Sync upstream 21e26de45 (conflicts)

.gitattributes

@@ -7,5 +7,6 @@
 /config/scripts/verify-cli-bin.mjs text eol=lf
 /config/scripts/verify-release-required-assets.mjs text eol=lf
 /skill-guides/*.md text eol=lf
+/skill-stubs/*.md text eol=lf
 /skills/*/SKILL.md text eol=lf
 /src/cli/bundled-skill-guides.ts text eol=lf

.github/workflows/computer-e2e.yml

@@ -75,8 +75,12 @@ jobs:
           npm install -g node-gyp@11.5.0
           echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV"
       - run: pnpm install --frozen-lockfile
+      # Why: without --config, bare vitest ignores config/vitest.config.ts (there
+      # is no root config) and falls back to the 5s default timeout with no
+      # Windows worker cap, so the real csc.exe launcher-compile tests time out
+      # on hosted Windows. Use the shared config so this job matches pnpm test.
       - run: >-
-          pnpm vitest run
+          pnpm vitest run --config config/vitest.config.ts
           config/scripts/build-windows-cli-launcher.test.mjs
           src/main/ssh/ssh-remote-cli-launcher.test.ts
           config/scripts/computer-e2e-workflow.test.mjs

.github/workflows/pr.yml

@@ -15,6 +15,11 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          # Why: the freshness registry is derived from immutable release tags,
+          # so shallow PR checkouts cannot verify historical official identities.
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Install native build tools
         run: sudo apt-get update && sudo apt-get install -y build-essential python3 zlib1g-dev zsh
@@ -82,6 +87,9 @@ jobs:
       - name: Verify bundled skill guides
         run: pnpm run verify:bundled-skill-guides
 
+      - name: Verify skill freshness manifest
+        run: pnpm run verify:skill-bundle-manifest
+
       # Why: project-owned type declarations must live in .ts so tsc
       # actually checks them. TypeScript's skipLibCheck: true (inherited
       # from @electron-toolkit/tsconfig) silently widens unresolved names

.github/workflows/skill-update-roundtrip.yml

@@ -0,0 +1,50 @@
+name: Skill update round trip
+
+on:
+  pull_request:
+    paths:
+      - 'skills/**'
+      - 'resources/skills/**'
+      - 'config/scripts/verify-skill-update-roundtrip.mjs'
+      - 'src/main/skills/skill-freshness-eligibility.ts'
+      - 'src/shared/skill-freshness.ts'
+      - '.github/workflows/skill-update-roundtrip.yml'
+  merge_group:
+  push:
+    branches:
+      - main
+
+jobs:
+  roundtrip:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, ubuntu-latest, windows-latest]
+        shape: [symlink, copy]
+        autocrlf: ['false', 'true']
+        skills-cli: ['1.5.17']
+        include:
+          - os: ubuntu-latest
+            shape: symlink
+            autocrlf: 'false'
+            skills-cli: latest
+    continue-on-error: ${{ matrix.skills-cli == 'latest' }}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+      - name: Verify targeted update convergence and copy behavior
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          SKILL_UPDATE_SOURCE: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          SKILL_UPDATE_REF: ${{ github.head_ref || github.ref_name }}
+        run: >-
+          node config/scripts/verify-skill-update-roundtrip.mjs
+          --cli=${{ matrix.skills-cli }}
+          --autocrlf=${{ matrix.autocrlf }}
+          --shape=${{ matrix.shape }}

.github/workflows/win-crash-survival-e2e.yml

@@ -0,0 +1,195 @@
+name: Windows Crash-Survival E2E
+
+# Why: proves the detached daemon-host relocation makes terminal sessions SURVIVE
+# a CRASH of Orca's main process (GitHub #7742), the companion guarantee to the
+# update-survival harness. Builds an (unsigned) installer FROM THIS BRANCH,
+# silent-installs it, opens a terminal, force-kills ONLY the app main (no
+# tree-kill), and asserts the daemon + shell stay alive, a relaunch adopts the
+# same daemon and shell, and post-crash input causes no pwsh FailFast. Targeted
+# pull requests keep it as a durable regression gate. A CI runner is the only
+# safe place to install — see the relocation post-mortem.
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+    paths:
+      - '.github/workflows/win-crash-survival-e2e.yml'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'electron.vite.config.ts'
+      - 'build-plugins/**'
+      - 'config/electron-builder.config.cjs'
+      - 'config/patches/**'
+      - 'config/scripts/ensure-native-runtime.mjs'
+      - 'config/scripts/rebuild-native-deps.mjs'
+      - 'native/**'
+      - 'resources/win32/**'
+      - 'src/main/daemon/**'
+      - 'src/main/index.ts'
+      - 'src/main/ipc/pty*.ts'
+      - 'src/main/persistence.ts'
+      - 'src/main/providers/**'
+      - 'src/main/pty/**'
+      - 'src/main/startup/first-window-startup-services.ts'
+      - 'src/main/window/attach-main-window-services.ts'
+      - 'src/preload/**'
+      - 'src/renderer/src/App.tsx'
+      - 'src/renderer/src/components/terminal-pane/**'
+      - 'src/renderer/src/hooks/useIpcEvents.ts'
+      - 'src/renderer/src/lib/pane-manager/**'
+      - 'src/renderer/src/lib/session-write-subscriber.ts'
+      - 'src/renderer/src/lib/workspace-session-host-persistence.ts'
+      - 'src/renderer/src/store/slices/terminals.ts'
+      - 'src/shared/pty-session-id-format.ts'
+      - 'tools/win-crash-survival-e2e/**'
+      - 'tools/win-update-e2e/**'
+      # Why: source tests and benchmarks do not change the packaged artifact;
+      # their own verify jobs cover them without spending a Windows build slot.
+      - '!src/**/*.test.*'
+      - '!src/**/*.bench.*'
+  workflow_dispatch:
+    inputs:
+      expect:
+        description: Expected outcome profile
+        required: true
+        type: choice
+        default: survival
+        options:
+          - survival
+          - orphaned
+
+permissions:
+  contents: read
+
+concurrency:
+  group: win-crash-survival-e2e-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  crash-survival:
+    name: crash-survival (packaged build)
+    runs-on: windows-2022
+    timeout-minutes: 50
+    env:
+      EXPECT: ${{ inputs.expect || 'survival' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          # This job only builds and runs the harness locally; it never pushes.
+          persist-credentials: false
+
+      # Why: setup-node can restore pnpm's content-addressed store only after
+      # the pnpm binary exists, avoiding repeat dependency downloads per run.
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # Why: cache the built installer by production build inputs, excluding
+      # tests/reliability metadata so harness-only edits skip electron-builder.
+      # The daemon relocation lives under src/, so product changes still rebuild.
+      - name: Cache branch installer
+        id: cache-installer
+        uses: actions/cache@v4
+        with:
+          path: dist/orca-windows-setup.exe
+          key: >-
+            crash-survival-installer-${{ hashFiles(
+              'src/**',
+              '!src/**/*.test.*',
+              '!src/**/*.bench.*',
+              'config/**',
+              '!config/**/*.test.*',
+              '!config/reliability-gates.jsonc',
+              '!config/max-lines-baseline.txt',
+              '!config/vitest.config.ts',
+              'build-plugins/**',
+              'native/**',
+              'resources/**',
+              'electron.vite.config.ts',
+              'tsconfig.json',
+              'vite.web.config.ts',
+              '.npmrc',
+              'package.json',
+              'pnpm-lock.yaml',
+              'pnpm-workspace.yaml'
+            ) }}
+
+      # Why: production edits miss the installer cache by design, but Electron
+      # and NSIS downloads are lockfile-owned and need not be fetched again.
+      - name: Cache electron-builder downloads
+        if: steps.cache-installer.outputs.cache-hit != 'true'
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~\AppData\Local\electron\Cache
+            ~\AppData\Local\electron-builder\Cache
+          key: crash-survival-electron-builder-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            crash-survival-electron-builder-
+
+      - name: Build Windows installer (unsigned)
+        if: steps.cache-installer.outputs.cache-hit != 'true'
+        run: |
+          node config/scripts/ensure-native-runtime.mjs --runtime=electron
+          pnpm run build:desktop
+          pnpm exec electron-builder --config config/electron-builder.config.cjs --win --publish never
+
+      # Why: silent-install the branch build so the crash harness has a packaged
+      # Orca.exe to drive. A clean CI runner installs to the default per-user
+      # location (%LOCALAPPDATA%\Programs\Orca), which the harness auto-locates.
+      - name: Silent-install branch build
+        shell: pwsh
+        run: |
+          $exe = "dist/orca-windows-setup.exe"
+          if (-not (Test-Path $exe)) { throw "Installer not found at $exe" }
+          Start-Process -FilePath $exe -ArgumentList '/S' -Wait
+          $installed = Join-Path $env:LOCALAPPDATA 'Programs/Orca/Orca.exe'
+          if (-not (Test-Path $installed)) {
+            $installed = Join-Path $env:LOCALAPPDATA 'Programs/orca/Orca.exe'
+          }
+          if (-not (Test-Path $installed)) { throw "Installed Orca.exe not found after silent install" }
+          "ORCA_EXE=$installed" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
+      # Why: crash ONLY the app main and assert the relocated daemon + its shell
+      # survive, then that relaunch adopts them and input causes no pwsh FailFast.
+      - name: Run crash-survival harness
+        id: harness
+        shell: pwsh
+        env:
+          ORCA_E2E_DIAG_DIR: artifacts/diag
+        run: |
+          New-Item -ItemType Directory -Force artifacts | Out-Null
+          $log = "artifacts/crash-survival-output.log"
+          node tools/win-crash-survival-e2e/run.mjs `
+            --expect "$env:EXPECT" `
+            --exe-path "$env:ORCA_EXE" `
+            --soak-seconds 8 2>&1 | Tee-Object -FilePath $log
+          exit $LASTEXITCODE
+
+      - name: Upload crash-survival output
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: win-crash-survival-output
+          path: |
+            artifacts/crash-survival-output.log
+            artifacts/diag/**
+          retention-days: 7
+          if-no-files-found: warn

.github/workflows/windows-terminal-restart-e2e.yml

@@ -0,0 +1,103 @@
+name: Windows terminal restart E2E
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+    paths:
+      - '.github/workflows/windows-terminal-restart-e2e.yml'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'electron.vite.config.ts'
+      - 'config/patches/**'
+      - 'config/scripts/ensure-native-runtime.mjs'
+      - 'config/scripts/rebuild-native-deps.mjs'
+      - 'tests/playwright.config.ts'
+      - 'tests/e2e/global-setup.ts'
+      - 'tests/e2e/global-teardown.ts'
+      - 'tests/e2e/helpers/**'
+      - 'tests/e2e/restart-restore-terminal-input.spec.ts'
+      - 'tests/e2e/restored-terminal-input-readiness.unit.test.ts'
+      - 'tests/e2e/terminal-probe-input-sequence.ts'
+      - 'tests/e2e/terminal-probe-input-sequence.unit.test.ts'
+      - 'tests/e2e/terminal-restart-persistence.spec.ts'
+      - 'src/main/daemon/**'
+      - 'src/main/ipc/pty*.ts'
+      - 'src/main/providers/**'
+      - 'src/main/pty/**'
+      - 'src/preload/**'
+      - 'src/renderer/src/components/terminal-pane/**'
+      - 'src/renderer/src/lib/pane-manager/**'
+      - 'src/shared/pty-session-id-format.ts'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Ref to check out
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: windows-terminal-restart-e2e-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  windows-terminal-restart:
+    name: Windows terminal restart regressions
+    runs-on: windows-2022
+    timeout-minutes: 30
+    env:
+      NODE_OPTIONS: --max-old-space-size=4096
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false
+
+      # Why: pnpm must exist before setup-node resolves its dependency cache.
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build Electron app for Windows E2E
+        run: pnpm exec electron-vite build --mode e2e
+
+      - name: Run Windows terminal restart regressions
+        env:
+          SKIP_BUILD: '1'
+          ORCA_E2E_FORWARD_APP_LOGS: '1'
+          ORCA_REQUIRE_WINDOWS_TERMINAL_RESTART_E2E: '1'
+        # Why: pnpm forwards a literal `--` to Playwright, which makes the
+        # grep and worker flags positional filters instead of CLI options.
+        run: >-
+          pnpm run test:e2e
+          tests/e2e/restart-restore-terminal-input.spec.ts
+          tests/e2e/terminal-restart-persistence.spec.ts
+          --grep "clean restart with a live daemon session|cold-restored pane accepts typing|daemon snapshot relaunch preserves"
+          --workers=1
+
+      - name: Upload Playwright traces
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows-terminal-restart-playwright-traces
+          path: test-results/
+          retention-days: 7
+          if-no-files-found: ignore