From bcb6dd0102ea3ec752a629fb7724a876e5cb3f0b Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Wed, 4 Nov 2026 13:44:42 -0800 Subject: [PATCH] Remove 129 low-value test cases and 45 whole suites (#38233) * Remove low-value renderer and main tests 129 registrations removed; 45 whole suites deleted. * Clean deleted-suite CI reference and retained type import --------- Co-authored-by: Codex --- .github/workflows/pr.yml | 4 +- config/flaky-test-pattern-baseline.txt | 3 - config/reliability-gates.jsonc | 370 ++++++------------ config/scripts/ci-shard-timings.json | 41 -- config/scripts/pr-package-test-paths.mjs | 2 - .../ai-vault/ai-vault-scan-progress.test.ts | 50 --- ...anner-opencode-sqlite-worker-spawn.test.ts | 44 --- ...scanner-opencode-sources-wsl-stall.test.ts | 28 +- .../structured-chat-conversation-copy.test.ts | 27 +- .../automations/service-lifecycle.test.ts | 73 ---- ...er-client-file-channel-negotiation.test.ts | 16 - .../browser-client-upload-command.test.ts | 91 ----- ...rowser-client-host-identity-wiring.test.ts | 124 ------ .../browser-client-page-inventory.test.ts | 31 -- .../browser-extension-install-store.test.ts | 6 - .../wsl-host-browser-jar-identity.test.ts | 106 ----- .../runtime-home-wsl-sibling-bridge.test.ts | 116 ------ ...shared-owner-incarnation-retention.test.ts | 99 ----- .../gh-exec-file-lifetime.test.ts | 33 -- .../git-command-timeout-behavior.test.ts | 103 ----- .../git-operation-executor.test.ts | 48 +-- .../settled-diff-cache-bounds.test.ts | 56 --- ...ktree-create-git-executor-real-git.test.ts | 108 ----- .../creation/worktree-safety-real-git.test.ts | 107 ----- ...rktree-rebase-update-refs-real-git.test.ts | 109 ------ .../hermes-config-flow-insertion.test.ts | 90 +---- .../desktop-browser-bridge-wiring.test.ts | 106 ----- .../pty/ipc/closed-pane-spawn-refusal.test.ts | 69 ---- .../ipc/terminal-view-attributes-ipc.test.ts | 113 ------ .../pty/ipc/write-input-user-input.test.ts | 42 +- ...pty-spawn-cwd-fallback-hung-folder.test.ts | 99 ----- ...untime-environment-removal-storage.test.ts | 21 - ...ithub-pr-refresh-document-lifetime.test.ts | 99 ----- ...cal-pty-registry-folder-workspaces.test.ts | 68 ---- .../memory/memory-snapshot-buckets.test.ts | 71 ---- ...ournal-atomic-settlement-oversized.spec.ts | 82 ---- ...journal-atomic-terminal-settlement.spec.ts | 2 - .../agent-session-stop-note-refresh.test.ts | 98 ----- ...ent-session-codex-version-recovery.test.ts | 96 ----- ...red-agent-session-options-deadline.test.ts | 100 ----- ...agent-session-recovered-queue-idle.test.ts | 75 ---- ...gent-session-resend-ledger-refusal.test.ts | 47 +-- ...-session-restart-continuation-wait.test.ts | 110 ------ ...uctured-agent-session-unopened-tab.test.ts | 116 ------ src/main/omp/omp-session-cwd-lookup.test.ts | 30 -- .../opencode-credential-backend.test.ts | 45 --- .../orcad/orcad-managed-idle-exit.test.ts | 36 -- .../store-prune-gate-signals.test.ts | 114 ------ .../plugin-atomic-file-write.test.ts | 40 +- .../plugin-frame-module-transform.test.ts | 37 -- .../plugin-worker-panel-requests.test.ts | 20 - ...-repaint-wide-char-buffer.node-pty.test.ts | 114 ------ .../agent-session-tab-layout-command.test.ts | 129 ------ ...wser-execution-host-key-resolution.test.ts | 13 - .../runtime/dsh-readiness-transcript.test.ts | 63 --- ...-session-tabs-duplicate-pty-repair.spec.ts | 43 -- ...obile-session-tabs-split-agent-tab.spec.ts | 100 ----- .../worktree-native-chat-setup.spec.ts | 111 ------ src/main/runtime/orca-runtime.test.ts | 3 - .../repo-worktree-admin-fingerprint.test.ts | 94 ----- src/main/runtime/rpc/e2ee-crypto.test.ts | 78 +--- .../worker/worker-start-prompt-budget.test.ts | 43 -- .../mobile-e2ee-v2-compressed-frame.test.ts | 29 +- .../runtime-reference-integration.test.ts | 89 ----- .../runtime-remove-project-host-scope.spec.ts | 28 -- .../runtime-terminal-exit-contracts.test.ts | 54 --- .../identity/terminal-identity-source.test.ts | 92 ----- .../input/terminal-send-plugin-hook.test.ts | 36 +- .../window-tab-start-layout-owner.test.ts | 86 ---- ...rktree-scan-admin-fingerprint-gate.test.ts | 1 - .../worktree-terminal-mutation-lock.test.ts | 35 -- .../skill-discovery-wsl-alias-sharing.test.ts | 78 ---- .../ssh/orcad-migration-path-rewrite.test.ts | 98 ----- .../ssh/orcad-migration-terminal-gate.test.ts | 46 --- ...gent-hook-interrupt-reconciliation.test.ts | 84 ---- .../foreground-activation-policy.test.ts | 27 -- .../local-worktree-path-presence.test.ts | 125 ------ .../wsl-orphan-holder-release.test.ts | 9 - 78 files changed, 126 insertions(+), 5203 deletions(-) delete mode 100644 src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-sqlite-worker-spawn.test.ts delete mode 100644 src/main/automations/service-lifecycle.test.ts delete mode 100644 src/main/browser/client-hosts/file-transfers/browser-client-file-channel-negotiation.test.ts delete mode 100644 src/main/browser/client-hosts/file-transfers/browser-client-upload-command.test.ts delete mode 100644 src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-identity-wiring.test.ts delete mode 100644 src/main/browser/routing/local-host-partitions/wsl-host-browser-jar-identity.test.ts delete mode 100644 src/main/codex-accounts/runtime-home-wsl-sibling-bridge.test.ts delete mode 100644 src/main/daemon/daemon-shared-owner-incarnation-retention.test.ts delete mode 100644 src/main/git/command-runner/git-command-timeout-behavior.test.ts delete mode 100644 src/main/git/source-control/settled-diff-cache-bounds.test.ts delete mode 100644 src/main/git/worktrees/creation/worktree-create-git-executor-real-git.test.ts delete mode 100644 src/main/git/worktrees/creation/worktree-safety-real-git.test.ts delete mode 100644 src/main/git/worktrees/removal/worktree-rebase-update-refs-real-git.test.ts delete mode 100644 src/main/ipc/browser/desktop-browser-bridge-wiring.test.ts delete mode 100644 src/main/ipc/pty/ipc/closed-pane-spawn-refusal.test.ts delete mode 100644 src/main/ipc/pty/ipc/terminal-view-attributes-ipc.test.ts delete mode 100644 src/main/ipc/pty/pty-spawn-cwd-fallback-hung-folder.test.ts delete mode 100644 src/main/ipc/source-control/github-pr-refresh-document-lifetime.test.ts delete mode 100644 src/main/memory/hydrate-local-pty-registry-folder-workspaces.test.ts delete mode 100644 src/main/memory/memory-snapshot-buckets.test.ts delete mode 100644 src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts delete mode 100644 src/main/native-chat/agent-session-wire/agent-session-stop-note-refresh.test.ts delete mode 100644 src/main/native-chat/agent-session-wire/structured-agent-session-codex-version-recovery.test.ts delete mode 100644 src/main/native-chat/agent-session-wire/structured-agent-session-options-deadline.test.ts delete mode 100644 src/main/native-chat/agent-session-wire/structured-agent-session-recovered-queue-idle.test.ts delete mode 100644 src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts delete mode 100644 src/main/native-chat/agent-session-wire/structured-agent-session-unopened-tab.test.ts delete mode 100644 src/main/opencode/opencode-credential-backend.test.ts delete mode 100644 src/main/persistence/loading-store/store-prune-gate-signals.test.ts delete mode 100644 src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts delete mode 100644 src/main/runtime/agent-session-tab-layout-command.test.ts delete mode 100644 src/main/runtime/dsh-readiness-transcript.test.ts delete mode 100644 src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts delete mode 100644 src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts delete mode 100644 src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts delete mode 100644 src/main/runtime/repo-worktree-admin-fingerprint.test.ts delete mode 100644 src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-budget.test.ts delete mode 100644 src/main/runtime/runtime-reference-integration.test.ts delete mode 100644 src/main/runtime/terminal/identity/terminal-identity-source.test.ts delete mode 100644 src/main/runtime/terminal/launch/window-tab-start-layout-owner.test.ts delete mode 100644 src/main/runtime/worktree-terminal-mutation-lock.test.ts delete mode 100644 src/main/skills/skill-discovery-wsl-alias-sharing.test.ts delete mode 100644 src/main/ssh/orcad-migration-path-rewrite.test.ts delete mode 100644 src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts delete mode 100644 src/main/workspaces/catalog/local-worktree-path-presence.test.ts diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 486af2b239f..481e4e6ee38 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -629,9 +629,7 @@ jobs: export GIT_EXEC_PATH="$HOME/.cache/orca-git-compat/git-$ORCA_GIT_COMPAT_VERSION" fi pnpm exec vitest run --config config/vitest.config.ts \ - src/shared/git/compatibility/git-binary-compatibility.test.ts \ - src/main/git/worktrees/creation/worktree-safety-real-git.test.ts \ - src/main/git/worktrees/removal/worktree-rebase-update-refs-real-git.test.ts + src/shared/git/compatibility/git-binary-compatibility.test.ts # Run pinned real Codex: thread/read must repair an unindexed rollout’s threads row; stub-only units cannot detect upstream removal of this behavior. codex_index_heal_contract: diff --git a/config/flaky-test-pattern-baseline.txt b/config/flaky-test-pattern-baseline.txt index 9d8dd4019dd..6e30a30aee9 100644 --- a/config/flaky-test-pattern-baseline.txt +++ b/config/flaky-test-pattern-baseline.txt @@ -548,7 +548,6 @@ 1 test-no-wall-clock:src/main/skills/skill-placement-reconciliation.test.ts 1 test-no-wall-clock:src/main/skills/skill-placement-transaction.test.ts 1 test-no-wall-clock:src/main/ssh/legacy-relay/legacy-relay-bridge-runtime-exit.test.ts -1 test-no-wall-clock:src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts 1 test-no-wall-clock:src/main/star-nag/service-force-show-races.test.ts 1 test-no-wall-clock:src/main/startup/login-shell-environment.test.ts 1 test-no-wall-clock:src/main/window/desktop-integration/macos-press-and-hold-default.defaults-domain.test.ts @@ -1009,7 +1008,6 @@ 2 test-no-wall-clock:src/main/git/command-runner/git-command-resolution-windows-checkout.test.ts 2 test-no-wall-clock:src/main/git/refs/maintenance/repo-ref-maintenance-real-git.test.ts 2 test-no-wall-clock:src/main/git/runner-gh-account-binding.test.ts -2 test-no-wall-clock:src/main/git/source-control/settled-diff-cache-bounds.test.ts 2 test-no-wall-clock:src/main/git/worktrees/catalog/worktree-created-description-real-git.test.ts 2 test-no-wall-clock:src/main/github/client-pr-fallback-number.test.ts 2 test-no-wall-clock:src/main/github/pr-refresh-coordinator-error-cadence.test.ts @@ -1245,7 +1243,6 @@ 3 test-timeout-needs-reason:src/main/daemon/daemon-shutdown-final-checkpoint-caller-deadline.test.ts 3 test-timeout-needs-reason:src/main/daemon/node-pty-windows-input-error.win32.test.ts 3 test-timeout-needs-reason:src/main/native-chat/agent-model-catalog/agent-model-catalog-probe-runner.test.ts -1 test-timeout-needs-reason:src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts 3 test-timeout-needs-reason:src/main/runtime/orchestration-cli-subprocess.test.ts 3 test-timeout-needs-reason:src/main/runtime/terminal-interactive-wait-visibility.test.ts 3 test-timeout-needs-reason:src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc index 4dd1ffabc3d..7fc742c54b7 100644 --- a/config/reliability-gates.jsonc +++ b/config/reliability-gates.jsonc @@ -602,10 +602,10 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime", "mobile-relay"], "coveredPlatforms": ["macos"], "coveredProviders": [], - "coverageNotes": "Audit1383 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audits1340 and1348 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1316 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Production mobile controller, parser, presentation, overlay, view, question, permission and composer run with native surfaces mocked on macOS. Desktop selector groups traverse the real observed-write queue, verified helper, IPC chunker, SSH provider and transport callbacks; paired sends traverse the real dispatcher and runtime writer into that provider. Local/daemon contracts and released-version terminal codecs are covered. Provider labels describe contracts, not physical deployments; physical WSL/Linux/Windows remain gaps. Audit885 removes the isolated observed-send mock-call suite; no replacement-equivalence claim is made. Audit1107 removes the small healthy ordinary SSH-send byte/callback sample. Its exact clear/body/Enter sample alarm is lost; retained slow-answer, cancellation and simulated older-host sequence checks are not claimed as equivalent replacement coverage. The SSH delivery fixture uses controlled fake provider settlement, and its paired path uses the real runtime/dispatcher without a physical SSH or paired wire transport. Audit1278 removes the mobile Stop display/disabled/placeholder suite; its local Stop presentation, repeat-stop and dispatch-visibility alarms are intentionally lost. No equivalent replacement or runtime stopping proof is claimed. Audit1292: The blind OpenCode readiness warning and late launch success/failure content-plus-submit write samples are removed. Their mocked readiness/inspection/delivery alarms are lost; no real PTY delivery or equivalent replacement coverage is claimed. Audit1294 removes mobile/src/session/native-chat/input/mobile-native-chat-permission-send.test.ts. Its mock-only request/capability/private-state/copy alarms are intentionally lost. Remaining tests are not equivalent replacement coverage. Narrowed commands require fresh parent-owned validation; no new runtime, platform or physical mobile evidence is claimed. Audit1302: src/main/ipc/pty/ipc/write-input-acceptance.test.ts: Provider registry and write acceptance/refusal/unverifiable receipts are supplied by fixture; local/daemon/WSL/SSH labels use the same fake provider. Chunking/settlement/remount cases inspect delegated calls or canned receipts without actual provider acceptance/acknowledgement. Lose chunk/refusal/pending/remount and raw-pane routing alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts, mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed. Audit1310 removes the supplied-geometry/direct-callback chat history-paging suite. Its prepend/scroll-position examples are intentionally lost; no real rendered anchoring, equivalent replacement or physical phone proof is claimed. Narrowed commands need fresh validation. Audit1315 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts, mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1316: src/renderer/src/lib/agent-followup-delivery.test.ts removed. Interpreter wrapper/live child/shell readiness and final readiness recheck delivery mock samples lose alarms. No equivalent replacement coverage is claimed. Audit1322 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1334 removes/narrows mobile/src/session/native-chat/mobile-native-chat-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1335 removes/narrows mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/mobile-prompt-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1340: src/main/daemon/daemon-pty-write-settlement-recovery.test.ts removed. Ambiguous handoff settlement remains unverifiable when listener throws. No equivalent replacement coverage is claimed. Audit1348: src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts removed. Check-phase yielding and no-yield single-chunk scheduling work. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Lose admission provenance spy, direct local Escape write outcome matrix and separate client-side SSH no-evidence control. Provider writes mocked; retained tests protect observation order/facts only. No equivalent replacement coverage is claimed.", + "coverageNotes": "Audit1383 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audits1340 and1348 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1316 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Production mobile controller, parser, presentation, overlay, view, question, permission and composer run with native surfaces mocked on macOS. Desktop selector groups traverse the real observed-write queue, verified helper, IPC chunker, SSH provider and transport callbacks; paired sends traverse the real dispatcher and runtime writer into that provider. Local/daemon contracts and released-version terminal codecs are covered. Provider labels describe contracts, not physical deployments; physical WSL/Linux/Windows remain gaps. Audit885 removes the isolated observed-send mock-call suite; no replacement-equivalence claim is made. Audit1107 removes the small healthy ordinary SSH-send byte/callback sample. Its exact clear/body/Enter sample alarm is lost; retained slow-answer, cancellation and simulated older-host sequence checks are not claimed as equivalent replacement coverage. The SSH delivery fixture uses controlled fake provider settlement, and its paired path uses the real runtime/dispatcher without a physical SSH or paired wire transport. Audit1278 removes the mobile Stop display/disabled/placeholder suite; its local Stop presentation, repeat-stop and dispatch-visibility alarms are intentionally lost. No equivalent replacement or runtime stopping proof is claimed. Audit1292: The blind OpenCode readiness warning and late launch success/failure content-plus-submit write samples are removed. Their mocked readiness/inspection/delivery alarms are lost; no real PTY delivery or equivalent replacement coverage is claimed. Audit1294 removes mobile/src/session/native-chat/input/mobile-native-chat-permission-send.test.ts. Its mock-only request/capability/private-state/copy alarms are intentionally lost. Remaining tests are not equivalent replacement coverage. Narrowed commands require fresh parent-owned validation; no new runtime, platform or physical mobile evidence is claimed. Audit1302: src/main/ipc/pty/ipc/write-input-acceptance.test.ts: Provider registry and write acceptance/refusal/unverifiable receipts are supplied by fixture; local/daemon/WSL/SSH labels use the same fake provider. Chunking/settlement/remount cases inspect delegated calls or canned receipts without actual provider acceptance/acknowledgement. Lose chunk/refusal/pending/remount and raw-pane routing alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1303 intentionally removes supplied-state/mock-callback component and hook examples in mobile/src/session/native-chat/input/use-mobile-native-chat-ask-dismiss.test.ts, mobile/src/session/native-chat/input/MobileNativeChatPromptCard.test.tsx. Their exact retired alarms are not equivalent to retained coverage; no new runtime, physical phone or deployed mixed-version evidence is claimed. Audit1310 removes the supplied-geometry/direct-callback chat history-paging suite. Its prepend/scroll-position examples are intentionally lost; no real rendered anchoring, equivalent replacement or physical phone proof is claimed. Narrowed commands need fresh validation. Audit1315 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.composer-lock.test.ts, mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1316: src/renderer/src/lib/agent-followup-delivery.test.ts removed. Interpreter wrapper/live child/shell readiness and final readiness recheck delivery mock samples lose alarms. No equivalent replacement coverage is claimed. Audit1322 removes/narrows mobile/src/session/native-chat/MobileNativeChatView.tail-follow.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1334 removes/narrows mobile/src/session/native-chat/mobile-native-chat-send.test.ts, mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1341 scope1335 removes/narrows mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts, mobile/src/session/mobile-prompt-controller.test.ts, mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts. Exact retired scenarios are intentionally lost; surviving assertions are limited to unchanged retained authored cases. No equivalent replacement, physical phone or deployed mixed-host claim. Fresh validation is required for narrowed commands. Audit1340: src/main/daemon/daemon-pty-write-settlement-recovery.test.ts removed. Ambiguous handoff settlement remains unverifiable when listener throws. No equivalent replacement coverage is claimed. Audit1348: src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts removed. Check-phase yielding and no-yield single-chunk scheduling work. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Lose admission provenance spy, direct local Escape write outcome matrix and separate client-side SSH no-evidence control. Provider writes mocked; retained tests protect observation order/facts only. No equivalent replacement coverage is claimed. Audit1401: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Loses local-only post-accept observation and refused/unverifiable settlement delivery alarms. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": ["https://github.com/stablyai/orca/pull/25761"], "invariant": "A prompt occurrence leaves the input region only when an accepted reply answers it (a current host's provider acknowledgment, or an older host's whole-write acceptance as before) or the user collapses it to a strip above the composer, which writes nothing and keeps the card mounted with its partial answer; status-backed occurrences are told apart by the host wait's start, so view toggles and remounts preserve them while real clear/replacement supersedes them, and a transcript-only one is dropped when the view stops observing it; obsolete results cannot change replacements; selector groups wait for complete writes before pacing; refusal or unknown handoff never causes replay; a card retires an unsubmitted composer send without writing under it or losing its text, and the hidden composer cannot send or interrupt; Collapse or Escape folds a card without writing, never during an in-flight answer, and a new occurrence shows expanded again; the phone blocks only Send while a card is expanded and shows one card per occurrence; cancellation stops unsent groups and active dictation can stop.", - "oracle": "Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): After acknowledged phone replies with stale host status, the exact card disappears and Send is enabled; unknown, refused or unverifiable-settlement replies retain enabled choices, while an older host's accepted reply dismisses like an acknowledged one; a same-occurrence view toggle retains pending acknowledgment and real replacements discard it. A slow 32 KiB SSH answer completes all chunks before Enter; cancellation preserves issued bytes but omits remaining groups. Paired settlement invokes the actual provider and lost callbacks remain unknown; older hosts deliver ordinary messages, launch and selector groups once and their accepted answers dismiss as before. An answered card stays hidden across a view remount; a collapsed card is a strip that frees the composer and expands back; an identical question in a new wait shows again; a composer send caught by a new card keeps its bubble without submitting or clearing the line under it.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Retained unchanged-selector receipts are the only current execution evidence. Reduced-source assertions await validation. Historical prior oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): After acknowledged phone replies with stale host status, the exact card disappears and Send is enabled; unknown, refused or unverifiable-settlement replies retain enabled choices, while an older host's accepted reply dismisses like an acknowledged one; a same-occurrence view toggle retains pending acknowledgment and real replacements discard it. A slow 32 KiB SSH answer completes all chunks before Enter; cancellation preserves issued bytes but omits remaining groups. Paired settlement invokes the actual provider and lost callbacks remain unknown; older hosts deliver ordinary messages, launch and selector groups once and their accepted answers dismiss as before. An answered card stays hidden across a view remount; a collapsed card is a strip that frees the composer and expands back; an identical question in a new wait shows again; a composer send caught by a new card keeps its bubble without submitting or clearing the line under it.", "commands": [ "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2", "ORCA_BACKGROUND_LAUNCH=1 mobile/node_modules/.bin/vitest run --config mobile/vitest.config.ts mobile/src/session/native-chat/MobileNativeChatView.prompt-presentation.test.ts mobile/src/session/native-chat/use-mobile-native-chat-controller.test.ts mobile/src/session/native-chat/MobileNativeChatView.failure-banner.test.ts mobile/src/session/mobile-prompt-controller.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-cancel-ask.test.ts mobile/src/session/native-chat/input/use-mobile-native-chat-answer-send.test.ts mobile/src/session/native-chat/transcript/use-mobile-native-chat-message-send.test.ts --maxWorkers=2", @@ -778,7 +778,8 @@ "Audit1383 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-11-04\",\n \"runner\": \"local\",\n \"platform\": \"linux\",\n \"result\": \"passed\",\n \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts --maxWorkers=2\",\n \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts --maxWorkers=2\",\n \"durationSeconds\": 15.57,\n \"summary\": \"Test Files 13 passed (13); Tests 218 passed (218). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e.\"\n }", "Audit1383 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-11-04\",\n \"runner\": \"local\",\n \"platform\": \"linux\",\n \"result\": \"passed\",\n \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-composer.test.tsx src/renderer/src/components/native-chat/use-native-chat-prompt-card-presentation.test.ts src/renderer/src/components/native-chat/NativeChatComposer.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/main/runtime/runtime-terminal-writer.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts tests/e2e/native-chat-ssh-delivery.unit.test.ts --maxWorkers=2\",\n \"durationSeconds\": 30.79,\n \"summary\": \"Test Files 20 passed (20); Tests 310 passed (310). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n }", "Audit1383 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-11-04\",\n \"runner\": \"local\",\n \"platform\": \"linux\",\n \"result\": \"passed\",\n \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts --maxWorkers=2\",\n \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts src/renderer/src/components/native-chat/NativeChatResolvedView.prompt-card-input.test.tsx src/renderer/src/components/native-chat/NativeChatResolvedView.turn-status.test.tsx src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/lib/agent-paste-draft.test.ts src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts src/main/ipc/pty/ipc/write-input-user-input.test.ts src/main/ipc/pty/pty-write-ipc-validation.test.ts --maxWorkers=2\",\n \"durationSeconds\": 15.79,\n \"summary\": \"Test Files 13 passed (13); Tests 218 passed (218). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n }", - "Audit1383 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[]}. Static assertion references are not current execution evidence." + "Audit1383 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[]}. Static assertion references are not current execution evidence.", + "Audit1401: src/main/ipc/pty/ipc/write-input-user-input.test.ts reduced. Loses local-only post-accept observation and refused/unverifiable settlement delivery alarms. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []" ], "promotionCriteria": [ "Record change-reverted red/green evidence and repeatable remote rendered approval/question/dictation journeys.", @@ -790,7 +791,7 @@ "id": "agent-status.claude-task-wakeup-cycle", "title": "Claude task wake-ups cannot finish an automation before its lead turn", "maturity": "experimental", - "protection": "partial", + "protection": "none", "owner": "agent-status", "layer": "execution-host-hooks-and-runtime-wait", "surfaces": [ @@ -800,67 +801,34 @@ ], "platforms": ["macos", "linux", "windows"], "providers": ["local", "ssh", "wsl", "remote-runtime"], - "coveredPlatforms": ["linux"], - "coveredProviders": ["local"], - "coverageNotes": "The reduced six-file selector passed 125 cases on Linux, exercising real HTTP hook ingress and the existing runtime automation observer. SSH/WSL ownership remains simulated; no physical remote-host, native macOS/Windows, task capacity or timer/resource-budget claim. Audit1318: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts: Hand-built task notifications/cap inventories plus a manually assembled normalize/cache/expiry-timer host run under fake clocks with production lease constants and private state. No actual main/relay entry or provider delivery. Intentionally lose owed-task/Monitor/teammate/reset/notification expiry and cancellation-restatement alarms; no equivalent replacement claimed. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.", + "coveredPlatforms": [], + "coveredProviders": [], + "coverageNotes": "Audit1401 intentionally deletes or reduces the listed sources. No fresh execution result validates their reduced selectors. Historical coverage account: The reduced six-file selector passed 125 cases on Linux, exercising real HTTP hook ingress and the existing runtime automation observer. SSH/WSL ownership remains simulated; no physical remote-host, native macOS/Windows, task capacity or timer/resource-budget claim. Audit1318: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts: Hand-built task notifications/cap inventories plus a manually assembled normalize/cache/expiry-timer host run under fake clocks with production lease constants and private state. No actual main/relay entry or provider delivery. Intentionally lose owed-task/Monitor/teammate/reset/notification expiry and cancellation-restatement alarms; no equivalent replacement claimed. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1401: src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts removed. Loses current-host proof, foreign/disposed/unsubscribed and legacy interrupt dispatch fence alarms. No equivalent replacement coverage is claimed.", "motivatingLinks": [ "https://github.com/stablyai/orca/pull/24878", "https://github.com/stablyai/orca/issues/23942" ], "invariant": "An ended tracked task stays pending until its wake-up and finishing turn end; missing wake-ups expire only after 60 idle seconds. Cancellation remains owned by the executing host, duplicate delivery cannot create a fresh completion veto, and fresh native rest can recover a lost finishing Stop.", - "oracle": "Replay captured hook ordering through production HTTP entry points and native ready bytes through the actual automation observer. Check local/relay state, cancellation/new-turn fencing, fresh versus retained rest, zero global status reads during indexed runtime waits.", - "commands": [ - "ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts" - ], - "testFiles": [ - "src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts", - "src/main/runtime/tui-idle-claude-task-wakeup.test.ts", - "src/main/runtime/tui-idle-hook-lane-runtime.test.ts", - "src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts", - "src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts" - ], - "assertionRefs": [ - { - "file": "src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts", - "assertions": [ - "does not reopen notification debt for a duplicate child-end post", - "waits on captured ready bytes through task finishing or missing wake-up expiry: %s" - ] - }, - { - "file": "src/main/runtime/tui-idle-hook-lane-runtime.test.ts", - "assertions": [ - "reads only its pane with 512 unrelated agents, including an empty index: pending=%s" - ] - } - ], - "evidenceRuns": [ - { - "date": "2026-11-04", - "runner": "local", - "platform": "linux", - "result": "passed", - "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts --maxWorkers=2", - "currentCommand": "ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts", - "durationSeconds": 10.48, - "summary": "Test Files 5 passed (5); Tests 108 passed (108). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head bb0888828cc11d69b4463514e7f8cb121771b14f." - } - ], + "oracle": "No current automated execution oracle is claimed for this gate after Audit1401 retired changed-source receipts. Historical oracle account: Replay captured hook ordering through production HTTP entry points and native ready bytes through the actual automation observer. Check local/relay state, cancellation/new-turn fencing, fresh versus retained rest, zero global status reads during indexed runtime waits.", + "commands": [], + "testFiles": [], + "assertionRefs": [], + "evidenceRuns": [], "runtimeBudget": { "p95Seconds": 30, - "scope": "Focused local host/relay/runtime suite; CI p95 and platform soak not established. New focused Linux selector completed once; historical p95 target is unchanged and not measured by this execution." + "scope": "Historical prior-selector budget; reduced selector has no new runtime measurement." }, "flakeHistory": { "status": "not-started", - "evidence": "The fresh reduced Linux fixture selector passed once; no CI soak history." + "evidence": "Audit1401 retired changed-source receipts; reduced selector has no new soak result. Historical account: The fresh reduced Linux fixture selector passed once; no CI soak history." }, "redGreenEvidence": { - "status": "complete", - "evidence": "Identical corrected production automation test with actual Claude launch ownership prematurely completes on both parent main and the original PR; repaired candidate holds through task finishing. Same endpoint captures fail 12 of 18 parent tests. Indexed runtime counters fail before targeted reads and pass after." + "status": "missing", + "evidence": "Audit1401 changed referenced test sources; no new red/green validation. Historical account: Identical corrected production automation test with actual Claude launch ownership prematurely completes on both parent main and the original PR; repaired candidate holds through task finishing. Same endpoint captures fail 12 of 18 parent tests. Indexed runtime counters fail before targeted reads and pass after." }, "performanceBudget": { "required": true, - "evidence": "Audit1297 removed direct task-map capacity and timer/publication count assertions. Indexed runtime read suites remain listed, but the reduced selector has no new run. No current task/timer resource-budget proof is claimed." + "evidence": "Historical budget only after Audit1401 changed test sources; no new measurement. Previous account: Audit1297 removed direct task-map capacity and timer/publication count assertions. Indexed runtime read suites remain listed, but the reduced selector has no new run. No current task/timer resource-budget proof is claimed." }, "knownGaps": [ "Missing notifications intentionally postpone completion up to 60 idle seconds plus the existing runtime polling interval.", @@ -871,7 +839,13 @@ "Audit1297 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n {\n \"file\": \"src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts\",\n \"assertions\": [\n \"does not reopen notification debt for a duplicate child-end post\",\n \"waits on captured ready bytes through task finishing or missing wake-up expiry: %s\"\n ]\n },\n {\n \"file\": \"src/main/runtime/tui-idle-hook-lane-runtime.test.ts\",\n \"assertions\": [\n \"reads only its pane with 512 unrelated agents, including an empty index: pending=%s\"\n ]\n }\n]", "Audit1300 reran the reduced six-file selector on Linux after audit1297 archived the complete former whole-selector receipt. Partial protection is restored only for the surviving assertion references; the retired task/timer bounds remain unprotected.", "Audit1318: src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts: Hand-built task notifications/cap inventories plus a manually assembled normalize/cache/expiry-timer host run under fake clocks with production lease constants and private state. No actual main/relay entry or provider delivery. Intentionally lose owed-task/Monitor/teammate/reset/notification expiry and cancellation-restatement alarms; no equivalent replacement claimed. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.", - "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-11-04\",\n \"runner\": \"local\",\n \"platform\": \"linux\",\n \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts --maxWorkers=2\",\n \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 11.23,\n \"summary\": \"Test Files 6 passed (6); Tests 125 passed (125). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n }" + "Audit1318 retired the complete dated receipt after source coverage changed. Its result does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-11-04\",\n \"runner\": \"local\",\n \"platform\": \"linux\",\n \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts --maxWorkers=2\",\n \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/shared/agent-hook-listener/normalization/agent-hook-listener-claude-task-notification.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 11.23,\n \"summary\": \"Test Files 6 passed (6); Tests 125 passed (125). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"\n }", + "Audit1401: src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts removed. Loses current-host proof, foreign/disposed/unsubscribed and legacy interrupt dispatch fence alarms. No equivalent replacement coverage is claimed.", + "Audit1401 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-11-04\",\n \"runner\": \"local\",\n \"platform\": \"linux\",\n \"result\": \"passed\",\n \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts --maxWorkers=2\",\n \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\",\n \"durationSeconds\": 10.48,\n \"summary\": \"Test Files 5 passed (5); Tests 108 passed (108). Focused unit selector; native adapters remain mocked where present. Single local execution, not a p95 or cross-platform measurement. Source head bb0888828cc11d69b4463514e7f8cb121771b14f.\"\n }", + "Audit1401 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"linux\"],\"coveredProviders\":[\"local\"]}. Remaining provider scope applies only to unchanged-source receipts.", + "Audit1401 retained but unvalidated assertion inventory pending a new run of the reduced command:\n[\n {\n \"file\": \"src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts\",\n \"assertions\": [\n \"does not reopen notification debt for a duplicate child-end post\",\n \"waits on captured ready bytes through task finishing or missing wake-up expiry: %s\"\n ]\n },\n {\n \"file\": \"src/main/runtime/tui-idle-hook-lane-runtime.test.ts\",\n \"assertions\": [\n \"reads only its pane with 512 unrelated agents, including an empty index: pending=%s\"\n ]\n }\n]", + "Audit1401 archived original active assertionRefs verbatim after retirement of all passed receipts:\n[\n {\n \"file\": \"src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts\",\n \"assertions\": [\n \"does not reopen notification debt for a duplicate child-end post\",\n \"waits on captured ready bytes through task finishing or missing wake-up expiry: %s\"\n ]\n },\n {\n \"file\": \"src/main/runtime/tui-idle-hook-lane-runtime.test.ts\",\n \"assertions\": [\n \"reads only its pane with 512 unrelated agents, including an empty index: pending=%s\"\n ]\n }\n ]", + "Audit1401 archived active selectors after retirement of all passed receipts: {\"commands\":[\"ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts src/main/runtime/tui-idle-claude-task-wakeup.test.ts src/main/runtime/tui-idle-hook-lane-runtime.test.ts src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\"],\"testFiles\":[\"src/main/agent-hooks/server-claude-task-wakeup-lifecycle.test.ts\",\"src/main/runtime/tui-idle-claude-task-wakeup.test.ts\",\"src/main/runtime/tui-idle-hook-lane-runtime.test.ts\",\"src/wsl-guest/agent-hook-interrupt-reconciliation.test.ts\",\"src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts\"]}" ], "promotionCriteria": [ "Collect cross-platform and physical remote-host evidence plus the policy soak threshold without relaxing owner, phase, deadline or resource assertions." @@ -895,7 +869,7 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": [], - "coverageNotes": "Audits1340 and1348 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Real temporary profile databases and production Store/CLI recovery paths on macOS; mocked updater feed admission for macOS/Linux/Windows. PTY execution and remote wire payloads are unchanged. Profile persistence executes on its owning runtime. Native installers and physical remote hosts are untested. Audit1340: src/main/orca-profiles/profile-session-owner-transfer.test.ts removed. Ambiguous markdown owner override suppression. src/main/persistence/profile-state/profile-state-writer-capacity-errors.test.ts reduced. Capacity code and permission/busy distinction across synthetic nested errors. No equivalent replacement coverage is claimed. Audit1348: src/main/persistence/loading-store/pty-incarnation-renderer-save.test.ts reduced. Merging another pane incarnation from a partially populated renderer map. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1366 deletes pty-binding-fast-lane.test.ts (five handcrafted predicate/diagnostic inventories) and removes two no-change/switch-off registrations from reused-terminal-id-unbind.test.ts. Those predicate-only and default-branch alarms are intentionally lost; remaining incarnation unbinding behavior is retained. Directory-selected prior unit receipts include these changed sources and are historical, not validation of the reduced set. The separate unchanged E2E receipt remains scoped to its own command. Fresh unit validation remains required. Audit1371 removes the captureSource boolean invalidation replay from durable-settings-write.spec.ts. Actual SQLite acknowledgement, rollback, concurrent edit and optional-key restoration callbacks remain unchanged. Catalog-invalidation-only alarm is intentionally lost; no equivalent report-publication coverage is claimed. Directory-selected old unit receipts are historical; fresh validation remains required. Audit1383: src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts removed. Lose Japanese copy, copy/quit/ambiguity button payloads, selection index/confirmation and missing date formatting alarms. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1400: src/main/persistence/loading-store/workspace-session-terminal-binding-replay.test.ts reduced. Lose implementation-specific prior-tab read work bound; no behavior assertion lost beyond computed bulk replay. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", + "coverageNotes": "Audits1340 and1348 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Real temporary profile databases and production Store/CLI recovery paths on macOS; mocked updater feed admission for macOS/Linux/Windows. PTY execution and remote wire payloads are unchanged. Profile persistence executes on its owning runtime. Native installers and physical remote hosts are untested. Audit1340: src/main/orca-profiles/profile-session-owner-transfer.test.ts removed. Ambiguous markdown owner override suppression. src/main/persistence/profile-state/profile-state-writer-capacity-errors.test.ts reduced. Capacity code and permission/busy distinction across synthetic nested errors. No equivalent replacement coverage is claimed. Audit1348: src/main/persistence/loading-store/pty-incarnation-renderer-save.test.ts reduced. Merging another pane incarnation from a partially populated renderer map. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1366 deletes pty-binding-fast-lane.test.ts (five handcrafted predicate/diagnostic inventories) and removes two no-change/switch-off registrations from reused-terminal-id-unbind.test.ts. Those predicate-only and default-branch alarms are intentionally lost; remaining incarnation unbinding behavior is retained. Directory-selected prior unit receipts include these changed sources and are historical, not validation of the reduced set. The separate unchanged E2E receipt remains scoped to its own command. Fresh unit validation remains required. Audit1371 removes the captureSource boolean invalidation replay from durable-settings-write.spec.ts. Actual SQLite acknowledgement, rollback, concurrent edit and optional-key restoration callbacks remain unchanged. Catalog-invalidation-only alarm is intentionally lost; no equivalent report-publication coverage is claimed. Directory-selected old unit receipts are historical; fresh validation remains required. Audit1383: src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts removed. Lose Japanese copy, copy/quit/ambiguity button payloads, selection index/confirmation and missing date formatting alarms. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1400: src/main/persistence/loading-store/workspace-session-terminal-binding-replay.test.ts reduced. Lose implementation-specific prior-tab read work bound; no behavior assertion lost beyond computed bulk replay. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/persistence/loading-store/store-prune-gate-signals.test.ts removed. Loses gate signals for release/removal and parked state for additive writes. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", "motivatingLinks": ["https://github.com/stablyai/orca/pull/23262"], "invariant": "Ordinary lifecycle operations durably checkpoint SQLite without rewriting legacy JSON; missing SQLite cannot revive stale JSON; explicit recovery preserves artifacts and selects the named profile without changing active-profile state; the updater refuses JSON-era releases before admitting their feed.", "oracle": "The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Assert unchanged JSON through final flush and maintenance, failure propagation before quit, missing-database refusal after marker publication, archived SQLite and latest committed JSON from inactive-profile conversion, unchanged active database/index/HTTP marker, and zero feed/check calls for incompatible pinned/local builds.", @@ -972,7 +946,8 @@ "Historical receipt retired by audit1366 at 25cd81665e1b8eaf75d7715d37999ca1583e1228; original record unchanged, not current validation:\n{\n \"date\": \"2026-11-04\",\n \"runner\": \"local\",\n \"platform\": \"linux\",\n \"result\": \"passed\",\n \"command\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/handlers/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/cli/specs/profile-state.test.ts src/main/ipc/profiles/orca-profiles-switch-persistence.test.ts src/main/orca-profiles src/main/persistence/loading-store src/main/persistence/profile-state src/main/startup/profile-state-recovery-preflight.test.ts src/main/updater/updater.build-channel-selection.test.ts src/shared/profile-state-build-compatibility.test.ts src/shared/profile-state-recovery-command.test.ts --maxWorkers=2\",\n \"currentCommand\": \"ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/persistence/profile-state src/main/persistence/loading-store src/main/orca-profiles src/main/startup/profile-state-recovery-preflight.test.ts src/main/ipc/profiles/orca-profiles-switch-persistence.test.ts src/main/updater/updater.build-channel-selection.test.ts src/cli/handlers/profile-state.test.ts src/cli/handlers/profile-state-recovery-admission.test.ts src/cli/specs/profile-state.test.ts src/cli/runtime/profile-state-recovery-launch.test.ts src/shared/profile-state-recovery-command.test.ts src/shared/profile-state-build-compatibility.test.ts\",\n \"durationSeconds\": 90.28,\n \"summary\": \"Test Files 145 passed | 2 skipped (147); Tests 1588 passed | 30 skipped (1618). Focused Linux unit execution; no physical-provider, p95 or cross-platform claim. Source head 415c9cffc2d10024131ec4b6721767a22195de6d.\"\n }", "Audit1371 removes the captureSource boolean invalidation replay from durable-settings-write.spec.ts. Actual SQLite acknowledgement, rollback, concurrent edit and optional-key restoration callbacks remain unchanged. Catalog-invalidation-only alarm is intentionally lost; no equivalent report-publication coverage is claimed. Directory-selected old unit receipts are historical; fresh validation remains required.", "Audit1383: src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts removed. Lose Japanese copy, copy/quit/ambiguity button payloads, selection index/confirmation and missing date formatting alarms. No equivalent replacement coverage is claimed.", - "Audit1400: src/main/persistence/loading-store/workspace-session-terminal-binding-replay.test.ts reduced. Lose implementation-specific prior-tab read work bound; no behavior assertion lost beyond computed bulk replay. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." + "Audit1400: src/main/persistence/loading-store/workspace-session-terminal-binding-replay.test.ts reduced. Lose implementation-specific prior-tab read work bound; no behavior assertion lost beyond computed bulk replay. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", + "Audit1401: src/main/persistence/loading-store/store-prune-gate-signals.test.ts removed. Loses gate signals for release/removal and parked state for additive writes. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." ], "promotionCriteria": [ "Collect cross-platform CI and crash-boundary soak evidence without weakening authority or durable-save assertions." @@ -1640,7 +1615,7 @@ "providers": ["local", "remote-runtime"], "coveredPlatforms": ["linux"], "coveredProviders": [], - "coverageNotes": "Production SQLite and reducer tests on macOS. Execution-host-local storage behavior is shared by remote runtimes; no live SSH or Windows/Linux run. PTY, daemon, WSL process launch, transport framing and mobile rendering are unaffected. Test-value audit1293 removes src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts (1 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts: Keep actual SQLite replay classification of future versions, first sequence damage and missing epoch against independent literal state/damage expectations. Remove GC/heap thresholds and private reducer-call counters plus same-connection PASSIVE checkpoint busy checks, which do not demonstrate an independently blocked checkpoint. Lose assembled replay memory/snapshot scheduling alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1345: focused Linux unit execution now validates this primary selector on source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0. Historical platform statements above describe earlier receipts. Removed fixture/matrix/call-count alarms are intentional losses with no equivalent replacement; no live SSH, physical-provider, p95 or cross-platform claim. Audit1371 removes synthetic receipt callback choreography and single/batch timestamp comparison from journal-row-writer.spec.ts. Actual SQLite duplicate-insert rollback/reuse and batch atomicity callbacks remain unchanged. The old directory-selected receipt is historical and does not validate this reduced selector. No equivalent replacement claim. Audit1372: current Linux unit selection passed on source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Exact selectors and execution command are recorded in the new receipt. Intentional test losses remain in knownGaps; no replacement, live provider, native input, rendered E2E, performance threshold or soak coverage is claimed. Audit1379 changes src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts (1 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/queued-message-edit-leases.test.ts (10 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/journal-subagent-item.spec.ts (4 authored registrations removed; 1 retained). Intentional losses: Loses production batch-cap/cursor-count fallback expectations; retained case checks real database rollback and successful retry, with once-per-startup variants. Intentionally removes 10 authored registrations: 'a repeated acquire answers the same lease without extending it'; 'acquire refuses a card that is gone or whose text moved on'; 'reuses an edit key only after its previous target becomes invalid'; 'expires on its own and wakes the queue with no other activity'; 'renewal extends the deadline; a lapsed lease is not revived'; 'release frees only the exact caller and edit, never another editor on the same card'; 'every read re-derives: a card whose %s holds nothing'; 'a save retires every lease on the card; others stay'; 'reads the rows it is given inside a transaction'; 'dispose drops every lease and deadline; a closed handle grants none'. Retained focused cases are not claimed as equivalent replacement for these losses. Loses identity/schema/constant/field-bound and generic revision/turnScope persistence controls; retained recovery checks structured and legacy text twins. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts and primary claims remain scoped to their unchanged sources; the broad optional selector has no new execution result. Audit1390: src/main/native-chat/agent-session-journal/journal-submission-positions.spec.ts reduced. Standalone history-page submitted-sequence projection alarm removed. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1392: src/main/native-chat/agent-session-journal/journal-payload-bounds-retention.test.ts reduced. Retires hand-copied UTF-8 clipping implementation comparison loops and deterministic random differential replay. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/native-chat/agent-session-journal/command-receipt-schema.spec.ts reduced. Fresh receipt schema physical layout no longer independently enumerated. src/main/native-chat/agent-session-journal/journal-unsent-send-hold-queue.spec.ts reduced. Source-present versus source-absent folded property shape loses one separate assertion. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/native-chat/agent-session-journal/command-receipt-transaction.spec.ts reduced. Lose the standalone handcrafted deletion-transaction characterization; actual journal replacement retained. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", + "coverageNotes": "Production SQLite and reducer tests on macOS. Execution-host-local storage behavior is shared by remote runtimes; no live SSH or Windows/Linux run. PTY, daemon, WSL process launch, transport framing and mobile rendering are unaffected. Test-value audit1293 removes src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts (1 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts: Keep actual SQLite replay classification of future versions, first sequence damage and missing epoch against independent literal state/damage expectations. Remove GC/heap thresholds and private reducer-call counters plus same-connection PASSIVE checkpoint busy checks, which do not demonstrate an independently blocked checkpoint. Lose assembled replay memory/snapshot scheduling alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1345: focused Linux unit execution now validates this primary selector on source head de234fc7b4a73eda58dd0084bc9e064b5d1191e0. Historical platform statements above describe earlier receipts. Removed fixture/matrix/call-count alarms are intentional losses with no equivalent replacement; no live SSH, physical-provider, p95 or cross-platform claim. Audit1371 removes synthetic receipt callback choreography and single/batch timestamp comparison from journal-row-writer.spec.ts. Actual SQLite duplicate-insert rollback/reuse and batch atomicity callbacks remain unchanged. The old directory-selected receipt is historical and does not validate this reduced selector. No equivalent replacement claim. Audit1372: current Linux unit selection passed on source head 9b07e8f1bea37bba70c78df2f9a238ea31d1be7e. Exact selectors and execution command are recorded in the new receipt. Intentional test losses remain in knownGaps; no replacement, live provider, native input, rendered E2E, performance threshold or soak coverage is claimed. Audit1379 changes src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts (1 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/queued-message-edit-leases.test.ts (10 authored registrations removed; 1 retained); src/main/native-chat/agent-session-journal/journal-subagent-item.spec.ts (4 authored registrations removed; 1 retained). Intentional losses: Loses production batch-cap/cursor-count fallback expectations; retained case checks real database rollback and successful retry, with once-per-startup variants. Intentionally removes 10 authored registrations: 'a repeated acquire answers the same lease without extending it'; 'acquire refuses a card that is gone or whose text moved on'; 'reuses an edit key only after its previous target becomes invalid'; 'expires on its own and wakes the queue with no other activity'; 'renewal extends the deadline; a lapsed lease is not revived'; 'release frees only the exact caller and edit, never another editor on the same card'; 'every read re-derives: a card whose %s holds nothing'; 'a save retires every lease on the card; others stay'; 'reads the rows it is given inside a transaction'; 'dispose drops every lease and deadline; a closed handle grants none'. Retained focused cases are not claimed as equivalent replacement for these losses. Loses identity/schema/constant/field-bound and generic revision/turnScope persistence controls; retained recovery checks structured and legacy text twins. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts and primary claims remain scoped to their unchanged sources; the broad optional selector has no new execution result. Audit1390: src/main/native-chat/agent-session-journal/journal-submission-positions.spec.ts reduced. Standalone history-page submitted-sequence projection alarm removed. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1392: src/main/native-chat/agent-session-journal/journal-payload-bounds-retention.test.ts reduced. Retires hand-copied UTF-8 clipping implementation comparison loops and deterministic random differential replay. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/native-chat/agent-session-journal/command-receipt-schema.spec.ts reduced. Fresh receipt schema physical layout no longer independently enumerated. src/main/native-chat/agent-session-journal/journal-unsent-send-hold-queue.spec.ts reduced. Source-present versus source-absent folded property shape loses one separate assertion. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/native-chat/agent-session-journal/command-receipt-transaction.spec.ts reduced. Lose the standalone handcrafted deletion-transaction characterization; actual journal replacement retained. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts removed. Loses oversized atomic-settlement rollback and replay/idempotence alarms. src/main/native-chat/agent-session-journal/journal-atomic-terminal-settlement.spec.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/blob/main/src/main/native-chat/agent-session-journal/journal-open.ts" ], @@ -1722,7 +1697,8 @@ "Audit1390: src/main/native-chat/agent-session-journal/journal-submission-positions.spec.ts reduced. Standalone history-page submitted-sequence projection alarm removed. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", "Audit1392: src/main/native-chat/agent-session-journal/journal-payload-bounds-retention.test.ts reduced. Retires hand-copied UTF-8 clipping implementation comparison loops and deterministic random differential replay. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", "Audit1396: src/main/native-chat/agent-session-journal/command-receipt-schema.spec.ts reduced. Fresh receipt schema physical layout no longer independently enumerated. src/main/native-chat/agent-session-journal/journal-unsent-send-hold-queue.spec.ts reduced. Source-present versus source-absent folded property shape loses one separate assertion. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", - "Audit1400: src/main/native-chat/agent-session-journal/command-receipt-transaction.spec.ts reduced. Lose the standalone handcrafted deletion-transaction characterization; actual journal replacement retained. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." + "Audit1400: src/main/native-chat/agent-session-journal/command-receipt-transaction.spec.ts reduced. Lose the standalone handcrafted deletion-transaction characterization; actual journal replacement retained. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", + "Audit1401: src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts removed. Loses oversized atomic-settlement rollback and replay/idempotence alarms. src/main/native-chat/agent-session-journal/journal-atomic-terminal-settlement.spec.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." ], "promotionCriteria": ["Retain red/green heap and value assertions and complete CI soak."], "demotionRule": "Keep experimental until cross-platform and soak evidence; investigate failures without weakening content or memory assertions." @@ -4975,13 +4951,13 @@ "providers": ["local", "daemon", "ssh"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh"], - "coverageNotes": "Deterministic unit coverage exercises activation gating, single-instance ownership, local/remote CLI status, headless binding persistence, local daemon identity, SSH identity transfer, the promoted renderer's agent-resume accounting, and the macOS serve update handoff from staged installer through atomic bundle replacement and target-version readiness. Supervisor settlement coverage prevents a late handoff-completion failure from rearming termination after the replacement child exits. A macOS Electron journey covers headless promotion and persistent PTY identity. A disposable locally signed Electron canary exercised real ShipIt and a temporary LaunchAgent with the compiled production supervisor; full packaged Orca and Linux/Windows serve updates remain uncollected. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Deterministic unit coverage exercises activation gating, single-instance ownership, local/remote CLI status, headless binding persistence, local daemon identity, SSH identity transfer, the promoted renderer's agent-resume accounting, and the macOS serve update handoff from staged installer through atomic bundle replacement and target-version readiness. Supervisor settlement coverage prevents a late handoff-completion failure from rearming termination after the replacement child exits. A macOS Electron journey covers headless promotion and persistent PTY identity. A disposable locally signed Electron canary exercised real ShipIt and a temporary LaunchAgent with the compiled production supervisor; full packaged Orca and Linux/Windows serve updates remain uncollected. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/8457", "https://github.com/stablyai/orca/issues/9563" ], "invariant": "A safely promotable headless serve process is the single app owner. Desktop activation preserves its daemon-backed sessions. On macOS, a CLI-supervised serve update keeps the node-mode parent alive across ShipIt's atomic bundle swap, restarts with the original serve arguments only after the target bundle is present, and clears handoff state only after that target version reports runtime readiness. Once a supervised child exits or fails to start, no late handoff completion may signal it or arm force-kill escalation. Unsupported or failed handoffs leave the current serving owner intact or recover it once without an install retry loop.", - "oracle": "Unit tests coalesce early activation, preserve daemon and SSH identity, and reproduce the update race with a staged target, old serving child, persistent CLI parent, atomic .app replacement, and replacement readiness message. They assert the parent does not exit for launchd to respawn the old app, the native updater does not launch an interactive GUI, the replacement version is verified before handoff completion, mismatches become durable failures without retries, and unsupported/preflight-failed installs do not invoke native quit or PTY cleanup. Force handoff completion to fail after the replacement child exits and require zero later child signals and zero escalation timers. A joined lock-owner/activation/hydration contract asserts that a forced relaunch opens exactly one window and that the renderer promoted inside the serve process launches zero agent resumes, creates no replacement tab or startup command, and leaves every surviving session record untouched. The Electron journey independently verifies headless promotion retains owner/runtime/daemon/PTY identity and terminal I/O.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Unit tests coalesce early activation, preserve daemon and SSH identity, and reproduce the update race with a staged target, old serving child, persistent CLI parent, atomic .app replacement, and replacement readiness message. They assert the parent does not exit for launchd to respawn the old app, the native updater does not launch an interactive GUI, the replacement version is verified before handoff completion, mismatches become durable failures without retries, and unsupported/preflight-failed installs do not invoke native quit or PTY cleanup. Force handoff completion to fail after the replacement child exits and require zero later child signals and zero escalation timers. A joined lock-owner/activation/hydration contract asserts that a forced relaunch opens exactly one window and that the renderer promoted inside the serve process launches zero agent resumes, creates no replacement tab or startup command, and leaves every surviving session record untouched. The Electron journey independently verifies headless promotion retains owner/runtime/daemon/PTY identity and terminal I/O.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/updater/serve-update-handoff.test.ts src/main/updater/updater.headless-serve-install.test.ts src/main/updater/mac-install/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/serve-signal-exit-diagnostic.test.ts", @@ -5056,15 +5032,6 @@ "remote-paired open reports remote desktop state without launching a local app" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "the headless sentinel transfers authority to the first real window", - "headless local and SSH PTY bindings are persisted on first promotion and later windowless reattach without changing ordinary desktop spawn persistence", - "status distinguishes available, openable, initializing, and blocked desktop states", - "desktop-only bell, command, and link scanners remain disabled until a real renderer graph is ready" - ] - }, { "file": "src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts", "assertions": [ @@ -5129,7 +5096,8 @@ "The live ShipIt/LaunchAgent canary used a disposable minimal Electron bundle plus the compiled production supervisor; a full packaged Orca update has not yet been run.", "Linux and Windows single-instance activation have unit coverage but no live Electron evidence yet.", "SSH identity transfer is deterministic unit coverage only; the live Electron journey currently exercises the local daemon provider.", - "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed." + "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"the headless sentinel transfers authority to the first real window\",\"headless local and SSH PTY bindings are persisted on first promotion and later windowless reattach without changing ordinary desktop spawn persistence\",\"status distinguishes available, openable, initializing, and blocked desktop states\",\"desktop-only bell, command, and link scanners remain disabled until a real renderer graph is ready\"]}]" ], "demotionRule": "Quarantine the Electron journey only with a linked product or harness defect; demote if activation changes the owner/runtime/daemon/PTY identity, loses prior output, opens before provider readiness, or fails to honor a committed quit." }, @@ -5149,14 +5117,14 @@ "providers": ["local", "daemon", "ssh", "paired-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "paired-runtime"], - "coverageNotes": "Deterministic lifecycle, IPC, window-notification, and runtime ownership tests cover generation replacement, stale callbacks, same-frame old-document publication, blocked external navigation, cancelled renderer navigation, concurrent provisional starts, process loss, timeout cleanup, headless fallback, and competing windows. Isolated macOS Electron validation covers cancelled navigation, forced renderer recovery, and headless serve promotion with live daemon-backed PTY identity and I/O. Linux, Windows, WSL, SSH promotion, and mixed-version desktop/server live runs remain uncollected; the renderer generation stays local to Electron IPC and does not change the remote wire. The renderer scheduling fixture now retains in-flight coalescing only, and payload partitioning retains publication-failure and main-dropped-worktree retry. Immediate publication, stale SSH cleanup, reconnect resync and isolated partition membership alarms were removed; other lifecycle evidence does not establish equivalent coverage. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Deterministic lifecycle, IPC, window-notification, and runtime ownership tests cover generation replacement, stale callbacks, same-frame old-document publication, blocked external navigation, cancelled renderer navigation, concurrent provisional starts, process loss, timeout cleanup, headless fallback, and competing windows. Isolated macOS Electron validation covers cancelled navigation, forced renderer recovery, and headless serve promotion with live daemon-backed PTY identity and I/O. Linux, Windows, WSL, SSH promotion, and mixed-version desktop/server live runs remain uncollected; the renderer generation stays local to Electron IPC and does not change the remote wire. The renderer scheduling fixture now retains in-flight coalescing only, and payload partitioning retains publication-failure and main-dropped-worktree retry. Immediate publication, stale SSH cleanup, reconnect resync and isolated partition membership alarms were removed; other lifecycle evidence does not establish equivalent coverage. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/14066", "https://linear.app/stably/issue/STA-4016", "https://github.com/stablyai/orca/pull/14070" ], "invariant": "Every genuine renderer graph reload revision settles exactly once, while a blocked external navigation that preserves the current document never starts a revision. A cancelled renderer-document navigation restores authority only when that same renderer survived; cancellation after an earlier document committed remains fenced until publication or timeout. Replacing a reload cancels only the prior revision; its timer and callbacks cannot settle a newer revision. A desktop reload succeeds only from a publication carrying a new renderer-document generation, while a failed headless promotion may recover only from its originating window. Timeout, renderer loss, and close reach a terminal graph state, and successful desktop publication permanently retires headless sentinel fallback until a new headless runtime is established.", - "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start a blocked external main-frame navigation and require the current renderer graph and notification path to remain authoritative. Start a same-renderer navigation, cancel it before commit, and require the renderer canary and ready authority to survive; coalesce overlapping provisional starts into one fence, and keep an earlier committed reload fenced if a later navigation is cancelled. Drive two genuine reloads half a timeout apart and require the first deadline to leave the second revision reloading while the second deadline alone makes it unavailable. During the second revision publish from the prior renderer document through the still-current main frame and require rejection without graph mutation or timeout cancellation. Restore headless authority after failed promotion, publish from a competing window, and require rejection while the sentinel remains authoritative. Then force a real renderer crash and separately promote an isolated headless serve owner; require runtime graph readiness, stable runtime/main/daemon/PTY identities, recovered visible terminal output, and post-recovery input/output.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start a blocked external main-frame navigation and require the current renderer graph and notification path to remain authoritative. Start a same-renderer navigation, cancel it before commit, and require the renderer canary and ready authority to survive; coalesce overlapping provisional starts into one fence, and keep an earlier committed reload fenced if a later navigation is cancelled. Drive two genuine reloads half a timeout apart and require the first deadline to leave the second revision reloading while the second deadline alone makes it unavailable. During the second revision publish from the prior renderer document through the still-current main frame and require rejection without graph mutation or timeout cancellation. Restore headless authority after failed promotion, publish from a competing window, and require rejection while the sentinel remains authoritative. Then force a real renderer crash and separately promote an isolated headless serve owner; require runtime graph readiness, stable runtime/main/daemon/PTY identities, recovered visible terminal output, and post-recovery input/output.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts", "pnpm exec electron-vite build --mode e2e", @@ -5185,17 +5153,6 @@ "settlement and timeout release their timers" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "only the newest reload owns the terminal timeout", - "a superseded renderer-document generation cannot settle a reload", - "cancelled navigation restores only the renderer or headless authority that actually survived", - "cancellation after an earlier document commit stays fenced until its restarted timeout", - "failed headless promotion remains pinned to its originating window", - "successful desktop publication retires headless fallback" - ] - }, { "file": "src/main/ipc/runtime.test.ts", "assertions": [ @@ -5301,7 +5258,8 @@ "The renderer scheduling fixture now retains in-flight coalescing only, and payload partitioning retains publication-failure and main-dropped-worktree retry. Immediate publication, stale SSH cleanup, reconnect resync and isolated partition membership alarms were removed; other lifecycle evidence does not establish equivalent coverage.", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-14\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts\",\"result\":\"passed\",\"durationSeconds\":12,\"summary\":\"Eight focused files passed with 1,175 tests and one pre-existing skip after the merge from latest main. The suite covers exact reload settlement, timeout replacement, cancelled-navigation recovery, concurrent provisional starts, document and window authority, notification containment, preload IPC, and renderer publication scheduling.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts\"}", "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", - "Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []" + "Audit1400: src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts removed. Removes whole coalescing call-count suite; no newest-state delivery or replacement claim. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"only the newest reload owns the terminal timeout\",\"a superseded renderer-document generation cannot settle a reload\",\"cancelled navigation restores only the renderer or headless authority that actually survived\",\"cancellation after an earlier document commit stays fenced until its restarted timeout\",\"failed headless promotion remains pinned to its originating window\",\"successful desktop publication retires headless fallback\"]}]" ], "demotionRule": "Demote if a reload revision settles more than once, a stale document or competing window can publish, a timer survives settlement, desktop failure stays indefinitely reloading, headless fallback returns after successful promotion, or either isolated Electron journey loses runtime or PTY identity." }, @@ -5650,7 +5608,7 @@ "providers": ["remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": [], - "coverageNotes": "Audit1386 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A macOS desktop host and a separate paired Electron client exercise the Explorer preview action end to end: the document renders inside the client-local orca-preview guest, the client gains exactly one browser workspace and it is the document one, the host's own page registry and tab snapshot gain nothing, the split does not take focus from the source editor, an explicit click activates the preview, and closing it with its X leaves the editor and terminal intact. Both host oracles are read in a run where an ordinary URL browser tab from the same client does arrive in them, because a host that cannot project browser pages at all would otherwise answer the absence question the same way. A second journey quits that client with a document tab open and relaunches it on the same profile, which is the restore the user's original report turned on: the same workspace row comes back blank and named by the document, renders again, and does so over a grant URL that differs from the one that was quit. The same journey pins the guest URL to the orca-preview scheme, so a regression back to file:// or to a host browser page is visible. The rewritten journey caught a live gap the old one could not see: since previews became browser pages they had no chrome to hand focus to their guest, so main refused every reported link click as coming from an unfocused guest and the one route out of a preview was dead. Main's own log answered it — registered true, grant live, focused false — after the embedder reported the anchor really taking six real presses. The pane now hands focus over when it is the reader's surface, and the journey routes. The preview's own components moved out of the editor folder into browser-pane/workspace-doc/ with this change, since a preview is a browser pane and no longer an editor one; their i18n keys keep the historical auto.components.editor.HtmlDocPreview prefix rather than dropping thirty translated strings across four locales for a tidier key path. Seven gate commands named those files by their old paths and were re-issued at the new ones, and the nine dated runs behind them were retired rather than left naming files that are no longer there, on the same principle this gate already applied twice: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. Each retired record's finding is carried into the replacement run recorded below it, including the red half of the entry/subresource pair, which was re-measured by re-applying its mutant at the new path rather than being dropped. The fence over the page-management channels was decided channel by channel before it was built, and that decision record is: of the 23 channels that can name a page, 6 are allowed for a workspace-document page — the tool channels the reader drives, which reach it through the one authority that reads both halves of the registry — 9 refuse (download accept and cancel, devtools, certificate proceed, client page metadata publish, viewport override, WebAuthn account response, registration probe, registration repair), 3 cannot name a page at all because they take a profile or a worktree instead, and the rest are the registration and activation doors, refused on membership. What shipped is not the per-channel guard that classification implies: eleven call sites read the browsing map directly, so a guard per channel is exactly the caller-flag seam that has to be remembered at every future call site. The registry was split in two instead, which makes the classification structural — a document guest is absent from the browsing map, so every refusing channel refuses by absence rather than by a guard, and a channel added later inherits the refusal without being classified at all. Unit contracts cover grant scoping and path containment, per-owner read routing, refusal of a truncated or over-cap read, the old-server binary degradation, scheme admission on will-attach-webview, the guest navigation policy, the plan layer's local/SSH/paired/out-of-worktree routing, and the distinct sentence the reader sees for each failure reason. The paired browser-creation surfaces this gate still owns — capability rejection cleanup, canonical page identity, reconciliation rollback, close convergence — keep their existing headed and headless journeys. Linux and Windows live journeys remain gaps. A refused subresource is a notice on a rendered document rather than a failure panel, since only the entry document's failure leaves the reader with nothing; the entry document is served as text by every owner and cannot be refused for its format at all. Grants die with the renderer document that minted them, at window creation and on every reload, because the renderer holds the only record of which preview owns which grant. The mint and revoke channels answer only the trusted renderer, and a preview tab is never republished to mobile clients, which have no grant to read it with. External URLs leave the preview only via a trusted user click on an anchor while the preview is focused; script-driven navigation and popups reach nothing. The guest's navigation sinks are deny-only and route no URL at all, and the guest carries a preview-only preload, pinned by will-attach-webview and denied to every other attach path, whose capture-phase click handler reports an anchor's URL to main; main answers only a report from a preview guest with a live bound grant that is the focused contents, and only for http(s). Two earlier reader-facing records from 2026-08-26, which measured a shape where a subresource failure was filtered out and the panel still carried an unsupported-asset sentence, were retired with that shape rather than left contradicting the 10/10 runs of the command they share. Two more were retired on the same principle when the external-link design changed: a record showing that removing a recent-input gate let the unattended document open two browser tabs, and a record showing that dropping the webview's allowpopups attribute left a target=_blank press with nothing to route. Both measured machinery that no longer exists — the input gate could not tell a script's navigation from the click it followed, which is the case now recorded below, and the preload intercepts the press before Chromium considers a popup at all, so allowpopups was removed. WebRTC is fenced by the guest's IP-handling policy alone: this Chromium answers a webrtc content-security-policy directive as unrecognized and gathers candidates anyway, so the directive is deliberately absent from the served policy and a unit assertion keeps it out. A standalone Electron probe on the same version gathered 7 candidates including a STUN reflexive one without the policy and 0 with it. Two command paths this gate used to carry no longer exist, and their structured evidence was retired with them rather than left naming files that are no longer there: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. The first is src/renderer/src/lib/file-preview-capability-cleanup.test.ts, deleted in STA-5557 when HTML previews stopped creating paired browser tabs: on 2026-08-12 its five-assertion STA-4063 oracle ran red 5/5 on scan e4c278eb52 and on main bc2e30000b, partially green 2/5 on pre-fix PR #14100, and green 5/5 on candidate 14b5877a75; the surviving half of that oracle is web-runtime-browser-capability-cleanup.test.ts, still commanded above. The second is tests/e2e/paired-remote-html-browser-focus.spec.ts, renamed in STA-5557 to paired-remote-html-preview-local-render.spec.ts because the journey no longer proves anything about browser focus: its 2026-08-12 runs established the owning-runtime routing and no-focus-steal behavior of the then-current browser-tab preview (red on main 346e59c879 and a90a18d43d, green on candidates d05217c40d and b7de9c0961, red again with only the side-preview focus or routing seam disabled), and its 2026-08-26 runs are recorded below under the current path. An adversarial pass after the journey landed found four coverage gaps rather than shipping defects, and all four are pinned here. The page url had a third door: the navigation commit wrote whatever url was reported, unfenced, and while nothing reaches it for a document page today it sat one report away from giving a document page a URL that persistence, the publish boundary and the address bar all read. The group projection was the load-bearing half of the mobile publish boundary that no test had: removing it alone left the whole suite green, because no test in it had tab groups, while the phone payload gained a group whose order and active tab named a document tab it was never sent. The focus handoff was covered only in the narrowing direction, so widening it — dropping the page-activity check, or either half of the reader-surface check — survived both suites. And the handoff itself was offered once and never again, so another app taking the front left the preview's one route out shut until the pane remounted, which is a desktop gap rather than a test-only one. The standalone capability-cleanup and browser-placement ledger suites were removed, including their mixed-version rejection, cleanup transfer, capacity and partition alarms. web-runtime-session.test.ts no longer supplies browser creation, rollback or recovery assertions. The grouped workspace-document exclusion remains; the separate no-group publication example was removed. Existing live/browser-store evidence does not establish equivalent replacement alarms. Earlier descriptions of the removed fixtures and their run results are historical. The client-owned-placement and layout-groups suites are removed. The broad mirror fixture no longer supplies preview placement/reservation/move assertions. Browser rows retain pre-response replay and real local-workspace reuse; focus intent retains response ordering and exact-leaf sibling ordering. Supplied browser-layout and placement/focus projection alarms are lost; retained evidence is narrower and not equivalent. The test-value audit retires renderer grant-release mock ledgers, direct creation/title/session-field copies, notification/onboarding calls and several placement/per-page projections. Canonical-ID rejection, document reopen/restore and preview URL fences remain; they do not prove close-to-registry revocation or replace every lost alarm. Historical execution evidence is unchanged. The test-value audit removed the direct legacy editor-preview hydration example from tabs-hydration.test.ts. Dropping legacy preview chrome while preserving the same-document ordinary editor no longer has that alarm. The surviving corrupt-id deduplication case does not cover that migration, and retained preview journeys are not equivalent replacement coverage. Historical run counts and migration mutation findings describe the earlier suite. Audit1308: src/renderer/src/components/editor/EditorPanelShell.header.test.tsx removed. Header visibility and mocked editor-surface inventory alarms disappear. No equivalent replacement coverage is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1386: src/renderer/src/lib/doc-preview-grants.test.ts reduced. Repeated-mount mint count, ordinary release/remint and failed-mint cache retry standalone alarms removed; no actual grant server/access test. No equivalent replacement coverage is claimed.", + "coverageNotes": "Audit1386 changes referenced sources; no new execution result validates reduced selectors. Retained unchanged receipts apply only to unchanged commands. Historical coverage: Audit1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): A macOS desktop host and a separate paired Electron client exercise the Explorer preview action end to end: the document renders inside the client-local orca-preview guest, the client gains exactly one browser workspace and it is the document one, the host's own page registry and tab snapshot gain nothing, the split does not take focus from the source editor, an explicit click activates the preview, and closing it with its X leaves the editor and terminal intact. Both host oracles are read in a run where an ordinary URL browser tab from the same client does arrive in them, because a host that cannot project browser pages at all would otherwise answer the absence question the same way. A second journey quits that client with a document tab open and relaunches it on the same profile, which is the restore the user's original report turned on: the same workspace row comes back blank and named by the document, renders again, and does so over a grant URL that differs from the one that was quit. The same journey pins the guest URL to the orca-preview scheme, so a regression back to file:// or to a host browser page is visible. The rewritten journey caught a live gap the old one could not see: since previews became browser pages they had no chrome to hand focus to their guest, so main refused every reported link click as coming from an unfocused guest and the one route out of a preview was dead. Main's own log answered it — registered true, grant live, focused false — after the embedder reported the anchor really taking six real presses. The pane now hands focus over when it is the reader's surface, and the journey routes. The preview's own components moved out of the editor folder into browser-pane/workspace-doc/ with this change, since a preview is a browser pane and no longer an editor one; their i18n keys keep the historical auto.components.editor.HtmlDocPreview prefix rather than dropping thirty translated strings across four locales for a tidier key path. Seven gate commands named those files by their old paths and were re-issued at the new ones, and the nine dated runs behind them were retired rather than left naming files that are no longer there, on the same principle this gate already applied twice: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. Each retired record's finding is carried into the replacement run recorded below it, including the red half of the entry/subresource pair, which was re-measured by re-applying its mutant at the new path rather than being dropped. The fence over the page-management channels was decided channel by channel before it was built, and that decision record is: of the 23 channels that can name a page, 6 are allowed for a workspace-document page — the tool channels the reader drives, which reach it through the one authority that reads both halves of the registry — 9 refuse (download accept and cancel, devtools, certificate proceed, client page metadata publish, viewport override, WebAuthn account response, registration probe, registration repair), 3 cannot name a page at all because they take a profile or a worktree instead, and the rest are the registration and activation doors, refused on membership. What shipped is not the per-channel guard that classification implies: eleven call sites read the browsing map directly, so a guard per channel is exactly the caller-flag seam that has to be remembered at every future call site. The registry was split in two instead, which makes the classification structural — a document guest is absent from the browsing map, so every refusing channel refuses by absence rather than by a guard, and a channel added later inherits the refusal without being classified at all. Unit contracts cover grant scoping and path containment, per-owner read routing, refusal of a truncated or over-cap read, the old-server binary degradation, scheme admission on will-attach-webview, the guest navigation policy, the plan layer's local/SSH/paired/out-of-worktree routing, and the distinct sentence the reader sees for each failure reason. The paired browser-creation surfaces this gate still owns — capability rejection cleanup, canonical page identity, reconciliation rollback, close convergence — keep their existing headed and headless journeys. Linux and Windows live journeys remain gaps. A refused subresource is a notice on a rendered document rather than a failure panel, since only the entry document's failure leaves the reader with nothing; the entry document is served as text by every owner and cannot be refused for its format at all. Grants die with the renderer document that minted them, at window creation and on every reload, because the renderer holds the only record of which preview owns which grant. The mint and revoke channels answer only the trusted renderer, and a preview tab is never republished to mobile clients, which have no grant to read it with. External URLs leave the preview only via a trusted user click on an anchor while the preview is focused; script-driven navigation and popups reach nothing. The guest's navigation sinks are deny-only and route no URL at all, and the guest carries a preview-only preload, pinned by will-attach-webview and denied to every other attach path, whose capture-phase click handler reports an anchor's URL to main; main answers only a report from a preview guest with a live bound grant that is the focused contents, and only for http(s). Two earlier reader-facing records from 2026-08-26, which measured a shape where a subresource failure was filtered out and the panel still carried an unsupported-asset sentence, were retired with that shape rather than left contradicting the 10/10 runs of the command they share. Two more were retired on the same principle when the external-link design changed: a record showing that removing a recent-input gate let the unattended document open two browser tabs, and a record showing that dropping the webview's allowpopups attribute left a target=_blank press with nothing to route. Both measured machinery that no longer exists — the input gate could not tell a script's navigation from the click it followed, which is the case now recorded below, and the preload intercepts the press before Chromium considers a popup at all, so allowpopups was removed. WebRTC is fenced by the guest's IP-handling policy alone: this Chromium answers a webrtc content-security-policy directive as unrecognized and gathers candidates anyway, so the directive is deliberately absent from the served policy and a unit assertion keeps it out. A standalone Electron probe on the same version gathered 7 candidates including a STUN reflexive one without the policy and 0 with it. Two command paths this gate used to carry no longer exist, and their structured evidence was retired with them rather than left naming files that are no longer there: vitest treats a missing named file as a filter and exits 0, so such a command reports green while silently running only the half that still exists. The first is src/renderer/src/lib/file-preview-capability-cleanup.test.ts, deleted in STA-5557 when HTML previews stopped creating paired browser tabs: on 2026-08-12 its five-assertion STA-4063 oracle ran red 5/5 on scan e4c278eb52 and on main bc2e30000b, partially green 2/5 on pre-fix PR #14100, and green 5/5 on candidate 14b5877a75; the surviving half of that oracle is web-runtime-browser-capability-cleanup.test.ts, still commanded above. The second is tests/e2e/paired-remote-html-browser-focus.spec.ts, renamed in STA-5557 to paired-remote-html-preview-local-render.spec.ts because the journey no longer proves anything about browser focus: its 2026-08-12 runs established the owning-runtime routing and no-focus-steal behavior of the then-current browser-tab preview (red on main 346e59c879 and a90a18d43d, green on candidates d05217c40d and b7de9c0961, red again with only the side-preview focus or routing seam disabled), and its 2026-08-26 runs are recorded below under the current path. An adversarial pass after the journey landed found four coverage gaps rather than shipping defects, and all four are pinned here. The page url had a third door: the navigation commit wrote whatever url was reported, unfenced, and while nothing reaches it for a document page today it sat one report away from giving a document page a URL that persistence, the publish boundary and the address bar all read. The group projection was the load-bearing half of the mobile publish boundary that no test had: removing it alone left the whole suite green, because no test in it had tab groups, while the phone payload gained a group whose order and active tab named a document tab it was never sent. The focus handoff was covered only in the narrowing direction, so widening it — dropping the page-activity check, or either half of the reader-surface check — survived both suites. And the handoff itself was offered once and never again, so another app taking the front left the preview's one route out shut until the pane remounted, which is a desktop gap rather than a test-only one. The standalone capability-cleanup and browser-placement ledger suites were removed, including their mixed-version rejection, cleanup transfer, capacity and partition alarms. web-runtime-session.test.ts no longer supplies browser creation, rollback or recovery assertions. The grouped workspace-document exclusion remains; the separate no-group publication example was removed. Existing live/browser-store evidence does not establish equivalent replacement alarms. Earlier descriptions of the removed fixtures and their run results are historical. The client-owned-placement and layout-groups suites are removed. The broad mirror fixture no longer supplies preview placement/reservation/move assertions. Browser rows retain pre-response replay and real local-workspace reuse; focus intent retains response ordering and exact-leaf sibling ordering. Supplied browser-layout and placement/focus projection alarms are lost; retained evidence is narrower and not equivalent. The test-value audit retires renderer grant-release mock ledgers, direct creation/title/session-field copies, notification/onboarding calls and several placement/per-page projections. Canonical-ID rejection, document reopen/restore and preview URL fences remain; they do not prove close-to-registry revocation or replace every lost alarm. Historical execution evidence is unchanged. The test-value audit removed the direct legacy editor-preview hydration example from tabs-hydration.test.ts. Dropping legacy preview chrome while preserving the same-document ordinary editor no longer has that alarm. The surviving corrupt-id deduplication case does not cover that migration, and retained preview journeys are not equivalent replacement coverage. Historical run counts and migration mutation findings describe the earlier suite. Audit1308: src/renderer/src/components/editor/EditorPanelShell.header.test.tsx removed. Header visibility and mocked editor-surface inventory alarms disappear. No equivalent replacement coverage is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1386: src/renderer/src/lib/doc-preview-grants.test.ts reduced. Repeated-mount mint count, ordinary release/remint and failed-mint cache retry standalone alarms removed; no actual grant server/access test. No equivalent replacement coverage is claimed. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-5557/remote-html-preview-render-workspace-files-locally-over-the-file", "https://linear.app/stably/issue/STA-3872/unable-to-open-html-files-in-remote-server", @@ -6314,7 +6272,8 @@ "Audit1386: src/renderer/src/lib/doc-preview-grants.test.ts reduced. Repeated-mount mint count, ordinary release/remint and failed-mint cache retry standalone alarms removed; no actual grant server/access test. No equivalent replacement coverage is claimed.", "Audit1386 retires this complete dated receipt because a changed source or imported registration driver is in either command field. It does not validate the reduced selector. Original receipt verbatim:\n{\n \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/doc-preview-grant-registry.test.ts src/main/browser/doc-preview-file-reader.test.ts src/main/browser/doc-preview-protocol.test.ts src/main/browser/doc-preview-guest-policy.test.ts src/main/browser/doc-preview-failure-notice.test.ts src/shared/doc-preview-scheme.test.ts src/renderer/src/lib/doc-preview-grants.test.ts src/renderer/src/lib/file-preview.test.ts src/renderer/src/lib/file-preview-action-visibility.test.tsx src/main/window/main-window-webview-security.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts\",\n \"date\": \"2026-08-27\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"result\": \"passed\",\n \"durationSeconds\": 1.63,\n \"summary\": \"189/189 over the grant, reader, protocol, guest-policy, scheme-admission, plan-routing, action-visibility, failure-message, external-link and terminal-row contracts. This replaces the 2026-08-27 record of the same command at 174/174, whose thirteenth file was the deleted doc-preview-external-link-bridge.test.ts: the STA-5758 hardening moved that behavior into the reader-facing confirmation (doc-preview-external-link-confirmation.test.ts), which now proves the exact destination is shown and nothing opens on cancel, alongside everything the retired run carried — the stale-mint rejection that must not evict a reopened preview tab, the CSP header and session request filter, the SSH symlink refusal, subframe containment, truncated and over-cap reads, the unservable-asset and empty-file split, the out-of-worktree paired refusal, and the guest deny-only navigation sinks. The count also carries the entry-only rule added on top of the hardening: a grant whose document directory is its own request base — a workspace-root or out-of-workspace document — reads nothing but the entry file until the reader approves a directory, at both the lexical and the canonical containment pass, because that directory is where secrets live and a DNS-prefetch beacon needs no click. Historical command preserved after removal of the mocked preview test suite in the test-value audit; currentCommand links only the remaining suites. The recorded result, count, duration and mutation narrative describe the historical command. The current command has not been rerun here and does not claim equivalent coverage.\",\n \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/document-preview/doc-preview-grant-registry.test.ts src/main/browser/document-preview/doc-preview-file-reader.test.ts src/main/browser/document-preview/doc-preview-protocol.test.ts src/main/browser/document-preview/doc-preview-guest-policy.test.ts src/main/browser/document-preview/doc-preview-failure-notice.test.ts src/shared/doc-preview-scheme.test.ts src/renderer/src/lib/doc-preview-grants.test.ts src/main/window/main-window-webview-security.test.ts src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts\"\n }", "Audit1386 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"remote-runtime\"]}. Static assertion references are not current execution evidence.", - "Audit1386 historical assertion inventory for changed sources:\n[\n {\n \"file\": \"src/renderer/src/lib/doc-preview-grants.test.ts\",\n \"assertions\": [\n \"grants are deduped per preview tab so a StrictMode double-mount cannot revoke the surviving webview\",\n \"a mint that rejects after its tab was released and reopened leaves the reopened tab's grant revocable\"\n ]\n }\n]" + "Audit1386 historical assertion inventory for changed sources:\n[\n {\n \"file\": \"src/renderer/src/lib/doc-preview-grants.test.ts\",\n \"assertions\": [\n \"grants are deduped per preview tab so a StrictMode double-mount cannot revoke the surviving webview\",\n \"a mint that rejects after its tab was released and reopened leaves the reopened tab's grant revocable\"\n ]\n }\n]", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." ], "demotionRule": "Demote if a paired HTML preview creates a browser workspace on either side, renders from anything other than the orca-preview scheme, serves a read the host reported as truncated or over-cap, serves a document without the self-only content security policy, lets the preview session carry an off-machine request, reads an SSH path that canonicalizes outside its grant root, steals focus from the source editor when it opens, removes unrelated editor or terminal state on close, hides a document that rendered because one subresource was refused, leaves a grant readable after the tab or renderer that owns it is gone, mints one for a sender that is not the trusted renderer, opens a browser tab for a navigation the document started with no one at the keyboard, or lets the guest gather an ICE candidate; or if a paired browser creation this gate still owns produces duplicate client or host identities or loses its requested split." }, @@ -6346,12 +6305,12 @@ "providers": ["local", "remote-runtime", "ssh", "wsl"], "coveredPlatforms": ["macos", "linux"], "coveredProviders": [], - "coverageNotes": "Audit1340 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic protocol, registry, injected-socket, and loopback-listener tests cover strict framing, remote-DNS targets, exact destination-write and source-consumption credit, at most 256 streams per route with pending opens counted inside that cap, 1024 admitted opens per 10-second monotonic window, an 8 MiB per-route application-buffer ledger, shared 32 MiB browser-host and 128 MiB process ledgers across application copies, encrypted client queues, and native WebSocket bufferedAmount, bounded byte/claim/socket-source counts, a four-frame queued-drain quantum, authority epochs, exact host selection, one host per authenticated connection, four hosts per paired device, eight global browser-host polls with four per authenticated paired device, a shared ask/host ceiling that retains one quarter for waits, bounded initial and reconnect runtime_busy recovery, long-poll metering and disconnect abort, monotonic host/page/route generations without page tombstones, two-phase exact page retirement with cancellation, connection-owned cleanup, exact client revocation, stale and replaced fences, retired stream IDs, half-close and close ordering, SOCKS CONNECT, bind/close races, listener wildcard normalization, unsupported commands, unavailable routes, and raw/terminal binary-handler isolation. Page commands use a separately echoed v1 attach negotiation, exact authority/host/page generations, bounded command IDs and sequences, and bounded create/navigate payloads; legacy attaches still receive only the unchanged ready/revoked event shapes. A second optional reconciliation subprotocol gates bounded reclaim, close, and restore payloads behind exact attach/ready echo, complete inventory, command negotiation, reconnect authority, and command-result authority; the production client advertises it only with the matching command and inventory capabilities. Exact guest or app-renderer loss marks one page generation outcome-unknown, coalesces a bounded negotiated inventory reattach, closes or retires the dead generation, and allocates a fresh generation before URL restore; explicit close is not misclassified as a crash. Mixed-version mutation tests project hidden client pages before activate, close, split, reorder, and move-to-group admission, preserve hidden raw order slots, translate visible insertion indices, and project mutation snapshots. A production server orchestrator consumes each immutable inventory once, reserves target generations without exposing placement, emits only negotiated ledger commands, commits after exact completed proof, preserves unrelated and server placements, aborts an attempt when connection authority enters reconnect grace, and requires fresh inventory after failure or abort. The production client dispatcher additionally proves per-page FIFO execution, exact payload-matched duplicate replay, frozen command/result snapshots, a global retired-generation floor, transactional admission, bounded pages/active commands/queues/per-page and global result cache/concurrency, create dependency failure, cancellation, deduplicated retirement joining, and bounded close without late-result overwrite. The server ledger owns issue order and immutable command/result snapshots, bounds outstanding commands, active pages, and per-page/global replay caches, releases active-page capacity after an exact completed close while retaining bounded result replay, validates the shared wire payload before admission, requires live delivery and exact placement, authenticates results to the negotiated connection and paired lease, rejects gaps and conflicting replay, and fences outstanding outcomes at exact retirement. Negotiated command results reuse the authenticated attach socket through bounded nested JSON requests; exact ID routing, reverse-order replies, unknown and duplicate IDs, timeout teardown, serialization failure, aggregate queue accounting, acknowledgement validation, and the unchanged non-v1 path are deterministic. A stable local listener rejects CONNECT while offline or reconnecting, retains its address across replacement, requires a strictly increasing tunnel generation, ignores late superseded callbacks, propagates tunnel protocol failure to the route owner, and recycles exhausted stream IDs only after generation replacement. Reconnect uses the unchanged native v1 attach payload and capability pair; SSH descriptors alone add an execution-host capability and require a runtime-minted grant bound to the exact browser-host lease. Exact SSH provider epoch and connection generation fence ssh2 forwardOut and one non-interactive standalone system-SSH dynamic forward per route. Unit tests preserve domain-form SOCKS requests, sanitize remote errors, bound stderr, cancel startup, release timed-out and synchronously failed sockets, and release routes once. An ephemeral Docker sshd resolves a container-only domain and returns a unique HTTP marker through both ssh2 and the actual system-OpenSSH dynamic-forward adapter without touching the user's SSH files; authority loss fences the ssh2 route. The execution runtime charges route application bytes to the same per-host/process policy; its existing E2EE owner separately caps native outbound buffers process-wide. Production-registered browser-host and paired-runtime methods lease one exact host, prove attach, command delivery, and result settlement share one exact connection identity, then carry SOCKS and HTTP bytes over a dedicated E2EE socket to the fenced execution-host revision and prove route close destroys the destination socket. The production desktop adapter now composes one exact host per environment pairing revision with the page executor, current renderer selector, route Session/WebContents registries, and one reference-counted route per canonical execution-host key. Negotiated same-client control reconnect retains exact authority, placements, grants, dispatcher dedupe, executor guests, and listener addresses; it fences tunnels immediately, blocks route admission, reattaches command delivery only after ready, and replays unsettled commands without repeating completed mutations. Terminal release, replacement, legacy disconnect, and reconnect-grace expiry make only the exact host generation's client placements non-cancellable retirement-pending while retaining capacity until exact cleanup; reconnect grace preserves them. Environment replacement and app shutdown still serialize transport closure before page cleanup and force-close every remaining route. The production placement preparation starts the exact desktop adapter and advertises host/tunnel capabilities only when the paired Electron client is eligible. Node stream-internal high-water bytes, strict cross-route scheduling, and physical cross-platform evidence remain uncovered. The two Docker remote-only SSH browser routing journeys now run in the dedicated Linux ssh-browser-network-route CI job on full runs and their mapped source/test changes; 2 baseline and 6 repeated cases passed with no skips/retries on 2026-09-06. The removed retry-arithmetic and attach-request inventory suites are not current coverage; retained lease and composition suites exercise admission retry, cleanup, inventory negotiation, and reconnect behavior. Test-value audit1293 removes src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/browser/client-pages/lifecycle/browser-client-page-unavailability.test.ts: Every route/guest lifecycle/currentness/navigation/renderer/automation authority is supplied by fake callbacks, then unavailability listener is invoked manually and private inventory/mock calls are checked. No guest destruction, renderer disconnect or actual reconciliation/close consumer. Lose generation fence/reconcile-once/missing-renderer-close branch alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1318: src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts: Retain actual local encrypted WebSocket subscription concurrency routing when host replies out of order, plus an exception thrown by a real ws consumer callback being turned into a subscription error. Server is a test-shaped handshake/response producer using production crypto, not actual runtime host/auth authority or independent cryptographic oracle. Remove happy second-request duplicate, unknown/duplicate-ID branches, fixed32 capacity, serialization/capacity/timeouts and fake memory release/admission call-count scenarios; intentionally lose those alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1340: src/main/runtime/runtime-binary-message-router.test.ts removed. Connection mode conflict exceptions and one terminal/raw callback each. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1371 removes the reconciliation protocol/capability echo inventory from browser-client-host-reconciliation.test.ts. The pending command result refusal without exact authority and later accepted acknowledgement callback remains byte-identical. The narrow negotiation echo alarm is intentionally lost; no equivalent browser/authenticated transport proof is claimed. Existing receipts with unchanged selectors retain only their original scope.", + "coverageNotes": "Audit1401 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1340 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic protocol, registry, injected-socket, and loopback-listener tests cover strict framing, remote-DNS targets, exact destination-write and source-consumption credit, at most 256 streams per route with pending opens counted inside that cap, 1024 admitted opens per 10-second monotonic window, an 8 MiB per-route application-buffer ledger, shared 32 MiB browser-host and 128 MiB process ledgers across application copies, encrypted client queues, and native WebSocket bufferedAmount, bounded byte/claim/socket-source counts, a four-frame queued-drain quantum, authority epochs, exact host selection, one host per authenticated connection, four hosts per paired device, eight global browser-host polls with four per authenticated paired device, a shared ask/host ceiling that retains one quarter for waits, bounded initial and reconnect runtime_busy recovery, long-poll metering and disconnect abort, monotonic host/page/route generations without page tombstones, two-phase exact page retirement with cancellation, connection-owned cleanup, exact client revocation, stale and replaced fences, retired stream IDs, half-close and close ordering, SOCKS CONNECT, bind/close races, listener wildcard normalization, unsupported commands, unavailable routes, and raw/terminal binary-handler isolation. Page commands use a separately echoed v1 attach negotiation, exact authority/host/page generations, bounded command IDs and sequences, and bounded create/navigate payloads; legacy attaches still receive only the unchanged ready/revoked event shapes. A second optional reconciliation subprotocol gates bounded reclaim, close, and restore payloads behind exact attach/ready echo, complete inventory, command negotiation, reconnect authority, and command-result authority; the production client advertises it only with the matching command and inventory capabilities. Exact guest or app-renderer loss marks one page generation outcome-unknown, coalesces a bounded negotiated inventory reattach, closes or retires the dead generation, and allocates a fresh generation before URL restore; explicit close is not misclassified as a crash. Mixed-version mutation tests project hidden client pages before activate, close, split, reorder, and move-to-group admission, preserve hidden raw order slots, translate visible insertion indices, and project mutation snapshots. A production server orchestrator consumes each immutable inventory once, reserves target generations without exposing placement, emits only negotiated ledger commands, commits after exact completed proof, preserves unrelated and server placements, aborts an attempt when connection authority enters reconnect grace, and requires fresh inventory after failure or abort. The production client dispatcher additionally proves per-page FIFO execution, exact payload-matched duplicate replay, frozen command/result snapshots, a global retired-generation floor, transactional admission, bounded pages/active commands/queues/per-page and global result cache/concurrency, create dependency failure, cancellation, deduplicated retirement joining, and bounded close without late-result overwrite. The server ledger owns issue order and immutable command/result snapshots, bounds outstanding commands, active pages, and per-page/global replay caches, releases active-page capacity after an exact completed close while retaining bounded result replay, validates the shared wire payload before admission, requires live delivery and exact placement, authenticates results to the negotiated connection and paired lease, rejects gaps and conflicting replay, and fences outstanding outcomes at exact retirement. Negotiated command results reuse the authenticated attach socket through bounded nested JSON requests; exact ID routing, reverse-order replies, unknown and duplicate IDs, timeout teardown, serialization failure, aggregate queue accounting, acknowledgement validation, and the unchanged non-v1 path are deterministic. A stable local listener rejects CONNECT while offline or reconnecting, retains its address across replacement, requires a strictly increasing tunnel generation, ignores late superseded callbacks, propagates tunnel protocol failure to the route owner, and recycles exhausted stream IDs only after generation replacement. Reconnect uses the unchanged native v1 attach payload and capability pair; SSH descriptors alone add an execution-host capability and require a runtime-minted grant bound to the exact browser-host lease. Exact SSH provider epoch and connection generation fence ssh2 forwardOut and one non-interactive standalone system-SSH dynamic forward per route. Unit tests preserve domain-form SOCKS requests, sanitize remote errors, bound stderr, cancel startup, release timed-out and synchronously failed sockets, and release routes once. An ephemeral Docker sshd resolves a container-only domain and returns a unique HTTP marker through both ssh2 and the actual system-OpenSSH dynamic-forward adapter without touching the user's SSH files; authority loss fences the ssh2 route. The execution runtime charges route application bytes to the same per-host/process policy; its existing E2EE owner separately caps native outbound buffers process-wide. Production-registered browser-host and paired-runtime methods lease one exact host, prove attach, command delivery, and result settlement share one exact connection identity, then carry SOCKS and HTTP bytes over a dedicated E2EE socket to the fenced execution-host revision and prove route close destroys the destination socket. The production desktop adapter now composes one exact host per environment pairing revision with the page executor, current renderer selector, route Session/WebContents registries, and one reference-counted route per canonical execution-host key. Negotiated same-client control reconnect retains exact authority, placements, grants, dispatcher dedupe, executor guests, and listener addresses; it fences tunnels immediately, blocks route admission, reattaches command delivery only after ready, and replays unsettled commands without repeating completed mutations. Terminal release, replacement, legacy disconnect, and reconnect-grace expiry make only the exact host generation's client placements non-cancellable retirement-pending while retaining capacity until exact cleanup; reconnect grace preserves them. Environment replacement and app shutdown still serialize transport closure before page cleanup and force-close every remaining route. The production placement preparation starts the exact desktop adapter and advertises host/tunnel capabilities only when the paired Electron client is eligible. Node stream-internal high-water bytes, strict cross-route scheduling, and physical cross-platform evidence remain uncovered. The two Docker remote-only SSH browser routing journeys now run in the dedicated Linux ssh-browser-network-route CI job on full runs and their mapped source/test changes; 2 baseline and 6 repeated cases passed with no skips/retries on 2026-09-06. The removed retry-arithmetic and attach-request inventory suites are not current coverage; retained lease and composition suites exercise admission retry, cleanup, inventory negotiation, and reconnect behavior. Test-value audit1293 removes src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/browser/client-pages/lifecycle/browser-client-page-unavailability.test.ts: Every route/guest lifecycle/currentness/navigation/renderer/automation authority is supplied by fake callbacks, then unavailability listener is invoked manually and private inventory/mock calls are checked. No guest destruction, renderer disconnect or actual reconciliation/close consumer. Lose generation fence/reconcile-once/missing-renderer-close branch alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1318: src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts: Retain actual local encrypted WebSocket subscription concurrency routing when host replies out of order, plus an exception thrown by a real ws consumer callback being turned into a subscription error. Server is a test-shaped handshake/response producer using production crypto, not actual runtime host/auth authority or independent cryptographic oracle. Remove happy second-request duplicate, unknown/duplicate-ID branches, fixed32 capacity, serialization/capacity/timeouts and fake memory release/admission call-count scenarios; intentionally lose those alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1340: src/main/runtime/runtime-binary-message-router.test.ts removed. Connection mode conflict exceptions and one terminal/raw callback each. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1371 removes the reconciliation protocol/capability echo inventory from browser-client-host-reconciliation.test.ts. The pending command result refusal without exact authority and later accepted acknowledgement callback remains byte-identical. The narrow negotiation echo alarm is intentionally lost; no equivalent browser/authenticated transport proof is claimed. Existing receipts with unchanged selectors retain only their original scope. Audit1401: src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. No equivalent replacement coverage is claimed.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews" ], "invariant": "A client-hosted browser network route exists only for an exact live server-owned browser-host lease, authority epoch, host generation, paired identity, execution-host revision or SSH provider authority, and server-owned route generation. A client page is usable only when its runtime ID, authority epoch, host identity and generation, logical page ID, page-host generation, current placement, and still-live lease all match atomically; a retired, retirement-pending, or server-placed page cannot be claimed as live client placement. Live logical placements and their identities are bounded, an occupied logical page cannot change placement until exact two-phase retirement completes, cancellation restores the same authority, and the runtime-wide page generation stays monotonic without tombstones. Server-issued page commands and results remain bounded, FIFO per page, immutable after admission, authenticated to the exact paired lease, attach connection, and live placement, and replayable only when byte-equivalent. Negotiated transient result-transport loss retains exact authority and replays unsettled commands through the preserved client dedupe cache; terminal authority loss makes outstanding outcomes unknown and makes only the exact host generation's placements non-cancellable retirement-pending until exact cleanup or reconciliation proof. Desktop composition installs exact command authority before delivery, keeps result settlements below nested-request capacity, suspends every tunnel without closing guests on negotiated loss, gates handlers through route recovery, and synchronously suspends routes and revokes exact retained navigation grants before asynchronous transport or handler cleanup on terminal loss. Navigation-revocation failure remains observable without preventing guest destruction and route cleanup. One environment pairing revision owns at most one composed desktop host and one reference-counted route per canonical execution-host key; pairing replacement and shutdown close control transport before pages and force-close routes even when guest cleanup remains ambiguous. Non-native descriptors require explicit capability negotiation and an exact runtime-minted lease-bound execution-host grant. Host selection never chooses arbitrarily, stale cleanup or settlement cannot remove a replacement, destination names remain unresolved until the execution host, credit returns only after writes settle, and route loss never falls back to desktop DNS or sockets. A main-owned local listener remains stable across upstream transport loss, rejects CONNECT while offline, accepts only a strictly newer tunnel generation, ignores superseded callbacks, and never reuses a stream ID within one generation. Pending opens, admitted open rate, nested control requests, per-route application bytes, aggregate browser-host/process bytes, claims, and socket sources remain bounded with exact release on settlement and retirement. Queued transport drain yields after a bounded quantum. The local SOCKS endpoint accepts only loopback CONNECT and rejects unsupported commands.", - "oracle": "The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Attach two browser hosts and require unqualified selection to fail ambiguous while exact selection succeeds. Reject a second identity on one connection and a fifth identity for one paired device, release one exact lease, then admit its replacement without starving another device. Admit four hosts from one authenticated device and a host from a second, reject the first device's fifth host, and release only the first device's exact counters while the second remains live. Fill asks and hosts to their shared ceiling, retain a quarter of the total budget for ordinary waits, close both sockets, and prove every global, class, and device counter releases. Reject one initial host attach with the unchanged runtime_busy response, then require bounded client-specific jitter to attach when capacity returns; repeated rejection and explicit close must release every timer and subscription. Replace one same-device connection, require the old subscription and route to fence, then prove late old cleanup leaves the new generation live. Mint an exact execution-host grant, reject a different key, prove late old grant cleanup leaves its replacement, and invalidate every grant with lease replacement. Reject client-to-client, client-to-server, server-to-server, and server-to-client placement overwrite until exact retirement. Begin retirement once idempotently, reject client use and every replacement while pending, cancel the exact token to restore the same placement, and reject delayed cancellation or completion after a newer retirement begins. On explicit release, replacement, legacy disconnect, and reconnect-grace expiry, require only the exact host generation's client placements to become non-cancellable retirement-pending before lease settlement; preserve negotiated grace, other hosts, server placements, replacements, and capacity until exact completion. Complete only the exact pending token, retain capacity until completion, and require a reused client page ID to receive a higher global generation without retaining a tombstone. Require a client page through the exact runtime, epoch, host, and page tuple; reject every mismatch, released or replaced leases, retirement-pending pages, retired pages, server placements, invalid identities, and the 257th live placement. Admit 1024 opens in one monotonic 10-second window and reject the 1025th until the window expires. Fill 8 MiB across destination-to-client queues and separately across unsettled client-to-destination writes, release one exact retired stream, admit one replacement, and require the next byte claim to close the route without stale-callback or reentrant-close underflow. Across multiple routes, charge application copies, encrypted queue entries, and dynamic native socket bytes to one 32 MiB browser-host and 128 MiB process ceiling; reject zero-byte claim/socket-source floods, fence released leases, synchronously release JavaScript queue claims while retaining native claims through exact socket close, and yield a parked queue after four frames without reordering. Route nested responses by exact ID under reordering, reject unknown and duplicate IDs, cap pending requests and queued bytes, and tear down every concurrent waiter once on timeout or close. Drive one real paired attach, command, and result through one exact connection ID; reject missing send support and malformed or wrong-runtime acknowledgements while preserving old non-v1 attaches. Drop an authenticated transport, require the same listener to reject CONNECT before and during reconnect, attach the exact existing native v1 payload and capability pair to a strictly newer generation, ignore late old callbacks, and roll an exhausted stream-ID ledger only by replacing the generation. Require SSH descriptors to add an execution-host capability and exact grant, reject missing grants and stale provider authority before resolver or binary registration, pass exact domains to ssh2 and system-SSH SOCKS without local resolution, sanitize connector diagnostics, and close every stream and standalone route process once on timeout, synchronous failure, or rotation. Drive the accepted lease through real paired E2EE native SOCKS-to-HTTP and ephemeral Docker ssh2 remote-only DNS journeys, then exercise exact frame, credit, half-close, stale-stream, remote-DNS, unsupported-command, offline, and teardown assertions.", + "oracle": "The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Attach two browser hosts and require unqualified selection to fail ambiguous while exact selection succeeds. Reject a second identity on one connection and a fifth identity for one paired device, release one exact lease, then admit its replacement without starving another device. Admit four hosts from one authenticated device and a host from a second, reject the first device's fifth host, and release only the first device's exact counters while the second remains live. Fill asks and hosts to their shared ceiling, retain a quarter of the total budget for ordinary waits, close both sockets, and prove every global, class, and device counter releases. Reject one initial host attach with the unchanged runtime_busy response, then require bounded client-specific jitter to attach when capacity returns; repeated rejection and explicit close must release every timer and subscription. Replace one same-device connection, require the old subscription and route to fence, then prove late old cleanup leaves the new generation live. Mint an exact execution-host grant, reject a different key, prove late old grant cleanup leaves its replacement, and invalidate every grant with lease replacement. Reject client-to-client, client-to-server, server-to-server, and server-to-client placement overwrite until exact retirement. Begin retirement once idempotently, reject client use and every replacement while pending, cancel the exact token to restore the same placement, and reject delayed cancellation or completion after a newer retirement begins. On explicit release, replacement, legacy disconnect, and reconnect-grace expiry, require only the exact host generation's client placements to become non-cancellable retirement-pending before lease settlement; preserve negotiated grace, other hosts, server placements, replacements, and capacity until exact completion. Complete only the exact pending token, retain capacity until completion, and require a reused client page ID to receive a higher global generation without retaining a tombstone. Require a client page through the exact runtime, epoch, host, and page tuple; reject every mismatch, released or replaced leases, retirement-pending pages, retired pages, server placements, invalid identities, and the 257th live placement. Admit 1024 opens in one monotonic 10-second window and reject the 1025th until the window expires. Fill 8 MiB across destination-to-client queues and separately across unsettled client-to-destination writes, release one exact retired stream, admit one replacement, and require the next byte claim to close the route without stale-callback or reentrant-close underflow. Across multiple routes, charge application copies, encrypted queue entries, and dynamic native socket bytes to one 32 MiB browser-host and 128 MiB process ceiling; reject zero-byte claim/socket-source floods, fence released leases, synchronously release JavaScript queue claims while retaining native claims through exact socket close, and yield a parked queue after four frames without reordering. Route nested responses by exact ID under reordering, reject unknown and duplicate IDs, cap pending requests and queued bytes, and tear down every concurrent waiter once on timeout or close. Drive one real paired attach, command, and result through one exact connection ID; reject missing send support and malformed or wrong-runtime acknowledgements while preserving old non-v1 attaches. Drop an authenticated transport, require the same listener to reject CONNECT before and during reconnect, attach the exact existing native v1 payload and capability pair to a strictly newer generation, ignore late old callbacks, and roll an exhausted stream-ID ledger only by replacing the generation. Require SSH descriptors to add an execution-host capability and exact grant, reject missing grants and stale provider authority before resolver or binary registration, pass exact domains to ssh2 and system-SSH SOCKS without local resolution, sanitize connector diagnostics, and close every stream and standalone route process once on timeout, synchronous failure, or rotation. Drive the accepted lease through real paired E2EE native SOCKS-to-HTTP and ephemeral Docker ssh2 remote-only DNS journeys, then exercise exact frame, credit, half-close, stale-stream, remote-DNS, unsupported-command, offline, and teardown assertions.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/runtime-browser-client-page-recovery.test.ts src/main/runtime/rpc/methods/session-tab-browser-placement-mutations.test.ts src/main/runtime/rpc/methods/session-tab-browser-placement-projection.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/browser-host-page-retirement.test.ts src/main/runtime/browser-host/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host/browser-host-page-placement.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts", @@ -6666,13 +6625,6 @@ "spontaneous exact guest destruction revokes active inventory before explicit page retirement" ] }, - { - "file": "src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts", - "assertions": [ - "optional URLs compact by deterministic codepoint order without dropping required page identity", - "an unencodable complete snapshot declines inventory negotiation instead of dropping a page" - ] - }, { "file": "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts", "assertions": [ @@ -6979,16 +6931,6 @@ "durationSeconds": 2.23, "summary": "Fourteen files passed 150 negotiated same-client reconnect, legacy skew, active takeover, exact authority, immediate route suspension, independently bounded route retry, stable fail-closed SOCKS, ready-before-replay, completed-mutation dedupe, partial-replay delivery recovery, repeated-loss, stale-callback, explicit-revocation, grace cleanup, and deterministic jittered-backoff tests." }, - { - "date": "2026-08-14", - "runner": "local", - "platform": "macos", - "command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-inventory.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/browser-host/browser-host-page-reconciliation-plan.test.ts", - "currentCommand": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser/client-hosting/browser-client-host-protocol.test.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/browser-host/browser-host-page-reconciliation-plan.test.ts", - "result": "passed", - "durationSeconds": 7.3, - "summary": "Eleven files passed 145 exact inventory negotiation, 256-page and 768 KiB atomic bounds, worst-case JSON-escaped inventory identities, deterministic optional-URL compaction, legacy-command preservation when inventory is unencodable, legacy strip, immutable authenticated lease snapshot, strict v1/duplicate/foreign-client rejection, paired-device-bound previous-runtime restart admission, missing and unsolicited echo, create-to-active deduplication, renderer/guest-stale outcome-unknown classification, normalized URL bounds, composition sampling, RPC retention, and reconciliation tests." - }, { "date": "2026-08-14", "runner": "local", @@ -7112,15 +7054,15 @@ }, "flakeHistory": { "status": "unknown", - "evidence": "Changed selectors have no new soak result after Audit1340; any retained unchanged-source receipts apply only to their own commands. Historical account: The deterministic and paired-runtime suites passed locally; CI and soak history have not started for the stacked route stage." + "evidence": "Changed selectors have no new soak result after Audit1401; any retained unchanged-source receipts apply only to their own commands. Historical account: Changed selectors have no new soak result after Audit1340; any retained unchanged-source receipts apply only to their own commands. Historical account: The deterministic and paired-runtime suites passed locally; CI and soak history have not started for the stacked route stage." }, "redGreenEvidence": { "status": "missing", - "evidence": "Audit1340 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The protocol and tunnel-session oracles fail on origin/main 3246b73add because the modules do not exist, then pass on the candidate. The lease registry and control-client suites were recorded red at missing modules before implementation. The unchanged tunnel authorization oracle was behaviorally red because an authenticated socket could self-assert its paired device ID and received ready generation 7 without a lease; it is green after server-owned lease and route fencing. On c9a41abf24, the unchanged admission oracle failed three ways: a second identity on one connection and a fifth identity for one paired device were both admitted, and closed page placement had no retirement API. All three pass after bounded admission and tombstone-free global page generations. Before the admission-fairness stage, one paired device's four hosts filled the global host cap and rejected a second device, initial runtime_busy was terminal, and reconnect runtime_busy ended preserved authority. Raising only the host cap then let asks and hosts starve ordinary waits. The reviewed candidate caps hosts at eight globally and four per authenticated paired device, caps asks plus hosts at twelve of sixteen polls, and retries runtime_busy only inside the existing attach or reconnect deadline; the unchanged oracle passes all 16 focused assertions with exact counter, subscription, and timer release. On parent 81eb14c849, the initial three replacement-barrier tests failed because occupied client and server pages could be overwritten without retirement; the candidate rejects every placement-kind overwrite before host selection, preserves capacity until exact retirement, and keeps replacement generations monotonic. On parent 32c0c7f309, all five two-phase retirement tests failed because retirement had only an immediate-delete API; the candidate fences pending pages, restores exact cancellation, rejects delayed tokens, and releases capacity only after exact completion. On parent 392d13be9f, the deterministic resource oracle admitted 17 pending opens, admitted a 129th open inside 10 seconds, and retained more than 8 MiB across one route; all three failed assertions pass on the candidate, which also covers unsettled writes and reentrant exact release. With aggregate enforcement replaced by a no-op scaffold on parent b32610e365, all three host/process memory assertions failed: host bytes, process bytes, claims, and socket sources were independently unbounded. They pass with exact owner release, client and execution-host application charging, encrypted queue/native socket charging, and bounded drain. On parent a089829521, stream exhaustion was not distinguishable, transport loss closed the local listener with ECONNREFUSED, reconnect opened no replacement subscription, and a ready generation that closed before await continuation could be replayed. The initial reconnect candidate also retained a dead transport after a client-side protocol failure and therefore refused replacement. The reviewed candidate keeps one fail-closed address, propagates protocol closure, strictly fences observed generations, ignores superseded callbacks, and recycles stream IDs only after replacement while preserving the v1 attach shape. Parent 9889adf4c5 accepts only a native executionHost schema and its handler unconditionally reads native runtimeId and revision; widening the schema made node typecheck fail at those exact assumptions before adapter integration. The candidate keeps native subscription bytes and capabilities unchanged, capability-gates SSH, rejects stale authority before binary registration, and passes exact domains through both adapter contracts. Before the reviewed authorization and lifecycle fix, 10 of 34 focused assertions failed: an ungranted SSH key reached the resolver, grants did not exist, native routes exposed a global never-settling invalidation promise, pre-attach destroy emitted no close, synchronous forwardOut escaped without cleanup, OpenSSH did not force a standalone process, and raw connector detail crossed the RPC boundary. The same 34 assertions pass with exact tokenized grants, optional native invalidation, one-close deferred sockets, caught synchronous opens, standalone OpenSSH, and stable public errors. The real paired journey failed at the missing network.browserTunnel method before explicit test injection, then passed with an exact control lease while both production registries remained closed. Full mutation/revert evidence remains to be collected before promotion." + "evidence": "Audit1401 changed referenced test sources; no new red/green validation of the reduced set. Historical account: Audit1340 changed referenced test sources; no new red/green validation of the reduced set. Historical account: The protocol and tunnel-session oracles fail on origin/main 3246b73add because the modules do not exist, then pass on the candidate. The lease registry and control-client suites were recorded red at missing modules before implementation. The unchanged tunnel authorization oracle was behaviorally red because an authenticated socket could self-assert its paired device ID and received ready generation 7 without a lease; it is green after server-owned lease and route fencing. On c9a41abf24, the unchanged admission oracle failed three ways: a second identity on one connection and a fifth identity for one paired device were both admitted, and closed page placement had no retirement API. All three pass after bounded admission and tombstone-free global page generations. Before the admission-fairness stage, one paired device's four hosts filled the global host cap and rejected a second device, initial runtime_busy was terminal, and reconnect runtime_busy ended preserved authority. Raising only the host cap then let asks and hosts starve ordinary waits. The reviewed candidate caps hosts at eight globally and four per authenticated paired device, caps asks plus hosts at twelve of sixteen polls, and retries runtime_busy only inside the existing attach or reconnect deadline; the unchanged oracle passes all 16 focused assertions with exact counter, subscription, and timer release. On parent 81eb14c849, the initial three replacement-barrier tests failed because occupied client and server pages could be overwritten without retirement; the candidate rejects every placement-kind overwrite before host selection, preserves capacity until exact retirement, and keeps replacement generations monotonic. On parent 32c0c7f309, all five two-phase retirement tests failed because retirement had only an immediate-delete API; the candidate fences pending pages, restores exact cancellation, rejects delayed tokens, and releases capacity only after exact completion. On parent 392d13be9f, the deterministic resource oracle admitted 17 pending opens, admitted a 129th open inside 10 seconds, and retained more than 8 MiB across one route; all three failed assertions pass on the candidate, which also covers unsettled writes and reentrant exact release. With aggregate enforcement replaced by a no-op scaffold on parent b32610e365, all three host/process memory assertions failed: host bytes, process bytes, claims, and socket sources were independently unbounded. They pass with exact owner release, client and execution-host application charging, encrypted queue/native socket charging, and bounded drain. On parent a089829521, stream exhaustion was not distinguishable, transport loss closed the local listener with ECONNREFUSED, reconnect opened no replacement subscription, and a ready generation that closed before await continuation could be replayed. The initial reconnect candidate also retained a dead transport after a client-side protocol failure and therefore refused replacement. The reviewed candidate keeps one fail-closed address, propagates protocol closure, strictly fences observed generations, ignores superseded callbacks, and recycles stream IDs only after replacement while preserving the v1 attach shape. Parent 9889adf4c5 accepts only a native executionHost schema and its handler unconditionally reads native runtimeId and revision; widening the schema made node typecheck fail at those exact assumptions before adapter integration. The candidate keeps native subscription bytes and capabilities unchanged, capability-gates SSH, rejects stale authority before binary registration, and passes exact domains through both adapter contracts. Before the reviewed authorization and lifecycle fix, 10 of 34 focused assertions failed: an ungranted SSH key reached the resolver, grants did not exist, native routes exposed a global never-settling invalidation promise, pre-attach destroy emitted no close, synchronous forwardOut escaped without cleanup, OpenSSH did not force a standalone process, and raw connector detail crossed the RPC boundary. The same 34 assertions pass with exact tokenized grants, optional native invalidation, one-close deferred sockets, caught synchronous opens, standalone OpenSSH, and stable public errors. The real paired journey failed at the missing network.browserTunnel method before explicit test injection, then passed with an exact control lease while both production registries remained closed. Full mutation/revert evidence remains to be collected before promotion." }, "performanceBudget": { "required": true, - "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Data frames, send credit, pending bytes and chunk counts in both directions, streams, SOCKS handshake, and pipelined application bytes are bounded. Each route admits at most 256 streams (pending opens included), 1024 opens per monotonic 10-second window, and 8 MiB of session-owned queued or unsettled application bytes with exact settlement and retirement release. Multiple client routes share a 32 MiB browser-host and 128 MiB process ceiling across application copies, encrypted queue frames, and dynamic native socket buffers; the execution runtime uses the same per-host/process application policy. Claims, socket sources, host records, and leases have independent count caps; explicit close releases JavaScript queue claims synchronously while native socket ownership remains charged until exact socket close. Parked encrypted queues hand at most four frames to the native socket per immediate cooperative drain turn. One authenticated connection retains at most one browser host and one paired device at most four, with exact release restoring admission. Permanent browser-host polls use at most eight of sixteen slots and four per authenticated paired device; asks plus hosts use at most twelve, preserving four slots for ordinary waits. Admission retry adds no polling or subprocess: it owns one attach subscription and one timer at a time, uses deterministic client-specific jitter, and cannot outlive the existing attach timeout or negotiated reconnect grace. Each SSH route owns one ssh2 authority or one standalone system-SSH dynamic-forward process, keeps at most 64 KiB of stderr tail, and releases every adapter/socket on exact route close or provider rotation. The system-SSH process exposes a separate no-auth loopback SOCKS listener outside application stream/rate/memory accounting under the documented same-user desktop trust boundary. Credit returns only after the execution-host or browser-facing socket write settles, and the injected transport must explicitly accept each frame. Node stream-internal high-water bytes and strict cross-route scheduling evidence remain required before live tunnel advertisement." + "evidence": "Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Historical account for the pre-audit test set; removed work-count alarms and changed selectors have no fresh measurement. Data frames, send credit, pending bytes and chunk counts in both directions, streams, SOCKS handshake, and pipelined application bytes are bounded. Each route admits at most 256 streams (pending opens included), 1024 opens per monotonic 10-second window, and 8 MiB of session-owned queued or unsettled application bytes with exact settlement and retirement release. Multiple client routes share a 32 MiB browser-host and 128 MiB process ceiling across application copies, encrypted queue frames, and dynamic native socket buffers; the execution runtime uses the same per-host/process application policy. Claims, socket sources, host records, and leases have independent count caps; explicit close releases JavaScript queue claims synchronously while native socket ownership remains charged until exact socket close. Parked encrypted queues hand at most four frames to the native socket per immediate cooperative drain turn. One authenticated connection retains at most one browser host and one paired device at most four, with exact release restoring admission. Permanent browser-host polls use at most eight of sixteen slots and four per authenticated paired device; asks plus hosts use at most twelve, preserving four slots for ordinary waits. Admission retry adds no polling or subprocess: it owns one attach subscription and one timer at a time, uses deterministic client-specific jitter, and cannot outlive the existing attach timeout or negotiated reconnect grace. Each SSH route owns one ssh2 authority or one standalone system-SSH dynamic-forward process, keeps at most 64 KiB of stderr tail, and releases every adapter/socket on exact route close or provider rotation. The system-SSH process exposes a separate no-auth loopback SOCKS listener outside application stream/rate/memory accounting under the documented same-user desktop trust boundary. Credit returns only after the execution-host or browser-facing socket write settles, and the injected transport must explicitly accept each frame. Node stream-internal high-water bytes and strict cross-route scheduling evidence remain required before live tunnel advertisement." }, "promotionCriteria": [ "Charge Node stream-internal high-water bytes and prove cross-route fairness under slow physical links; add a strict scheduler if the four-frame yield quantum is insufficient.", @@ -7157,7 +7099,11 @@ "Audit1340 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[\"remote-runtime\",\"ssh\"]}. Remaining provider scope applies only to unchanged-source receipts.", "Audit1340 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n {\n \"file\": \"src/main/runtime/runtime-binary-message-router.test.ts\",\n \"assertions\": [\n \"dedicated raw tunnel traffic cannot replace or be decoded as terminal stream traffic on the same connection\"\n ]\n }\n]", "Audit1371 removes the reconciliation protocol/capability echo inventory from browser-client-host-reconciliation.test.ts. The pending command result refusal without exact authority and later accepted acknowledgement callback remains byte-identical. The narrow negotiation echo alarm is intentionally lost; no equivalent browser/authenticated transport proof is claimed. Existing receipts with unchanged selectors retain only their original scope.", - "Audit1372 historical assertion inventory, not current coverage: [{\"file\":\"src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts\",\"assertions\":[\"the authenticated server echoes and retains reconciliation only when explicitly requested\",\"command result settlement requires the exact negotiated reconciliation authority\"]}]" + "Audit1372 historical assertion inventory, not current coverage: [{\"file\":\"src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts\",\"assertions\":[\"the authenticated server echoes and retains reconciliation only when explicitly requested\",\"command result settlement requires the exact negotiated reconciliation authority\"]}]", + "Audit1401: src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. No equivalent replacement coverage is claimed.", + "Audit1401 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-08-14\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-inventory.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/browser-host/browser-host-page-reconciliation-plan.test.ts\",\n \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser/client-hosting/browser-client-host-protocol.test.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/browser-host/browser-host-page-reconciliation-plan.test.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 7.3,\n \"summary\": \"Eleven files passed 145 exact inventory negotiation, 256-page and 768 KiB atomic bounds, worst-case JSON-escaped inventory identities, deterministic optional-URL compaction, legacy-command preservation when inventory is unencodable, legacy strip, immutable authenticated lease snapshot, strict v1/duplicate/foreign-client rejection, paired-device-bound previous-runtime restart admission, missing and unsolicited echo, create-to-active deduplication, renderer/guest-stale outcome-unknown classification, normalized URL bounds, composition sampling, RPC retention, and reconciliation tests.\"\n }", + "Audit1401 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\",\"linux\"],\"coveredProviders\":[]}. Remaining provider scope applies only to unchanged-source receipts.", + "Audit1401 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n {\n \"file\": \"src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts\",\n \"assertions\": [\n \"optional URLs compact by deterministic codepoint order without dropping required page identity\",\n \"an unencodable complete snapshot declines inventory negotiation instead of dropping a page\"\n ]\n }\n]" ], "demotionRule": "Keep experimental or demote if a self-asserted or ambiguous host can receive a route, an SSH descriptor bypasses capability, lease-bound grant, or provider-authority checks, late cleanup can remove a replacement, a route can resolve names on the desktop, exceed a byte or stream bound, replenish credit before destination settlement, accept a stale or non-increasing generation, reuse a stream ID within one generation, lose or bypass its fail-closed listener during reconnect, expose the SOCKS listener off-loopback, accept BIND/UDP, or fall back when the selected route is unavailable." }, @@ -8005,10 +7951,10 @@ "providers": ["local", "daemon", "ssh", "remote-runtime", "wsl"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "remote-runtime"], - "coverageNotes": "Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic host/parser, process-classifier, snapshot-publication, mixed-version, renderer, and macOS Electron coverage proves the local and shared paired-runtime contracts. Direct SSH intentionally publishes no shell proof and immediately preserves incumbent behavior. WSL, Windows ConPTY, Linux desktop, and paired headed/headless journeys remain gaps. The audit removed the isolated terminal-multiplex pending-escape-tail forwarding test. Its direct RPC snapshot field-copy alarm is lost; retained parser, snapshot and lifecycle suites do not establish equivalent RPC field coverage. Audit1320: src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts removed. Snapshot pending escape/alternate-screen/shell metadata forwarding and negative app-store-read alarm disappears. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", + "coverageNotes": "Audit1320 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic host/parser, process-classifier, snapshot-publication, mixed-version, renderer, and macOS Electron coverage proves the local and shared paired-runtime contracts. Direct SSH intentionally publishes no shell proof and immediately preserves incumbent behavior. WSL, Windows ConPTY, Linux desktop, and paired headed/headless journeys remain gaps. The audit removed the isolated terminal-multiplex pending-escape-tail forwarding test. Its direct RPC snapshot field-copy alarm is lost; retained parser, snapshot and lifecycle suites do not establish equivalent RPC field coverage. Audit1320: src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts removed. Snapshot pending escape/alternate-screen/shell metadata forwarding and negative app-store-read alarm disappears. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": ["https://github.com/stablyai/orca/pull/16379"], "invariant": "After a TUI exits or is killed, reveal, reattach, snapshot replay, or renderer remount must not deliver terminal-owned mouse or alternate-screen protocol bytes to the surviving shell. Recovery is an ordered output barrier in the daemon session data path: an OSC 133;D completing while the alternate screen is still active pauses the stream at that exact byte boundary, a fresh execution-host process inspection proves shell ownership, and on proof a mode reset is injected as in-stream output so every consumer converges by parsing the same bytes and the queued post-boundary shell output (the prompt) lands on the normal buffer. Snapshots are pure reads. Any failure — refuted proof, timeout, queue overflow, session death, disposal — flushes the queue unmodified, preserving incumbent behavior; later command or mode bytes revoke proof. Clean alternate-screen exits prove ownership asynchronously without pausing.", - "oracle": "The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Run one fixed child-TUI journey for normal exit and cleanup-free SIGKILL. Assert renderer and host normal-buffer/non-mouse state, host snapshot terminalOwner metadata, exact PTY writes with no post-exit mouse report, unrelated-pane survival, post-boundary prompt output preserved (normal exit), ordered proof invalidation, bounded settlement and bail-out flush, one inspection per unclean episode with zero scans for ordinary output, split-escape safety at every chunk boundary, and old/new client-host fallback parity.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Run one fixed child-TUI journey for normal exit and cleanup-free SIGKILL. Assert renderer and host normal-buffer/non-mouse state, host snapshot terminalOwner metadata, exact PTY writes with no post-exit mouse report, unrelated-pane survival, post-boundary prompt output preserved (normal exit), ordered proof invalidation, bounded settlement and bail-out flush, one inspection per unclean episode with zero scans for ordinary output, split-escape safety at every chunk boundary, and old/new client-host fallback parity.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/terminal-shell-lifecycle-scanner.test.ts src/main/daemon/terminal-shell-recovery-barrier.test.ts src/main/daemon/session-shell-recovery.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host-concurrent-create.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-restore-scrollback-depth.test.ts src/main/daemon/terminal-checkpoint-serializer.test.ts src/main/providers/agent-foreground-process.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/mobile-presence-lock.test.ts src/renderer/src/components/terminal-pane/pty-connection-visibility-and-exit.test.ts src/renderer/src/components/terminal-pane/pty-connection-input-and-repaint.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-replay.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.test.ts src/shared/terminal/protocol/escape/terminal-partial-escape-tail.fuzz.test.ts --reporter=dot", "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts --reporter=dot", @@ -8116,7 +8062,8 @@ "The audit removed the isolated terminal-multiplex pending-escape-tail forwarding test. Its direct RPC snapshot field-copy alarm is lost; retained parser, snapshot and lifecycle suites do not establish equivalent RPC field coverage.", "Audit1320: src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts removed. Snapshot pending escape/alternate-screen/shell metadata forwarding and negative app-store-read alarm disappears. No equivalent replacement coverage is claimed.", "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", - "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." + "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []" ], "demotionRule": "Keep experimental or demote if missing ownership proof changes incumbent behavior, a live TUI loses mouse/focus modes, foreground inspection enters ordinary output/reveal paths, or the focused Electron journey flakes without an identified product or harness fault." }, @@ -8572,7 +8519,7 @@ "providers": ["local", "daemon", "ssh", "runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh", "runtime"], - "coverageNotes": "Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. A deterministic final-pane interleaving now proves durable tab retirement commits before externally owned PTY teardown can publish graph loss, and preserves an unrelated live canary through duplicate exit retirement. Deterministic tests also cover final-pane CLI close durability and same-incarnation handle continuity; persisted-empty restart suppression remains historical Electron evidence, alongside replacement and hard graph-loss stale fencing, preallocated-handle supersession, daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending. A paired macOS Electron journey (real attached-window desktop host plus a separate real paired desktop client, isolated profiles) covers the inverse authority direction for host-created terminals: a renderer graph sync must not retire a tab that `orca terminal create` made. The retained paired journey covers the incident shape the real CLI produces - a repo's FIRST host-created terminal, since src/cli/handlers/terminal.ts sends no clientMutationId. The repeated target-after-unrelated-terminal journey was retired; its separate ordering alarm is no longer provided. An earlier reading of this gate called a preceding host-created terminal and a `clientMutationId` protective; main-process instrumentation refuted that. The renderer's stale session write deleted the host tab from persistence in every variant, and only the delete's timing relative to the measured sync differed, so those rows were false negatives of a single-sync oracle. The defect was in persistence: persistPtyBinding did not raise the repo's terminal topology fence for the first host-admitted tab, leaving the renderer's pre-create tab list free to replay over it. Elapsed time and paired-client mirroring never decided anything. A windowless `orca serve` parity arm runs the identical oracle and passes on both the merge-base and the branch, confirming that topology does not exhibit the defect (the gate it turns on is window-conditioned) and that making the host binding unconditional did not regress it. All of this is macOS-local only. The reported incident occurred on a physical Windows host; we did not run against one. The claim that the mechanism is platform-independent rests on the authoritative-window gate and publication-epoch inheritance being OS-agnostic, not on Windows evidence, so no ConPTY, Windows window-lifecycle, update, or sleep behavior is covered here. The synthetic default-tabs unit suite was retired: its explicit-empty/default-tab assertions no longer supply unit evidence. This retirement supplies no new persisted-restart, runtime-routing, cross-platform, or mobile evidence; existing historical runs and counts remain historical. The test-value audit removes the isolated re-retirement-token/epoch, activity-cutoff, idle-reattach and sibling-restore examples. The cited exact retirement and chained-detach cases remain unchanged, alongside closed-tab revival fencing and alias churn bounds. Their retained evidence is not equivalent coverage for every removed permutation; historical execution evidence is unchanged. The test-value audit removed shared-owner snapshot/cold-restore reference examples, a direct absent-tab PTY-index update, caller-supplied host-owned teardown boolean/no-dispatch, and a single local-provider rejection example. It also removed hand-built detach-retention comparator examples for different runs, handles, provider identities, and handle-less rows without independent identity ingress. Their specific snapshot, missing-tab, host-decision, rejection-count, and comparator alarms are lost. Current exact authority/ordering and chained-detach cases remain retained; they do not establish equivalent coverage for the removed examples. Historical commands, counts, results, and red-green narratives remain historical. The test-value audit retires terminals-explicit-empty-hydration.test.ts in full: its direct git/folder empty-tombstone assertions and literal-flag auto-create helper check are lost. The store test never mounted the initial-terminal effect or performed a persisted restart. The audit also removes terminal-tab-retirement.test.ts pure ownership/alias/routing plan inventories and sleeping-record map assertions; its former 100-tab scan-count case was subsequently retired too; no assertion remains in that suite. These retained and historical cases do not establish equivalent tombstone, default-create, provider teardown, cross-platform, or mobile coverage. Historical commands, results, counts, and red-green narratives remain historical. The subsequent test-value audit deletes the remaining terminal-tab-retirement.test.ts suite. Its 100-tab case asserted only returned plan count and one outer scan per ownership store; it never inspected per-tab plans or provider teardown. Those direct cardinality/work-count alarms are intentionally lost. Historical executed commands, results, counts and red-green narratives remain historical; no equivalent replacement or new runtime, platform or mobile evidence is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. A deterministic final-pane interleaving now proves durable tab retirement commits before externally owned PTY teardown can publish graph loss, and preserves an unrelated live canary through duplicate exit retirement. Deterministic tests also cover final-pane CLI close durability and same-incarnation handle continuity; persisted-empty restart suppression remains historical Electron evidence, alongside replacement and hard graph-loss stale fencing, preallocated-handle supersession, daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending. A paired macOS Electron journey (real attached-window desktop host plus a separate real paired desktop client, isolated profiles) covers the inverse authority direction for host-created terminals: a renderer graph sync must not retire a tab that `orca terminal create` made. The retained paired journey covers the incident shape the real CLI produces - a repo's FIRST host-created terminal, since src/cli/handlers/terminal.ts sends no clientMutationId. The repeated target-after-unrelated-terminal journey was retired; its separate ordering alarm is no longer provided. An earlier reading of this gate called a preceding host-created terminal and a `clientMutationId` protective; main-process instrumentation refuted that. The renderer's stale session write deleted the host tab from persistence in every variant, and only the delete's timing relative to the measured sync differed, so those rows were false negatives of a single-sync oracle. The defect was in persistence: persistPtyBinding did not raise the repo's terminal topology fence for the first host-admitted tab, leaving the renderer's pre-create tab list free to replay over it. Elapsed time and paired-client mirroring never decided anything. A windowless `orca serve` parity arm runs the identical oracle and passes on both the merge-base and the branch, confirming that topology does not exhibit the defect (the gate it turns on is window-conditioned) and that making the host binding unconditional did not regress it. All of this is macOS-local only. The reported incident occurred on a physical Windows host; we did not run against one. The claim that the mechanism is platform-independent rests on the authoritative-window gate and publication-epoch inheritance being OS-agnostic, not on Windows evidence, so no ConPTY, Windows window-lifecycle, update, or sleep behavior is covered here. The synthetic default-tabs unit suite was retired: its explicit-empty/default-tab assertions no longer supply unit evidence. This retirement supplies no new persisted-restart, runtime-routing, cross-platform, or mobile evidence; existing historical runs and counts remain historical. The test-value audit removes the isolated re-retirement-token/epoch, activity-cutoff, idle-reattach and sibling-restore examples. The cited exact retirement and chained-detach cases remain unchanged, alongside closed-tab revival fencing and alias churn bounds. Their retained evidence is not equivalent coverage for every removed permutation; historical execution evidence is unchanged. The test-value audit removed shared-owner snapshot/cold-restore reference examples, a direct absent-tab PTY-index update, caller-supplied host-owned teardown boolean/no-dispatch, and a single local-provider rejection example. It also removed hand-built detach-retention comparator examples for different runs, handles, provider identities, and handle-less rows without independent identity ingress. Their specific snapshot, missing-tab, host-decision, rejection-count, and comparator alarms are lost. Current exact authority/ordering and chained-detach cases remain retained; they do not establish equivalent coverage for the removed examples. Historical commands, counts, results, and red-green narratives remain historical. The test-value audit retires terminals-explicit-empty-hydration.test.ts in full: its direct git/folder empty-tombstone assertions and literal-flag auto-create helper check are lost. The store test never mounted the initial-terminal effect or performed a persisted restart. The audit also removes terminal-tab-retirement.test.ts pure ownership/alias/routing plan inventories and sleeping-record map assertions; its former 100-tab scan-count case was subsequently retired too; no assertion remains in that suite. These retained and historical cases do not establish equivalent tombstone, default-create, provider teardown, cross-platform, or mobile coverage. Historical commands, results, counts, and red-green narratives remain historical. The subsequent test-value audit deletes the remaining terminal-tab-retirement.test.ts suite. Its 100-tab case asserted only returned plan count and one outer scan per ownership store; it never inspected per-tab plans or provider teardown. Those direct cardinality/work-count alarms are intentionally lost. Historical executed commands, results, counts and red-green narratives remain historical; no equivalent replacement or new runtime, platform or mobile evidence is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-4327", "https://github.com/stablyai/orca/pull/14590", @@ -8581,7 +8528,7 @@ "https://github.com/stablyai/orca/issues/14524" ], "invariant": "Close permanently removes the owned provider session, agent descendants, persisted tab/layout authority, and resume authority even when no TerminalPane is mounted; final-pane CLI close commits durable tab retirement before PTY stop can publish graph loss, does not acknowledge before that retirement, and treats the later exit retirement as idempotent. Workspace-wide CLI close applies that same durable contract to every terminal in exactly one worktree, including pinned and persisted-only surfaces, without touching sibling-worktree PTYs or resume records. A persisted explicit-empty state prevents initial-tab fallback from repopulating the workspace after reload or restart. A handle remains valid while the same provider-attested PTY incarnation survives renderer reload or re-key, and becomes stale without adopting a replacement incarnation. A terminating id remains reserved through natural exit, duplicate callers await the same completion, and immediate teardown upgrades any graceful request without signalling a recycled PID or a descendant tree after root ownership is lost; process-table work is locale-stable, bounded, fresh for each post-start request, same-turn coalesced, and begins within the requesting caller's deadline, including bulk worktree cleanup; detach and park preserve ownership; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.", - "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Capture exact tab, pane, PTY, handle, incarnation, and persisted layout identities. Final-pane terminal.close must invoke one durability-acknowledged tab retirement before exact PTY teardown; controlled PTY exit and graph removal afterward must remain idempotent, omit the target from persistence and provider inventory, and leave an unrelated canary handle live. terminal.closeAll must force-retire every pinned and unpinned target surface, clear its persisted agent-resume and incarnation records, await authoritative PTY exit, preserve a sibling worktree's tab, PTY, and resume authority, and return an unverifiable failure instead of claiming exit when the owning host does not confirm a stop. The ordinary path stays pending until the persisted row is removed and never falls back to the fire-and-forget pane event; reload/restart must keep the explicitly emptied worktree at zero terminal tabs and provider sessions. Reloading the renderer with the same tab/pane/PTY/incarnation must keep the handle readable; changing only the incarnation behind the same PTY id, losing the authoritative graph, or superseding the renderer handle with a preallocated handle must reject the old handle with terminal_handle_stale. Parked-close tests prove the exact PTY disappears; descendant/process tests keep natural exits reserved, upgrade teardown safely, bound/coalesce process-table work, and protect recycled identities.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Capture exact tab, pane, PTY, handle, incarnation, and persisted layout identities. Final-pane terminal.close must invoke one durability-acknowledged tab retirement before exact PTY teardown; controlled PTY exit and graph removal afterward must remain idempotent, omit the target from persistence and provider inventory, and leave an unrelated canary handle live. terminal.closeAll must force-retire every pinned and unpinned target surface, clear its persisted agent-resume and incarnation records, await authoritative PTY exit, preserve a sibling worktree's tab, PTY, and resume authority, and return an unverifiable failure instead of claiming exit when the owning host does not confirm a stop. The ordinary path stays pending until the persisted row is removed and never falls back to the fire-and-forget pane event; reload/restart must keep the explicitly emptied worktree at zero terminal tabs and provider sessions. Reloading the renderer with the same tab/pane/PTY/incarnation must keep the handle readable; changing only the incarnation behind the same PTY id, losing the authoritative graph, or superseding the renderer handle with a preallocated handle must reject the old handle with terminal_handle_stale. Parked-close tests prove the exact PTY disappears; descendant/process tests keep natural exits reserved, upgrade teardown safely, bound/coalesce process-table work, and protect recycled identities.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-terminal-close-continuity.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts", @@ -8620,12 +8567,6 @@ "tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts" ], "assertionRefs": [ - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "workspace-wide close force-retires pinned and unpinned tabs, clears resume/incarnation state, awaits both target PTYs, preserves the sibling worktree, and reports an unconfirmed stop as unverifiable" - ] - }, { "file": "src/main/runtime/orca-runtime-terminal-close-continuity.test.ts", "assertions": [ @@ -8815,7 +8756,8 @@ "The subsequent test-value audit deletes the remaining terminal-tab-retirement.test.ts suite. Its 100-tab case asserted only returned plan count and one outer scan per ownership store; it never inspected per-tab plans or provider teardown. Those direct cardinality/work-count alarms are intentionally lost. Historical executed commands, results, counts and red-green narratives remain historical; no equivalent replacement or new runtime, platform or mobile evidence is claimed.", "The duplicate paired CLI graph-sync journey with an earlier unrelated host-created terminal was retired. The first-host-created-terminal journey retains the same original-PTY reply, host/client inventory and unrelated live canary oracles; target-after-unrelated ordering is no longer separately asserted. A single sync does not prove persisted restart durability. Historical evidence runs/results/counts remain unchanged.", "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", - "Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []" + "Audit1392: src/main/agent-hooks/server-pane-authority.test.ts reduced. Retires one duplicate-transfer no-op listener count and latest pty/timestamp callback fixture. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"workspace-wide close force-retires pinned and unpinned tabs, clears resume/incarnation state, awaits both target PTYs, preserves the sibling worktree, and reports an unconfirmed stop as unverifiable\"]}]" ], "demotionRule": "Keep experimental or demote to protection none if exact PTY disappearance flakes, a sibling/detached pane is retired, late hooks can recreate closed authority, or a renderer graph sync retires a host-created tab that no explicit close retired." }, @@ -8837,7 +8779,7 @@ "providers": ["daemon", "runtime", "ssh", "wsl"], "coveredPlatforms": ["linux", "macos", "windows"], "coveredProviders": ["daemon", "runtime"], - "coverageNotes": "The browser auth capability-advertisement case is removed in this audit; its direct encrypted-auth literal alarm is lost. Retained lifecycle evidence is not an equivalent replacement. Historical run commands and results remain historical. Recorded native Windows evidence covers the v21/v22/v23/v24/v25 named-pipe matrix. The deterministic daemon harness covers capable and legacy paired-runtime request shapes against live v25/v26 PTYs in separate worktrees, plus an unrelated control. Host/renderer tests cover old servers, missing liveness, stale publications, reused claims, split parents, explicit user intent, cross-profile isolation, remote runtime clients, SSH-provider routing, and WSL boundaries. A headed host paired to a separate live client, headless serve parity, Linux, SSH, and WSL remain explicit gaps. The audit removed private-router tests of mocked kill results and log fields. Their isolated success/failure attribution and pending-spawn tolerance alarms are no longer registered here; live lifecycle evidence does not establish equivalent log coverage. The isolated close-intent suite was removed. web-runtime-session.test.ts no longer supplies the lifecycle-close or old-server method-not-found assertions formerly referenced here. Their direct partition and RPC-shape alarms are lost; retained live daemon evidence does not establish equivalent coverage. The broad mirror fixture retains user-close suppression, refused-close reconciliation and optimistic reorder only. Its earlier reconnect/incarnation and projection examples no longer establish current daemon-generation coverage. Those narrow alarms are lost; other daemon evidence is not equivalent replacement coverage. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "The browser auth capability-advertisement case is removed in this audit; its direct encrypted-auth literal alarm is lost. Retained lifecycle evidence is not an equivalent replacement. Historical run commands and results remain historical. Recorded native Windows evidence covers the v21/v22/v23/v24/v25 named-pipe matrix. The deterministic daemon harness covers capable and legacy paired-runtime request shapes against live v25/v26 PTYs in separate worktrees, plus an unrelated control. Host/renderer tests cover old servers, missing liveness, stale publications, reused claims, split parents, explicit user intent, cross-profile isolation, remote runtime clients, SSH-provider routing, and WSL boundaries. A headed host paired to a separate live client, headless serve parity, Linux, SSH, and WSL remain explicit gaps. The audit removed private-router tests of mocked kill results and log fields. Their isolated success/failure attribution and pending-spawn tolerance alarms are no longer registered here; live lifecycle evidence does not establish equivalent log coverage. The isolated close-intent suite was removed. web-runtime-session.test.ts no longer supplies the lifecycle-close or old-server method-not-found assertions formerly referenced here. Their direct partition and RPC-shape alarms are lost; retained live daemon evidence does not establish equivalent coverage. The broad mirror fixture retains user-close suppression, refused-close reconciliation and optimistic reorder only. Its earlier reconnect/incarnation and projection examples no longer establish current daemon-generation coverage. Those narrow alarms are lost; other daemon evidence is not equivalent replacement coverage. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/9749", "https://github.com/stablyai/orca/issues/9949", @@ -8846,7 +8788,7 @@ "https://github.com/stablyai/orca/issues/9229" ], "invariant": "Reconnect, replay, or lifecycle observations from a viewer that negotiated explicit close intent must never kill a live PTY. A capable reasonless close must keep and republish; a legacy paired viewer must retain current-main behavior because its intentional close and cleanup echo are wire-identical. Lifecycle close requires the exact observed publication, terminal, environment, and authoritative liveness, never signals a process, and leaves renderer-owned or partial-split retirement to its owner. Legacy daemon hello and warm reattachment remain non-destructive.", - "oracle": "Start isolated v25 and v26 daemon generations with one capable-viewer PTY and one legacy-viewer PTY per generation in four target worktrees plus an unaddressed control PTY in a fifth worktree. Route them through the production desktop scanner, runtime, RPC dispatcher, renderer-close relay, and daemon router. First issue sequential reasonless closes from an authenticated capable connection and require refusal, snapshot republish, zero shutdown calls, exact process survival, and post-close I/O. Then issue the byte-identical requests without the negotiated capability and require current-main behavior: two ordered immediate shutdowns, session-killed events, and exact root/descendant death, while capable and control PTYs survive. An observer lists all targets before, between, and after while issuing zero closes. Unit contracts also require in-process reasonless refusal, legacy runtime/mobile compatibility, explicit user closes, encrypted client-auth advertisement, and old-server lifecycle calls never to fall back.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Start isolated v25 and v26 daemon generations with one capable-viewer PTY and one legacy-viewer PTY per generation in four target worktrees plus an unaddressed control PTY in a fifth worktree. Route them through the production desktop scanner, runtime, RPC dispatcher, renderer-close relay, and daemon router. First issue sequential reasonless closes from an authenticated capable connection and require refusal, snapshot republish, zero shutdown calls, exact process survival, and post-close I/O. Then issue the byte-identical requests without the negotiated capability and require current-main behavior: two ordered immediate shutdowns, session-killed events, and exact root/descendant death, while capable and control PTYs survive. An observer lists all targets before, between, and after while issuing zero closes. Unit contracts also require in-process reasonless refusal, legacy runtime/mobile compatibility, explicit user closes, encrypted client-auth advertisement, and old-server lifecycle calls never to fall back.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/remote-runtime-request-connection.integration.test.ts src/main/runtime/rpc/runtime-close-attribution-topology.test.ts src/main/runtime/rpc/methods/session-tabs.test.ts src/main/runtime/rpc/e2ee-channel.test.ts src/main/runtime/rpc/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile-socket-wiring.test.ts src/main/runtime/rpc/runtime-client-capabilities.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/shared/remote-runtime/requests/remote-runtime-request-connection.test.ts src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts", "pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1", @@ -8938,13 +8880,6 @@ "the cached paired-desktop request connection advertises close-intent support in encrypted authentication while reusing one socket" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "live, unknown, stale, missing-intent, non-owner, and inventory-proven but not yet pane-bound lifecycle closes invoke neither PTY kill nor renderer close", - "dead whole-headless retirement removes stale state without signalling a retained PTY id" - ] - }, { "file": "src/main/runtime/rpc/methods/session-tabs.test.ts", "assertions": [ @@ -9011,7 +8946,8 @@ "The isolated close-intent suite was removed. web-runtime-session.test.ts no longer supplies the lifecycle-close or old-server method-not-found assertions formerly referenced here. Their direct partition and RPC-shape alarms are lost; retained live daemon evidence does not establish equivalent coverage.", "The broad mirror fixture retains user-close suppression, refused-close reconciliation and optimistic reorder only. Its earlier reconnect/incarnation and projection examples no longer establish current daemon-generation coverage. Those narrow alarms are lost; other daemon evidence is not equivalent replacement coverage.", "Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim.", - "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed." + "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"live, unknown, stale, missing-intent, non-owner, and inventory-proven but not yet pane-bound lifecycle closes invoke neither PTY kill nor renderer close\",\"dead whole-headless retirement removes stale state without signalling a retained PTY id\"]}]" ], "demotionRule": "Keep experimental or quarantine if reconnect emits session-killed for a live canary, an exact root/descendant dies, an old server receives fallback destructive close, cleanup leaks a fixture process/pipe, or the gate flakes without a proven harness defect." }, @@ -9596,7 +9532,7 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "remote-runtime"], - "coverageNotes": "Renderer ownership/dedupe contracts cover provider-session claims. Local and daemon attach-only contracts prove an existing stable-pane owner is adopted without provider creation, while remote-runtime transport contracts preserve adopted ownership through cancellation. The Electron oracle covers a local macOS runtime and daemon with real agent, Setup, and unrelated-canary processes; SSH, WSL, paired-server, Linux, and Windows remain contract-only or unrun. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", + "coverageNotes": "Renderer ownership/dedupe contracts cover provider-session claims. Local and daemon attach-only contracts prove an existing stable-pane owner is adopted without provider creation, while remote-runtime transport contracts preserve adopted ownership through cancellation. The Electron oracle covers a local macOS runtime and daemon with real agent, Setup, and unrelated-canary processes; SSH, WSL, paired-server, Linux, and Windows remain contract-only or unrun. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/pull/6800", "https://github.com/stablyai/orca/pull/5240", @@ -9606,7 +9542,7 @@ "https://github.com/stablyai/orca/pull/11819" ], "invariant": "Workspace activation, launch, restore, sleep, hibernate, dedupe, clearing, mount, remount, and reconnect code must not replay or resume a provider session id already owned, queued, pending, live, or durably bound to a host PTY in that workspace. A renderer with missing projection state must adopt the exact runtime-owned PTY for the original tab and leaf rather than create a replacement.", - "oracle": "Renderer-state tests assert provider-session ownership across preserved and queued panes. Main/provider contracts assert atomic attach-only adoption, stable host/worktree/tab/leaf identity, no fresh spawn on adoption, and safe paired-runtime cancellation. The Electron oracle creates inactive runtime-owned Codex and Setup PTYs plus an unrelated canary, seeds an exact resumable provider session, removes only the target renderer projections, and activates the workspace. It requires byte-stable handle, PTY, incarnation, tab, leaf, process PID, renderer graph, persisted binding, runtime id, graph epoch, and daemon PID across first mount and reload; PID-specific DOM keyboard I/O must remain live with one launch, zero resume argv, zero signals, zero interruption text, and no canary mutation.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Renderer-state tests assert provider-session ownership across preserved and queued panes. Main/provider contracts assert atomic attach-only adoption, stable host/worktree/tab/leaf identity, no fresh spawn on adoption, and safe paired-runtime cancellation. The Electron oracle creates inactive runtime-owned Codex and Setup PTYs plus an unrelated canary, seeds an exact resumable provider session, removes only the target renderer projections, and activates the workspace. It requires byte-stable handle, PTY, incarnation, tab, leaf, process PID, renderer graph, persisted binding, runtime id, graph epoch, and daemon PID across first mount and reload; PID-specific DOM keyboard I/O must remain live with one launch, zero resume argv, zero signals, zero interruption text, and no canary mutation.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts", "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose", @@ -9750,7 +9686,8 @@ "The live Electron topology is local macOS only; folder workspaces, SSH, WSL, paired headed/headless servers, Linux, and Windows are not exercised by that journey.", "The oracle covers first activation and one renderer reload, not repeated soak activation or an installed-app update.", "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", - "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." + "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []" ], "demotionRule": "Demote or quarantine if failures are non-actionable or if a duplicate resume escape occurs outside the modeled matrix." }, @@ -9776,7 +9713,7 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh", "wsl", "remote-runtime"], - "coverageNotes": "Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audits1301 and1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic macOS tests cover controller claims, daemon and SSH/relay operation replay, mixed-version selection, runtime ownership, exact provisional handoff, durable terminal retirement, two independent viewer mirrors, guarded adoption of legacy live PTYs, and completion classification when either the outer remote transport or authoritative host/provider process inspection becomes unreachable. The adoption harness models v1.4.150 agent/setup/shell tabs, current-generation restart and reconnect, exact handle/incarnation/worktree/host checks, topology CAS, competing clients, split-pane/group restoration, WSL ownership, and SSH owner rejection. The secondary parity repro runs independent clients against one headless remote Orca runtime over encrypted pairing and a real daemon-backed PTY, with tokened fixture-process identity separated from unrelated Codex app-server startup probes. The automated primary topology runs an isolated headed macOS Orca desktop server plus a separate paired web client and proves viewer-local fresh/resume focus, exact legacy placement, writable PTYs, unrelated-terminal survival, and host/client cleanup. SSH coverage is provider/relay contract and fault-injection coverage only; it does not substitute for paired-server coverage. Live Windows, Linux, WSL, SSH, and physical paired-Linux hosts remain gaps. The isolated intent-owner ledger suite was removed. web-runtime-session.test.ts retains exact post-create handoff confirmation only; its previous fresh/resume presentation and publication-replay assertions are no longer current references. Those direct owner-partition, cap and RPC/focus alarms are lost; other agent-session evidence does not establish equivalence. Structured handoff and adopted-leaf focus references now point to their dedicated surviving fixtures. Mixed-version recovery retains actual old-host recovery followed by a new CLI tab; its unsupported/missing-evidence tables are removed. Orphan recovery retains in-flight adoption-conflict serialization only; previous topology/pruning and absence/adoption examples are removed. These removed projection, capability and adoption-shape alarms are lost; retained cases do not replace them. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1308: src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts removed. Exact provisional replacement and post-create exit confirmation handoff pipeline alarms disappear. No equivalent replacement coverage is claimed. Audit1313: src/main/runtime/terminal-orphan-topology.test.ts: Retain actual topology merge algorithms preserving disjoint subtrees and grafted/ambiguous shared anchors with independent expected trees. Remove duplicate leaf validator and empty/no-change passthrough examples. Lose basic validation and no-group/noop characterization; no renderer layout proof. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Audit1342 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audits1301 and1308 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic macOS tests cover controller claims, daemon and SSH/relay operation replay, mixed-version selection, runtime ownership, exact provisional handoff, durable terminal retirement, two independent viewer mirrors, guarded adoption of legacy live PTYs, and completion classification when either the outer remote transport or authoritative host/provider process inspection becomes unreachable. The adoption harness models v1.4.150 agent/setup/shell tabs, current-generation restart and reconnect, exact handle/incarnation/worktree/host checks, topology CAS, competing clients, split-pane/group restoration, WSL ownership, and SSH owner rejection. The secondary parity repro runs independent clients against one headless remote Orca runtime over encrypted pairing and a real daemon-backed PTY, with tokened fixture-process identity separated from unrelated Codex app-server startup probes. The automated primary topology runs an isolated headed macOS Orca desktop server plus a separate paired web client and proves viewer-local fresh/resume focus, exact legacy placement, writable PTYs, unrelated-terminal survival, and host/client cleanup. SSH coverage is provider/relay contract and fault-injection coverage only; it does not substitute for paired-server coverage. Live Windows, Linux, WSL, SSH, and physical paired-Linux hosts remain gaps. The isolated intent-owner ledger suite was removed. web-runtime-session.test.ts retains exact post-create handoff confirmation only; its previous fresh/resume presentation and publication-replay assertions are no longer current references. Those direct owner-partition, cap and RPC/focus alarms are lost; other agent-session evidence does not establish equivalence. Structured handoff and adopted-leaf focus references now point to their dedicated surviving fixtures. Mixed-version recovery retains actual old-host recovery followed by a new CLI tab; its unsupported/missing-evidence tables are removed. Orphan recovery retains in-flight adoption-conflict serialization only; previous topology/pruning and absence/adoption examples are removed. These removed projection, capability and adoption-shape alarms are lost; retained cases do not replace them. Audit1301: src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts reduced. Direct dedupe eviction/count and equal receipt-position sample loses authored alarm. No equivalent replacement coverage is claimed. Audit1308: src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts removed. Exact provisional replacement and post-create exit confirmation handoff pipeline alarms disappear. No equivalent replacement coverage is claimed. Audit1313: src/main/runtime/terminal-orphan-topology.test.ts: Retain actual topology merge algorithms preserving disjoint subtrees and grafted/ambiguous shared anchors with independent expected trees. Remove duplicate leaf validator and empty/no-change passthrough examples. Lose basic validation and no-group/noop characterization; no renderer layout proof. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1342: src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/8878", "https://github.com/stablyai/orca/issues/9151", @@ -9786,7 +9723,7 @@ "https://github.com/stablyai/orca/pull/10193" ], "invariant": "For every claim-capable execution route, one provider-session identity has at most one live PTY owner and one canonical host surface across concurrent clients, retries, reconnects, and stale publications. For paired structured fresh and resume requests, the authenticated owning runtime creates in background without a renderer window; activate=true focuses the exact requested leaf only on the requesting viewer, while activate=false changes no viewer focus. A live orphan may be adopted only when the controller proves its exact handle and incarnation, its worktree and host owner match, no competing visual owner exists, and a host topology CAS wins. A viewer may classify completion only from successful host/provider inspection or explicit lifecycle evidence; transport, handle, or provider unavailability remains unknown and breaks any consecutive-idle proof. A physical exit retires that exact incarnation durably so stale client state and host restart cannot recreate it. Mixed-version routes select the unchanged legacy request before any authority side effect or execution-owner-local filesystem access.", - "oracle": "The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Race independent clients and repeated operation IDs, then assert one physical spawn and one canonical PTY/surface; inject exit-before-reply, provider disconnect, conflicting claim scope, old daemon/relay capabilities, reused handles, stale incarnations, owner mismatch, and topology revision conflict; assert safe adoption or explicit failure without a second spawn or wrong-process attachment. Run fresh/resume with activate true/false against an isolated headed desktop host and a separate paired client, then against isolated headless serve: assert host presentation stays background, only the requesting viewer focuses the exact leaf, inactive calls preserve client/DOM focus, a same-version publication replay cannot lose focus intent, and sibling-first split publication cannot consume exact-leaf intent. Restore legacy split panes and groups beside a newer host-owned tab, preserving exact predecessor/new/successor order, output, input, resize, titles, tab/leaf identity, active group, and multi-client convergence. For completion, drive a known running agent through outer transport loss, authoritative provider rejection, reconnect, explicit stop, real exit status, and successful hook completion; assert unavailable evidence never dispatches completion and two fresh authoritative idle samples are required after the gap. After exact exit, assert terminal and tab listings omit the surface, a stale publication cannot restore it, restart cannot resurrect it, exact tokened fixture PIDs are dead, and unrelated tabs/processes survive until scoped cleanup.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Race independent clients and repeated operation IDs, then assert one physical spawn and one canonical PTY/surface; inject exit-before-reply, provider disconnect, conflicting claim scope, old daemon/relay capabilities, reused handles, stale incarnations, owner mismatch, and topology revision conflict; assert safe adoption or explicit failure without a second spawn or wrong-process attachment. Run fresh/resume with activate true/false against an isolated headed desktop host and a separate paired client, then against isolated headless serve: assert host presentation stays background, only the requesting viewer focuses the exact leaf, inactive calls preserve client/DOM focus, a same-version publication replay cannot lose focus intent, and sibling-first split publication cannot consume exact-leaf intent. Restore legacy split panes and groups beside a newer host-owned tab, preserving exact predecessor/new/successor order, output, input, resize, titles, tab/leaf identity, active group, and multi-client convergence. For completion, drive a known running agent through outer transport loss, authoritative provider rejection, reconnect, explicit stop, real exit status, and successful hook completion; assert unavailable evidence never dispatches completion and two fresh authoritative idle samples are required after the gap. After exact exit, assert terminal and tab listings omit the surface, a stale publication cannot restore it, restart cannot resurrect it, exact tokened fixture PIDs are dead, and unrelated tabs/processes survive until scoped cleanup.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/runtime/orca-runtime-agent-session-operation.test.ts src/main/runtime/remote-agent-session-host-authority.integration.test.ts src/main/runtime/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-runtime-session.test.ts", @@ -9835,16 +9772,6 @@ "src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts" ], "assertionRefs": [ - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "v1.4.150-shaped agent, setup, and shell PTYs adopt as one CAS transaction while stale incarnation and competing clients fail safely", - "current-generation restart and disconnect/reconnect preserve output, input, resize, title, tab, leaf, handle, and incarnation identity", - "split-pane and multi-group legacy topology merges beside a newer host-owned terminal without replacing it", - "equivalent Windows and separator-normalized persisted worktree keys canonicalize without duplicate terminal topology", - "connection mismatch, reused handles, SSH ownership mismatch, and stale topology revisions cannot claim a live PTY while WSL ownership succeeds" - ] - }, { "file": "src/main/providers/pty-process-inspection.test.ts", "assertions": [ @@ -9944,16 +9871,6 @@ "same-epoch stale publications cannot resurrect the retired surface after reconnect" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "v1.4.150-shaped agent, setup, and shell PTYs adopt as one CAS transaction while stale incarnation and competing clients fail safely", - "current-generation restart and disconnect/reconnect preserve output, input, resize, title, tab, leaf, handle, and incarnation identity", - "split-pane and multi-group legacy topology merges beside a newer host-owned terminal without replacing it", - "equivalent Windows and separator-normalized persisted worktree keys canonicalize without duplicate terminal topology", - "connection mismatch, reused handles, SSH ownership mismatch, and stale topology revisions cannot claim a live PTY while WSL ownership succeeds" - ] - }, { "file": "src/renderer/src/runtime/web-runtime-session.test.ts", "assertions": ["confirms only the exact handoff after its post-create list completes"] @@ -10099,7 +10016,8 @@ "Audit1342 retires this complete dated receipt because a source in its selector was deleted or reduced. It does not validate the reduced selector. Original receipt verbatim:\n{\n \"date\": \"2026-07-23\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts src/renderer/src/lib/codex-session-restart.test.ts\",\n \"result\": \"passed\",\n \"durationSeconds\": 11.96,\n \"summary\": \"Eleven focused files and 870 tests passed on the current-main candidate. The cross-boundary harness fails with the implementation reverted by dispatching process-exit from unavailable remote evidence. Direct SSH uses strict main-process inspection, daemon and relay inspection reject missing or unmapped sessions, the terminal lifecycle suite uses the atomic inspection boundary, and one stale pane cannot suppress restart notices for a separately confirmed Codex pane.\",\n \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts src/renderer/src/lib/codex-session-restart.test.ts\"\n }", "Audit1342 historical platform/provider scope before source changes: {\"coveredPlatforms\":[\"macos\"],\"coveredProviders\":[\"local\",\"daemon\",\"ssh\",\"wsl\",\"remote-runtime\"]}. Remaining provider scope applies only to unchanged-source receipts.", "Audit1342 historical assertion inventory for deleted/reduced sources; not current validated assertions:\n[\n {\n \"file\": \"src/renderer/src/components/terminal-pane/pty-connection-completion-and-notification.test.ts\",\n \"assertions\": [\n \"completion polling uses the atomic process-inspection boundary without regressing established lifecycle behavior\"\n ]\n }\n]", - "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed." + "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"v1.4.150-shaped agent, setup, and shell PTYs adopt as one CAS transaction while stale incarnation and competing clients fail safely\",\"current-generation restart and disconnect/reconnect preserve output, input, resize, title, tab, leaf, handle, and incarnation identity\",\"split-pane and multi-group legacy topology merges beside a newer host-owned terminal without replacing it\",\"equivalent Windows and separator-normalized persisted worktree keys canonicalize without duplicate terminal topology\",\"connection mismatch, reused handles, SSH ownership mismatch, and stale topology revisions cannot claim a live PTY while WSL ownership succeeds\"]},{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"v1.4.150-shaped agent, setup, and shell PTYs adopt as one CAS transaction while stale incarnation and competing clients fail safely\",\"current-generation restart and disconnect/reconnect preserve output, input, resize, title, tab, leaf, handle, and incarnation identity\",\"split-pane and multi-group legacy topology merges beside a newer host-owned terminal without replacing it\",\"equivalent Windows and separator-normalized persisted worktree keys canonicalize without duplicate terminal topology\",\"connection mismatch, reused handles, SSH ownership mismatch, and stale topology revisions cannot claim a live PTY while WSL ownership succeeds\"]}]" ], "demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if a retry can physically spawn twice, if a stale exit/publication can replace or resurrect a terminal, or if mixed-version fallback occurs after an authority side effect." }, @@ -11196,13 +11114,13 @@ "providers": ["paired-runtime", "ssh"], "coveredPlatforms": ["macos", "linux"], "coveredProviders": ["paired-runtime"], - "coverageNotes": "This audit removes the browser response-after-manual-disconnect example. Its distinct in-flight response fencing alarm is lost; retained queued-call disconnect tests are not an equivalent replacement. Historical commands and results remain historical. Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, then drive 180 timed real-PTY spinner frames through a second production `session.tabs.subscribeAll` transport and the real Zustand store. Each worktree must publish and apply only its exact initial-working and final-idle titles. Both topologies ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. Production-parity React contracts reproduce and remove the independent cold-park watcher/title feedback loop, including memo-cache discard, StrictMode cleanup replay, detached split-PTY replacement, and the zero-park fast path. A deterministic cross-boundary contract drives 24 real PTY trackers in distinct worktrees through 2,880 decorative spinner and bare-native redraw chunks and counts host publications, serialized bytes, renderer apply calls, and store mutations while preserving exact per-PTY raw chunks and per-worktree semantic transitions. Fake-clock continuation beyond the 30-minute stale boundary requires one deduplicated refresh per worktree every 15 minutes, globally spaced by at least 50 ms, with every mirrored working status still fresh. Exact-identical Pi plus rotating normalized Pi/Grok frames renew coarse working/permission state; rich prompt/tool/question fields retain their original 30-minute lease, and `stateStartedAt`/acknowledgement identity remain stable across title/hook source swaps. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps. The audit removed the E2E parking override/debug-handle suite. Override exposure guards, delay/retention independence, TTL filtering and debug-handle forwarding alarms are lost. Retained real parking journeys do not establish equivalent test-harness configuration coverage. The test-value audit removes separate responsive-stream, intervening-control-frame and capacity-error classification examples. Retained multiplexer checks use fake clocks and captured transport callbacks; their per-stream isolation, deadline and probe-baseline assertions do not prove an actual host restart or equivalent replacement coverage. Historical run commands and results remain historical. The test-value audit removes the standalone retained/live metadata projection and additive-preference negative example from runtime-client-events.test.ts. Its remaining case checks partial-authority event admission through a captured callback; it does not establish full-pair projection, actual peer delivery or equivalent replacement coverage. Historical commands and results remain historical. The isolated accepted-handle-events observer suite is removed. Its runtime/worktree/pane membership, once-only delivery and listener-release ledger alarms are lost. Live hidden-retention evidence does not establish equivalent observer coverage. Audit1292: The entire host-session mirror empty-inventory settle suite is removed. Live-unpublished versus genuinely-empty hydration, same-ID revision response/in-flight fencing and cleared-tracking pending-probe invalidation alarms are lost. The singleton store and inventories were mocked; no real host census or resume delivery or equivalent replacement coverage is claimed. Audit1302: src/main/runtime/session-tabs-inventory-publication.test.ts: Keep actual runtime public inventory authority across renderer epochs/resync, fallback, aborts and invalid graph publishers. Remove copied nonempty publication, private scan counters/collector and known-host replacement, fake refresh that performs the restoration itself, environment capability flag, and private resume-store characterization whose fixture supplies reservation/rollback ordering. Lose isolated refresh/churn/receiver/capability and copied-payload wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1346 removes the entire private-state-injected session-tabs rich-status boundary suite. Its stale task/question, neutral-title preservation, owner-change and provider-generation alarms are intentionally lost. Retained real terminal journeys do not establish equivalent replacement coverage. The prior mixed 42-contract execution receipt is historical and must not validate the reduced current selector; fresh validation remains required. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "This audit removes the browser response-after-manual-disconnect example. Its distinct in-flight response fencing alarm is lost; retained queued-call disconnect tests are not an equivalent replacement. Historical commands and results remain historical. Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, then drive 180 timed real-PTY spinner frames through a second production `session.tabs.subscribeAll` transport and the real Zustand store. Each worktree must publish and apply only its exact initial-working and final-idle titles. Both topologies ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. Production-parity React contracts reproduce and remove the independent cold-park watcher/title feedback loop, including memo-cache discard, StrictMode cleanup replay, detached split-PTY replacement, and the zero-park fast path. A deterministic cross-boundary contract drives 24 real PTY trackers in distinct worktrees through 2,880 decorative spinner and bare-native redraw chunks and counts host publications, serialized bytes, renderer apply calls, and store mutations while preserving exact per-PTY raw chunks and per-worktree semantic transitions. Fake-clock continuation beyond the 30-minute stale boundary requires one deduplicated refresh per worktree every 15 minutes, globally spaced by at least 50 ms, with every mirrored working status still fresh. Exact-identical Pi plus rotating normalized Pi/Grok frames renew coarse working/permission state; rich prompt/tool/question fields retain their original 30-minute lease, and `stateStartedAt`/acknowledgement identity remain stable across title/hook source swaps. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps. The audit removed the E2E parking override/debug-handle suite. Override exposure guards, delay/retention independence, TTL filtering and debug-handle forwarding alarms are lost. Retained real parking journeys do not establish equivalent test-harness configuration coverage. The test-value audit removes separate responsive-stream, intervening-control-frame and capacity-error classification examples. Retained multiplexer checks use fake clocks and captured transport callbacks; their per-stream isolation, deadline and probe-baseline assertions do not prove an actual host restart or equivalent replacement coverage. Historical run commands and results remain historical. The test-value audit removes the standalone retained/live metadata projection and additive-preference negative example from runtime-client-events.test.ts. Its remaining case checks partial-authority event admission through a captured callback; it does not establish full-pair projection, actual peer delivery or equivalent replacement coverage. Historical commands and results remain historical. The isolated accepted-handle-events observer suite is removed. Its runtime/worktree/pane membership, once-only delivery and listener-release ledger alarms are lost. Live hidden-retention evidence does not establish equivalent observer coverage. Audit1292: The entire host-session mirror empty-inventory settle suite is removed. Live-unpublished versus genuinely-empty hydration, same-ID revision response/in-flight fencing and cleared-tracking pending-probe invalidation alarms are lost. The singleton store and inventories were mocked; no real host census or resume delivery or equivalent replacement coverage is claimed. Audit1302: src/main/runtime/session-tabs-inventory-publication.test.ts: Keep actual runtime public inventory authority across renderer epochs/resync, fallback, aborts and invalid graph publishers. Remove copied nonempty publication, private scan counters/collector and known-host replacement, fake refresh that performs the restoration itself, environment capability flag, and private resume-store characterization whose fixture supplies reservation/rollback ordering. Lose isolated refresh/churn/receiver/capability and copied-payload wiring alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1318: src/shared/remote-runtime/control/remote-runtime-shared-control-connection.test.ts: Retain real local encrypted WebSocket regressions for pre-ready socket replacement preserving a request, close-before-ready logical subscription cleanup, unrelated RPC surviving another deadline, and pending setup abort leaving a sibling pending. Host server is synthetic and uses production crypto; kept scenarios also retain internal diagnostics/memory assertions unchanged. Remove happy routing, authority-envelope, unknown-ID/log, cleanup enum, binary, keepalive/liveness and production-budget/private socket inventories; intentionally lose those alarms, no physical host authorization, independent crypto or remote provider claim. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1346 removes the entire private-state-injected session-tabs rich-status boundary suite. Its stale task/question, neutral-title preservation, owner-change and provider-generation alarms are intentionally lost. Retained real terminal journeys do not establish equivalent replacement coverage. The prior mixed 42-contract execution receipt is historical and must not validate the reduced current selector; fresh validation remains required. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/8652", "https://github.com/stablyai/orca/pull/10625" ], "invariant": "A host advertising terminal.paired-parking.v1 keeps the PTY and bounded authoritative history alive while an ordinary hidden-view park destroys the client xterm and releases its raw per-PTY stream. Reveal must restore up to the requested 5,000 rows, parked-time side effects/output, the same PTY identity, and continued input/output. Parked watcher synchronization compares parking semantics rather than fresh object identity, owns setup and cleanup across StrictMode replay, reconciles real PTY/layout changes, and performs no terminal-state scan when nothing is parked. After a host main-process relaunch, unknown local delivery-sync state must not be treated as proof that a surviving daemon PTY is already foregrounded. An empty headed session-tab inventory is authoritative only after the current renderer graph generation publishes a complete inventory and every execution host answers the PTY census; unpublished, resync-pending, transport-failed, and partially scoped inventories remain unverifiable, while genuinely authoritative empty and non-empty inventories settle and a scope-less legacy empty keeps its pre-authority best-effort settle so outdated hosts retain agent auto-resume. The unpublished-empty regression must keep the resume dispatch parked with exactly one daemon process/writer; restoring unconditional empty hydration must release one dispatch and create two live writers. If subscription precedes provider readiness, authoritative inventory must reconsider that existing subscriber without spawning, resizing, or changing reconnect state. A snapshot without an output high-water must keep it unknown rather than borrowing a layout version that can suppress newer live output. Hosts without the capability must gate hidden raw output before xterm scheduling and repaint from the authoritative snapshot on reveal while retaining the existing limit/TTL force-parking fallback. After the first semantic title state, decorative spinner frequency must add zero paired client-event frames and zero full session-tabs work between status-freshness leases regardless of hidden worktree count. Continuous working or permission evidence may refresh each affected worktree once per 15 minutes through one globally spaced FIFO so current and legacy viewers do not decay before 30 minutes; sibling PTYs share that worktree refresh, while local title animation, raw output, and semantic title, status, bell, completion, and query facts remain intact. A paired terminal stream whose delivery credits stop progressing must replace only that stream; command silence first probes authoritative state and replaces the stream if the probe times out or proves the PTY advanced beyond the client's delivered output sequence. When no comparable delivery high-water exists, the first sequenced probe establishes a baseline and only later advancement proves staleness. A same-sequence snapshot remains valid proof of a responsive silent command. A successful status probe may replace a pre-ready shared-control socket without rejecting or duplicating calls already waiting for that transport. Manual disconnect must retain pairing while preventing queued or passive calls and subscriptions from recreating transport until explicit Connect. A paired pane reconnecting to a relaunched host that has not yet published its window graph (an unpublished frame, bare or client-projected) must stay in recovery rather than retire, and the host's first published snapshot carrying the surface must reattach it; a published frame lacking the surface still retires it. The placeholder is only ever sent before the host's graph first publishes; afterwards a worktree with no tabs gets a real empty answer, pushed once to any client that asked during startup, so a paired client opening a never-opened host worktree still gets its first terminal.", - "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, hide all six warm managers, emit an initial working title followed by 30 timed real-PTY spinner frames and a final idle title per worktree, and observe a second real session-tabs subscription plus the production renderer store. Require exactly two transport envelopes and two title mutations per worktree, no decorative title crossing either boundary, and positive decoded-envelope bytes. Enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 24 real PTY title trackers in distinct worktrees through 40 decorative spinner frames each, then 40 spinner frames alternating with Cursor's bare native identity redraw, using fake clocks. Require all 2,880 raw chunks exactly and zero host session-tabs publications, serialized bytes, renderer apply calls, and renderer store mutations. Continue decorative evidence beyond 30 minutes, require exactly one refresh per worktree per 15-minute lease through a FIFO spaced by at least 50 ms, and require all 24 viewer statuses to remain working and fresh; then require one exact semantic idle transition and one visible-output chunk per PTY. Require ordinary and interior-Braille title changes to publish. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, hide all six warm managers, emit an initial working title followed by 30 timed real-PTY spinner frames and a final idle title per worktree, and observe a second real session-tabs subscription plus the production renderer store. Require exactly two transport envelopes and two title mutations per worktree, no decorative title crossing either boundary, and positive decoded-envelope bytes. Enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 24 real PTY title trackers in distinct worktrees through 40 decorative spinner frames each, then 40 spinner frames alternating with Cursor's bare native identity redraw, using fake clocks. Require all 2,880 raw chunks exactly and zero host session-tabs publications, serialized bytes, renderer apply calls, and renderer store mutations. Continue decorative evidence beyond 30 minutes, require exactly one refresh per worktree per 15-minute lease through a FIFO spaced by at least 50 ms, and require all 24 viewer statuses to remain working and fresh; then require one exact semantic idle transition and one visible-output chunk per PTY. Require ordinary and interior-Braille title changes to publish. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-unpublished-host-graph.test.ts", "ORCA_BACKGROUND_LAUNCH=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-quit-reconnect-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1", @@ -11434,16 +11352,6 @@ "force-parks the least-recently-hidden candidates beyond the retention limit" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "forwards facts over the shared client-event stream without a desktop renderer", - "bounds decorative title delivery per paired client without reducing local frames", - "prefers provider history over a partial headless mirror for requested snapshots", - "falls back to the available mirror when authoritative provider history is unavailable", - "bounds a hung authoritative provider acquisition and reuses its fallback" - ] - }, { "file": "src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts", "assertions": [ @@ -11768,7 +11676,8 @@ "Retired during audit1355 application of audit1346 at b176; complete original execution receipt unchanged, historical only:\n{\n \"date\": \"2026-08-10\",\n \"runner\": \"local\",\n \"platform\": \"macos\",\n \"command\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts --maxWorkers=1\",\n \"result\": \"passed\",\n \"durationSeconds\": 5.62,\n \"summary\": \"Forty-two deterministic contracts passed. The real-PTY cross-boundary contract delivered all 2,880 decorative spinner and bare-native redraw chunks with zero hot-path host publications, serialized bytes, renderer applies, or store mutations; continued past 30 minutes with one globally spaced freshness refresh per worktree every 15 minutes; kept all 24 mirrored statuses working; and preserved stable stateStartedAt. Exact-identical Pi and rotating normalized Pi/Grok frames renewed renderer-authored and retained-hook status without changing acknowledgement semantics. Rich status could not cross task completion, permission, provider-generation, or identity-owner boundaries, while neutral titles preserved same-task prompt and acknowledgement identity until authoritative shell evidence. Fresh renderer, retained OSC, and live-hook questions remained visible under the current shell title, but a later working interval, identity-only owner title, or provider generation stripped them; inherited tools and stale, resume-only, restored, or prior-interval questions stayed suppressed. After each rich source's original lease expired, title evidence kept only coarse working state and provider identity fresh while dropping unverifiable prompts. Unknown foreground ownership held publications at zero until resolution, then resumed the bounded heartbeat; tracked terminal state reset removed its delayed marker. The focused heartbeat contracts proved worktree deduplication, FIFO fairness, semantic bypass, PTY-source teardown, and timer cleanup. Causal-disable controls made ownership, teardown, retained source-switch, renderer rich-TTL, completion-transition, boundary-ordering, and live-question oracles fail; restoring the production corrections returned green.\",\n \"currentCommand\": \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts --maxWorkers=1\"\n }", "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", "Audit1391: src/renderer/src/components/terminal-pane/pty-connection-remote-pause-drop-notice.spec.ts reduced. Lose repeated quiet switches avoiding snapshots and legacy host without drop-report capability requesting a snapshot. Retained imported registrar uses fake transport/xterm writes, exercising real gap/restore lifecycle rather than actual terminal rendering. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", - "Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []" + "Audit1396: src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts reduced. Retire standalone reconcile set output and positive untouchedFreshSpawn/workspaceOwner copying alarms; no native watcher execution claim. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"forwards facts over the shared client-event stream without a desktop renderer\",\"bounds decorative title delivery per paired client without reducing local frames\",\"prefers provider history over a partial headless mirror for requested snapshots\",\"falls back to the available mirror when authoritative provider history is unavailable\",\"bounds a hung authoritative provider acquisition and reuses its fallback\"]}]" ], "demotionRule": "Keep experimental or demote to protection none if decorative title frequency changes paired client-event or session-tabs publication volume after convergence, a semantic fact is dropped, paired first paint is blank, passive work reconnects after manual disconnect, a capable hidden paired manager survives ordinary parking, a legacy hidden pane schedules raw xterm output or bypasses its fallback, reveal loses requested bounded history or live PTY identity, retained buffer cells do not fall, or either headed/headless scenario flakes." }, @@ -11999,7 +11908,7 @@ "providers": ["local", "daemon", "ssh", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["ssh"], - "coverageNotes": "Local macOS evidence covers main-process pending-output and projection-admission caps, saturated-tail wait detection, direct-SSH source retention/accounting, always-on V1 negotiation with legacy peer fallback, exact provider-generation pause ownership, renderer exit/data ordering, decoder input bounds, bounded reconnect scheduling, and WSL stdio transport settlement through deterministic unit contracts. A joined main/runtime oracle exercises renderer-sourced headed semantics and headless-model snapshot semantics without launching a live paired server. Separately, a macOS-hosted Docker OpenSSH run exercises only the deployed Linux relay and direct SSH provider with an exact 256 KiB source-credit plateau, concurrent PTY typing, fixed-size filesystem frames, Git churn, and owner-lease reconnect. Neither deterministic topology labels nor Docker SSH constitute live headed desktop, headless orca serve, or physical WSL evidence; local/daemon, prior-version daemons, Windows named pipes/ConPTY, folder workspaces, and mixed-version clients also remain uncovered. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Local macOS evidence covers main-process pending-output and projection-admission caps, saturated-tail wait detection, direct-SSH source retention/accounting, always-on V1 negotiation with legacy peer fallback, exact provider-generation pause ownership, renderer exit/data ordering, decoder input bounds, bounded reconnect scheduling, and WSL stdio transport settlement through deterministic unit contracts. A joined main/runtime oracle exercises renderer-sourced headed semantics and headless-model snapshot semantics without launching a live paired server. Separately, a macOS-hosted Docker OpenSSH run exercises only the deployed Linux relay and direct SSH provider with an exact 256 KiB source-credit plateau, concurrent PTY typing, fixed-size filesystem frames, Git churn, and owner-lease reconnect. Neither deterministic topology labels nor Docker SSH constitute live headed desktop, headless orca serve, or physical WSL evidence; local/daemon, prior-version daemons, Windows named pipes/ConPTY, folder workspaces, and mixed-version clients also remain uncovered. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/pull/6836", "https://github.com/stablyai/orca/pull/6858", @@ -12007,7 +11916,7 @@ "https://github.com/stablyai/orca/pull/7054" ], "invariant": "High-volume terminal output must stay bounded across daemon socket writes, SSH relay writer/decoder/source retention/reconnect, main model and projection admission, runtime metadata, detectors, and tail checks, main-to-renderer in-flight bytes, renderer scheduler queues, and hidden-output restore without starving focused input. Every new SSH session offers V1 and every same-build relay supports it; legacy delivery is reachable only when capability negotiation proves the peer cannot use V1. Negotiated SSH spans remain exact and contiguous through activation, exit, cancellation, recovery, desktop projection, and required remote replacement; provisional activation data cannot project, reconnect may release it only into the exact attempt's private recovery quarantine after contract validation, and exit seals that quarantine against later same-token frames until ordered admission or exact cancellation proof. Reconnect checkpoint capture freezes exact provider-generation/PTy admission, cancels queued old work, and waits for the running raw completion before exposing its accepted checkpoint; timeout or failure detaches only that PTy's old model, makes the checkpoint unavailable, and releases the bounded fence without closing the shared provider, while the same failure outside an active exact migration remains generation-fatal and overlapping reconnects preserve any earlier outstanding fence. Pending renderer projection IDs are capped and compacted across split remainders, exit preparation owns its renderer fence through finalization, exit-time cancellation transfers published projections before proof commit, generation close fences late proof while draining exact projection waiters, closed-generation identity compacts without weakening stale rejection, canceled source-delivery retirement retains at most one ordered token per PTY, and pause/resume targets only the exact provider generation. Additional subscribers cannot stall the owner, while the required legacy primary retains backpressure.", - "oracle": "The current executable slice injects main-process renderer backlog pressure, then asserts ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, a 1,024-ID projection cap with split-remainder compaction, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, exact provider-generation pause ownership, renderer exit/data ordering, and ACK-gated in-flight bounds. The negotiation seam proves every initial connection and reconnect offers V1, the same-build relay advertises V1 without launch flags, old clients remain token-free, and method-not-found peers fall back without installing source ACK publication. The joined source-intake/multiplex oracle blocks renderer or headless serialization, admits one snapshot-covered span and one trailing span, requires replacement reservation only after the authoritative sequence is known, advances upstream ACK eligibility exactly to the covered boundary after SnapshotEnd, and delivers then ACKs the trailing span through the ordinary live path without cancellation. Source-range ledger and multiplex seams additionally require cumulative byte ACK 40 then 100 for one 100-byte frame to release exact byte credit without early source settlement, admit a contiguous higher-generation recovered token while the prior token remains unsettled, and reject stale stream or source generations without releasing in-flight byte credit. Replacement reservation rolls back every earlier span on a later failure, commit requires the exact frozen transfer states, and an authoritatively reclaimed covered span rejects commit without local trim authority while rollback removes the reservation idempotently. The exit-deadline oracle publishes a source-backed desktop projection, advances a fake clock to cancellation, and requires one projection transfer, proof commit, preparation, and final exit with no provider close, retained obligation, duplicate finalization, or process-lifetime cancellation tombstone; a second controlled proof remains pending across generation close and must never publish final exit, while both paths release the renderer preparation lease exactly once. The model-migration oracle accepts span A, blocks span B's raw emulator completion, begins disconnect migration, and proves no checkpoint or reconnect attach can remain at A; releasing B advances the exact checkpoint to B and projects B once. Its fake-clock arm reaches the 10-second deadline, requires checkpoint-unavailable, one exact model reset, zero retained admission charge and timers, and no effect from late raw settlement. Its two-PTY failure arm rejects one running raw callback under an active exact migration and requires one checkpoint-unavailable result, one model reset, zero provider closes, retained sibling checkpoint and transport liveness, zero charges and timers, and an unaffected other generation; a non-migrating sibling oracle still requires generation close. The intake additionally closes 2,048 sequential provider generations into one exact range, rejects stale events across that range, and preserves an out-of-order live gap until its own close. Direct-SSH contracts additionally prove activation-response settlement before the first source frame, claim-gated projection under same-decoder-turn response/data delivery, exact early-ACK reservation through send settlement or same-token retry, recovery completion visible before lease-held frames transfers those frames only into the private quarantine and admits no output until exact checkpoint-to-recoveryEnd coverage, invalid-checkpoint restore retention through response settlement followed by fresh-token retry and one live source frame, isolated saturated-subscriber eviction with healthy owner liveness, preserved legacy-primary backpressure, one-write ownership across write(false)/drain, control selection ahead of queued ordinary PTY input with FIFO lanes and bounded fairness, liveness rebasing, failed-exit retention through late ACK or exact recovery, response-settlement cancellation authority, token-scoped exit cancellation, exact checkpoint-to-recoveryEnd continuity, stale-owner one-shot retry, no physical PTY teardown on recovery failure, exact provider-generation closure and once-only cleanup when recovery cancellation publication or proof rejects, 16 MiB-plus-1 MiB decoder caps, charged per-PTY/session retention budgets, and eight-wide isolated reattach. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: The current executable slice injects main-process renderer backlog pressure, then asserts ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, a 1,024-ID projection cap with split-remainder compaction, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, exact provider-generation pause ownership, renderer exit/data ordering, and ACK-gated in-flight bounds. The negotiation seam proves every initial connection and reconnect offers V1, the same-build relay advertises V1 without launch flags, old clients remain token-free, and method-not-found peers fall back without installing source ACK publication. The joined source-intake/multiplex oracle blocks renderer or headless serialization, admits one snapshot-covered span and one trailing span, requires replacement reservation only after the authoritative sequence is known, advances upstream ACK eligibility exactly to the covered boundary after SnapshotEnd, and delivers then ACKs the trailing span through the ordinary live path without cancellation. Source-range ledger and multiplex seams additionally require cumulative byte ACK 40 then 100 for one 100-byte frame to release exact byte credit without early source settlement, admit a contiguous higher-generation recovered token while the prior token remains unsettled, and reject stale stream or source generations without releasing in-flight byte credit. Replacement reservation rolls back every earlier span on a later failure, commit requires the exact frozen transfer states, and an authoritatively reclaimed covered span rejects commit without local trim authority while rollback removes the reservation idempotently. The exit-deadline oracle publishes a source-backed desktop projection, advances a fake clock to cancellation, and requires one projection transfer, proof commit, preparation, and final exit with no provider close, retained obligation, duplicate finalization, or process-lifetime cancellation tombstone; a second controlled proof remains pending across generation close and must never publish final exit, while both paths release the renderer preparation lease exactly once. The model-migration oracle accepts span A, blocks span B's raw emulator completion, begins disconnect migration, and proves no checkpoint or reconnect attach can remain at A; releasing B advances the exact checkpoint to B and projects B once. Its fake-clock arm reaches the 10-second deadline, requires checkpoint-unavailable, one exact model reset, zero retained admission charge and timers, and no effect from late raw settlement. Its two-PTY failure arm rejects one running raw callback under an active exact migration and requires one checkpoint-unavailable result, one model reset, zero provider closes, retained sibling checkpoint and transport liveness, zero charges and timers, and an unaffected other generation; a non-migrating sibling oracle still requires generation close. The intake additionally closes 2,048 sequential provider generations into one exact range, rejects stale events across that range, and preserves an out-of-order live gap until its own close. Direct-SSH contracts additionally prove activation-response settlement before the first source frame, claim-gated projection under same-decoder-turn response/data delivery, exact early-ACK reservation through send settlement or same-token retry, recovery completion visible before lease-held frames transfers those frames only into the private quarantine and admits no output until exact checkpoint-to-recoveryEnd coverage, invalid-checkpoint restore retention through response settlement followed by fresh-token retry and one live source frame, isolated saturated-subscriber eviction with healthy owner liveness, preserved legacy-primary backpressure, one-write ownership across write(false)/drain, control selection ahead of queued ordinary PTY input with FIFO lanes and bounded fairness, liveness rebasing, failed-exit retention through late ACK or exact recovery, response-settlement cancellation authority, token-scoped exit cancellation, exact checkpoint-to-recoveryEnd continuity, stale-owner one-shot retry, no physical PTY teardown on recovery failure, exact provider-generation closure and once-only cleanup when recovery cancellation publication or proof rejects, 16 MiB-plus-1 MiB decoder caps, charged per-PTY/session retention budgets, and eight-wide isolated reattach. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty/delivery/pty-renderer-inflight-credit.test.ts src/main/ipc/pty/delivery/pty-global-renderer-credit.test.ts src/main/ipc/pty/delivery/pty-output-batching-drain.test.ts src/main/ipc/pty/delivery/pty-pending-output-cap.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts", @@ -12063,15 +11972,6 @@ "stays equivalent across tail eviction beyond the retained cap" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "returns a blocked wait result for Codex update prompts", - "returns a blocked wait result for Codex workspace trust prompts", - "returns a blocked wait result for generic Codex interactive prompts", - "resolves tui-idle when a stale Codex prompt is followed by the ready header" - ] - }, { "file": "src/main/persistence/terminal-topology/persistence-ssh-targets-and-pane-keys.test.ts", "assertions": [ @@ -12190,7 +12090,8 @@ "Current command does not prove renderer parse pressure, scheduler queue depth, event-loop delay, or active key latency.", "Live hidden-output pressure, active input latency, and full Electron perf artifacts remain unproved.", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-07-10\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts\",\"result\":\"passed\",\"durationSeconds\":21.33,\"summary\":\"2 test files passed, 609 tests passed on pushed commit 4fb14eac3897.\"}", - "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed." + "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"returns a blocked wait result for Codex update prompts\",\"returns a blocked wait result for Codex workspace trust prompts\",\"returns a blocked wait result for generic Codex interactive prompts\",\"resolves tui-idle when a stale Codex prompt is followed by the ready header\"]}]" ], "demotionRule": "Cannot promote without metric artifacts and bounded-byte assertions." }, @@ -13672,10 +13573,10 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon"], - "coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, verified managed-Claude launch identity, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal when no verified launch identity exists. Protocol-version constant inventories are excluded from handshake and foreground-confirmation evidence. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, verified managed-Claude launch identity, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal when no verified launch identity exists. Protocol-version constant inventories are excluded from handshake and foreground-confirmation evidence. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": ["https://github.com/stablyai/orca/issues/8303"], "invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; a generic busy title requires independent agent identity from the title, a verified managed launch bound to the current PTY incarnation, or the foreground process; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.", - "oracle": "A quarter-circle Claude task title authorizes without a provider lookup only on the exact PTY incarnation carrying verified managed-Claude launch identity; the same title in a bare pane, with an unverified launch hint, or after PTY incarnation replacement is refused while current Claude activity remains a working signal. Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: A quarter-circle Claude task title authorizes without a provider lookup only on the exact PTY incarnation carrying verified managed-Claude launch identity; the same title in a bare pane, with an unverified launch hint, or after PTY incarnation replacement is refused while current Claude activity remains a working signal. Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/quarter-circle-title-send-authorization.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts" @@ -13701,16 +13602,6 @@ "quarter circles remain working signals and braille authorization is unchanged" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "a recognized fresh provider confirmation authorizes explicit hook state over an ordinary shell result", - "shell, non-agent, null, thrown, and missing confirmation remain fail-closed", - "title blockers and ordinary recognized agent evidence add no confirmation call", - "PTY exit or handle rebind during either foreground read rejects evidence bound to the original PTY", - "controller-less yields preserve stale-handle errors and confirmation methods retain their controller receiver" - ] - }, { "file": "src/main/runtime/rpc/terminal-send.test.ts", "assertions": [ @@ -13792,7 +13683,8 @@ "SSH, WSL, legacy daemon, and remote-runtime providers without confirmation remain intentionally fail-closed on an ordinary-shell conflict; no live artifacts cover those degraded paths.", "No live Linux PTY, paired-web, mobile/relay, restore/replay, or multi-window artifact is attached; those surfaces receive no renderer, persistence, or protocol change.", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-25\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/providers/windows-pty-job-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts\",\"result\":\"passed\",\"durationSeconds\":13.74,\"summary\":\"Twelve focused test files passed (1351 tests, 1 skipped), covering runtime confirmation and PTY revalidation, guarded RPC zero-write behavior, PTY controller routing, local/daemon fresh scans, exact ConPTY membership, and unchanged renderer note routing.\"}", - "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed." + "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"a recognized fresh provider confirmation authorizes explicit hook state over an ordinary shell result\",\"shell, non-agent, null, thrown, and missing confirmation remain fail-closed\",\"title blockers and ordinary recognized agent evidence add no confirmation call\",\"PTY exit or handle rebind during either foreground read rejects evidence bound to the original PTY\",\"controller-less yields preserve stale-handle errors and confirmation methods retain their controller receiver\"]}]" ], "demotionRule": "Keep non-blocking or demote to protection none if a generic busy title authorizes without exact title, verified-launch, or foreground identity; provider confirmation becomes unconditional; exact-PTY mismatch can write bytes; unsupported providers fail open; or the focused gate flakes without an actionable product or harness defect." }, @@ -13814,13 +13706,13 @@ "providers": ["local", "daemon", "ssh", "remote-runtime"], "coveredPlatforms": ["macos", "windows"], "coveredProviders": ["local"], - "coverageNotes": "Source-built macOS and physical Windows Electron journeys cover the public CLI through RPC, runtime identity, real PTY/ConPTY writes, and a delayed fake Codex composer. Focused units cover CLI intent, fresh Claude/Codex foreground identity, framing bytes, stale-agent shell fallback, and exact legacy behavior for every other configured agent. SSH, daemon, and remote-runtime remain explicit gaps. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/rpc/terminal-agent-prompt-send.test.ts reduced. Lose mocked successful routing, fallback args and signal identity forwarding. Retained fake PTY write sink observes no output; no actual shell/provider claimed. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Source-built macOS and physical Windows Electron journeys cover the public CLI through RPC, runtime identity, real PTY/ConPTY writes, and a delayed fake Codex composer. Focused units cover CLI intent, fresh Claude/Codex foreground identity, framing bytes, stale-agent shell fallback, and exact legacy behavior for every other configured agent. SSH, daemon, and remote-runtime remain explicit gaps. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/rpc/terminal-agent-prompt-send.test.ts reduced. Lose mocked successful routing, fallback args and signal identity forwarding. Retained fake PTY write sink observes no output; no actual shell/provider claimed. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-4328", "https://github.com/stablyai/orca/issues/14525" ], "invariant": "A public CLI send containing non-empty text plus Enter and no interrupt identifies agent-prompt intent. The owning runtime uses bracketed-paste and settled submit only when a fresh foreground-process read positively identifies the exact target as Claude or Codex on a desktop call; every other agent, stale agent metadata over a shell, text-only input, bare Enter, interrupts, mobile input, query replies, and older clients keep the direct terminal contract.", - "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Launch a bare fake Codex through the real Electron PTY and delay its composer render for 1,200 ms, beyond the legacy generic 500 ms gap. Send a 557-byte prompt with the public CLI and require the marker, zero premature Enter, no rescue Enter, and one submission. POSIX child stdin must retain one bracketed-paste frame; Windows ConPTY consumes that control frame, so runtime tests require the frame at the PTY write boundary while the Windows child requires the exact prompt. The same harness against the installed pre-fix runtime must record one premature Enter and require one bare rescue Enter. Focused units require CLI intent only for text plus Enter, settlement only for freshly identified Claude/Codex, the legacy platform delay for every other configured agent, stale Codex launch identity over a shell to fall back, no wrapper polling, and byte-for-byte direct delivery for non-targets.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Launch a bare fake Codex through the real Electron PTY and delay its composer render for 1,200 ms, beyond the legacy generic 500 ms gap. Send a 557-byte prompt with the public CLI and require the marker, zero premature Enter, no rescue Enter, and one submission. POSIX child stdin must retain one bracketed-paste frame; Windows ConPTY consumes that control frame, so runtime tests require the frame at the PTY write boundary while the Windows child requires the exact prompt. The same harness against the installed pre-fix runtime must record one premature Enter and require one bare rescue Enter. Focused units require CLI intent only for text plus Enter, settlement only for freshly identified Claude/Codex, the legacy platform delay for every other configured agent, stale Codex launch identity over a shell to fall back, no wrapper polling, and byte-for-byte direct delivery for non-targets.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/terminal.test.ts src/main/runtime/rpc/terminal-agent-prompt-send.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/orca-runtime.test.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts", "pnpm run build:cli && pnpm exec playwright test tests/e2e/terminal-send-agent-prompt-submit.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1", @@ -13844,15 +13736,6 @@ "text-only and bare Enter remain direct terminal input" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "Claude and Codex wait for marker-gated composer quiescence before submit", - "every other configured TUI agent retains the legacy platform delay", - "a speculative CLI prompt check does not poll wrapper foregrounds", - "the PTY write boundary retains bracketed framing and one delayed submit" - ] - }, { "file": "tests/e2e/terminal-send-agent-prompt-submit.spec.ts", "assertions": [ @@ -13918,7 +13801,8 @@ "The E2E fake agent models the submission race without requiring external agent authentication; live account-backed agents are covered separately.", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-15\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/terminal.test.ts src/main/runtime/rpc/terminal-agent-prompt-send.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/orca-runtime.test.ts src/shared/agent-prompt-injection.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/terminal.test.ts src/main/runtime/rpc/terminal-agent-prompt-send.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/orca-runtime.test.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts\",\"result\":\"passed\",\"durationSeconds\":23.2,\"summary\":\"After rebasing onto current main, the final narrowed runtime/CLI/RPC suite passed 1,201 tests with one skip, including fresh Claude/Codex identity, stale-agent shell fallback, and legacy timing for every other configured agent.\"}", "Audit1383: src/main/runtime/rpc/terminal-agent-prompt-send.test.ts reduced. Lose mocked successful routing, fallback args and signal identity forwarding. Retained fake PTY write sink observes no output; no actual shell/provider claimed. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", - "Audit1383 historical assertion inventory for changed sources:\n[\n {\n \"file\": \"src/main/runtime/rpc/terminal-agent-prompt-send.test.ts\",\n \"assertions\": [\n \"a freshly proven Claude or Codex desktop target uses settled prompt delivery\",\n \"a non-target agent or shell preserves the existing direct send\"\n ]\n }\n]" + "Audit1383 historical assertion inventory for changed sources:\n[\n {\n \"file\": \"src/main/runtime/rpc/terminal-agent-prompt-send.test.ts\",\n \"assertions\": [\n \"a freshly proven Claude or Codex desktop target uses settled prompt delivery\",\n \"a non-target agent or shell preserves the existing direct send\"\n ]\n }\n]", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"Claude and Codex wait for marker-gated composer quiescence before submit\",\"every other configured TUI agent retains the legacy platform delay\",\"a speculative CLI prompt check does not poll wrapper foregrounds\",\"the PTY write boundary retains bracketed framing and one delayed submit\"]}]" ], "demotionRule": "Keep experimental or demote to protection none if direct shell/mobile/query input is reframed, an unrecognized target receives bracketed paste, a prompt can emit duplicate Enter, mixed-version decoding rejects the optional field, or the deterministic fake-composer candidate requires a rescue send." }, @@ -13940,7 +13824,7 @@ "providers": ["local", "daemon", "ssh", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local"], - "coverageNotes": "Local macOS evidence covers the runtime PTY write contract, live Codex orchestration, a dev-runtime CLI repro, and Claude and Codex composer traces. A deterministic worker-start RPC/SQLite contract proves delayed Codex composer acceptance, exactly one submitted turn, durable Dispatch success, and explicit stalled failure when Enter is swallowed without a rescue send. The render gate stays on the PTY-owning runtime, so paired and SSH callers use the same provider write/output path without a wire change. SSH, daemon, remote-runtime, Linux, and Windows live journeys remain gaps. The test-value audit intentionally removes these direct unit alarms: Only OMP joins submit to paste frame. Exact bracketed multiline prompt frame. Claude/team/unknown lead-line positives and Codex/OpenCode negatives. DSB generic lead/submit/delay fallback on three platform strings. 2KB/8KB Windows and 8KB Darwin delay below700ms. 320KB ingest estimate greater than1.4x3342ms. 145KB delay greater than1500ms. Darwin8KB <=2ms, zero/NaN Linux and negative Windows return zero. 400KB greater than40KB across platforms and Windows slower than Darwin. Antigravity100-line settle addition and Aider one-line delta. Retained unit cases still assert safe typed-lead normalization, pinned measured delay floors and chunk byte-budget bounds, ESC sanitization, exact framed UTF-8 chunk reassembly, and held-draft discrimination. The later test-value audit also removes the 16MiB arithmetic extrapolation: Windows delay greater than250000ms and Linux delay greater than4000ms, including its no-cap scaling alarm; that test never delivered ceiling input. They are not equivalent replacements for the removed unit alarms. The OMP-versus-Claude/Codex/unidentified-agent submit-join predicate obligation remains deferred. Runtime PTY-writer, worker-start and live evidence above are unchanged; no runtime-writer coverage loss, new execution, owner-gap closure or credit is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "Local macOS evidence covers the runtime PTY write contract, live Codex orchestration, a dev-runtime CLI repro, and Claude and Codex composer traces. A deterministic worker-start RPC/SQLite contract proves delayed Codex composer acceptance, exactly one submitted turn, durable Dispatch success, and explicit stalled failure when Enter is swallowed without a rescue send. The render gate stays on the PTY-owning runtime, so paired and SSH callers use the same provider write/output path without a wire change. SSH, daemon, remote-runtime, Linux, and Windows live journeys remain gaps. The test-value audit intentionally removes these direct unit alarms: Only OMP joins submit to paste frame. Exact bracketed multiline prompt frame. Claude/team/unknown lead-line positives and Codex/OpenCode negatives. DSB generic lead/submit/delay fallback on three platform strings. 2KB/8KB Windows and 8KB Darwin delay below700ms. 320KB ingest estimate greater than1.4x3342ms. 145KB delay greater than1500ms. Darwin8KB <=2ms, zero/NaN Linux and negative Windows return zero. 400KB greater than40KB across platforms and Windows slower than Darwin. Antigravity100-line settle addition and Aider one-line delta. Retained unit cases still assert safe typed-lead normalization, pinned measured delay floors and chunk byte-budget bounds, ESC sanitization, exact framed UTF-8 chunk reassembly, and held-draft discrimination. The later test-value audit also removes the 16MiB arithmetic extrapolation: Windows delay greater than250000ms and Linux delay greater than4000ms, including its no-cap scaling alarm; that test never delivered ceiling input. They are not equivalent replacements for the removed unit alarms. The OMP-versus-Claude/Codex/unidentified-agent submit-join predicate obligation remains deferred. Runtime PTY-writer, worker-start and live evidence above are unchanged; no runtime-writer coverage loss, new execution, owner-gap closure or credit is claimed. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-3800", "https://linear.app/stably/issue/STA-3904", @@ -13950,7 +13834,7 @@ "https://github.com/stablyai/orca/issues/14347" ], "invariant": "Injected orchestration task prompts for recognized agent CLIs must send the prompt body inside one bracketed-paste frame, sanitize embedded ESC bytes, preserve chunk boundaries without losing the frame, and submit exactly once only after the agent can accept Enter. Local worker-start with supported observation must preserve an unobserved turn as start_unknown without revoking authority, closing questions, or triggering a rescue Enter; a worker report during observation must settle normally. Claude and Codex must emit a post-paste composer marker and then settle, or reach the bounded fallback first; every other agent retains the platform delay.", - "oracle": "Runtime tests assert the exact PTY write sequence, failure cleanup, Claude/Codex marker-gated multi-frame renders, and the legacy platform delay for every other configured agent. The candidate resets settlement on later frames, gives a late marker a fresh bounded window, and still submits once at the hard deadline if output never settles. The worker-start contract drives the production RPC through a delayed fake Codex composer and independently checks exact turn/Enter counts plus reopened SQLite Task, Dispatch, worker receipt, and mutation receipt state for accepted and swallowed outcomes. Other orchestration tests assert dispatch/coordinator use the agent prompt path; the live CLI harness covers long Codex-like framing.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Runtime tests assert the exact PTY write sequence, failure cleanup, Claude/Codex marker-gated multi-frame renders, and the legacy platform delay for every other configured agent. The candidate resets settlement on later frames, gives a late marker a fresh bounded window, and still submits once at the hard deadline if output never settles. The worker-start contract drives the production RPC through a delayed fake Codex composer and independently checks exact turn/Enter counts plus reopened SQLite Task, Dispatch, worker receipt, and mutation receipt state for accepted and swallowed outcomes. Other orchestration tests assert dispatch/coordinator use the agent prompt path; the live CLI harness covers long Codex-like framing.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts --reporter=dot", @@ -13974,19 +13858,6 @@ "chunk reconstruction preserves the paste frame" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "runtime writes bracketed paste before a delayed submit", - "Claude and Codex ignore unrelated and split pre-marker output, then wait for render quiescence before one submit", - "every other configured TUI agent retains the platform delay", - "a late Codex marker receives a fresh settlement window before one submit", - "a silent Claude composer reaches one bounded fallback submit", - "a marked Claude composer with continuous render output reaches one bounded fallback submit", - "large prompt frames are chunked and reconstructed before submit", - "partial prompt write failure closes the paste frame and does not submit" - ] - }, { "file": "src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts", "assertions": [ @@ -14068,7 +13939,8 @@ "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"result\":\"passed\",\"durationSeconds\":13.3,\"summary\":\"4 files and 1,283 tests passed. The hardened multi-frame oracle failed on the first-marker candidate because it submitted at 751 ms during an intermediate Claude frame; the quiescence candidate waited through the final 1,000 ms frame and submitted once at 2,500 ms. Continuous render output remained bounded to one fallback submit at 8 seconds. An isolated Claude Code 2.1.231 Haiku probe saw the first marker at 400 ms, continued output through 1,500 ms, sent one Enter at 3,000 ms after 1.5 seconds quiet, and created the expected marker; no Fable or Opus probe was used.\"}", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"result\":\"passed\",\"durationSeconds\":16.9,\"summary\":\"4 files and 1,282 tests passed. Unmodified main wrote Enter at 500 ms before the deterministic Claude composer rendered at 750 ms; the candidate waited for the split show-cursor marker and wrote one Enter. A live Claude Code 2.1.231 Haiku trace rendered the pasted marker and show-cursor in one 523-byte frame without submitting a model request.\"}", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-07-07\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-launch/startup/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts\",\"result\":\"passed\",\"durationSeconds\":7.4,\"summary\":\"4 test files passed, 697 tests passed; covers framing, runtime PTY writes, orchestration RPC dispatch, and coordinator dispatch behavior.\"}", - "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed." + "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"runtime writes bracketed paste before a delayed submit\",\"Claude and Codex ignore unrelated and split pre-marker output, then wait for render quiescence before one submit\",\"every other configured TUI agent retains the platform delay\",\"a late Codex marker receives a fresh settlement window before one submit\",\"a silent Claude composer reaches one bounded fallback submit\",\"a marked Claude composer with continuous render output reaches one bounded fallback submit\",\"large prompt frames are chunked and reconstructed before submit\",\"partial prompt write failure closes the paste frame and does not submit\"]}]" ], "demotionRule": "Demote or quarantine if the live harness flakes without a product bug or harness bug filed to the terminal-input owner." }, @@ -14092,14 +13964,14 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh"], - "coverageNotes": "A deterministic isolated runtime/SQLite/RPC harness covers Run and Dispatch ownership, exact handle and remint-stable pane recipients, fixed Delivery replay and acknowledgment, restart, concurrent pollers, filtered waiters, and built-CLI parity with direct DB state. Schema v28 durably records every coordinator handle through SQLite triggers, backfills current handles on open, recreates routing triggers after old table rebuilds, and atomically canonicalizes coordinator-addressed inserts to run:. A 125-row oracle and 151-row reconciliation suite cover paged old-handle backlogs, commit-without-notify recovery, duplicate Dispatch owners, cancellation, and lifecycle fencing. Federation tests use real databases, dropped acknowledgments, restart/reconnect, and protocol v1/v2 peers; duplicate read rows do not wake again. Daemon and SSH pointer settlement is deterministic, with SSH bounded at 60 seconds beyond the 20-second mux health window. No RPC parameter, stream opcode, or published payload changed. Live headed/headless paired-runtime, physical SSH, WSL, Linux, and Windows acceptance remain gaps. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "A deterministic isolated runtime/SQLite/RPC harness covers Run and Dispatch ownership, exact handle and remint-stable pane recipients, fixed Delivery replay and acknowledgment, restart, concurrent pollers, filtered waiters, and built-CLI parity with direct DB state. Schema v28 durably records every coordinator handle through SQLite triggers, backfills current handles on open, recreates routing triggers after old table rebuilds, and atomically canonicalizes coordinator-addressed inserts to run:. A 125-row oracle and 151-row reconciliation suite cover paged old-handle backlogs, commit-without-notify recovery, duplicate Dispatch owners, cancellation, and lifecycle fencing. Federation tests use real databases, dropped acknowledgments, restart/reconnect, and protocol v1/v2 peers; duplicate read rows do not wake again. Daemon and SSH pointer settlement is deterministic, with SSH bounded at 60 seconds beyond the 20-second mux health window. No RPC parameter, stream opcode, or published payload changed. Live headed/headless paired-runtime, physical SSH, WSL, Linux, and Windows acceptance remain gaps. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-4325", "https://github.com/stablyai/orca/issues/14522", "internal incident evidence: improve-vps-setup, 2026-08-10" ], "invariant": "Each message has one stable row ID and authoritative recipient; coordinator-addressed current-delivery inserts are atomically owned by run:. Pointer staging may set delivered_at but never consumes mail. Each Run consumer generation has at most one outstanding Delivery with a fixed ID and fixed message IDs; ordinary checks replay it until an explicit matching acknowledgment marks exactly those rows read. Rebinding fences the old generation, notification types/counts correspond to unread rows retrievable under the same authority, and federation replay imports each stable message identity once without re-waking an already-read duplicate.", - "oracle": "Seed status, dispatch, and worker_done rows across direct-handle and canonical Run recipients in an isolated DB. Compare pointer count, RPC and built-CLI check output, direct SQLite rows, unread/peek/all/type filters, concurrent pollers, fixed Delivery IDs, explicit acknowledgment, restart, filtered check --wait, and coordinator remint. Route a 125-row old-handle backlog, inject a commit without notification, and require startup repair. Exercise duplicate Run/Dispatch owners, stale panes, 50-row pages, cancellation, lifecycle fencing, and absent PTYs. Drop a federation ACK, reconnect/restart v1/v2 peers, and require stable import plus no duplicate read-row wake. Hold a healthy SSH write past five seconds but below the 60-second settlement deadline, then distinguish the three settlement outcomes end to end: only a proven refusal releases the reservation and drains a delivery parked behind the watermark; a dropped in-flight settlement must surface as unverifiable with bytes handed to the transport, preserve the durable write-attempted reservation, and emit no duplicate pointer after restart; a settled write that throws mid-pointer is unverifiable, not a refusal; and an Enter whose settlement is lost stays at enter-attempted so restart emits no second Enter. Install the production PTY controller and verify that it routes settled writes through the owning provider and refuses before any byte when the routed provider cannot settle. Census every production PTY provider class and reject a settlement synthesized from the fire-and-forget write.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Seed status, dispatch, and worker_done rows across direct-handle and canonical Run recipients in an isolated DB. Compare pointer count, RPC and built-CLI check output, direct SQLite rows, unread/peek/all/type filters, concurrent pollers, fixed Delivery IDs, explicit acknowledgment, restart, filtered check --wait, and coordinator remint. Route a 125-row old-handle backlog, inject a commit without notification, and require startup repair. Exercise duplicate Run/Dispatch owners, stale panes, 50-row pages, cancellation, lifecycle fencing, and absent PTYs. Drop a federation ACK, reconnect/restart v1/v2 peers, and require stable import plus no duplicate read-row wake. Hold a healthy SSH write past five seconds but below the 60-second settlement deadline, then distinguish the three settlement outcomes end to end: only a proven refusal releases the reservation and drains a delivery parked behind the watermark; a dropped in-flight settlement must surface as unverifiable with bytes handed to the transport, preserve the durable write-attempted reservation, and emit no duplicate pointer after restart; a settled write that throws mid-pointer is unverifiable, not a refusal; and an Enter whose settlement is lost stays at enter-attempted so restart emits no second Enter. Install the production PTY controller and verify that it routes settled writes through the owning provider and refuses before any byte when the routed provider cannot settle. Census every production PTY provider class and reject a settlement synthesized from the fire-and-forget write.", "commands": [ "pnpm run build:cli && pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-message-delivery-identity.test.ts --reporter=dot --testTimeout=5000", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-delivery.test.ts src/main/ipc/pty/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts", @@ -14302,7 +14174,8 @@ "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-09-05\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts\",\"result\":\"passed\",\"durationSeconds\":4.73,\"summary\":\"267 tests passed after the pointer-write path moved to the three-valued WriteSettlement union. New coverage: a dropped in-flight SSH settlement reaches the stager as unverifiable with bytes handed to the transport, a settled write that throws mid-pointer preserves the write-attempted reservation, an Enter whose settlement is lost stays at enter-attempted with no second Enter after restart, a refusal releases the reservation and drains a delivery parked behind its watermark, the production controller refuses before any byte when the routed provider cannot settle, and a census pins the five production IPtyProvider classes and rejects a settlement synthesized from the fire-and-forget write. Each new assertion was verified red against the pre-fix shape.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-delivery.test.ts src/main/ipc/pty/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts\"}", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-13\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/ipc/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts\",\"result\":\"passed\",\"durationSeconds\":8.22,\"summary\":\"245 tests passed across mailbox identity, durable coordinator-handle migration, insertion-time canonicalization, duplicate-free 51-row ownership branch caps, unrestricted reservation merging, direct and Dispatch pointer suppression, persisted reconciliation, 50-row paging and filtered waits, cross-PTY serialization, lifecycle fencing, bounded daemon and SSH transport settlement, outstanding Deliveries, reminted Dispatch ownership, acknowledgment, cancellation, and bounded pane lookup.\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-delivery.test.ts src/main/ipc/pty/pty-controller-ownership-routing.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/orchestration/mailbox-pointer-stage.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts\"}", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-08-14\",\"runner\":\"local\",\"platform\":\"macos\",\"command\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/main/runtime/rpc/methods/orchestration/runs/runs.test.ts src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts\",\"result\":\"passed\",\"durationSeconds\":14.15,\"summary\":\"1,293 tests passed and 1 was skipped across Run-bound pointer delivery, PTY retirement and respawn, stale-leaf liveness, direct-mail routing, filtered waiter ownership, canonical stored-recipient notification, and orchestration RPC behavior.\"}", - "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed." + "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: []" ], "demotionRule": "Demote or quarantine if the deterministic oracle flakes without a product or harness bug owned by orchestration." }, @@ -14326,7 +14199,7 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos", "linux"], "coveredProviders": ["local", "daemon", "ssh"], - "coverageNotes": "A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, exact legacy Task/Dispatch/report-receipt verification, JSON rejection envelopes, and capability-negotiated Run-home settlement. The federation oracle drops the first terminal ACK, restarts Run-home twice, verifies replay through the existing polling path and the persisted acknowledgment watermark, races identical reports, accepts preexisting same-outcome ACK batches, rejects conflicting batches, and covers protocol v1/v2 completion across independently updated peers. A migration unit upgrades a v26 database with a zeroed watermark without replaying older migrations. Three isolated macOS Electron journeys launch fake Codex workers through the real RPC path. Distinct installed A/B artifacts plus live SSH, WSL, folder, Linux, and Windows cutover journeys remain explicit gaps. Test-value audit1293 removes src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, exact legacy Task/Dispatch/report-receipt verification, JSON rejection envelopes, and capability-negotiated Run-home settlement. The federation oracle drops the first terminal ACK, restarts Run-home twice, verifies replay through the existing polling path and the persisted acknowledgment watermark, races identical reports, accepts preexisting same-outcome ACK batches, rejects conflicting batches, and covers protocol v1/v2 completion across independently updated peers. A migration unit upgrades a v26 database with a zeroed watermark without replaying older migrations. Three isolated macOS Electron journeys launch fake Codex workers through the real RPC path. Distinct installed A/B artifacts plus live SSH, WSL, folder, Linux, and Windows cutover journeys remain explicit gaps. Test-value audit1293 removes src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/pull/11107#discussion_r3663321387", "https://github.com/stablyai/orca/issues/13858", @@ -14336,7 +14209,7 @@ "https://linear.app/stably/issue/STA-4022" ], "invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. A worker_done caller may report success only after the owning runtime returns an explicit lifecycle verdict or authoritative reads prove that the exact Task, Dispatch, and worker report receipt settled the expected outcome. Federated terminal settlement must remain replay-eligible until the worker durably acknowledges it, and identical same-outcome retries must converge idempotently. Independently updated clients and worker servers must preserve the negotiated protocol: current peers use Run-home lifecycle settlement, while protocol v1/v2 peers retain their legacy completion path without receiving newer-only fields. A federated worker may accept only the authority defined by its negotiated protocol. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.", - "oracle": "Drive Run create, Task create, and worker-start through production Electron runtimes with a deterministic Codex fixture. Require append-only ledgers with one still-live PID and no interruption, a visible inactive worker tab while the coordinator stays active, Run delivery through stable pane identity, and stable PTY/incarnation, tab, leaf, worktree, Task, and Dispatch across workspace re-entry. In a restart journey, retain the original daemon PTY and PID, remove renderer ownership, retain sleeping-session evidence, mark the Dispatch legacy, relaunch, and require exact inactive tab adoption, readable ACK output, cleared resume state, one spawn, and no resume argv or Conversation interrupted text after another workspace round trip. The service oracle removes renderer lookup identity from current-contract callers while retaining real restored-PTY and hook commitments, replays authenticated completion and takeover across fresh runtimes, and requires one Task, Dispatch, terminal authority, message, mutation, ordinary-mail delivery, remote process fencing, and unchanged fixture marker bytes while foreign pane evidence remains rejected. Unit tests separately remint a creator pane and process from Run A into Run B, require the nested Run A worker to fall back to its current coordinator, require indexed query plans, and bound 300 Task reads with 50,000 retained Runs. They also assert authority-specific legacy affordances, exact identity and owner matching, retained-output fallback, pane-stable routing, federated non-activation, and SSH fallback parity.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Drive Run create, Task create, and worker-start through production Electron runtimes with a deterministic Codex fixture. Require append-only ledgers with one still-live PID and no interruption, a visible inactive worker tab while the coordinator stays active, Run delivery through stable pane identity, and stable PTY/incarnation, tab, leaf, worktree, Task, and Dispatch across workspace re-entry. In a restart journey, retain the original daemon PTY and PID, remove renderer ownership, retain sleeping-session evidence, mark the Dispatch legacy, relaunch, and require exact inactive tab adoption, readable ACK output, cleared resume state, one spawn, and no resume argv or Conversation interrupted text after another workspace round trip. The service oracle removes renderer lookup identity from current-contract callers while retaining real restored-PTY and hook commitments, replays authenticated completion and takeover across fresh runtimes, and requires one Task, Dispatch, terminal authority, message, mutation, ordinary-mail delivery, remote process fencing, and unchanged fixture marker bytes while foreign pane evidence remains rejected. Unit tests separately remint a creator pane and process from Run A into Run B, require the nested Run A worker to fall back to its current coordinator, require indexed query plans, and bound 300 Task reads with 50,000 retained Runs. They also assert authority-specific legacy affordances, exact identity and owner matching, retained-output fallback, pane-stable routing, federated non-activation, and SSH fallback parity.", "commands": [ "ORCA_BACKGROUND_LAUNCH=1 npx vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot", @@ -14389,14 +14262,6 @@ "ordinary mail and remote attachments use the same attested pane and process authority" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "one exact live legacy worker is adopted into its original background pane without input or signals", - "automatic provider resume stays fenced until exact adoption is persisted", - "retained renderer output remains readable through the recovered terminal" - ] - }, { "file": "src/main/runtime/orchestration/formatter.test.ts", "assertions": [ @@ -14715,7 +14580,8 @@ "The local Electron restart proof covers retained visible output from the same-build daemon checkpoint, not transcript recovery after a transport cut or distinct A/B runtime replacement.", "Test-value audit1293 removes src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required.", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/runtime/orca-runtime.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts\",\"result\":\"passed\",\"durationSeconds\":24.4,\"summary\":\"Test Files 1 passed (1); Tests 1445 passed | 3 skipped (1448). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}", - "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed." + "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"one exact live legacy worker is adopted into its original background pane without input or signals\",\"automatic provider resume stays fenced until exact adoption is persisted\",\"retained renderer output remains readable through the recovered terminal\"]}]" ], "demotionRule": "Keep experimental or demote if either Electron journey flakes without a product or harness defect, if local worker-start can return before tab materialization without an explicit reveal warning, if focus moves to the worker, if restart or workspace re-entry spawns/resumes/duplicates/interferes with the worker, if retained output becomes unreadable, or if pane-stable delivery reads the wrong mailbox." }, @@ -16658,14 +16524,14 @@ "providers": ["local", "remote-runtime", "ssh"], "coveredPlatforms": ["macos", "linux"], "coveredProviders": ["local", "remote-runtime", "ssh"], - "coverageNotes": "This audit removes the paired-web stopped-during-outage and late-ready direct-branch examples. The retained pre-ready cancellation, failed-unwatch retry and replay-continuity cases are not equivalent replacements for those ordering alarms. Current web-runtime-client.test.ts assertions below name only its retained pre-ready callback case; replay cases remain in their separate suite. Historical commands and results remain historical. Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation. The test-value audit corrects the active renderer watch command/file reference to the existing runtime-file-client-watch.test.ts, whose three cases are retained unchanged. They observe synthetic subscription retry/fanout and unsubscribe/unwatch calls, not actual preload/main bookkeeping or physical watcher-process cleanup. The separate read/preview client suite loses forwarding, supplied-error and negative-only examples, retaining binary detection and Unicode SVG decoding. Historical evidence commands/results are unchanged. Test-value audit1293 removes src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result.", + "coverageNotes": "This audit removes the paired-web stopped-during-outage and late-ready direct-branch examples. The retained pre-ready cancellation, failed-unwatch retry and replay-continuity cases are not equivalent replacements for those ordering alarms. Current web-runtime-client.test.ts assertions below name only its retained pre-ready callback case; replay cases remain in their separate suite. Historical commands and results remain historical. Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation. The test-value audit corrects the active renderer watch command/file reference to the existing runtime-file-client-watch.test.ts, whose three cases are retained unchanged. They observe synthetic subscription retry/fanout and unsubscribe/unwatch calls, not actual preload/main bookkeeping or physical watcher-process cleanup. The separate read/preview client suite loses forwarding, supplied-error and negative-only examples, retaining binary detection and Unicode SVG decoding. Historical evidence commands/results are unchanged. Test-value audit1293 removes src/main/providers/local-pty/local-pty-provider-session-inventory.test.ts (2 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1312 removes low-value imported specs from aggregate test drivers; old whole-driver execution receipts are archived. Retained registrations are unchanged. No equivalent replacement coverage is claimed. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://github.com/stablyai/orca/issues/5308", "https://github.com/stablyai/orca/issues/7547", "https://github.com/stablyai/orca/issues/8212" ], "invariant": "Local runtime and SSH relay roots share one watcher child per host process while healthy and use at most four quarantine children after shard failure; native desktop, paired-runtime, and direct WSL snapshot children consume the same process-wide eight-child reservation and retry transient exhaustion without permanently disabling a root. Cancellation remains owned by its child generation and settles only after acknowledgement or bounded physical exit; paired-web retains cleanup ownership and can cancel before readiness even while capacity is exhausted, retries a failed unwatch after already-resolved or late physical exit without duplicating stream termination, replacements never overlap a still-retiring generation, and aborted or timed-out callers detach immediately even while queued behind same-root relay teardown. Destructive local and SSH cleanup holds one containment-aware watcher/terminal removal fence through descendant watcher and PTY physical exit plus parent Git/filesystem deletion; daemon and relay kill requests retain ownership until the actual subprocess exit callback or an equivalent positive dead-PID proof and propagate rejected signals or a bounded failure otherwise. A crash-fused shared shard moves affected roots into the bounded quarantine pool, a second fused quarantine ends those watch lifetimes, interrupted setup emits overflow after recovery, metadata work stays bounded, and the SSH relay, PTYs, Git, and other filesystem operations never load the watcher native addon or share its fault boundary.", - "oracle": "Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/files-watch-cleanup.test.ts --reporter=dot", "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-unsubscribe-timeout.test.ts --reporter=dot", @@ -16989,17 +16855,6 @@ "remote provider enumeration matches authoritative worktree ownership without touching the local-only registry" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "destructive worktree teardown awaits controller stopAndWait instead of treating fire-and-forget kill as physical exit", - "runtime worktree deletion never starts Git removal when a known PTY cannot be physically stopped", - "SSH runtime deletion shuts down an authoritatively owned remote PTY before remote Git removal", - "a delayed physical-exit retry remains scoped to its registered cleanup owner and cannot tear down a same-id replacement", - "failed CLI worktree deletion restores watcher ownership after releasing the install fence", - "cross-layer teardown failure joins every bounded watcher close before restoration begins" - ] - }, { "file": "src/main/runtime/rpc/methods/files.test.ts", "assertions": [ @@ -17253,7 +17108,8 @@ "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty/local-pty-provider-shutdown.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts\",\"result\":\"passed\",\"durationSeconds\":29.2,\"summary\":\"Test Files 26 passed (26); Tests 1924 passed | 3 skipped (1927). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty/pty-listener-teardown-and-orphans.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts\",\"result\":\"passed\",\"durationSeconds\":27.48,\"summary\":\"Test Files 24 passed (24); Tests 1839 passed | 3 skipped (1842). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}", "Retired during audit1312 aggregate-driver import cleanup; original complete execution receipt (unchanged): {\"date\":\"2026-11-04\",\"runner\":\"local\",\"platform\":\"linux\",\"command\":\"ORCA_BACKGROUND_LAUNCH=1 pnpm --config.verifyDepsBeforeRun=false test src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts --maxWorkers=2\",\"currentCommand\":\"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-disconnect-termination.test.ts src/main/ipc/filesystem/watcher-process/runtime-watcher-process-pool.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-process-entry.test.ts src/main/ipc/filesystem/watcher-process/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem/watchers/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/workspaces/removal/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/renderer/src/runtime/runtime-file-client-watch.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts\",\"result\":\"passed\",\"durationSeconds\":26.75,\"summary\":\"Test Files 20 passed (20); Tests 1764 passed | 3 skipped (1767). Deterministic fixtures; no physical phone or deployed mixed-host claim.\"}", - "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed." + "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"destructive worktree teardown awaits controller stopAndWait instead of treating fire-and-forget kill as physical exit\",\"runtime worktree deletion never starts Git removal when a known PTY cannot be physically stopped\",\"SSH runtime deletion shuts down an authoritatively owned remote PTY before remote Git removal\",\"a delayed physical-exit retry remains scoped to its registered cleanup owner and cannot tear down a same-id replacement\",\"failed CLI worktree deletion restores watcher ownership after releasing the install fence\",\"cross-layer teardown failure joins every bounded watcher close before restoration begins\"]}]" ], "demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds one runtime watcher child, if total physical operation exceeds eight children including retiring generations, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process." }, @@ -18383,7 +18239,7 @@ "providers": ["local", "remote-runtime", "ssh", "wsl"], "coveredPlatforms": ["macos"], "coveredProviders": ["local"], - "coverageNotes": "The owner-boundary contract injects an isolated BrowserManager, offscreen WebContents, and AgentBrowserBridge. It proves explicit close removes the page from command routing before awaiting exact named-session retirement, runs retirement on unexpected renderer destruction, preserves unrelated pages, joins pending creation/retirement during shutdown, rejects command admission after terminal cleanup begins, retries Electron quit after a vetoed signal, preserves Windows shared-console graceful Ctrl-C, reserves the full renderer-acknowledgement and committed-teardown budgets before supervisor force-kill, bounds process-swap retirement to five seconds, and caps cleanup concurrency at four. A built-CLI macOS headless serve run used an isolated profile, folder workspace, socket directory, and port: exact PPID-1 helper/session identity disappeared within five seconds after page close and after Ctrl-C runtime shutdown, while an unrelated page survived close and reconnect. Linux cgroup and paired/SSH journeys remain gaps. Audit1379 changes src/main/browser/cdp/snapshots/snapshot-engine-iframe-sessions.test.ts (3 authored registrations removed; 0 retained); src/main/browser/client-hosts/file-transfers/browser-client-download-routing.test.ts (3 authored registrations removed; 4 retained). Intentional losses: Loses ref/string/Map.get-count projections; no real browser operation. Intentionally removes 3 authored registrations: 'cancels a client-hosted download whose owner cannot be resolved'; 'leaves ordinary browser guests on their desktop Downloads path'; 'stops routing to a composition once it starts closing'. Retained focused cases are not claimed as equivalent replacement for these losses. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts and primary claims remain scoped to their unchanged sources; the broad optional selector has no new execution result. Audit1383: src/main/browser/guest-lifecycle/browser-guest-devtools-dock.test.ts reduced. Lose capture failure baseline and destroyed-host callback control. Fake Electron view models native lifecycle and custody; no native rendering/visible focus claimed. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1390: src/main/browser/agent-browser/agent-browser-action-effects.test.ts reduced. No standalone baseline snapshot call-count alarm. src/main/browser/routing/partitions/browser-route-partition-stability.test.ts removed. Standalone assembled partition stability/separation/binding-count alarms across runtime/SSH/WSL/environment identity removed. No real browser cookie/session continuity or replacement equivalence is claimed. src/main/browser/element-grab/browser-grab-payload.test.ts reduced. Standalone annotation clamp/list-count/default preservation characterization removed. src/main/browser/cdp/input/guest-focused-frame-route.test.ts reduced. Attach-call count, default widget fallback and claimed detach-forgetting alarm removed; no actual Chromium frame/input delivery claimed. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts removed. Deletes entire one-registration native Electron baseline/protected UDP probe, including fixture shell and packet observer. No equivalent actual network egress proof is claimed; actual Orca policy owner reviewed separately. src/main/browser/cdp/screencast/browser-screencast-live-frame-allocation.test.ts reduced. Retires captured PNG/JPEG twelve-frame digest/metadata/ack replay bundled with zero copied-byte instrumentation; surviving retry ownership witness is not claimed equivalent format or sequence coverage. src/main/browser/extensions/context-menus/browser-extension-context-menu-model.test.ts reduced. Toolbar-context constant membership, wrapper submenu structure and click-data property projection no longer independently asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/browser/cookies/sources/browser-cookie-source-partition.test.ts reduced. Lose standalone true identity projections, default-schema/unpartitioned examples and repeated raw flag/object type rejection alarms; retained cases are not claimed equivalent coverage. src/main/browser/routing/partitions/browser-route-partition-storage-runtime.test.ts reduced. Lose callback error propagation/no-clear alarm; file-backed pending queue and production lifecycle remain exercised. src/main/browser/client-hosts/file-transfers/browser-client-download-relay.test.ts reduced. Lose standalone successful destination projection and first/final offset expectations; no replacement delivery proof claimed. src/main/browser/cdp/screencast/browser-screencast-guest-view-limit.test.ts reduced. Lose the direct 320x240 floor example; modeled CDP frames do not prove native compositor pixels. src/main/browser/identity/browser-identity-mode-store.test.ts reduced. Lose basic last-assignment-wins example; no asynchronous write race is exercised. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", + "coverageNotes": "The owner-boundary contract injects an isolated BrowserManager, offscreen WebContents, and AgentBrowserBridge. It proves explicit close removes the page from command routing before awaiting exact named-session retirement, runs retirement on unexpected renderer destruction, preserves unrelated pages, joins pending creation/retirement during shutdown, rejects command admission after terminal cleanup begins, retries Electron quit after a vetoed signal, preserves Windows shared-console graceful Ctrl-C, reserves the full renderer-acknowledgement and committed-teardown budgets before supervisor force-kill, bounds process-swap retirement to five seconds, and caps cleanup concurrency at four. A built-CLI macOS headless serve run used an isolated profile, folder workspace, socket directory, and port: exact PPID-1 helper/session identity disappeared within five seconds after page close and after Ctrl-C runtime shutdown, while an unrelated page survived close and reconnect. Linux cgroup and paired/SSH journeys remain gaps. Audit1379 changes src/main/browser/cdp/snapshots/snapshot-engine-iframe-sessions.test.ts (3 authored registrations removed; 0 retained); src/main/browser/client-hosts/file-transfers/browser-client-download-routing.test.ts (3 authored registrations removed; 4 retained). Intentional losses: Loses ref/string/Map.get-count projections; no real browser operation. Intentionally removes 3 authored registrations: 'cancels a client-hosted download whose owner cannot be resolved'; 'leaves ordinary browser guests on their desktop Downloads path'; 'stops routing to a composition once it starts closing'. Retained focused cases are not claimed as equivalent replacement for these losses. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts and primary claims remain scoped to their unchanged sources; the broad optional selector has no new execution result. Audit1383: src/main/browser/guest-lifecycle/browser-guest-devtools-dock.test.ts reduced. Lose capture failure baseline and destroyed-host callback control. Fake Electron view models native lifecycle and custody; no native rendering/visible focus claimed. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1390: src/main/browser/agent-browser/agent-browser-action-effects.test.ts reduced. No standalone baseline snapshot call-count alarm. src/main/browser/routing/partitions/browser-route-partition-stability.test.ts removed. Standalone assembled partition stability/separation/binding-count alarms across runtime/SSH/WSL/environment identity removed. No real browser cookie/session continuity or replacement equivalence is claimed. src/main/browser/element-grab/browser-grab-payload.test.ts reduced. Standalone annotation clamp/list-count/default preservation characterization removed. src/main/browser/cdp/input/guest-focused-frame-route.test.ts reduced. Attach-call count, default widget fallback and claimed detach-forgetting alarm removed; no actual Chromium frame/input delivery claimed. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts removed. Deletes entire one-registration native Electron baseline/protected UDP probe, including fixture shell and packet observer. No equivalent actual network egress proof is claimed; actual Orca policy owner reviewed separately. src/main/browser/cdp/screencast/browser-screencast-live-frame-allocation.test.ts reduced. Retires captured PNG/JPEG twelve-frame digest/metadata/ack replay bundled with zero copied-byte instrumentation; surviving retry ownership witness is not claimed equivalent format or sequence coverage. src/main/browser/extensions/context-menus/browser-extension-context-menu-model.test.ts reduced. Toolbar-context constant membership, wrapper submenu structure and click-data property projection no longer independently asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/browser/cookies/sources/browser-cookie-source-partition.test.ts reduced. Lose standalone true identity projections, default-schema/unpartitioned examples and repeated raw flag/object type rejection alarms; retained cases are not claimed equivalent coverage. src/main/browser/routing/partitions/browser-route-partition-storage-runtime.test.ts reduced. Lose callback error propagation/no-clear alarm; file-backed pending queue and production lifecycle remain exercised. src/main/browser/client-hosts/file-transfers/browser-client-download-relay.test.ts reduced. Lose standalone successful destination projection and first/final offset expectations; no replacement delivery proof claimed. src/main/browser/cdp/screencast/browser-screencast-guest-view-limit.test.ts reduced. Lose the direct 320x240 floor example; modeled CDP frames do not prove native compositor pixels. src/main/browser/identity/browser-identity-mode-store.test.ts reduced. Lose basic last-assignment-wins example; no asynchronous write race is exercised. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/browser/client-hosts/file-transfers/browser-client-file-channel-negotiation.test.ts removed. Loses file-channel negotiation refusal at the schema parse boundary; no replacement asserted. src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. src/main/browser/client-hosts/file-transfers/browser-client-upload-command.test.ts removed. Loses original upload-error priority when cleanup also fails and staging-release alarm. src/main/browser/extensions/installation/browser-extension-install-store.test.ts reduced. Loses install-directory path escape refusal alarm from the unpinned exception case. src/main/browser/routing/local-host-partitions/wsl-host-browser-jar-identity.test.ts removed. Loses WSL deploy/rename/reimport cookie-jar identity helper alarms without actual page/storage attachment. src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-identity-wiring.test.ts removed. Loses profile-stable versus profile-isolated host identity composition alarms. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", "motivatingLinks": [ "https://linear.app/stably/issue/STA-5400", "https://github.com/stablyai/orca/issues/16367" @@ -18482,7 +18338,8 @@ "Audit1383: src/main/browser/guest-lifecycle/browser-guest-devtools-dock.test.ts reduced. Lose capture failure baseline and destroyed-host callback control. Fake Electron view models native lifecycle and custody; no native rendering/visible focus claimed. No equivalent replacement coverage is claimed.", "Audit1390: src/main/browser/agent-browser/agent-browser-action-effects.test.ts reduced. No standalone baseline snapshot call-count alarm. src/main/browser/routing/partitions/browser-route-partition-stability.test.ts removed. Standalone assembled partition stability/separation/binding-count alarms across runtime/SSH/WSL/environment identity removed. No real browser cookie/session continuity or replacement equivalence is claimed. src/main/browser/element-grab/browser-grab-payload.test.ts reduced. Standalone annotation clamp/list-count/default preservation characterization removed. src/main/browser/cdp/input/guest-focused-frame-route.test.ts reduced. Attach-call count, default widget fallback and claimed detach-forgetting alarm removed; no actual Chromium frame/input delivery claimed. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", "Audit1396: src/main/browser/network/egress/browser-route-webrtc-egress.electron.test.ts removed. Deletes entire one-registration native Electron baseline/protected UDP probe, including fixture shell and packet observer. No equivalent actual network egress proof is claimed; actual Orca policy owner reviewed separately. src/main/browser/cdp/screencast/browser-screencast-live-frame-allocation.test.ts reduced. Retires captured PNG/JPEG twelve-frame digest/metadata/ack replay bundled with zero copied-byte instrumentation; surviving retry ownership witness is not claimed equivalent format or sequence coverage. src/main/browser/extensions/context-menus/browser-extension-context-menu-model.test.ts reduced. Toolbar-context constant membership, wrapper submenu structure and click-data property projection no longer independently asserted. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", - "Audit1400: src/main/browser/cookies/sources/browser-cookie-source-partition.test.ts reduced. Lose standalone true identity projections, default-schema/unpartitioned examples and repeated raw flag/object type rejection alarms; retained cases are not claimed equivalent coverage. src/main/browser/routing/partitions/browser-route-partition-storage-runtime.test.ts reduced. Lose callback error propagation/no-clear alarm; file-backed pending queue and production lifecycle remain exercised. src/main/browser/client-hosts/file-transfers/browser-client-download-relay.test.ts reduced. Lose standalone successful destination projection and first/final offset expectations; no replacement delivery proof claimed. src/main/browser/cdp/screencast/browser-screencast-guest-view-limit.test.ts reduced. Lose the direct 320x240 floor example; modeled CDP frames do not prove native compositor pixels. src/main/browser/identity/browser-identity-mode-store.test.ts reduced. Lose basic last-assignment-wins example; no asynchronous write race is exercised. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." + "Audit1400: src/main/browser/cookies/sources/browser-cookie-source-partition.test.ts reduced. Lose standalone true identity projections, default-schema/unpartitioned examples and repeated raw flag/object type rejection alarms; retained cases are not claimed equivalent coverage. src/main/browser/routing/partitions/browser-route-partition-storage-runtime.test.ts reduced. Lose callback error propagation/no-clear alarm; file-backed pending queue and production lifecycle remain exercised. src/main/browser/client-hosts/file-transfers/browser-client-download-relay.test.ts reduced. Lose standalone successful destination projection and first/final offset expectations; no replacement delivery proof claimed. src/main/browser/cdp/screencast/browser-screencast-guest-view-limit.test.ts reduced. Lose the direct 320x240 floor example; modeled CDP frames do not prove native compositor pixels. src/main/browser/identity/browser-identity-mode-store.test.ts reduced. Lose basic last-assignment-wins example; no asynchronous write race is exercised. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", + "Audit1401: src/main/browser/client-hosts/file-transfers/browser-client-file-channel-negotiation.test.ts removed. Loses file-channel negotiation refusal at the schema parse boundary; no replacement asserted. src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. src/main/browser/client-hosts/file-transfers/browser-client-upload-command.test.ts removed. Loses original upload-error priority when cleanup also fails and staging-release alarm. src/main/browser/extensions/installation/browser-extension-install-store.test.ts reduced. Loses install-directory path escape refusal alarm from the unpinned exception case. src/main/browser/routing/local-host-partitions/wsl-host-browser-jar-identity.test.ts removed. Loses WSL deploy/rename/reimport cookie-jar identity helper alarms without actual page/storage attachment. src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-identity-wiring.test.ts removed. Loses profile-stable versus profile-isolated host identity composition alarms. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." ], "demotionRule": "Demote if a closed or destroyed page leaves its exact named helper session, if quit can exit before helper retirement settles, if unrelated live pages are retired, or if cleanup regresses to a global process-name kill or timer-only sweep." }, @@ -19160,14 +19017,14 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh"], - "coverageNotes": "Temporary SQLite databases and fake-clock/provider contracts cover assignment repair, uncertain starts/stops, missing git/folder workspaces, owning SSH inventories, and rejection of foreign paired-runtime PTYs. Hidden macOS Electron journeys retain real daemon PTYs. A macOS client against a Debian ARM64 Docker SSH host proves historical repair preserves terminal ownership, the same live shell and background child, input and rendered output through app restart and SSH reconnect. Native Linux/Windows desktop, WSL and active-worker remote absence/deleted-folder journeys remain gaps; no execution commands or wire payloads change. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1390: src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts removed. Retires compile-count, SQL-shape and self-derived repeated-publication alarms. No independent dispatch/task outcome asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/runtime/orchestration/agent-facing-parity.test.ts reduced. Whole chat-versus-terminal preamble equality and incidental identity wording assertions no longer independently asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-abandon.test.ts reduced. Lose fallback attribution wording and repeat-abandon result characterization, preserving actual state/resource transition alarms. src/main/runtime/orchestration/crew/crew-read-model-invalidation.test.ts reduced. Lose SQL preparation optimization alarm for unrelated mailbox traffic. src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts reduced. Lose generic retry identity/default-generation example. First two cases seed replacement generation through fixture SQL; they do not prove a production reattach path. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result.", + "coverageNotes": "Temporary SQLite databases and fake-clock/provider contracts cover assignment repair, uncertain starts/stops, missing git/folder workspaces, owning SSH inventories, and rejection of foreign paired-runtime PTYs. Hidden macOS Electron journeys retain real daemon PTYs. A macOS client against a Debian ARM64 Docker SSH host proves historical repair preserves terminal ownership, the same live shell and background child, input and rendered output through app restart and SSH reconnect. Native Linux/Windows desktop, WSL and active-worker remote absence/deleted-folder journeys remain gaps; no execution commands or wire payloads change. Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed. Existing exact unaffected receipts and their platform/provider/budget claims remain scoped to unchanged selectors. Changed optional selectors have no new execution result. Audit1390: src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts removed. Retires compile-count, SQL-shape and self-derived repeated-publication alarms. No independent dispatch/task outcome asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1396: src/main/runtime/orchestration/agent-facing-parity.test.ts reduced. Whole chat-versus-terminal preamble equality and incidental identity wording assertions no longer independently asserted. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1400: src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-abandon.test.ts reduced. Lose fallback attribution wording and repeat-abandon result characterization, preserving actual state/resource transition alarms. src/main/runtime/orchestration/crew/crew-read-model-invalidation.test.ts reduced. Lose SQL preparation optimization alarm for unrelated mailbox traffic. src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts reduced. Lose generic retry identity/default-generation example. First two cases seed replacement generation through fixture SQL; they do not prove a production reattach path. No equivalent replacement coverage is claimed. The existing primary-selector receipt and its claims remain scoped to their unchanged sources; the broad optional command has no new execution result. Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Existing exact unaffected receipts remain unchanged and apply only to their unchanged selectors. Changed optional selectors have no new execution result.", "motivatingLinks": [ "https://stablygroup.slack.com/archives/C0AK2T3JEF4/p1791225819076759", "https://github.com/stablyai/orca/pull/11271", "https://github.com/stablyai/orca/pull/22612" ], "invariant": "Completing an assignment settles its active worker bookkeeping in the same transaction without asserting process exit or releasing a terminal. Historical settled assignments converge on database open; an additive active-worker index excludes finished history, and healthy checks do not take a writer lock. Missing workspaces require owning-provider evidence before exact-incarnation retirement; a restarted relay's empty inventory and loss of contact are unverifiable. Automatic retries retain unresolved assignments without revisiting settled workers or persisting empty batches; late availability converges without user intervention.", - "oracle": "Reopen historical completed/failed/circuit-broken PTY, structured and handle-less assignments and require no active recovery rows; preserve genuine report outcomes, pending unknown workers, diagnostics and terminal resources. Inject settlement failure and require complete transaction rollback. Resolve each workspace once per pass, recheck it on later passes, and query 100 missing-workspace candidates once per provider, preserve live/unidentified PTYs and wrong-host SSH evidence. Advance fake time ten minutes and require zero persistence for unresolved passes and no repeated settlement. Make a host verifiable after two minutes and require automatic convergence and timer cleanup. Require indexed SQL lookups for only the requested assignments, one query shape across batch sizes, and recovery after a failed SQL read. Require the actual startup query to use the active-worker partial index, let healthy repair finish under a competing writer lock, and repair stale rows introduced by an older SQL writer after the first repair. Check all 45 assignment/worker state combinations and idempotent reopen; inject failure on the second startup repair and require complete rollback. Measure 100,000 historical assignments with 1,000 stale workers and require zero writes on the next repair pass. On a real SSH host, require settled worker bookkeeping with unchanged terminal ownership, shell PID, background child PID, environment and working directory through restart and reconnect, with rendered input/output proof.", + "oracle": "Existing exact unchanged-selector receipts remain the only current execution evidence. Changed source selectors have no fresh execution result. Historical prior-source oracle account: Reopen historical completed/failed/circuit-broken PTY, structured and handle-less assignments and require no active recovery rows; preserve genuine report outcomes, pending unknown workers, diagnostics and terminal resources. Inject settlement failure and require complete transaction rollback. Resolve each workspace once per pass, recheck it on later passes, and query 100 missing-workspace candidates once per provider, preserve live/unidentified PTYs and wrong-host SSH evidence. Advance fake time ten minutes and require zero persistence for unresolved passes and no repeated settlement. Make a host verifiable after two minutes and require automatic convergence and timer cleanup. Require indexed SQL lookups for only the requested assignments, one query shape across batch sizes, and recovery after a failed SQL read. Require the actual startup query to use the active-worker partial index, let healthy repair finish under a competing writer lock, and repair stale rows introduced by an older SQL writer after the first repair. Check all 45 assignment/worker state combinations and idempotent reopen; inject failure on the second startup repair and require complete rollback. Measure 100,000 historical assignments with 1,000 stale workers and require zero writes on the next repair pass. On a real SSH host, require settled worker bookkeeping with unchanged terminal ownership, shell PID, background child PID, environment and working directory through restart and reconnect, with rendered input/output proof.", "commands": [ "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts tests/e2e/cross-version-wire/orchestration-delivery-downgrade.unit.test.ts", "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/runtime/orchestration/worker-dispatch-settlement.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts src/main/runtime/runtime-legacy-worker-missing-workspace-recovery.test.ts src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.test.ts src/main/runtime/orchestration/worker-dispatch-repair-safety.test.ts", @@ -19213,12 +19070,6 @@ "foreign provider identities do not start local recovery timers" ] }, - { - "file": "src/main/runtime/orca-runtime.test.ts", - "assertions": [ - "recovery starts zero foreground-process probes while an explicit status refresh still reads its requested terminal" - ] - }, { "file": "src/main/runtime/orchestration/worker-dispatch-repair-safety.test.ts", "assertions": [ @@ -19285,7 +19136,8 @@ "Audit1383: src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts reduced. Lose command-list/receipt/default/background activation matrices whose provider spawn returns canned IDs. Retained test proves actual tab allocation separation, not terminal startup. No equivalent replacement coverage is claimed.", "Audit1390: src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts removed. Retires compile-count, SQL-shape and self-derived repeated-publication alarms. No independent dispatch/task outcome asserted. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", "Audit1396: src/main/runtime/orchestration/agent-facing-parity.test.ts reduced. Whole chat-versus-terminal preamble equality and incidental identity wording assertions no longer independently asserted. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", - "Audit1400: src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-abandon.test.ts reduced. Lose fallback attribution wording and repeat-abandon result characterization, preserving actual state/resource transition alarms. src/main/runtime/orchestration/crew/crew-read-model-invalidation.test.ts reduced. Lose SQL preparation optimization alarm for unrelated mailbox traffic. src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts reduced. Lose generic retry identity/default-generation example. First two cases seed replacement generation through fixture SQL; they do not prove a production reattach path. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged." + "Audit1400: src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-abandon.test.ts reduced. Lose fallback attribution wording and repeat-abandon result characterization, preserving actual state/resource transition alarms. src/main/runtime/orchestration/crew/crew-read-model-invalidation.test.ts reduced. Lose SQL preparation optimization alarm for unrelated mailbox traffic. src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts reduced. Lose generic retry identity/default-generation example. First two cases seed replacement generation through fixture SQL; they do not prove a production reattach path. No equivalent replacement coverage is claimed. Existing exact primary-selector receipts remain unchanged.", + "Audit1401: src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts removed. Loses listing-on-already-repaired-data alarm; it never established runtime repair invocation. src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts removed. Loses actual mobile split sibling shell versus recorded-agent resume command alarms; no equivalent coverage asserted. src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts removed. Loses separate setup/startup tab result in that manually assembled path. src/main/runtime/orca-runtime.test.ts reduced. Driver registration/import of a whole-deleted selected spec is removed; directly authored cases remain unchanged. No extra authored removal credit. No equivalent replacement coverage is claimed. Historical removed assertion inventory: [{\"file\":\"src/main/runtime/orca-runtime.test.ts\",\"assertions\":[\"recovery starts zero foreground-process probes while an explicit status refresh still reads its requested terminal\"]}]" ], "promotionCriteria": [ "Collect cross-platform and provider soak evidence with no weakened identity, transaction or bounded-work assertions." diff --git a/config/scripts/ci-shard-timings.json b/config/scripts/ci-shard-timings.json index c7a5c4f1fa6..d330af861ec 100644 --- a/config/scripts/ci-shard-timings.json +++ b/config/scripts/ci-shard-timings.json @@ -1089,7 +1089,6 @@ "src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-sqlite-process.test.ts": 3815, "src/main/ai-vault/scanners/opencode/sqlite/session-scanner-opencode-sqlite-scan-scope.test.ts": 54, "src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-sqlite-worker-client.test.ts": 181, - "src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-sqlite-worker-spawn.test.ts": 180, "src/main/ai-vault/scanners/opencode/sqlite/session-scanner-opencode-sqlite.test.ts": 410, "src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-wsl-routing.test.ts": 200, "src/main/ai-vault/scanners/opencode2/session-scanner-opencode2-message.test.ts": 138, @@ -1200,7 +1199,6 @@ "src/main/automations/runtime-terminal-run-observer-evidence.test.ts": 230, "src/main/automations/runtime-terminal-run-observer.test.ts": 4026, "src/main/automations/schedule-drift-report.test.ts": 83, - "src/main/automations/service-lifecycle.test.ts": 1952, "src/main/automations/service-precheck.test.ts": 2057, "src/main/automations/service.test.ts": 2970, "src/main/azure-devops/client.test.ts": 411, @@ -1235,7 +1233,6 @@ "src/main/browser/certificate-trust/browser-certificate-trust-controller.test.ts": 496, "src/main/browser/client-hosts/file-transfers/browser-client-download-relay.test.ts": 124, "src/main/browser/client-hosts/file-transfers/browser-client-download-routing.test.ts": 124, - "src/main/browser/client-hosts/file-transfers/browser-client-file-channel-negotiation.test.ts": 116, "src/main/browser/client-hosts/file-transfers/browser-client-file-channel-reconnect.test.ts": 556, "src/main/browser/client-hosts/lifecycle/browser-client-host-authority-replacement.test.ts": 47, "src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts": 156, @@ -1260,7 +1257,6 @@ "src/main/browser/cookies/client-route/browser-client-route-cookie-import-partition-parity.test.ts": 374, "src/main/browser/cookies/client-route/browser-client-route-cookie-import.test.ts": 101, "src/main/browser/client-hosts/file-transfers/browser-client-upload-buffer-retention.test.ts": 736, - "src/main/browser/client-hosts/file-transfers/browser-client-upload-command.test.ts": 115, "src/main/browser/client-hosts/file-transfers/browser-client-upload-staging.test.ts": 140, "src/main/browser/client-hosts/file-transfers/browser-client-upload-transfer.test.ts": 93, "src/main/browser/cdp/input/browser-element-functions.test.ts": 228, @@ -1471,7 +1467,6 @@ "src/main/browser/routing/local-host-partitions/local-ssh-browser-route.test.ts": 92, "src/main/browser/backends/offscreen-browser-backend-lifecycle.test.ts": 341, "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts": 165, - "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-identity-wiring.test.ts": 1368, "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts": 568, "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts": 53, "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-route-identity.test.ts": 1404, @@ -1490,7 +1485,6 @@ "src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts": 53, "src/main/browser/network/execution-routes/wsl-browser-network-execution-route.test.ts": 678, "src/main/browser/network/execution-routes/wsl-browser-network-relay-launch.test.ts": 146, - "src/main/browser/routing/local-host-partitions/wsl-host-browser-jar-identity.test.ts": 806, "src/main/browser/routing/local-host-partitions/wsl-host-browser-route-partition.test.ts": 753, "src/main/claude-accounts/claude-account-folder.test.ts": 153, "src/main/claude-accounts/claude-account-service.test.ts": 1207, @@ -1755,7 +1749,6 @@ "src/main/codex-accounts/runtime-home-windows-profile-ownership.test.ts": 359, "src/main/codex-accounts/runtime-home-wsl-managed-accounts.test.ts": 1199, "src/main/codex-accounts/runtime-home-wsl-session-bridge.test.ts": 1018, - "src/main/codex-accounts/runtime-home-wsl-sibling-bridge.test.ts": 545, "src/main/codex-accounts/runtime-home-wsl-system-default.test.ts": 758, "src/main/codex-accounts/service-abandoned-login-supersede.test.ts": 780, "src/main/codex-accounts/service-account-add-login.test.ts": 757, @@ -2175,7 +2168,6 @@ "src/main/daemon/daemon-session-owner-resolution.test.ts": 114, "src/main/daemon/daemon-session-scrollback-window.test.ts": 554, "src/main/daemon/daemon-severed-restart.test.ts": 629, - "src/main/daemon/daemon-shared-owner-incarnation-retention.test.ts": 1025, "src/main/daemon/daemon-shutdown-final-checkpoint-caller-deadline.test.ts": 2543, "src/main/daemon/daemon-socket-endpoint-path.test.ts": 529, "src/main/daemon/daemon-spawner.test.ts": 708, @@ -2408,7 +2400,6 @@ "src/main/git/command-runner/git-admission-output-parity.test.ts": 271, "src/main/git/command-runner/git-admission-storm-measurement.test.ts": 264, "src/main/git/command-runner/git-command-resolution-windows-checkout.test.ts": 133, - "src/main/git/command-runner/git-command-timeout-behavior.test.ts": 2006, "src/main/git/command-runner/git-exec-admission-lifetime.test.ts": 718, "src/main/git/command-runner/git-operation-executor.test.ts": 59, "src/main/git/command-runner/git-spawn-wsl-admission.test.ts": 153, @@ -2479,7 +2470,6 @@ "src/main/git/runner-wsl-network-ssh-policy.test.ts": 260, "src/main/git/runner.test.ts": 284, "src/main/git/saved-clone-target.test.ts": 890, - "src/main/git/source-control/settled-diff-cache-bounds.test.ts": 71, "src/main/git/source-control/blob-absence-real-git.test.ts": 629, "src/main/git/source-control/complete-merge-real-git.test.ts": 958, "src/main/git/source-control/diff-textconv-real-git.test.ts": 520, @@ -2525,7 +2515,6 @@ "src/main/git/worktrees/creation/worktree-base-refresh-lock-real-git.test.ts": 1588, "src/main/git/worktrees/creation/worktree-checkout-progress-real-git.test.ts": 769, "src/main/git/worktrees/creation/worktree-configured-paths-concurrency.test.ts": 80, - "src/main/git/worktrees/creation/worktree-create-git-executor-real-git.test.ts": 528, "src/main/git/worktrees/creation/worktree-create-preparation-real-git.test.ts": 1858, "src/main/git/worktrees/creation/worktree-create-preparation-real-wsl.test.ts": 382, "src/main/git/worktrees/catalog/worktree-created-description-real-git.test.ts": 1119, @@ -2554,10 +2543,8 @@ "src/main/git/worktrees/creation/worktree-preparation-tip-refresh-real-git.test.ts": 844, "src/main/git/worktrees/creation/worktree-preparation-tip-refresh.test.ts": 113, "src/main/git/worktrees/removal/worktree-prune-guard.test.ts": 159, - "src/main/git/worktrees/removal/worktree-rebase-update-refs-real-git.test.ts": 284, "src/main/git/worktrees/removal/worktree-removal-real-git.test.ts": 3365, "src/main/git/worktrees/removal/worktree-remove-branch-deletion.test.ts": 353, - "src/main/git/worktrees/creation/worktree-safety-real-git.test.ts": 549, "src/main/git/worktrees/catalog/worktree-scan-cache-annotation-reuse.test.ts": 361, "src/main/git/worktrees/catalog/worktree-separate-git-dir.test.ts": 689, "src/main/git/worktrees/content-paths/worktree-shared-directories.test.ts": 1045, @@ -2770,7 +2757,6 @@ "src/main/ipc/created-worktree-root-prune.test.ts": 494, "src/main/ipc/dashboard-payload-validation.test.ts": 188, "src/main/ipc/dashboard-popout.test.ts": 124, - "src/main/ipc/browser/desktop-browser-bridge-wiring.test.ts": 1211, "src/main/ipc/developer-permissions.test.ts": 147, "src/main/ipc/diagnostics.test.ts": 124, "src/main/ipc/doc-preview-grant-ipc.test.ts": 58, @@ -2869,7 +2855,6 @@ "src/main/ipc/folder-repo-git-upgrade-lifetime.test.ts": 123, "src/main/ipc/folder-repo-git-upgrade.test.ts": 2302, "src/main/ipc/worktrees/git/git-status-upstream-ref-watch-request.test.ts": 405, - "src/main/ipc/source-control/github-pr-refresh-document-lifetime.test.ts": 120, "src/main/ipc/source-control/github-pr-refresh-routing.test.ts": 715, "src/main/ipc/source-control/github-repo-access-guards.test.ts": 805, "src/main/ipc/source-control/github-repo-routing-twin-host.test.ts": 124, @@ -2958,12 +2943,10 @@ "src/main/ipc/pty/host-env/spawn-cwd-hung-folder.test.ts": 650, "src/main/ipc/pty/host-env/spawn-cwd-wsl-move.test.ts": 817, "src/main/ipc/pty/ipc/claude-old-terminal.test.ts": 47, - "src/main/ipc/pty/ipc/closed-pane-spawn-refusal.test.ts": 242, "src/main/ipc/pty/ipc/spawn-commit-run-facts.test.ts": 1661, "src/main/ipc/pty/ipc/spawn-options-codex-isolation.test.ts": 1115, "src/main/ipc/pty/ipc/spawn-push-target-materialization-real-git.test.ts": 1316, "src/main/ipc/pty/ipc/spawn-reattach-size-cache.test.ts": 1459, - "src/main/ipc/pty/ipc/terminal-view-attributes-ipc.test.ts": 516, "src/main/ipc/pty/ipc/write-input-user-input.test.ts": 84, "src/main/ipc/pty/managed-data-account-spawn-environment.test.ts": 1150, "src/main/ipc/pty/opencode-legacy-spawn-deletions.test.ts": 1214, @@ -3010,7 +2993,6 @@ "src/main/ipc/pty/pty-serializer-settlement-mapping.test.ts": 4245, "src/main/ipc/pty/pty-session-liveness-and-ownership.test.ts": 3423, "src/main/ipc/pty/pty-spawn-codex-home-unavailable.test.ts": 4208, - "src/main/ipc/pty/pty-spawn-cwd-fallback-hung-folder.test.ts": 3949, "src/main/ipc/pty/pty-spawn-cwd-fallback.test.ts": 4680, "src/main/ipc/pty/pty-spawn-env-agent-overlays.test.ts": 3981, "src/main/ipc/pty/pty-spawn-env-codex-home-routing.test.ts": 6383, @@ -3317,7 +3299,6 @@ "src/main/workspaces/removal/local-worktree-filesystem-wsl-banner.wsl.test.ts": 84, "src/main/workspaces/removal/local-worktree-filesystem.test.ts": 4284, "src/main/workspaces/catalog/local-worktree-metadata-prune-gate.test.ts": 41, - "src/main/workspaces/catalog/local-worktree-path-presence.test.ts": 52, "src/main/workspaces/removal/local-worktree-removal-recovery-live.test.ts": 465, "src/main/workspaces/removal/local-worktree-removal-recovery.test.ts": 351, "src/main/ports/workspace-labels/localhost-worktree-label-proxy.test.ts": 120, @@ -3421,9 +3402,7 @@ "src/main/memory/collector.test.ts": 925, "src/main/memory/host-malloc-tunables.test.ts": 41, "src/main/memory/host-memory.test.ts": 80, - "src/main/memory/hydrate-local-pty-registry-folder-workspaces.test.ts": 535, "src/main/memory/hydrate-local-pty-registry.test.ts": 1970, - "src/main/memory/memory-snapshot-buckets.test.ts": 113, "src/main/memory/verified-local-folder-workspaces.test.ts": 74, "src/main/menu/register-app-menu.test.ts": 280, "src/main/mimo/hook-service.test.ts": 115, @@ -3526,7 +3505,6 @@ "src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts": 1049, "src/main/native-chat/agent-session-wire/agent-session-item-wire-form.test.ts": 2246, "src/main/native-chat/agent-session-wire/agent-session-stop-note-paging.test.ts": 1337, - "src/main/native-chat/agent-session-wire/agent-session-stop-note-refresh.test.ts": 213, "src/main/native-chat/agent-session-wire/at-rest-command-demand.test.ts": 43, "src/main/native-chat/agent-session-wire/hook-failure-provider-frame.test.ts": 234, "src/main/native-chat/agent-session-wire/hook-outcome-rows.test.ts": 2040, @@ -3565,7 +3543,6 @@ "src/main/native-chat/agent-session-wire/structured-agent-session-codex-applied-inputs.test.ts": 2594, "src/main/native-chat/agent-session-wire/structured-agent-session-codex-held-goal.test.ts": 2081, "src/main/native-chat/agent-session-wire/structured-agent-session-codex-input-host.test.ts": 19298, - "src/main/native-chat/agent-session-wire/structured-agent-session-codex-version-recovery.test.ts": 2227, "src/main/native-chat/agent-session-wire/structured-agent-session-command-publication.test.ts": 1350, "src/main/native-chat/agent-session-wire/structured-agent-session-command-readers.test.ts": 567, "src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts": 2096, @@ -3615,7 +3592,6 @@ "src/main/native-chat/agent-session-wire/structured-agent-session-omp-menu-persistence.test.ts": 1063, "src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts": 1852, "src/main/native-chat/agent-session-wire/structured-agent-session-operation-start-refusal.test.ts": 1210, - "src/main/native-chat/agent-session-wire/structured-agent-session-options-deadline.test.ts": 1036, "src/main/native-chat/agent-session-wire/structured-agent-session-options-read-scaling.test.ts": 1006, "src/main/native-chat/agent-session-wire/structured-agent-session-options-read.accepted-inputs.test.ts": 1063, "src/main/native-chat/agent-session-wire/structured-agent-session-options-read.test.ts": 1405, @@ -3650,7 +3626,6 @@ "src/main/native-chat/agent-session-wire/structured-agent-session-received-output.test.ts": 2740, "src/main/native-chat/agent-session-wire/structured-agent-session-receiving-cancellation.test.ts": 5834, "src/main/native-chat/agent-session-wire/structured-agent-session-receiving-catalog.test.ts": 5757, - "src/main/native-chat/agent-session-wire/structured-agent-session-recovered-queue-idle.test.ts": 1857, "src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts": 1539, "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts": 2112, "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-read.test.ts": 918, @@ -3665,7 +3640,6 @@ "src/main/native-chat/agent-session-wire/structured-agent-session-restart-cap.test.ts": 731, "src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts": 1898, "src/main/native-chat/agent-session-wire/structured-agent-session-restart-context-clear.test.ts": 538, - "src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts": 191, "src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts": 533, "src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts": 2350, "src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts": 1903, @@ -3739,7 +3713,6 @@ "src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts": 430, "src/main/native-chat/agent-session-wire/structured-agent-session-unnamed-stop-races.test.ts": 2959, "src/main/native-chat/agent-session-wire/structured-agent-session-unopened-send-withdrawal.test.ts": 156, - "src/main/native-chat/agent-session-wire/structured-agent-session-unopened-tab.test.ts": 1885, "src/main/native-chat/agent-session-wire/structured-agent-session-unrun-send-hold.test.ts": 2343, "src/main/native-chat/agent-session-wire/structured-agent-session-unsent-send-hold.test.ts": 6694, "src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts": 5757, @@ -3877,7 +3850,6 @@ "src/main/opencode/opencode-acp-connection.test.ts": 1205, "src/main/opencode/opencode-cli-version.test.ts": 54, "src/main/opencode/opencode-client-sweep.test.ts": 124, - "src/main/opencode/opencode-credential-backend.test.ts": 84, "src/main/opencode/opencode-go-api-key-store.test.ts": 128, "src/main/opencode/opencode-launch-model-config.test.ts": 87, "src/main/opencode/opencode-launch-model-context-cleanup.test.ts": 1204, @@ -4077,7 +4049,6 @@ "src/main/persistence/loading-store/secret-sentinel-substitution.test.ts": 90, "src/main/persistence/loading-store/state-write-round-trip.test.ts": 1983, "src/main/persistence/loading-store/store-host-partition-before-unload.test.ts": 1670, - "src/main/persistence/loading-store/store-prune-gate-signals.test.ts": 1787, "src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts": 1757, "src/main/persistence/loading-store/store-workspace-session-host-removal.test.ts": 1738, "src/main/persistence/loading-store/terminal-close-async-durability.test.ts": 5719, @@ -4568,7 +4539,6 @@ "src/main/providers/pty-default-cwd.test.ts": 54, "src/main/providers/pty-process-inspection.test.ts": 45, "src/main/providers/pty-process-list-admission.test.ts": 138, - "src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts": 2018, "src/main/providers/stable-foreground-process.test.ts": 77, "src/main/providers/startup-line-typed-length.live-shell.test.ts": 316, "src/main/providers/terminal-path-existence-batch.integration.test.ts": 337, @@ -4707,7 +4677,6 @@ "src/main/runtime/agent-session-record-store-damaged.test.ts": 1557, "src/main/runtime/agent-session-saved-roster.test.ts": 3035, "src/main/runtime/agent-session-store-load-scale.test.ts": 732, - "src/main/runtime/agent-session-tab-layout-command.test.ts": 279, "src/main/runtime/agent-session-tab-layout-queue.test.ts": 4061, "src/main/runtime/agent-session/agent-session-conversation-clear-commit.test.ts": 957, "src/main/runtime/agent-session/agent-session-death-evidence-persistence.test.ts": 1113, @@ -4860,7 +4829,6 @@ "src/main/runtime/device-registry-own-quarantine.test.ts": 123, "src/main/runtime/device-registry-startup-offer.test.ts": 102, "src/main/runtime/dsh-launch-prompt-resubmit.test.ts": 6527, - "src/main/runtime/dsh-readiness-transcript.test.ts": 71, "src/main/runtime/e2ee-keypair.test.ts": 77, "src/main/runtime/editor-view-layout-apply.test.ts": 6870, "src/main/runtime/editor-view-partition-changes.test.ts": 5531, @@ -5236,7 +5204,6 @@ "src/main/runtime/renderer-browser-session-reconciliation.test.ts": 3882, "src/main/runtime/renderer-owned-tab-properties.test.ts": 15027, "src/main/runtime/repo-icon-fork-backfill.test.ts": 4159, - "src/main/runtime/repo-worktree-admin-fingerprint.test.ts": 668, "src/main/runtime/repo-worktree-row-resolution.test.ts": 664, "src/main/runtime/restored-editor-move-restart.test.ts": 5390, "src/main/runtime/restored-pane-hook-store-resume.test.ts": 4423, @@ -5408,7 +5375,6 @@ "src/main/runtime/rpc/methods/orchestration/worker/worker-run-dispatch-contracts.test.ts": 5136, "src/main/runtime/rpc/methods/orchestration/worker/worker-start-budgets.test.ts": 45, "src/main/runtime/rpc/methods/orchestration/worker/worker-start-launch-executor-parity.test.ts": 1137, - "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-budget.test.ts": 100, "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts": 6279, "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-exit-race.test.ts": 4508, "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-liveness-verdict.test.ts": 5279, @@ -5667,7 +5633,6 @@ "src/main/runtime/runtime-provisioned-root-adoption.test.ts": 537, "src/main/runtime/runtime-reference-agents.test.ts": 207, "src/main/runtime/runtime-reference-find.test.ts": 245, - "src/main/runtime/runtime-reference-integration.test.ts": 4136, "src/main/runtime/runtime-remote-fetch-ref-maintenance.test.ts": 419, "src/main/runtime/runtime-repo-update-worktree-refresh.test.ts": 4375, "src/main/runtime/runtime-repository-clone-host-dedupe.test.ts": 874, @@ -5890,13 +5855,11 @@ "src/main/runtime/terminal/identity/main-pane-record-arrival.test.ts": 5024, "src/main/runtime/terminal/identity/terminal-identity-placement-schedules.test.ts": 4255, "src/main/runtime/terminal/identity/terminal-identity-schedules.test.ts": 4334, - "src/main/runtime/terminal/identity/terminal-identity-source.test.ts": 3963, "src/main/runtime/terminal/input/agent-prompt-permission-hold.test.ts": 48, "src/main/runtime/terminal/input/terminal-send-plugin-hook.test.ts": 169, "src/main/runtime/terminal/launch/mobile-terminal-chat-fork.test.ts": 3900, "src/main/runtime/terminal/launch/terminal-split-layout-owner.test.ts": 4503, "src/main/runtime/terminal/launch/terminal-split-retry.test.ts": 4038, - "src/main/runtime/terminal/launch/window-tab-start-layout-owner.test.ts": 4124, "src/main/runtime/terminal/launch/window-tab-start-switch-off.test.ts": 4475, "src/main/runtime/terminal/layout/agent-generated-tab-titles.test.ts": 5572, "src/main/runtime/terminal/lifecycle/main-pane-liveness.test.ts": 4871, @@ -5956,7 +5919,6 @@ "src/main/runtime/worktree-teardown-daemon-inventory.test.ts": 463, "src/main/runtime/worktree-teardown-unstopped-pty.test.ts": 419, "src/main/runtime/worktree-teardown.test.ts": 862, - "src/main/runtime/worktree-terminal-mutation-lock.test.ts": 55, "src/main/runtime/worktree-terminal-sleep-host-twin.test.ts": 4345, "src/main/runtime/wsl-distro-loss-exit-retention.test.ts": 5519, "src/main/runtime/wsl-guest-drive-mountinfo.test.ts": 38, @@ -6011,7 +5973,6 @@ "src/main/skills/skill-delete/wsl-enumeration-protocol.test.ts": 52, "src/main/skills/skill-discovery-concurrency.test.ts": 222, "src/main/skills/skill-discovery-target.test.ts": 124, - "src/main/skills/skill-discovery-wsl-alias-sharing.test.ts": 165, "src/main/skills/skill-discovery-wsl-bash-filter.test.ts": 2105, "src/main/skills/skill-discovery-wsl-script-roundtrip.test.ts": 136, "src/main/skills/skill-discovery-wsl.test.ts": 104, @@ -6185,7 +6146,6 @@ "src/main/ssh/orcad-migration-delta-move.test.ts": 3812, "src/main/ssh/orcad-migration-delta-snapshot.test.ts": 2611, "src/main/ssh/orcad-migration-manifest-export.test.ts": 613, - "src/main/ssh/orcad-migration-path-rewrite.test.ts": 175, "src/main/ssh/orcad-migration-repository-link.test.ts": 4281, "src/main/ssh/orcad-migration-snapshot-coordinator.test.ts": 309, "src/main/ssh/orcad-migration-snapshot-resume.test.ts": 1878, @@ -6221,7 +6181,6 @@ "src/main/ssh/sftp-stream-late-error.test.ts": 209, "src/main/ssh/sftp-upload-pipeline.test.ts": 480, "src/main/ssh/sftp-upload.test.ts": 533, - "src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts": 610, "src/main/ssh/ssh-agent-identity-filter.test.ts": 54, "src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts": 102, "src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts": 60, diff --git a/config/scripts/pr-package-test-paths.mjs b/config/scripts/pr-package-test-paths.mjs index 5108491a36a..46f7f7639b5 100644 --- a/config/scripts/pr-package-test-paths.mjs +++ b/config/scripts/pr-package-test-paths.mjs @@ -49,7 +49,6 @@ export const WINDOWS_BOUNDARY_TESTS = [ 'src/main/browser/client-pages/renderer/browser-client-page-renderer-lifecycle.electron.test.ts', 'src/main/persistence/profile-state/profile-state-writer-stall.electron.test.ts', 'src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts', - 'src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts', 'src/shared/__tests__/process-host/windows-command-line.win32.test.ts', 'src/shared/__tests__/process-host/windows-cmd-shim-resolution.test.ts', 'src/shared/__tests__/process-host/windows-cmd-shim-resolution.win32.test.ts', @@ -95,7 +94,6 @@ export const WINDOWS_BOUNDARY_TESTS = [ 'src/main/startup/windows-app-data-path.test.ts', 'src/main/startup/windows-std-handle-inheritance.win32.test.ts', 'src/main/startup/windows-isolated-spawner.win32.test.ts', - 'src/main/runtime/repo-worktree-admin-fingerprint.test.ts', 'src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts', 'src/shared/secure-file-fsync-flags.test.ts', 'src/shared/secure-path-windows-acl.win32.test.ts', diff --git a/src/main/ai-vault/ai-vault-scan-progress.test.ts b/src/main/ai-vault/ai-vault-scan-progress.test.ts index 0ffc6e2f706..fbc20f97b4a 100644 --- a/src/main/ai-vault/ai-vault-scan-progress.test.ts +++ b/src/main/ai-vault/ai-vault-scan-progress.test.ts @@ -5,10 +5,6 @@ import { afterEach, describe, expect, it, vi } from 'vitest' import type { AiVaultScanWork } from '../../shared/ai-vault/scanning/ai-vault-scan-progress' import { AI_VAULT_SCAN_PROGRESS_INTERVAL_MS, - noteAiVaultScanFileFound, - aiVaultScanWork, - openAiVaultScanSource, - noteAiVaultScanWorkChanged, trackAiVaultScanProgress } from './ai-vault-scan-progress' import { scanAiVaultSessions } from './session-scanner' @@ -30,37 +26,7 @@ async function tempRoot(): Promise { return root } -function codexFile(index: number): { path: string; dev: number; ino: number } { - return { path: `/sessions/${index}.jsonl`, dev: 1, ino: index + 1 } -} - describe('scan progress reporting', () => { - it('reports at most once per interval, with the latest tally trailing', () => { - vi.useFakeTimers() - const signal = new AbortController().signal - const files: number[] = [] - const stop = trackAiVaultScanProgress( - signal, - (work) => files.push(work.agents[0]?.files ?? 0), - () => Date.now() - ) - - noteAiVaultScanFileFound(signal, 'codex', codexFile(0)) - noteAiVaultScanWorkChanged(signal) - for (let index = 1; index < 16; index++) { - noteAiVaultScanFileFound(signal, 'codex', codexFile(index)) - noteAiVaultScanWorkChanged(signal) - } - expect(files).toEqual([1]) - vi.advanceTimersByTime(AI_VAULT_SCAN_PROGRESS_INTERVAL_MS) - expect(files).toEqual([1, 16]) - - stop() - noteAiVaultScanWorkChanged(signal) - vi.advanceTimersByTime(AI_VAULT_SCAN_PROGRESS_INTERVAL_MS) - expect(files).toEqual([1, 16]) - }) - it('reports discovery and reading for its own scan, never for an unrelated one', async () => { const root = await tempRoot() const roots = isolatedScanRoots(root) @@ -104,19 +70,3 @@ describe('scan progress reporting', () => { expect(reports.at(-1)).toMatchObject({ stage: 'reading', read: { done: 3, total: 3 } }) }) }) - -it('keeps source ownership and final facts independent of immediate and trailing sink faults', () => { - vi.useFakeTimers() - const signal = new AbortController().signal - const sink = vi.fn(() => { - throw new Error('Synthetic reporting sink fault') - }) - const stop = trackAiVaultScanProgress(signal, sink, () => Date.now()) - const close = openAiVaultScanSource(signal, 'claude') - expect(aiVaultScanWork(signal)?.agents[0]?.walking).toBe(true) - close() - expect(() => vi.advanceTimersByTime(AI_VAULT_SCAN_PROGRESS_INTERVAL_MS)).not.toThrow() - expect(sink).toHaveBeenCalledTimes(2) - expect(aiVaultScanWork(signal)?.agents).toEqual([]) - stop() -}) diff --git a/src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-sqlite-worker-spawn.test.ts b/src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-sqlite-worker-spawn.test.ts deleted file mode 100644 index 5f226b1c779..00000000000 --- a/src/main/ai-vault/scanners/opencode/reader-transport/session-scanner-opencode-sqlite-worker-spawn.test.ts +++ /dev/null @@ -1,44 +0,0 @@ -import { expect, it, vi } from 'vitest' -import type * as OpenCodeWslClient from './session-scanner-opencode-wsl-client' -import type { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client' -import type { AiVaultScanIssue } from '../../../../../shared/ai-vault/contracts/ai-vault-types' -import { listOpenCodeSqliteSessionsViaWorker } from './session-scanner-opencode-sqlite-worker-spawn' - -const mocks = vi.hoisted(() => ({ list: vi.fn() })) -vi.mock('./session-scanner-opencode-wsl-client', async (importOriginal) => { - const { parseWslUncPath } = await import('../../../../../shared/wsl-paths') - return { - ...(await importOriginal()), - openCodeWslPath: parseWslUncPath, - openCodeWslClient: async () => ({ list: mocks.list }) - } -}) - -it('routes scoped SQLite reads only to the owning distro and reports a scoped-only failure', async () => { - const ubuntu = String.raw`\\wsl.localhost\Ubuntu\home\ada\opencode.db` - const debian = String.raw`\\wsl.localhost\Debian\home\ada\opencode.db` - const issues: AiVaultScanIssue[] = [] - mocks.list.mockImplementation(async (args) => { - if (args.scopePaths?.length) { - expect(args.scopePaths).toEqual(['/home/ada/repo']) - args.issues.push({ - agent: 'opencode', - kind: 'scope', - path: args.dbPaths[0], - message: 'Scoped read timed out' - }) - } - return [] - }) - await listOpenCodeSqliteSessionsViaWorker({ dbPaths: [ubuntu], limit: 1, issues }) - await listOpenCodeSqliteSessionsViaWorker({ - dbPaths: [ubuntu, debian], - limit: 1, - issues, - scopePaths: [String.raw`\\wsl.localhost\Ubuntu\home\ada\repo`] - }) - expect(mocks.list).toHaveBeenCalledTimes(2) - expect(issues).toEqual([ - { agent: 'opencode', kind: 'scope', path: ubuntu, message: 'Scoped read timed out' } - ]) -}) diff --git a/src/main/ai-vault/scanners/opencode/session-scanner-opencode-sources-wsl-stall.test.ts b/src/main/ai-vault/scanners/opencode/session-scanner-opencode-sources-wsl-stall.test.ts index 3f5386cb52b..973d8d24ce2 100644 --- a/src/main/ai-vault/scanners/opencode/session-scanner-opencode-sources-wsl-stall.test.ts +++ b/src/main/ai-vault/scanners/opencode/session-scanner-opencode-sources-wsl-stall.test.ts @@ -1,10 +1,9 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import type { Dirent } from 'node:fs' + import type * as NodeFsPromisesModule from 'node:fs/promises' import type { AiVaultScanIssue } from '../../../../shared/ai-vault/contracts/ai-vault-types' const WSL_HOME = '\\\\wsl.localhost\\Ubuntu\\home\\ada' -const WSL_DATA_DIR = `${WSL_HOME}/.local/share/opencode` const mocks = vi.hoisted(() => ({ readdir: vi.fn(), stat: vi.fn() })) @@ -58,31 +57,6 @@ afterEach(async () => { }) describe('OpenCode source discovery with a stalled WSL data directory', () => { - it('reports the stalled home as an issue and still resolves every discovery', async () => { - mocks.readdir.mockImplementation((dir: string) => - dir === WSL_DATA_DIR ? stalls() : Promise.resolve([] as Dirent[]) - ) - const issues: AiVaultScanIssue[] = [] - const discoveries = Promise.all( - opencodeDiscoveries( - { opencodeStorageDir: '/home/ada/.local/share/opencode/storage' }, - [WSL_HOME], - 10, - issues - ) - ) - // The storage scan queues before the data-dir timeout marks the route stuck; both reach their deadlines. - await vi.advanceTimersByTimeAsync(WSL_TRANSCRIPT_FS_SCAN_TIMEOUT_MS * 2 + 2) - - // A scan issue distinguishes an unreachable source from an uninstalled agent. - const resolved = await discoveries - expect(resolved).toHaveLength(4) - expect(mocks.readdir.mock.calls.filter(([path]) => path === WSL_DATA_DIR)).toHaveLength(1) - expect(resolved.every((discovery) => discovery.files.length === 0)).toBe(true) - expect(issues.some((issue) => issue.path === WSL_DATA_DIR)).toBe(true) - expect(issues.every((issue) => issue.agent === 'opencode')).toBe(true) - }) - it('reports a refused primary data directory instead of scanning clean', async () => { const previousXdg = process.env.XDG_DATA_HOME const previousDb = process.env.OPENCODE_DB diff --git a/src/main/ai-vault/structured-chat-conversation-copy.test.ts b/src/main/ai-vault/structured-chat-conversation-copy.test.ts index c4aef779901..307778863b7 100644 --- a/src/main/ai-vault/structured-chat-conversation-copy.test.ts +++ b/src/main/ai-vault/structured-chat-conversation-copy.test.ts @@ -10,7 +10,7 @@ import { copyStructuredChatConversation } from './structured-chat-conversation-c import { installCopyingChat as installChat } from './structured-session-ownership.test-support' const OMP_ID = '019fd611-2b3c-7d4e-9f50-6b7c8d9e0f1a' -const OPENCODE_ID = 'ses_2f9aB3cD4eF5gH6iJ7kL8mN9oP' + const OMP_FILE = `/sessions/${OMP_ID}.jsonl` const acp = (agent: 'opencode' | 'omp', nativeId: string): AgentSessionProviderHandle => ({ @@ -34,31 +34,6 @@ const fork = ( afterEach(() => setStructuredAgentSessionHost(null)) describe('copying a chat conversation for Resume in New CLI', () => { - it.each([ - { agent: 'omp' as const, handle: acp('omp', OMP_ID), sessionId: OMP_ID }, - { agent: 'opencode2' as const, handle: acp('opencode', OPENCODE_ID), sessionId: OPENCODE_ID } - ])( - "has the chat's host copy a $agent row's conversation", - async ({ agent, handle, sessionId }) => { - const copy = vi.fn(async () => ({ - sessionId: 'copy-1', - filePath: '/sessions/copy-1.jsonl' - })) - installChat(handle, copy) - - await expect( - copyStructuredChatConversation(fork({ agent, sessionId, filePath: `/x/${sessionId}` })) - ).resolves.toEqual({ - useRealCodexHome: false, - forkedSession: { - sessionId: 'copy-1', - filePath: '/sessions/copy-1.jsonl', - agent: handle.agent - } - }) - } - ) - it.each(['source', 'owned'])('rejects a %s fork id on the execution host', async (returned) => { const lease = agentSessionLeaseFixture() const fixture = agentSessionRecordFixture(lease) diff --git a/src/main/automations/service-lifecycle.test.ts b/src/main/automations/service-lifecycle.test.ts deleted file mode 100644 index 2f849483370..00000000000 --- a/src/main/automations/service-lifecycle.test.ts +++ /dev/null @@ -1,73 +0,0 @@ -import { it, expect, vi } from 'vitest' -import { mkdtempSync, rmSync } from 'node:fs' -import { join } from 'node:path' -import { tmpdir } from 'node:os' -import { createStore, closeTestStores, testState } from '../persistence/persistence-test-harness' -import { buildProfileStateCutoverFixture } from '../persistence/profile-state-cutover-fixture' -import { AutomationRunLaunchError } from './headless-dispatch' -import { AutomationService } from './service' - -vi.mock('electron', () => ({ - app: { getPath: () => testState.dir }, - safeStorage: { - isEncryptionAvailable: () => true, - encryptString: (plaintext: string) => Buffer.from(`encrypted:${plaintext}`, 'utf-8'), - decryptString: (ciphertext: Buffer) => ciphertext.toString('utf-8').slice('encrypted:'.length) - } -})) - -it.each(['chat', 'terminal'] as const)( - 'durably saves an unsuccessful published %s target without a resend', - async (kind) => { - testState.dir = mkdtempSync(join(tmpdir(), 'orca-34332-failed-target-')) - const store = await createStore() - try { - store.addRepo({ - ...buildProfileStateCutoverFixture('/repo').repos[0], - id: 'r1', - path: '/repo' - }) - const automation = store.createAutomation({ - name: 'Failed delivery', - prompt: 'check', - agentId: 'claude', - launchSetupPatch: { surface: 'chat' }, - projectId: 'r1', - workspaceMode: 'existing', - workspaceId: 'r1::/repo', - timezone: 'UTC', - rrule: 'FREQ=DAILY', - dtstart: 1 - }) - const published = { - workspaceId: 'actually-created', - sessionKind: kind, - chatSessionId: kind === 'chat' ? 'claude_actual' : null, - terminalSessionId: kind === 'terminal' ? 'actual-tab' : null, - terminalPaneKey: - kind === 'terminal' ? 'actual-tab:11111111-1111-4111-8111-111111111111' : null, - terminalPtyId: kind === 'terminal' ? 'actual-pty' : null - } - const dispatch = vi.fn(async () => { - throw new AutomationRunLaunchError( - 'Claude could not confirm delivery. Open the run.', - published - ) - }) - const service = new AutomationService(store, { chatDispatcher: dispatch }) - service.setWebContents({ isDestroyed: () => false, send: vi.fn() }) - service.setRendererReady() - const failed = await service.runNow(automation.id) - expect(failed).toMatchObject({ ...published, status: 'dispatch_failed' }) - expect(store.listAutomationRuns()[0]).toMatchObject({ - ...published, - status: 'dispatch_failed' - }) - expect(dispatch).toHaveBeenCalledOnce() - service.stop() - } finally { - await closeTestStores() - rmSync(testState.dir, { recursive: true, force: true }) - } - } -) diff --git a/src/main/browser/client-hosts/file-transfers/browser-client-file-channel-negotiation.test.ts b/src/main/browser/client-hosts/file-transfers/browser-client-file-channel-negotiation.test.ts deleted file mode 100644 index 5f3d273c193..00000000000 --- a/src/main/browser/client-hosts/file-transfers/browser-client-file-channel-negotiation.test.ts +++ /dev/null @@ -1,16 +0,0 @@ -import { describe, expect, it } from 'vitest' - -import { BrowserClientHostAttachParams } from '../../../../shared/browser/client-hosting/browser-client-host-protocol' - -describe('browser file channel negotiation', () => { - it('rejects an attach that asks for the file channel without command negotiation', () => { - expect( - BrowserClientHostAttachParams.safeParse({ - authorityRuntimeId: 'runtime-1', - browserHostClientId: 'host-1', - hostCapabilities: ['webview'], - fileChannelProtocolVersion: 1 - }).success - ).toBe(false) - }) -}) diff --git a/src/main/browser/client-hosts/file-transfers/browser-client-upload-command.test.ts b/src/main/browser/client-hosts/file-transfers/browser-client-upload-command.test.ts deleted file mode 100644 index ad761512030..00000000000 --- a/src/main/browser/client-hosts/file-transfers/browser-client-upload-command.test.ts +++ /dev/null @@ -1,91 +0,0 @@ -import { mkdtemp, realpath, rm } from 'node:fs/promises' -import { tmpdir } from 'node:os' -import path from 'node:path' -import { afterEach, beforeEach, describe, expect, it } from 'vitest' - -import type { BrowserClientHostCommandEvent } from '../../../../shared/browser/client-hosting/browser-client-host-protocol' -import { BrowserClientFileChannelTransport } from './browser-client-file-channel-transport' -import { executeBrowserClientUploadCommand } from './browser-client-upload-command' -import { BrowserClientUploadStaging } from './browser-client-upload-staging' - -let stagingRoot = '' - -beforeEach(async () => { - stagingRoot = await realpath(await mkdtemp(path.join(tmpdir(), 'orca-upload-command-'))) -}) - -afterEach(async () => { - await rm(stagingRoot, { recursive: true, force: true }) -}) - -function uploadEvent(files: unknown): BrowserClientHostCommandEvent { - return { - type: 'command', - pageCommandProtocolVersion: 1, - authorityRuntimeId: 'runtime-1', - authorityEpoch: 'epoch-1', - browserHostClientId: 'host-1', - browserHostGeneration: 2, - browserPageId: 'page-1', - pageHostGeneration: 3, - commandSequence: 1, - commandId: 'command-1', - command: { type: 'automation', method: 'browser.upload', params: { element: '#f', files } } - } as BrowserClientHostCommandEvent -} - -function transportReturning( - responses: Map -): { transport: BrowserClientFileChannelTransport; calls: unknown[] } { - const calls: unknown[] = [] - const transport = new BrowserClientFileChannelTransport() - transport.bind({ - fileChannelNegotiated: true, - fileChannelAvailability: 'negotiated' as const, - sendFileChannelRequest: async (_method, params) => { - calls.push(params) - const requested = (params as { workspaceRelativePath: string }).workspaceRelativePath - const queue = responses.get(requested) - if (!queue?.length) { - return { ok: false, error: { code: 'not_found', message: 'missing' }, _meta: {} } as never - } - const next = queue.shift() - return { - ok: true, - result: { ...next, totalBytes: next?.bytesRead ?? 0 }, - _meta: {} - } as never - } - }) - return { transport, calls } -} - -describe('executeBrowserClientUploadCommand', () => { - it('reports the upload failure, not the cleanup failure, when both fail', async () => { - const staging = new BrowserClientUploadStaging(stagingRoot, { - mkdir: async () => {}, - writeFile: async () => {}, - removeDirectorySync: () => {}, - removeDirectory: async () => { - throw new Error('EBUSY: resource busy or locked') - } - }) - const { transport } = transportReturning( - new Map([['a.txt', [{ contentBase64: '', bytesRead: 0, eof: true }]]]) - ) - - await expect( - executeBrowserClientUploadCommand({ - event: uploadEvent(['a.txt']), - params: { element: '#f', files: ['a.txt'] }, - fileChannel: transport, - staging, - run: async () => { - throw new Error('element not found') - } - }) - ).rejects.toThrow('element not found') - // A later page release needs the retained directory record to retry cleanup. - expect(staging.activeStagingCount()).toBe(1) - }) -}) diff --git a/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-identity-wiring.test.ts b/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-identity-wiring.test.ts deleted file mode 100644 index e940f2629fd..00000000000 --- a/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-identity-wiring.test.ts +++ /dev/null @@ -1,124 +0,0 @@ -import { mkdtempSync } from 'node:fs' -import { tmpdir } from 'node:os' -import { join } from 'node:path' -import { afterEach, describe, expect, it, vi } from 'vitest' -import type { KnownRuntimeEnvironment } from '../../../../shared/remote-runtime/host-catalog/runtime-environments' - -vi.mock('electron', () => ({ - app: { getPath: () => tmpdir() }, - ipcMain: { on: vi.fn(), removeListener: vi.fn() } -})) - -type CreateHost = ( - next: { pairing: unknown; authorityRuntimeId: string }, - callbacks: Record -) => unknown - -const createHostCallbacks: CreateHost[] = [] -const hostOptions: { browserHostClientId: string }[] = [] - -vi.mock('./paired-runtime-browser-client-host', () => ({ - PairedRuntimeBrowserClientHost: class { - constructor(options: { browserHostClientId: string }) { - hostOptions.push(options) - } - } -})) - -vi.mock('../file-transfers/browser-client-file-channel-transport', () => ({ - BrowserClientFileChannelTransport: class { - bind(): void {} - } -})) - -vi.mock('./paired-runtime-browser-client-host-composition', () => ({ - PairedRuntimeBrowserClientHostComposition: class { - constructor(options: { createHost: CreateHost }) { - createHostCallbacks.push(options.createHost) - } - - start(): Promise { - return Promise.resolve({ authority: 'lease-a' }) - } - - close(): Promise { - return Promise.resolve(true) - } - - whenClosed(): Promise { - return Promise.resolve() - } - } -})) - -function pairedEnvironment(id: string): KnownRuntimeEnvironment { - return { - id, - name: `Environment ${id}`, - createdAt: 1, - updatedAt: 1, - lastUsedAt: null, - runtimeId: null, - preferredEndpointId: 'endpoint-a', - endpoints: [ - { - id: 'endpoint-a', - endpoint: 'ws://127.0.0.1:9999', - deviceToken: 'token-a', - publicKeyB64: 'key-a' - } - ] - } as KnownRuntimeEnvironment -} - -async function launch(profileDirectory: string): Promise { - vi.resetModules() - createHostCallbacks.length = 0 - hostOptions.length = 0 - const { initializeBrowserClientHostId } = await import('./browser-client-host-id') - initializeBrowserClientHostId(profileDirectory) -} - -async function hostingIdentity(): Promise { - const runtime = await import('./paired-runtime-browser-client-host-runtime') - runtime.configurePairedRuntimeBrowserClientHostsForOrcaProfile({ orcaProfileId: 'profile-a' }) - await runtime.startPairedRuntimeBrowserClientHost({ - environment: pairedEnvironment('environment-a'), - authorityRuntimeId: 'runtime-a' - }) - const createHost = createHostCallbacks[0] - if (!createHost) { - throw new Error('client host composition never asked for a host') - } - createHost({ pairing: {}, authorityRuntimeId: 'runtime-a' }, {}) - const options = hostOptions[0] - if (!options) { - throw new Error('client host was never constructed') - } - return options.browserHostClientId -} - -async function hostingIdentityForLaunch(profileDirectory: string): Promise { - await launch(profileDirectory) - return await hostingIdentity() -} - -afterEach(() => { - vi.resetModules() -}) - -describe('client host hosting identity wiring', () => { - it('attaches under the same identity after the desktop relaunches', async () => { - const profileDirectory = mkdtempSync(join(tmpdir(), 'orca-host-wiring-')) - - expect(await hostingIdentityForLaunch(profileDirectory)).toBe( - await hostingIdentityForLaunch(profileDirectory) - ) - }) - - it('attaches under a different identity for a different Orca profile', async () => { - expect( - await hostingIdentityForLaunch(mkdtempSync(join(tmpdir(), 'orca-host-wiring-'))) - ).not.toBe(await hostingIdentityForLaunch(mkdtempSync(join(tmpdir(), 'orca-host-wiring-')))) - }) -}) diff --git a/src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts b/src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts index 9380e340483..f3c2a5e1602 100644 --- a/src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts +++ b/src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts @@ -9,26 +9,6 @@ describe('browser client page inventory', () => { expect(prepareBrowserClientPageInventoryForAttach([page, page])).toBeUndefined() }) - it('uses codepoint order to break equal URL-compaction ties across input order', () => { - const pageIds = [ - 'ä-page', - 'z-page', - ...Array.from({ length: 254 }, (_, index) => `page-${index.toString().padStart(3, '0')}`) - ] - const inventory = pageIds.map(inventoryPage) - const forward = prepareBrowserClientPageInventoryForAttach(inventory) - const reversed = prepareBrowserClientPageInventoryForAttach(inventory.toReversed()) - if (!forward || !reversed) { - throw new Error('expected encodable inventory') - } - const omitted = omittedPageIds(forward) - const expected = [...pageIds].sort(compareCodepoints).slice(0, omitted.length) - - expect(omitted.length).toBeGreaterThan(0) - expect(omitted).toEqual(expected) - expect(omittedPageIds(reversed)).toEqual(expected) - }) - it('declines the optional snapshot instead of dropping an unencodable page', () => { expect( prepareBrowserClientPageInventoryForAttach([ @@ -53,14 +33,3 @@ function inventoryPage(browserPageId: string): BrowserClientHostedPageInventory currentUrl: `https://remote.internal/${'x'.repeat(4096)}` } } - -function omittedPageIds(pages: readonly BrowserClientHostedPageInventory[]): string[] { - return pages - .filter((page) => page.currentUrl === undefined) - .map((page) => page.browserPageId) - .sort(compareCodepoints) -} - -function compareCodepoints(left: string, right: string): number { - return left < right ? -1 : left > right ? 1 : 0 -} diff --git a/src/main/browser/extensions/installation/browser-extension-install-store.test.ts b/src/main/browser/extensions/installation/browser-extension-install-store.test.ts index b2981fc86ea..ae2a68da45f 100644 --- a/src/main/browser/extensions/installation/browser-extension-install-store.test.ts +++ b/src/main/browser/extensions/installation/browser-extension-install-store.test.ts @@ -72,12 +72,6 @@ describe('BrowserExtensionInstallStore', () => { store.save(record({ id: STORE_ID })) expect(store.get(STORE_ID)?.installTime).toBeGreaterThanOrEqual(updated ?? 0) }) - - it('refuses install directories that could escape the root', () => { - const store = new BrowserExtensionInstallStore(root) - expect(() => store.installDirectory('../evil', '1.0')).toThrow() - expect(() => store.installDirectory(STORE_ID, '../../1.0')).toThrow() - }) }) describe('readBrowserExtensionManifest', () => { diff --git a/src/main/browser/routing/local-host-partitions/wsl-host-browser-jar-identity.test.ts b/src/main/browser/routing/local-host-partitions/wsl-host-browser-jar-identity.test.ts deleted file mode 100644 index 09c9e3b4fe8..00000000000 --- a/src/main/browser/routing/local-host-partitions/wsl-host-browser-jar-identity.test.ts +++ /dev/null @@ -1,106 +0,0 @@ -/** - * R45: which in-app browser jar a WSL host's pages get, pinned by what can change about the host. - * The jar follows the environment (named by the distro) and orcad's key; the distro's registry id - * is deliberately not part of it (#29610). - */ -import { mkdtempSync, realpathSync, rmSync } from 'node:fs' -import { tmpdir } from 'node:os' -import { join } from 'node:path' -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import type { KnownRuntimeEnvironment } from '../../../../shared/remote-runtime/host-catalog/runtime-environments' -import { defaultWslOrcadEnvironmentId } from '../../../wsl/orcad/wsl-orcad-deploy' - -const bindings = vi.hoisted(() => ({ filePath: '' })) - -vi.mock('electron', () => ({ - app: { getPath: () => tmpdir() }, - ipcMain: { on: vi.fn(), removeListener: vi.fn() } -})) -vi.mock('../partitions/browser-route-partition-binding-runtime', async () => { - const { BrowserRoutePartitionBindingStore } = - await import('../partitions/browser-route-partition-binding-store') - return { - currentBrowserRoutePartitionBindingStore: () => - new BrowserRoutePartitionBindingStore({ filePath: bindings.filePath }) - } -}) -vi.mock('../partitions/browser-route-partition-storage-dependencies', () => ({ - releaseEvictedBrowserRoutePartitionStorage: vi.fn(async () => {}) -})) - -import { - bindWslHostBrowserRoutePartition, - wslHostBrowserRouteStorage -} from './wsl-host-browser-route-partition' - -const ORCA_PROFILE = 'profile-a' - -function wslHost( - distro: string, - hostKey: string, - pairing = { revision: 1, device: 'device-a' } -): KnownRuntimeEnvironment { - return { - id: defaultWslOrcadEnvironmentId(distro), - name: distro, - createdAt: 1, - updatedAt: 1, - lastUsedAt: null, - runtimeId: null, - pairingRevision: pairing.revision, - pairedDeviceId: pairing.device, - orcadDeployment: { kind: 'wsl', distro, localPort: 9999, remotePort: 7777 }, - preferredEndpointId: 'endpoint-a', - endpoints: [ - { - id: 'endpoint-a', - kind: 'websocket', - label: distro, - endpoint: 'ws://127.0.0.1:9999', - deviceToken: `token-${pairing.device}`, - publicKeyB64: hostKey - } - ] - } -} - -function jar(environment: KnownRuntimeEnvironment): string { - const result = wslHostBrowserRouteStorage(ORCA_PROFILE, environment) - if (result.kind !== 'stable') { - throw new Error(`expected a stable partition, got ${result.reason}`) - } - return bindWslHostBrowserRoutePartition(result.storage, 'default') -} - -let directory: string - -beforeEach(() => { - directory = realpathSync(mkdtempSync(join(realpathSync(tmpdir()), 'wsl-host-jar-'))) - bindings.filePath = join(directory, 'bindings.json') -}) -afterEach(() => { - rmSync(directory, { recursive: true, force: true }) -}) - -describe('WSL host browser jar identity', () => { - it('starts a new jar when the distro runs a newly deployed orcad (a new key)', () => { - const before = jar(wslHost('Ubuntu', 'orcad-key-a')) - - expect(jar(wslHost('Ubuntu', 'orcad-key-b'))).not.toBe(before) - // The old jar is still the old key's; nothing of it moved to the new one. - expect(jar(wslHost('Ubuntu', 'orcad-key-a'))).toBe(before) - }) - - it('starts a new jar for a renamed distro, even one that kept its orcad key', () => { - const before = jar(wslHost('Ubuntu', 'orcad-key-a')) - - expect(jar(wslHost('Ubuntu-work', 'orcad-key-a'))).not.toBe(before) - }) - - // Accepted (R45, Low): the same name and key is the same host to this desktop. - it('keeps the jar for a distro re-imported under its old name with its old key', () => { - const before = jar(wslHost('Ubuntu', 'orcad-key-a')) - - expect(jar(wslHost('Ubuntu', 'orcad-key-a', { revision: 7, device: 'device-b' }))).toBe(before) - }) -}) diff --git a/src/main/codex-accounts/runtime-home-wsl-sibling-bridge.test.ts b/src/main/codex-accounts/runtime-home-wsl-sibling-bridge.test.ts deleted file mode 100644 index 562d556590e..00000000000 --- a/src/main/codex-accounts/runtime-home-wsl-sibling-bridge.test.ts +++ /dev/null @@ -1,116 +0,0 @@ -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import { join } from 'node:path' -import { createSettings } from './runtime-home-settings-test-fixtures' -import { - createStore, - setupRuntimeHomeTest, - teardownRuntimeHomeTest, - testState -} from './runtime-home-service-test-harness' - -vi.mock('electron', () => ({ - app: { - getPath: () => testState.userDataDir - } -})) - -vi.mock(import('node:os'), async (importOriginal) => { - const actual = await importOriginal() - return { - ...actual, - homedir: () => testState.fakeHomeDir - } -}) - -const bridge = vi.hoisted(() => ({ - start: vi.fn<(target: Record) => Promise>(() => Promise.resolve()) -})) - -vi.mock('../codex/history/bridges/wsl-codex-session-bridge', () => ({ - startWslCodexSessionBridgeInBackground: bridge.start -})) - -let wslHome = '' -vi.mock('../wsl/discovery/distro-catalog', () => ({ - getDefaultWslDistro: () => 'Ubuntu', - getWslHome: () => wslHome -})) - -function accountsRoot(): string { - return join(wslHome, '.local', 'share', 'orca', 'codex-accounts') -} - -function wslAccount(id: string, distro: string) { - return { - id, - email: `${id}@example.com`, - managedHomePath: join(accountsRoot(), id, 'home'), - managedHomeRuntime: 'wsl' as const, - wslDistro: distro, - wslLinuxHomePath: join(accountsRoot(), id, 'home'), - providerAccountId: null, - workspaceLabel: null, - workspaceAccountId: null, - createdAt: 1, - updatedAt: 1, - lastAuthenticatedAt: 1 - } -} - -async function createService(selectedUbuntuAccount: string | null) { - const store = createStore( - createSettings({ - codexManagedAccounts: [ - wslAccount('a', 'Ubuntu'), - wslAccount('b', 'Ubuntu'), - wslAccount('other-distro', 'Debian') - ], - activeCodexManagedAccountIdsByRuntime: { - host: null, - wsl: { Ubuntu: selectedUbuntuAccount } - } - }) - ) - const { CodexRuntimeHomeService } = await import('./runtime-home-service') - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the harness store implements the getSettings/updateSettings surface this service reads. - return new CodexRuntimeHomeService(store as never) -} - -describe('WSL sibling account session bridging', () => { - let originalPlatform: PropertyDescriptor | undefined - - beforeEach(() => { - setupRuntimeHomeTest() - originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform') - Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) - wslHome = join(testState.userDataDir, 'ubuntu-home') - bridge.start.mockReset() - bridge.start.mockImplementation(() => Promise.resolve()) - }) - - afterEach(() => { - if (originalPlatform) { - Object.defineProperty(process, 'platform', originalPlatform) - } - teardownRuntimeHomeTest() - }) - - it('lets a concurrent launch join the sibling loop already bridging that home', async () => { - let releaseFirst: () => void = () => {} - bridge.start.mockImplementationOnce( - () => - new Promise((resolve) => { - releaseFirst = resolve - }) - ) - const service = await createService('b') - - service.prepareForCodexLaunch({ runtime: 'wsl', wslDistro: 'Ubuntu' }) - service.prepareForCodexLaunch({ runtime: 'wsl', wslDistro: 'Ubuntu' }) - await vi.waitFor(() => expect(bridge.start).toHaveBeenCalledTimes(1)) - releaseFirst() - await vi.waitFor(() => expect(bridge.start).toHaveBeenCalledTimes(2)) - await Promise.resolve() - expect(bridge.start).toHaveBeenCalledTimes(2) - }) -}) diff --git a/src/main/daemon/daemon-shared-owner-incarnation-retention.test.ts b/src/main/daemon/daemon-shared-owner-incarnation-retention.test.ts deleted file mode 100644 index ed86ab90e9a..00000000000 --- a/src/main/daemon/daemon-shared-owner-incarnation-retention.test.ts +++ /dev/null @@ -1,99 +0,0 @@ -import { afterEach, describe, expect, it, vi } from 'vitest' -import { join } from 'node:path' -import { tmpdir } from 'node:os' -import { DaemonPtyAdapter } from './daemon-pty-adapter' -import { DegradedDaemonPtyProvider } from './degraded-daemon-pty-provider' -import { LocalPtyProvider } from '../providers/local-pty/local-pty-provider' -import type { PtyProcessInfo } from '../providers/pty-provider-contract' -import { TerminalSessionOwnerUnverifiedError } from './daemon-errors' - -const cleanups: (() => void)[] = [] - -afterEach(() => { - for (const cleanup of cleanups.splice(0)) { - cleanup() - } - vi.restoreAllMocks() -}) - -function adapterFixture(label: string, pid: number) { - const adapter = new DaemonPtyAdapter({ - socketPath: join(tmpdir(), `unused-${label}.sock`), - tokenPath: join(tmpdir(), `unused-${label}.token`) - }) - const client = adapter['client'] - vi.spyOn(client, 'ensureConnected').mockResolvedValue() - vi.spyOn(client, 'ensureConnectedWithin').mockResolvedValue() - const identity = vi.spyOn(client, 'getDaemonIdentity') - const request = vi.spyOn(client, 'request').mockResolvedValue({ sessions: [] }) - const spawn = vi.spyOn(adapter, 'spawn').mockImplementation(async (opts) => ({ - id: opts.sessionId ?? 'unexpected-fresh-spawn', - incarnationId: opts.expectedIncarnationId, - isReattach: true - })) - return { - adapter, - request, - spawn, - setProcesses(processes: PtyProcessInfo[]) { - request.mockResolvedValue({ - sessions: processes.map((process) => ({ - sessionId: process.id, - incarnationId: process.incarnationId, - cwd: process.cwd, - isAlive: true - })) - }) - }, - async publishIdentity(generation: number) { - identity.mockReturnValue({ - pid, - startedAtMs: generation + 1, - launchNonce: label + generation - }) - await adapter.establishLifecycleLease() - } - } -} - -async function fixture() { - const current = adapterFixture('current', 999_999_997) - const legacy = adapterFixture('legacy', 999_999_998) - const fallback = new LocalPtyProvider() - vi.spyOn(fallback, 'listProcesses').mockResolvedValue([]) - const provider = new DegradedDaemonPtyProvider({ - current: current.adapter, - legacy: [legacy.adapter], - fallback - }) - cleanups.push(() => provider.dispose()) - await current.publishIdentity(0) - await legacy.publishIdentity(0) - const recovery = provider['ownerRecovery'] - return { current, legacy, provider, recovery } -} - -function processInfo(id: string, incarnationId: string): PtyProcessInfo { - return { id, incarnationId, cwd: '', title: 'shell' } -} - -describe('shared daemon owner incarnation retirement', () => { - it('retains authoritative incarnation mismatch refusal after another daemon changes', async () => { - const { current, legacy, provider } = await fixture() - legacy.setProcesses([processInfo('live', 'current-incarnation')]) - await provider.discoverDaemonSessions() - await current.publishIdentity(1) - await expect( - provider.spawn({ - sessionId: 'live', - attachOnly: true, - cols: 80, - rows: 24, - expectedIncarnationId: 'retired-incarnation', - expectedIncarnationIsAuthoritative: true - }) - ).rejects.toBeInstanceOf(TerminalSessionOwnerUnverifiedError) - expect(current.spawn).not.toHaveBeenCalled() - expect(legacy.spawn).not.toHaveBeenCalled() - }) -}) diff --git a/src/main/git/command-runner/gh-exec-file-lifetime.test.ts b/src/main/git/command-runner/gh-exec-file-lifetime.test.ts index 1dbcf38c178..91227bfc3b6 100644 --- a/src/main/git/command-runner/gh-exec-file-lifetime.test.ts +++ b/src/main/git/command-runner/gh-exec-file-lifetime.test.ts @@ -46,39 +46,6 @@ describe('tracked gh capture lifetime', () => { vi.restoreAllMocks() }) - it.each([false, true])( - 'keeps grace settlement separate from termination (abort: %s)', - async (abort) => { - const value = child(1234) - spawnMock.mockReturnValue(value) - const owner = createGhLogicalLifetime() - const controller = new AbortController() - const result = ghExecFileAsync( - ['api', 'user'], - { timeout: 10, ...(abort ? { signal: controller.signal } : {}) }, - owner.hooks - ) - const rejection = expect(result).rejects.toThrow() - await vi.advanceTimersByTimeAsync(0) - if (abort) { - controller.abort('private-reason') - } - await vi.advanceTimersByTimeAsync(12_010) - await rejection - owner.seal() - let terminated = false - void owner.terminated.then(() => { - terminated = true - }) - await vi.advanceTimersByTimeAsync(0) - expect(terminated).toBe(false) - expect(spawnMock).toHaveBeenCalledOnce() - value.emit('close', null, 'SIGKILL') - await vi.advanceTimersByTimeAsync(0) - expect(terminated).toBe(true) - } - ) - it('waits for a PID error close before retry and ignores its stale callback', async () => { const values = [child(11), child(12)] spawnMock.mockReturnValueOnce(values[0]).mockReturnValueOnce(values[1]) diff --git a/src/main/git/command-runner/git-command-timeout-behavior.test.ts b/src/main/git/command-runner/git-command-timeout-behavior.test.ts deleted file mode 100644 index 8f3b058dc9d..00000000000 --- a/src/main/git/command-runner/git-command-timeout-behavior.test.ts +++ /dev/null @@ -1,103 +0,0 @@ -import { chmod, mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises' -import { tmpdir } from 'node:os' -import path from 'node:path' -import { afterEach, describe, expect, it } from 'vitest' -import { gitExecFileAsync, gitExecFileAsyncBuffer } from './git-exec-file' -import { GitCommandTimeoutError } from '../../../shared/git/commands/git-command-timeout' -import { gitStreamStdout } from './git-stream-stdout' - -const tempRoots: string[] = [] - -afterEach(async () => { - await Promise.all(tempRoots.splice(0).map((root) => rm(root, { recursive: true, force: true }))) -}) - -async function createTimedGitFixture(): Promise<{ - cwd: string - env: NodeJS.ProcessEnv -}> { - const root = await mkdtemp(path.join(tmpdir(), 'orca-git-timeout-')) - tempRoots.push(root) - const binDir = path.join(root, 'bin') - const cwd = path.join(root, 'repo') - await mkdir(binDir) - await mkdir(cwd) - const script = path.join(binDir, 'git') - await writeFile( - script, - `#!/usr/bin/env node -const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)) -async function run() { - if (process.env.ORCA_STUB_PROGRESSIVE === '1') { - const remaining = Math.max(0, Number(process.env.ORCA_STUB_EXIT_AT_MS) - Date.now()) - const step = remaining / 3 - await sleep(step) - process.stdout.write('one') - await sleep(step) - process.stdout.write('two') - await sleep(step) - process.stdout.write('three') - return - } - await sleep(Number(process.env.ORCA_STUB_SLEEP_MS)) - process.stdout.write('done') -} -void run() -` - ) - await chmod(script, 0o755) - return { - cwd, - env: { ...process.env, PATH: `${binDir}${path.delimiter}${process.env.PATH ?? ''}` } - } -} - -describe.skipIf(process.platform === 'win32')('git read timeout behavior', () => { - it('rejects a silent read at 1.1 times the deadline with a typed error', async () => { - const fixture = await createTimedGitFixture() - await expect( - gitExecFileAsync(['status', '--porcelain=v2'], { - ...fixture, - env: { ...fixture.env, ORCA_STUB_SLEEP_MS: '110' }, - timeoutMsForTest: 100 - }) - ).rejects.toBeInstanceOf(GitCommandTimeoutError) - }) - - it('times out a silent streaming read with the same typed error', async () => { - const fixture = await createTimedGitFixture() - await expect( - gitStreamStdout(['status'], { - ...fixture, - env: { ...fixture.env, ORCA_STUB_SLEEP_MS: '110' }, - timeoutMsForTest: 100, - onStdout: () => {} - }) - ).rejects.toBeInstanceOf(GitCommandTimeoutError) - }) - - it('applies the read default to binary blob reads', async () => { - const fixture = await createTimedGitFixture() - await expect( - gitExecFileAsyncBuffer(['show', 'HEAD:file.bin'], { - ...fixture, - env: { ...fixture.env, ORCA_STUB_SLEEP_MS: '110' }, - timeoutMsForTest: 100 - }) - ).rejects.toBeInstanceOf(GitCommandTimeoutError) - }) - - it.each([['fetch'], ['checkout'], ['unrecognized-command']])( - 'does not default-timeout the fail-safe %s class', - async (subcommand) => { - const fixture = await createTimedGitFixture() - await expect( - gitExecFileAsync([subcommand], { - ...fixture, - env: { ...fixture.env, ORCA_STUB_SLEEP_MS: '110' }, - timeoutMsForTest: 100 - }) - ).resolves.toMatchObject({ stdout: 'done' }) - } - ) -}) diff --git a/src/main/git/command-runner/git-operation-executor.test.ts b/src/main/git/command-runner/git-operation-executor.test.ts index 5cb77e999bb..8084af88491 100644 --- a/src/main/git/command-runner/git-operation-executor.test.ts +++ b/src/main/git/command-runner/git-operation-executor.test.ts @@ -1,11 +1,7 @@ import { afterEach, describe, expect, it } from 'vitest' import { resolveGitAdmissionTier } from './git-operation-executor' -import { - acquireGitAdmission, - _resetGitAdmissionForTests, - _gitAdmissionSnapshotForTests -} from './git-subprocess-admission' -import { GitAdmissionScheduler } from '../../../shared/git/admission/git-admission-scheduler' +import { _resetGitAdmissionForTests } from './git-subprocess-admission' + import { worktreeCreateGit, worktreePreparationGit @@ -34,44 +30,4 @@ describe('Git operation execution policy', () => { await create expect(resolveGitAdmissionTier()).toBe('status') }) - - it.each([false, true])( - 'expires inherited policy after completion (failure: %s)', - async (fail) => { - const finishDetached = Promise.withResolvers() - let detached: Promise | undefined - const create = worktreeCreateGit.run(async () => { - detached = finishDetached.promise.then(() => resolveGitAdmissionTier()) - if (fail) { - throw new Error('create failed') - } - }) - await (fail ? expect(create).rejects.toThrow('create failed') : create) - finishDetached.resolve() - await expect(detached).resolves.toBe('status') - } - ) - - it('admits nested commands without priority options while preparation work stays queued', async () => { - _resetGitAdmissionForTests(new GitAdmissionScheduler({ generalCap: 1, generalHeadroom: 1 })) - const blocker = await acquireGitAdmission({ args: ['status'], cwd: '/repo' }) - const preparation = worktreePreparationGit.run(() => - acquireGitAdmission({ args: ['status'], cwd: '/repo' }) - ) - try { - await worktreeCreateGit.run(async () => { - const grant = await acquireGitAdmission({ args: ['rev-parse', 'HEAD'], cwd: '/repo' }) - expect(_gitAdmissionSnapshotForTests()).toMatchObject({ - queued: 1, - budgets: { general: { baseUsed: 1, headroomUsed: 1 } } - }) - grant.release() - }) - } finally { - blocker.release() - const grant = await preparation - grant.release() - } - expect(_gitAdmissionSnapshotForTests().queued).toBe(0) - }) }) diff --git a/src/main/git/source-control/settled-diff-cache-bounds.test.ts b/src/main/git/source-control/settled-diff-cache-bounds.test.ts deleted file mode 100644 index 38633ce18ee..00000000000 --- a/src/main/git/source-control/settled-diff-cache-bounds.test.ts +++ /dev/null @@ -1,56 +0,0 @@ -import { describe, expect, it } from 'vitest' -import type { GitDiffResult } from '../../../shared/git/diff/git-diff-compare-types' -import { MAX_SETTLED_DIFF_CACHE_RESULT_CHARACTERS, SettledDiffCache } from './settled-diff-cache' -import type { WorktreeDiffStamp } from './worktree-diff-stamp' - -function settledStamp(value: string): WorktreeDiffStamp { - // Old enough that the racy-write margin is satisfied. - return { value, newestMtimeMs: Date.now() - 60_000, capturedAtMs: Date.now() } -} - -function diffOfSize(characters: number): GitDiffResult { - return { - kind: 'text', - originalContent: '', - modifiedContent: 'x'.repeat(characters), - originalIsBinary: false, - modifiedIsBinary: false - } -} - -describe('SettledDiffCache bounds', () => { - it('declines a single result larger than the per-entry cap', () => { - const cache = new SettledDiffCache() - - cache.set( - 'huge', - settledStamp('huge-stamp'), - diffOfSize(MAX_SETTLED_DIFF_CACHE_RESULT_CHARACTERS + 1), - cache.beginRead() - ) - - expect(cache.stats().entries).toBe(0) - expect(cache.stats().retainedCharacters).toBe(0) - }) - - it('releases retained characters when a key is overwritten', () => { - const cache = new SettledDiffCache() - cache.set('key', settledStamp('first'), diffOfSize(1_000), cache.beginRead()) - cache.set('key', settledStamp('second'), diffOfSize(10), cache.beginRead()) - - expect(cache.stats().entries).toBe(1) - expect(cache.stats().retainedCharacters).toBe(10) - expect(cache.get('key', settledStamp('first'))).toBeUndefined() - expect(cache.get('key', settledStamp('second'))).toBeDefined() - }) - - it('drops everything and refuses in-flight stores after a clear', () => { - const cache = new SettledDiffCache() - const readGeneration = cache.beginRead() - cache.clear() - cache.set('key', settledStamp('stamp'), diffOfSize(1), readGeneration) - - expect(cache.stats().entries).toBe(0) - expect(cache.stats().invalidatedDuringRead).toBe(1) - }) -}) diff --git a/src/main/git/worktrees/creation/worktree-create-git-executor-real-git.test.ts b/src/main/git/worktrees/creation/worktree-create-git-executor-real-git.test.ts deleted file mode 100644 index 11b0a073fae..00000000000 --- a/src/main/git/worktrees/creation/worktree-create-git-executor-real-git.test.ts +++ /dev/null @@ -1,108 +0,0 @@ -import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises' -import { tmpdir } from 'node:os' -import { join } from 'node:path' -import { afterEach, expect, it } from 'vitest' -import { gitExecFileAsync } from '../../command-runner/git-exec-file' -import { addWorktree } from './worktree-add' -import { listWorktrees } from '../catalog/worktree-scan-cache' -import { finalizePreparedWorktree } from './worktree-create-preparation' -import { worktreeCreateGit } from './worktree-create-git-executor' -import { - _resetPreparationPoolForTests, - listPreparations, - startPreparation, - takePreparation -} from '../../../workspaces/creation/preparation/worktree-create-preparation-pool' -import { - acquireGitAdmission, - _resetGitAdmissionForTests -} from '../../command-runner/git-subprocess-admission' -import { GitAdmissionScheduler } from '../../../../shared/git/admission/git-admission-scheduler' -import type { GitAdmissionEvent } from '../../../../shared/git/admission/git-admission-state' - -const roots: string[] = [] -afterEach(async () => { - _resetGitAdmissionForTests() - await _resetPreparationPoolForTests() - await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true }))) -}) - -it('creates cold and prepared worktrees with real Git while status capacity is occupied', async () => { - const root = await mkdtemp(join(tmpdir(), 'orca-create-policy-')) - roots.push(root) - const repo = join(root, 'repo') - await gitExecFileAsync(['init', '--quiet', repo], { cwd: root }) - await gitExecFileAsync(['symbolic-ref', 'HEAD', 'refs/heads/main'], { cwd: repo }) - await writeFile(join(repo, 'file.txt'), 'workspace content\n') - await gitExecFileAsync(['add', '.'], { cwd: repo }) - await gitExecFileAsync( - ['-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '-qm', 'fixture'], - { cwd: repo } - ) - - const events: GitAdmissionEvent[] = [] - _resetGitAdmissionForTests( - new GitAdmissionScheduler({ - generalCap: 1, - generalHeadroom: 1, - onAdmissionEvent: (event) => { - if (event.phase === 'grant') { - events.push(event) - } - } - }) - ) - await worktreeCreateGit.run(() => - startPreparation({ - repoPath: repo, - workspaceRoot: root, - baseBranch: 'main', - canonicalBase: 'refs/heads/main', - options: {} - }) - ) - expect(events.length).toBeGreaterThan(0) - expect(events.every((event) => event.tier === 'status')).toBe(true) - const [prepared] = listPreparations() - expect(prepared).toBeDefined() - takePreparation(prepared) - - const blocker = await acquireGitAdmission({ args: ['status'], cwd: repo }) - events.length = 0 - try { - await worktreeCreateGit.run(async () => { - await gitExecFileAsync(['fetch', repo, 'main'], { - cwd: repo, - useConfiguredSshCommandForNetwork: true, - env: { ...process.env, GIT_SSH_COMMAND: '' } - }) - await addWorktree(repo, join(root, 'cold'), 'cold', 'main') - await finalizePreparedWorktree( - repo, - prepared.preparedPath, - join(root, 'warm'), - 'warm', - 'main', - false, - {}, - prepared.lockReason - ) - expect(await listWorktrees(repo)).toHaveLength(3) - }) - expect( - events.filter((event) => event.args[0] === 'config').map((event) => event.args) - ).toContainEqual(['config', '--null', '--get-regexp', '^(core\\.sshcommand|ssh\\.variant)$']) - expect(events.some((event) => event.args.includes('fetch'))).toBe(true) - expect(events.every((event) => event.tier === 'interactive')).toBe(true) - expect( - events - .filter((event) => event.admissionClass === 'general') - .every((event) => event.slotKind === 'headroom') - ).toBe(true) - for (const name of ['cold', 'warm']) { - expect(await readFile(join(root, name, 'file.txt'), 'utf8')).toBe('workspace content\n') - } - } finally { - blocker.release() - } -}) diff --git a/src/main/git/worktrees/creation/worktree-safety-real-git.test.ts b/src/main/git/worktrees/creation/worktree-safety-real-git.test.ts deleted file mode 100644 index e9c2a5efd95..00000000000 --- a/src/main/git/worktrees/creation/worktree-safety-real-git.test.ts +++ /dev/null @@ -1,107 +0,0 @@ -import { mkdir, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises' -import { tmpdir } from 'node:os' -import { join } from 'node:path' -import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest' - -const { runner } = vi.hoisted(() => ({ runner: vi.fn() })) -vi.mock('../../command-runner/git-exec-file', async (importOriginal) => ({ - ...(await importOriginal>()), - gitExecFileAsync: runner -})) - -vi.mock('../../command-runner/git-exec-file-sync', async (importOriginal) => ({ - ...(await importOriginal>()), - gitExecFileSync: vi.fn() -})) - -vi.mock('../../command-runner/wsl-path-translation', async (importOriginal) => ({ - ...(await importOriginal>()), - translateWslOutputPaths: (value: string) => value -})) -vi.mock('../../source-control/git-read-cache-invalidation', () => ({ - runWithGitReadCacheInvalidation: (run: () => unknown) => run() -})) - -import { getBranchConflictKind, getBranchConflictKindViaExec } from '../../repo-branch-conflict' -import { clearGitCapabilityStateForTests } from '../../command-runner/git-capability-state' -import { GitBinaryTestFixture } from '../../../../shared/git/compatibility/git-binary.test-fixture' - -const expectedVersion = process.env.ORCA_GIT_COMPAT_VERSION -let fixture: GitBinaryTestFixture -let root = '' -let repo = '' - -async function git(args: string[], cwd = repo): Promise<{ stdout: string; stderr: string }> { - return fixture.exec(args, cwd) -} - -async function initializeRepo(cwd: string): Promise { - await mkdir(cwd, { recursive: true }) - await git(['init', '-q', '-b', 'main'], cwd).catch(() => git(['init', '-q'], cwd)) - await git(['config', 'user.name', 'Worktree Safety'], cwd) - await git(['config', 'user.email', 'safety@example.invalid'], cwd) - await git(['config', 'commit.gpgSign', 'false'], cwd) - await git(['config', 'core.hooksPath', '.git/no-hooks'], cwd) - await git(['config', 'gc.auto', '0'], cwd) - await writeFile(join(cwd, 'seed'), 'seed\n') - await git(['add', 'seed'], cwd) - await git(['commit', '-qm', 'seed'], cwd) -} - -beforeAll(async () => { - root = await realpath(await mkdtemp(join(tmpdir(), 'orca-worktree-safety-'))) - fixture = new GitBinaryTestFixture(root) - await fixture.start() - const { stdout } = await fixture.exec(['--version']) - expect(stdout).toContain(expectedVersion ? `git version ${expectedVersion}` : 'git version ') -}) - -afterAll(async () => { - try { - await fixture.stop() - } finally { - await rm(root, { recursive: true, force: true }) - } -}) - -beforeEach(async () => { - repo = await mkdtemp(join(root, 'repo-')) - await initializeRepo(repo) - clearGitCapabilityStateForTests() - runner.mockImplementation((args: string[], options: { cwd?: string }) => git(args, options.cwd)) -}) - -afterEach(async () => { - await rm(repo, { recursive: true, force: true }) -}) - -describe('worktree safety with the real Git binary', () => { - it.each([ - ['feature', 'Feature'], - ['Ä', 'ä'], - ['K', 'K'], - ['ß', 'ẞ'] - ])( - 'protects packed %s from the alias %s on native and SSH hosts', - async (existing, candidate) => { - await git(['branch', existing]) - await git(['pack-refs', '--all']) - const before = (await git(['rev-parse', `refs/heads/${existing}`])).stdout - await writeFile(join(repo, 'seed'), 'advanced base\n') - await git(['commit', '-qam', 'advance']) - for (const setting of ['true', 'false', 'unset']) { - await git( - setting === 'unset' - ? ['config', '--unset', 'core.ignoreCase'] - : ['config', 'core.ignoreCase', setting] - ) - await expect(getBranchConflictKind(repo, candidate)).resolves.toBe('local') - await expect(getBranchConflictKindViaExec((args) => git(args), candidate)).resolves.toBe( - 'local' - ) - expect((await git(['rev-parse', `refs/heads/${existing}`])).stdout).toBe(before) - } - }, - 90_000 - ) -}) diff --git a/src/main/git/worktrees/removal/worktree-rebase-update-refs-real-git.test.ts b/src/main/git/worktrees/removal/worktree-rebase-update-refs-real-git.test.ts deleted file mode 100644 index 08c4de1dbd7..00000000000 --- a/src/main/git/worktrees/removal/worktree-rebase-update-refs-real-git.test.ts +++ /dev/null @@ -1,109 +0,0 @@ -import { mkdir, mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises' -import { tmpdir } from 'node:os' -import { join } from 'node:path' -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import { GitBinaryTestFixture } from '../../../../shared/git/compatibility/git-binary.test-fixture' - -vi.mock('../../command-runner/git-exec-file', async (importOriginal) => ({ - ...(await importOriginal>()), - gitExecFileAsync: vi.fn() -})) - -vi.mock('../../command-runner/git-exec-file-sync', async (importOriginal) => ({ - ...(await importOriginal>()), - gitExecFileSync: vi.fn() -})) -vi.mock('../../refs/maintenance/local-repo-ref-maintenance', () => ({ - withRepoRefMaintenancePaused: (_reason: string, run: () => unknown) => run() -})) - -import { forceDeleteLocalBranch } from './worktree-branch-removal' - -let fixture: GitBinaryTestFixture -let root = '' -let repo = '' -let checkout = '' - -async function git(args: string[], cwd = repo): Promise<{ stdout: string; stderr: string }> { - return fixture.exec(args, cwd, { GIT_CONFIG_GLOBAL: join(root, 'empty-config') }) -} - -beforeEach(async () => { - root = await realpath(await mkdtemp(join(tmpdir(), 'orca-rebase-reservation-'))) - fixture = new GitBinaryTestFixture(root) - await fixture.start() - repo = join(root, 'repo') - checkout = join(root, 'checkout') - await mkdir(repo) - await writeFile(join(root, 'empty-config'), '') - await git(['init', '-q']) - await git(['symbolic-ref', 'HEAD', 'refs/heads/main']) - for (const [key, value] of [ - ['user.name', 'Reservation Safety'], - ['user.email', 'safety@example.invalid'], - ['commit.gpgSign', 'false'], - ['core.hooksPath', '.git/no-hooks'], - ['gc.auto', '0'] - ]) { - await git(['config', key, value]) - } - await writeFile(join(repo, 'seed'), 'seed\n') - await git(['add', 'seed']) - await git(['commit', '-qm', 'seed']) -}) - -afterEach(async () => { - try { - await fixture.stop() - } finally { - await rm(root, { recursive: true, force: true }) - } -}) - -describe('rebase branch reservations with real Git', () => { - it.for(['native'] as const)( - '%s retains auxiliary branches reserved by a paused real rebase --update-refs', - { timeout: 120_000 }, - async (_host, context) => { - await git(['worktree', 'add', '-q', '-b', 'feature', checkout]) - await writeFile(join(checkout, 'first'), 'first\n') - await git(['add', 'first'], checkout) - await git(['commit', '-qm', 'first'], checkout) - await git(['branch', 'auxiliary'], checkout) - const expected = (await git(['rev-parse', 'refs/heads/auxiliary'])).stdout.trim() - await writeFile(join(checkout, 'second'), 'second\n') - await git(['add', 'second'], checkout) - await git(['commit', '-qm', 'second'], checkout) - await writeFile(join(repo, 'base'), 'advanced main\n') - await git(['add', 'base']) - await git(['commit', '-qm', 'advance main']) - try { - await git(['rebase', '--update-refs', '--exec', 'false', 'main'], checkout) - throw new Error('Rebase did not pause') - } catch (error) { - if (error instanceof Error && /unknown option[^\n]*update-refs/.test(error.message)) { - context.skip() - } - if (!(error instanceof Error) || !/execution failed/.test(error.message)) { - throw error - } - } - const gitDir = (await git(['rev-parse', '--absolute-git-dir'], checkout)).stdout.trim() - expect(await readFile(join(gitDir, 'rebase-merge', 'update-refs'), 'utf8')).toContain( - 'refs/heads/auxiliary\n' - ) - await expect(git(['branch', '-D', 'auxiliary'])).rejects.toThrow( - /checked out|used by worktree/ - ) - const cleanupGit = vi.fn((args: string[], cwd: string) => git(args, cwd)) - const remove = () => forceDeleteLocalBranch(repo, 'auxiliary', expected, cleanupGit) - await expect(remove()).rejects.toThrow('checked out in another worktree') - expect(cleanupGit.mock.calls.map(([args]) => args)).toEqual([ - ['worktree', 'list', '--porcelain'] - ]) - expect((await git(['rev-parse', 'refs/heads/auxiliary'])).stdout.trim()).toBe(expected) - await git(['rebase', '--abort'], checkout) - await expect(remove()).resolves.toBeUndefined() - } - ) -}) diff --git a/src/main/hermes/hermes-config-flow-insertion.test.ts b/src/main/hermes/hermes-config-flow-insertion.test.ts index 50936ca4364..6bd7661a4ad 100644 --- a/src/main/hermes/hermes-config-flow-insertion.test.ts +++ b/src/main/hermes/hermes-config-flow-insertion.test.ts @@ -1,96 +1,8 @@ import { describe, expect, it } from 'vitest' -import { isMap, parseDocument } from 'yaml' + import { enablePlugin, updateConfigContent } from './hermes-config-yaml' -function expectInsertion(source: string, expected: unknown, eol: string): string { - const original = parseDocument(source) - expect(original.errors).toEqual([]) - expect(original.warnings).toEqual([]) - const plugins = original.get('plugins', true) - const parent = isMap(plugins) ? plugins : original.contents - if (!isMap(parent) || !parent.range) { - throw new Error('Fixture must contain a ranged mapping') - } - const position = parent.range[1] - 1 - const result = updateConfigContent(source, enablePlugin) - expect(result.detail).toBeUndefined() - const output = result.content ?? '' - const document = parseDocument(output) - expect(document.errors).toEqual([]) - expect(document.warnings).toEqual([]) - expect(document.toJS()).toEqual(expected) - expect(output.startsWith(source.slice(0, position))).toBe(true) - expect(output.endsWith(source.slice(position))).toBe(true) - expect(updateConfigContent(output, enablePlugin)).toEqual({ content: output }) - if (eol === '\r\n') { - expect(output.replaceAll(eol, '')).not.toContain('\n') - } - return output -} - describe.each(['\n', '\r\n'])('Hermes flow insertion with tab separation (%j)', (eol) => { - it.each([ - { - name: 'minimal tab', - source: 'plugins: {custom: keep # note\n\t}', - padding: '\n ' - }, - { - name: 'deeper escaped quoted key', - source: ' "plu\\u0067ins": {custom: keep # note\n \t}', - padding: '\n ' - }, - { - name: 'mixed spaces and tabs below required indentation', - source: ' plugins: {custom: keep # note\n \t \t }', - padding: '\n ' - }, - { - name: 'whitespace-only closing line', - source: 'plugins: {custom: keep # note\n\t \t }', - padding: '\n ' - }, - { - name: 'sufficient spaces before a tab', - source: 'plugins: {custom: keep # note\n \t}', - padding: '' - }, - { - name: 'deeper sufficient spaces before mixed separation', - source: ' plugins: {custom: keep # note\n \t \t}', - padding: '' - }, - { - name: 'root flow with zero required indentation', - source: ' {plugins: {custom: keep # note\n\t}}', - padding: '' - }, - { - name: 'tab after content on the same line', - source: 'plugins: {custom: keep\t}', - padding: '' - }, - { - name: 'explicit plugins key', - source: '? "plugins"\n: {custom: keep # note\n\t}', - padding: '\n ' - }, - { - name: 'deeper split explicit key', - source: ' ?\n "plugins"\n : {custom: keep # note\n \t}', - padding: '\n ' - } - ])('preserves source around $name', ({ source: input, padding }) => { - const source = input.replaceAll('\n', eol) - const output = expectInsertion( - source, - { plugins: { custom: 'keep', enabled: ['orca-status'] } }, - eol - ) - const insertion = `${padding}, enabled: [ orca-status ]`.replaceAll('\n', eol) - expect(output).toBe(source.replace('}', `${insertion}}`)) - }) - it('rejects an unrelated value change after repairing tab-separated insertion', () => { const source = 'model: "001"\nplugins: {custom: keep # note\n\t}'.replaceAll('\n', eol) expect( diff --git a/src/main/ipc/browser/desktop-browser-bridge-wiring.test.ts b/src/main/ipc/browser/desktop-browser-bridge-wiring.test.ts deleted file mode 100644 index 04f1d8b6b1b..00000000000 --- a/src/main/ipc/browser/desktop-browser-bridge-wiring.test.ts +++ /dev/null @@ -1,106 +0,0 @@ -import type * as RuntimeEnvironmentConnectivityHandlersModule from '../runtime-environments/runtime-environment-connectivity-handlers' -import type * as RuntimeEnvironmentManualDisconnectModule from '../runtime-environments/runtime-environment-manual-disconnect' -import { beforeEach, describe, expect, it, vi } from 'vitest' -import type { GlobalSettings } from '../../../shared/global-settings-types' -import type { SshConnectionState, SshTarget } from '../../../shared/ssh-types' - -const { targets, settings } = vi.hoisted(() => { - const targets: SshTarget[] = [] - const settings: { current: Partial } = { current: {} } - return { targets, settings } -}) - -vi.mock('electron', () => ({ webContents: { fromId: () => null } })) -vi.mock('../../browser/browser-manager', () => ({ browserManager: {} })) -vi.mock('../../runtime/rpc/methods/index', () => ({ ALL_RPC_METHODS: [] })) -vi.mock('../ssh/ssh-ipc-context', () => ({ - persistedStore: { getSettings: () => settings.current } -})) -vi.mock('../../managed-server/lifecycle/orcad-managed-tunnel', () => ({ - ensureOrcadManagedTunnel: vi.fn() -})) -vi.mock('../../ssh/targets/ssh-target-registry', async (importOriginal) => ({ - ...(await importOriginal>()), - getSshTargetRegistryStore: () => ({ listTargets: () => targets }) -})) -vi.mock('../../../shared/managed-orcad-ssh-owner', async (importOriginal) => ({ - ...(await importOriginal>()), - getManagedOrcadFenceEnvironmentId: (target: SshTarget) => `env-${target.id}` -})) -vi.mock('../runtime-environments/runtime-environment-connectivity-handlers', () => ({ - isRuntimeEnvironmentManuallyDisconnected: () => false -})) - -vi.mock('../runtime-environments/runtime-environment-manual-disconnect', async (importOriginal) => { - const facadeMocks = await vi.importMock( - '../runtime-environments/runtime-environment-connectivity-handlers' - ) - return { - ...(await importOriginal()), - isRuntimeEnvironmentManuallyDisconnected: facadeMocks.isRuntimeEnvironmentManuallyDisconnected - } -}) -vi.mock( - '../../../shared/remote-runtime/host-store/runtime-environment-store', - async (importOriginal) => ({ - ...(await importOriginal>()), - resolveEnvironment: (_userDataPath: string, environmentId: string) => ({ environmentId }) - }) -) -vi.mock( - '../../../shared/remote-runtime/host-catalog/runtime-environments', - async (importOriginal) => ({ - ...(await importOriginal>()), - getOrcadSshDeployment: ({ environmentId }: { environmentId: string }) => ({ - sshTargetId: environmentId.slice('env-'.length) - }) - }) -) - -import { listDesktopBrowserBridgeCandidates } from './desktop-browser-bridge-wiring' - -const host = (id: string, extra: Partial = {}): SshTarget => ({ - id, - label: id, - host: `${id}.example.com`, - port: 22, - username: 'me', - ...extra -}) -const connected = { - getState: (targetId: string): SshConnectionState => ({ - targetId, - status: 'connected', - error: null, - reconnectAttempt: 0 - }) -} - -beforeEach(() => { - targets.length = 0 - settings.current = {} -}) - -describe('which managed hosts may attach the desktop browser bridge', () => { - it('attaches a host with no saved switch or an explicit true, never an explicit false', () => { - targets.push( - host('absent'), - host('on', { allowRemoteCliControl: true }), - host('off', { allowRemoteCliControl: false }) - ) - - const candidates = listDesktopBrowserBridgeCandidates('/user-data', connected) - - expect(candidates.map((candidate) => candidate.targetId)).toEqual(['absent', 'on']) - }) - - it('holds back a host whose pages browse from this device', () => { - targets.push(host('routed'), host('opted-out')) - settings.current = { browserSshWorkspaceRoutingDisabledTargetIds: ['opted-out'] } - expect( - listDesktopBrowserBridgeCandidates('/user-data', connected).map((c) => c.targetId) - ).toEqual(['routed']) - settings.current = { browserSshWorkspaceRoutingEnabled: false } - expect(listDesktopBrowserBridgeCandidates('/user-data', connected)).toEqual([]) - }) -}) diff --git a/src/main/ipc/pty/ipc/closed-pane-spawn-refusal.test.ts b/src/main/ipc/pty/ipc/closed-pane-spawn-refusal.test.ts deleted file mode 100644 index 8194dfe6e3b..00000000000 --- a/src/main/ipc/pty/ipc/closed-pane-spawn-refusal.test.ts +++ /dev/null @@ -1,69 +0,0 @@ -import { afterEach, describe, expect, it, vi } from 'vitest' -import { getDefaultWorkspaceSession } from '../../../../shared/constants' -import type { WorkspaceSessionState } from '../../../../shared/workspace-session/workspace-session-state-types' -import type { Store } from '../../../persistence/loading-store/store' -import { - _resetClosedPaneFencesForTests, - fencedIfLayoutOwner, - partitionsFence -} from '../../../persistence/terminal-topology/closed-pane-binding-fence' -import { refuseClosedPaneSpawn } from './closed-pane-spawn-refusal' - -vi.mock('../../../../shared/layout-owner-switch', () => ({ ORCA_LAYOUT_OWNER_IS_MAIN: true })) - -function session(leafIds: string[]): WorkspaceSessionState { - const [first, second] = leafIds - return { - ...getDefaultWorkspaceSession(), - terminalLayoutsByTabId: { - t: { - root: second - ? { - type: 'split', - direction: 'vertical', - first: { type: 'leaf', leafId: first! }, - second: { type: 'leaf', leafId: second } - } - : { type: 'leaf', leafId: first! }, - activeLeafId: first!, - expandedLeafId: null - } - } - } -} - -function storeHolding(current: { value: WorkspaceSessionState }): Store { - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: refuseClosedPaneSpawn reads only these two Store members. - return { - getWorkspaceSessionHostIds: () => ['local'], - getWorkspaceSession: () => current.value - } as unknown as Store -} - -describe('a spawn for a pane main closed while it waited', () => { - afterEach(() => _resetClosedPaneFencesForTests()) - - it('starts nothing once main took the pane back', () => { - const current = { value: session(['a', 'b']) } - fencedIfLayoutOwner( - () => partitionsFence(['local'], () => current.value, true), - () => ((current.value = session(['a'])), { value: null }) - )() - - expect(() => refuseClosedPaneSpawn(storeHolding(current), 't', 'b')).toThrow( - 'terminal_pane_closed' - ) - }) - - it('starts a pane main never closed, or one it holds again', () => { - const current = { value: session(['a', 'b']) } - expect(() => refuseClosedPaneSpawn(storeHolding(current), 't', 'b')).not.toThrow() - - fencedIfLayoutOwner( - () => partitionsFence(['local'], () => current.value, true), - () => ((current.value = session(['a'])), { value: null }) - )() - current.value = session(['a', 'b']) - expect(() => refuseClosedPaneSpawn(storeHolding(current), 't', 'b')).not.toThrow() - }) -}) diff --git a/src/main/ipc/pty/ipc/terminal-view-attributes-ipc.test.ts b/src/main/ipc/pty/ipc/terminal-view-attributes-ipc.test.ts deleted file mode 100644 index 5c0eaf7c568..00000000000 --- a/src/main/ipc/pty/ipc/terminal-view-attributes-ipc.test.ts +++ /dev/null @@ -1,113 +0,0 @@ -import { afterEach, describe, expect, it } from 'vitest' -import { getDefaultSettings } from '../../../../shared/constants' -import type { TerminalOscColorQueryReplyColors } from '../../../../shared/terminal/protocol/queries/terminal-osc-color-reply' -import { LocalPtyProvider } from '../../../providers/local-pty/local-pty-provider' -import { - _resetTerminalViewAttributesForTest, - getTerminalViewerColors, - setPairedViewerColors, - setTerminalViewAttributes, - setTerminalViewerColorsListener -} from '../../../runtime/terminal-view-attribute-store' - -import type { TerminalViewAttributes } from '../../../../shared/terminal/protocol/queries/terminal-view-attributes' -import { - _resetColorQueryReplyColorsForTest, - getLocalPtyProvider, - setLocalPtyProvider -} from '../provider/registry' -import { installTerminalViewAttributesIpc } from './terminal-view-attributes-ipc' - -class RecordingProvider extends LocalPtyProvider { - readonly pushes: TerminalOscColorQueryReplyColors[] = [] - - override setColorQueryReplyColors(colors: TerminalOscColorQueryReplyColors): void { - this.pushes.push(colors) - } -} - -const DESKTOP_ATTRIBUTES: TerminalViewAttributes = { - foreground: [0, 0, 0], - background: [0x12, 0x34, 0x56], - cursor: [0, 0, 0], - ansi: Array.from({ length: 256 }, (): [number, number, number] => [0, 0, 0]), - colorSchemeMode: 'light', - cursorStyle: 'block', - cursorBlink: false -} -const DESKTOP = { foreground: '#000000', background: '#123456' } -const CLIENT = { foreground: '#2e3434', background: '#ffffff' } - -describe('seeding PTY owner colours from saved settings', () => { - const originalLocal = getLocalPtyProvider() - const settings = getDefaultSettings('/tmp') - - afterEach(() => { - _resetTerminalViewAttributesForTest() - _resetColorQueryReplyColorsForTest() - setLocalPtyProvider(originalLocal) - }) - - it('seeds a host with no display from its saved dark theme', () => { - const owner = new RecordingProvider() - setLocalPtyProvider(owner) - - installTerminalViewAttributesIpc({ getSettings: () => ({ ...settings, theme: 'dark' }) }) - - expect(owner.pushes).toEqual([{ foreground: '#ffffff', background: '#282c34' }]) - }) - - it('publishes colours a renderer already pushed instead of the saved theme', () => { - setTerminalViewAttributes(DESKTOP_ATTRIBUTES) - const owner = new RecordingProvider() - setLocalPtyProvider(owner) - - installTerminalViewAttributesIpc({ getSettings: () => settings }) - - expect(owner.pushes).toEqual([DESKTOP]) - }) -}) - -describe('one viewer colour value for every PTY owner', () => { - const originalLocal = getLocalPtyProvider() - const settings = getDefaultSettings('/tmp') - const SEED = { foreground: '#ffffff', background: '#282c34' } - - afterEach(() => { - _resetTerminalViewAttributesForTest() - _resetColorQueryReplyColorsForTest() - setLocalPtyProvider(originalLocal) - }) - - function install(): RecordingProvider { - const owner = new RecordingProvider() - setLocalPtyProvider(owner) - installTerminalViewAttributesIpc({ getSettings: () => ({ ...settings, theme: 'dark' }) }) - return owner - } - - it("switches to this host's window theme once its renderer pushes", () => { - const owner = install() - setPairedViewerColors(CLIENT) - - setTerminalViewAttributes(DESKTOP_ATTRIBUTES) - setPairedViewerColors({ foreground: '#111111', background: '#eeeeee' }) - - expect(getTerminalViewerColors()).toEqual(DESKTOP) - expect(owner.pushes).toEqual([SEED, CLIENT, DESKTOP]) - }) - - it('notifies once per change of the answered colours', () => { - install() - const published: unknown[] = [] - setTerminalViewerColorsListener((colors) => published.push(colors)) - - setPairedViewerColors(CLIENT) - setPairedViewerColors({ ...CLIENT }) - setTerminalViewAttributes(DESKTOP_ATTRIBUTES) - setTerminalViewAttributes({ ...DESKTOP_ATTRIBUTES, cursorBlink: true }) - setPairedViewerColors({ foreground: '#111111', background: '#eeeeee' }) - - expect(published).toEqual([CLIENT, DESKTOP]) - }) -}) diff --git a/src/main/ipc/pty/ipc/write-input-user-input.test.ts b/src/main/ipc/pty/ipc/write-input-user-input.test.ts index 9a9d29532ed..cb1470db3c9 100644 --- a/src/main/ipc/pty/ipc/write-input-user-input.test.ts +++ b/src/main/ipc/pty/ipc/write-input-user-input.test.ts @@ -3,12 +3,7 @@ import { TerminalRunFactsRegister } from '../../../runtime/terminal-run-facts' import { ptyOwnership } from '../provider/ownership-state' import { createPtyWriteInput } from './write-input' -import { - WRITE_ACCEPTED, - writeRefused, - writeUnverifiable, - type WriteSettlement -} from '../../../../shared/terminal/pty/lifecycle/pty-write-settlement' +import type { WriteSettlement } from '../../../../shared/terminal/pty/lifecycle/pty-write-settlement' const PTY_ID = 'pty-user-input' @@ -52,41 +47,6 @@ afterEach(() => { }) describe('renderer PTY writes: input kind', () => { - it.each(['local', 'ssh:ssh-connection'] as const)( - 'observes a settled write only after acceptance on the execution host (%s)', - async (owner) => { - ptyOwnership.set(PTY_ID, owner) - const observe = vi.fn() - const input = createWriteInput(new TerminalRunFactsRegister(), observe) - let finish: (settlement: WriteSettlement) => void = () => {} - provider.writeWithSettlement.mockReturnValueOnce( - new Promise((resolve) => { - finish = resolve - }) - ) - const args = { - id: PTY_ID, - data: '\x1b[27u', - inputKind: 'driving' as const, - requireWriteSettlement: true as const - } - const pending = input.writePtyInputAccepted(args) - expect(observe).not.toHaveBeenCalled() - finish(WRITE_ACCEPTED) - expect(await pending).toBe(true) - expect(observe).toHaveBeenCalledTimes(owner === 'local' ? 1 : 0) - observe.mockClear() - provider.writeWithSettlement.mockReturnValueOnce(writeRefused('endpoint_disconnected')) - expect(await input.writePtyInputAccepted(args)).toBe(false) - provider.writeWithSettlement.mockResolvedValueOnce( - writeUnverifiable('transport_settlement_lost', true) - ) - await expect(input.writePtyInputAccepted(args)).rejects.toThrow('acknowledgment unavailable') - expect(observe).not.toHaveBeenCalled() - expect(provider.write).not.toHaveBeenCalled() - } - ) - it.each(['writePtyInput', 'writePtyInputAccepted'] as const)( '%s records driving input before the provider write', async (writer) => { diff --git a/src/main/ipc/pty/pty-spawn-cwd-fallback-hung-folder.test.ts b/src/main/ipc/pty/pty-spawn-cwd-fallback-hung-folder.test.ts deleted file mode 100644 index a1202b92db2..00000000000 --- a/src/main/ipc/pty/pty-spawn-cwd-fallback-hung-folder.test.ts +++ /dev/null @@ -1,99 +0,0 @@ -import type * as FsPromises from 'node:fs/promises' -import { beforeEach, describe, expect, it, vi } from 'vitest' -import { spawnMock } from './pty-ipc-mock-registry' - -import { setupPtyIpcSuite } from './pty-ipc-test-harness' -import { registerPtyHandlers } from './register-handlers' - -type DirectoryStats = { isDirectory(): boolean } - -const statMock = vi.hoisted(() => vi.fn<(path: string) => Promise>()) - -vi.mock('node:fs/promises', async (importOriginal) => ({ - ...(await importOriginal()), - stat: statMock -})) -vi.mock('electron', () => import('./pty-ipc-mock-registry').then((m) => m.electronModuleMock())) -vi.mock('fs', () => import('./pty-ipc-mock-registry').then((m) => m.fsModuleMock())) -vi.mock('node-pty', () => import('./pty-ipc-mock-registry').then((m) => m.nodePtyModuleMock())) -vi.mock('node:child_process', async (importOriginal) => - (await import('./pty-ipc-mock-registry')).childProcessModuleMock(await importOriginal()) -) -vi.mock('../../opencode/hook-service', () => - import('./pty-ipc-mock-registry').then((m) => m.openCodeHookServiceModuleMock()) -) -vi.mock('../../mimo/hook-service', () => - import('./pty-ipc-mock-registry').then((m) => m.mimoHookServiceModuleMock()) -) -vi.mock('../../agent-hooks/server', () => - import('./pty-ipc-mock-registry').then((m) => m.agentHookServerModuleMock()) -) -vi.mock('../../pi/titlebar-extension-service', () => - import('./pty-ipc-mock-registry').then((m) => m.piTitlebarExtensionModuleMock()) -) -vi.mock('../../pty/shell-startup/pwsh', () => - import('./pty-ipc-mock-registry').then((m) => m.pwshModuleMock()) -) -vi.mock('../../wsl/filesystem/unc-path-access', async (importOriginal) => - (await import('./pty-ipc-mock-registry')).wslModuleMock(await importOriginal()) -) -vi.mock('../../telemetry/client', () => - import('./pty-ipc-mock-registry').then((m) => m.telemetryClientModuleMock()) -) -vi.mock('../../telemetry/classify-error', () => - import('./pty-ipc-mock-registry').then((m) => m.classifyErrorModuleMock()) -) -vi.mock('../../cli/linux-terminal-orca-cli-shim', () => - import('./pty-ipc-mock-registry').then((m) => m.linuxCliShimModuleMock()) -) -vi.mock('../../memory/pty-registry', () => - import('./pty-ipc-mock-registry').then((m) => m.ptyRegistryModuleMock()) -) -vi.mock('../../agent-hooks/migration-unsupported-pty-state', () => - import('./pty-ipc-mock-registry').then((m) => m.migrationUnsupportedPtyModuleMock()) -) -vi.mock('../../codex/configuration/homes/codex-pane-account-registry', () => - import('./pty-ipc-mock-registry').then((m) => m.codexPaneAccountRegistryModuleMock()) -) -vi.mock('../../codex/history/index/codex-state-db-backfill-recovery', () => - import('./pty-ipc-mock-registry').then((m) => m.codexBackfillRecoveryModuleMock()) -) - -const WORKTREE = '/Volumes/nas/repo' -const directoryStats = { isDirectory: () => true } - -function spawnWithWorktreeFallback(cwd: string): Promise { - return Promise.resolve( - handlers.get('pty:spawn')!(null, { - cols: 80, - rows: 24, - cwd, - cwdFallback: 'worktree', - worktreeId: `repo-1::${WORKTREE}` - }) - ) -} - -const { handlers, mainWindow } = setupPtyIpcSuite() - -beforeEach(() => { - statMock.mockReset() - // Provider validation uses sync stat; folder-workspace validation uses async stat. - statMock.mockImplementation(async () => directoryStats) -}) - -describe('pty:spawn with the worktree-folder fallback on a mount that stopped answering', () => { - it('never asks the worktree folder once the saved folder answers', async () => { - const outsideCwd = '/Users/alice/scratch' - statMock.mockImplementation(async (path) => - path === outsideCwd ? directoryStats : new Promise(() => {}) - ) - registerPtyHandlers(mainWindow as never) - - await spawnWithWorktreeFallback(outsideCwd) - - expect(statMock.mock.calls.map(([path]) => path)).toEqual([outsideCwd]) - const [, , options] = spawnMock.mock.calls.at(-1) as [string, string[], { cwd: string }] - expect(options.cwd).toBe(outsideCwd) - }) -}) diff --git a/src/main/ipc/runtime-environments/runtime-environment-removal-storage.test.ts b/src/main/ipc/runtime-environments/runtime-environment-removal-storage.test.ts index 33eeb524f75..0cab1c9eb4e 100644 --- a/src/main/ipc/runtime-environments/runtime-environment-removal-storage.test.ts +++ b/src/main/ipc/runtime-environments/runtime-environment-removal-storage.test.ts @@ -67,25 +67,4 @@ describe('runtime environment removal storage clearing', () => { finishTeardown() await vi.waitFor(() => expect(clearStorageMock).toHaveBeenCalledWith('environment-a')) }) - - it('retries a partition the first pass refused as live', async () => { - clearStorageMock - .mockResolvedValueOnce({ clearedPartitions: [], livePartitions: ['persist:one'] }) - .mockResolvedValueOnce({ clearedPartitions: ['persist:one'], livePartitions: [] }) - registerRuntimeEnvironmentConnectivityHandlers({ - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: remove reads only settings and the session-host prune. - store: { - getSettings: () => ({}), - removeWorkspaceSessionHost: vi.fn(), - setRemoteLayoutSnapshot: vi.fn(), - setHostRepoCatalogSnapshot: vi.fn() - } as never, - getUserDataPath: () => '/tmp/orca-user-data', - invalidateTransport: () => Promise.resolve() - }) - - removeHandler()(null, { selector: 'environment-a' }) - - await vi.waitFor(() => expect(clearStorageMock).toHaveBeenCalledTimes(2), { timeout: 2_000 }) - }) }) diff --git a/src/main/ipc/source-control/github-pr-refresh-document-lifetime.test.ts b/src/main/ipc/source-control/github-pr-refresh-document-lifetime.test.ts deleted file mode 100644 index d39700d0542..00000000000 --- a/src/main/ipc/source-control/github-pr-refresh-document-lifetime.test.ts +++ /dev/null @@ -1,99 +0,0 @@ -import type * as ClientModule from '../../github/client' -import type * as GetPrForBranchModule from '../../github/client/lookup/get-pr-for-branch' -import { EventEmitter } from 'node:events' -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import type { PRRefreshOutcome } from '../../../shared/github/pull-request-refresh-types' - -const { handlers, lookup, contents } = vi.hoisted(() => ({ - handlers: new Map unknown>(), - lookup: vi.fn(), - contents: new Map boolean }>() -})) -vi.mock('electron', () => ({ - ipcMain: { - handle: (channel: string, handler: (...args: unknown[]) => unknown) => - handlers.set(channel, handler) - }, - webContents: { fromId: (id: number) => contents.get(id) } -})) -vi.mock('../../github/client', () => ({ getPRForBranch: vi.fn(), getPRForBranchOutcome: lookup })) - -vi.mock('../../github/client/lookup/get-pr-for-branch', async (importOriginal) => { - const facadeMocks = await vi.importMock('../../github/client') - return { - ...(await importOriginal()), - getPRForBranch: facadeMocks.getPRForBranch - } -}) -vi.mock('../../github/pr-refresh-rate-limit-gate', () => ({ - prRefreshRateLimitPausedUntil: async () => null -})) -vi.mock('../../wsl/filesystem/wsl-unc-access-gate', () => ({ - wslDistroForPath: () => null, - blockedWslDistroForPath: async () => null -})) -vi.mock('../../crash-reporting/crash-breadcrumb-store', () => ({ - recordCoalescedCrashBreadcrumb: () => {} -})) -vi.mock('../ui', () => ({ sendToTrustedUIRenderer: () => {} })) -vi.mock('./github-repo-routing', () => ({ - validateAutomaticPRRefreshCandidate: (candidate: unknown) => ({ kind: 'ok', candidate }), - isPRRefreshCandidateRegistered: () => true -})) - -import { makeCandidate, makePR } from '../../github/pr-refresh-coordinator-test-harness' - -function sender(id: number) { - return Object.assign(new EventEmitter(), { id, isDestroyed: () => false }) -} -function found(): PRRefreshOutcome { - return { kind: 'found', pr: makePR({ checksStatus: 'pending' }), fetchedAt: Date.now() } -} -async function setup() { - const { registerGitHubPRRefreshHandlers } = await import('./github-pr-refresh-handlers') - const coordinator = await import('../../github/pr-refresh-coordinator') - const owner = sender(17) - const other = sender(18) - contents.set(owner.id, owner) - contents.set(other.id, other) - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Visible refresh registration reads only this store fixture's repo list. - const store = { getRepos: () => [] } as never - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Every PR is already counted, so the observer reads only this stats method. - const stats = { hasCountedPR: () => true } as never - registerGitHubPRRefreshHandlers(store, stats) - const report = (target = owner) => - handlers.get('gh:reportVisiblePRRefreshCandidates')!( - { sender: target }, - { candidates: [makeCandidate()], generation: Date.now() } - ) - return { owner, other, report, coordinator } -} - -describe('automatic PR refresh document ownership', () => { - beforeEach(() => { - vi.resetModules() - vi.useFakeTimers() - vi.setSystemTime(1_700_000_000_000) - handlers.clear() - contents.clear() - lookup.mockReset().mockImplementation(async () => found()) - }) - afterEach(() => { - vi.clearAllTimers() - vi.useRealTimers() - }) - - it('does not requeue a late lookup after document retirement', async () => { - const pending = Promise.withResolvers() - lookup.mockImplementationOnce(() => pending.promise) - const { owner, report, coordinator } = await setup() - report() - await vi.advanceTimersByTimeAsync(0) - owner.emit('render-process-gone') - pending.resolve(found()) - await vi.advanceTimersByTimeAsync(360_000) - expect(lookup).toHaveBeenCalledTimes(1) - expect(coordinator._getVisiblePRRefreshWindowCountForTests()).toBe(0) - expect(coordinator._getPRRefreshQueueSizeForTests()).toBe(0) - }) -}) diff --git a/src/main/memory/hydrate-local-pty-registry-folder-workspaces.test.ts b/src/main/memory/hydrate-local-pty-registry-folder-workspaces.test.ts deleted file mode 100644 index 11db2a8801e..00000000000 --- a/src/main/memory/hydrate-local-pty-registry-folder-workspaces.test.ts +++ /dev/null @@ -1,68 +0,0 @@ -import { beforeEach, expect, it, vi } from 'vitest' -import type { FolderWorkspace } from '../../shared/folder-workspaces/folder-workspace-types' -import type { SessionInfo } from '../daemon/types' -import type { Store } from '../persistence/loading-store/store' - -const getDaemonProviderMock = vi.fn() -vi.mock('../daemon/daemon-provider-state', () => ({ - getDaemonProvider: () => getDaemonProviderMock() -})) -vi.mock('../workspaces/execution-host/project-runtime-git-options', () => ({ - getLocalProjectWorktreeGitOptions: () => ({}) -})) -const listLocalRepoWorktreesStrictMock = vi.fn() -vi.mock('../workspaces/catalog/repo-worktrees', () => ({ - listLocalRepoWorktreesStrict: (...args: unknown[]) => listLocalRepoWorktreesStrictMock(...args) -})) - -function makeStore(folderWorkspaces: FolderWorkspace[]): Store { - const store: Partial = { - getRepos: () => [], - getFolderWorkspaces: () => folderWorkspaces, - getProjectGroups: () => [], - getAllWorktreeMeta: () => ({}), - getAllWorktreeMetaForHost: () => ({}) - } - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: hydration reads only the store members stubbed here. - return store as Store -} - -// Reset both memoized hydration and the module-scoped registry. -async function loadFresh() { - vi.resetModules() - const hydrateMod = await import('./hydrate-local-pty-registry') - const registryMod = await import('./pty-registry') - return { - hydrate: hydrateMod.hydrateLocalPtyRegistryAtBoot, - listRegisteredPtys: registryMod.listRegisteredPtys - } -} - -beforeEach(() => { - getDaemonProviderMock.mockReset() - listLocalRepoWorktreesStrictMock.mockReset() -}) - -it.each(['deleted', 'remote', 'ssh'] as const)( - 'rechecks folder ownership after inventory when the catalog becomes %s', - async (change) => { - const { hydrate, listRegisteredPtys } = await loadFresh() - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: ownership reads only id and executionHostId. - const folders = [{ id: 'folder-1', executionHostId: 'local' } as FolderWorkspace] - getDaemonProviderMock.mockReturnValue({ - listSessions: vi.fn().mockImplementation(async (): Promise[]> => { - if (change === 'deleted') { - folders.splice(0) - } else { - folders[0].executionHostId = change === 'ssh' ? 'ssh:target-1' : 'runtime:environment-1' - } - return [{ sessionId: 'folder:folder-1@@cafebabe', pid: 4242 }] - }) - }) - - await hydrate(makeStore(folders)) - - expect(listRegisteredPtys()).toEqual([]) - expect(listLocalRepoWorktreesStrictMock).not.toHaveBeenCalled() - } -) diff --git a/src/main/memory/memory-snapshot-buckets.test.ts b/src/main/memory/memory-snapshot-buckets.test.ts deleted file mode 100644 index a22feade543..00000000000 --- a/src/main/memory/memory-snapshot-buckets.test.ts +++ /dev/null @@ -1,71 +0,0 @@ -import { describe, expect, it, vi } from 'vitest' -import type { FolderWorkspace } from '../../shared/folder-workspaces/folder-workspace-types' -import type { MemorySnapshotStore } from './collector' -import { resolveWorktreeMemoryNames } from './memory-snapshot-buckets' - -const folder: FolderWorkspace = { - id: 'notes-folder', - projectGroupId: 'documentation', - name: 'Release notes', - folderPath: '/notes', - linkedTask: null, - comment: '', - isArchived: false, - isUnread: false, - isPinned: false, - sortOrder: 0, - lastActivityAt: 0, - createdAt: 0, - updatedAt: 0 -} -const group = { id: 'documentation', name: 'Documentation' } - -function makeStore(): MemorySnapshotStore & - Required> { - return { - getRepo: vi.fn(), - getWorktreeMeta: vi.fn(), - getFolderWorkspace: vi.fn((id) => (id === folder.id ? folder : undefined)), - getProjectGroups: vi.fn(() => [group]) - } -} - -describe('memory snapshot workspace names', () => { - it('resolves a folder workspace and its project group from persisted metadata', () => { - const store = makeStore() - expect(resolveWorktreeMemoryNames('folder:notes-folder', store)).toEqual({ - worktreeName: 'Release notes', - repoId: 'folder-workspace:documentation', - repoName: 'Documentation' - }) - expect(store.getRepo).not.toHaveBeenCalled() - }) - - it('reads updated folder and project-group names on the next snapshot', () => { - const store = makeStore() - resolveWorktreeMemoryNames('folder:notes-folder', store) - vi.mocked(store.getFolderWorkspace).mockReturnValue({ ...folder, name: 'Changelog' }) - vi.mocked(store.getProjectGroups).mockReturnValue([{ ...group, name: 'Docs' }]) - expect(resolveWorktreeMemoryNames('folder:notes-folder', store)).toMatchObject({ - worktreeName: 'Changelog', - repoName: 'Docs' - }) - }) - - it('keeps a readable folder label if its project-group metadata is missing', () => { - const store = makeStore() - vi.mocked(store.getProjectGroups).mockReturnValue([]) - expect(resolveWorktreeMemoryNames('folder:notes-folder', store)).toMatchObject({ - worktreeName: 'Release notes', - repoName: 'Release notes' - }) - }) - - it('keeps unknown folder ids identifiable without assigning them to a different folder', () => { - expect(resolveWorktreeMemoryNames('folder:missing', makeStore())).toEqual({ - worktreeName: 'folder:missing', - repoId: 'folder:missing', - repoName: 'folder:missing' - }) - }) -}) diff --git a/src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts b/src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts deleted file mode 100644 index 954ba07a6d6..00000000000 --- a/src/main/native-chat/agent-session-journal/journal-atomic-settlement-oversized.spec.ts +++ /dev/null @@ -1,82 +0,0 @@ -import type { createFixture } from './journal-atomic-settlement-contract-test-fixture' -import { expect, it } from 'vitest' -import { - AGENT_JOURNAL_THREAD_SCOPE, - type AgentJournalSnapshot -} from '../../../shared/agent-session/journal/agent-session-journal-types' -import { settleObservedExitForTest } from '../agent-session-wire/structured-agent-session-observed-exit.test-fixture' -import { openTestJournalHostDatabase } from './journal-host-database-test-support' -import { MAX_JOURNAL_LIFECYCLE_BATCH_BYTES } from './journal-row-schema' - -export function registerJournalAtomicSettlementOversizedTests( - fixture: ReturnType -): void { - it.each(['startup', 'stop'] as const)( - 'rolls back the %s submission verdict with its oversized item', - async (mode) => { - await fixture.journal.appendSubmission({ - clientMessageId: 'unanswered', - payloadFingerprint: 'unanswered', - fence: 7, - handoverRecorded: true, - body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'next' }] } - }) - await fixture.journal.resolveDispatch({ - clientMessageId: 'unanswered', - state: 'pending', - fence: 7, - turnScope: AGENT_JOURNAL_THREAD_SCOPE - }) - if (mode === 'stop') { - await fixture.journal.appendStopEvent({ reason: 'user-stop' }, 7) - } - await fixture.journal.appendItem( - { provider: 'orca', clientMessageId: 'oversized-call' }, - { - kind: 'tool-call', - name: 'Write', - input: 'x'.repeat(MAX_JOURNAL_LIFECYCLE_BATCH_BYTES), - state: 'running' - }, - { fence: 7, turnScope: AGENT_JOURNAL_THREAD_SCOPE } - ) - const input = { - journal: fixture.journal, - sessionId: fixture.SESSION, - fence: 7, - settlementId: `${mode}:7`, - verdict: { state: 'interrupted' as const, completedAt: 1_000 }, - pendingSubmissionReason: 'owner exited', - showUnexpectedExitOutcome: mode === 'startup', - ...(mode === 'startup' ? { exitedDuringStartup: { generation: 'start-7' } } : {}) - } - const database = openTestJournalHostDatabase(fixture.root) - const before = fixture.journal.snapshot() - const diskBefore = fixture.rows() - const published: AgentJournalSnapshot[] = [] - fixture.journal.observeCommits(() => published.push(fixture.journal.snapshot())) - database.db.exec(`CREATE TEMP TRIGGER reject_submission_settlement_item - BEFORE INSERT ON journal_rows - WHEN NEW.session_id = '${fixture.SESSION}' AND json_extract(NEW.row_json, '$.recovered') = 1 - AND json_extract(NEW.row_json, '$.kind') = 'item' - BEGIN SELECT RAISE(ABORT, 'item rejected after submission'); END`) - expect(await settleObservedExitForTest(input)).toMatchObject({ ok: false }) - expect(fixture.journal.snapshot()).toEqual(before) - expect(fixture.rows()).toEqual(diskBefore) - expect(published).toEqual([]) - database.db.exec('DROP TRIGGER reject_submission_settlement_item') - expect(await settleObservedExitForTest(input)).toMatchObject({ ok: true }) - expect(fixture.journal.submission('unanswered')).toMatchObject({ - dispatchState: mode === 'stop' ? 'unknown' : 'rejected', - recovered: true, - ...(mode === 'stop' ? {} : { rejection: { kind: 'providerStartFailed' } }) - }) - const committed = fixture.rows().slice(diskBefore.length) - expect(committed.filter((row) => row.kind === 'dispatch')).toHaveLength(1) - expect(published).toEqual([fixture.journal.snapshot()]) - expect(await settleObservedExitForTest(input)).toMatchObject({ ok: true }) - expect(fixture.rows().slice(diskBefore.length)).toEqual(committed) - expect(published).toHaveLength(1) - } - ) -} diff --git a/src/main/native-chat/agent-session-journal/journal-atomic-terminal-settlement.spec.ts b/src/main/native-chat/agent-session-journal/journal-atomic-terminal-settlement.spec.ts index 7b84274b638..6bbc9a464b8 100644 --- a/src/main/native-chat/agent-session-journal/journal-atomic-terminal-settlement.spec.ts +++ b/src/main/native-chat/agent-session-journal/journal-atomic-terminal-settlement.spec.ts @@ -1,9 +1,7 @@ import { createFixture } from './journal-atomic-settlement-contract-test-fixture' import { registerJournalAtomicSettlementRollbackTests } from './journal-atomic-settlement-rollback.spec' -import { registerJournalAtomicSettlementOversizedTests } from './journal-atomic-settlement-oversized.spec' export function registerJournalAtomicTerminalSettlementTests(): void { const fixture = createFixture() registerJournalAtomicSettlementRollbackTests(fixture) - registerJournalAtomicSettlementOversizedTests(fixture) } diff --git a/src/main/native-chat/agent-session-wire/agent-session-stop-note-refresh.test.ts b/src/main/native-chat/agent-session-wire/agent-session-stop-note-refresh.test.ts deleted file mode 100644 index 8a8b9bf9106..00000000000 --- a/src/main/native-chat/agent-session-wire/agent-session-stop-note-refresh.test.ts +++ /dev/null @@ -1,98 +0,0 @@ -// Rows frames must restate current work or clients interpret them as legacy-host frames. - -import { describe, expect, it } from 'vitest' -import { agentJournalItemKey } from '../../../shared/agent-session/journal/agent-session-journal-item-key' -import type { AgentJournalRenderItem } from '../../../shared/agent-session/journal/agent-session-journal-types' -import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session/agent-session-wire' -import type { AgentSessionJournal } from '../agent-session-journal/journal-store' -import { refreshDerivedStopNotes } from './agent-session-stop-note-refresh' -import { structuredAgentSessionStopNoteIdentity } from './structured-agent-session-command-turn' -import { StructuredAgentSessionCurrentWork } from './structured-agent-session-current-work' -import type { Subscriber } from './structured-agent-session-subscribers' - -const staleTurn: AgentJournalRenderItem = { - itemId: 'turn-old', - revision: 1, - sequence: 1, - observedAt: 1, - body: { kind: 'turn', turnId: 't-old', state: 'running', startedAt: 1 } -} -const stalePrompt: AgentJournalRenderItem = { - itemId: 'prompt-old', - revision: 1, - sequence: 2, - observedAt: 2, - body: { - kind: 'approval', - title: 'Run ls', - detail: null, - options: [{ id: 'allow', label: 'Allow' }], - resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null } - } -} -const noteId = agentJournalItemKey(structuredAgentSessionStopNoteIdentity('t-old')) -const unconfirmed = { - kind: 'status' as const, - text: 'x', - failure: { kind: 'cancelUnconfirmed' as const } -} -const projectedNote: AgentJournalRenderItem = { - itemId: noteId, - revision: 2, - sequence: 3, - observedAt: 3, - body: { kind: 'status', text: 'Stopped.' } -} -const items = [staleTurn, stalePrompt, projectedNote] - -describe('the stop-note refresh frame', () => { - it("restates the host's current work", () => { - const emitted: AgentSessionSubscribeEvent[] = [] - const journal = { - visitItems: (visit: (itemId: string, sequence: number, body: unknown) => void) => - visit(noteId, 3, unconfirmed), - itemsRead: () => ({ - sessionId: 's', - cursor: { epoch: 'e', sequence: 3 }, - items, - submissions: [] - }), - itemBody: (itemId: string) => (itemId === noteId ? unconfirmed : null) - } - const work = new StructuredAgentSessionCurrentWork( - { - cursor: () => ({ epoch: 'e', sequence: 3 }), - item: (id) => items.find((item) => item.itemId === id) ?? null, - runningTurn: () => ({ item: staleTurn, turnId: 't-old' }), - itemFence: () => 1, - visitItems: (visit) => { - for (const item of items) { - visit(item.itemId, item.sequence, item.body) - } - }, - submissions: () => [], - inputOrder: { recoverableSubmissions: () => [] }, - wroteBeforeOpen: () => false - }, - 2 - ) - const subscriber = { sessionId: 's', cursor: { epoch: 'e', sequence: 3 }, fence: 2 } - refreshDerivedStopNotes( - { emit: (_subscriber, event) => emitted.push(event), isActive: () => true }, - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the refresh reads only the subscriber's session, cursor and fence. - subscriber as unknown as Subscriber, - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the refresh reads only visitItems, snapshot and itemBody, all supplied. - journal as unknown as AgentSessionJournal, - 10, - work - ) - - expect(emitted).toHaveLength(1) - const frame = emitted[0] - if (frame?.type !== 'batch') { - throw new Error('expected a batch') - } - expect(frame.batch.items.length).toBeGreaterThan(0) - expect(frame).toMatchObject({ working: false, actionablePromptIds: [], latestTurn: null }) - }) -}) diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-codex-version-recovery.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-codex-version-recovery.test.ts deleted file mode 100644 index 649caee7562..00000000000 --- a/src/main/native-chat/agent-session-wire/structured-agent-session-codex-version-recovery.test.ts +++ /dev/null @@ -1,96 +0,0 @@ -import { afterEach, beforeEach, expect, it } from 'vitest' -import { AgentCliInstallationError } from '../agent-cli-installation-error' -import { isStructuredAgentSessionStartFailureRow } from '../../../shared/agent-session/failures/structured-agent-session-start-failure-row-key' -import { projectQueuedMessageCards } from '../../../shared/agent-session/view/structured-agent-session-queued-cards' -import { HOST_TEST_SESSION, hostTestMessage } from './structured-agent-session-host-test-data' -import { - createQueuedMessageTestRig, - eventually, - type QueuedMessageTestRig -} from './structured-agent-session-queued-message-rig.test-fixture' - -let rig: QueuedMessageTestRig -beforeEach(async () => { - rig = await createQueuedMessageTestRig({ - restartable: true, - idleSweep: { idleMs: () => 0, intervalMs: 60 * 60 * 1000 } - }) -}) -afterEach(() => rig.dispose()) - -async function retainedCards() { - const result = await rig.host.history({ sessionId: HOST_TEST_SESSION, direction: 'tail' }) - if (!result.ok) { - throw new Error('History refused') - } - const { page } = result - const cards = projectQueuedMessageCards(page.queuedMessages, page.submissions, { - queuePaused: Boolean(page.queuePause) - }) - return { page, cards } -} - -async function retainedDraft() { - const working = await rig.workingSend() - const queued = await rig.send('retained instruction', 'queue-if-active').result - if (!queued.ok || !('queued' in queued.value)) { - throw new Error('Expected a queued draft') - } - await rig.stop() - await rig.settleAccepted(working, 'earlier-turn') - await rig.host.collaboratorsForTests().lifetime.idleSweep.tick() - rig.starts.mockImplementationOnce(() => { - throw new AgentCliInstallationError({ - agent: 'codex', - installedVersion: '0.135.0', - minimumVersion: '0.136.0' - }) - }) - return queued.value.queued.messageId -} - -it.each(['returned', 'held'] as const)( - 'uses per-message Send after an existing conversation restart is version-refused with a %s draft and no pause', - async (kind) => { - let id = await retainedDraft() - expect(await rig.resume()).toMatchObject({ ok: true, value: { resumed: true } }) - await eventually(async () => expect((await rig.handoff(id))?.dispatchState).toBe('rejected')) - const rejected = await rig.handoffId(id) - if (kind === 'held') { - await rig.deleteQueued(id) - id = 'held-draft' - const journal = rig.host.collaboratorsForTests().sessions.get(HOST_TEST_SESSION)?.journal - if (!journal) { - throw new Error('Missing journal') - } - await journal.queuedMessages.insert({ - messageId: id, - body: hostTestMessage('retained instruction'), - holdReason: 'send_failed' - }) - } - const { page, cards } = await retainedCards() - expect(page.queuePause ?? null).toBeNull() - expect(cards).toMatchObject([{ messageId: id, hold: kind === 'held' ? 'paused' : 'returned' }]) - expect( - page.items.filter((item) => isStructuredAgentSessionStartFailureRow(item.itemId)) - ).toMatchObject([ - { - body: { - text: 'Codex 0.135.0 is too old for chats. Update to 0.136.0 or newer.', - tone: 'error', - failure: { refusal: { details: { codexInstallation: { installedVersion: '0.135.0' } } } } - } - } - ]) - expect(await rig.resume()).toMatchObject({ ok: true, value: { resumed: false } }) - const attempts = rig.starts.mock.calls.length - expect((await rig.submission(rejected))?.handedOverAt).toBeUndefined() - expect(rig.starts).toHaveBeenCalledTimes(attempts) - expect(await rig.sendNow(id)).toMatchObject({ ok: true }) - await eventually(async () => expect((await rig.handoff(id))?.handedOverAt).toBeDefined()) - expect(await rig.handoffId(id)).not.toBe(rejected) - expect(rig.starts).toHaveBeenCalledTimes(attempts + 1) - expect((await rig.submission(rejected))?.dispatchState).toBe('rejected') - } -) diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-options-deadline.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-options-deadline.test.ts deleted file mode 100644 index 6e5ca2350f2..00000000000 --- a/src/main/native-chat/agent-session-wire/structured-agent-session-options-deadline.test.ts +++ /dev/null @@ -1,100 +0,0 @@ -import { agentSessionConversationView } from '../../../shared/agent-session/lifecycle/agent-session-conversation-view' -import { it, expect, vi } from 'vitest' -import { createClaudeModelCatalogProbe } from '../../claude/claude-model-catalog-probe' -import { createAgentModelCatalogService } from '../agent-model-catalog/agent-model-catalog-service' -import { AgentModelCatalogStore } from '../agent-model-catalog/agent-model-catalog-store' -import { agentSessionRecordFixture } from '../agent-session-record-test-fixture' -import { claudeAndCodexAgents } from './structured-agent-session-adapter-router-test-support' -import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations' -import { readStructuredAgentSessionOptions } from './structured-agent-session-options-read' - -const SESSION = 'session-1' -function restingJournal() { - return { - threadGoal: () => null, - visitItems: () => {}, - inputOrder: { hasInputs: () => false }, - statusRead: () => ({ items: [], submissions: [] }), - contextUsage: () => null, - context: { floor: () => null } - } -} - -it('keeps one legacy deadline across an optional join and current resting read', async () => { - vi.useFakeTimers() - const args = Promise.withResolvers() - const resolving = vi.fn(() => args.promise) - const environment = vi.fn(async () => ({})) - const record = agentSessionRecordFixture({ - sessionId: SESSION, - provider: 'claude', - permissionMode: 'auto', - accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/fixture/account' } - }) - const catalog = createAgentModelCatalogService({ - store: new AgentModelCatalogStore(), - getConversation: () => { - const held = record - return held ? agentSessionConversationView(held) : undefined - }, - getRecord: () => record, - drivesRecord: () => true, - resolveAccountHome: async () => record.accountHome, - recordWorkspacePath: async () => '/fixture/workspace', - probes: { - claude: createClaudeModelCatalogProbe({ - resolveLaunchArgs: resolving, - resolveInheritedEnv: environment, - resolveCommand: () => ({ command: '/fixture/claude', prefixArgs: [] }), - resolveAuthPolicy: () => ({ account: 'system' }) - }) - } - }) - const completion = Promise.withResolvers() - const optionsReady = vi.fn(() => completion.promise) - let child: { phase: 'ready'; fence: number } | null = { phase: 'ready', fence: 1 } - const resting = { child: null, params: { provider: 'claude' }, journal: restingJournal() } - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the full read only uses these context members. - const context = { - deps: { - adapter: { readOptions: async () => ({ models: [], current: {} }) }, - agents: claudeAndCodexAgents(), - store: { - getConversation: () => { - const held = record - return held ? agentSessionConversationView(held) : undefined - }, - getRecord: () => record - }, - modelCatalog: catalog - }, - deliveryOrder: { optionsReady }, - serialize: (_id: string, task: () => Promise) => task(), - openConversation: async () => ({ ...resting, child }), - conversation: async () => resting - } as unknown as StructuredAgentSessionMutationContext - try { - const answer = readStructuredAgentSessionOptions(context, SESSION, { - readsWithoutModel: false - }) - await vi.advanceTimersByTimeAsync(0) - expect(resolving).not.toHaveBeenCalled() - await vi.advanceTimersByTimeAsync(10_000) - child = null - completion.resolve() - await vi.advanceTimersByTimeAsync(0) - expect(optionsReady).toHaveBeenCalledExactlyOnceWith(SESSION) - expect(resolving).toHaveBeenCalledOnce() - await vi.advanceTimersByTimeAsync(20_001) - await expect(answer).resolves.toMatchObject({ current: { permissionMode: 'auto' } }) - expect(resolving).toHaveBeenCalledOnce() - args.resolve([]) - await vi.advanceTimersByTimeAsync(0) - expect(environment).not.toHaveBeenCalled() - } finally { - completion.resolve() - args.resolve([]) - catalog.stop() - vi.useRealTimers() - } -}) diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-queue-idle.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-queue-idle.test.ts deleted file mode 100644 index ad7ff4f47a7..00000000000 --- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-queue-idle.test.ts +++ /dev/null @@ -1,75 +0,0 @@ -import { expect, it } from 'vitest' -import { projectStructuredAgentSessionMessages } from '../../../shared/agent-session/view/structured-agent-session-message-projection' -import { agentJournalSubmissionKey } from '../../../shared/agent-session/journal/agent-session-journal-item-key' -import { - createQueuedMessageTestRig, - eventually -} from './structured-agent-session-queued-message-rig.test-fixture' -import { - HOST_TEST_NOW, - HOST_TEST_SESSION as SESSION -} from './structured-agent-session-host-test-data' -import { STRUCTURED_AGENT_SESSION_IDLE_MS as IDLE_MS } from './structured-agent-session-idle-sweep' - -it('keeps a recovered handoff consumed through natural idle unload and a history reopen', async () => { - let now = HOST_TEST_NOW - const rig = await createQueuedMessageTestRig({ - restartable: true, - now: () => now, - idleSweep: { idleMs: () => IDLE_MS, intervalMs: 2_000_000_000 } - }) - try { - const first = await rig.workingSend() - await rig.send('handed-over card', 'queue-if-active').result - await rig.send('still waiting', 'queue-if-active').result - const cards = await rig.drafts() - const consumedId = cards[0]!.messageId - const waitingId = cards[1]!.messageId - await rig.settleAccepted(first, 'initial') - await eventually(async () => - expect((await rig.handoff(consumedId))?.handedOverAt).toBeDefined() - ) - const handoffId = await rig.handoffId(consumedId) - const dispatches = rig.dispatch.mock.calls.length - // Simulate process loss without a graceful close settling the handed-over row. - rig.host.collaboratorsForTests().lifetime.idleSweep.dispose() - rig.crashRestartHostProcess() - const read = async () => { - const result = await rig.host.history({ sessionId: SESSION, direction: 'tail' }) - if (!result.ok) { - throw new Error('history refused') - } - return result.page - } - const recovered = await read() - expect(recovered.submissions.find((row) => row.clientMessageId === handoffId)).toMatchObject({ - queuedMessageId: consumedId, - dispatchState: 'unknown', - recovered: true - }) - expect(recovered.queuedMessages?.map((card) => card.messageId)).toEqual([waitingId]) - const messages = () => - read().then((page) => projectStructuredAgentSessionMessages(page.items, [], page.submissions)) - const bubble = (await messages()).filter( - (message) => message.id === agentJournalSubmissionKey(handoffId) - ) - expect(bubble).toHaveLength(1) - expect(bubble[0]?.unsent).toBeUndefined() - expect(bubble[0]?.queued).toBeUndefined() - now += IDLE_MS + 1 - await rig.host.collaboratorsForTests().lifetime.idleSweep.tick() - expect(rig.host.collaboratorsForTests().sessions.has(SESSION)).toBe(true) - expect(await rig.deleteQueued(waitingId)).toMatchObject({ ok: true }) - now += IDLE_MS + 1 - await rig.host.collaboratorsForTests().lifetime.idleSweep.tick() - expect(rig.host.collaboratorsForTests().sessions.has(SESSION)).toBe(false) - const reopened = await read() - expect(reopened.queuedMessages ?? []).toEqual([]) - expect( - (await messages()).filter((message) => message.id === agentJournalSubmissionKey(handoffId)) - ).toEqual(bubble) - expect(rig.dispatch).toHaveBeenCalledTimes(dispatches) - } finally { - await rig.dispose() - } -}) diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-resend-ledger-refusal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-resend-ledger-refusal.test.ts index 49d8cbb5287..735cb00a671 100644 --- a/src/main/native-chat/agent-session-wire/structured-agent-session-resend-ledger-refusal.test.ts +++ b/src/main/native-chat/agent-session-wire/structured-agent-session-resend-ledger-refusal.test.ts @@ -1,6 +1,6 @@ import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest' import { AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS } from '../../../shared/agent-session/agent-session-host-authority' -import type { AgentSessionJournal } from '../agent-session-journal/journal-store' + import { openTestJournalHostDatabase } from '../agent-session-journal/journal-host-database-test-support' import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter' import type { StructuredAgentSessionHost } from './structured-agent-session-host' @@ -10,11 +10,7 @@ import { envelope, hostTestState } from './structured-agent-session-host-test-harness' -import { - HOST_TEST_NOW as NOW, - HOST_TEST_SESSION as SESSION, - hostTestMessage -} from './structured-agent-session-host-test-data' +import { HOST_TEST_NOW as NOW, hostTestMessage } from './structured-agent-session-host-test-data' let root: string let host: StructuredAgentSessionHost @@ -26,12 +22,6 @@ beforeEach(() => { afterEach(() => vi.restoreAllMocks()) -function hostJournal(): AgentSessionJournal { - return ( - host as unknown as { sessions: Map } - ).sessions.get(SESSION)!.journal -} - function sendParams(text: string, clientOperationId?: string) { const body = hostTestMessage(text) return { @@ -72,39 +62,6 @@ describe('send without ledger policy', () => { }) describe('a /clear in flight', () => { - it('answers a resend from the attempt queued ahead of it, delivering once', async () => { - await attach() - const journal = hostJournal() - const append = journal.appendSubmission.bind(journal) - const held = Promise.withResolvers() - // Hold the earlier send so clear arrives before the queued retry runs. - vi.spyOn(journal, 'appendSubmission').mockImplementationOnce(async (...args) => { - await held.promise - return append(...args) - }) - const earlier = host.send(CALLER, sendParams('holds the queue')) - const params = sendParams('queued ahead of the clear') - const id = params.envelope.clientOperationId - const attempt = host.send(CALLER, params) - await vi.waitFor(() => expect(journal.appendSubmission).toHaveBeenCalledTimes(1)) - - const clearing = clear() - const resent = host.send(CALLER, params) - held.resolve() - const [first, second] = await Promise.all([attempt, resent, earlier, clearing]) - - expect(first).toMatchObject({ ok: true, replayed: false }) - expect(second).toMatchObject({ - ok: true, - replayed: true, - value: { submission: { clientMessageId: id } } - }) - expect(journal.submissions().filter((entry) => entry.clientMessageId === id)).toHaveLength(1) - expect( - dispatch.mock.calls.filter(([input]) => input.clientMessageId === id).length - ).toBeLessThanOrEqual(1) - }) - it('refuses an old id only for the clear in flight', async () => { await attach() const clearing = clear() diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts deleted file mode 100644 index 9b0d0100634..00000000000 --- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts +++ /dev/null @@ -1,110 +0,0 @@ -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import type { AgentJournalSubmission } from '../../../shared/agent-session/journal/agent-session-journal-types' -import { structuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-wiring' - -import { StructuredAgentSessionSendSettlement } from './structured-agent-session-send-settlement' - -const SESSION = 'session-1' -const MESSAGE = 'continuation-1' - -let submission: AgentJournalSubmission -const journal = { - submission: (id: string): AgentJournalSubmission | undefined => - id === MESSAGE ? submission : undefined, - cursor: () => ({ epoch: 'epoch-1', sequence: 1 }), - activeTurnId: () => null -} - -beforeEach(() => { - vi.useFakeTimers() - submission = { - clientMessageId: MESSAGE, - fence: 2, - payloadFingerprint: 'fingerprint', - dispatchState: 'pending', - providerItemId: null, - reason: null, - submittedAt: 1, - resolvedAt: null, - handoverRecorded: true - } -}) - -afterEach(() => { - vi.useRealTimers() -}) - -describe('the restart continuation waits for its delivery (W18)', () => { - it('reaches accepted after a 40 s cold start, with nothing filed as unconfirmed', async () => { - const settlement = new StructuredAgentSessionSendSettlement(() => journal) - const surfaces = structuredAgentSessionRestartResumeSurfaces( - { - revealSession: async () => ({ readable: true }), - send: async () => { - throw new Error('not used') - }, - waitForSendSettlement: settlement.wait - }, - () => 0 - ) - - const verdict = surfaces.awaitSendSettlement(SESSION, MESSAGE) - await vi.advanceTimersByTimeAsync(40_000) - submission = { ...submission, dispatchState: 'accepted', providerItemId: 'item-1' } - settlement.publish(SESSION, journal) - - await expect(verdict).resolves.toMatchObject({ - value: { submission: { dispatchState: 'accepted' } } - }) - }) -}) - -describe('a restart batch holds a chat until its continuation is handed over', () => { - function surfacesOver(settlement: StructuredAgentSessionSendSettlement) { - return structuredAgentSessionRestartResumeSurfaces( - { - revealSession: async () => ({ readable: true }), - send: async () => { - throw new Error('not used') - }, - waitForSendSettlement: settlement.wait - }, - () => 0 - ) - } - - it('keeps waiting through a slow start and resolves once the agent takes the message', async () => { - const settlement = new StructuredAgentSessionSendSettlement(() => journal) - let released = false - const handedOver = surfacesOver(settlement) - .awaitSendHandedOver(SESSION, MESSAGE) - .then((result) => { - released = true - return result - }) - await vi.advanceTimersByTimeAsync(5 * 60_000) - expect(released).toBe(false) - submission = { ...submission, handedOverAt: 2 } - settlement.publish(SESSION, journal) - await expect(handedOver).resolves.toMatchObject({ - value: { submission: { dispatchState: 'pending', handedOverAt: 2 } } - }) - }) - - it('resolves once the start fails and the message is rejected', async () => { - const settlement = new StructuredAgentSessionSendSettlement(() => journal) - const handedOver = surfacesOver(settlement).awaitSendHandedOver(SESSION, MESSAGE) - submission = { ...submission, dispatchState: 'rejected', reason: 'Codex could not start.' } - settlement.publish(SESSION, journal) - await expect(handedOver).resolves.toMatchObject({ - value: { submission: { dispatchState: 'rejected' } } - }) - }) - - it('resolves undefined when the session closes first', async () => { - const settlement = new StructuredAgentSessionSendSettlement(() => journal) - const handedOver = surfacesOver(settlement).awaitSendHandedOver(SESSION, MESSAGE) - settlement.closeSession(SESSION) - await expect(handedOver).resolves.toBeUndefined() - }) -}) diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-unopened-tab.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-unopened-tab.test.ts deleted file mode 100644 index 008b4e48a7a..00000000000 --- a/src/main/native-chat/agent-session-wire/structured-agent-session-unopened-tab.test.ts +++ /dev/null @@ -1,116 +0,0 @@ -import { cp, rm } from 'node:fs/promises' -import { afterEach, beforeEach, expect, it, vi } from 'vitest' -import { openTestAgentSessionRecordStore } from '../../runtime/agent-session/records/agent-session-record-store-test-harness' -import { JOURNAL_OUTCOME_MARKER_VERSION } from '../agent-session-journal/journal-outcome-format' -import type Database from '../../sqlite/sync-database' -import { - closeTestJournalHostDatabases, - liveTestJournalRows, - openTestJournalHostDatabase, - updateTestJournalRowJson -} from '../agent-session-journal/journal-host-database-test-support' -import { StructuredAgentSessionHost } from './structured-agent-session-host' -import { - adapter, - attach, - CALLER, - envelope, - hostTestState, - replaceHostTestState -} from './structured-agent-session-host-test-harness' -import { - HOST_TEST_NOW as NOW, - HOST_TEST_SESSION as SESSION, - hostTestMessage -} from './structured-agent-session-host-test-data' -import { createStructuredAgentSessionLogger } from './structured-agent-session-logger' -import { NO_STRUCTURED_AGENTS } from './structured-agent-session-adapter-router-test-support' - -const relaunchedRoots: string[] = [] - -beforeEach(() => { - vi.spyOn(console, 'warn').mockImplementation(() => undefined) -}) - -afterEach(async () => { - vi.restoreAllMocks() - await closeTestJournalHostDatabases() - await Promise.all( - relaunchedRoots.splice(0).map((dir) => rm(dir, { recursive: true, force: true })) - ) -}) - -async function relaunchWith( - edit: (db: Database.Database) => void -): Promise { - const before = hostTestState() - await attach() - await before.host.flushStreamedEvents(SESSION) - await before.store.renewLeases([]) - const relaunched = `${before.root}-relaunched` - relaunchedRoots.push(relaunched) - // Simulate process death without copying its live lock. - await cp(before.root, relaunched, { - recursive: true, - filter: (source) => !source.includes('.lock') - }) - edit(openTestJournalHostDatabase(relaunched).db) - const store = await openTestAgentSessionRecordStore(relaunched, { - legacySessionTabIds: [SESSION] - }) - const host = new StructuredAgentSessionHost({ - agents: NO_STRUCTURED_AGENTS, - logger: createStructuredAgentSessionLogger(), - store, - adapter: adapter(), - journalDatabase: openTestJournalHostDatabase(relaunched), - claimKeyId: 'key-1', - mintSpawnToken: () => 'spawn-next', - now: () => NOW - }) - replaceHostTestState({ store, host }) - return host -} - -const damaged = (db: Database.Database) => updateTestJournalRowJson(db, SESSION, 1, '}{') -const savedByNewerOrca = (db: Database.Database) => { - const epochRow = liveTestJournalRows(db, SESSION).find((row) => row.seq === 1)! - const newer = { ...JSON.parse(epochRow.rowJson), v: JOURNAL_OUTCOME_MARKER_VERSION + 1 } - updateTestJournalRowJson(db, SESSION, 1, JSON.stringify(newer)) -} - -it.each([ - ['damaged', damaged, 'journalCorrupt'], - ['saved by a newer Orca', savedByNewerOrca, 'journalWrittenByNewerOrca'] -] as const)( - 'lists a restored chat that could not be opened (%s), and its read and send are refused with why', - async (_why, edit, reason) => { - const host = await relaunchWith(edit) - const workspaceId = hostTestState().store.getRecord(SESSION)?.location.workspaceId - const refusal = { code: 'agent_session_journal_unreadable', details: { reason } } - - await host.seedSessionTabs([SESSION]) - - expect(host.hasSession(SESSION)).toBe(false) - expect(host.listSessionTabs()).toEqual([ - { sessionId: SESSION, workspaceId, agent: expect.any(String) } - ]) - for (let read = 0; read < 3; read += 1) { - await expect(host.history({ sessionId: SESSION, direction: 'tail' })).rejects.toMatchObject({ - refusal - }) - } - const readFailureLogs = vi - .mocked(console.warn) - .mock.calls.filter(([line]) => String(line).includes('open-for-read')) - expect(readFailureLogs).toHaveLength(1) - const body = hostTestMessage('sent to a chat that cannot load') - await expect( - host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body }) - ).resolves.toMatchObject({ ok: false, refusal }) - - await host.setSessionTabVisibility(SESSION, false) - expect(host.listSessionTabs()).toEqual([]) - await host.flushAllStreamedEvents() - } -) diff --git a/src/main/omp/omp-session-cwd-lookup.test.ts b/src/main/omp/omp-session-cwd-lookup.test.ts index 971f3ac42b3..e6469ddf77d 100644 --- a/src/main/omp/omp-session-cwd-lookup.test.ts +++ b/src/main/omp/omp-session-cwd-lookup.test.ts @@ -61,12 +61,6 @@ async function lookup(cwd = '/repo/orca', homeDir = join(root, 'home'), temp = j } describe('OMP known-workspace transcript lookup', () => { - it('does not search unrelated workspaces when the known cwd has no transcript', async () => { - await record('--unrelated-project--') - expect(await lookup()).toBeNull() - expect(io.open).not.toHaveBeenCalled() - }) - it('finds the reverted SHA256 bucket used by OMP 17.2.5–17.2.8', async () => { const windows = process.platform === 'win32' const digest = windows @@ -88,28 +82,4 @@ describe('OMP known-workspace transcript lookup', () => { expect(await lookup(alias, home)).toBe(expected) } ) - - it('never descends into session artifacts even when a child carries the wanted ID', async () => { - const dir = join(sessionsDir, '--repo-orca--') - const artifact = FILE.slice(0, -'.jsonl'.length) - await mkdir(join(dir, artifact), { recursive: true }) - await writeFile(join(dir, artifact, FILE), '{}\n') - expect(await lookup()).toBeNull() - expect(io.open.mock.calls.map(([path]) => path)).toEqual([dir]) - }) - - it.skipIf(process.platform === 'win32')('rejects symlinked groups and files', async () => { - const outside = join(root, 'outside') - await mkdir(outside, { recursive: true }) - await mkdir(sessionsDir, { recursive: true }) - await writeFile(join(outside, FILE), '{}\n') - const group = join(sessionsDir, '--repo-orca--') - await symlink(outside, group) - expect(await lookup()).toBeNull() - expect(io.open).not.toHaveBeenCalled() - await rm(group) - await mkdir(group) - await symlink(join(outside, FILE), join(group, FILE)) - expect(await lookup()).toBeNull() - }) }) diff --git a/src/main/opencode/opencode-credential-backend.test.ts b/src/main/opencode/opencode-credential-backend.test.ts deleted file mode 100644 index fb72a555be0..00000000000 --- a/src/main/opencode/opencode-credential-backend.test.ts +++ /dev/null @@ -1,45 +0,0 @@ -import { beforeEach, describe, expect, it, vi } from 'vitest' -import { runProcess } from '@orca/process-host' -import { resolveCommandOnLocalPath } from '../ipc/command-path/command-path-resolver' -import { - detectOpenCodeCredentialBackend, - resetOpenCodeCredentialBackendProbes -} from './opencode-credential-backend' - -const files = vi.hoisted(() => ({ realpath: vi.fn(), stat: vi.fn() })) - -vi.mock('@orca/process-host', () => ({ runProcess: vi.fn() })) -vi.mock('../ipc/command-path/command-path-resolver', () => ({ resolveCommandOnLocalPath: vi.fn() })) -vi.mock('node:fs/promises', () => files) - -describe('OpenCode credential execution backend', () => { - beforeEach(() => { - vi.resetAllMocks() - resetOpenCodeCredentialBackendProbes() - files.realpath.mockImplementation(async (path: string) => path) - files.stat.mockResolvedValue({ dev: 1, ino: 2, size: 3, mtimeMs: 4, ctimeMs: 5 }) - vi.mocked(resolveCommandOnLocalPath).mockResolvedValue('/task/bin/opencode') - vi.mocked(runProcess).mockResolvedValue({ - code: 0, - signal: null, - stdout: '1.18.30\n', - stderr: '', - timedOut: false - }) - }) - - it('reprobes when the resolved binary is replaced', async () => { - expect(await detectOpenCodeCredentialBackend()).toBe('v1') - files.stat.mockResolvedValue({ dev: 1, ino: 6, size: 3, mtimeMs: 7, ctimeMs: 8 }) - vi.mocked(runProcess).mockResolvedValue({ - code: 0, - signal: null, - stdout: 'opencode v2.0.16', - stderr: '', - timedOut: false - }) - - expect(await detectOpenCodeCredentialBackend()).toBe('v2') - expect(runProcess).toHaveBeenCalledTimes(2) - }) -}) diff --git a/src/main/orcad/orcad-managed-idle-exit.test.ts b/src/main/orcad/orcad-managed-idle-exit.test.ts index 481437b1f33..f5e68538977 100644 --- a/src/main/orcad/orcad-managed-idle-exit.test.ts +++ b/src/main/orcad/orcad-managed-idle-exit.test.ts @@ -5,10 +5,8 @@ import { afterEach, describe, expect, it } from 'vitest' import { activationFenceExists, createOrcadIdleProbes, - resolveOrcadManagedIdleExit, type OrcadManagedIdleExitPorts } from './orcad-managed-idle-exit' -import { ORCAD_E2E_IDLE_TIMEOUT_ENV } from '../../shared/orcad-idle-exit' const config = { timeoutMs: 1_000, activationRoot: '/home/u/.orca-remote/.fence' } @@ -34,41 +32,7 @@ async function verdicts(ports: OrcadManagedIdleExitPorts): Promise { - it('stays off for a server the user started or paired', () => { - expect(resolveOrcadManagedIdleExit({})).toBeNull() - expect(resolveOrcadManagedIdleExit({ [ORCAD_E2E_IDLE_TIMEOUT_ENV]: '50' })).toBeNull() - }) -}) - describe('createOrcadIdleProbes', () => { - it.each<[string, Partial, string]>([ - [ - 'an open client socket', - { - readClientActivity: () => ({ openConnections: 1, requestsInFlight: 0, lastRequestAt: 0 }) - }, - 'clients' - ], - [ - 'a request still running', - { - readClientActivity: () => ({ openConnections: 0, requestsInFlight: 1, lastRequestAt: 0 }) - }, - 'clients' - ], - ['an in-process terminal', { listTerminals: async () => [{ id: 'pty-1' }] }, 'terminals'], - ['a live daemon session', { countDaemonSessions: async () => 2 }, 'terminals'], - ['a working agent', { agentStates: () => [{ state: 'working' }] }, 'agents'], - ['a loaded chat provider', { hasChatProviders: () => true }, 'chat-providers'], - ['a staged migration', { hasStagedMigration: () => true }, 'migration'], - ['an enabled or running automation', { automationsBusy: () => true }, 'automations'], - ['an Orca-started emulator', { emulatorsBusy: async () => true }, 'emulators'], - ['a held activation fence', { activationFenceExists: async () => true }, 'activation'] - ])('reads %s as busy', async (_label, override, probe) => { - expect((await verdicts({ ...idlePorts(), ...override }))[probe]).toBe('busy') - }) - it('treats a daemon that did not answer as unverifiable, not as no terminals', async () => { const result = await verdicts({ ...idlePorts(), countDaemonSessions: async () => null }) expect(result.terminals).toBe('unverifiable') diff --git a/src/main/persistence/loading-store/store-prune-gate-signals.test.ts b/src/main/persistence/loading-store/store-prune-gate-signals.test.ts deleted file mode 100644 index 6f9a5bc69ed..00000000000 --- a/src/main/persistence/loading-store/store-prune-gate-signals.test.ts +++ /dev/null @@ -1,114 +0,0 @@ -import { hostWorktreeTarget } from '../../../shared/worktree/host-qualified-identity' -import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness' -// Drive real Store writers so disconnected prune-gate call sites cannot pass unnoticed. -import { mkdtempSync, realpathSync } from 'node:fs' -import { tmpdir } from 'node:os' -import { join } from 'node:path' -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -import type { WorkspaceSessionState } from '../../../shared/workspace-session/workspace-session-state-types' -import { removeWorktreeMetaRow } from '../host-qualified-worktree-meta' - -vi.mock('electron', () => ({ - app: { - getPath: () => tmpdir(), - getName: () => 'orca-test', - getVersion: () => '0.0.0-test', - isPackaged: false, - on: () => {}, - whenReady: () => Promise.resolve() - }, - safeStorage: { - isEncryptionAvailable: () => false, - encryptString: (value: string) => Buffer.from(value), - decryptString: (value: Buffer) => value.toString() - }, - ipcMain: { on: () => {}, handle: () => {} }, - BrowserWindow: { getAllWindows: () => [] } -})) - -const { Store } = await import('./store') -const { - __resetLocalWorktreeMetadataPruneGateForTests, - isLocalWorktreeMetadataPruneDue, - markLocalWorktreeMetadataPruneStarted -} = await import('../../workspaces/catalog/local-worktree-metadata-prune-gate') - -const REPO_ID = 'repo-1' -const WORKTREE_ID = `${REPO_ID}::/tmp/worktree-a` - -const stores: InstanceType[] = [] - -beforeEach(() => { - __resetLocalWorktreeMetadataPruneGateForTests() -}) - -afterEach(async () => { - // Freeze debounced writes before their temporary directories disappear. - for (const store of stores.splice(0)) { - store.freezeWrites() - } - await closeTestStores() - vi.restoreAllMocks() -}) - -function createStore(): InstanceType { - const dir = realpathSync(mkdtempSync(join(tmpdir(), 'orca-store-prune-gate-'))) - const store = createSqliteTestStore(Store, { dataFile: join(dir, 'orca-data.json') }) - stores.push(store) - return store -} - -function parkGate(): void { - markLocalWorktreeMetadataPruneStarted(REPO_ID) - expect(isLocalWorktreeMetadataPruneDue(REPO_ID)).toBe(false) -} - -describe('store signals to the worktree metadata prune gate', () => { - it('re-arms the gate when a session releases its claim on a worktree', () => { - const store = createStore() - store.setWorkspaceSession({ - activeRepoId: REPO_ID, - activeWorktreeId: WORKTREE_ID, - activeTabId: 'tab-1', - tabsByWorktree: { [WORKTREE_ID]: [{ id: 'tab-1', worktreeId: WORKTREE_ID }] }, - terminalLayoutsByTabId: {} - } as unknown as WorkspaceSessionState) - parkGate() - - store.removeWorkspaceSessionStateForWorktree( - hostWorktreeTarget({ id: WORKTREE_ID, hostId: 'local' }) - ) - - expect(isLocalWorktreeMetadataPruneDue(REPO_ID)).toBe(true) - }) - - it('re-arms the gate when a metadata row is removed', () => { - const store = createStore() - store.setWorktreeMeta(hostWorktreeTarget({ id: WORKTREE_ID, hostId: 'local' }), { - displayName: 'a', - hostId: 'local' - }) - parkGate() - - removeWorktreeMetaRow(store, WORKTREE_ID, undefined) - - expect(isLocalWorktreeMetadataPruneDue(REPO_ID)).toBe(true) - }) - - it('leaves the gate parked for writes that only add or update a claim', () => { - const store = createStore() - parkGate() - - store.setWorktreeMeta(hostWorktreeTarget({ id: WORKTREE_ID, hostId: 'local' }), { - displayName: 'a', - hostId: 'local' - }) - store.setWorktreeMeta(hostWorktreeTarget({ id: WORKTREE_ID, hostId: 'local' }), { - displayName: 'b', - hostId: 'local' - }) - - // Ordinary scan writes must not rearm pruning and recreate the scan storm. - expect(isLocalWorktreeMetadataPruneDue(REPO_ID)).toBe(false) - }) -}) diff --git a/src/main/plugins/installation/plugin-atomic-file-write.test.ts b/src/main/plugins/installation/plugin-atomic-file-write.test.ts index 24e9f7a5624..7adb32bce9f 100644 --- a/src/main/plugins/installation/plugin-atomic-file-write.test.ts +++ b/src/main/plugins/installation/plugin-atomic-file-write.test.ts @@ -3,10 +3,7 @@ import { tmpdir } from 'node:os' import { join } from 'node:path' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import type * as FsPromises from 'node:fs/promises' -import { - renamePluginFileWithWindowsRetry, - writePluginFileAtomically -} from './plugin-atomic-file-write' +import { writePluginFileAtomically } from './plugin-atomic-file-write' // Windows AV/indexer locks cannot be provoked on CI, so queue the errno codes instead. const locks = vi.hoisted(() => ({ codes: [] as string[] })) @@ -89,38 +86,3 @@ describe('writePluginFileAtomically', () => { expect(await readFile(target, 'utf8')).toMatch(/^value-\d$/) }) }) - -describe('renamePluginFileWithWindowsRetry', () => { - describe('on Windows', () => { - let dir: string - let restorePlatform: () => void - - beforeEach(async () => { - dir = await mkdtemp(join(tmpdir(), 'orca-plugin-rename-win-')) - restorePlatform = withPlatform('win32') - }) - - afterEach(async () => { - restorePlatform() - locks.codes = [] - await rm(dir, { recursive: true, force: true }) - }) - - it.each(['EPERM', 'EACCES', 'EBUSY'])('retries past a transient %s lock', async (code) => { - await writePluginFileAtomically(join(dir, 'from'), 'payload') - locks.codes = [code, code] - await renamePluginFileWithWindowsRetry(join(dir, 'from'), join(dir, 'to')) - expect(await readFile(join(dir, 'to'), 'utf8')).toBe('payload') - expect(locks.codes).toEqual([]) - }) - - it('rethrows a non-retryable code without retrying', async () => { - await writePluginFileAtomically(join(dir, 'from'), 'payload') - locks.codes = ['ENOSPC', 'ENOSPC'] - await expect( - renamePluginFileWithWindowsRetry(join(dir, 'from'), join(dir, 'to')) - ).rejects.toMatchObject({ code: 'ENOSPC' }) - expect(locks.codes).toEqual(['ENOSPC']) - }) - }) -}) diff --git a/src/main/plugins/panels/plugin-frame-module-transform.test.ts b/src/main/plugins/panels/plugin-frame-module-transform.test.ts index 5a70bcf37d9..da85b01851b 100644 --- a/src/main/plugins/panels/plugin-frame-module-transform.test.ts +++ b/src/main/plugins/panels/plugin-frame-module-transform.test.ts @@ -1,13 +1,5 @@ import { describe, expect, it } from 'vitest' import { resolvePluginModuleSpecifier } from './plugin-frame-module-resolution' -import { createPluginSourceModuleCompiler } from './plugin-frame-module-transform' -import { transpilePluginSource } from './plugin-source-transpiler' - -// The real transform, in process; the worker hop is covered by plugin-source-transpile-client. -const inProcess = () => - createPluginSourceModuleCompiler({ - transpile: async (path, source) => transpilePluginSource(path, source) - }) const FILES = new Set([ 'src/panel.tsx', @@ -18,7 +10,6 @@ const FILES = new Set([ 'src/my file.ts' ]) const exists = async (path: string) => FILES.has(path) -const encode = (text: string) => new TextEncoder().encode(text) describe('resolvePluginModuleSpecifier', () => { it('refuses bare packages, escapes and missing files', async () => { @@ -36,31 +27,3 @@ describe('resolvePluginModuleSpecifier', () => { }) }) }) - -describe('createPluginSourceModuleCompiler', () => { - it('strips types, compiles JSX for orca and rewrites relative imports, keeping lines', async () => { - const compile = inProcess() - const source = [ - "import { Stack, type Atom } from 'orca'", - "import { add } from './util'", - 'type Props = { n: number }', - 'export default function Panel({ n }: Props) {', - ' return {add(n, 1)}', - '}', - "export const later = () => import('./list')" - ].join('\n') - const code = await compile({ relativePath: 'src/panel.tsx', bytes: encode(source), exists }) - expect(code).toContain('from "orca/jsx-runtime"') - expect(code).toContain("from './util.ts'") - expect(code).toContain('import("./list/index.tsx")') - expect(code).not.toContain('Props') - expect(code).not.toContain('Atom') - // Line-preserving: a guest error's line number is the author's line number. - const lines = code.split('\n') - expect(lines[4]).toContain('_jsx(Stack') - const mapLine = lines.at(-2) ?? '' - expect(mapLine).toMatch(/^\/\/# sourceMappingURL=data:application\/json/) - const map = JSON.parse(Buffer.from(mapLine.split('base64,')[1], 'base64').toString('utf8')) - expect(map).toMatchObject({ sources: ['panel.tsx'], sourcesContent: [source] }) - }) -}) diff --git a/src/main/plugins/workers/plugin-worker-panel-requests.test.ts b/src/main/plugins/workers/plugin-worker-panel-requests.test.ts index 81fcee75c42..30ea99f1baf 100644 --- a/src/main/plugins/workers/plugin-worker-panel-requests.test.ts +++ b/src/main/plugins/workers/plugin-worker-panel-requests.test.ts @@ -67,23 +67,3 @@ describe('worker panel requests', () => { await pending }) }) - -describe('workspace.changed in workers', () => { - it('replays the current context to a handler as it subscribes', async () => { - let orca!: PluginWorkerOrcaApi - const { send, runtime } = await activate((api) => (orca = api)) - const handler = vi.fn() - const disposed = vi.fn() - orca.events.on('workspace.changed', handler) - orca.events.on('workspace.changed', disposed).dispose() - const reads = send.mock.calls - .map(([message]) => message) - .filter((message) => message.method === 'workspace.readContext') - expect(reads).toHaveLength(2) - for (const read of reads) { - await runtime.handleMessage({ orca: 1, kind: 'res', id: read.id, result: { branch: 'main' } }) - } - await vi.waitFor(() => expect(handler).toHaveBeenCalledWith({ context: { branch: 'main' } })) - expect(disposed).not.toHaveBeenCalled() - }) -}) diff --git a/src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts b/src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts deleted file mode 100644 index 4efd8e46b26..00000000000 --- a/src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts +++ /dev/null @@ -1,114 +0,0 @@ -/** #15192: replay ConPTY bytes/resizes into the host emulator and assert buffer cells, since valid repaint bytes can still duplicate glyphs. - * Fixture/control assertions also run on POSIX; only bundled-vs-system ConPTY comparison requires Windows. */ -import { describe, expect, it } from 'vitest' -import type { Terminal } from '@xterm/headless' -import { HeadlessEmulator } from '../daemon/headless-emulator' -import { readWrappedLineGlyphs } from '../daemon/__fixtures__/terminal-wide-cell-grid' - -const KOREAN_LINE = '안녕하세요 오르카 테스트입니다. 결론부터 말씀드리면 시각적 피로도' -const LATIN_LINE = 'roadmap/complete-overhaul-backlog-history.md (1.75) R-08)' -const LINE_REPEATS = 8 -const COLS = 40 -const ROWS = 12 - -const glyphsOf = (line: string): string => line.replace(/\s+/g, '') -const KOREAN_GLYPHS = glyphsOf(KOREAN_LINE) -const LATIN_GLYPHS = glyphsOf(LATIN_LINE) - -type Event = { data: string } | { resizeTo: number } - -type RunOptions = { - useConptyDll: boolean - /** Milliseconds after spawn at which to resize, paired with the target width. */ - resizes?: { atMs: number; cols: number }[] - /** How long the child stays alive after its last write, so a resize can trigger a repaint. */ - holdMs: number -} - -// Node writes deterministic UTF-8; cmd.exe output depends on the machine codepage. -function childScript(holdMs: number): string { - return [ - `const ko=${JSON.stringify(KOREAN_LINE)};`, - `const la=${JSON.stringify(LATIN_LINE)};`, - `let i=0;`, - `const t=setInterval(()=>{process.stdout.write(ko+"\\r\\n"+la+"\\r\\n");`, - `if(++i>=${LINE_REPEATS}){clearInterval(t);setTimeout(()=>process.exit(0),${holdMs});}},25);` - ].join('') -} - -async function recordConpty(options: RunOptions): Promise { - const nodePty = await import('node-pty') - const proc = nodePty.spawn(process.execPath, ['-e', childScript(options.holdMs)], { - name: 'xterm-256color', - cols: COLS, - rows: ROWS, - cwd: process.cwd(), - env: process.env as Record, - ...(options.useConptyDll ? { useConptyDll: true } : {}) - }) - - // Preserve resize/output order for faithful Session.resize replay. - const events: Event[] = [] - proc.onData((chunk) => { - events.push({ data: chunk }) - }) - const timers = (options.resizes ?? []).map((resize) => - setTimeout(() => { - events.push({ resizeTo: resize.cols }) - try { - proc.resize(resize.cols, ROWS) - } catch { - /* the child may already have exited */ - } - }, resize.atMs) - ) - - await new Promise((resolve) => { - proc.onExit(() => resolve()) - }) - for (const timer of timers) { - clearTimeout(timer) - } - return events -} - -function replayIntoEmulator(events: Event[]): string[] { - const emulator = new HeadlessEmulator({ cols: COLS, rows: ROWS }) - for (const event of events) { - if ('resizeTo' in event) { - // Session.resize sizes the emulator before the pty; keep that order. - emulator.resize(event.resizeTo, ROWS) - } else { - emulator.writeSync(event.data) - } - } - const terminal = (emulator as unknown as { terminal: Terminal }).terminal - const lines = readWrappedLineGlyphs(terminal).filter((line) => line.length > 0) - emulator.dispose() - return lines -} - -/** Adjacent identical wide glyphs. Neither fixture contains any, so a hit is duplication. */ - -function expectFixtureLinesOnly(lines: string[]): void { - expect(lines.length).toBeGreaterThan(0) - expect(lines.filter((line) => line === KOREAN_GLYPHS)).toHaveLength(LINE_REPEATS) - // Latin is the control for script-specific corruption. - expect(lines.filter((line) => line === LATIN_GLYPHS)).toHaveLength(LINE_REPEATS) - expect(lines.filter((line) => line !== KOREAN_GLYPHS && line !== LATIN_GLYPHS)).toEqual([]) -} - -describe('pty repaint fidelity in the terminal buffer (#15192)', () => { - it('survives the resize the reporter used as a workaround, after output settles', async () => { - // Resize a quiet child so only ConPTY repaint can change the settled text. - const events = await recordConpty({ - useConptyDll: true, - holdMs: 900, - resizes: [ - { atMs: 450, cols: 31 }, - { atMs: 650, cols: 47 } - ] - }) - expectFixtureLinesOnly(replayIntoEmulator(events)) - }, 60_000) -}) diff --git a/src/main/runtime/agent-session-tab-layout-command.test.ts b/src/main/runtime/agent-session-tab-layout-command.test.ts deleted file mode 100644 index f926ca1e410..00000000000 --- a/src/main/runtime/agent-session-tab-layout-command.test.ts +++ /dev/null @@ -1,129 +0,0 @@ -import { describe, expect, it } from 'vitest' -import type { Tab } from '../../shared/tab-types' -import type { WorkspaceSessionState } from '../../shared/workspace-session/workspace-session-state-types' -import { chatTabLayoutCommand, loadChatTabLayout } from './agent-session/agent-session-tab-layout' - -const WT = 'repo-1::/tmp/worktree-a' - -function chatTab(sessionId: string, id: string): Tab { - return { - id, - entityId: sessionId, - groupId: 'group-1', - worktreeId: WT, - contentType: 'agent-session', - label: 'Chat', - customLabel: null, - color: null, - sortOrder: 0, - createdAt: 1 - } -} - -function session(tabs: Tab[], activeGroupId?: string): WorkspaceSessionState { - return { - activeRepoId: 'repo-1', - activeWorktreeId: WT, - activeTabId: null, - tabsByWorktree: {}, - terminalLayoutsByTabId: {}, - unifiedTabs: { [WT]: tabs }, - tabGroups: { - [WT]: [{ id: 'group-1', worktreeId: WT, activeTabId: null, tabOrder: tabs.map((t) => t.id) }] - }, - ...(activeGroupId ? { activeGroupIdByWorktree: { [WT]: activeGroupId } } : {}) - } -} - -function commandOn( - stored: WorkspaceSessionState, - change: Parameters[3] -) { - const { loaded, activeGroupId } = loadChatTabLayout('local', stored, WT) - return chatTabLayoutCommand(loaded.layout.workspaces[WT], activeGroupId, WT, change) -} - -const open = (sessionId: string) => ({ - open: { sessionId, agent: 'codex' as const, tabId: `agent-session:${sessionId}` } -}) - -describe("a host's chat tab change as main's layout command", () => { - it('names no group the workspace no longer holds, nor one with no layout loaded', () => { - expect(commandOn(session([chatTab('a', 'saved-tab')], 'gone'), open('b'))).toEqual( - expect.not.objectContaining({ groupId: expect.anything() }) - ) - expect(chatTabLayoutCommand(undefined, 'group-1', WT, open('b'))).toEqual( - expect.not.objectContaining({ groupId: expect.anything() }) - ) - }) - - describe("a paired client's chosen place (L270)", () => { - function twoGroups(): WorkspaceSessionState { - const tabs = [ - chatTab('a', 'tab-a'), - chatTab('c', 'tab-c'), - { ...chatTab('d', 'tab-d'), groupId: 'group-2' } - ] - return { - ...session(tabs, 'group-1'), - tabGroups: { - [WT]: [ - { id: 'group-1', worktreeId: WT, activeTabId: null, tabOrder: ['tab-a', 'tab-c'] }, - { id: 'group-2', worktreeId: WT, activeTabId: null, tabOrder: ['tab-d'] } - ] - } - } - } - const placed = (placement: { groupId?: string; afterTabId?: string }) => ({ - open: { ...open('b').open, placement } - }) - - it('opens the chat in the named group, after the named tab', () => { - expect(commandOn(twoGroups(), placed({ groupId: 'group-1', afterTabId: 'tab-a' }))).toEqual({ - type: 'openAgentSessionTab', - workspace: WT, - tabId: 'agent-session:b', - sessionId: 'b', - agent: 'codex', - groupId: 'group-1', - afterTabId: 'tab-a' - }) - }) - - it('prefers the named group to the remembered active one', () => { - expect(commandOn(twoGroups(), placed({ groupId: 'group-2' }))).toMatchObject({ - groupId: 'group-2' - }) - }) - - it('falls back to the active group for a group the workspace no longer holds', () => { - expect( - commandOn(twoGroups(), placed({ groupId: 'gone', afterTabId: 'tab-a' })) - ).toMatchObject({ - groupId: 'group-1', - afterTabId: 'tab-a' - }) - }) - - it('drops an anchor tab that is not in the chosen group', () => { - expect(commandOn(twoGroups(), placed({ groupId: 'group-2', afterTabId: 'tab-a' }))).toEqual( - expect.not.objectContaining({ afterTabId: expect.anything() }) - ) - }) - }) - - it('opens nothing for a chat a tab already shows', () => { - expect(commandOn(session([chatTab('a', 'saved-tab')], 'group-1'), open('a'))).toBeNull() - }) - - it('closes the tab that shows the chat, under its saved id, forced', () => { - expect( - commandOn(session([chatTab('a', 'saved-tab')]), { close: 'a', tabId: 'saved-tab' }) - ).toEqual({ - type: 'closeTabs', - workspace: WT, - tabIds: ['saved-tab'], - force: true - }) - }) -}) diff --git a/src/main/runtime/browser-execution-host-key-resolution.test.ts b/src/main/runtime/browser-execution-host-key-resolution.test.ts index fc33a8765ec..92bf418b36f 100644 --- a/src/main/runtime/browser-execution-host-key-resolution.test.ts +++ b/src/main/runtime/browser-execution-host-key-resolution.test.ts @@ -23,19 +23,6 @@ describe('browser execution host key resolution', () => { ).toMatchObject({ kind: 'native', runtimeId: runtime.getRuntimeId() }) }) - it('holds a resolvable workspace whose execution host cannot be minted yet', async () => { - const runtime = createRuntime() - Object.defineProperty(runtime, 'resolveBrowserNetworkExecutionHostForWorktree', { - value: async () => { - throw new Error('Host provider is not ready') - } - }) - - await expect(runtime.resolveBrowserExecutionHostKeyForWorkspace(WORKSPACE_ID)).resolves.toEqual( - { status: 'unavailable' } - ) - }) - it('settles a workspace that no longer resolves', async () => { const runtime = createRuntime() diff --git a/src/main/runtime/dsh-readiness-transcript.test.ts b/src/main/runtime/dsh-readiness-transcript.test.ts deleted file mode 100644 index 49dc3088fe7..00000000000 --- a/src/main/runtime/dsh-readiness-transcript.test.ts +++ /dev/null @@ -1,63 +0,0 @@ -import { readFileSync } from 'node:fs' -import { join } from 'node:path' -import { describe, expect, it } from 'vitest' -import { createDraftPasteReadyScanner } from '../../shared/draft-paste-ready-scanner' -import { - getAgentLabel, - isGeminiTerminalTitle, - resolveExplicitTerminalTitleAgentType -} from '../../shared/agent-status/title/terminal-title-agent-type' - -// Raw dsh-tui 0.10.2 / @deepseek-ai/dsh 0.1.5-rc.1 capture; agent-pty-transcript-capture.md. -const TRANSCRIPT = readFileSync(join(__dirname, '__fixtures__', 'dsh-tui-ready-no-key.txt'), 'utf8') - -const ESC = String.fromCharCode(27) -const BEL = String.fromCharCode(7) - -function readFirstOscTitle(data: string): string { - const open = data.indexOf(`${ESC}]0;`) - const bodyStart = open === -1 ? -1 : open + 4 - const terminator = bodyStart === -1 ? -1 : data.indexOf(BEL, bodyStart) - if (terminator === -1) { - throw new Error('the captured transcript carries no BEL-terminated OSC 0 title') - } - return data.slice(bodyStart, terminator) -} - -describe('DSH-TUI readiness from captured terminal bytes', () => { - it('fires the composer-ready signal well before the transcript ends', () => { - const scanner = createDraftPasteReadyScanner('dsh-composer-prompt') - let readyAt = -1 - for (let offset = 0; offset < TRANSCRIPT.length; offset += 1024) { - const chunk = TRANSCRIPT.slice(offset, offset + 1024) - if (scanner.observe(chunk).ready && readyAt === -1) { - readyAt = offset + chunk.length - } - } - // Composer arrives near byte 5910; do not wait for the remaining ~70KB whale animation. - expect(readyAt).toBeGreaterThan(0) - expect(readyAt).toBeLessThan(8192) - }) - - it('arms the quiet-window fallback from DECSET 2004 as well', () => { - const scanner = createDraftPasteReadyScanner('dsh-composer-prompt') - expect(scanner.observe(TRANSCRIPT.slice(0, 40)).armQuietTimer).toBe(true) - }) - - it('identifies the pane from DSH’s own title, not Gemini’s', () => { - const title = readFirstOscTitle(TRANSCRIPT) - expect(title).toContain('✦') - expect(title).toContain('\u{1F40B}') - expect(isGeminiTerminalTitle(title)).toBe(false) - expect(getAgentLabel(title)).toBe('DeepSeek Harness') - expect(resolveExplicitTerminalTitleAgentType(title)).toBe('dsh') - }) - - it('keeps a working DSH title out of Claude’s braille-spinner lane', () => { - // DSH working braille overlaps Claude's spinner glyphs. - for (const frame of ['⠂', '⠐']) { - const working = `${frame} \u{1F40B} fix the flaky test` - expect(getAgentLabel(working)).toBe('DeepSeek Harness') - } - }) -}) diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts deleted file mode 100644 index 55d2f43925a..00000000000 --- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec.ts +++ /dev/null @@ -1,43 +0,0 @@ -import { describe, expect, it } from 'vitest' -import { OrcaRuntimeService } from '../orca-runtime-test-mocks.spec' -import { - HEADLESS_LEAF_ID, - HEADLESS_SECOND_LEAF_ID, - TEST_WORKTREE_ID, - makeHeadlessTerminalLayout, - makeRuntimeStoreWithWorkspaceSession, - makeWorkspaceSessionWithHeadlessTerminal -} from '../orca-runtime-test-fixtures.spec' -import { planDuplicatePtyPaneRepair } from '../../persistence/terminal-topology/duplicate-pty-pane-repair' -import type { WorkspaceSessionState } from '../../../shared/workspace-session/workspace-session-state-types' - -// Windowless listing reads stored layout; duplicate PTY bindings need durable repair to avoid duplicate tabs. -const duplicate = makeWorkspaceSessionWithHeadlessTerminal({ - terminalLayoutsByTabId: { - 'host-tab': makeHeadlessTerminalLayout({ - [HEADLESS_LEAF_ID]: 'persisted-pty', - [HEADLESS_SECOND_LEAF_ID]: 'persisted-pty' - }) - } -}) - -async function terminalRows(session: WorkspaceSessionState): Promise { - const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession(session) - const runtime = new OrcaRuntimeService(runtimeStore) - runtime.setPtyController({ - write: () => true, - kill: () => true, - getForegroundProcess: async () => null, - listProcesses: async () => [] - }) - const snapshots = await runtime.listAllMobileSessionTabs() - return (snapshots.find((snapshot) => snapshot.worktree === TEST_WORKTREE_ID)?.tabs ?? []).filter( - (tab) => tab.type === 'terminal' - ).length -} - -describe('windowless mobile list of a terminal stored in two panes', () => { - it('lists one row once main has repaired the stored tree', async () => { - await expect(terminalRows(planDuplicatePtyPaneRepair(duplicate)!.session)).resolves.toBe(1) - }) -}) diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts deleted file mode 100644 index 011dfebb312..00000000000 --- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec.ts +++ /dev/null @@ -1,100 +0,0 @@ -import { describe, expect, it, vi } from 'vitest' -import { OrcaRuntimeService } from '../orca-runtime-test-mocks.spec' -import type { WorkspaceSessionState } from '../../../shared/workspace-session/workspace-session-state-types' -import { - HEADLESS_LEAF_ID, - HEADLESS_SECOND_LEAF_ID, - TEST_WORKTREE_ID, - makeHeadlessTerminalLayout, - makeRuntimeStoreWithWorkspaceSession, - makeWorkspaceSessionWithHeadlessTerminal -} from '../orca-runtime-test-fixtures.spec' - -// Model a moved/restored tab with an agent first pane, shell sibling and no live terminals; launchAgent applies tab-wide. -function splitAgentTabSession(withRecord: boolean): WorkspaceSessionState { - const base = makeWorkspaceSessionWithHeadlessTerminal() - const tab = base.tabsByWorktree[TEST_WORKTREE_ID]?.[0] - return { - ...base, - tabsByWorktree: { - [TEST_WORKTREE_ID]: tab ? [{ ...tab, ptyId: null, launchAgent: 'codex' }] : [] - }, - terminalLayoutsByTabId: { - 'host-tab': makeHeadlessTerminalLayout({ - [HEADLESS_LEAF_ID]: undefined, - [HEADLESS_SECOND_LEAF_ID]: undefined - }) - }, - sleepingAgentSessionsByPaneKey: withRecord - ? { - [`host-tab:${HEADLESS_LEAF_ID}`]: { - paneKey: `host-tab:${HEADLESS_LEAF_ID}`, - tabId: 'host-tab', - worktreeId: TEST_WORKTREE_ID, - agent: 'codex', - providerSession: { key: 'session_id', id: 'codex-session-1' }, - prompt: 'do the thing', - state: 'done', - capturedAt: 1, - updatedAt: 1, - origin: 'worktree-sleep' - } - } - : {} - } -} - -function startRuntime(session: WorkspaceSessionState): { - runtime: OrcaRuntimeService - spawn: ReturnType -} { - const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession(session) - const spawn = vi.fn().mockResolvedValue({ id: 'started-pty' }) - // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fixture store implements the runtime store methods these tests reach. - const runtime = new OrcaRuntimeService(runtimeStore as never) - runtime.setPtyController({ - spawn, - write: () => true, - kill: () => true, - getForegroundProcess: async () => null, - listProcesses: async () => [] - }) - runtime.syncWindowGraph(0, { tabs: [], leaves: [] }) - return { runtime, spawn } -} - -function spawnCommand(spawn: ReturnType): string { - const args: unknown = spawn.mock.calls[0]?.[0] - return typeof args === 'object' && args !== null && 'command' in args - ? String(args.command ?? '') - : '' -} - -const activate = (runtime: OrcaRuntimeService, leafId: string) => - runtime.activateMobileSessionTab(`id:${TEST_WORKTREE_ID}`, 'host-tab', leafId, { - notifyClients: false, - navigation: 'caller', - intent: 'user' - }) - -describe('OrcaRuntimeService', () => { - describe('a split agent tab starting with no live terminal', () => { - it('starts the split sibling as a plain shell, not as a fresh agent', async () => { - const { runtime, spawn } = startRuntime(splitAgentTabSession(true)) - - await activate(runtime, HEADLESS_SECOND_LEAF_ID) - - expect(spawn).toHaveBeenCalledOnce() - expect(spawnCommand(spawn)).not.toContain('codex') - expect(spawn.mock.calls[0]?.[0]).not.toMatchObject({ launchAgent: 'codex' }) - }) - - it('still resumes the agent in the pane that recorded it', async () => { - const { runtime, spawn } = startRuntime(splitAgentTabSession(true)) - - await activate(runtime, HEADLESS_LEAF_ID) - - expect(spawnCommand(spawn)).toContain('codex-session-1') - }) - }) -}) diff --git a/src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts b/src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts deleted file mode 100644 index d68d7512a23..00000000000 --- a/src/main/runtime/orca-runtime-tests/worktree-native-chat-setup.spec.ts +++ /dev/null @@ -1,111 +0,0 @@ -import { describe, expect, it, vi } from 'vitest' -import { getDefaultWorkspaceSession } from '../../../shared/constants' -import { WorktreeCreate } from '../../../shared/rpc-contract/worktree-create-params' -import { - buildRuntimeWorktreeCreateParams, - type WorktreeCreateRequest -} from '../../../renderer/src/store/slices/worktrees/create/worktree-create-payload' -import { buildManagedWorktreeCreateArgs } from '../rpc/methods/worktree-create-args' -import { - OrcaRuntimeService, - computeWorktreePathMock, - createSetupRunnerScript, - ensurePathWithinWorkspaceMock, - getDefaultTabsLaunch, - getEffectiveHooks, - listWorktrees -} from '../orca-runtime-test-mocks.spec' -import { - makeRuntimeStoreWithWorkspaceSession, - spawnedPtyEnv, - store -} from '../orca-runtime-test-fixtures.spec' - -const WORKTREE_PATH = '/tmp/workspaces/native-chat-setup' -const RUNNER = '/tmp/repo/.git/orca/setup-runner.sh' -const SETUP_ENV = { ORCA_WORKTREE_PATH: WORKTREE_PATH, SETUP_INPUT: 'preserved' } - -async function createFromRendererPayload(options: { - agent?: WorktreeCreateRequest['createdWithAgent'] - mode?: 'new-tab' | 'split-horizontal' | 'split-vertical' - activate?: boolean - runHooks?: boolean - withSetup?: boolean - defaultTabs?: boolean - startup?: boolean -}) { - const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession(getDefaultWorkspaceSession()) - const runtime = new OrcaRuntimeService({ - ...runtimeStore, - getSettings: () => ({ - ...store.getSettings(), - ...(options.mode ? { setupScriptLaunchMode: options.mode } : {}) - }) - }) - const spawn = vi.fn(async (_args: { command?: string; env?: Record }) => ({ - id: `pty-native-chat-${spawn.mock.calls.length}` - })) - runtime.setPtyController({ - spawn, - write: () => true, - kill: () => true, - getForegroundProcess: async () => null - }) - computeWorktreePathMock.mockReturnValue(WORKTREE_PATH) - ensurePathWithinWorkspaceMock.mockReturnValue(WORKTREE_PATH) - vi.mocked(listWorktrees).mockResolvedValue([ - { - path: WORKTREE_PATH, - head: 'def', - branch: 'native-chat-setup', - isBare: false, - isMainWorktree: false - } - ]) - vi.mocked(getEffectiveHooks).mockReturnValue({ scripts: { setup: 'pnpm install' } }) - vi.mocked(createSetupRunnerScript).mockResolvedValue({ - runnerScriptPath: RUNNER, - envVars: SETUP_ENV - }) - if (options.defaultTabs) { - vi.mocked(getDefaultTabsLaunch).mockReturnValue({ - runCommands: true, - tabs: [{ title: 'Dev', command: 'pnpm dev' }] - }) - } - const params = WorktreeCreate.parse({ - ...buildRuntimeWorktreeCreateParams( - { - repoId: 'repo-1', - name: 'native-chat-setup', - setupDecision: options.withSetup === false ? 'skip' : 'run', - ...(options.agent ? { createdWithAgent: options.agent } : {}), - ...(options.startup ? { startup: { command: 'codex' } } : {}) - }, - { name: 'native-chat-setup' } - ), - ...(options.activate ? { activate: true } : {}), - ...(options.runHooks ? { runHooks: true } : {}) - }) - const args = buildManagedWorktreeCreateArgs(params, {}, { clientKind: 'runtime' }) - expect(args.createdWithAgent).toBe(options.agent) - expect(args.startup?.command).toBe(options.startup ? 'codex' : undefined) - expect(args.activate).toBe(options.activate === true || options.startup === true) - expect(args.runHooks).toBe(options.runHooks === true) - const result = await runtime.createManagedWorktree({ ...args, awaitTerminalProvisioning: true }) - return { result, spawn } -} - -describe('native-chat setup through renderer payload, RPC and execution host', () => { - it.each(['split-horizontal', 'split-vertical'] as const)( - 'gives the requested startup and Setup separate tabs despite retired location %s', - async (mode) => { - const { spawn } = await createFromRendererPayload({ agent: 'codex', mode, startup: true }) - expect(spawn.mock.calls.map(([args]) => args.command)).toEqual(['codex', `bash ${RUNNER}`]) - const startupTabId = spawnedPtyEnv(spawn.mock.calls[0][0]).ORCA_TAB_ID - expect(startupTabId).toEqual(expect.any(String)) - expect(startupTabId).not.toBe('') - expect(startupTabId).not.toBe(spawnedPtyEnv(spawn.mock.calls[1][0]).ORCA_TAB_ID) - } - ) -}) diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts index e214500b57e..11dcf980d5c 100644 --- a/src/main/runtime/orca-runtime.test.ts +++ b/src/main/runtime/orca-runtime.test.ts @@ -91,9 +91,7 @@ await import('./orca-runtime-tests/mobile-session-tabs-part-13.spec') await import('./orca-runtime-tests/mobile-session-tabs-part-14.spec') await import('./orca-runtime-tests/mobile-session-tabs-cold-serve-hydrate.spec') await import('./orca-runtime-tests/mobile-session-tabs-empty-headless-snapshot.spec') -await import('./orca-runtime-tests/mobile-session-tabs-duplicate-pty-repair.spec') await import('./orca-runtime-tests/mobile-session-tabs-headless-chat-rebuild.spec') -await import('./orca-runtime-tests/mobile-session-tabs-split-agent-tab.spec') await import('./orca-runtime-tests/mobile-session-tabs-windowless-sleep-resume.spec') await import('./orca-runtime-tests/mobile-session-tabs-targeted-agent-resume.spec') await import('./orca-runtime-tests/mobile-session-tabs-headless-wake-report.spec') @@ -122,7 +120,6 @@ await import('./orca-runtime-tests/worktree-setup-and-startup-part-02.spec') await import('./orca-runtime-tests/worktree-setup-and-startup-part-03.spec') await import('./orca-runtime-tests/worktree-setup-and-startup-part-04.spec') await import('./orca-runtime-tests/worktree-setup-single-creator.spec') -await import('./orca-runtime-tests/worktree-native-chat-setup.spec') await import('./orca-runtime-tests/gitlab-and-pr-bases.spec') await import('./orca-runtime-tests/gitlab-and-pr-bases-part-02.spec') await import('./orca-runtime-tests/gitlab-and-pr-bases-part-03.spec') diff --git a/src/main/runtime/repo-worktree-admin-fingerprint.test.ts b/src/main/runtime/repo-worktree-admin-fingerprint.test.ts deleted file mode 100644 index e21b465fc39..00000000000 --- a/src/main/runtime/repo-worktree-admin-fingerprint.test.ts +++ /dev/null @@ -1,94 +0,0 @@ -// Use real Git to verify admin fingerprints, including Windows path/CRLF/move/lock semantics that Linux mocks cannot cover. -import { execFile } from 'node:child_process' -import { mkdir, mkdtemp, realpath, writeFile } from 'node:fs/promises' -import { removeTree } from '../../shared/windows-transient-lock-removal' -import { tmpdir } from 'node:os' -import { join } from 'node:path' -import { promisify } from 'node:util' -import { afterEach, beforeEach, describe, expect, it } from 'vitest' -import { readRepoWorktreeAdminFingerprint } from './repo-worktree-admin-fingerprint' - -const execFileAsync = promisify(execFile) - -let scratchDir = '' -let repoPath = '' -let worktreePath = '' - -async function git(args: string[], cwd: string): Promise { - const { stdout } = await execFileAsync('git', args, { cwd }) - return stdout -} - -async function fingerprint(path = repoPath): Promise { - return await readRepoWorktreeAdminFingerprint(path) -} - -beforeEach(async () => { - // realpath: macOS hands out /var/... temp paths while Git records /private/var/... in `gitdir`. - scratchDir = await realpath(await mkdtemp(join(tmpdir(), 'orca-worktree-fingerprint-'))) - repoPath = join(scratchDir, 'repo') - worktreePath = join(scratchDir, 'trees', 'feature') - await mkdir(repoPath, { recursive: true }) - await mkdir(join(scratchDir, 'trees'), { recursive: true }) - await git(['init', '-q'], repoPath) - await git(['config', 'user.email', 'fingerprint@example.invalid'], repoPath) - await git(['config', 'user.name', 'Fingerprint'], repoPath) - await writeFile(join(repoPath, 'seed.txt'), 'seed\n') - await git(['add', '-A'], repoPath) - await git(['commit', '-qm', 'seed'], repoPath) - await git(['worktree', 'add', '-q', worktreePath, '-b', 'feature'], repoPath) -}) - -afterEach(async () => { - await removeTree(scratchDir) -}) - -describe('readRepoWorktreeAdminFingerprint', () => { - it('changes when a worktree directory is deleted outside Git', async () => { - // The admin dir is untouched by `rm -rf`, but the row's `prunable` flag flips. - const before = await fingerprint() - await removeTree(worktreePath) - expect(await fingerprint()).not.toBe(before) - }) - - it('changes when an existing worktree lock is replaced', async () => { - await git( - ['worktree', 'lock', '--reason', 'orca-create-preparation:v1:12345:lease', worktreePath], - repoPath - ) - const before = await fingerprint() - const gitDir = (await git(['rev-parse', '--absolute-git-dir'], worktreePath)).trim() - await writeFile(join(gitDir, 'locked'), 'different user-owned lock\n') - expect(await fingerprint()).not.toBe(before) - }) - - it('changes when a linked worktree records a commit', async () => { - // Committing rewrites refs/heads/feature and leaves HEAD alone, but moves the reported HEAD oid. - const before = await fingerprint() - await writeFile(join(worktreePath, 'work.txt'), 'work\n') - await git(['add', '-A'], worktreePath) - await git(['commit', '-qm', 'work'], worktreePath) - expect(await fingerprint()).not.toBe(before) - }) - - it('still tracks a tip whose loose ref has been packed away', async () => { - await git(['pack-refs', '--all'], repoPath) - const before = await fingerprint() - await writeFile(join(worktreePath, 'packed.txt'), 'packed\n') - await git(['add', '-A'], worktreePath) - await git(['commit', '-qm', 'packed'], worktreePath) - expect(await fingerprint()).not.toBe(before) - }) - - it('reads a bare repo through its own gitdir', async () => { - const barePath = join(scratchDir, 'bare.git') - await git(['clone', '-q', '--bare', repoPath, barePath], scratchDir) - const before = await fingerprint(barePath) - expect(before).not.toBeNull() - await git( - ['worktree', 'add', '-q', join(scratchDir, 'trees', 'from-bare'), '-b', 'bare-tree'], - barePath - ) - expect(await fingerprint(barePath)).not.toBe(before) - }) -}) diff --git a/src/main/runtime/rpc/e2ee-crypto.test.ts b/src/main/runtime/rpc/e2ee-crypto.test.ts index bd7ac3cdced..824a2e09868 100644 --- a/src/main/runtime/rpc/e2ee-crypto.test.ts +++ b/src/main/runtime/rpc/e2ee-crypto.test.ts @@ -1,14 +1,10 @@ -import { describe, expect, it, vi } from 'vitest' +import { describe, expect, it } from 'vitest' import nacl from 'tweetnacl' import { generateKeyPair, deriveSharedKey, - encrypt, decrypt, - encryptBytes, - decryptBytes, - MAX_E2EE_ENCRYPTED_BASE64_CHARACTERS, - publicKeyFromBase64 + decryptBytes } from '../../../shared/remote-runtime/e2ee/node/e2ee-crypto' import { MOBILE_E2EE_LEGACY_FIXTURE } from '../../../shared/remote-runtime/e2ee/mobile-e2ee-legacy-fixtures' @@ -28,78 +24,8 @@ describe('e2ee-crypto', () => { ) }) - it('decrypt returns null with wrong key', () => { - const server = generateKeyPair() - const client = generateKeyPair() - const attacker = generateKeyPair() - - const clientShared = deriveSharedKey(client.secretKey, server.publicKey) - const attackerShared = deriveSharedKey(attacker.secretKey, server.publicKey) - - const encrypted = encrypt('secret data', clientShared) - expect(decrypt(encrypted, attackerShared)).toBeNull() - }) - - it('each encryption produces unique ciphertext (random nonce)', () => { - const server = generateKeyPair() - const client = generateKeyPair() - const shared = deriveSharedKey(client.secretKey, server.publicKey) - - const message = 'same message' - const a = encrypt(message, shared) - const b = encrypt(message, shared) - - expect(a).not.toBe(b) - }) - - it('handles unicode content', () => { - const server = generateKeyPair() - const client = generateKeyPair() - const shared = deriveSharedKey(client.secretKey, server.publicKey) - - const message = '日本語テスト 🎉 émojis' - const encrypted = encrypt(message, shared) - expect(decrypt(encrypted, shared)).toBe(message) - }) - it('decrypt returns null for truncated data', () => { const shared = deriveSharedKey(generateKeyPair().secretKey, generateKeyPair().publicKey) expect(decrypt('dG9vc2hvcnQ=', shared)).toBeNull() }) - - it('rejects oversized encoded inputs before base64 decoding', () => { - const shared = deriveSharedKey(generateKeyPair().secretKey, generateKeyPair().publicKey) - const decode = vi.spyOn(Buffer, 'from') - - expect(() => publicKeyFromBase64('A'.repeat(45))).toThrow('encoded value is too large') - expect(decrypt('A'.repeat(MAX_E2EE_ENCRYPTED_BASE64_CHARACTERS + 1), shared)).toBeNull() - expect(decode).not.toHaveBeenCalled() - decode.mockRestore() - }) - - it('decrypt returns null for tampered data', () => { - const server = generateKeyPair() - const client = generateKeyPair() - const shared = deriveSharedKey(client.secretKey, server.publicKey) - - const encrypted = encrypt('hello', shared) - const bytes = Buffer.from(encrypted, 'base64') - bytes[bytes.length - 1] ^= 0xff - const tampered = bytes.toString('base64') - - expect(decrypt(tampered, shared)).toBeNull() - }) - - it('encrypt/decrypt round-trips raw bytes for binary terminal frames', () => { - const server = generateKeyPair() - const client = generateKeyPair() - const serverShared = deriveSharedKey(server.secretKey, client.publicKey) - const clientShared = deriveSharedKey(client.secretKey, server.publicKey) - const payload = new Uint8Array([0, 1, 2, 127, 128, 255]) - - const encrypted = encryptBytes(payload, clientShared) - const decrypted = decryptBytes(encrypted, serverShared) - - expect(decrypted).toEqual(payload) - }) }) diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-budget.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-budget.test.ts deleted file mode 100644 index e7000310d34..00000000000 --- a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-budget.test.ts +++ /dev/null @@ -1,43 +0,0 @@ -import { describe, expect, it } from 'vitest' -import { getTerminalPasteIngestMs } from '../../../../../../shared/agent-launch/startup/agent-prompt-injection' -import { ORCHESTRATION_WORKER_START_CLIENT_GRACE_MS } from '../../../../../../shared/orchestration-timing-budgets' -import { - isWorkerStartTaskSpecTooLarge, - ORCHESTRATION_WORKER_START_PROMPT_MAX_BYTES, - ORCHESTRATION_WORKER_START_TASK_SPEC_MAX_BYTES -} from '../../../../../../shared/orchestration-worker-start-prompt-budget' -import { getTerminalInputByteLength } from '../../../../../../shared/terminal/input/terminal-input' -import { buildDispatchPreamble } from '../../../../orchestration/preamble' - -describe('worker-start prompt budget', () => { - it('refuses an 8 MiB Task spec whose fake-Windows ingest outlives RPC grace', async () => { - const spec = 'x'.repeat(8 * 1024 * 1024) - const prompt = buildDispatchPreamble({ - taskId: 'task_test', - dispatchId: 'ctx_test', - taskSpec: spec, - coordinatorHandle: 'term_coordinator', - workerHandle: 'term_worker' - }) - - expect(getTerminalPasteIngestMs('win32', getTerminalInputByteLength(prompt))).toBeGreaterThan( - ORCHESTRATION_WORKER_START_CLIENT_GRACE_MS - ) - await expect(isWorkerStartTaskSpecTooLarge(spec)).resolves.toBe(true) - }) - - it('keeps a maximum legal composition under the derived full-prompt ceiling', () => { - const prompt = buildDispatchPreamble({ - taskId: `task_${'a'.repeat(32)}`, - dispatchId: `ctx_${'b'.repeat(32)}`, - taskSpec: 'x'.repeat(ORCHESTRATION_WORKER_START_TASK_SPEC_MAX_BYTES), - coordinatorHandle: `term_${'d'.repeat(256)}`, - workerHandle: `term_${'e'.repeat(256)}`, - canDispatchSubWorkers: true - }) - - expect(getTerminalInputByteLength(prompt)).toBeLessThanOrEqual( - ORCHESTRATION_WORKER_START_PROMPT_MAX_BYTES - ) - }) -}) diff --git a/src/main/runtime/rpc/mobile-e2ee-v2-compressed-frame.test.ts b/src/main/runtime/rpc/mobile-e2ee-v2-compressed-frame.test.ts index d17e8d8412b..eafbc441bbf 100644 --- a/src/main/runtime/rpc/mobile-e2ee-v2-compressed-frame.test.ts +++ b/src/main/runtime/rpc/mobile-e2ee-v2-compressed-frame.test.ts @@ -1,37 +1,10 @@ -import { gunzipSync } from 'node:zlib' import { describe, expect, it, vi } from 'vitest' -import { - COMPRESSED_FRAMES_CLIENT_CAPABILITY, - readCompressedFrame -} from '../../../shared/remote-runtime/e2ee/paired-e2ee-compressed-frame' +import { COMPRESSED_FRAMES_CLIENT_CAPABILITY } from '../../../shared/remote-runtime/e2ee/paired-e2ee-compressed-frame' import { compressMobileE2EEV2Item } from './mobile-e2ee-v2-compressed-frame' const capable = [COMPRESSED_FRAMES_CLIENT_CAPABILITY] -function inflate(item: ReturnType) { - const frame = item.kind === 'binary' ? readCompressedFrame(item.plaintext) : null - return frame && { payloadKind: frame.payloadKind, bytes: gunzipSync(frame.gzipped) } -} - describe('compressMobileE2EEV2Item', () => { - it('sends large text to a capable phone as a compressed frame that inflates to the same text', () => { - const plaintext = JSON.stringify({ rows: Array.from({ length: 200 }, (_, i) => `ü-row-${i}`) }) - - const inflated = inflate(compressMobileE2EEV2Item({ kind: 'text', plaintext }, capable)) - - expect(inflated?.payloadKind).toBe('text') - expect(inflated?.bytes.toString('utf8')).toBe(plaintext) - }) - - it('compresses binary only when its sender marks it compressible', () => { - const terminal = { kind: 'binary' as const, plaintext: new Uint8Array(4096).fill(0x74) } - - expect(compressMobileE2EEV2Item(terminal, capable)).toBe(terminal) - const inflated = inflate(compressMobileE2EEV2Item(terminal, capable, { compressible: true })) - expect(inflated?.payloadKind).toBe('binary') - expect(new Uint8Array(inflated!.bytes)).toEqual(terminal.plaintext) - }) - it('leaves frames alone for phones without the capability and for small frames', () => { const large = { kind: 'text' as const, plaintext: 'x'.repeat(4096) } const small = { kind: 'text' as const, plaintext: '{"id":"1"}' } diff --git a/src/main/runtime/runtime-reference-integration.test.ts b/src/main/runtime/runtime-reference-integration.test.ts deleted file mode 100644 index 292519a84e8..00000000000 --- a/src/main/runtime/runtime-reference-integration.test.ts +++ /dev/null @@ -1,89 +0,0 @@ -import { afterEach, describe, expect, it, vi } from 'vitest' -import { - OrcaRuntimeService, - listWorktrees, - listWorktreesStrict, - listWorktreesSharedStrict -} from './orca-runtime-test-mocks.spec' -import { store, TEST_WORKTREE_ID } from './orca-runtime-test-fixtures.spec' -import { parseWorkspaceReferenceUrl } from '../../shared/workspace-attachments/workspace-reference-identity' - -vi.mock('./agent-session/records/agent-session-record-store-slot', () => ({ - peekOpenedAgentSessionRecordStore: () => null, - openAgentSessionRecordStoreOnce: async () => ({ - store: { listConversations: () => [], getConversation: () => null } - }) -})) - -const linear = 'https://linear.app/acme/issue/STA-1234' - -afterEach(() => vi.restoreAllMocks()) - -function setup(Runtime: typeof OrcaRuntimeService = OrcaRuntimeService) { - const base = store.getAllWorktreeMeta()[TEST_WORKTREE_ID] - const linkedItems = [parseWorkspaceReferenceUrl(linear)] - const runtimeStore = { - ...store, - getAllWorktreeMeta: () => ({ - [TEST_WORKTREE_ID]: { ...base, linkedItems }, - 'repo-2::/elsewhere': { ...base, displayName: 'other', linkedItems } - }), - getRepos: () => [ - ...store.getRepos(), - { id: 'repo-2', path: '/elsewhere', displayName: 'other', badgeColor: '', addedAt: 0 } - ] - } - vi.mocked(listWorktrees).mockClear() - vi.mocked(listWorktreesStrict).mockClear() - vi.mocked(listWorktreesSharedStrict).mockClear() - return new Runtime(runtimeStore) -} - -describe('reference find runtime integration', () => { - it('searches cold saved metadata across repos without a Git scan', async () => { - const runtime = setup() - const result = await runtime.findWorkspaceReferences({ query: 'STA-1234' }) - expect(result.matches.map(({ workspace }) => workspace.id)).toEqual([ - TEST_WORKTREE_ID, - 'repo-2::/elsewhere' - ]) - expect(listWorktrees).not.toHaveBeenCalled() - expect(listWorktreesStrict).not.toHaveBeenCalled() - expect(listWorktreesSharedStrict).not.toHaveBeenCalled() - }) - - it('filters explicit repo and workspace selectors without populating the Git cache', async () => { - const runtime = setup() - expect( - (await runtime.findWorkspaceReferences({ query: linear, repo: 'id:repo-2' })).matches.map( - ({ workspace }) => workspace.id - ) - ).toEqual(['repo-2::/elsewhere']) - expect( - (await runtime.findWorkspaceReferences({ query: linear, worktree: 'name:foo' })).matches.map( - ({ workspace }) => workspace.id - ) - ).toEqual([TEST_WORKTREE_ID]) - expect(listWorktrees).not.toHaveBeenCalled() - expect(listWorktreesStrict).not.toHaveBeenCalled() - expect(listWorktreesSharedStrict).not.toHaveBeenCalled() - }) - - it('warms the worktree cache when a branch selector misses cold metadata', async () => { - const discovered = { - path: '/tmp/worktree-a', - head: 'abc', - branch: 'refs/heads/feat', - isBare: false, - isMainWorktree: false - } - class ScannedRuntime extends OrcaRuntimeService { - protected override async listRepoWorktreesForResolution(repo: { id: string }) { - return { ok: true as const, worktrees: repo.id === 'repo-2' ? [] : [discovered] } - } - } - const runtime = setup(ScannedRuntime) - const result = await runtime.findWorkspaceReferences({ query: linear, worktree: 'branch:feat' }) - expect(result.matches.map(({ workspace }) => workspace.id)).toEqual([TEST_WORKTREE_ID]) - }) -}) diff --git a/src/main/runtime/runtime-remove-project-host-scope.spec.ts b/src/main/runtime/runtime-remove-project-host-scope.spec.ts index d656d051f6c..53af1a80602 100644 --- a/src/main/runtime/runtime-remove-project-host-scope.spec.ts +++ b/src/main/runtime/runtime-remove-project-host-scope.spec.ts @@ -76,14 +76,6 @@ export function registerRuntimeRemoveProjectHostScopeTests(): void { } describe('repo.rm with the same repo id on two execution hosts', () => { - it('removes only the resolved row when a path selector picks the SSH host copy', async () => { - const { runtime, repos } = createRuntime() - - await runtime.removeProject('path:/remote/dup') - - expect(repos.map((repo) => repo.path)).toEqual(['/laptop/dup']) - }) - it('refuses a bare duplicated id rather than guessing a host', async () => { const { runtime, repos, removeProjectForHost } = createRuntime() @@ -118,24 +110,4 @@ export function registerRuntimeRemoveProjectHostScopeTests(): void { expect(repos.map((repo) => repo.path)).toEqual(['/laptop/dup']) }) }) - - describe('projectGroup.moveProject with the same repo id on two execution hosts', () => { - it('moves the SSH row a paired client names by its connection', async () => { - const { runtime, repos } = createRuntime() - - await runtime.moveProjectToGroup('dup', 'group-1', undefined, 'ssh-1') - - expect(repos.map((repo) => repo.projectGroupId)).toEqual([undefined, 'group-1']) - }) - }) - - describe('repo.update with the same repo id on two execution hosts', () => { - it('writes the SSH row a path selector picked, not its local sibling', async () => { - const { runtime, repos } = createRuntime() - - await runtime.updateRepo('path:/remote/dup', { displayName: 'Renamed Remote' }) - - expect(repos.map((repo) => repo.displayName)).toEqual(['Dup Local', 'Renamed Remote']) - }) - }) } diff --git a/src/main/runtime/runtime-terminal-exit-contracts.test.ts b/src/main/runtime/runtime-terminal-exit-contracts.test.ts index 39479c79168..b8356cae107 100644 --- a/src/main/runtime/runtime-terminal-exit-contracts.test.ts +++ b/src/main/runtime/runtime-terminal-exit-contracts.test.ts @@ -1,59 +1,5 @@ -import { expect, it, vi } from 'vitest' -import { createTranscriptPane, TRANSCRIPT_PANE_PTY_ID } from './agent-transcript-pane-test-harness' import { registerTerminalPtyExitWaiterTests } from './terminal-pty-exit-waiter.spec' import { registerClaudeAgentTeamsPtyExitLeakTests } from './claude-agent-teams-pty-exit-leak.spec' registerTerminalPtyExitWaiterTests() registerClaudeAgentTeamsPtyExitLeakTests() - -it('reports an already-exited terminal from the idle wait command', async () => { - const originalExitCode = process.exitCode - const { runtime, handle } = await createTranscriptPane({ - paneTitle: 'shell', - foregroundProcess: 'bash', - data: '' - }) - runtime.onPtyExit(TRANSCRIPT_PANE_PTY_ID, 137, 'inc-1', { providerExitObserved: true }) - const callMock = vi.fn( - async (method: string, params: { terminal: string; for: 'tui-idle'; timeoutMs: number }) => { - expect(method).toBe('terminal.wait') - return runtime.waitForTerminal(params.terminal, { - condition: params.for, - timeoutMs: params.timeoutMs - }) - } - ) - vi.doMock('../../cli/runtime-client', async (importOriginal) => ({ - ...(await importOriginal>()), - RuntimeClient: class { - call = callMock - } - })) - try { - process.exitCode = undefined - vi.stubEnv('ORCA_ENVIRONMENT', '') - const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {}) - const cliPath = '../../cli/index' - const { main }: { main(argv: string[], cwd: string): Promise } = await import(cliPath) - - await main( - ['terminal', 'wait', '--terminal', handle, '--for', 'tui-idle', '--timeout-ms', '25'], - '/tmp/repo' - ) - - expect(callMock).toHaveBeenCalledExactlyOnceWith( - 'terminal.wait', - { terminal: handle, for: 'tui-idle', timeoutMs: 25 }, - { timeoutMs: 5025 } - ) - expect(process.exitCode).toBe(1) - expect(errorSpy.mock.calls.flat().join('\n')).toContain('terminal_exited') - expect(runtime['terminalWaiters'].forPty(TRANSCRIPT_PANE_PTY_ID)).toHaveLength(0) - } finally { - process.exitCode = originalExitCode - vi.doUnmock('../../cli/runtime-client') - vi.unstubAllEnvs() - vi.restoreAllMocks() - vi.resetModules() - } -}) diff --git a/src/main/runtime/terminal/identity/terminal-identity-source.test.ts b/src/main/runtime/terminal/identity/terminal-identity-source.test.ts deleted file mode 100644 index 5703da8691f..00000000000 --- a/src/main/runtime/terminal/identity/terminal-identity-source.test.ts +++ /dev/null @@ -1,92 +0,0 @@ -import { expect, it, vi } from 'vitest' -import { identityFixture, LEAF, PANE } from '../query/terminal-identity.test-fixture' -import { - makeRuntimeStoreWithWorkspaceSession, - makeWorkspaceSessionWithHeadlessTerminal, - TEST_WORKTREE_ID -} from '../../orca-runtime-test-fixtures.spec' -import { recordPtySurface, forgetPtySurface } from '../../pty-recorded-surface-topology' -import type { TerminalLeafMoveResult } from '../../../../shared/workspace-layout/terminal-leaf-move' - -it('retires before dependent callbacks, keeps connected output idle and preserves partial writes when a callback fails', () => { - const f = identityFixture() - const pty = f.owner.recordPtyWorktree('pty-owned', TEST_WORKTREE_ID) - const changes: (string | null | undefined)[] = [] - const stop = f.owner.crewChanges.subscribe(() => changes.push(pty.paneKey)) - recordPtySurface(f.owner.source, pty, 'tab-original', PANE, 3) - expect(changes).toEqual([PANE]) - recordPtySurface(f.owner.source, pty, 'tab-original', PANE, 2) - expect(changes).toEqual([PANE]) - f.owner.source.replaceLeaves(f.owner.leaves) - f.owner.source.bindPty('pty-owned', 'term_owned') - const before = changes.length - f.owner.source.bindPty('pty-owned', 'term_owned') - for (let i = 0; i < 30; i++) { - f.runtime.onPtyData('pty-owned', 'output', 500 + i) - } - expect(changes).toHaveLength(before) - const fail = f.owner.crewChanges.subscribe(() => { - throw new Error('consumer_failure') - }) - expect(() => forgetPtySurface(f.owner.source, pty)).not.toThrow() - expect(pty.paneKey).toBeNull() - expect(changes.at(-1)).toBeNull() - fail() - expect(() => { - recordPtySurface(f.owner.source, pty, 'tab-original', PANE, 4) - throw new Error('later_operation_failure') - }).toThrow('later_operation_failure') - expect(changes.at(-1)).toBe(PANE) - stop() -}) - -it('wakes for preallocation before any leaf or incarnation and for a real pane move only after its awaited commit', async () => { - const harness = makeRuntimeStoreWithWorkspaceSession(makeWorkspaceSessionWithHeadlessTerminal()) - const f = identityFixture(undefined, harness.runtimeStore) - const wake = vi.fn() - const stop = f.owner.crewChanges.subscribe(wake) - const old = f.runtime.createTerminalIdentityReadContext() - expect(f.owner.getLivePtyForHandle('absent', old)).toBeNull() - const handle = f.runtime.preAllocateHandleForPty('pty-owned') - expect(wake).toHaveBeenCalledTimes(1) - expect(f.owner.handleByPtyId.get('pty-owned')).toBe(handle) - expect(f.owner.leaves.size).toBe(0) - expect(f.owner.handleByPtyIncarnation.size).toBe(0) - f.runtime.onPtySpawned('pty-owned') - const pty = f.owner.recordPtyWorktree('pty-owned', TEST_WORKTREE_ID, { paneKey: PANE }) - let finish: ((result: TerminalLeafMoveResult) => void) | undefined - const commit = vi.fn( - () => - new Promise((resolve) => { - finish = resolve - }) - ) - const move = f.runtime.moveMobileSessionLeafToNewTab( - `id:${TEST_WORKTREE_ID}`, - { - sourceTabId: 'tab-original', - targetTabId: 'tab-moved', - leafId: LEAF - }, - commit - ) - expect(commit).toHaveBeenCalledOnce() - const before = wake.mock.calls.length - expect(pty.paneKey).toBe(PANE) - const warmed = f.runtime.createTerminalIdentityReadContext() - f.owner.getPtyRecordForPaneKey(`tab-moved:${LEAF}`, warmed) - if (!finish) { - throw new Error('Expected the production move to await commit') - } - finish({ status: 'moved', ptyId: 'pty-owned' }) - await expect(move).resolves.toEqual({ status: 'moved', ptyId: 'pty-owned' }) - expect(pty.paneKey).toBe(`tab-moved:${LEAF}`) - expect(wake.mock.calls.length).toBeGreaterThan(before) - expect( - f.owner.getPtyRecordForPaneKey( - `tab-moved:${LEAF}`, - f.runtime.createTerminalIdentityReadContext() - ) - ).toBe(f.owner.getPtyRecordForPaneKey(`tab-moved:${LEAF}`)) - stop() -}) diff --git a/src/main/runtime/terminal/input/terminal-send-plugin-hook.test.ts b/src/main/runtime/terminal/input/terminal-send-plugin-hook.test.ts index a0401b68269..9cea810d1f1 100644 --- a/src/main/runtime/terminal/input/terminal-send-plugin-hook.test.ts +++ b/src/main/runtime/terminal/input/terminal-send-plugin-hook.test.ts @@ -1,25 +1,8 @@ import { afterEach, describe, expect, it, vi } from 'vitest' -import type { PluginHookName } from '../../../../shared/plugins/contributions/plugin-hook-contribution' -import type { PluginHookChainOutcome } from '../../../../shared/plugins/workers/plugin-hook-chain' + import { setPluginHookRunner } from '../../../plugins/hooks/plugin-hook-dispatch' -import { - runTerminalSendPluginHook, - terminalHookOrderKind, - TerminalPluginHookOrder -} from './terminal-send-plugin-hook' +import { terminalHookOrderKind, TerminalPluginHookOrder } from './terminal-send-plugin-hook' -function installRunner( - decide: (payload: unknown) => PluginHookChainOutcome | Promise -) { - const run = vi.fn(async (_event: PluginHookName, payload: unknown) => decide(payload)) - setPluginHookRunner({ wants: (event) => event === 'terminal.send', run }) - return run -} - -const rewrite = (changes: Record) => (payload: unknown) => ({ - kind: 'continue' as const, - payload: { ...Object(payload), ...changes } -}) const allowed = vi.fn(async () => undefined) afterEach(() => { @@ -27,21 +10,6 @@ afterEach(() => { allowed.mockClear() }) -describe('terminal.send hook site', () => { - it('refuses a rewrite the caller’s own checks would refuse, and skips them when unchanged', async () => { - installRunner(rewrite({ text: 'claude --resume owned-by-chat' })) - const refuse = vi.fn(async () => { - throw new Error('legacy writer refused') - }) - await expect(runTerminalSendPluginHook('t', { text: 'ls' }, 'driving', refuse)).rejects.toThrow( - 'legacy writer refused' - ) - installRunner(rewrite({})) - await runTerminalSendPluginHook('t', { text: 'ls' }, 'driving', refuse) - expect(refuse).toHaveBeenCalledOnce() - }) -}) - describe('TerminalPluginHookOrder', () => { const pass = async (value: A) => value diff --git a/src/main/runtime/terminal/launch/window-tab-start-layout-owner.test.ts b/src/main/runtime/terminal/launch/window-tab-start-layout-owner.test.ts deleted file mode 100644 index 8f5e4d21e37..00000000000 --- a/src/main/runtime/terminal/launch/window-tab-start-layout-owner.test.ts +++ /dev/null @@ -1,86 +0,0 @@ -import { describe, expect, it, vi } from 'vitest' -import { collectLeafIds } from '../../../../shared/workspace-layout/terminal-pane-layout-tree' -import { toRuntimeExecutionHostId } from '../../../../shared/execution-host' -import { setupLayoutOwnerRuntime, WORKTREE_ID } from '../../orca-runtime-layout-owner-start-fixture' - -vi.mock('../../../../shared/layout-owner-switch', () => ({ ORCA_LAYOUT_OWNER_IS_MAIN: true })) - -const TAB_ID = 'window-tab' -const LEAF_ID = '33333333-3333-4333-8333-333333333333' - -async function windowTab(runtime: ReturnType['runtime']) { - // The window drew the tab and recorded it in main under its own ids, as createTab does. - const reply = await runtime.applyLayoutCommand({ - type: 'createTerminalTab', - workspace: WORKTREE_ID, - tabId: TAB_ID, - leafId: LEAF_ID - }) - expect(reply.ok).toBe(true) -} - -describe("the window's new tab, started by main in a layout-owner build", () => { - it('starts the first pane in the tab the window wrote, in its folder, with nothing revealed', async () => { - const { runtime, spawn, session } = setupLayoutOwnerRuntime() - await windowTab(runtime) - const statuses: unknown[] = [] - spawn.mockImplementationOnce(async (args) => { - statuses.push(runtime.startStatusOf(`${args.tabId}:${args.leafId}`)) - return { id: 'pty-window' } - }) - - const created = await runtime.startWindowTabTerminal( - WORKTREE_ID, - { tabId: TAB_ID, leafId: LEAF_ID }, - { cwd: '/workspace/sub', command: 'make dev' } - ) - - expect(spawn).toHaveBeenCalledTimes(1) - expect(spawn.mock.calls[0]![0]).toMatchObject({ - tabId: TAB_ID, - leafId: LEAF_ID, - cwd: '/workspace/sub', - resolvedWorkspace: expect.objectContaining({ - id: WORKTREE_ID, - path: '/workspace', - connectionId: null - }), - command: 'make dev' - }) - // Publish starting status so views cannot spawn duplicates; clear it after binding. - expect(statuses).toEqual([{ status: 'starting' }]) - expect(runtime.startStatusOf(`${TAB_ID}:${LEAF_ID}`)).toBeNull() - expect(created).toMatchObject({ tabId: TAB_ID, ptyId: 'pty-window', surface: 'background' }) - expect(session().tabsByWorktree[WORKTREE_ID]?.map((tab) => tab.id)).toEqual([TAB_ID]) - expect(collectLeafIds(session().terminalLayoutsByTabId[TAB_ID]?.root)).toEqual([LEAF_ID]) - }) - - it('keeps the pane showing why when its start fails, as a start that timed out does', async () => { - const { runtime, spawn, session } = setupLayoutOwnerRuntime() - await windowTab(runtime) - spawn.mockRejectedValueOnce(new Error('Request timed out: createOrAttach')) - - await expect( - runtime.startWindowTabTerminal(WORKTREE_ID, { tabId: TAB_ID, leafId: LEAF_ID }, {}) - ).rejects.toThrow('Request timed out: createOrAttach') - - expect(session().tabsByWorktree[WORKTREE_ID]?.map((tab) => tab.id)).toEqual([TAB_ID]) - expect(runtime.startStatusOf(`${TAB_ID}:${LEAF_ID}`)).toEqual({ - status: 'failed', - reason: 'Request timed out: createOrAttach' - }) - }) - - it("refuses a paired server's tab, starting nothing, so the window starts it as today", async () => { - const { runtime, spawn } = setupLayoutOwnerRuntime() - await windowTab(runtime) - Object.assign(runtime, { - getWorkspaceSessionHostIdsForTab: () => [toRuntimeExecutionHostId('env-1')] - }) - - await expect( - runtime.startWindowTabTerminal(WORKTREE_ID, { tabId: TAB_ID, leafId: LEAF_ID }, {}) - ).rejects.toThrow('host_not_owned') - expect(spawn).not.toHaveBeenCalled() - }) -}) diff --git a/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts b/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts index 34b9ea6cd6f..43a6db35944 100644 --- a/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts +++ b/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts @@ -1,5 +1,4 @@ import type * as WorktreeListingModule from '../git/worktrees/catalog/worktree-listing' -// Check scan-cache gating here; real-Git fingerprint behavior lives in repo-worktree-admin-fingerprint.test.ts. Windows CI also exercises repo-path handling. import { beforeEach, describe, expect, it, vi } from 'vitest' const electronMocks = vi.hoisted(() => { diff --git a/src/main/runtime/worktree-terminal-mutation-lock.test.ts b/src/main/runtime/worktree-terminal-mutation-lock.test.ts deleted file mode 100644 index 2eef38d6ed4..00000000000 --- a/src/main/runtime/worktree-terminal-mutation-lock.test.ts +++ /dev/null @@ -1,35 +0,0 @@ -import { describe, expect, it, vi } from 'vitest' -import { - WORKTREE_TERMINAL_SLEEP_TIMEOUT_ERROR, - WorktreeTerminalMutationLock -} from './worktree-terminal-mutation-lock' - -const KEY = 'repo::/tmp/worktree' - -describe('WorktreeTerminalMutationLock', () => { - it('hands the turn onward when a queued sleep abandons ahead of a spawn', async () => { - vi.useFakeTimers() - try { - const lock = new WorktreeTerminalMutationLock() - const releaseSpawn = await lock.acquire(KEY, 'shared') - const sleep = lock.acquire(KEY, 'exclusive', Date.now() + 1_000) - const rejection = expect(sleep).rejects.toThrow(WORKTREE_TERMINAL_SLEEP_TIMEOUT_ERROR) - let laterSpawnAcquired = false - const laterSpawn = lock.acquire(KEY, 'shared').then((release) => { - laterSpawnAcquired = true - return release - }) - - await vi.advanceTimersByTimeAsync(1_001) - await rejection - // The spawn was queued behind the sleep; its abandonment must release it. - const releaseLater = await laterSpawn - expect(laterSpawnAcquired).toBe(true) - releaseSpawn() - releaseLater() - expect(lock.trackedKeyCount).toBe(0) - } finally { - vi.useRealTimers() - } - }) -}) diff --git a/src/main/skills/skill-discovery-wsl-alias-sharing.test.ts b/src/main/skills/skill-discovery-wsl-alias-sharing.test.ts deleted file mode 100644 index f844d8d4d95..00000000000 --- a/src/main/skills/skill-discovery-wsl-alias-sharing.test.ts +++ /dev/null @@ -1,78 +0,0 @@ -import { beforeEach, expect, it, vi } from 'vitest' -const io = vi.hoisted(() => ({ run: vi.fn(), plugins: vi.fn(async () => []) })) -vi.mock('../wsl/execution/wsl-runner', () => ({ runWslProcess: io.run })) -vi.mock('./claude-plugin-skill-sources-wsl', () => ({ - discoverClaudePluginSkillSourcesInWsl: io.plugins -})) -vi.mock('./discovery', () => ({ clearSkillRootScanCache: vi.fn(), discoverSkills: vi.fn() })) -import { clearSkillDiscoveryCaches, discoverSkillsOnTarget } from './skill-discovery-target' - -const target = { kind: 'wsl' as const, distro: 'Ubuntu', homeDir: '/home/test', cwd: '/repo' } -const record = (...fields: string[]) => `${fields.join('\0')}\0` -const encoded = Buffer.from('---\nname: shared-frontmatter\ndescription: Fixture\n---\n').toString( - 'base64' -) -const common = '/opt/physical/SKILL.md' -const rows = [ - record('S', '0', '/home/test/.codex/skills/.system/bundle/SKILL.md', common, '1', encoded), - record('S', '0', '/home/test/.codex/skills/alias-a/SKILL.md', common, '1', encoded), - record('S', '1', '/home/test/.agents/skills/alias-b/SKILL.md', common, '1', encoded), - ...Array.from({ length: 6 }, (_, i) => - record( - 'S', - '0', - `/home/test/.codex/skills/skill-${i}/SKILL.md`, - `/physical/skill-${i}/SKILL.md`, - '1', - encoded - ) - ) -] -const output = record('R', '0', '1') + record('R', '1', '1') + rows.join('') -beforeEach(() => { - clearSkillDiscoveryCaches() - io.run.mockReset() - io.plugins.mockClear() - io.run.mockResolvedValue({ code: 0, timedOut: false, stdout: output, stderr: '' }) -}) -it('keeps both home aliases when a bundled canonical duplicate appears first', async () => { - const [a, b, bundle] = await Promise.all([ - discoverSkillsOnTarget({ ...target, names: ['alias-a'], sourceKinds: ['home'] }, []), - discoverSkillsOnTarget({ ...target, names: ['alias-b'], sourceKinds: ['home'] }, []), - discoverSkillsOnTarget({ ...target, names: ['bundle'], sourceKinds: ['bundled'] }, []) - ]) - expect(io.run).toHaveBeenCalledTimes(1) - expect(a.skills.map((s) => s.directoryPath)).toEqual(['/home/test/.codex/skills/alias-a']) - expect(b.skills.map((s) => s.directoryPath)).toEqual(['/home/test/.agents/skills/alias-b']) - expect(bundle.skills.map((s) => s.directoryPath)).toEqual([ - '/home/test/.codex/skills/.system/bundle' - ]) - expect(a.skills[0].providers).toEqual(['codex']) - expect(b.skills[0].providers).toEqual(['agent-skills']) - expect(a.skills[0].id).toBe(b.skills[0].id) - expect(a.skills[0].sourceKind).toBe('home') -}) -it('cache projections do not contaminate later aliases or source metadata', async () => { - const first = await discoverSkillsOnTarget( - { ...target, names: ['alias-a'], sourceKinds: ['home'] }, - [] - ) - first.skills[0].providers.push('claude') - first.skills[0].rootPaths!.push('/poison') - first.sources[0].providers.push('claude') - const later = await discoverSkillsOnTarget( - { ...target, names: ['alias-a'], sourceKinds: ['home'] }, - [] - ) - expect(later.skills[0].providers).toEqual(['codex']) - expect(later.skills[0].rootPaths).toEqual(['/home/test/.codex/skills']) - expect(later.sources[0].providers).not.toContain('claude') - expect(io.run).toHaveBeenCalledTimes(1) -}) -it('does not cache failed scans as an empty successful observation', async () => { - io.run.mockResolvedValueOnce({ code: 1, timedOut: false, stdout: '', stderr: 'failure' }) - const req = { ...target, names: ['alias-a'], sourceKinds: ['home' as const] } - await expect(discoverSkillsOnTarget(req, [])).rejects.toThrow('skill-discovery-wsl-scan-failed') - expect((await discoverSkillsOnTarget(req, [])).skills).toHaveLength(1) - expect(io.run).toHaveBeenCalledTimes(2) -}) diff --git a/src/main/ssh/orcad-migration-path-rewrite.test.ts b/src/main/ssh/orcad-migration-path-rewrite.test.ts deleted file mode 100644 index a2722b54a26..00000000000 --- a/src/main/ssh/orcad-migration-path-rewrite.test.ts +++ /dev/null @@ -1,98 +0,0 @@ -import { describe, expect, it } from 'vitest' -import type { OrcadMigrationCatalogPayload } from '../../shared/orcad-migration/orcad-migration-manifest' - -import { isRecord } from '../../shared/orcad-migration/orcad-migration-manifest-fields' -import { ownedEditorFileId } from '../../shared/workspace-session/workspace-session-pane-ownership' -import { - ORCAD_MIGRATION_PATH_FIELDS, - type OrcadMigrationPathFieldKind -} from './orcad-migration-path-fields' - -import { - parseFieldLocation, - rewriteOrcadMigrationPayloadPaths, - type OrcadMigrationPathRewriter -} from './orcad-migration-path-rewrite' - -const WT = 'repo-1::/src/wt' -const SAMPLE: Record = { - absolute: '/src/a', - 'maybe-absolute': '/src/b', - relative: 'rel/c', - url: 'file:///src/d', - 'worktree-id': WT, - 'owner-key': `worktree:${WT}`, - 'pty-session-id': `${WT}@@pty-1`, - 'editor-file-id': ownedEditorFileId('/src/wt/f.ts', WT, 'env-1') -} - -/** Mark rewritten relative paths and map /src to /dst so omissions remain visible. */ - -function payloadWithEveryField(): OrcadMigrationCatalogPayload { - const root: Record = { - repositories: [], - projectGroups: [], - folderWorkspaces: [] - } - for (const field of ORCAD_MIGRATION_PATH_FIELDS) { - place(root, parseFieldLocation(field.at), SAMPLE[field.kind]) - } - // Sparse fixtures suffice because traversal follows the field table, not a full payload schema. - return { repositories: [], projectGroups: [], folderWorkspaces: [], ...root } -} - -function place( - node: Record, - steps: ReturnType, - sample: string -): void { - const [step, next, ...rest] = steps - if (step?.type !== 'prop') { - throw new Error('table locations start with a property') - } - if (!next) { - node[step.name] = sample - return - } - node[step.name] = placeInto(node[step.name], [next, ...rest], sample) -} - -function placeInto( - existing: unknown, - steps: ReturnType, - sample: string -): unknown { - const [step, ...rest] = steps - if (!step) { - return sample - } - if (step.type === 'items') { - const items = Array.isArray(existing) ? existing : [] - items[0] = placeInto(items[0], rest, sample) - return items - } - const record = isRecord(existing) ? existing : {} - if (step.type === 'keys') { - record[sample] = true - } else if (step.type === 'values') { - record.entry = placeInto(record.entry, rest, sample) - } else { - record[step.name] = placeInto(record[step.name], rest, sample) - } - return record -} - -describe('orcad migration path-rewrite stage', () => { - it('refuses a rewrite that would merge two records', () => { - const payload = payloadWithEveryField() - const session = payload.dormantState?.workspaceSession - expect(session).toBeDefined() - session!.tabsByWorktree = { 'repo-1::/src/a': [], 'repo-1::/src/b': [] } - const merging: OrcadMigrationPathRewriter = { - path: (value) => (value.startsWith('/src') ? '/dst' : value) - } - expect(() => rewriteOrcadMigrationPayloadPaths(payload, merging)).toThrow( - 'orcad_migration_path_rewrite_key_collision' - ) - }) -}) diff --git a/src/main/ssh/orcad-migration-terminal-gate.test.ts b/src/main/ssh/orcad-migration-terminal-gate.test.ts index f727c6db4d2..1c2653b5ef8 100644 --- a/src/main/ssh/orcad-migration-terminal-gate.test.ts +++ b/src/main/ssh/orcad-migration-terminal-gate.test.ts @@ -19,11 +19,6 @@ const MIXED: LeaseRow[] = [ { ptyId: 'exp', state: 'expired' }, { ptyId: 'ter', state: 'terminated' } ] -const UNRESOLVED: LeaseRow[] = [ - { ptyId: 'det', state: 'detached' }, - { ptyId: 'exp', state: 'expired' }, - { ptyId: 'ter', state: 'terminated' } -] describe('terminal gate characterization: census-only verdicts', () => { it('a census that throws is bridged as unverifiable, never exited', async () => { @@ -38,47 +33,6 @@ describe('terminal gate characterization: census-only verdicts', () => { hostTerminals: 0 }) }) - - it.each([ - [ - 'an attached lease', - MIXED, - { verdict: 'live', ptyIds: ['att'], reason: 'terminals on this host are still running' } - ], - [ - 'detached or expired leases', - UNRESOLVED, - { - verdict: 'unverifiable', - ptyIds: ['det', 'exp'], - reason: 'no SSH relay could confirm these terminals exited' - } - ], - [ - 'only terminated leases', - [{ ptyId: 'ter', state: 'terminated' }], - { - verdict: 'unverifiable', - ptyIds: [], - reason: "no census of every relay on this host's account was taken" - } - ], - [ - 'no leases', - [], - { - verdict: 'unverifiable', - ptyIds: [], - reason: "no census of every relay on this host's account was taken" - } - ] - ] as const)('without a census, %s blocks', async (_label, leases, expected) => { - for (const census of [undefined, null]) { - await expect( - assessOrcadMigrationTerminals(store([...leases]), 'ssh-1', census) - ).resolves.toEqual(expected) - } - }) }) describe('acting on a terminal proof', () => { diff --git a/src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts b/src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts deleted file mode 100644 index e657319003f..00000000000 --- a/src/main/ssh/ssh-agent-hook-interrupt-reconciliation.test.ts +++ /dev/null @@ -1,84 +0,0 @@ -import { describe, expect, it, vi } from 'vitest' -import { AgentHookServer } from '../agent-hooks/server' -import { makePaneKey } from '../../shared/workspace-layout/stable-pane-id' -import { AGENT_HOOK_INFER_INTERRUPT_METHOD } from '../../shared/agent-hook-listener/transport/agent-hook-interrupt-reconciliation' -import { bindRemoteClaudeInterruptReconciliation } from './ssh-agent-hook-interrupt-reconciliation' - -vi.mock('../telemetry/client', () => ({ track: vi.fn() })) -vi.mock('../telemetry/cohort-classifier', () => ({ getCohortAtEmit: vi.fn(() => ({})) })) -const PANE = makePaneKey('tab-1', '11111111-1111-4111-8111-111111111111') -const REVISION = '11111111-1111-4111-8111-111111111112' - -function host(revision: string | undefined) { - const server = new AgentHookServer() - server.ingestRemote( - { - paneKey: PANE, - tabId: 'tab-1', - source: 'claude', - launchToken: 'launch-a', - hostTurnRevision: revision, - providerSession: { key: 'session_id', id: 'session-a' }, - hookEventName: 'UserPromptSubmit', - payload: { - state: 'working', - prompt: 'do work', - agentType: 'claude', - mainAgent: { state: 'working', stateStartedAt: Date.now() } - } - }, - 'ssh-owner' - ) - const infer = () => { - const row = server.getStatusSnapshotForPane(PANE)[0] - if (!row) { - throw new Error('Missing row') - } - return server.inferInterrupt({ - paneKey: PANE, - baselineUpdatedAt: row.receivedAt, - baselineStateStartedAt: row.stateStartedAt, - baselinePrompt: row.prompt, - baselineAgentType: row.agentType, - intent: 'ctrl-c' - }) - } - return { server, infer } -} - -describe('remote interrupt mux and version fences', () => { - it.each(['current', 'foreign', 'replaced', 'disposed', 'unsubscribed', 'legacy'])( - '%s mux dispatches only with a matching current host proof', - (scope) => { - const { server, infer } = host(scope === 'legacy' ? undefined : REVISION) - const request = vi.fn().mockResolvedValue({ applied: true }) - const mux = { request, isDisposed: () => scope === 'disposed' } - const unsubscribe = bindRemoteClaudeInterruptReconciliation( - server, - mux, - scope === 'foreign' ? 'other-host' : 'ssh-owner', - () => scope !== 'replaced' - ) - try { - if (scope === 'unsubscribed') { - unsubscribe() - } - expect(infer()).toBe(true) - if (scope === 'current') { - expect(request).toHaveBeenCalledExactlyOnceWith(AGENT_HOOK_INFER_INTERRUPT_METHOD, { - paneKey: PANE, - hostTurnRevision: REVISION, - launchToken: 'launch-a', - providerSession: { key: 'session_id', id: 'session-a' }, - intent: 'ctrl-c' - }) - } else { - expect(request).not.toHaveBeenCalled() - } - } finally { - unsubscribe() - server.stop() - } - } - ) -}) diff --git a/src/main/window/foreground-activation-policy.test.ts b/src/main/window/foreground-activation-policy.test.ts index adee9a36b95..aa37676f455 100644 --- a/src/main/window/foreground-activation-policy.test.ts +++ b/src/main/window/foreground-activation-policy.test.ts @@ -6,9 +6,6 @@ vi.mock('electron', () => ({ app: { dock: { hide: vi.fn() }, setActivationPolicy const { applyBackgroundActivationPolicy, applyServeDesktopWindowActivationPolicy, - isBackgroundLaunch, - isOrcadSidecarLaunch, - isWindowlessLaunch, showWindowWithoutStealingFocus } = await import('./foreground-activation-policy') @@ -26,30 +23,6 @@ function makeWindow(destroyed = false): BrowserWindow & { } } -describe('isBackgroundLaunch', () => { - it('treats the orcad browser sidecar as an explicit background launch', () => { - expect(isOrcadSidecarLaunch({ ORCA_ORCAD_SIDECAR: '1' })).toBe(true) - expect(isOrcadSidecarLaunch({})).toBe(false) - expect(isBackgroundLaunch({ ORCA_ORCAD_SIDECAR: '1', ORCA_E2E_FOREGROUND: '1' })).toBe(true) - expect(isWindowlessLaunch({ ORCA_ORCAD_SIDECAR: '1', ORCA_E2E_HEADFUL: '1' })).toBe(true) - }) -}) - -describe('isWindowlessLaunch', () => { - it('keeps explicit background launches hidden while headful E2E can paint', () => { - expect(isWindowlessLaunch({ ORCA_E2E_HEADLESS: '1' })).toBe(true) - expect(isWindowlessLaunch({ ORCA_E2E_HEADLESS: '1', ORCA_E2E_HEADFUL: '1' })).toBe(false) - expect(isWindowlessLaunch({ ORCA_BACKGROUND_LAUNCH: '1' })).toBe(true) - expect( - isWindowlessLaunch({ - ORCA_BACKGROUND_LAUNCH: '1', - ORCA_E2E_HEADFUL: '1', - ORCA_E2E_FOREGROUND: '1' - }) - ).toBe(true) - }) -}) - describe('showWindowWithoutStealingFocus', () => { it('never reveals an explicitly background window', () => { const window = makeWindow() diff --git a/src/main/workspaces/catalog/local-worktree-path-presence.test.ts b/src/main/workspaces/catalog/local-worktree-path-presence.test.ts deleted file mode 100644 index 1e99db45d65..00000000000 --- a/src/main/workspaces/catalog/local-worktree-path-presence.test.ts +++ /dev/null @@ -1,125 +0,0 @@ -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' - -const { statMock } = vi.hoisted(() => ({ - statMock: vi.fn() -})) - -vi.mock('node:fs/promises', () => ({ stat: statMock })) - -import { - LOCAL_WORKTREE_PATH_PROBE_TIMEOUT_MS, - localWorktreePathsExistOrAreUnverifiable -} from './local-worktree-path-presence' - -function fsError(code: string): NodeJS.ErrnoException { - return Object.assign(new Error(code), { code }) -} - -function installFakeAbortSignalTimeout(): AbortController[] { - const controllers: AbortController[] = [] - vi.spyOn(AbortSignal, 'timeout').mockImplementation((timeoutMs) => { - const controller = new AbortController() - controllers.push(controller) - setTimeout( - () => controller.abort(new DOMException('The operation timed out.', 'TimeoutError')), - timeoutMs - ) - return controller.signal - }) - return controllers -} - -describe('local worktree path presence', () => { - beforeEach(() => { - statMock.mockReset() - }) - - afterEach(() => { - vi.useRealTimers() - vi.restoreAllMocks() - }) - - it('returns one result per distinct path and only treats ENOENT/ENOTDIR as missing', async () => { - statMock.mockImplementation(async (pathValue: string) => { - if (pathValue === '/missing') { - throw fsError('ENOENT') - } - if (pathValue === '/not-a-directory') { - throw fsError('ENOTDIR') - } - if (pathValue === '/permission-denied') { - throw fsError('EACCES') - } - return { isDirectory: () => true } - }) - - const result = await localWorktreePathsExistOrAreUnverifiable([ - '/present', - '/missing', - '/not-a-directory', - '/permission-denied', - '/present' - ]) - - expect([...result.entries()]).toEqual([ - ['/present', true], - ['/missing', false], - ['/not-a-directory', false], - ['/permission-denied', true] - ]) - expect(statMock).toHaveBeenCalledTimes(4) - }) - - it('settles timed-out batches without exceeding or leaking the global stat bound', async () => { - vi.useFakeTimers() - const timeoutControllers = installFakeAbortSignalTimeout() - const releaseStats: (() => void)[] = [] - let returnMissing = false - statMock.mockImplementation(() => - returnMissing - ? Promise.reject(fsError('ENOENT')) - : new Promise((resolve) => releaseStats.push(() => resolve({ isDirectory: () => true }))) - ) - - try { - const firstPaths = ['/first-1', '/first-2', '/first-3', '/first-4'] - const first = localWorktreePathsExistOrAreUnverifiable(firstPaths) - let firstSettled = false - void first.then(() => { - firstSettled = true - }) - await vi.advanceTimersByTimeAsync(0) - - expect(statMock).toHaveBeenCalledTimes(2) - await vi.advanceTimersByTimeAsync(LOCAL_WORKTREE_PATH_PROBE_TIMEOUT_MS - 1) - expect(firstSettled).toBe(false) - await vi.advanceTimersByTimeAsync(1) - await expect(first).resolves.toEqual( - new Map(firstPaths.map((pathValue) => [pathValue, true])) - ) - expect(statMock).toHaveBeenCalledTimes(2) - - const secondPaths = ['/second-1', '/second-2', '/second-3'] - const second = localWorktreePathsExistOrAreUnverifiable(secondPaths) - await vi.advanceTimersByTimeAsync(LOCAL_WORKTREE_PATH_PROBE_TIMEOUT_MS) - await expect(second).resolves.toEqual( - new Map(secondPaths.map((pathValue) => [pathValue, true])) - ) - expect(statMock).toHaveBeenCalledTimes(2) - - returnMissing = true - releaseStats.splice(0).forEach((release) => release()) - await vi.advanceTimersByTimeAsync(0) - - await expect(localWorktreePathsExistOrAreUnverifiable(['/after-release'])).resolves.toEqual( - new Map([['/after-release', false]]) - ) - expect(statMock).toHaveBeenCalledTimes(3) - } finally { - timeoutControllers.forEach((controller) => controller.abort()) - releaseStats.splice(0).forEach((release) => release()) - await Promise.resolve() - await Promise.resolve() - } - }) -}) diff --git a/src/main/wsl/host-lifecycle/wsl-orphan-holder-release.test.ts b/src/main/wsl/host-lifecycle/wsl-orphan-holder-release.test.ts index 80d06aa52f4..2778be01a95 100644 --- a/src/main/wsl/host-lifecycle/wsl-orphan-holder-release.test.ts +++ b/src/main/wsl/host-lifecycle/wsl-orphan-holder-release.test.ts @@ -60,15 +60,6 @@ afterEach(() => { }) describe('releasing orphaned WSL holders at launch', () => { - it('touches nothing for a user who never ran a WSL host', async () => { - const { factory } = fakeHolder() - await expect( - releaseUnwantedWslHolders({ userDataPath, isWanted: () => false, holder: factory }) - ).resolves.toEqual([]) - // No holder means no process table read and no wsl.exe. - expect(factory).not.toHaveBeenCalled() - }) - it('keeps a live host’s holder and releases only orphans and pending removals', async () => { addHost('Ubuntu', 42000) addHost('Debian', 42001)