sync: upstream 31012aeb09 into swaplabs/main

.github/workflows/bun-profile-tests.yml

@@ -17,6 +17,24 @@ on:
       - '.pnpmfile.cjs'
       - '.github/actions/install-node-dependencies/**'
       - '.github/workflows/bun-profile-tests.yml'
+  # The pull request qualifies one platform for an unflavoured change; this is where all six
+  # are re-qualified, so a platform break surfaces minutes after merge instead of next cron.
+  push:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'config/**'
+      - 'native/**'
+      - 'tests/**'
+      - 'resources/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'tsconfig.json'
+      - '.npmrc'
+      - '.pnpmfile.cjs'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/workflows/bun-profile-tests.yml'
   workflow_dispatch:
   schedule:
     - cron: '30 11 * * *'
@@ -57,7 +75,11 @@ jobs:
   persistence:
     needs: changes
     # Missing/failed detection runs the full matrix; manual runs remain unconditional.
-    if: ${{ !cancelled() && needs.changes.outputs.should_run != 'false' }}
+    # A draft carries no platform verdict; readiness re-triggers this workflow. Spelled against
+    # the event name so the push and schedule paths do not rest on a null property comparison.
+    if: >-
+      ${{ !cancelled() && needs.changes.outputs.should_run != 'false' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.draft != true) }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/homebrew-bump.yml

@@ -132,11 +132,10 @@ jobs:
           print(src)
           PY
 
-      # Why: reuse the existing buf0-bot GitHub App (also used by
-      # track-community-prs.yaml) instead of minting a new PAT. The app is
-      # installed org-wide, so it has access to stablyai/homebrew-orca
-      # automatically. GITHUB_TOKEN cannot push cross-repo; a short-lived
-      # installation token can.
+      # Why: reuse the existing buf0-bot GitHub App instead of minting a new
+      # PAT. The app is installed org-wide, so it has access to
+      # stablyai/homebrew-orca automatically. GITHUB_TOKEN cannot push
+      # cross-repo; a short-lived installation token can.
       - name: Generate buf0-bot token
         id: app-token
         uses: actions/create-github-app-token@v3

.github/workflows/mobile.yml

@@ -41,9 +41,8 @@ on:
       - 'config/scripts/mobile-test-change-scope*'
       - 'config/scripts/pr-code-change-scope.mjs'
       - 'config/scripts/mobile-recording-pin-checkout.test.mjs'
-  # Why main too: a behaviour-change branch legitimately pins its own last fenced commit, and that
-  # commit only stops being reachable when the branch squash-merges. The pull_request run cannot
-  # see that; this one is where the pin guard finds it.
+  # Why main too: a squash is where a spliced corpus lands, and where a behaviour-change branch's
+  # own pinned commit leaves main's history for its pull request's head ref, which the guard follows.
   push:
     branches:
       - main
@@ -182,6 +181,10 @@ jobs:
     name: RPC recording pin
     # Why ARM: pure Node plus git; the golden comparison masks `platform`.
     runs-on: ubuntu-24.04-arm
+    # Why pull-requests: the guard asks GitHub which pull requests hold a pin main's history lacks.
+    permissions:
+      contents: read
+      pull-requests: read
 
     defaults:
       run:
@@ -191,7 +194,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          # The ancestry verdict is read straight off history. On a shallow checkout
+          # The reachability verdict is read straight off history. On a shallow checkout
           # `git merge-base --is-ancestor` answers from grafted parents, so the guard refuses to
           # answer at all rather than reporting a pass it has no evidence for -- and the pinned tree
           # below has to be checkable out.
@@ -211,12 +214,14 @@ jobs:
       # Seconds. No `--ref`, so the pin is judged against the same tree it was read out of. On a
       # pull request that is the merge preview, which already carries main's repins; judging the
       # branch head instead fails every branch cut before the day's repin, and its instruction would
-      # tell the author to pin their own head -- creating the break this guard exists to catch. A
-      # branch that pins its own commit passes here and fails on the push after the squash, which is
-      # where the pin actually leaves the history.
+      # tell the author to pin their own head. A branch that pins its own commit still passes on the
+      # push after the squash: the guard asks GitHub which pull requests hold the pin and fetches
+      # their `refs/pull/<n>/head`, which GitHub keeps for good. The token lifts the API rate limit.
       - name: Check the recording pin is reachable
         shell: bash
-        run: pnpm exec tsx scripts/rpc-recording-pin-guard.mts ancestry
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: pnpm exec tsx scripts/rpc-recording-pin-guard.mts reachable
 
       # ~2 min locally for the record itself, so it is gated rather than run twice over. A pull
       # request that moves none of the corpus, the manifest or the recorder cannot move this
@@ -226,6 +231,7 @@ jobs:
       - name: Reproduce the corpus from the pinned tree
         shell: bash
         env:
+          GITHUB_TOKEN: ${{ github.token }}
           PIN_GUARD_BASE: ${{ github.event.pull_request.base.sha }}
         run: |
           if [ -n "$PIN_GUARD_BASE" ]; then

.github/workflows/node-next-compat.yml

@@ -34,8 +34,12 @@ jobs:
           native-runtime: node
           node-version: ${{ matrix.node }}
 
+  unit_plan:
+    uses: ./.github/workflows/unit-plan.yml
+
   test:
-    needs: [test_native_cache]
+    needs: [test_native_cache, unit_plan]
     uses: ./.github/workflows/unit-tests.yml
     with:
       node_versions: '["24", "26"]'
+      shards: ${{ needs.unit_plan.outputs.shards }}

.github/workflows/pr.yml

@@ -638,6 +638,7 @@ jobs:
             src/main/zsh-scoped-histfile.live-shell.test.ts \
             src/main/zsh-startup-hook-user-config-equivalence.live-shell.test.ts \
             src/main/zsh-wrapper-version-mismatch.live-shell.test.ts \
+            src/main/runtime/structured-session-cli-login-shell.live-shell.test.ts \
             src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts \
             src/shared/fish-query-reply-child-stdin.node-pty.test.ts \
             src/shared/pty-reply-echo-shapes.node-pty.test.ts \
@@ -663,20 +664,40 @@ jobs:
           native-runtime: node
           node-version: '24'
 
+  # Why hoisted out of unit-tests.yml: a caller's `needs` gate the whole called workflow, so
+  # while planning lived in there it queued behind static analysis and typecheck and the shards
+  # then queued behind it. Planning needs none of their output, so running it against
+  # code_paths alone overlaps it with the gate. Measured a median 93s off the matrix's start.
+  unit_plan:
+    needs: [code_paths]
+    if: needs.code_paths.outputs.test == 'true'
+    uses: ./.github/workflows/unit-plan.yml
+    with:
+      selection_mode: ${{ vars.ORCA_UNIT_SELECTION_MODE || 'shadow' }}
+
   test:
-    needs: [code_paths, test_native_cache, static_analysis, typecheck]
+    needs: [code_paths, unit_plan, test_native_cache, static_analysis, typecheck]
     # Honor cancellation while allowing the optional native-cache primer to skip.
     if: >-
       !cancelled() &&
       needs.code_paths.outputs.test == 'true' &&
+      needs.unit_plan.result == 'success' &&
       needs.static_analysis.result == 'success' &&
       needs.typecheck.result == 'success' &&
       (needs.test_native_cache.result == 'success' || needs.test_native_cache.result == 'skipped')
     uses: ./.github/workflows/unit-tests.yml
     with:
       node_versions: '["24"]'
       runner: ubuntu-24.04-arm
-      selection_mode: ${{ vars.ORCA_UNIT_SELECTION_MODE || 'shadow' }}
+      shards: ${{ needs.unit_plan.outputs.shards }}
+
+  # Why a sibling and not part of the test workflow: it is advisory, so it must not delay the
+  # gate. Inside unit-tests.yml a caller's `needs: test` waited for it, holding verify ~36s
+  # after the last shard. Deliberately absent from verify's needs for the same reason.
+  unit_selection_evidence:
+    needs: [test]
+    if: ${{ !cancelled() && needs.test.result == 'success' }}
+    uses: ./.github/workflows/unit-selection-evidence.yml
 
   # Why a separate job: the test needs a real Chrome, and the sharded `test` matrix
   # would pay for it on every shard to run one file in whichever shard it landed in.
@@ -1130,11 +1151,9 @@ jobs:
         uses: actions/cache@v5
         with:
           path: native/windows-cli-launcher/.build
-          key: windows-cli-launcher-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-cli-launcher/**', 'config/scripts/build-windows-cli-launcher.mjs') }}
+          key: windows-cli-launcher-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-cli-launcher/**', 'config/scripts/build-windows-cli-launcher.mjs', 'resources/build/icon.ico', 'package.json') }}
 
       - name: Build package inputs
-        env:
-          ORCA_REUSE_WINDOWS_CLI_LAUNCHER: '1'
         run: pnpm run build:release:parallel
 
       - name: Restore compiled Electron native modules