sync: upstream main 2026-10-11c (56 commits → v1.4.224-0)

.github/workflows/adhoc-mac-build.yml

@@ -128,18 +128,6 @@ jobs:
           echo "Resolved $REQUESTED_REF -> $sha"
           echo "sha=$sha" >>"$GITHUB_OUTPUT"
 
-  # Why its own job: this package ships relays for Windows SSH hosts, and only a
-  # Windows runner compiles the addon that launches one outside sshd's job.
-  # Why the unvetted ref is safe here: this job holds no secrets, and the mac job
-  # vets the same ref before it downloads anything, so fork code never gets signed.
-  relay-windows-process-tree:
-    needs: resolve-ref
-    permissions:
-      contents: read
-    uses: ./.github/workflows/relay-windows-process-tree.yml
-    with:
-      ref: ${{ needs.resolve-ref.outputs.sha }}
-
   # Why: a branch cut before the orcad template landed has none to build or ship.
   orcad-template-support:
     needs: resolve-ref
@@ -156,8 +144,17 @@ jobs:
           ref: ${{ needs.resolve-ref.outputs.sha }}
           sparse-checkout: |
             /config/scripts/packaged-orcad-template.cjs
+            /config/tsconfig.relay.json
           sparse-checkout-cone-mode: false
           persist-credentials: false
+      # Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
+      - name: Refuse a ref that still ships the SSH relay
+        shell: bash
+        run: |
+          if [[ -e config/tsconfig.relay.json ]]; then
+            echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
+            exit 1
+          fi
       - name: Detect whether the ref ships the orcad template
         id: detect
         shell: bash
@@ -171,8 +168,8 @@ jobs:
 
   # Design D2, as release-cut does: every desktop build ships the orcad template (server JS plus
   # every target's addons), merged from the node-server lanes that qualify each slot at this ref.
-  # Without it an adhoc build cannot deploy managed orcad to an SSH host. No secrets, like the
-  # relay job, and the mac job vets the ref before anything is signed.
+  # Without it an adhoc build cannot deploy managed orcad to an SSH host. No secrets, and the mac
+  # job vets the ref before anything is signed.
   orcad-template:
     needs: [resolve-ref, orcad-template-support]
     if: needs.orcad-template-support.outputs.ships == 'true'
@@ -184,11 +181,10 @@ jobs:
       build_template: true
 
   build-adhoc-mac:
-    needs: [resolve-ref, relay-windows-process-tree, orcad-template-support, orcad-template]
+    needs: [resolve-ref, orcad-template-support, orcad-template]
     # Why not the implicit success(): a ref without the orcad template skips that job on purpose.
     if: >-
       !cancelled() && github.repository == 'stablyai/orca' &&
-      needs.relay-windows-process-tree.result == 'success' &&
       needs.orcad-template-support.result == 'success' &&
       (needs.orcad-template.result == 'success' ||
         (needs.orcad-template.result == 'skipped' &&
@@ -371,14 +367,6 @@ jobs:
           fi
           cat "$RUNNER_TEMP/adhoc-identity.txt" >>"$GITHUB_OUTPUT"
 
-      # Only a Windows runner compiles these; the relay-windows-process-tree job
-      # built them for this run.
-      - name: Collect the Windows process-table addons for the relay
-        uses: actions/download-artifact@v8
-        with:
-          name: relay-windows-process-tree
-          path: .build/windows-process-tree
-
       - name: Build app
         run: pnpm build:release
         env:
@@ -387,9 +375,6 @@ jobs:
           # gate accepts only 'stable' or 'rc', so leaving this unset keeps them
           # silent, which is correct for unvetted branch artifacts.
           ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
-          # Fail the build rather than ship a relay that cannot launch outside
-          # sshd's job for a standard user on a Windows SSH host.
-          ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
 
       # After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
       - name: Download the orcad deployment template

.github/workflows/cloud-deploy-relay-production-director.yml

@@ -51,6 +51,10 @@ on:
         description: Exact immutable serving predecessor digest for the one-time identity bootstrap
         required: true
         type: string
+      shape-baseline-revision:
+        description: Only after a Terraform apply changed the director template. The apply's 0% revision, whose shape the deploy adopts
+        required: false
+        type: string
 
 permissions:
   contents: read
@@ -93,6 +97,7 @@ jobs:
       EXPECTED_REHOME_GENERATION: ${{ inputs.expected-rehome-generation }}
       BOOTSTRAP_RUNTIME_IDENTITY: ${{ inputs.bootstrap-runtime-identity }}
       PREDECESSOR_IMAGE_DIGEST: ${{ inputs.predecessor-image-digest }}
+      SHAPE_BASELINE_REVISION: ${{ inputs.shape-baseline-revision }}
     steps:
       - uses: actions/checkout@v4
 
@@ -140,7 +145,13 @@ jobs:
             [[ "${PREDECESSOR_IMAGE_DIGEST}" =~ ^sha256:[a-f0-9]{64}$ ]]
             test "${PRUNE_INCOMPATIBLE_REVISIONS}" = false
             test "${REGIONAL_PLACEMENT_MODE}" = preserve
+            test -z "${SHAPE_BASELINE_REVISION}"
             test "${CONFIRMATION}" = BOOTSTRAP_RELAY_DIRECTOR_REHOME_IDENTITY
+          elif test -n "${SHAPE_BASELINE_REVISION}"; then
+            [[ "${SHAPE_BASELINE_REVISION}" =~ ^orca-cloud-relay-[0-9]{5}-[a-z0-9]{3}$ ]]
+            test "${PRUNE_INCOMPATIBLE_REVISIONS}" = false
+            test "${REGIONAL_PLACEMENT_MODE}" = preserve
+            test "${CONFIRMATION}" = ADOPT_RELAY_DIRECTOR_TERRAFORM_SHAPE
           elif test "${PRUNE_INCOMPATIBLE_REVISIONS}" = true; then
             test "${REGIONAL_PLACEMENT_MODE}" = preserve
             test "${CONFIRMATION}" = PRUNE_INCOMPATIBLE_RELAY_DIRECTOR_REVISIONS
@@ -222,12 +233,17 @@ jobs:
           fi
           [[ "${target_version}" =~ ^[1-9][0-9]*$ ]]
           RELEASE_ID="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${GITHUB_SHA:0:8}"
+          shape_args=()
+          if test -n "${SHAPE_BASELINE_REVISION}"; then
+            shape_args=(--shape-baseline-revision "${SHAPE_BASELINE_REVISION}")
+          fi
           node dev/scripts/deploy-relay-blue-green.mjs \
             --project "${GCP_PROJECT_ID}" \
             --region "${GCP_REGION}" \
             --service "${DIRECTOR_SERVICE_NAME}" \
             --image "${IMAGE}" \
             --role director \
+            "${shape_args[@]}" \
             --runtime-service-account "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}" \
             --predecessor-runtime-service-account "${PREDECESSOR_RUNTIME_SERVICE_ACCOUNT}" \
             --bootstrap-runtime-identity "${BOOTSTRAP_RUNTIME_IDENTITY}" \

.github/workflows/cloud-deploy-relay-staging.yml

@@ -39,7 +39,11 @@ on:
         type: choice
         options: [preserve, '0', '2']
       confirmation:
-        description: BOOTSTRAP_RELAY_DIRECTOR_REHOME_IDENTITY for a bootstrap
+        description: BOOTSTRAP_RELAY_DIRECTOR_REHOME_IDENTITY for a bootstrap, ADOPT_RELAY_DIRECTOR_TERRAFORM_SHAPE with a shape baseline
+        required: false
+        type: string
+      shape-baseline-revision:
+        description: Only after a Terraform apply changed the director template. The apply's 0% revision, whose shape the deploy adopts
         required: false
         type: string
       shadow-seat-feed-cells:
@@ -86,6 +90,7 @@ jobs:
       PREDECESSOR_IMAGE_DIGEST: ${{ inputs.predecessor-image-digest }}
       CAPACITY_CELL_ID: ${{ inputs.capacity-cell-id }}
       MIN_INSTANCES: ${{ inputs.min-instances }}
+      SHAPE_BASELINE_REVISION: ${{ inputs.shape-baseline-revision }}
     steps:
       - uses: actions/checkout@v4
 
@@ -106,6 +111,12 @@ jobs:
           else
             test -z "${PREDECESSOR_IMAGE_DIGEST}"
           fi
+          if test -n "${SHAPE_BASELINE_REVISION}"; then
+            [[ "${SHAPE_BASELINE_REVISION}" =~ ^orca-cloud-relay-staging-[0-9]{5}-[a-z0-9]{3}$ ]]
+            test "${BOOTSTRAP_RUNTIME_IDENTITY}" = false
+            test "${CAPACITY_CELL_ID}" = none
+            test "${CONFIRMATION}" = ADOPT_RELAY_DIRECTOR_TERRAFORM_SHAPE
+          fi
 
       - uses: hashicorp/setup-terraform@v3
         with:
@@ -186,6 +197,10 @@ jobs:
           if test "${MIN_INSTANCES}" != preserve; then
             floor_args=(--min-instances "${MIN_INSTANCES}")
           fi
+          shape_args=()
+          if test -n "${SHAPE_BASELINE_REVISION}"; then
+            shape_args=(--shape-baseline-revision "${SHAPE_BASELINE_REVISION}")
+          fi
           topology_args=()
           if test "${CAPACITY_CELL_ID}" != none; then
             topology_args=(
@@ -207,6 +222,7 @@ jobs:
             "${floor_args[@]}" \
             --runtime-service-account "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}" \
             "${identity_args[@]}" \
+            "${shape_args[@]}" \
             --rehome-director-service-account "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}" \
             --rehome-audience "${REHOME_AUDIENCE}" \
             --rehome-control-origin https://relay-staging.onorca.dev \

.github/workflows/cloud-prove-relay-asia-staging.yml

@@ -26,17 +26,27 @@ on:
         required: false
         type: string
       load-region:
-        description: Load only. asia-east2 runs on the Asia load runner; us-central1 on a hosted runner
+        description: >-
+          Load only. asia-east2 runs on the Asia load runner; asia-east2-hosted asks for asia-east2
+          from a hosted runner; us-central1 runs on a hosted runner
         required: false
         default: asia-east2
         type: choice
-        options: [asia-east2, us-central1]
+        options: [asia-east2, asia-east2-hosted, us-central1]
       load-shards:
         description: Load only. Generator processes, each with its own shard of the 32 load principals
         required: false
         default: '4'
         type: choice
         options: ['1', '2', '3', '4']
+      load-runners:
+        description: >-
+          Load only, hosted runners only. Runner machines, each with load-shards generators; one
+          hosted runner holds about 2,000 connections to one cell
+        required: false
+        default: '1'
+        type: choice
+        options: ['1', '2']
       load-args:
         description: >-
           Load only. Per-shard generator arguments, e.g. --controls 150 --splices 15
@@ -364,14 +374,21 @@ jobs:
   # free-form staging load lives here rather than in a workflow of its own.
   load:
     if: ${{ vars.ORCA_CLOUD_OPERATIONS_ENABLED == 'true' && (github.ref == 'refs/heads/main') && inputs.mode == 'load' }}
-    runs-on: ${{ inputs.load-region == 'us-central1' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","x64","relay-asia-east2-load"]') }}
+    runs-on: ${{ inputs.load-region == 'asia-east2' && fromJSON('["self-hosted","linux","x64","relay-asia-east2-load"]') || 'ubuntu-latest' }}
+    strategy:
+      # One runner's failure must not drop the other half of the load mid-run.
+      fail-fast: false
+      matrix:
+        runner: ${{ fromJSON(inputs.load-runners == '2' && '[0, 1]' || '[0]') }}
     timeout-minutes: 180
     environment: staging
     env:
       DIRECTOR_ORIGIN: https://relay-staging.onorca.dev
       AUTH_ORIGIN: https://auth-staging.onorca.dev
       LOAD_REGION: ${{ inputs.load-region }}
       LOAD_SHARDS: ${{ inputs.load-shards }}
+      LOAD_RUNNERS: ${{ inputs.load-runners }}
+      LOAD_RUNNER_INDEX: ${{ matrix.runner }}
       LOAD_ARGS: ${{ inputs.load-args }}
     steps:
       - uses: actions/checkout@v4
@@ -383,8 +400,14 @@ jobs:
         run: |
           set -euo pipefail
           test "${CONFIRMATION}" = LOAD_RELAY_STAGING
-          [[ "${LOAD_REGION}" =~ ^(asia-east2|us-central1)$ ]]
+          [[ "${LOAD_REGION}" =~ ^(asia-east2|asia-east2-hosted|us-central1)$ ]]
           [[ "${LOAD_SHARDS}" =~ ^[1-4]$ ]]
+          [[ "${LOAD_RUNNERS}" =~ ^[12]$ ]]
+          # The Asia runner is one machine; a second matrix job would only queue behind the first.
+          if test "${LOAD_RUNNERS}" != 1 && test "${LOAD_REGION}" = asia-east2; then
+            echo "load-runners 2 needs a hosted runner" >&2
+            exit 1
+          fi
           read -r -a args <<< "${LOAD_ARGS}"
           for arg in "${args[@]}"; do
             [[ "${arg}" =~ ^[A-Za-z0-9=:/._,-]+$ ]] || { echo "unsupported characters in load-args" >&2; exit 1; }
@@ -445,10 +468,10 @@ jobs:
             node dev/scripts/load-relay-controls.mjs \
               --director-origin "${DIRECTOR_ORIGIN}" \
               --auth-origin "${AUTH_ORIGIN}" \
-              --preferred-region "${LOAD_REGION}" \
+              --preferred-region "${LOAD_REGION%-hosted}" \
               --relay-asia-load-principals 32 \
-              --shard-count "${LOAD_SHARDS}" \
-              --shard-index "${shard}" \
+              --shard-count "$((LOAD_SHARDS * LOAD_RUNNERS))" \
+              --shard-index "$((LOAD_RUNNER_INDEX * LOAD_SHARDS + shard))" \
               "${args[@]}" \
               > "${load_dir}/shard-${shard}.jsonl" &
             pids+=("$!")
@@ -468,7 +491,7 @@ jobs:
         if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
-          name: relay-staging-load-${{ github.run_id }}-${{ github.run_attempt }}
+          name: relay-staging-load-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.runner }}
           path: ${{ runner.temp }}/relay-staging-load/
           if-no-files-found: warn
           retention-days: 7

.github/workflows/computer-e2e.yml

@@ -43,8 +43,6 @@ on:
       - 'src/main/runtime/rpc/dispatcher.ts'
       - 'src/main/runtime/rpc/errors.ts'
       - 'src/main/runtime/rpc/methods/computer*.ts'
-      - 'src/main/ssh/ssh-remote-cli-launcher.ts'
-      - 'src/main/ssh/ssh-remote-cli-launcher.test.ts'
       - 'src/shared/computer-use-*.ts'
       - 'tests/e2e/computer-linux.e2e.ts'
       - 'tests/e2e/computer-windows.e2e.ts'
@@ -85,7 +83,6 @@ jobs:
       # on hosted Windows. Use the shared config so this job matches pnpm test.
       - run: >-
           pnpm vitest run --config config/vitest.config.ts
-          src/main/ssh/ssh-remote-cli-launcher.test.ts
           config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs
           config/scripts/macos-computer-helper-owner-loss-processes.test.mjs
           config/scripts/computer-use-smoke.test.mjs