El orquestador de IA para desarrolladores 100x. - Ejecuta Claude Code, OpenClaude, Codex u OpenCode en paralelo — cada uno en su propio worktree, supervisados desde un solo lugar. + Ejecuta Codex, Claude Code, OpenCode u Pi en paralelo — cada uno en su propio worktree, supervisados desde un solo lugar.
100x ビルダーのための AI オーケストレーター。 - Claude Code、OpenClaude、Codex、OpenCode を並べて実行 — それぞれを専用のワークツリーで動かし、1 か所で追跡できます。 + Codex、Claude Code、OpenCode、Pi を並べて実行 — それぞれを専用のワークツリーで動かし、1 か所で追跡できます。
100x 빌더를 위한 AI 오케스트레이터. - Claude Code, OpenClaude, Codex, OpenCode를 나란히 실행하세요 — 각 에이전트는 자체 worktree에서 실행되고 한곳에서 추적됩니다. + Codex, Claude Code, OpenCode, Pi를 나란히 실행하세요. — 각 에이전트는 자체 worktree에서 실행되고 한곳에서 추적됩니다.
面向 100x 构建者的 AI 编排器。 - 并排运行 Claude Code、OpenClaude、Codex 或 OpenCode — 每个都在自己的 worktree 中运行，并在一个地方统一跟踪。 + 并排运行 Codex、Claude Code、OpenCode 或 Pi — 每个都在自己的 worktree 中运行，并在一个地方统一跟踪。
- 
+ 
- **Feedback & Ideas:** We ship fast. Missing something? [Request a new feature](https://github.com/stablyai/orca/issues).
- **Privacy:** See the [privacy & telemetry docs](https://www.onorca.dev/docs/telemetry) for what anonymous usage data Orca collects and how to opt out.
diff --git a/config/electron-builder.config.cjs b/config/electron-builder.config.cjs
index 0dd6a3d85c7..98beb0c1c1f 100644
--- a/config/electron-builder.config.cjs
+++ b/config/electron-builder.config.cjs
@@ -18,6 +18,12 @@ const featureWallResources = {
from: 'resources/onboarding/feature-wall',
to: 'onboarding/feature-wall'
}
+// Why: freshness detection needs immutable identity metadata from this exact
+// app build, but never needs the skill package bytes or a runtime network read.
+const skillFreshnessResources = {
+ from: 'resources/skills',
+ to: 'skills'
+}
// Why: SSH relay deploy resolves bundles from process.resourcesPath in packaged
// apps. Keeping relay assets as extraResources makes them real directories
// instead of paths hidden inside app.asar.
@@ -31,7 +37,11 @@ const relayExtraResource = {
// do not fall through to a developer checkout's node_modules.
const packagedRuntimeNodeModuleResources = createPackagedRuntimeNodeModuleResources()
-const commonExtraResources = [relayExtraResource, ...packagedRuntimeNodeModuleResources]
+const commonExtraResources = [
+ relayExtraResource,
+ ...packagedRuntimeNodeModuleResources,
+ skillFreshnessResources
+]
const macSpeechNativeResource = {
from: 'node_modules/sherpa-onnx-darwin-${arch}',
to: 'node_modules/sherpa-onnx-darwin-${arch}'
@@ -66,6 +76,10 @@ module.exports = {
// authoring sources too would duplicate content without a runtime consumer.
'!skill-guides{,/**/*}',
'!tests{,/**/*}',
+ // Why: pr-evidence/ is a local e2e screenshot output (ORCA_CAPTURE_EVIDENCE);
+ // it is gitignored, but exclude it defensively so a stray local capture at
+ // package time never bloats app.asar.
+ '!pr-evidence{,/**/*}',
'!Casks{,/**/*}',
'!{AGENTS.md,CLAUDE.md,DEVELOPING.md,bundle-size-progress.md}',
'!out/**/*.test.js',
@@ -75,7 +89,8 @@ module.exports = {
'!tsconfig.json',
// Why: feature-wall media is copied via extraResources so runtime can read
// it from process.resourcesPath; exclude the source copy from app.asar.
- '!resources/onboarding/feature-wall/**'
+ '!resources/onboarding/feature-wall/**',
+ '!resources/skills/**'
],
// Why: the CLI entry-point lives in out/cli/ but imports shared modules
// from out/shared/ and local hook mutators from out/main/. These paths must be
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index 9965e738a8a..448b4beac63 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -711,15 +711,18 @@
"ssh",
"runtime"
],
- "coverageNotes": "A live macOS Electron test proves exact local PTY disappearance after a parked-tab close. Deterministic unit/store tests cover daemon and SSH routing, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending.",
+ "coverageNotes": "Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. Deterministic tests cover daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending.",
"motivatingLinks": [
- "https://github.com/stablyai/orca/pull/8628"
+ "https://github.com/stablyai/orca/pull/8628",
+ "https://github.com/stablyai/orca/pull/8706"
],
- "invariant": "Close permanently removes the owned provider session and resume authority even when no TerminalPane is mounted; detach and park preserve both; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.",
- "oracle": "Capture the exact PTY before parking, prove it remains listed while the view is absent, close through the product state boundary, and poll the provider inventory until that exact ID disappears; unit tests assert canonical owner dedupe, one teardown owner, exact pane tombstones, chained detach transfer, and restart alias restoration.",
+ "invariant": "Close permanently removes the owned provider session, agent descendants, and resume authority even when no TerminalPane is mounted; a terminating id remains reserved through natural exit, duplicate callers await the same completion, and immediate teardown upgrades any graceful request without signalling a recycled PID or a descendant tree after root ownership is lost; process-table work is locale-stable, bounded, fresh for each post-start request, same-turn coalesced, and begins within the requesting caller's deadline, including bulk worktree cleanup; detach and park preserve ownership; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.",
+ "oracle": "Capture the exact PTY before parking, prove it remains listed while the view is absent, close through the product state boundary, and poll the provider inventory until that exact ID disappears; an agent-marked PTY's detached-pgid child is alive before close and absent afterward; unit tests keep a naturally exited id reserved without re-killing its PID or signalling its captured tree, upgrade pending and post-snapshot graceful kills to immediate, force ps into the C locale, coalesce each bounded bulk-shutdown batch, share duplicate teardown completion, coalesce 20 same-turn process-table requests, start one shared successor without waiting for the prior scan, terminate cyclic-looking traversal, retain the source scan's timestamp, bound both read phases, avoid ambiguous SIGKILL, and assert canonical owner dedupe, exact pane tombstones, chained detach transfer, and restart alias restoration.",
"commands": [
"pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/ipc/pty-management.test.ts src/main/persistence.test.ts src/renderer/src/store/slices/agent-pane-authority.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/slices/terminal-tab-retirement.test.ts src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
- "pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1"
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/pty-descendant-termination.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/providers/local-pty-provider.test.ts src/main/runtime/worktree-teardown.test.ts",
+ "pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
+ "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1"
],
"testFiles": [
"src/main/agent-hooks/server-pane-authority.test.ts",
@@ -727,12 +730,18 @@
"src/main/ipc/agent-pane-authority-ownership.test.ts",
"src/main/ipc/pty-management.test.ts",
"src/main/persistence.test.ts",
+ "src/main/pty-descendant-termination.test.ts",
+ "src/main/daemon/session.test.ts",
+ "src/main/daemon/terminal-host.test.ts",
+ "src/main/providers/local-pty-provider.test.ts",
+ "src/main/runtime/worktree-teardown.test.ts",
"src/renderer/src/store/slices/agent-pane-authority.test.ts",
"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
"src/renderer/src/store/slices/terminal-tab-retirement.test.ts",
"src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts",
"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
- "tests/e2e/terminal-parked-close-retirement.spec.ts"
+ "tests/e2e/terminal-parked-close-retirement.spec.ts",
+ "tests/e2e/agent-descendant-process-kill.spec.ts"
],
"assertionRefs": [
{
@@ -754,6 +763,39 @@
"exact pane retirement removes resume and launch authority while preserving siblings",
"chained detach keeps physical hooks and resume authority routed to the current owner until that owner closes"
]
+ },
+ {
+ "file": "src/main/pty-descendant-termination.test.ts",
+ "assertions": [
+ "20 same-turn process-table requests execute one fresh scan while later arrivals start one shared successor inside their own deadline",
+ "snapshot and escalation readers stop at their deadline",
+ "production ps reads force locale-independent C timestamps",
+ "the source scan timestamp survives request resolution and capture-second identities are never escalated with SIGKILL",
+ "cyclic-looking duplicate PID rows terminate with each descendant visited once and duplicate escalation identities stay unsignalled",
+ "descendant signals are suppressed after the caller loses root ownership"
+ ]
+ },
+ {
+ "file": "src/main/daemon/terminal-host.test.ts",
+ "assertions": [
+ "agent immediate kill rejects reattach while descendant capture is pending",
+ "a naturally exited session id remains reserved until capture finishes without force-killing its retired PID",
+ "graceful teardown upgrades to immediate both during and after descendant capture",
+ "duplicate immediate kill starts one descendant sweep"
+ ]
+ },
+ {
+ "file": "src/main/runtime/worktree-teardown.test.ts",
+ "assertions": [
+ "owned provider shutdowns start together so process-table snapshots can coalesce within a batch",
+ "inventories above 32 sessions never exceed 32 concurrent provider shutdowns"
+ ]
+ },
+ {
+ "file": "tests/e2e/agent-descendant-process-kill.spec.ts",
+ "assertions": [
+ "a detached-pgid descendant is alive before agent PTY kill and absent afterward"
+ ]
}
],
"evidenceRuns": [
@@ -765,11 +807,29 @@
"result": "passed",
"durationSeconds": 40.3,
"summary": "A fresh E2E build launched an isolated Electron profile, parked a live terminal, closed it through closeTab, and observed its exact PTY disappear."
+ },
+ {
+ "date": "2026-07-14",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
+ "result": "passed",
+ "durationSeconds": 37.7,
+ "summary": "A current-main integrated fresh-build run proved a detached-pgid child was alive before agent PTY kill and absent afterward on the deadline-safe, root-ownership-gated implementation."
+ },
+ {
+ "date": "2026-07-15",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
+ "result": "passed",
+ "durationSeconds": 78,
+ "summary": "The cycle-safe, target-indexed, bounded-fanout review head passed from a cold full build; the live detached-pgid descendant test body completed in 4.8 seconds."
}
],
"runtimeBudget": {
"p95Seconds": 60,
- "scope": "fresh E2E build plus one isolated local Electron parked-close test"
+ "scope": "fresh E2E build plus isolated local Electron parked-close and descendant-kill tests"
},
"flakeHistory": {
"status": "unknown",
@@ -780,8 +840,8 @@
"evidence": "The test exercises the original parked-view failure shape and passed with the retirement boundary; an archived intentional-break run is not yet attached."
},
"performanceBudget": {
- "required": false,
- "evidence": "The close path is user-triggered and bounded by canonical live-owner indexing; kill-all scale remains covered by terminal-session.kill-all-surface-cleanup."
+ "required": true,
+ "evidence": "The close path is user-triggered and bounded by canonical live-owner indexing. Production ps has a 1s kill timeout; 20 same-turn requests execute one fresh process-table read, while requests arriving after a scan starts immediately share one successor so their deadline is not consumed waiting and no unusable ps starts after timeout. Completed tables are never reused. Bulk worktree shutdown runs in 32-wide batches so each batch can coalesce its initial scan without unbounded provider fanout. Descendant traversal uses a visited set and index cursor; a Node 24 local 100,000-wide synthetic tree fell from 861ms to 16.7ms, and escalation indexes only the requested descendant PIDs instead of duplicating the full process table. Escalation uses the same bounded coordinator, and kill-all store scale remains covered by terminal-session.kill-all-surface-cleanup."
},
"promotionCriteria": [
"Accumulate 100 clean runs or 14 days on required CI platforms.",
@@ -791,7 +851,10 @@
"knownGaps": [
"The live Electron proof currently covers macOS local PTYs only.",
"Disconnected SSH relay death still requires reconnect-aware provider ownership.",
- "Daemon owner leases and durable retry inventory remain follow-up hardening."
+ "Daemon owner leases and durable retry inventory remain follow-up hardening.",
+ "Windows ConPTY, SSH-hosted PTYs, app-quit killAll, and daemon dispose retain foreground-tree-only teardown.",
+ "A process born in the capture second is SIGTERMed but not SIGKILLed because ps cannot prove its recycled-PID identity.",
+ "A descendant orphaned before or during root ownership loss requires the separate crash-orphan sweep and is not recovered from a stale kill-time snapshot."
],
"demotionRule": "Keep experimental or demote to protection none if exact PTY disappearance flakes, a sibling/detached pane is retired, or late hooks can recreate closed authority."
},
@@ -1887,7 +1950,6 @@
"daemon stream",
"main PTY batching",
"runtime path provenance",
- "runtime serve-sim detection",
"runtime terminal wait detection",
"renderer ACK",
"xterm scheduler",
@@ -1908,7 +1970,7 @@
"macos"
],
"coveredProviders": [],
- "coverageNotes": "Local macOS evidence covers the existing main-process pending-output caps plus deterministic runtime path-provenance history reuse, idle-path serve-sim detection, and saturated-tail wait detection. Daemon stream write(false)/drain contracts, cross-session drain priority, and bounded queued tails arrive with the pending perf slice; live flood/latency artifacts remain gaps.",
+ "coverageNotes": "Local macOS evidence covers the existing main-process pending-output caps plus deterministic runtime path-provenance history reuse and saturated-tail wait detection. Daemon stream write(false)/drain contracts, cross-session drain priority, and bounded queued tails arrive with the pending perf slice; live flood/latency artifacts remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6836",
"https://github.com/stablyai/orca/pull/6858",
@@ -1916,17 +1978,15 @@
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "High-volume terminal output must stay bounded across daemon socket writes, main runtime metadata, detectors, and tail checks, main-to-renderer in-flight bytes, renderer scheduler queues, and hidden-output restore without starving focused input.",
- "oracle": "The current executable slice injects daemon socket backpressure and main-process renderer backlog pressure, then asserts write(false)/drain ordering, bounded queued daemon bytes, unchanged path-provenance history reuse for pathless output, idle serve-sim detection with split-JSON continuity, ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, and ACK-gated in-flight bounds. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.",
+ "oracle": "The current executable slice injects main-process renderer backlog pressure, then asserts unchanged path-provenance history reuse for pathless output, ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, and ACK-gated in-flight bounds. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
- "pnpm exec vitest run --config config/vitest.config.ts src/main/emulator/serve-sim-state-watcher.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts"
],
"testFiles": [
"src/main/ipc/pty.test.ts",
"src/main/runtime/orca-runtime-path-candidate-history.test.ts",
- "src/main/emulator/serve-sim-state-watcher.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/orca-runtime-tail-wait-memo.test.ts"
],
@@ -1946,13 +2006,6 @@
"copies history when new output adds a path candidate"
]
},
- {
- "file": "src/main/emulator/serve-sim-state-watcher.test.ts",
- "assertions": [
- "does not buffer repeated brace-free PTY output while waiting for metadata",
- "detects serve-sim metadata split across PTY chunks and releases the partial object"
- ]
- },
{
"file": "src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
"assertions": [
@@ -1990,15 +2043,6 @@
"durationSeconds": 3.49,
"summary": "1 test file passed, 2 tests passed on the exact rebased tree based on main@dc468f0ded."
},
- {
- "date": "2026-07-10",
- "runner": "local",
- "platform": "macos",
- "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/emulator/serve-sim-state-watcher.test.ts",
- "result": "passed",
- "durationSeconds": 0.37,
- "summary": "1 test file passed, 6 tests passed on pushed commit f0e3a185593b."
- },
{
"date": "2026-07-10",
"runner": "local",
@@ -2015,11 +2059,11 @@
},
"flakeHistory": {
"status": "unknown",
- "evidence": "Daemon stream backpressure and focused main/renderer backlog tests are deterministic unit slices. The combined perf soak still needs runtime history before promotion."
+ "evidence": "Focused main-process backlog tests are deterministic unit slices. The combined perf soak still needs runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
- "evidence": "Tests assert daemon stream writes pause after socket write(false), later stream data queues behind the pressured socket, flush-immediate output from another session is prioritized ahead of unrelated queued background backlog on drain while preserving per-session order, queued lines resume on drain, global cleanup clears clients that only have backpressured writes, queued daemon stream bytes are bounded by keeping priority output and the newest tail under sustained pressure, pathless runtime output reuses unchanged path-provenance history with zero old-candidate byte scans, ordinary output leaves the niche serve-sim detector idle while split JSON still emits and releases its partial buffer, ordinary saturated terminal tails retain no rebuilt wait text or repeated phrase scans while every blocked/ready prompt family remains live, main pending renderer output is capped per PTY and in total, total-pressure trimming prefers background pending output before active pending output, trimmed pending tails preserve seq/rawLength metadata, and ACK-gated in-flight output remains bounded. Intentionally restoring the old path-history shape failed the focused scale test after 774ms and 4,096 replacements; restoring the old serve-sim buffer failed its scale test after 180ms with 4,096 buffer writes; disabling the ordinary-tail branch failed with a retained 253,999-character waitText. The fixed shapes passed their focused suites. Existing renderer tests cover replay/backlog slices. Needs broader hidden-output/input-latency perf artifacts before promotion."
+ "evidence": "Tests assert pathless runtime output reuses unchanged path-provenance history with zero old-candidate byte scans, ordinary saturated terminal tails retain no rebuilt wait text or repeated phrase scans while every blocked/ready prompt family remains live, main pending renderer output is capped per PTY and in total, total-pressure trimming prefers background pending output before active pending output, trimmed pending tails preserve seq/rawLength metadata, and ACK-gated in-flight output remains bounded. Intentionally restoring the old path-history shape failed the focused scale test after 774ms and 4,096 replacements; disabling the ordinary-tail branch failed with a retained 253,999-character waitText. The fixed shapes passed their focused suites. Existing renderer tests cover replay/backlog slices. Needs daemon-stream contract coverage and broader hidden-output/input-latency perf artifacts before promotion."
},
"performanceBudget": {
"required": true,
@@ -2031,9 +2075,8 @@
"Keep stress variants non-blocking until stable runtime history exists."
],
"knownGaps": [
- "Current command asserts daemon stream write(false)/drain/cleanup at the batcher contract layer and main pending renderer caps at the IPC contract layer.",
+ "Daemon stream write(false)/drain/cleanup and bounded queued-tail contracts are not registered in the current command.",
"Runtime provenance coverage is deterministic and does not include a live high-throughput provider artifact.",
- "Serve-sim detector coverage is deterministic and does not include a live external simulator helper.",
"Terminal-wait scale evidence is deterministic and does not yet include a live saturated-tail event-loop artifact.",
"Current command does not prove renderer parse pressure, scheduler queue depth, event-loop delay, or active key latency.",
"Live hidden-output pressure, active input latency, and full Electron perf artifacts remain unproved."
@@ -3833,6 +3876,7 @@
"layer": "runtime-rpc-contract",
"surfaces": [
"mobile terminal",
+ "native-chat terminal overlay",
"runtime RPC",
"binary multiplex",
"JSON subscribe fallback",
@@ -3854,21 +3898,25 @@
"macos"
],
"coveredProviders": [],
- "coverageNotes": "Local macOS evidence over the runtime-RPC stream budgets on main@1282f5c2d. The pending stack adds byte-exact 512KB/2MB/256KB/48KB budget assertions; legacy JSON subscribe parity remains undecided.",
+ "coverageNotes": "Local macOS evidence over the runtime-RPC stream budgets on main@1282f5c2d. PR #5824 adds a platform-neutral mobile decision gate proving chat-covered terminal streams pause and resume only after the mounted WebView is ready; live Android restore evidence remains required. The pending stack adds byte-exact 512KB/2MB/256KB/48KB budget assertions; legacy JSON subscribe parity remains undecided.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6951",
"https://github.com/stablyai/orca/pull/6955",
"https://github.com/stablyai/orca/pull/7009"
],
- "invariant": "Runtime and mobile terminal subscriptions must cap initial snapshots, live output buffered while snapshots load, chunk sizes, and batch sizes, while preserving output order, input locks, resize/driver events, and fallback parity or explicit fallback deprecation.",
- "oracle": "The current executable slice asserts mobile initial snapshots downgrade until they fit <=512KB, requested binary snapshots downgrade until they fit <=2MB, binary live output queued while the initial snapshot loads stays <=256KB while preserving the newest tail, large binary output is split into <=48KB frames, output bursts are coalesced before emit, aborts do not register stale listeners, and stale mobile resize re-stream completions are dropped. JSON fallback parity/deprecation remains an explicit gap.",
+ "invariant": "Runtime and mobile terminal subscriptions must cap initial snapshots, live output buffered while snapshots load, chunk sizes, and batch sizes; a terminal covered by native chat must have no live output subscription and must restore from fresh scrollback when revealed, while preserving output order, input locks, resize/driver events, and fallback parity or explicit fallback deprecation.",
+ "oracle": "The current executable slice asserts mobile initial snapshots downgrade until they fit <=512KB, requested binary snapshots downgrade until they fit <=2MB, binary live output queued while the initial snapshot loads stays <=256KB while preserving the newest tail, large binary output is split into <=48KB frames, output bursts are coalesced before emit, aborts do not register stale listeners, and stale mobile resize re-stream completions are dropped. The mobile native-chat decision test asserts an active stream pauses while covered and resumes only for a ready active terminal. JSON fallback parity and live Android scrollback restoration remain explicit gaps.",
"commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts"
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts",
+ "pnpm --dir mobile exec vitest run --root .. mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
+ "pnpm --dir mobile exec vitest run --root .. mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts"
],
"testFiles": [
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"src/main/runtime/rpc/terminal-output-batching.test.ts",
- "src/main/runtime/rpc/terminal-multiplex.test.ts"
+ "src/main/runtime/rpc/terminal-multiplex.test.ts",
+ "mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
+ "mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts"
],
"assertionRefs": [
{
@@ -3893,6 +3941,21 @@
"oversized live output frames are bounded for subscribed binary streams",
"multibyte live output flushes when encoded bytes reach the batch budget"
]
+ },
+ {
+ "file": "mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
+ "assertions": [
+ "an active terminal stream pauses while native chat covers its WebView",
+ "the stream resumes only for the ready active terminal after chat closes",
+ "non-terminal and already-settled stream states perform no lifecycle work"
+ ]
+ },
+ {
+ "file": "mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts",
+ "assertions": [
+ "a late WebView-ready transition converts a cold-start lease-only stream back to output",
+ "ordinary WebView readiness does not rerender the mobile session route"
+ ]
}
],
"evidenceRuns": [
@@ -3904,6 +3967,15 @@
"result": "passed",
"durationSeconds": 3.8,
"summary": "3 test file(s) passed, 28 tests passed on main@1282f5c2d in a clean checkout."
+ },
+ {
+ "date": "2026-07-12",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm --dir mobile exec vitest run --root .. mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
+ "result": "passed",
+ "durationSeconds": 0.2,
+ "summary": "The focused mobile native-chat suite passed with 3 terminal-stream lifecycle assertions in the staged PR #5824 worktree."
}
],
"runtimeBudget": {
@@ -3928,7 +4000,7 @@
"Record byte counts and order/cursor artifacts on failure."
],
"knownGaps": [
- "Current command covers binary runtime/mobile stream contracts only.",
+ "The pure mobile decision gate does not yet prove live Android WebView scrollback restore after a chat toggle.",
"Legacy JSON subscribe parity is undecided."
],
"demotionRule": "Cannot promote while a supported stream path has uncapped snapshot or live-output buffering."
@@ -4290,63 +4362,200 @@
"remote-runtime",
"ssh"
],
- "coverageNotes": "Deterministic tests cover a four-child healthy runtime pool, a one-child healthy SSH relay pool, and at most four bounded quarantine children, with one quarantine attempt per watch lifetime, queue-aware cancellation, bounded initial and crash-resubscribe crawls, physical desktop-install abort, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. A built-entry macOS harness drives the real supervisor, kills its child with SIGSEGV, then requires automatic resubscription and a later event. SSH bundles the same child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation. A built-relay harness kills that child and requires the original relay PID and existing PTY to survive before overflow and precise events resume.",
+ "coverageNotes": "Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/5308",
"https://github.com/stablyai/orca/issues/7547",
"https://github.com/stablyai/orca/issues/8212"
],
- "invariant": "Local runtime roots use at most four shared watcher children while healthy, while each SSH relay process uses at most one; either pool uses at most four additional quarantine children after shard failure. Cancelling queued setup removes only that request; cancelling an active crawl restarts one shard and restores its healthy records. Setup deadlines start only when the child owns the crawl; the runtime RPC transport owns the normal 15-second initial budget, while a 60-second recovery deadline quarantines a root that would otherwise pin its shard. A crash-fused shared shard moves affected roots into the bounded quarantine pool, and a second fused quarantine ends those watch lifetimes instead of spawning replacements indefinitely. Every interrupted setup emits overflow after recovery, event delivery stays bounded, and each SSH target's relay, PTYs, Git, and other filesystem operations remain isolated from other targets and never load the watcher native addon or share its fault boundary.",
- "oracle": "Fill the four-child healthy runtime pool with multiple roots, and map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor. Inject IPC disconnect-before-exit, queued and active setup cancellation, initial and crash-resubscribe timeouts, and shard-level terminal failure, then assert healthy roots are restored, affected roots spread across no more than four quarantine supervisors, a second quarantine fuse creates no replacement, stale generations stop delivering, and existing same-root clients receive overflow plus later events without error/end. Abort a pending desktop install and require worktree close and app shutdown to settle before the native crawl resolves. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.",
+ "invariant": "Local runtime and SSH relay roots share one watcher child per host process while healthy and use at most four quarantine children after shard failure; native desktop, paired-runtime, and direct WSL snapshot children consume the same process-wide eight-child reservation and retry transient exhaustion without permanently disabling a root. Cancellation remains owned by its child generation and settles only after acknowledgement or bounded physical exit; paired-web retains cleanup ownership and can cancel before readiness even while capacity is exhausted, retries a failed unwatch after already-resolved or late physical exit without duplicating stream termination, replacements never overlap a still-retiring generation, and aborted or timed-out callers detach immediately even while queued behind same-root relay teardown. Destructive local and SSH cleanup holds one containment-aware watcher/terminal removal fence through descendant watcher and PTY physical exit plus parent Git/filesystem deletion; daemon and relay kill requests retain ownership until the actual subprocess exit callback or an equivalent positive dead-PID proof and propagate rejected signals or a bounded failure otherwise. A crash-fused shared shard moves affected roots into the bounded quarantine pool, a second fused quarantine ends those watch lifetimes, interrupted setup emits overflow after recovery, metadata work stays bounded, and the SSH relay, PTYs, Git, and other filesystem operations never load the watcher native addon or share its fault boundary.",
+ "oracle": "Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.",
"commands": [
- "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/files-watch-cleanup.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-pending-setup-waiters.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-parent-removal.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-pending-assignment.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/pty-handler.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
+ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
"pnpm run build:electron-vite",
+ "node config/scripts/runtime-file-watcher-resource-probe.mjs",
"node config/scripts/runtime-file-watcher-fault-harness.mjs",
"ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
- "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
+ "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
+ "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"pnpm run build:relay",
"node config/scripts/relay-watcher-fault-harness.mjs"
],
"testFiles": [
+ "src/main/daemon/daemon-pty-adapter.test.ts",
+ "src/main/ipc/filesystem-watcher.test.ts",
+ "src/main/ipc/filesystem-watcher-native-capacity.test.ts",
+ "src/main/ipc/parcel-watcher-child-registry.test.ts",
+ "src/main/ipc/parcel-watcher-child-launch.test.ts",
"src/main/ipc/parcel-watcher-process.test.ts",
+ "src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts",
+ "src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts",
+ "src/main/ipc/parcel-watcher-supervisor-capacity.test.ts",
+ "src/main/ipc/parcel-watcher-disconnect-termination.test.ts",
+ "src/main/ipc/runtime-watcher-pending-assignment.test.ts",
"src/main/ipc/runtime-watcher-process-pool.test.ts",
"src/main/ipc/parcel-watcher-process-entry.test.ts",
"src/main/ipc/parcel-watcher-event-delivery.test.ts",
"src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
"src/main/ipc/filesystem-watcher-wsl.test.ts",
+ "src/main/ipc/worktrees.test.ts",
+ "src/main/ipc/watcher-removal-gate.test.ts",
+ "src/main/ipc/pty.test.ts",
+ "src/main/providers/local-pty-provider.test.ts",
+ "src/main/daemon/pty-subprocess.test.ts",
+ "src/main/daemon/session.test.ts",
+ "src/main/daemon/terminal-host.test.ts",
+ "src/main/daemon/terminal-host-session-reaping-leak.test.ts",
"src/main/runtime/file-watcher-host.test.ts",
+ "src/main/runtime/orca-runtime-files-watch.test.ts",
+ "src/main/runtime/worktree-teardown.test.ts",
+ "src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/rpc/methods/files.test.ts",
+ "src/main/runtime/rpc/methods/files-watch-cancellation.test.ts",
+ "src/main/runtime/rpc/methods/files-watch-cleanup.test.ts",
"src/main/providers/ssh-filesystem-provider.test.ts",
+ "src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts",
+ "src/main/providers/ssh-pty-provider.test.ts",
"src/renderer/src/runtime/runtime-file-client.test.ts",
+ "src/renderer/src/web/web-runtime-client.test.ts",
+ "src/shared/cross-platform-path.test.ts",
+ "src/shared/physical-exit-tracker.test.ts",
+ "src/shared/promise-settlement-waiters.test.ts",
"config/scripts/runtime-file-watcher-fault-harness.mjs",
+ "config/scripts/runtime-file-watcher-resource-probe.mjs",
"src/relay/relay-filesystem-watch-registry.test.ts",
+ "src/relay/relay-watcher-pending-setup-waiters.test.ts",
+ "src/relay/relay-watcher-parent-removal.test.ts",
+ "src/relay/relay-watcher-setup-wait.test.ts",
"src/relay/fs-handler.test.ts",
+ "src/relay/pty-handler.test.ts",
+ "src/relay/git-handler.test.ts",
"src/relay/subprocess.test.ts",
"src/main/ssh/ssh-relay-versioned-install.test.ts",
"config/scripts/package-electron-runtime-contract.test.mjs",
"config/scripts/relay-watcher-fault-harness.mjs"
],
"assertionRefs": [
+ {
+ "file": "src/main/ipc/filesystem-watcher.test.ts",
+ "assertions": [
+ "a transient WSL child-capacity rejection automatically retries on release and renderer unwatch cancels the wait",
+ "failed SSH worktree removal restores every live renderer listener, emits overflow, and resumes precise events"
+ ]
+ },
+ {
+ "file": "src/main/ipc/filesystem-watcher-native-capacity.test.ts",
+ "assertions": [
+ "typed native child-capacity exhaustion automatically retries after a serialized slot release",
+ "renderer unwatch cancels a pending native capacity retry before subscription restarts"
+ ]
+ },
+ {
+ "file": "src/main/ipc/parcel-watcher-child-registry.test.ts",
+ "assertions": [
+ "capacity notification closes the release-before-listen race, supports cancellation, fires at most once, and serializes reserving waiters per released slot"
+ ]
+ },
+ {
+ "file": "src/main/ipc/parcel-watcher-child-launch.test.ts",
+ "assertions": [
+ "native launcher reports typed transient capacity exhaustion without forking another child"
+ ]
+ },
+ {
+ "file": "src/shared/physical-exit-tracker.test.ts",
+ "assertions": [
+ "timed-out physical-exit waiters detach while active and later retries still settle on exact exit"
+ ]
+ },
+ {
+ "file": "src/shared/promise-settlement-waiters.test.ts",
+ "assertions": [
+ "one shared-promise reaction serves an anchor plus 10,000 abortable callers, and all cancelled closures detach immediately",
+ "timeout and already-aborted paths remove timers, listeners, and ownership while preserving the active anchor"
+ ]
+ },
+ {
+ "file": "src/main/daemon/daemon-pty-adapter.test.ts",
+ "assertions": [
+ "daemon process enumeration falls back to spawn cwd before OSC 7 reports a live cwd",
+ "force-killed keep-history sleep remains cold-restorable across repeated wake cycles after physical exit"
+ ]
+ },
{
"file": "src/main/ipc/parcel-watcher-process.test.ts",
"assertions": [
"initial-subscribe crashes complete with an interruption refresh",
+ "watch errors before readiness reject setup and physically cancel the native crawl",
+ "watch errors during replacement crawl terminate recovery and a late readiness ack cannot revive the failed root",
"IPC disconnect recovery restores every existing root before accepting new setup",
"queued abort removes one request without restarting healthy roots, while active abort or crawl-scoped timeout restores the shard",
- "a crash-resubscribe crawl deadline ends only the stuck root and tears down its shard process",
+ "a crash-resubscribe crawl deadline and concurrent unsubscribe settle only after physical shard exit, or report physical-exit failure at the termination deadline",
+ "a close-only asynchronous spawn failure settles physical termination without waiting for the exit deadline",
+ "production runtime-pool disposal rejects later subscriptions without forking an overlapping child",
+ "Vitest cleanup resets rather than re-disposes the reusable runtime pool",
+ "native child launch preserves typed transient capacity exhaustion instead of reporting permanent process unavailability",
"missing built entries fail closed and unavailable canary storage remains optional",
"fault-harness PID reporting cannot clobber an existing filesystem path"
]
},
+ {
+ "file": "src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts",
+ "assertions": [
+ "a canary-independent native-unsubscribe deadline restarts the shard and restores healthy siblings after physical child exit",
+ "an unkillable child rejects the native unsubscribe with its retained physical-exit promise only at the bounded exit deadline"
+ ]
+ },
+ {
+ "file": "src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts",
+ "assertions": [
+ "10,000 cancelled capacity callers leave exactly one live anchor and zero waiters after the released slot settles"
+ ]
+ },
+ {
+ "file": "src/main/ipc/parcel-watcher-supervisor-capacity.test.ts",
+ "assertions": [
+ "one released physical slot launches one shared supervisor child for every waiting root, while partial/all cancellation and disposal remove the shared capacity barrier",
+ "a waiter recursively re-enters the event-driven barrier when crash recovery reclaims its announced slot"
+ ]
+ },
+ {
+ "file": "src/main/ipc/parcel-watcher-disconnect-termination.test.ts",
+ "assertions": [
+ "pending-crawl cancellation after disconnect remains pending until the exact child exits",
+ "ready and pending-crawl cancellation force disconnected-child exit even while a healthy sibling root remains",
+ "a cancellation deadline joins active disconnect termination without duplicate sibling resubscription",
+ "an exit-deadline failure replaces the early cancellation and remains visible to synchronous unsubscribe until physical exit"
+ ]
+ },
+ {
+ "file": "src/main/ipc/runtime-watcher-pending-assignment.test.ts",
+ "assertions": [
+ "10,000 cancelled quarantine-assignment callers leave exactly one live anchor and zero waiters after grant",
+ "an already-aborted first caller synchronously releases pending assignment ownership"
+ ]
+ },
{
"file": "src/main/ipc/runtime-watcher-process-pool.test.ts",
"assertions": [
- "healthy roots spread across at most four shared supervisors before sharing",
+ "healthy roots share one supervisor until a fault requires quarantine",
"a supervisor-scoped failure spreads affected roots across at most four quarantine supervisors",
"a second fused quarantine creates no further replacement for that watch lifetime",
"a root-specific failure preserves healthy shard assignments",
"a live root whose crash-resubscribe times out moves to quarantine",
- "an older same-root teardown cannot erase a newer watch lease's assignment"
+ "an older same-root teardown cannot erase a newer watch lease's assignment",
+ "test reset explicitly reopens the production-disposed pool",
+ "a zero-waiter aborted assignment cannot poison a same-turn replacement subscribe"
]
},
{
@@ -4371,15 +4580,126 @@
"file": "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
"assertions": [
"worktree deletion physically aborts pending native setup and settles before its crawl resolves",
- "app shutdown physically aborts pending native setup and releases a late native handle"
+ "app shutdown physically aborts pending native setup and releases a late native handle",
+ "a cancelled pending install retains physical-exit failure across an immediate second destructive close",
+ "desktop terminal failure remains root-owned even when the cleared subscription later unsubscribes cleanly",
+ "Windows drive and UNC watcher ownership is found across path casing and separator variants",
+ "Windows event payloads retain the physical root spelling instead of the comparison key",
+ "failed local worktree removal restores every live renderer listener and emits overflow"
+ ]
+ },
+ {
+ "file": "src/main/ipc/filesystem-watcher-wsl.test.ts",
+ "assertions": [
+ "unsubscribe and startup abort remain pending until the WSL watcher process physically closes",
+ "a termination timeout or rejected kill retains the WSL watcher owner for later physical-exit proof",
+ "WSL watcher processes consume the shared eight-child reservation until physical close, including synchronous startup-write cleanup"
+ ]
+ },
+ {
+ "file": "src/main/ipc/worktrees.test.ts",
+ "assertions": [
+ "desktop IPC deletion never starts Git removal when physical PTY teardown cannot be proven",
+ "normal and orphan/leftover deletion paths perform strict PTY teardown before local or SSH Git/filesystem removal",
+ "SSH deletion fails closed before Git when the remote PTY provider is unavailable",
+ "failed IPC deletion finishes the watcher fence as aborted so logical subscriptions can recover"
+ ]
+ },
+ {
+ "file": "src/main/ipc/watcher-removal-gate.test.ts",
+ "assertions": [
+ "Windows-equivalent spellings share one removal fence while distinct POSIX backslash roots do not",
+ "desktop and runtime removal entry points cannot own overlapping destructive roots concurrently",
+ "parent removal waits descendant terminal spawns and rejects later descendant installs"
+ ]
+ },
+ {
+ "file": "src/main/ipc/pty.test.ts",
+ "assertions": [
+ "renderer PTY spawn is rejected before provider creation while destructive worktree removal holds the shared terminal gate",
+ "renderer and runtime spawns fence both the worktree-ID root and resolved cwd, including cross-worktree cwd ownership with rollback",
+ "manual and runtime-controller local PTY shutdown retain listener and provider ownership until physical exit",
+ "did-finish-load orphan cleanup disposes data delivery but retains the onExit listener and tracker through physical exit",
+ "a failed local PTY kill retains retryable provider ownership until a later physical exit"
+ ]
+ },
+ {
+ "file": "src/main/providers/local-pty-provider.test.ts",
+ "assertions": [
+ "local shutdown remains pending and owned until node-pty reports physical exit",
+ "local process enumeration retains the spawn cwd for destructive ownership fallback",
+ "destructive cleanup escalates an existing graceful shutdown without losing its shared exit proof",
+ "POSIX graceful shutdown escalates to one bounded SIGKILL when the child ignores SIGTERM",
+ "Windows graceful-to-destructive cleanup treats the first ConPTY kill as final and never double-closes the handle",
+ "orphan cleanup racing immediate shutdown shares one kill and remains owned until the queued physical exit",
+ "timeout and kill failure preserve ownership for a later successful retry"
+ ]
+ },
+ {
+ "file": "src/main/daemon/pty-subprocess.test.ts",
+ "assertions": [
+ "rejected graceful and force kills propagate without marking the wrapper dead so retries can signal the same child"
+ ]
+ },
+ {
+ "file": "src/main/daemon/session.test.ts",
+ "assertions": [
+ "graceful daemon termination force-kills after its deadline but retains session ownership and late output until physical exit",
+ "rejected graceful and force kills reopen termination state for a later retry"
+ ]
+ },
+ {
+ "file": "src/main/daemon/terminal-host.test.ts",
+ "assertions": [
+ "immediate daemon kill remains pending and listed until the subprocess exit callback",
+ "an unconfirmed immediate kill rejects at the bounded deadline, retains ownership, and blocks same-id replacement"
+ ]
+ },
+ {
+ "file": "src/main/daemon/terminal-host-session-reaping-leak.test.ts",
+ "assertions": [
+ "immediate daemon kill reaps the emulator and session only after physical exit"
]
},
{
"file": "src/main/runtime/file-watcher-host.test.ts",
"assertions": [
"same-root clients share one physical watch and one client abort cannot cancel another owner's setup",
+ "concurrent pre-ready cancellations join one native root release before an immediate replacement subscribes",
+ "10,000 cancelled runtime-root callers detach while one setup anchor remains",
+ "root-scoped destructive cleanup joins an in-progress subscriber teardown",
"shard failure preserves existing subscribers through isolated recovery and rejects stale-generation events",
- "only failed isolated recovery ends subscribers, after a conservative overflow"
+ "only failed isolated recovery ends subscribers, after a conservative overflow",
+ "initial setup failure remains discoverable by root-scoped destructive cleanup until physical exit"
+ ]
+ },
+ {
+ "file": "src/main/runtime/orca-runtime-files-watch.test.ts",
+ "assertions": [
+ "Windows runtime cleanup waits for the native close event, fails closed at a bounded deadline, and clears retained ownership on late close without retry listeners",
+ "a Windows watcher error before cleanup uses Node's proven native error-close as physical-exit proof, emits final overflow and terminal error, and releases deletion ownership",
+ "pre-publication local runtime setup failure remains owned through destructive cleanup",
+ "failed deletion re-arms runtime watches immediately after ordinary teardown or after delayed physical exit, without reviving a logically stopped watch"
+ ]
+ },
+ {
+ "file": "src/main/runtime/worktree-teardown.test.ts",
+ "assertions": [
+ "overlapping runtime, provider, and registry sweeps stay behind one physical PTY-stop promise",
+ "destructive teardown rejects instead of releasing deletion when physical stop misses its deadline",
+ "cwd-owned and floating PTYs are swept while legacy rows without cwd retain prefix ownership",
+ "remote provider enumeration matches authoritative worktree ownership without touching the local-only registry"
+ ]
+ },
+ {
+ "file": "src/main/runtime/orca-runtime.test.ts",
+ "assertions": [
+ "destructive worktree teardown awaits controller stopAndWait instead of treating fire-and-forget kill as physical exit",
+ "runtime worktree deletion never starts Git removal when a known PTY cannot be physically stopped",
+ "SSH runtime deletion shuts down an authoritatively owned remote PTY before remote Git removal",
+ "a delayed physical-exit retry remains scoped to its registered cleanup owner and cannot tear down a same-id replacement",
+ "failed CLI worktree deletion restores watcher ownership after releasing the install fence",
+ "cross-layer teardown failure joins every bounded watcher close before restoration begins"
]
},
{
@@ -4389,12 +4709,43 @@
"terminal watcher loss flushes a final overflow change before error/end and unregisters cleanup"
]
},
+ {
+ "file": "src/main/runtime/rpc/methods/files-watch-cancellation.test.ts",
+ "assertions": [
+ "the server publishes a cleanup token before ready and files.unwatch aborts pending setup without delivering queued crawl events"
+ ]
+ },
+ {
+ "file": "src/main/runtime/rpc/methods/files-watch-cleanup.test.ts",
+ "assertions": [
+ "a failed paired-web unwatch retries after already-resolved or late physical exit and emits stream end exactly once"
+ ]
+ },
+ {
+ "file": "src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts",
+ "assertions": [
+ "10,000 cancelled SSH callers detach while one registration-owned setup anchor remains"
+ ]
+ },
{
"file": "src/main/providers/ssh-filesystem-provider.test.ts",
"assertions": [
"an SSH caller abort rejects promptly without cancelling another same-root subscriber's shared setup",
"the physical relay request is cancelled when the last pending subscriber leaves",
- "provider disposal cancels pending setup and sends one remote unwatch"
+ "provider disposal cancels pending setup and sends one remote unwatch",
+ "equivalent Windows spellings share one provider generation and terminal failure reaches the surviving owner"
+ ]
+ },
+ {
+ "file": "src/main/providers/ssh-pty-provider.test.ts",
+ "assertions": [
+ "remote process enumeration preserves authoritative worktree ownership while scoping relay PTY ids to the SSH connection"
+ ]
+ },
+ {
+ "file": "src/shared/cross-platform-path.test.ts",
+ "assertions": [
+ "comparison keys preserve literal POSIX backslashes while folding Windows drive and UNC spellings"
]
},
{
@@ -4406,6 +4757,25 @@
"a later same-root listener opens a fresh server subscription instead of reusing a dead stream"
]
},
+ {
+ "file": "src/relay/relay-watcher-parent-removal.test.ts",
+ "assertions": [
+ "POSIX and Windows parent deletion closes and terminally notifies descendant watches before removal while preserving path siblings",
+ "parent deletion waits for descendant setup publication and already-retiring descendant teardown before removal"
+ ]
+ },
+ {
+ "file": "src/relay/relay-watcher-pending-setup-waiters.test.ts",
+ "assertions": [
+ "10,000 aborted relay setup callers detach while one same-root teardown anchor remains and only one replacement installs"
+ ]
+ },
+ {
+ "file": "src/relay/relay-watcher-setup-wait.test.ts",
+ "assertions": [
+ "10,000 cancelled relay setup callers leave exactly one explicit anchor and one base-promise reaction"
+ ]
+ },
{
"file": "src/relay/relay-filesystem-watch-registry.test.ts",
"assertions": [
@@ -4414,19 +4784,48 @@
"replacement emits overflow before later ordered events",
"terminal shard failure preserves same-root clients through recovery",
"pending setup aborts only after the last same-root client leaves",
+ "relay-side removal sends every client a terminal failure, closes every watch, and fences new same-root watcher or PTY setup even when deletion fails",
"a missing child fails closed even if the relay inherits a VITEST environment"
]
},
{
"file": "src/relay/fs-handler.test.ts",
"assertions": [
- "shared watches retain the twenty-root budget and release after every client leaves"
+ "shared watches retain the twenty-root budget and release after every client leaves",
+ "recursive relay deletion closes and terminally notifies same-root watches before removing the directory"
+ ]
+ },
+ {
+ "file": "src/relay/pty-handler.test.ts",
+ "assertions": [
+ "immediate relay shutdown stays pending with the PTY map entry retained until onExit",
+ "a missing exit rejects at the bounded deadline, preserves the physical owner, and a retry joins without duplicate SIGKILL",
+ "Windows relay graceful, fallback, immediate, stale-spawn, exit-dispose, and handler-dispose paths issue at most one ConPTY kill",
+ "relay PTY admission succeeds when post-Node-18 array copy methods are unavailable",
+ "attach dead-PID proof settles a concurrent immediate shutdown before the stale PTY entry is reaped",
+ "concurrent spawn and revive admission is atomic, capped at fifty physical PTYs, and same-id revive is deduplicated",
+ "worktree removal waits explicit and default-cwd PTY creation, rejects later creation, and physically stops only authoritative matching PTYs before deletion",
+ "relay spawn and revive fence distinct worktree-ID and cwd roots, rolling back earlier admissions in reverse when either root is removing"
+ ]
+ },
+ {
+ "file": "src/renderer/src/web/web-runtime-client.test.ts",
+ "assertions": [
+ "a stopped pre-ready paired-web watch retains its callback beyond the former deadline and uses the early server token to unwatch",
+ "transient shared-socket loss replays an active file watch under a new transport id while preserving its logical handle and never revives a stopped watch"
+ ]
+ },
+ {
+ "file": "src/relay/git-handler.test.ts",
+ "assertions": [
+ "remote Git worktree removal executes inside the relay filesystem watcher fence"
]
},
{
"file": "src/relay/subprocess.test.ts",
"assertions": [
- "the real relay bundle serves PTY, filesystem, and Git requests with its adjacent watcher child"
+ "the real relay bundle serves PTY, filesystem, and Git requests with its adjacent watcher child",
+ "the Node-18-targeted relay bundle contains no unsupported array copy methods"
]
},
{
@@ -4441,6 +4840,15 @@
"every release platform packages and gates the hashed watcher child"
]
},
+ {
+ "file": "config/scripts/runtime-file-watcher-resource-probe.mjs",
+ "assertions": [
+ "five healthy roots share one exact watcher PID within the per-child RSS budget",
+ "four quarantine roots use exactly four child PIDs and remain within the global eight-child reservation cap",
+ "CPU and RSS are sampled for every exact child PID and every PID exits during cleanup",
+ "per-child and aggregate RSS and sampled CPU ceilings fail the probe before the physical child cap can hide excess resource use"
+ ]
+ },
{
"file": "config/scripts/runtime-file-watcher-fault-harness.mjs",
"assertions": [
@@ -4459,13 +4867,202 @@
],
"evidenceRuns": [
{
- "date": "2026-07-12",
+ "date": "2026-07-13",
"runner": "local",
"platform": "macos",
- "command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
+ "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-pending-assignment.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/pty-handler.test.ts --reporter=dot",
"result": "passed",
- "durationSeconds": 4.5,
- "summary": "Five relay registry, handler, bundled subprocess, install, and package contract files passed with 114 tests."
+ "durationSeconds": 11.98,
+ "summary": "Thirty-nine watcher, cancellation, desktop/serve, paired-web, WSL, SSH/relay, removal, and PTY physical-exit files passed with 2,008 tests. Capacity, quarantine, runtime-root, relay, and SSH setup layers each prove that 10,000 aborted callers detach while one anchor remains and zero waiters remain after settlement."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
+ "result": "passed",
+ "durationSeconds": 11.59,
+ "summary": "Thirty-four watcher, cancellation, desktop/serve, paired-web, WSL, removal, PTY physical-exit, provider, renderer, and path files passed with 1,999 tests; paired-web cancellation now owns a server token before ready and aborts pending setup without a late native install."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
+ "result": "passed",
+ "durationSeconds": 0.58,
+ "summary": "Five healthy roots shared one child at 50,688 KiB RSS and 4.9% sampled CPU; four quarantine children totaled 202,368 KiB RSS and 29.5% sampled CPU, all budgets and the eight-child cap passed, and exact-PID cleanup was true."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
+ "result": "passed",
+ "durationSeconds": 10.01,
+ "summary": "Twenty-seven watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,886 tests. The suite includes nested removal fencing, renderer/runtime cwd-only admission, legacy provider rows, rejected kill retries, transient WSL capacity, and synchronous-startup reservation cleanup."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
+ "result": "passed",
+ "durationSeconds": 0.56,
+ "summary": "Five healthy roots shared one child at 50,176 KiB RSS and 6.0% sampled CPU; four quarantine children totaled 200,112 KiB RSS and 18.0% sampled CPU. The global eight-child cap and all per-child/aggregate budgets passed, and exact-PID cleanup was true."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
+ "result": "passed",
+ "durationSeconds": 10.01,
+ "summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm run build:electron-vite",
+ "result": "passed",
+ "durationSeconds": 24.41,
+ "summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
+ "result": "passed",
+ "durationSeconds": 0.1,
+ "summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
+ "result": "passed",
+ "durationSeconds": 0.46,
+ "summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm run build:relay",
+ "result": "passed",
+ "durationSeconds": 0.38,
+ "summary": "Relay and adjacent watcher artifacts built for Linux, macOS, and Windows on x64 and arm64, plus the WSL hook relay."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "node config/scripts/relay-watcher-fault-harness.mjs",
+ "result": "passed",
+ "durationSeconds": 0.12,
+ "summary": "The relay and existing PTY survived watcher-child SIGSEGV; replacement delivered overflow and a precise post-crash event."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
+ "result": "passed",
+ "durationSeconds": 9.12,
+ "summary": "Twenty-five watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,762 tests. The suite covers operations joining in-flight termination, kill failures retaining ownership, bounded timeouts, atomic relay spawn/revive caps, and PTY-removal admission."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
+ "result": "passed",
+ "durationSeconds": 0.56,
+ "summary": "Five healthy roots shared one child at 50,096 KiB RSS and 3.4% sampled CPU; four quarantine children totaled 200,576 KiB RSS and 25.0% sampled CPU. The eight-child physical cap and every per-child/aggregate CPU and RSS budget passed, and exact-PID cleanup was true."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
+ "result": "passed",
+ "durationSeconds": 10.69,
+ "summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests, including watcher/PTY removal fencing and recursive deletion failure behavior."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm run build:electron-vite",
+ "result": "passed",
+ "durationSeconds": 24,
+ "summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
+ "result": "passed",
+ "durationSeconds": 0.01,
+ "summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
+ "result": "passed",
+ "durationSeconds": 0.46,
+ "summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm run build:relay",
+ "result": "passed",
+ "durationSeconds": 0.39,
+ "summary": "Relay and adjacent watcher artifacts built for Linux, macOS, and Windows on x64 and arm64, plus the WSL hook relay."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "node config/scripts/relay-watcher-fault-harness.mjs",
+ "result": "passed",
+ "durationSeconds": 0.12,
+ "summary": "The relay and existing PTY survived watcher-child SIGSEGV; replacement delivered overflow and a precise post-crash event."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
+ "result": "passed",
+ "durationSeconds": 9.03,
+ "summary": "Twenty-three watcher, desktop/serve removal, terminal-spawn gate, daemon/SSH physical PTY exit, provider ownership, RPC, renderer, and cross-platform path files passed with 1,630 tests. The suite includes same-turn watcher replacement, authoritative SSH teardown before Git, bounded kill-without-exit failures that retain ownership, and local/SSH deletion fail-closed behavior."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
+ "result": "passed",
+ "durationSeconds": 0.55,
+ "summary": "Five healthy roots shared one child at 50,160 KiB RSS and 5.6% sampled CPU; four quarantine children totaled 199,968 KiB RSS and 16.7% sampled CPU, hard per-child and aggregate RSS/CPU budgets passed, the eight-child reservation cap rejected the next launch, and every exact PID exited during cleanup."
+ },
+ {
+ "date": "2026-07-13",
+ "runner": "local",
+ "platform": "macos",
+ "command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
+ "result": "passed",
+ "durationSeconds": 9.79,
+ "summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 225 tests, including terminal removal notification and recursive deletion fencing."
},
{
"date": "2026-07-12",
@@ -4477,13 +5074,13 @@
"summary": "The relay PID and existing PTY survived watcher-child SIGSEGV; overflow and precise events resumed from a replacement child."
},
{
- "date": "2026-07-12",
+ "date": "2026-07-13",
"runner": "local",
"platform": "macos",
- "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts",
+ "command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
"result": "passed",
- "durationSeconds": 1.7,
- "summary": "10 focused supervisor, pool, child-entry, delivery, desktop/WSL cleanup, runtime-host, RPC, SSH ownership, and renderer-client test files passed with 223 tests."
+ "durationSeconds": 8.85,
+ "summary": "18 focused supervisor, disconnect termination, pool, child-entry, delivery, desktop/WSL cleanup and IPC removal, removal-gate, runtime-host/commands and physical PTY teardown, RPC, SSH ownership, renderer/paired-web clients, and cross-platform path files passed with 1,193 tests."
},
{
"date": "2026-07-12",
@@ -4527,7 +5124,7 @@
},
"performanceBudget": {
"required": true,
- "evidence": "Local runtime operation remains capped at four shared child processes, while each SSH relay is capped at one healthy child instead of spreading a standard repository's three roots across three children. Based on the measured 51.9 MiB per child, normal SSH watcher overhead is bounded near 51.9 MiB rather than 155.7 MiB before relay and PTY overhead. Degraded operation adds at most four quarantine children, distributes affected roots by least load, disposes empty slots, and permits no replacement after a quarantine shard itself fuses. Each child caps directory stats at eight across its assigned roots (at most 32 healthy or 64 total logical stat operations for local runtime; 8 healthy or 40 total per SSH relay), each subscription retains at most one active plus one bounded pending batch, and no polling or serve-process stat fanout is added."
+ "evidence": "The committed resource probe reproducibly measures five healthy roots sharing one child (50,160 KiB RSS, 5.6% sampled CPU) and four quarantine children (199,968 KiB total RSS, 16.7% sampled CPU), enforces 128 MiB/50% per-child and 512 MiB/100% quarantine aggregate budgets, derives a 1 GiB/400% ceiling across the global eight-physical-child cap, and waits for every exact PID during cleanup. A relay policy test separately proves a standard SSH repository's three roots share one healthy child. Shared pending setup attaches one base-promise reaction per generation; quantitative owner tests abort 10,000 callers at each affected layer and require exactly one anchor, then zero explicit waiters after settlement. The shared supervisor capacity barrier is event-driven, one-shot, abortable, and serialized per released physical slot, waking every same-child desktop, paired-runtime, or SSH relay root without consuming crash-recovery attempts; direct WSL capacity retains the same event-driven desktop retry. Relay PTY admission adds at most two deduplicated path checks per spawn/revive and releases both without polling or retained listeners, while dead-PID reaping settles an existing tracker without allocating another timer. Fault quarantine distributes affected roots by least load, disposes empty slots, and permits no replacement after a quarantine shard itself fuses. Each child caps directory stats at eight across its assigned roots (at most eight healthy or 32 quarantined operations), each subscription retains at most one active plus one bounded pending batch, and no additional polling or serve-process stat fanout is added."
},
"promotionCriteria": [
"Run the built-entry SIGSEGV harness in soak for at least 100 consecutive passes or 14 days on macOS.",
@@ -4536,11 +5133,11 @@
],
"knownGaps": [
"The fault harness bundles the real source supervisor and drives the built child, but it does not launch a packaged orca serve pairing session or exercise app.asar path resolution.",
- "The one-child SSH healthy and four-child quarantine memory ceilings are inferred from the earlier one-child measurement; direct degraded-state RSS plus sustained six-writer event-loop-delay and CPU soak evidence is still absent.",
+ "The committed resource probe covers the one-child healthy pool, four-child fault-quarantine ceiling, RSS/CPU sampling, global physical-child cap, and exact-PID cleanup, but sustained six-writer event-loop-delay and CPU soak evidence is still absent.",
"Linux native watcher fault containment is source-equivalent but not live fault-injected in this evidence run.",
- "Windows runtime watches bypass this path; SSH registration ownership is deterministic-contract tested but not live-relay fault-injected."
+ "Windows native runtime watches bypass this child path; WSL reservation/release is deterministic-contract tested but not live fault-injected, and SSH registration ownership is not live-relay fault-injected."
],
- "demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds four local runtime watcher children or one child in any SSH relay, if total healthy plus quarantine operation exceeds eight locally or five in an SSH relay, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process."
+ "demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds one runtime watcher child, if total physical operation exceeds eight children including retiring generations, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process."
}
]
}
diff --git a/config/scripts/build-windows-cli-launcher.test.mjs b/config/scripts/build-windows-cli-launcher.test.mjs
index 4af5a68dd5a..0d14e2373b6 100644
--- a/config/scripts/build-windows-cli-launcher.test.mjs
+++ b/config/scripts/build-windows-cli-launcher.test.mjs
@@ -4,9 +4,14 @@ import { dirname, join, resolve } from 'node:path'
import { spawnSync } from 'node:child_process'
import { describe, expect, it } from 'vitest'
-const itWindows = process.platform === 'win32' ? it : it.skip
const itCrossHost = process.platform === 'win32' ? it.skip : it
const projectRoot = resolve(import.meta.dirname, '../..')
+// Why: cold csc.exe startup exceeds Vitest's 5s unit budget on hosted Windows;
+// keep the larger allowance scoped to the real compiler integration test.
+function itWindows(name, test) {
+ const runner = process.platform === 'win32' ? it : it.skip
+ runner(name, { timeout: 15_000 }, test)
+}
describe('Windows CLI launcher', () => {
itCrossHost('fails closed when the Windows launcher cannot be compiled on this host', () => {
diff --git a/config/scripts/electron-builder-config.test.mjs b/config/scripts/electron-builder-config.test.mjs
index 7d4fd9af56b..d5671498468 100644
--- a/config/scripts/electron-builder-config.test.mjs
+++ b/config/scripts/electron-builder-config.test.mjs
@@ -29,7 +29,9 @@ describe('electron-builder config', () => {
'!native{,/**/*}',
'!skills{,/**/*}',
'!skill-guides{,/**/*}',
+ '!resources/skills/**',
'!tests{,/**/*}',
+ '!pr-evidence{,/**/*}',
'!Casks{,/**/*}',
'!{AGENTS.md,CLAUDE.md,DEVELOPING.md,bundle-size-progress.md}',
'!out/**/*.test.js'
@@ -38,6 +40,12 @@ describe('electron-builder config', () => {
})
it('keeps runtime resources available through extraResources', () => {
+ for (const platform of ['mac', 'linux', 'win']) {
+ expect(electronBuilderConfig[platform].extraResources).toContainEqual({
+ from: 'resources/skills',
+ to: 'skills'
+ })
+ }
expect(electronBuilderConfig.mac.extraResources).toEqual(
expect.arrayContaining([
expect.objectContaining({
diff --git a/config/scripts/generate-skill-bundle-manifest.mjs b/config/scripts/generate-skill-bundle-manifest.mjs
new file mode 100644
index 00000000000..c3542d6f0e2
--- /dev/null
+++ b/config/scripts/generate-skill-bundle-manifest.mjs
@@ -0,0 +1,522 @@
+import { createHash } from 'node:crypto'
+import { execFileSync } from 'node:child_process'
+import { constants } from 'node:fs'
+import { access, lstat, mkdir, readFile, readdir, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+import { isDeepStrictEqual } from 'node:util'
+
+const SCHEMA_VERSION = 1
+const SCRIPT_DIR = import.meta.dirname
+const REPO_ROOT = path.resolve(SCRIPT_DIR, '..', '..')
+const SKILLS_ROOT = path.join(REPO_ROOT, 'skills')
+const OUTPUT_ROOT = path.join(REPO_ROOT, 'resources', 'skills')
+const CURRENT_MANIFEST_PATH = path.join(OUTPUT_ROOT, 'current-manifest.json')
+const SNAPSHOT_REGISTRY_PATH = path.join(OUTPUT_ROOT, 'snapshot-registry.json')
+const RELEASE_MAPPING_PATH = path.join(OUTPUT_ROOT, 'release-mapping.json')
+
+function sha256(bytes) {
+ return createHash('sha256').update(bytes).digest('hex')
+}
+
+function compareCodeUnits(left, right) {
+ return left === right ? 0 : left < right ? -1 : 1
+}
+
+function gitObjectSha(kind, bytes) {
+ return createHash('sha1').update(`${kind} ${bytes.length}\0`).update(bytes).digest()
+}
+
+function normalizeText(bytes) {
+ const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes)
+ return Buffer.from(text.replace(/\r\n/g, '\n').replace(/\r/g, '\n'), 'utf8')
+}
+
+function classifyFile(bytes) {
+ if (bytes.includes(0)) {
+ return 'binary'
+ }
+ try {
+ normalizeText(bytes)
+ return 'text'
+ } catch {
+ return 'binary'
+ }
+}
+
+function assertSafeRelativePath(relativePath) {
+ if (
+ path.isAbsolute(relativePath) ||
+ relativePath === '..' ||
+ relativePath.startsWith(`..${path.sep}`)
+ ) {
+ throw new Error(`Unsafe skill package path: ${relativePath}`)
+ }
+}
+
+function describeFile(manifestPath, bytes, executable) {
+ const classification = classifyFile(bytes)
+ const exactSha256 = sha256(bytes)
+ const textNormalizedSha256 = classification === 'text' ? sha256(normalizeText(bytes)) : null
+ return {
+ path: manifestPath,
+ size: bytes.length,
+ executable,
+ classification,
+ exactSha256,
+ textNormalizedSha256,
+ identitySha256: classification === 'text' && !executable ? textNormalizedSha256 : exactSha256,
+ gitBlobSha: gitObjectSha('blob', bytes).toString('hex')
+ }
+}
+
+function gitTreeSha(entries) {
+ const root = { directories: new Map(), files: [] }
+ for (const entry of entries) {
+ const parts = entry.path.split('/')
+ const filename = parts.pop()
+ let directory = root
+ for (const part of parts) {
+ let child = directory.directories.get(part)
+ if (!child) {
+ child = { directories: new Map(), files: [] }
+ directory.directories.set(part, child)
+ }
+ directory = child
+ }
+ directory.files.push({ filename, ...entry })
+ }
+
+ function hashDirectory(directory) {
+ const children = [
+ ...[...directory.directories].map(([name, child]) => ({
+ mode: '40000',
+ name,
+ hash: hashDirectory(child)
+ })),
+ ...directory.files.map((file) => ({
+ mode: file.executable ? '100755' : '100644',
+ name: file.filename,
+ hash: Buffer.from(file.gitBlobSha, 'hex')
+ }))
+ ].sort((left, right) => {
+ const leftName = left.mode === '40000' ? `${left.name}/` : left.name
+ const rightName = right.mode === '40000' ? `${right.name}/` : right.name
+ return Buffer.from(leftName).compare(Buffer.from(rightName))
+ })
+ const body = Buffer.concat(
+ children.map(({ mode, name, hash }) =>
+ Buffer.concat([Buffer.from(`${mode} ${name}\0`, 'utf8'), hash])
+ )
+ )
+ return gitObjectSha('tree', body)
+ }
+
+ return hashDirectory(root).toString('hex')
+}
+
+async function collectPackageFiles(packageRoot) {
+ const files = []
+ const caseFoldedPaths = new Map()
+
+ async function visit(directory) {
+ const entries = await readdir(directory, { withFileTypes: true })
+ // Why: build-time Node and packaged Electron may ship different ICU data;
+ // package identity order must use the same locale-independent comparison.
+ entries.sort((left, right) => compareCodeUnits(left.name, right.name))
+ for (const entry of entries) {
+ const absolutePath = path.join(directory, entry.name)
+ const relativePath = path.relative(packageRoot, absolutePath)
+ assertSafeRelativePath(relativePath)
+ const manifestPath = relativePath.split(path.sep).join('/')
+ const foldedPath = manifestPath.toLocaleLowerCase('en-US')
+ const collision = caseFoldedPaths.get(foldedPath)
+ if (collision && collision !== manifestPath) {
+ throw new Error(`Case-colliding skill paths: ${collision} and ${manifestPath}`)
+ }
+ caseFoldedPaths.set(foldedPath, manifestPath)
+ const fileStat = await lstat(absolutePath)
+ if (fileStat.isSymbolicLink()) {
+ throw new Error(`Symlink is not allowed in a shipped skill: ${manifestPath}`)
+ }
+ if (fileStat.isDirectory()) {
+ await visit(absolutePath)
+ continue
+ }
+ if (!fileStat.isFile()) {
+ throw new Error(`Special file is not allowed in a shipped skill: ${manifestPath}`)
+ }
+ // Why: Windows observation cannot see execute bits, so an executable file in
+ // a shipped skill would misclassify every pristine Windows install as unrecognized.
+ if ((fileStat.mode & 0o111) !== 0) {
+ throw new Error(`Executable file is not allowed in a shipped skill: ${manifestPath}`)
+ }
+ files.push(describeFile(manifestPath, await readFile(absolutePath), false))
+ }
+ }
+
+ await visit(packageRoot)
+ return sortManifestFiles(files)
+}
+
+function collectGitSkillTreeEntries(treeSha) {
+ const output = execFileSync('git', ['ls-tree', '-r', '-z', treeSha])
+ .toString('utf8')
+ .split('\0')
+ .filter(Boolean)
+ const packages = new Map()
+ for (const line of output) {
+ const match = /^(\d+) (\w+) ([a-f0-9]+)\t(.+)$/.exec(line)
+ if (!match) {
+ throw new Error(`Unexpected git tree entry in ${treeSha}: ${line}`)
+ }
+ const [, mode, type, objectSha, sourcePath] = match
+ const separator = sourcePath.indexOf('/')
+ if (separator <= 0 || separator === sourcePath.length - 1) {
+ throw new Error(`Unsupported shipped skill path in ${treeSha}: ${sourcePath}`)
+ }
+ const name = sourcePath.slice(0, separator)
+ const manifestPath = sourcePath.slice(separator + 1)
+ const entries = packages.get(name) ?? []
+ entries.push({ mode, type, objectSha, manifestPath })
+ packages.set(name, entries)
+ }
+ return packages
+}
+
+function readGitBlobs(objectShas) {
+ const uniqueShas = [...new Set(objectShas)]
+ if (uniqueShas.length === 0) {
+ return new Map()
+ }
+ // Why: released history spans hundreds of tags. Batch mode avoids a Git
+ // subprocess per historical file while remaining available on Git 2.25.
+ const output = execFileSync('git', ['cat-file', '--batch'], {
+ input: `${uniqueShas.join('\n')}\n`,
+ maxBuffer: 64 * 1024 * 1024
+ })
+ const blobs = new Map()
+ let offset = 0
+ for (const requestedSha of uniqueShas) {
+ const headerEnd = output.indexOf(10, offset)
+ if (headerEnd < 0) {
+ throw new Error(`Missing git cat-file header for ${requestedSha}`)
+ }
+ const header = output.subarray(offset, headerEnd).toString('utf8')
+ const match = /^([a-f0-9]+) blob (\d+)$/.exec(header)
+ if (!match || match[1] !== requestedSha) {
+ throw new Error(`Unexpected git cat-file header for ${requestedSha}: ${header}`)
+ }
+ const size = Number(match[2])
+ const contentStart = headerEnd + 1
+ const contentEnd = contentStart + size
+ if (contentEnd >= output.length || output[contentEnd] !== 10) {
+ throw new Error(`Truncated git blob for ${requestedSha}`)
+ }
+ blobs.set(requestedSha, Buffer.from(output.subarray(contentStart, contentEnd)))
+ offset = contentEnd + 1
+ }
+ return blobs
+}
+
+function collectGitPackageFiles(treeSha, name, entries, blobs) {
+ const caseFoldedPaths = new Map()
+ const files = entries.map(({ mode, type, objectSha, manifestPath }) => {
+ if (type !== 'blob' || (mode !== '100644' && mode !== '100755')) {
+ throw new Error(`Unsupported shipped skill entry in ${treeSha}: ${name}/${manifestPath}`)
+ }
+ assertSafeRelativePath(manifestPath)
+ const foldedPath = manifestPath.toLocaleLowerCase('en-US')
+ const collision = caseFoldedPaths.get(foldedPath)
+ if (collision && collision !== manifestPath) {
+ throw new Error(`Case-colliding skill paths in ${treeSha}: ${collision} and ${manifestPath}`)
+ }
+ caseFoldedPaths.set(foldedPath, manifestPath)
+ const bytes = blobs.get(objectSha)
+ if (!bytes) {
+ throw new Error(`Missing git blob ${objectSha} for ${name}/${manifestPath}`)
+ }
+ return describeFile(manifestPath, bytes, mode === '100755')
+ })
+ // Why: git ls-tree emits git byte-order, not the canonical walk order.
+ return sortManifestFiles(files)
+}
+
+// Why: snapshot matching compares files by array index, so every producer —
+// working-tree walk, git history, and runtime observation — must emit one
+// canonical order. This mirrors the sorted depth-first filesystem walk.
+function compareManifestPaths(left, right) {
+ const leftParts = left.split('/')
+ const rightParts = right.split('/')
+ const shared = Math.min(leftParts.length, rightParts.length)
+ for (let index = 0; index < shared; index += 1) {
+ const order = compareCodeUnits(leftParts[index], rightParts[index])
+ if (order !== 0) {
+ return order
+ }
+ }
+ return leftParts.length - rightParts.length
+}
+
+function sortManifestFiles(files) {
+ return [...files].sort((left, right) => compareManifestPaths(left.path, right.path))
+}
+
+function packageDigest(files) {
+ return sha256(
+ Buffer.from(
+ JSON.stringify(
+ files.map((file) => ({
+ path: file.path,
+ executable: file.executable,
+ classification: file.classification,
+ identitySha256: file.identitySha256
+ }))
+ ),
+ 'utf8'
+ )
+ )
+}
+
+function releaseTags() {
+ return execFileSync(
+ 'git',
+ ['for-each-ref', '--sort=creatordate', '--format=%(refname:short)', 'refs/tags/v*'],
+ { encoding: 'utf8' }
+ )
+ .split('\n')
+ .filter((tag) => /^v\d+\.\d+\.\d+(?:[-.][0-9A-Za-z.-]+)?$/.test(tag))
+}
+
+function skillsTreeShasAtRefs(refs) {
+ if (refs.length === 0) {
+ return []
+ }
+ const output = execFileSync('git', ['cat-file', '--batch-check=%(objectname) %(objecttype)'], {
+ input: `${refs.map((ref) => `${ref}:skills`).join('\n')}\n`,
+ encoding: 'utf8'
+ })
+ const lines = output.trimEnd().split('\n')
+ if (lines.length !== refs.length) {
+ throw new Error(`Expected ${refs.length} skills tree identities, received ${lines.length}`)
+ }
+ return lines.map((line, index) => {
+ if (line.endsWith(' missing')) {
+ return null
+ }
+ const match = /^([a-f0-9]+) tree$/.exec(line)
+ if (!match) {
+ throw new Error(`Unexpected skills tree identity at ${refs[index]}: ${line}`)
+ }
+ return match[1]
+ })
+}
+
+function buildReleasedHistory() {
+ const registry = { schemaVersion: SCHEMA_VERSION, skills: {} }
+ const mapping = { schemaVersion: SCHEMA_VERSION, releases: [] }
+ const tags = releaseTags()
+ const treeShas = skillsTreeShasAtRefs(tags)
+ const distinctTreeShas = [...new Set(treeShas.filter(Boolean))]
+ const packagesByTree = new Map(
+ distinctTreeShas.map((treeSha) => [treeSha, collectGitSkillTreeEntries(treeSha)])
+ )
+ const blobs = readGitBlobs(
+ [...packagesByTree.values()].flatMap((packages) =>
+ [...packages.values()].flatMap((entries) => entries.map((entry) => entry.objectSha))
+ )
+ )
+ let previousSkillsTreeSha = null
+ for (const [index, tag] of tags.entries()) {
+ const skillsTreeSha = treeShas[index]
+ if (!skillsTreeSha || skillsTreeSha === previousSkillsTreeSha) {
+ continue
+ }
+ previousSkillsTreeSha = skillsTreeSha
+ const revisions = {}
+ const packages = packagesByTree.get(skillsTreeSha)
+ if (!packages) {
+ throw new Error(`Missing released skill tree ${skillsTreeSha} at ${tag}`)
+ }
+ for (const name of [...packages.keys()].sort(compareCodeUnits)) {
+ const entries = packages.get(name)
+ const filesWithGitHashes = collectGitPackageFiles(skillsTreeSha, name, entries, blobs)
+ if (!filesWithGitHashes.some((file) => file.path === 'SKILL.md')) {
+ continue
+ }
+ const digest = packageDigest(filesWithGitHashes)
+ const snapshots = registry.skills[name] ?? []
+ const latest = snapshots.at(-1)
+ if (!latest || latest.packageDigest !== digest) {
+ const files = filesWithGitHashes.map(({ gitBlobSha: _gitBlobSha, ...file }) => file)
+ snapshots.push({
+ releaseRevision: (latest?.releaseRevision ?? 0) + 1,
+ packageDigest: digest,
+ gitTreeSha: gitTreeSha(filesWithGitHashes),
+ files
+ })
+ registry.skills[name] = snapshots
+ }
+ revisions[name] = snapshots.at(-1).releaseRevision
+ }
+ if (Object.keys(revisions).length > 0) {
+ mapping.releases.push({ appVersion: tag.slice(1), skills: revisions })
+ }
+ }
+ return { registry, mapping }
+}
+
+async function buildArtifacts(appVersion) {
+ const { registry, mapping } = buildReleasedHistory()
+ const releasedSnapshotCounts = Object.fromEntries(
+ Object.entries(registry.skills).map(([name, snapshots]) => [name, snapshots.length])
+ )
+ const skillDirectories = (await readdir(SKILLS_ROOT, { withFileTypes: true }))
+ .filter((entry) => entry.isDirectory())
+ .map((entry) => entry.name)
+ .sort(compareCodeUnits)
+ const currentSkills = []
+ for (const name of skillDirectories) {
+ const filesWithGitHashes = await collectPackageFiles(path.join(SKILLS_ROOT, name))
+ if (!filesWithGitHashes.some((file) => file.path === 'SKILL.md')) {
+ throw new Error(`Skill package ${name} has no top-level SKILL.md`)
+ }
+ const digest = packageDigest(filesWithGitHashes)
+ const snapshots = registry.skills[name] ?? []
+ const latest = snapshots.at(-1)
+ let snapshot = latest
+ if (!latest || latest.packageDigest !== digest) {
+ const files = filesWithGitHashes.map(({ gitBlobSha: _gitBlobSha, ...file }) => file)
+ snapshot = {
+ releaseRevision: (latest?.releaseRevision ?? 0) + 1,
+ packageDigest: digest,
+ gitTreeSha: gitTreeSha(filesWithGitHashes),
+ files
+ }
+ snapshots.push(snapshot)
+ registry.skills[name] = snapshots
+ }
+ currentSkills.push({
+ name,
+ sourcePath: `skills/${name}`,
+ appVersion,
+ ...snapshot
+ })
+ }
+ return {
+ currentManifest: {
+ schemaVersion: SCHEMA_VERSION,
+ appVersion,
+ skills: currentSkills
+ },
+ snapshotRegistry: registry,
+ releaseMapping: mapping,
+ releasedSnapshotCounts
+ }
+}
+
+// Why: released snapshots are the detection ground truth for existing installs,
+// so a generation-logic change must not rewrite them silently. Only the one
+// unreleased working-tree append per skill may change between runs.
+function assertReleasedHistoryPreserved(committedRegistry, artifacts) {
+ if (!committedRegistry || committedRegistry.schemaVersion !== SCHEMA_VERSION) {
+ return
+ }
+ for (const [name, committedSnapshots] of Object.entries(committedRegistry.skills ?? {})) {
+ const releasedCount = artifacts.releasedSnapshotCounts[name] ?? 0
+ const regenerated = artifacts.snapshotRegistry.skills[name] ?? []
+ if (releasedCount < Math.max(0, committedSnapshots.length - 1)) {
+ throw new Error(
+ `Released snapshot history is incomplete for ${name}. ` +
+ 'Fetch all release tags before regenerating skill artifacts.'
+ )
+ }
+ const protectedCount = Math.min(committedSnapshots.length, releasedCount)
+ for (let index = 0; index < protectedCount; index += 1) {
+ const committed = committedSnapshots[index]
+ const rebuilt = regenerated[index]
+ if (!rebuilt || !isDeepStrictEqual(rebuilt, committed)) {
+ throw new Error(
+ `Released snapshot history changed for ${name} at revision ${committed.releaseRevision}. ` +
+ 'Released snapshots are append-only; a deliberate identity migration must update this check.'
+ )
+ }
+ }
+ }
+}
+
+async function readCommittedRegistry() {
+ try {
+ return JSON.parse(await readFile(SNAPSHOT_REGISTRY_PATH, 'utf8'))
+ } catch {
+ return null
+ }
+}
+
+function serialized(value) {
+ return `${JSON.stringify(value, null, 2)}\n`
+}
+
+async function writeArtifacts(artifacts) {
+ await mkdir(OUTPUT_ROOT, { recursive: true })
+ await Promise.all([
+ writeFile(CURRENT_MANIFEST_PATH, serialized(artifacts.currentManifest)),
+ writeFile(SNAPSHOT_REGISTRY_PATH, serialized(artifacts.snapshotRegistry)),
+ writeFile(RELEASE_MAPPING_PATH, serialized(artifacts.releaseMapping))
+ ])
+}
+
+async function verifyArtifacts(artifacts) {
+ const expected = [
+ [CURRENT_MANIFEST_PATH, artifacts.currentManifest],
+ [SNAPSHOT_REGISTRY_PATH, artifacts.snapshotRegistry],
+ [RELEASE_MAPPING_PATH, artifacts.releaseMapping]
+ ]
+ const stale = []
+ for (const [filePath, value] of expected) {
+ try {
+ await access(filePath, constants.R_OK)
+ if ((await readFile(filePath, 'utf8')) !== serialized(value)) {
+ stale.push(filePath)
+ }
+ } catch {
+ stale.push(filePath)
+ }
+ }
+ if (stale.length > 0) {
+ throw new Error(
+ `Generated skill artifacts are stale:\n${stale
+ .map((filePath) => path.relative(REPO_ROOT, filePath))
+ .join('\n')}\nRun pnpm generate:skill-bundle-manifest.`
+ )
+ }
+}
+
+async function main() {
+ const packageJson = JSON.parse(await readFile(path.join(REPO_ROOT, 'package.json'), 'utf8'))
+ const artifacts = await buildArtifacts(packageJson.version)
+ assertReleasedHistoryPreserved(await readCommittedRegistry(), artifacts)
+ await (process.argv.includes('--write') ? writeArtifacts : verifyArtifacts)(artifacts)
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === import.meta.filename) {
+ main().catch((error) => {
+ console.error(error instanceof Error ? error.message : error)
+ process.exitCode = 1
+ })
+}
+
+export {
+ assertReleasedHistoryPreserved,
+ buildArtifacts,
+ buildReleasedHistory,
+ classifyFile,
+ collectPackageFiles,
+ describeFile,
+ gitTreeSha,
+ normalizeText,
+ packageDigest,
+ sortManifestFiles,
+ verifyArtifacts,
+ writeArtifacts
+}
diff --git a/config/scripts/generate-skill-bundle-manifest.test.mjs b/config/scripts/generate-skill-bundle-manifest.test.mjs
new file mode 100644
index 00000000000..cf4a8a100e5
--- /dev/null
+++ b/config/scripts/generate-skill-bundle-manifest.test.mjs
@@ -0,0 +1,199 @@
+import { execFileSync } from 'node:child_process'
+import { chmod, mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+ assertReleasedHistoryPreserved,
+ classifyFile,
+ collectPackageFiles,
+ describeFile,
+ gitTreeSha,
+ normalizeText,
+ packageDigest,
+ sortManifestFiles
+} from './generate-skill-bundle-manifest.mjs'
+
+const temporaryDirectories = []
+
+async function createPackage() {
+ const directory = await mkdtemp(path.join(tmpdir(), 'orca-skill-manifest-'))
+ temporaryDirectories.push(directory)
+ return directory
+}
+
+afterEach(async () => {
+ await Promise.all(
+ temporaryDirectories.splice(0).map((directory) => rm(directory, { recursive: true }))
+ )
+})
+
+describe('skill bundle manifest generator', () => {
+ it('folds platform line endings for text identity', () => {
+ const lf = Buffer.from('first\nsecond\n')
+ const crlf = Buffer.from('first\r\nsecond\r\n')
+
+ expect(classifyFile(lf)).toBe('text')
+ expect(normalizeText(crlf)).toEqual(lf)
+ })
+
+ it('classifies null-containing and invalid UTF-8 content as binary', () => {
+ expect(classifyFile(Buffer.from([0, 1, 2]))).toBe('binary')
+ expect(classifyFile(Buffer.from([0xc3, 0x28]))).toBe('binary')
+ })
+
+ it('uses normalized text identity but exact executable identity', () => {
+ const skillFile = describeFile('SKILL.md', Buffer.from('line one\r\nline two\r\n'), false)
+ const executable = describeFile('run.sh', Buffer.from('#!/bin/sh\r\necho ok\r\n'), true)
+
+ expect(skillFile.identitySha256).toBe(skillFile.textNormalizedSha256)
+ expect(skillFile.identitySha256).not.toBe(skillFile.exactSha256)
+ expect(executable.exactSha256).not.toBe(executable.textNormalizedSha256)
+ expect(executable.identitySha256).toBe(executable.exactSha256)
+ expect(packageDigest([skillFile, executable])).toMatch(/^[a-f0-9]{64}$/)
+ })
+
+ it('orders git-history files identically to the filesystem walk', async () => {
+ const packageRoot = await createPackage()
+ await mkdir(path.join(packageRoot, 'sub'))
+ for (const name of ['apple.md', 'sub.md', 'Zebra.md', path.join('sub', 'inner.txt')]) {
+ await writeFile(path.join(packageRoot, name), `${name}\n`)
+ }
+ const walked = await collectPackageFiles(packageRoot)
+
+ // Why: git ls-tree emits [Zebra.md, apple.md, sub.md, sub/inner.txt]; index-based
+ // snapshot matching requires history and observation to share one order.
+ const gitOrdered = ['Zebra.md', 'apple.md', 'sub.md', 'sub/inner.txt'].map((manifestPath) =>
+ walked.find((file) => file.path === manifestPath)
+ )
+
+ expect(sortManifestFiles(gitOrdered)).toEqual(walked)
+ expect(packageDigest(sortManifestFiles(gitOrdered))).toBe(packageDigest(walked))
+ expect(walked.map((file) => file.path)).toEqual([
+ 'Zebra.md',
+ 'apple.md',
+ 'sub/inner.txt',
+ 'sub.md'
+ ])
+ })
+
+ it('rejects rewrites of released snapshots and allows floating-tail replacement', () => {
+ const snapshot = (releaseRevision, packageDigest) => ({ releaseRevision, packageDigest })
+ const artifacts = {
+ releasedSnapshotCounts: { 'orca-cli': 2 },
+ snapshotRegistry: {
+ schemaVersion: 1,
+ skills: { 'orca-cli': [snapshot(1, 'aaa'), snapshot(2, 'bbb'), snapshot(3, 'ccc')] }
+ }
+ }
+
+ expect(() =>
+ assertReleasedHistoryPreserved(
+ { schemaVersion: 1, skills: { 'orca-cli': [snapshot(1, 'aaa'), snapshot(2, 'bbb')] } },
+ artifacts
+ )
+ ).not.toThrow()
+ expect(() =>
+ assertReleasedHistoryPreserved(
+ {
+ schemaVersion: 1,
+ skills: { 'orca-cli': [snapshot(1, 'aaa'), snapshot(2, 'bbb'), snapshot(3, 'stale')] }
+ },
+ artifacts
+ )
+ ).not.toThrow()
+ expect(() =>
+ assertReleasedHistoryPreserved(
+ {
+ schemaVersion: 1,
+ skills: { 'orca-cli': [snapshot(1, 'aaa'), snapshot(2, 'rewritten')] }
+ },
+ artifacts
+ )
+ ).toThrow('Released snapshot history changed for orca-cli at revision 2')
+ expect(() =>
+ assertReleasedHistoryPreserved(
+ {
+ schemaVersion: 1,
+ skills: {
+ 'orca-cli': [snapshot(1, 'aaa'), { ...snapshot(2, 'bbb'), gitTreeSha: 'rewritten' }]
+ }
+ },
+ artifacts
+ )
+ ).toThrow('Released snapshot history changed for orca-cli at revision 2')
+ expect(() =>
+ assertReleasedHistoryPreserved(
+ {
+ schemaVersion: 1,
+ skills: {
+ 'orca-cli': [snapshot(1, 'aaa'), snapshot(2, 'bbb'), snapshot(3, 'stale')]
+ }
+ },
+ { ...artifacts, releasedSnapshotCounts: { 'orca-cli': 1 } }
+ )
+ ).toThrow('Released snapshot history is incomplete for orca-cli')
+ expect(() => assertReleasedHistoryPreserved(null, artifacts)).not.toThrow()
+ })
+
+ it.runIf(process.platform !== 'win32')(
+ 'rejects executable files in shipped skill packages',
+ async () => {
+ const packageRoot = await createPackage()
+ await writeFile(path.join(packageRoot, 'SKILL.md'), 'skill\n')
+ await writeFile(path.join(packageRoot, 'run.sh'), '#!/bin/sh\necho ok\n')
+ await chmod(path.join(packageRoot, 'run.sh'), 0o755)
+
+ await expect(collectPackageFiles(packageRoot)).rejects.toThrow(
+ 'Executable file is not allowed in a shipped skill: run.sh'
+ )
+ }
+ )
+
+ it.runIf(process.platform === 'linux')('rejects case-colliding paths', async () => {
+ const packageRoot = await createPackage()
+ await writeFile(path.join(packageRoot, 'SKILL.md'), 'skill')
+ await writeFile(path.join(packageRoot, 'Readme.md'), 'one')
+ await writeFile(path.join(packageRoot, 'README.md'), 'two')
+
+ await expect(collectPackageFiles(packageRoot)).rejects.toThrow('Case-colliding skill paths')
+ })
+
+ it.runIf(process.platform !== 'win32')('rejects symlinks inside shipped packages', async () => {
+ const packageRoot = await createPackage()
+ await writeFile(path.join(packageRoot, 'SKILL.md'), 'skill')
+ await symlink('SKILL.md', path.join(packageRoot, 'linked.md'))
+
+ await expect(collectPackageFiles(packageRoot)).rejects.toThrow(
+ 'Symlink is not allowed in a shipped skill'
+ )
+ })
+
+ it('computes the same Git tree identity as Git', async () => {
+ const packageRoot = path.resolve('skills', 'orca-cli')
+ const files = await collectPackageFiles(packageRoot)
+ const expected = execFileSync('git', ['ls-tree', 'HEAD:skills', 'orca-cli'], {
+ encoding: 'utf8'
+ })
+ .trim()
+ .split(/\s+/)[2]
+
+ expect(gitTreeSha(files)).toBe(expected)
+ })
+
+ it('matches Git when a directory and file share a name prefix', async () => {
+ const packageRoot = await createPackage()
+ await mkdir(path.join(packageRoot, 'sub'))
+ await writeFile(path.join(packageRoot, 'sub', 'inner.txt'), 'nested\n')
+ await writeFile(path.join(packageRoot, 'sub.md'), 'sibling\n')
+ const files = await collectPackageFiles(packageRoot)
+ execFileSync('git', ['init', '--quiet'], { cwd: packageRoot })
+ execFileSync('git', ['add', '-A'], { cwd: packageRoot })
+ const expected = execFileSync('git', ['write-tree'], {
+ cwd: packageRoot,
+ encoding: 'utf8'
+ }).trim()
+
+ expect(gitTreeSha(files)).toBe(expected)
+ })
+})
diff --git a/config/scripts/runtime-file-watcher-resource-probe.mjs b/config/scripts/runtime-file-watcher-resource-probe.mjs
new file mode 100644
index 00000000000..67d2df02a63
--- /dev/null
+++ b/config/scripts/runtime-file-watcher-resource-probe.mjs
@@ -0,0 +1,257 @@
+import { execFile } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { mkdtemp, realpath, rm } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { promisify } from 'node:util'
+import { build } from 'esbuild'
+
+const ENTRY_PATH = resolve('out/main/parcel-watcher-process-entry.js')
+const POOL_SOURCE = resolve('src/main/ipc/runtime-watcher-process-pool.ts')
+const FAILURE_SOURCE = resolve('src/main/ipc/parcel-watcher-process-failure.ts')
+const REGISTRY_SOURCE = resolve('src/main/ipc/parcel-watcher-child-registry.ts')
+const MAX_CHILD_RSS_KIB = 128 * 1024
+const MAX_CHILD_CPU_PERCENT = 50
+const MAX_QUARANTINE_RSS_KIB = 512 * 1024
+const MAX_QUARANTINE_CPU_PERCENT = 100
+const PHYSICAL_CHILD_CAP = 8
+const WAIT_TIMEOUT_MS = 15_000
+const execFileAsync = promisify(execFile)
+const require = createRequire(import.meta.url)
+
+async function main() {
+ if (!existsSync(ENTRY_PATH)) {
+ throw new Error(`Missing ${ENTRY_PATH}; run pnpm run build:electron-vite first`)
+ }
+
+ const createdRoots = []
+ const exactPids = new Set()
+ let bundleDir
+ let pool
+ let result
+ try {
+ bundleDir = await mkdtemp(join(tmpdir(), 'orca-runtime-watcher-resource-'))
+ const { RuntimeWatcherProcessPool, WatcherProcessFailure, reserveWatcherChild } =
+ await loadProbe(bundleDir)
+ const roots = []
+ for (let index = 0; index < 5; index++) {
+ const createdRoot = await mkdtemp(join(tmpdir(), `orca-watcher-resource-${index}-`))
+ createdRoots.push(createdRoot)
+ roots.push(await realpath(createdRoot))
+ }
+
+ pool = new RuntimeWatcherProcessPool()
+ await Promise.all(roots.map((rootPath) => pool.subscribe(rootPath, () => undefined, {}, {})))
+ const healthyPids = activeChildPids(pool)
+ assertPidCount(healthyPids, 1, 'five healthy roots')
+ healthyPids.forEach((pid) => exactPids.add(pid))
+ const healthyResources = await sampleResources(healthyPids)
+ assertResourceBudget(healthyResources, 'healthy pool', {
+ maxTotalRssKiB: MAX_CHILD_RSS_KIB,
+ maxTotalCpuPercent: MAX_CHILD_CPU_PERCENT
+ })
+ assertRegistryCapacity(reserveWatcherChild, 7)
+
+ const sharedSlot = [...pool.activeSlots][0]
+ const failure = new WatcherProcessFailure(
+ 'resource probe synthetic shared-shard fault',
+ 'supervisor',
+ 'supervisor_crash_fuse'
+ )
+ for (const record of sharedSlot.supervisor.records.values()) {
+ record.hooks.onTerminalError?.(failure)
+ }
+ await waitFor(() => !isPidAlive(healthyPids[0]), 'healthy child exit')
+
+ await Promise.all(
+ roots.slice(0, 4).map((rootPath) => pool.subscribe(rootPath, () => undefined, {}, {}))
+ )
+ const quarantinePids = activeChildPids(pool)
+ assertPidCount(quarantinePids, 4, 'four fault-quarantine roots')
+ quarantinePids.forEach((pid) => exactPids.add(pid))
+ const quarantineResources = await sampleResources(quarantinePids)
+ assertResourceBudget(quarantineResources, 'quarantine pool', {
+ maxTotalRssKiB: MAX_QUARANTINE_RSS_KIB,
+ maxTotalCpuPercent: MAX_QUARANTINE_CPU_PERCENT
+ })
+ // Four live quarantine children leave four reservations before the global
+ // eight-physical-child ceiling rejects the next launch.
+ assertRegistryCapacity(reserveWatcherChild, 4)
+
+ result = {
+ hostPid: process.pid,
+ healthy: summarizeResources(healthyResources),
+ quarantine: summarizeResources(quarantineResources),
+ physicalChildCap: PHYSICAL_CHILD_CAP,
+ budgets: {
+ maxChildRssKiB: MAX_CHILD_RSS_KIB,
+ maxChildCpuPercent: MAX_CHILD_CPU_PERCENT,
+ maxQuarantineRssKiB: MAX_QUARANTINE_RSS_KIB,
+ maxQuarantineCpuPercent: MAX_QUARANTINE_CPU_PERCENT,
+ maxPhysicalRssKiB: MAX_CHILD_RSS_KIB * PHYSICAL_CHILD_CAP,
+ maxPhysicalCpuPercent: MAX_CHILD_CPU_PERCENT * PHYSICAL_CHILD_CAP
+ },
+ exactPidCleanup: true
+ }
+ } finally {
+ pool?.dispose()
+ await Promise.all(
+ [...exactPids].map((pid) => waitFor(() => !isPidAlive(pid), `watcher PID ${pid} cleanup`))
+ )
+ await Promise.all([
+ ...createdRoots.map((rootPath) => rm(rootPath, { recursive: true, force: true })),
+ bundleDir ? rm(bundleDir, { recursive: true, force: true }) : Promise.resolve()
+ ])
+ }
+ console.log(JSON.stringify(result))
+}
+
+async function loadProbe(bundleDir) {
+ const outfile = join(bundleDir, 'watcher-resource-probe.cjs')
+ await build({
+ stdin: {
+ contents: [
+ `export { RuntimeWatcherProcessPool } from ${JSON.stringify(POOL_SOURCE)}`,
+ `export { WatcherProcessFailure } from ${JSON.stringify(FAILURE_SOURCE)}`,
+ `export { reserveWatcherChild } from ${JSON.stringify(REGISTRY_SOURCE)}`
+ ].join('\n'),
+ resolveDir: process.cwd(),
+ sourcefile: 'runtime-file-watcher-resource-probe-entry.ts',
+ loader: 'ts'
+ },
+ bundle: true,
+ platform: 'node',
+ format: 'cjs',
+ outfile,
+ external: ['@parcel/watcher', 'electron'],
+ logLevel: 'silent'
+ })
+ return require(outfile)
+}
+
+function activeChildPids(pool) {
+ return [...pool.activeSlots]
+ .map((slot) => slot.supervisor.child?.pid)
+ .filter((pid) => Number.isInteger(pid))
+}
+
+function assertPidCount(pids, expected, label) {
+ if (new Set(pids).size !== expected || pids.some((pid) => !isPidAlive(pid))) {
+ throw new Error(
+ `${label} used ${new Set(pids).size} live watcher children; expected ${expected}`
+ )
+ }
+}
+
+function assertRegistryCapacity(reserveWatcherChild, availableReservations) {
+ const releases = []
+ try {
+ for (let index = 0; index < availableReservations; index++) {
+ const release = reserveWatcherChild()
+ if (!release) {
+ throw new Error(`Watcher child registry rejected reservation ${index + 1}`)
+ }
+ releases.push(release)
+ }
+ const unexpectedReservation = reserveWatcherChild()
+ if (unexpectedReservation) {
+ unexpectedReservation()
+ throw new Error('Watcher child registry exceeded its global physical-process cap')
+ }
+ } finally {
+ releases.forEach((release) => release())
+ }
+}
+
+async function sampleResources(pids) {
+ await new Promise((resolveDelay) => setTimeout(resolveDelay, 250))
+ return Promise.all(pids.map((pid) => sampleProcess(pid)))
+}
+
+async function sampleProcess(pid) {
+ if (process.platform === 'win32') {
+ const command =
+ `$p=Get-Process -Id ${pid};` +
+ `[pscustomobject]@{rssKiB=[math]::Round($p.WorkingSet64/1KB);cpuSeconds=$p.CPU}|ConvertTo-Json -Compress`
+ const first = JSON.parse(
+ (await execFileAsync('powershell.exe', ['-NoProfile', '-Command', command])).stdout.trim()
+ )
+ await new Promise((resolveDelay) => setTimeout(resolveDelay, 250))
+ const second = JSON.parse(
+ (await execFileAsync('powershell.exe', ['-NoProfile', '-Command', command])).stdout.trim()
+ )
+ return {
+ pid,
+ rssKiB: second.rssKiB,
+ cpuPercent: Math.max(0, (second.cpuSeconds - first.cpuSeconds) * 400)
+ }
+ }
+ const { stdout } = await execFileAsync('ps', ['-o', 'rss=', '-o', '%cpu=', '-p', String(pid)], {
+ env: { ...process.env, LC_ALL: 'C' }
+ })
+ const [rssKiB, cpuPercent] = stdout.trim().split(/\s+/).map(Number)
+ return { pid, rssKiB, cpuPercent }
+}
+
+function assertResourceBudget(resources, label, { maxTotalRssKiB, maxTotalCpuPercent }) {
+ for (const resource of resources) {
+ if (!Number.isFinite(resource.rssKiB) || resource.rssKiB <= 0) {
+ throw new Error(`Missing RSS evidence for watcher PID ${resource.pid}`)
+ }
+ if (resource.rssKiB > MAX_CHILD_RSS_KIB) {
+ throw new Error(
+ `Watcher PID ${resource.pid} RSS ${resource.rssKiB} KiB exceeded ${MAX_CHILD_RSS_KIB} KiB`
+ )
+ }
+ if (!Number.isFinite(resource.cpuPercent) || resource.cpuPercent < 0) {
+ throw new Error(`Missing CPU evidence for watcher PID ${resource.pid}`)
+ }
+ if (resource.cpuPercent > MAX_CHILD_CPU_PERCENT) {
+ throw new Error(
+ `Watcher PID ${resource.pid} CPU ${resource.cpuPercent}% exceeded ${MAX_CHILD_CPU_PERCENT}%`
+ )
+ }
+ }
+ const summary = summarizeResources(resources)
+ if (summary.totalRssKiB > maxTotalRssKiB) {
+ throw new Error(
+ `${label} RSS ${summary.totalRssKiB} KiB exceeded aggregate budget ${maxTotalRssKiB} KiB`
+ )
+ }
+ if (summary.sampledCpuPercent > maxTotalCpuPercent) {
+ throw new Error(
+ `${label} CPU ${summary.sampledCpuPercent}% exceeded aggregate budget ${maxTotalCpuPercent}%`
+ )
+ }
+}
+
+function summarizeResources(resources) {
+ return {
+ childCount: resources.length,
+ pids: resources.map(({ pid }) => pid),
+ totalRssKiB: resources.reduce((total, { rssKiB }) => total + rssKiB, 0),
+ sampledCpuPercent: resources.reduce((total, { cpuPercent }) => total + cpuPercent, 0)
+ }
+}
+
+function isPidAlive(pid) {
+ try {
+ process.kill(pid, 0)
+ return true
+ } catch {
+ return false
+ }
+}
+
+async function waitFor(predicate, label) {
+ const deadline = Date.now() + WAIT_TIMEOUT_MS
+ while (!predicate()) {
+ if (Date.now() >= deadline) {
+ throw new Error(`Timed out waiting for ${label}`)
+ }
+ await new Promise((resolveDelay) => setTimeout(resolveDelay, 25))
+ }
+}
+
+await main()
diff --git a/config/scripts/serve-sim-seen-keys-leak-benchmark.mjs b/config/scripts/serve-sim-seen-keys-leak-benchmark.mjs
deleted file mode 100644
index 512191599d0..00000000000
--- a/config/scripts/serve-sim-seen-keys-leak-benchmark.mjs
+++ /dev/null
@@ -1,93 +0,0 @@
-#!/usr/bin/env node
-// Benchmark: main-process retained-Set growth of the serve-sim state watcher's
-// external-helper dedupe across worktree switches.
-//
-// emitIfExternal() records one entry per (worktreeId, deviceUdid, pid, wsUrl,
-// streamUrl) tuple in `seenExternalKeys` so a helper is only auto-tabbed once.
-// Before the fix, forgetWorktree() pruned ptyToWorktree and ptyBuffers but never
-// touched seenExternalKeys, so its keys accumulated for the renderer/main
-// process lifetime — only cleared at app shutdown (stop()). This script
-// simulates N bind→detect→forget cycles and reports retained Set size with the
-// prune disabled vs enabled.
-import { performance } from 'node:perf_hooks'
-
-const CYCLES = Number.parseInt(process.env.ORCA_SEEN_KEYS_BENCH_CYCLES ?? '5000', 10)
-const HELPERS_PER_WORKTREE = Number.parseInt(process.env.ORCA_SEEN_KEYS_BENCH_HELPERS ?? '2', 10)
-
-for (const [name, value] of [
- ['ORCA_SEEN_KEYS_BENCH_CYCLES', CYCLES],
- ['ORCA_SEEN_KEYS_BENCH_HELPERS', HELPERS_PER_WORKTREE]
-]) {
- if (!Number.isInteger(value) || value <= 0) {
- throw new Error(`${name} must be a positive integer, received ${value}`)
- }
-}
-
-// Mirror of the watcher's dedupe bookkeeping (serve-sim-state-watcher.ts): a
-// Set of `${worktreeId}::${instanceKey}` keys, plus the prefix-prune the fix
-// adds to forgetWorktree().
-function makeWatcher({ prune }) {
- const seenExternalKeys = new Set()
- return {
- set: seenExternalKeys,
- emitIfExternal(worktreeId, instanceKey) {
- const dedupeKey = `${worktreeId}::${instanceKey}`
- if (seenExternalKeys.has(dedupeKey)) {
- return false
- }
- seenExternalKeys.add(dedupeKey)
- return true
- },
- forgetWorktree(worktreeId) {
- if (!prune) {
- return
- }
- const prefix = `${worktreeId}::`
- for (const key of seenExternalKeys) {
- if (key.startsWith(prefix)) {
- seenExternalKeys.delete(key)
- }
- }
- }
- }
-}
-
-function run({ prune }) {
- const watcher = makeWatcher({ prune })
- const start = performance.now()
- for (let cycle = 0; cycle < CYCLES; cycle++) {
- const worktreeId = `worktree-${cycle}`
- for (let h = 0; h < HELPERS_PER_WORKTREE; h++) {
- // A realistic instance key: device udid :: pid :: wsUrl :: streamUrl.
- const instanceKey = `udid-${cycle}-${h}::pid-${1000 + h}::ws://127.0.0.1:${3100 + h}/ws::http://127.0.0.1:${3100 + h}/stream.mjpeg`
- watcher.emitIfExternal(worktreeId, instanceKey)
- }
- watcher.forgetWorktree(worktreeId)
- }
- return { retained: watcher.set.size, elapsedMs: performance.now() - start }
-}
-
-console.log(
- `serve-sim seenExternalKeys leak benchmark: ${CYCLES} worktree open/forget cycles, ` +
- `${HELPERS_PER_WORKTREE} helper(s)/worktree\n`
-)
-
-const before = run({ prune: false })
-const after = run({ prune: true })
-
-// Each key is ~120-160 bytes (worktreeId + udid + pid + two URLs).
-const APPROX_BYTES_PER_KEY = 140
-const leakedKb = (before.retained * APPROX_BYTES_PER_KEY) / 1024
-
-console.log(
- `before (no prune) retained=${before.retained} keys ` +
- `(~${leakedKb.toFixed(0)} KiB) time=${before.elapsedMs.toFixed(1)}ms`
-)
-console.log(
- `after (prune) retained=${after.retained} keys ` +
- `(~0 KiB) time=${after.elapsedMs.toFixed(1)}ms`
-)
-console.log(
- `\nBounded the dedupe Set to live worktrees: ${before.retained} → ${after.retained} ` +
- `retained keys after ${CYCLES} worktree switches.`
-)
diff --git a/config/scripts/verify-skill-update-roundtrip.mjs b/config/scripts/verify-skill-update-roundtrip.mjs
new file mode 100644
index 00000000000..bfb10a50494
--- /dev/null
+++ b/config/scripts/verify-skill-update-roundtrip.mjs
@@ -0,0 +1,249 @@
+import { execFileSync } from 'node:child_process'
+import {
+ chmod,
+ cp,
+ lstat,
+ mkdir,
+ mkdtemp,
+ readFile,
+ realpath,
+ rm,
+ symlink,
+ writeFile
+} from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import process from 'node:process'
+import { collectPackageFiles, packageDigest } from './generate-skill-bundle-manifest.mjs'
+
+function option(name) {
+ return process.argv.find((value) => value.startsWith(`--${name}=`))?.slice(name.length + 3)
+}
+
+const cliVersion = option('cli')
+const autocrlf = option('autocrlf')
+const shape = option('shape')
+// Why: PR branch names are untrusted workflow input. Keep them out of the
+// generated shell command and pass them to Node through the environment.
+const source = option('source') ?? process.env.SKILL_UPDATE_SOURCE
+const ref = option('ref') ?? process.env.SKILL_UPDATE_REF
+if (
+ !cliVersion ||
+ (autocrlf !== 'true' && autocrlf !== 'false') ||
+ (shape !== 'symlink' && shape !== 'copy') ||
+ !source ||
+ !ref ||
+ !/^[^/\s]+\/[^/\s]+$/.test(source)
+) {
+ throw new Error(
+ 'Usage: verify-skill-update-roundtrip.mjs --cli=