Sync upstream 1.4.214

.gitattributes

@@ -46,6 +46,7 @@
 # normalisation on a Windows checkout would rewrite the evidence the fixture exists to be.
 /src/main/runtime/__fixtures__/*.txt -text
 /src/main/daemon/__fixtures__/pty-transcripts/*.txt -text
+/src/renderer/src/components/terminal-pane/terminal-link-transcripts/*.txt -text whitespace=cr-at-eol
 # Generated runtime English subset: compared byte-for-byte by
 # verify:localization-runtime-catalog, so a CRLF checkout would fail the gate.
 /src/renderer/src/i18n/en-runtime-required.json linguist-generated=true text eol=lf

.github/actions/prepare-native-runtime/action.yml

@@ -54,7 +54,7 @@ runs:
       env:
         NATIVE_RUNTIME: ${{ inputs.native-runtime }}
         NODE_VERSION: ${{ inputs.node-version }}
-        NATIVE_SOURCE_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs', '.github/actions/prepare-native-runtime/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/scripts/node-pty-job-ownership.cjs', 'config/scripts/windows-pe-machine.cjs', 'config/scripts/windows-process-tree-gyp-rebuild.mjs', 'config/scripts/windows-process-tree-creation-time.cjs', 'config/scripts/install-electron-package-binary.mjs', 'config/scripts/electron-platform-path.mjs', 'config/scripts/zip-extractor-command.mjs', 'src/shared/zip-extractor-command.ts', 'config/scripts/shared-electron-dist-cache.mjs', 'config/scripts/space-sharing-copy.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json', 'native/windows-registry/index.js') }}
+        NATIVE_SOURCE_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs', '.github/actions/prepare-native-runtime/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/initialize-windows-native-toolchain.mjs', 'config/scripts/capture-windows-native-environment.cmd', 'config/scripts/rebuild-native-deps.mjs', 'config/scripts/node-pty-job-ownership.cjs', 'config/scripts/windows-pe-machine.cjs', 'config/scripts/windows-process-tree-gyp-rebuild.mjs', 'config/scripts/windows-process-tree-creation-time.cjs', 'config/scripts/install-electron-package-binary.mjs', 'config/scripts/electron-platform-path.mjs', 'config/scripts/zip-extractor-command.mjs', 'src/shared/zip-extractor-command.ts', 'config/scripts/shared-electron-dist-cache.mjs', 'config/scripts/space-sharing-copy.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch', 'native/windows-registry/src/addon.cc', 'native/windows-registry/binding.gyp', 'native/windows-registry/package.json', 'native/windows-registry/index.js', 'native/windows-security/src/addon.cc', 'native/windows-security/binding.gyp', 'native/windows-security/package.json', 'native/windows-security/index.js') }}
       run: |
         scope="${ImageOS:-$RUNNER_OS}"
         if [ -r /etc/os-release ]; then
@@ -69,6 +69,7 @@ runs:
         path<<ORCA_NATIVE_BUILD_DIRECTORIES
         node_modules/.pnpm/node-pty@*/node_modules/node-pty/build
         native/windows-registry/build
+        native/windows-security/build
         node_modules/.pnpm/@vscode+windows-process-tre*/node_modules/@vscode/windows-process-tree/build
         ORCA_NATIVE_BUILD_DIRECTORIES
         ORCA_NATIVE_CACHE_PATHS
@@ -82,6 +83,7 @@ runs:
         path: |
           node_modules/.pnpm/node-pty@*/node_modules/node-pty/build
           native/windows-registry/build
+          native/windows-security/build
           node_modules/.pnpm/@vscode+windows-process-tre*/node_modules/@vscode/windows-process-tree/build
         key: ${{ steps.native-cache-scope.outputs.key }}
 
@@ -93,6 +95,7 @@ runs:
         path: |
           node_modules/.pnpm/node-pty@*/node_modules/node-pty/build
           native/windows-registry/build
+          native/windows-security/build
           node_modules/.pnpm/@vscode+windows-process-tre*/node_modules/@vscode/windows-process-tree/build
         key: ${{ steps.native-cache-scope.outputs.key }}
 
@@ -117,4 +120,9 @@ runs:
       shell: bash
       env:
         NATIVE_RUNTIME: ${{ inputs.native-runtime }}
-      run: node config/scripts/ensure-native-runtime.mjs --runtime="$NATIVE_RUNTIME"
+      run: |
+        if [ "$RUNNER_OS" = Windows ] && [ "$NATIVE_RUNTIME" = node ]; then
+          node config/scripts/initialize-windows-native-toolchain.mjs
+        else
+          node config/scripts/ensure-native-runtime.mjs --runtime="$NATIVE_RUNTIME"
+        fi

.github/actions/prepare-orcad-prebuilds/action.yml

@@ -63,5 +63,5 @@ runs:
           fi
           pnpm build:orcad-prebuilds
         fi
-        pnpm build:orcad-prebuilds --require-slots "$(node config/scripts/build-orcad-prebuilds.mjs --print-slot)"
-        pnpm build:orcad-prebuilds --smoke
+        node config/scripts/build-orcad-prebuilds.mjs --require-slots "$(node config/scripts/build-orcad-prebuilds.mjs --print-slot)"
+        node config/scripts/build-orcad-prebuilds.mjs --smoke

.github/actions/prepare-wayland-clipboard/action.yml

@@ -0,0 +1,53 @@
+name: Prepare Wayland clipboard helper
+description: Reuse the source-matched Ubuntu 20.04 helper, validating its architecture and glibc requirements every time.
+
+inputs:
+  save-cache:
+    description: Publish a validated helper from the default branch.
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve Wayland clipboard build identity
+      id: identity
+      shell: bash
+      run: |
+        node --input-type=module <<'NODE'
+        import { appendFileSync } from 'node:fs'
+        import { waylandClipboardFingerprint } from './config/scripts/build-wayland-clipboard.mjs'
+        const fingerprint = waylandClipboardFingerprint(process.cwd(), process.arch)
+        // Immutable invalid hits need a version bump here before publishing their repair.
+        appendFileSync(process.env.GITHUB_OUTPUT, `key=wayland-clipboard-v1-${process.arch}-${fingerprint}\n`)
+        NODE
+
+    - name: Restore Wayland clipboard helper
+      id: cache
+      uses: actions/cache/restore@v5
+      continue-on-error: true
+      with:
+        path: native/wayland-clipboard/.build
+        key: ${{ steps.identity.outputs.key }}
+
+    - name: Build or validate Wayland clipboard helper
+      shell: bash
+      env:
+        CACHE_HIT: ${{ steps.cache.outputs.cache-hit }}
+      run: |
+        if node config/scripts/build-wayland-clipboard.mjs; then
+          exit 0
+        fi
+        if [ "$CACHE_HIT" != true ]; then
+          exit 1
+        fi
+        echo 'Discarding an unusable Wayland clipboard cache and rebuilding from source.'
+        rm -rf -- native/wayland-clipboard/.build
+        node config/scripts/build-wayland-clipboard.mjs
+
+    - name: Save validated Wayland clipboard helper from main
+      if: inputs.save-cache == 'true' && steps.cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+      uses: actions/cache/save@v5
+      continue-on-error: true
+      with:
+        path: native/wayland-clipboard/.build
+        key: ${{ steps.identity.outputs.key }}

.github/actions/prepare-windows-agent-hook/action.yml

@@ -0,0 +1,27 @@
+name: Prepare the Windows agent hook
+description: Compiles native/windows-agent-hook into native/windows-agent-hook/.build/orca-agent-hook.exe, which electron-builder --win refuses to package without.
+
+runs:
+  using: composite
+  steps:
+    - name: Cache the Windows agent hook build
+      if: runner.os == 'Windows'
+      uses: actions/cache@v5
+      with:
+        path: |
+          native/windows-agent-hook/.build
+          native/windows-agent-hook/target
+          ~/.cargo/registry
+        key: windows-agent-hook-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-agent-hook/**', 'config/scripts/build-windows-agent-hook.mjs', 'config/scripts/windows-rust-executable-build.mjs', 'resources/build/icon.ico', 'package.json') }}
+
+    # Why explicit: a runner image without cargo would otherwise fail inside electron-builder's verify.
+    - name: Build the Windows agent hook
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+        }
+        node config/scripts/build-windows-agent-hook.mjs
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

.github/actions/prepare-windows-cli-launcher/action.yml

@@ -17,7 +17,7 @@ runs:
           .build/windows-cli-launcher
           native/windows-cli-launcher/target
           ~/.cargo/registry
-        key: orcad-windows-cli-launcher-${{ runner.arch }}-${{ inputs.arches }}-${{ hashFiles('native/windows-cli-launcher/**', 'config/scripts/build-windows-cli-launcher.mjs', 'resources/build/icon.ico', 'package.json') }}
+        key: orcad-windows-cli-launcher-${{ runner.arch }}-${{ inputs.arches }}-${{ hashFiles('native/windows-cli-launcher/**', 'config/scripts/build-windows-cli-launcher.mjs', 'config/scripts/windows-rust-executable-build.mjs', 'resources/build/icon.ico', 'package.json') }}
 
     # Why explicit: a runner image without cargo would otherwise fail inside the orcad build.
     - name: Build the launcher for each architecture

.github/scripts/check-required-pr-context.mjs

@@ -0,0 +1,27 @@
+import { readdirSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+export function verifyRequiredPrContext(parseYaml) {
+  const directory = '.github/workflows'
+  const providers = readdirSync(directory)
+    .filter((file) => /\.ya?ml$/.test(file))
+    .flatMap((file) => {
+      const workflow = parseYaml(readFileSync(join(directory, file), 'utf8'))
+      return Object.entries(workflow.jobs)
+        .filter(([id, job]) => (job.name ?? id) === 'PR checks passed')
+        .map(([id]) => `${file}:${id}`)
+    })
+  if (providers.length !== 1 || providers[0] !== 'pr.yml:verify') {
+    throw new Error(`Required PR context must belong only to pr.yml:verify; found ${providers}`)
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const yaml = globalThis.Bun?.YAML
+  if (!yaml) {
+    throw new Error('Run workflow context validation with the pinned Bun runtime.')
+  }
+  verifyRequiredPrContext(yaml.parse)
+  console.log('Required PR check context verified.')
+}

.github/workflows/ci-cache-warmup-platform-jobs.yml

@@ -0,0 +1,112 @@
+name: Warm shared CI platform cache jobs
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  warm-linux-arm:
+    if: github.event_name != 'pull_request'
+    concurrency:
+      group: ci-cache-warmup-linux-arm-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: ${{ github.event_name != 'schedule' }}
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+          node-version: '24'
+          cache-electron-package: 'true'
+          cache-pnpm-store-lookup-only: 'true'
+      - name: Populate shared Electron archive
+        run: node config/scripts/install-electron-package-binary.mjs
+      - name: Verify native cache is usable
+        run: node config/scripts/ensure-native-runtime.mjs --check-only
+
+  warm-windows:
+    concurrency:
+      group: ci-cache-warmup-windows-${{ matrix.os }}-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: ${{ github.event_name != 'schedule' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2022, windows-11-arm]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+          cache-pnpm-store-lookup-only: 'true'
+      - name: Verify native cache is usable
+        run: node config/scripts/ensure-native-runtime.mjs --check-only
+
+      - name: Cache Windows CLI launcher
+        if: runner.arch == 'X64'
+        uses: actions/cache@v5
+        with:
+          path: |
+            native/windows-cli-launcher/.build
+            native/windows-cli-launcher/target
+            native/windows-agent-hook/.build
+            native/windows-agent-hook/target
+            ~/.cargo/registry
+          key: windows-cli-launcher-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-cli-launcher/**', 'native/windows-agent-hook/**', 'config/scripts/build-windows-cli-launcher.mjs', 'config/scripts/build-windows-agent-hook.mjs', 'config/scripts/windows-rust-executable-build.mjs', 'resources/build/icon.ico', 'package.json') }}
+
+      - name: Build the Windows native executables
+        if: runner.arch == 'X64'
+        shell: pwsh
+        run: |
+          if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
+            rustup toolchain install stable --profile minimal
+            rustup default stable
+          }
+          node config/scripts/build-windows-agent-hook.mjs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          node config/scripts/build-windows-cli-launcher.mjs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      - name: Warm the Windows ARM server launcher
+        if: runner.arch == 'ARM64'
+        uses: ./.github/actions/prepare-windows-cli-launcher
+        with:
+          arches: arm64
+
+  warm-linux-package-fixtures:
+    if: github.event_name != 'pull_request'
+    concurrency:
+      group: ci-cache-warmup-linux-package-fixtures-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: ${{ github.event_name != 'schedule' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        with:
+          fixture: daemon-shutdown-descendants
+          save-cache: ${{ github.event_name != 'pull_request' }}
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        with:
+          fixture: headless-serve-shutdown
+          save-cache: ${{ github.event_name != 'pull_request' }}
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        with:
+          fixture: cli-launch-contract
+          save-cache: ${{ github.event_name != 'pull_request' }}

.github/workflows/ci-cache-warmup-platforms.yml

@@ -0,0 +1,56 @@
+name: Warm shared CI platform caches
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/ci-cache-warmup.yml'
+      - '.github/workflows/ci-cache-warmup-platform-jobs.yml'
+      - '.github/workflows/ci-cache-warmup-platforms.yml'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/actions/restore-pnpm-verification/**'
+      - '.github/actions/prepare-native-runtime/**'
+      - '.github/actions/prepare-windows-cli-launcher/**'
+      - '.github/actions/prepare-git-compatibility/**'
+      - '.github/actions/prepare-linux-package-fixture/**'
+      - 'config/docker/headless-serve-shutdown/**'
+      - 'config/docker/cli-launch-contract/**'
+      - 'config/docker/daemon-shutdown-descendants/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - '.npmrc'
+      - '.pnpmfile.cjs'
+      - 'config/scripts/ensure-native-runtime.mjs'
+      - 'config/scripts/initialize-windows-native-toolchain.mjs'
+      - 'config/scripts/capture-windows-native-environment.cmd'
+      - 'config/scripts/rebuild-native-deps.mjs'
+      - 'config/scripts/node-pty-job-ownership.cjs'
+      - 'config/scripts/windows-pe-machine.cjs'
+      - 'config/scripts/windows-process-tree-gyp-rebuild.mjs'
+      - 'config/scripts/windows-process-tree-creation-time.cjs'
+      - 'config/scripts/install-electron-package-binary.mjs'
+      - 'config/scripts/electron-platform-path.mjs'
+      - 'config/scripts/zip-extractor-command.mjs'
+      - 'src/shared/zip-extractor-command.ts'
+      - 'config/scripts/shared-electron-dist-cache.mjs'
+      - 'config/scripts/space-sharing-copy.mjs'
+      - 'config/patches/**'
+      - 'native/windows-registry/**'
+      - 'native/windows-cli-launcher/**'
+      - 'native/windows-agent-hook/**'
+      - 'config/scripts/build-windows-cli-launcher.mjs'
+      - 'config/scripts/build-windows-agent-hook.mjs'
+      - 'config/scripts/windows-rust-executable-build.mjs'
+      - 'resources/build/icon.ico'
+  pull_request:
+    paths:
+      - '.github/workflows/ci-cache-warmup-platforms.yml'
+      - '.github/workflows/ci-cache-warmup-platform-jobs.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  warm-platforms:
+    uses: ./.github/workflows/ci-cache-warmup-platform-jobs.yml