[upstream #12998] fix(agent-status): suppress replayed completion notifications

.gitattributes

@@ -10,3 +10,5 @@
 /skill-stubs/*.md text eol=lf
 /skills/*/SKILL.md text eol=lf
 /src/cli/bundled-skill-guides.ts text eol=lf
+# Bundled plugin trees are byte-hashed; CRLF checkout would break the pinned hash.
+/resources/plugins/** text eol=lf

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# Product source remains owned by its normal reviewers; localization inputs need focused review.
+/src/renderer/src/i18n/locales/ @brennanb2025
+/config/scripts/*localization*.mjs @brennanb2025
+/config/scripts/*locale*.mjs @brennanb2025
+/config/i18next.config.ts @brennanb2025

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -10,6 +10,8 @@ body:
       value: |
         Use this form for Orca bugs. Include enough detail for someone else to reproduce the issue.
 
+        Please write your issue in English.
+
   - type: dropdown
     id: os
     attributes:

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -10,6 +10,8 @@ body:
       value: |
         Use this form for new features or workflow improvements.
 
+        Please write your issue in English.
+
   - type: textarea
     id: problem
     attributes:

.github/ISSUE_TEMPLATE/other.yml

@@ -2,6 +2,11 @@ name: Other
 description: Report another Orca issue type
 title: '[Other]: '
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Please write your issue in English.
+
   - type: textarea
     id: details
     attributes:

.github/actions/install-node-dependencies/action.yml

@@ -0,0 +1,80 @@
+name: Install Node dependencies
+description: Installs the Node toolchain and repository dependencies for Linux CI jobs.
+
+inputs:
+  native-runtime:
+    description: Native runtime to prepare after the script-free install (none, node, or electron).
+    required: false
+    default: none
+  node-version:
+    description: Node.js version override; defaults to the version declared in package.json.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    # setup-node needs pnpm on PATH to locate and restore its store.
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v6
+      with:
+        run_install: false
+
+    - name: Setup Node.js
+      if: inputs.node-version == ''
+      uses: actions/setup-node@v6
+      with:
+        node-version-file: package.json
+        cache: pnpm
+
+    - name: Setup requested Node.js
+      if: inputs.node-version != ''
+      uses: actions/setup-node@v6
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: pnpm
+
+    - name: Validate native runtime
+      shell: bash
+      env:
+        NATIVE_RUNTIME: ${{ inputs.native-runtime }}
+      run: |
+        case "$NATIVE_RUNTIME" in
+          none|node|electron) ;;
+          *)
+            echo "::error::native-runtime must be none, node, or electron"
+            exit 2
+            ;;
+        esac
+
+    # pnpm's bundled gyp_main.py is not executable on fresh Linux runners.
+    - name: Use external node-gyp
+      if: inputs.native-runtime != 'none'
+      shell: bash
+      run: |
+        npm install -g node-gyp@11.5.0
+        echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV"
+
+    - name: Prepare dependency install
+      shell: bash
+      run: |
+        if [ -e node_modules ]; then
+          ls -ld node_modules
+          rm -rf node_modules
+        fi
+
+    - name: Install dependencies
+      shell: bash
+      run: |
+        pnpm install \
+          --no-frozen-lockfile \
+          --prefer-frozen-lockfile=false \
+          --ignore-scripts
+        git diff --exit-code package.json pnpm-lock.yaml
+
+    - name: Prepare native runtime
+      if: inputs.native-runtime != 'none'
+      shell: bash
+      env:
+        NATIVE_RUNTIME: ${{ inputs.native-runtime }}
+      run: node config/scripts/ensure-native-runtime.mjs --runtime="$NATIVE_RUNTIME"

.github/actions/install-signpath-module/action.yml

@@ -0,0 +1,197 @@
+name: Install SignPath PowerShell module
+description: >-
+  Installs the SignPath PowerShell module (Get-SignedArtifact) from PSGallery,
+  falling back to a pinned, hash-verified nupkg from the gallery CDN when the
+  gallery's package API is unavailable.
+
+inputs:
+  fallback-version:
+    description: Module version fetched directly from the CDN when the gallery API is unreachable.
+    required: false
+    default: 4.4.6
+  fallback-sha256:
+    description: >-
+      SHA-256 of the pinned fallback nupkg. The CDN path bypasses the gallery's own
+      package validation, so this hash is the only integrity check on that route.
+    required: false
+    default: 2487357a9a02c7d985baaf9ebd9158b4ce877316a2d9de3a6e9af1b263c0a32d
+
+runs:
+  using: composite
+  steps:
+    - name: Install SignPath PowerShell module
+      shell: pwsh
+      env:
+        SIGNPATH_FALLBACK_VERSION: ${{ inputs.fallback-version }}
+        SIGNPATH_FALLBACK_SHA256: ${{ inputs.fallback-sha256 }}
+      run: |
+        $ErrorActionPreference = 'Stop'
+        # Why: force TLS 1.2 so gallery downloads work on older hosted images.
+        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+
+        # Why: on some hosted Windows images `Register-PSRepository -Default`
+        # fails inside the legacy nuget.exe provider with "Missing option value
+        # for: '-source'", so PSGallery is never registered and the install
+        # below dies with "No repository with the name 'PSGallery'". PSResourceGet
+        # (bundled with PowerShell 7.4+) has PSGallery registered by default and
+        # avoids that code path, so prefer it and fall back to PowerShellGet only
+        # when it is absent.
+        $useResourceGet = $null -ne (Get-Command -Name Install-PSResource -ErrorAction SilentlyContinue)
+
+        try {
+          if ($useResourceGet) {
+            if ($null -eq (Get-PSResourceRepository -Name PSGallery -ErrorAction SilentlyContinue)) {
+              Register-PSResourceRepository -PSGallery -Trusted
+            } else {
+              Set-PSResourceRepository -Name PSGallery -Trusted
+            }
+          } else {
+            Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null
+            if ($null -eq (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) {
+              Register-PSRepository -Default -InstallationPolicy Trusted
+            }
+            Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
+          }
+        } catch {
+          # Why: repository registration also talks to the gallery, so a gallery
+          # outage can fail here before a single install is attempted. The CDN
+          # fallback below does not need a registered repository, so keep going.
+          Write-Warning "PSGallery repository registration failed: $_"
+        }
+
+        $trimChars = [char[]]@([System.IO.Path]::DirectorySeparatorChar, [System.IO.Path]::AltDirectorySeparatorChar)
+        $documentsRoot = [System.IO.Path]::GetFullPath([Environment]::GetFolderPath('MyDocuments')).TrimEnd($trimChars)
+        $currentUserModuleRoot = $env:PSModulePath -split [System.IO.Path]::PathSeparator |
+          Where-Object {
+            if ([string]::IsNullOrWhiteSpace($_)) {
+              $false
+            } else {
+              $candidate = [System.IO.Path]::GetFullPath($_).TrimEnd($trimChars)
+              $candidate.StartsWith($documentsRoot, [System.StringComparison]::OrdinalIgnoreCase)
+            }
+          } |
+          Select-Object -First 1
+
+        if ([string]::IsNullOrWhiteSpace($currentUserModuleRoot)) {
+          throw 'Unable to resolve the current-user PowerShell module root from PSModulePath.'
+        }
+
+        $signPathModulePath = Join-Path -Path $currentUserModuleRoot -ChildPath 'SignPath'
+
+        function Test-SignPathModule {
+          Import-Module SignPath -ErrorAction Stop
+          Get-Command -Name Get-SignedArtifact -Module SignPath -ErrorAction Stop
+        }
+
+        function Remove-SignPathModuleDirectory {
+          if (Test-Path -LiteralPath $signPathModulePath) {
+            Write-Warning "Removing current-user SignPath module directory: $signPathModulePath"
+            Remove-Item -LiteralPath $signPathModulePath -Recurse -Force
+          }
+        }
+
+        $installed = $false
+
+        for ($attempt = 1; $attempt -le 3; $attempt++) {
+          if ($attempt -eq 2) {
+            Start-Sleep -Seconds 15
+          } elseif ($attempt -eq 3) {
+            Start-Sleep -Seconds 30
+          }
+
+          try {
+            if ($useResourceGet) {
+              Install-PSResource -Name SignPath -Version '[4.0.0,5.0.0)' -Repository PSGallery -Scope CurrentUser -TrustRepository -Reinstall -ErrorAction Stop
+            } else {
+              Install-Module -Name SignPath -Repository PSGallery -MinimumVersion 4.0.0 -MaximumVersion 4.999.999 -Scope CurrentUser -Force -AllowClobber -ErrorAction Stop
+            }
+            Test-SignPathModule
+            $installed = $true
+            break
+          } catch {
+            Write-Warning "SignPath PowerShell module preflight attempt $attempt failed: $_"
+            Remove-SignPathModuleDirectory
+          }
+        }
+
+        # Why: the gallery's package API (OData search + repository metadata) sits
+        # behind Azure Front Door and has returned 403/502/504 for every install
+        # attempt during gallery incidents, which hard-failed the whole Windows
+        # release job. The CDN that serves the nupkg itself is a separate origin
+        # and stays up through those incidents, so fall back to a pinned version
+        # fetched straight from it. The hash pin is mandatory: this route skips the
+        # gallery's package validation, so an unexpected payload must fail loudly.
+        if (-not $installed) {
+          $version = $env:SIGNPATH_FALLBACK_VERSION
+          $expectedHash = $env:SIGNPATH_FALLBACK_SHA256
+          Write-Warning "PSGallery install failed; falling back to pinned SignPath $version from the gallery CDN."
+
+          $nupkg = Join-Path -Path $env:RUNNER_TEMP -ChildPath "signpath-$version.zip"
+          if (Test-Path -LiteralPath $nupkg) {
+            Remove-Item -LiteralPath $nupkg -Force
+          }
+
+          # Why two URLs: the /api/v2/package route 302s to the CDN and can serve
+          # while the OData search endpoint is failing; the CDN URL is the same
+          # redirect target reached directly when the api host is down entirely.
+          $sources = @(
+            "https://www.powershellgallery.com/api/v2/package/SignPath/$version",
+            "https://cdn.powershellgallery.com/packages/signpath.$version.nupkg"
+          )
+
+          $downloaded = $false
+          foreach ($source in $sources) {
+            for ($attempt = 1; $attempt -le 3; $attempt++) {
+              if ($attempt -gt 1) {
+                Start-Sleep -Seconds (10 * $attempt)
+              }
+
+              try {
+                Invoke-WebRequest -Uri $source -OutFile $nupkg -MaximumRedirection 5 -UseBasicParsing -ErrorAction Stop
+                $actualHash = (Get-FileHash -LiteralPath $nupkg -Algorithm SHA256).Hash
+                if ($actualHash -ne $expectedHash.ToUpperInvariant()) {
+                  throw "SHA-256 mismatch for $source (expected $expectedHash, got $actualHash)."
+                }
+                $downloaded = $true
+                Write-Host "Downloaded and verified SignPath $version from $source"
+                break
+              } catch {
+                Write-Warning "SignPath CDN download attempt $attempt from $source failed: $_"
+                if (Test-Path -LiteralPath $nupkg) {
+                  Remove-Item -LiteralPath $nupkg -Force
+                }
+              }
+            }
+
+            if ($downloaded) {
+              break
+            }
+          }
+
+          if (-not $downloaded) {
+            throw "Unable to install the SignPath PowerShell module: PSGallery installs failed and the pinned $version nupkg could not be downloaded from any source."
+          }
+
+          Remove-SignPathModuleDirectory
+          # Why a version-named subdirectory: PowerShell only treats a nested folder
+          # as a side-by-side module version when the name matches the manifest's
+          # ModuleVersion, which is what makes `Import-Module SignPath` resolve it.
+          $versionRoot = Join-Path -Path $signPathModulePath -ChildPath $version
+          New-Item -ItemType Directory -Path $versionRoot -Force | Out-Null
+          Expand-Archive -LiteralPath $nupkg -DestinationPath $versionRoot -Force
+
+          # Why: strip nupkg packaging entries so only the module files remain.
+          foreach ($entry in @('_rels', 'package', '[Content_Types].xml', 'SignPath.nuspec')) {
+            $path = Join-Path -Path $versionRoot -ChildPath $entry
+            if (Test-Path -LiteralPath $path) {
+              Remove-Item -LiteralPath $path -Recurse -Force
+            }
+          }
+
+          $manifest = Join-Path -Path $versionRoot -ChildPath 'SignPath.psd1'
+          if (-not (Test-Path -LiteralPath $manifest)) {
+            throw "Pinned SignPath nupkg did not contain SignPath.psd1 at $versionRoot."
+          }
+
+          Test-SignPathModule
+        }

.github/scripts/check-root-directory-entries.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+  echo "Usage: $0 <base-sha> <head-sha>" >&2
+  exit 2
+fi
+
+base_sha=$1
+head_sha=$2
+git rev-parse --verify "${base_sha}^{tree}" >/dev/null
+git rev-parse --verify "${head_sha}^{tree}" >/dev/null
+
+declare -A base_entries=()
+while IFS= read -r -d '' entry; do
+  base_entries["$entry"]=1
+done < <(git ls-tree -z --name-only "$base_sha")
+
+blocked_entries=()
+while IFS= read -r -d '' entry; do
+  if [[ -z "${base_entries[$entry]+present}" ]]; then
+    blocked_entries+=("$entry")
+  fi
+done < <(git ls-tree -z --name-only "$head_sha")
+
+if (( ${#blocked_entries[@]} == 0 )); then
+  echo "Root directory guard passed: no new root-level files or folders."
+  exit 0
+fi
+
+echo "::error title=Root-level additions blocked::New root-level files or folders bloat the GitHub landing page."
+echo "Root directory guard failed."
+echo "New root-level files or folders are not allowed because they bloat the GitHub landing page."
+echo "Move each new entry under an existing top-level directory."
+printf 'Blocked entries:\n'
+printf '  %s\n' "${blocked_entries[@]}"
+exit 1