Sync upstream/main to v1.4.229's cut point, and ship a Windows installer

.gitattributes

@@ -7,13 +7,18 @@
 /skill-stubs/_shared/*.md text eol=lf
 /skills/*/SKILL.md text eol=lf
 /src/cli/bundled-skill-guides.ts text eol=lf
+# SVG bytes feed embedded data URLs and asset hashes on every build host.
+*.svg text eol=lf
+# Compiler input line breaks must not depend on the checkout OS.
+*.ts text eol=lf
+*.tsx text eol=lf
+*.html text eol=lf
 # Bundled plugin trees are byte-hashed; CRLF checkout would break the pinned hash.
 /resources/plugins/** text eol=lf
 # Relay assets are copied verbatim into the bundle and hashed byte-for-byte into
 # .version, which names the immutable remote install dir. A CRLF checkout makes a
 # Windows-built client disagree with a mac/Linux-built one on the same release,
 # so one host ends up with two relay trees (#17886 review).
-/config/relay-assets/** text eol=lf
 # Pin the bytes so a patch reads and diffs identically on every host. It is NOT
 # what makes the hash right: pnpm hashes a patch LF-normalized, so a CRLF checkout
 # cannot change it. Believing otherwise put a hand-computed raw digest in the
@@ -23,14 +28,76 @@
 # runs `git apply` on one must force `-c core.autocrlf=input` rather than trust
 # the host's setting. See config/scripts/windows-process-tree-gyp-rebuild.mjs.
 /config/patches/*.patch -text
+# Same reason, and pnpm parses these too: a CRLF checkout makes the mobile
+# patches unparseable, so Windows packaging dies on ERR_PNPM_INVALID_PATCH.
+/mobile/patches/*.patch -text
 # The xterm bundle hunks also make a diff nobody can read; review the hand-written
 # source patch under xterm-src/ instead. The sibling patches stay diffable.
 /config/patches/@xterm__xterm@*.patch -diff
 /config/patches/xterm-src/*.patch text eol=lf
+# pnpm parses these unified diffs during Windows installs; keep checkout bytes stable.
+/mobile/patches/*.patch -text
 # Generated wrapper fixtures: collapse them in the PR diff so they stop drowning
 # the reviewable change, and pin LF because they are compared byte-for-byte.
 # Not -diff: the shell diff is the review surface when a wrapper does change.
 /src/main/__fixtures__/shell-wrapper-snapshots/*.txt linguist-generated=true text eol=lf
+# Captured agent PTY transcripts. -text, not `text eol=lf` like the wrapper snapshots above:
+# these carry real CR and CRLF bytes as the terminal emitted them, and line-ending
+# normalisation on a Windows checkout would rewrite the evidence the fixture exists to be.
+/src/main/runtime/__fixtures__/*.txt -text
+/src/main/daemon/__fixtures__/pty-transcripts/*.txt -text
+/src/renderer/src/components/terminal-pane/terminal-link-transcripts/*.txt -text whitespace=cr-at-eol
 # Generated runtime English subset: compared byte-for-byte by
 # verify:localization-runtime-catalog, so a CRLF checkout would fail the gate.
 /src/renderer/src/i18n/en-runtime-required.json linguist-generated=true text eol=lf
+# Generated method->params catalog: compared byte-for-byte by
+# verify:rpc-params-catalog, so a CRLF checkout would fail the gate.
+/src/shared/rpc-contract/rpc-params-catalog.generated.ts linguist-generated=true text eol=lf
+# Mobile RPC recording goldens: replay requires the file text to equal what rpc:record writes
+# (LF), so a CRLF checkout would fail every golden.
+/mobile/rpc-foundation/goldens/*.json text eol=lf
+# Mobile web page source. Every text byte here is hashed into an asset digest and from
+# there into buildId, so a CRLF Windows checkout would ship a different bundle id for
+# identical source (91af2897 vs 9d78435e, measured on the bundle this replaced).
+/mobile/src/** text eol=lf
+/mobile/app/** text eol=lf
+/mobile/web-entry/** text eol=lf
+# The blanket pin above would mark a future binary as text; exempt the asset types an
+# RN page actually carries.
+/mobile/src/**/*.png -text
+/mobile/src/**/*.jpg -text
+/mobile/src/**/*.jpeg -text
+/mobile/src/**/*.gif -text
+/mobile/src/**/*.ico -text
+/mobile/src/**/*.webp -text
+/mobile/src/**/*.ttf -text
+/mobile/src/**/*.otf -text
+/mobile/src/**/*.woff -text
+/mobile/src/**/*.woff2 -text
+/mobile/app/**/*.png -text
+/mobile/app/**/*.jpg -text
+/mobile/app/**/*.jpeg -text
+/mobile/app/**/*.gif -text
+/mobile/app/**/*.ico -text
+/mobile/app/**/*.webp -text
+/mobile/app/**/*.ttf -text
+/mobile/app/**/*.otf -text
+/mobile/app/**/*.woff -text
+/mobile/app/**/*.woff2 -text
+/mobile/web-entry/**/*.png -text
+/mobile/web-entry/**/*.jpg -text
+/mobile/web-entry/**/*.jpeg -text
+/mobile/web-entry/**/*.gif -text
+/mobile/web-entry/**/*.ico -text
+/mobile/web-entry/**/*.webp -text
+/mobile/web-entry/**/*.ttf -text
+/mobile/web-entry/**/*.otf -text
+/mobile/web-entry/**/*.woff -text
+/mobile/web-entry/**/*.woff2 -text
+
+# Generated ACP schemas are checked byte-for-byte against formatted output.
+/src/main/acp/generated/*.generated.ts linguist-generated=true text eol=lf
+# Generated skill bundle artifacts are verified byte-for-byte against fresh output.
+/resources/skills/*.json linguist-generated=true text eol=lf
+# Vitest writes snapshots with LF, so checkout bytes must match on every host.
+**/__snapshots__/*.snap text eol=lf

.github/CONTRIBUTING.md

@@ -16,11 +16,38 @@ Thanks for contributing to Orca.
 
 ## Local Setup
 
+Install Node 24, pnpm, and the Bun version in [`config/.bun-version`](../config/.bun-version).
+`pnpm test` runs Vitest on Bun, with Node workers for runtime contracts such as SQLite,
+native PTYs, socket liveness, and V8 memory behavior. `pnpm test:node` runs the same suites
+entirely on Node. Builds and dependency installation still use Node and pnpm.
+
 ```bash
 pnpm install
 pnpm dev
 ```
 
+To reduce main-process rebuild CPU and memory when you do not need its source maps,
+set `ORCA_DEV_MAIN_SOURCEMAPS=0` before `pnpm dev`. In Bash/zsh:
+
+```bash
+ORCA_DEV_MAIN_SOURCEMAPS=0 pnpm dev
+```
+
+In PowerShell, use `$env:ORCA_DEV_MAIN_SOURCEMAPS='0'` before `pnpm dev`.
+Remove the variable when debugging the main process with source maps. Renderer and
+preload settings are unaffected; production builds always keep their hidden main maps.
+
+Ordinary installs include native optional dependencies for the current OS and CPU only.
+Before a cross-architecture build (including `pnpm build:mac`, which produces both x64 and
+arm64 artifacts by default), run `pnpm install:release` to add the other CPU's variants.
+
+Linux `pnpm build`, `pnpm build:native`, and Linux packaging require a running Docker
+daemon to build the clipboard helper against Ubuntu 20.04 rather than the host's
+newer libraries. A verified cached helper can be reused without Docker. For native
+Wayland development, run `pnpm build:native` before `pnpm dev` to make text copying
+available. See the [clipboard build guide](../native/wayland-clipboard/README.md#building-and-testing).
+macOS and Windows builds do not use this helper or require Docker for it.
+
 ## Branch Naming
 
 Use a clear, descriptive branch name that reflects the change.
@@ -44,6 +71,12 @@ pnpm test
 pnpm build
 ```
 
+For repeated local typechecks, use `pnpm tc` (or `pnpm tc:node`, `pnpm tc:web`,
+and `pnpm tc:cli`). These keep TypeScript's incremental cache. CI uses
+`pnpm typecheck:ci` with Bun for full checks. Shared tests are checked by the
+Node project; shared production code is checked in all three environments.
+Run `pnpm tc:node` after editing shared tests, or `pnpm tc` to check everything.
+
 Add high-quality tests for behavior changes and bug fixes. Prefer tests that would actually catch a regression, not shallow coverage that only exercises the happy path.
 
 If your change affects UI or interaction behavior, verify it on the platforms it could impact.
@@ -58,9 +91,10 @@ CI enforces this for `src/preload/` and `src/shared/`.
 
 Each pull request should follow [`.github/pull_request_template.md`](./pull_request_template.md). In particular:
 
+- if you are an outside contributor, link the issue your PR addresses
 - open with an ELI5 of the change (plain language paragraph; the PR title is the one-liner)
 - explain what changed and why, and stay focused on a single topic when possible
-- for any UI or interaction change, attach **before and after** screenshots (or short videos); if there is no visual change, say `No visual change` and why
+- for any UI or interaction change, attach **before and after** screenshots (or short videos); if there is no visual or interaction change, write `N/A` and briefly explain why
 - include high-quality tests when behavior changes or bug fixes warrant them
 - include a brief code review summary from your AI coding agent that explicitly checks cross-platform compatibility, SSH/remote/local compatibility, supported agent and integration compatibility, performance risk, UI quality when applicable, and basic security risk
 - mention any platform-specific, remote/SSH-specific, agent-specific, integration-specific, or git-provider-specific behavior and testing notes
@@ -101,7 +135,7 @@ All stable kinds (`patch`, `minor`, `major`) are computed off the latest _stable
 - If the latest RC tag exists but is still draft-only or missing its GitHub Release, the workflow resumes that tag only when it was built from the current release ref. Otherwise the next RC number is cut.
 - RC numbering also considers release commits on `main`, so deleting a stale tag does not let a later cut reuse the same RC number.
 - Off-main releases (when `ref` is not the tip of `main`) only push the tag. `main` is never mutated from a non-main ref, so you can safely release an older commit without polluting history.
-- When `ref` is the tip of `main`, the version-bump commit is fast-forwarded onto `main` so local `package.json` stays in sync with what's shipped.
+- When `ref` is the tip of `main`, the workflow tries to fast-forward the version-bump commit onto `main`. If main requires pull requests, it leaves main unchanged and pushes only the release tag. Other push errors still stop the cut.
 
 **Common scenarios:**
 

.github/actions/build-mobile-web-bundle/action.yml

@@ -0,0 +1,11 @@
+name: Build the mobile web bundle
+description: Builds out/mobile-web, the page phones load, which every orcad build ships and refuses to build without.
+
+runs:
+  using: composite
+  steps:
+    # Why: the bundle build resolves React Native and Expo from mobile/node_modules.
+    - uses: ./.github/actions/install-mobile-dependencies
+    - name: Build the mobile web bundle
+      shell: bash
+      run: pnpm run build:mobile-web

.github/actions/download-pinned-orca-release/action.yml

@@ -0,0 +1,42 @@
+name: Download pinned Orca release
+description: Downloads a released Linux .deb, checks its SHA-512, extracts it and points ORCA_CROSS_VERSION_PACKAGED_EXECUTABLE at its executable.
+
+inputs:
+  version:
+    description: Release version without the leading v (e.g. 1.4.224).
+    required: true
+  sha512:
+    description: Base64 SHA-512 of orca-ide_<version>_amd64.deb.
+    required: true
+  github-token:
+    description: Token for gh release download.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download and verify
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        ORCA_PINNED_VERSION: ${{ inputs.version }}
+        ORCA_PINNED_SHA512: ${{ inputs.sha512 }}
+      run: |
+        gh release download "v$ORCA_PINNED_VERSION" --repo stablyai/orca --pattern "orca-ide_${ORCA_PINNED_VERSION}_amd64.deb" --dir "$RUNNER_TEMP/old-orca"
+        python3 - <<'PYVERIFY'
+        import base64,hashlib,os,pathlib,subprocess
+        version=os.environ['ORCA_PINNED_VERSION']
+        root=pathlib.Path(os.environ['RUNNER_TEMP'])/'old-orca'
+        package=root/f'orca-ide_{version}_amd64.deb'
+        digest=hashlib.sha512()
+        with package.open('rb') as archive:
+            for block in iter(lambda: archive.read(1024*1024), b''):
+                digest.update(block)
+        assert base64.b64encode(digest.digest()).decode()==os.environ['ORCA_PINNED_SHA512']
+        extracted=root/'extracted'
+        subprocess.run(['dpkg-deb','-x',str(package),str(extracted)],check=True)
+        executable=extracted/'opt'/'Orca'/'orca-ide'
+        assert executable.is_file() and os.access(executable,os.X_OK)
+        with open(os.environ['GITHUB_ENV'],'a') as env: env.write('ORCA_CROSS_VERSION_PACKAGED_EXECUTABLE='+str(executable)+'\n')
+        print('Verified old package:',executable)
+        PYVERIFY

.github/actions/install-mobile-dependencies/action.yml

@@ -0,0 +1,22 @@
+name: Install mobile dependencies
+description: Frozen pnpm install for the mobile/ project, whose node_modules the mobile web bundle build and the mobile-aware lint passes resolve React Native and Expo from.
+
+runs:
+  using: composite
+  steps:
+    # Why a separate install: mobile is its own pnpm project, so the root install leaves
+    # mobile/node_modules empty and every mobile import resolves to nothing.
+    # Why no --ignore-scripts, unlike the root install: mobile's postinstall generates the
+    # gitignored terminal/mermaid webview engine modules that tracked source imports.
+    # The drift guard mirrors the root install so a stale mobile lockfile fails by name --
+    # mobile's lockfile carries patchedDependencies that a silent rewrite would drop.
+    - name: Install mobile dependencies
+      shell: bash
+      working-directory: mobile
+      run: |
+        pnpm install --frozen-lockfile
+        # Job containers can run composite steps from a source mirror without .git.
+        if [ "$(git -C "$GITHUB_WORKSPACE" rev-parse --is-inside-work-tree 2>/dev/null)" = true ]; then
+          git -C "$GITHUB_WORKSPACE" diff --exit-code -- \
+            mobile/package.json mobile/pnpm-lock.yaml mobile/pnpm-workspace.yaml
+        fi