sync: absorb upstream v1.4.206

.github/workflows/adhoc-mac-build.yml

@@ -235,11 +235,14 @@ jobs:
             fi
           done
           echo "head_sha=$(git rev-parse HEAD)" >>"$GITHUB_OUTPUT"
-          # Why the main repo's tags: package.json on a branch is as stale as the
-          # main it forked from, and stable patches never merge back into it.
-          published="$(GH_TOKEN="$MAIN_REPO_TOKEN" gh release list \
-            --repo "$GITHUB_REPOSITORY" --limit 100 --exclude-drafts \
-            --json tagName --jq '.[].tagName' || true)"
+          # Why git tags, not GitHub releases: unpublishing a buggy cut deletes the
+          # GitHub release and leaves the tag, which still owns that number.
+          # Releases-only let adhoc sit on a number already taken, so the updater
+          # would not install it. Empty on failure — the script then falls back
+          # to package.json.
+          published="$(GH_TOKEN="$MAIN_REPO_TOKEN" gh api \
+            "repos/$GITHUB_REPOSITORY/git/matching-refs/tags/v" \
+            --jq '.[].ref | sub("^refs/tags/"; "")' || true)"
           ORCA_PUBLISHED_VERSIONS="$published" ORCA_ADHOC_LABEL="${LABEL:-$REF}" \
             node config/scripts/adhoc-build-version.mjs \
             >"$RUNNER_TEMP/adhoc-identity.txt"

.github/workflows/daily-mac-build.yml

@@ -90,7 +90,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: main
-          # Version helpers only read HEAD; published versions come from the release API.
+          # Version helpers only read HEAD; published versions come from git tags.
           fetch-depth: 1
           # Why: this job only reads stablyai/orca and never pushes; every write
           # goes to the daily repo through a minted App token passed by env.
@@ -209,17 +209,21 @@ jobs:
           # number free", where a stranded draft still holds one.
           names="$(gh release list --repo "$DAILY_REPO" --limit 200 --json name \
             --jq '.[].name // empty')"
-          # Why the main repo's tags decide the base version rather than
-          # package.json: main's version only moves on `release:` commits, and
-          # stable patches are cut from release branches that never merge back, so
-          # package.json can sit several patches behind what users are running. A
+          # Why git tags, not GitHub releases: unpublishing a buggy cut deletes the
+          # GitHub release and leaves the tag. That dragged hourlies backwards so
+          # electron-updater stopped offering them; dailies would do the same. A
           # separate token because GH_TOKEN above is the App's, scoped to the
           # daily repo. Empty on failure — the script then falls back to
           # package.json, which is stale but never wrong enough to fail a build.
-          published="$(GH_TOKEN="$MAIN_REPO_TOKEN" gh release list \
-            --repo "$GITHUB_REPOSITORY" --limit 100 --exclude-drafts \
-            --json tagName --jq '.[].tagName' || true)"
-          echo "Highest published tag seen: $(head -1 <<<"$published")"
+          main_tags="$(GH_TOKEN="$MAIN_REPO_TOKEN" gh api \
+            "repos/$GITHUB_REPOSITORY/git/matching-refs/tags/v" \
+            --jq '.[].ref | sub("^refs/tags/"; "")' || true)"
+          # Already-shipped channel tags are a second floor so unpublishing a
+          # buggy main release cannot drag this series below a daily already out.
+          channel_tags="$(gh release list --repo "$DAILY_REPO" --limit 200 --json tagName \
+            --jq '.[].tagName' || true)"
+          published="$main_tags"$'\n'"$channel_tags"
+          echo "Published version sources: $(grep -c . <<<"$main_tags" || true) main tags, $(grep -c . <<<"$channel_tags" || true) channel tags"
           ORCA_PUBLISHED_VERSIONS="$published" ORCA_DAILY_RELEASE_NAMES="$names" \
             node config/scripts/daily-build-version.mjs \
             >"$RUNNER_TEMP/daily-identity.txt"

.github/workflows/git-command-termination-runtime.yml

@@ -0,0 +1,22 @@
+name: Git command termination runtime
+on:
+  pull_request:
+    paths:
+      - 'src/main/git/command-runner/spawned-command-tree-kill*'
+      - '.github/workflows/git-command-termination-runtime.yml'
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  windows-exit:
+    runs-on: windows-latest
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+      - name: Verify exited native child does not trigger taskkill
+        run: node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/git/command-runner/spawned-command-tree-kill.test.ts

.github/workflows/hourly-mac-build.yml

@@ -137,7 +137,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ needs.preflight.outputs.head_sha }}
-          # Version helpers only read HEAD; published versions come from the release API.
+          # Version helpers only read HEAD; published versions come from git tags.
           fetch-depth: 1
           # Why: this job only reads stablyai/orca and never pushes; every write
           # goes to the hourly repo through a minted App token passed by env.
@@ -213,17 +213,25 @@ jobs:
           # number free", where a stranded draft still holds one.
           names="$(gh release list --repo "$HOURLY_REPO" --limit 200 --json name \
             --jq '.[].name // empty')"
-          # Why the main repo's tags decide the base version rather than
-          # package.json: main's version only moves on `release:` commits, and
-          # stable patches are cut from release branches that never merge back, so
-          # package.json can sit several patches behind what users are running. A
-          # separate token because GH_TOKEN above is the App's, scoped to the
-          # hourly repo. Empty on failure — the script then falls back to
-          # package.json, which is stale but never wrong enough to fail a build.
-          published="$(GH_TOKEN="$MAIN_REPO_TOKEN" gh release list \
-            --repo "$GITHUB_REPOSITORY" --limit 100 --exclude-drafts \
-            --json tagName --jq '.[].tagName' || true)"
-          echo "Highest published tag seen: $(head -1 <<<"$published")"
+          # Why git tags, not GitHub releases: unpublishing a buggy cut deletes the
+          # GitHub release and leaves the tag. On 2026-09-14 we deleted v1.4.202's
+          # release for a bug; hourlies had already climbed to 1.4.203, then
+          # `gh release list` fell back to v1.4.201 and the next hourlies shipped
+          # as 1.4.202-hourly — which electron-updater will not install over
+          # 1.4.203-hourly or over the still-tagged 1.4.202. A separate token
+          # because GH_TOKEN above is the App's, scoped to the hourly repo. Empty
+          # on failure — the script then falls back to package.json, which is
+          # stale but never wrong enough to fail a build.
+          main_tags="$(GH_TOKEN="$MAIN_REPO_TOKEN" gh api \
+            "repos/$GITHUB_REPOSITORY/git/matching-refs/tags/v" \
+            --jq '.[].ref | sub("^refs/tags/"; "")' || true)"
+          # Already-shipped channel tags are a second floor: even if main's tag
+          # list is empty this run, a 1.4.203-hourly already out must not be
+          # followed by a 1.4.202-hourly.
+          channel_tags="$(gh release list --repo "$HOURLY_REPO" --limit 200 --json tagName \
+            --jq '.[].tagName' || true)"
+          published="$main_tags"$'\n'"$channel_tags"
+          echo "Published version sources: $(grep -c . <<<"$main_tags" || true) main tags, $(grep -c . <<<"$channel_tags" || true) channel tags"
           ORCA_PUBLISHED_VERSIONS="$published" ORCA_HOURLY_RELEASE_NAMES="$names" \
             node config/scripts/hourly-build-version.mjs \
             >"$RUNNER_TEMP/hourly-identity.txt"

.github/workflows/pr.yml

@@ -142,6 +142,9 @@ jobs:
       - name: Lint
         run: pnpm exec oxlint --format github
 
+      - name: Reject low-evidence patterns
+        run: pnpm run audit:anti-slop
+
       - name: Enforce focused code-quality plugins
         run: pnpm run audit:code-quality:native
 
@@ -186,6 +189,9 @@ jobs:
       - name: Check reliability gate manifest
         run: pnpm run check:reliability-gates
 
+      - name: Enforce dead design-system classes
+        run: pnpm run check:dead-classes
+
       - name: Check VM runtime rollback compatibility
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
@@ -369,40 +375,59 @@ jobs:
       # Why: the 2.25.5 lane is a source build of a pinned tarball, so it produced the
       # same binary on every PR for minutes of runner time. The key carries the version
       # because that is the only input; the sha256 assertion below still guards the
-      # tarball on the miss path that actually builds.
+      # tarball on the miss path that actually builds. Only this PR's own later pushes
+      # can restore it — GitHub scopes a cache written from a pull_request run to that
+      # ref — so a first push always takes the build path below.
       - name: Cache baseline Git build
         uses: actions/cache@v5
         with:
           path: ~/.cache/orca-git-compat/git-2.25.5
           key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
 
+      # Why its own step: this is `make -j$(nproc)` on every core, and the lanes below
+      # spend their wall clock waiting on container starts, not on Git. Sharing a runner
+      # with the build stretched one ~1.5s boundary case past Vitest's 30s timeout, so
+      # the build has to finish before anything timed starts.
+      - name: Build the baseline Git binary
+        run: |
+          archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
+          source="$HOME/.cache/orca-git-compat/git-2.25.5"
+          if [ -x "$source/git" ]; then
+            exit 0
+          fi
+          curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
+          echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
+            | sha256sum --check
+          mkdir -p "$source"
+          tar -xzf "$archive" -C "$source" --strip-components=1
+          make -C "$source" -j"$(nproc)" \
+            NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
+          # Why: the linked binaries are what the next run needs; the objects that
+          # produced them are most of the tree and would bloat the cache entry.
+          find "$source" -name '*.o' -delete
+
       - name: Verify Git binary compatibility matrix
         run: |
+          specs=(
+            "alpine/git:edge-2.38.1|2.38.1"
+            "alpine/git:v2.49.1|2.49.1"
+          )
+          # Why pull up front: a lane's first `docker run` otherwise pulls its image
+          # while the sibling lane is mid-test, and that stall is charged to the test.
+          for spec in "${specs[@]}"; do
+            docker pull --quiet "${spec%%|*}"
+          done
+
           pids=()
           (
-            archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
-            source="$HOME/.cache/orca-git-compat/git-2.25.5"
-            if [ ! -x "$source/git" ]; then
-              curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
-              echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
-                | sha256sum --check
-              mkdir -p "$source"
-              tar -xzf "$archive" -C "$source" --strip-components=1
-              make -C "$source" -j"$(nproc)" \
-                NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
-              # Why: the linked binaries are what the next run needs; the objects that
-              # produced them are most of the tree and would bloat the cache entry.
-              find "$source" -name '*.o' -delete
-            fi
-            ORCA_GIT_COMPAT_BINARY="$source/git" ORCA_GIT_COMPAT_VERSION="2.25.5" \
+            ORCA_GIT_COMPAT_BINARY="$HOME/.cache/orca-git-compat/git-2.25.5/git" \
+              ORCA_GIT_COMPAT_VERSION="2.25.5" \
               pnpm exec vitest run --config config/vitest.config.ts \
               src/shared/git-binary-compatibility.test.ts
           ) &
           pids+=("$!")
 
-          for spec in \
-            "alpine/git:edge-2.38.1|2.38.1" \
-            "alpine/git:v2.49.1|2.49.1"; do
+          for spec in "${specs[@]}"; do
             (
               image="${spec%%|*}"
               version="${spec#*|}"

.github/workflows/release-cut.yml

@@ -1222,6 +1222,20 @@ jobs:
           echo "identity=$identity" >>"$GITHUB_OUTPUT"
           echo "Classified $TAG as $identity"
 
+      # Why here and not in build:relay: only a Windows runner can compile it, and
+      # arm64 cross-compiles from this same x64 agent. Mirrors dev-channel-win-build.yml,
+      # which had it while release-cut did not — so every stable installer through
+      # v1.4.203 shipped Windows relays with no windows-process-tree.node, silently
+      # falling back to the PowerShell scan on every Windows SSH host.
+      # Why no run_attempt guard, unlike the artifact steps below: Build app is ungated,
+      # so a rerun would reach the required-addon check with nothing staged and fail.
+      - name: Build Windows process-table addon for the relay
+        if: matrix.platform == 'win'
+        shell: bash
+        run: |
+          node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=x64
+          node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=arm64
+
       # Why ORCA_POSTHOG_WRITE_KEY here: this is the only build that
       # produces a published binary, so this is the only place the secret
       # needs to be in scope. The key is a PostHog *project* API key, not
@@ -1244,6 +1258,9 @@ jobs:
           ORCA_BUILD_IDENTITY: ${{ steps.tag-classify.outputs.identity }}
           ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
           ORCA_POSTHOG_WRITE_KEY: ${{ secrets.ORCA_POSTHOG_WRITE_KEY }}
+          # Fail the release rather than ship a relay that silently falls back to
+          # the PowerShell scan on every Windows SSH host.
+          ORCA_REQUIRE_RELAY_NATIVE_ADDONS: ${{ matrix.platform == 'win' && 'x64,arm64' || '' }}
 
       - name: Gate runtime file-watcher process isolation
         if: runner.os == 'Linux'

.github/workflows/unit-tests.yml

@@ -56,6 +56,7 @@ jobs:
             --exclude=src/main/daemon/node-pty-fd-leak.test.ts \
             --exclude=src/main/providers/local-pty-shell-ready-zsh-launch-environment.test.ts \
             --exclude=src/main/providers/__tests__/shell-ready-framework-example.test.ts \
+            --exclude=src/main/pty/omp-shell-wrapper-alias-safety.test.ts \
             --exclude=src/main/pty/omp-shell-wrapper.node-pty.test.ts \
             --exclude=src/main/shell-startup-feature-channel.test.ts \
             --exclude=src/main/terminal-history-fish-session.node-pty.test.ts \

.gitignore

@@ -134,6 +134,7 @@ docs/**
 !docs/reference/ssh-host-key-verification.md
 !docs/reference/ssh-reconnect-source-recovery.md
 !docs/reference/windows-setup-shell.md
+!docs/reference/windows-terminal-shell-selection.md
 !docs/reference/worktree-scan-fingerprint.md
 !docs/reference/wsl-command-execution.md
 !docs/reference/wsl-probe-failure-semantics.md
@@ -193,3 +194,6 @@ tests/e2e/.cross-version-checkouts/
 # IS committed). Also keeps oxfmt/oxlint, which honor this file, from walking
 # vendored gems.
 /mobile/vendor/
+
+# Generated by config/scripts/sync-anti-slop-plugin.mjs from the pinned oxlint-plugin-anti-slop
+.anti-slop-plugin/

.oxfmtrc.json

@@ -4,5 +4,9 @@
   "semi": false,
   "printWidth": 100,
   "trailingComma": "none",
-  "ignorePatterns": ["cloud/**", ".github/actions/cloud-sql-rollout-lease/**"]
+  "ignorePatterns": [
+    "cloud/**",
+    ".github/actions/cloud-sql-rollout-lease/**",
+    ".anti-slop-plugin/**"
+  ]
 }

AGENTS.md

@@ -1,6 +1,6 @@
 # Design System
 
-All UI work — layout, color, typography, spacing, component selection, UX behavior — must follow [`docs/STYLEGUIDE.md`](./docs/STYLEGUIDE.md). Use the tokens defined in `src/renderer/src/assets/main.css` (the canonical source) and the shadcn primitives in `src/renderer/src/components/ui/`. Don't invent new color values, font sizes, or shadow tiers when a documented one already covers the role. When STYLEGUIDE.md is silent, follow the resolution order in its final section.
+All UI work — layout, color, typography, spacing, component selection, UX behavior — must follow [`docs/STYLEGUIDE.md`](./docs/STYLEGUIDE.md). Most of it is linted: `pnpm run check:code-quality:changed` fails on new restyles of a `components/ui/` primitive, raw palette colors, and computed `className` strings; `pnpm lint` fails on any class Tailwind cannot generate. See the Enforcement section of the style guide before suppressing either. Use the tokens defined in `src/renderer/src/assets/main.css` (the canonical source) and the shadcn primitives in `src/renderer/src/components/ui/`. Don't invent new color values, font sizes, or shadow tiers when a documented one already covers the role. When STYLEGUIDE.md is silent, follow the resolution order in its final section.
 
 ## Electron UI Validation
 
@@ -46,6 +46,7 @@ Avoid type assertions except `as const`. Unavoidable casts need a line-specific
 - **Typecheck**: `pnpm tc` (or `tc:node` / `tc:cli` / `tc:web`)
 - **Test**: see [Running Tests: Remote Sandbox Only](#running-tests-remote-sandbox-only) — `pnpm test` is blocked on this machine
 - **Lint**: `oxlint`, or `pnpm run check:code-quality:changed` for changed files (full `pnpm lint` is slow); format with `pnpm format`
+- **Design system**: `pnpm run lint:design-system` for the full renderer report (not a gate); the changed-lines gate above is what CI enforces
 
 # Typed Observations: the Orca Ledger
 
@@ -204,6 +205,7 @@ Orca targets macOS, Linux, and Windows. Keep all platform-dependent behavior beh
 - **Keyboard shortcuts**: Never hardcode `e.metaKey`. Use a platform check (`navigator.userAgent.includes('Mac')`) to pick `metaKey` on Mac and `ctrlKey` on Linux/Windows. Electron menu accelerators should use `CmdOrCtrl`.
 - **Shortcut labels in UI**: Display `⌘` / `⇧` on Mac and `Ctrl+` / `Shift+` on other platforms.
 - **File paths**: Use `path.join` or Electron/Node path utilities — never assume `/` or `\`.
+- **Windows terminal shells**: `--shell` picks the shell a terminal *is*; `--command` is typed into whatever shell the host spawned, so a shell choice routed through `command` silently becomes a child process. See [`docs/reference/windows-terminal-shell-selection.md`](./docs/reference/windows-terminal-shell-selection.md).
 - **Windows setup scripts**: the setup/issue-command runner is a `.cmd` batch file unless the script starts with a `#!` line — never derive that from the user's terminal-shell preference, and never launch a `.cmd` runner with a bare `cmd.exe /c` from a Git Bash pane (MSYS rewrites the `/c`). See [`docs/reference/windows-setup-shell.md`](./docs/reference/windows-setup-shell.md).
 - **Windows child processes**: start them through `runProcess`/`spawnProcess` in `src/shared/child-process/` — never `child_process` directly. It pins `windowsHide`, refuses `shell: true`, and encodes `.cmd`/`.bat` arguments so neither `CommandLineToArgvW` nor `cmd.exe` mangles them. A ratchet test fails on any new direct import. Recognised npm/pnpm `.cmd` shims are resolved to their real target so the spawn skips `cmd.exe` entirely; see [`docs/reference/windows-cmd-shim-resolution.md`](./docs/reference/windows-cmd-shim-resolution.md) before adding a shim shape or debugging one.
 - **Windows process enumeration**: read the table through `src/main/windows/windows-process-table.ts`, never by forking `powershell.exe`. See [`docs/reference/windows-process-enumeration.md`](./docs/reference/windows-process-enumeration.md).