Sync upstream 1.4.214

.github/CONTRIBUTING.md

@@ -26,6 +26,17 @@ pnpm install
 pnpm dev
 ```
 
+To reduce main-process rebuild CPU and memory when you do not need its source maps,
+set `ORCA_DEV_MAIN_SOURCEMAPS=0` before `pnpm dev`. In Bash/zsh:
+
+```bash
+ORCA_DEV_MAIN_SOURCEMAPS=0 pnpm dev
+```
+
+In PowerShell, use `$env:ORCA_DEV_MAIN_SOURCEMAPS='0'` before `pnpm dev`.
+Remove the variable when debugging the main process with source maps. Renderer and
+preload settings are unaffected; production builds always keep their hidden main maps.
+
 Ordinary installs include native optional dependencies for the current OS and CPU only.
 Before a cross-architecture build (including `pnpm build:mac`, which produces both x64 and
 arm64 artifacts by default), run `pnpm install:release` to add the other CPU's variants.
@@ -60,6 +71,15 @@ pnpm test
 pnpm build
 ```
 
+For repeated local typechecks, use `pnpm tc` (or `pnpm tc:node`, `pnpm tc:web`,
+and `pnpm tc:cli`). These run `bun check` from the pinned `bun` devDependency —
+about a third of tsc's CPU and an eighth of its memory, so several agents can
+typecheck at once. Pass `--compiler=native` to use tsc and its incremental
+cache instead. CI uses `pnpm typecheck:ci`, the same Bun check with CI's
+concurrency. Shared tests are checked by the
+Node project; shared production code is checked in all three environments.
+Run `pnpm tc:node` after editing shared tests, or `pnpm tc` to check everything.
+
 Add high-quality tests for behavior changes and bug fixes. Prefer tests that would actually catch a regression, not shallow coverage that only exercises the happy path.
 
 If your change affects UI or interaction behavior, verify it on the platforms it could impact.
@@ -118,7 +138,7 @@ All stable kinds (`patch`, `minor`, `major`) are computed off the latest _stable
 - If the latest RC tag exists but is still draft-only or missing its GitHub Release, the workflow resumes that tag only when it was built from the current release ref. Otherwise the next RC number is cut.
 - RC numbering also considers release commits on `main`, so deleting a stale tag does not let a later cut reuse the same RC number.
 - Off-main releases (when `ref` is not the tip of `main`) only push the tag. `main` is never mutated from a non-main ref, so you can safely release an older commit without polluting history.
-- When `ref` is the tip of `main`, the version-bump commit is fast-forwarded onto `main` so local `package.json` stays in sync with what's shipped.
+- When `ref` is the tip of `main`, the workflow tries to fast-forward the version-bump commit onto `main`. If main requires pull requests, it leaves main unchanged and pushes only the release tag. Other push errors still stop the cut.
 
 **Common scenarios:**
 

.github/actions/build-mobile-web-bundle/action.yml

@@ -0,0 +1,11 @@
+name: Build the mobile web bundle
+description: Builds out/mobile-web, the page phones load, which every orcad build ships and refuses to build without.
+
+runs:
+  using: composite
+  steps:
+    # Why: the bundle build resolves React Native and Expo from mobile/node_modules.
+    - uses: ./.github/actions/install-mobile-dependencies
+    - name: Build the mobile web bundle
+      shell: bash
+      run: pnpm run build:mobile-web

.github/actions/install-node-dependencies/action.yml

@@ -209,6 +209,14 @@ runs:
           git -C "$GITHUB_WORKSPACE" diff --exit-code -- package.json pnpm-lock.yaml pnpm-workspace.yaml
         fi
 
+    # Why: the script-free install leaves node_modules/.bin/bun as a stub that shadows setup-bun under `pnpm run`.
+    - name: Link pinned Bun
+      shell: bash
+      run: |
+        if [ -d node_modules/bun ]; then
+          pnpm rebuild bun
+        fi
+
     # Why --if-present: release cuts run main's workflows against older release tags that predate this script.
     - name: Build internal packages
       shell: bash

.github/scripts/check-required-pr-context.mjs

@@ -10,10 +10,19 @@ export function verifyRequiredPrContext(parseYaml) {
       const workflow = parseYaml(readFileSync(join(directory, file), 'utf8'))
       return Object.entries(workflow.jobs)
         .filter(([id, job]) => (job.name ?? id) === 'PR checks passed')
-        .map(([id]) => `${file}:${id}`)
+        .map(([id, job]) => ({ owner: `${file}:${id}`, job }))
     })
-  if (providers.length !== 1 || providers[0] !== 'pr.yml:verify') {
-    throw new Error(`Required PR context must belong only to pr.yml:verify; found ${providers}`)
+  const owners = providers.map((provider) => provider.owner)
+  if (providers.length !== 1 || owners[0] !== 'pr.yml:verify') {
+    throw new Error(`Required PR context must belong only to pr.yml:verify; found ${owners}`)
+  }
+  const gate = providers[0].job
+  const condition = gate.if?.replace(/^\$\{\{\s*|\s*\}\}$/g, '').trim()
+  if (condition !== '!cancelled() && github.event.pull_request.draft != true') {
+    throw new Error('Required PR aggregate must run unless cancelled or the PR is a draft.')
+  }
+  if (gate['continue-on-error'] || gate.steps?.some((step) => step['continue-on-error'])) {
+    throw new Error('Required PR aggregate must not ignore failures.')
   }
 }
 

.github/workflows/ci-cache-warmup-platform-jobs.yml

@@ -7,12 +7,16 @@ permissions:
   contents: read
 
 jobs:
-  warm-linux-arm:
+  warm-linux-runtime:
     if: github.event_name != 'pull_request'
     concurrency:
-      group: ci-cache-warmup-linux-arm-${{ github.event.pull_request.number || github.ref }}
+      group: ci-cache-warmup-linux-runtime-${{ matrix.runner }}-${{ github.event.pull_request.number || github.ref }}
       cancel-in-progress: ${{ github.event_name != 'schedule' }}
-    runs-on: ubuntu-24.04-arm
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04-arm, blacksmith-4vcpu-ubuntu-2404]
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 10
     env:
       ORCA_BACKGROUND_LAUNCH: '1'
@@ -50,7 +54,8 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
-          cache-pnpm-store-lookup-only: 'true'
+          # Windows PR consumers download packages directly; retain only the build caches.
+          cache-pnpm-store: 'false'
       - name: Verify native cache is usable
         run: node config/scripts/ensure-native-runtime.mjs --check-only
 

.github/workflows/ci-cache-warmup-platforms.yml

@@ -37,20 +37,27 @@ on:
       - 'config/scripts/space-sharing-copy.mjs'
       - 'config/patches/**'
       - 'native/windows-registry/**'
+      - 'native/windows-security/**'
       - 'native/windows-cli-launcher/**'
       - 'native/windows-agent-hook/**'
       - 'config/scripts/build-windows-cli-launcher.mjs'
       - 'config/scripts/build-windows-agent-hook.mjs'
       - 'config/scripts/windows-rust-executable-build.mjs'
       - 'resources/build/icon.ico'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
     paths:
       - '.github/workflows/ci-cache-warmup-platforms.yml'
       - '.github/workflows/ci-cache-warmup-platform-jobs.yml'
 
 permissions:
   contents: read
 
+concurrency:
+  group: ci-cache-warmup-platforms-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   warm-platforms:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
     uses: ./.github/workflows/ci-cache-warmup-platform-jobs.yml

.github/workflows/ci-cache-warmup.yml

@@ -48,6 +48,7 @@ on:
       - 'native/windows-registry/**'
       - 'native/windows-security/**'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
     paths:
       - '.github/workflows/ci-cache-warmup.yml'
       - '.github/actions/prepare-headless-compiler/**'
@@ -57,8 +58,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-cache-warmup-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   warm:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
     concurrency:
       group: ci-cache-warmup-linux-x64-${{ github.event.pull_request.number || github.ref }}
       cancel-in-progress: ${{ github.event_name != 'schedule' }}

.github/workflows/ci-closed-pr-caches.yml

@@ -1,46 +1,74 @@
-name: Clean closed PR work
+name: Clean obsolete PR work
 
 on:
   pull_request_target:
-    types: [closed]
+    types: [closed, synchronize]
 
 permissions:
   actions: write
   pull-requests: read
 
 jobs:
   clean:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2204
     timeout-minutes: 5
     steps:
-      - name: Cancel checks for an unmerged closed PR
-        if: github.event.pull_request.merged == false
+      - name: Cancel obsolete PR checks
+        if: github.event.action == 'synchronize' || github.event.pull_request.merged == false
         uses: actions/github-script@v8
         with:
           script: |
-            const closed = context.payload.pull_request
+            const pr = context.payload.pull_request
+            const superseded = context.payload.action === 'synchronize'
             const targets = [
               ['pr-checks', 'pr.yml'],
               ['node-server', 'node-server-tests.yml'],
               ['ssh-windows-hosts', 'ssh-windows-hosts.yml'],
               ['ssh-hostile-hosts', 'ssh-hostile-hosts.yml'],
               ['mobile', 'mobile.yml'],
-              ['computer-e2e', 'computer-e2e.yml']
+              ['computer-e2e', 'computer-e2e.yml'],
+              ['wsl-orcad-e2e', 'wsl-orcad-e2e.yml'],
+              ['performance-contracts', 'performance-contracts.yml'],
+              ['pr-test-loc', 'pr-test-loc.yml'],
+              ['preflight-critical-path', 'preflight-critical-path-benchmark.yml'],
+              ['preflight-cli', 'preflight-cli-platforms.yml'],
+              ['macos-updater', 'macos-updater-tests.yml'],
+              ['preflight-comparison', 'preflight-benchmark.yml'],
+              ['windows-typecheck-parity', 'windows-typecheck-parity.yml'],
+              ['zcode-transcript-contract', 'zcode-transcript-contract.yml'],
+              ['release-ref-validation', 'release-ref-validation.yml'],
+              ['docs-pr', 'docs.yml'],
+              ['cloud-verify-refs/pull', 'cloud-verify.yml', '/merge'],
+              ['pnpm-verification-pilot', 'ci-pnpm-verification-pilot.yml'],
+              ['win-orcad-serve-switch-e2e', 'win-orcad-serve-switch-e2e.yml'],
+              ['pi-provider-runtime', 'pi-provider-runtime.yml'],
+              ['coding-plan-contract', 'zcode-credential-contract.yml', '-credentials'],
+              ['release-javascript-comparison', 'release-javascript-benchmark.yml'],
+              ['ci-cache-warmup-platforms', 'ci-cache-warmup-platforms.yml'],
+              ['pi-owner-runtime', 'pi-owner-runtime.yml'],
+              ['git-command-termination', 'git-command-termination-runtime.yml'],
+              ['skill-roundtrip-pull_request', 'skill-update-roundtrip.yml'],
+              ['ci-cache-warmup', 'ci-cache-warmup.yml']
             ]
-            const stillClosed = async () => {
+            const stillCurrent = async () => {
               const { data: current } = await github.rest.pulls.get({
-                ...context.repo, pull_number: closed.number
+                ...context.repo, pull_number: pr.number
               })
+              if (superseded) {
+                return current.state === 'open' && current.head.sha === pr.head.sha
+              }
               return current.state === 'closed' && current.merged_at === null &&
-                current.closed_at === closed.closed_at
+                current.closed_at === pr.closed_at
             }
-            if (!Number.isSafeInteger(closed.number) || closed.number <= 0 ||
-                !Number.isFinite(Date.parse(closed.closed_at))) {
-              throw new Error('Missing closed PR identity')
+            if (!Number.isSafeInteger(pr.number) || pr.number <= 0 ||
+                (superseded ? !/^[a-f0-9]{40}$/.test(pr.head?.sha ?? '') :
+                  !Number.isFinite(Date.parse(pr.closed_at)))) {
+              throw new Error('Missing PR identity')
             }
-            if (!await stillClosed()) return
-            for (const [prefix, workflow] of targets) {
-              const group = `${prefix}-${closed.number}`
+            if (!await stillCurrent()) return
+            for (const [prefix, workflow, suffix = ''] of targets) {
+              const group = prefix === 'cloud-verify-refs/pull'
+                ? `${prefix}/${pr.number}${suffix}` : `${prefix}-${pr.number}${suffix}`
               let data
               try {
                 const response = await github.request(
@@ -65,9 +93,11 @@ jobs:
                 })
                 if (run.event !== 'pull_request' || run.path !== `.github/workflows/${workflow}` ||
                     run.status === 'completed' ||
-                    !Number.isFinite(Date.parse(run.created_at)) ||
-                    Date.parse(run.created_at) > Date.parse(closed.closed_at)) continue
-                if (!await stillClosed()) return
+                    (superseded ? !/^[a-f0-9]{40}$/.test(run.head_sha ?? '') ||
+                      run.head_sha === pr.head.sha :
+                      !Number.isFinite(Date.parse(run.created_at)) ||
+                      Date.parse(run.created_at) > Date.parse(pr.closed_at))) continue
+                if (!await stillCurrent()) return
                 try {
                   await github.rest.actions.cancelWorkflowRun({
                     ...context.repo, run_id: member.run_id
@@ -80,7 +110,7 @@ jobs:
             }
       # No checkout: this runs trusted default-branch code, including for fork PRs.
       - uses: actions/github-script@v8
-        if: '!cancelled()'
+        if: ${{ !cancelled() && github.event.action == 'closed' }}
         with:
           script: |
             const ref = `refs/pull/${context.payload.pull_request.number}/merge`

.github/workflows/ci-pnpm-verification-pilot.yml

@@ -2,6 +2,7 @@ name: pnpm verification cache pilot
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
     paths: ['.github/workflows/ci-pnpm-verification-pilot.yml']
   workflow_dispatch:
 
@@ -17,6 +18,7 @@ env:
 
 jobs:
   seed:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
     strategy:
       matrix:
         runner: [ubuntu-latest, ubuntu-24.04-arm]

.github/workflows/cloud-monitor-relay-clock-skew.yml

@@ -23,8 +23,13 @@ jobs:
     if: ${{ vars.ORCA_CLOUD_OPERATIONS_ENABLED == 'true' }}
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: cloud/infra/terraform/environments/production.tfvars
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+
       - name: Measure Date-header skew for every relay cell
-        working-directory: .
         run: |
           set -u
           # Date headers carry whole seconds; compare floored seconds on both
@@ -36,10 +41,18 @@ jobs:
           failures=0
           reachable=0
           unserved=0
-          # Keep this upper bound at or above the highest provisioned cell in
-          # environments/production.tfvars; unlisted cells are silently unmonitored.
-          for n in $(seq 1 22); do
-            cell="c${n}"
+          # Every relay_gce_cells hostname (the block relayOpsCellsFromTerraform reads), fenced
+          # cells included, so a newly declared cell is probed from its first run.
+          cells="$(awk '
+            /^relay_gce_cells[ \t]*=[ \t]*\{/ { inside = 1; next }
+            inside && /^\}/ { exit }
+            inside && /^[ \t]*hostname[ \t]*=/ { split($0, quoted, "\""); print quoted[2] }
+          ' infra/terraform/environments/production.tfvars || true)"
+          if [ -z "${cells}" ]; then
+            echo "::error::read no relay cells from production.tfvars; monitor blind"
+            exit 1
+          fi
+          for cell in ${cells}; do
             url="https://${cell}.relay.onorca.dev/health"
             # Why: *.relay.onorca.dev is a wildcard, so the load balancer answers with its own
             # accurate Date for a fenced, dead, or never-provisioned cell. Timing that reads as

.github/workflows/cloud-verify.yml

@@ -2,6 +2,7 @@ name: Cloud Verify
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
     paths:
       - cloud/**
       - src/packages/process-host/**
@@ -29,6 +30,7 @@ defaults:
 jobs:
   # Public-repository hosted runners preserve Blacksmith allowance for macOS.
   security:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
     name: Secret scan
     runs-on: ubuntu-22.04
     steps:
@@ -79,6 +81,7 @@ jobs:
   # Compiles the workspace. No Postgres service: nothing here reaches a
   # database, and the service container costs ~13s of startup.
   build:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
@@ -99,6 +102,7 @@ jobs:
   # packages it needs through pretest hooks, so it does not depend on
   # `pnpm build` having run.
   test:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
     runs-on: ubuntu-22.04
     services:
       postgres:
@@ -135,6 +139,7 @@ jobs:
   # Fork pull requests reach this job, so it never configures a backend, never plans, and never
   # holds a credential. Only the relay root ships here; foundation and apps stay private.
   terraform:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4