Summary

Adds focused regression coverage for residual high-risk seams outside open coverage PRs #298–#303 (main tip still at fa5c0f68). Also refreshes canary mobile lockfile + research-readiness desktop bridge stabilizers used by CI.

Risky behavior now covered

• Cowork runtime tool env fail-closed: missing/untrusted COWORK_RUNTIME_DIR strips all COWORK_RUNTIME_* keys and logs a block; disable flag leaves env untouched; instruction rendering requires NODE_MODULES and includes optional Node/Python/soffice paths.
• MCP connect retry/backoff: transient failures sleep with increasing backoff, exhaust attempts with a counted error, and invalid retries fall back to the default of 3.
• Control-session bootstrap budget exhaustion: when socket ready consumes the full wait budget, waitForControlSession returns false without treating a pending bootstrap as ready.
• Provider API-key copy validation: non-OpenCode sibling pairs and unsupported providers are rejected with validation_failed before any connect attempt.

Test files added/updated

• test/coworkRuntime.prepareToolEnv.test.ts (added)
• test/mcp.retry.test.ts (added)
• apps/desktop/test/control-socket.ensure.test.ts (updated)
• test/session/agentSession.provider.test.ts (updated)
• apps/desktop/test/research-readiness.test.tsx (CI stabilizer)
• apps/mobile/bun.lock (canary lockfile refresh)

Why these tests materially reduce regression risk

These paths gate first-turn tooling availability, cold-start control readiness, and cross-provider auth key movement. Silent strip/retry/budget mistakes and over-broad key-copy acceptance are easy to regress without direct assertions and have large blast radius across agent turns and desktop startup.

Validation

• Targeted suites green
• Touched files Biome-clean (biome check)
• bun run lint, bun run typecheck, bun run docs:check clean
• Full bun run test: all 674 files passed (Bun 1.4.0-canary)

Notes

Avoided duplicating open #298–#303 seams. Deferred control-sync timeout silent path still depends on #298’s timeout override landing on main.