Wait for OpenCode worker input before the first dispatch

.github/actions/install-node-dependencies/action.yml

@@ -2,6 +2,14 @@ name: Install Node dependencies
 description: Installs the Node toolchain and repository dependencies for CI jobs, with optional Electron archive caching.
 
 inputs:
+  cache-pnpm-store:
+    description: Restore or save the pnpm download store; verification and native caches are independent.
+    required: false
+    default: 'true'
+  cache-pnpm-store-lookup-only:
+    description: Auto uses measured hosted Node 24 root installs; true forces lookup, false retains archive restoration.
+    required: false
+    default: auto
   cache-pnpm-verification:
     description: Restore pnpm's policy-checked lockfile verification record.
     required: false
@@ -28,9 +36,12 @@ inputs:
     default: 'false'
 
 outputs:
+  pnpm-store-cache-hit:
+    description: Whether the requested download store matched an existing cache.
+    value: ${{ steps.pnpm-store-lookup.outputs.cache-hit || steps.pnpm-store-restore.outputs.cache-hit || steps.requested-node.outputs.cache-hit || steps.default-node.outputs.cache-hit }}
   verification-cache-hit:
     description: Whether pnpm's verification record was restored.
-    value: ${{ steps.verification-cache-restore.outputs.cache-hit }}
+    value: ${{ steps.verification-cache.outputs.cache-hit }}
   verification-cache-path:
     description: The small pnpm-owned verification record, without registry metadata.
     value: ${{ steps.verification-cache.outputs.path }}
@@ -56,6 +67,30 @@ outputs:
 runs:
   using: composite
   steps:
+    - name: Resolve pnpm store mode
+      id: pnpm-store-mode
+      if: >-
+        github.event_name != 'pull_request' && inputs.cache-pnpm-store != 'false' &&
+        (inputs.cache-pnpm-store-lookup-only == 'true' ||
+        (inputs.cache-pnpm-store-lookup-only == 'auto' &&
+        inputs.cache-dependency-path == 'pnpm-lock.yaml' &&
+        runner.environment == 'github-hosted' && job.container.id == '' &&
+        (runner.os == 'Linux' || runner.os == 'macOS' || runner.os == 'Windows') &&
+        (runner.arch == 'X64' || runner.arch == 'ARM64') &&
+        (inputs.node-version == '' || inputs.node-version == '24')))
+      shell: bash
+      env:
+        LOOKUP_REQUEST: ${{ inputs.cache-pnpm-store-lookup-only }}
+      run: |
+        lookup_only=true
+        case "$LOOKUP_REQUEST" in
+          [aA][uU][tT][oO])
+            # Hosted runners have Node for this manifest-only check before toolchain setup.
+            lookup_only="$(node -p 'const p = require("./package.json"); p.engines?.node === "24" && typeof p.packageManager === "string" && p.packageManager.split("+")[0] === "pnpm@12.8.1"')"
+            ;;
+        esac
+        printf 'lookup-only=%s\n' "$lookup_only" >> "$GITHUB_OUTPUT"
+
     # setup-node needs pnpm on PATH to locate and restore its store.
     - name: Setup pnpm
       uses: pnpm/setup@v2
@@ -69,7 +104,7 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version-file: package.json
-        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
+        cache: ${{ github.event_name != 'pull_request' && inputs.cache-pnpm-store != 'false' && steps.pnpm-store-mode.outputs.lookup-only != 'true' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
         package-manager-cache: false
 
@@ -79,59 +114,66 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
-        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
+        cache: ${{ github.event_name != 'pull_request' && inputs.cache-pnpm-store != 'false' && steps.pnpm-store-mode.outputs.lookup-only != 'true' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
         package-manager-cache: false
 
     # PR-local stores compete with reusable build caches for the repository quota.
     - name: Resolve pnpm download store
       id: pnpm-store
       if: >-
-        github.event_name == 'pull_request' &&
-        (runner.os != 'Windows' || runner.arch != 'X64' || !contains(inputs.cache-dependency-path, 'mobile/pnpm-lock.yaml'))
+        github.event_name == 'pull_request' && inputs.cache-pnpm-store != 'false' &&
+        !((runner.os == 'Linux' || runner.os == 'macOS') && (runner.arch == 'X64' || runner.arch == 'ARM64') && inputs.cache-dependency-path == 'pnpm-lock.yaml') &&
+        (runner.os != 'Windows' ||
+        !(runner.arch == 'X64' && contains(inputs.cache-dependency-path, 'mobile/pnpm-lock.yaml')) &&
+        !((runner.arch == 'X64' || runner.arch == 'ARM64') && inputs.cache-dependency-path == 'pnpm-lock.yaml')) ||
+        (github.event_name != 'pull_request' && inputs.cache-pnpm-store != 'false' &&
+        steps.pnpm-store-mode.outputs.lookup-only == 'true')
       shell: bash
       env:
         LOCKFILE_HASH: ${{ hashFiles(inputs.cache-dependency-path) }}
+        STORE_LOOKUP_ONLY: ${{ steps.pnpm-store-mode.outputs.lookup-only == 'true' }}
       run: |
         test -n "$LOCKFILE_HASH"
         cache_path="$(pnpm store path --silent)"
         test -n "$cache_path"
         printf 'path=%s\n' "$cache_path" >> "$GITHUB_OUTPUT"
         printf 'arch=%s\n' "$(node -p 'require("node:os").arch()')" >> "$GITHUB_OUTPUT"
+        if [ "$STORE_LOOKUP_ONLY" = 'true' ]; then
+          printf 'ORCA_PNPM_STORE_CACHE_PATH=%s\n' "$cache_path" >> "$GITHUB_ENV"
+        fi
 
     # Match setup-node's key and path so existing default-branch stores remain reusable.
-    # Hosted Windows x64 mixed installs cost less than restoring their root/mobile store.
+    # Direct downloads beat store restoration for the measured Linux, macOS and Windows installs.
     - name: Restore pnpm download store without saving
+      id: pnpm-store-restore
       if: >-
-        github.event_name == 'pull_request' &&
-        (runner.os != 'Windows' || runner.arch != 'X64' || !contains(inputs.cache-dependency-path, 'mobile/pnpm-lock.yaml'))
+        github.event_name == 'pull_request' && inputs.cache-pnpm-store != 'false' &&
+        !((runner.os == 'Linux' || runner.os == 'macOS') && (runner.arch == 'X64' || runner.arch == 'ARM64') && inputs.cache-dependency-path == 'pnpm-lock.yaml') &&
+        (runner.os != 'Windows' ||
+        !(runner.arch == 'X64' && contains(inputs.cache-dependency-path, 'mobile/pnpm-lock.yaml')) &&
+        !((runner.arch == 'X64' || runner.arch == 'ARM64') && inputs.cache-dependency-path == 'pnpm-lock.yaml'))
       uses: actions/cache/restore@v5
       with:
         path: ${{ steps.pnpm-store.outputs.path }}
         key: node-cache-${{ runner.os }}-${{ steps.pnpm-store.outputs.arch }}-pnpm-${{ hashFiles(inputs.cache-dependency-path) }}
 
-    - name: Resolve pnpm verification cache
-      id: verification-cache
-      if: >-
-        inputs.cache-pnpm-verification == 'true' &&
-        (runner.os == 'Linux' ||
-        (runner.os == 'Windows' && (runner.arch == 'X64' || runner.arch == 'ARM64')) ||
-        (runner.os == 'macOS' && runner.arch == 'X64'))
-      shell: bash
-      env:
-        POLICY_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc') }}
-      run: |
-        printf 'path=%s/lockfile-verified.jsonl\n' "$(pnpm cache path)" >> "$GITHUB_OUTPUT"
-        printf 'key=pnpm-verification-v1-%s-%s-%s-%s\n' "$RUNNER_OS" "$RUNNER_ARCH" "$(pnpm --version)" "$POLICY_HASH" >> "$GITHUB_OUTPUT"
+    # Producers can refresh access and publish misses without downloading existing archives.
+    - name: Keep pnpm download store without restoring
+      id: pnpm-store-lookup
+      if: steps.pnpm-store-mode.outputs.lookup-only == 'true'
+      uses: actions/cache@v5
+      with:
+        # Twice-nested composite cleanup loses internal step outputs.
+        path: ${{ env.ORCA_PNPM_STORE_CACHE_PATH }}
+        key: node-cache-${{ runner.os }}-${{ steps.pnpm-store.outputs.arch }}-pnpm-${{ hashFiles(inputs.cache-dependency-path) }}
+        lookup-only: true
 
     - name: Restore pnpm verification record
-      id: verification-cache-restore
-      if: steps.verification-cache.outputs.key != ''
-      continue-on-error: true
-      uses: actions/cache/restore@v5
+      id: verification-cache
+      uses: ./.github/actions/restore-pnpm-verification
       with:
-        path: ${{ steps.verification-cache.outputs.path }}
-        key: ${{ steps.verification-cache.outputs.key }}
+        enabled: ${{ inputs.cache-pnpm-verification }}
 
     - name: Validate native runtime
       shell: bash
@@ -169,7 +211,7 @@ runs:
 
     # pnpm checks the cached record's policy and validity; never bypass verification.
     - name: Save pnpm verification record on main
-      if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && steps.verification-cache.outputs.key != '' && steps.verification-cache-restore.outputs.cache-hit != 'true'
+      if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && steps.verification-cache.outputs.key != '' && steps.verification-cache.outputs.cache-hit != 'true'
       continue-on-error: true
       uses: actions/cache/save@v5
       with:

.github/actions/prepare-git-compatibility/action.yml

@@ -10,15 +10,17 @@ runs:
       uses: actions/cache@v5
       with:
         path: ~/.cache/orca-git-compat/git-2.25.5
-        key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
+        key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5-submodule
 
     # Finish the CPU-heavy build before any timed compatibility lanes start.
     - name: Build the baseline Git binary
       shell: bash
       run: |
         archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
         source="$HOME/.cache/orca-git-compat/git-2.25.5"
-        if [ -x "$source/git" ]; then
+        if [ -x "$source/git" ] && [ -x "$source/git-submodule" ] \
+          && [ -f "$source/git-sh-setup" ] && [ -f "$source/git-sh-i18n" ] \
+          && [ -f "$source/git-parse-remote" ] && [ -x "$source/git-sh-i18n--envsubst" ]; then
           exit 0
         fi
         curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
@@ -27,6 +29,7 @@ runs:
         mkdir -p "$source"
         tar -xzf "$archive" -C "$source" --strip-components=1
         make -C "$source" -j"$(nproc)" \
-          NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
+          NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease \
+          git git-submodule git-sh-setup git-sh-i18n git-parse-remote git-sh-i18n--envsubst
         # Object files are no longer needed after linking the cached binary.
         find "$source" -name '*.o' -delete

.github/actions/prepare-headless-compiler/action.yml

@@ -0,0 +1,45 @@
+name: Prepare headless detector compiler
+description: Reuse the policy-checked compiler from main; callers install normally on a miss.
+inputs:
+  seed:
+    description: Pack an already installed compiler instead of activating a cached compiler.
+    default: 'false'
+outputs:
+  available:
+    description: Whether the cached compiler was validated and activated.
+    value: ${{ steps.activate.outputs.available }}
+runs:
+  using: composite
+  steps:
+    - id: identity
+      shell: bash
+      env:
+        COMPILER_POLICY_HASH: ${{ hashFiles('package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs', 'config/patches/**', '.github/actions/install-node-dependencies/**', '.github/actions/restore-pnpm-verification/**', 'config/scripts/headless-detector-compiler-cache.mjs', '.github/actions/prepare-headless-compiler/action.yml') }}
+      run: node config/scripts/headless-detector-compiler-cache.mjs identity
+    - id: cache
+      uses: actions/cache/restore@v5
+      continue-on-error: true
+      with:
+        path: ${{ steps.identity.outputs.path }}
+        key: ${{ steps.identity.outputs.key }}
+    - id: activate
+      if: inputs.seed != 'true' && steps.cache.outputs.cache-hit == 'true'
+      shell: bash
+      env:
+        COMPILER_CACHE_KEY: ${{ steps.identity.outputs.key }}
+        COMPILER_CACHE_PATH: ${{ steps.identity.outputs.path }}
+      run: node config/scripts/headless-detector-compiler-cache.mjs activate
+    - name: Pack installed compiler
+      if: inputs.seed == 'true' && steps.cache.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        COMPILER_CACHE_KEY: ${{ steps.identity.outputs.key }}
+        COMPILER_CACHE_PATH: ${{ steps.identity.outputs.path }}
+      run: node config/scripts/headless-detector-compiler-cache.mjs pack
+    - name: Save compiler only from main
+      if: inputs.seed == 'true' && steps.cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+      uses: actions/cache/save@v5
+      continue-on-error: true
+      with:
+        path: ${{ steps.identity.outputs.path }}
+        key: ${{ steps.identity.outputs.key }}

.github/actions/restore-pnpm-verification/action.yml

@@ -0,0 +1,58 @@
+name: Restore pnpm verification
+description: Restore the pnpm-owned lockfile verdict without installing dependencies.
+
+inputs:
+  enabled:
+    description: Restore a verification record on supported runners.
+    default: 'true'
+  container-toolchain:
+    description: Use the manifest's pnpm version and default Linux cache path without installing host pnpm.
+    default: 'false'
+
+outputs:
+  path:
+    description: The pnpm-owned verification record.
+    value: ${{ steps.verification-cache.outputs.path }}
+  key:
+    description: Exact OS, architecture, pnpm version and policy key.
+    value: ${{ steps.verification-cache.outputs.key }}
+  cache-hit:
+    description: Whether the exact record was restored.
+    value: ${{ steps.verification-cache-restore.outputs.cache-hit }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve pnpm verification cache
+      id: verification-cache
+      if: >-
+        inputs.enabled == 'true' &&
+        (runner.os == 'Linux' ||
+        (runner.os == 'Windows' && (runner.arch == 'X64' || runner.arch == 'ARM64')) ||
+        (runner.os == 'macOS' && runner.arch == 'X64'))
+      shell: bash
+      env:
+        POLICY_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc') }}
+        CONTAINER_TOOLCHAIN: ${{ inputs.container-toolchain }}
+      run: |
+        if [ "$CONTAINER_TOOLCHAIN" = true ]; then
+          test "$RUNNER_OS" = Linux
+          # Cache versions include paths, so match the native Linux producer.
+          cache_path="$(node -p "require('node:path').join(process.env.XDG_CACHE_HOME || require('node:path').join(require('node:os').homedir(), '.cache'), 'pnpm')")"
+          pnpm_version="$(node -p "require('./package.json').packageManager.match(/^pnpm@([^+]+)/)[1]")"
+          mkdir -p "$cache_path"
+        else
+          cache_path="$(pnpm cache path)"
+          pnpm_version="$(pnpm --version)"
+        fi
+        printf 'path=%s/lockfile-verified.jsonl\n' "$cache_path" >> "$GITHUB_OUTPUT"
+        printf 'key=pnpm-verification-v1-%s-%s-%s-%s\n' "$RUNNER_OS" "$RUNNER_ARCH" "$pnpm_version" "$POLICY_HASH" >> "$GITHUB_OUTPUT"
+
+    - name: Restore pnpm verification record
+      id: verification-cache-restore
+      if: steps.verification-cache.outputs.key != ''
+      continue-on-error: true
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.verification-cache.outputs.path }}
+        key: ${{ steps.verification-cache.outputs.key }}

.github/scripts/render-readme-downloads-badge.mjs

@@ -1,5 +1,7 @@
 import { mkdir, writeFile } from 'node:fs/promises'
 import { dirname } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { isAgentStateRulesTag } from '../../config/scripts/release-tag-patterns.mjs'
 
 const repository = process.env.GITHUB_REPOSITORY ?? 'stablyai/orca'
 const token = process.env.GITHUB_TOKEN
@@ -24,6 +26,22 @@ async function fetchJson(url) {
   return response.json()
 }
 
+// Why rules releases are excluded: every running app fetches them every few hours, so they
+// count fetches, not installs.
+export function countReleaseDownloads(releases) {
+  let total = 0
+  for (const release of releases) {
+    if (release.draft || isAgentStateRulesTag(release.tag_name ?? '')) {
+      continue
+    }
+
+    for (const asset of release.assets ?? []) {
+      total += asset.download_count ?? 0
+    }
+  }
+  return total
+}
+
 async function getTotalReleaseDownloads() {
   let page = 1
   let total = 0
@@ -37,16 +55,7 @@ async function getTotalReleaseDownloads() {
       return total
     }
 
-    for (const release of releases) {
-      if (release.draft) {
-        continue
-      }
-
-      for (const asset of release.assets ?? []) {
-        total += asset.download_count ?? 0
-      }
-    }
-
+    total += countReleaseDownloads(releases)
     page += 1
   }
 }
@@ -104,9 +113,11 @@ function renderBadge(value) {
 `
 }
 
-const total = await getTotalReleaseDownloads()
-const badge = renderBadge(formatDownloads(total))
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  const total = await getTotalReleaseDownloads()
+  const badge = renderBadge(formatDownloads(total))
 
-await mkdir(dirname(outputPath), { recursive: true })
-await writeFile(outputPath, badge)
-console.log(`Rendered ${outputPath} from ${total} downloads.`)
+  await mkdir(dirname(outputPath), { recursive: true })
+  await writeFile(outputPath, badge)
+  console.log(`Rendered ${outputPath} from ${total} downloads.`)
+}