test(deepagent-code): widen margins for load-sensitive subprocess and server-boot tests

- ACP test client receive timeout 15s -> 30s (subprocess boot under
  full-suite load exceeded 15s; isolated 3.7s)
- ACP lifecycle stdin-EOF exit wait 5s -> 30s
- run-process #27371: assert duration < 20s instead of < 15s (the SDK
  timeoutMs is exactly 15s, so a slow host overruns the old bound by
  construction; a true hang is still killed by the 30s test timeout)
- httpapi-cors tests: explicit 30s per-test timeout (server boot +
  resetDatabase at the 5s boundary under load)
- activity progress projection #16: 60s timeout (read-only PRAGMA
  quick_check over the 4.8GB incident snapshot runs ~1s warm but
  cold-cache/first-touch exceeds the 5s default)

Author: deepagent-ai

packages/deepagent-code/test/cli/acp/acp-test-client.ts

@@ -44,7 +44,7 @@ export function createAcpClient(acp: AcpHandle): AcpClient {
       yield* acp.send(message)
 
       while (true) {
-        const received = yield* acp.receive.pipe(Effect.timeout(Duration.seconds(15)))
+        const received = yield* acp.receive.pipe(Effect.timeout(Duration.seconds(30)))
         if (isJsonRpcResponse<T>(received) && received.id === id) return received
       }
     })

packages/deepagent-code/test/cli/acp/lifecycle.test.ts

@@ -18,7 +18,7 @@ describe("deepagentCode acp lifecycle subprocess", () => {
         const acp = yield* deepagentCode.acp()
         acp.close()
 
-        const code = yield* Effect.promise(() => acp.exited).pipe(Effect.timeout(Duration.seconds(5)))
+        const code = yield* Effect.promise(() => acp.exited).pipe(Effect.timeout(Duration.seconds(30)))
         expect(code).toBe(0)
       }),
     60_000,

packages/deepagent-code/test/cli/run/run-process.test.ts

@@ -124,8 +124,10 @@ describe("deepagentCode run (non-interactive subprocess)", () => {
   // Regression for #27371: an unknown model used to hang the process forever
   // waiting on a session.status === idle event that never arrived. The fix
   // makes the SDK call surface an error promptly so the process exits nonzero.
-  // We assert nonzero exit AND wall-clock under the harness timeout — a hang
-  // would expire the timeout and produce a different (signal-killed) failure.
+  // The SDK guarantees return by timeoutMs (15s), so measure against the
+  // harness timeout (30s) instead: a genuine hang is killed by the 30s test
+  // timeout (a different, signal-killed failure), while the fixed path exits
+  // on its own well before it — the 20s bound leaves slack for slow CI hosts.
   cliIt.concurrent(
     "exits nonzero promptly when the model is unknown (regression for #27371)",
     ({ deepagentCode }) =>
@@ -135,7 +137,7 @@ describe("deepagentCode run (non-interactive subprocess)", () => {
           timeoutMs: 15_000,
         })
         expect(result.exitCode).not.toBe(0)
-        expect(result.durationMs).toBeLessThan(15_000)
+        expect(result.durationMs).toBeLessThan(20_000)
       }),
     30_000,
   )

packages/deepagent-code/test/server/httpapi-cors.test.ts

@@ -58,6 +58,7 @@ describe("HttpApi CORS", () => {
       expect(response.headers["access-control-allow-origin"]).toBe("http://localhost:3000")
       expect(response.headers["access-control-allow-headers"]).toBe("authorization")
     }),
+    { timeout: 30_000 },
   )
 
   it.live("adds CORS headers to unauthorized responses", () =>
@@ -80,6 +81,7 @@ describe("HttpApi CORS", () => {
       expect(response.status).toBe(401)
       expect(response.headers.get("access-control-allow-origin")).toBe("https://app.deepagent-code.ai")
     }),
+    { timeout: 30_000 },
   )
 
   it.live("uses custom CORS origins passed to the server", () =>
@@ -118,5 +120,6 @@ describe("HttpApi CORS", () => {
       expect(rejected.status).toBe(204)
       expect(rejected.headers.get("access-control-allow-origin")).not.toBe("https://evil.example")
     }),
+    { timeout: 30_000 },
   )
 })

packages/deepagent-code/test/session/activity-progress-runtime.test.ts

@@ -1611,7 +1611,7 @@ test("activity progress projection #16: incident DB copy opens read-only without
   } finally {
     db.close()
   }
-})
+}, { timeout: 60_000 })
 
 // ---------------------------------------------------------------------------
 // §7.1 #17 — per-caller validation: settleProgress terminal / interruptActivity