[OrcaWin]

	Files	Added	Deleted	Net
Test	31	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1374	$\color{#cf222e}{\Huge{\mathbf{−}}}$​200	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1174
Prod	43	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1666	$\color{#cf222e}{\Huge{\mathbf{−}}}$​389	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1277

ELI5

Orca's packaged and developer CLI commands run on a Bun runtime shipped with Orca, rather than borrowing Electron's Node mode or the user's Node for application code.

What Changed

Packaged POSIX/native Windows, developer, public bin, remote and WSL CLI launchers now suppress workspace Bun configuration and dotenv and disable implicit installs while preserving user argv/cwd and legacy Node selection. The bundled-runtime gate runs real-Bun fork and zero-network missing-dependency regressions.

Stacked on #23354. Stage the pinned, verified runtime outside asar with its license notice and packaging guards. Update POSIX, native Windows, developer and WSL bridge launchers, plus host-side CLI calls and packaged startup redirection. Keep Electron as the desktop app executable.

The public npm bin is a small Node 18-compatible bootstrap that hands off before importing the CLI graph. On POSIX it isolates signal delivery and uses IPC to shut down Bun if the bootstrap disappears; completed commands do not stay alive just because that IPC channel exists. The developer launcher reuses the same asynchronous lifecycle implementation. Existing managed-launcher recognition remains for upgrades. On Windows, the native launcher owns a lifetime pipe; losing the launcher requests graceful foreground-child shutdown over IPC after the child advertises its quit handler. Shared-console Ctrl-C and the bounded shutdown deadline remain intact.

Windows public/developer bootstraps detach Bun only when all standard streams are redirected. A lifetime pipe then requests graceful shutdown on launcher loss and forwards SIGINT/SIGTERM without force-killing the child. Console-attached commands retain their console handles and direct Ctrl-C delivery; force-killing that Node bootstrap still force-kills its child, matching prior behavior.

Why

Bundling the runtime removes host Node API restrictions from CLI application code. Keeping a minimal bootstrap preserves existing package-bin invocations without asking users to upgrade Node. Electron remains the desktop runtime, and Bun APIs are qualified against the pinned binary rather than assumed to match Node 24.

Linked Issue

No linked issue; part of the requested bundled-runtime migration.

Visual Proof

N/A — CLI launch and packaging behavior; no renderer changes.

Testing

Latest focused stack check: Node and CLI typechecks pass; 78 tests across 13 suites pass, including actual pinned-Bun isolation and loopback-registry controls. Relay/CLI/WSL backport checks also passed before restacking. These overlap earlier counts. Fresh CI and platform qualification for the updated heads remain required; signed-package results below are historical.

• I manually tested these changes locally
• Automated tests added/updated, or explained why not below

Real Node18 bootstrap→Bun checks, POSIX signal/suspend/parent-loss cases, and native Windows C# and Node launcher tests passed. Windows checks cover argument preservation, console input/Ctrl-C, redirected lifetime-pipe shutdown, and an asynchronous fsynced child write before exit. Node/CLI typechecks and targeted lint passed at the recorded implementation heads.

Full headless git and folder scenarios passed on Linux/Windows x64 and ARM64: restart restores saved state, terminal commands produce output, and folder cleanup preserves user files. Windows test signing passed (36327159351); branch-to-branch updates passed seven live-session survival assertions (36328359597). Updating from shipped v1.4.215 loses the daemon during that release's old uninstaller; cold restore works.

Signed/notarized Intel and ARM64 macOS ZIPs passed extracted signature, staple and Gatekeeper checks. Both now pass packaged git/folder restart, final profile export and terminal output using those unchanged archives (36338541068). The CI harness creates and cleans up a disposable keychain without disabling encryption, and verifies launcher/server exit without waiting for helper-held pipes. Twelve harness tests and the changed-code quality gate pass. Native Squirrel installation also passed on ARM64 from signed v1.4.215 to the archived signed branch build (36339364360): installed signature, restored workspace and the same terminal executing commands before/after. That test explicitly relaunched in the background; automatic relaunch on Intel/ARM64 remains under qualification.

The preceding heads passed main/Bun CI on every stack layer. Historical CLI head 2ef35cf passed main CI and Bun CI; lower layers are unchanged.

Review

Latest scoped Codex and Claude Opus reviews found no unresolved P0/P1 after the owned-runtime fixes and reliability-manifest correction. The final supervisor/probe changes pass 59 focused tests; all 135 reliability gates validate, and the checker/consumer tests pass. Native Windows packaged and generated C# launchers passed the final three-flag policy, including hostile workspace config, argument/environment and lifecycle checks; private test resources were cleaned up. Fresh CI and final release qualification remain open.

This revision is rebased over direct-Bun orcad startup and the shared relay output fixes. Fresh head CI is pending; platform and signed-package results below describe earlier heads. Desktop Bun daemon consolidation remains separate local work.

Draft. Targeted source and entry/native API audits are complete with no new blocker found; previous-head main/Bun CI passes. Archived signed Intel/ARM64 candidates pass native Squirrel installation, automatic relaunch and original-shell memory retention (36340770547). SSH qualification passes both transports on macOS, glibc Linux, Alpine musl and native Windows (36342129127). macOS13 remains unavailable/unqualified. First upgrade from shipped Windows1.4.215 cold-restores because its old uninstaller kills the daemon; the new installer pair preserves sessions. No independent approval or merge authorization claimed.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer material copied.

Notes

The renderer and Electron runtime are unchanged. No design/tracking documents or local benchmarks are included. The earlier test-signed Windows candidate96e3d00474c7 is232,072,992 bytes versus201,801,832 bytes for shipped v1.4.215 (+28.87MiB,+15.00%). This is an actual EXE measurement, not Actions archive size. It includes other revision/build/signing differences and does not isolate Bun-only cost or measure the exact latest head. The signed ARM64 ZIP is256,452,220 versus229,128,420 bytes (+26.06MiB,+11.93%), with the same release-relative attribution limits.

Checklist

• This PR is focused on CLI runtime ownership, separate from relay and guest helper cutovers
• I explained the before/after, mechanism and alternatives
• Visual proof is N/A with reason
• Final review and platform qualification complete
• Cross-platform, SSH and WSL impact considered
• Fresh revision CI must pass before merge

Native signed macOS update qualification now passes on Intel and Apple Silicon (run 36340770547): Squirrel installation, automatic relaunch, installed signature, restored workspace, terminal execution, original shell PID, and a random shell-only variable retained across the update. This used shipped 1.4.215 → the unchanged archived signed branch 1.4.214 candidate to exercise installation; it is not a forward-release or latest-head signed rebuild.

[OrcaWin]

Closing as defunct: Orca stays on Node outside Electron, and the bundled-Bun runtime migration this stack belongs to was wound down. Servers and remote hosts now run on the bundled Node 24 runtime (#26171).