sync: absorb upstream v1.4.233

.github/CONTRIBUTING.md

@@ -37,6 +37,24 @@ In PowerShell, use `$env:ORCA_DEV_MAIN_SOURCEMAPS='0'` before `pnpm dev`.
 Remove the variable when debugging the main process with source maps. Renderer and
 preload settings are unaffected; production builds always keep their hidden main maps.
 
+Local installs use pnpm's global virtual store: each package version is one slot
+under `~/pnpm/store` that every worktree links to, instead of a full `node_modules` per worktree.
+An existing worktree converts on its next `pnpm install`, and an older branch without the setting
+converts back the same way. CI always uses the normal layout. On Windows, pnpm links with
+junctions when you lack the symlink privilege, so no administrator rights or Developer Mode are
+needed. Things to know:
+
+- Keep `~/node_modules` (and any other `node_modules` above the store) out of your home
+  directory. Node resolves upward from the store slot, so a stray one there supplies
+  dependencies the package never declared and hides missing-dependency bugs; `pnpm install` warns
+  when it finds one.
+- Native addons are never rebuilt in place in a shared slot: each CPU gets its own build
+  beside it (see [`native-build-entry.cjs`](../config/scripts/native-build-entry.cjs)), so
+  cross-arch packaging is safe for other worktrees.
+- `ORCA_PNPM_GLOBAL_VIRTUAL_STORE=0` opts out. Keep it set
+  in your shell: `pnpm run` re-checks the install and relinks a worktree whose layout no longer
+  matches.
+
 Ordinary installs include native optional dependencies for the current OS and CPU only.
 Before a cross-architecture build (including `pnpm build:mac`, which produces both x64 and
 arm64 artifacts by default), run `pnpm install:release` to add the other CPU's variants.

.github/actions/install-node-dependencies/action.yml

@@ -86,7 +86,7 @@ runs:
         case "$LOOKUP_REQUEST" in
           [aA][uU][tT][oO])
             # Hosted runners have Node for this manifest-only check before toolchain setup.
-            lookup_only="$(node -p 'const p = require("./package.json"); p.engines?.node === "24" && typeof p.packageManager === "string" && p.packageManager.split("+")[0] === "pnpm@12.8.1"')"
+            lookup_only="$(node -p 'const p = require("./package.json"); p.engines?.node === "24" && typeof p.packageManager === "string" && p.packageManager.split("+")[0] === "pnpm@12.14.0"')"
             ;;
         esac
         printf 'lookup-only=%s\n' "$lookup_only" >> "$GITHUB_OUTPUT"

.github/actions/prepare-headless-compiler/action.yml

@@ -14,7 +14,7 @@ runs:
     - id: identity
       shell: bash
       env:
-        COMPILER_POLICY_HASH: ${{ hashFiles('package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs', 'config/patches/**', '.github/actions/install-node-dependencies/**', '.github/actions/restore-pnpm-verification/**', 'config/scripts/headless-detector-compiler-cache.mjs', '.github/actions/prepare-headless-compiler/action.yml') }}
+        COMPILER_POLICY_HASH: ${{ hashFiles('package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', 'config/pnpmfile.cjs', 'config/patches/**', '.github/actions/install-node-dependencies/**', '.github/actions/restore-pnpm-verification/**', 'config/scripts/headless-detector-compiler-cache.mjs', '.github/actions/prepare-headless-compiler/action.yml') }}
       run: node config/scripts/headless-detector-compiler-cache.mjs identity
     - id: cache
       uses: actions/cache/restore@v5

.github/actions/prepare-linux-package-fixture/action.yml

@@ -7,10 +7,16 @@ inputs:
   save-cache:
     description: Build and save a missing fixture on the default branch.
     default: 'false'
+  load:
+    description: Load the image here; 'false' only restores, so the caller can load it in a background run step.
+    default: 'true'
 outputs:
   image:
     description: Loaded image to use as a Docker build cache, or empty on a cache miss.
     value: ${{ steps.image.outputs.image }}
+  cache-hit:
+    description: Whether the fixture archive was restored under the exact key.
+    value: ${{ steps.cache.outputs.cache-hit }}
 runs:
   using: composite
   steps:
@@ -20,39 +26,17 @@ runs:
       continue-on-error: true
       with:
         path: ${{ runner.temp }}/orca-package-fixtures/${{ inputs.fixture }}.tar
-        key: linux-package-fixture-v1-${{ runner.os }}-${{ runner.arch }}-linux-amd64-${{ inputs.fixture }}-${{ hashFiles(format('config/docker/{0}/**', inputs.fixture), '.github/actions/prepare-linux-package-fixture/action.yml') }}
+        key: linux-package-fixture-v1-${{ runner.os }}-${{ runner.arch }}-linux-amd64-${{ inputs.fixture }}-${{ hashFiles(format('config/docker/{0}/**', inputs.fixture), '.github/actions/prepare-linux-package-fixture/action.yml', '.github/actions/prepare-linux-package-fixture/load-fixture.sh') }}
 
     - name: Load or seed fixture build cache
       id: image
+      if: inputs.load != 'false'
       shell: bash
       env:
         FIXTURE: ${{ inputs.fixture }}
         SAVE_CACHE: ${{ inputs.save-cache }}
         CACHE_HIT: ${{ steps.cache.outputs.cache-hit }}
-      run: |
-        set -euo pipefail
-        case "$FIXTURE" in
-          headless-serve-shutdown|cli-launch-contract|daemon-shutdown-descendants) ;;
-          *) echo "Unsupported package fixture: $FIXTURE" >&2; exit 1 ;;
-        esac
-        archive="$RUNNER_TEMP/orca-package-fixtures/$FIXTURE.tar"
-        image="orca-package-fixture-$FIXTURE:cache"
-        if [[ "$CACHE_HIT" == true ]] && docker load --input "$archive"; then
-          if docker image inspect "$image" > /dev/null; then
-            echo "image=$image" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-        fi
-        if [[ "$SAVE_CACHE" != true ]]; then
-          echo 'No usable fixture cache; the package runner will build normally.'
-          exit 0
-        fi
-        docker build --platform linux/amd64 --build-arg BUILDKIT_INLINE_CACHE=1 \
-          --tag "$image" --file "config/docker/$FIXTURE/Dockerfile" "config/docker/$FIXTURE"
-        mkdir -p "$(dirname "$archive")"
-        docker save --output "$archive" "$image"
-        echo "image=$image" >> "$GITHUB_OUTPUT"
-        echo 'built=true' >> "$GITHUB_OUTPUT"
+      run: bash "$GITHUB_ACTION_PATH/load-fixture.sh"
 
     - name: Save fixture image
       if: inputs.save-cache == 'true' && steps.cache.outputs.cache-hit != 'true' && steps.image.outputs.built == 'true'

.github/actions/prepare-linux-package-fixture/load-fixture.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Loads a restored fixture image; only the default-branch warmer builds and exports a missing one.
+set -euo pipefail
+case "$FIXTURE" in
+  headless-serve-shutdown|cli-launch-contract|daemon-shutdown-descendants) ;;
+  *) echo "Unsupported package fixture: $FIXTURE" >&2; exit 1 ;;
+esac
+archive="$RUNNER_TEMP/orca-package-fixtures/$FIXTURE.tar"
+image="orca-package-fixture-$FIXTURE:cache"
+if [[ "${CACHE_HIT:-}" == true ]] && docker load --input "$archive"; then
+  if docker image inspect "$image" > /dev/null; then
+    echo "image=$image" >> "$GITHUB_OUTPUT"
+    exit 0
+  fi
+fi
+if [[ "${SAVE_CACHE:-}" != true ]]; then
+  echo 'No usable fixture cache; the package runner will build normally.'
+  exit 0
+fi
+docker build --platform linux/amd64 --build-arg BUILDKIT_INLINE_CACHE=1 \
+  --tag "$image" --file "config/docker/$FIXTURE/Dockerfile" "config/docker/$FIXTURE"
+mkdir -p "$(dirname "$archive")"
+docker save --output "$archive" "$image"
+echo "image=$image" >> "$GITHUB_OUTPUT"
+echo 'built=true' >> "$GITHUB_OUTPUT"

.github/actions/prepare-native-runtime/action.yml

@@ -54,7 +54,7 @@ runs:
       env:
         NATIVE_RUNTIME: ${{ inputs.native-runtime }}
         NODE_VERSION: ${{ inputs.node-version }}
-        NATIVE_SOURCE_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs', '.github/actions/prepare-native-runtime/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/initialize-windows-native-toolchain.mjs', 'config/scripts/capture-windows-native-environment.cmd', 'config/scripts/rebuild-native-deps.mjs', 'config/scripts/node-pty-job-ownership.cjs', 'config/scripts/windows-pe-machine.cjs', 'config/scripts/windows-process-tree-gyp-rebuild.mjs', 'config/scripts/windows-process-tree-creation-time.cjs', 'config/scripts/install-electron-package-binary.mjs', 'config/scripts/electron-platform-path.mjs', 'config/scripts/zip-extractor-command.mjs', 'src/shared/zip-extractor-command.ts', 'config/scripts/shared-electron-dist-cache.mjs', 'config/scripts/space-sharing-copy.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json', 'native/windows-registry/index.js', 'native/windows-security/src/addon.cc', 'native/windows-security/binding.gyp', 'native/windows-security/package.json', 'native/windows-security/index.js') }}
+        NATIVE_SOURCE_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', 'config/pnpmfile.cjs', '.github/actions/prepare-native-runtime/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/initialize-windows-native-toolchain.mjs', 'config/scripts/capture-windows-native-environment.cmd', 'config/scripts/rebuild-native-deps.mjs', 'config/scripts/node-pty-job-ownership.cjs', 'config/scripts/windows-pe-machine.cjs', 'config/scripts/windows-process-tree-gyp-rebuild.mjs', 'config/scripts/windows-process-tree-creation-time.cjs', 'config/scripts/install-electron-package-binary.mjs', 'config/scripts/electron-platform-path.mjs', 'config/scripts/zip-extractor-command.mjs', 'src/shared/zip-extractor-command.ts', 'config/scripts/shared-electron-dist-cache.mjs', 'config/scripts/space-sharing-copy.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json', 'native/windows-registry/index.js', 'native/windows-security/src/addon.cc', 'native/windows-security/binding.gyp', 'native/windows-security/package.json', 'native/windows-security/index.js') }}
       run: |
         scope="${ImageOS:-$RUNNER_OS}"
         if [ -r /etc/os-release ]; then

.github/actions/prepare-wayland-clipboard/action.yml

@@ -5,6 +5,14 @@ inputs:
   save-cache:
     description: Publish a validated helper from the default branch.
     default: 'false'
+  build:
+    description: Build here; 'false' only restores, so the caller can build in a background run step.
+    default: 'true'
+
+outputs:
+  cache-hit:
+    description: Whether the helper was restored under the exact key.
+    value: ${{ steps.cache.outputs.cache-hit }}
 
 runs:
   using: composite
@@ -30,22 +38,14 @@ runs:
         key: ${{ steps.identity.outputs.key }}
 
     - name: Build or validate Wayland clipboard helper
+      if: inputs.build != 'false'
       shell: bash
       env:
         CACHE_HIT: ${{ steps.cache.outputs.cache-hit }}
-      run: |
-        if node config/scripts/build-wayland-clipboard.mjs; then
-          exit 0
-        fi
-        if [ "$CACHE_HIT" != true ]; then
-          exit 1
-        fi
-        echo 'Discarding an unusable Wayland clipboard cache and rebuilding from source.'
-        rm -rf -- native/wayland-clipboard/.build
-        node config/scripts/build-wayland-clipboard.mjs
+      run: bash "$GITHUB_ACTION_PATH/build-or-validate.sh"
 
     - name: Save validated Wayland clipboard helper from main
-      if: inputs.save-cache == 'true' && steps.cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+      if: inputs.build != 'false' && inputs.save-cache == 'true' && steps.cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
       uses: actions/cache/save@v5
       continue-on-error: true
       with:

.github/actions/prepare-wayland-clipboard/build-or-validate.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Validates a restored helper and rebuilds once from source when the restored copy is unusable.
+set -e
+if node config/scripts/build-wayland-clipboard.mjs; then
+  exit 0
+fi
+if [ "${CACHE_HIT:-}" != true ]; then
+  exit 1
+fi
+echo 'Discarding an unusable Wayland clipboard cache and rebuilding from source.'
+rm -rf -- native/wayland-clipboard/.build
+node config/scripts/build-wayland-clipboard.mjs