Consolidate desktop and WSL terminals on the bundled Bun service

[OrcaWin]

	Files	Added	Deleted	Net
Test	355	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​14932	$\color{#cf222e}{\Huge{\mathbf{−}}}$​14702	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​230
Prod	403	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​12279	$\color{#cf222e}{\Huge{\mathbf{−}}}$​11423	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​856

ELI5

Desktop and WSL terminals use the bundled Bun terminal service, so shells can survive app restarts without retaining an Electron runtime. This removes the desktop node-pty backend and its native rebuild/install path.

What Changed

• Route terminal creation, inspection, output, history and reconnect through the persistent daemon. Adopt live owners before starting replacements.
• Run new WSL terminals in their captured Linux distro and user. Preserve existing Windows-owned WSL sessions, authenticated guest ownership, and persisted recovery records.
• Bound output batching and account for consumed source bytes. Package the independently verified Windows ConPTY files.
• Batch plain ASCII within one headless terminal row, preserving wrapping, Unicode, insert-mode, accessibility and hyperlink behavior. Keep the vendor patch derived from pinned source with CJS/ESM regression checks.
• Remove the obsolete local PTY implementation and move its behavior tests to the service boundary.

Why

One terminal service reduces separate lifecycle implementations across desktop, headless and WSL. Retaining a node-pty fallback would keep a second process-ownership model and native build chain. Existing live sessions retain compatibility while new sessions use the shared service.

Linked Issue

Stacked on #23355, following the four bundled-runtime foundation PRs. Earlier exploration in #16741 informed this work.

Visual Proof

Pending rendered terminal, WSL and mobile acceptance. Headless receipts do not establish rendered parity. Draft; not ready to merge.

Testing

• At production checkpoint 02e7f7ba71, Linux x64/ARM64 packages pass including Ubuntu 20.04/glibc 2.31 smoke, and signed macOS x64/ARM64 packages pass signing, notarization, Gatekeeper and public folder/Git terminal round trips: run 36448906343. Both Mac artifact downloads passed SHA256 and CRC. No release was published. These receipts predate the ASCII optimization.
• All eight Linux shards, typechecks and static checks pass at test-only checkpoint c7cf94bae5: run 36449826878. Windows still fails the known wide-character repaint assertion with stock Bun. Nine diagnostic captures pass with patched Bun and the complete ConPTY/OpenConsole pair; durable signed distribution is still required. No diagnostic runtime pin was promoted.
• Final04d Windows ARM64 owned-companions job109044612284 also executes the generated CLI, native C# launcher/compiler, relay terminal reconnect, and git/folder headless terminal smoke successfully. This closes that native CLI boundary, not actual SSH transport or installed Electron lifecycle. Final-source real Windows→WSL recovery/output is being refreshed separately; older receipts predate relevant source repairs.
• Current c8c74d1d94 adds a source-derived headless ASCII row fast path, with exact source-to-generated CJS/ESM map checks. Author, Codex and Opus each pass 40 generator/provider tests plus 34 installed-package contracts. Mutation tests reject missing mode/provider guards and altered source-map contents. Earlier differential runs matched 11,636 states under both Bun and Electron.
• The current frozen macOS adapter comparison completed 120 exact 4 MiB transfers in ten alternating process pairs, with no owned daemon leaks. Baseline/candidate medians: ASCII 75.53/55.50 ms, ANSI/Unicode 119.84/98.40 ms. Paired median ratios and 95% bootstrap intervals: ASCII 0.741 [0.717, 0.775], ANSI 0.820 [0.806, 0.840]. Transfer p95 improved from 78.49 to 65.30 ms for ASCII and 157.09 to 138.95 ms for ANSI.
• Backend echo p95 remains slightly higher: ASCII 0.312/0.571 ms and ANSI 0.793/1.099 ms. Candidate maximum echo was 3.90 ms. This passes the proposed adapter gate, not rendered latency or whole-app CPU/memory qualification.
• The separate Electron parser control completed 72 transfers with matching snapshots and clean process exits. ASCII paired medians improve 26–33% depending on order; ANSI improves about 7%. This is parser performance, not rendered UI performance.
• Current-source resource endpoints completed 3,000 exact transfers and 500 matching snapshots, with all captured processes gone. At 200 cycles, daemon RSS is 161.1 MiB native / 171.6 MiB Bun; client-plus-daemon physical footprint is 197.9 / 196.2 MiB. Summed retained-process RSS is 369.45 / 429.78 MiB (+16.3%); shared-page counting and harness allocations limit its interpretation, but this cost remains reported. Bun allocator occupancy stays nearly flat from 50 to 200 cycles (33.41→34.02 MiB). Idle daemon footprint is higher (19.5 / 38.2 MiB). Login-wrapper inspection is denied on macOS, so whole-tree footprint remains incomplete; one process per endpoint does not prove statistical memory/CPU parity or leak absence.
• Earlier failed ASCII p95 evidence (80.27→90.28 ms) remains retained. The new improvement follows a source change; no samples were discarded to obtain it. The new benchmark's first attempt failed before candidate startup because the copied runtime lacked execute permission. That attempt was archived, the mode fixed without changing bytes, and the entire paired matrix restarted.
• Real macOS Bun startup witness at 02e7f7ba71 accounts for all 4,194,318 characters despite a simulated 500 ms receipt delay, bounds replay, and confirms the exact child exited. Windows-to-WSL recovery checks preserve identity/scrollback and reject displaced-owner replacement without SQLite mutation. Hidden-renderer/mobile acceptance remains open.

PR CI on test-only 04d9099d8c completed: all eight Linux shards, typecheck, static checks and relay integration pass; the known Windows repaint failure and aggregate keep the run red. The new test uses the existing CommonJS-compatible path convention. The old c8c74 package build also hit that test-only typecheck failure. Replacement nonpublishing package validation run36456329488 targets corrected 04d9099d8c; Linux x64/ARM64 package jobs now pass, including Ubuntu 20.04 userspace smoke. Real Linux 5.4 x64 guest diagnostic run36457786062 passed on the exact artifact: kernel5.4.0-216/glibc2.31, terminal output/resize/history/reconnect, clean guest/QEMU exit and unchanged base images. ARM64 initial run36458970167 failed before guest boot on an optional QEMU network-boot ROM. After removing that unused harness dependency, run36460003467 passed the same final artifact on actualLinux5.4.0-216/glibc2.31, including terminal output/resize/history/reconnect and clean guest/QEMU exit. Both architectures now have actual-kernel evidence for the tested packaged terminal path. Both final04d signed Mac jobs passed. Both Mac artifacts have passed local SHA256/CRC verification. Signed-client A02e→B04d→A02e continuity run36460617328 passed on both native Mac architectures: retained daemon identity, Git/folder shell PIDs and unexported shell memory, fresh output, fresh B terminal admission and verified cleanup. Both sanitized receipts were downloaded and independently checked. The first diagnostic failed before admission because its temporary socket path exceeded the macOS limit; the fixture-only correction preserves the original failure evidence and unchanged app bytes. The paired apps share the same version and Bun runtime, with different daemon-entry bytes. Linux ARM64 rerun36460003467 also completed successfully; its downloaded receipt and serial were independently checked against the source/runtime/entry hashes. These diagnostics do not substitute for updater/install/rollback qualification. The frozen native41509 baseline is separately identified; it is not a replacement claim for the unavailable original75a9 baseline. Every receipt qualifies its named source and scope only.

Review

Final combined review remains open. WSL protocol retention/metadata normalization and restart/admission findings have corrections with independent tests. Late guest registration repair 6cfa81d490 passed Codex and Opus reviews. Startup repair 1ffab10d12 fixed delayed-receipt output loss, but Opus correctly found it retained completed spawn inputs. Follow-up corrections clear request/native-cleanup captures after publication, preserve cleanup errors during cancellation, avoid republishing exited attachments and clean up relay listener-admission failures. Production-observer GC coverage now proves inputs collect while the session remains live. Retention/cancellation correction a2ba9fb421 passed independent Codex and Opus reviews with no remaining P0/P1/P2 in scope; Opus ran662 tests and verified old-source failures versus corrected-source passes. Codex reviewed all corrections with91 tests passing. Admission/relay correction 02e7f7ba71 also passed Opus review:627 tests plus4 scratch interleaving regressions, no P0/P1/P2 in scope. Both commits are pushed. The headless ASCII optimization and its four test/provenance corrections also passed Codex and Claude Opus reviews with no remaining P0/P1/P2 in scope. An optional future manifest-validation guard is recorded locally. Four earlier nonblocking P3 observations remain documented locally; earlier scoped approvals do not imply the entire migration or platform qualification is complete.

An inherited local-close failure can leave a daemon process running after its tab closes. A separate acknowledged-close or owner/incarnation-fenced stop-intent change is needed; this PR does not claim to repair it. Loss of contact is never treated as evidence of process exit.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer implementation copied.

Notes

Do not merge until final review/CI, durable patched Windows runtime distribution, installed update/rollback/uninstall, rendered throughput/interactive latency, WSL/mobile acceptance, and oldest-supported platform checks are resolved. Runtime pins remain unchanged. Plans, trackers and measurements remain local and are excluded from this PR.

Checklist

• This PR is small and focused (the coordinated backend removal is large)
• Explained behavior, mechanism and alternatives
• Rendered acceptance attached
• Final self-review and independent review complete
• Cross-platform, SSH, mixed-owner and folder-workspace implications considered
• Final-head CI and required artifact qualification complete

Final-source Windows→WSL qualification also passed: three byte-exact 4 MiB transfers, dead-owner recovery with retained history and SQLite binding, and refusal to replace a live owner with an unavailable socket. All six recorded daemon/shell processes exited and private fixture cleanup was verified. This fixture does not qualify WSL CLI injection or rendered UI.

Windowless updater qualification follow-up

Signed Mac update testing found that orca serve exposed the updater API but never initialized the updater because setup only ran when a desktop window was created. The server now initializes it after proxy setup and before reporting readiness, reusing desktop auth preservation, profile export, and awaited flush. Cleanup failure still aborts installation; no dummy window is created.

Codex and Claude Opus reviews found no P0/P1 in this fix. Opus passed 430 related tests, the Node typecheck, and changed-file lint. Real signed update/downgrade qualification is being rebuilt; prior signed packages failed before installation and are not a pass. Two nonblocking concerns remain: updater initialization failure can fail serve startup, and cold updater loading adds work before readiness on Windows.

[OrcaWin]

Closing as defunct: Orca stays on Node outside Electron, and the bundled-Bun runtime migration this stack belongs to was wound down. Servers and remote hosts now run on the bundled Node 24 runtime (#26171).