sync: upstream main 2026-10-11

.github/workflows/pr.yml

@@ -319,6 +319,10 @@ jobs:
         if: needs.code_paths.outputs.static_analysis == 'true'
         run: pnpm run check:runtime-electron-ratchet
 
+      - name: Enforce owner-routing ratchet
+        if: needs.code_paths.outputs.static_analysis == 'true'
+        run: pnpm run check:owner-routing-ratchet
+
       - name: Check Node runtime pin
         if: needs.code_paths.outputs.static_analysis == 'true'
         run: pnpm run check:node-runtime-pin
@@ -808,13 +812,15 @@ jobs:
     # Cancellation and failed prerequisites stop the expensive matrix.
     if: >-
       !cancelled() &&
+      needs.code_paths.result == 'success' &&
       needs.code_paths.outputs.test == 'true' &&
       needs.preflight.result == 'success'
     uses: ./.github/workflows/unit-tests.yml
     with:
       node_versions: '["24"]'
       runner: ubuntu-24.04-arm
       shards: ${{ needs.preflight.outputs.shards }}
+      browser_contract: ${{ needs.code_paths.outputs.orcad_browser == 'true' }}
 
   # Why a sibling and not part of the test workflow: it is advisory, so it must not delay the
   # gate. Inside unit-tests.yml a caller's `needs: test` waited for it, holding verify ~36s
@@ -824,48 +830,6 @@ jobs:
     if: ${{ !cancelled() && (needs.test.result == 'success' || needs.test.result == 'failure') }}
     uses: ./.github/workflows/unit-selection-evidence.yml
 
-  # Why a separate job: the test needs a real Chrome, and the sharded `test` matrix
-  # would pay for it on every shard to run one file in whichever shard it landed in.
-  orcad_browser:
-    name: orcad browser provider
-    needs: [code_paths, preflight]
-    if: >-
-      !cancelled() &&
-      needs.code_paths.result == 'success' &&
-      needs.code_paths.outputs.orcad_browser == 'true' &&
-      needs.preflight.result == 'success'
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      # Why no native-runtime: the provider drives the prebuilt agent-browser binary
-      # shipped in node_modules and never touches node-pty.
-      - uses: ./.github/actions/install-node-dependencies
-
-      # Why the runner's Google Chrome and not its chromium: Ubuntu 24.04 only ships an
-      # AppArmor userns profile for the Chrome .deb, so chromium dies with "No usable
-      # sandbox" and the provider passes no --no-sandbox. Why fail instead of skip: an
-      # unset ORCA_BROWSER_EXECUTABLE is exactly how this test went uncovered for so long.
-      - name: Resolve Chrome for the browser provider
-        run: |
-          set -euo pipefail
-          chrome="$(command -v google-chrome || command -v google-chrome-stable || true)"
-          if [ -z "$chrome" ]; then
-            echo "::error::No Google Chrome on the runner; the browser provider test would silently skip."
-            exit 1
-          fi
-          "$chrome" --version
-          echo "ORCA_BROWSER_EXECUTABLE=$chrome" >> "$GITHUB_ENV"
-
-      - name: Test external Chromium browser provider
-        run: |
-          pnpm exec vitest run --config config/vitest.config.ts \
-            src/main/orcad/external-chromium-browser-process.integration.test.ts
-
   # Why its own job: it needs mobile/node_modules and a real browser, and the sharded `test`
   # matrix would pay for both on every shard to run two files. It builds the same bundle the
   # package job ships, and adds the render and census checks packaging does not run.
@@ -1428,7 +1392,6 @@ jobs:
       - xterm_patch_sync
       - shell_contracts
       - test
-      - orcad_browser
       - mobile_web_app
       - cross-version-wire
       - managed_hook_node18
@@ -1463,8 +1426,6 @@ jobs:
           SHELL_CONTRACTS_SHOULD_RUN: ${{ needs.code_paths.outputs.shell_contracts }}
           TEST: ${{ needs.test.result }}
           TEST_SHOULD_RUN: ${{ needs.code_paths.outputs.test }}
-          ORCAD_BROWSER: ${{ needs.orcad_browser.result }}
-          ORCAD_BROWSER_SHOULD_RUN: ${{ needs.code_paths.outputs.orcad_browser }}
           MOBILE_WEB_APP: ${{ needs.mobile_web_app.result }}
           MOBILE_WEB_APP_SHOULD_RUN: ${{ needs.code_paths.outputs.mobile_web_app }}
           CROSS_VERSION_WIRE: ${{ needs.cross-version-wire.result }}
@@ -1504,7 +1465,6 @@ jobs:
           check_job xterm_patch_sync "$XTERM_PATCH_SYNC" "$XTERM_PATCH_SYNC_SHOULD_RUN"
           check_job shell_contracts "$SHELL_CONTRACTS" "$SHELL_CONTRACTS_SHOULD_RUN"
           check_job test "$TEST" "$TEST_SHOULD_RUN"
-          check_job orcad_browser "$ORCAD_BROWSER" "$ORCAD_BROWSER_SHOULD_RUN"
           check_job mobile_web_app "$MOBILE_WEB_APP" "$MOBILE_WEB_APP_SHOULD_RUN"
           check_job cross-version-wire "$CROSS_VERSION_WIRE" "$CROSS_VERSION_WIRE_SHOULD_RUN"
           check_job managed_hook_node18 "$MANAGED_HOOK_NODE18" "$MANAGED_HOOK_NODE18_SHOULD_RUN"

.github/workflows/ssh-hostile-hosts.yml

@@ -17,6 +17,7 @@ on:
       - 'src/main/ssh/ssh-hostile-host-*'
       - 'src/main/ssh/sftp-*'
       - 'src/relay/**'
+      - 'src/wsl-guest/**'
       - 'src/shared/node-runtime-pin.ts'
       - 'src/shared/orcad-artifacts.ts'
       - 'config/scripts/build-orcad-*.mjs'

.github/workflows/ssh-windows-hosts.yml

@@ -18,6 +18,7 @@ on:
       - 'src/main/ssh/ssh-windows-host-*'
       - 'src/main/ssh/ssh-session-command-audit.ts'
       - 'src/relay/**'
+      - 'src/wsl-guest/**'
       - 'src/packages/process-host/**'
       - 'pnpm-workspace.yaml'
       - 'src/shared/node-runtime-pin.ts'

.github/workflows/unit-tests.yml

@@ -14,6 +14,12 @@ on:
         default: ubuntu-latest
         type: string
 
+      browser_contract:
+        description: Include the PR external Chromium browser contract in relay integration.
+        required: false
+        default: false
+        type: boolean
+
       shards:
         description: JSON array of shard assignments, produced by unit-plan.yml.
         required: true
@@ -96,22 +102,48 @@ jobs:
           persist-credentials: false
 
       - uses: ./.github/actions/install-node-dependencies
+        id: root_dependencies
         with:
           native-runtime: none
           node-version: ${{ matrix.node }}
           cache-dependency-path: |
             pnpm-lock.yaml
             cloud/pnpm-lock.yaml
 
+      - name: Resolve Chrome for the browser provider
+        id: browser_executable
+        if: inputs.browser_contract && success()
+        run: |
+          set -euo pipefail
+          chrome="$(command -v google-chrome || command -v google-chrome-stable || true)"
+          if [ -z "$chrome" ]; then
+            echo "::error::No Google Chrome on the runner; the browser provider test would silently skip."
+            exit 1
+          fi
+          "$chrome" --version
+          echo "executable=$chrome" >> "$GITHUB_OUTPUT"
+
+      - name: Test external Chromium browser provider
+        if: inputs.browser_contract && success()
+        env:
+          ORCA_BACKGROUND_LAUNCH: '1'
+          ORCA_BROWSER_EXECUTABLE: ${{ steps.browser_executable.outputs.executable }}
+        run: |
+          pnpm exec vitest run --config config/vitest.config.ts \
+            src/main/orcad/external-chromium-browser-process.integration.test.ts
+
       # These two tests import the cloud relay workspace directly. Keeping them in one job
       # avoids installing and building the same workspace once per unit-test shard.
       - name: Install relay integration dependencies
+        id: relay_dependencies
+        if: ${{ !cancelled() && steps.root_dependencies.outcome == 'success' }}
         working-directory: cloud
         run: |
           npx --yes pnpm@10.34.6 --filter '@orca-cloud/relay...' install --frozen-lockfile --ignore-scripts
           npx --yes pnpm@10.34.6 --filter '@orca-cloud/relay^...' build
 
       - name: Test relay integration contracts
+        if: ${{ !cancelled() && steps.relay_dependencies.outcome == 'success' }}
         env:
           ORCA_BACKGROUND_LAUNCH: '1'
         run: >-

config/knip.json

@@ -21,7 +21,7 @@
     "src/renderer/src/**/*.worker.ts",
     "src/cli/index.ts",
     "src/relay/relay.ts",
-    "src/relay/wsl-agent-hook-relay.ts",
+    "src/wsl-guest/wsl-agent-hook-relay.ts",
     "config/scripts/**/*.{mjs,cjs,js,ts}",
     "config/build-plugins/**/*.ts",
     "electron.vite.config.ts",

config/owner-routing-baseline.txt

@@ -0,0 +1,131 @@
+# Renderer call sites that route by the Active Server focus setting:
+# getActiveRuntimeTarget( + legacyRouteFromSettings( + settingsForRuntimeOwner(, per file.
+# This is a RATCHET: counts may only go DOWN. Route new work by the resource owner instead.
+# Prune after removing sites: pnpm check:owner-routing-ratchet --prune
+1 src/renderer/src/components/editor/EditorPanel.tsx
+1 src/renderer/src/components/editor/ExternalFileChangeBanner.tsx
+1 src/renderer/src/components/editor/ExternalFileChangeCompareDialog.tsx
+1 src/renderer/src/components/editor/combined-diff/load-sections/fetch-combined-diff-section.ts
+2 src/renderer/src/components/editor/editor-restored-tab-conflict-scan.ts
+1 src/renderer/src/components/editor/markdown-preview-link-actions.ts
+1 src/renderer/src/components/editor/rich-markdown-image-context.ts
+1 src/renderer/src/components/editor/rich-markdown-image-insert.ts
+1 src/renderer/src/components/editor/rich-markdown-paste-image.ts
+1 src/renderer/src/components/editor/use-markdown-preview-source-foundation.ts
+1 src/renderer/src/components/editor/useEditorPanelDiffContentLoader.ts
+1 src/renderer/src/components/editor/useEditorPanelFileContentLoader.ts
+2 src/renderer/src/components/editor/useMarkdownDocuments.ts
+1 src/renderer/src/components/github-item-dialog/land-pull-request/pr-actions-panel.tsx
+1 src/renderer/src/components/github-item-dialog/land-pull-request/pr-reviewers-panel.tsx
+2 src/renderer/src/components/github-item-dialog/land-pull-request/pr-reviewers-request-actions.ts
+1 src/renderer/src/components/github-project/ProjectCellIssueType.tsx
+4 src/renderer/src/components/github-project/project-picker-runtime.ts
+1 src/renderer/src/components/github-project/slug-dialog/Comments.tsx
+1 src/renderer/src/components/github-project/slug-dialog/SlugDialogBody.tsx
+1 src/renderer/src/components/github/github-rate-limit-display.tsx
+4 src/renderer/src/components/github/github-work-item-edit-mutations.ts
+1 src/renderer/src/components/gitlab/gitlab-rate-limit-display.tsx
+1 src/renderer/src/components/linear-api-key-dialog.tsx
+1 src/renderer/src/components/ports/WorkspacePortScanner.tsx
+1 src/renderer/src/components/pull-request-page/actions/panel.tsx
+1 src/renderer/src/components/pull-request-page/reviewers/panel.tsx
+2 src/renderer/src/components/pull-request-page/reviewers/request-actions.ts
+1 src/renderer/src/components/quick-open-file-navigation.ts
+1 src/renderer/src/components/settings/GeneralPane.tsx
+1 src/renderer/src/components/settings/RepositoryGitHubAccountSection.tsx
+1 src/renderer/src/components/settings/RepositoryIconPicker.tsx
+1 src/renderer/src/components/setup-guide/setup-guide-progress-readiness.ts
+1 src/renderer/src/components/sidebar/add-repo-runtime-owner.ts
+1 src/renderer/src/components/status-bar/ClaudeSwitcherMenu.tsx
+1 src/renderer/src/components/status-bar/use-codex-switcher-controller.ts
+1 src/renderer/src/components/tab-bar/use-tab-bar-runtime-model-worktree-write-probe.ts
+1 src/renderer/src/components/tab-bar/use-tab-bar-runtime-model.ts
+2 src/renderer/src/components/task-page-github-reviewer-actions.ts
+1 src/renderer/src/components/task-page/github/AssigneesCell.tsx
+2 src/renderer/src/components/task-page/github/MergeCell.tsx
+1 src/renderer/src/components/task-page/github/StatusCell.tsx
+1 src/renderer/src/components/terminal-pane/terminal-file-path-mapping.ts
+1 src/renderer/src/components/terminal-pane/terminal-path-existence-batch.ts
+1 src/renderer/src/components/terminal-pane/terminal-worktree-path-link.ts
+1 src/renderer/src/components/use-task-page-github-issue-draft.ts
+1 src/renderer/src/hooks/composer-state/gitlab-provider-selection.ts
+1 src/renderer/src/hooks/composer-state/provider-runtime-sync.ts
+1 src/renderer/src/hooks/composer-state/quick-creation-execution.ts
+1 src/renderer/src/hooks/use-active-skill-discovery-runtime-target.ts
+2 src/renderer/src/hooks/useGitHubSlugMetadata.ts
+1 src/renderer/src/hooks/useIssueMetadata.ts
+1 src/renderer/src/hooks/useSettingsNavigationMetadata.ts
+3 src/renderer/src/lib/activate-ai-vault-structured-session.ts
+1 src/renderer/src/lib/active-agent-note-send.ts
+1 src/renderer/src/lib/active-agent-note-target.ts
+1 src/renderer/src/lib/automation-session-observer.ts
+1 src/renderer/src/lib/codex-pane-selection-lane.ts
+1 src/renderer/src/lib/github-pr-start-point.ts
+1 src/renderer/src/lib/github-source-runtime-context.ts
+1 src/renderer/src/lib/hosted-review-repo-read.ts
+1 src/renderer/src/lib/launch-agent-background-session.ts
+1 src/renderer/src/lib/launch-worktree-background-terminals.ts
+1 src/renderer/src/lib/local-file-access.ts
+1 src/renderer/src/lib/repo-slug-cache.ts
+1 src/renderer/src/lib/repo-slug-index.ts
+1 src/renderer/src/lib/structured-agent-session-tab-activation.ts
+1 src/renderer/src/lib/workspace-file-host-routing.ts
+1 src/renderer/src/lib/worktree-creation-flow-startup.ts
+1 src/renderer/src/runtime/mobile-markdown-bridge.ts
+1 src/renderer/src/runtime/runtime-file-import-client.ts
+1 src/renderer/src/runtime/runtime-file-metadata-client.ts
+1 src/renderer/src/runtime/runtime-file-mutation-client.ts
+1 src/renderer/src/runtime/runtime-file-range-client.ts
+2 src/renderer/src/runtime/runtime-file-read-client.ts
+4 src/renderer/src/runtime/runtime-file-routing.ts
+4 src/renderer/src/runtime/runtime-file-search-client.ts
+1 src/renderer/src/runtime/runtime-file-watch-client.ts
+1 src/renderer/src/runtime/runtime-git-client-context.ts
+5 src/renderer/src/runtime/runtime-git-diff-client.ts
+5 src/renderer/src/runtime/runtime-git-generation-client.ts
+6 src/renderer/src/runtime/runtime-git-status-client.ts
+10 src/renderer/src/runtime/runtime-git-sync-client.ts
+9 src/renderer/src/runtime/runtime-git-working-tree-client.ts
+3 src/renderer/src/runtime/runtime-hooks-client.ts
+1 src/renderer/src/runtime/runtime-jira-target.ts
+1 src/renderer/src/runtime/runtime-linear-client.ts
+3 src/renderer/src/runtime/runtime-repo-client.ts
+3 src/renderer/src/runtime/runtime-terminal-inspection.ts
+1 src/renderer/src/runtime/runtime-terminal-stream.ts
+1 src/renderer/src/runtime/runtime-terminal-verified-input.ts
+1 src/renderer/src/store/folder-workspaces/folder-path-status-actions.ts
+2 src/renderer/src/store/folder-workspaces/folder-workspace-catalog-actions.ts
+3 src/renderer/src/store/folder-workspaces/folder-workspace-mutations.ts
+1 src/renderer/src/store/folder-workspaces/folder-workspace-routing.ts
+1 src/renderer/src/store/github/cache-identity.ts
+1 src/renderer/src/store/github/project-actions.ts
+1 src/renderer/src/store/github/project-field-mutations.ts
+2 src/renderer/src/store/github/project-row-actions.ts
+1 src/renderer/src/store/github/repository-routing.ts
+1 src/renderer/src/store/github/work-item-mutation-actions.ts
+6 src/renderer/src/store/project-groups/nested-repository-operations.ts
+2 src/renderer/src/store/project-groups/project-group-catalog-actions.ts
+4 src/renderer/src/store/project-groups/project-group-mutations.ts
+1 src/renderer/src/store/projects/project-host-routing.ts
+1 src/renderer/src/store/repos/all-host-repo-catalog-actions.ts
+2 src/renderer/src/store/repos/repo-add-actions.ts
+2 src/renderer/src/store/repos/repo-catalog-actions.ts
+1 src/renderer/src/store/repos/repo-removal.ts
+1 src/renderer/src/store/repos/repo-update.ts
+1 src/renderer/src/store/repos/runtime-repo-catalog-actions.ts
+1 src/renderer/src/store/slices/diff-comment-persistence.ts
+1 src/renderer/src/store/slices/editor/actions/markdown-link-action.ts
+4 src/renderer/src/store/slices/hosted-review.ts
+1 src/renderer/src/store/slices/preflight.ts
+1 src/renderer/src/store/slices/worktree-visibility-owner-settings.ts
+3 src/renderer/src/store/slices/worktree-visibility-settings-write.ts
+1 src/renderer/src/store/slices/worktrees/create/create-worktree.ts
+1 src/renderer/src/store/slices/worktrees/create/prefetch-worktree-create-base.ts
+2 src/renderer/src/store/slices/worktrees/listing/detected-worktree-provider-request.ts
+1 src/renderer/src/store/slices/worktrees/listing/detected-worktree-refresh.ts
+2 src/renderer/src/store/slices/worktrees/metadata/hosted-review-push-target.ts
+3 src/renderer/src/store/slices/worktrees/metadata/worktree-lineage-refresh.ts
+1 src/renderer/src/store/slices/worktrees/metadata/worktree-meta-persist.ts
+1 src/renderer/src/store/slices/worktrees/teardown/force-delete-preserved-branch.ts
+1 src/renderer/src/store/slices/worktrees/teardown/missing-worktree-terminal-teardown.ts
+1 src/renderer/src/store/slices/worktrees/teardown/remove-worktree.ts

config/process-host-direct-import-baseline.txt

@@ -130,7 +130,6 @@ src/relay/ai-vault-service-spawn.ts
 src/relay/external-automations-handler.ts
 src/relay/fs-handler-git-fallback.ts
 src/relay/fs-handler-list-files.ts
-src/relay/preflight-handler.ts
 src/relay/pty-shell-utils.ts
 src/relay/subprocess-tree-termination.ts
 src/relay/workspace-space-scan.ts
@@ -140,3 +139,4 @@ src/shared/fish-binary-requirement.ts
 src/shared/process-table-snapshot-reader.ts
 src/shared/pty-slave-line-discipline-echo.ts
 src/shared/shell-process-readiness.ts
+src/wsl-guest/preflight-handler.ts