sync: upstream stablyai/orca bd2f4635 (2026-10-26)

.gitattributes

@@ -1,6 +1,4 @@
-# A shebang plus CRLF makes vite's SSR transform emit a literal `#!` mid-module,
-# so any suite importing the script dies at load with a SyntaxError. Pin the whole
-# directory rather than the scripts that happen to have a test today.
+# CRLF shebangs break Vite's SSR transform.
 /config/scripts/**/*.mjs text eol=lf
 /skill-guides/*.md text eol=lf
 /skill-stubs/*.md text eol=lf
@@ -15,55 +13,33 @@
 *.html text eol=lf
 # Bundled plugin trees are byte-hashed; CRLF checkout would break the pinned hash.
 /resources/plugins/** text eol=lf
-# Relay assets are copied verbatim into the bundle and hashed byte-for-byte into
-# .version, which names the immutable remote install dir. A CRLF checkout makes a
-# Windows-built client disagree with a mac/Linux-built one on the same release,
-# so one host ends up with two relay trees (#17886 review).
-# Pin the bytes so a patch reads and diffs identically on every host. It is NOT
-# what makes the hash right: pnpm hashes a patch LF-normalized, so a CRLF checkout
-# cannot change it. Believing otherwise put a hand-computed raw digest in the
-# lockfile twice and broke every install (#17886).
-# These files are stored LF, which is not always the encoding they were written
-# against -- @vscode/windows-process-tree ships CRLF sources -- so any code that
-# runs `git apply` on one must force `-c core.autocrlf=input` rather than trust
-# the host's setting. See config/scripts/windows-process-tree-gyp-rebuild.mjs.
+# Keep patch diffs stable; pnpm hashes them with LF normalization.
+# CRLF upstream sources still need git -c core.autocrlf=input apply (windows-process-tree-gyp-rebuild.mjs).
 /config/patches/*.patch -text
-# Same reason, and pnpm parses these too: a CRLF checkout makes the mobile
-# patches unparseable, so Windows packaging dies on ERR_PNPM_INVALID_PATCH.
+# CRLF patches fail pnpm parsing on Windows.
 /mobile/patches/*.patch -text
-# The xterm bundle hunks also make a diff nobody can read; review the hand-written
-# source patch under xterm-src/ instead. The sibling patches stay diffable.
+# Review xterm-src/ instead of generated bundle hunks.
 /config/patches/@xterm__xterm@*.patch -diff
 /config/patches/xterm-src/*.patch text eol=lf
 # pnpm parses these unified diffs during Windows installs; keep checkout bytes stable.
 /mobile/patches/*.patch -text
-# Generated wrapper fixtures: collapse them in the PR diff so they stop drowning
-# the reviewable change, and pin LF because they are compared byte-for-byte.
-# Not -diff: the shell diff is the review surface when a wrapper does change.
+# Collapse generated wrappers but keep diffs available; tests compare LF bytes.
 /src/main/__fixtures__/shell-wrapper-snapshots/*.txt linguist-generated=true text eol=lf
-# Captured agent PTY transcripts. -text, not `text eol=lf` like the wrapper snapshots above:
-# these carry real CR and CRLF bytes as the terminal emitted them, and line-ending
-# normalisation on a Windows checkout would rewrite the evidence the fixture exists to be.
+# PTY transcripts must retain captured CR and CRLF bytes.
 /src/main/runtime/__fixtures__/*.txt -text
 /src/main/daemon/__fixtures__/pty-transcripts/*.txt -text
 /src/renderer/src/components/terminal-pane/terminal-link-transcripts/*.txt -text whitespace=cr-at-eol
-# Generated runtime English subset: compared byte-for-byte by
-# verify:localization-runtime-catalog, so a CRLF checkout would fail the gate.
+# verify:localization-runtime-catalog compares LF bytes.
 /src/renderer/src/i18n/en-runtime-required.json linguist-generated=true text eol=lf
-# Generated method->params catalog: compared byte-for-byte by
-# verify:rpc-params-catalog, so a CRLF checkout would fail the gate.
+# verify:rpc-params-catalog compares LF bytes.
 /src/shared/rpc-contract/rpc-params-catalog.generated.ts linguist-generated=true text eol=lf
-# Mobile RPC recording goldens: replay requires the file text to equal what rpc:record writes
-# (LF), so a CRLF checkout would fail every golden.
+# RPC recording goldens must match rpc:record's LF output.
 /mobile/rpc-foundation/goldens/*.json text eol=lf
-# Mobile web page source. Every text byte here is hashed into an asset digest and from
-# there into buildId, so a CRLF Windows checkout would ship a different bundle id for
-# identical source (91af2897 vs 9d78435e, measured on the bundle this replaced).
+# Mobile build IDs hash source bytes; checkout line endings must match across hosts.
 /mobile/src/** text eol=lf
 /mobile/app/** text eol=lf
 /mobile/web-entry/** text eol=lf
-# The blanket pin above would mark a future binary as text; exempt the asset types an
-# RN page actually carries.
+# Preserve binary assets under the text-pinned mobile directories.
 /mobile/src/**/*.png -text
 /mobile/src/**/*.jpg -text
 /mobile/src/**/*.jpeg -text

.github/CODEOWNERS

@@ -1,10 +1,8 @@
-# Product source remains owned by its normal reviewers; localization inputs need focused review.
 /src/renderer/src/i18n/locales/ @brennanb2025
 /config/scripts/*localization*.mjs @brennanb2025
 /config/scripts/*locale*.mjs @brennanb2025
 /config/i18next.config.ts @brennanb2025
 
-# The relay's deploy and operate surface: workspace, workflows, and the rollout lease action.
 /cloud/ @Jinwoo-H
 /.github/workflows/cloud-*.yml @Jinwoo-H
 /.github/actions/cloud-sql-rollout-lease/ @Jinwoo-H

.github/actions/cloud-sql-rollout-lease/gcloud-access-token.mjs

@@ -1,17 +1,6 @@
 import { execFileSync } from 'node:child_process'
 
-// DESIGN CHOICE: shell out to `gcloud auth print-access-token` instead of exchanging the
-// external_account credentials file that google-github-actions/auth writes.
-//
-// Every workflow on the Cloud SQL rollout lease already runs google-github-actions/setup-gcloud
-// right after auth (verified across all 11 mutating members), so gcloud is on PATH and already
-// bound to the federated identity. Doing the exchange ourselves would mean reimplementing the STS
-// token swap plus the service-account impersonation leg, in an action that must stay
-// zero-dependency and is duplicated by hand into a second repo. gcloud already handles every ADC
-// flavour and refreshes on its own. The metadata server is not an option: it does not exist on
-// GitHub or Blacksmith runners.
-//
-// Consequence, documented in the README: the lease step MUST come after setup-gcloud.
+// Use gcloud after setup-gcloud: it handles federated STS/impersonation and ADC refresh without dependencies or repo-local code in this duplicated action. Actions/Blacksmith runners have no metadata server.
 
 const TOKEN_REUSE_MS = 40 * 60 * 1_000 // GCP access tokens live ~60 min; re-mint well before that.
 

.github/actions/cloud-sql-rollout-lease/holder-identity.mjs

@@ -1,5 +1,4 @@
-// Who we claim to be on the lease object. Shared by main and the detached renewer so both agree
-// on the holder key without re-deriving it from a different set of environment variables.
+// Main and detached renewer must derive the same holder key from one environment contract.
 
 export function holderIdentity(explicitHolderKey) {
   const repository = process.env.GITHUB_REPOSITORY ?? 'unknown'

.github/actions/cloud-sql-rollout-lease/renew.mjs

@@ -3,8 +3,7 @@ import { createAccessTokenSource } from './gcloud-access-token.mjs'
 import { renewerLogPath } from './runner-state.mjs'
 import { CloudSqlRolloutLease, RENEW_INTERVAL_MS } from './storage-lease.mjs'
 
-// Detached renewer. `main` spawns it, `post` kills it. It rewrites expires_at on the same
-// generation-matched path as acquisition, and stops the moment the object stops being ours.
+// Detached renewer shares acquisition’s generation-matched writes; stop when ownership changes. Main starts it and post kills it.
 
 const MAX_LIFETIME_MS = 6 * 60 * 60 * 1_000 // Backstop if post never runs (runner killed).
 

.github/actions/cloud-sql-rollout-lease/runner-state.mjs

@@ -1,7 +1,6 @@
 import { appendFileSync } from 'node:fs'
 
-// Action-state and output plumbing via the runner's file protocol, so the action needs no
-// @actions/core dependency. Values are single-line by construction; anything else is rejected.
+// Use runner files without @actions/core; reject multiline values rather than corrupting their protocol.
 
 /** The detached renewer's stdio is ignored, so it appends here instead and `post` echoes it. */
 export function renewerLogPath() {

.github/actions/cloud-sql-rollout-lease/storage-lease.mjs

@@ -1,10 +1,4 @@
-// Compare-and-swap lease over a single Cloud Storage object.
-//
-// Ported from apps/relay-fence-broker/src/mutation-lease.ts rather than imported: this action is
-// duplicated verbatim into stablyai/orca, so it must carry no repo-local imports. Only the
-// algorithm is shared (read metadata -> write with ifGenerationMatch -> 412 is a conflict ->
-// generation-matched delete -> an expired record is free). The broker's token path is NOT shared;
-// it reads the GCE metadata server, which does not exist on Actions runners.
+// Ported CAS algorithm from relay-fence-broker/mutation-lease.ts: keep repo-local imports out of this duplicated action. Broker metadata-server tokens cannot work on Actions runners; use generation-matched writes/deletes, 412 conflicts and expiry.
 
 export const LEASE_TTL_MS = 35 * 60 * 1_000
 export const RENEW_INTERVAL_MS = 5 * 60 * 1_000

.github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs

@@ -12,10 +12,7 @@ const BUCKET = 'onorca-cloud-terraform-state'
 const OBJECT = 'terraform/state/cloud-sql-rollout/production.lock'
 const NOW = 1_756_000_000_000
 
-/**
- * Enough of the Cloud Storage JSON API to exercise real compare-and-swap semantics: generations
- * increment, ifGenerationMatch is enforced, and a mismatch is a 412. `faults` injects failures.
- */
+/** Model real GCS generation increments, ifGenerationMatch and 412 conflicts; faults inject failures. */
 function fakeStorage({ object = null, faults = [] } = {}) {
   const state = { object, requests: [] }
   const fetcher = async (rawUrl, init = {}) => {

.github/actions/install-mobile-dependencies/action.yml

@@ -4,12 +4,7 @@ description: Frozen pnpm install for the mobile/ project, whose node_modules the
 runs:
   using: composite
   steps:
-    # Why a separate install: mobile is its own pnpm project, so the root install leaves
-    # mobile/node_modules empty and every mobile import resolves to nothing.
-    # Why no --ignore-scripts, unlike the root install: mobile's postinstall generates the
-    # gitignored terminal/mermaid webview engine modules that tracked source imports.
-    # The drift guard mirrors the root install so a stale mobile lockfile fails by name --
-    # mobile's lockfile carries patchedDependencies that a silent rewrite would drop.
+    # Install the separate mobile project: root install leaves its imports unresolved. Keep lifecycle scripts for generated terminal/mermaid engines; reject lockfile drift that could drop patchedDependencies.
     - name: Install mobile dependencies
       shell: bash
       working-directory: mobile

.github/actions/install-node-dependencies/action.yml

@@ -222,10 +222,7 @@ runs:
           rm -rf node_modules
         fi
 
-    # Why --frozen-lockfile: re-resolving pulls ~62 MB of registry packuments per job
-    # (measured) to recompute what the lockfile already pins, and the `git diff` guard
-    # below fails the run whenever that recomputation would have changed anything. The
-    # guard stays so a stale lockfile still fails by name rather than by resolver error.
+    # Frozen install avoids ~62MB/job of redundant resolution; retain diff guard to name stale lockfiles explicitly.
     - name: Install dependencies
       shell: bash
       run: |

.github/actions/install-signpath-module/action.yml

@@ -29,13 +29,7 @@ runs:
         # Why: force TLS 1.2 so gallery downloads work on older hosted images.
         [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
 
-        # Why: on some hosted Windows images `Register-PSRepository -Default`
-        # fails inside the legacy nuget.exe provider with "Missing option value
-        # for: '-source'", so PSGallery is never registered and the install
-        # below dies with "No repository with the name 'PSGallery'". PSResourceGet
-        # (bundled with PowerShell 7.4+) has PSGallery registered by default and
-        # avoids that code path, so prefer it and fall back to PowerShellGet only
-        # when it is absent.
+        # Prefer PSResourceGet (PowerShell 7.4+): legacy nuget Register-PSRepository can fail with “Missing option value for: -source” and leave PSGallery absent.
         $useResourceGet = $null -ne (Get-Command -Name Install-PSResource -ErrorAction SilentlyContinue)
 
         try {
@@ -53,9 +47,7 @@ runs:
             Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
           }
         } catch {
-          # Why: repository registration also talks to the gallery, so a gallery
-          # outage can fail here before a single install is attempted. The CDN
-          # fallback below does not need a registered repository, so keep going.
+          # Repository registration can fail during gallery outages; continue so the independent CDN fallback remains reachable.
           Write-Warning "PSGallery repository registration failed: $_"
         }
 
@@ -114,13 +106,8 @@ runs:
           }
         }
 
-        # Why: the gallery's package API (OData search + repository metadata) sits
-        # behind Azure Front Door and has returned 403/502/504 for every install
-        # attempt during gallery incidents, which hard-failed the whole Windows
-        # release job. The CDN that serves the nupkg itself is a separate origin
-        # and stays up through those incidents, so fall back to a pinned version
-        # fetched straight from it. The hash pin is mandatory: this route skips the
-        # gallery's package validation, so an unexpected payload must fail loudly.
+        # Gallery OData/metadata has returned 403/502/504 while the independent nupkg CDN stayed up.
+        # Fall back to a pinned version and mandatory hash because this bypasses gallery validation.
         if (-not $installed) {
           $version = $env:SIGNPATH_FALLBACK_VERSION
           $expectedHash = $env:SIGNPATH_FALLBACK_SHA256
@@ -131,9 +118,7 @@ runs:
             Remove-Item -LiteralPath $nupkg -Force
           }
 
-          # Why two URLs: the /api/v2/package route 302s to the CDN and can serve
-          # while the OData search endpoint is failing; the CDN URL is the same
-          # redirect target reached directly when the api host is down entirely.
+          # Try the API’s CDN redirect, then the CDN directly if the API host is down.
           $sources = @(
             "https://www.powershellgallery.com/api/v2/package/SignPath/$version",
             "https://cdn.powershellgallery.com/packages/signpath.$version.nupkg"
@@ -173,9 +158,7 @@ runs:
           }
 
           Remove-SignPathModuleDirectory
-          # Why a version-named subdirectory: PowerShell only treats a nested folder
-          # as a side-by-side module version when the name matches the manifest's
-          # ModuleVersion, which is what makes `Import-Module SignPath` resolve it.
+          # PowerShell resolves side-by-side modules only when the directory matches the manifest’s ModuleVersion.
           $versionRoot = Join-Path -Path $signPathModulePath -ChildPath $version
           New-Item -ItemType Directory -Path $versionRoot -Force | Out-Null
           Expand-Archive -LiteralPath $nupkg -DestinationPath $versionRoot -Force

.github/dependabot.yml

@@ -1,7 +1,6 @@
 version: 2
 updates:
-  # Why only ripgrep: the bundled rg ships in every artifact and to SSH remotes, and a bump is a
-  # one-line pin change (the SSH cache keys on the binary's hash). Other dependencies stay manual.
+  # Automate only bundled ripgrep’s single pin; its hash invalidates SSH cache. Other dependency updates stay manual.
   - package-ecosystem: npm
     directory: /
     schedule:

.github/scripts/check-root-directory-entries.mjs

@@ -2,10 +2,7 @@ import { execFileSync } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
 
 function readRootEntries(sha) {
-  // Why: a git pathname is arbitrary bytes, and 'utf8' folds every invalid
-  // sequence to U+FFFD — that mangles the reported name and makes two different
-  // entries compare equal, so a genuinely new one can slip past the Set below.
-  // latin1 maps each byte to one code unit, so the bytes survive the round trip.
+  // Git paths are arbitrary bytes; latin1 round-trips them while utf8 merges invalid sequences into U+FFFD, hiding distinct entries.
   const stdout = execFileSync('git', ['ls-tree', '-z', '--name-only', sha], {
     encoding: 'latin1',
     stdio: ['ignore', 'pipe', 'inherit']
@@ -42,10 +39,7 @@ function checkRootDirectoryEntries(argv) {
   )
   console.log('Move each new entry under an existing top-level directory.')
   console.log('Blocked entries:')
-  // Why: an entry name is attacker-controlled and may start with '::' (the runner
-  // trims leading spaces before matching) or embed a newline, so printing it bare
-  // lets a PR forge annotations. Fence the untrusted list with an unguessable
-  // stop-commands token, and write the raw bytes rather than a re-encoded string.
+  // Untrusted names can forge runner commands/newlines; fence them with a random stop-commands token and preserve raw bytes.
   const resumeToken = randomUUID()
   console.log(`::stop-commands::${resumeToken}`)
   for (const entry of blockedEntries) {
@@ -56,12 +50,10 @@ function checkRootDirectoryEntries(argv) {
 }
 
 try {
-  // Why: process.exit truncates a piped write part-way through on macOS, so set
-  // exitCode and let node flush the blocked-entry list before it exits.
+  // Let piped output flush; process.exit can truncate it on macOS.
   process.exitCode = checkRootDirectoryEntries(process.argv.slice(2))
 } catch (error) {
-  // Why: git already reported the failure on the inherited stderr, so surface its
-  // status rather than a node stack trace. Anything else is a real bug — rethrow.
+  // Git already reported failures; preserve its exit status and rethrow other bugs.
   if (typeof error.status !== 'number') {
     throw error
   }

.github/scripts/pr-test-loc-table.mjs

@@ -3,9 +3,7 @@ export const LOC_BLOCK_END = '<!-- /orca-pr-loc -->'
 export const LOC_HANDS_OFF_COMMENT =
   '<!-- Programmatic LoC summary. Do not edit by hand; rewritten on every commit. -->'
 
-// Why the __-wrapped names: they are unambiguous test-data markers, so a dir
-// cannot be one by accident. Bare `fixtures/` is deliberately absent — it reads
-// as a plausible prod module name, and this classifier bills every PR.
+// __-wrapped segments unambiguously mark test data; bare fixtures/ could be production, and this classifier bills every PR.
 const TEST_DIR_SEGMENT = /(?:^|\/)(?:__tests__|__fixtures__|__snapshots__|e2e|tests)(?:\/|$)/i
 const TEST_FILENAME = /\.(?:test|spec|e2e)\.[^/]+$/i