test: enable Docker SSH browser network route coverage in CI (#19095)

* test: enable Docker SSH browser network route journeys in CI

* test: register Docker browser job in token permissions contract

* test: declare SSH client dependency and narrow browser fixture routing

.github/workflows/e2e.yml

@@ -228,6 +228,7 @@ jobs:
             . != "tests/e2e/ssh-startup-exec-readiness.spec.ts" and
             . != "tests/e2e/paired-startup-exec-readiness.spec.ts" and
             . != "tests/e2e/local-ssh-browser-routing.spec.ts" and
+            . != "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts" and
             . != "tests/e2e/ssh-client-hosted-browser-drop-reconnect.spec.ts" and
             . != "tests/e2e/ssh-docker-bulk-open-freeze-repro.spec.ts" and
             . != "tests/e2e/terminal-ibus-hangul-native.spec.ts"
@@ -354,3 +355,23 @@ jobs:
           path: e2e-traces/
           retention-days: 7
           if-no-files-found: ignore
+
+  ssh-browser-network-route:
+    name: ssh browser network route
+    if: inputs.test_files == '' || contains(inputs.test_files, 'tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+      - name: Install SSH client
+        run: sudo apt-get update && sudo apt-get install -y openssh-client
+      - name: Run Docker SSH browser network route journeys
+        env:
+          ORCA_BACKGROUND_LAUNCH: '1'
+          ORCA_RUN_DOCKER_SSH_BROWSER_E2E: '1'
+        run: node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts

config/scripts/pr-e2e-source-routing.mjs

@@ -13,6 +13,17 @@ const NATIVE_IME_HARNESS =
   /^(?:config\/scripts\/(?:run-terminal-ibus-hangul-e2e|terminal-ime-engagement-receipt)\.mjs$|tests\/e2e\/terminal-ime-(?:boundary-probe|byte-reader|engagement-receipt)\.ts$|tests\/e2e\/terminal-(?:ibus-hangul|hangul-terminating-digit|macos-2set-korean)-native\.spec\.ts$)/
 
 export const PR_E2E_SOURCE_ROUTES = [
+  {
+    id: 'browser-network.ssh-docker-route',
+    specs: ['tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts'],
+    matches: (file) =>
+      file === 'tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts' ||
+      /^tests\/e2e\/helpers\/docker-ssh-relay-(?:image|target)\.ts$/.test(file) ||
+      (isProductSource(file) &&
+        /^src\/main\/(?:browser\/(?:ssh-browser-network-execution-route|browser-network-deferred-socket|browser-network-execution-route|system-ssh-socks-client-socket)|ssh\/system-ssh-dynamic-forward-process)\.ts$/.test(
+          file
+        ))
+  },
   {
     id: 'terminal.windows-wsl-launch-and-paste',
     specs: [

config/scripts/release-cut-token-permissions.test.mjs

@@ -12,6 +12,7 @@ const EXPECTED_MATRIX = {
   '.github/workflows/e2e.yml#changed-e2e': { contents: 'read' },
   '.github/workflows/e2e.yml#e2e': { contents: 'read' },
   '.github/workflows/e2e.yml#prepare-native-cache': { contents: 'read' },
+  '.github/workflows/e2e.yml#ssh-browser-network-route': { contents: 'read' },
   '.github/workflows/e2e.yml#ssh-docker-watcher-isolation': { contents: 'read' },
   '.github/workflows/homebrew-bump.yml#bump-cask': { contents: 'read' },
   '.github/workflows/release-mac-build.yml#build-mac': { contents: 'write' },

config/scripts/run-ssh-docker-e2e.mjs

@@ -48,11 +48,10 @@ if (runtime.status !== 0) {
 //   - E2E does not gate merges: `verify.needs` in pr.yml omits `e2e` while the suite is red on
 //     main. Nothing in this lane blocks a PR yet. pr.yml's Require-successful-checks comment
 //     has the exact wiring to flip it, and the gate contract asserts the current state.
-//   - Three specs and one unit test are gated on env vars no workflow sets, so they run nowhere
+//   - Three specs are gated on env vars no workflow sets, so they run nowhere
 //     and are not Docker-gated, which puts them outside this file's contract:
 //       nested-runtime-ssh-lifecycle, nested-runtime-ssh-routing (ORCA_E2E_NESTED_RUNTIME_SSH)
 //       ssh-localhost (ORCA_E2E_SSH_LOCALHOST)
-//       ssh-browser-network-execution-route.docker.unit.test.ts (ORCA_RUN_DOCKER_SSH_BROWSER_E2E)
 //     The nested-runtime runner remains unused by CI.
 const result = spawnSync(
   pnpm,

config/scripts/ssh-browser-e2e-routing.test.mjs

@@ -2,6 +2,7 @@ import { readFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { parse } from 'yaml'
 import { expect, it } from 'vitest'
+import { selectPrE2eSpecs } from './pr-e2e-source-routing.mjs'
 
 const root = resolve(import.meta.dirname, '../..')
 const workflow = parse(readFileSync(join(root, '.github/workflows/e2e.yml'), 'utf8'))
@@ -24,3 +25,40 @@ it('routes SSH browser specs to a lane that enables their opt-ins', () => {
     expect(changedRun.run).toContain(`. != "${spec}"`)
   }
 })
+
+it('executes both Docker network routes in a Node job with their opt-in enabled', () => {
+  const spec = 'tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts'
+  const job = workflow.jobs['ssh-browser-network-route']
+  const install = job.steps.find(
+    (step) => step.uses === './.github/actions/install-node-dependencies'
+  )
+  const run = job.steps.find(
+    (step) => step.name === 'Run Docker SSH browser network route journeys'
+  )
+  expect(job['runs-on']).toBe('ubuntu-latest')
+  expect(job.if).toContain("inputs.test_files == ''")
+  expect(job.if).toContain(spec)
+  expect(install.with['native-runtime']).toBe('node')
+  expect(run.env.ORCA_RUN_DOCKER_SSH_BROWSER_E2E).toBe('1')
+  expect(run.run).toContain(`vitest run --config config/vitest.config.ts ${spec}`)
+  expect(run['continue-on-error']).toBeUndefined()
+  expect(
+    workflow.jobs['changed-e2e'].steps.find((step) => step.name === 'Run changed E2E specs').run
+  ).toContain(`. != "${spec}"`)
+  for (const changed of [
+    spec,
+    'src/main/browser/ssh-browser-network-execution-route.ts',
+    'src/main/browser/browser-network-deferred-socket.ts',
+    'src/main/browser/browser-network-execution-route.ts',
+    'src/main/browser/system-ssh-socks-client-socket.ts',
+    'src/main/ssh/system-ssh-dynamic-forward-process.ts',
+    'tests/e2e/helpers/docker-ssh-relay-target.ts',
+    'tests/e2e/helpers/docker-ssh-relay-image.ts'
+  ]) {
+    expect(selectPrE2eSpecs([changed])).toContain(spec)
+  }
+  expect(selectPrE2eSpecs(['src/renderer/src/components/Unrelated.tsx'])).not.toContain(spec)
+  expect(selectPrE2eSpecs(['tests/e2e/helpers/docker-ssh-relay-terminal-tabs.ts'])).not.toContain(
+    spec
+  )
+})