@crouton-kit/crouter 0.3.70 → 0.3.79

package/dist/commands/view-pick.d.ts

@@ -1,2 +1,6 @@
 import type { LeafDef } from '../core/command.js';
+import { type BindingId, type BindingResolution, type RawTerminalInput } from '../core/keybindings/index.js';
+declare const VIEW_PICK_ACTIONS: readonly ["crtr.view-picker.quit", "crtr.view-picker.down", "crtr.view-picker.up", "crtr.view-picker.run"];
+export declare function resolveViewPickAction(bindings: BindingResolution<BindingId>, raw: RawTerminalInput): (typeof VIEW_PICK_ACTIONS)[number] | null;
 export declare const viewPickLeaf: LeafDef;
+export {};

package/dist/commands/view-pick.js

@@ -10,6 +10,16 @@ import { defineLeaf } from '../core/command.js';
 import { listViews } from '../core/view/loader.js';
 import { setupTerminal, restoreTerminal, getTerminalSize, parseKeypress, } from '../core/tui/terminal.js';
 import { createDraw, detectColorCaps } from '../core/tui/draw.js';
+import { formatBinding, matchesTerminalInput, resolveUserKeybindings, } from '../core/keybindings/index.js';
+const VIEW_PICK_ACTIONS = [
+    'crtr.view-picker.quit',
+    'crtr.view-picker.down',
+    'crtr.view-picker.up',
+    'crtr.view-picker.run',
+];
+export function resolveViewPickAction(bindings, raw) {
+    return VIEW_PICK_ACTIONS.find((id) => matchesTerminalInput(bindings, id, raw)) ?? null;
+}
 export const viewPickLeaf = defineLeaf({
     name: 'pick',
     tier: 'hidden',
@@ -42,6 +52,7 @@ export const viewPickLeaf = defineLeaf({
             return;
         }
         const caps = detectColorCaps();
+        const bindings = resolveUserKeybindings();
         let cursor = 0;
         let scroll = 0;
         let restored = false;
@@ -58,7 +69,7 @@ export const viewPickLeaf = defineLeaf({
         const render = () => {
             const size = getTerminalSize();
             const { draw, frame } = createDraw(size, caps);
-            draw.text(0, 0, 'crtr views — j/k move · Enter run · q quit', { bold: true });
+            draw.text(0, 0, `crtr views — ${formatBinding(bindings, 'crtr.view-picker.down')}/${formatBinding(bindings, 'crtr.view-picker.up')} move · ${formatBinding(bindings, 'crtr.view-picker.run')} run · ${formatBinding(bindings, 'crtr.view-picker.quit')} quit`, { bold: true });
             draw.hline(1, 0, size.cols);
             const rect = { row: 2, col: 0, width: size.cols, height: Math.max(1, size.rows - 3) };
             const items = views.map((v) => ({
@@ -97,21 +108,20 @@ export const viewPickLeaf = defineLeaf({
                     return;
                 }
                 const { input, key } = parsed;
-                if (key.ctrl && input === 'c')
+                const action = resolveViewPickAction(bindings, { input, ...key });
+                if (action === 'crtr.view-picker.quit')
                     finish();
-                if (input === 'q' || key.escape)
-                    finish();
-                if (input === 'j' || key.downArrow) {
+                if (action === 'crtr.view-picker.down') {
                     cursor = Math.min(views.length - 1, cursor + 1);
                     render();
                     return;
                 }
-                if (input === 'k' || key.upArrow) {
+                if (action === 'crtr.view-picker.up') {
                     cursor = Math.max(0, cursor - 1);
                     render();
                     return;
                 }
-                if (key.return)
+                if (action === 'crtr.view-picker.run')
                     launch(views[cursor].id);
             });
         });

package/dist/core/__tests__/base-worker-prompt.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/base-worker-prompt.test.js

@@ -0,0 +1,24 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { renderPreferencesForSubject } from '../substrate/render.js';
+function subject(mode) {
+    return {
+        kind: 'plan/reviewers/security',
+        mode,
+        lifecycle: 'terminal',
+        hasManager: true,
+        cwd: process.cwd(),
+        scope: 'project',
+        orchestration: { depth: 1 },
+        profile: null,
+    };
+}
+test('base sub-personas receive hands-on guidance instead of universal delegation pressure', () => {
+    const base = renderPreferencesForSubject(subject('base')).block;
+    assert.match(base, /You are a hands-on worker/);
+    assert.match(base, /Each child gets a bounded outcome distinct from your whole assignment/);
+    assert.doesNotMatch(base, /Hand any self-contained unit of work to a child/);
+    const orchestrator = renderPreferencesForSubject(subject('orchestrator')).block;
+    assert.doesNotMatch(orchestrator, /You are a hands-on worker/);
+    assert.match(orchestrator, /You are an orchestrator/);
+});

package/dist/core/__tests__/canvas-inbox-watcher-hold.test.js

@@ -10,7 +10,8 @@ import { mkdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import registerCanvasInboxWatcher from '../../pi-extensions/canvas-inbox-watcher.js';
-import { appendInbox } from '../feed/inbox.js';
+import { appendInbox, readCursor } from '../feed/inbox.js';
+import { appendSituationalContext } from '../runtime/situational-context.js';
 import { createNode, setIntent } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
 // Drive the watcher's injectable cadence seam (CRTR_WATCHER_TICK_MS /
@@ -36,11 +37,25 @@ function makeFakePi() {
     const handlers = {};
     return {
         injected: [],
+        sentMessages: [],
         on(e, h) { handlers[e] = h; },
         sendUserMessage(content, options) { this.injected.push({ content, deliverAs: options?.deliverAs }); },
+        sendMessage(message) { this.sentMessages.push(message); },
         fire(e, ev, ctx) { handlers[e]?.(ev, ctx); },
     };
 }
+// Fire agent_settled — the ONLY durable-commit boundary in the at-least-once
+// model. `pending` maps to pi's `hasPendingMessages()`: false = pi's
+// steer/followUp queue is drained (the normal production case — pi 0.80.6 drains
+// retry/queued continuations within the same prompt cycle before this settle —
+// so commit proceeds); true = the context still reports an unconsumed handed-off
+// send, which exercises the extension's DEFENSIVE coarse hold (commit is HELD
+// until a later drained settle). The true case is an API-behavior scenario for
+// the guard, not a lifecycle the normal production settle emits.
+function settle(pi, opts = {}) {
+    const pending = opts.pending === true;
+    pi.fire('agent_settled', { type: 'agent_settled' }, { isIdle: () => true, hasPendingMessages: () => pending });
+}
 const wait = (ms) => new Promise((r) => setTimeout(r, ms));
 let origTick;
 let origDebounce;
@@ -116,3 +131,219 @@ describe('canvas inbox watcher — hold + idle delivery', () => {
         assert.equal(pi.injected[0].deliverAs, undefined, 'idle → sendUserMessage triggers a turn, no deliverAs');
     });
 });
+// Durable-cursor model (at-least-once, one conservative boundary): the in-memory
+// `cursor` advances at buffer time (so a burst is never re-read into the same
+// watcher's buffer), but the on-disk cursor commits ONLY at `agent_settled` (and
+// `session_shutdown` as the graceful safety net) — never on the fire-and-forget
+// send return, never at `agent_end` (which fires before pi decides on retry/
+// continuation). A send returning normally is a HANDOFF, and the commit clamps
+// below anything still buffered. When pi still holds an unconsumed handed-off
+// send — a failed/aborted turn RETAINS its in-memory steer/followUp queue for the
+// next turn — `ctx.hasPendingMessages()` is true and the commit is HELD until a
+// later settle drains it. A watcher that dies (crash, SIGTERM, daemon kick)
+// before a committing settle leaves the on-disk cursor behind, so a fresh watcher
+// re-reads and re-delivers rather than silently losing the entry. See
+// canvas-inbox-watcher.ts's header/inline comments on `handedOffWatermark`,
+// `commitTarget`, and `commitAtSettle` for the full rationale.
+describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
+    test('mid-turn handoff, crash before settle: on-disk cursor NOT advanced, fresh watcher re-delivers', async () => {
+        freshNode('node-cursor-crash');
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        // Streaming (mid-turn) so this delivers via followUp, not the idle path.
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 100);
+        appendInbox('node-cursor-crash', { from: 'child-1', tier: 'normal', kind: 'update', label: 'still working' });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.injected.length, 1, 'delivered mid-turn as a followUp');
+        assert.equal(pi1.injected[0].deliverAs, 'followUp');
+        // The durability boundary: no settle has fired, so the on-disk cursor must
+        // still be untouched — this is the assertion that proves the fix (a
+        // commit-at-buffer-time / commit-on-send variant would have committed here).
+        assert.equal(readCursor('node-cursor-crash'), undefined, 'on-disk cursor not committed before a settle');
+        // Simulate the watcher dying without a graceful session_shutdown — never
+        // settle OR fire session_shutdown on pi1. The broker's SIGTERM handler DOES
+        // run a JS handler (disposeAndExit: session.dispose() + process.exit), but
+        // that path never emits this extension's session_shutdown, so its safety-net
+        // commit does not run on a kill. Registering a fresh watcher clears pi1's
+        // timer (the module-level liveTimer guard) without running its teardown,
+        // modeling crash-then-revive rather than a clean stop.
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 1, 'a fresh watcher re-reads and re-delivers the same uncommitted entry');
+        assert.match(pi2.injected[0].content, /still working/);
+    });
+    test('mid-turn handoff + agent_settled: cursor committed, fresh watcher does NOT redeliver', async () => {
+        freshNode('node-cursor-committed');
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 100);
+        const entry = appendInbox('node-cursor-committed', { from: 'child-2', tier: 'normal', kind: 'update', label: 'still working' });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.injected.length, 1);
+        assert.equal(readCursor('node-cursor-committed'), undefined, 'not yet committed before the settle');
+        // The turn settles with pi's queue drained (the followUp was consumed) —
+        // THAT commits the cursor.
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-committed'), entry.ts, 'cursor committed to disk at agent_settled');
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 0, 'a fresh watcher does not redeliver an already-committed entry');
+    });
+    test('idle-path delivery: NOT committed on the void send, committed at agent_settled', async () => {
+        freshNode('node-cursor-idle');
+        const pi = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi));
+        // No agent_start fired → watcher treats the node as idle.
+        await wait(TICK_MS + 100);
+        const entry = appendInbox('node-cursor-idle', { from: 'child-3', tier: 'normal', kind: 'update', label: 'idle update' });
+        await wait(SETTLE_MS);
+        assert.equal(pi.injected.length, 1);
+        assert.equal(pi.injected[0].deliverAs, undefined, 'idle delivery has no deliverAs');
+        // The idle send triggers a turn, but its void return is a handoff, not proof
+        // of acceptance — the cursor stays put until the turn settles. (One rule: no
+        // immediate idle-path commit.)
+        assert.equal(readCursor('node-cursor-idle'), undefined, 'idle send does not commit on the fire-and-forget return');
+        settle(pi);
+        assert.equal(readCursor('node-cursor-idle'), entry.ts, 'idle-path delivery commits at the turn it started settling');
+    });
+    test('synchronous send throw then agent_settled: durable cursor NOT advanced past the re-buffered entry, fresh watcher re-delivers', async () => {
+        freshNode('node-cursor-failsend');
+        const pi1 = makeFakePi();
+        // Persistent synchronous send failure: the entry is read + buffered, flush
+        // throws, it is re-buffered and never handed off.
+        pi1.sendUserMessage = () => { throw new Error('send always fails'); };
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 100);
+        appendInbox('node-cursor-failsend', { from: 'child-1', tier: 'normal', kind: 'update', label: 'never delivered' });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.injected.length, 0, 'the failing send delivered nothing');
+        // agent_settled must NOT commit past the still-re-buffered (never-handed-off) entry.
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-failsend'), undefined, 'durable cursor not advanced past a re-buffered, never-delivered entry');
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 1, 'a fresh watcher re-reads and re-delivers the never-committed entry');
+        assert.match(pi2.injected[0].content, /never delivered/);
+    });
+    test('critical abort then abort-generated settle: pending critical entry NOT committed, fresh watcher re-delivers', async () => {
+        freshNode('node-cursor-critical');
+        const pi1 = makeFakePi();
+        let aborted = 0;
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        // Mid-turn streaming, with an abort() seam on the ctx (a critical entry
+        // preempts via ctx.abort()).
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false, abort: () => { aborted += 1; } });
+        await wait(TICK_MS + 100);
+        appendInbox('node-cursor-critical', { from: 'child-1', tier: 'critical', kind: 'update', label: 'critical work' });
+        await wait(SETTLE_MS);
+        assert.ok(aborted >= 1, 'the critical entry aborted the live turn');
+        assert.equal(pi1.injected.length, 0, 'the critical path re-buffers, it does not deliver mid-stream');
+        // The abort-generated agent_end/settle must not commit the pending critical
+        // entry (it is re-buffered, never handed off).
+        pi1.fire('agent_end', { type: 'agent_end', messages: [] }, { isIdle: () => true });
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-critical'), undefined, 'abort-generated settle does not commit the pending critical entry before its retry');
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 1, 'a fresh watcher re-delivers the critical entry');
+        assert.match(pi2.injected[0].content, /critical work/);
+    });
+    test('batch A settles while batch B still debounces: commit stops at A, fresh watcher re-delivers B', async () => {
+        freshNode('node-cursor-batchB');
+        // Wide debounce for THIS watcher so B stays buffered-but-unflushed when we
+        // settle A; the watcher captures the cadence at registration, so restore the
+        // file default immediately after for the fresh (pi2) watcher.
+        process.env['CRTR_WATCHER_DEBOUNCE_MS'] = '200';
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        process.env['CRTR_WATCHER_DEBOUNCE_MS'] = String(DEBOUNCE_MS);
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 60);
+        const a = appendInbox('node-cursor-batchB', { from: 'child-a', tier: 'normal', kind: 'update', label: 'batch A' });
+        await wait(280); // > 200ms debounce → A flushes and is delivered mid-turn (handoff)
+        assert.equal(pi1.injected.length, 1, 'batch A delivered mid-turn');
+        assert.equal(pi1.injected[0].deliverAs, 'followUp');
+        const b = appendInbox('node-cursor-batchB', { from: 'child-b', tier: 'normal', kind: 'update', label: 'batch B' });
+        await wait(70); // B read into the buffer but < 200ms debounce → not yet flushed
+        // A's turn settles while B is still debouncing in the buffer. The commit must
+        // clamp below the still-buffered B and land on A only.
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-batchB'), a.ts, 'commit lands on handed-off batch A');
+        assert.notEqual(readCursor('node-cursor-batchB'), b.ts, 'commit does not cross the still-buffered batch B');
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS + 40);
+        assert.equal(pi2.injected.length, 1, 'a fresh watcher re-reads from A and re-delivers B');
+        assert.match(pi2.injected[0].content, /batch B/);
+        assert.doesNotMatch(pi2.injected[0].content, /batch A/, 'A is already committed, only B is re-delivered');
+    });
+    // Defensive coarse-hold guard, driven at the API boundary. In the installed pi
+    // 0.80.6 `AgentSession` a handed-off followUp is drained within the same
+    // prompt cycle before the sole extension-facing settle, so the normal
+    // production settle sees `hasPendingMessages() === false`. This test does NOT
+    // reproduce a production failure→pending-settle→later-settle lifecycle; it
+    // pins the guard's contract directly: WHEN a settle's context reports pending
+    // sends (hasPendingMessages() = true), committing would durably consume a
+    // message not yet delivered, so the commit is HELD (never at agent_end, never
+    // at the pending settle); a crash in that window re-delivers; and once a later
+    // settle reports a drained queue (hasPendingMessages() = false) the cursor
+    // commits exactly once.
+    test('settle reporting pending sends: HELD by the defensive guard, then committed once the queue drains', async () => {
+        freshNode('node-cursor-failhold');
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 100);
+        const entry = appendInbox('node-cursor-failhold', { from: 'child-1', tier: 'normal', kind: 'update', label: 'queued across a failure' });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.injected.length, 1, 'delivered mid-turn as a followUp');
+        assert.equal(pi1.injected[0].deliverAs, 'followUp');
+        // A failure/aborted agent_end is never a commit point regardless of queue
+        // state, so it must NOT commit.
+        pi1.fire('agent_end', { type: 'agent_end', messages: [] }, { isIdle: () => false });
+        assert.equal(readCursor('node-cursor-failhold'), undefined, 'a failure agent_end does not commit');
+        // Drive the guard directly: a settle whose context reports pending sends
+        // (hasPendingMessages = true). The commit is HELD — committing now would
+        // durably consume a message not yet delivered.
+        settle(pi1, { pending: true });
+        assert.equal(readCursor('node-cursor-failhold'), undefined, 'settle reporting pending sends does NOT commit (held)');
+        // A crash in this exact held window re-delivers — nothing was committed.
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 1, 'crash while held re-delivers');
+        assert.match(pi2.injected[0].content, /queued across a failure/);
+        // The next settle reports a drained queue (hasPendingMessages = false) →
+        // commit lands exactly once.
+        settle(pi2);
+        assert.equal(readCursor('node-cursor-failhold'), entry.ts, 'the settle after pi drains the queue commits the cursor');
+    });
+    // Situational custom sends do not enter pi's user steer/followUp queue, so
+    // hasPendingMessages() never reflects them: a situational handoff commits at
+    // the next drained settle (a situational send that async-rejected is the
+    // accepted silent-loss window, not held).
+    test('situational custom send: committed at the next drained agent_settled', async () => {
+        freshNode('node-cursor-situational');
+        appendSituationalContext('node-cursor-situational', 'ambient checkout state');
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        // Idle so the situational-only entry delivers as a hidden custom message.
+        await wait(TICK_MS + 100);
+        const entry = appendInbox('node-cursor-situational', {
+            from: null, tier: 'normal', kind: 'message', label: '(ambient context updated)',
+            data: { situational: true, situationalOnly: true },
+        });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.sentMessages.length, 1, 'the hidden custom message was sent');
+        assert.equal(readCursor('node-cursor-situational'), undefined, 'not committed before the settle');
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-situational'), entry.ts, 'the situational handoff commits at the drained settle');
+    });
+});

package/dist/core/__tests__/canvas-inbox-watcher.test.js

@@ -15,12 +15,13 @@ import registerCanvasInboxWatcher from '../../pi-extensions/canvas-inbox-watcher
 import { appendInbox } from '../feed/inbox.js';
 import { appendSituationalContext, SITUATIONAL_CONTEXT_CUSTOM_TYPE } from '../runtime/situational-context.js';
 // Drive the watcher's injectable cadence seam (CRTR_WATCHER_TICK_MS /
-// CRTR_WATCHER_DEBOUNCE_MS) at a fast tempo so the test sleeps milliseconds, not
-// seconds. SETTLE_MS still allows a resolve+seed tick, a read tick, and the
-// debounce window before asserting, exactly as against the real 800/1000 cadence.
+// CRTR_WATCHER_DEBOUNCE_MS) at a fast tempo so the watcher delivers in tens of
+// milliseconds, not seconds — exactly the resolve+seed tick, read tick, and
+// debounce window it runs against the real 800/1000 cadence. Tests then poll for
+// the delivery with waitFor() rather than sleeping a fixed settle window, so a
+// starved interval tick on a loaded CI runner can't race the assertion.
 const TICK_MS = 20;
 const DEBOUNCE_MS = 25;
-const SETTLE_MS = TICK_MS * 2 + DEBOUNCE_MS + 30;
 let origHome;
 let origNode;
 const homes = [];
@@ -45,6 +46,23 @@ function makeFakePi() {
     };
 }
 const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+// Poll `predicate` until it holds or `timeoutMs` elapses, then return either
+// way. The watcher delivers on its own setInterval cadence, which competes for
+// the event loop with this test's timers; a fixed sleep before asserting is
+// unreliable on an oversubscribed CI runner (--test-concurrency=4), where an
+// interval tick is starved past the debounce window and the assertion runs
+// before the flush — the observed `0 !== 1` flake. Polling returns the instant
+// delivery lands (fast in the common case) and tolerates scheduling jitter with
+// a generous ceiling; returning on timeout lets the following asserts produce a
+// precise message instead of a generic wait error.
+async function waitFor(predicate, timeoutMs = 3000, stepMs = 10) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (predicate())
+            return;
+        await wait(stepMs);
+    }
+}
 let origTick;
 let origDebounce;
 before(() => {
@@ -92,7 +110,7 @@ describe('canvas inbox watcher — finished-node delivery', () => {
         pi.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
         await wait(TICK_MS + 100);
         appendInbox('node-final', { from: 'child-1', tier: 'normal', kind: 'final', label: 'all done' });
-        await wait(SETTLE_MS);
+        await waitFor(() => pi.injected.length >= 1);
         assert.equal(pi.injected.length, 1, 'one coalesced injection');
         assert.equal(pi.injected[0].deliverAs, 'steer', 'a finished node steers, not follows up');
     });
@@ -103,7 +121,7 @@ describe('canvas inbox watcher — finished-node delivery', () => {
         pi.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
         await wait(TICK_MS + 100);
         appendInbox('node-update', { from: 'child-2', tier: 'normal', kind: 'update', label: 'still working' });
-        await wait(SETTLE_MS);
+        await waitFor(() => pi.injected.length >= 1);
         assert.equal(pi.injected.length, 1);
         assert.equal(pi.injected[0].deliverAs, 'followUp', 'a normal update is not urgent → followUp');
     });
@@ -121,7 +139,10 @@ describe('canvas inbox watcher — hidden situational-context delivery', () => {
             label: '(ambient context updated)',
             data: { situational: true, situationalOnly: true },
         });
-        await wait(SETTLE_MS);
+        // A situational-only flush sets sentMessages (never injected) in a single
+        // synchronous flush(), so waiting on the hidden send is sufficient to also
+        // settle the injected.length === 0 assertion below.
+        await waitFor(() => pi.sentMessages.length >= 1);
         assert.equal(pi.injected.length, 0, 'a situational-only entry never triggers a visible digest');
         assert.equal(pi.sentMessages.length, 1, 'exactly one hidden custom message sent');
         assert.match(pi.sentMessages[0].content, /<situational-context>/);
@@ -144,7 +165,9 @@ describe('canvas inbox watcher — hidden situational-context delivery', () => {
             label: 'visible update',
             data: { body: 'the visible message body', situational: true },
         });
-        await wait(SETTLE_MS);
+        // The hidden send and the visible digest both fire in one synchronous
+        // flush(); the injection is the later of the two, so wait on it.
+        await waitFor(() => pi.injected.length >= 1 && pi.sentMessages.length >= 1);
         assert.equal(pi.injected.length, 1, 'the visible body still reaches the digest');
         assert.match(pi.injected[0].content, /the visible message body/);
         assert.doesNotMatch(pi.injected[0].content, /hidden ambient checkout state/, 'ambient text never rides the visible digest');
@@ -177,7 +200,9 @@ describe('canvas inbox watcher — hidden situational-context delivery', () => {
             label: '(ambient context updated)',
             data: { situational: true, situationalOnly: true },
         });
-        await wait(SETTLE_MS * 3);
+        // First send throws (re-queued), so a later flush retries: wait for the
+        // successful second delivery rather than a fixed multi-settle sleep.
+        await waitFor(() => calls >= 2 && pi.sentMessages.length >= 1);
         assert.ok(calls >= 2, 'sendMessage retried after the first failure instead of being swallowed once');
         assert.equal(pi.injected.length, 0, 'still never reaches the visible digest');
         assert.equal(pi.sentMessages.length, 1, 'eventually delivered exactly once after the retry succeeds');

package/dist/core/__tests__/command-plugins-surfaces.test.d.ts

@@ -0,0 +1 @@
+export {};