@kabmo-labs/kabmo 0.2.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kabmo-labs/kabmo",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Web console and diagnostic workbench for AI coding agents — Elysia + Preact on Bun.",
   "license": "UNLICENSED",
   "author": "Wijanarko Putra Rajeb <wijanarko.rajeb@gmail.com>",

package/src/client/bootstrap.d.ts

@@ -26,10 +26,19 @@ export interface KabmoBootstrap {
    * The Android shell's version, when this page was requested by the APK
    * (`KabmoAndroid/<version>` in the User-Agent). Null in every browser.
    *
-   * The sidebar uses it to decide whether a download button applies at all, and
-   * whether this install is behind the published APK.
+   * The sidebar uses it to decide whether an UPDATE applies — this install is
+   * behind the published APK.
    */
   shellVersion?: string | null;
+  /**
+   * Whether this request came from an Android device at all — the app, or a
+   * browser running on it.
+   *
+   * The wider fact, and it exists for the INSTALL offer: a reader on Chrome or
+   * Brave for Android carries no shell token, so `shellVersion` alone cannot
+   * tell them from a desktop where an APK is useless.
+   */
+  isAndroid?: boolean;
 }
 
 declare global {

package/src/client/components/layout/session-sidebar/Footer.tsx

@@ -1,12 +1,16 @@
 import { Download, Info, Settings } from 'lucide-preact';
+import {
+  androidDownloadLabel,
+  type AndroidDownload,
+} from '@/client/hooks/ui/updates/android-download';
 
 interface SessionSidebarFooterProps {
   onSettings: () => void;
   onInfo: () => void;
   updateAvailable?: boolean;
   onUpdateClick?: () => void;
-  /** The newer APK to offer, or null. Only ever set inside the Android app. */
-  androidDownload?: { url: string; latest: string; releaseUrl: string | null } | null;
+  /** The APK to offer, or null. Set inside the app (an update) or on an Android browser (an install). */
+  androidDownload?: AndroidDownload | null;
 }
 
 /**
@@ -42,16 +46,16 @@ export function SessionSidebarFooter({ onSettings, onInfo, updateAvailable, onUp
           <Info size={16} />
         </button>
         {androidDownload && (
-          // Next to About, and only when BOTH facts hold: this page is inside
-          // the Android app, and a newer APK is published. An up-to-date app
-          // shows nothing here, and a browser never does — see
-          // `useAndroidDownload`.
+          // Next to About. Two reasons to be here, and the label says which:
+          // an installed APK that is behind (an update), or an Android browser
+          // whose reader may not know the shell exists (an install). A desktop
+          // browser gets neither — see `useAndroidDownload`.
           <a
             href={androidDownload.url}
             target="_blank"
             rel="noopener noreferrer"
-            title={`Download Kabmo ${androidDownload.latest} for Android`}
-            aria-label={`Download Kabmo ${androidDownload.latest} for Android`}
+            title={androidDownloadLabel(androidDownload)}
+            aria-label={androidDownloadLabel(androidDownload)}
             className="p-1 rounded hover:text-ink hover:bg-ink/5 cursor-pointer transition-colors"
           >
             <Download size={16} />

package/src/client/components/layout/session-sidebar/index.tsx

@@ -57,9 +57,12 @@ export function SessionSidebar({ className = '', onClose, appSettings = {}, stre
   const [schedulerOpen, setSchedulerOpen] = useState(false);
   const scheduledCount = useScheduledTaskCount();
   const updates = useUpdates();
-  // The Android download offer: null in a browser and null when this APK is
-  // already the newest published one, so the footer draws nothing.
-  const androidDownload = useAndroidDownload(window.__OMP_BOOTSTRAP__?.shellVersion);
+  // The Android offer: an UPDATE inside the APK, an INSTALL on an Android
+  // browser, and nothing anywhere else — see `useAndroidDownload`.
+  const androidDownload = useAndroidDownload(
+    window.__OMP_BOOTSTRAP__?.shellVersion,
+    window.__OMP_BOOTSTRAP__?.isAndroid,
+  );
   const { toasts, pushToast, dismissToast } = useToasts();
 
   // Sidebar inline states

package/src/client/components/mobile/SessionSidebar.tsx

@@ -73,9 +73,12 @@ export function MobileSessionSidebar({
   const scheduledCount = useScheduledTaskCount();
   const [aboutOpen, setAboutOpen] = useState(false);
   const updates = useUpdates();
-  // Null in a browser, and null when this APK is already current — see
-  // `useAndroidDownload`.
-  const androidDownload = useAndroidDownload(window.__OMP_BOOTSTRAP__?.shellVersion);
+  // An update inside the APK, an install on an Android browser, nothing
+  // elsewhere — see `useAndroidDownload`.
+  const androidDownload = useAndroidDownload(
+    window.__OMP_BOOTSTRAP__?.shellVersion,
+    window.__OMP_BOOTSTRAP__?.isAndroid,
+  );
   const { toasts, pushToast, dismissToast } = useToasts();
 
   // The popup's "Update now" hands the run over rather than starting its own —

package/src/client/components/mobile/mobile-session-sidebar/Footer.tsx

@@ -1,13 +1,17 @@
 import { Download, Info, Monitor, Settings } from 'lucide-preact';
 import packageJson from '@/../package.json';
+import {
+  androidDownloadLabel,
+  type AndroidDownload,
+} from '@/client/hooks/ui/updates/android-download';
 
 interface MobileSessionFooterProps {
   onSettings: () => void;
   onAbout: () => void;
   updateAvailable?: boolean;
   onUpdateClick?: () => void;
-  /** The newer APK to offer, or null. Only ever set inside the Android app. */
-  androidDownload?: { url: string; latest: string; releaseUrl: string | null } | null;
+  /** The APK to offer, or null. Set inside the app (an update) or on an Android browser (an install). */
+  androidDownload?: AndroidDownload | null;
   /** Switch the app to the desktop layout for this page session only. The
    *  choice is not persisted, so the next load re-detects the device. */
   onDesktopToggle?: () => void;
@@ -48,16 +52,20 @@ export function MobileSessionFooter({
           // button: the download is the browser's (or the WebView's) job, and
           // `target="_blank"` hands it to the system browser so the console is
           // not replaced by a file download.
+          //
+          // The visible word is the OFFER, not the file type: `APK` told a
+          // reader what the bytes are but not what the control does, and on a
+          // browser it is the only place the native shell is ever mentioned.
           <a
             href={androidDownload.url}
             target="_blank"
             rel="noopener noreferrer"
-            title={`Download Kabmo ${androidDownload.latest} for Android`}
-            aria-label={`Download Kabmo ${androidDownload.latest} for Android`}
+            title={androidDownloadLabel(androidDownload)}
+            aria-label={androidDownloadLabel(androidDownload)}
             className="flex items-center space-x-1 hover:text-ink transition-colors"
           >
             <Download size={14} />
-            <span>APK</span>
+            <span>{androidDownload.kind === 'update' ? 'Update APK' : 'Get APK'}</span>
           </a>
         )}
         {onDesktopToggle && (

package/src/client/data/settings/omp-schema.json

@@ -1,5 +1,5 @@
 {
-  "source": "@oh-my-pi/pi-coding-agent 10 tabs / 554 settings",
+  "source": "@oh-my-pi/pi-coding-agent 10 tabs / 559 settings",
   "tabs": [
     {
       "id": "appearance",
@@ -507,6 +507,16 @@
         ]
       }
     },
+    "tui.completeScrollback": {
+      "type": "boolean",
+      "default": false,
+      "ui": {
+        "tab": "appearance",
+        "group": "Display",
+        "label": "Complete Scrollback",
+        "description": "Send transcript rows pushed off screen by a growing HUD or dialog straight to scrollback; when it shrinks, blank rows sit between the transcript and the input until new output fills them"
+      }
+    },
     "terminal.showProgress": {
       "type": "boolean",
       "default": false,
@@ -3865,6 +3875,39 @@
         "condition": "advisorEnabled"
       }
     },
+    "advisor.continueSeverity": {
+      "type": "enum",
+      "default": "concern",
+      "values": [
+        "nit",
+        "concern",
+        "blocker"
+      ],
+      "ui": {
+        "tab": "model",
+        "group": "Advisor",
+        "label": "Advisor Continue Severity",
+        "description": "Minimum severity of an advisor note that wakes the agent after it finished with a final answer. Lower-severity notes stay as a card at the end of the transcript and reach the agent with your next message.",
+        "options": [
+          {
+            "value": "nit",
+            "label": "Nit",
+            "description": "Every note continues the run."
+          },
+          {
+            "value": "concern",
+            "label": "Concern",
+            "description": "Concerns and blockers continue the run. Default."
+          },
+          {
+            "value": "blocker",
+            "label": "Blocker",
+            "description": "Only blockers continue the run."
+          }
+        ],
+        "condition": "advisorEnabled"
+      }
+    },
     "advisor.reviewMode": {
       "type": "enum",
       "default": "turn",
@@ -4062,7 +4105,7 @@
           {
             "value": "remote",
             "label": "Server compaction",
-            "description": "Use provider-native server compaction (OpenAI Responses compact, Anthropic compaction beta) when the active route supports it"
+            "description": "Use provider-native server compaction (OpenAI Responses compact, Anthropic compaction beta, including on Bedrock) when the active route supports it"
           },
           {
             "value": "snapcompact",
@@ -4312,7 +4355,7 @@
         "tab": "context",
         "group": "Compaction",
         "label": "Idle Compaction Delay",
-        "description": "Seconds to wait while idle before compacting",
+        "description": "Seconds to wait while idle before compacting; with a 1-hour prompt cache, compaction instead runs just before the cache expires",
         "options": [
           {
             "value": "60",
@@ -5811,6 +5854,7 @@
       "default": "yolo",
       "values": [
         "always-ask",
+        "always-ask-cached",
         "write",
         "yolo"
       ],
@@ -5818,13 +5862,18 @@
         "tab": "interaction",
         "group": "Approvals",
         "label": "Tool Approval",
-        "description": "Default approval behavior for tool calls. 'Always ask' auto-approves read-only tools only. 'Write' auto-approves read and workspace-write tools. 'Yolo' auto-approves all tiers; user policy may still prompt or block.",
+        "description": "Default approval behavior for tool calls. 'Always ask' auto-approves read-only tools only. 'Ask and remember' also asks before file reads, and can remember a file or folder. 'Write' auto-approves read and workspace-write tools. 'Yolo' auto-approves all tiers; user policy may still prompt or block.",
         "options": [
           {
             "value": "always-ask",
             "label": "Always ask",
             "description": "Auto-approve read-only tools; require confirmation for write and exec tools."
           },
+          {
+            "value": "always-ask-cached",
+            "label": "Ask and remember",
+            "description": "Ask before reading or writing a file, with answers that remember the file or its folder for this session or every session; require confirmation for exec tools."
+          },
           {
             "value": "write",
             "label": "Write",
@@ -6199,6 +6248,32 @@
         "description": "Maximum screenshot height in pixels"
       }
     },
+    "computer.backgroundFallback": {
+      "type": "enum",
+      "default": "takeover",
+      "values": [
+        "takeover",
+        "refuse"
+      ],
+      "ui": {
+        "tab": "tools",
+        "group": "Computer",
+        "label": "Computer Background Fallback",
+        "description": "What window input does when its background route is unavailable: rerun it in takeover and return focus to your app (macOS; elsewhere plain takeover), or refuse, which also keeps the agent from taking the foreground or opening macOS menus itself",
+        "options": [
+          {
+            "value": "takeover",
+            "label": "Takeover",
+            "description": "Briefly bring the target forward for that one call, then return focus to your app (on macOS even if you kept typing)"
+          },
+          {
+            "value": "refuse",
+            "label": "Refuse",
+            "description": "Fail the call; nothing takes over, and the agent's own takeover, raise, activating open, desktop input and macOS menus (context menus, popup and menu buttons; they take your keyboard while open) are refused too"
+          }
+        ]
+      }
+    },
     "images.questionTimeoutMs": {
       "type": "number",
       "default": 300000,
@@ -6435,6 +6510,16 @@
         "description": "Enable async bash commands and background task execution"
       }
     },
+    "async.widgets": {
+      "type": "boolean",
+      "default": true,
+      "ui": {
+        "tab": "tools",
+        "group": "Execution",
+        "label": "Live Job Widgets",
+        "description": "Draw a live widget for each running background job (charts, bars, status grids derived from its output) in the wait card, the jobs pill and the jobs sheet. The `widget` model role (default: `smol`) writes one spec per job; updates need no further model calls"
+      }
+    },
     "tools.xdev": {
       "type": "boolean",
       "default": true,

package/src/client/hooks/ui/updates/android-download.test.ts

@@ -6,21 +6,22 @@
 import { describe, expect, test } from 'bun:test';
 
 import {
+  androidDownloadLabel,
   parseAndroidRelease,
   shouldOfferAndroidDownload,
   type AndroidDownload,
 } from '@/client/hooks/ui/updates/android-download';
 
-/**
- * The download button is a promise that a newer APK exists. These are the four
- * ways that promise can be wrong, and each must render nothing.
- */
-const RELEASE: AndroidDownload = {
+/** The published release every case compares against. */
+const RELEASE = {
   url: 'https://github.com/kabmo-labs/kabmo/releases/download/v1.2.3/kabmo-android-v1.2.3.apk',
   latest: '1.2.3',
   releaseUrl: 'https://github.com/kabmo-labs/kabmo/releases/tag/v1.2.3',
 };
 
+const UPDATE: AndroidDownload = { ...RELEASE, kind: 'update' };
+const INSTALL: AndroidDownload = { ...RELEASE, kind: 'install' };
+
 describe('parseAndroidRelease', () => {
   test('reads a complete payload', () => {
     expect(parseAndroidRelease(RELEASE)).toEqual(RELEASE);
@@ -44,30 +45,68 @@ describe('parseAndroidRelease', () => {
   });
 });
 
-describe('shouldOfferAndroidDownload', () => {
-  test('offers a newer release to the app', () => {
-    expect(shouldOfferAndroidDownload('1.2.2', RELEASE)).toEqual(RELEASE);
-  });
-
-  test('offers nothing to a browser', () => {
-    // No shell version means the page is not the APK; a browser has no app to
-    // update, and the app's own update badge already covers the server.
-    expect(shouldOfferAndroidDownload(null, RELEASE)).toBeNull();
-    expect(shouldOfferAndroidDownload(undefined, RELEASE)).toBeNull();
-    expect(shouldOfferAndroidDownload('', RELEASE)).toBeNull();
+describe('the offer inside the installed app', () => {
+  test('offers an UPDATE when a newer APK is published', () => {
+    expect(shouldOfferAndroidDownload('1.2.2', true, RELEASE)).toEqual(UPDATE);
   });
 
   test('offers nothing when the app is already current', () => {
-    expect(shouldOfferAndroidDownload('1.2.3', RELEASE)).toBeNull();
+    expect(shouldOfferAndroidDownload('1.2.3', true, RELEASE)).toBeNull();
   });
 
   test('offers nothing when the app is ahead', () => {
     // A sideloaded build newer than the published asset: downloading it would be
     // a downgrade.
-    expect(shouldOfferAndroidDownload('1.3.0', RELEASE)).toBeNull();
+    expect(shouldOfferAndroidDownload('1.3.0', true, RELEASE)).toBeNull();
   });
 
   test('offers nothing when the probe failed', () => {
-    expect(shouldOfferAndroidDownload('1.0.0', null)).toBeNull();
+    expect(shouldOfferAndroidDownload('1.0.0', true, null)).toBeNull();
+  });
+});
+
+describe('the offer to an Android browser', () => {
+  test('offers an INSTALL, because there is no installed version to compare', () => {
+    // The reported gap: a reader on Chrome or Brave for Android was told
+    // nothing, and the shell is exactly what they do not know exists.
+    expect(shouldOfferAndroidDownload(null, true, RELEASE)).toEqual(INSTALL);
+  });
+
+  test('offers an install even when the published APK is older than some build', () => {
+    // Nothing is installed here, so "newer than" has no left-hand side — the
+    // published asset is simply what the button names.
+    expect(shouldOfferAndroidDownload(undefined, true, { ...RELEASE, latest: '0.0.1' })).toEqual({
+      ...INSTALL,
+      latest: '0.0.1',
+    });
+  });
+
+  test('offers nothing when no APK is published', () => {
+    expect(shouldOfferAndroidDownload(null, true, null)).toBeNull();
+  });
+});
+
+describe('everywhere else', () => {
+  test('a desktop browser is offered nothing', () => {
+    // An APK cannot be installed there, and the app's own update badge already
+    // covers the server.
+    expect(shouldOfferAndroidDownload(null, false, RELEASE)).toBeNull();
+    expect(shouldOfferAndroidDownload(null, null, RELEASE)).toBeNull();
+    expect(shouldOfferAndroidDownload(null, undefined, RELEASE)).toBeNull();
+    expect(shouldOfferAndroidDownload('', false, RELEASE)).toBeNull();
+  });
+
+  test('the shell token alone is enough, even if the wider flag is missing', () => {
+    // `isAndroid` is derived from the same UA, so a stale bootstrap that predates
+    // the field must not silently drop the update offer.
+    expect(shouldOfferAndroidDownload('1.2.2', false, RELEASE)).toEqual(UPDATE);
+    expect(shouldOfferAndroidDownload('1.2.2', undefined, RELEASE)).toEqual(UPDATE);
+  });
+});
+
+describe('androidDownloadLabel', () => {
+  test('names the verb the reader needs', () => {
+    expect(androidDownloadLabel(UPDATE)).toBe('Update Kabmo 1.2.3 for Android');
+    expect(androidDownloadLabel(INSTALL)).toBe('Install Kabmo 1.2.3 for Android');
   });
 });

package/src/client/hooks/ui/updates/android-download.ts

@@ -1,31 +1,38 @@
 /**
- * Whether the sidebar should offer an APK download.
+ * What the sidebar should offer for the Android shell, and why.
  *
- * Two independent facts, and the button needs both:
+ * Two DIFFERENT offers, from two different facts:
  *
- * - **Running inside the Android app** (`shellVersion`, read from the bootstrap).
- *   In a browser there is no app to update, and a "Download APK" button there
- *   would be a second, unrelated offer sitting next to the app's own update
- *   badge.
- * - **A newer APK than the one running it** (`latest` > `shellVersion`). The
- *   published asset is attached to the app's release, so it moves on its own
- *   schedule; an up-to-date app must show nothing at all rather than a button
- *   that downloads the build already installed.
+ * - **`update`** — this page is running inside the APK (`shellVersion` from the
+ *   bootstrap) and a newer one is published. An up-to-date app offers nothing:
+ *   a button that downloads the build already installed is worse than no button.
+ * - **`install`** — this page is an Android BROWSER (Chrome, Brave, Firefox) and
+ *   an APK is published. The reader may not know a native shell exists, and
+ *   telling them is the whole point of the offer; there is no installed version
+ *   to compare against, so the newest published one is what it names.
  *
- * The probe is lazy: it is fetched once when a shell is detected, never in a
- * browser, so a desktop console makes no request it cannot use.
+ * A desktop browser gets neither: `isAndroid` is false, an APK cannot be
+ * installed there, and the app's own update badge already covers the server.
+ *
+ * The probe is lazy: it runs only on an Android device, never on a desktop, so a
+ * console that can never show the button makes no request for it.
  */
 
 import { useEffect, useState } from 'preact/hooks';
 import { isNewer } from '@/shared/lib/updates/semver';
 
+/** Which offer this is — the two carry different wording. */
+export type AndroidOfferKind = 'update' | 'install';
+
 export interface AndroidDownload {
-  /** The asset to download, or null when there is nothing to offer. */
+  /** The asset to download. */
   url: string;
   /** The version that asset ships. */
   latest: string;
   /** The release page, for a "what changed" link. */
   releaseUrl: string | null;
+  /** An update to an installed APK, or a first install from a browser. */
+  kind: AndroidOfferKind;
 }
 
 interface ReleasePayload {
@@ -41,7 +48,7 @@ interface ReleasePayload {
  * probe, so a shape check that only looks at the version would offer a button
  * with no link.
  */
-export function parseAndroidRelease(payload: unknown): AndroidDownload | null {
+export function parseAndroidRelease(payload: unknown): Omit<AndroidDownload, 'kind'> | null {
   if (typeof payload !== 'object' || payload === null) return null;
   const body = payload as ReleasePayload;
   if (typeof body.url !== 'string' || !body.url) return null;
@@ -54,23 +61,51 @@ export function parseAndroidRelease(payload: unknown): AndroidDownload | null {
 }
 
 /**
- * The download to offer, or null.
+ * The offer, or null.
+ *
+ * `shellVersion` is null in every browser — that is what makes the two branches
+ * mutually exclusive — and `isAndroid` is the wider fact that admits a browser
+ * ON ANDROID. Both come from the bootstrap rather than a client-side UA sniff:
+ * the server already parsed them for the very request that served the page.
  *
- * `shellVersion` is null in a browser — that is the whole gate, and it is why
- * this takes the bootstrap value rather than sniffing the UA again on the
- * client: the server already parsed it for the very request that served the
- * page.
+ * An `install` needs no version comparison, because nothing is installed. It
+ * does require a published APK: `release` being null is a failed probe, and a
+ * button the console cannot back with a link must not appear.
  */
 export function shouldOfferAndroidDownload(
   shellVersion: string | null | undefined,
-  release: AndroidDownload | null,
+  isAndroid: boolean | null | undefined,
+  release: Omit<AndroidDownload, 'kind'> | null,
 ): AndroidDownload | null {
-  if (!shellVersion || !release) return null;
-  return isNewer(release.latest, shellVersion) ? release : null;
+  if (!release) return null;
+
+  // Inside the APK: an update, and only when one exists.
+  if (shellVersion) {
+    return isNewer(release.latest, shellVersion) ? { ...release, kind: 'update' } : null;
+  }
+
+  // A browser on an Android device: the app is something to install.
+  if (isAndroid) return { ...release, kind: 'install' };
+
+  return null;
+}
+
+/**
+ * The wording of the offer, in one place.
+ *
+ * Both layouts draw this control and they must say the same thing: an installed
+ * app that is behind is an UPDATE, and a browser on Android is an INSTALL —
+ * "Download" for both would leave a first-time reader unsure whether they
+ * already have the app. The version is in the label because the asset is a
+ * specific build, not "the app".
+ */
+export function androidDownloadLabel(download: AndroidDownload): string {
+  const verb = download.kind === 'update' ? 'Update' : 'Install';
+  return `${verb} Kabmo ${download.latest} for Android`;
 }
 
 /**
- * Fetch the published APK and compare it with the running shell.
+ * Fetch the published APK and decide what to offer.
  *
  * `fetchImpl` is a seam for the tests: the cases that matter (no release, a
  * failed probe, a version equal to the installed one) cannot be produced by a
@@ -78,12 +113,14 @@ export function shouldOfferAndroidDownload(
  */
 export function useAndroidDownload(
   shellVersion: string | null | undefined,
+  isAndroid: boolean | null | undefined,
   fetchImpl: typeof fetch = fetch,
 ): AndroidDownload | null {
-  const [release, setRelease] = useState<AndroidDownload | null>(null);
+  const [release, setRelease] = useState<Omit<AndroidDownload, 'kind'> | null>(null);
+  const wanted = Boolean(shellVersion) || Boolean(isAndroid);
 
   useEffect(() => {
-    if (!shellVersion) return;
+    if (!wanted) return;
 
     let cancelled = false;
     void (async () => {
@@ -100,7 +137,7 @@ export function useAndroidDownload(
     return () => {
       cancelled = true;
     };
-  }, [shellVersion, fetchImpl]);
+  }, [wanted, fetchImpl]);
 
-  return shouldOfferAndroidDownload(shellVersion, release);
+  return shouldOfferAndroidDownload(shellVersion, isAndroid, release);
 }

package/src/server/lib/panels/git-update.server.test.ts

@@ -16,7 +16,7 @@
  * environment condition, not a bug, so the suite is skipped rather than failed.
  */
 
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, setDefaultTimeout, test } from 'bun:test';
 import fs from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -29,6 +29,23 @@ import { removeDir } from '@/test-support/remove-dir';
 
 const hasGit = Boolean(Bun.which('git'));
 
+/**
+ * The suite drives REAL git processes — `init`, `add`, `commit`, `ls-remote`,
+ * `fetch`, `reset`, and a plugin build — and one test of it pays for most of
+ * them. Bun's default per-test budget is 5s, which a Linux runner clears in
+ * ~1.2s and a Windows runner does not: measured on `windows-latest`, the update
+ * test timed out at 5072ms and failed `expect(result.ok).toBe(true)` because the
+ * timeout fired mid-await (the run reported 1 fail + 1 unhandled error, and the
+ * suite is green locally). Process spawn on that runner costs several times what
+ * it does on POSIX, and this is the only suite here that spawns this many.
+ *
+ * A budget, not a skip: the behaviour under test — a shallow clone advancing past
+ * its boundary — is identical on both platforms, and skipping it there would
+ * report the update path as unverified on the platform the CLI ships to.
+ */
+const GIT_TEST_TIMEOUT_MS = 30_000;
+setDefaultTimeout(GIT_TEST_TIMEOUT_MS);
+
 let root = '';
 let work = '';