fix(android): let only a clean adb exit prove clipboard support

Third review P1 on #2021. The typed verdict landed one layer too high. The
adapter probe runs `adb shell cmd clipboard get text` with `allowFailure`, so a
non-zero exit comes back as an ordinary result rather than a throw — and the
only thing standing between that result and `supported` was the missing-shell
prose check. A device that had gone offline, was unauthorized, timed out, or
failed for any other reason produced none of that prose, so it fell through to
`supported` and was then cached by device id for the runtime owner's lifetime.
The `catch` I added guarded the one path adb almost never takes.

Each adb outcome now proves only what it can:

- `exitCode === 0` is the sole evidence of support, because it is the only
  result that shows the command ran.
- The recognized missing-shell prose is the sole evidence of absence, and is
  read before the exit code — adb reports that condition non-zero, so checking
  the code first would turn every honest `unsupported` into a refusal.
- Everything else — non-zero without that prose, and the transport throw — is
  `probe-failed`, which admission refuses and the cache does not remember.

The package tests mocked the typed verdict, so they sat downstream of the bug
and could not see it. The regression is therefore at the adapter, over the raw
adb result: four planted reds (offline, unauthorized, device-not-found, generic
failure) that all returned `supported` before this change, plus the two
definitive verdicts and the ordering case that keeps `unsupported` reachable.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019RpfS12XApXqasuAWZJaEX

Author: claude

src/__tests__/platform-runtime-android-clipboard-probe.test.ts

@@ -0,0 +1,74 @@
+import { describe, expect, test, vi } from 'vitest';
+import type { DeviceInfo } from '@agent-device/kernel/device';
+import { createAndroidToolHost } from '../platform-runtime-android-tool-host.ts';
+
+const runAndroidAdb = vi.hoisted(() => vi.fn());
+
+vi.mock('../platforms/android/adb.ts', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../platforms/android/adb.ts')>()),
+  runAndroidAdb,
+}));
+
+const device: DeviceInfo = {
+  platform: 'android',
+  id: 'emulator-5554',
+  name: 'Pixel 9 Pro XL',
+  kind: 'emulator',
+  booted: true,
+};
+
+function adbResult(exitCode: number, stdout = '', stderr = '') {
+  return { exitCode, stdout, stderr, stdoutBuffer: Buffer.from(stdout) };
+}
+
+async function probe() {
+  const host = createAndroidToolHost();
+  return await host.probeClipboardShellSupport?.(device);
+}
+
+// The probe runs with `allowFailure`, so every adb outcome short of a transport throw arrives as an
+// ordinary result. Anything the adapter reports as `supported` is cached for the runtime owner's
+// lifetime, so a wrong admission here is not a single bad answer -- it advertises a clipboard the
+// build may not have until the daemon restarts.
+describe('android clipboard shell probe: what each adb result is allowed to prove', () => {
+  test('a clean exit is the only thing that proves support', async () => {
+    runAndroidAdb.mockResolvedValueOnce(adbResult(0, 'clipboard contents'));
+    await expect(probe()).resolves.toBe('supported');
+  });
+
+  test('an empty clipboard on a clean exit still proves support', async () => {
+    runAndroidAdb.mockResolvedValueOnce(adbResult(0, ''));
+    await expect(probe()).resolves.toBe('supported');
+  });
+
+  test('the missing-shell prose proves the build ships no clipboard command', async () => {
+    runAndroidAdb.mockResolvedValueOnce(
+      adbResult(255, '', 'Error: no shell command implementation.'),
+    );
+    await expect(probe()).resolves.toBe('unsupported');
+  });
+
+  // The planted red: before the fix every non-zero result that lacked the missing-shell prose fell
+  // through to `supported`, so an offline device advertised a working clipboard.
+  test.each([
+    ['a device that dropped off the bridge', 'error: device offline'],
+    ['an unauthorized device', 'error: device unauthorized.'],
+    ['a bridge that never found the device', "error: device '(null)' not found"],
+    ['a generic adb failure', 'error: closed'],
+  ])('%s refuses rather than admitting support', async (_case, stderr) => {
+    runAndroidAdb.mockResolvedValueOnce(adbResult(1, '', stderr));
+    await expect(probe()).resolves.toBe('probe-failed');
+  });
+
+  test('a transport throw refuses rather than admitting support', async () => {
+    runAndroidAdb.mockRejectedValueOnce(new Error('spawn adb ENOENT'));
+    await expect(probe()).resolves.toBe('probe-failed');
+  });
+
+  // Recognized absence outranks the exit code: adb reports the missing shell command non-zero, so
+  // reading the code first would turn every honest `unsupported` into a refusal.
+  test('missing-shell prose on a non-zero exit still reads as unsupported', async () => {
+    runAndroidAdb.mockResolvedValueOnce(adbResult(1, '', 'Unknown command: clipboard'));
+    await expect(probe()).resolves.toBe('unsupported');
+  });
+});

src/platform-runtime-android-tool-host.ts

@@ -4,9 +4,13 @@ import type { AndroidToolHost } from '@agent-device/contracts/platform';
 export function createAndroidToolHost(): AndroidToolHost {
   return Object.freeze({
     /**
-     * Definitive in both directions where adb answers, and honest when it does not: a transport
-     * failure reports `probe-failed` rather than a guess, so admission can refuse instead of
-     * fabricating availability the operation would then reject.
+     * Definitive in both directions only where adb actually answers, and honest everywhere else.
+     * The probe runs with `allowFailure`, so a device that is offline, unauthorized, timed out or
+     * otherwise broken comes back as an ordinary non-zero result rather than a throw: only a clean
+     * exit proves the clipboard shell command exists, and only the recognized missing-shell prose
+     * proves it does not. Every other result -- non-zero without that prose, or a transport throw
+     * -- is `probe-failed`, so admission refuses instead of caching availability the operation
+     * would then reject.
      */
     probeClipboardShellSupport: async (device, signal) => {
       try {
@@ -16,9 +20,8 @@ export function createAndroidToolHost(): AndroidToolHost {
           allowFailure: true,
           signal,
         });
-        return isClipboardShellUnsupported(result.stdout, result.stderr)
-          ? 'unsupported'
-          : 'supported';
+        if (isClipboardShellUnsupported(result.stdout, result.stderr)) return 'unsupported';
+        return result.exitCode === 0 ? 'supported' : 'probe-failed';
       } catch {
         return 'probe-failed';
       }