Consolidate desktop and WSL terminals on the bundled Bun service

.github/actions/install-node-dependencies/action.yml

@@ -146,8 +146,7 @@ runs:
         path: ${{ steps.electron-package-cache.outputs.cache-root }}
         key: electron-package-${{ runner.os }}-${{ runner.arch }}-${{ steps.electron-package-cache.outputs.version }}
 
-    # Why cached: `--ignore-scripts` leaves node-pty without build/Release, so
-    # ensure-native-runtime node-gyp-compiles it in every job that asks for a runtime.
+    # Cache Windows registry and process-tree addons built by ensure-native-runtime.
     # The artifacts are ABI-bound, so the key carries the target runtime, the resolved
     # Node version, and the patch whose contents the build has to match.
     # Windows extra globs are empty on Linux. No restore-keys: a partial-match key is
@@ -173,21 +172,19 @@ runs:
       uses: actions/cache@v5
       with:
         path: |
-          node_modules/.pnpm/node-pty@*/node_modules/node-pty/build
           native/windows-registry/build
           node_modules/.pnpm/@vscode+windows-process-tre*/node_modules/@vscode/windows-process-tree/build
-        key: native-modules-${{ runner.os }}-${{ steps.native-cache-scope.outputs.scope }}-${{ runner.arch }}-${{ inputs.native-runtime }}-node${{ steps.requested-node.outputs.node-version || steps.default-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml', '.github/actions/install-node-dependencies/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json') }}
+        key: native-modules-${{ runner.os }}-${{ steps.native-cache-scope.outputs.scope }}-${{ runner.arch }}-${{ inputs.native-runtime }}-node${{ steps.requested-node.outputs.node-version || steps.default-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml', '.github/actions/install-node-dependencies/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json') }}
 
     - name: Restore compiled native modules without saving
       id: native-cache-restore-only
       if: inputs.native-runtime != 'none' && inputs.persist-native-cache == 'false'
       uses: actions/cache/restore@v5
       with:
         path: |
-          node_modules/.pnpm/node-pty@*/node_modules/node-pty/build
           native/windows-registry/build
           node_modules/.pnpm/@vscode+windows-process-tre*/node_modules/@vscode/windows-process-tree/build
-        key: native-modules-${{ runner.os }}-${{ steps.native-cache-scope.outputs.scope }}-${{ runner.arch }}-${{ inputs.native-runtime }}-node${{ steps.requested-node.outputs.node-version || steps.default-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml', '.github/actions/install-node-dependencies/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json') }}
+        key: native-modules-${{ runner.os }}-${{ steps.native-cache-scope.outputs.scope }}-${{ runner.arch }}-${{ inputs.native-runtime }}-node${{ steps.requested-node.outputs.node-version || steps.default-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml', '.github/actions/install-node-dependencies/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json') }}
 
     # pnpm's bundled gyp_main.py is not executable on fresh Linux runners.
     - name: Use external node-gyp

.github/workflows/bun-profile-tests.yml

@@ -20,11 +20,18 @@ on:
       - '.github/actions/load-windows-watcher-artifacts/**'
   workflow_dispatch:
     inputs:
+      linux_package:
+        description: Package and test Linux x64 and ARM64 without publishing a release
+        type: boolean
+        default: false
       signed_mac_package:
         description: Sign, notarize and test macOS packages without publishing a release
         type: boolean
         default: false
 
+env:
+  ORCA_TEST_REQUIRE_ORCAD_ARTIFACTS: '1'
+
 permissions:
   contents: read
 
@@ -183,7 +190,7 @@ jobs:
       - name: Verify native Alpine artifact and persistence
         run: |
           docker run --rm --init -i \
-            -e ORCA_BACKGROUND_LAUNCH=1 \
+            -e ORCA_BACKGROUND_LAUNCH=1 -e ORCA_TEST_REQUIRE_ORCAD_ARTIFACTS=1 \
             -v "$GITHUB_WORKSPACE:/work" -w /work \
             node:24-alpine3.23 sh -s <<'BUN_QUALIFICATION'
           set -eu
@@ -200,6 +207,73 @@ jobs:
           node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts config/scripts/orcad-companion-artifacts.test.mjs
           BUN_QUALIFICATION
 
+  linux_package:
+    needs: windows_watcher
+    if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.linux_package && needs.windows_watcher.result == 'success' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-22.04
+            arch: x64
+            unpacked_dir: dist/linux-unpacked
+          - os: ubuntu-24.04-arm
+            arch: arm64
+            unpacked_dir: dist/linux-arm64-unpacked
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 90
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+      NODE_OPTIONS: --max-old-space-size=4096
+      PACKAGE_ARCH: ${{ matrix.arch }}
+      PACKAGE_DIRECTORY: ${{ matrix.unpacked_dir }}
+      ORCA_LINUX_ARM64_RELEASE: ${{ matrix.arch == 'arm64' && '1' || '0' }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: ./.github/actions/load-windows-watcher-artifacts
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: electron
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            mobile/pnpm-lock.yaml
+      - uses: ./.github/actions/install-mobile-dependencies
+      - name: Install Linux package and computer-use dependencies
+        run: sudo apt-get update && sudo apt-get install -y python3-gi gir1.2-atspi-2.0 at-spi2-core xclip xdotool rpm
+      - run: pnpm build:release
+      - name: Package without release publication
+        run: |
+          node config/scripts/ensure-native-runtime.mjs --runtime=electron
+          pnpm exec electron-builder --config config/electron-builder.config.cjs --linux AppImage deb rpm --"$PACKAGE_ARCH" --publish never
+      - name: Preserve exact package and provenance
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/linux-package-evidence"
+          git rev-parse HEAD > "$RUNNER_TEMP/linux-package-evidence/source-commit.txt"
+          uname -a > "$RUNNER_TEMP/linux-package-evidence/host-kernel.txt"
+          tar -czf "$RUNNER_TEMP/linux-package-evidence/unpacked-$PACKAGE_ARCH.tar.gz" -C "$PACKAGE_DIRECTORY" .
+          (cd "$PACKAGE_DIRECTORY" && find . -type f -print0 | sort -z | xargs -0 sha256sum) > "$RUNNER_TEMP/linux-package-evidence/payload-sha256.txt"
+          sha256sum dist/*.AppImage dist/*.deb dist/*.rpm > "$RUNNER_TEMP/linux-package-evidence/installers-sha256.txt"
+          (cd "$RUNNER_TEMP/linux-package-evidence" && sha256sum "unpacked-$PACKAGE_ARCH.tar.gz") > "$RUNNER_TEMP/linux-package-evidence/archive-sha256.txt"
+      - name: Qualify packaged terminal on Ubuntu 20.04 userspace
+        run: |
+          set -euo pipefail
+          node config/scripts/run-linux-packaged-terminal-floor-smoke.mjs --app-dir "$PACKAGE_DIRECTORY" 2>&1 | tee "$RUNNER_TEMP/linux-package-evidence/floor-smoke.log"
+      - uses: actions/upload-artifact@v7
+        if: ${{ always() }}
+        with:
+          name: bun-linux-package-${{ matrix.arch }}
+          path: |
+            ${{ runner.temp }}/linux-package-evidence/
+            dist/*.AppImage
+            dist/*.deb
+            dist/*.rpm
+          if-no-files-found: error
+          retention-days: 7
+
   signed_mac_package:
     needs: windows_watcher
     if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.signed_mac_package && github.repository == 'stablyai/orca' && startsWith(github.ref, 'refs/heads/') && needs.windows_watcher.result == 'success' }}

.github/workflows/ci-cache-warmup.yml

@@ -19,7 +19,6 @@ on:
       - 'config/tsconfig*.json'
       - 'config/scripts/ensure-native-runtime.mjs'
       - 'config/scripts/rebuild-native-deps.mjs'
-      - 'config/patches/node-pty@1.1.0.patch'
       - 'config/patches/@vscode__windows-process-tree@0.8.0.patch'
       - 'native/windows-registry/**'
   pull_request:

.github/workflows/computer-e2e.yml

@@ -26,13 +26,21 @@ on:
       - 'config/scripts/daemon-endpoint-handover-smoke.mjs'
       - 'config/scripts/windows-daemon-workspace-close-repro.mjs'
       - 'config/scripts/verify-computer-native.mjs'
-      # Why: the native-smoke job boots the built terminal daemon under plain
-      # Node, so any change to the daemon bundle graph or the main build must
-      # re-run it (the v1.4.129-rc.1 daemon outage shipped with green CI).
+      # Runtime and standalone bundle changes must exercise actual daemon startup.
+      - 'config/scripts/daemon-smoke-launch*'
+      - 'config/scripts/build-terminal-daemon.mjs'
+      - 'config/scripts/orcad-entry-build.mjs'
+      - 'config/scripts/build-cli-runtime.mjs'
+      - 'config/scripts/build-orcad-bun.mjs'
+      - 'config/scripts/build-windows-conpty.mjs'
+      - 'config/licenses/windows-conpty-LICENSE.txt'
+      - 'resources/licenses/bun/**'
+      - 'config/bundled-cli-runtime.cjs'
+      - 'src/shared/orcad-bun-runtime.ts'
+      - 'src/shared/windows-conpty-release.ts'
       - 'electron.vite.config.ts'
       - 'config/build-plugins/**'
       - 'src/main/daemon/**'
-      - 'src/main/providers/local-pty-provider.ts'
       - 'src/main/providers/windows-shell-args.ts'
       - 'src/main/providers/windows-shell-preflight-runtime.windows.test.ts'
       - 'native/computer-use-macos/**'
@@ -81,6 +89,11 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
+      - name: Prepare pinned Bun for Windows shell fixtures
+        if: runner.os == 'Windows'
+        run: node --input-type=module -e "import { buildCliRuntime } from './config/scripts/build-cli-runtime.mjs'; await buildCliRuntime(process.platform, process.arch)"
+      - name: Build terminal service and Windows gate for shell fixtures
+        run: pnpm run build:terminal-daemon
       # Why: without --config, bare vitest ignores config/vitest.config.ts (there
       # is no root config) and falls back to the 5s default timeout with no
       # Windows worker cap, so the real csc.exe launcher-compile tests time out
@@ -126,10 +139,8 @@ jobs:
       - run: pnpm verify:computer-native
       - run: pnpm build:cli
       - run: pnpm run build:electron-vite:parallel
-      # Why: boot the BUILT daemon-entry under plain Node the way production
-      # forks it. v1.4.129-rc.1 shipped a daemon that exited at module load
-      # (leaked electron require) while every other check passed; this fails
-      # the PR when the built daemon cannot start on ubuntu-22.04 / windows.
+      - run: pnpm exec vitest run --config config/vitest.config.ts config/scripts/daemon-smoke-launch.test.mjs
+      # Exercise the shipped Bun runtime and standalone daemon bundle together.
       - name: Daemon boot smoke
         run: node config/scripts/daemon-boot-smoke.mjs
       # Why: a daemon that lost its endpoint name used to delete the replacement's

.github/workflows/e2e.yml

@@ -57,7 +57,7 @@ jobs:
         with:
           ref: ${{ inputs.ref || github.ref }}
 
-      # Why: the build's plain-Node daemon smoke load resolves node-pty.
+      # Build checks require the Electron runtime and Windows native addons.
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
@@ -77,6 +77,8 @@ jobs:
           VITE_EXPOSE_STORE: 'true'
         run: |
           status=0
+          pnpm run build:cli || status=1
+          pnpm run build:terminal-daemon || status=1
           pnpm run build:relay &
           relay_pid=$!
           npx electron-vite build --mode e2e || status=1