fix(install,test): exclude cowork from --target all + stabilize defer-start timer test (#1191)

* fix(install,test): exclude cowork from --target all + stabilize defer-start timer test

active_targets() for explicit_target='all' (project scope) was returning
KNOWN_TARGETS minus EXPLICIT_ONLY_TARGETS, which still includes the
experimental copilot-cowork target. Cowork is user-scope-only, so the
unconditional project-scope gate in phases/targets.py raised SystemExit
and aborted any 'apm install --target all' invocation. This made gh-aw
shared workflows that pin 'target: all' unusable (run 25511043293).

Excluding EXPERIMENTAL_TARGETS from the 'all' expansion matches the
documented contract on EXPERIMENTAL_TARGETS in core/target_detection.py
('NOT included in parse_target_arg("all") expansion -- explicit opt-in
only'). Updated three test_targets.py expectations and flipped
test_cowork_absent_from_all_when_flag_off, which previously asserted
the buggy behaviour with a misleading 'this is documented' comment.
Added a parallel test for the flag-on case.

Separately, test_install_over_defer_threshold_starts_live_once was
flaky on macOS x86_64 (run 25496089562) because it waited only 100ms
beyond _DEFER_SHOW_S before asserting the mocked _defer_start fired.
threading.Timer scheduling under parallel pytest-xdist load can slip
past that window. Joining tui._timer with a 2s timeout before the with
block exits makes the assertion deterministic.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(changelog): backfill PR number #1191

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Daniel Meppiel <copilot-rework@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

CHANGELOG.md

@@ -14,6 +14,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - `shared/apm.md` no longer wraps the `target` input in a `|| 'all'` fallback. The defensive expression broke gh-aw's bare-expression substitution regex, causing consumer-supplied `target:` values to be silently dropped; the `import-schema` default already covers the omitted-input case. (#1185)
+- `apm install --target all` no longer enumerates the experimental `copilot-cowork` target, which was crashing project-scope installs with a "requires --global" error and made `gh aw` workflows that pin `target: all` unusable. (#1191)
+- Stabilized `test_install_over_defer_threshold_starts_live_once` on slow CI runners by joining the deferred-start timer thread instead of relying on a 100ms grace window. (#1191)
 
 ## [0.12.4] - 2026-05-07
 

src/apm_cli/integration/targets.py

@@ -775,14 +775,24 @@ def active_targets(
         for t in raw:
             canonical = "copilot" if t in ("copilot", "vscode", "agents") else t
             if canonical == "all":
-                # Return all targets regardless of flag gating.
                 # Exclude explicit-only targets (agent-skills) -- they must
                 # be requested individually.
-                # The project-scope gate in phases/targets.py and
-                # for_scope() handle user-observable blocking.
-                from apm_cli.core.target_detection import EXPLICIT_ONLY_TARGETS
+                # Exclude experimental targets (copilot-cowork) -- they must
+                # be opted into explicitly via `--target copilot-cowork`,
+                # matching the documented contract on EXPERIMENTAL_TARGETS in
+                # core/target_detection.py. Including cowork in `all` for
+                # project scope hits the unconditional project-scope gate in
+                # phases/targets.py and aborts the entire install (#1185 b).
+                from apm_cli.core.target_detection import (
+                    EXPERIMENTAL_TARGETS,
+                    EXPLICIT_ONLY_TARGETS,
+                )
 
-                return [p for p in KNOWN_TARGETS.values() if p.name not in EXPLICIT_ONLY_TARGETS]
+                return [
+                    p
+                    for p in KNOWN_TARGETS.values()
+                    if p.name not in EXPLICIT_ONLY_TARGETS and p.name not in EXPERIMENTAL_TARGETS
+                ]
             profile = KNOWN_TARGETS.get(canonical)
             if profile and _flag_gated(profile) and profile.name not in seen:
                 seen.add(profile.name)

tests/unit/integration/test_copilot_cowork_target.py

@@ -160,17 +160,29 @@ def test_cowork_absent_when_flag_off_explicit_cowork(
         assert results == []
 
     def test_cowork_absent_from_all_when_flag_off(self, tmp_path: Path, inject_config: Any) -> None:
+        """`--target all` (project scope) must NOT include cowork.
+
+        cowork is in EXPERIMENTAL_TARGETS; per the documented contract in
+        core/target_detection.py it is opt-in only -- explicit
+        ``--target copilot-cowork`` -- and never resolved via ``all``.
+        Including it in the project-scope ``all`` set hits the
+        project-scope gate in phases/targets.py and aborts the install.
+        """
         inject_config({"experimental": {"copilot_cowork": False}})
         results = active_targets(tmp_path, explicit_target="all")
         names = [t.name for t in results]
-        # "all" returns all targets regardless of flag gating
-        # but explicit_target="copilot-cowork" with flag off returns []
-        # The "all" path returns list(KNOWN_TARGETS.values()) which
-        # includes cowork. This is documented: "all" bypasses flag gate.
-        # So cowork IS in the "all" set even when flag is off.
-        # This matches the implementation comment:
-        # "Return all targets regardless of flag gating."
-        assert "copilot-cowork" in names
+        assert "copilot-cowork" not in names
+
+    def test_cowork_absent_from_all_when_flag_on(self, tmp_path: Path, inject_config: Any) -> None:
+        """`--target all` (project scope) excludes cowork even when the
+        experimental flag is enabled. cowork is user-scope only and the
+        project-scope gate would error otherwise; ``all`` honors the
+        documented EXPERIMENTAL_TARGETS exclusion regardless of flag.
+        """
+        inject_config({"experimental": {"copilot_cowork": True}})
+        results = active_targets(tmp_path, explicit_target="all")
+        names = [t.name for t in results]
+        assert "copilot-cowork" not in names
 
     def test_cowork_absent_when_flag_on_resolver_returns_none(
         self, tmp_path: Path, inject_config: Any

tests/unit/integration/test_targets.py

@@ -76,10 +76,17 @@ def test_explicit_claude(self):
         assert [t.name for t in targets] == ["claude"]
 
     def test_explicit_all_returns_every_known_target(self):
-        from apm_cli.core.target_detection import EXPLICIT_ONLY_TARGETS
+        from apm_cli.core.target_detection import (
+            EXPERIMENTAL_TARGETS,
+            EXPLICIT_ONLY_TARGETS,
+        )
 
         targets = active_targets(self.root, explicit_target="all")
-        assert len(targets) == len(KNOWN_TARGETS) - len(EXPLICIT_ONLY_TARGETS)
+        expected = len(KNOWN_TARGETS) - len(EXPLICIT_ONLY_TARGETS) - len(EXPERIMENTAL_TARGETS)
+        assert len(targets) == expected
+        names = [t.name for t in targets]
+        assert "copilot-cowork" not in names
+        assert "agent-skills" not in names
 
     def test_explicit_vscode_alias(self):
         targets = active_targets(self.root, explicit_target="vscode")
@@ -193,17 +200,25 @@ def test_explicit_list_deduplicates_aliases(self):
         assert [t.name for t in targets] == ["copilot"]
 
     def test_explicit_list_with_all_returns_every_known_target(self):
-        from apm_cli.core.target_detection import EXPLICIT_ONLY_TARGETS
+        from apm_cli.core.target_detection import (
+            EXPERIMENTAL_TARGETS,
+            EXPLICIT_ONLY_TARGETS,
+        )
 
         targets = active_targets(self.root, explicit_target=["all"])
-        assert len(targets) == len(KNOWN_TARGETS) - len(EXPLICIT_ONLY_TARGETS)
+        expected = len(KNOWN_TARGETS) - len(EXPLICIT_ONLY_TARGETS) - len(EXPERIMENTAL_TARGETS)
+        assert len(targets) == expected
 
     def test_explicit_list_all_mixed_returns_every_known_target(self):
         """'all' anywhere in the list wins."""
-        from apm_cli.core.target_detection import EXPLICIT_ONLY_TARGETS
+        from apm_cli.core.target_detection import (
+            EXPERIMENTAL_TARGETS,
+            EXPLICIT_ONLY_TARGETS,
+        )
 
         targets = active_targets(self.root, explicit_target=["claude", "all"])
-        assert len(targets) == len(KNOWN_TARGETS) - len(EXPLICIT_ONLY_TARGETS)
+        expected = len(KNOWN_TARGETS) - len(EXPLICIT_ONLY_TARGETS) - len(EXPERIMENTAL_TARGETS)
+        assert len(targets) == expected
 
     def test_explicit_list_all_unknown_returns_empty(self):
         """When the parser is bypassed and all tokens are unknown, the

tests/unit/test_install_tui.py

@@ -132,12 +132,16 @@ def test_install_over_defer_threshold_starts_live_once(
             with patch.object(InstallTui, "_defer_start", autospec=True) as mock_defer:
                 with tui:
                     # Sleep slightly longer than the defer window so the
-                    # timer fires before __exit__ cancels it.
+                    # timer fires before __exit__ cancels it, then join the
+                    # Timer thread to deterministically wait for the
+                    # callback to complete. Without the join this test is
+                    # flaky on busy CI runners where threading.Timer
+                    # scheduling can slip past a fixed grace window.
                     time.sleep(_DEFER_SHOW_S + 0.10)
-                # Either the timer fired (preferred) or it was cancelled.
-                # We assert at most one call -- never multiple.
-                assert mock_defer.call_count <= 1
-                # In the typical case the timer fires; assert it did.
+                    if tui._timer is not None:
+                        tui._timer.join(timeout=2.0)
+                # The timer must have fired exactly once (deterministic
+                # via the join above).
                 assert mock_defer.call_count == 1