Explorer: group finished subagents, show running counts

.github/actions/linux-ci/action.yml

@@ -0,0 +1,80 @@
+name: Linux Rust CI setup
+description: >-
+  Rust toolchain, cargo-nextest, optional apt packages (with a cached .deb
+  directory) and the main-seeded Rust cache for Linux test jobs. Run
+  actions/checkout first.
+
+inputs:
+  rust-cache:
+    description: >-
+      rust-cache shared key. Jobs with the same key share one cache, so they
+      must have the same dependency graph.
+    required: true
+  save-rust-cache:
+    description: >-
+      Whether this job may save the cache when it runs on main. Give it to
+      exactly one job per key. Pull requests never save.
+    default: 'false'
+  apt-packages:
+    description: apt packages to install (space separated). Nothing is installed when empty.
+    default: ''
+  apt-cache:
+    description: Name of the cached .deb directory for apt-packages (one per package list).
+    default: ''
+  apt-recommends:
+    description: Install recommended packages too ('true' or 'false').
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    - name: Rust toolchain
+      shell: bash
+      run: rustup show active-toolchain || rustup toolchain install
+
+    # apt mirrors on hosted runners occasionally stall for minutes; apt-install.sh
+    # bounds and retries the download and uses a directory of .debs that main
+    # saves to the cache (pull requests only restore it).
+    - name: Restore apt packages
+      id: apt-cache
+      if: inputs.apt-packages != ''
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ~/apt-debs/*.deb
+        key: apt-debs-v1-${{ inputs.apt-cache }}-${{ hashFiles('scripts/ci/apt-install.sh') }}
+    - name: Install system packages
+      if: inputs.apt-packages != ''
+      shell: bash
+      env:
+        APT_RECOMMENDS: ${{ inputs.apt-recommends == 'true' && '1' || '0' }}
+        APT_PACKAGES: ${{ inputs.apt-packages }}
+      run: |
+        # shellcheck disable=SC2086 # the package list is word-split on purpose
+        bash scripts/ci/apt-install.sh $APT_PACKAGES
+    - name: Save apt packages
+      if: inputs.apt-packages != '' && github.ref == 'refs/heads/main' && steps.apt-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ~/apt-debs/*.deb
+        key: apt-debs-v1-${{ inputs.apt-cache }}-${{ hashFiles('scripts/ci/apt-install.sh') }}
+
+    # Exported for the rest of the job. Tests and the browser fixture are built in
+    # the dev profile without debug info (smaller, faster to link). CARGO_* variables
+    # are part of the rust-cache key, so every job sharing a cache must set the same.
+    - name: Build settings
+      shell: bash
+      run: echo "CARGO_PROFILE_DEV_DEBUG=0" >> "$GITHUB_ENV"
+
+    - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        prefix-key: ci-linux-v1
+        shared-key: ${{ inputs.rust-cache }}
+        add-job-id-key: false
+        save-if: ${{ inputs.save-rust-cache == 'true' && github.ref == 'refs/heads/main' }}
+        cache-on-failure: true
+
+    # After the cache restore, so the checksum-verified binary is the one that
+    # runs (rust-cache restores ~/.cargo/bin).
+    - name: Install cargo-nextest
+      shell: bash
+      run: bash scripts/ci/install-nextest.sh

.github/actions/windows-ci-setup/action.yml

@@ -0,0 +1,54 @@
+name: Windows CI setup
+description: >-
+  Prepare a Windows runner for the Windows test jobs: toolchain, shader
+  compiler, a cheaper release profile for the CI builds, and the Rust cache.
+
+runs:
+  using: composite
+  steps:
+    - name: Disable Defender real-time scanning
+      shell: pwsh
+      # Hosted runners are ephemeral and only build this repository; scanning
+      # every file rustc writes slows builds down. Best effort: warn and carry
+      # on if the runner image does not allow it.
+      run: |
+        try { Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction Stop }
+        catch { Write-Warning "Could not disable Defender real-time scanning: $_" }
+    - name: Rust toolchain
+      shell: pwsh
+      run: rustup show active-toolchain || rustup toolchain install
+    - name: Locate Windows SDK shader compiler
+      shell: pwsh
+      run: |
+        $fxc = Get-ChildItem "${env:ProgramFiles(x86)}/Windows Kits/10/bin/*/x64/fxc.exe" |
+          Sort-Object FullName -Descending | Select-Object -First 1
+        if (-not $fxc) { throw 'Windows SDK fxc.exe is required for GPUI release shaders' }
+        "GPUI_FXC_PATH=$($fxc.FullName)" >> $env:GITHUB_ENV
+    - name: Cheaper release profile for CI builds
+      shell: pwsh
+      # CI only: the binaries built and tested here are NOT the shipped ones
+      # (release.yml still builds those with the committed profile). Thin LTO is
+      # off and the workspace's own crates are built at opt-level 0; third-party
+      # dependencies (gpui, tokio, ...) keep the release opt-level. Written to
+      # $CARGO_HOME/config.toml so Cargo.toml is untouched and every cargo
+      # invocation in the job, including the ones inside
+      # scripts/package-windows.ps1, picks it up.
+      run: |
+        $members = (cargo metadata --no-deps --format-version 1 | ConvertFrom-Json).packages.name
+        $config = @('[profile.release]', 'lto = false')
+        foreach ($name in $members) {
+          $config += "[profile.release.package.`"$name`"]"
+          $config += 'opt-level = 0'
+        }
+        $cargoHome = if ($env:CARGO_HOME) { $env:CARGO_HOME } else { Join-Path $env:USERPROFILE '.cargo' }
+        Add-Content -LiteralPath (Join-Path $cargoHome 'config.toml') -Value $config
+        Write-Host "opt-level 0 for $($members.Count) workspace crates: $($members -join ', ')"
+    - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        # Only main writes the cache; PRs restore it.
+        save-if: ${{ github.ref == 'refs/heads/main' }}
+        cache-on-failure: true
+        # Workspace crates are rebuilt on every change anyway and are cheap at
+        # opt-level 0, so keep them out of the cache. Each job gets its own
+        # cache (rust-cache keys on the job id by default).
+        cache-workspace-crates: false

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  # Workflow actions are pinned to commit SHAs (with the version in a comment);
+  # this keeps the pins current. One grouped PR per week.
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/*
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ['*']

.github/workflows/cursor-compatibility.yml

@@ -9,6 +9,16 @@ on:
       - 'Cargo.lock'
       - 'scripts/*cursor-sdk*'
       - '.github/workflows/cursor-*.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'crates/harness/**'
+      - 'crates/doc/**'
+      - 'crates/engine/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'scripts/*cursor-sdk*'
+      - '.github/workflows/cursor-*.yml'
   workflow_dispatch:
   workflow_call:
 permissions:
@@ -18,11 +28,10 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
-      - uses: Swatinem/rust-cache@v2
       - name: Dependency updater validation
         run: python3 scripts/test-update-cursor-sdk.py
       - name: Install the exact SDK selected by this engine
@@ -31,14 +40,21 @@ jobs:
           npm install --prefix "$RUNNER_TEMP/cursor-sdk-contract" --ignore-scripts --no-audit --no-fund "$pin"
       - name: Actual SDK token expiry, stream invalidation, and transient auth recovery
         run: node scripts/test-cursor-sdk-auth.mjs "$RUNNER_TEMP/cursor-sdk-contract/node_modules/@cursor/sdk"
-      - name: Harness compatibility, steering, and session recovery
-        run: cargo test --locked -p zeron-harness
-      - name: Durable commands and engine message delivery
-        run: |
-          cargo test --locked -p zeron-doc
-          cargo test --locked -p zeron-engine --test message_queue
-          cargo test --locked -p zeron-engine --lib sessions::tests
-      - name: Native Pi RPC driver
-        run: |
-          cargo test --locked -p zeron-harness --features native-fixture --test pi_rpc
-          cargo test --locked -p zeron-engine --test pi_resume
+
+  # The Rust half (harness compatibility, steering, session recovery, durable
+  # commands, message delivery, native Pi RPC) is part of the `core-tests` job
+  # of ui-tests.yml, which already runs on pull requests and on main with a
+  # superset of this workflow's paths. Run it here only for the callers that
+  # do not get that: release.yml (tag push), cursor-sdk-update.yml (manual
+  # dispatch on the update branch) and manual runs.
+  rust-tests:
+    if: ${{ github.event_name != 'pull_request' && !(github.event_name == 'push' && github.ref == 'refs/heads/main') }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: ./.github/actions/linux-ci
+        with:
+          rust-cache: core # saved by core-tests in ui-tests.yml
+      - name: Harness, engine, sync, update, doc and preview tests
+        run: scripts/ci/test-core.sh

.github/workflows/cursor-sdk-update.yml

@@ -15,8 +15,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
       - name: Check stable SDK version

.github/workflows/deploy.yml

@@ -25,7 +25,7 @@ jobs:
       # the token through job env and gate on that instead.
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           # `github.event.before` may precede several commits in a batched push.
           fetch-depth: 0
@@ -43,7 +43,7 @@ jobs:
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
           fi
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         if: steps.changed.outputs.changed == 'true'
         with:
           node-version: 22
@@ -72,7 +72,7 @@ jobs:
     env:
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
       - name: detect landing changes
@@ -89,7 +89,7 @@ jobs:
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
           fi
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         if: steps.changed.outputs.changed == 'true'
         with:
           node-version: 22
@@ -108,7 +108,7 @@ jobs:
     env:
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
       - name: detect www-redirect changes
@@ -125,7 +125,7 @@ jobs:
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
           fi
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         if: steps.changed.outputs.changed == 'true'
         with:
           node-version: 22

.github/workflows/linux-installer.yml

@@ -6,6 +6,7 @@ on:
       - 'edge/src/install.sh'
       - 'scripts/package-linux.sh'
       - 'scripts/test-linux-desktop-entry.sh'
+      - 'scripts/ci/apt-install.sh'
       - 'dist/zeron.desktop'
       - 'dist/zeron.png'
       - '.github/workflows/linux-installer.yml'
@@ -15,6 +16,7 @@ on:
       - 'edge/src/install.sh'
       - 'scripts/package-linux.sh'
       - 'scripts/test-linux-desktop-entry.sh'
+      - 'scripts/ci/apt-install.sh'
       - 'dist/zeron.desktop'
       - 'dist/zeron.png'
       - '.github/workflows/linux-installer.yml'
@@ -25,18 +27,18 @@ permissions:
 
 concurrency:
   group: linux-installer-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   desktop-entry:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Desktop entry validator
-        run: |
-          sudo apt-get update -qq -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" -o Dir::Etc::sourceparts="-"
-          sudo apt-get install -y -qq desktop-file-utils
+        # Skips apt when the runner image already has it; otherwise the install
+        # retries and is bounded instead of hanging on a stalled mirror.
+        run: command -v desktop-file-validate || bash scripts/ci/apt-install.sh desktop-file-utils
       # Both installers, offline, under a throwaway HOME (no network, no systemd).
       - name: Installers write a valid launcher entry
         run: scripts/test-linux-desktop-entry.sh