test(e2e): prove the terminal daemon survives a main-process crash on Windows (#7742) by OrcaWin · Pull Request #9311 · stablyai/orca

OrcaWin · 2026-07-18T07:37:07Z

What & why

Adds a packaged Windows crash-survival E2E for #7742. It force-kills Orca's real Electron main and proves the detached terminal daemon, its ConPTY shell, and the UI binding all survive intact.

The review hardened the proof so missing or ambiguous evidence fails closed, fixed an existing Windows restart hydration flake exposed by the new gate, and removed avoidable installer rebuilds for harness-only changes. There are no production-path changes in this PR.

Reliability contract

Invariant: terminal-session.windows-main-crash-survival — a packaged Windows main-process crash preserves the exact userData-scoped daemon and interactive shell; relaunch adopts that daemon and reattaches the same shell without a PowerShell 0xE9 FailFast.
Crash antecedent: resolve the authoritative main PID inside Electron, then taskkill /F /PID it without /T and require that PID to die.
Identity oracle: require exactly one live userData-scoped daemon; require its PID and the stamped shell PID to survive; require relaunch to adopt the unchanged daemon PID.
Same-shell oracle: record the exact created terminal tab ID, restore that same tab, and read both the per-shell environment canary and the exact survivor $PID through it. A respawned or unrelated shell cannot pass.
FailFast oracle: query the Windows Application log successfully and require zero matching pwsh FailFast events across the full crash-to-reattach-input window.
Gate: experimental, partial terminal-session.windows-main-crash-survival in config/reliability-gates.jsonc.

Review hardening

Event-log access/query failures fail closed, including successful PowerShell exits with blank output or malformed valid JSON; the legitimate no-events result remains valid only through an explicit JSON envelope.
PID liveness checks fail closed on spawn failure, nonzero exit, blank output, or an unexpected value instead of misreporting uncertain evidence as a dead process.
Live command-line-scoped daemon discovery is authoritative over stale PID files; missing, duplicate, and mismatched identities fail closed.
The crash proof refuses launcher-stub PID fallback when the authoritative in-main PID cannot be resolved; cleanup-only paths retain the fallback. Main-PID resolution is capped at five seconds so a wedged Electron connection cannot hang the gate.
App-close and PID-resolution deadline timers are cleared after successful operations and unref'd so they cannot retain the harness process.
Unknown/duplicate CLI flags are rejected, and generated PowerShell paths quote apostrophes safely.
The harness tracks the one terminal it creates and never types shell commands into the agent tab.
Reattach input is readiness-aware and bounded: it retries an idempotent command only on the exact restored tab, clears partial PSReadLine input, and still requires exact PID + canary identity.
FailFast scanning happens after the post-crash keystroke, covering PowerShell's “fails on next console read” behavior.
Assertion failures upload bounded screenshot/DOM diagnostics including tab identities and focus state.
Source-order contract checks now fail if either the reattach probe or post-input FailFast scan is missing.
The targeted workflow watches the production IPC, persistence, preload, app-startup, terminal-pane/transport, pane-manager, session-writer, and hydration paths that can affect reattachment.
pnpm store caching is active, Electron/NSIS downloads are cached on installer misses, and installer invalidation covers production resources and root build configuration while excluding source tests/benchmarks and reliability metadata.
Restart E2E hydration tolerates only the known document-navigation transition; unrelated failures still throw and the terminal oracle/timeouts are unchanged.

Final evidence

Final SHA: 653b37c1501585dde550f5b8a339ce118f161f0f

Packaged Windows crash-survival run: PASS in 9m19s total
- main PID 6428 died
- daemon PID 5548 survived and was adopted unchanged
- shell PID 4780 survived
- exact restored tab read the same-shell PID + canary on attempt 1
- zero pwsh FailFast / 0xE9 events after crash and reattach input
- all harness assertions passed; harness runtime after install: ~49 seconds
General verify: PASS in 15m38s — lint, reliability manifest, max-lines ratchet, typecheck, Git compatibility, full tests, unpacked build, and packaged CLI smoke.
Windows terminal restart regressions: PASS.
Golden E2E macOS and Linux: PASS.
Local focused contract tests: 16/16; related daemon/relocation/startup coverage: 465/465 (481/481 combined); changed-file oxlint/formatting, reliability manifest (44 gates), max-lines ratchet, typecheck, and diff checks passed.

Performance and scope

No production code runs any new work. The harness uses bounded 500 ms evidence polls, one 8 second soak, a 5 second failure-only authoritative-PID deadline, and a 30 second failure-only reattach deadline; the successful packaged run completed the same-shell probe on attempt 1 in a ~49-second harness run. Successful operations clear their deadline timers, and failure diagnostics run only on failure. The production-input cache key avoids repeated installer builds for harness/test/metadata edits while still invalidating on source, packaging, native, resource, lockfile, or build-config changes.

Windows local daemon + ConPTY + PowerShell is covered live. WSL-backed shells, concurrent live restoration across the user's multi-terminal/multi-worktree layout, standalone daemon self-crash, and a retained pre-relocation packaged red fixture remain explicit gaps. SSH/remote-runtime/mobile are outside this Windows relocated-host contract and are not changed.

Relates to #7742.

Made with Orca 🐋

… Windows (#7742) Add a win-crash-survival e2e harness (sibling to win-update-e2e) that force-kills ONLY the packaged app's real Electron main (resolved via app.evaluate -> process.pid, /F no /T) and asserts the detached orca-terminal-daemon.exe plus its ConPTY shell survive with no pwsh 0xE9 FailFast, then that a relaunch re-adopts the SAME daemon and the reattached UI binds to the SAME survivor shell (proved via a per-shell env sentinel read back through the restored terminal). This guards the #7742 fix (standalone relocated daemon that outlives main death) against regression. A directional `--expect orphaned` profile fails on a fixed build, keeping the survival assertions honest. Windows-only; reuses win-update-e2e app-driver/daemon-process modules.

coderabbitai · 2026-07-18T07:42:51Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a Windows-only crash-survival E2E harness that forcefully terminates Orca’s Electron main process, checks daemon and shell survival, scans PowerShell event logs, and verifies relaunch reattachment through a sentinel and PID. It includes CLI parsing, assertion profiles, documentation, an npm script, scoped teardown, and shared E2E driver cleanup. A GitHub Actions workflow builds and installs the Windows app, runs the harness, and uploads logs and diagnostics.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is detailed but does not follow the required template and omits the Screenshots, Testing, AI Review Report, Security Audit, and Notes sections.	Rewrite the PR description using the repository template, including Summary, Screenshots, Testing checklist, AI Review Report, Security Audit, and Notes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 81.48% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is specific, concise, and matches the main change: a Windows E2E crash-survival test for the terminal daemon.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 5

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 6febb287-9092-4387-a57f-430adc046057

📥 Commits

Reviewing files that changed from the base of the PR and between 72d0a40 and 10ecd12.

📒 Files selected for processing (10)

.github/workflows/win-crash-survival-e2e.yml
package.json
tools/win-crash-survival-e2e/README.md
tools/win-crash-survival-e2e/cli-args.mjs
tools/win-crash-survival-e2e/crash-assertions.mjs
tools/win-crash-survival-e2e/crash-step.mjs
tools/win-crash-survival-e2e/run.mjs
tools/win-update-e2e/README.md
tools/win-update-e2e/app-driver.mjs
tools/win-update-e2e/assertions.mjs

…h-restart-orphans-open-terminal-pty

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: d8acc54e-f62b-40a4-941d-325f7037fca1

📥 Commits

Reviewing files that changed from the base of the PR and between 47f3c62 and 1a11df1.

📒 Files selected for processing (7)

.github/workflows/win-crash-survival-e2e.yml
config/reliability-gates.jsonc
config/scripts/win-crash-survival-e2e.test.mjs
tools/win-crash-survival-e2e/README.md
tools/win-crash-survival-e2e/reattach-proof.mjs
tools/win-crash-survival-e2e/run.mjs
tools/win-update-e2e/app-driver.mjs

🚧 Files skipped from review as they are similar to previous changes (4)

config/reliability-gates.jsonc
.github/workflows/win-crash-survival-e2e.yml
tools/win-crash-survival-e2e/README.md
tools/win-crash-survival-e2e/run.mjs

…h-restart-orphans-open-terminal-pty # Conflicts: # config/reliability-gates.jsonc

… Windows (stablyai#7742) (stablyai#9311) * test(e2e): prove the terminal daemon survives a main-process crash on Windows (stablyai#7742) Add a win-crash-survival e2e harness (sibling to win-update-e2e) that force-kills ONLY the packaged app's real Electron main (resolved via app.evaluate -> process.pid, /F no /T) and asserts the detached orca-terminal-daemon.exe plus its ConPTY shell survive with no pwsh 0xE9 FailFast, then that a relaunch re-adopts the SAME daemon and the reattached UI binds to the SAME survivor shell (proved via a per-shell env sentinel read back through the restored terminal). This guards the stablyai#7742 fix (standalone relocated daemon that outlives main death) against regression. A directional `--expect orphaned` profile fails on a fixed build, keeping the survival assertions honest. Windows-only; reuses win-update-e2e app-driver/daemon-process modules. * test(e2e): harden Windows crash-survival proof * test(ci): keep crash survival gate durable * test(e2e): tolerate restart hydration navigation * test(e2e): prove exact shell input after crash * perf(ci): avoid crash harness installer rebuilds * test(ci): harden crash survival evidence and cost * test(e2e): fail closed on authoritative crash target * test(e2e): fail closed on crash liveness evidence --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>

coderabbitai Bot reviewed Jul 18, 2026

View reviewed changes

AmethystLiang self-assigned this Jul 18, 2026

AmethystLiang self-requested a review July 18, 2026 16:47

brennanb2025 added 5 commits July 18, 2026 18:41

test(e2e): harden Windows crash-survival proof

c8177e3

Merge remote-tracking branch 'origin/main' into OrcaWin/renderer-cras…

5a3c4a8

…h-restart-orphans-open-terminal-pty

test(ci): keep crash survival gate durable

cf2a250

test(e2e): tolerate restart hydration navigation

47f3c62

test(e2e): prove exact shell input after crash

1a11df1

coderabbitai Bot reviewed Jul 19, 2026

View reviewed changes

Comment thread config/scripts/win-crash-survival-e2e.test.mjs Resolved

brennanb2025 added 5 commits July 18, 2026 19:33

perf(ci): avoid crash harness installer rebuilds

1f8def6

test(ci): harden crash survival evidence and cost

445abd1

Merge remote-tracking branch 'origin/main' into OrcaWin/renderer-cras…

5d122a8

…h-restart-orphans-open-terminal-pty # Conflicts: # config/reliability-gates.jsonc

test(e2e): fail closed on authoritative crash target

c3afda1

test(e2e): fail closed on crash liveness evidence

653b37c

brennanb2025 merged commit 0b71f3b into main Jul 19, 2026
5 checks passed

TsekaLuk mentioned this pull request Jul 27, 2026

[Upstream Orca] v1.4.147 semantic port review Nebutra/pebble#21

Closed

6 tasks

Navigation Menu

Repository navigation

test(e2e): prove the terminal daemon survives a main-process crash on Windows (#7742) - #9311

test(e2e): prove the terminal daemon survives a main-process crash on Windows (#7742)#9311
brennanb2025 merged 11 commits into
mainfrom
OrcaWin/renderer-crash-restart-orphans-open-terminal-pty

OrcaWin commented Jul 18, 2026 •

edited by brennanb2025

Loading

Uh oh!

coderabbitai Bot commented Jul 18, 2026 •

edited

Loading

Reviews paused

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

OrcaWin commented Jul 18, 2026 • edited by brennanb2025 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What & why

Reliability contract

Review hardening

Final evidence

Performance and scope

Uh oh!

coderabbitai Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

OrcaWin commented Jul 18, 2026 •

edited by brennanb2025

Loading

coderabbitai Bot commented Jul 18, 2026 •

edited

Loading