feat(orcad): ship the mobile web page so phones paired to orcad get it (#29882)

* feat(orcad): ship the mobile web page so phones paired to orcad get it

orcad never carried out/mobile-web, so it did not advertise
mobileWeb.bundle.v1 and phones paired directly to an orcad server fell
back to the app's built-in native screens.

The built page now ships in every orcad package at out/mobile-web, the
path getBundledMobileWebBundleRoot already probes under the install
root. Its manifest is a fixed artifact; its content-addressed assets
join the hashed artifact list from that manifest, as one shared copy in
the template's common files. build-orcad fails when the page is missing
or stale, and CI lanes that build orcad now build the page first.

* ci(orcad): check out mobile/ for the Windows host template build

* refactor(orcad): copy the page tree whole and build it once per CI run

The guard already refuses unlisted files, so staging copies the
bundle directory as native-chat-visuals is copied. The shipped template
takes the page the qualification lanes tested, the e2e build artifact
carries it, and the PR smoke builds it through install-mobile-dependencies
behind its own scope step. Drops tests that duplicated the guard's own.

* fix(orcad): refuse a template page asset name that escapes the slot

.github/workflows/e2e.yml

@@ -134,6 +134,10 @@ jobs:
             echo 'available=false' >> "$GITHUB_OUTPUT"
           fi
 
+      # The orcad builds downstream refuse to run without the page; older refs predate the action.
+      - uses: ./.github/actions/build-mobile-web-bundle
+        if: hashFiles('.github/actions/build-mobile-web-bundle/action.yml') != ''
+
       # Only the completed output upload overlaps the change from Node to Electron ABI.
       - name: Upload E2E build output
         id: e2e-build-upload
@@ -519,6 +523,7 @@ jobs:
       - uses: ./.github/actions/prepare-windows-cli-launcher
         with:
           arches: x64
+      - uses: ./.github/actions/build-mobile-web-bundle
       - name: Build the e2e app, CLI, orcad slot and template
         shell: bash
         env:

.github/workflows/node-server-tests.yml

@@ -191,6 +191,7 @@ jobs:
         if: runner.os == 'Windows'
         with:
           arches: ${{ (inputs.build_template && matrix.os == 'windows-2022') && 'x64 arm64' || (runner.arch == 'ARM64' && 'arm64' || 'x64') }}
+      - uses: ./.github/actions/build-mobile-web-bundle
       - run: pnpm build:orcad
         env:
           ORCA_REUSE_PREPARED_WINDOWS_SECURITY: ${{ github.event_name == 'pull_request' && runner.os == 'Windows' && steps.dependencies.outcome == 'success' }}
@@ -297,14 +298,40 @@ jobs:
           # A rerun attempt re-uploads under the same name, which v4 otherwise refuses.
           overwrite: true
 
+  # The container lanes take the page from here: it is platform-independent, and building it needs
+  # mobile/node_modules, which those images never install.
+  mobile_web_bundle:
+    needs: changes
+    if: >-
+      ${{ !cancelled() && needs.changes.outputs.should_run != 'false' &&
+      needs.changes.outputs.qualification != 'false' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.draft != true) }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+      - uses: ./.github/actions/build-mobile-web-bundle
+      - uses: actions/upload-artifact@v7
+        with:
+          name: orcad-mobile-web-bundle
+          path: out/mobile-web/
+          if-no-files-found: error
+          retention-days: 1
+          overwrite: true
+
   linux_glibc_floor:
-    needs: [changes, persistence]
+    needs: [changes, persistence, mobile_web_bundle]
     concurrency:
       group: node-server-linux_glibc_floor-${{ matrix.os }}-${{ github.event_name == 'push' && !inputs.build_template && inputs.ref == '' && github.ref || github.run_id }}
       cancel-in-progress: ${{ github.event_name == 'push' && !inputs.build_template && inputs.ref == '' }}
     # A failed smoke already blocks qualification; missing scope still selects every platform.
     if: >-
       ${{ !cancelled() && needs.persistence.result == 'success' &&
+      needs.mobile_web_bundle.result == 'success' &&
       needs.changes.outputs.should_run != 'false' &&
       needs.changes.outputs.qualification != 'false' }}
     strategy:
@@ -353,6 +380,10 @@ jobs:
           pnpm build:orcad-prebuilds
           pnpm build:orcad-prebuilds --require-slots "$(node config/scripts/build-orcad-prebuilds.mjs --print-slot)"
           pnpm build:orcad-prebuilds --smoke
+      - uses: actions/download-artifact@v8
+        with:
+          name: orcad-mobile-web-bundle
+          path: out/mobile-web
       - run: pnpm build:orcad
       - run: pnpm test:node-server --artifact
       - name: Keep this runner's glibc 2.28 slot for the desktop template
@@ -423,13 +454,14 @@ jobs:
           overwrite: true
 
   linux_musl:
-    needs: [changes, persistence]
+    needs: [changes, persistence, mobile_web_bundle]
     concurrency:
       group: node-server-linux_musl-${{ matrix.os }}-${{ github.event_name == 'push' && !inputs.build_template && inputs.ref == '' && github.ref || github.run_id }}
       cancel-in-progress: ${{ github.event_name == 'push' && !inputs.build_template && inputs.ref == '' }}
     # A failed smoke already blocks qualification; missing scope still selects every platform.
     if: >-
       ${{ !cancelled() && needs.persistence.result == 'success' &&
+      needs.mobile_web_bundle.result == 'success' &&
       needs.changes.outputs.should_run != 'false' &&
       needs.changes.outputs.qualification != 'false' }}
     strategy:
@@ -449,6 +481,10 @@ jobs:
         id: pnpm-verification
         with:
           container-toolchain: 'true'
+      - uses: actions/download-artifact@v8
+        with:
+          name: orcad-mobile-web-bundle
+          path: out/mobile-web
       - name: Verify native Alpine artifact and persistence
         env:
           VERIFICATION_CACHE_PATH: ${{ steps.pnpm-verification.outputs.path }}
@@ -483,10 +519,11 @@ jobs:
 
   # Design D2: the desktop ships every target's addons, merged from the lanes that qualified them.
   desktop_template:
-    needs: [persistence, linux_glibc_floor, linux_glibc217_compat, linux_musl]
+    needs: [persistence, mobile_web_bundle, linux_glibc_floor, linux_glibc217_compat, linux_musl]
     if: >-
       ${{ !cancelled() && inputs.build_template &&
-      needs.persistence.result == 'success' && needs.linux_glibc_floor.result == 'success' &&
+      needs.persistence.result == 'success' && needs.mobile_web_bundle.result == 'success' &&
+      needs.linux_glibc_floor.result == 'success' &&
       needs.linux_glibc217_compat.result == 'success' && needs.linux_musl.result == 'success' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -523,6 +560,11 @@ jobs:
           node config/scripts/merge-orcad-prebuilds.mjs "$RUNNER_TEMP"/orcad-prebuild-lanes/*
           pnpm build:orcad-prebuilds --require-slots
           pnpm build:orcad-prebuilds --require-slots linux-x64-glibc217
+      # The page the qualification lanes tested, not a rebuild.
+      - uses: actions/download-artifact@v8
+        with:
+          name: orcad-mobile-web-bundle
+          path: out/mobile-web
       - run: pnpm build:orcad-template
       - name: Report the template size
         shell: bash

.github/workflows/pr.yml

@@ -412,24 +412,35 @@ jobs:
             bun config/scripts/verify-localization-extraction.mjs
           fi
 
-      # Why both: the ratchet proves nothing reachable from the runtime imports electron,
-      # which is a property of the import graph. This proves the Node artifact it enables
-      # actually boots, pairs, creates a worktree and round-trips a real PTY.
-      - name: Boot orcad and round-trip a terminal
+      - name: Decide whether the orcad terminal smoke runs
+        id: orcad-smoke-scope
         if: needs.code_paths.outputs.static_analysis == 'true'
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          ORCA_BACKGROUND_LAUNCH: '1'
         run: |
           # Detection failures run the smoke; renames retain the removed input path.
           DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
           if git diff --name-only --no-renames -z "$DIFF_BASE" HEAD > "$RUNNER_TEMP/orcad-smoke-changes" &&
             scope="$(node config/scripts/orcad-terminal-smoke-change-scope.mjs "$RUNNER_TEMP/orcad-smoke-changes")" && [ "$scope" = false ]; then
             echo "Orcad terminal smoke inputs are unchanged."
+            echo 'run=false' >> "$GITHUB_OUTPUT"
           else
-            pnpm run smoke:orcad-terminal
+            echo 'run=true' >> "$GITHUB_OUTPUT"
           fi
 
+      # orcad refuses to build without the page phones load.
+      - uses: ./.github/actions/build-mobile-web-bundle
+        if: steps.orcad-smoke-scope.outputs.run == 'true'
+
+      # Why both: the ratchet proves nothing reachable from the runtime imports electron,
+      # which is a property of the import graph. This proves the Node artifact it enables
+      # actually boots, pairs, creates a worktree and round-trips a real PTY.
+      - name: Boot orcad and round-trip a terminal
+        if: steps.orcad-smoke-scope.outputs.run == 'true'
+        env:
+          ORCA_BACKGROUND_LAUNCH: '1'
+        run: pnpm run smoke:orcad-terminal
+
       - name: Verify the generated RPC params catalog
         if: needs.code_paths.outputs.static_analysis == 'true'
         run: node config/scripts/generate-rpc-params-catalog.mjs --check

.github/workflows/ssh-hostile-hosts.yml

@@ -194,6 +194,7 @@ jobs:
           pnpm build:orcad-prebuilds --require-slots linux-x64-glibc,linux-x64-musl,linux-x64-glibc217
       # Only the x64 Linux slots exist here, so the template is built for those two, and
       # glibc217 is staged beside its base.
+      - uses: ./.github/actions/build-mobile-web-bundle
       - name: Build the orcad template
         run: node config/scripts/build-orcad-template.mjs --targets linux-x64-glibc,linux-x64-musl
       - name: Run the hostile-host matrix
@@ -228,6 +229,7 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
+      - uses: ./.github/actions/build-mobile-web-bundle
       - name: Build and smoke this runner's slot and the orcad template
         run: |
           pnpm build:orcad-prebuilds

.github/workflows/ssh-windows-hosts.yml

@@ -106,9 +106,11 @@ jobs:
           persist-credentials: false
           # Keep complete server/test trees; missing future imports fail the unchanged builds.
           # All of src: the orcad-convert cell builds the full e2e app and the bundled CLI.
+          # mobile: the template ships the mobile web page, which builds from mobile/.
           sparse-checkout: |
             .github
             config
+            mobile
             native
             resources
             tests
@@ -159,6 +161,7 @@ jobs:
       - uses: ./.github/actions/prepare-windows-cli-launcher
         with:
           arches: ${{ matrix.arch }}
+      - uses: ./.github/actions/build-mobile-web-bundle
       - name: Build the win32 template
         shell: bash
         env:

.github/workflows/win-orcad-serve-switch-e2e.yml

@@ -98,6 +98,7 @@ jobs:
       - uses: ./.github/actions/prepare-windows-cli-launcher
         with:
           arches: x64
+      - uses: ./.github/actions/build-mobile-web-bundle
       - name: Build the win32-x64 orcad template
         shell: bash
         env:

.github/workflows/wsl-orcad-e2e.yml

@@ -50,6 +50,7 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
+      - uses: ./.github/actions/build-mobile-web-bundle
       - name: Build the template
         run: |
           pnpm build:orcad-prebuilds