patch changeset for @croco/diagnostics-core.

Verification

• Reproduced the original hang before the fix with a never-settling provider: pending-after-50ms.
• pnpm --filter @croco/diagnostics-core test - 1 file, 8 tests passed after rebase.
• pnpm --filter @croco/diagnostics-core typecheck - passed after rebase.
• pnpm --filter @croco/diagnostics-core build - passed after rebase.
• pnpm --filter @croco/diagnostics-core lint - 0 warnings/errors after rebase.
• pnpm changeset-required:check - valid non-README changeset found.
• pnpm check - package manifests, docs catalog, circular dependency scan, oxlint, and oxfmt passed after rebase.
• git diff --check and git diff --cached --check - passed.
• Full pnpm typecheck - 196/196 tasks passed before rebase; pre-push rerun passed 196/196 tasks after rebase.
• Full pnpm test - 197/197 tasks passed before rebase; pre-push rerun passed 197/197 tasks after rebase.
• Pre-commit Lefthook: oxfmt and oxlint passed on changed files.
• Pre-push Lefthook: auto-changeset, full pnpm test, and full pnpm typecheck passed.

Self-review

• Correctness/regression: PASS. Issue [diagnostics-core] provider health check에 timeout이 없어 전체 report가 멈출 수 있음 #701 acceptance is covered by fake-timer tests proving a pending provider returns at the configured timeout, appears as a degraded component, preserves the collector timeout message even when the provider reacts to abort, and honors a per-provider timeout override. Existing rejected-provider behavior remains covered by the integration test suite.
• API/security/compatibility/release: PASS. The provider API change is additive because the new AbortSignal parameter is optional and existing no-argument providers remain assignable. The new collector/provider option types are exported, no dependencies or lockfile entries changed, no secrets or environment assumptions were introduced, and a patch changeset covers the publishable behavior change.
• Maintainability/minimality: PASS. The diff is scoped to @croco/diagnostics-core and release metadata, reuses the existing Promise.allSettled degraded conversion path, and adds no new abstractions or dependencies. Independent adversarial review found no actionable blockers.

Risk

Low. Providers that ignore AbortSignal may keep doing their own background work after the collector has returned, but diagnostics reports are now bounded and surface the timed-out provider as degraded.

[coderabbitai]

Warning

Review limit reached

@kang-heewon, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 1 minute and 7 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a618d43f-b79f-4522-9548-069eb84724ff

📥 Commits

Reviewing files that changed from the base of the PR and between 7db1d3f and c732e36.

📒 Files selected for processing (5)

• .changeset/diagnostics-provider-timeouts.md
• packages/diagnostics-core/src/index.ts
• packages/diagnostics-core/src/libs/DiagnosticsCollector.ts
• packages/diagnostics-core/src/libs/types.ts
• packages/diagnostics-core/src/tests/DiagnosticsIntegration.spec.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/701-diagnostics-timeouts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📊 Benchmark Results

❌ Some benchmarks failed

Benchmark	p75	Threshold	Baseline	vs Baseline	Status
CrocoApp benchmarks	3.3μs	-	-	-	⚠️
EventBusConfig.start (10 handlers)	1.5μs	-	9.0μs	-83.3%	✅
EventPublisher.publishNow single event	1.7μs	-	-	-	⚠️
DefaultHandlerResolver.resolve × 10	0.1μs	-	0.2μs	-60.0%	✅
Container.get singleton (cold)	0.9μs	-	0.5μs	+84.2%	❌
Container.register × 50 components	10.7μs	-	8.0μs	+34.3%	❌
Container.validate (50 components)	27.9μs	-	25.0μs	+11.7%	✅
Container.get singleton (warm)	0.4μs	-	0.3μs	+27.0%	❌
TelemetryRuntime benchmarks	2.0μs	-	2.0μs	+0.7%	✅

_{Updated: 2026-06-14T22:45:48.208Z · Commit: d3c4455}