test(e2e): repair full-suite specs that missed intentional product changes (fork notes)

.github/CONTRIBUTING.md

@@ -21,6 +21,27 @@ Install Node 24, pnpm, and the Bun version in [`config/.bun-version`](../config/
 native PTYs, socket liveness, and V8 memory behavior. `pnpm test:node` runs the same suites
 entirely on Node. Builds and dependency installation still use Node and pnpm.
 
+Use the pnpm version in `packageManager` in [`package.json`](../package.json): `corepack enable`
+needs Corepack 0.34.5 or newer to start the pinned pnpm (`npm install -g corepack@latest`). On
+Windows it writes shims next to `node.exe` and fails with `EPERM` outside an elevated shell when
+Node is in `C:\Program Files\nodejs`; run `npm install -g pnpm@<that version>` instead.
+
+`pnpm install` compiles native modules such as `node-pty` with `node-gyp` and loads them in
+Electron, so a fresh machine also needs:
+
+- **macOS**: Xcode Command Line Tools (`xcode-select --install`).
+- **Windows**: Python 3 and Visual Studio Build Tools with the "Desktop development with C++"
+  workload.
+- **Linux**: a C++ toolchain, Python 3, and the libraries Electron loads even on a headless
+  machine, plus `xvfb`, which the `*.electron.test.ts` files in `pnpm test` use when `DISPLAY` is
+  unset. On Ubuntu 24.04+ and Debian 13+:
+
+  ```bash
+  sudo apt-get update && sudo apt-get install -y build-essential python3 xvfb libgtk-3-0 libnss3 libgbm1 libasound2t64
+  ```
+
+  Older releases name the last package `libasound2`.
+
 ```bash
 pnpm install
 pnpm dev
@@ -175,6 +196,9 @@ pnpm test
 pnpm build
 ```
 
+`pnpm lint` runs independent checks in a bounded pool. Use
+`pnpm lint --maxWorkers=2 --timings` to limit concurrent checks and print their durations.
+
 For repeated local typechecks, use `pnpm tc` (or `pnpm tc:node`, `pnpm tc:web`,
 and `pnpm tc:cli`). On Apple Silicon macOS and x64/arm64 Linux, these use the pinned
 `tsrs` compiler with incremental caches. Keep `.cache/typecheck/` between checks;

.github/pull_request_template.md

@@ -12,15 +12,15 @@
 
 ## Linked Issue
 
-_If you do not have one and are an outside contributors, your PR **wiil** be ignored. Refs is not sufficient. Link an actual issue_
+_If you do not have one and are an outside contributor, your PR **will** be ignored. Refs is not sufficient. Link an actual issue_
 <!-- Link the issue this PR addresses, there should ALWAYS be one (for outside contributors) -->
 <!-- SPECIAL CASE: If you are a maintainer (member of stablyai org) AVOID opening needless issues. Only attach pre-existing ones -->
 
 Fixes #
 
 ## Visual Proof
 
-<!-- REQUIRED for UI / behavior changes. Please attach a BEFORE and AFTER that can easily tabbed/switched. Use videos for when appropriate over screenshots -->
+<!-- REQUIRED for UI / behavior changes. Please attach a BEFORE and AFTER that can easily be tabbed/switched. Use videos for when appropriate over screenshots -->
 <!-- If there is truly no visual or interaction change, write exactly: `N/A` and briefly say why. -->
 <!-- For attachments NEVER add directly to the PR files (do not commit to files), use `gh image` extension or drag + drop (works for any attachment) -->
 
@@ -44,7 +44,7 @@ Fixes #
 
 ## Notes
 
-Ensure no issues in: Security, Cross-platoform support (Linux, Windows, Mac), Remote SSH, Mobile, general backwards compatibility, performance
+Ensure no issues in: Security, Cross-platform support (Linux, Windows, Mac), Remote SSH, Mobile, general backwards compatibility, performance
 
 ## Checklist
 

.github/workflows/adhoc-mac-build.yml

@@ -250,11 +250,19 @@ jobs:
           echo "tag=$TAG" >>"$GITHUB_OUTPUT"
 
   build-adhoc-mac-arch:
-    needs: [resolve-ref, orcad-template-support, release-javascript, prepare-adhoc-mac-release]
-    # Template qualification gates packaging after desktop preparation.
+    needs:
+      [
+        resolve-ref,
+        orcad-template-support,
+        orcad-template,
+        release-javascript,
+        prepare-adhoc-mac-release
+      ]
+    # Start after template qualification: overlapping ~2.5 min of preparation left both 12-vCPU Macs idle ~7 min.
     if: >-
       !cancelled() && github.repository == 'stablyai/orca' &&
       needs.orcad-template-support.result == 'success' &&
+      (needs.orcad-template.result == 'success' || needs.orcad-template-support.outputs.ships != 'true') &&
       needs.release-javascript.result == 'success' &&
       needs.prepare-adhoc-mac-release.result == 'success'
     # Signing environment must restrict deployments to main after MAC_CERTS/password, APPLE_ID/app password/team and hourly App secrets move there; referencing it alone enforces nothing.
@@ -374,30 +382,6 @@ jobs:
           # Leave build identity unset: telemetry accepts only official stable/rc, so branch artifacts stay silent.
           ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
 
-      - name: Wait for the qualified orcad template
-        if: needs.orcad-template-support.outputs.ships == 'true'
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const deadline = Date.now() + 30 * 60_000
-            while (Date.now() < deadline) {
-              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
-                ...context.repo, run_id: context.runId, filter: 'latest', per_page: 100
-              })
-              const lanes = jobs.filter(job => job.name.startsWith('orcad-template / '))
-              const failed = lanes.find(job => job.status === 'completed' &&
-                ['failure', 'cancelled', 'timed_out', 'action_required', 'startup_failure'].includes(job.conclusion))
-              if (failed) throw new Error(`Template qualification failed: ${failed.name}`)
-              const artifacts = await github.paginate(github.rest.actions.listWorkflowRunArtifacts, {
-                ...context.repo, run_id: context.runId, per_page: 100
-              })
-              const ready = artifacts.some(artifact => artifact.name === 'orcad-template' && !artifact.expired)
-              const completed = lanes.length > 0 && lanes.every(job => job.status === 'completed')
-              if (ready && (process.env.WAIT_FOR_TEMPLATE_COMPLETION !== '1' || completed)) return
-              await new Promise(resolve => setTimeout(resolve, 15_000))
-            }
-            throw new Error('Timed out waiting for the qualified orcad template')
-
       # After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
       - name: Download the orcad deployment template
         if: needs.orcad-template-support.outputs.ships == 'true'

.github/workflows/ci-closed-pr-caches.yml

@@ -28,6 +28,7 @@ jobs:
               ['ssh-hostile-hosts', 'ssh-hostile-hosts.yml'],
               ['mobile', 'mobile.yml'],
               ['computer-e2e', 'computer-e2e.yml'],
+              ['computer-macos-native', 'computer-macos-native.yml'],
               ['wsl-orcad-e2e', 'wsl-orcad-e2e.yml'],
               ['performance-contracts', 'performance-contracts.yml'],
               ['pr-test-loc', 'pr-test-loc.yml'],

.github/workflows/computer-e2e.yml

@@ -120,7 +120,7 @@ jobs:
           src/main/runtime/rpc/methods/computer.test.ts
           src/main/runtime/rpc/methods/computer-actions.test.ts
           src/cli/runtime/envelope-schema.test.ts
-          src/shared/remote-runtime-client.test.ts
+          src/shared/remote-runtime/remote-runtime-client.test.ts
       - run: pnpm verify:computer-native
       - run: pnpm build:cli
       - run: pnpm run build:electron-vite:parallel
@@ -134,36 +134,6 @@ jobs:
       - name: Windows daemon workspace-close repro
         if: runner.os == 'Windows'
         run: node config/scripts/windows-daemon-workspace-close-repro.mjs
-  # Hosted macOS runners cannot receive persistent Accessibility/Screen Recording
-  # grants. Keep the real native build/owner-loss checks on every trigger instead.
-  mac-native-owner-smoke:
-    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
-    runs-on: blacksmith-6vcpu-macos-15
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/install-node-dependencies
-        with:
-          native-runtime: electron
-      - name: Owner-loss benchmark process cleanup
-        run: >-
-          pnpm vitest run
-          config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs
-          config/scripts/macos-computer-helper-owner-loss-processes.test.mjs
-      # Why: the parallel launcher's cancellation tests are darwin-only and no
-      # other PR job runs on macOS.
-      - name: Parallel native build launcher cancellation
-        run: >-
-          pnpm vitest run --config config/vitest.config.ts
-          config/scripts/build-native-for-platform.test.mjs
-      - name: Authenticated helper owner-loss smoke
-        run: pnpm bench:macos-computer-helper-owner-loss --expect reaped --trials 1
-      - name: Swift tests and signed universal helper verification
-        run: pnpm verify:computer-native
-
   linux:
     if: github.event_name != 'pull_request'
     runs-on: blacksmith-4vcpu-ubuntu-2204

.github/workflows/computer-macos-native.yml

@@ -0,0 +1,64 @@
+name: Computer-use macOS native
+
+# Split from computer-e2e.yml so CLI/daemon-only PRs skip the paid macOS runner: this job builds the
+# Swift helper and forks out/main/computer-sidecar.js, whose imports never reach src/cli or src/main/daemon.
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
+    paths:
+      - '.github/workflows/computer-macos-native.yml'
+      - 'electron.vite.config.ts'
+      - 'config/build-plugins/**'
+      - 'config/scripts/build-computer-macos.mjs'
+      - 'config/scripts/build-native-for-platform.mjs'
+      - 'config/scripts/build-native-for-platform.test.mjs'
+      - 'config/scripts/pnpm-cli-invocation.mjs'
+      - 'config/scripts/macos-computer-helper-owner-loss-*'
+      - 'config/scripts/verify-computer-native.mjs'
+      - 'native/computer-use-macos/**'
+      - 'native/computer-use-linux/**'
+      - 'native/computer-use-windows/**'
+      - 'skills/computer-use/SKILL.md'
+      - 'src/main/computer/**'
+      - 'src/shared/computer-use-*.ts'
+  workflow_dispatch:
+  schedule:
+    - cron: '0 6 * * *'
+
+concurrency:
+  group: computer-macos-native-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  # Hosted macOS runners cannot receive persistent Accessibility/Screen Recording
+  # grants. Keep the real native build/owner-loss checks on every matching trigger instead.
+  mac-native-owner-smoke:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
+    runs-on: blacksmith-6vcpu-macos-15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: electron
+      - name: Owner-loss benchmark process cleanup
+        run: >-
+          pnpm vitest run
+          config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs
+          config/scripts/macos-computer-helper-owner-loss-processes.test.mjs
+      # Why: the parallel launcher's cancellation tests are darwin-only and no
+      # other PR job runs on macOS.
+      - name: Parallel native build launcher cancellation
+        run: >-
+          pnpm vitest run --config config/vitest.config.ts
+          config/scripts/build-native-for-platform.test.mjs
+      - name: Authenticated helper owner-loss smoke
+        run: pnpm bench:macos-computer-helper-owner-loss --expect reaped --trials 1
+      - name: Swift tests and signed universal helper verification
+        run: pnpm verify:computer-native

.github/workflows/e2e.yml

@@ -382,6 +382,9 @@ jobs:
             exit 0
           fi
           E2E_ENV=(SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1)
+          if printf '%s\n' "${TEST_FILES[@]}" | grep -Fxq 'tests/e2e/browser-image-link-focus.spec.ts'; then
+            E2E_ENV+=(ORCA_BACKGROUND_LAUNCH=1 ORCA_E2E_BROWSER_NATIVE_XVFB=1)
+          fi
           E2E_PROJECT_ARGS=()
           if [ -n "$LAYOUT_OWNER" ]; then
             test -f out/main/ORCA_LAYOUT_OWNER_MAIN

.github/workflows/macos-updater-tests.yml

@@ -15,6 +15,10 @@ on:
       - 'src/main/window/main-window-state-lifecycle*'
       - 'src/main/window/dashboard-popout-window*'
       - 'src/packages/process-host/**'
+      - 'src/main/runtime/structured-agent-cli-writers*'
+      - 'src/main/providers/macos-tcc-login-shell*'
+      - 'src/shared/process-table-snapshot*'
+      - 'src/shared/darwin-process-table-capture*'
       - 'src/shared/update-status-types.ts'
       - 'pnpm-lock.yaml'
   workflow_dispatch:
@@ -29,7 +33,7 @@ concurrency:
 jobs:
   updater:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
-    runs-on: blacksmith-6vcpu-macos-15
+    runs-on: macos-15
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
@@ -55,3 +59,8 @@ jobs:
           src/main/startup/main-process-quit-update-veto.test.ts
           src/main/window/main-window-state-lifecycle.test.ts
           src/main/window/dashboard-popout-window.test.ts
+      - name: Prove login-backed terminal writer census on the disposable runner
+        env:
+          ORCA_MACOS_LOGIN_CENSUS_CI: '1'
+          ORCA_BACKGROUND_LAUNCH: '1'
+        run: pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/structured-agent-cli-writers.test.ts

.github/workflows/node-server-tests.yml

@@ -153,9 +153,10 @@ jobs:
       fail-fast: false
       matrix:
         os: ${{ fromJSON(needs.changes.outputs.runners || '["ubuntu-22.04","ubuntu-24.04-arm","macos-15","macos-15-intel","windows-2022","windows-11-arm"]') }}
-    # Keep platform keys stable for slot names and Windows cross-compilation.
+    # Keep platform keys stable for slot names and Windows cross-compilation. Hosted Windows x64 is free and
+    # still finishes before the windows-11-arm and macos-15-intel lanes that set wall time.
     runs-on: >-
-      ${{ (inputs.fast_runners || github.event_name == 'pull_request' || github.event_name == 'schedule') && fromJSON('{"ubuntu-22.04":"blacksmith-8vcpu-ubuntu-2204","ubuntu-24.04-arm":"blacksmith-8vcpu-ubuntu-2404-arm","macos-15":"blacksmith-6vcpu-macos-15","macos-15-intel":"macos-15-intel","windows-2022":"blacksmith-8vcpu-windows-2025","windows-11-arm":"windows-11-arm"}')[matrix.os] || matrix.os }}
+      ${{ (inputs.fast_runners || github.event_name == 'pull_request' || github.event_name == 'schedule') && fromJSON('{"ubuntu-22.04":"blacksmith-8vcpu-ubuntu-2204","ubuntu-24.04-arm":"blacksmith-8vcpu-ubuntu-2404-arm","macos-15":"blacksmith-6vcpu-macos-15","macos-15-intel":"macos-15-intel","windows-2022":"windows-2022","windows-11-arm":"windows-11-arm"}')[matrix.os] || matrix.os }}
     timeout-minutes: 20
     env:
       ORCA_BACKGROUND_LAUNCH: '1'

.github/workflows/pr.yml

@@ -80,6 +80,7 @@ jobs:
             /config/scripts/pr-package-test-paths.mjs
             /config/scripts/pr-layout-oracle-route.mjs
             /config/scripts/pr-e2e-source-routing.mjs
+            /config/scripts/pr-browser-e2e-source-routes.mjs
             /config/scripts/ci-e2e-job-selection.mjs
             /config/scripts/pr-ready-check-reuse.mjs
           sparse-checkout-cone-mode: false
@@ -1089,10 +1090,7 @@ jobs:
           xvfb-run --auto-servernum pnpm exec vitest run --config config/vitest.config.ts
           --no-file-parallelism
           src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts
-          src/main/browser/browser-route-tcp-egress.electron.test.ts
           src/main/browser/browser-route-webrtc-egress.electron.test.ts
-          src/main/browser/browser-route-h3-egress.electron.test.ts
-          src/main/browser/browser-route-dns-prefetch.electron.test.ts
           src/main/persistence/profile-state/profile-state-writer-stall.electron.test.ts
           src/main/browser/popup-origin-chrome.electron.test.ts
           src/main/browser/browser-link-materialization.electron.test.ts

.github/workflows/windows-signing-rehearsal.yml

@@ -17,14 +17,28 @@ on:
         default: windows-inner-binaries-zip
 
 jobs:
+  # Ship the same qualified template as release-cut so the reseal over SignPath-rewritten binaries is rehearsed too.
+  orcad-template:
+    permissions:
+      contents: read
+      actions: read
+    uses: ./.github/workflows/qualified-orcad-template.yml
+    with:
+      ref: ${{ github.sha }}
+      # SignPath origin verification covers reusable-workflow jobs, so they stay GitHub-hosted.
+      fast_runners: false
+
   rehearse:
+    needs: orcad-template
     # Why: SignPath origin verification requires GitHub-hosted runners, and
     # windows-2022 matches the real release job's build environment.
     runs-on: windows-2022
     timeout-minutes: 360
     permissions:
       actions: read
       contents: read
+    env:
+      ORCA_REQUIRE_ORCAD_TEMPLATE: '1'
 
     steps:
       - name: Checkout
@@ -79,6 +93,13 @@ jobs:
         env:
           NODE_OPTIONS: --max-old-space-size=4096
 
+      # After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
+      - name: Download the orcad deployment template
+        uses: actions/download-artifact@v8
+        with:
+          name: orcad-template
+          path: out/orcad-template
+
       # Build full --win: --dir never creates the NSIS uninstaller needed for MDE evidence.
       - name: Package Windows app and export the NSIS uninstaller
         shell: pwsh
@@ -111,6 +132,11 @@ jobs:
             Where-Object { $_.Extension -in '.exe', '.dll', '.node' } |
             ForEach-Object {
               $relative = [System.IO.Path]::GetRelativePath($root, $_.FullName)
+              # The orcad template's Linux/macOS addons are data for SSH hosts, not PE files.
+              if ($relative -match '^resources[\\/]orcad-template[\\/]targets[\\/](?!win32-)') {
+                $skipped.Add("$relative  <non-Windows orcad template payload>")
+                return
+              }
               $signature = Get-AuthenticodeSignature -FilePath $_.FullName
               if ($signature.Status -eq 'Valid') {
                 $skipped.Add("$relative  <already signed: $($signature.SignerCertificate.Subject)>")
@@ -214,6 +240,10 @@ jobs:
             throw "Signed inner artifact did not round-trip cleanly ($($failures.Count) failures)."
           }
 
+      # Recompute template checksums over the signed bytes, then verify the template as release-cut does.
+      - name: Reseal the orcad template over its signed binaries
+        run: node config/scripts/packaged-orcad-template.cjs --reseal-signed dist/win-unpacked inner-signing-list.txt
+
       - name: Restore signed uninstaller for the installer rebuild
         shell: pwsh
         env: