sync: absorb upstream v1.4.215

.gitattributes

@@ -40,27 +40,21 @@
 # these carry real CR and CRLF bytes as the terminal emitted them, and line-ending
 # normalisation on a Windows checkout would rewrite the evidence the fixture exists to be.
 /src/main/runtime/__fixtures__/*.txt -text
+/src/main/daemon/__fixtures__/pty-transcripts/*.txt -text
 # Generated runtime English subset: compared byte-for-byte by
 # verify:localization-runtime-catalog, so a CRLF checkout would fail the gate.
 /src/renderer/src/i18n/en-runtime-required.json linguist-generated=true text eol=lf
 # Generated method->params catalog: compared byte-for-byte by
 # verify:rpc-params-catalog, so a CRLF checkout would fail the gate.
 /src/shared/rpc-contract/rpc-params-catalog.generated.ts linguist-generated=true text eol=lf
-# Mobile web bundle source. Every text byte here is hashed into an asset digest and
-# from there into buildId, so a CRLF checkout produces a different bundle id for the
-# same commit (91af2897 vs 9d78435e). The PNG is -text because it must not be touched.
-/src/mobile-web/index.html text eol=lf
-/src/mobile-web/src/*.ts text eol=lf
-/src/mobile-web/src/*.css text eol=lf
-/src/mobile-web/src/*.png -text
-# Mobile web page source. Same buildId hazard as src/mobile-web above: these bytes are
-# hashed into the Phase C bundle, so a CRLF Windows checkout would ship a different
-# buildId for identical source. web-entry/ does not exist yet; the pin lands ahead of it.
+# Mobile web page source. Every text byte here is hashed into an asset digest and from
+# there into buildId, so a CRLF Windows checkout would ship a different bundle id for
+# identical source (91af2897 vs 9d78435e, measured on the bundle this replaced).
 /mobile/src/** text eol=lf
 /mobile/app/** text eol=lf
 /mobile/web-entry/** text eol=lf
 # The blanket pin above would mark a future binary as text; exempt the asset types an
-# RN page actually carries, the same way src/mobile-web exempts its PNG.
+# RN page actually carries.
 /mobile/src/**/*.png -text
 /mobile/src/**/*.jpg -text
 /mobile/src/**/*.jpeg -text

.github/actions/install-node-dependencies/action.yml

@@ -50,17 +50,41 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version-file: package.json
-        cache: pnpm
+        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
+        package-manager-cache: false
 
     - name: Setup requested Node.js
       id: requested-node
       if: inputs.node-version != ''
       uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
-        cache: pnpm
+        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
+        package-manager-cache: false
+
+    # PR-local stores compete with reusable build caches for the repository quota.
+    - name: Resolve pnpm download store
+      id: pnpm-store
+      if: github.event_name == 'pull_request'
+      shell: bash
+      env:
+        LOCKFILE_HASH: ${{ hashFiles(inputs.cache-dependency-path) }}
+      run: |
+        test -n "$LOCKFILE_HASH"
+        cache_path="$(pnpm store path --silent)"
+        test -n "$cache_path"
+        printf 'path=%s\n' "$cache_path" >> "$GITHUB_OUTPUT"
+        printf 'arch=%s\n' "$(node -p 'require("node:os").arch()')" >> "$GITHUB_OUTPUT"
+
+    # Match setup-node's key and path so existing default-branch stores remain reusable.
+    - name: Restore pnpm download store without saving
+      if: github.event_name == 'pull_request'
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.pnpm-store.outputs.path }}
+        key: node-cache-${{ runner.os }}-${{ steps.pnpm-store.outputs.arch }}-pnpm-${{ hashFiles(inputs.cache-dependency-path) }}
 
     - name: Validate native runtime
       shell: bash

.github/actions/prepare-git-compatibility/action.yml

@@ -0,0 +1,32 @@
+name: Prepare baseline Git compatibility binary
+description: Restore or build the pinned Linux Git binary for the compatibility contract.
+
+runs:
+  using: composite
+  steps:
+    # The default-branch warmer shares this key across PRs; a PR save is private to its merge ref.
+    # Cache eviction remains possible, so keep the checksum-verified cold build below.
+    - name: Cache baseline Git build
+      uses: actions/cache@v5
+      with:
+        path: ~/.cache/orca-git-compat/git-2.25.5
+        key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
+
+    # Finish the CPU-heavy build before any timed compatibility lanes start.
+    - name: Build the baseline Git binary
+      shell: bash
+      run: |
+        archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
+        source="$HOME/.cache/orca-git-compat/git-2.25.5"
+        if [ -x "$source/git" ]; then
+          exit 0
+        fi
+        curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
+        echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
+          | sha256sum --check
+        mkdir -p "$source"
+        tar -xzf "$archive" -C "$source" --strip-components=1
+        make -C "$source" -j"$(nproc)" \
+          NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
+        # Object files are no longer needed after linking the cached binary.
+        find "$source" -name '*.o' -delete

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  # Why only ripgrep: the bundled rg ships in every artifact and to SSH remotes, and a bump is a
+  # one-line pin change (the SSH cache keys on the binary's hash). Other dependencies stay manual.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
+    allow:
+      - dependency-name: '@vscode/ripgrep-universal'
+    open-pull-requests-limit: 1

.github/pull_request_template.md

@@ -12,7 +12,8 @@
 
 ## Linked Issue
 
-<!-- Link the issue this PR addresses, there should ALWAYS be one -->
+<!-- Link the issue this PR addresses, there should ALWAYS be one (for outside contributors) -->
+<!-- SPECIAL CASE: If you are a maintainer (member of stablyai org) AVOID opening needless issues. Only attach pre-existing ones -->
 
 Fixes #
 

.github/workflows/bun-profile-tests.yml

@@ -0,0 +1,140 @@
+name: Bun profile persistence
+
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'config/**'
+      - 'native/**'
+      - 'tests/**'
+      - 'resources/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'tsconfig.json'
+      - '.npmrc'
+      - '.pnpmfile.cjs'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/workflows/bun-profile-tests.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: bun-profile-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      should_run: ${{ steps.scope.outputs.should_run }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+      - name: Detect Bun build and test inputs
+        id: scope
+        shell: bash
+        run: |
+          # Compare the tested merge with its base, retaining both sides of renames.
+          if git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/bun-changes"; then
+            node config/scripts/bun-profile-change-scope.mjs "$RUNNER_TEMP/bun-changes"
+          else
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          fi
+
+  persistence:
+    needs: changes
+    # Missing/failed detection runs the full matrix; manual runs remain unconditional.
+    if: ${{ !cancelled() && needs.changes.outputs.should_run != 'false' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04-arm, macos-14, macos-15-intel, windows-2022, windows-11-arm]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: ${{ runner.os == 'Windows' && 'node' || 'none' }}
+      - name: Build the native Windows process reader
+        if: runner.os == 'Windows'
+        run: node config/scripts/build-windows-process-tree-relay-addon.mjs
+      - run: pnpm build:orcad
+      - run: pnpm test:bun:profile --artifact
+      - uses: actions/setup-node@v6
+        if: runner.arch == 'X64'
+        with:
+          node-version: '18'
+      - name: Verify Node 18 loads and hands off to bundled Bun
+        if: runner.arch == 'X64'
+        run: |
+          node out/orcad/orcad.js --orcad-smoke-load-check
+          node out/orcad/orcad.js --orcad-profile-state-preflight 00000000-0000-4000-8000-000000000018
+
+  linux_glibc_floor:
+    needs: changes
+    # Missing/failed detection runs the full matrix; manual runs remain unconditional.
+    if: ${{ !cancelled() && needs.changes.outputs.should_run != 'false' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.os }}
+    container: ubuntu:20.04
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - name: Install Ubuntu 20.04 prerequisites
+        run: apt-get update && apt-get install -y build-essential ca-certificates git python3 unzip
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Trust the checked-out workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - uses: ./.github/actions/install-node-dependencies
+      - run: pnpm build:orcad
+      - run: pnpm test:bun:profile --artifact
+
+  linux_musl:
+    needs: changes
+    # Missing/failed detection runs the full matrix; manual runs remain unconditional.
+    if: ${{ !cancelled() && needs.changes.outputs.should_run != 'false' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Verify native Alpine artifact and persistence
+        run: |
+          docker run --rm --init -i \
+            -e ORCA_BACKGROUND_LAUNCH=1 \
+            -v "$GITHUB_WORKSPACE:/work" -w /work \
+            node:24-alpine3.23 sh -s <<'BUN_QUALIFICATION'
+          set -eu
+          apk add --no-cache bash git libstdc++ python3 make g++
+          git config --global --add safe.directory /work
+          npm install -g "$(node -p "require('./package.json').packageManager.split('+')[0]")"
+          pnpm install --frozen-lockfile --ignore-scripts
+          pnpm build:orcad
+          pnpm test:bun:profile --artifact
+          BUN_QUALIFICATION

.github/workflows/ci-cache-warmup.yml

@@ -0,0 +1,65 @@
+name: Warm shared CI caches
+
+on:
+  schedule:
+    - cron: '41 * * * *'
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/ci-cache-warmup.yml'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/actions/prepare-git-compatibility/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'config/tsconfig*.json'
+      - 'config/scripts/ensure-native-runtime.mjs'
+      - 'config/scripts/rebuild-native-deps.mjs'
+      - 'config/patches/node-pty@1.1.0.patch'
+      - 'config/patches/@vscode__windows-process-tree@0.8.0.patch'
+      - 'native/windows-registry/**'
+  pull_request:
+    paths:
+      - '.github/workflows/ci-cache-warmup.yml'
+      - '.github/actions/prepare-git-compatibility/**'
+      - 'config/scripts/ci-cache-warmup-workflow.test.mjs'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-cache-warmup-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  warm:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      # Default-branch caches can be restored by every PR; PR caches cannot.
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+          node-version: '24'
+
+      - uses: ./.github/actions/prepare-git-compatibility
+
+      - name: Cache TypeScript incremental state
+        id: typecheck-cache
+        uses: actions/cache@v5
+        with:
+          path: config/*.tsbuildinfo
+          key: tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-${{ github.sha }}
+          restore-keys: |
+            tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-
+
+      - name: Refresh TypeScript state for this commit
+        if: steps.typecheck-cache.outputs.cache-hit != 'true'
+        run: pnpm run typecheck