fix(ci): raise the python floor to 3.12 and stop the bridge audit serializing the batch

Two review findings, both real.

MIN_PYTHON was 3.10, chosen for the `match` statements the compiler suite
generates. But two of the three guarded tests also use PEP 701 f-strings --
reusing the outer quote, and embedding `#` -- which are 3.12. Verified on a real
3.11 interpreter: the match-guard test passes, the other two fail with
`f-string: unmatched '('` and `f-string expression part cannot include '#'`,
which is exactly the raw SyntaxError the guard exists to prevent. A 3.10 floor
let them through and failed anyway.

The audit parallelization did not speed CI up -- it slowed it down. Serially the
21 audits took ~31s; concurrently the batch took 39.2s wall, because
check:desktop-bridge went from 1s to 39.2s and became the entire wall clock while
the other 20 finished in 9s. It is the only audit that shells out through `bunx`,
which re-resolves the package against the shared install cache -- a network-backed
sticky-disk mount on CI. Cheap when it runs alone, serialized behind the others
when they run together. Spawning the resolved compiler entry point directly
removes that layer.

Verified the audit still fails on a breaking bridge change rather than passing
faster by doing less.

Author: waleedlatif1

packages/testing/src/environment/index.ts

@@ -13,11 +13,18 @@
  */
 import { spawnSync } from 'node:child_process'
 
-/** Python 3.10 is the floor: the compiler suite generates `match` statements. */
-export const MIN_PYTHON: readonly [number, number] = [3, 10]
+/**
+ * Python 3.12 is the floor, set by PEP 701 f-strings rather than by `match` statements.
+ *
+ * The compiler suite generates `match` (3.10) but also f-strings that reuse the outer quote
+ * and embed `#`. On 3.11 those raise `f-string: unmatched '('` and `f-string expression part
+ * cannot include '#'` — exactly the raw SyntaxError this guard exists to prevent — so a 3.10
+ * floor would have let two of the three guarded tests through and failed anyway.
+ */
+export const MIN_PYTHON: readonly [number, number] = [3, 12]
 
 /** Reasons to pass to vitest's `ctx.skip(...)` so the report says why, not just that. */
-export const PYTHON_SKIP_REASON = 'needs python3 >= 3.10; macOS ships 3.9'
+export const PYTHON_SKIP_REASON = 'needs python3 >= 3.12 (PEP 701 f-strings); macOS ships 3.9'
 export const RIPGREP_SKIP_REASON = 'needs ripgrep (`rg`) on PATH'
 
 const warned = new Set<string>()

scripts/check-desktop-bridge-contract.ts

@@ -31,13 +31,21 @@
 import { spawnSync } from 'node:child_process'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { readFile, writeFile } from 'node:fs/promises'
+import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { formatGeneratedSource } from './format-generated-source'
 
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url))
 const ROOT = resolve(SCRIPT_DIR, '..')
+
+/** The native TypeScript 7 compiler entry point, resolved once. */
+const TSC_ENTRY = join(
+  dirname(createRequire(import.meta.url).resolve('typescript/package.json')),
+  'bin',
+  'tsc'
+)
 const BRIDGE_SOURCE_PATH = resolve(ROOT, 'packages/desktop-bridge/src/index.ts')
 const PROTOCOL_SOURCE_PATH = resolve(ROOT, 'packages/browser-protocol/src/index.ts')
 const TERMINAL_PROTOCOL_SOURCE_PATH = resolve(ROOT, 'packages/terminal-protocol/src/index.ts')
@@ -173,7 +181,12 @@ function checkCompatibility(): { compatible: boolean; output: string } {
   try {
     writeFileSync(join(dir, 'compat.ts'), compatSource)
     writeFileSync(join(dir, 'tsconfig.json'), JSON.stringify(tsconfig, null, 2))
-    const result = spawnSync('bunx', ['tsc', '-p', dir, '--pretty', 'false'], {
+    // Spawned as a resolved module path rather than via `bunx`. `bunx` re-resolves the
+    // package on every call against the shared install cache, which on CI is a network-backed
+    // sticky-disk mount — cheap when this audit runs alone, but it serialized behind the
+    // other audits once they started running concurrently and took this step from 1s to 39s,
+    // making it the entire wall clock of the batch.
+    const result = spawnSync(process.execPath, [TSC_ENTRY, '-p', dir, '--pretty', 'false'], {
       cwd: ROOT,
       encoding: 'utf8',
     })