Review round on #758.
bash.run() only promises to resolve for nonzero exits, timeouts, and aborts,
and bash.resolve() can reject on policy grounds, so either could escape the
serial agent/step listener and abort the model turn — contradicting the
plugin's documented failed-query no-op contract. Contain both and log a
warning instead; the location is optional context.
The Agent Note claimed an unchanged location suppresses the query. It does
not: only the interval floor is checked before the query, while change
suppression compares state the query returned. Corrected in both languages
and re-recorded the i18n pairs.
The headless-agent test fixtures and the e2e test that depended on them
are out of scope for this PR. Unit tests in tmux-context.spec.ts cover
the plugin behavior.
The headless-agent test fixtures were removed; move the driver, cordis.yml,
and mocks into packages/context/tmux-context/tests/fixtures/ so the e2e test
is self-contained.
TestWorkspaces.listDirectory now records the signal and passes it to the
installed stub, mirroring the production face, so cancellation
integration tests can observe or reject on a superseded scan instead of
the harness silently dropping it.
Supersession (newer navigation, path editing, closing, unmount) now
aborts the in-flight listing's request instead of only discarding its
result: the browser mints an AbortController per listing, the signal
rides the workspace face (IWorkspaces.listDirectory gains an optional
signal) onto the fetch carrier, and the Host scan stops with it (817's
cancellation chain). apps/cli keeps both picker packages as dependencies
so the documented one-row cordis.yml swap to the native backend resolves
at boot.
Same contract as the path editor: trim only rejects an all-whitespace
draft, and the Host receives the original spelling — the backend accepts
any non-blank single segment verbatim, so trimming here would create and
select a different sibling.
Trim now only detects a blank draft; the original text navigates — a
real directory name may end in whitespace, and trimming would list its
sibling or adopt the wrong workspace.
The aborted exit no longer awaits close (Node queues it behind any
in-flight read, chaining the departed caller back onto the very stall
the abort escaped) — the abandoned close's failure is swallowed, it has
no consumer. Symlink stat probes race the signal too, with a
per-candidate abort check between probes, so a stalled probe target
cannot keep a departed request alive. The deferred handle cleanup after
a lost opendir race now consumes its own close failure instead of
leaking it as an unhandled rejection.
The confirm/cancel pair wraps onto its own row when the viewport-clamped
card is too narrow for the whole footer, so Open stays visible instead
of clipping past the card's hidden overflow.
Every filesystem await in the browse scan (opendir and each read) now
races the signal through raceAbort, so a stalled network open/read stops
with a departed caller and an already-aborted request rejects even for
an empty level; the abandoned settlement is swallowed and an abandoned
open that still mints a handle is closed, never leaked. apiproxy maps an
aborted listing to the cancelled wire code, matching pickDirectory and
command.execute, instead of reporting a false internal failure. The
fixture spec call sites gain the wire signal argument the previous
commit's static lane flagged.
