sync: absorb upstream v1.4.230

.gitattributes

@@ -19,7 +19,6 @@
 # .version, which names the immutable remote install dir. A CRLF checkout makes a
 # Windows-built client disagree with a mac/Linux-built one on the same release,
 # so one host ends up with two relay trees (#17886 review).
-/config/relay-assets/** text eol=lf
 # Pin the bytes so a patch reads and diffs identically on every host. It is NOT
 # what makes the hash right: pnpm hashes a patch LF-normalized, so a CRLF checkout
 # cannot change it. Believing otherwise put a hand-computed raw digest in the
@@ -47,6 +46,7 @@
 # normalisation on a Windows checkout would rewrite the evidence the fixture exists to be.
 /src/main/runtime/__fixtures__/*.txt -text
 /src/main/daemon/__fixtures__/pty-transcripts/*.txt -text
+/src/renderer/src/components/terminal-pane/terminal-link-transcripts/*.txt -text whitespace=cr-at-eol
 # Generated runtime English subset: compared byte-for-byte by
 # verify:localization-runtime-catalog, so a CRLF checkout would fail the gate.
 /src/renderer/src/i18n/en-runtime-required.json linguist-generated=true text eol=lf

.github/CONTRIBUTING.md

@@ -26,10 +26,28 @@ pnpm install
 pnpm dev
 ```
 
+To reduce main-process rebuild CPU and memory when you do not need its source maps,
+set `ORCA_DEV_MAIN_SOURCEMAPS=0` before `pnpm dev`. In Bash/zsh:
+
+```bash
+ORCA_DEV_MAIN_SOURCEMAPS=0 pnpm dev
+```
+
+In PowerShell, use `$env:ORCA_DEV_MAIN_SOURCEMAPS='0'` before `pnpm dev`.
+Remove the variable when debugging the main process with source maps. Renderer and
+preload settings are unaffected; production builds always keep their hidden main maps.
+
 Ordinary installs include native optional dependencies for the current OS and CPU only.
 Before a cross-architecture build (including `pnpm build:mac`, which produces both x64 and
 arm64 artifacts by default), run `pnpm install:release` to add the other CPU's variants.
 
+Linux `pnpm build`, `pnpm build:native`, and Linux packaging require a running Docker
+daemon to build the clipboard helper against Ubuntu 20.04 rather than the host's
+newer libraries. A verified cached helper can be reused without Docker. For native
+Wayland development, run `pnpm build:native` before `pnpm dev` to make text copying
+available. See the [clipboard build guide](../native/wayland-clipboard/README.md#building-and-testing).
+macOS and Windows builds do not use this helper or require Docker for it.
+
 ## Branch Naming
 
 Use a clear, descriptive branch name that reflects the change.
@@ -53,6 +71,15 @@ pnpm test
 pnpm build
 ```
 
+For repeated local typechecks, use `pnpm tc` (or `pnpm tc:node`, `pnpm tc:web`,
+and `pnpm tc:cli`). These run `bun check` from the pinned `bun` devDependency —
+about a third of tsc's CPU and an eighth of its memory, so several agents can
+typecheck at once. Pass `--compiler=native` to use tsc and its incremental
+cache instead. CI uses `pnpm typecheck:ci`, the same Bun check with CI's
+concurrency. Shared tests are checked by the
+Node project; shared production code is checked in all three environments.
+Run `pnpm tc:node` after editing shared tests, or `pnpm tc` to check everything.
+
 Add high-quality tests for behavior changes and bug fixes. Prefer tests that would actually catch a regression, not shallow coverage that only exercises the happy path.
 
 If your change affects UI or interaction behavior, verify it on the platforms it could impact.
@@ -111,7 +138,7 @@ All stable kinds (`patch`, `minor`, `major`) are computed off the latest _stable
 - If the latest RC tag exists but is still draft-only or missing its GitHub Release, the workflow resumes that tag only when it was built from the current release ref. Otherwise the next RC number is cut.
 - RC numbering also considers release commits on `main`, so deleting a stale tag does not let a later cut reuse the same RC number.
 - Off-main releases (when `ref` is not the tip of `main`) only push the tag. `main` is never mutated from a non-main ref, so you can safely release an older commit without polluting history.
-- When `ref` is the tip of `main`, the version-bump commit is fast-forwarded onto `main` so local `package.json` stays in sync with what's shipped.
+- When `ref` is the tip of `main`, the workflow tries to fast-forward the version-bump commit onto `main`. If main requires pull requests, it leaves main unchanged and pushes only the release tag. Other push errors still stop the cut.
 
 **Common scenarios:**
 

.github/actions/build-mobile-web-bundle/action.yml

@@ -0,0 +1,11 @@
+name: Build the mobile web bundle
+description: Builds out/mobile-web, the page phones load, which every orcad build ships and refuses to build without.
+
+runs:
+  using: composite
+  steps:
+    # Why: the bundle build resolves React Native and Expo from mobile/node_modules.
+    - uses: ./.github/actions/install-mobile-dependencies
+    - name: Build the mobile web bundle
+      shell: bash
+      run: pnpm run build:mobile-web

.github/actions/download-pinned-orca-release/action.yml

@@ -0,0 +1,42 @@
+name: Download pinned Orca release
+description: Downloads a released Linux .deb, checks its SHA-512, extracts it and points ORCA_CROSS_VERSION_PACKAGED_EXECUTABLE at its executable.
+
+inputs:
+  version:
+    description: Release version without the leading v (e.g. 1.4.224).
+    required: true
+  sha512:
+    description: Base64 SHA-512 of orca-ide_<version>_amd64.deb.
+    required: true
+  github-token:
+    description: Token for gh release download.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download and verify
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        ORCA_PINNED_VERSION: ${{ inputs.version }}
+        ORCA_PINNED_SHA512: ${{ inputs.sha512 }}
+      run: |
+        gh release download "v$ORCA_PINNED_VERSION" --repo stablyai/orca --pattern "orca-ide_${ORCA_PINNED_VERSION}_amd64.deb" --dir "$RUNNER_TEMP/old-orca"
+        python3 - <<'PYVERIFY'
+        import base64,hashlib,os,pathlib,subprocess
+        version=os.environ['ORCA_PINNED_VERSION']
+        root=pathlib.Path(os.environ['RUNNER_TEMP'])/'old-orca'
+        package=root/f'orca-ide_{version}_amd64.deb'
+        digest=hashlib.sha512()
+        with package.open('rb') as archive:
+            for block in iter(lambda: archive.read(1024*1024), b''):
+                digest.update(block)
+        assert base64.b64encode(digest.digest()).decode()==os.environ['ORCA_PINNED_SHA512']
+        extracted=root/'extracted'
+        subprocess.run(['dpkg-deb','-x',str(package),str(extracted)],check=True)
+        executable=extracted/'opt'/'Orca'/'orca-ide'
+        assert executable.is_file() and os.access(executable,os.X_OK)
+        with open(os.environ['GITHUB_ENV'],'a') as env: env.write('ORCA_CROSS_VERSION_PACKAGED_EXECUTABLE='+str(executable)+'\n')
+        print('Verified old package:',executable)
+        PYVERIFY

.github/actions/install-node-dependencies/action.yml

@@ -209,6 +209,14 @@ runs:
           git -C "$GITHUB_WORKSPACE" diff --exit-code -- package.json pnpm-lock.yaml pnpm-workspace.yaml
         fi
 
+    # Why: the script-free install leaves node_modules/.bin/bun as a stub that shadows setup-bun under `pnpm run`.
+    - name: Link pinned Bun
+      shell: bash
+      run: |
+        if [ -d node_modules/bun ]; then
+          pnpm rebuild bun
+        fi
+
     # Why --if-present: release cuts run main's workflows against older release tags that predate this script.
     - name: Build internal packages
       shell: bash

.github/actions/prepare-native-runtime/action.yml

@@ -54,7 +54,7 @@ runs:
       env:
         NATIVE_RUNTIME: ${{ inputs.native-runtime }}
         NODE_VERSION: ${{ inputs.node-version }}
-        NATIVE_SOURCE_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs', '.github/actions/prepare-native-runtime/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/scripts/node-pty-job-ownership.cjs', 'config/scripts/windows-pe-machine.cjs', 'config/scripts/windows-process-tree-gyp-rebuild.mjs', 'config/scripts/windows-process-tree-creation-time.cjs', 'config/scripts/install-electron-package-binary.mjs', 'config/scripts/electron-platform-path.mjs', 'config/scripts/zip-extractor-command.mjs', 'src/shared/zip-extractor-command.ts', 'config/scripts/shared-electron-dist-cache.mjs', 'config/scripts/space-sharing-copy.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json', 'native/windows-registry/index.js') }}
+        NATIVE_SOURCE_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs', '.github/actions/prepare-native-runtime/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/initialize-windows-native-toolchain.mjs', 'config/scripts/capture-windows-native-environment.cmd', 'config/scripts/rebuild-native-deps.mjs', 'config/scripts/node-pty-job-ownership.cjs', 'config/scripts/windows-pe-machine.cjs', 'config/scripts/windows-process-tree-gyp-rebuild.mjs', 'config/scripts/windows-process-tree-creation-time.cjs', 'config/scripts/install-electron-package-binary.mjs', 'config/scripts/electron-platform-path.mjs', 'config/scripts/zip-extractor-command.mjs', 'src/shared/zip-extractor-command.ts', 'config/scripts/shared-electron-dist-cache.mjs', 'config/scripts/space-sharing-copy.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json', 'native/windows-registry/index.js', 'native/windows-security/src/addon.cc', 'native/windows-security/binding.gyp', 'native/windows-security/package.json', 'native/windows-security/index.js') }}
       run: |
         scope="${ImageOS:-$RUNNER_OS}"
         if [ -r /etc/os-release ]; then
@@ -69,6 +69,7 @@ runs:
         path<<ORCA_NATIVE_BUILD_DIRECTORIES
         node_modules/.pnpm/node-pty@*/node_modules/node-pty/build
         native/windows-registry/build
+        native/windows-security/build
         node_modules/.pnpm/@vscode+windows-process-tre*/node_modules/@vscode/windows-process-tree/build
         ORCA_NATIVE_BUILD_DIRECTORIES
         ORCA_NATIVE_CACHE_PATHS
@@ -82,6 +83,7 @@ runs:
         path: |
           node_modules/.pnpm/node-pty@*/node_modules/node-pty/build
           native/windows-registry/build
+          native/windows-security/build
           node_modules/.pnpm/@vscode+windows-process-tre*/node_modules/@vscode/windows-process-tree/build
         key: ${{ steps.native-cache-scope.outputs.key }}
 
@@ -93,6 +95,7 @@ runs:
         path: |
           node_modules/.pnpm/node-pty@*/node_modules/node-pty/build
           native/windows-registry/build
+          native/windows-security/build
           node_modules/.pnpm/@vscode+windows-process-tre*/node_modules/@vscode/windows-process-tree/build
         key: ${{ steps.native-cache-scope.outputs.key }}
 
@@ -117,4 +120,9 @@ runs:
       shell: bash
       env:
         NATIVE_RUNTIME: ${{ inputs.native-runtime }}
-      run: node config/scripts/ensure-native-runtime.mjs --runtime="$NATIVE_RUNTIME"
+      run: |
+        if [ "$RUNNER_OS" = Windows ] && [ "$NATIVE_RUNTIME" = node ]; then
+          node config/scripts/initialize-windows-native-toolchain.mjs
+        else
+          node config/scripts/ensure-native-runtime.mjs --runtime="$NATIVE_RUNTIME"
+        fi

.github/actions/prepare-orcad-prebuilds/action.yml

@@ -63,5 +63,5 @@ runs:
           fi
           pnpm build:orcad-prebuilds
         fi
-        pnpm build:orcad-prebuilds --require-slots "$(node config/scripts/build-orcad-prebuilds.mjs --print-slot)"
-        pnpm build:orcad-prebuilds --smoke
+        node config/scripts/build-orcad-prebuilds.mjs --require-slots "$(node config/scripts/build-orcad-prebuilds.mjs --print-slot)"
+        node config/scripts/build-orcad-prebuilds.mjs --smoke

.github/actions/prepare-wayland-clipboard/action.yml

@@ -0,0 +1,53 @@
+name: Prepare Wayland clipboard helper
+description: Reuse the source-matched Ubuntu 20.04 helper, validating its architecture and glibc requirements every time.
+
+inputs:
+  save-cache:
+    description: Publish a validated helper from the default branch.
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve Wayland clipboard build identity
+      id: identity
+      shell: bash
+      run: |
+        node --input-type=module <<'NODE'
+        import { appendFileSync } from 'node:fs'
+        import { waylandClipboardFingerprint } from './config/scripts/build-wayland-clipboard.mjs'
+        const fingerprint = waylandClipboardFingerprint(process.cwd(), process.arch)
+        // Immutable invalid hits need a version bump here before publishing their repair.
+        appendFileSync(process.env.GITHUB_OUTPUT, `key=wayland-clipboard-v1-${process.arch}-${fingerprint}\n`)
+        NODE
+
+    - name: Restore Wayland clipboard helper
+      id: cache
+      uses: actions/cache/restore@v5
+      continue-on-error: true
+      with:
+        path: native/wayland-clipboard/.build
+        key: ${{ steps.identity.outputs.key }}
+
+    - name: Build or validate Wayland clipboard helper
+      shell: bash
+      env:
+        CACHE_HIT: ${{ steps.cache.outputs.cache-hit }}
+      run: |
+        if node config/scripts/build-wayland-clipboard.mjs; then
+          exit 0
+        fi
+        if [ "$CACHE_HIT" != true ]; then
+          exit 1
+        fi
+        echo 'Discarding an unusable Wayland clipboard cache and rebuilding from source.'
+        rm -rf -- native/wayland-clipboard/.build
+        node config/scripts/build-wayland-clipboard.mjs
+
+    - name: Save validated Wayland clipboard helper from main
+      if: inputs.save-cache == 'true' && steps.cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+      uses: actions/cache/save@v5
+      continue-on-error: true
+      with:
+        path: native/wayland-clipboard/.build
+        key: ${{ steps.identity.outputs.key }}

.github/actions/prepare-windows-agent-hook/action.yml

@@ -0,0 +1,27 @@
+name: Prepare the Windows agent hook
+description: Compiles native/windows-agent-hook into native/windows-agent-hook/.build/orca-agent-hook.exe, which electron-builder --win refuses to package without.
+
+runs:
+  using: composite
+  steps:
+    - name: Cache the Windows agent hook build
+      if: runner.os == 'Windows'
+      uses: actions/cache@v5
+      with:
+        path: |
+          native/windows-agent-hook/.build
+          native/windows-agent-hook/target
+          ~/.cargo/registry
+        key: windows-agent-hook-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-agent-hook/**', 'config/scripts/build-windows-agent-hook.mjs', 'config/scripts/windows-rust-executable-build.mjs', 'resources/build/icon.ico', 'package.json') }}
+
+    # Why explicit: a runner image without cargo would otherwise fail inside electron-builder's verify.
+    - name: Build the Windows agent hook
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+        }
+        node config/scripts/build-windows-agent-hook.mjs
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

.github/actions/prepare-windows-cli-launcher/action.yml

@@ -0,0 +1,39 @@
+name: Prepare the orcad Windows CLI launcher
+description: Compiles native/windows-cli-launcher for each requested arch into .build/windows-cli-launcher/<arch>/orca.exe.
+
+inputs:
+  arches:
+    description: Space-separated Windows architectures (x64, arm64).
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Cache the Windows CLI launcher builds
+      if: runner.os == 'Windows'
+      uses: actions/cache@v5
+      with:
+        path: |
+          .build/windows-cli-launcher
+          native/windows-cli-launcher/target
+          ~/.cargo/registry
+        key: orcad-windows-cli-launcher-${{ runner.arch }}-${{ inputs.arches }}-${{ hashFiles('native/windows-cli-launcher/**', 'config/scripts/build-windows-cli-launcher.mjs', 'config/scripts/windows-rust-executable-build.mjs', 'resources/build/icon.ico', 'package.json') }}
+
+    # Why explicit: a runner image without cargo would otherwise fail inside the orcad build.
+    - name: Build the launcher for each architecture
+      if: runner.os == 'Windows'
+      shell: pwsh
+      env:
+        ARCHES: ${{ inputs.arches }}
+      run: |
+        if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+        }
+        $triples = @{ x64 = 'x86_64-pc-windows-msvc'; arm64 = 'aarch64-pc-windows-msvc' }
+        foreach ($arch in ($env:ARCHES -split ' ' | Where-Object { $_ })) {
+          rustup target add $triples[$arch]
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          node config/scripts/build-windows-cli-launcher.mjs --arch $arch --output ".build/windows-cli-launcher/$arch/orca.exe"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+        }

.github/scripts/check-required-pr-context.mjs

@@ -0,0 +1,36 @@
+import { readdirSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+export function verifyRequiredPrContext(parseYaml) {
+  const directory = '.github/workflows'
+  const providers = readdirSync(directory)
+    .filter((file) => /\.ya?ml$/.test(file))
+    .flatMap((file) => {
+      const workflow = parseYaml(readFileSync(join(directory, file), 'utf8'))
+      return Object.entries(workflow.jobs)
+        .filter(([id, job]) => (job.name ?? id) === 'PR checks passed')
+        .map(([id, job]) => ({ owner: `${file}:${id}`, job }))
+    })
+  const owners = providers.map((provider) => provider.owner)
+  if (providers.length !== 1 || owners[0] !== 'pr.yml:verify') {
+    throw new Error(`Required PR context must belong only to pr.yml:verify; found ${owners}`)
+  }
+  const gate = providers[0].job
+  const condition = gate.if?.replace(/^\$\{\{\s*|\s*\}\}$/g, '').trim()
+  if (condition !== '!cancelled() && github.event.pull_request.draft != true') {
+    throw new Error('Required PR aggregate must run unless cancelled or the PR is a draft.')
+  }
+  if (gate['continue-on-error'] || gate.steps?.some((step) => step['continue-on-error'])) {
+    throw new Error('Required PR aggregate must not ignore failures.')
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const yaml = globalThis.Bun?.YAML
+  if (!yaml) {
+    throw new Error('Run workflow context validation with the pinned Bun runtime.')
+  }
+  verifyRequiredPrContext(yaml.parse)
+  console.log('Required PR check context verified.')
+}