Verify Herdr SSH terminal RED2

.github/workflows/tests.yml

@@ -1,142 +1,41 @@
 name: Tests
-
-# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
-# list each published package would contain. Each suite is its own job so one failure does not
-# hide the others. No provider credentials or operator configuration are supplied.
-# Package suites deny external networking; scenario runtime has no external route.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
+on: workflow_dispatch
 permissions:
   contents: read
-
-concurrency:
-  group: tests-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  build-and-package:
+  notice-recovery:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: ddda185b3427950842cbe266522adc72452453a4
           persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: npm
+      - run: command -v tmux || (sudo apt-get update && sudo apt-get install -y tmux)
       - run: npm ci
       - run: npm run build
-      - name: Record the published file list of each package
+      - name: Herdr SSH terminal regression
+        shell: bash
         run: |
-          set -euo pipefail
-          mkdir -p pack-lists
-          for p in cli daemon tui; do
-            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
-              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
-              | sort > pack-lists/$p.txt
-            echo "$p: $(wc -l < pack-lists/$p.txt) files"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pack-lists
-          path: pack-lists/
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-
-  repo-checks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:repo
-
-  package-tests:
-    if: ${{ github.event_name != 'push' }}
-    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
-    # file-inode behaviour and release tags.
-    runs-on: macos-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        package: [daemon, cli, tui, ui]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: brew install tmux
-      - run: npm ci
-      - name: Build the packages the tests import
-        run: npm run build
-      - name: Run the suite without ambient credentials or external network
-        run: |
-          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
-          suite_root=$(cd "$suite_root" && pwd -P)
-          mkdir -p "$suite_root/home" "$suite_root/bin"
-          # Same system bytes, nonprivileged mode; no system file is changed.
-          /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
-          # Only this job's temporary sockets (including tmux) are reachable.
-          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
-            CI=true TERM=xterm-256color \
-            sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
-            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
-          set -euo pipefail
-          node scripts/ci-macos-process-probe.mjs
-          # The production readers use bare ps. Select real system bytes only after
-          # self/owned-child observation and network/IPC confinement are proved.
-          export PATH="$TMPDIR/bin:$PATH"
-          test "$(command -v ps)" = "$TMPDIR/bin/ps"
-          exec npm run test -w "packages/$1"
-          SUITE
-
-  installed-scenario:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - name: Installed package, daemon restart, and seeded durability failure
-        run: bash scripts/run-pr-scenarios.sh
+          set +e
+          set -uo pipefail
+          mkdir -p proof
+          git rev-parse HEAD HEAD^{tree} > proof/source.txt
+          node --version > proof/node-version.txt
+          npm --workspace @openrig/cli test -- test/herdr-ssh-node-invocation.test.ts test/claude-core-plugin-load.test.ts test/codex-core-plugin-route.test.ts test/successor-session-launcher.test.ts test/claude-activity-hook-delivery.test.ts --reporter=verbose 2>&1 | tee proof/daemon.log
+          result=${PIPESTATUS[0]}
+          npm run lint 2>&1 | tee proof/typecheck.log
+          lint_result=${PIPESTATUS[0]}
+          git diff --exit-code > proof/source-unchanged.txt
+          printf 'daemon=%s\ntypecheck=%s\n' "$result" "$lint_result" > proof/exits.txt
+          test "$result" -eq 0 && test "$lint_result" -eq 0
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: installed-scenario-evidence
-          path: dist/pr-scenarios/
+          name: herdr-ssh-red2
+          path: proof/
           if-no-files-found: error

packages/cli/test/terminal-window.test.ts

@@ -594,7 +594,7 @@ describe("welcome launcher for desktop apps and an existing Herdr client", () =>
     expect(f.post).not.toHaveBeenCalled();
   });
 
-  it.each([{}, { HERDR_SESSION: "personal" }, { HERDR_SOCKET_PATH: "/personal/herdr.sock" }])("opens a fresh space in the current Herdr endpoint without a window: %j", async extra => {
+  it.each([{}, { HERDR_SESSION: "personal" }, { HERDR_SOCKET_PATH: "/personal/herdr.sock" }, { SSH_TTY: "/dev/pts/1" }])("opens a fresh space in the current Herdr endpoint without a window: %j", async extra => {
     const f = fixture();
     f.deps.env = { HOME: "/fixture", TERM_PROGRAM: "herdr", __CFBundleIdentifier: "com.apple.Terminal", ...extra };
     f.preview.status.launch.socketPath = extra.HERDR_SOCKET_PATH ?? (extra.HERDR_SESSION ? "/fixture/.config/herdr/sessions/personal/herdr.sock" : "/fixture/.config/herdr/herdr.sock");
@@ -610,7 +610,7 @@ describe("welcome launcher for desktop apps and an existing Herdr client", () =>
     expect(result.notes?.at(-1)).toBe("Herdr did not confirm the view's space is focused; ask the person whether they see it.");
   });
 
-  it.each([{ TERM_PROGRAM: "tmux", TMUX: "/tmp/tmux-1000/default,1,0" }, { TERM_PROGRAM: "ghostty" }])("recognises a Herdr pane by its pane markers when TERM_PROGRAM is not herdr, on Linux: %j", async extra => {
+  it.each([{ TERM_PROGRAM: "tmux", TMUX: "/tmp/tmux-1000/default,1,0" }, { TERM_PROGRAM: "ghostty" }, { TERM_PROGRAM: "tmux", SSH_TTY: "/dev/pts/1" }])("recognises a Herdr pane by its pane markers when TERM_PROGRAM is not herdr, on Linux: %j", async extra => {
     const f = fixture();
     f.deps.platform = "linux";
     f.deps.env = { HOME: "/fixture", WAYLAND_DISPLAY: "wayland-1", HERDR_ENV: "1", HERDR_PANE_ID: "w1:p1", HERDR_SOCKET_PATH: f.preview.status.launch.socketPath, ...extra };
@@ -618,6 +618,7 @@ describe("welcome launcher for desktop apps and an existing Herdr client", () =>
     expect(result).toMatchObject({ ok: true }); expect(result.window).toBeUndefined();
     expect(f.post).toHaveBeenCalledWith("/api/terminal/open", expect.objectContaining({ view: "saved:kernel", provider: "herdr" }), expect.anything());
     expect(f.deps.launch).not.toHaveBeenCalled();
+    expect(f.exec.mock.calls.some(([file]) => file === "/usr/bin/osascript" || file === "/bin/launchctl")).toBe(false);
   });
 
   it("does not treat a partial Herdr marker as a Herdr pane", async () => {
@@ -666,10 +667,12 @@ describe("welcome launcher for desktop apps and an existing Herdr client", () =>
     expect(f.deps.launch).not.toHaveBeenCalled();
   });
 
-  it.each([{ CI: "true" }, { SSH_CONNECTION: "remote" }, { SSH_CLIENT: "remote" }, { SSH_TTY: "/dev/ttys1" }])("keeps current-Herdr opens behind the CI/SSH boundary: %j", async extra => {
-    const f = fixture(); f.deps.env = { HOME: "/fixture", TERM_PROGRAM: "herdr", ...extra };
+  it("keeps current-Herdr opens behind the CI boundary even over SSH", async () => {
+    const f = fixture(); f.deps.env = { HOME: "/fixture", TERM_PROGRAM: "herdr", HERDR_ENV: "1", HERDR_PANE_ID: "w1:p1", HERDR_SOCKET_PATH: f.preview.status.launch.socketPath, SSH_TTY: "/dev/pts/1", CI: "true" };
     const result = await openTerminalWindow(f.client, "saved:kernel", undefined, f.deps);
     expect(result).toMatchObject({ ok: false, windowAttempted: false });
     expect(f.post).not.toHaveBeenCalled();
+    expect(result.error).toContain("CI run");
+    expect(f.deps.launch).not.toHaveBeenCalled();
   });
 });