@bridge4dev/runner 0.59.1 → 0.61.0

package/dist/adapters/claude.js

@@ -11,7 +11,7 @@ import { evaluateToolUse, maskSecrets, maskString, } from '../policy.js';
 import { availableModes, cardDescription, DIRECT_BRANCH_RULE, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, policyContextFor, DEVBRIDGE_MCP_SERVER_NAME, } from './types.js';
 import { percentFromUtilization, RATE_WINDOW_MINUTES, rateWindowKey } from './rate-limits.js';
 import { applyUsagePercentages, lastUsageRows, readUsageRows } from './claude-usage.js';
-import { claudeExecutableOption, sessionClaudePath } from '../agent-binary.js';
+import { assertClaudeInstalled, claudeExecutableOption, sessionClaudePath, } from '../agent-binary.js';
 /** Same 2KB the SDK keeps: enough for the CLI's last words, not a log sink. */
 const STDERR_TAIL_LIMIT = 2048;
 import { answerSummary, answerValue, discussMessage, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
@@ -340,10 +340,21 @@ class ClaudeSession {
      * has no such field. Without stashing it, the supervisor would be left with a
      * sentence — and a decision made from a sentence can be made by prose (#252).
      *
-     * Reset per turn in `endTaskTurn`, which already owns the turn epoch.
+     * Reset when a turn BEGINS — `beginTurnFacts`, reached from `resumingTurn`
+     * for every turn this runner starts and from the boundary guard in the read
+     * loop for one the CLI started by itself (#406). The docblock used to say
+     * `endTaskTurn` owns the epoch; it never has, and reading it that way is what
+     * made «a code from this turn» and «a code from some turn» look identical.
      */
     turnFailureCode = null;
     turnFailureStatus = null;
+    /**
+     * A `result` has gone out and no new message has arrived since (#406).
+     *
+     * The marker the read loop uses to tell a turn the CLI opened by itself from
+     * a second `result` for the turn that just ended.
+     */
+    turnClosed = false;
     /**
      * Did this turn put ANYTHING on the wire — text, thinking, or a tool call?
      *
@@ -2169,6 +2180,65 @@ class ClaudeSession {
     conversationAnchor() {
         return this.lastMessageUuid;
     }
+    /** A compaction the CLI has announced and not yet ended (#348). */
+    compacting = false;
+    /**
+     * `system:status` — the CLI's own word on what it is doing (#348).
+     *
+     * Read the way the CLI's own remote client reads it (`noteInbound`):
+     * «compacting» opens a compaction, `requesting` says nothing about one (the
+     * summary itself is a model request, and this status arrives DURING a
+     * compaction), and any other status closes it — with `compact_result` when
+     * the CLI says how it went, and as «skipped» when it does not: a PreCompact
+     * hook that said no, or a reactive compaction that found nothing to fold,
+     * both end on a bare `status: null`. Left unclosed, that start line would
+     * keep the dashboard saying «compacting» until the turn ended, minutes later.
+     *
+     * De-duplicated here as well as in the supervisor: the CLI re-says
+     * «compacting» every thirty seconds while it waits on a precomputed summary.
+     *
+     * No `standalone` on this agent: `/compact` is a turn, and its `result`
+     * settles the status the ordinary way.
+     */
+    noteStatus(msg) {
+        const status = msg.status;
+        if (status === 'requesting')
+            return;
+        if (status === 'compacting') {
+            if (this.compacting)
+                return;
+            this.compacting = true;
+            this.emit({ type: 'compaction', phase: 'started' });
+            return;
+        }
+        // An end is only an end of something that began: without a start on
+        // record there is nothing to close, and the second of two endings (a
+        // `compact_result` after a `compact_boundary`) must not open a second
+        // pair. A mode change also travels on this message — `{status: null,
+        // permissionMode}` on every `setPermissionMode` in CLI 2.1.271 — and says
+        // nothing about a compaction at all.
+        if (!this.compacting)
+            return;
+        const compactResult = msg.compact_result;
+        if (compactResult === undefined && msg.permissionMode !== undefined)
+            return;
+        this.compacting = false;
+        if (compactResult === 'failed') {
+            this.emit({
+                type: 'compaction',
+                phase: 'finished',
+                ok: false,
+                error: maskString(String(msg.compact_error ?? 'unknown')).slice(0, 300),
+            });
+            return;
+        }
+        this.emit({
+            type: 'compaction',
+            phase: 'finished',
+            ok: true,
+            ...(compactResult === 'success' ? {} : { skipped: true }),
+        });
+    }
     /**
      * `/compact` — the CLI's own command, delivered as ordinary user input.
      *
@@ -2226,6 +2296,25 @@ class ClaudeSession {
     async consume() {
         try {
             for await (const msg of this.q) {
+                /**
+                 * A turn the CLI started by itself begins here (#406).
+                 *
+                 * `beginTurnFacts` has exactly one other caller, `resumingTurn`, and it
+                 * covers every turn THIS runner opens. The CLI opens turns too — a
+                 * background subagent finishing wakes one, and its `result` carries
+                 * `origin.kind: 'task-notification'` — and those used to inherit the
+                 * previous turn's `turnFailureCode`, `turnProduced` and
+                 * `turnIrreversible`, which is how a long-healed stream cut could still
+                 * be the reason attached to a turn an hour later.
+                 *
+                 * The guard is «a message that is not another `result`», not «the turn
+                 * ended»: one Stop can produce two results (see the stop-cycle tests),
+                 * and the second one has to see the same facts as the first.
+                 */
+                if (this.turnClosed && msg.type !== 'result') {
+                    this.turnClosed = false;
+                    this.beginTurnFacts();
+                }
                 // Ticket #126: where we are in the transcript, remembered BEFORE the
                 // message is interpreted.
                 //
@@ -2266,19 +2355,15 @@ class ClaudeSession {
                             this.refreshUsage();
                         }
                         else if (msg.subtype === 'status') {
-                            const status = msg.status;
-                            const compactResult = msg.compact_result;
-                            if (status === 'compacting') {
-                                this.emit({ type: 'notice', level: 'info', text: 'Compacting the conversation…' });
-                            }
-                            else if (compactResult) {
-                                this.emit({
-                                    type: 'notice',
-                                    level: compactResult === 'failed' ? 'warn' : 'info',
-                                    text: compactResult === 'failed'
-                                        ? `Compaction failed: ${maskString(String(msg.compact_error ?? 'unknown')).slice(0, 300)}`
-                                        : 'Conversation compacted',
-                                });
+                            this.noteStatus(msg);
+                        }
+                        else if (msg.subtype === 'compact_boundary') {
+                            // The summary is in place: this marker is the end of a
+                            // compaction whether or not a status said so first (#348) — the
+                            // CLI's own remote client reads it the same way.
+                            if (this.compacting) {
+                                this.compacting = false;
+                                this.emit({ type: 'compaction', phase: 'finished', ok: true });
                             }
                         }
                         else if (msg.subtype === 'api_retry') {
@@ -2410,6 +2495,10 @@ class ClaudeSession {
                         break;
                     }
                     case 'result': {
+                        // A turn's end is the end of any compaction it carried (#348):
+                        // the supervisor closes the pair on `turn_end`, and the flag here
+                        // has to agree, or the next «compacting» would be read as a repeat.
+                        this.compacting = false;
                         this.emit({
                             type: 'cost',
                             costUsd: msg.total_cost_usd,
@@ -2426,7 +2515,50 @@ class ClaudeSession {
                         // once, for exactly one result.
                         const aborted = this.aborting;
                         this.aborting = false;
-                        const failure = msg.subtype === 'success' ? '' : classifyError(msg.subtype, msg.errors);
+                        /**
+                         * The CLI's own word for why it stopped — and the one signal that
+                         * it gave up (#406).
+                         *
+                         * `subtype` alone is not that signal: on 12.09.2026 Claude Code
+                         * wrote «API Error: Connection lost mid-response», ended the turn,
+                         * and stamped the result `subtype: "success"` with
+                         * `terminal_reason: "api_error"` beside it. The runner read the
+                         * first field, reported a clean turn, and the session stood for
+                         * 5 h 17 min with «your turn» on it.
+                         *
+                         * Deliberately NOT the accumulated `turnFailureCode`: Claude Code
+                         * survives most stream cuts by itself, and a code left over from
+                         * one it survived would fail three healthy turns an hour (the
+                         * correction on §492, ticket #406's second comment).
+                         */
+                        const terminalReason = typeof msg.terminal_reason === 'string'
+                            ? msg.terminal_reason
+                            : null;
+                        /**
+                         * The other half of the turn boundary above (#406).
+                         *
+                         * The guard in the read loop forgets the last turn on the first
+                         * message that is not a `result` — which a turn the CLI woke and
+                         * that said NOTHING never sends. Its only message is its own
+                         * closing `result`, and `origin.kind` is the field the SDK marks it
+                         * with; #373 already treats that field as the one thing that tells a
+                         * genuinely new internal turn from a second ending of the last one.
+                         * Without this, a silent internal turn would report the `produced`
+                         * and `irreversible` of whatever ran before it.
+                         */
+                        const originKind = typeof msg.origin?.kind === 'string'
+                            ? msg.origin.kind
+                            : null;
+                        if (this.turnClosed && originKind === 'task-notification') {
+                            this.turnClosed = false;
+                            this.beginTurnFacts();
+                        }
+                        const gaveUp = msg.subtype === 'success' && terminalReason === 'api_error';
+                        const failure = gaveUp
+                            ? API_ERROR_TURN_MESSAGE
+                            : msg.subtype === 'success'
+                                ? ''
+                                : classifyError(msg.subtype, msg.errors);
                         // #373, plan stage D. What the incident could not answer: the second
                         // result's origin was never recorded, so «is this the same turn
                         // twice or a turn the CLI started by itself» had no evidence either
@@ -2452,10 +2584,13 @@ class ClaudeSession {
                                 code: 'rewind_failed',
                             });
                         }
-                        else if (msg.subtype === 'success' || aborted) {
-                            // A turn the user stopped is not a failed turn. Reporting it as
-                            // one moved the session to FAILED, which is terminal — pressing
-                            // Stop cost people the session they meant to keep.
+                        else if (aborted || (msg.subtype === 'success' && !gaveUp)) {
+                            // `aborted` is tested FIRST, and stays ahead of `gaveUp`: a turn
+                            // the user stopped is not a failed turn whatever the CLI writes
+                            // beside it, and an abort can land on top of an API error.
+                            // Reporting a stop as a failure moved the session to FAILED,
+                            // which is terminal — pressing Stop cost people the session they
+                            // meant to keep.
                             this.emit({
                                 type: 'turn_end',
                                 ok: true,
@@ -2487,7 +2622,17 @@ class ClaudeSession {
                                 // the closed enum rides on the assistant message, this `result`
                                 // has no such field. Handed over so the supervisor can decide
                                 // from a code rather than from the sentence in `errorMessage`.
-                                ...(this.turnFailureCode !== null ? { failureCode: this.turnFailureCode } : {}),
+                                //
+                                // #406: a turn the CLI gave up on always carries a code, even
+                                // when nothing in it named one — `server_error` is what «their
+                                // side, try again» is spelled as, and without it `classifyFailure`
+                                // would have only the sentence to go on, which is the thing #252
+                                // took away from it.
+                                ...(this.turnFailureCode !== null
+                                    ? { failureCode: this.turnFailureCode }
+                                    : gaveUp
+                                        ? { failureCode: 'server_error' }
+                                        : {}),
                                 ...(this.turnFailureStatus !== null
                                     ? { failureStatus: this.turnFailureStatus }
                                     : {}),
@@ -2496,6 +2641,11 @@ class ClaudeSession {
                             });
                             this.refreshUsage();
                         }
+                        // #406: the facts above have been reported, so the next message —
+                        // whoever starts the turn it belongs to — may forget them. Armed
+                        // here rather than cleared here, because a second `result` for this
+                        // same ending has to read exactly what the first one did.
+                        this.turnClosed = true;
                         break;
                     }
                     default:
@@ -2671,6 +2821,15 @@ function stringifyContent(content) {
     }
     return content === undefined ? '' : JSON.stringify(content);
 }
+/**
+ * What the feed says about a turn Claude Code gave up on (#406).
+ *
+ * Deliberately free of «mid-response» and «may be incomplete»: `refine()` in
+ * `error-policy.ts` matches those two phrases and narrows a retry to a single
+ * «carry on» attempt. Here the narrowing must come from `produced`, which is a
+ * fact about the turn, and not from the wording of a sentence.
+ */
+const API_ERROR_TURN_MESSAGE = 'The connection to the model failed and Claude Code ended the turn on an API error';
 function classifyError(subtype, errors) {
     // Optional on purpose despite the SDK's type: a `result` without `errors`
     // threw from inside the event pump, which the loop's catch turned into a
@@ -2745,6 +2904,23 @@ export class ClaudeAdapter {
         this.queryFn = queryFn;
     }
     startSession(spec) {
+        /**
+         * «There is no Claude here» is answered once, and here (#395).
+         *
+         * BEFORE the session object exists, and that placement is the point: the
+         * constructor writes the MCP config — a 0600 file holding this workspace's
+         * live key — before it builds `Options`, and nothing removes that file for
+         * a constructor that threw. The supervisor turns this throw into one red
+         * line in the feed (`launchCrashed`) and a FAILED session, which is the
+         * honest answer when the agent is not on the machine.
+         *
+         * Only for the real SDK. An adapter built on an injected `query` is a test
+         * or a probe: it spawns nothing, so the fallback this guards against cannot
+         * happen — and asking anyway would fail the whole suite on every machine
+         * without the CLI, CI included. That is how the 0.56.0 release broke.
+         */
+        if (this.queryFn === query)
+            assertClaudeInstalled();
         return new ClaudeSession(spec, this.queryFn);
     }
 }

package/dist/adapters/codex.js

@@ -876,6 +876,7 @@ class CodexSession {
             return false;
         try {
             await this.client.request('thread/compact/start', { threadId: this.threadId });
+            this.requestedCompaction = true;
             return true;
         }
         catch (error) {
@@ -883,6 +884,14 @@ class CodexSession {
             return false;
         }
     }
+    /**
+     * A compaction THIS adapter asked for with `thread/compact/start` (#348) —
+     * the one kind that runs outside any turn and therefore has nothing to
+     * settle the session status behind it. The agent's own compaction inside a
+     * turn is not it, even when its item happens to complete before the
+     * `turn/started` that announces the turn.
+     */
+    requestedCompaction = false;
     stop(reason = 'session_stopped') {
         if (this.stopped)
             return;
@@ -1472,8 +1481,19 @@ class CodexSession {
                 return;
             }
             case 'contextCompaction': {
-                if (done)
-                    this.notice('info', 'Conversation compacted');
+                // #348: an event, not a notice — see `AgentEvent['compaction']`. A
+                // compaction started from the dashboard runs outside any turn on this
+                // agent (`thread/compact/start` creates none), so nothing will settle
+                // the status behind it; `standalone` tells the supervisor to.
+                if (method === 'item/started') {
+                    this.emit({ type: 'compaction', phase: 'started' });
+                    return;
+                }
+                if (done) {
+                    const standalone = this.requestedCompaction && this.activeTurnId === null;
+                    this.requestedCompaction = false;
+                    this.emit({ type: 'compaction', phase: 'finished', ok: true, standalone });
+                }
                 return;
             }
             case 'webSearch':

package/dist/adapters/questions.js

@@ -110,6 +110,7 @@ const INVALIDATION_PHRASES = {
     turn_aborted: 'the turn was interrupted',
     agent_cancelled: 'the agent withdrew it',
     budget_spent: 'the session ran out of its allowed working time',
+    not_held: 'the agent no longer holds this question',
 };
 /** The question was taken away from the user — say why, never fake an answer. */
 export function invalidationMessage(reason) {

package/dist/adapters/types.d.ts

@@ -366,7 +366,16 @@ export interface AgentQuestionAnswer {
     notes?: string;
 }
 /** Why a question was taken away from the user without them answering it. */
-export type QuestionInvalidationReason = 'session_stopped' | 'session_parked' | 'runner_restarted' | 'turn_aborted' | 'agent_cancelled' | 'budget_spent';
+export type QuestionInvalidationReason = 'session_stopped' | 'session_parked' | 'runner_restarted' | 'turn_aborted' | 'agent_cancelled' | 'budget_spent'
+/**
+ * An answer arrived for a card no live process holds (#392): the card
+ * outlived the process that asked, or the ask was withdrawn before the
+ * answer got here. The runner does not know which, and says only what it
+ * does know. Never handed to an agent — there is no agent holding the ask
+ * to hand it to — so its phrase in `INVALIDATION_PHRASES` is for the type
+ * checker; the words a person reads are the dashboard's.
+ */
+ | 'not_held';
 /** The dashboard's answer to one open ask. */
 export interface QuestionReply {
     askId: string;
@@ -502,6 +511,38 @@ export type AgentEvent = {
     type: 'notice';
     level: 'info' | 'warn';
     text: string;
+}
+/**
+ * The conversation is being folded into a summary, or just was (#348).
+ *
+ * Its own event and not a `notice` on purpose: adapter notices are
+ * de-duplicated per session on their text (gotcha §148), so «Conversation
+ * compacted» reached the feed once and every later compaction was silence.
+ * A compaction is a fact the feed has to hear every time — the dashboard's
+ * «compacting…» indicator is read off the feed, and a second compaction
+ * with no lines is a second compaction the person cannot see end.
+ *
+ * `standalone` on the ending: `true` when NO turn is going to close behind
+ * this compaction, so the supervisor has to settle the session status
+ * itself. Codex runs a compaction started from the dashboard outside any
+ * turn (`thread/compact/start`); Claude delivers `/compact` as a turn, and
+ * that turn's own ending settles the status the ordinary way.
+ */
+ | {
+    type: 'compaction';
+    phase: 'started';
+} | {
+    type: 'compaction';
+    phase: 'finished';
+    ok: boolean;
+    error?: string;
+    standalone?: boolean;
+    /**
+     * It ended without a summary: the CLI decided not to compact after all
+     * (a PreCompact hook said no, or it found nothing worth folding). Not a
+     * failure — nothing broke — and not a compaction either.
+     */
+    skipped?: boolean;
 } | {
     type: 'cost';
     costUsd: number;

package/dist/agent-binary.d.ts

@@ -62,13 +62,54 @@ export declare const USE_BUNDLED_CLAUDE = false;
  * the tests also need the real behaviour of; production always takes the default.
  */
 export declare function sessionClaudePath(useBundled?: boolean): string | null;
+/**
+ * What every caller says when Claude Code is not on this machine (#395).
+ *
+ * Word for word the API's own refusal (`assertAgentAvailable` in
+ * `dev-sessions.service.ts`): the two halves answer the same question about the
+ * same binary, and a person who meets both — the API when it can see the
+ * measurement, this one when it cannot — should not have to work out whether
+ * they are being told two different things.
+ */
+export declare const CLAUDE_NOT_INSTALLED = "Claude Code is not installed on this server \u2014 install it there, or pick another agent";
+/** Thrown where a run would otherwise start on a binary nobody chose. */
+export declare class ClaudeNotInstalledError extends Error {
+    constructor();
+}
+/**
+ * Refuse, in words, when a real Claude run has nothing legitimate to start.
+ *
+ * ## The hole this closes (#395, decision D14)
+ *
+ * With the bundled binary switched off and no system `claude`,
+ * `claudeExecutableOption` has nothing to pin and returns `{}`. To the SDK an
+ * absent `pathToClaudeCodeExecutable` does not mean «there is no Claude» — it
+ * means «resolve your own». So the machine either ran sessions on a SECOND
+ * Claude of a different version while its card said «not installed» (five
+ * sessions on `vmi3024903`, one of them $93), or — on a machine installed the
+ * standard way, where `--omit=optional` means the bundled package is not there
+ * at all — died inside the SDK with `Native CLI binary for linux-x64 not found`
+ * before its first word.
+ *
+ * ## Why it is a separate call and not a throw from `claudeExecutableOption`
+ *
+ * Both places that build `Options` do so eagerly, including in tests, where the
+ * SDK is replaced by a fake `query` and no binary is ever spawned. A throw from
+ * the option builder would therefore fail the whole suite on any machine
+ * without the CLI — CI among them, which is exactly how the 0.56.0 release
+ * broke. The callers below ask this question only on the path that reaches the
+ * REAL SDK.
+ */
+export declare function assertClaudeInstalled(useBundled?: boolean, 
+/** Where the binary is looked up. Production always takes the default. */
+resolve?: (useBundled: boolean) => string | null): void;
 /**
  * The SDK option that pins the executable, for both places that build `Options`.
  *
- * Empty while the bundled binary is in use: the SDK then resolves its own, which
- * is exactly today's behaviour and keeps `main` neutral. Empty also when the
- * system binary is missing — passing a path we know is not there would turn a
- * clear «Claude is not installed» into an SDK spawn error.
+ * Empty while the bundled binary is in use: the SDK then resolves its own,
+ * which is exactly what `USE_BUNDLED_CLAUDE = true` asks for. Empty also when
+ * there is no system binary — and that emptiness is no longer allowed to reach
+ * the real SDK: `assertClaudeInstalled` is asked first, on both paths.
  */
 export declare function claudeExecutableOption(useBundled?: boolean): {
     pathToClaudeCodeExecutable?: string;

package/dist/agent-binary.js

@@ -137,13 +137,62 @@ export const USE_BUNDLED_CLAUDE = false;
 export function sessionClaudePath(useBundled = USE_BUNDLED_CLAUDE) {
     return useBundled ? claudeCliPath() : whichExecutable(AGENT_RUNTIMES.claude.bin);
 }
+/**
+ * What every caller says when Claude Code is not on this machine (#395).
+ *
+ * Word for word the API's own refusal (`assertAgentAvailable` in
+ * `dev-sessions.service.ts`): the two halves answer the same question about the
+ * same binary, and a person who meets both — the API when it can see the
+ * measurement, this one when it cannot — should not have to work out whether
+ * they are being told two different things.
+ */
+export const CLAUDE_NOT_INSTALLED = 'Claude Code is not installed on this server — install it there, or pick another agent';
+/** Thrown where a run would otherwise start on a binary nobody chose. */
+export class ClaudeNotInstalledError extends Error {
+    constructor() {
+        super(CLAUDE_NOT_INSTALLED);
+        this.name = 'ClaudeNotInstalledError';
+    }
+}
+/**
+ * Refuse, in words, when a real Claude run has nothing legitimate to start.
+ *
+ * ## The hole this closes (#395, decision D14)
+ *
+ * With the bundled binary switched off and no system `claude`,
+ * `claudeExecutableOption` has nothing to pin and returns `{}`. To the SDK an
+ * absent `pathToClaudeCodeExecutable` does not mean «there is no Claude» — it
+ * means «resolve your own». So the machine either ran sessions on a SECOND
+ * Claude of a different version while its card said «not installed» (five
+ * sessions on `vmi3024903`, one of them $93), or — on a machine installed the
+ * standard way, where `--omit=optional` means the bundled package is not there
+ * at all — died inside the SDK with `Native CLI binary for linux-x64 not found`
+ * before its first word.
+ *
+ * ## Why it is a separate call and not a throw from `claudeExecutableOption`
+ *
+ * Both places that build `Options` do so eagerly, including in tests, where the
+ * SDK is replaced by a fake `query` and no binary is ever spawned. A throw from
+ * the option builder would therefore fail the whole suite on any machine
+ * without the CLI — CI among them, which is exactly how the 0.56.0 release
+ * broke. The callers below ask this question only on the path that reaches the
+ * REAL SDK.
+ */
+export function assertClaudeInstalled(useBundled = USE_BUNDLED_CLAUDE, 
+/** Where the binary is looked up. Production always takes the default. */
+resolve = sessionClaudePath) {
+    if (useBundled)
+        return;
+    if (!resolve(useBundled))
+        throw new ClaudeNotInstalledError();
+}
 /**
  * The SDK option that pins the executable, for both places that build `Options`.
  *
- * Empty while the bundled binary is in use: the SDK then resolves its own, which
- * is exactly today's behaviour and keeps `main` neutral. Empty also when the
- * system binary is missing — passing a path we know is not there would turn a
- * clear «Claude is not installed» into an SDK spawn error.
+ * Empty while the bundled binary is in use: the SDK then resolves its own,
+ * which is exactly what `USE_BUNDLED_CLAUDE = true` asks for. Empty also when
+ * there is no system binary — and that emptiness is no longer allowed to reach
+ * the real SDK: `assertClaudeInstalled` is asked first, on both paths.
  */
 export function claudeExecutableOption(useBundled = USE_BUNDLED_CLAUDE) {
     if (useBundled)

package/dist/attachments.d.ts

@@ -56,6 +56,10 @@ export declare function ensureGitExclude(worktreePath: string): Promise<void>;
  * Returns what actually landed — a file that could not be fetched is reported
  * and skipped rather than failing the whole message, because the text the user
  * typed is usually still worth delivering.
+ *
+ * Each file gets up to `DOWNLOAD_ATTEMPTS` goes inside ONE `DOWNLOAD_TIMEOUT_MS`
+ * budget (#407): the ceiling on how long a person waits for their own message is
+ * unchanged, and the attempts share it rather than each getting their own.
  */
 export declare function saveAttachments(input: {
     worktreePath: string;
@@ -63,6 +67,8 @@ export declare function saveAttachments(input: {
     token: string;
     attachments: RemoteAttachment[];
     fetchImpl?: typeof fetch;
+    /** Test seam: the pauses between attempts, so a suite does not sit through them. */
+    sleepImpl?: (ms: number) => Promise<void>;
 }): Promise<{
     saved: SavedAttachment[];
     failed: string[];