Fix macOS daemon worker stalls in the packaged terminal runtime by nwparker · Pull Request #29133 · stablyai/orca

nwparker · 2026-10-15T10:12:38Z

	Files	Added	Deleted	Net
Test	14	$\color{#1a7f37}{\Huge{\mathbf{+}}}$658	$\color{#cf222e}{\Huge{\mathbf{−}}}$16	$\color{#1a7f37}{\Huge{\mathbf{+}}}$642
Prod	29	$\color{#1a7f37}{\Huge{\mathbf{+}}}$1100	$\color{#cf222e}{\Huge{\mathbf{−}}}$78	$\color{#1a7f37}{\Huge{\mathbf{+}}}$1022

ELI5

A long-running macOS terminal service can keep answering requests while its worker pool stops delivering typing and filesystem work. Build its private Node runtime with bounded worker waits so stale Darwin waits refresh and queued work can recover.

What Changed

Build hash-pinned Node 24.22.1 source with the reviewed private Darwin worker-wait patch. Workers retain the existing queue predicate and Darwin error workaround, wake immediately on normal signals, and refresh idle waits every 30 seconds. The default four-worker pool adds at most eight idle timeout wakes per minute.

The build verifies the archive, exact patched worker source, target architecture, macOS floor and executable receipt. Cache identity includes the builder and dependent build scripts. Source extraction is asynchronous so it cannot starve the cache lease heartbeat; cleanup releases the lease first.

All four Mac packaging workflows now verify both target runtimes before packaging. Each verifier rebuilds patched node-pty in disposable scratch under the exact target Node; it does not mutate Electron's native addon installation. Target architecture is checked explicitly. The optional 30-million-job stress requires resumed native work, four fresh stats and fresh PTY echo after any progress stall, allowing the native 30-second recovery bound plus margin.

Two missing routing-module fixture copies are fixed. Release orchestration carries one 390-minute deadline across two bounded observation jobs; verified Mac success precedes Windows/Linux artifact jobs, preserving Windows signing approval time. Adhoc Windows publication also waits through job dependencies rather than consuming its runner timeout during a cold Mac build.

Why

The October 15/23 incidents had queued work and four sleeping workers. Native witnesses and an ordinary sequential-job workload reproduce the Darwin condition-generation half-range failure. Detailed evidence and remaining limits are in docs/bug-reproductions/darwin-worker-wakeup.md and upstream libuv PR 5351.

Linked Issue

Related preserved-owner detection/recovery: #32220.

Visual Proof

N/A — runtime and packaging changes have no new visual surface.

Testing

The initial full stress run exceeded its five-minute total deadline while still progressing (about 3.9 million jobs); it did not prove a stranded worker. The revised run permits an hour on a busy host while retaining bounded no-progress recovery checks. On the final cold ARM runtime, all 30,000,000 jobs completed in about 272 seconds, with final filesystem access and fresh PTY echo; the wrapper exited 0.

An additional isolated stable-copy upgrade-pattern exercise passed on this host: the older signed protocol50 helper served a PTY from its CDHash path and retained FDA access after its disposable source location was replaced; the candidate protocol51 helper published to its distinct verified CDHash path and passed PTY/FDA. Both outer app designated requirements match. Exact test labels/processes/copies were cleaned up. This mirrors stable-copy publication; it does not execute production signed-main materialization or the real updater lifecycle.

Review

Reliability gate terminal-runtime.darwin-worker-wakeup remains experimental. Public condition variables, Linux, Windows and WSL are unchanged. The existing signed helper layout and stable host copy remain in use. Already-running daemons keep their executable until deliberate restart; no automatic destructive recovery or queued-input replay is added.

Agent skill upstream boundary

No upstream skill-installer source or artifacts copied.

Notes

Standalone/SSH macOS servers and development Electron fallback remain unpatched. Mobile/relay benefit through a patched execution host. Installed-copy upgrade/TCC attribution, exact minimum macOS 13.5, battery and extended soak remain qualification gaps. macOS 14.8.9 signed-package qualification passes on ARM hardware for both architectures (x64 through Rosetta). Physical Intel native qualification now passes at 3e57861d5df4; orchestration-only final-head main workflow and aggregate gate pass; separate LoC retry also passes. The exact Orca producer sequence remains unknown.

Earlier dependency-audit failures at merge c5e7ff6c3f59 reported existing critical/high dompurify and Next advisories. The final JavaScript audit now passes at integration eaffa020d672 against newer base d10626876ea0 (the job installs dompurify3.4.17); this PR did not change dependency manifests/lockfiles in its final follow-up. Current audit output retains a moderate ip-address finding and recognizes repository-patched advisories. Do not treat the earlier audit failure as a current failed check. The signed canary remains pinned to its explicitly stated earlier source.

Checklist

Self-reviewed native synchronization, provenance, packaging and cache failure paths.
Cross-platform, remote, mobile and folder-workspace impact considered.
Both final-head native architecture gates pass.
Final-head main workflow and explicit aggregate gate pass; mobile retry passes486/486.
Separate LoC API workflow retry passes. Final head:33successful checks,14intentional skips,zero pending/failing.
Signed package canary and isolated packaged launchd/PTY/FDA checks pass for ARM native and Intel via Rosetta; installed-copy upgrade attribution remains unqualified.

coderabbitai · 2026-10-23T08:16:54Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Last reviewed commit: 096d2af
Latest commit, not reviewed: 4f9372c

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: 7b872452-431d-4f33-91ab-8a337974243d

Commits

Reviewing files that changed from the base of the PR and between 313110f and 096d2af.

Files selected for processing: 18

.github/workflows/adhoc-mac-build.yml
.github/workflows/daily-mac-build.yml
.github/workflows/hourly-mac-build.yml
.github/workflows/pr.yml
.github/workflows/release-cut.yml
.github/workflows/release-mac-build.yml
config/reliability-gates.jsonc
config/scripts/package-electron-runtime-contract.test.mjs
config/scripts/pr-code-change-scope.mjs
config/scripts/release-mac-build-workflow-dispatch.test.mjs
config/scripts/release-windows-signing-gate.test.mjs
config/scripts/win32-test-lane-registration.test.mjs
src/main/daemon/daemon-adoption-telemetry-event.ts
src/main/daemon/daemon-pty-adapter.ts
src/main/ipc/telemetry.ts
src/shared/daemon-adoption-telemetry.ts
src/shared/telemetry-daemon-event-schemas.ts
src/shared/telemetry-event-registry.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

The macOS terminal runtime now uses a source-built Node.js 24.22.1 build with a Darwin worker-wait patch. Build scripts validate and cache arm64 and x64 executables. Runtime probes and optional stress tests check worker waits, PTY behavior, and filesystem, DNS, and crypto operations. macOS packaging workflows build and verify the patched runtime. Pull request checks route and require runtime verification. Release workflows observe macOS builds and require successful verification before dependent Windows steps. Windows workflow runner classification now resolves matrix-based runner labels. The changes also add daemon async-I/O stall and recovery telemetry.

Priority: Normal

Merge Risk: Low · up to 096d2

Runner classification may miss a Windows-capable job, and a rejected telemetry recovery may not be reported again. These bounded concerns warrant owner follow-up; the release-token timing issue has been addressed.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 6.98% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 28 files. (7 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary change: fixing macOS daemon worker stalls in the packaged terminal runtime.
Description check		The description is complete and closely follows the repository template. It explains the user impact, implementation, motivation, linked issue, testing, review concerns, limitations, and checklist sta…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description is complete and closely follows the repository template. It explains the user impact, implementation, motivation, linked issue, testing, review concerns, limitations, and checklist status. It also documents the required N/A visual proof and extensive platform coverage.

Full details: Docstring Coverage

Explanation

Docstring coverage is 6.98% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 28 files. (7 skipped: 7 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 3

ℹ️ Review info

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: 64ccfc92-b007-4eae-b028-8af9b1b61edb

📥 Commits

Reviewing files that changed from the base of the PR and between 6d473f4 and 6f006d8.

📒 Files selected for processing: 22

.github/workflows/adhoc-mac-build.yml
.github/workflows/daily-mac-build.yml
.github/workflows/hourly-mac-build.yml
.github/workflows/pr.yml
.github/workflows/release-mac-build.yml
config/node-runtime-patches/darwin-worker-wait.json
config/node-runtime-patches/darwin-worker-wait.patch
config/reliability-gates.jsonc
config/scripts/__fixtures__/darwin-terminal-worker-wait.c
config/scripts/__fixtures__/darwin-threadpool-wait.h
config/scripts/build-darwin-terminal-node.mjs
config/scripts/build-darwin-terminal-node.test.mjs
config/scripts/darwin-terminal-node-probe.cjs
config/scripts/darwin-terminal-node-workflow.test.mjs
config/scripts/darwin-terminal-worker-stress.cjs
config/scripts/macos-terminal-host-bundle.cjs
config/scripts/pr-code-change-scope.mjs
config/scripts/pr-darwin-terminal-node-route.mjs
config/scripts/verify-darwin-terminal-node.mjs
config/scripts/win32-test-lane-registration.test.mjs
docs/bug-reproductions/darwin-worker-wakeup.md
docs/reference/macos-daemon-tcc-attribution.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

coderabbitai · 2026-10-23T08:16:57Z

+      - name: Build the patched terminal runtimes
+        timeout-minutes: 180
+        run: |
+          node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/build-darwin-terminal-node.mjs arm64
+          node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/build-darwin-terminal-node.mjs x64


🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🔎 Supported by static analysis

🏁 Script executed:

set -eu printf '%s\n' '--- hourly workflow relevant references ---' rg -n -F -e 'app_token' -e 'Compute hourly version' -e 'gh release list' -e 'Build the patched terminal runtimes' -e 'create-github-app-token' .github/workflows/hourly-mac-build.yml || test "$?" -eq 1 printf '%s\n' '--- daily workflow relevant references ---' rg -n -F -e 'app_token' -e 'Compute daily version' -e 'Compute version' -e 'gh release list' -e 'Build the patched terminal runtimes' -e 'create-github-app-token' .github/workflows/daily-mac-build.yml || test "$?" -eq 1 printf '%s\n' '--- hourly workflow block ---' sed -n '145,245p' .github/workflows/hourly-mac-build.yml printf '%s\n' '--- daily workflow token/build/version block ---' sed -n '135,255p' .github/workflows/daily-mac-build.yml printf '%s\n' '--- token action/script references in workflow files ---' rg -n -F -e 'actions/create-github-app-token' -e 'github-app-token' -e 'GITHUB_TOKEN' .github/workflows config/scripts | head -120

Repository: stablyai/orca

Length of output: 19155

🌐 Web query:

official actions/create-github-app-token v2 documentation token expiration lifetime

💡 Result:

<source_evidence> <source kind="open_page"> <title>create-github-app-token/README.md at v2 · actions/create-github-app-token · GitHub</title> <location>https://github.com/actions/create-github-app-token/blob/v2/README.md</location> <excerpt>citeturn1view0 [wordlim: 200] Crawled: today; Content type: text/html; Source: open({"ref_id":"https://github.com/actions/create-github-app-token/blob/v2/README.md","lineno":null}); Total lines: 533 L0: 【0†Skip to content】 L1: ## Navigation Menu L2: L3: 【1†Sign in】 L4: L5: Appearance settings L6: L7: * Platform L8: L9: * AI CODE CREATION L10: * 【2†GitHub CopilotWrite better code with AI】 L11: * 【3†GitHub Copilot appDirect agents from issue to merge】 L12: * 【4†MCP RegistryIntegrate external tools】 L13: L14: * DEVELOPER WORKFLOWS L15: * 【5†ActionsAutomate any workflow】 L16: * 【6†CodespacesInstant dev environments】 L17: * 【7†IssuesPlan and track work】 L18: * 【8†Code ReviewManage code changes】 L19: * 【9†Code QualityEnforce quality at merge】 L20: * APPLICATION SECURITY L21: * 【10†GitHub Advanced SecurityFind and fix vulnerabilities】 L22: * 【11†Code securitySecure your code as you build】 L23: * 【12†Secret protectionStop leaks before they start】 L24: L25: * EXPLORE L26: * 【13†Why GitHub】 L27: * 【14†Documentation†docs.github.com】 L28: * 【15†Blog†github.blog】 L29: * 【16†Changelog†github.blog】 L30: * 【17†Marketplace】 L31: L32: 【18†View all features】 L33: L34: * Solutions L35: * BY COMPANY SIZE L36: * 【19†Enterprises】 L37: * 【20†Small and medium teams】 L38: * 【21†Startups】 L39: * 【22†Nonprofits】 L40: L41: * BY USE CASE L42: * 【23†App Modernization】 L43: * 【24†DevSecOps】 L44: * 【25†DevOps】 L45: * 【26†CI/CD】 L46: * 【27†View all use cases】 L47: L48: * BY INDUSTRY L49: * 【28†Healthcare】 L50: * 【29†Financial services】 L51: * 【30†Manufacturing】 L52: * 【31†Government】 L53: * 【32†View all industries】 L54: L55: 【33†View all solutions】 L56: L57: * Resources L58: * EXPLORE BY TOPIC L59: * 【34†AI】 L60: * 【35†Software Development】 L61: * 【36†DevOps】 L62: * 【37†Security】 L63: * 【38†View all topics】 L64: L65: * EXPLORE BY TYPE L66: * 【39†Customer stories】 L67: * 【40†Events & webinars】 L68: * 【41†Ebooks & reports】 L69: * 【42†Business insights】 L70: * 【43†GitHub Skills†skills.github.com】 L71: * SUPPORT & SERVICES L72: * 【14†Documentation†docs.github.com】 L73: * 【44†Customer support†support.github.com】 L74: * 【45†Community forum】 L75: * 【46†Trust center】 L76: * 【47†Partners】 L77: L78: 【48†View all resources】 L79: L80: * Open Source L81: L82: * COMMUNITY L83: * 【49†GitHub SponsorsFund open source developers】 L84: * PROGRAMS L85: * 【50†Security Lab†securitylab.github.com】 L86: * 【51†Maintainer Community†maintainers.github.com】 L87: * 【52†GitHub Stars†stars.github.com】 L88: * 【53†Archive Program†archiveprogram.github.com】 L89: L90: * REPOSITORIES L91: * 【54†Topics】 L92: * 【55†Trending】 L93: * 【56†Collections】 L94: L95: * Enterprise L96: L97: * ENTERPRISE SOLUTIONS L98: * 【19†Enterprise platformAI-powered developer platform】 L99: * AVAILABLE ADD-ONS L100: * 【10†GitHub Advanced SecurityEnterprise-grade security features】 L101: * 【57†Copilot for BusinessEnterprise-grade AI features】 L102: * 【58†Premium SupportEnterprise-grade 24/7 support】 L103: L104: * 【59†Pricing】 L105: L106: Search`/` L107: L108: 【1†Sign in】 L109: L110: 【60†Sign up】 L111: L112: Appearance settings L113: You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert L114: L115: 1. 【61†actions】 L116: 2. 【62†create-github-app-token】 L117: ## Repository navigation L118: L119: * * 【62†Code】 L120: * 【63†Issues7 (7)】 L121: *…[truncated]</excerpt> </source> <source kind="search"> <title>create-github-app-token/README.md at main · actions/create-github-app-token · GitHub</title> <location>https://github.com/actions/create-github-app-token/blob/main/README.md</location> <excerpt>citeturn0search0 [wordlim: 200] Crawled: last month; - uses: actions/create-github-app-token@v3 ... - uses: actions/create-github-app-token@v3 # Create GitHub App Token GitHub Action for creating a GitHub App installation access token. ## Usage In order to use this action, you need to: 1. Register new GitHub App. 2. Store the App's Client ID in your repository variables (example: `APP_CLIENT_ID`). 3. Store the App's private key in your repository secrets (example: `APP_PRIVATE_KEY`). Important An installation access token expires after 1 hour. Please see this comment for alternative approaches if you have long-running processes. ### Create a token for the current repository name: Run tests on staging on: push: branches: - main jobs: hello-world: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v3 id: app-token with: client-id: ${{ vars.APP_CLIENT_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} - uses: ./actions/staging-tests with: token: ${{ steps.app-token.outputs.token }} ### Use app token with `actions/checkout` on: [pull_request] jobs: auto-format: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v3 id: app-token with: # required client-id: ${{ vars.APP_CLIENT_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} - uses: actions/checkout@v6 with: token: ${{ steps.app-token.outputs.token }} ref: ${{ github.head_ref }} # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config persist-credentials: false - uses: creyD/prettier_action@v6 with: github_token: ${{ steps.app-token.outputs.token }} ### Create a Git committer string for an app installation on: [pull_request] jobs: auto-format: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v3 id: app-token with: # required client-id: ${{ vars.APP_CLIENT_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} - name: Get GitHub App User ID id: get-user-id run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" env: GH_TOKEN: ${{ steps.app-token.outputs.token }} - id: committer run: echo "string=${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>" >> "$GITHUB_OUTPUT" - run: echo "committer string is ${{ steps.committer.outputs.string }}" </excerpt> </source> <source kind="search"> <title>create-github-app-token/README.md at main · actions/create-github-app-token · GitHub</title> <location>https://github.com/actions/create-github-app-token/blob/main/README.md?plain=1</location> <excerpt>citeturn0search1 [wordlim: 200] Crawled: today; - uses: actions/create-github-app-token@v3 ... The action creates an installation access token using [the `POST /app/installations/{installation_id}/access_tokens` endpoint](https://docs.github.com/rest/apps/apps? # Create GitHub App Token [![test](https://github.com/actions/create-github-app-token/actions/workflows/test.yml/badge.svg)](https://github.com/actions/create-github-app-token/actions/workflows/test.yml) GitHub Action for creating a GitHub App installation access token. ## Usage In order to use this action, you need to: 1. [Register new GitHub App](https://docs.github.com/apps/creating-github-apps/setting-up-a-github-app/creating-a-github-app). 2. [Store the App's Client ID in your repository variables](https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#defining-configuration-variables-for-multiple-workflows) (example: `APP_CLIENT_ID`). 3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets?tool=webui#creating-secrets-for-a-repository) (example: `APP_PRIVATE_KEY`). > [!IMPORTANT] > An installation access token expires after 1 hour. Please see this comment (GitHub issue 121 in actions/create-github-app-token (link omitted to avoid creating a cross-reference)) for alternative approaches if you have long-running processes. ### Create a token for the current repository ```yaml name: Run tests on staging on: push: branches: - main jobs: hello-world: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v3 id: app-token with: client-id: ${{ vars.APP_CLIENT_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} - uses: ./actions/staging-tests with: token: ${{ steps.app-token.outputs.token }} ``` ### Use app token with `actions/checkout` ```yaml on: [pull_request] jobs: auto-format: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v3 id: app-token with: # required client-id: ${{ vars.APP_CLIENT_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} - uses: actions/checkout@v6 with: token: ${{ steps.app-token.outputs.token }} ref: ${{ github.head_ref }} # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config persist-credentials: false - uses: creyD/prettier_action@v6 with: github_token: ${{ steps.app-token.outputs.token }} ``` ### Create a Git committer string for an app installation ```yaml on: [pull_request] jobs: auto-format: runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v3 id: app-token with: </excerpt> </source> <source kind="search"> <title>Releases · actions/create-github-app-token · GitHub</title> <location>https://github.com/actions/create-github-app-token/releases</location> <excerpt>citeturn0search2 [wordlim: 200] Crawled: 3 weeks ago; # Releases: actions/create-github-app-token ... Releases · actions/create-github-app-token ... * Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner. actions / create-github-app-token Public * Notifications You must be signed in to change notification settings * Fork 175 * Star * Code * Issues 9 * Pull requests 9 * Discussions * Actions * Security and quality 0 * Insights # Releases: actions/create-github-app-token Releases Tags [Input: Find a release] [Input] Releases · actions/create-github-app-token ## Release list * v3.2.0 * v3.1.1 * v3.1.0 * v3.0.0 * v3.0.0-beta.6 * v3.0.0-beta.5 * v3.0.0-beta.4 * v3.0.0-beta.3 * v2.2.2 * v2.2.1 ## v3.2.0 v3.2.0 Latest Compare # Choose a tag to compare ## Sorry, something went wrong. Filter Loading [Input] ## Sorry, something went wrong. ### Uh oh! There was an error while loading. Please reload this page. ## No results found View all tags Image: @create-app-token-action-releaser create-app-token-action-releaser released this 12 May 23:31 Immutable release. Only release title and notes can be modified. v3.2.0 `bcd2ba4` This commit was created on GitHub.com and signed with GitHub’s verified signature. GPG key ID: B5690EEEBB952194 Verified Learn about vigilant mode. ## 3.2.0 (2026-05-12) ### Features * add support for enterprise-level GitHub Apps (#263) (952a2a7) * support full repository names in `repositories` input (#372) (85eb8dd) ### Bug Fixes * deps: bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34) * validate private-key input (#376) (f24bbd8) Assets 3 ## v3.1.1 v3.1.1 Compare </excerpt> </source> <source kind="search"> <title>GITHUB_TOKEN - GitHub Docs</title> <location>https://docs.github.com/en/actions/concepts/security/github_token</location> <excerpt>citeturn0search3 [wordlim: 200] Crawled: today; When you enable GitHub Actions, GitHub installs a GitHub App on your repository.The `GITHUB_TOKEN` secret is a GitHub App installation access token. ... The `GITHUB_TOKEN` expires when the job finishes or after its effective maximum lifetime. # GITHUB_TOKEN Learn what `GITHUB_TOKEN` is, how it works, and why it matters for secure automation in GitHub Actions workflows. ## About the `GITHUB_TOKEN` At the start of each workflow job, GitHub automatically creates a unique `GITHUB_TOKEN` secret to use in your workflow. You can use the `GITHUB_TOKEN` to authenticate in the workflow job. When you enable GitHub Actions, GitHub installs a GitHub App on your repository. The `GITHUB_TOKEN` secret is a GitHub App installation access token. You can use the installation access token to authenticate on behalf of the GitHub App installed on your repository. The token's permissions are limited to the repository that contains your workflow. For more information, see Workflow syntax for GitHub Actions. Before each job begins, GitHub fetches an installation access token for the job. The `GITHUB_TOKEN` expires when the job finishes or after its effective maximum lifetime. The effective maximum lifetime of the token depends on the type of runner: </excerpt> </source> <omitted_sources count="11">Additional source records were omitted from this bounded result.</omitted_sources> </source_evidence> Citations: - 1: https://github.com/actions/create-github-app-token/blob/v2/README.md

Renew the release token after the long runtime build.

The actions/create-github-app-token@v2 token expires after one hour. If installation and a cold build exceed one hour, the existing app_token can expire before Compute hourly version or Compute daily version runs gh release list. Mint a new token after the build steps in both workflows, before the version queries.

coderabbitai · 2026-10-23T08:16:57Z

+      const included = Array.isArray(matrix.include)
+        ? matrix.include.flatMap((entry) => (entry[axis] === undefined ? [] : [entry[axis]]))
+        : []
+      return [...values, ...included].some((value) => couldRunOnWindows(value))


🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Keep OS-neutral self-hosted values conservative.

If runs-on is ${{ matrix.os }} and matrix.os contains self-hosted, this call returns false. A Windows self-hosted runner can match that label, so readWindowsWorkflow() can omit a Windows-capable job. Treat a resolved value without an OS restriction as potentially Windows, and add a regression case for self-hosted. (docs.github.com)

…d download

…ect reference

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: ee65b00a-caf6-4732-a119-8b3d85a53f73

📥 Commits

Reviewing files that changed from the base of the PR and between f8a8eed and 313110f.

📒 Files selected for processing: 14

.github/workflows/adhoc-mac-build.yml
.github/workflows/daily-mac-build.yml
.github/workflows/hourly-mac-build.yml
.github/workflows/release-mac-build.yml
config/scripts/darwin-terminal-node-workflow.test.mjs
src/main/daemon/daemon-adoption-telemetry-event.ts
src/main/daemon/daemon-async-io-telemetry-event.test.ts
src/main/daemon/daemon-async-io-telemetry-event.ts
src/main/daemon/daemon-pty-adapter-async-io-health.test.ts
src/main/daemon/daemon-pty-adapter.ts
src/main/ipc/telemetry.ts
src/shared/daemon-adoption-telemetry.ts
src/shared/telemetry-daemon-event-schemas.ts
src/shared/telemetry-event-registry.ts

🚧 Files skipped from review as they are similar to previous changes: 2

config/scripts/darwin-terminal-node-workflow.test.mjs
.github/workflows/release-mac-build.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

coderabbitai · 2026-10-24T01:09:43Z

+      }
+      return
+    }
+    seen.recovered = true


🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Record recovery only after track accepts the event.

If track returns false, Line 46 still marks the stall recovered. Later healthy polls then cannot emit the recovery event. Set seen.recovered only when track returns true, as the stalled branch does.

Proposed fix

--- "a/src/main/daemon/daemon-async-io-telemetry-event.ts" +++ "b/src/main/daemon/daemon-async-io-telemetry-event.ts" @@ -43,12 +43,13 @@ } return } - seen.recovered = true - track('daemon_async_io_health', { + if (track('daemon_async_io_health', { transition: 'recovered', ...base, stalled_for_bucket: bucketStallDuration(nowMs - seen.stalledAtMs) - }) + })) { + seen.recovered = true + } } catch { // Telemetry is best-effort; a dropped event must not fail a health read. }

nwparker · 2026-10-25T05:12:30Z

Field recurrence on October 24: a second terminal in the same preserved v50 daemon (PID 55321) stopped accepting input. The daemon still runs the unpatched Node 24.21.0 / libuv 1.52.1 binary from October 19; updating the GUI had preserved it and its running sessions.

Before recovery, all four libuv workers were in __psynch_cvwait, the global work queue was nonempty, the loop completion queue was empty, and a fresh asynchronous stat did not complete. A version-specific, one-off diagnostic woke the four verified workers under the pool mutex. The queue drained; a subsequent fresh stat completed in less than 1 ms, and terminal output showed keyboard input again. Daemon PID, PTY incarnation, shell PID, and Codex PID were all preserved. No service or agent was restarted, and no recurring recovery hook was installed.

This is additional field evidence for the same failure signature and for the importance of the existing-daemon rollout limitation. It does not establish the exact Orca job-producer sequence, nor indicate a regression in the patched runtime: this daemon has never loaded the patch. The ordinary sequential-native-job reproduction documented in the PR remains the controlled workload evidence.

# Conflicts: # .github/workflows/adhoc-mac-build.yml # .github/workflows/daily-mac-build.yml # .github/workflows/hourly-mac-build.yml # .github/workflows/release-mac-build.yml # config/scripts/win32-test-lane-registration.test.mjs # src/shared/telemetry-daemon-event-schemas.ts

…patched runtime Daemons survive app updates, so without a bump every user's new terminals keep landing on the already-running v51 daemon, which runs unpatched Node, until it restarts. v52 starts new terminals on a fresh daemon; v51 stays attachable.

…keep stall telemetry Reverts #29133 except its daemon async-I/O stall telemetry, so we can measure how often stalls happen on official Node before committing to a patched runtime. Protocol returns to v51: no release or hourly build published v52.

…keep stall telemetry (#33688) Reverts #29133 except its daemon async-I/O stall telemetry, so we can measure how often stalls happen on official Node before committing to a patched runtime. The macOS terminal host goes back to the official Node 24.22.1 download and the daemon protocol back to v51; no release or hourly build published v52.

nwparker mentioned this pull request Oct 15, 2026

threadpool: bound idle waits on Darwin libuv/libuv#5351

Open

nwparker force-pushed the nwparker/macos-terminal-worker-wakeup branch from 78cf612 to b137e3d Compare October 15, 2026 19:34

nwparker marked this pull request as ready for review October 23, 2026 07:09

nwparker requested review from Jinwoo-H and brennanb2025 as code owners October 23, 2026 07:09

nwparker mentioned this pull request Oct 23, 2026

Detect stalled preserved terminal daemon owners #32220

Open

10 of 11 tasks

Fix Darwin terminal worker stalls with a verified patched runtime

6f006d8

nwparker force-pushed the nwparker/macos-terminal-worker-wakeup branch from 04bb770 to 6f006d8 Compare October 23, 2026 08:08

coderabbitai Bot reviewed Oct 23, 2026

View reviewed changes

fix(build): qualify both patched mac runtimes before packaging

3e57861

nwparker temporarily deployed to adhoc-mac-build October 23, 2026 10:27 — with GitHub Actions Inactive

nwparker temporarily deployed to adhoc-mac-build October 23, 2026 10:40 — with GitHub Actions Inactive

fix: preserve release budgets around cold terminal runtime builds

f8a8eed

nwparker temporarily deployed to adhoc-mac-build October 23, 2026 11:37 — with GitHub Actions Inactive

Jinwoo-H added 4 commits October 23, 2026 20:50

fix(ci): keep adhoc and release Mac builds of older refs on the pinne…

8c91c2d

…d download

fix(ci): mint the daily and hourly version token after the runtime build

6808dca

feat(telemetry): count terminal daemon async I/O stalls and recoveries

a12e920

fix(telemetry): match daemon incarnations by identity fields, not obj…

313110f

…ect reference

coderabbitai Bot reviewed Oct 24, 2026

View reviewed changes

Jinwoo-H mentioned this pull request Oct 24, 2026

fix(terminal): show the stalled-daemon banner when the daemon is actually stalled #33000

Merged

2 tasks done

Jinwoo-H added 2 commits October 25, 2026 13:57

Jinwoo-H temporarily deployed to adhoc-mac-build October 25, 2026 18:08 — with GitHub Actions Inactive

Jinwoo-H temporarily deployed to adhoc-mac-build October 25, 2026 19:16 — with GitHub Actions Inactive

Jinwoo-H temporarily deployed to adhoc-mac-build October 25, 2026 19:17 — with GitHub Actions Inactive

Jinwoo-H merged commit 65e513b into main Oct 25, 2026
93 checks passed

Jinwoo-H mentioned this pull request Oct 26, 2026

fix(daemon): roll the daemon-side terminal fixes since v1.4.240 into a fresh v52 daemon #33705

Merged

Fanzzzd mentioned this pull request Oct 30, 2026

fix(daemon): wake every macOS pool worker each minute so none ages past psynch's half-range #36373

Open

10 of 12 tasks

Navigation Menu

Repository navigation

Fix macOS daemon worker stalls in the packaged terminal runtime - #29133

Fix macOS daemon worker stalls in the packaged terminal runtime#29133
Jinwoo-H merged 9 commits into
mainfrom
nwparker/macos-terminal-worker-wakeup

nwparker commented Oct 15, 2026 •

edited by github-actions Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Reviews paused

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot Oct 23, 2026

Uh oh!

coderabbitai Bot Oct 23, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Oct 24, 2026

Uh oh!

nwparker commented Oct 25, 2026

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nwparker commented Oct 15, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ELI5

What Changed

Why

Linked Issue

Visual Proof

Testing

Review

Agent skill upstream boundary

Notes

Checklist

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Oct 24, 2026

Choose a reason for hiding this comment

Uh oh!

nwparker commented Oct 25, 2026

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nwparker commented Oct 15, 2026 •

edited by github-actions Bot

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading