sync: upstream 5d32f372e7 into swaplabs/main

.github/CONTRIBUTING.md

@@ -90,11 +90,14 @@ pnpm build
 ```
 
 For repeated local typechecks, use `pnpm tc` (or `pnpm tc:node`, `pnpm tc:web`,
-and `pnpm tc:cli`). These run `bun check` from the pinned `bun` devDependency —
-about a third of tsc's CPU and an eighth of its memory, so several agents can
-typecheck at once. Pass `--compiler=native` to use tsc and its incremental
-cache instead. CI uses `pnpm typecheck:ci`, the same Bun check with CI's
-concurrency. Shared tests are checked by the
+and `pnpm tc:cli`). On Apple Silicon macOS and x64/arm64 Linux, these use the pinned
+`tsrs` compiler with incremental caches. Keep `.cache/typecheck/` between checks;
+delete it to force a fresh check. Caches are separate for each project, compiler
+version, and worktree. At most two projects run together, subject to the memory budget.
+Windows, Intel macOS, and other unsupported platforms use pinned Bun automatically.
+Pass `--compiler=bun` to explicitly use Bun, or `--compiler=native` to use TypeScript.
+CI uses `pnpm typecheck:ci`, which explicitly selects Bun and its CI concurrency.
+Shared tests are checked by the
 Node project; shared production code is checked in all three environments.
 Run `pnpm tc:node` after editing shared tests, or `pnpm tc` to check everything.
 

.github/actions/cloud-sql-rollout-lease/README.md

@@ -137,7 +137,7 @@ runners; only the compare-and-swap algorithm is shared with the fence broker.
 ## Duplication
 
 This directory is copied verbatim into `stablyai/orca`. It has no `package.json`, no
-`node_modules`, and imports nothing outside itself — `action-contract.test.mjs` enforces all three.
+`node_modules`, and imports nothing outside itself. Keep it self-contained when updating the action.
 Cross-repo consumption via `uses: stablyai/orca/.github/actions/...@<sha>` was rejected: it would
 put public-repo code inside private app deploys that hold a production credential, and neither
 repository protects `main` today.

.github/actions/cloud-sql-rollout-lease/action-contract.test.mjs

@@ -1,11 +1,9 @@
 import assert from 'node:assert/strict'
-import { readFileSync, readdirSync } from 'node:fs'
+import { readFileSync } from 'node:fs'
 import { test } from 'node:test'
 
 const here = new URL('./', import.meta.url)
 const action = readFileSync(new URL('action.yml', here), 'utf8')
-const modules = readdirSync(here).filter((name) => name.endsWith('.mjs'))
-const shipped = modules.filter((name) => !name.endsWith('.test.mjs'))
 
 test('is a node24 JavaScript action with an always-run post step', () => {
   // A composite action has no `post:`, so the lease could never be released on cancel or failure.
@@ -23,30 +21,3 @@ test('declares the inputs the wave-chain callers depend on', () => {
   assert.match(action, /default: \$\{\{ github\.repository \}\}\/\$\{\{ github\.run_id \}\}/)
   assert.match(action, /default: 'true'/)
 })
-
-test('stays self-contained so it can be duplicated into the public repo', () => {
-  assert.deepEqual(
-    readdirSync(here).filter((name) => name === 'package.json' || name === 'node_modules'),
-    [],
-    'the action must run with zero installed dependencies'
-  )
-  for (const name of modules) {
-    const source = readFileSync(new URL(name, here), 'utf8')
-    for (const match of source.matchAll(/^import\b[\s\S]*?from '([^']+)'/gm)) {
-      const specifier = match[1]
-      const local = specifier.startsWith('.')
-      assert.ok(
-        specifier.startsWith('node:') || (local && !specifier.includes('..')),
-        `${name} imports ${specifier}; only node: builtins and same-directory modules are allowed`
-      )
-    }
-  }
-})
-
-test('never reaches for the GCE metadata server', () => {
-  // Runners have no metadata.google.internal; the fence broker's token path must not be copied.
-  for (const name of shipped) {
-    const source = readFileSync(new URL(name, here), 'utf8')
-    assert.doesNotMatch(source, /metadata\.google\.internal/, name)
-  }
-})

.github/scripts/prepare-ubuntu-apt.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# GitHub's mirror+file sources resolve through apt-mirrors.txt, not just sources.list.
+for source in /etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
+  if [ -f "$source" ]; then
+    sudo sed -i 's|https*://azure\.archive\.ubuntu\.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' "$source"
+  fi
+done
+sudo tee /etc/apt/apt.conf.d/99-orca-ci >/dev/null <<'APTCONF'
+Acquire::http::Timeout "15";
+Acquire::https::Timeout "15";
+Acquire::Retries "1";
+APTCONF

.github/workflows/ci-closed-pr-caches.yml

@@ -47,7 +47,6 @@ jobs:
               ['ci-cache-warmup-platforms', 'ci-cache-warmup-platforms.yml'],
               ['pi-owner-runtime', 'pi-owner-runtime.yml'],
               ['git-command-termination', 'git-command-termination-runtime.yml'],
-              ['skill-roundtrip-pull_request', 'skill-update-roundtrip.yml'],
               ['ci-cache-warmup', 'ci-cache-warmup.yml']
             ]
             const stillCurrent = async () => {

.github/workflows/e2e.yml

@@ -88,17 +88,21 @@ jobs:
             exit 0
           fi
           read -r -a packages <<< "$ORCA_E2E_APT_PACKAGES"
-          # Why apt-mirrors.txt: runner images resolve mirror+file: sources through it, so editing the lists alone leaves Azure in use.
-          for source in /etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
-            if [ -f "$source" ]; then
-              sudo sed -i 's|https*://azure\.archive\.ubuntu\.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' "$source"
-            fi
-          done
-          sudo tee /etc/apt/apt.conf.d/99-orca-e2e >/dev/null <<'APTCONF'
+          if [ -f .github/scripts/prepare-ubuntu-apt.sh ]; then
+            bash .github/scripts/prepare-ubuntu-apt.sh
+          else
+            # Dispatched refs can predate the shared preparation script.
+            for source in /etc/apt/apt-mirrors.txt /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
+              if [ -f "$source" ]; then
+                sudo sed -i 's|https*://azure\.archive\.ubuntu\.com/ubuntu|https://archive.ubuntu.com/ubuntu|g' "$source"
+              fi
+            done
+            sudo tee /etc/apt/apt.conf.d/99-orca-ci >/dev/null <<'APTCONF'
           Acquire::http::Timeout "15";
           Acquire::https::Timeout "15";
           Acquire::Retries "1";
           APTCONF
+          fi
           timeout 120 sudo apt-get update
           timeout 300 sudo apt-get install -y "${packages[@]}" || timeout 300 sudo apt-get install -y --fix-missing "${packages[@]}"
 

.github/workflows/layout-owner-e2e.yml

@@ -25,7 +25,7 @@ jobs:
     uses: ./.github/workflows/e2e.yml
     with:
       ref: ${{ inputs.ref || github.sha }}
-      test_files: '["tests/e2e/workspace-layout-oracle-headless.spec.ts","tests/e2e/workspace-layout-oracle.spec.ts","tests/e2e/cli-file-open-position.spec.ts","tests/e2e/relaunch-first-terminal.spec.ts","tests/e2e/relaunch-sleeping-agents-resume-on-view.spec.ts","tests/e2e/terminal-cold-activation-deferral.spec.ts","tests/e2e/cli-first-worktree-single-terminal.spec.ts","tests/e2e/unopened-workspace-agent-single-resume.spec.ts","tests/e2e/terminal-pane-close-layout-consistency.spec.ts","tests/e2e/golden-file-open-edit-save.spec.ts","tests/e2e/golden-source-control-open-diff.spec.ts","tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts","tests/e2e/floating-workspace-pane-height.spec.ts","tests/e2e/editor-model-host-isolation.spec.ts","tests/e2e/editor-tab-selection-restore.spec.ts","tests/e2e/finished-agent-ghost-resume.spec.ts","tests/e2e/live-background-terminal-mount-authority.spec.ts","tests/e2e/workspace-back-forward-navigation.spec.ts","tests/e2e/worktree-lineage-toggle-shortcut.spec.ts","tests/e2e/local-cli-terminal-retention.spec.ts","tests/e2e/default-tabs-mark-crash-relaunch.spec.ts","tests/e2e/terminal-cli-split-closed-before-mount.spec.ts","tests/e2e/layout-stream-loss-reopen.spec.ts","tests/e2e/terminal-tab-close-restart-persistence.spec.ts","tests/e2e/artificial-opencode-terminal-load.spec.ts","tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts","tests/e2e/headless-paired-remote-terminal-reveal-grid.spec.ts","tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts","tests/e2e/headless-paired-remote-terminal-viewer-size.spec.ts","tests/e2e/headless-serve-browser-tab-restart.spec.ts","tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts","tests/e2e/headless-serve-desktop-activation.spec.ts","tests/e2e/headless-serve-focused-terminal-create.spec.ts","tests/e2e/headless-serve-mobile-chat-tab-order.spec.ts","tests/e2e/headless-serve-mobile-native-chat-identity.spec.ts","tests/e2e/headless-serve-session-history-naming-requests.spec.ts","tests/e2e/layout-compat-old-phone-on-new-server.spec.ts","tests/e2e/layout-compat-serve-restart-keeps-at-at-terminals.spec.ts","tests/e2e/paired-mobile-serve-restart-terminal-tabs.spec.ts","tests/e2e/paired-mobile-desktop-tab-composition.spec.ts","tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts","tests/e2e/paired-desktop-server-layout-frames.spec.ts","tests/e2e/paired-desktop-server-held-pane-reopen.spec.ts","tests/e2e/paired-desktop-server-file-open-group.spec.ts","tests/e2e/paired-desktop-server-layout-intents.spec.ts","tests/e2e/paired-desktop-server-layout-writes.spec.ts","tests/e2e/ssh-orcad-"]'
+      test_files: '["tests/e2e/workspace-layout-oracle-headless.spec.ts","tests/e2e/workspace-layout-oracle.spec.ts","tests/e2e/cli-file-open-position.spec.ts","tests/e2e/relaunch-first-terminal.spec.ts","tests/e2e/relaunch-sleeping-agents-resume-on-view.spec.ts","tests/e2e/terminal-cold-activation-deferral.spec.ts","tests/e2e/cli-first-worktree-single-terminal.spec.ts","tests/e2e/unopened-workspace-agent-single-resume.spec.ts","tests/e2e/terminal-pane-close-layout-consistency.spec.ts","tests/e2e/golden-file-open-edit-save.spec.ts","tests/e2e/golden-source-control-open-diff.spec.ts","tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts","tests/e2e/floating-workspace-pane-height.spec.ts","tests/e2e/editor-model-host-isolation.spec.ts","tests/e2e/editor-tab-selection-restore.spec.ts","tests/e2e/finished-agent-ghost-resume.spec.ts","tests/e2e/live-background-terminal-mount-authority.spec.ts","tests/e2e/workspace-back-forward-navigation.spec.ts","tests/e2e/worktree-lineage-toggle-shortcut.spec.ts","tests/e2e/local-cli-terminal-retention.spec.ts","tests/e2e/default-tabs-mark-crash-relaunch.spec.ts","tests/e2e/terminal-cli-split-closed-before-mount.spec.ts","tests/e2e/layout-stream-loss-reopen.spec.ts","tests/e2e/terminal-tab-close-restart-persistence.spec.ts","tests/e2e/artificial-opencode-terminal-load.spec.ts","tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts","tests/e2e/headless-paired-remote-terminal-reveal-grid.spec.ts","tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts","tests/e2e/headless-paired-remote-terminal-viewer-size.spec.ts","tests/e2e/headless-serve-browser-tab-restart.spec.ts","tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts","tests/e2e/headless-serve-desktop-activation.spec.ts","tests/e2e/headless-serve-focused-terminal-create.spec.ts","tests/e2e/headless-serve-chat-tab-placement.spec.ts","tests/e2e/headless-serve-mobile-chat-tab-order.spec.ts","tests/e2e/headless-serve-mobile-native-chat-identity.spec.ts","tests/e2e/headless-serve-session-history-naming-requests.spec.ts","tests/e2e/layout-compat-old-phone-on-new-server.spec.ts","tests/e2e/layout-compat-serve-restart-keeps-at-at-terminals.spec.ts","tests/e2e/paired-mobile-serve-restart-terminal-tabs.spec.ts","tests/e2e/paired-mobile-desktop-tab-composition.spec.ts","tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts","tests/e2e/paired-desktop-server-layout-frames.spec.ts","tests/e2e/paired-desktop-server-held-pane-reopen.spec.ts","tests/e2e/paired-desktop-server-file-open-group.spec.ts","tests/e2e/paired-desktop-server-layout-intents.spec.ts","tests/e2e/paired-desktop-server-layout-writes.spec.ts","tests/e2e/paired-desktop-server-editor-handover.spec.ts","tests/e2e/ssh-orcad-"]'
       run_changed_e2e: true
       needs_build: true
       artifact_suffix: -layout-owner-switch-on

.github/workflows/pr.yml

@@ -939,7 +939,9 @@ jobs:
       - name: Install WebKit for the drawer check
         id: webkit
         background: true
-        run: pnpm exec playwright-core install --with-deps webkit
+        run: |
+          bash .github/scripts/prepare-ubuntu-apt.sh
+          pnpm exec playwright-core install --with-deps webkit
 
       # The entry lives in mobile/ so one React resolves; without this every RN import is nothing.
       - uses: ./.github/actions/install-mobile-dependencies
@@ -1061,7 +1063,7 @@ jobs:
     name: package
     needs: [code_paths, preflight]
     if: needs.code_paths.outputs.package == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     # Let the serial Docker gates reach their own deadlines and report cleanup failures.
     timeout-minutes: 90
 

.github/workflows/preflight-benchmark.yml

@@ -17,7 +17,8 @@ env:
 jobs:
   compilers:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
-    runs-on: ubuntu-24.04-arm
+    # Native compiler peaks can exhaust the standard ARM runner before samples are saved.
+    runs-on: blacksmith-8vcpu-ubuntu-2404-arm
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@v6

.github/workflows/preflight-critical-path-benchmark.yml

@@ -34,6 +34,8 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: config/.bun-version
+      - uses: ./.github/actions/install-mobile-dependencies
+        if: matrix.comparison == 'smoke'
       - name: Compare checks and verify their results
         run: node config/scripts/benchmark-ci-preflight-critical-path.mjs ${{ matrix.comparison }}
       - uses: actions/upload-artifact@v7

.github/workflows/release-cut.yml

@@ -1017,7 +1017,6 @@ jobs:
           WORKFLOW_SHA: ${{ github.workflow_sha }}
         run: |
           git fetch --no-tags --depth=1 origin "$WORKFLOW_SHA"
-          # Why not skill-freshness-inventory.test.ts: it holds behaviour tests, so main's copy fails a tag that predates the behaviour.
           git checkout "$WORKFLOW_SHA" -- \
             src/main/skills/skill-provider-runtime-roots.test.ts
 
@@ -1069,7 +1068,6 @@ jobs:
           WORKFLOW_SHA: ${{ github.workflow_sha }}
         run: |
           git fetch --no-tags --depth=1 origin "$WORKFLOW_SHA"
-          # Why not skill-freshness-inventory.test.ts: it holds behaviour tests, so main's copy fails a tag that predates the behaviour.
           git checkout "$WORKFLOW_SHA" -- \
             src/main/skills/skill-provider-runtime-roots.test.ts
 

.github/workflows/unit-tests.yml

@@ -9,7 +9,7 @@ on:
         type: string
 
       runner:
-        description: Hosted runner for the unit shards; relay integration keeps its x86 host.
+        description: Hosted runner for the unit shards.
         required: false
         default: ubuntu-latest
         type: string
@@ -213,7 +213,7 @@ jobs:
       fail-fast: false
       matrix:
         node: ${{ fromJSON(inputs.node_versions) }}
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 60
 
     steps:

.gitignore

@@ -69,6 +69,7 @@ desktop.ini
 .oxlintcache
 /.cache/vite/
 /.cache/vite.lock/
+/.cache/typecheck/
 
 # Logs
 *.log

.oxfmtrc.json

@@ -9,6 +9,7 @@
     "resources/licenses/**",
     ".github/actions/cloud-sql-rollout-lease/**",
     ".anti-slop-plugin/**",
-    "src/main/runtime/__fixtures__/*.timing.json"
+    "src/main/runtime/__fixtures__/*.timing.json",
+    "resources/skills/released-digests.json"
   ]
 }