starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-09-29 08:03:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

merge main into fix/reveal-structured-chat-from-history

Browse Source 
Main landed #18906, which repairs the same epoch-fencing failure from the other
end: when the fence drops a frame it now schedules one bounded authoritative
census, and only that census may revive an epoch. This branch prevents the
wrongful retirement instead — a sentinel or a retraction is no longer recorded
as the current publication.

They compose. Prevention keeps the common case from ever reaching the fence, so
no census round trip and no window where the chat is invisible; the repair lane
still covers a retirement this branch does not prevent, such as a publisher
returning under an epoch it inherited. Kept both sides of the one textual
conflict: the retraction type guard and the census options.
This commit is contained in:
Merge Sim
2026-09-06 00:17:48 -07:00
parent ca7119c4d2 b51bbf3fc6
commit 64e040d0a0
347 changed files with 21610 additions and 2021 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitattributes
+13 -1
View File
@@ -8,7 +8,19 @@
/src/cli/bundled-skill-guides.ts text eol=lf
# Bundled plugin trees are byte-hashed; CRLF checkout would break the pinned hash.
/resources/plugins/** text eol=lf
# pnpm hashes every patch byte-for-byte, so a CRLF checkout breaks the install.
# Relay assets are copied verbatim into the bundle and hashed byte-for-byte into
# .version, which names the immutable remote install dir. A CRLF checkout makes a
# Windows-built client disagree with a mac/Linux-built one on the same release,
# so one host ends up with two relay trees (#17886 review).
/config/relay-assets/** text eol=lf
# Pin the bytes so a patch reads and diffs identically on every host. It is NOT
# what makes the hash right: pnpm hashes a patch LF-normalized, so a CRLF checkout
# cannot change it. Believing otherwise put a hand-computed raw digest in the
# lockfile twice and broke every install (#17886).
# These files are stored LF, which is not always the encoding they were written
# against -- @vscode/windows-process-tree ships CRLF sources -- so any code that
# runs `git apply` on one must force `-c core.autocrlf=input` rather than trust
# the host's setting. See config/scripts/windows-process-tree-gyp-rebuild.mjs.
/config/patches/*.patch -text
# The xterm bundle hunks also make a diff nobody can read; review the hand-written
# source patch under xterm-src/ instead. The sibling patches stay diffable.
.github/scripts/e2e-with-window-manager.sh
+26
View File
@@ -0,0 +1,26 @@
#!/usr/bin/env bash
set -euo pipefail
openbox --sm-disable > /tmp/orca-e2e-window-manager.log 2>&1 &
wm_pid=$!
cleanup() {
kill "$wm_pid" 2>/dev/null || true
wait "$wm_pid" 2>/dev/null || true
}
trap cleanup EXIT
ready=false
for attempt in {1..100}; do
if xprop -root _NET_SUPPORTING_WM_CHECK 2>/dev/null | rg -q 'window id # 0x[1-9a-fA-F]'; then
ready=true
break
fi
if ! kill -0 "$wm_pid" 2>/dev/null; then
cat /tmp/orca-e2e-window-manager.log
exit 1
fi
sleep 0.1
done
if [ "$ready" != true ]; then
echo 'Window manager did not acquire the Xvfb root window' >&2
exit 1
fi
"$@"
.github/workflows/e2e.yml
+12 -8
View File
@@ -27,6 +27,10 @@ on:
description: Ref to check out (defaults to the workflow ref)
required: false
type: string
test_files:
description: JSON array of specs to run; empty runs the full suite
required: false
type: string
schedule:
# Why: GitHub cron uses UTC; these slots map to 10am and 3pm
# America/Phoenix for the default-branch E2E run.
@@ -146,7 +150,7 @@ jobs:
# Native cache misses need the compiler, Electron needs Xvfb, and paired
# Quick Open needs ripgrep. Install them in one apt transaction per shard.
- name: Install native build and headless UI tools
run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk python3 ripgrep xvfb zsh
run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk python3 ripgrep xvfb zsh openbox x11-utils
- uses: ./.github/actions/install-node-dependencies
with:
@@ -167,7 +171,7 @@ jobs:
# ORCA_E2E_FORWARD_APP_LOGS keeps startup failures visible when Electron
# launches but never creates a BrowserWindow.
- name: Run E2E tests (${{ matrix.shard_name }})
run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --shard=${{ matrix.shard }}
run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --shard=${{ matrix.shard }}
# Why: Playwright retains traces/screenshots only on failure. Uploading
# them as an artifact makes post-mortem debugging on CI possible without
@@ -201,7 +205,7 @@ jobs:
# unbounded inventory fallback; the paired fixture exercises that real boundary.
# Why openssh-client: the Docker-SSH fixture shells out to ssh/ssh-keygen, and this
# lane now receives those specs from pr.yml's SSH source mapping.
run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 ripgrep xvfb zsh
run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 ripgrep xvfb zsh openbox x11-utils
- uses: ./.github/actions/install-node-dependencies
with:
@@ -241,7 +245,7 @@ jobs:
if grep -l '@headful' "${TEST_FILES[@]}" >/dev/null; then
E2E_PROJECT_ARGS+=(--project=electron-headful)
fi
xvfb-run --auto-servernum env "${E2E_ENV[@]}" \
xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env "${E2E_ENV[@]}" \
pnpm run test:e2e "${TEST_FILES[@]}" --workers=1 "${E2E_PROJECT_ARGS[@]}"
- name: Upload Playwright traces
@@ -278,7 +282,7 @@ jobs:
ref: ${{ inputs.ref || github.ref }}
- name: Install native build and headless UI tools
run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 xvfb zsh
run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 ripgrep xvfb zsh openbox x11-utils
- uses: ./.github/actions/install-node-dependencies
with:
@@ -293,7 +297,7 @@ jobs:
# Why: this is the release-path proof that the deployed Linux relay keeps
# its PTY and explorer live across a real watcher SIGSEGV.
- name: Run Docker SSH watcher isolation E2E
run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-watcher-isolation
run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-watcher-isolation
# Why: Playwright empties test-results/ when it starts, so each step here used to
# destroy the previous step's traces. Only the last lane's failure was ever
@@ -310,7 +314,7 @@ jobs:
# readiness across live SSH, headed paired, and headless serve topologies.
- name: Run Docker SSH terminal parking + startup readiness E2E
if: always()
run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-terminal-parking
run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-terminal-parking
- name: Keep terminal-parking traces
if: always()
@@ -326,7 +330,7 @@ jobs:
# legible as an SSH-named failure.
- name: Run remaining Docker SSH E2E
if: always()
run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker
run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker
- name: Keep remaining-ssh-docker traces
if: always()
.github/workflows/pr.yml
+10
View File
@@ -832,10 +832,13 @@ jobs:
node_modules/.pnpm/@vscode+windows-process-tree@*/node_modules/@vscode/windows-process-tree/build
key: native-modules-${{ runner.os }}-${{ steps.deps.outputs.native-cache-scope }}-${{ runner.arch }}-node-node${{ steps.deps.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml', '.github/actions/install-node-dependencies/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch') }}
# vitest runs here directly rather than through `pnpm test`, so the addon
# assertions only hold once install-node-dependencies has rebuilt natives.
- name: Test Windows-specific boundaries
run: >-
pnpm exec vitest run --config config/vitest.config.ts
config/scripts/rebuild-native-deps.test.mjs
config/scripts/rebuild-native-deps-windows-process-tree.test.mjs
src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts
src/main/browser/browser-route-tcp-egress.electron.test.ts
src/main/browser/browser-route-webrtc-egress.electron.test.ts
@@ -844,10 +847,13 @@ jobs:
src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts
src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts
src/shared/child-process/windows-command-line.win32.test.ts
src/shared/child-process/windows-cmd-shim-resolution.test.ts
src/shared/child-process/windows-cmd-shim-resolution.win32.test.ts
src/main/agent-hooks/windows-hook-payload-delivery.test.ts
src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts
src/main/windows/windows-pty-job.win32.test.ts
src/main/windows/windows-host-job.win32.test.ts
src/main/windows/windows-process-tree-command-line-patch.test.ts
src/main/windows-live-tree-kill.win32.test.ts
src/main/wsl/wsl-runner.test.ts
src/main/wsl/wsl-guest-environment.test.ts
@@ -856,14 +862,18 @@ jobs:
src/main/wsl/wsl-w1-w3-contract.test.ts
src/shared/source-scan/source-tree-scan.test.ts
src/main/cli/wsl-cli-powershell-boundary.test.ts
src/main/computer/desktop-script-runtime-host.win32.test.ts
src/main/cursor/hook-service.test.ts
src/main/orca-profiles/profile-index-store.test.ts
src/main/startup/windows-install-dir-acl-repair.win32.test.ts
src/main/runtime/repo-worktree-admin-fingerprint.test.ts
src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts
src/shared/secure-file-fsync-flags.test.ts
src/shared/secure-path-windows-acl.win32.test.ts
src/main/runtime/unreadable-secret-store-preservation.win32.test.ts
src/main/ipc/pty-codex-account-attribution.test.ts
src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts
src/relay/windows-port-scan.win32.test.ts
# Why the :parallel variant: identical to build:release except the three
# electron-vite targets overlap instead of running back to back. The Linux package
.github/workflows/release-cut.yml
+133 -20
View File
@@ -809,13 +809,7 @@ jobs:
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
TAG: ${{ needs.cut.outputs.tag }}
run: |
if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
echo "Release $TAG already exists."
exit 0
fi
node config/scripts/create-draft-release.mjs "$TAG"
run: node config/scripts/create-draft-release.mjs "$TAG"
terminal-rendering-golden:
needs: cut
@@ -1427,6 +1421,17 @@ jobs:
command: ${{ matrix.release_command }}
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Why: the NSIS uninstaller only exists inside electron-builder's
# uninstaller pass, which deletes it right after embedding it. The sign
# hook in config/scripts/windows-uninstaller-signing.cjs copies it out
# here so it can ride the inner-binaries SignPath request below.
# Why runner.temp and never the workspace: `files` in
# config/electron-builder.config.cjs is all-negation, so app-builder
# prepends `**/*` and packs whatever is left in the checkout root. This
# step retries up to 3 times; attempt 1 writes the file after packing,
# but attempts 2 and 3 would then pack the unsigned uninstaller into
# app.asar - the exact defect this chain exists to remove.
ORCA_WIN_UNINSTALLER_EXPORT_PATH: ${{ runner.temp }}\uninstaller-signing\unsigned\orca-uninstaller.exe
- name: Verify Windows node-pty ConPTY runtime
if: matrix.platform == 'win' && github.run_attempt == 1
@@ -1453,7 +1458,10 @@ jobs:
# Why: SignPath cannot deep-sign inside NSIS installers, so inner PE
# files (Orca.exe, node-pty *.node, DLLs) are signed via a separate zip
# request, then the installer is rebuilt from the signed tree before the
# existing installer signing request below. Every step in this chain is
# existing installer signing request below. The NSIS uninstaller rides
# this same request (it is the MDE update cluster: old-uninstaller.exe /
# Uninstall Orca.exe), captured through electron-builder's sign hook and
# swapped back in during the rebuild — no third approval wait. Every step is
# fail-open (continue-on-error + outcome gating): any failure ships the
# original installer with unsigned inner binaries, exactly like releases
# did before this chain existed. Rehearsed end to end in run 28988432001
@@ -1500,6 +1508,36 @@ jobs:
Write-Host "Skipped $($skipped.Count) already-signed files:"
$skipped | ForEach-Object { Write-Host " $_" }
# Why the uninstaller rides this request: it is the file MDE flagged in
# the whole update cluster (old-uninstaller.exe / Uninstall Orca.exe),
# and folding it in here costs no extra approval wait. Why it is kept
# out of inner-signing-list.txt: that list drives the copy-back into
# dist/win-unpacked, and the uninstaller does not live there — it is
# re-injected through the sign hook during the rebuild instead.
# Why this name and not "Uninstall Orca.exe": the restore loop below
# matches staged files by suffix (`-like "*$relative"`) and takes the
# first hit, so any staged path ending in "Orca.exe" is separated from
# the real Orca.exe only by Get-ChildItem's enumeration order. That
# order happens to favour the root file today, but it is not a
# documented guarantee; a name that cannot suffix-match is.
# Why the whole block is caught rather than just Test-Path'd: this
# step's outcome gates the upload of every inner binary, so a locked
# file or a full disk here would cost all of them their signatures -
# worse than shipping no uninstaller signature at all.
try {
$exportedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\unsigned\orca-uninstaller.exe'
if (Test-Path -LiteralPath $exportedUninstaller) {
$uninstallerStagePath = Join-Path $stage.FullName 'uninstaller\orca-uninstaller.exe'
New-Item -ItemType Directory -Force -Path (Split-Path $uninstallerStagePath) -ErrorAction Stop | Out-Null
Copy-Item -LiteralPath $exportedUninstaller -Destination $uninstallerStagePath -Force -ErrorAction Stop
Write-Host 'Staged the NSIS uninstaller for signing: uninstaller\orca-uninstaller.exe'
} else {
Write-Host "::warning::No exported NSIS uninstaller at $exportedUninstaller; this release ships an unsigned uninstaller (fail-open)."
}
} catch {
Write-Host "::warning::Could not stage the NSIS uninstaller ($_); this release ships an unsigned uninstaller (fail-open)."
}
- name: Upload unsigned inner binaries for SignPath
id: upload-unsigned-inner
if: matrix.platform == 'win' && github.run_attempt == 1 && steps.stage-inner.outcome == 'success'
@@ -1644,6 +1682,31 @@ jobs:
throw "Signed inner artifact did not round-trip cleanly ($($failures.Count) failures)."
}
# Why gated separately from the inner restore above: if SignPath's
# windows-inner-binaries-zip artifact configuration does not (yet) cover the
# uninstaller/ directory, the uninstaller comes back missing. That must cost
# only the uninstaller signature — the rebuild below still runs and still
# ships the signed inner binaries, exactly as it does today.
- name: Restore signed uninstaller for the installer rebuild
id: restore-signed-uninstaller
if: matrix.platform == 'win' && github.run_attempt == 1 && steps.restore-signed-inner.outcome == 'success'
continue-on-error: true
shell: pwsh
run: |
$signed = Get-ChildItem -Path signed-inner -Recurse -File -Filter 'orca-uninstaller.exe' |
Select-Object -First 1
if ($null -eq $signed) {
throw 'SignPath did not return uninstaller/orca-uninstaller.exe; check the windows-inner-binaries-zip artifact configuration covers it.'
}
$signature = Get-AuthenticodeSignature -FilePath $signed.FullName
if ($null -eq $signature.SignerCertificate) {
throw 'The returned NSIS uninstaller carries no signature.'
}
$signedDir = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed'
New-Item -ItemType Directory -Force -Path $signedDir | Out-Null
Copy-Item -LiteralPath $signed.FullName -Destination (Join-Path $signedDir 'orca-uninstaller.exe') -Force
Write-Host ("{0,-14} uninstaller <{1}>" -f $signature.Status, $signature.SignerCertificate.Subject)
# Why this step exists: electron-builder's CopyElevateHelper re-copies a
# pristine elevate.exe from its download cache over resources\elevate.exe
# on EVERY nsis pack — including the --prepackaged rebuild below — which
@@ -1653,9 +1716,12 @@ jobs:
# no-op. Known quirk: the cache persists across releases via actions/cache,
# so later runs may see elevate.exe as already signed and skip staging it —
# that is fine (the signature is timestamped) and the evidence gate checks
# elevate.exe in the shipped installer unconditionally. If this ever causes
# trouble, delete this step; the only effect is elevate.exe shipping
# unsigned again, which the evidence gate will flag.
# elevate.exe in the shipped installer unconditionally.
#
# The cache lookup lives in a script because the inline path this step used
# (`<cache>\nsis`) matches no app-builder-lib layout, and `SilentlyContinue`
# plus `exit 0` turned that miss into a green step — v1.4.193 and v1.4.194
# shipped an unsigned elevate.exe that way. A miss now fails the step.
- name: Replace cached elevate.exe with the signed copy
id: sign-elevate-cache
if: matrix.platform == 'win' && github.run_attempt == 1 && steps.restore-signed-inner.outcome == 'success'
@@ -1667,20 +1733,26 @@ jobs:
Write-Host '::warning::No elevate.exe in win-unpacked resources; nothing to protect from the rebuild clobber.'
exit 0
}
# Why this guard stays: windows-signing-rehearsal.yml shares the
# electron-builder-win-<lockfile hash> cache key with this workflow, so a
# test-certificate elevate.exe must never be staged into a release cache.
$signature = Get-AuthenticodeSignature -FilePath $signed
$subject = if ($null -eq $signature.SignerCertificate) { '<none>' } else { $signature.SignerCertificate.Subject }
if ($signature.Status -ne 'Valid' -or $subject -notlike '*CN=SignPath Foundation*') {
Write-Host "::warning::win-unpacked elevate.exe is not SignPath-signed ($($signature.Status), $subject); skipping cache swap."
exit 0
}
$cached = @(Get-ChildItem "$env:LOCALAPPDATA\electron-builder\Cache\nsis" -Recurse -Filter elevate.exe -ErrorAction SilentlyContinue)
if ($cached.Count -eq 0) {
Write-Host '::warning::No cached elevate.exe found (electron-builder cache layout changed?); the rebuild will pack the unsigned copy and the evidence gate will flag it.'
exit 0
}
foreach ($file in $cached) {
Copy-Item -Path $signed -Destination $file.FullName -Force
Write-Host "Replaced $($file.FullName) with the SignPath-signed copy."
node config/scripts/replace-cached-nsis-elevate.mjs $signed
if ($LASTEXITCODE -ne 0) {
$message = 'Cached elevate.exe swap found nothing to replace; the rebuilt installer ships an unsigned UAC elevation helper (issue #7785).'
if ($env:GITHUB_STEP_SUMMARY) {
try {
Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value "**Windows elevate.exe cache swap:** FAILED — $message" -ErrorAction Stop
} catch {
Write-Host "::warning::Could not write the elevate.exe swap verdict to the job summary: $_"
}
}
throw $message
}
- name: Rebuild NSIS installer from signed unpacked app
@@ -1688,6 +1760,11 @@ jobs:
if: matrix.platform == 'win' && github.run_attempt == 1 && steps.restore-signed-inner.outcome == 'success'
continue-on-error: true
shell: pwsh
env:
# Why unconditional: the sign hook keys off the file existing, which it
# only does when the restore step above succeeded. A missing file logs a
# warning and embeds the freshly built unsigned uninstaller instead.
ORCA_WIN_UNINSTALLER_SIGNED_PATH: ${{ runner.temp }}\uninstaller-signing\signed\orca-uninstaller.exe
run: |
# Why: keep the pre-rebuild artifacts so a failed rebuild can fall
# back to shipping them unchanged (fail-open).
@@ -1879,6 +1956,7 @@ jobs:
env:
ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED: 'false'
INNER_SIGNING_COMPLETED: ${{ steps.rebuild-nsis-signed.outcome == 'success' }}
UNINSTALLER_SIGNING_COMPLETED: ${{ steps.restore-signed-uninstaller.outcome == 'success' }}
run: |
$required = $env:ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED -eq 'true'
@@ -1959,6 +2037,39 @@ jobs:
if ($targets -notcontains 'resources\elevate.exe') {
$targets += 'resources\elevate.exe'
}
# Why the uninstaller is not in $targets: NSIS embeds it in its own
# compressed data section (`File /oname=${UNINSTALL_FILENAME}` in
# app-builder-lib templates/nsis/include/installer.nsh), not in the
# app 7z payload extracted above - the bundled 7za cannot see it.
# What the receipt proves and does not: the digest comparison is
# equal by construction (the hook digests the bytes it copied from
# this same file), so the real signal is that the receipt exists at
# all - the import leg ran, and these are the bytes it embedded. The
# signature check below is the part with teeth. The shipped-artifact
# check lives in windows-signing-rehearsal.yml, which installs the
# installer and inspects the uninstaller it drops on disk.
if ($env:UNINSTALLER_SIGNING_COMPLETED -eq 'true') {
$signedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed\orca-uninstaller.exe'
$receipt = "$signedUninstaller.embedded-sha256"
if (-not (Test-Path -LiteralPath $receipt)) {
$failures.Add('the sign hook did not embed the signed uninstaller into the rebuilt installer')
} else {
$embedded = (Get-Content -LiteralPath $receipt -Raw).Trim()
$actual = (Get-FileHash -LiteralPath $signedUninstaller -Algorithm SHA256).Hash.ToLowerInvariant()
$signature = Get-AuthenticodeSignature -FilePath $signedUninstaller
$subject = if ($null -eq $signature.SignerCertificate) { '<none>' } else { $signature.SignerCertificate.Subject }
$line = "{0,-14} {1} <{2}>" -f $signature.Status, 'Uninstall Orca.exe (embedded)', $subject
$report.Add($line)
Write-Host $line
if ($embedded -ne $actual) {
$failures.Add("the rebuilt installer embedded different uninstaller bytes than the signed one ($embedded vs $actual)")
} elseif ($signature.Status -ne 'Valid' -or $subject -notlike '*CN=SignPath Foundation*') {
$failures.Add("not signed by SignPath Foundation: Uninstall Orca.exe ($($signature.Status), $subject)")
}
}
} else {
Write-Host '::warning::The NSIS uninstaller was not signed on this run; it is excluded from the evidence gate (fail-open).'
}
foreach ($relative in $targets) {
$path = Join-Path $root $relative
if (-not (Test-Path $path)) {
@@ -1991,7 +2102,9 @@ jobs:
Add-GateEvidence "VERDICT: FAILED — $message"
Add-GateSummary "FAILED — $message"
} else {
$ok = "All $($targets.Count) inner binaries in the shipped installer are signed by SignPath Foundation."
# $report, not $targets: the embedded uninstaller is reported but
# is not one of the extracted payload targets.
$ok = "All $($report.Count) checked binaries are signed by SignPath Foundation."
Add-GateEvidence "VERDICT: PASSED — $ok"
Add-GateSummary "PASSED — $ok"
Write-Host $ok
.github/workflows/windows-signing-rehearsal.yml
+203 -12
View File
@@ -3,9 +3,11 @@
# Why: SignPath cannot deep-sign inside NSIS installers, so shipping signed
# inner binaries (Orca.exe, node-pty *.node, DLLs — see issue #7785) requires
# a two-request flow: sign the unpacked PE files first, then build the NSIS
# installer from the signed tree, then sign the installer. This workflow
# rehearses that entire flow from a branch, end to end, without publishing
# anything — so the release pipeline on main is never at risk while we verify.
# installer from the signed tree, then sign the installer. The NSIS uninstaller
# rides that same first request — it is captured through electron-builder's sign
# hook and swapped back in during the rebuild — so it adds no third approval.
# This workflow rehearses that entire flow from a branch, end to end, without
# publishing anything — so the release pipeline on main is never at risk.
#
# Runs only via manual dispatch. Use the test-signing policy for iteration
# (auto-approved test certificate) and release-signing to rehearse the
@@ -81,15 +83,27 @@ jobs:
env:
NODE_OPTIONS: --max-old-space-size=4096
- name: Package unpacked Windows app
# Why a full --win build and not --dir: the NSIS uninstaller only exists
# inside the installer build, and it is the file the MDE update cluster
# flags. --dir would never produce it, so the rehearsal would not rehearse
# the uninstaller leg at all. This mirrors release-cut's first Windows pass.
- name: Package Windows app and export the NSIS uninstaller
shell: pwsh
env:
# runner.temp, never the workspace: the all-negation `files` list in
# config/electron-builder.config.cjs packs whatever is left in the
# checkout root into app.asar.
ORCA_WIN_UNINSTALLER_EXPORT_PATH: ${{ runner.temp }}\uninstaller-signing\unsigned\orca-uninstaller.exe
run: |
node config/scripts/ensure-native-runtime.mjs --runtime=electron
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
pnpm exec electron-builder --config config/electron-builder.config.cjs --win --dir --publish never
pnpm exec electron-builder --config config/electron-builder.config.cjs --win --publish never
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
if (-not (Test-Path 'dist/win-unpacked/Orca.exe')) {
throw 'electron-builder --dir did not produce dist/win-unpacked/Orca.exe'
throw 'electron-builder --win did not produce dist/win-unpacked/Orca.exe'
}
if (-not (Test-Path -LiteralPath $env:ORCA_WIN_UNINSTALLER_EXPORT_PATH)) {
throw "The sign hook did not export the NSIS uninstaller to $env:ORCA_WIN_UNINSTALLER_EXPORT_PATH"
}
# Why: only unsigned PE files go to SignPath. Files that already carry a
@@ -132,6 +146,17 @@ jobs:
Write-Host "Skipped $($skipped.Count) already-signed files:"
$skipped | ForEach-Object { Write-Host " $_" }
# Why kept out of inner-signing-list.txt: that list drives the copy-back
# into dist/win-unpacked, and the uninstaller does not live there — it is
# re-injected through the electron-builder sign hook during the rebuild.
# No catch here, unlike the release job: the rehearsal exists to prove
# the flow, so a staging failure must fail it loudly.
$exportedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\unsigned\orca-uninstaller.exe'
$uninstallerStagePath = Join-Path $stage.FullName 'uninstaller\orca-uninstaller.exe'
New-Item -ItemType Directory -Force -Path (Split-Path $uninstallerStagePath) | Out-Null
Copy-Item -LiteralPath $exportedUninstaller -Destination $uninstallerStagePath -Force
Write-Host 'Staged the NSIS uninstaller for signing: uninstaller\orca-uninstaller.exe'
- name: Upload unsigned inner binaries for SignPath
id: upload-unsigned-inner
uses: actions/upload-artifact@v7
@@ -200,8 +225,27 @@ jobs:
throw "Signed inner artifact did not round-trip cleanly ($($failures.Count) failures)."
}
- name: Restore signed uninstaller for the installer rebuild
shell: pwsh
run: |
$signed = Get-ChildItem -Path signed-inner -Recurse -File -Filter 'orca-uninstaller.exe' |
Select-Object -First 1
if ($null -eq $signed) {
throw 'SignPath did not return uninstaller/orca-uninstaller.exe; check the inner-binaries artifact configuration covers it.'
}
$signature = Get-AuthenticodeSignature -FilePath $signed.FullName
if ($null -eq $signature.SignerCertificate) {
throw 'The returned NSIS uninstaller carries no signature.'
}
$signedDir = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed'
New-Item -ItemType Directory -Force -Path $signedDir | Out-Null
Copy-Item -LiteralPath $signed.FullName -Destination (Join-Path $signedDir 'orca-uninstaller.exe') -Force
Write-Host ("{0,-14} uninstaller <{1}>" -f $signature.Status, $signature.SignerCertificate.Subject)
- name: Build NSIS installer from signed unpacked app
shell: pwsh
env:
ORCA_WIN_UNINSTALLER_SIGNED_PATH: ${{ runner.temp }}\uninstaller-signing\signed\orca-uninstaller.exe
run: |
pnpm exec electron-builder --config config/electron-builder.config.cjs --win --publish never --prepackaged "$env:GITHUB_WORKSPACE\dist\win-unpacked"
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
@@ -289,20 +333,33 @@ jobs:
run: |
$report = New-Object System.Collections.Generic.List[string]
$failures = New-Object System.Collections.Generic.List[string]
$advisories = New-Object System.Collections.Generic.List[string]
$requireValid = $env:SIGNING_POLICY -eq 'release-signing'
function Test-Signature([string]$label, [string]$path) {
# -Advisory records a problem without failing the run. It exists for
# exactly one file (resources\elevate.exe, below) and must not be
# widened casually: the point of this workflow is to fail when signing
# is broken.
function Test-Signature([string]$label, [string]$path, [switch]$Advisory) {
$signature = Get-AuthenticodeSignature -FilePath $path
$subject = if ($null -eq $signature.SignerCertificate) { '<none>' } else { $signature.SignerCertificate.Subject }
$line = "{0,-14} {1} <{2}>" -f $signature.Status, $label, $subject
$script:report.Add($line)
Write-Host $line
$problem = $null
if ($null -eq $signature.SignerCertificate -or $signature.Status -eq 'NotSigned') {
$script:failures.Add("unsigned: $label")
$problem = "unsigned: $label"
} elseif ($script:requireValid -and $signature.Status -ne 'Valid') {
$script:failures.Add("not Valid under release-signing: $label ($($signature.Status))")
$problem = "not Valid under release-signing: $label ($($signature.Status))"
} elseif ($script:requireValid -and $subject -notlike '*CN=SignPath Foundation*') {
$script:failures.Add("unexpected signer: $label ($subject)")
$problem = "unexpected signer: $label ($subject)"
}
if ($null -eq $problem) { return }
if ($Advisory) {
$script:advisories.Add($problem)
Write-Host "::warning::$problem - known pre-existing issue, not failing the rehearsal"
} else {
$script:failures.Add($problem)
}
}
@@ -324,21 +381,155 @@ jobs:
& $7za x 'dist/orca-windows-setup.exe' '-oextracted-app' -y | Out-Null
$root = Resolve-Path 'extracted-app'
# The receipt only proves the import leg ran; it cannot prove what NSIS
# embedded, because the uninstaller lives in a compressed NSIS data
# section rather than the app 7z payload above and the bundled 7za has
# no NSIS handler. So the rehearsal - unlike the release job, which
# must not mutate the runner it publishes from - goes all the way: it
# installs the installer silently and inspects the uninstaller the
# installer actually wrote to disk. That is the file MDE flags.
$signedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed\orca-uninstaller.exe'
$receipt = "$signedUninstaller.embedded-sha256"
if (-not (Test-Path -LiteralPath $receipt)) {
$failures.Add('the sign hook did not embed the signed uninstaller into the rebuilt installer')
} else {
Test-Signature 'relayed: orca-uninstaller.exe' $signedUninstaller
}
# Why a full 7-Zip attempt first: it is non-invasive. The runner image
# ships the complete 7z.exe, which - unlike the reduced 7za - has an
# NSIS handler. If it cannot read the section either, fall back to a
# real silent install.
$installedUninstaller = $null
$installedVia = $null
$expectedDigest = if (Test-Path -LiteralPath $receipt) { (Get-Content -LiteralPath $receipt -Raw).Trim() } else { $null }
$full7z = 'C:\Program Files\7-Zip\7z.exe'
if (Test-Path -LiteralPath $full7z) {
New-Item -ItemType Directory -Path nsis-extract -Force | Out-Null
& $full7z x -tnsis 'dist/orca-windows-setup.exe' '-onsis-extract' -y 2>&1 | Out-Null
$installedUninstaller = Get-ChildItem -Path nsis-extract -Recurse -File -Filter 'Uninstall*.exe' -ErrorAction SilentlyContinue |
Select-Object -First 1
# Why the digest guard before trusting this route: 7-Zip's NSIS
# handler emits partial or garbled output on some NSIS builds, and a
# truncated extract would score NotSigned and fail the rehearsal as
# "the shipped uninstaller is unsigned" when nothing is wrong. Only
# trust it when it reproduces the bytes the relay embedded; otherwise
# fall through to the install route, which is ground truth. A name
# miss (the handler labelling the entry by its source name) falls
# through the same way.
if ($null -ne $installedUninstaller -and $null -ne $expectedDigest -and
(Get-FileHash -LiteralPath $installedUninstaller.FullName -Algorithm SHA256).Hash.ToLowerInvariant() -ne $expectedDigest) {
Write-Host "7-Zip's NSIS output did not match the relayed digest; falling back to a silent install."
$installedUninstaller = $null
}
if ($null -ne $installedUninstaller) {
$installedVia = "7-Zip's NSIS handler"
Write-Host "Read the embedded uninstaller with 7-Zip's NSIS handler: $($installedUninstaller.FullName)"
} else {
Write-Host "7-Zip's NSIS handler did not yield a usable uninstaller; falling back to a silent install."
}
}
if ($null -eq $installedUninstaller) {
# Nothing here is published, so mutating this runner is free.
# Why -PassThru and a bounded wait rather than -Wait: a bare -Wait on
# an installer that ever prompts hangs to the job's 360-minute cap.
$installerProcess = Start-Process -FilePath (Resolve-Path 'dist/orca-windows-setup.exe') -ArgumentList '/S' -PassThru
if (-not $installerProcess.WaitForExit(300000)) {
$installerProcess | Stop-Process -Force -ErrorAction SilentlyContinue
$failures.Add('the silent install did not exit within 5 minutes; it is likely prompting')
}
# Why a poll rather than one Stop-Process: the oneClick installer
# launches the app as it finishes, so Orca.exe can appear *after* the
# installer process exits. A single silenced Stop-Process would miss
# it and leave Orca plus orca-terminal-daemon.exe holding handles
# under %LOCALAPPDATA%\Programs for the rest of the job.
for ($attempt = 0; $attempt -lt 20; $attempt++) {
$running = @(Get-Process -Name 'Orca' -ErrorAction SilentlyContinue)
if ($running.Count -gt 0) {
$running | Stop-Process -Force -ErrorAction SilentlyContinue
break
}
Start-Sleep -Milliseconds 500
}
Get-Process -Name 'orca-terminal-daemon' -ErrorAction SilentlyContinue |
Stop-Process -Force -ErrorAction SilentlyContinue
$installedUninstaller = Get-ChildItem -Path "$env:LOCALAPPDATA\Programs" -Recurse -File -Filter 'Uninstall*.exe' -ErrorAction SilentlyContinue |
Where-Object { $_.FullName -like '*Orca*' } |
Select-Object -First 1
if ($null -ne $installedUninstaller) { $installedVia = 'a silent install' }
}
if ($null -eq $installedUninstaller) {
$failures.Add('could not obtain the uninstaller the installer ships; neither 7-Zip nor a silent install produced it')
} else {
# Why this digest comparison is the point of the whole rehearsal:
# unlike the release job's, it hashes a file NSIS itself wrote out
# rather than the file the hook copied, so it is the only check that
# proves the shipped installer embedded the SignPath-signed bytes. On
# the 7-Zip route the guard above already forced equality; on the
# install route this is the first time it is tested.
if ($null -ne $expectedDigest) {
$shippedDigest = (Get-FileHash -LiteralPath $installedUninstaller.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
if ($shippedDigest -ne $expectedDigest) {
$failures.Add("the uninstaller the installer ships is not the relayed one (via $installedVia): $shippedDigest vs $expectedDigest")
}
}
Test-Signature "shipped: Uninstall Orca.exe (via $installedVia)" $installedUninstaller.FullName
}
foreach ($relative in Get-Content 'inner-signing-list.txt') {
$path = Join-Path $root $relative
if (-not (Test-Path $path)) {
$failures.Add("missing from installer payload: $relative")
continue
}
Test-Signature "installed: $relative" $path
# Why elevate.exe alone is advisory: app-builder-lib re-copies the
# pristine cached elevate.exe over resources\elevate.exe on EVERY nsis
# pack - AppPackageHelper.packArch calls elevateHelper.copy() before
# buildAppPackage (nsisUtil.js), and CopyElevateHelper.copy does
# `copyFile(elevatePath, outFile, false)` then `signIf(outFile)`, which
# signs nothing because this build configures no certificate. So the
# signed copy restored into win-unpacked is clobbered by the rebuild.
# This predates the uninstaller relay and is not caused by it: with no
# `sign` hook, signIf already returned false at "no signing info
# identified" (windowsSignToolManager.js), so no signtool call was
# displaced. release-cut.yml mitigates it separately by pre-seeding the
# electron-builder cache ("Replace cached elevate.exe with the signed
# copy"); this workflow has no such step, which is why the clobber is
# visible here and not there. Mirroring that step here would not help:
# it only swaps when the copy is already Valid and SignPath-signed, so
# it no-ops under the test certificate.
#
# DO NOT relax that Valid + SignPath-signed guard to make this
# rehearsal go green. This workflow and release-cut.yml share the
# cache key `electron-builder-win-<lockfile hash>`, and that guard is
# the only thing stopping a test certificate from being seeded into
# the cache a real release restores from. Shipping users a binary
# signed by "Test certificate for 'Orca agent ide [OSS]'" is worse
# than shipping it unsigned.
#
# Fixing elevate.exe belongs in its own PR - it is a UAC elevation
# helper, and it deserves more scrutiny than a footnote in an
# uninstaller change.
if ($relative -eq 'resources\elevate.exe') {
Test-Signature "installed: $relative" $path -Advisory
} else {
Test-Signature "installed: $relative" $path
}
}
if ($advisories.Count -gt 0) {
$report.Add('')
$report.Add('ADVISORY (known pre-existing, did not fail this run):')
$advisories | ForEach-Object { $report.Add(" $_") }
}
Set-Content -Path 'signing-evidence.txt' -Value ($report -join "`n")
if ($failures.Count -gt 0) {
$failures | ForEach-Object { Write-Host "::error::$_" }
throw "Signing rehearsal failed with $($failures.Count) problems."
}
Write-Host "All $((Get-Content 'inner-signing-list.txt').Count) inner binaries plus the installer are signed."
Write-Host "All checked binaries are signed, including the uninstaller the installer writes to disk ($($advisories.Count) advisory)."
- name: Upload rehearsal evidence and installer
if: always()
.gitignore
+2
View File
@@ -110,6 +110,8 @@ docs/**
!docs/reference/macos-press-and-hold.md
!docs/reference/orcad-operations.md
!docs/reference/relay-grace-time-reconfiguration.md
!docs/reference/windows-cmd-shim-resolution.md
!docs/reference/windows-daemon-host-relocation.md
!docs/reference/windows-edr-posture.md
!docs/reference/windows-process-enumeration.md
!docs/reference/wsl-runner-verification.md
AGENTS.md
+8 -1
View File
@@ -4,6 +4,12 @@ All UI work — layout, color, typography, spacing, component selection, UX beha
## Electron UI Validation
Always run tests and agent-launched apps in the background with `ORCA_BACKGROUND_LAUNCH=1`.
Never steal monitor focus or reveal test windows: no `show()`, `showInactive()`, `bringToFront()`,
`app.focus()`, or OS activation. Use CDP screenshots of hidden renderers. Keep native-focus and
visible-window tests paused on the user's desktop; run them on an isolated display or CI.
Rebuild modified launch-policy code before running an app; stale build wrappers are not safe.
Use the `$electron` skill and Playwright CDP for rendered Orca UI checks. Do not use computer-use for Orca UI validation.
# Style
@@ -47,8 +53,9 @@ Orca targets macOS, Linux, and Windows. Keep all platform-dependent behavior beh
- **Shortcut labels in UI**: Display `⌘` / `⇧` on Mac and `Ctrl+` / `Shift+` on other platforms.
- **File paths**: Use `path.join` or Electron/Node path utilities — never assume `/` or `\`.
- **Windows setup scripts**: the setup/issue-command runner is a `.cmd` batch file unless the script starts with a `#!` line — never derive that from the user's terminal-shell preference, and never launch a `.cmd` runner with a bare `cmd.exe /c` from a Git Bash pane (MSYS rewrites the `/c`). See [`docs/reference/windows-setup-shell.md`](./docs/reference/windows-setup-shell.md).
- **Windows child processes**: start them through `runProcess`/`spawnProcess` in `src/shared/child-process/` — never `child_process` directly. It pins `windowsHide`, refuses `shell: true`, and encodes `.cmd`/`.bat` arguments so neither `CommandLineToArgvW` nor `cmd.exe` mangles them. A ratchet test fails on any new direct import.
- **Windows child processes**: start them through `runProcess`/`spawnProcess` in `src/shared/child-process/` — never `child_process` directly. It pins `windowsHide`, refuses `shell: true`, and encodes `.cmd`/`.bat` arguments so neither `CommandLineToArgvW` nor `cmd.exe` mangles them. A ratchet test fails on any new direct import. Recognised npm/pnpm `.cmd` shims are resolved to their real target so the spawn skips `cmd.exe` entirely; see [`docs/reference/windows-cmd-shim-resolution.md`](./docs/reference/windows-cmd-shim-resolution.md) before adding a shim shape or debugging one.
- **Windows process enumeration**: read the table through `src/main/windows/windows-process-table.ts`, never by forking `powershell.exe`. See [`docs/reference/windows-process-enumeration.md`](./docs/reference/windows-process-enumeration.md).
- **Windows daemon-host relocation**: the terminal daemon runs from a copy of the app runtime under `%LOCALAPPDATA%`, which is what survives an auto-update. Before touching that copy, its exe name, or the NSIS uninstall macro, read [`docs/reference/windows-daemon-host-relocation.md`](./docs/reference/windows-daemon-host-relocation.md).
- **Windows EDR signal**: don't add `-ExecutionPolicy Bypass`, `-EncodedCommand`, `cmd.exe /c` with escaped free text, per-operation interpreter spawning, or runtime `Add-Type` compilation without reading [`docs/reference/windows-edr-posture.md`](./docs/reference/windows-edr-posture.md) first — behavioural EDR scores each of those, and being signed does not clear them.
- **WSL commands**: build argv with `buildWslExecArgs` (always `--exec` — under `--`, `wsl.exe` expands `$name` in every argument and silently rewrites the script), and fence anything whose stdout you parse with `buildWslCapturedLoginShellCommand`, because the interactive login shell prints the distro banner to stdout. See [`docs/reference/wsl-command-execution.md`](./docs/reference/wsl-command-execution.md).
- **Linux native modules**: keep the glibc floor at Ubuntu 20.04 / glibc 2.31. A module compiled from source on a newer runner can reference symbol versions absent on the floor and crash the app on startup. See [`docs/reference/linux-glibc-compatibility.md`](./docs/reference/linux-glibc-compatibility.md); packaging fails if a bundled native binary needs newer glibc.
cloud/docs/relay-reconnect-2026-09-findings.md
+11
View File
@@ -989,3 +989,14 @@ Owner: "sure, feel free to drive these." Sequence chosen: Roll 1 first (highest
| Monitor dry-run #50 | Dispatched 21:54Z at gen 146 on main `51eed5a1bc`, run 33994385666. **Green** 22:10Z, 16/16 samples. Main had moved to `d7767fb196`; trusted paths identical to `a3c1d32995`. Chain dispatched the c29 `canary-apply` (run 33995164002, protocol 0) 12 s after green. |
| c29 canary (run 33995164002, `canary-apply`) | **Success** 22:27Z. Isolate → migration-only at **gen 147**, verifier passed on the old image (1 199 assignments), Terraform applied same-cap template `…20260905221622`, new incarnation on `519f4914` at protocol 0, verifier passed at migration-only, activate → **gen 148**, c29 general, verifier passed (1 199 assignments carried). No `container die` fleet-wide 22:11Z–22:30Z. |
| **Roll 1 complete** | Image census 22:30Z from MIG templates: c8–c10, c13–c16, c19–c29 on `519f4914` (18 cells); c7 on `85bf6799` (the earlier rehearsal image, carries the same fix); existing-only c1–c6, c11, c12 and migration-only c17, c18 untouched by design. No serving cell remains on `5aedbca5`. Selector gen 148, membership unchanged from the start of the roll. Zero relay container exits fleet-wide across the roll (01:14Z–22:30Z). Gates used: #19–#50; freezes were all monitor-side (provenance, freshness, flat Asia latency bar, one Cloud Monitoring collector failure), none a fleet health finding. Roll 2 (fresh image with #18722 + #18720) is the next data-plane step and waits on the owner's private-IP window decision. |
## Roll 2 (image `4916ed67`, 2026-09-06)
| Step | Result | Evidence |
|---|---|---|
| Docs split | #18958 merged `3bb038a185` (findings, checklist, roadmap, Roll 2 plan). | |
| Code PR | #18959 merged `61b09b7a02` (rebase of #18565 onto main; desktop rotation change dropped since #18719 shipped a proportional version). Two Opus review rounds: round 1 caught the mobile fail-fast rejecting on any socket close (one AP flap would book the 60 s cooldown) → 2 s grace, re-armed once on `handshaking`; round 2 caught a removed jitter assertion that let a one-sided jitter pass → exact pin on the top of the band. Control lease 55 min → 6 h ± 30 min. | |
| Image publish | run 34002233801 → `sha256:4916ed676d8389f694a648e750f1112d9002d68c84a1e0c7af828d5af129de62`; mirrored to staging (run 34002326150). | |
| Staging cell smoke | **Dropped.** Staging C4 is pinned to the Asia launch digest by `relay-staging-c4-refresh-workflow.test.mjs` (with production c27–c29 tfvars and the C4 recovery workflow) and the only C4 image-refresh path pins its accepted predecessor to an older digest. Re-pinning all of it for a smoke widens into the Asia launch machinery; #18969 closed. Roll 2 follows the Roll 1 path: director first, c7 as the rehearsal cell. | |
| Director deploy | run 34002673626 **success** 01:02Z: serving `orca-cloud-relay-00575-leq` on `4916ed67`, `00574-wag` (same image) tagged `selector-rollback`, `00569-ret` (`519f4914`) still deployable. Baseline before: 1 director Postgres retry in the prior hour, 0 `container die`. | |
| c7 `verify` (read-only) | run 34002885408 dispatched 01:03Z, target `4916ed67`, rollback `85bf6799`, protocol 1, gen 148. | |
config/electron-builder.config.cjs
+12 -3
View File
@@ -19,6 +19,7 @@ const {
} = require('./scripts/verify-packaged-node-pty-job-ownership.cjs')
const { verifySkillsCliRuntime } = require('./scripts/verify-skills-cli-runtime.cjs')
const { verifyStaticAppImagePackage } = require('./scripts/static-appimage-package-contract.cjs')
const { signWindowsUninstallerViaSignPath } = require('./scripts/windows-uninstaller-signing.cjs')
// Why: dev-channel builds must carry the *release* identity — same bundle id,
// Developer ID signature, and notarization ticket — or Squirrel.Mac refuses to
@@ -401,9 +402,17 @@ module.exports = {
// name is absent. An unsigned build that still claimed 'SignPath Foundation'
// would therefore reject its own channel's next build — and its way back to
// stable with it. Dropping it is what makes dev→dev and dev→stable work.
...(isWinDevChannel
? { verifyUpdateCodeSignature: false }
: { signtoolOptions: { publisherName: 'SignPath Foundation' } }),
// Why a sign hook on a build that does not sign: it is the only moment
// electron-builder exposes the NSIS uninstaller (built in its own makensis
// pass, embedded, then deleted). The hook signs nothing — it relays the file
// to and from the CI SignPath request, and is inert when the relay env vars
// are unset, so local and dev builds are unaffected. publisherName stays on
// its existing channel split above.
signtoolOptions: {
sign: signWindowsUninstallerViaSignPath,
...(isWinDevChannel ? {} : { publisherName: 'SignPath Foundation' })
},
...(isWinDevChannel ? { verifyUpdateCodeSignature: false } : {}),
extraResources: [
...commonExtraResources,
...createPackagedRuntimeNodeModuleResources('win32'),
config/nsis/orca-installer-hooks.nsh
+35 -9
View File
@@ -49,22 +49,48 @@
; ---------------------------------------------------------------------------
; Clean up the relocated terminal daemon on a REAL uninstall.
;
; Why: the daemon host is deliberately copied to a distinct image name
; (orca-terminal-daemon.exe) under %LOCALAPPDATA%\Orca\daemon-host so that app
; UPDATES cannot kill it — that relocation is what keeps terminals alive across
; updates. The same design means a normal uninstall's process sweep and file
; removal both miss it, leaving an orphaned daemon plus its runtime copy behind.
; Why: the daemon host is deliberately copied OUT of the install dir into
; %LOCALAPPDATA%\Orca\daemon-host so that app UPDATES cannot kill it —
; electron-builder's kill sweep selects processes whose image path is under
; $INSTDIR, and that relocation is what keeps terminals alive across updates.
; The same design means a normal uninstall's process sweep and file removal both
; miss it, leaving an orphaned daemon plus its runtime copy behind.
;
; The ${isUpdated} guard is essential: electron-builder runs this uninstaller as
; part of uninstallOldVersion on EVERY update, and killing the daemon there would
; defeat the whole feature. Only clean up on a genuine uninstall.
;
; The image name and the LOCALAPPDATA folder name must stay in sync with
; DAEMON_HOST_EXE_NAME and LOCAL_HOST_ROOT_NAME in
; src/main/daemon/daemon-host-relocation.ts.
; The LOCALAPPDATA folder name must stay in sync with LOCAL_HOST_ROOT_NAME in
; src/main/daemon/daemon-host-relocation.ts. See
; docs/reference/windows-daemon-host-relocation.md.
!macro customUnInstall
${ifNot} ${isUpdated}
nsExec::Exec 'taskkill /F /IM orca-terminal-daemon.exe'
Push $0
Push $1
Push $2
; The host exe is a verbatim copy of the app exe, so the app's own image name
; reaches it; the second name covers hosts left by builds that renamed the copy.
; Filtered to the current user like upstream's per-user KILL_PROCESS, so an
; elevated machine-wide uninstall cannot reach another logged-on user's session.
; NSIS expands USERNAME itself: routing through cmd.exe only to get %USERNAME%
; would add two interpreter spawns to the uninstall path for nothing.
ReadEnvStr $1 USERNAME
${if} $1 == ""
; Measured: taskkill rejects an empty filter value outright ("The search filter
; cannot be recognized") and kills nothing, so with no USERNAME to scope by,
; kill unfiltered rather than not at all. USERNAME is set in every session an
; uninstaller runs in, so this is a backstop, not the expected path.
StrCpy $2 ""
${else}
StrCpy $2 '/FI "USERNAME eq $1"'
${endIf}
nsExec::Exec 'taskkill /F /IM "${APP_EXECUTABLE_FILENAME}" $2'
Pop $0
nsExec::Exec 'taskkill /F /IM "orca-terminal-daemon.exe" $2'
Pop $0
Pop $2
Pop $1
Pop $0
; Give the OS a moment to release the image lock before removing the tree.
Sleep 500
RMDir /r "$LOCALAPPDATA\Orca\daemon-host"
config/patches/@vscode__windows-process-tree@0.8.0.patch
+417 -8
View File
@@ -27,15 +27,424 @@ index 855bd4b86f0a3c18c7594212c0e42b6e35bc4001..33774e7ae296f0de39dd94156673c9e7
"/guard:cf",
"/sdl",
diff --git a/src/process.cc b/src/process.cc
index 3eea92077c4d1d433119361d5c432881859131e9..1998f4addd4d7e9aba946ea6f7f7a4a5d13291bc 100644
index 3eea92077c4d1d433119361d5c432881859131e9..738775f6fcdfb676054386fe34c0380327ed1863 100644
--- a/src/process.cc
+++ b/src/process.cc
@@ -37,7 +37,7 @@ uint32_t GetRawProcessList(std::vector<ProcessInfo>& process_info,
process_info.push_back(std::move(pinfo));
process_count++;
}
@@ -1,108 +1,112 @@
-/*---------------------------------------------------------------------------------------------
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License. See License.txt in the project root for license information.
- *--------------------------------------------------------------------------------------------*/
-
-#include "process.h"
-#include "process_commandline.h"
-
-#include <tlhelp32.h>
-#include <psapi.h>
-#include <limits>
-
-uint32_t GetRawProcessList(std::vector<ProcessInfo>& process_info,
- DWORD process_data_flags) {
- // Fetch the PID and PPIDs
- PROCESSENTRY32 process_entry = { 0 };
- DWORD parent_pid = 0;
- uint32_t process_count = 0;
- HANDLE snapshot_handle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
- process_entry.dwSize = sizeof(PROCESSENTRY32);
- if (Process32First(snapshot_handle, &process_entry)) {
- do {
- if (process_entry.th32ProcessID != 0) {
- ProcessInfo pinfo;
- pinfo.pid = process_entry.th32ProcessID;
- pinfo.ppid = process_entry.th32ParentProcessID;
-
- if (MEMORY & process_data_flags) {
- GetProcessMemoryUsage(pinfo);
- }
-
- if (COMMANDLINE & process_data_flags) {
- GetProcessCommandLine(pinfo);
- }
-
- strcpy(pinfo.name, process_entry.szExeFile);
- process_info.push_back(std::move(pinfo));
- process_count++;
- }
- } while (process_count < 1024 && Process32Next(snapshot_handle, &process_entry));
- }
-
- CloseHandle(snapshot_handle);
- return process_count;
-}
-
-void GetProcessMemoryUsage(ProcessInfo& process_info) {
- DWORD pid = process_info.pid;
- HANDLE hProcess;
- PROCESS_MEMORY_COUNTERS pmc;
-
- hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid);
-
- if (hProcess == NULL) {
- return;
- }
-
- if (GetProcessMemoryInfo(hProcess, &pmc, sizeof(pmc))) {
- process_info.memory = (DWORD)pmc.WorkingSetSize;
- }
-
- CloseHandle(hProcess);
-}
-
-// Per documentation, it is not recommended to add or subtract values from the FILETIME
-// structure, or to cast it to ULARGE_INTEGER as this can cause alignment faults on 64-bit Windows.
-// Copy the high and low part to a ULARGE_INTEGER and peform arithmetic on that instead.
-// See https://msdn.microsoft.com/en-us/library/windows/desktop/ms724284(v=vs.85).aspx
-ULONGLONG GetTotalTime(const FILETIME* kernelTime, const FILETIME* userTime) {
- ULARGE_INTEGER kt, ut;
- kt.LowPart = (*kernelTime).dwLowDateTime;
- kt.HighPart = (*kernelTime).dwHighDateTime;
-
- ut.LowPart = (*userTime).dwLowDateTime;
- ut.HighPart = (*userTime).dwHighDateTime;
-
- return kt.QuadPart + ut.QuadPart;
-}
-
-void GetCpuUsage(Cpu& cpu_info, bool first_pass) {
- DWORD pid = cpu_info.pid;
- HANDLE hProcess;
-
- hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid);
-
- if (hProcess == NULL) {
- return;
- }
-
- FILETIME creationTime, exitTime, kernelTime, userTime;
- FILETIME sysIdleTime, sysKernelTime, sysUserTime;
- if (GetProcessTimes(hProcess, &creationTime, &exitTime, &kernelTime, &userTime)
- && GetSystemTimes(&sysIdleTime, &sysKernelTime, &sysUserTime)) {
- if (first_pass) {
- cpu_info.initialProcRunTime = GetTotalTime(&kernelTime, &userTime);
- cpu_info.initialSystemTime = GetTotalTime(&sysKernelTime, &sysUserTime);
- } else {
- ULONGLONG endProcTime = GetTotalTime(&kernelTime, &userTime);
- ULONGLONG endSysTime = GetTotalTime(&sysKernelTime, &sysUserTime);
-
- cpu_info.cpu = 100.0 * (endProcTime - cpu_info.initialProcRunTime) / (endSysTime - cpu_info.initialSystemTime);
- }
- } else {
- cpu_info.cpu = std::numeric_limits<double>::quiet_NaN();
- }
-
- CloseHandle(hProcess);
+/*---------------------------------------------------------------------------------------------
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+#include "process.h"
+#include "process_commandline.h"
+
+#include <tlhelp32.h>
+#include <psapi.h>
+#include <limits>
+
+uint32_t GetRawProcessList(std::vector<ProcessInfo>& process_info,
+ DWORD process_data_flags) {
+ // Fetch the PID and PPIDs
+ PROCESSENTRY32 process_entry = { 0 };
+ DWORD parent_pid = 0;
+ uint32_t process_count = 0;
+ HANDLE snapshot_handle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+ process_entry.dwSize = sizeof(PROCESSENTRY32);
+ if (Process32First(snapshot_handle, &process_entry)) {
+ do {
+ if (process_entry.th32ProcessID != 0) {
+ // Value-initialize: `memory` is otherwise stack garbage when the flag is unset.
+ ProcessInfo pinfo{};
+ pinfo.pid = process_entry.th32ProcessID;
+ pinfo.ppid = process_entry.th32ParentProcessID;
+
+ if (MEMORY & process_data_flags) {
+ GetProcessMemoryUsage(pinfo);
+ }
+
+ if (COMMANDLINE & process_data_flags) {
+ GetProcessCommandLine(pinfo);
+ }
+
+ strcpy(pinfo.name, process_entry.szExeFile);
+ process_info.push_back(std::move(pinfo));
+ process_count++;
+ }
+ } while (Process32Next(snapshot_handle, &process_entry));
}
CloseHandle(snapshot_handle);
+ }
+
+ CloseHandle(snapshot_handle);
+ return process_count;
+}
+
+void GetProcessMemoryUsage(ProcessInfo& process_info) {
+ DWORD pid = process_info.pid;
+ HANDLE hProcess;
+ PROCESS_MEMORY_COUNTERS pmc;
+
+ // PROCESS_VM_READ is never used here -- GetProcessMemoryInfo reads counters the
+ // kernel keeps, not the address space -- and acquiring it is what EDR scores.
+ hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid);
+
+ if (hProcess == NULL) {
+ return;
+ }
+
+ if (GetProcessMemoryInfo(hProcess, &pmc, sizeof(pmc))) {
+ process_info.memory = (DWORD)pmc.WorkingSetSize;
+ }
+
+ CloseHandle(hProcess);
+}
+
+// Per documentation, it is not recommended to add or subtract values from the FILETIME
+// structure, or to cast it to ULARGE_INTEGER as this can cause alignment faults on 64-bit Windows.
+// Copy the high and low part to a ULARGE_INTEGER and peform arithmetic on that instead.
+// See https://msdn.microsoft.com/en-us/library/windows/desktop/ms724284(v=vs.85).aspx
+ULONGLONG GetTotalTime(const FILETIME* kernelTime, const FILETIME* userTime) {
+ ULARGE_INTEGER kt, ut;
+ kt.LowPart = (*kernelTime).dwLowDateTime;
+ kt.HighPart = (*kernelTime).dwHighDateTime;
+
+ ut.LowPart = (*userTime).dwLowDateTime;
+ ut.HighPart = (*userTime).dwHighDateTime;
+
+ return kt.QuadPart + ut.QuadPart;
+}
+
+void GetCpuUsage(Cpu& cpu_info, bool first_pass) {
+ DWORD pid = cpu_info.pid;
+ HANDLE hProcess;
+
+ // GetProcessTimes needs no more than PROCESS_QUERY_LIMITED_INFORMATION.
+ hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid);
+
+ if (hProcess == NULL) {
+ return;
+ }
+
+ FILETIME creationTime, exitTime, kernelTime, userTime;
+ FILETIME sysIdleTime, sysKernelTime, sysUserTime;
+ if (GetProcessTimes(hProcess, &creationTime, &exitTime, &kernelTime, &userTime)
+ && GetSystemTimes(&sysIdleTime, &sysKernelTime, &sysUserTime)) {
+ if (first_pass) {
+ cpu_info.initialProcRunTime = GetTotalTime(&kernelTime, &userTime);
+ cpu_info.initialSystemTime = GetTotalTime(&sysKernelTime, &sysUserTime);
+ } else {
+ ULONGLONG endProcTime = GetTotalTime(&kernelTime, &userTime);
+ ULONGLONG endSysTime = GetTotalTime(&sysKernelTime, &sysUserTime);
+
+ cpu_info.cpu = 100.0 * (endProcTime - cpu_info.initialProcRunTime) / (endSysTime - cpu_info.initialSystemTime);
+ }
+ } else {
+ cpu_info.cpu = std::numeric_limits<double>::quiet_NaN();
+ }
+
+ CloseHandle(hProcess);
}
\ No newline at end of file
diff --git a/src/process_commandline.cc b/src/process_commandline.cc
index ea822b120e8038a4803e34647042f08f4aaf5ca1..25907c0bf542bed6c72b1b462b19bcf3210c3cfd 100644
--- a/src/process_commandline.cc
+++ b/src/process_commandline.cc
@@ -1,67 +1,125 @@
-/*---------------------------------------------------------------------------------------------
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License. See License.txt in the project root for license information.
- *--------------------------------------------------------------------------------------------*/
-
-#include "process.h"
-#include "process_commandline.h"
-#include <windows.h>
-#include <winternl.h>
-#include <iostream>
-
-bool GetProcessCommandLine(ProcessInfo& process_info) {
- HINSTANCE ntdll = GetModuleHandleW(L"ntdll.dll");
- if (!ntdll) {
- return false;
- }
-
- decltype(NtQueryInformationProcess)* nt_query_information_process =
- reinterpret_cast<decltype(NtQueryInformationProcess)*>(
- GetProcAddress(ntdll, "NtQueryInformationProcess"));
-
- if (!nt_query_information_process) {
- return false;
- }
-
- PROCESS_BASIC_INFORMATION pbi{};
- PEB peb = {NULL};
- RTL_USER_PROCESS_PARAMETERS process_parameters = {NULL};
-
- // Get process handle
- DWORD pid = process_info.pid;
- HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
- if (hProcess == INVALID_HANDLE_VALUE) {
- return false;
- }
-
- // Get Process Environment Block (PEB)
- NTSTATUS status = nt_query_information_process(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), nullptr);
- if (NT_SUCCESS(status) && pbi.PebBaseAddress) {
- // Read PEB
- if (ReadProcessMemory(hProcess, pbi.PebBaseAddress, &peb, sizeof(peb), nullptr)) {
- // Read the processs parameters
- if (ReadProcessMemory(hProcess, peb.ProcessParameters, &process_parameters, sizeof(RTL_USER_PROCESS_PARAMETERS), nullptr)) {
- if (process_parameters.CommandLine.Length > 0) {
- std::wstring buffer;
- buffer.resize(process_parameters.CommandLine.Length / sizeof(wchar_t));
- if (ReadProcessMemory(hProcess, process_parameters.CommandLine.Buffer, &buffer[0], process_parameters.CommandLine.Length, nullptr)) {
- int wide_length = static_cast<int>(buffer.length());
- int charcount = WideCharToMultiByte(CP_UTF8, 0, buffer.data(), wide_length,
- NULL, 0, NULL, NULL);
- if (charcount) {
- process_info.commandLine.resize(static_cast<size_t>(charcount));
- WideCharToMultiByte(CP_UTF8, 0, buffer.data(), wide_length,
- &process_info.commandLine[0], charcount,
- NULL, NULL);
- }
- CloseHandle(hProcess);
- return true;
- }
- }
- }
- }
- }
-
- CloseHandle(hProcess);
- return false;
-}
+/*---------------------------------------------------------------------------------------------
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+#include "process.h"
+#include "process_commandline.h"
+#include <windows.h>
+#include <winternl.h>
+#include <vector>
+
+namespace {
+
+// Windows 8.1 and later hand back a process's command line as a UNICODE_STRING
+// the kernel builds, needing only PROCESS_QUERY_LIMITED_INFORMATION.
+//
+// There is deliberately no PEB fallback. Reading the command line out of the
+// target's address space -- opening it for VM reads and then chaining
+// memory reads across every pid on a timer -- is the credential-dumping
+// primitive this reader exists to not perform, so it is absent from the binary
+// rather than one anomalous NTSTATUS away. Electron's floor is Windows 10, so
+// every OS Orca supports has this class; if a hooked ntdll refuses it anyway,
+// the command line comes back empty, which callers already handle, instead of
+// silently reinstating the primitive on exactly the instrumented machines this
+// reader was written for.
+const ULONG kProcessCommandLineInformation = 60;
+
+const NTSTATUS kStatusInfoLengthMismatch = static_cast<NTSTATUS>(0xC0000004L);
+const NTSTATUS kStatusBufferTooSmall = static_cast<NTSTATUS>(0xC0000023L);
+
+// A command line is a UNICODE_STRING, whose Length is a USHORT, so the kernel
+// can never need more than the header plus 64 KiB. Refusing anything larger
+// keeps a bogus size from throwing bad_alloc out of a scan that has already
+// walked most of the table.
+const ULONG kMaxCommandLineBytes = sizeof(UNICODE_STRING) + 0xFFFF + sizeof(wchar_t);
+
+// winternl.h's PROCESSINFOCLASS does not name class 60 and its enumerator range
+// stops far short of it, so the class travels as a ULONG rather than a cast enum.
+typedef NTSTATUS(NTAPI* NtQueryInformationProcessFn)(HANDLE, ULONG, PVOID, ULONG, PULONG);
+
+// ntdll ships no import library for this entry point; it has to be resolved.
+NtQueryInformationProcessFn ResolveNtQueryInformationProcess() {
+ HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
+ if (!ntdll) {
+ return nullptr;
+ }
+ return reinterpret_cast<NtQueryInformationProcessFn>(
+ GetProcAddress(ntdll, "NtQueryInformationProcess"));
+}
+
+NtQueryInformationProcessFn NtQueryInformationProcessEntry() {
+ static NtQueryInformationProcessFn entry = ResolveNtQueryInformationProcess();
+ return entry;
+}
+
+bool StoreCommandLineUtf8(ProcessInfo& process_info, const wchar_t* data, size_t wide_length) {
+ if (wide_length == 0) {
+ return false;
+ }
+ int length = static_cast<int>(wide_length);
+ int charcount = WideCharToMultiByte(CP_UTF8, 0, data, length, NULL, 0, NULL, NULL);
+ if (!charcount) {
+ return false;
+ }
+ process_info.commandLine.resize(static_cast<size_t>(charcount));
+ WideCharToMultiByte(CP_UTF8, 0, data, length, &process_info.commandLine[0], charcount, NULL,
+ NULL);
+ return true;
+}
+
+} // namespace
+
+bool GetProcessCommandLine(ProcessInfo& process_info) {
+ NtQueryInformationProcessFn query = NtQueryInformationProcessEntry();
+ if (!query) {
+ return false;
+ }
+
+ HANDLE process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, process_info.pid);
+ if (process == NULL) {
+ return false;
+ }
+
+ ULONG size = 0;
+ NTSTATUS status = query(process, kProcessCommandLineInformation, nullptr, 0, &size);
+ if (NT_SUCCESS(status)) {
+ // Nothing was written, so there is no command line to read.
+ CloseHandle(process);
+ return false;
+ }
+ if (status != kStatusInfoLengthMismatch && status != kStatusBufferTooSmall) {
+ CloseHandle(process);
+ return false;
+ }
+ if (size < sizeof(UNICODE_STRING) || size > kMaxCommandLineBytes) {
+ CloseHandle(process);
+ return false;
+ }
+
+ std::vector<unsigned char> buffer(size);
+ status = query(process, kProcessCommandLineInformation, &buffer[0], size, &size);
+ CloseHandle(process);
+ if (!NT_SUCCESS(status)) {
+ return false;
+ }
+
+ // Header and characters arrive in one allocation, but treat the header as
+ // untrusted: a hooked ntdll is the case this reader is written for, and an
+ // unchecked Buffer/Length here would be an over-read encoded straight into JS.
+ // Bound against buffer.size(), never `size` -- the second query overwrote it.
+ const UNICODE_STRING* command_line = reinterpret_cast<const UNICODE_STRING*>(&buffer[0]);
+ const unsigned char* begin = &buffer[0];
+ const unsigned char* end = begin + buffer.size();
+ const unsigned char* chars = reinterpret_cast<const unsigned char*>(command_line->Buffer);
+ if (chars == nullptr || chars < begin + sizeof(UNICODE_STRING) || chars > end ||
+ command_line->Length > static_cast<ULONG>(end - chars)) {
+ return false;
+ }
+
+ // True only when a command line was actually stored, so "empty" and "not
+ // recovered" stay the same answer they were before this reader replaced the
+ // PEB read. `src/process.cc` discards the result either way.
+ return StoreCommandLineUtf8(process_info, command_line->Buffer,
+ command_line->Length / sizeof(wchar_t));
+}
config/scripts/benchmark-browser-tunnel-framing.mjs
+110
View File
@@ -0,0 +1,110 @@
import assert from 'node:assert/strict'
import { execFileSync } from 'node:child_process'
import { readFileSync } from 'node:fs'
import { stripTypeScriptTypes } from 'node:module'
import { performance } from 'node:perf_hooks'
// Run from the worktree root: node config/scripts/benchmark-browser-tunnel-framing.mjs [base-ref]
const path = 'src/shared/browser-network-tunnel-stream-framing.ts'
const baselineRef = process.argv[2] ?? 'HEAD'
const beforeSource = execFileSync('git', ['show', `${baselineRef}:${path}`], {
encoding: 'utf8'
})
const afterSource = readFileSync(path, 'utf8')
const load = (source) =>
import(
`data:text/javascript;base64,${Buffer.from(
stripTypeScriptTypes(source, { mode: 'transform' })
).toString('base64')}`
)
const before = await load(beforeSource)
const after = await load(afterSource)
function measure(module, chunks, payload, repetitions) {
let frameCount = 0
let lastFrame
const onFrame = (frame) => {
frameCount++
lastFrame = frame
}
const onError = (error) => {
throw error
}
const run = () => {
const decoder = new module.BrowserNetworkTunnelStreamFrameDecoder(onFrame, onError)
for (const chunk of chunks) {
decoder.feed(chunk)
}
}
run()
assert.deepEqual(lastFrame, payload)
const samples = []
for (let sample = 0; sample < 5; sample++) {
const start = performance.now()
for (let iteration = 0; iteration < repetitions; iteration++) {
run()
}
samples.push((performance.now() - start) / repetitions)
}
assert.equal(frameCount, 1 + 5 * repetitions)
return samples.sort((a, b) => a - b)[2]
}
function countCopies(module, chunks) {
const originalSet = Uint8Array.prototype.set
const originalSlice = Uint8Array.prototype.slice
let copied = 0
Uint8Array.prototype.set = function (source, offset) {
copied += source.length
return originalSet.call(this, source, offset)
}
Uint8Array.prototype.slice = function (...args) {
const result = originalSlice.apply(this, args)
copied += result.length
return result
}
try {
const decoder = new module.BrowserNetworkTunnelStreamFrameDecoder(
() => {},
(error) => {
throw error
}
)
for (const chunk of chunks) {
decoder.feed(chunk)
}
} finally {
Uint8Array.prototype.set = originalSet
Uint8Array.prototype.slice = originalSlice
}
return copied
}
const rows = []
for (const [payloadBytes, chunkBytes, repetitions] of [
[1, 5, 10000],
[64 * 1024, 65540, 1000],
[64 * 1024, 4096, 100],
[64 * 1024, 256, 25],
[64 * 1024, 16, 5],
[64 * 1024, 1, 1]
]) {
const payload = Uint8Array.from({ length: payloadBytes }, (_, index) => index % 251)
const encoded = before.encodeBrowserNetworkTunnelStreamFrame(payload)
const chunks = []
for (let offset = 0; offset < encoded.length; offset += chunkBytes) {
chunks.push(encoded.subarray(offset, offset + chunkBytes))
}
const beforeMs = measure(before, chunks, payload, repetitions)
const afterMs = measure(after, chunks, payload, repetitions)
rows.push({
payloadBytes,
chunkBytes,
beforeMs: +beforeMs.toFixed(6),
afterMs: +afterMs.toFixed(6),
speedup: +(beforeMs / afterMs).toFixed(2),
beforeCopiedBytes: countCopies(before, chunks),
afterCopiedBytes: countCopies(after, chunks)
})
}
console.log(JSON.stringify({ node: process.version, baselineRef, rows }, null, 2))
config/scripts/benchmark-cli-error-imports.mjs
+121
View File
@@ -0,0 +1,121 @@
import assert from 'node:assert/strict'
import { createRequire } from 'node:module'
import { existsSync, realpathSync } from 'node:fs'
import { delimiter, join, resolve } from 'node:path'
// Emit each revision with tsc -p config/tsconfig.cli.json --outDir <dir> --composite false --incremental false.
// Run: node config/scripts/benchmark-cli-error-imports.mjs <before-dir> <after-dir>
const [beforeDir, afterDir] = process.argv.slice(2)
assert.ok(beforeDir && afterDir, 'Pass distinct before and after TypeScript output directories.')
assert.notEqual(
realpathSync(beforeDir),
realpathSync(afterDir),
'Do not compare a build to itself.'
)
const entries = {
before: join(resolve(beforeDir), 'cli', 'index.js'),
after: join(resolve(afterDir), 'cli', 'index.js')
}
for (const entry of Object.values(entries)) {
assert.ok(existsSync(entry), `Missing emitted CLI: ${entry}`)
}
const { runProcessSync } = createRequire(import.meta.url)(
join(resolve(afterDir), 'shared', 'child-process', 'run-process.js')
)
const child = String.raw`
const { performance } = require('node:perf_hooks')
const { writeSync } = require('node:fs')
const { createHash } = require('node:crypto')
const { basename } = require('node:path')
let stdout = '', stderr = ''
process.stdout.write = (text) => { stdout += text; return true }
process.stderr.write = (text) => { stderr += text; return true }
const started = performance.now()
const cli = require(process.argv[1])
const importMs = performance.now() - started
cli.main(JSON.parse(process.argv[2])).then(() => {
const totalMs = performance.now() - started
const modules = Object.keys(require.cache)
writeSync(1, JSON.stringify({
importMs, totalMs, modules: modules.length,
featureFormatters: modules.filter((file) => ['browser', 'terminal', 'project', 'automation', 'workspace', 'computer'].some((name) => basename(file) === name + '-format.js')),
stdout: createHash('sha256').update(stdout).digest('hex'),
stderr: createHash('sha256').update(stderr).digest('hex'),
exitCode: process.exitCode || 0
}))
process.exitCode = 0
}).catch((error) => { writeSync(2, String(error)); process.exitCode = 1 })
`
const cases = [
['--help'],
['help', 'terminal', 'read'],
['does-not-exist'],
['computer', 'click', '--does-not-exist'],
['does-not-exist', '--json']
]
const median = (values) => [...values].sort((a, b) => a - b)[Math.floor(values.length / 2)]
const summarize = (samples) => ({
importMs: median(samples.map((sample) => sample.importMs)),
totalMs: median(samples.map((sample) => sample.totalMs)),
modules: samples[0].modules
})
const rows = []
for (const args of cases) {
const samples = { before: [], after: [] }
let expected
for (let run = 0; run < 22; run++) {
for (const variant of run % 2 ? ['after', 'before'] : ['before', 'after']) {
const result = runProcessSync({
program: process.execPath,
args: ['-e', child, entries[variant], JSON.stringify(args)],
timeoutMs: 30_000,
env: {
...process.env,
NODE_PATH: [resolve('node_modules'), process.env.NODE_PATH]
.filter(Boolean)
.join(delimiter)
}
})
assert.equal(result.timedOut, false, 'CLI child timed out.')
assert.equal(result.code, 0, result.stderr)
const sample = JSON.parse(result.stdout)
const output = { stdout: sample.stdout, stderr: sample.stderr, exitCode: sample.exitCode }
expected ??= output
assert.deepEqual(output, expected, `${variant} output changed for ${args.join(' ')}`)
if (variant === 'after') {
assert.deepEqual(
sample.featureFormatters,
[],
'Help and syntax errors must skip feature formatters.'
)
}
if (run >= 2) {
samples[variant].push(sample)
}
}
}
assert.ok(samples.after[0].modules < samples.before[0].modules, 'Expected fewer loaded modules.')
rows.push({
args,
before: summarize(samples.before),
after: summarize(samples.after),
output: expected,
samples
})
}
console.log(
JSON.stringify(
{
node: process.version,
platform: process.platform,
measurement:
'Fresh-process import + main; excludes process creation; warmed filesystem; 2 warmups and 20 samples per variant, alternating order.',
entries,
rows
},
null,
2
)
)
config/scripts/benchmark-cli-response-framing.mjs
+128
View File
@@ -0,0 +1,128 @@
import assert from 'node:assert/strict'
import { execFileSync } from 'node:child_process'
import { EventEmitter } from 'node:events'
import { readFileSync } from 'node:fs'
import Module from 'node:module'
import { dirname, resolve } from 'node:path'
import { performance } from 'node:perf_hooks'
import { build } from 'esbuild'
// Run from the worktree root: node config/scripts/benchmark-cli-response-framing.mjs <base-ref>
const sourcePath = 'src/cli/runtime/transport.ts'
const baselineRef = process.argv[2]
assert.ok(baselineRef, 'Pass the pre-change transport revision as base-ref.')
const beforeSource = execFileSync('git', ['show', `${baselineRef}:${sourcePath}`], {
encoding: 'utf8'
})
let chunks = []
async function loadTransport(source) {
const built = await build({
stdin: { contents: source, loader: 'ts', resolveDir: dirname(resolve(sourcePath)) },
bundle: true,
platform: 'node',
format: 'cjs',
write: false,
logLevel: 'silent'
})
const module = new Module(resolve(sourcePath))
const originalRequire = module.require.bind(module)
module.require = (name) => {
if (name === 'node:crypto') {
return { randomUUID: () => 'benchmark-request' }
}
if (name !== 'node:net') {
return originalRequire(name)
}
return {
createConnection() {
const socket = new EventEmitter()
socket.setEncoding = () => {}
socket.end = () => {}
socket.destroy = () => {}
socket.write = () => {
for (const chunk of chunks) {
socket.emit('data', chunk)
}
}
queueMicrotask(() => socket.emit('connect'))
return socket
}
}
}
module._compile(built.outputFiles[0].text, resolve(sourcePath))
return module.exports.sendRequest
}
const before = await loadTransport(beforeSource)
const after = await loadTransport(readFileSync(sourcePath, 'utf8'))
const metadata = {
runtimeId: 'benchmark-runtime',
authToken: 'benchmark-token',
transports: [{ kind: 'unix', endpoint: 'injected-socket' }]
}
const run = (sendRequest) => sendRequest(metadata, 'terminal.read', {}, 30000)
async function measure(sendRequest, payloadBytes, repetitions) {
const warmup = await run(sendRequest)
assert.equal(warmup.result.data.length, payloadBytes)
const samples = []
for (let sample = 0; sample < 5; sample++) {
const start = performance.now()
for (let iteration = 0; iteration < repetitions; iteration++) {
await run(sendRequest)
}
samples.push((performance.now() - start) / repetitions)
}
return samples.sort((a, b) => a - b)[2]
}
async function searchedCharacters(sendRequest) {
const original = String.prototype.indexOf
let searched = 0
String.prototype.indexOf = function (needle, position) {
if (needle === '\n') {
searched += this.length - (position ?? 0)
}
return original.call(this, needle, position)
}
try {
await run(sendRequest)
} finally {
String.prototype.indexOf = original
}
return searched
}
const rows = []
for (const [payloadBytes, chunkChars, repetitions] of [
[32, 65536, 1000],
[1024 * 1024, 2 * 1024 * 1024, 20],
[1024 * 1024, 65536, 10],
[1024 * 1024, 4096, 5],
[4 * 1024 * 1024, 4096, 2],
[4 * 1024 * 1024, 256, 1]
]) {
const line = `${JSON.stringify({
id: 'benchmark-request',
ok: true,
result: { data: 'x'.repeat(payloadBytes) },
_meta: { runtimeId: 'benchmark-runtime' }
})}\n`
chunks = []
for (let offset = 0; offset < line.length; offset += chunkChars) {
chunks.push(line.slice(offset, offset + chunkChars))
}
const beforeMs = await measure(before, payloadBytes, repetitions)
const afterMs = await measure(after, payloadBytes, repetitions)
rows.push({
payloadBytes,
chunkChars,
beforeMs: +beforeMs.toFixed(6),
afterMs: +afterMs.toFixed(6),
speedup: +(beforeMs / afterMs).toFixed(2),
beforeSearchedCharacters: await searchedCharacters(before),
afterSearchedCharacters: await searchedCharacters(after)
})
}
console.log(JSON.stringify({ node: process.version, baselineRef, rows }, null, 2))
config/scripts/benchmark-explorer-dotfile-filter.mjs
+165
View File
@@ -0,0 +1,165 @@
import assert from 'node:assert/strict'
import { readFileSync } from 'node:fs'
import Module from 'node:module'
import { resolve } from 'node:path'
import { performance } from 'node:perf_hooks'
import { build } from 'esbuild'
// Pass the pre-change file-explorer-entries.ts snapshot as the only argument.
const baselinePath = process.argv[2]
assert.ok(baselinePath, 'Pass a pre-change file-explorer-entries.ts snapshot.')
const entry = 'src/renderer/src/components/right-sidebar/file-explorer-entries.ts'
const baseline = readFileSync(baselinePath, 'utf8')
assert.notEqual(baseline, readFileSync(entry, 'utf8'), 'Do not compare the source to itself.')
async function load(useBaseline) {
const result = await build({
stdin: {
contents: `export { isDotfileRelativePath } from './${entry}';
export { createNameFilteredFileExplorerProjection } from './src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.ts';`,
resolveDir: process.cwd(),
loader: 'ts'
},
bundle: true,
platform: 'node',
format: 'cjs',
write: false,
logLevel: 'silent',
alias: { '@': resolve('src/renderer/src') },
plugins: useBaseline
? [
{
name: 'baseline-dotfile-predicate',
setup(builder) {
builder.onLoad({ filter: /file-explorer-entries\.ts$/ }, () => ({
contents: baseline,
loader: 'ts'
}))
}
}
]
: []
})
const module = new Module(resolve('dotfile-benchmark.cjs'))
module.paths = Module._nodeModulePaths(process.cwd())
module._compile(result.outputFiles[0].text, module.id)
return module.exports
}
const versions = [await load(true), await load(false)]
let parityCases = 0
function check(path, depth) {
assert.equal(
versions[0].isDotfileRelativePath(path),
versions[1].isDotfileRelativePath(path),
path
)
parityCases++
if (depth > 0) {
for (const character of ['.', '/', '\\', 'a', '\n']) {
check(path + character, depth - 1)
}
}
}
check('', 8)
function measure(functions, iterations = 1) {
let sink = 0
const run = (fn) => {
for (let i = 0; i < iterations; i++) {
sink += Number(fn())
}
}
for (const fn of functions) {
for (let warmup = 0; warmup < 3; warmup++) {
run(fn)
}
}
const samples = [[], []]
for (let round = 0; round < 11; round++) {
for (const variant of round % 2 ? [1, 0] : [0, 1]) {
const start = performance.now()
run(functions[variant])
samples[variant].push(performance.now() - start)
}
}
return {
beforeMs: samples[0].sort((a, b) => a - b)[5],
afterMs: samples[1].sort((a, b) => a - b)[5],
iterations,
sink
}
}
const predicates = []
for (const path of [
'a',
'.env',
'packages/pkg/src/file.tsx',
`a${'.'.repeat(254)}`,
`${'/'.repeat(4096)}.`,
`${'../'.repeat(1000)}file.ts`,
'😀/.你好',
'\n/.\n'
]) {
check(path, 0)
predicates.push({
pathLength: path.length,
prefix: path.slice(0, 40),
...measure(
versions.map((version) => () => version.isDotfileRelativePath(path)),
10_000
)
})
}
const projections = []
for (const count of [1000, 10_000, 100_000]) {
for (const query of ['nonmatching-needle', 'file-42']) {
const args = {
ignoredSet: new Set(['unrelated']),
nameFilter: {
query,
relativePaths: Array.from(
{ length: count },
(_, i) => `packages/package-${i % 50}/src/components/section-${i % 10}/file-${i}.tsx`
)
},
showDotfiles: false,
showGitIgnoredFiles: false,
worktreePath: '/workspace'
}
const functions = versions.map(
(version) => () => version.createNameFilteredFileExplorerProjection(args)
)
const rows = functions.map((fn) => {
const projection = fn()
return Array.from({ length: projection.getVisibleCount() }, (_, i) =>
projection.getRowAtIndex(i)
)
})
assert.deepEqual(rows[0], rows[1])
projections.push({
count,
query,
visibleRows: rows[0].length,
...measure(functions.map((fn) => () => fn().getVisibleCount()))
})
}
}
console.log(
JSON.stringify(
{
node: process.version,
platform: process.platform,
baselinePath: resolve(baselinePath),
parityCases,
samples: 11,
warmups: 3,
predicates,
projections
},
null,
2
)
)
config/scripts/benchmark-sentinel-retention.mjs
+72
View File
@@ -0,0 +1,72 @@
import { strict as assert } from 'node:assert'
import { EventEmitter } from 'node:events'
import { mkdtemp, rm } from 'node:fs/promises'
import { createRequire } from 'node:module'
import { tmpdir } from 'node:os'
import { join, resolve } from 'node:path'
import { build } from 'esbuild'
if (!global.gc) {
throw new Error('Run with node --expose-gc')
}
const root = resolve(import.meta.dirname, '../..')
const directory = await mkdtemp(join(tmpdir(), 'orca-sentinel-retention-'))
const output = join(directory, 'sentinel.cjs')
try {
await build({
stdin: {
contents: `export {waitForSentinel} from './src/main/ssh/ssh-relay-deploy-helpers';
export {RELAY_SENTINEL} from './src/main/ssh/relay-protocol';`,
resolveDir: root,
loader: 'ts'
},
bundle: true,
platform: 'node',
format: 'cjs',
packages: 'external',
banner: {
js: `var require = require('node:module').createRequire(${JSON.stringify(join(root, 'package.json'))});`
},
outfile: output
})
const { waitForSentinel, RELAY_SENTINEL } = createRequire(import.meta.url)(output)
const held = []
const banners = []
for (let i = 0; i < 100; i++) {
const channel = Object.assign(new EventEmitter(), {
stderr: new EventEmitter(),
stdin: { write: () => true },
close: () => {}
})
const pending = waitForSentinel(channel)
banners.push(feedBanner(channel))
channel.emit('data', Buffer.from(RELAY_SENTINEL))
const transport = await pending
const received = []
transport.onData((bytes) => received.push(bytes.toString()))
channel.emit('data', Buffer.from('frame'))
assert.deepEqual(received, ['frame'])
held.push({ channel, transport })
}
await new Promise((resolve) => setImmediate(resolve))
for (let i = 0; i < 5; i++) {
global.gc()
}
const retained = banners.filter((reference) => reference.deref() !== undefined).length
console.log(
JSON.stringify({
connections: held.length,
bannerBytes: 65536,
retainedBannerBuffers: retained,
retainedBannerBytes: retained * 65536
})
)
} finally {
await rm(directory, { recursive: true, force: true })
}
function feedBanner(channel) {
const banner = Buffer.alloc(65536, 120)
channel.emit('data', banner)
return new WeakRef(banner.buffer)
}
config/scripts/benchmark-skill-depth.mjs
+122
View File
@@ -0,0 +1,122 @@
import assert from 'node:assert/strict'
import { readFileSync } from 'node:fs'
import * as fs from 'node:fs/promises'
import Module from 'node:module'
import { tmpdir } from 'node:os'
import { join, resolve } from 'node:path'
import { performance } from 'node:perf_hooks'
import { build } from 'esbuild'
// Pass a pre-change skill-root-file-walk.ts snapshot as the only argument.
const baselinePath = process.argv[2]
const brokenLinks = process.argv.includes('--broken')
assert.ok(baselinePath, 'Pass a pre-change skill-root-file-walk.ts snapshot.')
const entry = 'src/main/skills/skill-root-file-walk.ts'
const baseline = readFileSync(baselinePath, 'utf8')
assert.notEqual(baseline, readFileSync(entry, 'utf8'), 'Do not compare the source to itself.')
let statCalls = 0
async function load(useBaseline) {
const result = await build({
entryPoints: [entry],
bundle: true,
platform: 'node',
format: 'cjs',
write: false,
logLevel: 'silent',
plugins: useBaseline
? [
{
name: 'baseline-skill-depth',
setup(builder) {
builder.onLoad({ filter: /skill-root-file-walk\.ts$/ }, () => ({
contents: baseline,
loader: 'ts'
}))
}
}
]
: []
})
const module = new Module(resolve('skill-depth-benchmark.cjs'))
module.paths = Module._nodeModulePaths(process.cwd())
const originalRequire = module.require.bind(module)
module.require = (name) =>
name === 'node:fs/promises'
? {
...fs,
stat: (...args) => {
statCalls++
return fs.stat(...args)
}
}
: originalRequire(name)
module._compile(result.outputFiles[0].text, module.id)
return module.exports.findSkillFiles
}
const before = await load(true)
const after = await load(false)
const median = (values) => values.sort((a, b) => a - b)[Math.floor(values.length / 2)]
const temporaryRoot = await fs.mkdtemp(join(tmpdir(), 'orca-skill-depth-benchmark-'))
try {
for (const links of [0, 8, 100, 1000]) {
const root = join(temporaryRoot, String(links))
const edge = join(root, 'a', 'b', 'c', 'd')
const target = join(temporaryRoot, 'target')
await fs.mkdir(edge, { recursive: true })
await fs.mkdir(target, { recursive: true })
await fs.writeFile(join(target, 'SKILL.md'), 'skill')
await fs.writeFile(join(edge, 'SKILL.md'), 'edge')
for (let index = 0; index < links; index++) {
await fs.symlink(
brokenLinks ? join(target, 'missing') : target,
join(edge, `link${index}`),
process.platform === 'win32' ? 'junction' : 'dir'
)
}
for (const depth of [4, 5]) {
const timings = { before: [], after: [] }
const counts = {}
let rows
for (let sample = 0; sample < 13; sample++) {
const versions =
sample % 2
? [
['after', after],
['before', before]
]
: [
['before', before],
['after', after]
]
for (const [name, walk] of versions) {
statCalls = 0
const start = performance.now()
const result = await walk(root, depth)
const elapsed = performance.now() - start
if (rows) {
assert.deepEqual(result, rows)
}
rows = result
counts[name] = statCalls
if (sample >= 2) {
timings[name].push(elapsed)
}
}
}
console.log(
JSON.stringify({
links,
brokenLinks,
depth,
statCalls: counts,
rows: rows.length,
medianMs: { before: median(timings.before), after: median(timings.after) }
})
)
}
}
} finally {
await fs.rm(temporaryRoot, { recursive: true, force: true })
}
config/scripts/benchmark-tab-group-repair.mjs
+80
View File
@@ -0,0 +1,80 @@
import { strict as assert } from 'node:assert'
import { mkdtemp, readFile, rm } from 'node:fs/promises'
import { createRequire } from 'node:module'
import { tmpdir } from 'node:os'
import { join, resolve } from 'node:path'
import { performance } from 'node:perf_hooks'
import { build } from 'esbuild'
const root = resolve(import.meta.dirname, '../..')
const source = join(root, 'src/renderer/src/store/slices/tab-group-reference-repair.ts')
const directory = await mkdtemp(join(tmpdir(), 'orca-tab-repair-'))
const current = await readFile(source, 'utf8')
const indexed = `const orderedTabIds = new Set(group.tabOrder)
const missingTabIds = ownedTabIds.filter((tabId) => !orderedTabIds.has(tabId))`
assert(current.includes(indexed), 'Expected indexed implementation')
try {
const implementations = []
for (const baseline of [true, false]) {
const outfile = join(directory, baseline ? 'before.cjs' : 'after.cjs')
await build({
stdin: {
contents: baseline
? current.replace(
indexed,
'const missingTabIds = ownedTabIds.filter((tabId) => !group.tabOrder.includes(tabId))'
)
: current,
resolveDir: resolve(source, '..'),
loader: 'ts'
},
bundle: true,
platform: 'node',
format: 'cjs',
outfile,
alias: { '@': join(root, 'src/renderer/src') }
})
implementations.push(createRequire(import.meta.url)(outfile).appendOwnedTabIdsToGroups)
}
const rows = []
for (const count of [1, 10, 100, 1_000, 10_000]) {
for (const missing of [false, true]) {
const ids = Array.from({ length: count }, (_, i) => `tab-${i}`)
const groups = [
{ id: 'group', worktreeId: 'workspace', activeTabId: null, tabOrder: ids, recentTabIds: [] }
]
const owners = new Map(ids.map((id) => [missing ? `missing-${id}` : id, 'group']))
assert.deepEqual(implementations[0](groups, owners), implementations[1](groups, owners))
const iterations = Math.max(1, Math.floor(10_000 / count))
const samples = [[], []]
for (let sample = -3; sample < 11; sample++) {
for (const index of sample % 2 === 0 ? [0, 1] : [1, 0]) {
const start = performance.now()
for (let i = 0; i < iterations; i++) {
implementations[index](groups, owners)
}
const elapsed = (performance.now() - start) / iterations
if (sample >= 0) {
samples[index].push(elapsed)
}
}
}
rows.push({
count,
missing,
iterations,
beforeMs: samples[0].sort((a, b) => a - b)[5],
afterMs: samples[1].sort((a, b) => a - b)[5]
})
}
}
console.log(
JSON.stringify(
{ node: process.version, platform: process.platform, samples: 11, warmups: 3, rows },
null,
2
)
)
} finally {
await rm(directory, { recursive: true, force: true })
}
config/scripts/benchmark-transcript-reverse-lines.mjs
+124
View File
@@ -0,0 +1,124 @@
import assert from 'node:assert/strict'
import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
import Module from 'node:module'
import { tmpdir } from 'node:os'
import { join, resolve } from 'node:path'
import { performance } from 'node:perf_hooks'
import { build } from 'esbuild'
const entry = 'src/shared/agent-hook-listener/transcript-reader.ts'
assert.ok(process.argv[2], 'Pass a pre-change transcript-reader.ts snapshot.')
const baseline = readFileSync(process.argv[2], 'utf8')
assert.notEqual(baseline, readFileSync(entry, 'utf8'), 'Do not compare the source to itself.')
async function load(useBaseline) {
const result = await build({
stdin: {
contents: `export * from './${entry}';
export { extractAssistantTextFromLine } from './src/shared/agent-hook-listener/transcript-entry-text.ts';`,
resolveDir: process.cwd(),
loader: 'ts'
},
bundle: true,
platform: 'node',
format: 'cjs',
write: false,
logLevel: 'silent',
plugins: useBaseline
? [
{
name: 'baseline-transcript-reader',
setup(builder) {
builder.onLoad({ filter: /transcript-reader\.ts$/ }, () => ({
contents: baseline,
loader: 'ts'
}))
}
}
]
: []
})
const module = new Module(resolve('transcript-benchmark.cjs'))
module.paths = Module._nodeModulePaths(process.cwd())
module._compile(result.outputFiles[0].text, module.id)
return module.exports
}
const versions = [await load(true), await load(false)]
function measure(functions, iterations) {
let sink = 0
const run = (fn) => {
for (let i = 0; i < iterations; i++) {
sink += fn()?.length ?? 0
}
}
for (const fn of functions) {
for (let i = 0; i < 3; i++) {
run(fn)
}
}
const samples = [[], []]
for (let round = 0; round < 11; round++) {
for (const index of round % 2 ? [1, 0] : [0, 1]) {
const start = performance.now()
run(functions[index])
samples[index].push((performance.now() - start) / iterations)
}
}
return {
beforeMs: samples[0].sort((a, b) => a - b)[5],
afterMs: samples[1].sort((a, b) => a - b)[5],
iterations,
sink
}
}
const cases = [
['tiny', `${JSON.stringify({ role: 'assistant', content: 'hello' })}\n`, 10000],
['64KiB line', `${JSON.stringify({ role: 'assistant', content: 'x'.repeat(65500) })}\n`, 100],
[
'4MiB line',
`${JSON.stringify({ role: 'assistant', content: 'x'.repeat(4 * 1024 * 1024 - 40) })}\n`,
10
],
[
'1000 short tool lines',
Array.from({ length: 1000 }, () =>
JSON.stringify({ role: 'tool', content: 'x'.repeat(100) })
).join('\n'),
50
],
[
'Unicode line',
`${JSON.stringify({ role: 'assistant', content: '😀漢字'.repeat(16000) })}\n`,
100
],
[
'leading and trailing blank lines',
`\n\r\n${JSON.stringify({ role: 'assistant', content: 'hello' })}\n\n`,
10000
]
]
const directory = mkdtempSync(join(tmpdir(), 'orca-transcript-benchmark-'))
try {
for (const [name, text, iterations] of cases) {
const file = join(directory, 'transcript.jsonl')
writeFileSync(file, text)
const scanners = versions.map(
(v) => () => v.findLastExtractedTranscriptLineText(text, v.extractAssistantTextFromLine)
)
const readers = versions.map((v) => () => v.readLastAssistantFromTranscriptOnce(file))
assert.equal(scanners[0](), scanners[1](), name)
assert.equal(readers[0](), readers[1](), name)
console.log(
JSON.stringify({
name,
bytes: Buffer.byteLength(text),
scanner: measure(scanners, iterations),
warmFileReader: measure(readers, Math.min(iterations, 100))
})
)
}
} finally {
rmSync(directory, { recursive: true, force: true })
}
config/scripts/build-windows-process-tree-relay-addon.mjs
+26 -1
View File
@@ -32,6 +32,8 @@ import {
import { join, resolve } from 'node:path'
import { RELAY_WINDOWS_PROCESS_TREE_FILENAME } from '../../src/shared/relay-artifacts.ts'
import {
ensureWindowsProcessTreeCommandLinePatch,
inspectWindowsProcessTreeAddon,
nodeGypRebuildInvocation,
stageWindowsProcessTreeNodeAddonApiHeaders,
WINDOWS_PROCESS_TREE_PACKAGE_DIR as PACKAGE_DIR
@@ -89,6 +91,13 @@ function assertPatchApplied() {
'config/patches/@vscode__windows-process-tree@0.8.0.patch; run pnpm install.'
)
}
if (processCc.includes('OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ')) {
throw new Error(
'src/process.cc still takes PROCESS_VM_READ for memory or CPU counters it never reads ' +
'from the address space. pnpm did not apply ' +
'config/patches/@vscode__windows-process-tree@0.8.0.patch; run pnpm install.'
)
}
}
// pnpm can materialize this CRLF package without applying its patch. Repair the
@@ -123,6 +132,13 @@ function applyWindowsProcessTreeBuildFixes() {
''
)
processCc = processCc.replace(/process_count < 1024 && /, '')
// The memory and CPU readers only ever call GetProcessMemoryInfo/GetProcessTimes,
// which need no more than PROCESS_QUERY_LIMITED_INFORMATION; taking VM_READ is
// what EDR scores.
processCc = processCc.replaceAll(
'OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid)',
'OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid)'
)
if (bindingGyp !== originalBinding) {
writeFileSync(bindingPath, bindingGyp)
@@ -131,7 +147,8 @@ function applyWindowsProcessTreeBuildFixes() {
writeFileSync(processPath, processCc)
}
stageWindowsProcessTreeNodeAddonApiHeaders(PACKAGE_DIR)
if (bindingGyp !== originalBinding || processCc !== originalProcess) {
const repairedCommandLine = ensureWindowsProcessTreeCommandLinePatch(PACKAGE_DIR)
if (bindingGyp !== originalBinding || processCc !== originalProcess || repairedCommandLine) {
console.warn('[windows-process-tree] Repaired un-applied pnpm patch hunks before build.')
}
}
@@ -173,6 +190,14 @@ function main() {
if (!existsSync(built)) {
throw new Error(`node-gyp reported success but ${built} is missing.`)
}
// Why check the artifact and not only the source: the source checks above run
// before node-gyp, and a stale build directory can outlive them.
if (inspectWindowsProcessTreeAddon(built) === 'unpatched') {
throw new Error(
'The built addon still calls ReadProcessMemory, so it did not come from the patched ' +
'command-line reader. A relay would get the primitive MDE scores as credential dumping.'
)
}
const machine = readPeMachine(built)
if (machine !== PE_MACHINE[arch]) {
throw new Error(
config/scripts/cli-runtime-client-deferral-equivalence.mjs
+17 -6
View File
@@ -2,7 +2,7 @@
// Equivalence check for deferring the RuntimeClient module graph in the CLI.
//
// Builds the CLI twice with the REAL tsc emit — once from the working tree and
// once with the seven touched files restored from git HEAD~ (the pre-deferral
// once with the touched files restored from git HEAD~ (the pre-deferral
// implementation) — then compares stdout, stderr and exit code BYTE FOR BYTE
// across a matrix of invocations.
//
@@ -13,7 +13,7 @@
//
// Usage: node config/scripts/cli-runtime-client-deferral-equivalence.mjs [--baseline <rev>]
import { execFileSync, spawnSync } from 'node:child_process'
import { mkdirSync, mkdtempSync, rmSync, writeFileSync, readFileSync } from 'node:fs'
import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync, readFileSync } from 'node:fs'
import { join, resolve } from 'node:path'
import { fileURLToPath } from 'node:url'
@@ -21,8 +21,11 @@ const REPO = fileURLToPath(new URL('../..', import.meta.url))
// The files this change touches. Restoring exactly these from the baseline rev
// reconstructs the old implementation without disturbing anything else.
// Files absent at the baseline (e.g. cli-error.ts, split out of format.ts
// later) are removed for the baseline build and put back afterwards.
const TOUCHED = [
'src/cli/args.ts',
'src/cli/cli-error.ts',
'src/cli/dispatch.ts',
'src/cli/flags.ts',
'src/cli/format.ts',
@@ -72,12 +75,16 @@ function buildTree(label, baselineRev) {
if (baselineRev) {
for (const file of TOUCHED) {
const path = join(REPO, file)
restored.push([path, readFileSync(path)])
const old = execFileSync('git', ['show', `${baselineRev}:${file}`], {
restored.push([path, existsSync(path) ? readFileSync(path) : null])
const old = spawnSync('git', ['show', `${baselineRev}:${file}`], {
cwd: REPO,
maxBuffer: 64 * 1024 * 1024
})
writeFileSync(path, old)
if (old.status === 0) {
writeFileSync(path, old.stdout)
} else {
rmSync(path, { force: true })
}
}
}
execFileSync(
@@ -97,7 +104,11 @@ function buildTree(label, baselineRev) {
)
} finally {
for (const [path, contents] of restored) {
writeFileSync(path, contents)
if (contents === null) {
rmSync(path, { force: true })
} else {
writeFileSync(path, contents)
}
}
}
return join(outDir, 'cli/index.js')
config/scripts/create-draft-release.mjs
+88 -18
View File
@@ -128,10 +128,14 @@ export async function createDraftRelease({
throw new Error('token is required')
}
const previousTag = latestPreviousPublishedDesktopReleaseTag(
await fetchRepoReleases(repo, token, fetchImpl),
tag
)
const releases = await fetchRepoReleases(repo, token, fetchImpl)
const existingRelease = releases.find((release) => release?.tag_name === tag)
if (existingRelease && existingRelease.draft !== true) {
log(`Release ${tag} already exists and is published.`)
return
}
const previousTag = latestPreviousPublishedDesktopReleaseTag(releases, tag)
const generateNotesBody = {
tag_name: tag,
target_commitish: tag,
@@ -156,24 +160,90 @@ export async function createDraftRelease({
typeof releaseNotes.name === 'string' && releaseNotes.name.length > 0 ? releaseNotes.name : tag
const prerelease = tag.includes('-rc.')
// Why: GitHub's generated release notes can exceed the release body API
// limit, so create with a bounded body. Omit target_commitish because the
// release-cut tag already exists and GitHub rejects the tag name there.
await githubJson(fetchImpl, `https://api.github.com/repos/${repo}/releases`, token, {
method: 'POST',
body: JSON.stringify({
tag_name: tag,
name,
body,
draft: true,
prerelease
if (existingRelease) {
if (!Number.isInteger(existingRelease.id)) {
throw new Error(`Draft release ${tag} is missing a GitHub release id`)
}
// Why: the listing is a snapshot; the draft can be published while notes
// generate, and patching then overwrites a live release body.
const currentRelease = await githubJson(
fetchImpl,
`https://api.github.com/repos/${repo}/releases/${existingRelease.id}`,
token
)
if (currentRelease?.draft !== true) {
log(`Release ${tag} was published while notes were generated; leaving it unchanged.`)
return
}
// Why: the PATCH endpoint supports no conditional/versioned update, so the
// GET above cannot close the window. The PATCH response reports the state we
// actually wrote to; if publication won, put the published body back.
const patchedRelease = await githubJson(
fetchImpl,
`https://api.github.com/repos/${repo}/releases/${existingRelease.id}`,
token,
{
method: 'PATCH',
body: JSON.stringify({ body })
}
)
if (patchedRelease?.draft !== true) {
const publishedBody = typeof currentRelease.body === 'string' ? currentRelease.body : ''
if (publishedBody === body) {
log(`Release ${tag} was published while notes were patched; its body is unchanged.`)
return
}
// Why: the rollback must not clobber a body written after our PATCH, so
// restore only while the release still carries exactly what we wrote.
const releaseBeforeRollback = await githubJson(
fetchImpl,
`https://api.github.com/repos/${repo}/releases/${existingRelease.id}`,
token
)
if (releaseBeforeRollback?.body !== body) {
log(
`Release ${tag} was published and its body changed again while notes were patched; leaving the newer body in place.`
)
return
}
await githubJson(
fetchImpl,
`https://api.github.com/repos/${repo}/releases/${existingRelease.id}`,
token,
{
method: 'PATCH',
body: JSON.stringify({ body: publishedBody })
}
)
log(
`Release ${tag} was published while notes were patched; restored its published body and left the generated notes unapplied.`
)
return
}
} else {
// Why: GitHub's generated release notes can exceed the release body API
// limit, so create with a bounded body. Omit target_commitish because the
// release-cut tag already exists and GitHub rejects the tag name there.
await githubJson(fetchImpl, `https://api.github.com/repos/${repo}/releases`, token, {
method: 'POST',
body: JSON.stringify({
tag_name: tag,
name,
body,
draft: true,
prerelease
})
})
})
}
if (generatedBody.length !== body.length) {
log(`Created draft release ${tag} with truncated generated notes (${body.length} chars).`)
log(
`${existingRelease ? 'Updated' : 'Created'} draft release ${tag} with truncated generated notes (${body.length} chars).`
)
} else {
log(`Created draft release ${tag} with generated notes (${body.length} chars).`)
log(
`${existingRelease ? 'Updated' : 'Created'} draft release ${tag} with generated notes (${body.length} chars).`
)
}
}
config/scripts/create-draft-release.test.mjs
+129 -3
View File
@@ -132,7 +132,7 @@ describe('createDraftRelease', () => {
it('creates a draft release with bounded generated notes', async () => {
const fetchImpl = vi
.fn()
.mockResolvedValueOnce(jsonResponse([release('v1.4.35'), release('v1.4.36')]))
.mockResolvedValueOnce(jsonResponse([release('v1.4.35')]))
.mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'a'.repeat(130_000) }))
.mockResolvedValueOnce(jsonResponse({ tag_name: 'v1.4.36', draft: true }))
@@ -184,7 +184,7 @@ describe('createDraftRelease', () => {
it('marks rc tags as prereleases', async () => {
const fetchImpl = vi
.fn()
.mockResolvedValueOnce(jsonResponse([release('v1.4.36'), release('v1.4.36-rc.1')]))
.mockResolvedValueOnce(jsonResponse([release('v1.4.36')]))
.mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36-rc.1', body: 'notes' }))
.mockResolvedValueOnce(jsonResponse({ tag_name: 'v1.4.36-rc.1', draft: true }))
@@ -200,10 +200,136 @@ describe('createDraftRelease', () => {
expect(createBody.prerelease).toBe(true)
})
it('regenerates notes for an existing draft release', async () => {
const fetchImpl = vi
.fn()
.mockResolvedValueOnce(
jsonResponse([release('v1.4.35'), release('v1.4.36', { draft: true, id: 42 })])
)
.mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: true, body: 'stale' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: true, body: 'notes' }))
await createDraftRelease({
repo: 'stablyai/orca',
tag: 'v1.4.36',
token: 'token',
fetchImpl,
log: vi.fn()
})
expect(fetchImpl).toHaveBeenNthCalledWith(
3,
'https://api.github.com/repos/stablyai/orca/releases/42',
expect.not.objectContaining({ method: expect.anything() })
)
expect(fetchImpl).toHaveBeenNthCalledWith(
4,
'https://api.github.com/repos/stablyai/orca/releases/42',
expect.objectContaining({ method: 'PATCH', body: JSON.stringify({ body: 'notes' }) })
)
})
it('skips the update when the draft was published while notes were generated', async () => {
const fetchImpl = vi
.fn()
.mockResolvedValueOnce(
jsonResponse([release('v1.4.35'), release('v1.4.36', { draft: true, id: 42 })])
)
.mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: false }))
await createDraftRelease({
repo: 'stablyai/orca',
tag: 'v1.4.36',
token: 'token',
fetchImpl,
log: vi.fn()
})
expect(fetchImpl).toHaveBeenCalledTimes(3)
expect(fetchImpl).toHaveBeenNthCalledWith(
3,
'https://api.github.com/repos/stablyai/orca/releases/42',
expect.not.objectContaining({ method: expect.anything() })
)
})
it('restores the published body when publication lands between the check and the patch', async () => {
const log = vi.fn()
const fetchImpl = vi
.fn()
.mockResolvedValueOnce(
jsonResponse([release('v1.4.35'), release('v1.4.36', { draft: true, id: 42 })])
)
.mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: true, body: 'hand-written notes' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'notes' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'notes' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'hand-written notes' }))
await createDraftRelease({
repo: 'stablyai/orca',
tag: 'v1.4.36',
token: 'token',
fetchImpl,
log
})
expect(fetchImpl).toHaveBeenCalledTimes(6)
expect(fetchImpl).toHaveBeenNthCalledWith(
6,
'https://api.github.com/repos/stablyai/orca/releases/42',
expect.objectContaining({
method: 'PATCH',
body: JSON.stringify({ body: 'hand-written notes' })
})
)
expect(log).toHaveBeenCalledWith(expect.stringContaining('restored its published body'))
})
it('leaves a body written after the patch in place instead of rolling it back', async () => {
const log = vi.fn()
const fetchImpl = vi
.fn()
.mockResolvedValueOnce(
jsonResponse([release('v1.4.35'), release('v1.4.36', { draft: true, id: 42 })])
)
.mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: true, body: 'hand-written notes' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'notes' }))
.mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'newer published body' }))
await createDraftRelease({
repo: 'stablyai/orca',
tag: 'v1.4.36',
token: 'token',
fetchImpl,
log
})
expect(fetchImpl).toHaveBeenCalledTimes(5)
expect(log).toHaveBeenCalledWith(expect.stringContaining('leaving the newer body in place'))
})
it('preserves notes on an existing published release', async () => {
const fetchImpl = vi.fn().mockResolvedValueOnce(jsonResponse([release('v1.4.36', { id: 42 })]))
await createDraftRelease({
repo: 'stablyai/orca',
tag: 'v1.4.36',
token: 'token',
fetchImpl,
log: vi.fn()
})
expect(fetchImpl).toHaveBeenCalledTimes(1)
})
it('omits previous_tag_name for the first desktop release so notes fall back to the GitHub default', async () => {
const fetchImpl = vi
.fn()
.mockResolvedValueOnce(jsonResponse([release('v1.4.36'), release('mobile-v0.0.12')]))
.mockResolvedValueOnce(jsonResponse([release('mobile-v0.0.12')]))
.mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
.mockResolvedValueOnce(jsonResponse({ tag_name: 'v1.4.36', draft: true }))
config/scripts/electron-builder-markdown-associations.test.mjs
+15 -5
View File
@@ -103,14 +103,24 @@ describe('electron-builder markdown file associations', () => {
// Why: this include was renamed from daemon-host-uninstall.nsh to carry the markdown
// hooks too. electron-builder allows only one include, so a merge that drops the daemon
// sweep would silently orphan a running orca-terminal-daemon.exe on every uninstall.
// sweep would silently orphan a running daemon host on every uninstall.
//
// Asserted against comment-stripped script, and on the app exe name first: the relocated
// host is a verbatim copy of the app exe (daemonHostExeName, daemon-host-relocation.ts),
// so a macro that kills only orca-terminal-daemon.exe matches no running process. The
// prose above the macro names both, so a toContain over the raw file proves nothing.
it('keeps the daemon-host uninstall sweep across the include rename', async () => {
const hooks = await readInstallerHooks()
const script = stripNsisCommentLines(await readInstallerHooks())
expect(hooks).toContain('orca-terminal-daemon.exe')
expect(hooks).toContain('$LOCALAPPDATA\\Orca\\daemon-host')
expect(script).toMatch(/taskkill[^\n]*\/IM\s+"?\$\{APP_EXECUTABLE_FILENAME\}"?/)
// Legacy name, so hosts left by builds that renamed the copy still get reaped.
expect(script).toMatch(/taskkill[^\n]*\/IM\s+"?orca-terminal-daemon\.exe"?/)
// Scopes both kills to the uninstalling user: an elevated machine-wide uninstall must
// not reach another logged-on user's session.
expect(script).toMatch(/\/FI\s+"USERNAME eq /)
expect(script).toContain('$LOCALAPPDATA\\Orca\\daemon-host')
// Without this guard, uninstallOldVersion would kill the daemon on every update —
// defeating the relocation that keeps terminals alive across updates.
expect(hooks).toMatch(/\$\{ifNot\}\s+\$\{isUpdated\}/)
expect(script).toMatch(/\$\{ifNot\}\s+\$\{isUpdated\}/)
})
})
config/scripts/ensure-native-runtime.mjs
+25 -4
View File
@@ -5,6 +5,12 @@ import { createRequire } from 'node:module'
import { existsSync, readFileSync } from 'node:fs'
import { release } from 'node:os'
import { basename, dirname, resolve } from 'node:path'
import {
ensureWindowsProcessTreeCommandLinePatch,
inspectWindowsProcessTreeAddon,
stageWindowsProcessTreeNodeAddonApiHeaders,
windowsProcessTreeAddonPath
} from './windows-process-tree-gyp-rebuild.mjs'
const require = createRequire(import.meta.url)
const { assertNodePtyJobOwnership } = require('./node-pty-job-ownership.cjs')
@@ -253,11 +259,18 @@ function collectNativeModuleFailures() {
function loadNativeModule(moduleName) {
if (moduleName === '@vscode/windows-process-tree') {
// A bare require already loads the .node addon on win32, so it catches an
// ABI mismatch on its own. What it cannot catch is a snapshot that comes
// back empty -- the shape a blocked CreateToolhelp32Snapshot produces --
// so check the addon actually enumerates before calling the runtime healthy.
// A bare require loads the .node addon on win32, so it catches an ABI
// mismatch on its own. What it cannot catch is *which* addon loaded: the
// published tarball ships a prebuilt built from unpatched source that is
// node-addon-api, so it requires cleanly and then reads every process's
// command line out of its address space. Check the binary, not the load.
require(moduleName)
if (inspectWindowsProcessTreeAddon(windowsProcessTreeAddonPath()) === 'unpatched') {
throw new Error(
'the loaded addon still calls ReadProcessMemory, so it was not built from the patched ' +
'source. Rebuild it (pnpm run rebuild:electron) rather than using the published prebuild.'
)
}
return
}
if (moduleName === 'windows-native-registry') {
@@ -368,6 +381,14 @@ function getWindowsBuildNumber() {
function rebuildNodeRuntimeModules(moduleNames) {
for (const moduleName of moduleNames) {
const moduleDir = dirname(require.resolve(`${moduleName}/package.json`))
if (moduleName === '@vscode/windows-process-tree') {
// Why before node-gyp: this module is rebuilt precisely because the
// binary was the unpatched one, and pnpm materializes it unpatched often
// enough that compiling the source as-is would just rebuild the same
// reader and fail the verify pass.
ensureWindowsProcessTreeCommandLinePatch(moduleDir)
stageWindowsProcessTreeNodeAddonApiHeaders(moduleDir)
}
console.warn(`[native-runtime] Rebuilding ${moduleName} with node-gyp.`)
runPnpm(['exec', 'node-gyp', 'rebuild'], { cwd: moduleDir })
if (moduleName === 'node-pty' && process.platform === 'win32') {
config/scripts/ensure-native-runtime.test.mjs
+4 -6
View File
@@ -12,6 +12,7 @@ import { tmpdir } from 'node:os'
import { delimiter, join } from 'node:path'
import { fileURLToPath } from 'node:url'
import { describe, expect, it } from 'vitest'
import { copyScriptWithLocalModules } from './script-module-dependencies.mjs'
const sourceScriptPath = fileURLToPath(new URL('./ensure-native-runtime.mjs', import.meta.url))
const sourceNodePtyJobOwnershipPath = fileURLToPath(
@@ -27,7 +28,6 @@ describe('ensure-native-runtime', () => {
const logPath = join(projectDir, 'native-runtime.log')
const markerPath = join(projectDir, 'rebuilt.marker')
const binDir = join(projectDir, 'bin')
copyFileSync(sourceScriptPath, scriptPath)
writeFakeNativeModules(projectDir)
writeNodePtyPatchFile(projectDir)
writeFakePnpm(binDir)
@@ -67,7 +67,6 @@ describe('ensure-native-runtime', () => {
const logPath = join(projectDir, 'native-runtime.log')
const markerPath = join(projectDir, 'rebuilt.marker')
const binDir = join(projectDir, 'bin')
copyFileSync(sourceScriptPath, scriptPath)
writeFakeNativeModules(projectDir, { windowsRegistryRequiresMarker: true })
writeNodePtyPatchFile(projectDir)
writeFakePnpm(binDir)
@@ -102,7 +101,6 @@ describe('ensure-native-runtime', () => {
const logPath = join(projectDir, 'native-runtime.log')
const markerPath = join(projectDir, 'rebuilt.marker')
const binDir = join(projectDir, 'bin')
copyFileSync(sourceScriptPath, scriptPath)
writeLoadableNativeModules(projectDir)
writeNodePtyPatchFile(projectDir)
writeFakePnpm(binDir)
@@ -137,7 +135,6 @@ describe('ensure-native-runtime', () => {
const logPath = join(projectDir, 'native-runtime.log')
const markerPath = join(projectDir, 'rebuilt.marker')
const binDir = join(projectDir, 'bin')
copyFileSync(sourceScriptPath, scriptPath)
writeLoadableNativeModules(projectDir)
writeNodePtyPatchFile(projectDir)
writePatchedNodePtyBuildArtifacts(projectDir)
@@ -171,7 +168,6 @@ describe('ensure-native-runtime', () => {
const logPath = join(projectDir, 'native-runtime.log')
const markerPath = join(projectDir, 'rebuilt.marker')
const binDir = join(projectDir, 'bin')
copyFileSync(sourceScriptPath, scriptPath)
writeLoadableNativeModules(projectDir, { nativeDir: '../build/Release/' })
writeNodePtyPatchFile(projectDir)
writePatchedNodePtyBuildArtifacts(projectDir)
@@ -198,7 +194,9 @@ describe('ensure-native-runtime', () => {
function mkTempProject() {
const projectDir = mkdtempSync(join(tmpdir(), 'orca-native-runtime-'))
mkdirSync(join(projectDir, 'config', 'scripts'), { recursive: true })
// Walked, not listed: the script imports windows-process-tree-gyp-rebuild.mjs, and a fixture
// missing it fails every case with a module-resolution error instead of the defect under test.
copyScriptWithLocalModules(sourceScriptPath, join(projectDir, 'config', 'scripts'))
copyFileSync(
sourceNodePtyJobOwnershipPath,
join(projectDir, 'config', 'scripts', 'node-pty-job-ownership.cjs')
config/scripts/file-explorer-deletion-roots-benchmark.mjs
+75
View File
@@ -0,0 +1,75 @@
import assert from 'node:assert/strict'
import { join } from 'node:path'
import { performance } from 'node:perf_hooks'
import { fileURLToPath } from 'node:url'
import { build } from 'esbuild'
const root = fileURLToPath(new URL('../..', import.meta.url))
const bundled = await build({
stdin: {
contents: `export { selectDeletionRoots } from './file-explorer-batch-deletion';
export { isPathEqualOrDescendant } from './file-explorer-paths';`,
resolveDir: join(root, 'src/renderer/src/components/right-sidebar'),
loader: 'ts'
},
alias: { '@': join(root, 'src/renderer/src') },
bundle: true,
platform: 'node',
format: 'esm',
write: false,
logLevel: 'silent'
})
const { selectDeletionRoots, isPathEqualOrDescendant } = await import(
`data:text/javascript;base64,${Buffer.from(bundled.outputFiles[0].text).toString('base64')}`
)
// Original production selector; both paths use the same path-comparison implementation.
function original(nodes) {
return nodes.filter(
(n) =>
!nodes.some(
(other) => other !== n && other.isDirectory && isPathEqualOrDescendant(n.path, other.path)
)
)
}
function measure(run, nodes) {
for (let index = 0; index < 3; index++) {
run(nodes)
}
const samples = []
for (let index = 0; index < 11; index++) {
const start = performance.now()
run(nodes)
samples.push(performance.now() - start)
}
return samples.sort((a, b) => a - b)[5]
}
const results = []
for (const [fileCount, directoryCount] of [
[100, 0],
[1000, 0],
[5000, 0],
[5000, 5],
[0, 100]
]) {
const nodes = Array.from({ length: fileCount + directoryCount }, (_, index) => ({
name: `item-${index}`,
path: `/repo/item-${index}`,
relativePath: `item-${index}`,
isDirectory: index >= fileCount,
depth: 0
}))
const expected = original(nodes)
const actual = selectDeletionRoots(nodes)
assert.equal(actual.length, expected.length)
actual.forEach((node, index) => assert.equal(node, expected[index]))
results.push({
fileCount,
directoryCount,
beforeMs: measure(original, nodes),
afterMs: measure(selectDeletionRoots, nodes)
})
}
console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
config/scripts/mobile-file-ranking-benchmark.mjs
+53
View File
@@ -0,0 +1,53 @@
import assert from 'node:assert/strict'
import { execFileSync } from 'node:child_process'
import { readFileSync } from 'node:fs'
import { stripTypeScriptTypes } from 'node:module'
import { performance } from 'node:perf_hooks'
const baseline = process.argv[2]
if (!baseline) {
throw new Error('Usage: node config/scripts/mobile-file-ranking-benchmark.mjs <baseline-ref>')
}
async function load(source) {
const js = stripTypeScriptTypes(source, { mode: 'transform' })
return await import(`data:text/javascript;base64,${Buffer.from(js).toString('base64')}`)
}
function measure(fn, paths, query) {
for (let warmup = 0; warmup < 10; warmup++) {
fn(paths, query, 16)
}
const samples = []
for (let i = 0; i < 9; i++) {
const start = performance.now()
fn(paths, query, 16)
samples.push(performance.now() - start)
}
return samples.sort((a, b) => a - b)[4]
}
const results = []
for (const [file, name] of [
['src/main/runtime/runtime-mobile-file-path-search.ts', 'rankRuntimeMobileFilePaths'],
['mobile/src/session/mobile-native-chat-autocomplete.ts', 'rankSuggestions']
]) {
const before = (
await load(execFileSync('git', ['show', `${baseline}:${file}`], { encoding: 'utf8' }))
)[name]
const after = (await load(readFileSync(file, 'utf8')))[name]
for (const count of [100, 100000]) {
const paths = Array.from(
{ length: count },
(_, i) => `src/components/workspace/group-${i % 100}/file-${i}.tsx`
)
for (const query of ['file-9', 'missing', 'workspace']) {
assert.deepEqual(after(paths, query, 16), before(paths, query, 16))
results.push({
function: name,
paths: count,
query,
beforeMs: measure(before, paths, query),
afterMs: measure(after, paths, query)
})
}
}
}
console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
config/scripts/mobile-markdown-placeholder-benchmark.mjs
+58
View File
@@ -0,0 +1,58 @@
import assert from 'node:assert/strict'
import { execFileSync } from 'node:child_process'
import { readFileSync } from 'node:fs'
import { dirname, resolve } from 'node:path'
import { performance } from 'node:perf_hooks'
import { build } from 'esbuild'
const sourcePath = 'mobile/src/components/mobile-markdown-preview-html.ts'
const baselineRef = process.argv[2]
if (!baselineRef) {
throw new Error(
'Usage: node config/scripts/mobile-markdown-placeholder-benchmark.mjs <baseline-ref>'
)
}
async function load(source) {
const result = await build({
stdin: { contents: source, resolveDir: dirname(resolve(sourcePath)), loader: 'ts' },
bundle: true,
write: false,
platform: 'node',
format: 'esm'
})
return (
await import(
`data:text/javascript;base64,${Buffer.from(result.outputFiles[0].text).toString('base64')}`
)
).normalizeMobileMarkdownPreviewHtml
}
const before = await load(
execFileSync('git', ['show', `${baselineRef}:${sourcePath}`], { encoding: 'utf8' })
)
const after = await load(readFileSync(sourcePath, 'utf8'))
function measure(fn, input, repeats) {
const samples = []
for (let run = 0; run < repeats; run++) {
const start = performance.now()
fn(input)
samples.push(performance.now() - start)
}
return samples.sort((a, b) => a - b)[Math.floor(samples.length / 2)]
}
const results = []
for (const [shape, input] of [
['ordinary Markdown', '# Hello\n\n<p>Use `Array<string>` and <b>bold</b>.</p>'],
...[2048, 8192, 16384].map((length) => [
`${length} underscore collision`,
`\uE000ORCA_MD_CODE_${'_'.repeat(length)}0\uE000 and \`Array<string>\``
])
]) {
assert.equal(after(input), before(input))
results.push({
shape,
bytes: Buffer.byteLength(input),
beforeMs: measure(before, input, 5),
afterMs: measure(after, input, 15)
})
}
console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
config/scripts/patched-dependencies-frozen-install.test.mjs
+155
View File
@@ -0,0 +1,155 @@
import {
cpSync,
copyFileSync,
existsSync,
mkdirSync,
mkdtempSync,
readFileSync,
writeFileSync
} from 'node:fs'
import { tmpdir } from 'node:os'
import { isAbsolute, join, parse, resolve } from 'node:path'
import { describe, expect, it } from 'vitest'
import { runProcessSync } from '../../src/shared/child-process/run-process.ts'
import { resolveCliCommand } from '../../src/shared/node-cli-command-resolution.ts'
import { removeTreeSync } from '../../src/shared/windows-transient-lock-removal.ts'
import { resolvePnpmCliInvocation } from './pnpm-cli-invocation.mjs'
/**
* Run the command that actually consumes the patch hashes.
*
* A hash comparison is not this check. `@vscode/windows-process-tree@0.8.0` shipped
* twice with a hand-computed `sha256(patchBytes)` in the lockfile, and two separate
* reviews "verified" it by recomputing the same number the same wrong way. pnpm
* hashes the **LF-normalized** content, so a CRLF patch makes the raw digest a value
* pnpm will never produce, and `--frozen-lockfile` dies with
* ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on every runner. An independent check that
* repeats the original assumption is not independent; only the installer is.
*
* `--lockfile-only --ignore-scripts` keeps it to the resolution pnpm rejects on,
* with no node_modules and no native builds.
*/
const PROJECT_DIR = resolve(import.meta.dirname, '../..')
const WINDOWS_PROCESS_TREE_PATCH = '@vscode__windows-process-tree@0.8.0.patch'
/**
* Which pnpm to run belongs to pnpm-cli-invocation.mjs, not to this file: naming
* the Windows shim here is what windows-cmd-shim-spawn-boundary.test.mjs rejects.
* Its `shell` is dropped on purpose -- runProcessSync refuses that flag and
* already drives a shim through the interpreter itself.
*/
function resolvePnpmInvocation() {
const { command, prefixArgs } = resolvePnpmCliInvocation()
if (isAbsolute(command)) {
return existsSync(command) ? { program: command, prefixArgs } : null
}
// Bare name only when npm_execpath is unset (bare `vitest`, not `pnpm test`).
// Drop the extension so the shared resolver tries every executable form of it.
const resolved = resolveCliCommand(parse(command).name)
return isAbsolute(resolved) ? { program: resolved, prefixArgs } : null
}
describe('patched dependencies', () => {
it('installs with --frozen-lockfile, which is what validates every patch hash', () => {
const pnpm = resolvePnpmInvocation()
expect(pnpm, 'pnpm must be installed; it is the only thing that can check this').not.toBeNull()
// A copy, because a --frozen-lockfile run still rewrites parts of the
// lockfile this repo does not track, and the real one must not move.
const scratch = mkdtempSync(join(tmpdir(), 'orca-frozen-install-'))
try {
for (const file of ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml']) {
copyFileSync(join(PROJECT_DIR, file), join(scratch, file))
}
mkdirSync(join(scratch, 'config'), { recursive: true })
cpSync(join(PROJECT_DIR, 'config', 'patches'), join(scratch, 'config', 'patches'), {
recursive: true
})
const result = runProcessSync({
program: pnpm.program,
args: [
...pnpm.prefixArgs,
'install',
'--frozen-lockfile',
'--lockfile-only',
'--ignore-scripts'
],
cwd: scratch,
timeoutMs: 300_000
})
expect(result.code, `${result.stdout}\n${result.stderr}`).toBe(0)
} finally {
removeTreeSync(scratch)
}
// The 300s spawn budget is only reachable if the case is allowed to take it;
// config/vitest.config.ts caps every case at 30s by default.
}, 300_000)
/**
* `--lockfile-only` resolves; it never applies a patch. So the case above is
* bounded to hash consistency, and the actual question -- can pnpm still put
* the patched reader on disk? -- had nothing covering it.
*
* One package, patch applied for real, assert the marker landed. Scoped to the
* single dependency so it stays a ~2s check rather than a full install.
*/
it('materializes the patched command-line reader on a real install', () => {
const pnpm = resolvePnpmInvocation()
expect(pnpm, 'pnpm must be installed; it is the only thing that can check this').not.toBeNull()
const scratch = mkdtempSync(join(tmpdir(), 'orca-patch-apply-'))
try {
mkdirSync(join(scratch, 'config', 'patches'), { recursive: true })
copyFileSync(
join(PROJECT_DIR, 'config', 'patches', WINDOWS_PROCESS_TREE_PATCH),
join(scratch, 'config', 'patches', WINDOWS_PROCESS_TREE_PATCH)
)
writeFileSync(
join(scratch, 'package.json'),
`${JSON.stringify(
{
name: 'orca-patch-apply-probe',
version: '1.0.0',
dependencies: { '@vscode/windows-process-tree': '0.8.0' }
},
null,
2
)}\n`
)
writeFileSync(
join(scratch, 'pnpm-workspace.yaml'),
'packages: []\n' +
'patchedDependencies:\n' +
` '@vscode/windows-process-tree@0.8.0': config/patches/${WINDOWS_PROCESS_TREE_PATCH}\n`
)
const result = runProcessSync({
program: pnpm.program,
args: [...pnpm.prefixArgs, 'install', '--no-frozen-lockfile', '--ignore-scripts'],
cwd: scratch,
timeoutMs: 300_000
})
expect(result.code, `${result.stdout}\n${result.stderr}`).toBe(0)
const materialized = readFileSync(
join(
scratch,
'node_modules',
'@vscode',
'windows-process-tree',
'src',
'process_commandline.cc'
),
'utf8'
)
expect(materialized).toContain('kProcessCommandLineInformation')
// The whole point of the patch: the upstream reader is gone, not merely
// supplemented.
expect(materialized).not.toContain('ReadProcessMemory')
} finally {
removeTreeSync(scratch)
}
}, 300_000)
})
config/scripts/pr-code-change-scope.mjs
+9 -1
View File
@@ -213,13 +213,17 @@ const LINUX_PACKAGE_TESTS = [
const WINDOWS_PACKAGE_TESTS = [
...LINUX_PACKAGE_TESTS,
'config/scripts/rebuild-native-deps.test.mjs',
'config/scripts/rebuild-native-deps-windows-process-tree.test.mjs',
'src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts',
'src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts',
'src/shared/child-process/windows-command-line.win32.test.ts',
'src/shared/child-process/windows-cmd-shim-resolution.test.ts',
'src/shared/child-process/windows-cmd-shim-resolution.win32.test.ts',
'src/main/agent-hooks/windows-hook-payload-delivery.test.ts',
'src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts',
'src/main/windows/windows-pty-job.win32.test.ts',
'src/main/windows/windows-host-job.win32.test.ts',
'src/main/windows/windows-process-tree-command-line-patch.test.ts',
'src/main/windows-live-tree-kill.win32.test.ts',
'src/main/wsl/wsl-runner.test.ts',
'src/main/wsl/wsl-guest-environment.test.ts',
@@ -228,14 +232,18 @@ const WINDOWS_PACKAGE_TESTS = [
'src/main/wsl/wsl-w1-w3-contract.test.ts',
'src/shared/source-scan/source-tree-scan.test.ts',
'src/main/cli/wsl-cli-powershell-boundary.test.ts',
'src/main/computer/desktop-script-runtime-host.win32.test.ts',
'src/main/cursor/hook-service.test.ts',
'src/main/orca-profiles/profile-index-store.test.ts',
'src/main/startup/windows-install-dir-acl-repair.win32.test.ts',
'src/main/runtime/repo-worktree-admin-fingerprint.test.ts',
'src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts',
'src/shared/secure-file-fsync-flags.test.ts',
'src/shared/secure-path-windows-acl.win32.test.ts',
'src/main/runtime/unreadable-secret-store-preservation.win32.test.ts',
'src/main/ipc/pty-codex-account-attribution.test.ts',
'src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts'
'src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts',
'src/relay/windows-port-scan.win32.test.ts'
]
const DESKTOP_IRRELEVANT_PREFIXES = [
config/scripts/pr-e2e-gate-contract.test.mjs
+8 -8
View File
@@ -636,13 +636,8 @@ describe('PR E2E gate contract', () => {
.filter((spec) => nativeGateExpression.test(readFileSync(join(projectDir, spec), 'utf8')))
expect(nativeGatedSpecs.length).toBeGreaterThan(0)
// Why exempt: the digit repro needs a nested gnome-shell, which no hosted runner provides
// (headless mutter never answers RemoteDesktop.CreateSession); the macOS spec needs a real
// macOS input source, and no macOS runner exists on any PR or scheduled lane.
const unreachableSpecs = new Set([
'tests/e2e/terminal-hangul-terminating-digit-native.spec.ts',
'tests/e2e/terminal-macos-2set-korean-native.spec.ts'
])
// The macOS spec needs a native input source; PR and scheduled IME lanes use Linux.
const unreachableSpecs = new Set(['tests/e2e/terminal-macos-2set-korean-native.spec.ts'])
const unclaimed = nativeGatedSpecs.filter(
(spec) => !unreachableSpecs.has(spec) && !nativeImeRunner.includes(spec)
)
@@ -682,8 +677,13 @@ describe('PR E2E gate contract', () => {
// Why pin the titles: the runner requires one receipt per name, so a rename that nobody
// mirrored here would fail the lane loudly instead of quietly halving it.
const nativeDigitSpec = readFileSync(
join(projectDir, 'tests/e2e/terminal-hangul-terminating-digit-native.spec.ts'),
'utf8'
)
expect(nativeDigitSpec).toContain('appendImeEngagementReceipt(testInfo.title, trace)')
for (const title of EXPECTED_NATIVE_IME_TESTS) {
expect(nativeImeSpec, title).toContain(title)
expect(nativeImeSpec + nativeDigitSpec, title).toContain(title)
}
})
config/scripts/quick-open-exclusion-benchmark.mjs
+60
View File
@@ -0,0 +1,60 @@
import assert from 'node:assert/strict'
import { performance } from 'node:perf_hooks'
import { build } from 'esbuild'
const bundled = await build({
entryPoints: ['src/shared/quick-open-filter.ts'],
bundle: true,
platform: 'node',
format: 'esm',
write: false,
logLevel: 'silent'
})
const { shouldExcludeQuickOpenRelPath: after } = await import(
`data:text/javascript;base64,${Buffer.from(bundled.outputFiles[0].text).toString('base64')}`
)
// Original production predicate, including its exact boundary check.
function before(relPath, prefixes) {
for (const prefix of prefixes) {
if (relPath === prefix) {
return true
}
if (relPath.length > prefix.length && relPath.startsWith(`${prefix}/`)) {
return true
}
}
return false
}
const files = Array.from(
{ length: 100000 },
(_, index) => `src/components/group-${index % 100}/file-${index}.tsx`
)
function run(fn, prefixes) {
let excluded = 0
for (const file of files) {
excluded += Number(fn(file, prefixes))
}
return excluded
}
function measure(fn, prefixes) {
run(fn, prefixes)
const samples = []
for (let index = 0; index < 5; index++) {
const start = performance.now()
run(fn, prefixes)
samples.push(performance.now() - start)
}
return samples.sort((a, b) => a - b)[2]
}
const results = []
for (const count of [0, 10, 100, 500]) {
const prefixes = Array.from({ length: count }, (_, index) => `nested-worktrees/worktree-${index}`)
assert.equal(run(after, prefixes), run(before, prefixes))
results.push({
files: files.length,
exclusions: count,
beforeMs: measure(before, prefixes),
afterMs: measure(after, prefixes)
})
}
console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
config/scripts/rebuild-native-deps-node-pty.test.mjs
+122 -1
View File
@@ -4,6 +4,8 @@ import { join } from 'node:path'
import { describe, expect, it } from 'vitest'
import {
gitLineEndingEnv,
initGitWorkTree,
mkTempProject,
runRebuildScript,
writeFakeElectronRebuild,
@@ -14,7 +16,8 @@ import {
writeFakeWindowsProcessTreeWithNodeAddonApi,
writeFakeWindowsRegistry,
writeNodePtyPatchFile,
writePatchedNodePtyBuildArtifacts
writePatchedNodePtyBuildArtifacts,
writeWindowsProcessTreePatchFile
} from './rebuild-native-deps-test-fixtures.mjs'
describe('rebuild-native-deps patched node-pty rebuild', () => {
@@ -85,6 +88,91 @@ describe('rebuild-native-deps patched node-pty rebuild', () => {
}
})
const commandLineSourcePath = (projectDir) =>
join(
projectDir,
'node_modules',
'@vscode',
'windows-process-tree',
'src',
'process_commandline.cc'
)
// Why inside a git work tree: `git apply` run under one prefixes patch paths
// with the cwd-relative prefix, silently skips what does not match, and still
// exits 0. The package dir is always under the project root in production, so
// a fixture in %TEMP% alone would pass while the real repair did nothing.
//
// Why both line-ending modes: the patch is stored LF while upstream ships this
// source CRLF, so whether the pre-image matches depends on `core.autocrlf` --
// and under `false`, Git's own built-in default, it did not. The repair blinds
// git to the repo, so that value comes from global config, i.e. from whichever
// option the developer's installer wrote. Pinning both makes the case cover the
// host that breaks rather than the host that happens to run it.
for (const autocrlf of ['false', 'true']) {
it(`repairs an un-applied command-line patch in a work tree (autocrlf=${autocrlf})`, () => {
const projectDir = mkTempProject()
try {
initGitWorkTree(projectDir)
writeFakeUsableElectronPackage(projectDir, { platform: 'win32' })
writeFakeElectronRebuild(projectDir)
writeFakeNodePtyConptyPayload(projectDir, 'x64')
writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir, {
commandLinePatchApplied: false
})
writeWindowsProcessTreePatchFile(projectDir)
const result = runRebuildScript(
projectDir,
{
npm_config_platform: 'win32',
npm_config_arch: 'x64',
...gitLineEndingEnv(autocrlf)
},
['--platform=win32', '--arch=x64', '--force']
)
expect(result.status, result.stderr).toBe(0)
expect(readFileSync(commandLineSourcePath(projectDir), 'utf8')).toContain(
'kProcessCommandLineInformation'
)
} finally {
removeTreeSync(projectDir)
}
})
}
// Why fail rather than build: an unpatched command-line reader compiles fine
// and then opens every process with PROCESS_VM_READ to walk its PEB, which is
// the primitive the patch exists to remove.
it('refuses a Windows rebuild when the command-line patch cannot be applied', () => {
const projectDir = mkTempProject()
try {
initGitWorkTree(projectDir)
writeFakeUsableElectronPackage(projectDir, { platform: 'win32' })
writeFakeElectronRebuild(projectDir)
writeFakeNodePtyConptyPayload(projectDir, 'x64')
writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir, { commandLinePatchApplied: false })
// No patch file, so the repair has nothing to apply.
const result = runRebuildScript(
projectDir,
{ npm_config_platform: 'win32', npm_config_arch: 'x64' },
['--platform=win32', '--arch=x64', '--force']
)
expect(result.status).not.toBe(0)
expect(result.stderr).toContain('process_commandline.cc')
expect(readFileSync(commandLineSourcePath(projectDir), 'utf8')).not.toContain(
'kProcessCommandLineInformation'
)
} finally {
removeTreeSync(projectDir)
}
})
it('restores the ConPTY runtime payload after a Windows Electron rebuild', () => {
const projectDir = mkTempProject()
@@ -256,4 +344,37 @@ describe('rebuild-native-deps patched node-pty rebuild', () => {
}
}
)
// The binary this step produces is the one copied into the packaged app. The
// relay build checks its own artifact and ensure-native-runtime checks what it
// loads; nothing checked this one, so a rebuild that quietly emitted the
// upstream reader shipped. Both non-clean states have to fail, which is the
// caller the tri-state was missing: after a rebuild that reported success, an
// absent binary is a broken build, not an absence to shrug at.
for (const [addon, expected] of [
['unpatched', 'still imports ReadProcessMemory'],
['none', 'is not there']
]) {
it(`fails a Windows rebuild that leaves ${addon} windows-process-tree bytes`, () => {
const projectDir = mkTempProject()
try {
writeFakeUsableElectronPackage(projectDir, { platform: 'win32' })
writeFakeElectronRebuild(projectDir, { addon })
writeFakeNodePtyConptyPayload(projectDir, 'x64')
writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir)
const result = runRebuildScript(
projectDir,
{ npm_config_platform: 'win32', npm_config_arch: 'x64' },
['--platform=win32', '--arch=x64', '--force']
)
expect(result.status).not.toBe(0)
expect(result.stderr).toContain(expected)
} finally {
removeTreeSync(projectDir)
}
})
}
})
config/scripts/rebuild-native-deps-test-fixtures.mjs
+117 -6
View File
@@ -1,5 +1,12 @@
import { spawnSync } from 'node:child_process'
import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
import {
chmodSync,
copyFileSync,
mkdirSync,
mkdtempSync,
readFileSync,
writeFileSync
} from 'node:fs'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
import { fileURLToPath } from 'node:url'
@@ -15,6 +22,68 @@ const sourceNodePtyJobOwnershipPath = fileURLToPath(
const sourceWindowsProcessTreeGypRebuildPath = fileURLToPath(
new URL('./windows-process-tree-gyp-rebuild.mjs', import.meta.url)
)
const sourceWindowsProcessTreePatchPath = fileURLToPath(
new URL('../patches/@vscode__windows-process-tree@0.8.0.patch', import.meta.url)
)
/**
* The command-line reader as it is *before* the patch, taken from the patch's
* own pre-image so no upstream copy has to be vendored.
*
* Written back as **CRLF**, which is what `@vscode/windows-process-tree@0.8.0`
* actually ships: all 67 pre-image lines of this file carried a CR before the
* patch was normalized to LF. Rebuilding it with the patch's current newline
* instead would make fixture and patch agree by construction, on any encoding —
* which is exactly how a repair that cannot apply to the real package passed
* this suite.
*/
function unpatchedWindowsProcessTreeCommandLineSource() {
const lines = readFileSync(sourceWindowsProcessTreePatchPath, 'utf8').split('\n')
const start = lines.findIndex((line) =>
line.startsWith('diff --git a/src/process_commandline.cc ')
)
const rest = lines.slice(start + 1)
const end = rest.findIndex((line) => line.startsWith('diff --git '))
const preImage = (end === -1 ? rest : rest.slice(0, end))
.filter((line) => line.startsWith(' ') || line.startsWith('-'))
.filter((line) => !line.startsWith('---'))
.map((line) => line.slice(1).replace(/\r$/, ''))
.join('\r\n')
// Splitting drops the file's own trailing newline as an empty element, and
// `git apply` needs the bytes exact.
return `${preImage}\r\n`
}
/**
* Pin `core.autocrlf` for a spawned repair, whatever the host is set to.
*
* The repair blinds git to the surrounding repo with `GIT_DIR`, so the value it
* sees comes from global/system config — on a Git for Windows box that is
* whichever line-ending option the installer wrote, and `false` (Git's built-in
* default, "checkout as-is") is the one the repair used to fail under. A global
* config in a temp HOME outranks the system file, so this is deterministic
* rather than whatever the developer happens to have.
*/
export function gitLineEndingEnv(autocrlf) {
const home = mkdtempSync(join(tmpdir(), `orca-git-home-${autocrlf}-`))
writeFileSync(join(home, '.gitconfig'), `[core]\n\tautocrlf = ${autocrlf}\n`)
return { HOME: home, USERPROFILE: home }
}
/** Production always runs the repair from inside a work tree; `git apply` behaves differently there. */
export function initGitWorkTree(projectDir) {
for (const args of [['init'], ['config', 'user.email', 'a@b.c'], ['config', 'user.name', 't']]) {
spawnSync('git', args, { cwd: projectDir, encoding: 'utf8' })
}
}
export function writeWindowsProcessTreePatchFile(projectDir) {
mkdirSync(join(projectDir, 'config', 'patches'), { recursive: true })
copyFileSync(
sourceWindowsProcessTreePatchPath,
join(projectDir, 'config', 'patches', '@vscode__windows-process-tree@0.8.0.patch')
)
}
export function mkTempProject() {
const projectDir = mkdtempSync(join(tmpdir(), 'orca-rebuild-native-deps-'))
@@ -143,17 +212,46 @@ if (${JSON.stringify(createExecutable)}) {
)
}
export function writeFakeElectronRebuild(projectDir, { logPathEnv = null } = {}) {
/** Bytes that stand in for a compiled addon's import table. */
const FAKE_ADDON_BYTES = {
clean: 'MZ\0ntdll.dll\0NtQueryInformationProcess\0',
unpatched: 'MZ\0KERNEL32.dll\0ReadProcessMemory\0'
}
/**
* A rebuild that produces nothing leaves no addon to inspect, and the script now
* asserts the binary it just built is a patched one. Emit a stand-in so the
* fixture models a rebuild that actually succeeded. `addon` picks which kind,
* because "produced the upstream reader" and "produced nothing" are both real
* outcomes that assertion has to tell apart.
*/
export function writeFakeElectronRebuild(projectDir, { logPathEnv = null, addon = 'clean' } = {}) {
const rebuildDir = join(projectDir, 'node_modules', '@electron', 'rebuild')
mkdirSync(rebuildDir, { recursive: true })
writeFileSync(join(rebuildDir, 'package.json'), JSON.stringify({ type: 'module' }))
const emitAddon =
addon === 'none'
? ''
: `
const packageDir = join('node_modules', '@vscode', 'windows-process-tree')
if (existsSync(join(packageDir, 'package.json'))) {
mkdirSync(join(packageDir, 'build', 'Release'), { recursive: true })
writeFileSync(
join(packageDir, 'build', 'Release', 'windows_process_tree.node'),
${JSON.stringify(FAKE_ADDON_BYTES[addon])}
)
}`
const emitImports =
addon === 'none'
? ''
: "import { existsSync, mkdirSync, writeFileSync } from 'node:fs'\nimport { join } from 'node:path'\n"
writeFileSync(
join(rebuildDir, 'index.js'),
logPathEnv
? `
import { appendFileSync } from 'node:fs'
export async function rebuild(options) {
${emitImports}
export async function rebuild(options) {${emitAddon}
const logPath = process.env[${JSON.stringify(logPathEnv)}]
if (!logPath) {
return
@@ -171,7 +269,10 @@ export async function rebuild(options) {
)
}
`
: 'export async function rebuild() {}\n'
: `${emitImports}
export async function rebuild() {${emitAddon}
}
`
)
}
@@ -271,12 +372,22 @@ export function writeFakeWindowsProcessTree(projectDir) {
writeFileSync(join(processTreeDir, 'index.js'), 'module.exports = {}\n')
}
export function writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir) {
export function writeFakeWindowsProcessTreeWithNodeAddonApi(
projectDir,
{ commandLinePatchApplied = true } = {}
) {
const processTreeDir = join(projectDir, 'node_modules', '@vscode', 'windows-process-tree')
const nodeAddonApiDir = join(processTreeDir, 'node_modules', 'node-addon-api')
mkdirSync(nodeAddonApiDir, { recursive: true })
writeFileSync(join(processTreeDir, 'package.json'), '{"dependencies":{"node-addon-api":"*"}}\n')
writeFileSync(join(processTreeDir, 'index.js'), 'module.exports = {}\n')
mkdirSync(join(processTreeDir, 'src'), { recursive: true })
writeFileSync(
join(processTreeDir, 'src', 'process_commandline.cc'),
commandLinePatchApplied
? '// kProcessCommandLineInformation = 60\n'
: unpatchedWindowsProcessTreeCommandLineSource()
)
writeFileSync(join(nodeAddonApiDir, 'package.json'), '{"name":"node-addon-api"}\n')
writeFileSync(join(nodeAddonApiDir, 'napi.h'), '// napi.h\n')
writeFileSync(join(nodeAddonApiDir, 'napi-inl.h'), '// napi-inl.h\n')
config/scripts/rebuild-native-deps-windows-process-tree.test.mjs
+103
View File
@@ -0,0 +1,103 @@
import { spawn } from 'node:child_process'
import { appendFileSync, copyFileSync, existsSync, mkdirSync } from 'node:fs'
import { createRequire } from 'node:module'
import { join } from 'node:path'
import { describe, expect, it } from 'vitest'
import { removeTreeSync } from '../../src/shared/windows-transient-lock-removal.ts'
import {
mkTempProject,
runRebuildScript,
writeFakeElectronRebuild,
writeFakeNodePtyConptyPayload,
writeFakeUsableElectronPackage,
writeFakeWindowsProcessTreeWithNodeAddonApi
} from './rebuild-native-deps-test-fixtures.mjs'
const require = createRequire(import.meta.url)
/** A real loadable addon, so the OS holds the same lock a running Orca holds. */
function repoAddonPath() {
try {
const entry = require.resolve('@vscode/windows-process-tree')
const built = join(entry, '..', '..', 'build', 'Release', 'windows_process_tree.node')
return existsSync(built) ? built : null
} catch {
return null
}
}
/**
* Stage a stale addon and keep it loaded, exactly as a running Orca does.
*
* The bytes are the repo's own patched build with the flagged import appended,
* because the guard keys on that symbol and the patched binary does not carry
* it. Trailing bytes are PE overlay, so the file still loads.
*/
async function stageLoadedStaleAddon(projectDir) {
const source = repoAddonPath()
const releaseDir = join(
projectDir,
'node_modules',
'@vscode',
'windows-process-tree',
'build',
'Release'
)
mkdirSync(releaseDir, { recursive: true })
const stale = join(releaseDir, 'windows_process_tree.node')
copyFileSync(source, stale)
appendFileSync(stale, 'ReadProcessMemory')
const holder = spawn(
process.execPath,
['-e', 'require(process.argv[1]); process.send("held"); setInterval(() => {}, 1000)', stale],
{ stdio: ['ignore', 'ignore', 'ignore', 'ipc'] }
)
await new Promise((resolve, reject) => {
holder.once('message', resolve)
holder.once('exit', () => reject(new Error('the addon holder exited before loading')))
})
return holder
}
// Why an end-to-end run: the defect was purely one of placement. The guard threw
// a real EPERM, and the classifier that turns that into "close running Orca"
// already existed -- the throw simply happened before the try that reaches it.
// Only the whole script exercises that.
describe.runIf(process.platform === 'win32')('rebuild-native-deps stale addon under lock', () => {
it.skipIf(!repoAddonPath())(
'reports a locked stale addon as a Windows file lock instead of an EPERM stack',
async () => {
const projectDir = mkTempProject()
let holder
try {
writeFakeUsableElectronPackage(projectDir, { platform: 'win32' })
writeFakeElectronRebuild(projectDir)
writeFakeNodePtyConptyPayload(projectDir, process.arch)
writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir)
holder = await stageLoadedStaleAddon(projectDir)
const result = runRebuildScript(
projectDir,
{
npm_lifecycle_event: 'postinstall',
npm_config_platform: 'win32',
npm_config_arch: process.arch
},
['--platform=win32', `--arch=${process.arch}`, '--force']
)
expect(result.stderr).toContain(
'Close running Orca/Electron/dev processes for this worktree'
)
// Non-strict postinstall soft-exits on a lock; the next dev/start re-checks.
expect(result.status, result.stderr).toBe(0)
} finally {
holder?.kill()
removeTreeSync(projectDir)
}
}
)
})
config/scripts/rebuild-native-deps.mjs
+55 -9
View File
@@ -20,7 +20,12 @@
import { rebuild } from '@electron/rebuild'
import { execFileSync, spawnSync } from 'node:child_process'
import { stageWindowsProcessTreeNodeAddonApiHeaders } from './windows-process-tree-gyp-rebuild.mjs'
import {
ensureWindowsProcessTreeCommandLinePatch,
inspectWindowsProcessTreeAddon,
stageWindowsProcessTreeNodeAddonApiHeaders,
windowsProcessTreeAddonPath
} from './windows-process-tree-gyp-rebuild.mjs'
import {
copyFileSync,
existsSync,
@@ -141,15 +146,21 @@ if (!ignoreModules.includes('cpu-features')) {
}
}
if (
rebuildPlatform === 'win32' &&
modulesToRebuild.includes('@vscode/windows-process-tree') &&
existsSync(join(projectDir, 'node_modules', '@vscode', 'windows-process-tree', 'package.json'))
) {
stageWindowsProcessTreeNodeAddonApiHeaders()
}
try {
// Why inside the try: the patch guard deletes a stale addon binary, and that
// delete fails EPERM when the addon is loaded -- exactly the running-Orca case
// the catch below is written for. Outside, it aborted `pnpm install` with a
// raw stack instead of the "close running Orca/Electron processes" message.
if (
rebuildPlatform === 'win32' &&
modulesToRebuild.includes('@vscode/windows-process-tree') &&
existsSync(join(projectDir, 'node_modules', '@vscode', 'windows-process-tree', 'package.json'))
) {
stageWindowsProcessTreeNodeAddonApiHeaders()
if (ensureWindowsProcessTreeCommandLinePatch()) {
console.warn('[rebuild] Repaired the un-applied windows-process-tree command-line patch.')
}
}
await rebuild({
buildPath: projectDir,
electronVersion,
@@ -165,6 +176,7 @@ try {
force: true
})
restoreNodePtyWindowsConptyRuntime()
assertWindowsProcessTreeAddonIsPatched()
} catch (/** @type {any} */ err) {
console.error('[rebuild] Native module rebuild failed:', err?.message ?? err)
if (isWindowsNativeLockError(err)) {
@@ -184,6 +196,40 @@ try {
process.exit(1)
}
/**
* The binary this rebuild just produced is the one the packaged app ships.
*
* The relay build asserts its own artifact and `ensure-native-runtime.mjs`
* asserts what it loads, but nothing checked the addon that gets copied into the
* packaged `node_modules` -- so a rebuild that silently produced the upstream
* reader would reach users. Anything but `clean` fails: after a rebuild that
* reported success the binary must exist, so `missing` is a broken build, not an
* absence to shrug at. This is the caller that needs the state to be a state and
* not a boolean.
*/
function assertWindowsProcessTreeAddonIsPatched() {
if (
rebuildPlatform !== 'win32' ||
!modulesToRebuild.includes('@vscode/windows-process-tree') ||
!existsSync(join(projectDir, 'node_modules', '@vscode', 'windows-process-tree', 'package.json'))
) {
return
}
const addonPath = windowsProcessTreeAddonPath()
const state = inspectWindowsProcessTreeAddon(addonPath)
if (state === 'clean') {
return
}
throw new Error(
state === 'missing'
? `the rebuild reported success but ${addonPath} is not there, so the packaged app would ` +
'ship no windows-process-tree addon at all.'
: `${addonPath} still imports ReadProcessMemory, so it was not built from the patched ` +
'command-line reader. The packaged app would carry the primitive MDE scores as ' +
'credential dumping.'
)
}
function restoreNodePtyWindowsConptyRuntime() {
if (rebuildPlatform !== 'win32' || !onlyModules.includes('node-pty')) {
return
config/scripts/redactor-environment-lines-benchmark.mjs
+47
View File
@@ -0,0 +1,47 @@
import assert from 'node:assert/strict'
import { readFileSync } from 'node:fs'
import { stripTypeScriptTypes } from 'node:module'
import { performance } from 'node:perf_hooks'
import { redactString } from '../../src/main/observability/redactor.ts'
// Supply an unchanged redactor.ts snapshot to measure the actual previous production function.
const baselinePath = process.argv[2]
if (!baselinePath) {
throw new Error(
'Usage: node config/scripts/redactor-environment-lines-benchmark.mjs <baseline-redactor.ts>'
)
}
const baselineSource = stripTypeScriptTypes(readFileSync(baselinePath, 'utf8'))
const { redactString: before } = await import(
`data:text/javascript;base64,${Buffer.from(baselineSource).toString('base64')}`
)
function median(fn, input, repeats) {
const samples = []
for (let run = 0; run < repeats; run++) {
const started = performance.now()
fn(input)
samples.push(performance.now() - started)
}
return samples.sort((a, b) => a - b)[Math.floor(samples.length / 2)]
}
const rows = []
for (const [shape, input] of [
['8KiB blank lines', '\n'.repeat(8192)],
['16KiB blank lines', '\n'.repeat(16384)],
['32KiB blank lines', '\n'.repeat(32768)],
['32KiB blank lines then invalid key', `${'\n'.repeat(32768)}lowercase`],
['ordinary env', 'FOO=value\nBAR=other\n'],
['ordinary message', 'Cannot read directory /workspace/source: file not found']
]) {
assert.equal(redactString(input), before(input))
const beforeMs = median(before, input, 3)
const afterMs = median(redactString, input, 15)
rows.push({
shape,
bytes: Buffer.byteLength(input),
beforeMs,
afterMs,
speedup: beforeMs / afterMs
})
}
console.log(JSON.stringify({ node: process.version, platform: process.platform, rows }, null, 2))
config/scripts/relay-asset-line-ending-pin.test.mjs
+82
View File
@@ -0,0 +1,82 @@
import { execFileSync } from 'node:child_process'
import { resolve } from 'node:path'
import { RELAY_ARTIFACTS } from '../../src/shared/relay-artifacts.ts'
import { describe, expect, it } from 'vitest'
/**
* Guard the `.gitattributes` pin that keeps `config/relay-assets` on LF.
*
* `core.autocrlf=true` ships in the Git-for-Windows system config, so without a
* pin a Windows runner checks these out as CRLF. build-relay.mjs copies them
* verbatim into the bundle and hashes them byte-for-byte into `.version`, which
* names the immutable remote relay directory -- so a Windows-built client and a
* mac/Linux-built one disagree on the same release, and one SSH host ends up with
* two relay trees, each paying its own remote native-dep compile.
*
* Measured on v1.4.197: master-cloexec-patch.cjs shipped at 11229 bytes from the
* mac runner and 11547 (= 11229 + 318 lines) from the Windows one.
*/
const projectDir = resolve(import.meta.dirname, '../..')
function git(args) {
return execFileSync('git', args, { cwd: projectDir, encoding: 'utf8' })
}
/** `git check-attr -z` emits NUL-separated path/attr/value triples. */
function eolAttributes(paths) {
const fields = git(['check-attr', '-z', 'eol', '--', ...paths]).split('\0')
const found = new Map()
for (let index = 0; index + 2 < fields.length; index += 3) {
found.set(fields[index], fields[index + 2])
}
return found
}
/**
* Keyed off the manifest, not a directory: build-relay refuses to emit an
* artifact absent from RELAY_ARTIFACTS, so relocating an asset cannot slip
* past this the way a path glob would. esbuild bundles have no tracked
* source and contribute no hits, so they need no classifying.
*/
function trackedManifestSources() {
const paths = new Set()
for (const { filename } of RELAY_ARTIFACTS) {
const hits = git(['ls-files', '-z', '--', `*/${filename}`])
.split('\0')
.filter(Boolean)
for (const path of hits) {
paths.add(path)
}
}
return [...paths]
}
describe('config/relay-assets line-ending pin', () => {
it('pins every tracked relay artifact source to LF', () => {
const assets = trackedManifestSources()
expect(assets.length).toBeGreaterThan(0)
const attributes = eolAttributes(assets)
const unpinned = assets.filter((path) => attributes.get(path) !== 'lf')
expect(
unpinned,
'A relay asset left on the platform default gets CRLF on a Windows runner, ' +
'which changes the .version hash and splits one release across two remote ' +
'relay directories. Pin it in .gitattributes.'
).toEqual([])
})
// Why: the assertion above only sees files that exist today. These fix the
// pattern itself -- broad enough to cover a file added tomorrow, narrow enough
// not to claim neighbours.
it.each([
['config/relay-assets/example.cjs', 'lf'],
['config/relay-assets/nested/deeper/example.cjs', 'lf'],
['config/relay-assets/example.txt', 'lf'],
['config/relay-assets-extra/example.cjs', 'unspecified'],
['vendor/config/relay-assets/example.cjs', 'unspecified']
])('resolves %s to eol=%s', (path, expected) => {
expect(eolAttributes([path]).get(path)).toBe(expected)
})
})
config/scripts/relay-frame-buffer-benchmark.mjs
+62
View File
@@ -0,0 +1,62 @@
#!/usr/bin/env node
import assert from 'node:assert/strict'
import { readFileSync } from 'node:fs'
import { stripTypeScriptTypes } from 'node:module'
import { performance } from 'node:perf_hooks'
// Pass the pre-change source saved with git show <base>:src/shared/relay-frame-buffer.ts.
const baselinePath = process.argv[2]
if (!baselinePath) {
throw new Error('Usage: node config/scripts/relay-frame-buffer-benchmark.mjs <baseline.ts>')
}
async function load(source) {
return (
await import(
`data:text/javascript;base64,${Buffer.from(stripTypeScriptTypes(source)).toString('base64')}`
)
).RelayFrameBuffer
}
const Before = await load(readFileSync(baselinePath, 'utf8'))
const After = await load(
readFileSync(new URL('../../src/shared/relay-frame-buffer.ts', import.meta.url), 'utf8')
)
function median(values) {
return values.sort((a, b) => a - b)[Math.floor(values.length / 2)]
}
for (const count of [1, 256, 16384, 65536]) {
const chunks = Array.from({ length: count }, (_, index) => Buffer.alloc(64, index % 256))
const expected = Buffer.concat(chunks)
for (const mode of ['take', 'discard']) {
const times = [[], []]
for (let round = 0; round < 9; round += 1) {
for (const arm of round % 2 === 0 ? [0, 1] : [1, 0]) {
const FrameBuffer = arm === 0 ? Before : After
const buffer = new FrameBuffer()
for (const chunk of chunks) {
buffer.append(chunk)
}
const start = performance.now()
const output = buffer[mode](expected.length)
times[arm].push(performance.now() - start)
if (mode === 'take') {
assert.deepEqual(output, expected)
}
assert.equal(buffer.length, 0)
buffer.append(Buffer.from('tail'))
assert.equal(buffer.drain().toString(), 'tail')
}
}
const beforeMs = median(times[0]),
afterMs = median(times[1])
console.log(
JSON.stringify({
mode,
chunks: count,
bytes: expected.length,
beforeMs,
afterMs,
speedup: beforeMs / afterMs
})
)
}
}
config/scripts/replace-cached-nsis-elevate.mjs
+260
View File
@@ -0,0 +1,260 @@
#!/usr/bin/env node
// Why: electron-builder re-runs `CopyElevateHelper.copy` on every NSIS pack, so the
// release rebuild overwrites the SignPath-signed `resources/elevate.exe` with the
// unsigned copy sitting in the electron-builder toolset cache. The release workflow
// swapped the cached copy first, but searched `<cache>/nsis` — a directory no current
// app-builder-lib layout creates (real ones are `<cache>/nsis-3.0.4.1/nsis-3.0.4.1-<hash>/`
// and `<cache>/nsis@<toolset>/nsis-bundle-<v>-<hash>/`), so the swap silently found
// nothing and v1.4.193/v1.4.194 shipped an unsigned UAC elevation helper.
import { copyFileSync, readdirSync, statSync } from 'node:fs'
import { createRequire } from 'node:module'
import { homedir, platform as osPlatform, tmpdir } from 'node:os'
import { join, parse, resolve } from 'node:path'
const require = createRequire(import.meta.url)
const ELEVATE_EXE = 'elevate.exe'
// `nsis` (the layout the old hardcoded path assumed), `nsis-3.0.4.1` (legacy bundle via
// `getBinFromUrl`), `nsis@1.2.1` (unified bundle). Not `customNsisBinary`: the
// `nsis-<version>` key `getBinFromCustomLoc` builds is only `getBin`'s in-process promise
// key, and the extract dir is named for the custom URL's parent segment, which need not
// start with `nsis` at all. Only the app-builder-lib probe covers that layout — which is
// why the probe, not this scan, is what decides whether the swap succeeded.
const NSIS_RELEASE_DIR = /^nsis(?:[-@].*)?$/i
// elevate.exe lives at the bundle root, one level under the release dir. The legacy
// bundle carries thousands of files under Contrib/, so an unbounded walk is both slow
// and a way to match something that is not a toolset copy.
const MAX_DEPTH = 3
function isFile(path) {
try {
return statSync(path).isFile()
} catch {
return false
}
}
/**
* Mirrors `getCacheDirectory` in app-builder-lib's `out/util/electronGet.js`, which is what
* decides where the NSIS bundle is unpacked. Kept as a local port rather than an import
* because the swap must still resolve a cache root when app-builder-lib cannot be loaded.
*/
export function resolveElectronBuilderCacheDir({
env = process.env,
platform = osPlatform(),
home = homedir(),
temp = tmpdir()
} = {}) {
const override = env.ELECTRON_BUILDER_CACHE?.trim()
if (override && parse(override).root) {
return override
}
if (platform === 'darwin') {
return join(home, 'Library', 'Caches', 'electron-builder')
}
if (platform === 'win32') {
const localAppData = env.LOCALAPPDATA?.trim()
// https://github.com/electron-userland/electron-builder/issues/1164
const isSystemUser =
localAppData?.toLowerCase().includes('\\windows\\system32\\') === true ||
env.USERNAME?.trim().toLowerCase() === 'system'
if (!localAppData || isSystemUser) {
return join(temp, 'electron-builder-cache')
}
return join(localAppData, 'electron-builder', 'Cache')
}
const xdgCache = env.XDG_CACHE_HOME
return xdgCache && parse(xdgCache).root
? join(xdgCache, 'electron-builder')
: join(home, '.cache', 'electron-builder')
}
function collectElevateFiles(dir, depth, found) {
let entries
try {
entries = readdirSync(dir, { withFileTypes: true })
} catch {
return found
}
for (const entry of entries) {
const path = join(dir, entry.name)
if (entry.isFile()) {
if (entry.name.toLowerCase() === ELEVATE_EXE) {
found.push(path)
}
} else if (entry.isDirectory() && depth > 1) {
collectElevateFiles(path, depth - 1, found)
}
}
return found
}
/**
* Every cached `elevate.exe` under an NSIS release directory of `cacheDir`, plus the
* `ELECTRON_BUILDER_NSIS_DIR` override copy when that is set.
*/
export function findCachedElevatePaths(cacheDir, { env = process.env } = {}) {
const found = []
const overrideDir = env.ELECTRON_BUILDER_NSIS_DIR?.trim()
if (overrideDir && isFile(join(overrideDir, ELEVATE_EXE))) {
found.push(join(overrideDir, ELEVATE_EXE))
}
let entries
try {
entries = readdirSync(cacheDir, { withFileTypes: true })
} catch {
return found
}
for (const entry of entries) {
if (entry.isDirectory() && NSIS_RELEASE_DIR.test(entry.name)) {
collectElevateFiles(join(cacheDir, entry.name), MAX_DEPTH, found)
}
}
return found
}
/**
* The exact path `CopyElevateHelper` will pack, asked of app-builder-lib itself. Returns the
* failure instead of logging it: an unavailable probe leaves the directory scan as the only
* signal, and the caller has to say that out loud rather than quietly passing.
*/
export async function resolveToolsetElevatePath(projectDir = process.cwd()) {
try {
const configPath = require.resolve(resolve(projectDir, 'config/electron-builder.config.cjs'))
const config = require(configPath)
const { getNsisElevatePath } = require('app-builder-lib/out/toolsets/windows.js')
const path = await getNsisElevatePath(config.toolsets?.nsis, config.nsis?.customNsisBinary)
return { path, error: null }
} catch (error) {
return { path: null, error: error.message }
}
}
/**
* Replaces every cached copy rather than picking one. Which bundle the rebuild packs
* depends on the toolset version resolved at pack time, and each cached copy is an
* unsigned `elevate.exe` that a later pack could reach for; the helper is a standalone
* UAC shim, not coupled to the NSIS version around it, so overwriting all of them is safe.
*
* `toolsetReplaced` is the signal that matters. A non-empty `replaced` only says that some
* cached copy was rewritten, which a stale release directory carried in by the
* `electron-builder-win-` prefix restore can satisfy on its own.
*/
export async function replaceCachedElevateHelpers({
signedPath,
cacheDir = resolveElectronBuilderCacheDir(),
projectDir = process.cwd(),
env = process.env,
probe = resolveToolsetElevatePath
} = {}) {
if (!isFile(signedPath)) {
throw new Error(`Signed elevate.exe not found: ${signedPath}`)
}
const targets = new Set(findCachedElevatePaths(cacheDir, { env }))
const { path: toolsetPath, error: toolsetError } = await probe(projectDir)
if (toolsetPath != null && isFile(toolsetPath)) {
targets.add(toolsetPath)
}
const replaced = []
for (const target of targets) {
copyFileSync(signedPath, target)
replaced.push(target)
}
return {
replaced,
cacheDir,
toolsetPath,
toolsetError,
toolsetReplaced: toolsetPath != null && replaced.includes(toolsetPath)
}
}
/**
* The annotations and exit code a swap result earns. Split out so every branch is testable
* without a subprocess — including the one that made this defect class possible, where the
* step passes because *a* cached copy was replaced while the copy the rebuild packs was not.
*/
export function summarizeSwap({ replaced, cacheDir, toolsetPath, toolsetError, toolsetReplaced }) {
if (toolsetPath != null && !toolsetReplaced) {
return {
annotations: [
{
level: 'error',
message:
`app-builder-lib resolves the elevate.exe the NSIS rebuild will pack to ${toolsetPath}, ` +
'but that path could not be replaced, so the installer will ship an unsigned UAC ' +
'elevation helper.'
}
],
exitCode: 1
}
}
if (replaced.length === 0) {
return {
annotations: [
{
level: 'error',
message:
`No cached elevate.exe found under ${cacheDir}; the NSIS rebuild will pack the unsigned ` +
'helper and ship an unsigned UAC elevation binary. The electron-builder toolset cache ' +
'layout has changed — update config/scripts/replace-cached-nsis-elevate.mjs.'
}
],
exitCode: 1
}
}
if (toolsetPath == null) {
// A green step must never quietly mean "the authoritative check did not run". The scan
// alone is satisfiable by a stale release directory that the `electron-builder-win-`
// prefix restore carried across a lockfile change, while the bundle the rebuild actually
// packs sits in a directory this scan does not match.
return {
annotations: [
{
level: 'warning',
message:
'Could not ask app-builder-lib which elevate.exe the NSIS rebuild will pack ' +
`(${toolsetError}); replaced ${replaced.length} copies found by scanning ${cacheDir} ` +
'alone, which a stale release directory can satisfy while the packed copy stays unsigned.'
}
],
exitCode: 0
}
}
return { annotations: [], exitCode: 0 }
}
// Why an exit code and not a warning: a swap that misses the copy the rebuild packs exits
// before that rebuild restores the unsigned helper, so a silent success here is
// indistinguishable from a release that shipped a signed one — which is how this went
// unnoticed for two releases. The workflow step is `continue-on-error`, so this annotates
// loudly without making a release unbuildable.
if (import.meta.filename === process.argv[1]) {
const signedPath = process.argv[2]
if (!signedPath) {
process.stderr.write('Usage: replace-cached-nsis-elevate.mjs <signed-elevate.exe>\n')
process.exit(2)
}
try {
const result = await replaceCachedElevateHelpers({ signedPath })
const { annotations, exitCode } = summarizeSwap(result)
for (const { level, message } of annotations) {
process.stdout.write(`::${level}::${message}\n`)
}
if (exitCode === 0) {
for (const path of result.replaced) {
const role = path === result.toolsetPath ? ' (the copy app-builder-lib will pack)' : ''
process.stdout.write(`Replaced ${path} with the SignPath-signed copy.${role}\n`)
}
}
process.exit(exitCode)
} catch (error) {
process.stdout.write(`::error::Could not replace the cached elevate.exe: ${error.message}\n`)
process.exit(1)
}
}
config/scripts/replace-cached-nsis-elevate.test.mjs
+364
View File
@@ -0,0 +1,364 @@
import { spawnSync } from 'node:child_process'
import {
existsSync,
mkdirSync,
mkdtempSync,
readdirSync,
readFileSync,
rmSync,
writeFileSync
} from 'node:fs'
import { tmpdir } from 'node:os'
import { join, resolve } from 'node:path'
import { afterEach, beforeEach, describe, expect, it } from 'vitest'
import { parse } from 'yaml'
import {
findCachedElevatePaths,
replaceCachedElevateHelpers,
resolveElectronBuilderCacheDir,
summarizeSwap
} from './replace-cached-nsis-elevate.mjs'
// The probe is app-builder-lib asking itself where the packed elevate.exe lives; injected
// here so no test needs the network or a warm toolset cache.
const probeFound = (path) => async () => ({ path, error: null })
const probeUnavailable = async () => ({ path: null, error: 'app-builder-lib not loadable' })
const projectRoot = resolve(import.meta.dirname, '../..')
const scriptPath = join(projectRoot, 'config/scripts/replace-cached-nsis-elevate.mjs')
let scratch
beforeEach(() => {
scratch = mkdtempSync(join(tmpdir(), 'orca elevate swap '))
})
afterEach(() => {
rmSync(scratch, { recursive: true, force: true })
})
function makeCache(...relativeFiles) {
const cacheDir = join(scratch, 'Cache')
for (const relative of relativeFiles) {
const path = join(cacheDir, ...relative.split('/'))
mkdirSync(join(path, '..'), { recursive: true })
writeFileSync(path, 'unsigned-elevate')
}
mkdirSync(cacheDir, { recursive: true })
return cacheDir
}
describe('cached elevate.exe swap covers the real electron-builder layouts', () => {
// Why these exact shapes: `downloadBuilderToolset` unpacks to
// `<cache>/<releaseName>/<archive basename>-<url hash>/`, and `releaseName` is
// `nsis-3.0.4.1` on the legacy bundle (`getBinFromUrl`) and `nsis@<toolset>` on the
// unified bundle. The release workflow searched `<cache>/nsis`, which matches none of
// them. `customNsisBinary` is deliberately absent — see the probe suite below.
it.each([
['legacy bundle', 'nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe'],
['unified bundle', 'nsis@1.2.1/nsis-bundle-3.12-k4d9x/elevate.exe'],
['bare nsis release dir', 'nsis/nsis-3.0.4.1/elevate.exe']
])('finds the cached helper in the %s layout', (_label, relative) => {
const cacheDir = makeCache(relative)
expect(findCachedElevatePaths(cacheDir, { env: {} })).toEqual([
join(cacheDir, ...relative.split('/'))
])
})
it('leaves other toolsets and the raw download dir alone', () => {
const cacheDir = makeCache(
'winCodeSign/winCodeSign-2.6.0-abc12/elevate.exe',
'downloads/nsis/elevate.exe'
)
expect(findCachedElevatePaths(cacheDir, { env: {} })).toEqual([])
})
// `nsis-resources-3.4.1` matches the release-dir pattern and is scanned. Documented
// rather than excluded: `getLegacyNsisResourcesBin` ships plugins, never an elevate.exe,
// so the over-match costs one cheap directory read and nothing else. Narrowing the
// pattern to exclude it would be a guess about a name app-builder-lib owns.
it('scans the resources bundle too, which ships no helper to find', () => {
expect(
findCachedElevatePaths(makeCache('nsis-resources-3.4.1/plugins/x86-unicode/nsProcess.dll'), {
env: {}
})
).toEqual([])
const planted = 'nsis-resources-3.4.1/nsis-resources-3.4.1-p8w1z/elevate.exe'
const cacheDir = makeCache(planted)
expect(findCachedElevatePaths(cacheDir, { env: {} })).toEqual([
join(cacheDir, ...planted.split('/'))
])
})
// The rebuild picks one bundle, and nothing outside app-builder-lib knows which.
// Replacing every cached copy is the deliberate answer to that ambiguity.
it('replaces every cached copy when several bundles are present', async () => {
const cacheDir = makeCache(
'nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe',
'nsis@1.2.1/nsis-bundle-3.12-k4d9x/elevate.exe'
)
const signed = join(scratch, 'signed-elevate.exe')
writeFileSync(signed, 'signpath-signed-elevate')
const { replaced } = await replaceCachedElevateHelpers({
signedPath: signed,
cacheDir,
env: {},
probe: probeUnavailable
})
expect(replaced).toHaveLength(2)
for (const path of replaced) {
expect(readFileSync(path, 'utf8')).toBe('signpath-signed-elevate')
}
})
it('covers the ELECTRON_BUILDER_NSIS_DIR override copy', () => {
const overrideDir = join(scratch, 'nsis-override')
mkdirSync(overrideDir, { recursive: true })
writeFileSync(join(overrideDir, 'elevate.exe'), 'unsigned-elevate')
const cacheDir = makeCache()
expect(
findCachedElevatePaths(cacheDir, { env: { ELECTRON_BUILDER_NSIS_DIR: overrideDir } })
).toEqual([join(overrideDir, 'elevate.exe')])
})
it('resolves the cache root the same way app-builder-lib does', () => {
expect(
resolveElectronBuilderCacheDir({
env: { LOCALAPPDATA: 'C:\\Users\\runneradmin\\AppData\\Local' },
platform: 'win32'
})
).toBe(join('C:\\Users\\runneradmin\\AppData\\Local', 'electron-builder', 'Cache'))
expect(resolveElectronBuilderCacheDir({ env: {}, platform: 'darwin', home: '/Users/a' })).toBe(
join('/Users/a', 'Library', 'Caches', 'electron-builder')
)
expect(resolveElectronBuilderCacheDir({ env: { ELECTRON_BUILDER_CACHE: '/mnt/cache' } })).toBe(
'/mnt/cache'
)
})
// Proof against the layout actually on disk, not just the fixtures. Cross-checked
// against an independent unbounded walk so a search that scopes itself wrongly
// cannot pass by finding nothing — which is exactly how the inline path passed.
// Skipped only where no NSIS bundle has been downloaded into the cache yet.
it('finds every elevate.exe the real electron-builder cache holds', (ctx) => {
const cacheDir = resolveElectronBuilderCacheDir()
if (!existsSync(cacheDir)) {
// Reported as skipped, never as passed: this is the one test that checks the scan
// against a layout nobody wrote down, and a silent no-op here is the suite
// confirming itself. The Linux unit-test job has no electron-builder cache.
ctx.skip()
return
}
const walk = (dir) =>
readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
const path = join(dir, entry.name)
if (entry.isDirectory()) {
return walk(path)
}
return entry.name.toLowerCase() === 'elevate.exe' ? [path] : []
})
const onDisk = walk(cacheDir)
if (onDisk.length === 0) {
ctx.skip()
return
}
expect(findCachedElevatePaths(cacheDir, { env: {} }).sort()).toEqual(onDisk.sort())
})
})
describe('the probe, not the scan, decides whether the swap worked', () => {
// Why the probe is load-bearing: `getBinFromCustomLoc` passes `nsis-<version>` to `getBin`
// as its in-process promise key only — the extract dir is named for the custom URL's parent
// segment, so a customNsisBinary bundle can sit outside `nsis*` entirely.
it('covers a custom bundle the directory scan cannot match', async () => {
const relative = 'orca-nsis-mirror/nsis-custom-3.11-0zqp2/elevate.exe'
const cacheDir = makeCache(relative)
const packed = join(cacheDir, ...relative.split('/'))
const signed = join(scratch, 'signed-elevate.exe')
writeFileSync(signed, 'signpath-signed-elevate')
expect(findCachedElevatePaths(cacheDir, { env: {} })).toEqual([])
const result = await replaceCachedElevateHelpers({
signedPath: signed,
cacheDir,
env: {},
probe: probeFound(packed)
})
expect(result.toolsetReplaced).toBe(true)
expect(readFileSync(packed, 'utf8')).toBe('signpath-signed-elevate')
expect(summarizeSwap(result)).toEqual({ annotations: [], exitCode: 0 })
})
// The shape that reproduced the hole: release-cut.yml restores the toolset cache with
// `restore-keys: electron-builder-win-`, so a stale release directory survives a lockfile
// change. Replacing that stale copy satisfies `replaced.length > 0` on its own while the
// bundle the rebuild packs sits in a directory the scan never matches.
it('does not call a stale directory a success when the packed bundle is unmatched', async () => {
const stale = 'nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe'
const packed = 'builder-nsis@4.0.0/nsis-bundle-4.0-k4d9x/elevate.exe'
const cacheDir = makeCache(stale, packed)
const signed = join(scratch, 'signed-elevate.exe')
writeFileSync(signed, 'signpath-signed-elevate')
const result = await replaceCachedElevateHelpers({
signedPath: signed,
cacheDir,
env: {},
probe: probeUnavailable
})
// The scan rewrote only the stale copy; the one that would be packed is untouched.
expect(result.replaced).toEqual([join(cacheDir, ...stale.split('/'))])
expect(readFileSync(join(cacheDir, ...packed.split('/')), 'utf8')).toBe('unsigned-elevate')
// So the run must not look clean.
const { annotations, exitCode } = summarizeSwap(result)
expect(exitCode).toBe(0)
expect(annotations).toHaveLength(1)
expect(annotations[0].level).toBe('warning')
expect(annotations[0].message).toContain('Could not ask app-builder-lib')
})
it('fails when the probe names a copy that could not be replaced', () => {
const summary = summarizeSwap({
replaced: ['C:/cache/nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe'],
cacheDir: 'C:/cache',
toolsetPath: 'C:/cache/nsis@2.0.0/nsis-bundle-4.0-k4d9x/elevate.exe',
toolsetError: null,
toolsetReplaced: false
})
expect(summary.exitCode).toBe(1)
expect(summary.annotations[0].level).toBe('error')
expect(summary.annotations[0].message).toContain('will pack')
})
it('fails when nothing at all was replaced', () => {
const summary = summarizeSwap({
replaced: [],
cacheDir: 'C:/cache',
toolsetPath: null,
toolsetError: 'app-builder-lib not loadable',
toolsetReplaced: false
})
expect(summary.exitCode).toBe(1)
expect(summary.annotations[0].level).toBe('error')
expect(summary.annotations[0].message).toContain('No cached elevate.exe found')
})
})
describe('a cached elevate.exe miss is not silent', () => {
// ELECTRON_BUILDER_NSIS_DIR short-circuits app-builder-lib's own resolution before
// any download, so the probe fails offline instead of fetching the NSIS bundle.
function runScript(cacheDir, nsisDir, signedPath) {
return spawnSync(process.execPath, [scriptPath, signedPath], {
cwd: projectRoot,
encoding: 'utf8',
env: {
...process.env,
ELECTRON_BUILDER_CACHE: cacheDir,
ELECTRON_BUILDER_NSIS_DIR: nsisDir
}
})
}
it('exits non-zero with an ::error:: annotation when no cached copy is found', () => {
const cacheDir = makeCache()
const emptyNsisDir = join(scratch, 'empty-nsis')
mkdirSync(emptyNsisDir, { recursive: true })
const signed = join(scratch, 'signed-elevate.exe')
writeFileSync(signed, 'signpath-signed-elevate')
const result = runScript(cacheDir, emptyNsisDir, signed)
expect(result.status).toBe(1)
expect(result.stdout).toContain('::error::No cached elevate.exe found')
})
it('warns on the scan-only path so green never means the probe was skipped', () => {
const cacheDir = makeCache('nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe')
const emptyNsisDir = join(scratch, 'empty-nsis')
mkdirSync(emptyNsisDir, { recursive: true })
const signed = join(scratch, 'signed-elevate.exe')
writeFileSync(signed, 'signpath-signed-elevate')
const result = runScript(cacheDir, emptyNsisDir, signed)
expect(result.status).toBe(0)
expect(result.stdout).not.toContain('::error::')
expect(result.stdout).toContain('::warning::Could not ask app-builder-lib')
expect(
readFileSync(join(cacheDir, 'nsis-3.0.4.1', 'nsis-3.0.4.1-1mx3n', 'elevate.exe'), 'utf8')
).toBe('signpath-signed-elevate')
})
// The healthy release-job path: app-builder-lib answers, so the copy it will pack is the
// one that gets replaced and there is nothing to warn about.
it('exits clean when the probe resolves the copy the rebuild will pack', () => {
const cacheDir = makeCache()
const nsisDir = join(scratch, 'nsis-bundle')
mkdirSync(nsisDir, { recursive: true })
writeFileSync(join(nsisDir, 'elevate.exe'), 'unsigned-elevate')
const signed = join(scratch, 'signed-elevate.exe')
writeFileSync(signed, 'signpath-signed-elevate')
const result = runScript(cacheDir, nsisDir, signed)
expect(result.status).toBe(0)
expect(result.stdout).not.toContain('::error::')
expect(result.stdout).not.toContain('::warning::')
expect(result.stdout).toContain('the copy app-builder-lib will pack')
expect(readFileSync(join(nsisDir, 'elevate.exe'), 'utf8')).toBe('signpath-signed-elevate')
})
})
describe('release-cut.yml swaps the cached elevate.exe through the resolver', () => {
function swapStep() {
const workflow = parse(
readFileSync(join(projectRoot, '.github/workflows/release-cut.yml'), 'utf8')
)
const step = workflow.jobs.build.steps.find(
(candidate) => candidate.name === 'Replace cached elevate.exe with the signed copy'
)
expect(step).toBeDefined()
return step
}
it('delegates the cache lookup to the script instead of an inline path', () => {
const step = swapStep()
expect(step.run).toContain('node config/scripts/replace-cached-nsis-elevate.mjs $signed')
// The hardcoded miss that shipped v1.4.193/v1.4.194 unsigned.
expect(step.run).not.toContain('electron-builder\\Cache\\nsis')
expect(step.run).not.toContain('-ErrorAction SilentlyContinue')
})
it('fails the step when the swap reports a miss', () => {
const step = swapStep()
// Matched as an executed statement: downgrading this to a Write-Host restores
// the silent fail-open that let the unsigned helper ship.
expect(step.run).toMatch(/if \(\$LASTEXITCODE -ne 0\) \{/)
expect(step.run).toMatch(/^\s*throw \$message\s*$/m)
expect(step.run).toContain('GITHUB_STEP_SUMMARY')
})
// Why kept: windows-signing-rehearsal.yml shares the electron-builder-win-<hash>
// cache key, so dropping this guard would let a test certificate reach a release cache.
it('still refuses to stage anything but a SignPath-signed helper', () => {
const step = swapStep()
expect(step.run).toContain("$signature.Status -ne 'Valid'")
expect(step.run).toContain("$subject -notlike '*CN=SignPath Foundation*'")
})
// The inner-signing chain stays fail-open: a loud red step, not an unbuildable release.
it('keeps the step unable to fail the release job', () => {
expect(swapStep()['continue-on-error']).toBe(true)
})
})
config/scripts/repo-icon-source-href-benchmark.mjs
+55
View File
@@ -0,0 +1,55 @@
import assert from 'node:assert/strict'
import { performance } from 'node:perf_hooks'
import { extractIconHref } from '../../src/main/repo-icon-source-href.ts'
// Original production expressions, preserved for the before/after measurement.
const html =
/<link\b(?=[^>]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/i
const object =
/(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/i
const original = (source) => source.match(html)?.[1] ?? source.match(object)?.[1] ?? null
function measurePair(source) {
original(source)
extractIconHref(source)
const beforeSamples = []
const afterSamples = []
for (let run = 0; run < 5; run++) {
const measurements = [
[original, beforeSamples],
[extractIconHref, afterSamples]
]
if (run % 2 === 1) {
measurements.reverse()
}
for (const [fn, samples] of measurements) {
const started = performance.now()
fn(source)
samples.push(performance.now() - started)
}
}
return {
beforeMs: beforeSamples.sort((a, b) => a - b)[2],
afterMs: afterSamples.sort((a, b) => a - b)[2]
}
}
const results = []
for (const size of [8192, 16384, 32768]) {
for (const shape of ['no icon', 'rel without href', 'unterminated link starts']) {
const source =
shape === 'unterminated link starts'
? '<link '.repeat(Math.floor(size / 6))
: 'a'.repeat(size) + (shape === 'rel without href' ? ' rel:"icon"' : '')
assert.equal(extractIconHref(source), original(source))
const { beforeMs, afterMs } = measurePair(source)
results.push({
shape,
bytes: Buffer.byteLength(source),
beforeMs,
afterMs,
speedup: beforeMs / afterMs
})
}
}
console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
config/scripts/run-terminal-ibus-hangul-e2e.mjs
+2 -1
View File
@@ -199,7 +199,8 @@ async function runInsideSession(evidenceDir) {
'test:e2e:headful',
'--workers=1',
'--',
'tests/e2e/terminal-ibus-hangul-native.spec.ts'
'tests/e2e/terminal-ibus-hangul-native.spec.ts',
'tests/e2e/terminal-hangul-terminating-digit-native.spec.ts'
],
{
cwd: projectDir,
config/scripts/source-string-blanking-benchmark.mjs
+79
View File
@@ -0,0 +1,79 @@
import assert from 'node:assert/strict'
import { execFileSync } from 'node:child_process'
import { stripTypeScriptTypes } from 'node:module'
import { performance } from 'node:perf_hooks'
import { blankStringContents as after } from '../../src/shared/source-scan/source-tree-scan.ts'
const ref = process.argv[2]
if (!ref) {
throw new Error('Usage: node config/scripts/source-string-blanking-benchmark.mjs <baseline-ref>')
}
const source = execFileSync('git', ['show', `${ref}:src/shared/source-scan/source-tree-scan.ts`], {
encoding: 'utf8'
})
const { blankStringContents: before } = await import(
`data:text/javascript;base64,${Buffer.from(stripTypeScriptTypes(source)).toString('base64')}`
)
const tokens = [
'a',
'/',
'*',
' ',
'\n',
'\r',
'\t',
'\u00a0',
'\u2028',
'"',
"'",
'`',
'${',
'}',
'{',
'\\',
'(',
')',
'[',
']',
'=',
'+',
'-',
';'
]
let seed = 173
for (let sample = 0; sample < 3000; sample++) {
let input = ''
for (let token = 0; token < 40; token++) {
seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0
input += tokens[seed % tokens.length]
}
assert.equal(after(input), before(input), JSON.stringify(input))
assert.equal(after(input, true), before(input, true), JSON.stringify(input))
}
function measure(fn, input) {
const samples = []
for (let run = 0; run < 3; run++) {
const start = performance.now()
fn(input)
samples.push(performance.now() - start)
}
return samples.sort((a, b) => a - b)[1]
}
const results = []
for (const lines of [100, 1000, 5000, 10000]) {
const input = 'const x = value / 2;\n'.repeat(lines)
assert.equal(after(input), before(input))
results.push({
lines,
bytes: Buffer.byteLength(input),
beforeMs: measure(before, input),
afterMs: measure(after, input)
})
}
console.log(
JSON.stringify(
{ node: process.version, platform: process.platform, differentialCases: 3000, results },
null,
2
)
)
config/scripts/terminal-ime-engagement-receipt.mjs
+2 -1
View File
@@ -13,7 +13,8 @@ export const IME_ENGAGEMENT_RECEIPT_ENV = 'ORCA_E2E_IME_ENGAGEMENT_RECEIPT'
/** The tests that must each leave a receipt. Pinned so deleting one cannot quietly shrink the lane. */
export const EXPECTED_NATIVE_IME_TESTS = [
'forwards the issue exact-byte sequence without loss or duplication',
'forwards the issue sentence stress sequence without leaked ASCII'
'forwards the issue sentence stress sequence without leaked ASCII',
'a digit typed right after a Hangul syllable reaches the pty'
]
function parseReceipts(text) {
config/scripts/terminal-ime-engagement-receipt.test.mjs
+18 -9
View File
@@ -4,7 +4,7 @@ import {
verifyImeEngagementReceipts
} from './terminal-ime-engagement-receipt.mjs'
const [firstTest, secondTest] = EXPECTED_NATIVE_IME_TESTS
const [firstTest, secondTest, thirdTest] = EXPECTED_NATIVE_IME_TESTS
function receipt(test, overrides = {}) {
return JSON.stringify({
@@ -18,9 +18,11 @@ function receipt(test, overrides = {}) {
describe('verifyImeEngagementReceipts', () => {
it('accepts a run where every expected test observed real composition', () => {
expect(verifyImeEngagementReceipts(`${receipt(firstTest)}\n${receipt(secondTest)}\n`)).toEqual(
[]
)
expect(
verifyImeEngagementReceipts(
`${receipt(firstTest)}\n${receipt(secondTest)}\n${receipt(thirdTest)}\n`
)
).toEqual([])
})
// The failure this whole mechanism exists for: Playwright reports a skipped test as a pass, so
@@ -35,13 +37,20 @@ describe('verifyImeEngagementReceipts', () => {
it('rejects a partial run where only one test reached the engine', () => {
expect(verifyImeEngagementReceipts(`${receipt(firstTest)}\n`)).toEqual([
`no engagement receipt for "${secondTest}" — it was skipped, filtered out, or renamed`
`no engagement receipt for "${secondTest}" — it was skipped, filtered out, or renamed`,
`no engagement receipt for "${thirdTest}" — it was skipped, filtered out, or renamed`
])
})
it('requires the digit receipt even when both original native tests passed', () => {
expect(verifyImeEngagementReceipts(`${receipt(firstTest)}\n${receipt(secondTest)}\n`)).toEqual([
`no engagement receipt for "${thirdTest}" — it was skipped, filtered out, or renamed`
])
})
it('rejects a run that typed keys but never opened a composition', () => {
const problems = verifyImeEngagementReceipts(
`${receipt(firstTest, { compositionStart: 0 })}\n${receipt(secondTest)}\n`
`${receipt(firstTest, { compositionStart: 0 })}\n${receipt(secondTest)}\n${receipt(thirdTest)}\n`
)
expect(problems).toEqual([
`"${firstTest}" recorded no compositionstart — the IME never engaged`
@@ -50,7 +59,7 @@ describe('verifyImeEngagementReceipts', () => {
it('rejects a composition that produced no Hangul, which a latin passthrough would satisfy', () => {
const problems = verifyImeEngagementReceipts(
`${receipt(firstTest, { hangulComposition: 0 })}\n${receipt(secondTest)}\n`
`${receipt(firstTest, { hangulComposition: 0 })}\n${receipt(secondTest)}\n${receipt(thirdTest)}\n`
)
expect(problems).toEqual([
`"${firstTest}" recorded no Hangul composition data — the engine produced no syllables`
@@ -59,7 +68,7 @@ describe('verifyImeEngagementReceipts', () => {
it('rejects a renamed test rather than counting it toward coverage', () => {
const problems = verifyImeEngagementReceipts(
`${receipt(firstTest)}\n${receipt(secondTest)}\n${receipt('some new scenario')}\n`
`${receipt(firstTest)}\n${receipt(secondTest)}\n${receipt(thirdTest)}\n${receipt('some new scenario')}\n`
)
expect(problems).toEqual([
'unexpected engagement receipt for "some new scenario" — update EXPECTED_NATIVE_IME_TESTS'
@@ -68,7 +77,7 @@ describe('verifyImeEngagementReceipts', () => {
it('reports a truncated receipt rather than parsing around it', () => {
const problems = verifyImeEngagementReceipts(
`${receipt(firstTest)}\n{"test":"trunc\n${receipt(secondTest)}\n`
`${receipt(firstTest)}\n{"test":"trunc\n${receipt(secondTest)}\n${receipt(thirdTest)}\n`
)
expect(problems).toEqual(['malformed receipt line: {"test":"trunc'])
})
config/scripts/verify-dev-channel-packaging.test.mjs
+13
View File
@@ -53,6 +53,19 @@ describe('electron-builder dev-channel identity', () => {
expect(config.win.verifyUpdateCodeSignature).toBe(false)
})
// Why on every channel: the hook is the only handle electron-builder gives on
// the NSIS uninstaller, and it signs nothing — it relays the file to and from
// the CI SignPath request. Carrying it must not drag a publisherName onto a
// dev build, which is the failure the split above exists to prevent.
it('carries the uninstaller sign hook without changing publisherName semantics', () => {
for (const env of [{}, WIN_ADHOC_ENV]) {
const config = loadConfigWithEnv(env)
expect(typeof config.win.signtoolOptions.sign).toBe('function')
}
expect(loadConfigWithEnv({}).win.signtoolOptions.publisherName).toBe('SignPath Foundation')
expect(loadConfigWithEnv(WIN_ADHOC_ENV).win.signtoolOptions.publisherName).toBeUndefined()
})
it.each([
['hourly', { ORCA_WIN_HOURLY: '1' }, 'orca-hourly'],
['daily', { ORCA_WIN_DAILY: '1' }, 'orca-daily'],
config/scripts/windows-process-tree-gyp-rebuild.mjs
+125 -1
View File
@@ -9,7 +9,8 @@
* hop escapes the store and configure fails with "node_addon_api.gyp not
* found" (run 32999886072).
*/
import { copyFileSync, mkdirSync, realpathSync } from 'node:fs'
import { execFileSync } from 'node:child_process'
import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSync } from 'node:fs'
import { createRequire } from 'node:module'
import { dirname, join, resolve } from 'node:path'
@@ -22,6 +23,16 @@ export const WINDOWS_PROCESS_TREE_PACKAGE_DIR = join(
'windows-process-tree'
)
export const WINDOWS_PROCESS_TREE_PATCH_PATH = join(
ROOT,
'config',
'patches',
'@vscode__windows-process-tree@0.8.0.patch'
)
/** Only the patched reader defines this; the upstream one walks the PEB. */
const COMMAND_LINE_PATCH_MARKER = 'kProcessCommandLineInformation'
export const WINDOWS_PROCESS_TREE_NODE_ADDON_API_HEADERS = [
'napi.h',
'napi-inl.h',
@@ -39,6 +50,119 @@ export function nodeGypRebuildInvocation(arch, packageDir = WINDOWS_PROCESS_TREE
}
}
/** The binary the addon actually loads. */
export function windowsProcessTreeAddonPath(packageDir = WINDOWS_PROCESS_TREE_PACKAGE_DIR) {
return join(packageDir, 'build', 'Release', 'windows_process_tree.node')
}
/** The import whose absence tells the patched binary from the published prebuilt. */
const FLAGGED_IMPORT = 'ReadProcessMemory'
/**
* Does this compiled addon still carry the flagged primitive?
*
* The patched reader never calls `ReadProcessMemory`, so the symbol is absent
* from its import table; the upstream build imports it. That makes this a
* property of the binary rather than of the source next to it, which matters
* because the published tarball ships a *loadable* prebuilt built from
* unpatched source: it is node-addon-api, so it satisfies a bare `require()`
* under both Node and Electron, and a skipped rebuild would use it.
*
* Tri-state, not a predicate: a binary that is not there has not been cleared,
* and a boolean makes "absent" indistinguishable from "verified clean" at every
* call site. Takes the binary path so the relay's staged addon -- which sits
* beside the bundle, with no package around it -- gets the same check.
*
* @param {string} addonPath
* @returns {'clean' | 'unpatched' | 'missing'}
*/
export function inspectWindowsProcessTreeAddon(addonPath) {
if (!existsSync(addonPath)) {
return 'missing'
}
return readFileSync(addonPath).includes(FLAGGED_IMPORT) ? 'unpatched' : 'clean'
}
/**
* Refuse to compile or load the upstream command-line reader.
*
* Unpatched, it opens every process with `PROCESS_VM_READ` and walks the PEB to
* recover the command line -- the primitive MDE scores as credential dumping,
* and the reason this package is patched at all. pnpm has been seen
* materializing this CRLF package with its patch missing, so repair the source
* from the patch file, and drop any binary that predates the repair.
*/
export function ensureWindowsProcessTreeCommandLinePatch(
packageDir = WINDOWS_PROCESS_TREE_PACKAGE_DIR
) {
const source = join(packageDir, 'src', 'process_commandline.cc')
if (!existsSync(source)) {
throw new Error(
`${source} is missing, so the command-line patch cannot be verified. Run pnpm install.`
)
}
let repaired = false
if (!readFileSync(source, 'utf8').includes(COMMAND_LINE_PATCH_MARKER)) {
try {
execFileSync(
'git',
[
// Why force the line-ending mode: the patch is stored LF (a contract
// test forbids CR bytes in it), but upstream ships this source CRLF,
// so its pre-image lines and the file's differ by a CR. Under
// `core.autocrlf=false` -- Git's own built-in default, and what
// "checkout as-is" selects in the Git for Windows installer -- git
// compares them literally, the hunk does not match, and the repair
// throws. `input` normalizes line endings for that comparison and
// nothing else, so a hunk whose real content drifted is still
// rejected. Measured: without it, apply exits 1 at autocrlf=false and
// 0 at true/input; with it, 0 for CRLF and LF sources under all three.
'-c',
'core.autocrlf=input',
'apply',
'--include=src/process_commandline.cc',
WINDOWS_PROCESS_TREE_PATCH_PATH
],
{
cwd: realpathSync(packageDir),
stdio: 'pipe',
// Why blind git to the repo: run inside a work tree, `git apply`
// prefixes patch paths with the cwd-relative prefix, silently skips
// everything that does not match -- and still exits 0. The package
// dir is always under the project root, so without this the repair
// reports success and changes nothing.
env: { ...process.env, GIT_DIR: join(packageDir, '.orca-no-such-git-dir') }
}
)
} catch (error) {
throw new Error(
'src/process_commandline.cc still reads the PEB, and repairing it from ' +
`${WINDOWS_PROCESS_TREE_PATCH_PATH} failed: ${error?.message ?? error}. Run pnpm install.`
)
}
if (!readFileSync(source, 'utf8').includes(COMMAND_LINE_PATCH_MARKER)) {
throw new Error(
'src/process_commandline.cc still reads the PEB after repair, so the patch did not ' +
'apply. Run pnpm install.'
)
}
repaired = true
}
// A binary from before the repair -- or the tarball's own prebuilt -- would
// otherwise survive a skipped rebuild and load the flagged reader anyway.
// Deleting it can fail EPERM against a loaded (memory-mapped) addon, which
// `force: true` does not cover -- it only swallows ENOENT. That throw is the
// caller's to classify as a Windows file lock, so it must not be swallowed.
if (inspectWindowsProcessTreeAddon(windowsProcessTreeAddonPath(packageDir)) === 'unpatched') {
rmSync(windowsProcessTreeAddonPath(packageDir), { force: true })
repaired = true
}
return repaired
}
// Patched binding.gyp includes deps/node-addon-api; the tarball does not ship those headers.
export function stageWindowsProcessTreeNodeAddonApiHeaders(
packageDir = WINDOWS_PROCESS_TREE_PACKAGE_DIR
config/scripts/windows-process-tree-gyp-rebuild.test.mjs
+39 -1
View File
@@ -10,8 +10,9 @@ import {
} from 'node:fs'
import { tmpdir } from 'node:os'
import { join, resolve } from 'node:path'
import { describe, expect, it } from 'vitest'
import { afterEach, beforeEach, describe, expect, it } from 'vitest'
import {
inspectWindowsProcessTreeAddon,
nodeGypRebuildInvocation,
stageWindowsProcessTreeNodeAddonApiHeaders,
WINDOWS_PROCESS_TREE_NODE_ADDON_API_HEADERS,
@@ -59,3 +60,40 @@ describe('windows-process-tree node-gyp rebuild', () => {
}
})
})
describe('inspecting a compiled windows-process-tree addon', () => {
let dir
beforeEach(() => {
dir = mkdtempSync(join(tmpdir(), 'orca-windows-process-tree-addon-'))
})
afterEach(() => {
rmSync(dir, { recursive: true, force: true })
})
it('reports a binary that still imports ReadProcessMemory as unpatched', () => {
const addonPath = join(dir, 'windows_process_tree.node')
writeFileSync(addonPath, Buffer.from('MZ\0\0KERNEL32.dll\0ReadProcessMemory\0', 'binary'))
expect(inspectWindowsProcessTreeAddon(addonPath)).toBe('unpatched')
})
it('reports a binary without the import as clean', () => {
const addonPath = join(dir, 'windows_process_tree.node')
writeFileSync(addonPath, Buffer.from('MZ\0\0ntdll.dll\0NtQueryInformationProcess\0', 'binary'))
expect(inspectWindowsProcessTreeAddon(addonPath)).toBe('clean')
})
// The whole point of the tri-state: absence is not evidence of safety, and a
// boolean made "there is no binary" indistinguishable from "checked, clean".
it('reports an absent binary as missing rather than clean', () => {
expect(inspectWindowsProcessTreeAddon(join(dir, 'windows_process_tree.node'))).toBe('missing')
})
it('inspects whatever path it is handed, including a relay-staged addon', () => {
// The relay loads `./windows-process-tree.node` beside its bundle, which is
// nowhere near a node_modules package directory.
const staged = join(dir, 'windows-process-tree.node')
writeFileSync(staged, Buffer.from('MZ\0\0ReadProcessMemory\0', 'binary'))
expect(inspectWindowsProcessTreeAddon(staged)).toBe('unpatched')
})
})
config/scripts/windows-signing-workflow-contract.test.mjs
+234
View File
@@ -1,4 +1,5 @@
import { readFileSync } from 'node:fs'
import { createRequire } from 'node:module'
import { join, resolve } from 'node:path'
import { describe, expect, it } from 'vitest'
import { parse } from 'yaml'
@@ -212,6 +213,7 @@ describe('Windows signing workflow contract', () => {
'Notify Slack that inner-binary signing is waiting for approval',
'Download signed inner binaries from SignPath',
'Restore signed inner binaries into unpacked app',
'Restore signed uninstaller for the installer rebuild',
'Replace cached elevate.exe with the signed copy',
'Rebuild NSIS installer from signed unpacked app'
]
@@ -222,3 +224,235 @@ describe('Windows signing workflow contract', () => {
}
})
})
// Why these exist: the NSIS uninstaller is generated inside electron-builder's
// uninstaller pass and deleted immediately after being embedded, so the only way
// CI can sign it is the export/import relay through win.signtoolOptions.sign.
// Every link is asserted here the way Orca.exe and conpty_console_list.node are.
describe('Windows NSIS uninstaller signing', () => {
const releaseSteps = () => readWorkflow('.github/workflows/release-cut.yml').jobs.build.steps
const stepNamed = (steps, name) => steps.find((step) => step.name === name)
const EXPORT_ENV = 'ORCA_WIN_UNINSTALLER_EXPORT_PATH'
const SIGNED_ENV = 'ORCA_WIN_UNINSTALLER_SIGNED_PATH'
it('exports the uninstaller from the first Windows build', () => {
const build = stepNamed(releaseSteps(), 'Build Windows release artifacts')
expect(build.env[EXPORT_ENV]).toContain('uninstaller-signing')
expect(build.env[EXPORT_ENV]).toContain('orca-uninstaller.exe')
})
// Why this is a test and not a comment: `files` in the electron-builder config
// is all-negation, so app-builder packs whatever is left in the checkout root.
// These steps retry, and a retried attempt would pack an unsigned .exe into
// app.asar — the very defect this chain removes. Every relay path must live
// outside the checkout.
it('keeps every relay path out of the packed checkout', () => {
const relayEnvValues = [
...releaseSteps(),
...readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse.steps
].flatMap((step) => [step.env?.[EXPORT_ENV], step.env?.[SIGNED_ENV]].filter(Boolean))
expect(relayEnvValues.length).toBe(4)
for (const value of relayEnvValues) {
expect(value).toContain('runner.temp')
expect(value).not.toContain('github.workspace')
}
const relayScripts = [
...releaseSteps(),
...readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse.steps
]
.map((step) => step.run ?? '')
.filter((run) => run.includes('uninstaller-signing'))
expect(relayScripts.length).toBeGreaterThan(0)
for (const run of relayScripts) {
// Why count occurrences rather than assert `toContain` once: a step
// carrying two relay paths could root the first in RUNNER_TEMP and leave
// the second bare-relative — which resolves against the checkout, and is
// exactly the shape of the defect this test exists to catch.
const mentions = run.match(/uninstaller-signing/g) ?? []
const rooted = run.match(/Join-Path \$env:RUNNER_TEMP 'uninstaller-signing/g) ?? []
expect(rooted.length, run).toBe(mentions.length)
expect(run).not.toContain('$env:GITHUB_WORKSPACE')
}
})
it('stages the uninstaller into the same request as the inner binaries', () => {
const stage = stepNamed(releaseSteps(), 'Stage unsigned inner PE files for signing')
expect(stage.run).toContain('uninstaller-signing\\unsigned\\orca-uninstaller.exe')
expect(stage.run).toContain('uninstaller\\orca-uninstaller.exe')
// No third SignPath request: exactly two submissions, as budgeted for the
// 1h + 4h approval waits inside the 360-minute job cap.
const submissions = releaseSteps().filter(
(step) => step.uses === 'signpath/github-action-submit-signing-request@v2'
)
expect(submissions).toHaveLength(2)
})
// A staged-but-unreturned uninstaller must not fail the inner chain, or a
// SignPath artifact-configuration gap would cost the inner-binary signatures.
it('keeps the uninstaller out of the inner-binary copy-back list', () => {
const stage = stepNamed(releaseSteps(), 'Stage unsigned inner PE files for signing')
const restoreInner = stepNamed(
releaseSteps(),
'Restore signed inner binaries into unpacked app'
)
expect(stage.run).not.toMatch(/\$list\.Add\(['"]uninstaller/)
expect(restoreInner.run).not.toContain('orca-uninstaller.exe')
})
// This step's outcome gates the upload of every inner binary, so a filesystem
// error while staging the uninstaller must not escape — otherwise one
// uninstaller-specific failure costs every inner-binary signature, which is
// strictly worse than the behaviour before this chain existed.
it('cannot let an uninstaller staging failure cost the inner-binary signatures', () => {
const stage = stepNamed(releaseSteps(), 'Stage unsigned inner PE files for signing')
const uninstallerBlock = stage.run.slice(stage.run.indexOf('$exportedUninstaller'))
expect(stage.run).toMatch(/try \{[\s\S]*\$exportedUninstaller[\s\S]*\} catch \{/)
expect(uninstallerBlock).toContain('::warning::Could not stage the NSIS uninstaller')
expect(uninstallerBlock).not.toContain('throw')
// Explicit, so the catch does not silently depend on GitHub's
// $ErrorActionPreference='Stop' default for `shell: pwsh`.
expect(uninstallerBlock).toContain('New-Item -ItemType Directory -Force -Path (Split-Path')
expect(uninstallerBlock).toMatch(/New-Item[^\r\n]*-ErrorAction Stop/)
expect(uninstallerBlock).toMatch(/Copy-Item[^\r\n]*-ErrorAction Stop/)
// The upload it gates still keys off this step, so the catch is load-bearing.
expect(stepNamed(releaseSteps(), 'Upload unsigned inner binaries for SignPath').if).toContain(
"steps.stage-inner.outcome == 'success'"
)
})
it('re-injects the signed uninstaller into the rebuilt installer', () => {
const steps = releaseSteps()
const restore = stepNamed(steps, 'Restore signed uninstaller for the installer rebuild')
const rebuild = stepNamed(steps, 'Rebuild NSIS installer from signed unpacked app')
const names = steps.map((step) => step.name)
expect(restore.if).toContain('github.run_attempt == 1')
expect(restore.if).toContain("steps.restore-signed-inner.outcome == 'success'")
expect(restore.run).toContain('orca-uninstaller.exe')
expect(names.indexOf(restore.name)).toBeLessThan(names.indexOf(rebuild.name))
expect(rebuild.env[SIGNED_ENV]).toContain('uninstaller-signing')
// The rebuild must not depend on the uninstaller leg: a missing signed
// uninstaller ships today's installer, it does not skip the rebuild.
expect(rebuild.if).not.toContain('restore-signed-uninstaller')
})
// NSIS hides the uninstaller in a compressed data section the bundled 7za
// cannot read, so the gate proves it from the sign hook's digest receipt
// instead of extracting it — and only when the relay actually ran.
it('reports the embedded uninstaller in the inner-binary evidence gate', () => {
const gate = stepNamed(releaseSteps(), 'Verify Windows inner binary signatures')
expect(gate.env.UNINSTALLER_SIGNING_COMPLETED).toBe(
"${{ steps.restore-signed-uninstaller.outcome == 'success' }}"
)
expect(gate.run).toContain('.embedded-sha256')
expect(gate.run).toContain("$env:UNINSTALLER_SIGNING_COMPLETED -eq 'true'")
expect(gate.run).toContain('not signed by SignPath Foundation: Uninstall Orca.exe')
// The uninstaller must not join the 7z payload loop, which cannot see it.
expect(gate.run).not.toContain("$targets += 'Uninstall Orca.exe'")
})
it('rehearses the uninstaller leg end to end', () => {
const steps = readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse
.steps
const names = steps.map((step) => step.name)
const pack = stepNamed(steps, 'Package Windows app and export the NSIS uninstaller')
const rebuild = stepNamed(steps, 'Build NSIS installer from signed unpacked app')
const verify = stepNamed(steps, 'Verify signatures end to end')
// --dir never produces an uninstaller, so the rehearsal has to build the
// installer the way release-cut's first Windows pass does.
expect(pack.run).toContain('--win --publish never')
expect(pack.run).not.toContain('--dir')
expect(pack.env[EXPORT_ENV]).toContain('orca-uninstaller.exe')
expect(names).toContain('Restore signed uninstaller for the installer rebuild')
expect(rebuild.env[SIGNED_ENV]).toContain('orca-uninstaller.exe')
expect(verify.run).toContain('.embedded-sha256')
// The receipt only proves the import leg ran. The rehearsal is where the
// shipped uninstaller itself gets checked — the release job cannot install
// onto the runner it publishes from.
expect(verify.run).toContain('shipped: Uninstall Orca.exe')
expect(verify.run).toContain('-tnsis')
expect(verify.run).toContain("-ArgumentList '/S'")
})
// This workflow is the merge gate, so it must not be able to fail on its own
// artefact: 7-Zip's NSIS handler is unreliable enough that its output has to
// be corroborated before a signature verdict is drawn from it.
it('never lets an unreliable extract fail the rehearsal', () => {
const steps = readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse
.steps
const verify = stepNamed(steps, 'Verify signatures end to end')
// The 7-Zip route is only trusted when it reproduces the relayed bytes;
// otherwise it falls through to the install route rather than failing.
expect(verify.run).toContain(
'Write-Host "7-Zip\'s NSIS output did not match the relayed digest; falling back to a silent install."'
)
expect(verify.run).toMatch(/\$installedUninstaller = \$null\r?\n\s*\}/)
// The comparison that is not tautological: a file NSIS wrote out, against
// the digest the sign hook recorded.
expect(verify.run).toContain('$shippedDigest -ne $expectedDigest')
expect(verify.run).toContain('the uninstaller the installer ships is not the relayed one')
// An installer that prompts must not hang to the 360-minute job cap, and
// the app it launches must not outlive the step holding install-dir handles.
expect(verify.run).toContain('-PassThru')
expect(verify.run).toContain('$installerProcess.WaitForExit(300000)')
expect(verify.run).toContain('the silent install did not exit within 5 minutes')
expect(verify.run).toMatch(/for \(\$attempt = 0; \$attempt -lt 20; \$attempt\+\+\)/)
expect(verify.run).toContain("Get-Process -Name 'orca-terminal-daemon'")
})
// resources\elevate.exe is downgraded to advisory because app-builder-lib's
// CopyElevateHelper clobbers it on every nsis pack — a pre-existing defect
// that predates the uninstaller relay and is being tracked separately. The
// escape hatch it needed is the kind that quietly grows until the gate
// asserts nothing, so pin it to exactly that one file.
it('confines the advisory escape hatch to elevate.exe', () => {
const steps = readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse
.steps
const verify = stepNamed(steps, 'Verify signatures end to end')
const advisoryCalls = verify.run
.split('\n')
.filter((line) => line.includes('-Advisory') && line.includes('Test-Signature'))
expect(advisoryCalls).toHaveLength(1)
expect(advisoryCalls[0]).toContain('installed: $relative')
expect(verify.run).toContain("if ($relative -eq 'resources\\elevate.exe')")
// Both uninstaller verdicts stay fatal — the whole point of the gate.
for (const call of ['relayed: orca-uninstaller.exe', 'shipped: Uninstall Orca.exe']) {
const line = verify.run
.split('\n')
.find((it) => it.includes(`Test-Signature`) && it.includes(call))
expect(line, call).toBeDefined()
expect(line, call).not.toContain('-Advisory')
}
// An advisory must still reach the evidence artifact, or downgrading it
// becomes indistinguishable from deleting the check.
expect(verify.run).toContain('ADVISORY (known pre-existing')
expect(verify.run).toContain('$script:advisories.Add($problem)')
})
it('wires the electron-builder sign hook that the relay depends on', () => {
const require = createRequire(import.meta.url)
const configPath = resolve(projectDir, 'config/electron-builder.config.cjs')
delete require.cache[require.resolve(configPath)]
const config = require(configPath)
expect(typeof config.win.signtoolOptions.sign).toBe('function')
delete require.cache[require.resolve(configPath)]
})
})
config/scripts/windows-uninstaller-signing.cjs
+111
View File
@@ -0,0 +1,111 @@
// Why this exists: the NSIS uninstaller is the one Orca binary SignPath never
// saw. app-builder-lib builds it in a separate makensis pass, hands it to the
// packager's sign hook, embeds it in the installer, then deletes it
// (NsisTarget.computeScriptAndSignUninstaller → packager.signIf(uninstallerPath),
// then `unlink(defines.UNINSTALLER_OUT_FILE)`). That hook is the only moment the
// file exists on disk, so it is the only place a post-hoc signer can reach it.
//
// Orca does not sign during electron-builder — SignPath signs afterwards, behind
// a human approval — so instead of signing, this hook relays: build 1 exports the
// unsigned uninstaller so CI can put it in the existing inner-binaries SignPath
// request, and the rebuild-from-signed-tree pass swaps the signed bytes back in
// before makensis embeds them.
//
// Trap for whoever adds a real certificate to the Windows build: a custom sign
// hook *replaces* signtool rather than running alongside it — windowsSignToolManager
// does `const executor = customSign || (config => this.doSign(config))`. Inert
// today (no CSC_LINK/WIN_CSC_LINK anywhere in the Windows workflows), but setting
// one would silently sign nothing until this hook learns to delegate.
//
// Trap for whoever adds a second NSIS target or arch: app-builder-lib names the
// intermediate uninstaller per target *and* arch, while the relay is a single
// pair of env vars. Two targets would race — last write wins on export, every
// installer would embed the same uninstaller, and the receipt could not tell.
// Release is x64-only `--win` with `win.target` unset (so `["nsis"]`) today.
const { createHash } = require('node:crypto')
const { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } = require('node:fs')
const { basename, dirname } = require('node:path')
// app-builder-lib names the intermediate uninstaller `<installer basename>__uninstaller.exe`.
const UNINSTALLER_BASENAME_SUFFIX = '__uninstaller.exe'
// Why a receipt: NSIS embeds the uninstaller in its own compressed data section,
// not in the app 7z payload the evidence gate extracts, so the shipped installer
// cannot be inspected for it with the bundled 7za. The receipt records the digest
// of the exact bytes handed to makensis, which the gate compares against the
// SignPath-returned file — proving what was embedded without extracting it.
const EMBEDDED_RECEIPT_SUFFIX = '.embedded-sha256'
const isNsisUninstallerArtifact = (filePath) =>
typeof filePath === 'string' && basename(filePath).endsWith(UNINSTALLER_BASENAME_SUFFIX)
/**
* Pure relay. Returns a short verdict string for logging and tests.
* Never throws: a relay failure must ship today's installer, not break the build.
*/
function relayNsisUninstaller({
filePath,
exportPath,
signedPath,
fs = { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync }
}) {
if (!isNsisUninstallerArtifact(filePath)) {
return 'not-uninstaller'
}
try {
// Import wins over export: the rebuild pass must embed the signed bytes even
// though it also regenerates an unsigned uninstaller of its own.
if (signedPath) {
if (!fs.existsSync(signedPath)) {
return 'signed-missing'
}
fs.copyFileSync(signedPath, filePath)
const digest = createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
fs.writeFileSync(`${signedPath}${EMBEDDED_RECEIPT_SUFFIX}`, digest)
return 'imported'
}
if (exportPath) {
fs.mkdirSync(dirname(exportPath), { recursive: true })
fs.copyFileSync(filePath, exportPath)
return 'exported'
}
return 'idle'
} catch (error) {
return `failed: ${error.message}`
}
}
const VERDICT_MESSAGES = {
imported: (paths) => `embedded the SignPath-signed uninstaller from ${paths.signedPath}`,
exported: (paths) => `exported the unsigned uninstaller to ${paths.exportPath}`,
'signed-missing': (paths) =>
`no signed uninstaller at ${paths.signedPath}; embedding the unsigned one (fail-open)`
}
/**
* electron-builder `win.signtoolOptions.sign` hook. Called for every Windows
* executable, twice per file (once per signing hash), so it must be cheap for
* non-uninstaller paths and idempotent for the uninstaller.
*/
function signWindowsUninstallerViaSignPath(configuration) {
const paths = {
filePath: configuration?.path,
exportPath: process.env.ORCA_WIN_UNINSTALLER_EXPORT_PATH || undefined,
signedPath: process.env.ORCA_WIN_UNINSTALLER_SIGNED_PATH || undefined
}
const verdict = relayNsisUninstaller(paths)
const message = VERDICT_MESSAGES[verdict]
if (message) {
console.log(`[win-uninstaller-signing] ${message(paths)}`)
} else if (verdict.startsWith('failed')) {
console.warn(`[win-uninstaller-signing] ${verdict}; embedding the unsigned uninstaller.`)
}
}
module.exports = {
EMBEDDED_RECEIPT_SUFFIX,
UNINSTALLER_BASENAME_SUFFIX,
isNsisUninstallerArtifact,
relayNsisUninstaller,
signWindowsUninstallerViaSignPath
}
config/scripts/windows-uninstaller-signing.test.mjs
+235
View File
@@ -0,0 +1,235 @@
import { createHash } from 'node:crypto'
import { existsSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
import { tmpdir } from 'node:os'
import { createRequire } from 'node:module'
import { join } from 'node:path'
import { describe, expect, it } from 'vitest'
const require = createRequire(import.meta.url)
const {
EMBEDDED_RECEIPT_SUFFIX,
isNsisUninstallerArtifact,
relayNsisUninstaller,
signWindowsUninstallerViaSignPath
} = require('./windows-uninstaller-signing.cjs')
const makeDir = () => mkdtempSync(join(tmpdir(), 'orca-uninstaller-signing-'))
describe('isNsisUninstallerArtifact', () => {
// The name app-builder-lib's NsisTarget.computeScriptAndSignUninstaller gives
// the intermediate uninstaller; the hook keys off nothing else.
it('matches only electron-builder intermediate uninstallers', () => {
expect(isNsisUninstallerArtifact('C:\\dist\\orca-windows-setup.__uninstaller.exe')).toBe(true)
expect(isNsisUninstallerArtifact('/dist/orca-windows-setup.__uninstaller.exe')).toBe(true)
expect(isNsisUninstallerArtifact('C:\\dist\\win-unpacked\\Orca.exe')).toBe(false)
expect(isNsisUninstallerArtifact('C:\\dist\\orca-windows-setup.exe')).toBe(false)
expect(isNsisUninstallerArtifact(undefined)).toBe(false)
})
})
describe('relayNsisUninstaller', () => {
const writeUninstaller = (dir, contents) => {
const filePath = join(dir, 'orca-windows-setup.__uninstaller.exe')
writeFileSync(filePath, contents)
return filePath
}
it('ignores every file that is not the uninstaller', () => {
const dir = makeDir()
const filePath = join(dir, 'Orca.exe')
writeFileSync(filePath, 'app')
expect(relayNsisUninstaller({ filePath, exportPath: join(dir, 'out', 'x.exe') })).toBe(
'not-uninstaller'
)
})
it('exports the unsigned uninstaller, creating the destination directory', () => {
const dir = makeDir()
const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
const exportPath = join(dir, 'uninstaller-signing', 'unsigned', 'orca-uninstaller.exe')
expect(relayNsisUninstaller({ filePath, exportPath })).toBe('exported')
expect(readFileSync(exportPath, 'utf8')).toBe('unsigned-uninstaller')
})
it('overwrites the freshly built uninstaller with the signed bytes', () => {
const dir = makeDir()
const filePath = writeUninstaller(dir, 'rebuild-unsigned')
const signedPath = join(dir, 'signed', 'orca-uninstaller.exe')
mkdirSync(join(dir, 'signed'))
writeFileSync(signedPath, 'signpath-signed')
expect(relayNsisUninstaller({ filePath, signedPath })).toBe('imported')
expect(readFileSync(filePath, 'utf8')).toBe('signpath-signed')
})
// The receipt is the evidence gate's only handle on the embedded uninstaller:
// NSIS hides it in a compressed section the bundled 7za cannot read.
it('records the digest of the bytes it handed makensis', () => {
const dir = makeDir()
const filePath = writeUninstaller(dir, 'rebuild-unsigned')
const signedPath = join(dir, 'signed', 'orca-uninstaller.exe')
mkdirSync(join(dir, 'signed'))
writeFileSync(signedPath, 'signpath-signed')
relayNsisUninstaller({ filePath, signedPath })
const expected = createHash('sha256').update('signpath-signed').digest('hex')
expect(readFileSync(`${signedPath}${EMBEDDED_RECEIPT_SUFFIX}`, 'utf8')).toBe(expected)
})
it('leaves no receipt when the signed uninstaller never came back', () => {
const dir = makeDir()
const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
const signedPath = join(dir, 'absent', 'orca-uninstaller.exe')
relayNsisUninstaller({ filePath, signedPath })
expect(existsSync(`${signedPath}${EMBEDDED_RECEIPT_SUFFIX}`)).toBe(false)
})
// Import wins so the rebuild pass embeds the signed bytes even though it also
// regenerates an unsigned uninstaller of its own.
it('prefers importing over exporting when both are configured', () => {
const dir = makeDir()
const filePath = writeUninstaller(dir, 'rebuild-unsigned')
const signedPath = join(dir, 'signed', 'orca-uninstaller.exe')
mkdirSync(join(dir, 'signed'))
writeFileSync(signedPath, 'signpath-signed')
expect(
relayNsisUninstaller({ filePath, signedPath, exportPath: join(dir, 'out', 'x.exe') })
).toBe('imported')
expect(readFileSync(filePath, 'utf8')).toBe('signpath-signed')
})
// Fail-open: a missing or unwritable relay must leave the build with today's
// unsigned uninstaller, never throw.
it('leaves the unsigned uninstaller in place when no signed copy came back', () => {
const dir = makeDir()
const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
expect(
relayNsisUninstaller({ filePath, signedPath: join(dir, 'absent', 'orca-uninstaller.exe') })
).toBe('signed-missing')
expect(readFileSync(filePath, 'utf8')).toBe('unsigned-uninstaller')
})
it('swallows filesystem errors instead of failing the build', () => {
const dir = makeDir()
const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
const fs = {
existsSync: () => true,
mkdirSync: () => {},
copyFileSync: () => {
throw new Error('EACCES')
}
}
expect(relayNsisUninstaller({ filePath, exportPath: join(dir, 'x.exe'), fs })).toBe(
'failed: EACCES'
)
})
it('does nothing when neither relay path is configured (local builds)', () => {
const dir = makeDir()
const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
expect(relayNsisUninstaller({ filePath })).toBe('idle')
expect(readFileSync(filePath, 'utf8')).toBe('unsigned-uninstaller')
})
})
// Why a suite of its own: this is the function electron-builder actually calls,
// and it runs inside `Build Windows release artifacts`, which has no
// continue-on-error. If it throws, the release job dies before a single
// SignPath request is made. Nothing else in the chain guards that.
describe('signWindowsUninstallerViaSignPath', () => {
const RELAY_VARS = ['ORCA_WIN_UNINSTALLER_EXPORT_PATH', 'ORCA_WIN_UNINSTALLER_SIGNED_PATH']
const withEnv = (env, run) => {
const saved = Object.fromEntries(RELAY_VARS.map((key) => [key, process.env[key]]))
const apply = (values) => {
for (const key of RELAY_VARS) {
if (values[key] === undefined) {
delete process.env[key]
} else {
process.env[key] = values[key]
}
}
}
apply({ ...Object.fromEntries(RELAY_VARS.map((key) => [key, undefined])), ...env })
try {
return run()
} finally {
apply(saved)
}
}
const writeBuiltUninstaller = (dir) => {
const filePath = join(dir, 'orca-windows-setup.__uninstaller.exe')
writeFileSync(filePath, 'built-by-makensis')
return filePath
}
it.each([
['a missing configuration', undefined],
['a configuration with no path', {}],
['a non-uninstaller path', { path: 'C:\\dist\\win-unpacked\\Orca.exe' }]
])('never throws on %s', (_label, configuration) => {
withEnv({ ORCA_WIN_UNINSTALLER_EXPORT_PATH: join(makeDir(), 'out', 'x.exe') }, () => {
expect(() => signWindowsUninstallerViaSignPath(configuration)).not.toThrow()
})
})
// electron-builder calls the hook once per signing hash (sha1 then sha256),
// so both legs have to survive running twice over the same file.
it('is idempotent across the sha1 and sha256 invocations on both legs', () => {
const dir = makeDir()
const filePath = writeBuiltUninstaller(dir)
const exportPath = join(dir, 'relay', 'unsigned', 'orca-uninstaller.exe')
withEnv({ ORCA_WIN_UNINSTALLER_EXPORT_PATH: exportPath }, () => {
signWindowsUninstallerViaSignPath({ path: filePath })
signWindowsUninstallerViaSignPath({ path: filePath })
})
expect(readFileSync(exportPath, 'utf8')).toBe('built-by-makensis')
const signedPath = join(dir, 'relay', 'signed', 'orca-uninstaller.exe')
mkdirSync(join(dir, 'relay', 'signed'), { recursive: true })
writeFileSync(signedPath, 'signpath-signed')
withEnv({ ORCA_WIN_UNINSTALLER_SIGNED_PATH: signedPath }, () => {
signWindowsUninstallerViaSignPath({ path: filePath })
signWindowsUninstallerViaSignPath({ path: filePath })
})
expect(readFileSync(filePath, 'utf8')).toBe('signpath-signed')
expect(readFileSync(`${signedPath}${EMBEDDED_RECEIPT_SUFFIX}`, 'utf8')).toBe(
createHash('sha256').update('signpath-signed').digest('hex')
)
})
// An unwritable destination is the realistic filesystem failure, and it must
// cost the uninstaller signature rather than the release job.
it('never throws when the export destination cannot be created', () => {
const dir = makeDir()
const filePath = writeBuiltUninstaller(dir)
const blocker = join(dir, 'blocker')
writeFileSync(blocker, 'not a directory')
withEnv({ ORCA_WIN_UNINSTALLER_EXPORT_PATH: join(blocker, 'sub', 'x.exe') }, () => {
expect(() => signWindowsUninstallerViaSignPath({ path: filePath })).not.toThrow()
})
expect(readFileSync(filePath, 'utf8')).toBe('built-by-makensis')
})
it('does nothing when neither relay variable is set (local Windows builds)', () => {
const dir = makeDir()
const filePath = writeBuiltUninstaller(dir)
withEnv({}, () => {
expect(() => signWindowsUninstallerViaSignPath({ path: filePath })).not.toThrow()
})
expect(readFileSync(filePath, 'utf8')).toBe('built-by-makensis')
})
})
docs/reference/windows-cmd-shim-resolution.md
+77
View File
@@ -0,0 +1,77 @@
# Resolving Windows `.cmd` shims past cmd.exe
Node refuses to spawn a `.cmd`/`.bat` target without a shell (the
CVE-2024-27980 mitigation), so `resolveSpawn` has to make `cmd.exe` the program
and hand it `/d /v:off /s /c "<caret-escaped argv>"`. For an agent CLI that
means a long `cmd.exe /c` line whose caret-escaped payload is natural-language
prompt text — which Microsoft Defender for Endpoint's command-line model scores
as obfuscation. `codex.cmd` appeared in the spawn cluster of an MDE incident
against Orca for exactly this reason.
`src/shared/child-process/windows-cmd-shim-resolution.ts` sidesteps it. npm's
`cmd-shim` and pnpm's `@zkochan/cmd-shim` generate files whose entire body is
"find a Node interpreter and run this script". Reading one lets `resolveSpawn`
spawn `node.exe <script> <args…>` directly: no cmd.exe in the tree, and no
caret escaping at all.
## What resolution changes
Only `runProcess` / `spawnProcess` callers. Two things people expect it to
cover, and it does not:
- **The interactive terminal.** `src/main/daemon/pty-subprocess/native-pty-spawn.ts`
calls `pty.spawn` directly, so typing `codex` in an Orca terminal is
completely unaffected.
- **Orca's own hook wrappers** (`codex-hook.cmd` and friends). These are batch
files Orca writes, matching none of the generator shapes, so they keep the
cmd.exe path. They are addressable — we generate them — but not by this
module.
## Adding a shape
Four shapes are recognised, each transcribed verbatim from a real install into
`src/shared/child-process/__fixtures__/windows-cmd-shim-bodies.ts`. If you add a
fifth, add its real body there too. A shape guessed from documentation is not
evidence.
The rule for the parser is all-or-nothing: the whole canonicalised body must
match end to end, and anything unrecognised returns null and keeps the cmd.exe
path. **A mis-resolution silently runs the wrong program or drops arguments,
which is far worse than an EDR alert** — when in doubt, refuse.
Resolution also refuses a captured path that is absolute, drive-relative
(`D:evil.js` — `win32.isAbsolute` says false, but `win32.resolve` leaves the
shim directory), or contains `% ^ & | < > " :` or a line break; a script or
target that is not on disk; an interpreter-less target that is not `.exe`/`.com`;
and a program path that is not absolute.
Refusing every `:` cannot cause a false refusal. Windows reserves the character
within a path segment, so a relative path cannot contain one — the only
spellings that can are drive-qualified, an alternate data stream (`a.js:zone`),
or a `\\?\` device path, and the last is already refused as absolute.
## Kill switch
Set **`ORCA_DISABLE_CMD_SHIM_RESOLUTION`** to any non-empty value in the
environment a child is spawned with, and every `.cmd` goes back through
`cmd.exe /c` unchanged. It is read from the spawn's own environment, so
exporting it before launching Orca disables resolution process-wide.
Use it to confirm a suspected mis-resolution: run the failing operation with and
without it. Identical behaviour means resolution is not the cause. If it is,
report the shim's body — the parser is only allowed to recognise shapes we have
seen for real.
## Behaviour that changes, deliberately
A resolved shim is not merely a quieter spelling of the cmd.exe path. Two limits
of `cmd.exe` disappear with it:
- An argument containing `\r`/`\n` was rejected outright, because cmd ends its
command at a raw line break whatever the quote state. Multi-line agent prompts
now work.
- A command line over 8191 characters returned `The command line is too long.`
Long prompts now work.
Both are improvements, but they are behaviour changes: an unresolved shim still
hits both limits, so a caller must not assume every `.cmd` accepts them.
docs/reference/windows-daemon-host-relocation.md
+118
View File
@@ -0,0 +1,118 @@
# Windows daemon-host relocation
On Windows the terminal daemon does not run from the install directory. Before it forks the
daemon, Orca materializes a trimmed copy of its own runtime under
`%LOCALAPPDATA%\Orca\daemon-host\<app version>\` and forks the daemon from there
(`src/main/daemon/daemon-host-relocation.ts`). This is what keeps live terminals alive across an
auto-update and across a crash of the main process.
Read this before changing the copy plan, the host exe name, the LOCALAPPDATA layout, or
`config/nsis/orca-installer-hooks.nsh`.
## What the relocation actually escapes
The killer is **electron-builder's process sweep, matched on image path** — not file deletion.
Windows will not delete a running image, so `RMDir /r "$INSTDIR"` cannot end the daemon on its own.
In app-builder-lib's `allowOnlyOneInstallerInstance.nsh`, `FIND_PROCESS` / `KILL_PROCESS` have two
branches:
| Branch | Condition | Selector |
| -------- | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Primary | `powershell.exe` runs, `Get-CimInstance` resolves, and `Get-ExecutionPolicy -Scope Process` is not `Restricted` | `Win32_Process` where `$_.Path.StartsWith('$INSTDIR', 'CurrentCultureIgnoreCase')` — **path-scoped** |
| Fallback | otherwise | per-user: `taskkill /F /IM "<AppName>.exe" /FI "PID ne $pid" /FI "USERNAME eq %USERNAME%"`; per-machine: the same without the username filter — **image-name-scoped** |
The probe reads the **process** scope, not the effective policy, and Group Policy writes
`MachinePolicy`/`UserPolicy` — so a GPO-managed host whose effective policy is `Restricted` still
exits 0 and takes the primary branch. The fallback is reached only when `powershell.exe` is absent,
`Get-CimInstance` does not resolve, PowerShell is blocked outright (WDAC/AppLocker, Server Core), or
an inherited `PSExecutionPolicyPreference=Restricted` is in the environment.
So on essentially every machine the sweep is path-scoped, and a daemon whose image lives under
`%LOCALAPPDATA%` is out of range regardless of what the file is called. **Survival is a property of
the path.** The name only matters on the fallback branch.
## Why the exe is copied verbatim (and not renamed)
The host exe keeps the app exe's own file name (`daemonHostExeName()` returns
`basename(process.execPath)`), so the relocated image is a byte-for-byte copy of the app binary
under its original name.
An earlier revision copied it as `orca-terminal-daemon.exe` specifically so the fallback
`taskkill /IM Orca.exe` could not match. That bought survival on the rare no-PowerShell host and
cost a textbook defence-evasion signature: _a process copies its own image into a user-writable
directory under a different name so a kill-by-image-name cannot match it, then runs detached and
survives the installer._ Microsoft Defender for Endpoint flagged it as MITRE **T1036
(Masquerading)**, and — because it is the process every other flagged action is attributed to — it
acted as a reputation multiplier on unrelated findings. No VS Code fork does this.
Trading the fallback branch for the name is the right trade:
- On the primary branch nothing changes: the daemon still survives the update.
- On the fallback branch the daemon is killed with the app and terminals **cold-restore** on
relaunch. That is the documented pre-relocation behaviour, a first-class outcome the update
harness already asserts (`--expect cold-restore`), not a failure.
- Relocation is fail-open end to end anyway: any materialization failure returns `null` and the
caller forks the install-dir host.
One new failure mode comes with it, on the fallback branch only. The daemon now matches
`FIND_PROCESS` under the app's image name, so it enters electron-builder's retry loop
(`allowOnlyOneInstallerInstance.nsh:136-141`). If the `taskkill` there fails to end it — an elevated
or otherwise unkillable host — the loop reaches `MessageBox ... /SD IDCANCEL` and `Quit`s, aborting a
silent update rather than completing it. Under the old distinct name the daemon was invisible to
that loop. Low probability (fallback branch _and_ an unkillable daemon), but it is a real new path.
What this does **not** buy. Two things bound the win honestly:
- The strongest T1036 indicator is a PE-resource-vs-disk-name mismatch, and it was **never firing**:
the shipped binary's `OriginalFilename` is empty (only `InternalName = Orca` is set), so there was
no embedded name for the old disk name to contradict.
- The remaining behaviour — a signed app copying its own ~225 MB image into user-writable
`%LOCALAPPDATA%` and running it detached under `ELECTRON_RUN_AS_NODE=1` — is still execution from
a non-standard user-writable location, which maps to **T1036.005** and is a standard heuristic on
its own.
So this removes a real but partial signal. Expect the score to drop; do not expect the process to
stop being scored.
## Options that were rejected
| Option | Why not |
| ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Materialize the tree from the NSIS installer | The daemon host is ~246 MB. Writing it at install time doubles install footprint and lengthens the window in which the app is down during a silent update. Worse, on a per-machine install (`INSTALL_MODE_PER_ALL_USERS`) the installer runs as the installing admin, so `$LOCALAPPDATA` is the wrong user's — every other user still needs the runtime path, which means the runtime self-copy stays in the product and the signal is only made rarer. |
| Ship a second signed `orca-terminal-daemon.exe` in the installer | `Orca.exe` is 235,555,328 bytes (224.6 MiB). electron-builder's NSIS uses solid LZMA with a 64 MB dictionary, so a second copy 224 MB downstream does not dedupe; the compressed installer grows by roughly a whole compressed Electron binary, paid by every user on every update download. It also does not remove the runtime copy — the helper still has to reach `%LOCALAPPDATA%` to escape the sweep — so it buys the same signal reduction as the verbatim copy at a large download cost. |
| Override `customCheckAppRunning` to force a path-scoped kill on both branches | Cheap to write (~6 lines: `!include "getProcessInfo.nsh"`, `Var pid`, and a macro that pins `IsPowerShellAvailable`, reusing upstream's dialog, retry loop and elevated handling) — but wrong at any size. Forcing the PowerShell branch on a host where PowerShell is genuinely absent makes `FIND_PROCESS` and `KILL_PROCESS` silently no-op, so the installer proceeds with the **real app** still running and its files in use. That is a worse outcome than the cold restore it would prevent, so this is not worth doing ever, not merely not now. |
| Hardlink instead of copy | Avoids the 246 MB entirely and is not a "copy" at all, but is NTFS-and-same-volume-only and introduces fresh failure modes (link counts, AV interception, cross-volume installs). Worth revisiting deliberately, not as part of a signal fix. |
## Invariants to preserve
- The host exe name is **derived from `process.execPath`**, never a literal. A future
`executableName` or dev-channel rename must follow automatically; pinning a name of our own is
how the mismatch creeps back.
- The daemon is identified by **PID and command line**, never by image name — in the product
(`daemon-pid-file-parse`, `daemon-process-inspection`) and in the harness
(`tests/tools/win-update-e2e/daemon-processes.mjs`). Nothing may start matching on the exe name.
- `config/nsis/orca-installer-hooks.nsh` kills the daemon by image name. That now also matches the
app's own exe, which is correct on a genuine uninstall — the product is being removed — but its
`${isUpdated}` guard must stay: electron-builder runs the uninstaller during every update's
`uninstallOldVersion`, and killing the daemon there defeats the whole feature. The legacy
`orca-terminal-daemon.exe` name stays in the macro to reap hosts left by older builds.
- `LOCAL_HOST_ROOT_NAME` in `daemon-host-relocation.ts` and the path in the uninstall macro are the
same directory. Change both together.
## Verifying a change
Unit coverage lives in `src/main/daemon/daemon-host-relocation.test.ts` (copy plan, verbatim
naming, marker/atomic publish, fail-open, prune veto). Nothing in unit tests can prove survival, so
any change to this file or to the NSIS macro needs the packaged harnesses:
- `.github/workflows/win-update-survival-e2e.yml` — builds an installer from the branch and updates
it over itself with `--expect survival`. The primary proof.
- `.github/workflows/win-crash-survival-e2e.yml` — proves the daemon survives a main-process crash.
- `.github/workflows/windows-terminal-restart-e2e.yml` — terminal restart behaviour.
- `.github/workflows/win-update-e2e.yml` — release-tag-to-release-tag update, both `survival` and
`cold-restore` profiles.
All four are `workflow_dispatch`-only (the two update workflows also carry a push trigger pinned to
one historical feature branch), so they must be dispatched by hand against this branch before
merging a change here — which requires the workflow files to already exist on `main`.
docs/reference/windows-edr-posture.md
+74 -48
View File
@@ -13,7 +13,7 @@ two escalated to multi-stage incidents carrying ATT&CK tactic mappings
The framing this document keeps throughout, because both halves matter:
> **Defender is not malfunctioning. It is describing the code accurately.** Orca
> really does copy its own signed image under a different name, really does read
> really does copy its own signed image under a different name, really did read
> every process's memory on a timer, really does run base64-encoded PowerShell
> with the execution policy bypassed, and really does take screenshots and
> synthesise input from a runtime-compiled assembly. Each of those is a
@@ -50,33 +50,49 @@ and `orca-terminal-daemon.exe` report `Valid CN=SignPath Foundation`.
## The behaviours, and why each one exists
### The daemon runs from a renamed copy of our own image
### The daemon runs from a copy of our own image
`src/main/daemon/daemon-host-relocation.ts` copies the Electron runtime into
`%LOCALAPPDATA%\Orca\daemon-host\<version>\` and renames `Orca.exe` to
`orca-terminal-daemon.exe`. The comment on `DAEMON_HOST_EXE_NAME` states the
reason without varnish: _"so the NSIS updater's `taskkill /IM Orca.exe` can't
match it."_
`%LOCALAPPDATA%\Orca\daemon-host\<version>\` and forks the terminal daemon from
there.
It exists because the NSIS installer deletes the old install directory and force-
kills every process imaged under it. Without relocation, an auto-update kills the
terminal daemon and every live terminal with it. The copy is a run-as-node
`Orca.exe` rather than `node.exe` so there is no console flash and asar still
resolves; `config/nsis/daemon-host-uninstall.nsh` reaps it on a real uninstall
resolves; `config/nsis/orca-installer-hooks.nsh` reaps it on a real uninstall
(guarded by `${isUpdated}` so an update's `uninstallOldVersion` never fires it).
**How an EDR reads it: MITRE T1036, masquerading.** A signed executable copied
out of the install directory into `%LOCALAPPDATA%` under a different name, which
then spawns shells, matches the textbook description closely enough that no
behavioural engine can be expected to score it low.
**At the time of these incidents the copy was also renamed** to
`orca-terminal-daemon.exe`, the image name every incident here reports, and
`DAEMON_HOST_EXE_NAME`'s comment stated the reason without varnish: _"so the NSIS
updater's `taskkill /IM Orca.exe` can't match it."_ The rename has since been
removed; the copy now keeps the app exe's own file name, because the updater's
kill sweep is path-scoped on every host that has PowerShell and the rename only
ever bought the no-PowerShell fallback. See
[`windows-daemon-host-relocation.md`](./windows-daemon-host-relocation.md).
**How an EDR reads it: MITRE T1036, masquerading** — and, for what remains,
**T1036.005**. A signed executable copied out of the install directory into
`%LOCALAPPDATA%` under a different name, which then spawns shells, matches the
textbook description closely enough that no behavioural engine can be expected to
score it low. Dropping the rename removes that literal indicator but not the
underlying shape: execution from a non-standard user-writable location is scored
on its own. Note also that the strongest form of the T1036 signal was never
present here — the shipped binary's `OriginalFilename` is empty, so there was no
embedded name for the old disk name to contradict.
### Every process gets a handle, on a timer
`src/main/windows/windows-process-table.ts` takes a Toolhelp32 snapshot under
**one** flag set, `CommandLine | CreationTime`, shared by every caller. pid, ppid
and name come out of the snapshot itself and open nothing. `CommandLine` is what
opens a handle: the addon calls `GetProcessCommandLine` per process, which opens
`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and walks the PEB with three
`src/main/windows/windows-process-table.ts` takes a Toolhelp32 snapshot under one
of **two** flag sets: identity (`None | CreationTime`) for callers that read only
pid, ppid and name, and detailed (`+ CommandLine`) for callers that match on a
command line. pid, ppid and name come out of the snapshot itself and open
nothing, so an identity scan opens nothing at all. `CommandLine` is what opens a
handle: the addon calls `GetProcessCommandLine` per process, which opens
`PROCESS_QUERY_LIMITED_INFORMATION` — the same right Task Manager takes — and
asks the kernel for the string. Upstream it opened
`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and walked the PEB with three
`ReadProcessMemory` calls (`src/process_commandline.cc:32,41-47` in the vendored
`@vscode/windows-process-tree` 0.8.0 source that `config/patches/` patches).
@@ -84,8 +100,9 @@ opens a handle: the addon calls `GetProcessCommandLine` per process, which opens
`GetProcessMemoryUsage` open a **second** `PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ` handle per process for a `GetProcessMemoryInfo` call whose
result no caller read (`src/process.cc:47-63`). Dropping it halves the handles
opened per snapshot. It does not remove the remote memory read, because the
command line still performs one.
opened per snapshot. On its own it removed no memory read — both handles carried
`PROCESS_VM_READ` at the time — so it composes with the patch below rather than
substituting for it.
It exists because seven independent readers used to fork `powershell.exe` for a
`Get-CimInstance Win32_Process` scan. That cost, measured: a PowerShell
@@ -98,41 +115,49 @@ panes multiplied it (#15036). The native snapshot answers the same question in
See
[`windows-process-enumeration.md`](./windows-process-enumeration.md).
Asking for fewer fields is cheaper, and the module now asks for the smallest set
that still answers every caller. There is **no** per-flag-set cache split: one
TTL-cached snapshot serves everyone, deliberately, because a split would restore
the per-pane fan-out the cache exists to remove — a 32-wide teardown has to
collapse into one scan. So the cheap identity-only read is not something any
caller can select; every read pays for `CommandLine`. An earlier revision of this
file described a two-cache design with 6.3 ms / 12.3 ms p50 figures at 492
processes. That design is not in the tree and those numbers describe no code
path here; the figures that do apply are the module's own, in
Asking for fewer fields is cheaper, and each caller now asks for the smallest set
that answers it. There are exactly **two** TTL-cached snapshots, one per flag
set, never one per caller: the fan-out the cache exists to remove is one scan per
_caller_, and each reader still serves every caller wanting its flag set, so a
32-wide teardown still collapses into one scan of each. Teardown identity and the
owner probe select the identity set and therefore open no handles; the per-pane
foreground tracker genuinely needs a command line and still pays for one. A third
cache would need a third flag set, not a third caller. Measured at 492 processes,
p50: identity 6.3 ms, detailed 12.3 ms — see
[`windows-process-enumeration.md`](./windows-process-enumeration.md).
**How an EDR reads it:** a cross-process handle plus a remote memory read against
**How an EDR read it:** a cross-process handle plus a remote memory read against
every process on the box, repeating on a cadence, is the read half of the
telemetry that credential dumping and process injection produce. MDE surfaced it
as "suspicious memory activity".
**That signal is still present.** An earlier revision of this file claimed the
command line "now comes from the kernel" through `NtQueryInformationProcess`'s
`ProcessCommandLineInformation` class, needing only
`PROCESS_QUERY_LIMITED_INFORMATION`, and that `ReadProcessMemory` was absent from
the compiled addon. None of that is true of the code we ship.
`process_commandline.cc` calls `NtQueryInformationProcess` with
`ProcessBasicInformation` only — to locate the PEB — and then issues three
`ReadProcessMemory` calls against a `PROCESS_VM_READ` handle to read the PEB, the
`RTL_USER_PROCESS_PARAMETERS`, and the command-line buffer. Nothing asserts an
import table, and no such assertion would pass.
**The memory read is gone.** A fourth hunk in
`config/patches/@vscode__windows-process-tree@0.8.0.patch` has
`GetProcessCommandLine` call `NtQueryInformationProcess` with
`ProcessCommandLineInformation` (class 60, Windows 8.1+; Electron's floor is
Windows 10), which returns a `UNICODE_STRING` the kernel builds and needs only
`PROCESS_QUERY_LIMITED_INFORMATION`. Measured on ~540 processes, per detailed
scan: `ReadProcessMemory` 1128 → **0**, desired access `0x0410` → `0x1000`, with
byte-identical command lines on every process both readers recovered. There is no
PEB fallback to reinstate it — a hooked `ntdll` answering
`STATUS_INVALID_INFO_CLASS` for one target would have flipped a process-wide,
one-way switch back to `PROCESS_VM_READ` on exactly the machines this exists for.
What this change did remove is the `Memory` flag's second handle and its
`GetProcessMemoryInfo` call, so the per-process handle count per snapshot halves.
What remains to declare to administrators is unchanged in kind: one
`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` handle and a PEB read against every
process on the box, at the shared snapshot's cadence. Moving to
`ProcessCommandLineInformation` (Windows 8.1+, `PROCESS_QUERY_LIMITED_INFORMATION`
only) would genuinely retire the remote read, but it is an addon patch nobody has
written; treat it as unclaimed work, not as shipped.
Because the property is the *absence* of an import, it is checkable on the
artifact rather than the source: `inspectWindowsProcessTreeAddon()` answers
`clean` / `unpatched` / `missing`, and the rebuild, `ensure-native-runtime.mjs`,
the relay build and `loadWindowsProcessTree()` all key on it. That check is load-
bearing because the published tarball ships a *loadable* prebuilt built from
unpatched source, so "it required cleanly" is not evidence.
What to declare to administrators is now one
`PROCESS_QUERY_LIMITED_INFORMATION` handle per process on a detailed snapshot and
no remote memory access at all; an identity snapshot opens nothing. What this
does not narrow is _which_ processes are asked — a detailed scan still queries
every pid, including `lsass.exe`. Restricting the command-line pass to Orca's own
subtree needs job-object membership as its source of truth (a ppid-derived
allowlist would miss the detached, reparented descendants of #9045 and #10475),
and remains unclaimed work.
### Encoded, policy-bypassing PowerShell
@@ -232,7 +257,8 @@ obfuscated-command-line detector is tuned on.
### The spawn tree itself
`Orca.exe` → `orca-terminal-daemon.exe` → a shell → an agent CLI is what a
`Orca.exe` → the relocated daemon host (`orca-terminal-daemon.exe` in the builds
these incidents cover, `Orca.exe` since) → a shell → an agent CLI is what a
terminal multiplexer for coding agents *is*. `reg.exe` appears from
`src/main/win32-utils.ts`,
`src/main/agent-hooks/managed-hook-owner-identity.ts` and
@@ -363,7 +389,7 @@ The checklist. On Windows, do not reach for:
| Forking `powershell.exe` to read system state | The native reader — [`windows-process-enumeration.md`](./windows-process-enumeration.md) is the standing rule for the process table |
| A process per operation in a loop | One long-lived helper with a request channel. A burst of short-lived interpreters under one parent is itself the signal |
| `Add-Type -TypeDefinition` at runtime | A precompiled, signed assembly, or a native helper |
| Copying our own image under a different name | An installer or updater that does not need the rename. Where the rename is load-bearing, document it as such |
| Copying our own image under a different name | Copy it verbatim — [`windows-daemon-host-relocation.md`](./windows-daemon-host-relocation.md) (done for the daemon host) |
| Deriving a script runner from a UI preference | [`windows-setup-shell.md`](./windows-setup-shell.md) — the script declares its own interpreter |
Two framing rules that outlast the table:
docs/reference/windows-process-enumeration.md
+295 -23
View File
@@ -16,38 +16,193 @@ table. It wraps a Toolhelp32 snapshot from `@vscode/windows-process-tree`.
```ts
import {
readWindowsProcessIdentityTable,
readWindowsProcessIdentityTableFresh,
readWindowsProcessTable,
readWindowsProcessTableFresh
} from '../windows/windows-process-table'
```
- `readWindowsProcessTable()` — shared TTL cache. Use for anything periodic.
- `readWindowsProcessTableFresh()` — a snapshot that starts after the call. Use
for teardown identity, where a cached row can predate the exit it is being
asked about.
Each pair is a shared TTL cache plus a `Fresh` variant that starts its scan
after the call. Use `Fresh` for teardown identity, where a cached row can
predate the exit it is being asked about, and the cached one for anything
periodic.
Both **reject** when the table cannot be read. Do not convert that into an empty
array. An empty table is a claim that nothing is running, and callers act on
that claim by declaring a tree dead or a shell childless. "Unavailable" has to
stay distinguishable from "empty" — collapsing the two is how a PTY tree
All four **reject** when the table cannot be read. Do not convert that into an
empty array. An empty table is a claim that nothing is running, and callers act
on that claim by declaring a tree dead or a shell childless. "Unavailable" has
to stay distinguishable from "empty" — collapsing the two is how a PTY tree
survived its own teardown (#9045).
Measured on Windows 11 with 1050 processes (p50 / p95):
## Two flag sets: ask for a command line only if you read one
Neither flag is a wider column on the same query. Each is a separate
per-process syscall sequence, and they are not equally expensive to the EDR
watching:
- `CommandLine` (`process_commandline.cc`) —
`OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION)`, then
`NtQueryInformationProcess(ProcessCommandLineInformation)` twice: once to size
the buffer, once to fill it. The kernel builds the string, so no address space
is opened or read. It used to walk the target's PEB with three chained
`ReadProcessMemory` calls; the patched addon no longer contains that primitive.
- `Memory` (`process.cc`) — retired. It took a **second** `OpenProcess`, and that
one carried `PROCESS_VM_READ`, which it acquired and never used.
Measured here (541 processes, 405 openable), per detailed scan, before → after
dropping `Memory`: `OpenProcess` 1082 → 541. That halving is all the `Memory`
drop bought on its own — both handles carried `PROCESS_VM_READ` at the time, so
it moved the PEB traffic not at all. Replacing the PEB walk with the kernel
query is what took `PROCESS_VM_READ` and `ReadProcessMemory` out of the addon
altogether; the two changes compose, and neither substitutes for the other.
So be precise about what these two flag sets buy now. A detailed scan is one
`OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION)` per process and no memory
access at all. What the split buys on top of that is the handle itself: an
identity scan opens nothing.
So the module exposes two snapshots, and the row types differ so a cheap caller
cannot read what its flag set did not pay for:
| reader | row type | flags | per-process handles |
| ------------------------------------------ | ---------------------------- | --------------------------- | ------------------- |
| `readWindowsProcessIdentityTable[Fresh]()` | `WindowsProcessIdentityRow` | `None \| CreationTime` | none |
| `readWindowsProcessTable[Fresh]()` | `WindowsProcessRow` | `+ CommandLine` | one `OpenProcess` |
`Memory` is requested by neither. Nothing reads a working set off this table —
`windows-process-resource-collector.ts` runs its own sweep because it needs
commit and CPU counters in the same pass, and the addon stores `WorkingSetSize`
into a `DWORD` so anything above 4 GB wraps anyway.
Measured on Windows 11 with 492 processes (p50 / p95):
| | p50 | p95 |
| -------------------------------- | ------- | ------- |
| pid + ppid + name | 15.9 ms | 17.5 ms |
| + memory + command line | 30.6 ms | 33.7 ms |
| identity (pid + ppid + name) | 6.3 ms | 7.0 ms |
| detailed (+ command line) | 12.3 ms | 13.4 ms |
| _retired_ (+ memory) | 13.1 ms | 14.1 ms |
| `Get-CimInstance` via PowerShell | 706 ms | 723 ms |
Those are the module's published figures. The flag set this module actually
requests is `CommandLine | CreationTime` — **not** `Memory`, which cost a second
`OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ)` plus
`GetProcessMemoryInfo` per process (`src/process.cc:47-63`) for a value nothing
read. Dropping it halves the handles a snapshot opens. The remaining set sits
between the two rows above and has not been measured separately; on a real
Windows host, `Get-Counter '\Process(Orca)\Handle Count'` sampled across a
snapshot cadence is the check.
There are exactly **two** caches, never one per caller. The fan-out this module
exists to prevent is one scan per _caller_, and each reader still serves every
caller wanting its flag set, so a 32-wide teardown still collapses into one scan
of each. A third cache would need a third flag set, not a third caller.
### Only one native read may be in flight, ever
This is the price of having two flag sets, and it is not optional.
The npm wrapper **coalesces rather than queues**. `getRawProcessList` pushes the
callback onto one list and calls the addon only when no request is in progress,
so a second concurrent caller's `flags` are **discarded** and it is handed the
first caller's rows. Measured against the real addon: issue identity first, both
callers get the same array, 0 of 541 rows carry a command line. A detailed read
that overlaps an identity read therefore returns a table with **every command
line empty**, and agent recognition reads that as "no agent" — silently, and
only under concurrency.
Nothing else in this module prevents that. Each snapshot cache single-flights
only within itself (`inFlight` is a closure per reader), and the wedge set
latches only *after* a read misses its 3 s deadline, so through the healthy
~12 ms of a scan neither excludes the other. Overlap is the normal state rather
than an edge case: other panes keep polling detailed at 750 ms while a teardown
takes identity snapshots, and `codex-structured-turn-processes.ts` issues fresh
detailed scans on turn stop.
`nativeReadGate` serializes every native read across both flag sets. It is also
what makes the relay's bare addon safe: `adaptAddon` has no queue at all, and
two simultaneous `CreateToolhelp32Snapshot` calls are the crash the vendor's
queue exists to prevent. Every link settles — a wedged read still rejects on its
deadline — so a waiter is never stranded; it re-checks the wedge and rejects.
Because only one native call is ever outstanding, the wedge gate and the 3 s
deadline stay **shared** and retention stays bounded at exactly one callback,
not one per reader. Read ids are module-global and monotonic, so a late callback
can only clear its own wedge.
`resetNativeReaderState` **chains** onto the gate rather than replacing it. A
replacement would let a waiter still holding the old chain run beside a read
queued on the new one; every link settles within the deadline, so chaining costs
a bounded wait and keeps the exclusion whole. That path is test-only, which is
exactly why it matters — it would otherwise hand a suite two concurrent calls
into its own mock, the condition these tests exist to detect.
### Testing this module: assert a positive property, on the right mock
Three defects have now shipped in this file's tests, all the same shape — a case
that passed for a reason other than the one it claimed to check:
1. A loader that built a **fresh mock per call**, so the coalescing it was meant
to reproduce could never happen.
2. An identity-side assertion of only `!('command' in row)`, which a correctly
flagged read and a coalesced one satisfy equally, so the test would go green
on the very regression it guards.
3. A concurrency assertion placed on the **coalescing** mock, whose own
`requestInProgress` latch means it can never report more than one call in
flight — so it held whether or not this module excluded anything, and passed
against a read gate that had genuinely lost exclusion.
The third arrived in the fix for the first two, which is the point: this is not a
mistake you make once.
So: assert what each flag set **did** get, not only what it lacks, and put those
assertions in the helper both orderings run through, or the reverse order keeps
the blind spot. The identity set is checked on `creationTimeMs` because that is
the field it exists to carry. Keep both that check and the flags-array check —
they catch **different** failures and neither is redundant. The flags array
catches a read served another flag set's rows (the coalescing bug); the
positional `creationTimeMs` check catches field shaping — identity dropping
`CreationTime` from its flags, or `toIdentityRow` failing to forward it — which
no flags assertion would notice.
And pick the mock to match the claim. The coalescing mock models the npm
wrapper's queue semantics and is the only place to assert those. Concurrency has
to be measured against the bare-addon mock, which has no queue and so makes
re-entry observable.
With no native binding there is only one scan to run and it is the 1.4 s
PowerShell one, so the identity view rides the detailed snapshot — projected
through `toIdentityRow`, so an identity row carries no command line on any host.
### Which callers need which
| caller | reads | flag set |
| --------------------------------------------- | ------------------ | -------- |
| `windows-agent-foreground-process.ts` | `command` (agent recognition) | detailed |
| `local-workspace-platform-port-scanner.ts` | `command` (port attribution) | detailed |
| `codex-structured-turn-processes.ts` | `command` (turn-process identity) | detailed |
| `structured-tui-process-identity.ts` | `command` (child match) | detailed |
| `windows-pty-root-identity.ts` | `pid` / `ppid` only | identity |
| `agent-session-process-identity-probe.ts` | `creationTimeMs` only | identity |
| `relay/windows-port-scan.ts` | `name` (port owner label) | detailed |
`windows-port-scan.ts` is the one mismatch in the table: it reads only `pid` and
`name`, which the identity set answers, but it calls the detailed reader. On a
host with a live pane that costs nothing extra — the detailed snapshot is
already cached — and on a headless relay it pays for a command line no caller
reads. Left as-is deliberately, because moving it to identity would trade that
for a second scan whenever a pane is polling; revisit if the relay ever scans
ports without one.
The per-pane foreground tracker is the hot one (750 ms / 2 s cadence) and it
genuinely needs the command line, so the repeating per-process `OpenProcess` is
not something the split removes. What the split removes is that handle from
teardown identity and from the owner probe, which now open nothing.
### `creationTimeMs` does not exist on any shipped build
Nothing in the repo supplies a `CreationTime` flag. The package enum is
`None`/`Memory`/`CommandLine`, `process_worker.cc` emits no `creationTimeMs`,
the vendored patch adds none, and `adaptAddon`'s `PROCESS_DATA_FLAG` lacks the
bit. So `creationTimeMs` is always `undefined` in production and
`isWindowsProcessStartTimeAvailable()` is always `false` — a latent product gap
that predates the split and needs its own owner.
Two consequences. `IDENTITY_PROJECTION.flags` evaluates to `0` today, so the
identity reader really does open zero handles. And
`agent-session-process-identity-probe.ts` early-returns on
`isWindowsProcessStartTimeAvailable()` rather than scanning the whole table to
produce `null`. Do not build anything on Windows start time working.
Those CIM numbers are from a 1050-process host. The scan scales with process
count: on a 1486-process Windows SSH host it measured **1.36 s** and produced
@@ -189,7 +344,7 @@ on any other OS keeps using the scan.
## Why the package is patched
`config/patches/@vscode__windows-process-tree@0.8.0.patch` carries three hunks.
`config/patches/@vscode__windows-process-tree@0.8.0.patch` carries four hunks.
1. **Spectre mitigation.** The upstream `binding.gyp` requires Spectre-mitigated
libraries, which Orca's Windows build agents do not install. `node-pty` is
@@ -204,10 +359,122 @@ on any other OS keeps using the scan.
realpath, then loads the relative path from the `node_modules` symlink, so
`node_addon_api.gyp` resolves outside the repo and hourly Windows builds
die at configure. `node-pty` is patched the same way for the same reason.
4. **No PEB reads, no `PROCESS_VM_READ`.** See below.
The typings claim `commandLine` is truncated at 512 characters. Measured, it is
not: the longest observed on a real host was 26,059.
### The command line comes from the kernel, not the target's memory
Upstream, `GetProcessCommandLine` opens every process with
`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and issues three chained
`ReadProcessMemory` calls — PEB, `RTL_USER_PROCESS_PARAMETERS`, then the string
— to recover the command line. Walking another process's address space for
credentials-adjacent data on a repeating timer is what a credential dumper does,
so Defender for Endpoint scores it as such regardless of intent. Nothing about
the flag sets above changes that; only removing the read does.
Windows 8.1 added `NtQueryInformationProcess`'s `ProcessCommandLineInformation`
class (60), which returns the same string as a `UNICODE_STRING` the kernel
builds, needing only `PROCESS_QUERY_LIMITED_INFORMATION`. Electron's floor is
Windows 10, so every OS Orca supports has it. The entry point is resolved with
`GetProcAddress` on `ntdll.dll` — it has no import library — and the size is
probed with a null-buffer call that answers `STATUS_INFO_LENGTH_MISMATCH`.
The same hunk drops `PROCESS_VM_READ` from `GetProcessMemoryUsage` and
`GetCpuUsage`, which acquired it and never read an address space:
`GetProcessMemoryInfo` and `GetProcessTimes` are satisfied by
`PROCESS_QUERY_LIMITED_INFORMATION`. Measured, both return identical values
under the weaker right on every process that opens at all.
Measured on Windows 11, ~540 processes, counted in-process by replacing the
addon's import table entries with counting stubs:
| per `CommandLine` scan | before | after |
| ---------------------- | ----------------------------------------- | -------------------------------------- |
| `OpenProcess` calls | 543 | 543 |
| desired access | `0x0410` (`VM_READ \| QUERY_INFORMATION`) | `0x1000` (`QUERY_LIMITED_INFORMATION`) |
| `ReadProcessMemory` | 1128 | **0** |
| p50 / p95 | 13.5 / 14.5 ms | 12.3 / 13.5 ms |
Command lines were byte-identical on every process both readers recovered
(405/405, and 399/399 and 376/376 on other runs), including a 24,087-character
argv with embedded quotes, non-ASCII characters and trailing whitespace, and a
WOW64 target. The weaker right is also a strict superset in reach: three
processes that refused `PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` granted
`PROCESS_QUERY_LIMITED_INFORMATION`, and none went the other way.
### There is no PEB fallback, deliberately
An earlier revision kept the PEB reader for a kernel without class 60, behind a
latch. That was wrong, and the reason is worth recording: `ClassifyQueryFailure`
mapped `STATUS_INVALID_INFO_CLASS` / `NOT_SUPPORTED` / `NOT_IMPLEMENTED` from
**any single target** onto a process-wide, one-way switch back to
`PROCESS_VM_READ` plus three `ReadProcessMemory` per pid per scan, for the life
of the process, with nothing observable from JS.
The environment this reader exists for is one where an EDR hooks `ntdll`. A hook
that returns `STATUS_INVALID_INFO_CLASS` for a class it does not recognise would
have silently reinstated the exact primitive the patch removes, on precisely the
machines it was written for — and one stray status from one process was enough.
The same applies under Wine or any instrumented `ntdll`.
So the fallback is gone rather than guarded. `GetProcessCommandLine` returns
false and leaves the command line empty, which is already a normal outcome
(`WindowsProcessRow.command` is documented as empty when a process denies a
query handle, and callers fall back to the image name). Degrading to no command
line is recoverable; silently resuming address-space reads is not.
This also makes the property checkable on the artifact rather than the source:
the patched reader never calls `ReadProcessMemory`, so the symbol is absent from
the compiled addon's import table. `inspectWindowsProcessTreeAddon()` in
`config/scripts/windows-process-tree-gyp-rebuild.mjs` is that check, and it is
the only way to tell the two binaries apart — see below. It answers
`clean` / `unpatched` / `missing` rather than a boolean, because a binary that is
not there has not been cleared, and a caller reading `false` as “verified” would
pass exactly the thing the check exists to catch.
Because the returned `UNICODE_STRING` comes from that same hookable boundary,
its `Buffer` and `Length` are bounds-checked against the allocation before the
characters are encoded, and the probed size is capped at the header plus 64 KiB
(`Length` is a `USHORT`) so a bogus size cannot turn into a `bad_alloc` that
fails an entire scan instead of one process.
### The published tarball ships a loadable unpatched prebuilt
`@vscode/windows-process-tree@0.8.0` publishes
`build/Release/windows_process_tree.node` in the tarball. It is node-addon-api,
so it is ABI-stable and loads cleanly under both Node and Electron — and it was
built from unpatched source, so it performs 1179 `ReadProcessMemory` calls and
opens every process at `0x0410` per scan.
That matters because `allowBuilds` is `false` for this package and CI installs
with `--ignore-scripts`, so nothing compiles it at install time. A `require()`
health check cannot tell the two binaries apart, and a rebuild that is skipped —
`rebuild-native-deps.mjs` soft-exits 0 on a Windows file lock during postinstall
— leaves the upstream prebuilt in place and cached.
Four checks close that, all keyed on the absent `ReadProcessMemory` import:
- `ensureWindowsProcessTreeCommandLinePatch()` deletes a binary that still has
it, so a skipped rebuild fails loudly instead of using the prebuilt;
- `ensure-native-runtime.mjs` treats such a binary as a load failure, which is
what triggers the rebuild;
- the relay build asserts it on the artifact it just produced;
- `loadWindowsProcessTree()` asserts it again on the addon staged beside a relay
bundle and refuses to bind one that still imports the symbol, falling back to
the CIM scan. The build-time assertion is not enough on its own: a bundle and
the addon beside it redeploy independently, so a host that has not taken a new
bundle keeps whatever `.node` is already there.
What none of this does is narrow _which_ processes are asked. A detailed scan
still queries every pid, including `lsass.exe`; it now asks with the same right
Task Manager uses instead of `PROCESS_VM_READ`. Restricting the command-line
pass to Orca's own subtree is the complementary change, and it belongs with the
identity/detailed reader split rather than here — a ppid-derived allowlist would
miss exactly the detached, reparented descendants the trackers exist to find
(#9045, #10475), so it needs the job-object membership as its source of truth.
## Packaging
The addon is Windows-only, so it follows the same contract as
@@ -221,6 +488,10 @@ The addon is Windows-only, so it follows the same contract as
`ensure-native-runtime.mjs`;
- copied into the packaged `node_modules` for win32 only.
The relay's copy is a separate artifact staged beside the bundle, so a relay host
only picks up a rebuilt addon on redeploy. Until then it keeps whatever binary it
already has, which is why the addon is checked again at load.
## What the snapshot does not provide
`CreationDate` (process start time) has no equivalent. Anything using a start
@@ -229,9 +500,10 @@ ownership, and CPU accounting in the memory collector — still reads it through
its own query. Those callers are not migrated.
Committed private bytes have no equivalent either, and the one memory value the
snapshot _can_ carry is unusable for the sizes Orca now sees: `process.cc` stores
`pmc.WorkingSetSize` into a `DWORD`, so anything above 4 GB wraps. That is the
second reason `windows-process-resource-collector.ts` still runs its own
addon can produce is unusable for the sizes Orca now sees: `process.cc` stores
`pmc.WorkingSetSize` into a `DWORD`, so anything above 4 GB wraps — which is why
neither flag set asks for it. That is the second reason
`windows-process-resource-collector.ts` still runs its own
`Get-CimInstance` sweep — it needs `PageFileUsage` (commit) and the CPU-time
counters in the same pass. Migrating it to the native table would cost both, and
it is why this module no longer sets the `Memory` flag at all: the field had no
mobile/src/components/mobile-markdown-preview-html.ts
+11 -4
View File
@@ -204,11 +204,18 @@ function escapeRegExp(value: string): string {
}
function codePlaceholderPrefix(content: string): string {
let prefix = CODE_PLACEHOLDER_PREFIX_BASE
while (content.includes(prefix)) {
prefix = `${prefix}_`
let suffixLength = 0
let cursor = 0
while ((cursor = content.indexOf(CODE_PLACEHOLDER_PREFIX_BASE, cursor)) !== -1) {
cursor += CODE_PLACEHOLDER_PREFIX_BASE.length
const suffixStart = cursor
while (content[cursor] === '_') {
cursor += 1
}
// One extra underscore keeps the prefix longer than every authored run.
suffixLength = Math.max(suffixLength, cursor - suffixStart + 1)
}
return prefix
return CODE_PLACEHOLDER_PREFIX_BASE + '_'.repeat(suffixLength)
}
function protectMarkdownCode(content: string): {
mobile/src/components/mobile-markdown-preview-placeholder.test.ts
+33
View File
@@ -0,0 +1,33 @@
import { describe, expect, it } from 'vitest'
import { normalizeMobileMarkdownPreviewHtml } from './mobile-markdown-preview-html'
const marker = '\uE000ORCA_MD_CODE_'
const suffix = '\uE000'
describe('mobile Markdown code placeholder collisions', () => {
it.each([0, 1, 2, 15, 128, 16384])('preserves a literal marker with %i underscores', (length) => {
const literal = `${marker}${'_'.repeat(length)}0${suffix}`
const input = `${literal} and \`Array<string>\`\n\n\`\`\`html\n<p>literal</p>\n\`\`\``
expect(normalizeMobileMarkdownPreviewHtml(input)).toBe(input)
})
it('handles adjacent markers and repeated maximum suffixes', () => {
const literal = `${marker}${marker}__0${suffix}${marker}__1${suffix}${marker}_2${suffix}`
expect(normalizeMobileMarkdownPreviewHtml(`<p>${literal} and \`<div>\`</p>`)).toBe(
`${literal} and \`<div>\``
)
})
it('preserves authored markers across generated suffix orders and HTML islands', () => {
let seed = 173
for (let sample = 0; sample < 500; sample++) {
const literals: string[] = []
for (let index = 0; index < 8; index++) {
seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0
literals.push(`${marker}${'_'.repeat(seed % 32)}${index}${suffix}`)
}
const text = literals.join(' ') + ' and `Array<string>`'
expect(normalizeMobileMarkdownPreviewHtml(`<p>${text}</p>`)).toBe(text)
}
})
})
mobile/src/session/mobile-native-chat-autocomplete.ts
+1 -1
View File
@@ -81,7 +81,7 @@ export function rankSuggestions(candidates: readonly string[], query: string, li
const substring: string[] = []
for (const candidate of candidates) {
const lower = candidate.toLowerCase()
const base = lower.split('/').pop() ?? lower
const base = lower.slice(lower.lastIndexOf('/') + 1)
if (lower.startsWith(q) || base.startsWith(q)) {
prefix.push(candidate)
} else if (lower.includes(q)) {
mobile/src/session/mobile-session-route-parity.test.ts
+2 -2
View File
@@ -79,7 +79,7 @@ const HEAD_TIMER_CREATION_SHA256 =
'1a31b625e2174c3db77272249843196d2b6b06ab1e654a96d8f7858e3082e66b'
const HEAD_TIMER_CLEANUP_SHA256 = 'c73f1d1c2cc89642f3d727d6f3b6b81860a9d6f34234541a2065ec3d1a8cd116'
const HEAD_RUNTIME_STRING_SHA256 =
'ba52a3ede721bd29acbe8593161e90b216b7f361ff896e085927d4d73fa83b2f'
'0c08a53c2cd1e182e1d7edfb7b98bd9e4a313e47c7b93f5a509a89ec3292bc1f'
const HEAD_HOST_JSX_SHA256 = '390405926b1695fa3a33686f0bc192b432f5468d8576499d7cafbb4922defbb5'
const HEAD_LEAF_JSX_SHA256 = '21dba981875e173f692590bf910d60964660c5f4cbb79f3a377c7e54f6a1f016'
const HEAD_STYLE_REFERENCE_SHA256 =
@@ -517,7 +517,7 @@ describe('mobile session route extraction parity', () => {
it('preserves runtime strings, styles, and the expanded JSX tree', () => {
const strings = readRuntimeStrings()
expect(strings).toHaveLength(546)
expect(strings).toHaveLength(547)
expect(hash(strings)).toBe(HEAD_RUNTIME_STRING_SHA256)
const jsx = readJsxFacts(readDefinitions())
expect(jsx.host).toHaveLength(124)
mobile/src/session/use-mobile-session-terminal-runtime.ts
+2 -1
View File
@@ -1,5 +1,5 @@
import { useState, useRef, useCallback } from 'react'
import type { Keyboard, TextInput } from 'react-native'
import { Platform, type Keyboard, type TextInput } from 'react-native'
import { useFocusEffect } from 'expo-router'
import type { RpcClient } from '../transport/rpc-client'
import type { ConnectionState } from '../transport/types'
@@ -142,6 +142,7 @@ export function useMobileSessionTerminalRuntime(scope: MobileSessionScreenStateM
lifecycleIdentity: client,
lifecycleKey: JSON.stringify([hostId, worktreeId, connState]),
liveInputEnabled,
reopenFocusedInputWhenKeyboardHidden: Platform.OS === 'android',
timerRef: liveInputFocusTimerRef
})
useFocusEffect(
mobile/src/terminal/terminal-live-input.test.ts
+29 -3
View File
@@ -196,18 +196,40 @@ describe('terminal live input', () => {
const input = createFocusTarget(() => true)
const refocus = vi.fn()
focusTerminalLiveInputTarget(input, { keyboardHeight: 0, refocus })
focusTerminalLiveInputTarget(input, {
keyboardHeight: 0,
refocus,
reopenFocusedInputWhenKeyboardHidden: true
})
expect(input.blur).toHaveBeenCalledTimes(1)
expect(input.focus).not.toHaveBeenCalled()
expect(refocus).toHaveBeenCalledTimes(1)
})
it('keeps an iPad hardware-keyboard responder focused when the software keyboard is absent', () => {
const input = createFocusTarget(() => true)
const refocus = vi.fn()
focusTerminalLiveInputTarget(input, {
keyboardHeight: 0,
refocus,
reopenFocusedInputWhenKeyboardHidden: false
})
expect(input.blur).not.toHaveBeenCalled()
expect(input.focus).toHaveBeenCalledTimes(1)
expect(refocus).not.toHaveBeenCalled()
})
it('focuses the capture input directly when the keyboard is open', () => {
const input = createFocusTarget(() => true)
const refocus = vi.fn()
focusTerminalLiveInputTarget(input, { keyboardHeight: 240, refocus })
focusTerminalLiveInputTarget(input, {
keyboardHeight: 240,
refocus,
reopenFocusedInputWhenKeyboardHidden: true
})
expect(input.blur).not.toHaveBeenCalled()
expect(input.focus).toHaveBeenCalledTimes(1)
@@ -218,7 +240,11 @@ describe('terminal live input', () => {
const input = createFocusTarget(() => false)
const refocus = vi.fn()
focusTerminalLiveInputTarget(input, { keyboardHeight: 0, refocus })
focusTerminalLiveInputTarget(input, {
keyboardHeight: 0,
refocus,
reopenFocusedInputWhenKeyboardHidden: true
})
expect(input.blur).not.toHaveBeenCalled()
expect(input.focus).toHaveBeenCalledTimes(1)
mobile/src/terminal/terminal-live-input.ts
+7 -2
View File
@@ -75,6 +75,7 @@ export type TerminalLiveInputFocusTarget = {
type FocusTerminalLiveInputTargetOptions = {
readonly keyboardHeight: number
readonly refocus: () => void
readonly reopenFocusedInputWhenKeyboardHidden: boolean
}
export type TerminalLiveInputDefaultResult = {
@@ -230,13 +231,17 @@ export function scheduleTerminalLiveInputFocus(
export function focusTerminalLiveInputTarget(
input: TerminalLiveInputFocusTarget | null,
{ keyboardHeight, refocus }: FocusTerminalLiveInputTargetOptions
{
keyboardHeight,
refocus,
reopenFocusedInputWhenKeyboardHidden
}: FocusTerminalLiveInputTargetOptions
): void {
if (!input) {
return
}
if (keyboardHeight <= 0 && input.isFocused?.()) {
if (reopenFocusedInputWhenKeyboardHidden && keyboardHeight <= 0 && input.isFocused?.()) {
// Why: Android can keep a hidden TextInput focused after the IME is dismissed;
// focus() is then a no-op, so force a new focus session to reopen the keyboard.
input.blur()
mobile/src/terminal/use-terminal-live-input-focus.test.ts
+18
View File
@@ -15,6 +15,7 @@ type HarnessProps = {
readonly lifecycleIdentity: object | null
readonly lifecycleKey: string
readonly liveInputEnabled: boolean
readonly reopenFocusedInputWhenKeyboardHidden: boolean
readonly timerRef: TerminalLiveInputFocusTimerRef
}
@@ -92,6 +93,7 @@ function connectedProps(
lifecycleIdentity: null,
lifecycleKey: 'host-a:worktree-a:connected',
liveInputEnabled: true,
reopenFocusedInputWhenKeyboardHidden: true,
timerRef
}
}
@@ -128,6 +130,22 @@ describe('terminal live input focus hook', () => {
expect(input.focus).toHaveBeenCalledTimes(2)
harness.unmount()
})
it('preserves the focused iPad responder when a hardware keyboard keeps keyboard height at zero', () => {
vi.useFakeTimers()
const input = createFocusTarget(true)
const inputRef = { current: input }
const harness = createHarness({
...connectedProps(inputRef),
reopenFocusedInputWhenKeyboardHidden: false
})
harness.handlers().handleTerminalTap('terminal-a')
vi.runAllTimers()
expect(input.blur).not.toHaveBeenCalled()
expect(input.focus).toHaveBeenCalledTimes(1)
harness.unmount()
})
it('cancels focus when navigation reuses the mounted route', () => {
vi.useFakeTimers()
mobile/src/terminal/use-terminal-live-input-focus.ts
+12 -3
View File
@@ -11,6 +11,7 @@ type TerminalLiveInputFocusContext = {
readonly canSend: boolean
readonly keyboardHeight: number
readonly liveInputEnabled: boolean
readonly reopenFocusedInputWhenKeyboardHidden: boolean
}
type UseTerminalLiveInputFocusOptions<T extends TerminalLiveInputFocusTarget> =
@@ -35,17 +36,24 @@ export function useTerminalLiveInputFocus<T extends TerminalLiveInputFocusTarget
keyboardHeight,
lifecycleIdentity,
lifecycleKey,
reopenFocusedInputWhenKeyboardHidden,
liveInputEnabled,
timerRef
}: UseTerminalLiveInputFocusOptions<T>): TerminalLiveInputFocusHandlers {
const contextRef = useRef<TerminalLiveInputFocusContext>({
canSend,
keyboardHeight,
liveInputEnabled
liveInputEnabled,
reopenFocusedInputWhenKeyboardHidden
})
useLayoutEffect(() => {
contextRef.current = { canSend, keyboardHeight, liveInputEnabled }
}, [canSend, keyboardHeight, liveInputEnabled])
contextRef.current = {
canSend,
keyboardHeight,
liveInputEnabled,
reopenFocusedInputWhenKeyboardHidden
}
}, [canSend, keyboardHeight, liveInputEnabled, reopenFocusedInputWhenKeyboardHidden])
const resetLiveInputFocus = useCallback(() => {
clearTerminalLiveInputFocusTimer(timerRef)
@@ -62,6 +70,7 @@ export function useTerminalLiveInputFocus<T extends TerminalLiveInputFocusTarget
}
focusTerminalLiveInputTarget(inputRef.current, {
keyboardHeight: context.keyboardHeight,
reopenFocusedInputWhenKeyboardHidden: context.reopenFocusedInputWhenKeyboardHidden,
refocus: () => scheduleTerminalLiveInputFocus(timerRef, focusLiveInput)
})
}, [inputRef, timerRef])
mobile/src/transport/mobile-direct-endpoint-probe.ts
+25 -3
View File
@@ -31,7 +31,14 @@ export function directPathForEndpoint(
// instead of holding the supervisor's operation mutex for the full outer bound.
const RECONNECT_GRACE_MS = 2_000
function waitForAuthenticatedSession(session: RpcClient, timeoutMs: number): Promise<void> {
function waitForAuthenticatedSession(
session: RpcClient,
timeoutMs: number,
signal?: AbortSignal
): Promise<void> {
if (signal?.aborted) {
return Promise.reject(new Error('probe cancelled'))
}
if (session.getState() === 'connected') {
return Promise.resolve()
}
@@ -72,7 +79,13 @@ function waitForAuthenticatedSession(session: RpcClient, timeoutMs: number): Pro
finish()
reject(new Error('probe session authentication timed out'))
}, timeoutMs)
const onAbort = (): void => {
finish()
reject(new Error('probe cancelled'))
}
signal?.addEventListener('abort', onAbort, { once: true })
function finish(): void {
signal?.removeEventListener('abort', onAbort)
if (timer) {
clearTimeout(timer)
}
@@ -87,8 +100,12 @@ function waitForAuthenticatedSession(session: RpcClient, timeoutMs: number): Pro
export async function openAuthenticatedDirectEndpoint(
host: HostProfile,
openDirect: (endpoint: string) => RpcClient,
timeoutMs: number
timeoutMs: number,
signal?: AbortSignal
): Promise<{ client: RpcClient; path: Exclude<MobileConnectionPath, 'relay'> } | null> {
if (signal?.aborted) {
return null
}
const endpoints = directEndpointUrls(host)
return await new Promise((resolve) => {
const clients = new Set<RpcClient>()
@@ -110,8 +127,13 @@ export async function openAuthenticatedDirectEndpoint(
continue
}
clients.add(client)
void waitForAuthenticatedSession(client, timeoutMs).then(
void waitForAuthenticatedSession(client, timeoutMs, signal).then(
() => {
if (signal?.aborted) {
client.close()
rejectCandidate()
return
}
if (settled) {
client.close()
return
mobile/src/transport/mobile-direct-probe-stop-budget.test.ts
+175
View File
@@ -0,0 +1,175 @@
import { expect, it, vi } from 'vitest'
import {
dependencies,
FakeLogicalClient,
FakeSession,
host
} from './mobile-endpoint-supervisor-test-fakes'
import { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis'
import { createStableLogicalRpcClient } from './stable-logical-rpc-client'
import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
vi.mock('expo-secure-store', () => ({ WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'when-unlocked' }))
vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) }))
it('closes in-flight candidates and clears their timeout when the owner stops', async () => {
vi.useFakeTimers()
try {
const candidate = new FakeSession('connecting')
const logical = new FakeLogicalClient('connected', 'relay')
const deps = dependencies({ openDirect: vi.fn(() => candidate) })
const supervisor = new MobileEndpointSupervisor(logical, host, deps)
await supervisor.start()
await vi.advanceTimersByTimeAsync(15_000)
expect(deps.openDirect).toHaveBeenCalledOnce()
supervisor.stop()
await vi.advanceTimersByTimeAsync(0)
expect(candidate.close).toHaveBeenCalledOnce()
expect(vi.getTimerCount()).toBe(0)
await vi.advanceTimersByTimeAsync(12_000)
expect(vi.getTimerCount()).toBe(0)
expect(candidate.close).toHaveBeenCalledOnce()
expect(logical.migrateTo).not.toHaveBeenCalled()
expect(deps.openDirect).toHaveBeenCalledOnce()
} finally {
vi.restoreAllMocks()
vi.useRealTimers()
}
})
it('closes an authenticated candidate when stop races its completion', async () => {
vi.useFakeTimers()
try {
const candidate = new FakeSession('connecting')
const logical = new FakeLogicalClient('connected', 'relay')
const deps = dependencies({ openDirect: vi.fn(() => candidate) })
const supervisor = new MobileEndpointSupervisor(logical, host, deps)
await supervisor.start()
await vi.advanceTimersByTimeAsync(15_000)
candidate.publishState('connected')
supervisor.stop()
await vi.advanceTimersByTimeAsync(0)
expect(candidate.close).toHaveBeenCalledOnce()
expect(logical.migrateTo).not.toHaveBeenCalled()
expect(vi.getTimerCount()).toBe(0)
} finally {
vi.restoreAllMocks()
vi.useRealTimers()
}
})
it('preserves an in-flight probe across a transient background pause', async () => {
vi.useFakeTimers()
try {
const candidate = new FakeSession('connecting')
const logical = new FakeLogicalClient('connected', 'relay')
const deps = dependencies({ openDirect: vi.fn(() => candidate) })
const supervisor = new MobileEndpointSupervisor(logical, host, deps)
await supervisor.start()
await vi.advanceTimersByTimeAsync(15_000)
supervisor.setForeground(false)
await vi.advanceTimersByTimeAsync(0)
expect(candidate.close).not.toHaveBeenCalled()
supervisor.stop()
await vi.advanceTimersByTimeAsync(0)
expect(candidate.close).toHaveBeenCalledOnce()
expect(vi.getTimerCount()).toBe(0)
} finally {
vi.restoreAllMocks()
vi.useRealTimers()
}
})
it('releases every candidate when multiple endpoint probes are pending', async () => {
vi.useFakeTimers()
try {
const candidates: FakeSession[] = []
const logical = new FakeLogicalClient('connected', 'relay')
const deps = dependencies({
openDirect: vi.fn(() => {
const candidate = new FakeSession('connecting')
candidates.push(candidate)
return candidate
})
})
const supervisor = new MobileEndpointSupervisor(
logical,
{
...host,
endpoints: [{ id: 'alternate', kind: 'tailscale', url: 'ws://100.64.0.2:6768' }]
},
deps
)
await supervisor.start()
await vi.advanceTimersByTimeAsync(15_000)
expect(candidates).toHaveLength(2)
supervisor.stop()
await vi.advanceTimersByTimeAsync(0)
expect(vi.getTimerCount()).toBe(0)
for (const candidate of candidates) {
expect(candidate.close).toHaveBeenCalledOnce()
candidate.publishState('connected')
}
await vi.advanceTimersByTimeAsync(60_000)
expect(logical.migrateTo).not.toHaveBeenCalled()
expect(deps.openDirect).toHaveBeenCalledTimes(2)
expect(vi.getTimerCount()).toBe(0)
} finally {
vi.restoreAllMocks()
vi.useRealTimers()
}
})
it.each([false, true])(
'fences migration finishing after stop (already swapped: %s)',
async (alreadySwapped) => {
vi.useFakeTimers()
try {
const recordedMigration = vi.spyOn(MobileEndpointHysteresis.prototype, 'recordMigration')
const relay = new FakeSession('connected')
const logical = createStableLogicalRpcClient(relay, 'relay')
const candidates: FakeSession[] = []
const deps = dependencies({
openDirect: vi.fn(() => {
const candidate = new FakeSession('connected')
candidates.push(candidate)
return candidate
})
})
const supervisor = new MobileEndpointSupervisor(logical, host, deps)
const migrate = logical.migrateTo.bind(logical)
let release!: () => void
const pending = new Promise<void>((resolve) => {
release = resolve
})
const migration = vi.spyOn(logical, 'migrateTo').mockImplementation(async (...args) => {
if (alreadySwapped) {
await migrate(...args)
}
await pending
if (!alreadySwapped) {
await migrate(...args)
}
})
await supervisor.start()
await vi.advanceTimersByTimeAsync(60_000)
expect(migration).toHaveBeenCalledOnce()
const requestsBeforeStop = relay.sendRequest.mock.calls.length
const candidateRequestsBeforeStop = candidates[3].sendRequest.mock.calls.length
const migrationsBeforeStop = recordedMigration.mock.calls.length
supervisor.stop()
release()
await vi.advanceTimersByTimeAsync(0)
expect(logical.getActivePath()).toBe(alreadySwapped ? 'lan' : 'relay')
expect(logical.getGeneration()).toBe(alreadySwapped ? 2 : 1)
expect(relay.sendRequest).toHaveBeenCalledTimes(requestsBeforeStop)
expect(candidates[3].sendRequest).toHaveBeenCalledTimes(candidateRequestsBeforeStop)
expect(recordedMigration).toHaveBeenCalledTimes(migrationsBeforeStop)
expect(candidates[3].close).toHaveBeenCalledTimes(alreadySwapped ? 0 : 1)
expect(vi.getTimerCount()).toBe(0)
logical.close()
} finally {
vi.restoreAllMocks()
vi.useRealTimers()
}
}
)
mobile/src/transport/mobile-direct-return-probe.ts
+39 -4
View File
@@ -11,6 +11,9 @@ const DIRECT_PROBE_INTERVAL_MS = 15_000
export class DirectReturnProbe {
private timer: ReturnType<typeof setTimeout> | null = null
private stopped = false
private activeProbe: AbortController | null = null
constructor(
private readonly deps: {
now: () => number
@@ -24,14 +27,18 @@ export class DirectReturnProbe {
canSchedule: () => boolean
canAttempt: () => boolean
beginOperation: () => void
migrate: (client: RpcClient, path: MobileConnectionPath) => Promise<void>
migrate: (
client: RpcClient,
path: MobileConnectionPath,
shouldAbort: () => boolean
) => Promise<void>
onDirectMigrated: () => Promise<void>
afterProbe: () => void
}
) {}
schedule(delayMs = DIRECT_PROBE_INTERVAL_MS): void {
if (!this.hooks.canSchedule() || this.timer) {
if (this.stopped || !this.hooks.canSchedule() || this.timer) {
return
}
this.timer = this.deps.setTimer(() => {
@@ -47,19 +54,34 @@ export class DirectReturnProbe {
}
}
stop(): void {
this.stopped = true
this.clear()
this.activeProbe?.abort()
}
private async probe(): Promise<void> {
if (this.stopped) {
return
}
if (!this.hooks.canAttempt() || !this.hooks.hysteresis.canProbe(this.deps.now())) {
this.schedule()
return
}
const controller = new AbortController()
this.activeProbe = controller
this.hooks.beginOperation()
let successful: Awaited<ReturnType<typeof openAuthenticatedDirectEndpoint>> = null
try {
successful = await openAuthenticatedDirectEndpoint(
this.hooks.host(),
this.deps.openDirect,
12_000
12_000,
controller.signal
)
if (this.stopped) {
return
}
if (!successful) {
this.hooks.hysteresis.recordDirectFailure(this.deps.now())
return
@@ -68,11 +90,24 @@ export class DirectReturnProbe {
successful.client.close()
return
}
await this.hooks.migrate(successful.client, successful.path)
const candidate = successful
// Migration owns the candidate, including closing it if cutover is canceled.
successful = null
try {
await this.hooks.migrate(candidate.client, candidate.path, () => this.stopped)
} catch (error) {
if (this.stopped) {
return
}
throw error
}
if (this.stopped) {
return
}
this.hooks.hysteresis.recordMigration(this.deps.now())
await this.hooks.onDirectMigrated()
} finally {
this.activeProbe = null
successful?.client.close()
// Why: a relay drop or backoff timer can arrive while the probe owns the
// operation mutex; afterProbe releases it and replays deferred recovery.
mobile/src/transport/mobile-endpoint-supervisor.ts
+2 -1
View File
@@ -120,7 +120,7 @@ export class MobileEndpointSupervisor {
canSchedule: () => this.isActive() && this.logical.getActivePath() === 'relay',
canAttempt: () => this.isActive() && !this.operationInFlight,
beginOperation: () => (this.operationInFlight = true),
migrate: (client, path) => this.logical.migrateTo(client, path),
migrate: (client, path, abort) => this.logical.migrateTo(client, path, undefined, abort),
onDirectMigrated: async () => {
this.leaseRotation.clear()
this.relayRotationPending = false
@@ -195,6 +195,7 @@ export class MobileEndpointSupervisor {
stop(): void {
this.stopped = true
this.directProbe.stop()
this.unsubscribeState?.()
this.unsubscribeState = null
this.backgroundGrace.stop()
mobile/src/transport/mobile-relay-browser-cancel-budget.test.ts
+109
View File
@@ -0,0 +1,109 @@
import { describe, expect, it } from 'vitest'
import { RuntimeBrowserScreencastController } from '../../../src/main/runtime/runtime-browser-screencast-controller'
import type { RuntimeBrowserCommands } from '../../../src/main/runtime/orca-runtime-browser'
import type { BrowserScreencastResult } from '../../../src/shared/runtime-types'
import { MobileRelayRpcStreams } from './mobile-relay-rpc-streams'
import type { RpcResponse } from './types'
describe('relay browser cancellation resource budget', () => {
it.each([false, true])('stops host frames when cancellation precedes ready=%s', async (early) => {
const subscriptions = new Map<string, () => void | Promise<void>>()
const done = Promise.withResolvers<void>()
const ready = Promise.withResolvers<RpcResponse>()
let sequence = 0
let stopped = false
let frameSends = 0
let frameBytes = 0
let sendBinary: (bytes: Uint8Array) => boolean | void = () => false
let hostRun: Promise<void> | undefined
const methods: string[] = []
const cleanup = (id: string): void => {
const release = subscriptions.get(id)
subscriptions.delete(id)
void release?.()
}
const host = new RuntimeBrowserScreencastController({
getCommands: () =>
({
browserScreencast: async (_params, stream) => {
sendBinary = stream.sendBinary
return {
subscriptionId: 'server-stream',
ready: { type: 'ready', subscriptionId: 'server-stream', browserPageId: 'page' },
session: {
done: done.promise,
stop: () => {
stopped = true
done.resolve()
}
},
flushPendingFrame: () => {}
}
}
}) as RuntimeBrowserCommands,
registerSubscriptionCleanup: (id, release) => subscriptions.set(id, release),
cleanupSubscription: cleanup,
getDriver: () => ({ kind: 'idle' }),
setDriver: () => {},
notifyRemoteViewersChanged: () => {}
})
const streams = new MobileRelayRpcStreams({
nextId: () => `request-${++sequence}`,
waitForConnected: async () => {},
sendFrame: (request) => {
methods.push(request.method)
if (request.method === 'browser.screencast' && (request.params as { page?: string }).page) {
hostRun = host.start(request.params as Parameters<typeof host.start>[0], {
connectionId: 'relay-connection',
sendBinary: (bytes) => {
frameSends++
frameBytes += bytes.byteLength
return true
},
emit: (result: BrowserScreencastResult) => {
if (result.type === 'ready') {
ready.resolve({
id: request.id,
ok: true,
streaming: true,
result,
_meta: { runtimeId: 'host' }
})
}
}
})
} else if (request.method === 'browser.screencast.unsubscribe') {
cleanup((request.params as { subscriptionId: string }).subscriptionId)
}
return true
}
})
const cancel = streams.subscribe('browser.screencast', { page: 'page' }, () => {})
try {
const response = await ready.promise
if (early) {
cancel()
}
streams.handleResponse(response)
if (!early) {
cancel()
}
for (let frame = 0; frame < 100; frame++) {
if (!stopped) {
sendBinary(new Uint8Array(65_536))
}
}
expect({ stopped, subscriptions: subscriptions.size, frameSends, frameBytes }).toEqual({
stopped: true,
subscriptions: 0,
frameSends: 0,
frameBytes: 0
})
expect(methods).toEqual(['browser.screencast', 'browser.screencast.unsubscribe'])
} finally {
cleanup('server-stream')
await hostRun
streams.clear()
}
})
})
mobile/src/transport/mobile-relay-rpc-session.test.ts
+30
View File
@@ -136,6 +136,36 @@ describe('mobile relay RPC session', () => {
})
afterEach(() => vi.useRealTimers())
it('releases stream listeners on failure even when close follows it', async () => {
const { session } = await authenticateSession()
const listener = vi.fn()
session.subscribe('runtime.clientEvents.subscribe', {}, listener)
await Promise.resolve()
const request = JSON.parse(fakes.sendText.mock.calls[0]![0] as string) as { id: string }
fakes.linkOptions!.onText(
JSON.stringify({
id: request.id,
ok: true,
streaming: true,
result: { type: 'ready', subscriptionId: 'server-events' },
_meta: { runtimeId: 'runtime-1' }
})
)
expect(listener).toHaveBeenCalledTimes(1)
fakes.linkOptions!.onError(new Error('relay lost'))
session.close()
fakes.linkOptions!.onText(
JSON.stringify({
id: request.id,
ok: true,
streaming: true,
result: { type: 'event' },
_meta: { runtimeId: 'runtime-1' }
})
)
expect(listener).toHaveBeenCalledTimes(1)
})
it('requires exact resume observations and confirms by request ID before becoming connected', async () => {
const { session, confirmationRequest, capabilityRequest } = await authenticateSession()
mobile/src/transport/mobile-relay-rpc-session.ts
+1
View File
@@ -294,6 +294,7 @@ export function connectMobileRelayRpcSession(args: {
closed = true
failure = error
livenessWatchdog.stop(livenessIdentity)
streams.clear()
link.close()
pending.rejectAll(error)
publishState(error instanceof MobileE2EEAuthenticationError ? 'auth-failed' : 'disconnected')
mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts
+259
View File
@@ -0,0 +1,259 @@
import { describe, expect, it, vi } from 'vitest'
import { MobileRelayRpcStreams } from './mobile-relay-rpc-streams'
import type { RpcResponse } from './types'
function createStreams(waitForConnected = async () => {}) {
let sequence = 0
const sendFrame = vi.fn((_request: { id: string; method: string; params?: unknown }) => true)
const streams = new MobileRelayRpcStreams({
nextId: () => `request-${++sequence}`,
sendFrame,
waitForConnected
})
return { streams, sendFrame }
}
function response(id: string, result: unknown): RpcResponse {
return { id, ok: true, streaming: true, result, _meta: { runtimeId: 'test' } }
}
const serverSubscriptions = [
['browser.screencast', 'browser.screencast.unsubscribe'],
['runtime.clientEvents.subscribe', 'runtime.clientEvents.unsubscribe']
] as const
describe('mobile relay subscription cancellation', () => {
it.each(serverSubscriptions)('cleans up ready %s exactly once', async (method, unsubscribe) => {
const { streams, sendFrame } = createStreams()
const listener = vi.fn()
const cancel = streams.subscribe(method, {}, listener)
await Promise.resolve()
streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
cancel()
cancel()
expect(sendFrame.mock.calls).toEqual([
[{ id: 'request-1', method, params: {} }],
[{ id: 'request-2', method: unsubscribe, params: { subscriptionId: 'server-1' } }]
])
expect(streams.handleResponse(response('request-1', { type: 'end' }))).toBe(false)
expect(listener).toHaveBeenCalledTimes(1)
})
it.each(serverSubscriptions)(
'cleans up late-ready %s without calling disposed listeners',
async (method, unsubscribe) => {
const { streams, sendFrame } = createStreams()
const listener = vi.fn()
const cancel = streams.subscribe(method, {}, listener)
await Promise.resolve()
cancel()
cancel()
expect(sendFrame).toHaveBeenCalledTimes(1)
expect(streams.handleResponse(response('request-1', { type: 'starting' }))).toBe(true)
streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
expect(sendFrame).toHaveBeenLastCalledWith({
id: 'request-2',
method: unsubscribe,
params: { subscriptionId: 'server-1' }
})
expect(
streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
).toBe(false)
expect(listener).not.toHaveBeenCalled()
}
)
it.each(['error', 'end', 'disconnect', 'completed'])(
'forgets cancelled cleanup routes on %s',
async (ending) => {
const { streams, sendFrame } = createStreams()
const cancel = streams.subscribe('browser.screencast', {}, vi.fn())
await Promise.resolve()
cancel()
if (ending === 'disconnect') {
streams.clear()
} else if (ending === 'completed') {
streams.handleResponse({
id: 'request-1',
ok: true,
result: null,
_meta: { runtimeId: 'test' }
})
} else if (ending === 'error') {
streams.handleResponse({
id: 'request-1',
ok: false,
error: { code: 'unsupported', message: 'failed' },
_meta: { runtimeId: 'test' }
})
} else {
streams.handleResponse(response('request-1', { type: 'end', subscriptionId: 'server-1' }))
}
expect(
streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
).toBe(false)
expect(sendFrame).toHaveBeenCalledTimes(1)
}
)
it.each([
[
'terminal.subscribe',
{ terminal: 'term', client: { id: 'phone' } },
'terminal.unsubscribe',
{ subscriptionId: 'term:phone', client: { id: 'phone' } }
],
[
'session.tabs.subscribe',
{ worktree: 'id:workspace' },
'session.tabs.unsubscribe',
{ worktree: 'id:workspace', subscriptionId: 'request-1' }
],
[
'nativeChat.subscribe',
{ subscriptionId: 'chat' },
'nativeChat.unsubscribe',
{ subscriptionId: 'chat' }
]
])(
'cancels %s using its request cleanup identity',
async (method, params, unsubscribe, unsubscribeParams) => {
const { streams, sendFrame } = createStreams()
const cancel = streams.subscribe(method as string, params, vi.fn())
await Promise.resolve()
if (method === 'session.tabs.subscribe') {
streams.handleResponse(response('request-1', { type: 'snapshot' }))
}
cancel()
expect(sendFrame).toHaveBeenLastCalledWith({
id: 'request-2',
method: unsubscribe,
params: unsubscribeParams
})
}
)
it.each([
'terminal.subscribe',
'browser.screencast',
'runtime.clientEvents.subscribe',
'session.tabs.subscribe',
'nativeChat.subscribe'
])('does not unsubscribe an unsent %s', async (method) => {
const wait = Promise.withResolvers<void>()
const { streams, sendFrame } = createStreams(() => wait.promise)
const cancel = streams.subscribe(
method,
{ terminal: 'term', worktree: 'id:workspace', subscriptionId: 'chat' },
vi.fn()
)
cancel()
wait.resolve()
await Promise.resolve()
expect(sendFrame).not.toHaveBeenCalled()
expect(
streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
).toBe(false)
})
it.each([false, true])(
'preserves a same-worktree sibling when cancellation precedes snapshot=%s',
async (early) => {
const { streams, sendFrame } = createStreams()
const first = vi.fn()
const second = vi.fn()
const cancel = streams.subscribe(
'session.tabs.subscribe',
{ worktree: 'id:workspace' },
first
)
streams.subscribe('session.tabs.subscribe', { worktree: 'id:workspace' }, second)
await Promise.resolve()
if (early) {
cancel()
}
expect(sendFrame).toHaveBeenCalledTimes(2)
streams.handleResponse(response('request-1', { type: 'snapshot' }))
if (!early) {
cancel()
}
expect(sendFrame).toHaveBeenLastCalledWith({
id: 'request-3',
method: 'session.tabs.unsubscribe',
params: { worktree: 'id:workspace', subscriptionId: 'request-1' }
})
streams.handleResponse(response('request-2', { type: 'snapshot' }))
streams.handleResponse(response('request-2', { type: 'updated' }))
expect(second).toHaveBeenCalledTimes(2)
expect(first).toHaveBeenCalledTimes(early ? 0 : 1)
expect(streams.handleResponse(response('request-1', { type: 'updated' }))).toBe(false)
}
)
it.each([
['nativeChat.subscribe', { agent: 'claude', sessionId: 's1', subscriptionId: 'claude:s1' }],
['terminal.subscribe', { terminal: 'term', client: { id: 'phone' } }]
])(
'keeps the newer %s live when an older same-token subscription unmounts',
async (method, params) => {
const { streams, sendFrame } = createStreams()
const older = vi.fn()
const newer = vi.fn()
const cancelOlder = streams.subscribe(method, params, older)
const cancelNewer = streams.subscribe(method, { ...params }, newer)
await Promise.resolve()
expect(sendFrame).toHaveBeenCalledTimes(2)
cancelOlder()
// The host keys cleanup by the deterministic token, so unsubscribing would evict the newer.
expect(sendFrame).toHaveBeenCalledTimes(2)
streams.handleResponse(response('request-2', { type: 'snapshot' }))
expect(newer).toHaveBeenCalledTimes(1)
expect(streams.handleResponse(response('request-1', { type: 'snapshot' }))).toBe(false)
expect(older).not.toHaveBeenCalled()
cancelNewer()
expect(sendFrame).toHaveBeenCalledTimes(3)
expect(sendFrame).toHaveBeenLastCalledWith(
expect.objectContaining({ method: method.replace(/\.subscribe$/, '.unsubscribe') })
)
}
)
it('still unsubscribes a shared-token nativeChat stream when the sibling is unsent', async () => {
const wait = Promise.withResolvers<void>()
let connected = false
const { streams, sendFrame } = createStreams(() =>
connected ? Promise.resolve() : wait.promise
)
const params = { agent: 'claude', sessionId: 's1', subscriptionId: 'claude:s1' }
connected = true
const cancelOlder = streams.subscribe('nativeChat.subscribe', params, vi.fn())
await Promise.resolve()
connected = false
streams.subscribe('nativeChat.subscribe', params, vi.fn())
cancelOlder()
expect(sendFrame).toHaveBeenCalledTimes(2)
expect(sendFrame).toHaveBeenLastCalledWith({
id: 'request-3',
method: 'nativeChat.unsubscribe',
params: { subscriptionId: 'claude:s1' }
})
})
it('cleans up every cancelled server subscription across repeated late-ready cycles', async () => {
const { streams, sendFrame } = createStreams()
const listener = vi.fn()
for (let i = 0; i < 100; i++) {
const cancel = streams.subscribe('runtime.clientEvents.subscribe', {}, listener)
await Promise.resolve()
const requestId = `request-${2 * i + 1}`
cancel()
streams.handleResponse(response(requestId, { type: 'ready', subscriptionId: `server-${i}` }))
}
expect(
sendFrame.mock.calls.filter(
([request]) => (request as { method: string }).method === 'runtime.clientEvents.unsubscribe'
)
).toHaveLength(100)
expect(listener).not.toHaveBeenCalled()
})
})
mobile/src/transport/mobile-relay-rpc-streams.ts
+104 -15
View File
@@ -4,9 +4,11 @@ import {
type TerminalSnapshotState
} from './rpc-client-terminal-binary-frame'
import {
buildStreamUnsubscribe,
buildTerminalUnsubscribeParams,
updateTerminalSubscriptionViewport
} from './rpc-client-terminal-subscription'
import { buildReadyStreamUnsubscribe } from './rpc-client-server-subscription'
import type { RpcClient } from './rpc-client'
import type { RpcResponse, RpcSuccess } from './types'
@@ -22,6 +24,23 @@ type StreamRecord = {
streamIds: Set<number>
subscriptionId?: string
cancelled: boolean
sent: boolean
receivedSnapshot?: boolean
}
type StreamUnsubscribe = { method: string; params: unknown }
/** Unsubscribe derived from the subscribe params alone (no server-assigned id). */
function buildParamsUnsubscribe(
method: string,
params: unknown,
requestId: string
): StreamUnsubscribe | null {
if (method === 'terminal.subscribe') {
const unsubscribeParams = buildTerminalUnsubscribeParams(params)
return unsubscribeParams ? { method: 'terminal.unsubscribe', params: unsubscribeParams } : null
}
return buildStreamUnsubscribe(method, params, requestId)
}
type StreamManagerOptions = {
@@ -32,6 +51,10 @@ type StreamManagerOptions = {
export class MobileRelayRpcStreams {
private readonly streams = new Map<string, StreamRecord>()
private readonly cancelledSubscriptions = new Map<
string,
{ method: string; unsubscribe?: StreamUnsubscribe }
>()
private readonly terminalListeners = new Map<number, (result: unknown) => void>()
private readonly terminalSnapshots = new Map<number, TerminalSnapshotState>()
private activeBrowserStream: StreamRecord | null = null
@@ -51,13 +74,15 @@ export class MobileRelayRpcStreams {
listener,
onBinaryFrame: subscribeOptions?.onBinaryFrame,
streamIds: new Set(),
cancelled: false
cancelled: false,
sent: false
}
this.streams.set(id, stream)
void this.options
.waitForConnected()
.then(() => {
if (!stream.cancelled) {
stream.sent = true
if (!this.options.sendFrame({ id, method, params: stream.params })) {
this.fail(id, stream, 'Connection interrupted')
}
@@ -75,6 +100,30 @@ export class MobileRelayRpcStreams {
}
handleResponse(response: RpcResponse): boolean {
const cancelled = this.cancelledSubscriptions.get(response.id)
if (cancelled) {
if (!response.ok) {
this.cancelledSubscriptions.delete(response.id)
} else if (response.result && typeof response.result === 'object') {
const result = response.result as { subscriptionId?: unknown; type?: unknown }
if (result.type === 'end') {
this.cancelledSubscriptions.delete(response.id)
} else if (result.type === 'snapshot' && cancelled.unsubscribe) {
this.cancelledSubscriptions.delete(response.id)
this.options.sendFrame({ id: this.options.nextId(), ...cancelled.unsubscribe })
} else if (typeof result.subscriptionId === 'string') {
this.cancelledSubscriptions.delete(response.id)
const unsubscribe = buildReadyStreamUnsubscribe(cancelled.method, result.subscriptionId)
if (unsubscribe) {
this.options.sendFrame({ id: this.options.nextId(), ...unsubscribe })
}
}
}
if (response.ok && response.streaming !== true) {
this.cancelledSubscriptions.delete(response.id)
}
return true
}
const stream = this.streams.get(response.id)
if (!stream) {
return false
@@ -86,6 +135,9 @@ export class MobileRelayRpcStreams {
const result = (response as RpcSuccess).result
if (result && typeof result === 'object') {
const metadata = result as { subscriptionId?: unknown; streamId?: unknown; type?: unknown }
if (stream.method === 'session.tabs.subscribe' && metadata.type === 'snapshot') {
stream.receivedSnapshot = true
}
if (typeof metadata.subscriptionId === 'string') {
stream.subscriptionId = metadata.subscriptionId
}
@@ -125,6 +177,7 @@ export class MobileRelayRpcStreams {
stream.cancelled = true
}
this.streams.clear()
this.cancelledSubscriptions.clear()
this.terminalListeners.clear()
this.terminalSnapshots.clear()
this.activeBrowserStream = null
@@ -136,25 +189,61 @@ export class MobileRelayRpcStreams {
return
}
stream.cancelled = true
if (stream.method === 'terminal.subscribe') {
const params = buildTerminalUnsubscribeParams(stream.params)
if (params) {
this.options.sendFrame({
id: this.options.nextId(),
method: 'terminal.unsubscribe',
params
})
if (stream.sent) {
const byParams = buildParamsUnsubscribe(stream.method, stream.params, id)
if (stream.method === 'terminal.subscribe') {
if (byParams) {
this.sendUnsubscribe(byParams)
}
} else {
const unsubscribe = stream.subscriptionId
? buildReadyStreamUnsubscribe(stream.method, stream.subscriptionId)
: null
if (byParams && stream.method === 'session.tabs.subscribe' && !stream.receivedSnapshot) {
// The host registers cleanup only after resolving the initial snapshot.
this.cancelledSubscriptions.set(id, { method: stream.method, unsubscribe: byParams })
} else if (unsubscribe || byParams) {
this.sendUnsubscribe((unsubscribe ?? byParams)!)
} else if (
stream.method === 'browser.screencast' ||
stream.method === 'runtime.clientEvents.subscribe'
) {
// Keep only the cleanup route while the server assigns its subscription ID.
this.cancelledSubscriptions.set(id, { method: stream.method })
} else if (stream.subscriptionId) {
this.sendUnsubscribe({
method: stream.method.replace(/\.subscribe$/, '.unsubscribe'),
params: { subscriptionId: stream.subscriptionId }
})
}
}
} else if (stream.subscriptionId) {
this.options.sendFrame({
id: this.options.nextId(),
method: stream.method.replace(/\.subscribe$/, '.unsubscribe'),
params: { subscriptionId: stream.subscriptionId }
})
}
this.remove(id)
}
/** Skip the unsubscribe when a live sibling shares the host cleanup token (e.g. nativeChat's
* deterministic `agent:sessionId`), since the host would evict the sibling's registration. */
private sendUnsubscribe(unsubscribe: StreamUnsubscribe): void {
if (this.hasLiveOwner(unsubscribe)) {
return
}
this.options.sendFrame({ id: this.options.nextId(), ...unsubscribe })
}
private hasLiveOwner(unsubscribe: StreamUnsubscribe): boolean {
const token = JSON.stringify(unsubscribe)
for (const [siblingId, sibling] of this.streams) {
if (sibling.cancelled || !sibling.sent) {
continue
}
const siblingUnsubscribe = buildParamsUnsubscribe(sibling.method, sibling.params, siblingId)
if (siblingUnsubscribe && JSON.stringify(siblingUnsubscribe) === token) {
return true
}
}
return false
}
private remove(id: string): void {
const stream = this.streams.get(id)
if (!stream) {
mobile/src/transport/rpc-client-terminal-subscription.ts
+6 -2
View File
@@ -38,7 +38,8 @@ export function updateTerminalSubscriptionViewport(
* the per-method echo logic out of the rpc-client teardown closure. */
export function buildStreamUnsubscribe(
method: string | undefined,
params: unknown
params: unknown,
requestId?: string
): { method: string; params: Record<string, unknown> } | null {
if (!params || typeof params !== 'object') {
return null
@@ -46,7 +47,10 @@ export function buildStreamUnsubscribe(
if (method === 'session.tabs.subscribe') {
const worktree = (params as { worktree?: unknown }).worktree
return typeof worktree === 'string'
? { method: 'session.tabs.unsubscribe', params: { worktree } }
? {
method: 'session.tabs.unsubscribe',
params: { worktree, ...(requestId ? { subscriptionId: requestId } : {}) }
}
: null
}
if (method === 'nativeChat.subscribe') {
native/computer-use-windows/runtime.ps1
+60 -7
View File
@@ -1,9 +1,15 @@
param(
[Parameter(Mandatory = $true)]
[string]$OperationPath
[Parameter(Position = 0)]
[string]$OperationPath,
# Serve mode keeps one process alive so the Add-Type P/Invoke assembly below
# is emitted once per session instead of once per operation.
[switch]$Serve
)
$ErrorActionPreference = "Stop"
# Progress records render to the host, which in serve mode is a pipe carrying
# one JSON response per line; a stray record would desynchronise the stream.
$ProgressPreference = "SilentlyContinue"
$utf8NoBom = New-Object System.Text.UTF8Encoding $false
[Console]::InputEncoding = $utf8NoBom
[Console]::OutputEncoding = $utf8NoBom
@@ -1313,9 +1319,56 @@ function Invoke-OrcaOperation($Operation) {
[pscustomobject]@{ ok = $true; action = $action; snapshot = $snapshot }
}
try {
$operation = Read-OrcaOperation $OperationPath
Write-OrcaJson (Invoke-OrcaOperation $operation)
} catch {
Write-OrcaJson ([pscustomobject]@{ ok = $false; error = [string]$_.Exception.Message })
function Invoke-OrcaServeLoop {
# Announced before the first read, and after every Add-Type above: a caller
# that never sees this line knows the helper cannot have read a request, let
# alone synthesized a click, so replaying it is provably safe. Inferring that
# from a missing response instead would replay operations that did run.
[Console]::Out.WriteLine('{"ready":true}')
[Console]::Out.Flush()
# One NDJSON request per line in, one response per line out, until stdin closes.
# Responses carry base64 screenshots and routinely exceed a megabyte; ReadLine
# and the console writer are both length-bounded only by memory.
while ($true) {
$line = [Console]::In.ReadLine()
if ($null -eq $line) { break }
if ([string]::IsNullOrWhiteSpace($line)) { continue }
$requestId = $null
try {
$operation = $line | ConvertFrom-Json
$requestId = $operation.requestId
$response = Invoke-OrcaOperation $operation
} catch {
$response = [pscustomobject]@{ ok = $false; error = [string]$_.Exception.Message }
# ConvertFrom-Json throws before the id is read, so recover it from the
# raw line. An error the caller can match is delivered to the request
# that caused it; an unmatched one only trips the caller's desync
# guard, which kills this helper, charges a failure toward its cooldown
# and discards the message below - so a malformed request would be
# reported as a broken stream and its real cause never surface.
if ($null -eq $requestId -and $line -match '"requestId"\s*:\s*(\d+)') {
$requestId = [long]$Matches[1]
}
}
# Echoed so the caller can prove which request a line answers; a reply it
# cannot match is a desynchronised stream, not a usable response.
if ($null -ne $requestId) {
$response | Add-Member -NotePropertyName requestId -NotePropertyValue $requestId -Force
}
[Console]::Out.WriteLine((ConvertTo-Json $response -Depth 100 -Compress))
[Console]::Out.Flush()
}
}
if ($Serve) {
Invoke-OrcaServeLoop
} elseif ([string]::IsNullOrWhiteSpace($OperationPath)) {
Write-OrcaJson ([pscustomobject]@{ ok = $false; error = "runtime.ps1 requires an operation path or -Serve" })
} else {
try {
$operation = Read-OrcaOperation $OperationPath
Write-OrcaJson (Invoke-OrcaOperation $operation)
} catch {
Write-OrcaJson ([pscustomobject]@{ ok = $false; error = [string]$_.Exception.Message })
}
}
pnpm-lock.yaml
Generated
+3 -3
View File
@@ -109,7 +109,7 @@ overrides:
monaco-editor>dompurify: 3.4.13
patchedDependencies:
'@vscode/windows-process-tree@0.8.0': 9217ef36c01ed74127fef5512b0c92089cdbf820fd6c109dd671137eebdc7585
'@vscode/windows-process-tree@0.8.0': f8ea245391c94da5770045aeea01fa6de466c2199c6ef46b5b769b398aa9823e
'@xterm/addon-ligatures@0.11.0-beta.300': 47405b9994b5acf1b4e90b49250358c1ca03649854d59560e7732b72fe336920
'@xterm/addon-search@0.17.0-beta.300': eee5338dd2621ece46e79c61ec06766cd7fadaf79ffdb24e2a8ab68e97ef31f0
'@xterm/addon-serialize@0.15.0-beta.300': 851eac3d75e6d8c013b9f4c053e61d824b23965cb19ecc28e335e05059f3a294
@@ -510,7 +510,7 @@ importers:
optionalDependencies:
'@vscode/windows-process-tree':
specifier: 0.8.0
version: 0.8.0(patch_hash=9217ef36c01ed74127fef5512b0c92089cdbf820fd6c109dd671137eebdc7585)
version: 0.8.0(patch_hash=f8ea245391c94da5770045aeea01fa6de466c2199c6ef46b5b769b398aa9823e)
sherpa-onnx-darwin-arm64:
specifier: 1.12.37
version: 1.12.37
@@ -9821,7 +9821,7 @@ snapshots:
convert-source-map: 2.0.0
tinyrainbow: 3.1.0
'@vscode/windows-process-tree@0.8.0(patch_hash=9217ef36c01ed74127fef5512b0c92089cdbf820fd6c109dd671137eebdc7585)':
'@vscode/windows-process-tree@0.8.0(patch_hash=f8ea245391c94da5770045aeea01fa6de466c2199c6ef46b5b769b398aa9823e)':
dependencies:
node-addon-api: 7.1.0
optional: true
src/cli/cli-error.ts
+144
View File
@@ -0,0 +1,144 @@
import { computerUseErrorRecoveryData } from '../shared/computer-use-error-recovery'
import {
matchAutomationOwnerConflict,
stripAutomationOwnerConflictCode
} from '../shared/automation-owner-conflict'
import { automationOwnerConflictRecovery } from './automation-owner-conflict-recovery'
import type { RuntimeRpcFailure } from './runtime-client'
import { RuntimeClientError, RuntimeRpcFailureError } from './runtime/types'
type CliErrorContext = {
commandPath?: readonly string[]
}
export function formatCliError(error: unknown, context: CliErrorContext = {}): string {
const message = error instanceof Error ? error.message : String(error)
if (error instanceof RuntimeClientError && error.code === 'runtime_unavailable') {
if (hasOrchestrationRequestId(error.data)) {
return message
}
return `${message}\nOrca is not running. Run 'orca open' first.`
}
// Why: error-specific recovery must win over the generic computer fallback.
// Classified from the whole error, not just `.code`: a hop that flattens the class leaves only the token.
const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error))
if (conflict) {
return formatMessageWithNextSteps(stripAutomationOwnerConflictCode(message), conflict.nextSteps)
}
if (error instanceof RuntimeClientError) {
const nextSteps = nextStepsFromData(error.data)
if (nextSteps.length > 0) {
return formatMessageWithNextSteps(message, nextSteps)
}
if (error.code === 'invalid_argument' && context.commandPath?.[0] === 'computer') {
return formatMessageWithNextSteps(
message,
computerUseErrorRecoveryData('invalid_argument')?.nextSteps ?? []
)
}
}
if (
error instanceof RuntimeRpcFailureError &&
error.response.error.code === 'runtime_unavailable'
) {
return `${message}\nOrca is not running. Run 'orca open' first.`
}
if (error instanceof RuntimeRpcFailureError) {
return formatMessageWithNextSteps(message, nextStepsFromData(error.response.error.data))
}
return message
}
function hasOrchestrationRequestId(data: unknown): boolean {
return (
data !== null &&
typeof data === 'object' &&
typeof (data as { orchestrationRequestId?: unknown }).orchestrationRequestId === 'string'
)
}
export function reportCliError(error: unknown, json: boolean, context: CliErrorContext = {}): void {
if (json) {
if (error instanceof RuntimeRpcFailureError) {
console.log(JSON.stringify(withAutomationOwnerConflictRecovery(error.response), null, 2))
} else {
const response: RuntimeRpcFailure = {
id: 'local',
ok: false,
error: {
code:
matchAutomationOwnerConflict(error) ??
(error instanceof RuntimeClientError ? error.code : 'runtime_error'),
message: stripAutomationOwnerConflictCode(
error instanceof Error ? error.message : String(error)
),
data: localCliErrorData(error, context)
},
_meta: {
runtimeId: null
}
}
console.log(JSON.stringify(response, null, 2))
}
} else {
console.error(formatCliError(error, context))
}
}
/** Machine-readable half of the same recovery the human message carries. */
function withAutomationOwnerConflictRecovery(response: RuntimeRpcFailure): RuntimeRpcFailure {
const code = matchAutomationOwnerConflict(response)
const conflict = automationOwnerConflictRecovery(code)
if (!conflict || !code) {
return response
}
return {
...response,
error: {
...response.error,
// Restores the classification a flattening hop dropped, so --json consumers read the conflict, not the transport.
code,
message: stripAutomationOwnerConflictCode(response.error.message),
data: response.error.data ?? conflict
}
}
}
function formatMessageWithNextSteps(message: string, nextSteps: readonly string[]): string {
if (nextSteps.length === 0) {
return message
}
return `${message}\n${nextSteps.map((step) => `Next step: ${step}`).join('\n')}`
}
function nextStepsFromData(data: unknown): string[] {
if (
data &&
typeof data === 'object' &&
Array.isArray((data as { nextSteps?: unknown }).nextSteps)
) {
return (data as { nextSteps: unknown[] }).nextSteps.filter(
(step): step is string => typeof step === 'string'
)
}
return []
}
function localCliErrorData(error: unknown, context: CliErrorContext): unknown {
// Why: error-specific recovery must win over the generic computer fallback.
if (error instanceof RuntimeClientError && error.data !== undefined) {
return error.data
}
const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error))
if (conflict) {
return conflict
}
if (
error instanceof RuntimeClientError &&
error.code === 'invalid_argument' &&
context.commandPath?.[0] === 'computer'
) {
return computerUseErrorRecoveryData('invalid_argument')
}
return undefined
}
src/cli/command-suggestion-budget.test.ts
+44
View File
@@ -0,0 +1,44 @@
import { afterEach, describe, expect, it, vi } from 'vitest'
import * as distance from '../shared/edit-distance'
import { suggestCommands, unknownFlagData } from './command-suggestion'
import type { CommandSpec } from './command-spec'
const specs: CommandSpec[] = [
{ path: ['list'], summary: '', usage: '', allowedFlags: [] },
{ path: ['remove'], summary: '', usage: '', allowedFlags: [], destructive: true }
]
afterEach(() => vi.restoreAllMocks())
describe('suggestion distance work', () => {
it('does no distance calculations for a long command, including destructive intent', () => {
const spy = vi.spyOn(distance, 'levenshtein')
expect(suggestCommands(specs, ['x'.repeat(32_768)])).toEqual([])
expect(spy).not.toHaveBeenCalled()
})
it('does no distance calculations for a long flag but still lists valid flags', () => {
const spy = vi.spyOn(distance, 'levenshtein')
expect(unknownFlagData('x'.repeat(32_768), ['worktree', 'json'])).toEqual({
validFlags: ['json', 'worktree'],
suggestions: [],
nextSteps: ['Valid flags: --json, --worktree']
})
expect(spy).not.toHaveBeenCalled()
})
it('keeps the inclusive three-edit suggestion boundary', () => {
expect(suggestCommands(specs, ['listxxx'])).toEqual(['list'])
expect(unknownFlagData('jsonxxx', ['json']).suggestions).toEqual(['json'])
})
it('keeps the inclusive one-edit destructive intent boundary', () => {
expect(suggestCommands(specs, ['remov'])).toEqual(['remove'])
expect(suggestCommands(specs, ['remo'])).toEqual([])
})
it('retains UTF-16 distance semantics at the length boundary', () => {
expect(unknownFlagData('json😀x', ['json']).suggestions).toEqual(['json'])
expect(unknownFlagData('json😀😀', ['json']).suggestions).toEqual([])
})
})
src/cli/command-suggestion.ts
+14 -5
View File
@@ -37,7 +37,10 @@ function destructiveVerbs(specs: CommandSpec[]): Set<string> {
// input token is itself a near-miss of a destructive verb. #6303
function intendsDestruction(inputToken: string, verbs: Set<string>): boolean {
for (const verb of verbs) {
if (levenshtein(inputToken, verb) <= DESTRUCTIVE_INTENT_THRESHOLD) {
if (
Math.abs(inputToken.length - verb.length) <= DESTRUCTIVE_INTENT_THRESHOLD &&
levenshtein(inputToken, verb) <= DESTRUCTIVE_INTENT_THRESHOLD
) {
return true
}
}
@@ -85,7 +88,9 @@ export function suggestCommands(specs: CommandSpec[], commandPath: string[]): st
continue
}
seen.add(joined)
scored.push({ label: joined, distance: levenshtein(input, joined) })
if (Math.abs(input.length - joined.length) <= SUGGESTION_THRESHOLD) {
scored.push({ label: joined, distance: levenshtein(input, joined) })
}
}
}
return rankByDistance(scored)
@@ -106,9 +111,13 @@ export type FlagErrorData = {
}
function suggestFlags(flag: string, validFlags: string[]): string[] {
return rankByDistance(
validFlags.map((candidate) => ({ label: candidate, distance: levenshtein(flag, candidate) }))
)
const scored: { label: string; distance: number }[] = []
for (const candidate of validFlags) {
if (Math.abs(flag.length - candidate.length) <= SUGGESTION_THRESHOLD) {
scored.push({ label: candidate, distance: levenshtein(flag, candidate) })
}
}
return rankByDistance(scored)
}
// Why: include the accepted set so agents can recover without another help call.
src/cli/format.ts
+3 -144
View File
@@ -1,13 +1,8 @@
import type { CliStatusResult } from '../shared/runtime-types'
import { computerUseErrorRecoveryData } from '../shared/computer-use-error-recovery'
import {
matchAutomationOwnerConflict,
stripAutomationOwnerConflictCode
} from '../shared/automation-owner-conflict'
import { automationOwnerConflictRecovery } from './automation-owner-conflict-recovery'
import { prepareComputerCliJsonResult } from './computer-format'
import type { RuntimeRpcFailure, RuntimeRpcSuccess } from './runtime-client'
import { RuntimeClientError, RuntimeRpcFailureError } from './runtime/types'
import type { RuntimeRpcSuccess } from './runtime-client'
export { formatCliError, reportCliError } from './cli-error'
export {
formatBrowserProfileList,
@@ -67,10 +62,6 @@ export {
formatWorktreeShow
} from './workspace-format'
type CliErrorContext = {
commandPath?: readonly string[]
}
export function printResult<TResult>(
response: RuntimeRpcSuccess<TResult>,
json: boolean,
@@ -83,138 +74,6 @@ export function printResult<TResult>(
console.log(formatter(response.result))
}
export function formatCliError(error: unknown, context: CliErrorContext = {}): string {
const message = error instanceof Error ? error.message : String(error)
if (error instanceof RuntimeClientError && error.code === 'runtime_unavailable') {
if (hasOrchestrationRequestId(error.data)) {
return message
}
return `${message}\nOrca is not running. Run 'orca open' first.`
}
// Why: error-specific recovery must win over the generic computer fallback.
// Classified from the whole error, not just `.code`: a hop that flattens the class leaves only the token.
const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error))
if (conflict) {
return formatMessageWithNextSteps(stripAutomationOwnerConflictCode(message), conflict.nextSteps)
}
if (error instanceof RuntimeClientError) {
const nextSteps = nextStepsFromData(error.data)
if (nextSteps.length > 0) {
return formatMessageWithNextSteps(message, nextSteps)
}
if (error.code === 'invalid_argument' && context.commandPath?.[0] === 'computer') {
return formatMessageWithNextSteps(
message,
computerUseErrorRecoveryData('invalid_argument')?.nextSteps ?? []
)
}
}
if (
error instanceof RuntimeRpcFailureError &&
error.response.error.code === 'runtime_unavailable'
) {
return `${message}\nOrca is not running. Run 'orca open' first.`
}
if (error instanceof RuntimeRpcFailureError) {
return formatMessageWithNextSteps(message, nextStepsFromData(error.response.error.data))
}
return message
}
function hasOrchestrationRequestId(data: unknown): boolean {
return (
data !== null &&
typeof data === 'object' &&
typeof (data as { orchestrationRequestId?: unknown }).orchestrationRequestId === 'string'
)
}
export function reportCliError(error: unknown, json: boolean, context: CliErrorContext = {}): void {
if (json) {
if (error instanceof RuntimeRpcFailureError) {
console.log(JSON.stringify(withAutomationOwnerConflictRecovery(error.response), null, 2))
} else {
const response: RuntimeRpcFailure = {
id: 'local',
ok: false,
error: {
code:
matchAutomationOwnerConflict(error) ??
(error instanceof RuntimeClientError ? error.code : 'runtime_error'),
message: stripAutomationOwnerConflictCode(
error instanceof Error ? error.message : String(error)
),
data: localCliErrorData(error, context)
},
_meta: {
runtimeId: null
}
}
console.log(JSON.stringify(response, null, 2))
}
} else {
console.error(formatCliError(error, context))
}
}
/** Machine-readable half of the same recovery the human message carries. */
function withAutomationOwnerConflictRecovery(response: RuntimeRpcFailure): RuntimeRpcFailure {
const code = matchAutomationOwnerConflict(response)
const conflict = automationOwnerConflictRecovery(code)
if (!conflict || !code) {
return response
}
return {
...response,
error: {
...response.error,
// Restores the classification a flattening hop dropped, so --json consumers read the conflict, not the transport.
code,
message: stripAutomationOwnerConflictCode(response.error.message),
data: response.error.data ?? conflict
}
}
}
function formatMessageWithNextSteps(message: string, nextSteps: readonly string[]): string {
if (nextSteps.length === 0) {
return message
}
return `${message}\n${nextSteps.map((step) => `Next step: ${step}`).join('\n')}`
}
function nextStepsFromData(data: unknown): string[] {
if (
data &&
typeof data === 'object' &&
Array.isArray((data as { nextSteps?: unknown }).nextSteps)
) {
return (data as { nextSteps: unknown[] }).nextSteps.filter(
(step): step is string => typeof step === 'string'
)
}
return []
}
function localCliErrorData(error: unknown, context: CliErrorContext): unknown {
// Why: error-specific recovery must win over the generic computer fallback.
if (error instanceof RuntimeClientError && error.data !== undefined) {
return error.data
}
const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error))
if (conflict) {
return conflict
}
if (
error instanceof RuntimeClientError &&
error.code === 'invalid_argument' &&
context.commandPath?.[0] === 'computer'
) {
return computerUseErrorRecoveryData('invalid_argument')
}
return undefined
}
export type HostListEntry = {
kind: 'local' | 'ssh' | 'environment'
name: string
src/cli/index.ts
+1 -1
View File
@@ -15,7 +15,7 @@ import {
resolveHostFlagEnvironmentId
} from './execution-host-flag'
import { listSshTargets } from './host-selector-alternatives'
import { reportCliError } from './format'
import { reportCliError } from './cli-error'
import { printHelp } from './help'
import type { RuntimeClient } from './runtime-client'
import { COMMAND_SPECS } from './specs'
src/cli/runtime-client-deferral.test.ts
+3 -4
View File
@@ -84,14 +84,12 @@ describe('RuntimeClient module-graph deferral', () => {
process.exitCode = 0
})
// Why: the whole point of the change. These six modules load on EVERY
// invocation, so a value-import of the barrel from any of them drags the
// RuntimeClient graph (zod, ws, tweetnacl) back onto the --help path.
// These eager modules must not pull the RuntimeClient dependency graph into help.
it.each([
'args.ts',
'flags.ts',
'dispatch.ts',
'format.ts',
'cli-error.ts',
'selectors.ts',
'execution-host-flag.ts'
])('%s imports error classes from ./runtime/types, not the barrel', (file) => {
@@ -110,6 +108,7 @@ describe('RuntimeClient module-graph deferral', () => {
expect(source).toContain("import type { RuntimeClient } from './runtime-client'")
expect(source).not.toMatch(/^import \{[^}]*RuntimeClient[^}]*\} from '\.\/runtime-client'/m)
expect(source).toContain("await import('./runtime-client.js')")
expect(source).toContain("import { reportCliError } from './cli-error'")
})
it('constructs no client for --help', async () => {
src/cli/runtime/transport-framing.test.ts
+150
View File
@@ -0,0 +1,150 @@
import { EventEmitter } from 'node:events'
import { StringDecoder } from 'node:string_decoder'
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
import type { RuntimeMetadata } from '../../shared/runtime-bootstrap'
import { sendRequest } from './transport'
const { createConnection } = vi.hoisted(() => ({ createConnection: vi.fn() }))
vi.mock('node:net', () => ({ createConnection }))
vi.mock('node:crypto', () => ({ randomUUID: () => 'request-1' }))
const metadata: RuntimeMetadata = {
runtimeId: 'runtime-1',
pid: 123,
transports: [{ kind: 'unix', endpoint: 'test-only' }],
authToken: 'token',
startedAt: 1
}
const reply = (result: unknown) =>
`${JSON.stringify({ id: 'request-1', ok: true, result, _meta: { runtimeId: 'runtime-1' } })}\n`
class TestSocket extends EventEmitter {
setEncoding = vi.fn()
write = vi.fn()
end = vi.fn()
destroy = vi.fn()
}
let socket: TestSocket
beforeEach(() => {
socket = new TestSocket()
createConnection.mockReturnValue(socket)
})
afterEach(() => {
vi.restoreAllMocks()
vi.useRealTimers()
})
describe('CLI runtime response framing', () => {
it.each([1, 7, 256, 4096])(
'reads a fragmented response with %i-character chunks',
async (size) => {
const result = { data: '界😀'.repeat(10000) }
const encoded = reply(result)
const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
for (let offset = 0; offset < encoded.length; offset += size) {
socket.emit('data', encoded.slice(offset, offset + size))
}
await expect(pending).resolves.toMatchObject({ result })
expect(socket.setEncoding).toHaveBeenCalledExactlyOnceWith('utf8')
expect(socket.end).toHaveBeenCalledOnce()
}
)
it('accepts Unicode split across socket bytes using the existing UTF-8 decoder', async () => {
const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
const decoder = new StringDecoder('utf8')
for (const byte of Buffer.from(reply({ data: '界😀é' }))) {
socket.emit('data', decoder.write(Buffer.from([byte])))
}
socket.emit('data', decoder.end())
await expect(pending).resolves.toMatchObject({ result: { data: '界😀é' } })
})
it('searches each fragment once without rescanning the accumulated reply', async () => {
const encoded = reply({ data: 'x'.repeat(1024 * 1024) })
const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
const originalIndexOf = String.prototype.indexOf
let searchedCharacters = 0
const search = vi
.spyOn(String.prototype, 'indexOf')
.mockImplementation(function (this: string, value, position) {
if (value === '\n') {
searchedCharacters += this.length - (position ?? 0)
}
return originalIndexOf.call(this, value, position)
})
try {
for (let offset = 0; offset < encoded.length; offset += 256) {
socket.emit('data', encoded.slice(offset, offset + 256))
}
} finally {
search.mockRestore()
}
await expect(pending).resolves.toMatchObject({ ok: true })
expect(searchedCharacters).toBe(encoded.length)
})
it('refreshes keepalives across chunks and ignores blanks and data after the final frame', async () => {
vi.useFakeTimers()
const pending = sendRequest(metadata, 'terminal.read', {}, 100)
await vi.advanceTimersByTimeAsync(90)
socket.emit('data', ' \r\n{"_keep')
socket.emit('data', 'alive":true}\n\t\n')
await vi.advanceTimersByTimeAsync(90)
socket.emit('data', `${reply({ data: 'done' })}invalid JSON\n`)
socket.emit('data', 'more ignored data')
await expect(pending).resolves.toMatchObject({ result: { data: 'done' } })
expect(socket.end).toHaveBeenCalledOnce()
expect(vi.getTimerCount()).toBe(0)
})
it.each([
['broken JSON\n', 'invalid_runtime_response'],
['{}\n', 'invalid_runtime_response'],
['{"id":"other","ok":true,"result":{}}\n', 'invalid_runtime_response'],
[
'{"id":"request-1","ok":true,"result":{},"_meta":{"runtimeId":"other"}}\n',
'runtime_unavailable'
]
])(
'rejects a fragmented invalid first frame before subsequent valid frames',
async (line, code) => {
const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
socket.emit('data', line.slice(0, 2))
socket.emit('data', line.slice(2) + reply({ data: 'ignored' }))
await expect(pending).rejects.toMatchObject({ code })
expect(socket.end).toHaveBeenCalledOnce()
}
)
it('preserves terminal failure envelopes', async () => {
const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
socket.emit('data', '{"id":"request-1","ok":false,"error":{"code":"bad","message":"no"}}\n')
await expect(pending).resolves.toMatchObject({
ok: false,
error: { code: 'bad', message: 'no' }
})
})
it('rejects close with an incomplete frame and does not parse later data', async () => {
const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
socket.emit('data', '{"id":')
socket.emit('close')
socket.emit('data', reply({ data: 'ignored' }))
await expect(pending).rejects.toMatchObject({ code: 'runtime_unavailable' })
expect(socket.end).toHaveBeenCalledOnce()
})
it('destroys a timed out socket holding an incomplete frame', async () => {
vi.useFakeTimers()
const pending = sendRequest(metadata, 'terminal.read', {}, 100)
const rejected = expect(pending).rejects.toMatchObject({ code: 'runtime_timeout' })
socket.emit('data', '{"id":')
await vi.advanceTimersByTimeAsync(100)
socket.emit('data', reply({ data: 'ignored' }))
await rejected
expect(socket.destroy).toHaveBeenCalledOnce()
expect(vi.getTimerCount()).toBe(0)
})
})
src/cli/runtime/transport.ts
+18 -9
View File
@@ -31,7 +31,7 @@ export async function sendRequest<TResult>(
return
}
const socket = createConnection(transport.endpoint)
let buffer = ''
let lineSegments: string[] = []
let settled = false
const requestId = randomUUID()
@@ -40,6 +40,7 @@ export async function sendRequest<TResult>(
return
}
settled = true
lineSegments = []
socket.destroy()
reject(
new RuntimeClientError(
@@ -56,6 +57,7 @@ export async function sendRequest<TResult>(
return
}
settled = true
lineSegments = []
clearTimeout(timeout)
socket.end()
if (result.ok === false) {
@@ -89,18 +91,27 @@ export async function sendRequest<TResult>(
})
})
socket.on('data', (chunk: string) => {
buffer += chunk
// Why: the server may interleave `{"_keepalive":true}\n` frames with the
// final success/failure frame to keep both idle timers alive during a
// long-poll (see design doc §3.1). Read frames in a loop until we see a
// terminal frame. Each keepalive refreshes the client-side timer so a
// 10 min wait doesn't trip the 60 s default ceiling.
let newlineIndex = buffer.indexOf('\n')
while (newlineIndex !== -1 && !settled) {
const line = buffer.slice(0, newlineIndex)
buffer = buffer.slice(newlineIndex + 1)
let cursor = 0
while (cursor < chunk.length && !settled) {
const newlineIndex = chunk.indexOf('\n', cursor)
if (newlineIndex === -1) {
lineSegments.push(chunk.slice(cursor))
return
}
const segment = chunk.slice(cursor, newlineIndex)
let line = segment
if (lineSegments.length > 0) {
lineSegments.push(segment)
line = lineSegments.join('')
lineSegments = []
}
cursor = newlineIndex + 1
if (line.trim().length === 0) {
newlineIndex = buffer.indexOf('\n')
continue
}
@@ -124,7 +135,6 @@ export async function sendRequest<TResult>(
// major). See §7 risk #9.
if (isKeepaliveFrame(raw)) {
timeout.refresh()
newlineIndex = buffer.indexOf('\n')
continue
}
@@ -150,7 +160,6 @@ export async function sendRequest<TResult>(
const frame = parsed.data
if ('_keepalive' in frame) {
timeout.refresh()
newlineIndex = buffer.indexOf('\n')
continue
}
src/main/artifacts/artifact-create-intent-store.test.ts
+34 -12
View File
@@ -1,4 +1,3 @@
import { execFileSync } from 'node:child_process'
import { mkdtemp, readFile, readdir, rm, stat, truncate, writeFile } from 'node:fs/promises'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
@@ -16,9 +15,14 @@ import {
getOrCreateArtifactCreateIntent,
removeArtifactCreateIntent
} from './artifact-create-intent-store'
import { runProcessSync } from '../../shared/child-process/run-process'
import { __resetSecureFileWindowsUserSidForTests } from '../../shared/secure-file'
import type { ArtifactShareScope } from './artifact-share-record-store'
vi.mock('node:child_process', () => ({ execFile: vi.fn(), execFileSync: vi.fn() }))
vi.mock('../../shared/child-process/run-process', () => ({
runProcess: vi.fn(),
runProcessSync: vi.fn()
}))
const createdPaths: string[] = []
const scope: ArtifactShareScope = {
@@ -168,12 +172,26 @@ describe('artifact create intent store', () => {
expect((await readdir(directory)).some((name) => name.endsWith('.tmp'))).toBe(false)
})
it('hardens one Windows journal directory without per-file PowerShell launches', async () => {
it('hardens one Windows journal directory without per-file ACL launches', async () => {
const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
vi.mocked(execFileSync).mockImplementation((file) =>
String(file).endsWith('whoami.exe') ? '"USER","S-1-5-21-1000"' : ''
)
const ok = { code: 0, signal: null, stdout: '', stderr: '', timedOut: false }
// Earlier cases in this file already resolved (and cached) the SID against an unstubbed mock.
__resetSecureFileWindowsUserSidForTests()
vi.mocked(runProcessSync).mockImplementation((spec) => {
if (spec.program.endsWith('whoami.exe')) {
return { ...ok, stdout: '"USER","S-1-5-21-1000"' }
}
const args = spec.args ?? []
if (args.length > 1) {
return ok // /reset and the /grant:r pass
}
// The verify pass re-reads the DACL; answer with the three protected inheritable rules.
const rules = ['host\\me', 'NT AUTHORITY\\SYSTEM', 'BUILTIN\\Administrators'].map(
(name, index) => (index === 0 ? `${args[0]} ${name}:(OI)(CI)(F)` : ` ${name}:(OI)(CI)(F)`)
)
return { ...ok, stdout: `${rules.join('\r\n')}\r\n\r\nSuccessfully processed 1 files\r\n` }
})
try {
const userDataPath = await createUserDataPath()
getOrCreateArtifactCreateIntent(
@@ -193,16 +211,20 @@ describe('artifact create intent store', () => {
body
)
const powershellCalls = vi
.mocked(execFileSync)
.mock.calls.filter(([file]) => String(file).endsWith('powershell.exe'))
expect(powershellCalls).toHaveLength(1)
expect((powershellCalls[0]![1] as string[]).at(-1)).toBe('1')
// One harden across both intents: counted by its /reset pass, which opens each harden.
const aclCalls = vi
.mocked(runProcessSync)
.mock.calls.map(([spec]) => spec)
.filter((spec) => spec.program.endsWith('icacls.exe'))
expect(aclCalls.filter((spec) => spec.args?.includes('/reset'))).toHaveLength(1)
// The child intent files rely on inheritance, so the directory rules must carry (OI)(CI).
const grant = aclCalls.find((spec) => spec.args?.includes('/grant:r'))
expect(grant?.args?.filter((arg) => arg.endsWith(':(OI)(CI)(F)'))).toHaveLength(3)
} finally {
if (originalPlatform) {
Object.defineProperty(process, 'platform', originalPlatform)
}
vi.mocked(execFileSync).mockReset()
vi.mocked(runProcessSync).mockReset()
}
})
src/main/browser/browser-clicked-link-routing.test.ts
+89 -19
View File
@@ -10,6 +10,7 @@ import {
} from './browser-clicked-link-routing'
const FOREGROUND_FRAME_NAME = '__orca_clicked_link_foreground_test'
const BACKGROUND_FRAME_NAME = '__orca_clicked_link_background_test'
type RoutingGlobal = typeof globalThis & {
__orcaBrowserClickedLinkRouting?: {
@@ -32,7 +33,7 @@ function resetRouting(): void {
}
function installRouting(isMac = true): void {
installBrowserClickedLinkRouting(FOREGROUND_FRAME_NAME, isMac, true)
installBrowserClickedLinkRouting(FOREGROUND_FRAME_NAME, BACKGROUND_FRAME_NAME, isMac, true)
}
function clickLink(
@@ -90,7 +91,7 @@ describe('browser clicked-link routing', () => {
expect(clickLink(link, { metaKey: true }).open).not.toHaveBeenCalled()
expect(clickLink(link, { ctrlKey: true }).open).toHaveBeenCalledWith(
'https://example.com/reference',
FOREGROUND_FRAME_NAME
BACKGROUND_FRAME_NAME
)
})
@@ -102,7 +103,7 @@ describe('browser clicked-link routing', () => {
expect(clickLink(link, { type: 'auxclick' }).open).toHaveBeenCalledWith(
'https://example.com/reference',
FOREGROUND_FRAME_NAME
BACKGROUND_FRAME_NAME
)
expect(clickLink(link, { metaKey: true, shiftKey: true }).open).toHaveBeenCalledWith(
'https://example.com/reference',
@@ -110,6 +111,28 @@ describe('browser clicked-link routing', () => {
)
})
it.each([true, false])('routes Shift+middle-click to the foreground (isMac=%s)', (isMac) => {
const link = document.createElement('a')
link.href = 'https://example.com/reference'
document.body.append(link)
installRouting(isMac)
const { event, open } = clickLink(link, { type: 'auxclick', shiftKey: true })
expect(event.defaultPrevented).toBe(true)
expect(open).toHaveBeenCalledWith(link.href, FOREGROUND_FRAME_NAME)
resetRouting()
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
FOREGROUND_FRAME_NAME,
BACKGROUND_FRAME_NAME,
isMac,
true
)
const iframeClick = clickLink(link, { type: 'auxclick', shiftKey: true })
expect(iframeClick.event.defaultPrevented).toBe(true)
expect(iframeClick.open).toHaveBeenCalledWith(link.href, FOREGROUND_FRAME_NAME)
})
it('honors page cancellation and observes link rewrites before routing', () => {
const cancelled = document.createElement('a')
cancelled.href = 'https://example.com/original'
@@ -180,21 +203,35 @@ describe('browser clicked-link routing', () => {
const link = document.createElement('a')
link.href = 'https://example.com/reference'
document.body.append(link)
installBrowserClickedLinkRouting('__orca_clicked_link_old_fg', true, true)
installBrowserClickedLinkRouting('__orca_clicked_link_new_fg', false, true)
installBrowserClickedLinkRouting(
'__orca_clicked_link_old_fg',
'__orca_clicked_link_old_bg',
true,
true
)
installBrowserClickedLinkRouting(
'__orca_clicked_link_new_fg',
'__orca_clicked_link_new_bg',
false,
true
)
expect(addEventListener.mock.calls.filter(([event]) => event === 'click')).toHaveLength(1)
expect(clickLink(link, { ctrlKey: true }).open).toHaveBeenCalledWith(
'https://example.com/reference',
'__orca_clicked_link_new_fg'
'__orca_clicked_link_new_bg'
)
})
it('builds a self-contained isolated-world script', () => {
const script = buildBrowserClickedLinkRoutingScript(FOREGROUND_FRAME_NAME, false)
const script = buildBrowserClickedLinkRoutingScript(
FOREGROUND_FRAME_NAME,
BACKGROUND_FRAME_NAME,
false
)
expect(script).toContain('installBrowserClickedLinkRouting')
expect(script).toContain(`"${FOREGROUND_FRAME_NAME}",false`)
expect(script).toContain(`"${FOREGROUND_FRAME_NAME}","${BACKGROUND_FRAME_NAME}",false`)
expect(script).not.toContain('BrowserClickedLinkRoutingState')
})
@@ -203,7 +240,12 @@ describe('browser clicked-link routing', () => {
link.href = 'https://example.com/from-frame'
link.target = '_blank'
document.body.append(link)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
FOREGROUND_FRAME_NAME,
BACKGROUND_FRAME_NAME,
true,
true
)
const { event, open } = clickLink(link)
@@ -216,20 +258,35 @@ describe('browser clicked-link routing', () => {
blank.href = 'https://example.com/new-context'
blank.target = '_blank'
document.body.append(blank)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
FOREGROUND_FRAME_NAME,
BACKGROUND_FRAME_NAME,
true,
true
)
expect(clickLink(blank, { metaKey: true }).open).toHaveBeenCalledWith(
'https://example.com/new-context',
FOREGROUND_FRAME_NAME
BACKGROUND_FRAME_NAME
)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
FOREGROUND_FRAME_NAME,
BACKGROUND_FRAME_NAME,
true,
true
)
expect(clickLink(blank, { type: 'auxclick' }).open).toHaveBeenCalledWith(
'https://example.com/new-context',
FOREGROUND_FRAME_NAME
BACKGROUND_FRAME_NAME
)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
FOREGROUND_FRAME_NAME,
BACKGROUND_FRAME_NAME,
true,
true
)
expect(clickLink(blank, { metaKey: true, shiftKey: true }).open).toHaveBeenCalledWith(
'https://example.com/new-context',
FOREGROUND_FRAME_NAME
@@ -243,7 +300,12 @@ describe('browser clicked-link routing', () => {
const ordinary = document.createElement('a')
ordinary.href = 'https://example.com/current'
document.body.append(blank, ordinary)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
FOREGROUND_FRAME_NAME,
BACKGROUND_FRAME_NAME,
true,
true
)
expect(clickLink(blank, { ctrlKey: true }).open).not.toHaveBeenCalled()
expect(clickLink(blank, { shiftKey: true }).open).not.toHaveBeenCalled()
@@ -257,8 +319,12 @@ describe('browser clicked-link routing', () => {
frameLink.href = 'https://example.com/frame-synthetic'
frameLink.target = '_blank'
document.body.append(mainLink, frameLink)
installBrowserClickedLinkRouting(FOREGROUND_FRAME_NAME, true)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true)
installBrowserClickedLinkRouting(FOREGROUND_FRAME_NAME, BACKGROUND_FRAME_NAME, true)
cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
FOREGROUND_FRAME_NAME,
BACKGROUND_FRAME_NAME,
true
)
expect(clickLink(mainLink, { metaKey: true }).open).not.toHaveBeenCalled()
expect(clickLink(frameLink).open).not.toHaveBeenCalled()
@@ -266,9 +332,13 @@ describe('browser clicked-link routing', () => {
})
it('builds a self-contained iframe script with per-frame routing tokens', () => {
const script = buildBrowserIframeClickedLinkRoutingScript(FOREGROUND_FRAME_NAME, false)
const script = buildBrowserIframeClickedLinkRoutingScript(
FOREGROUND_FRAME_NAME,
BACKGROUND_FRAME_NAME,
false
)
expect(script).toContain('installBrowserIframeClickedLinkRouting')
expect(script).toContain(`"${FOREGROUND_FRAME_NAME}",false`)
expect(script).toContain(`"${FOREGROUND_FRAME_NAME}","${BACKGROUND_FRAME_NAME}",false`)
})
})
src/main/browser/browser-clicked-link-routing.ts
+33 -13
View File
@@ -1,7 +1,13 @@
export const BROWSER_CLICKED_LINK_ROUTING_WORLD_ID = 1208
export type BrowserClickedLinkFrameNames = {
foreground: string
background: string
}
type BrowserClickedLinkRoutingState = {
frameName: string
foregroundFrameName: string
backgroundFrameName: string
isMac: boolean
allowUntrustedEvents: boolean
listener: (event: MouseEvent) => void
@@ -16,21 +22,24 @@ type BrowserClickedLinkRoutingGlobal = typeof globalThis & {
* can distinguish them from opener-dependent window.open calls.
*/
export function installBrowserClickedLinkRouting(
frameName: string,
foregroundFrameName: string,
backgroundFrameName: string,
isMac: boolean,
allowUntrustedEvents = false
): void {
const routingGlobal = globalThis as BrowserClickedLinkRoutingGlobal
const existing = routingGlobal.__orcaBrowserClickedLinkRouting
if (existing) {
existing.frameName = frameName
existing.foregroundFrameName = foregroundFrameName
existing.backgroundFrameName = backgroundFrameName
existing.isMac = isMac
existing.allowUntrustedEvents = allowUntrustedEvents
return
}
const state: BrowserClickedLinkRoutingState = {
frameName,
foregroundFrameName,
backgroundFrameName,
isMac,
allowUntrustedEvents,
listener: () => {}
@@ -68,7 +77,7 @@ export function installBrowserClickedLinkRouting(
}
// Shift alone is browser-native new-window intent; keep OAuth and other
// opener-dependent window flows in Orca's guarded popup window.
if (event.shiftKey && !modifierClick) {
if (event.shiftKey && !modifierClick && !middleClick) {
return
}
@@ -101,7 +110,11 @@ export function installBrowserClickedLinkRouting(
// with the same disposition. The private frame name preserves that one
// distinction without weakening OAuth popups that need window.opener.
event.preventDefault()
window.open(targetUrl.toString(), state.frameName)
const openInBackground = (middleClick || modifierClick) && !event.shiftKey
window.open(
targetUrl.toString(),
openInBackground ? state.backgroundFrameName : state.foregroundFrameName
)
}
routingGlobal.__orcaBrowserClickedLinkRouting = state
@@ -116,7 +129,8 @@ export function installBrowserClickedLinkRouting(
* API cannot reach, so this runs in the page world against a one-use token.
*/
export function installBrowserIframeClickedLinkRouting(
frameName: string,
foregroundFrameName: string,
backgroundFrameName: string,
isMac: boolean,
allowUntrustedEvents = false
): () => void {
@@ -148,7 +162,7 @@ export function installBrowserIframeClickedLinkRouting(
const modifierClick = isMac ? event.metaKey : event.ctrlKey
const otherPlatformModifier = isMac ? event.ctrlKey : event.metaKey
if (otherPlatformModifier || (event.shiftKey && !modifierClick)) {
if (otherPlatformModifier || (event.shiftKey && !modifierClick && !middleClick)) {
return
}
@@ -179,7 +193,8 @@ export function installBrowserIframeClickedLinkRouting(
// A page that observes a real click cannot replay it to create more tabs.
event.preventDefault()
cleanup()
window.open(targetUrl.toString(), frameName)
const openInBackground = (middleClick || modifierClick) && !event.shiftKey
window.open(targetUrl.toString(), openInBackground ? backgroundFrameName : foregroundFrameName)
}
const cleanup = (): void => {
@@ -191,13 +206,18 @@ export function installBrowserIframeClickedLinkRouting(
return cleanup
}
export function buildBrowserClickedLinkRoutingScript(frameName: string, isMac: boolean): string {
return `(${installBrowserClickedLinkRouting.toString()})(${JSON.stringify(frameName)},${JSON.stringify(isMac)});`
export function buildBrowserClickedLinkRoutingScript(
foregroundFrameName: string,
backgroundFrameName: string,
isMac: boolean
): string {
return `(${installBrowserClickedLinkRouting.toString()})(${JSON.stringify(foregroundFrameName)},${JSON.stringify(backgroundFrameName)},${JSON.stringify(isMac)});`
}
export function buildBrowserIframeClickedLinkRoutingScript(
frameName: string,
foregroundFrameName: string,
backgroundFrameName: string,
isMac: boolean
): string {
return `void (${installBrowserIframeClickedLinkRouting.toString()})(${JSON.stringify(frameName)},${JSON.stringify(isMac)});`
return `void (${installBrowserIframeClickedLinkRouting.toString()})(${JSON.stringify(foregroundFrameName)},${JSON.stringify(backgroundFrameName)},${JSON.stringify(isMac)});`
}
src/main/browser/browser-client-upload-transfer.test.ts
+36 -1
View File
@@ -1,4 +1,4 @@
import { describe, expect, it } from 'vitest'
import { describe, expect, it, vi } from 'vitest'
import type { BrowserClientHostCommandEvent } from '../../shared/browser-client-host-protocol'
import {
@@ -102,3 +102,38 @@ describe('readBrowserClientUploadPaths', () => {
)
})
})
it.each([0, 1, 128 * 1024])(
'avoids recopying 16 single-chunk uploads of %i bytes',
async (size) => {
const source = Buffer.alloc(size, 171)
const response = {
contentBase64: source.toString('base64'),
bytesRead: size,
totalBytes: size,
eof: true
}
const remotePaths = Array.from({ length: 16 }, (_, i) => `file-${i}.bin`)
const request = vi.fn(async () => response)
const concat = vi.spyOn(Buffer, 'concat')
let copies = 0
let files: Awaited<ReturnType<typeof fetchBrowserClientUploadFiles>>
try {
files = await fetchBrowserClientUploadFiles({ request, event, remotePaths })
copies = concat.mock.calls.length
} finally {
concat.mockRestore()
}
expect(copies).toBe(0)
expect(request).toHaveBeenCalledTimes(16)
expect(files.map((file) => file.remotePath)).toEqual(remotePaths)
for (const file of files) {
expect(file.contents).toEqual(source)
}
if (size > 0) {
files[0].contents[0] = 0
expect(files[1].contents[0]).toBe(171)
expect(source[0]).toBe(171)
}
}
)
src/main/browser/browser-client-upload-transfer.ts
+1 -1
View File
@@ -74,7 +74,7 @@ export async function fetchBrowserClientUploadFiles(options: {
throw new Error('browser_client_upload_transfer_stalled')
}
}
files.push({ remotePath, contents: Buffer.concat(chunks) })
files.push({ remotePath, contents: chunks.length === 1 ? chunks[0] : Buffer.concat(chunks) })
}
return files
}
src/main/browser/browser-manager-final.ts
+3 -2
View File
@@ -3,7 +3,7 @@ import { normalizeBrowserNavigationUrl } from '../../shared/browser-url'
import { BrowserManagerEventForwarding } from './browser-manager-event-forwarding'
export abstract class BrowserManagerFinal extends BrowserManagerEventForwarding {
protected openLinkInOrcaTab(browserTabId: string, rawUrl: string): boolean {
protected openLinkInOrcaTab(browserTabId: string, rawUrl: string, activate?: boolean): boolean {
const renderer = this.resolveRendererForBrowserTab(browserTabId)
if (!renderer) {
return false
@@ -15,7 +15,8 @@ export abstract class BrowserManagerFinal extends BrowserManagerEventForwarding
// Why: only the renderer owns Orca's worktree/tab model; main forwards a validated URL, never letting guest content mutate it.
renderer.send('browser:open-link-in-orca-tab', {
browserPageId: browserTabId,
url: normalizedUrl
url: normalizedUrl,
...(activate === false ? { activate: false } : {})
})
return true
}
src/main/browser/browser-manager-guest-cleanup.ts
-1
View File
@@ -20,7 +20,6 @@ export abstract class BrowserManagerGuestCleanup extends BrowserManagerGuestNavi
this.policyCleanupByGuestId.delete(guestWebContentsId)
}
this.policyAttachedGuestIds.delete(guestWebContentsId)
this.clickedLinkFrameNameByGuestId.delete(guestWebContentsId)
this.offscreenGuestIds.delete(guestWebContentsId)
this.popupOwnerContextByGuestId.delete(guestWebContentsId)
this.pageInitiatedTabBudgetByRootGuestId.delete(guestWebContentsId)
src/main/browser/browser-manager-guest-lifecycle.test.ts
+5 -7
View File
@@ -288,19 +288,17 @@ describe('browserManager', () => {
webContentsId: 102,
rendererWebContentsId
})
// Why: attach-before-registration teardown skips unregisterGuest, so global
// cleanup must independently release the private click-routing token.
browserManager.attachGuestPolicies({ ...guest, id: 103 } as never)
// Guests attached before registration still need their policy listeners released.
const unregisteredGuestOff = vi.fn()
browserManager.attachGuestPolicies({ ...guest, id: 103, off: unregisteredGuestOff } as never)
browserManager.unregisterAll()
expect(browserManager.getGuestWebContentsId('browser-1')).toBeNull()
expect(browserManager.getGuestWebContentsId('browser-2')).toBeNull()
expect(guestOffMock).toHaveBeenCalled()
const managerState = browserManager as unknown as {
clickedLinkFrameNameByGuestId: Map<number, unknown>
}
expect(managerState.clickedLinkFrameNameByGuestId.size).toBe(0)
expect(unregisteredGuestOff).toHaveBeenCalledWith('dom-ready', expect.any(Function))
expect(unregisteredGuestOff).toHaveBeenCalledWith('frame-created', expect.any(Function))
})
it('rejects non-webview guest types to prevent privilege escalation', () => {
src/main/browser/browser-manager-guest-policy.ts
+1 -10
View File
@@ -1,4 +1,3 @@
import { randomUUID } from 'node:crypto'
import {
BROWSING_GUEST_POLICY,
type BrowserGuestPolicy,
@@ -27,18 +26,10 @@ export abstract class BrowserManagerGuestPolicy extends BrowserManagerGuestClean
if (inheritedOwnerContext) {
this.popupOwnerContextByGuestId.set(guest.id, inheritedOwnerContext)
}
// Why: only the primary embedded browser converts new-tab clicks to Orca tabs; OAuth child windows keep native link behavior.
const clickedLinkFrameName = inheritedOwnerContext
? null
: `__orca_clicked_link_foreground_${randomUUID()}`
if (clickedLinkFrameName) {
this.clickedLinkFrameNameByGuestId.set(guest.id, clickedLinkFrameName)
}
const disposeAuthDetachTracking = this.trackDebuggerDetachForAuthUserAgent(guest)
// Why: disable throttling so background screenshots still get frames; else the compositor stalls and capture returns empty.
guest.setBackgroundThrottling(false)
const disposePopupPolicy = this.installGuestPopupPolicy(guest, clickedLinkFrameName)
const disposePopupPolicy = this.installGuestPopupPolicy(guest, !inheritedOwnerContext)
const disposeNavigationPolicy = this.installGuestNavigationPolicy(guest)
// Why: store cleanup so unregisterGuest can drop these listeners on teardown and let the WebContents wrapper GC.
src/main/browser/browser-manager-guest-popup-policy.ts
+73 -35
View File
@@ -9,7 +9,8 @@ import {
import {
BROWSER_CLICKED_LINK_ROUTING_WORLD_ID,
buildBrowserClickedLinkRoutingScript,
buildBrowserIframeClickedLinkRoutingScript
buildBrowserIframeClickedLinkRoutingScript,
type BrowserClickedLinkFrameNames
} from './browser-clicked-link-routing'
import { isNewBrowserTabPopupIntent } from './browser-popup-new-tab-intent'
import { SAFE_POPUP_WINDOW_OPTIONS, safeOrigin } from './browser-manager-types'
@@ -19,11 +20,18 @@ import { BrowserManagerNavigation } from './browser-manager-navigation'
export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavigation {
protected installGuestPopupPolicy(
guest: Electron.WebContents,
clickedLinkFrameName: string | null
routeClickedLinks: boolean
): () => void {
let clickedLinkRoutingActive = Boolean(clickedLinkFrameName)
// OAuth child windows keep native link behavior.
const clickedLinkFrameNames: BrowserClickedLinkFrameNames | null = routeClickedLinks
? {
foreground: `__orca_clicked_link_foreground_${randomUUID()}`,
background: `__orca_clicked_link_background_${randomUUID()}`
}
: null
let clickedLinkRoutingActive = routeClickedLinks
const installClickedLinkRouting = (): void => {
if (!clickedLinkRoutingActive || !clickedLinkFrameName || guest.isDestroyed()) {
if (!clickedLinkRoutingActive || !clickedLinkFrameNames || guest.isDestroyed()) {
return
}
// Why: an isolated-world listener labels real anchor clicks without exposing the frame name to page scripts.
@@ -34,7 +42,8 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
{
// Why: mobile emulation spoofs the UA as iOS, so use the real host platform from main for modifier routing.
code: buildBrowserClickedLinkRoutingScript(
clickedLinkFrameName,
clickedLinkFrameNames.foreground,
clickedLinkFrameNames.background,
process.platform === 'darwin'
)
}
@@ -43,36 +52,50 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
)
.catch(() => {})
}
if (clickedLinkFrameName) {
if (clickedLinkFrameNames) {
guest.on('dom-ready', installClickedLinkRouting)
}
const pendingIframeRoutingInstalls = new Map<Electron.WebFrameMain, () => void>()
const iframeFrameNameByFrame = new Map<Electron.WebFrameMain, string>()
const iframeFrameByFrameName = new Map<string, Electron.WebFrameMain>()
const iframeFrameNamesByFrame = new Map<Electron.WebFrameMain, BrowserClickedLinkFrameNames>()
const iframeRoutingByFrameName = new Map<
string,
{ frame: Electron.WebFrameMain; activate: boolean }
>()
const clearIframeFrameName = (frame: Electron.WebFrameMain): void => {
const name = iframeFrameNameByFrame.get(frame)
if (!name) {
const names = iframeFrameNamesByFrame.get(frame)
if (!names) {
return
}
iframeFrameNameByFrame.delete(frame)
iframeFrameByFrameName.delete(name)
iframeFrameNamesByFrame.delete(frame)
for (const name of [names.foreground, names.background]) {
iframeRoutingByFrameName.delete(name)
}
}
const installIframeClickedLinkRouting = (frame: Electron.WebFrameMain): void => {
clearIframeFrameName(frame)
if (!clickedLinkRoutingActive || frame.isDestroyed()) {
return
}
const name = `__orca_clicked_link_iframe_foreground_${randomUUID()}`
iframeFrameNameByFrame.set(frame, name)
iframeFrameByFrameName.set(name, frame)
const foregroundName = `__orca_clicked_link_iframe_foreground_${randomUUID()}`
const backgroundName = `__orca_clicked_link_iframe_background_${randomUUID()}`
iframeFrameNamesByFrame.set(frame, {
foreground: foregroundName,
background: backgroundName
})
iframeRoutingByFrameName.set(foregroundName, { frame, activate: true })
iframeRoutingByFrameName.set(backgroundName, { frame, activate: false })
// Why: child-frame tokens live in the page world, so consume after one trusted click and replace before the next.
void frame
.executeJavaScript(
buildBrowserIframeClickedLinkRoutingScript(name, process.platform === 'darwin'),
buildBrowserIframeClickedLinkRoutingScript(
foregroundName,
backgroundName,
process.platform === 'darwin'
),
false
)
.catch(() => {
if (iframeFrameNameByFrame.get(frame) === name) {
if (iframeFrameNamesByFrame.get(frame)?.foreground === foregroundName) {
clearIframeFrameName(frame)
}
})
@@ -81,10 +104,10 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
_event: Electron.Event,
{ frame }: Electron.FrameCreatedDetails
): void => {
if (!clickedLinkFrameName || !frame || frame.parent === null) {
if (!clickedLinkFrameNames || !frame || frame.parent === null) {
return
}
for (const knownFrame of iframeFrameNameByFrame.keys()) {
for (const knownFrame of iframeFrameNamesByFrame.keys()) {
if (knownFrame.isDestroyed()) {
clearIframeFrameName(knownFrame)
}
@@ -96,7 +119,7 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
pendingIframeRoutingInstalls.set(frame, installAfterDomReady)
frame.once('dom-ready', installAfterDomReady)
}
if (clickedLinkFrameName) {
if (clickedLinkFrameNames) {
guest.on('frame-created', handleFrameCreated)
}
const handleDidCreateWindow = (window: Electron.BrowserWindow): void => {
@@ -109,19 +132,28 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
const browserTabId = ownerContext?.browserTabId ?? null
const browserUrl = normalizeBrowserNavigationUrl(url)
const externalUrl = normalizeExternalBrowserUrl(url)
const expectedClickedLinkFrameName = this.clickedLinkFrameNameByGuestId.get(guest.id)
const iframeFrame = frameName ? iframeFrameByFrameName.get(frameName) : undefined
let isClickedLink = Boolean(
expectedClickedLinkFrameName && frameName === expectedClickedLinkFrameName
)
if (!isClickedLink && iframeFrame) {
isClickedLink = true
clearIframeFrameName(iframeFrame)
queueMicrotask(() => installIframeClickedLinkRouting(iframeFrame))
const expectedClickedLinkFrameNames = clickedLinkRoutingActive ? clickedLinkFrameNames : null
const iframeRouting = frameName ? iframeRoutingByFrameName.get(frameName) : undefined
let clickedLinkActivate: boolean | null = null
if (expectedClickedLinkFrameNames && frameName === expectedClickedLinkFrameNames.foreground) {
clickedLinkActivate = true
} else if (
expectedClickedLinkFrameNames &&
frameName === expectedClickedLinkFrameNames.background
) {
clickedLinkActivate = false
} else if (iframeRouting) {
clickedLinkActivate = iframeRouting.activate
clearIframeFrameName(iframeRouting.frame)
queueMicrotask(() => installIframeClickedLinkRouting(iframeRouting.frame))
}
if (isClickedLink) {
if (browserTabId && browserUrl && this.openLinkInOrcaTab(browserTabId, browserUrl)) {
if (clickedLinkActivate !== null) {
if (
browserTabId &&
browserUrl &&
this.openLinkInOrcaTab(browserTabId, browserUrl, clickedLinkActivate)
) {
this.forwardOrQueuePopupEvent(guest.id, {
origin: safeOrigin(browserUrl),
action: 'opened-in-orca'
@@ -148,7 +180,13 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
})
return { action: 'deny' }
}
if (this.openLinkInOrcaTab(ownerContext.browserTabId, externalUrl)) {
if (
this.openLinkInOrcaTab(
ownerContext.browserTabId,
externalUrl,
disposition !== 'background-tab'
)
) {
this.forwardOrQueuePopupEvent(guest.id, {
origin: safeOrigin(externalUrl),
action: 'opened-in-orca'
@@ -190,7 +228,7 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
clickedLinkRoutingActive = false
try {
guest.off('did-create-window', handleDidCreateWindow)
if (clickedLinkFrameName) {
if (clickedLinkFrameNames) {
guest.off('dom-ready', installClickedLinkRouting)
guest.off('frame-created', handleFrameCreated)
for (const [frame, install] of pendingIframeRoutingInstalls) {
@@ -199,8 +237,8 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
}
}
pendingIframeRoutingInstalls.clear()
iframeFrameNameByFrame.clear()
iframeFrameByFrameName.clear()
iframeFrameNamesByFrame.clear()
iframeRoutingByFrameName.clear()
}
} catch {
// guest may already be destroyed
src/main/browser/browser-manager-popup-routing.test.ts
+33 -11
View File
@@ -263,6 +263,11 @@ describe('browserManager', () => {
browserPageId: 'browser-1',
url: 'https://docs.example.com/guide'
})
expect(rendererSendMock).toHaveBeenCalledWith('browser:open-link-in-orca-tab', {
browserPageId: 'browser-1',
url: 'https://docs.example.com/guide',
activate: false
})
expect(rendererSendMock).toHaveBeenCalledWith('browser:popup', {
browserPageId: 'browser-1',
origin: 'https://docs.example.com',
@@ -416,20 +421,21 @@ describe('browserManager', () => {
domReadyHandler?.()
await vi.waitFor(() => expect(executeJavaScriptInIsolatedWorldMock).toHaveBeenCalledTimes(1))
const managerState = browserManager as unknown as {
clickedLinkFrameNameByGuestId: Map<number, string>
const script = executeJavaScriptInIsolatedWorldMock.mock.calls[0][1][0].code as string
const clickedLinkFrameNames = {
foreground: script.match(/__orca_clicked_link_foreground_[0-9a-f-]+/)?.[0],
background: script.match(/__orca_clicked_link_background_[0-9a-f-]+/)?.[0]
}
const clickedLinkFrameName = managerState.clickedLinkFrameNameByGuestId.get(guest.id)
if (!clickedLinkFrameName) {
throw new Error('Expected a private clicked-link frame name')
if (!clickedLinkFrameNames.foreground || !clickedLinkFrameNames.background) {
throw new Error('Expected private clicked-link frame names')
}
expect(clickedLinkFrameName).toMatch(/^__orca_clicked_link_foreground_/)
expect(clickedLinkFrameNames.foreground).toMatch(/^__orca_clicked_link_foreground_/)
expect(executeJavaScriptInIsolatedWorldMock).toHaveBeenCalledWith(
expect.any(Number),
[
expect.objectContaining({
code: expect.stringContaining(
`${JSON.stringify(clickedLinkFrameName)},${process.platform === 'darwin'})`
`${JSON.stringify(clickedLinkFrameNames.foreground)},${JSON.stringify(clickedLinkFrameNames.background)},${process.platform === 'darwin'})`
)
})
],
@@ -443,13 +449,14 @@ describe('browserManager', () => {
expect(
handler({
url: 'https://docs.example.com/guide',
frameName: clickedLinkFrameName
frameName: clickedLinkFrameNames.background
})
).toEqual({ action: 'deny' })
expect(rendererSendMock).toHaveBeenCalledWith('browser:open-link-in-orca-tab', {
browserPageId: 'browser-1',
url: 'https://docs.example.com/guide'
url: 'https://docs.example.com/guide',
activate: false
})
expect(rendererSendMock).toHaveBeenCalledWith('browser:popup', {
browserPageId: 'browser-1',
@@ -512,9 +519,15 @@ describe('browserManager', () => {
const foregroundFrameName = firstScript.match(
/__orca_clicked_link_iframe_foreground_[0-9a-f-]+/
)?.[0]
const backgroundFrameName = firstScript.match(
/__orca_clicked_link_iframe_background_[0-9a-f-]+/
)?.[0]
if (!foregroundFrameName) {
throw new Error('Expected a private child-frame routing token')
}
if (!backgroundFrameName) {
throw new Error('Expected a private background child-frame routing token')
}
expect(firstScript).toContain('installBrowserIframeClickedLinkRouting')
expect(executeJavaScriptMock).toHaveBeenCalledWith(firstScript, false)
@@ -525,17 +538,26 @@ describe('browserManager', () => {
expect(
popupHandler({
url: 'https://docs.example.com/from-frame',
frameName: foregroundFrameName
frameName: backgroundFrameName
})
).toEqual({ action: 'deny' })
expect(rendererSendMock).toHaveBeenCalledWith('browser:open-link-in-orca-tab', {
browserPageId: 'browser-frame',
url: 'https://docs.example.com/from-frame'
url: 'https://docs.example.com/from-frame',
activate: false
})
expect(
popupHandler({
url: 'https://docs.example.com/from-frame-sibling',
frameName: foregroundFrameName
})
).toMatchObject({ action: 'allow' })
expect(rendererSendMock).toHaveBeenCalledTimes(2)
await vi.waitFor(() => expect(executeJavaScriptMock).toHaveBeenCalledTimes(2))
const secondScript = executeJavaScriptMock.mock.calls[1][0] as string
expect(secondScript).not.toContain(foregroundFrameName)
expect(secondScript).not.toContain(backgroundFrameName)
})
it('hosts allowed popups in an origin-bar window with inherited guest policies', () => {
src/main/browser/browser-manager-registration.ts
-1
View File
@@ -206,7 +206,6 @@ export abstract class BrowserManagerRegistration extends BrowserManagerGuestPoli
cleanup()
}
this.policyCleanupByGuestId.clear()
this.clickedLinkFrameNameByGuestId.clear()
this.tabIdByWebContentsId.clear()
this.popupOwnerContextByGuestId.clear()
this.pageInitiatedTabBudgetByRootGuestId.clear()
src/main/browser/browser-manager-state.ts
+5 -2
View File
@@ -102,7 +102,11 @@ export abstract class BrowserManagerState extends BrowserManagerViewportScrollSt
error: string | null
): void
protected abstract getDownloadReceivedBytes(item: Electron.DownloadItem): number
protected abstract openLinkInOrcaTab(browserTabId: string, rawUrl: string): boolean
protected abstract openLinkInOrcaTab(
browserTabId: string,
rawUrl: string,
activate?: boolean
): boolean
protected settingsResolver:
| (() => {
@@ -143,7 +147,6 @@ export abstract class BrowserManagerState extends BrowserManagerViewportScrollSt
protected readonly policyAttachedGuestIds = new Set<number>()
protected readonly offscreenGuestIds = new Set<number>()
protected readonly policyCleanupByGuestId = new Map<number, () => void>()
protected readonly clickedLinkFrameNameByGuestId = new Map<number, string>()
protected readonly loadErrorsByGuestId = new Map<number, BrowserLoadError>()
// Why: did-start-navigation hides the overlay optimistically; stash the cleared error so did-fail-load(-3) can restore an aborted nav.
protected readonly clearedLoadErrorsByGuestId = new Map<number, BrowserLoadError>()

Some files were not shown because too many files have changed in this diff Show More