fix(higgsfield): report upstream drift on every enable; final review fixes

lib/higgsfield-skills.sh

@@ -59,15 +59,19 @@ higgsfield_sync_skills() {
 }
 
 # _higgsfield_probe <args...>
-# Run `higgsfield <args>` silently, 15 s at most when `timeout` exists. The
-# CLI is closed source: a probe must never hang an installer, and what it
-# prints (a token, for `auth token`) must never reach a terminal or a log.
+# Run `higgsfield <args>` silently, 15 s at most when a timeout tool exists
+# (`timeout`, or `gtimeout` from Homebrew coreutils on macOS). The CLI is
+# closed source: a probe must never hang an installer, and what it prints
+# (a token, for `auth token`) must never reach a terminal or a log.
 _higgsfield_probe() {
-  if command -v timeout >/dev/null 2>&1; then
-    timeout 15 higgsfield "$@" </dev/null >/dev/null 2>&1
-  else
-    higgsfield "$@" </dev/null >/dev/null 2>&1
-  fi
+  local tool
+  for tool in timeout gtimeout; do
+    if command -v "$tool" >/dev/null 2>&1; then
+      "$tool" 15 higgsfield "$@" </dev/null >/dev/null 2>&1
+      return
+    fi
+  done
+  higgsfield "$@" </dev/null >/dev/null 2>&1
 }
 
 # higgsfield_cli_ok — 0 when the binary answers. `command -v` alone only

lib/tests/higgsfield.test.sh

@@ -110,7 +110,8 @@ probe() {
 
 # ── sync ────────────────────────────────────────────────────
 UP="$WORK/upstream"; mk_upstream "$UP"
-R1="$WORK/r1"; mkdir -p "$R1/skills" "$R1/skills-disabled"
+# The repo path carries a space on purpose: every expansion must be quoted.
+R1="$WORK/r 1"; mkdir -p "$R1/skills" "$R1/skills-disabled"
 EXT="$R1/skills-external"
 
 expect fixture  "$(yn test -f "$UP/.git/HEAD")" yes
@@ -162,6 +163,12 @@ expect shim-only   \
   "$(FAKE_HF_BINARY=missing probe "$BIN:$PATH" higgsfield_cli_ok)" "rc=1"
 expect no-cli      "$(probe "$CLEAN" higgsfield_cli_ok)" "rc=127"
 expect no-timeout  "$(probe "$BIN:$CLEAN" higgsfield_cli_ok)" "rc=0"
+# macOS spelling: only `gtimeout` exists. A wrapper, not a symlink: a
+# multi-call coreutils binary dispatches on the name it is invoked under.
+GT="$WORK/gtbin"; mkdir -p "$GT"
+printf '#!/bin/sh\nexec %s "$@"\n' "$(command -v timeout)" > "$GT/gtimeout"
+chmod +x "$GT/gtimeout"
+expect gtimeout    "$(probe "$BIN:$GT:$CLEAN" higgsfield_signed_in)" "rc=0"
 verdict PROBES_SILENT
 
 # ── toggle ──────────────────────────────────────────────────
@@ -216,7 +223,7 @@ verdict ENABLE_PACK_EXCLUDES_WEBSITES
 
 # The media pack is an allowlist: a synced skill nobody listed is reported,
 # never linked; neither is a listed name whose directory holds no SKILL.md.
-F8="$WORK/f8"; mk_toggle_fx "$F8" "${PACK[@]}" higgsfield-newcomer
+F8="$WORK/f 8"; mk_toggle_fx "$F8" "${PACK[@]}" higgsfield-newcomer
 mkdir -p "$F8/skills-external/higgsfield-brandkit" \
   "$F8/skills-external/higgsfield-noskill"
 out="$(tog "$F8" enable higgsfield)"; rc=$?
@@ -227,6 +234,11 @@ expect brandkit-off "$(yn test -e "$F8/skills/higgsfield-brandkit")" no
 expect_has reported "$out" "higgsfield-newcomer"
 expect_not noskill-quiet "$out" "higgsfield-noskill"
 expect links "$(entries "$F8/skills")" 2
+# Enabled is the steady state: a re-run must still name the drift.
+out="$(tog "$F8" enable higgsfield)"; rc=$?
+expect again-rc "$rc" 0
+expect_has again-state "$out" "higgsfield already enabled"
+expect_has again-reported "$out" "higgsfield-newcomer"
 verdict UNLISTED_NOT_LINKED
 
 F3="$WORK/f3"; mk_toggle_fx "$F3" "${PACK[@]}"

lib/toggle-external.sh

@@ -113,17 +113,21 @@ pack_skills() {
   esac
 }
 
-# bounded <cmd...> — run a CLI probe silently, 15 s at most when `timeout`
-# exists: a closed-source binary must never hang a toggle, and what it
-# prints (a token) must never reach the terminal. Twin of
-# _higgsfield_probe in lib/higgsfield-skills.sh, kept here because this
-# script takes no extra `source` (the fixture suites copy it alone).
+# bounded <cmd...> — run a CLI probe silently, 15 s at most when a timeout
+# tool exists (`timeout`, or `gtimeout` from Homebrew coreutils on macOS):
+# a closed-source binary must never hang a toggle, and what it prints (a
+# token) must never reach the terminal. Twin of _higgsfield_probe in
+# lib/higgsfield-skills.sh, kept here because this script takes no extra
+# `source` (the fixture suites copy it alone).
 bounded() {
-  if command -v timeout >/dev/null 2>&1; then
-    timeout 15 "$@" </dev/null >/dev/null 2>&1
-  else
-    "$@" </dev/null >/dev/null 2>&1
-  fi
+  local tool
+  for tool in timeout gtimeout; do
+    if command -v "$tool" >/dev/null 2>&1; then
+      "$tool" 15 "$@" </dev/null >/dev/null 2>&1
+      return
+    fi
+  done
+  "$@" </dev/null >/dev/null 2>&1
 }
 
 # Post-enable notes for a pack. Its skills shell out to a CLI: without it
@@ -322,6 +326,9 @@ enable_tool() {
           return 1
         fi
         warn "$tool already enabled"
+        # Enabled is the steady state, and Claude re-runs this on every
+        # media ask: the hints (upstream drift, CLI, session) show here too.
+        if [ "$tool" = "higgsfield" ]; then pack_hints higgsfield; fi
         return 0
       fi
       ok "$tool enabled ($((restored + linked)) skills: $restored restored, $linked linked)"