@@ -1,239 +1,136 @@
-name: desktop-e2e
-
-# Smoke coverage of the real Electron shell on desktop changes, plus a weekly
-# advisory canary against electron@latest so Chromium-cadence breakage surfaces
-# before an upgrade is attempted.
-
+name: desktop-release-review-validation
 on:
-  pull_request:
-    paths:
-      - '.github/workflows/desktop-e2e.yml'
-      - '.github/workflows/desktop-release.yml'
-      - 'apps/desktop/**'
-      - 'apps/sim/app/_shell/desktop-update-*.tsx'
-      - 'apps/sim/app/workspace/**/home/hooks/use-mothership-resize.ts'
-      - 'apps/sim/app/workspace/**/home/hooks/use-resource-panel.ts'
-      - 'apps/sim/app/workspace/**/home/components/chat-panel-layout.tsx'
-      - 'apps/sim/stores/chat-panel/**'
-      - 'apps/sim/stores/constants.ts'
-      - 'apps/sim/lib/browser-agent/transport.ts'
-      - 'apps/sim/lib/core/utils/separator-keys.ts'
-      - 'apps/sim/scripts/fixtures/chat-panel.tsx'
-      - 'apps/sim/app/layout.tsx'
-      - 'apps/sim/hooks/use-desktop-update-state.ts'
-      - 'apps/sim/lib/desktop/**'
-      - 'apps/sim/app/desktop/connect/**'
-      - 'apps/sim/app/credential-groups/**'
-      - 'apps/sim/hooks/queries/slack-search.ts'
-      - 'apps/sim/hooks/queries/personal-search-integrations.ts'
-      - 'apps/sim/hooks/use-search-integration-connection.ts'
-      - 'apps/sim/hooks/use-github-installation-setup.ts'
-      - 'apps/sim/lib/api/contracts/desktop-source-connect.ts'
-      - 'apps/sim/scripts/fixtures/desktop-source-connect.tsx'
-      - 'apps/sim/app/workspace/**/browser-session/**'
-      - 'apps/sim/app/_styles/**'
-      - 'apps/sim/lib/postcss/**'
-      - 'apps/sim/postcss.config.mjs'
-      - 'apps/sim/public/brand/fonts/**'
-      - 'packages/emcn/**'
-      - 'packages/desktop-bridge/**'
-      - 'packages/browser-protocol/**'
-      - 'packages/terminal-protocol/**'
-      - 'packages/logger/**'
-      - 'packages/security/**'
-      - 'packages/tsconfig/**'
-      - 'packages/utils/**'
-      - 'bun.lock'
-      - 'package.json'
-  schedule:
-    - cron: '23 9 * * 1'
   workflow_dispatch:
-
 permissions:
   contents: read
-
-concurrency:
-  group: desktop-e2e-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  e2e:
-    name: e2e
-    if: github.event_name != 'schedule'
-    runs-on: macos-26
-    timeout-minutes: 30
+  root:
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 40
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.4.2
-
-      # Electron, electron-builder and Playwright download their binaries on every cold install. All
-      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
-      - name: Cache Electron and Playwright downloads
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          path: |
-            ~/Library/Caches/electron
-            ~/Library/Caches/electron-builder
-            ~/Library/Caches/ms-playwright
-          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: desktop-downloads-${{ runner.os }}-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Bundle main and preload
-        working-directory: apps/desktop
-        run: bun run build
-
-      - name: Install system-browser fixture
-        working-directory: apps/desktop
-        run: bunx playwright install chromium
-
-      # The terminal-cancel suite drives a real tmux server; without tmux its tmux scenarios skip.
-      - name: Install tmux
-        run: brew install tmux
-
-      - name: Run Playwright _electron smoke suite
-        working-directory: apps/desktop
-        run: bunx playwright test
+          node-version: 22
+      - run: command -v rg || (sudo apt-get update && sudo apt-get install -y ripgrep)
+      - run: bun install --frozen-lockfile
+      - name: Complete root test gate
         env:
-          BACKGROUND_EXECUTOR_REPORT_PATH: test-results/background-executor-report.json
-          TERMINAL_CANCEL_REPORT_PATH: test-results/terminal-cancel-report.json
-
-      - name: Upload test results
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+          VITEST_MAX_WORKERS: '4'
+        run: |
+          set -o pipefail
+          bun run test 2>&1 | tee full-test.log
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        if: always()
         with:
-          name: desktop-e2e-results-pinned
-          path: apps/desktop/test-results
-          retention-days: 7
-
-  e2e-canary:
-    name: e2e-canary
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+          name: release-review-root-tests
+          path: full-test.log
+  native:
     runs-on: macos-26
     timeout-minutes: 30
-    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        variant: [baseline, pinned, canary]
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+          fetch-depth: 2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.4.2
-
-      # Electron, electron-builder and Playwright download their binaries on every cold install. All
-      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
-      - name: Cache Electron and Playwright downloads
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          path: |
-            ~/Library/Caches/electron
-            ~/Library/Caches/electron-builder
-            ~/Library/Caches/ms-playwright
-          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: desktop-downloads-${{ runner.os }}-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Switch to electron@latest
+          node-version: 22
+      - run: bun install --frozen-lockfile
+      - if: matrix.variant == 'canary'
         working-directory: apps/desktop
         run: bun add --no-save -d electron@latest
-
-      - name: Bundle main and preload
-        working-directory: apps/desktop
+      - name: Restore only the menu guard for the regression control
+        if: matrix.variant == 'baseline'
+        run: git show HEAD^:apps/desktop/src/main/menu.ts > apps/desktop/src/main/menu.ts
+      - working-directory: apps/desktop
         run: bun run build
-
-      - name: Install system-browser fixture
+      - if: matrix.variant != 'baseline'
         working-directory: apps/desktop
         run: bunx playwright install chromium
-
-      # The terminal-cancel suite drives a real tmux server; without tmux its tmux scenarios skip.
-      - name: Install tmux
+      - if: matrix.variant != 'baseline'
         run: brew install tmux
-
-      - name: Run Playwright _electron smoke suite
+      - name: Require the unfixed menu to fail for the reported reason
+        if: matrix.variant == 'baseline'
+        working-directory: apps/desktop
+        run: |
+          set +e
+          bunx playwright test e2e/smoke.spec.ts -g 'Folder Access opens from the focused main window and server picker' --retries=0 > menu-baseline.log 2>&1
+          result=$?
+          set -e
+          cat menu-baseline.log
+          test "$result" -ne 0
+          python3 - <<'PY'
+          import json
+          from pathlib import Path
+          reports=list(Path('test-results').rglob('folder-access-menu.json'))
+          assert len(reports)==1, reports
+          checks=json.loads(reports[0].read_text())['checks']
+          assert len(checks)==2, checks
+          assert checks[0]['status']=='passed', checks
+          assert checks[1]['status']=='failed' and checks[1]['shown'] is False and checks[1]['parentUrl'] is None, checks
+          print('Confirmed: main-window control passes; utility-window menu fails on the original guard.')
+          PY
+      - name: Full native suite with zero retries
+        if: matrix.variant != 'baseline'
         working-directory: apps/desktop
-        run: bunx playwright test
+        run: bunx playwright test --retries=0
         env:
           BACKGROUND_EXECUTOR_REPORT_PATH: test-results/background-executor-report.json
           TERMINAL_CANCEL_REPORT_PATH: test-results/terminal-cancel-report.json
-
-      - name: Upload test results
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        if: always()
         with:
-          name: desktop-e2e-results-latest
-          path: apps/desktop/test-results
-          retention-days: 7
-
-  package-smoke:
-    name: package-smoke
-    if: github.event_name != 'schedule'
-    runs-on: macos-26
+          name: release-review-native-${{ matrix.variant }}
+          path: |
+            apps/desktop/test-results
+            apps/desktop/menu-baseline.log
+  windows:
+    runs-on: windows-latest
     timeout-minutes: 20
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+          fetch-depth: 2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.4.2
-
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: 22
-
-      # Electron, electron-builder and Playwright download their binaries on every cold install. All
-      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
-      - name: Cache Electron and Playwright downloads
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
-        with:
-          path: |
-            ~/Library/Caches/electron
-            ~/Library/Caches/electron-builder
-            ~/Library/Caches/ms-playwright
-          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: desktop-downloads-${{ runner.os }}-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Bundle and package unsigned
-        working-directory: apps/desktop
-        env:
-          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+      - run: bun install --frozen-lockfile
+      - name: Require original test entrypoint to reject Windows
+        shell: pwsh
         run: |
-          bun run build
-          bunx electron-builder --mac dir --universal --publish never \
-            -c.mac.identity=- -c.mac.hardenedRuntime=false
-
-      - name: Run packaged Electron smoke suite
-        working-directory: apps/desktop
+          git show HEAD^:apps/desktop/package.json | Set-Content apps/desktop/package.json
+          $output = & bun run --cwd apps/desktop test src/main/menu.test.ts 2>&1 | Out-String
+          $result = $LASTEXITCODE
+          $output | Set-Content windows-baseline.log
+          Write-Output $output
+          git restore apps/desktop/package.json
+          if ($result -eq 0 -or -not $output.Contains('Native desktop modules require macOS or Linux.')) { throw 'Baseline did not reproduce the native prebuild rejection.' }
+      - name: Run portable cases through the real package test entrypoint
+        shell: pwsh
         run: |
-          APP_BUNDLE="$(find release -maxdepth 2 -name '*.app' -print -quit)"
-          if [ -z "$APP_BUNDLE" ]; then
-            echo "::error::Packaged app bundle was not found."
-            exit 1
-          fi
-          EXECUTABLE="$(find "$APP_BUNDLE/Contents/MacOS" -maxdepth 1 -type f -perm -111 -print -quit)"
-          if [ -z "$EXECUTABLE" ]; then
-            echo "::error::Packaged app executable was not found."
-            exit 1
-          fi
-          SIM_DESKTOP_EXECUTABLE="$EXECUTABLE" bunx playwright test e2e/packaged-smoke.spec.ts
+          & bun run --cwd apps/desktop test src/main/local-files.test.ts src/main/desktop-executor/runner.test.ts src/main/security-guards.test.ts src/main/config.test.ts src/main/desktop-settings.test.ts --reporter=default --reporter=json --outputFile=../../windows-portable-tests.json
+          exit $LASTEXITCODE
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        if: always()
+        with:
+          name: release-review-windows-tests
+          path: |
+            windows-baseline.log
+            windows-portable-tests.json
@@ -52,7 +52,7 @@ bun run dev                 # bundle + launch against https://www.sim.ai
 SIM_DESKTOP_ORIGIN=http://localhost:3000 bun run dev   # against local sim
 ```
 
-- `bun run test` — vitest unit suite (electron is mocked; runs anywhere).
+- `bun run test` — Vitest suite with Electron mocked. Native directory cases build and run on macOS/Linux; Windows can run the remaining cases without compiling native modules. `bun run test:watch` uses the same setup.
 - `bun run test:e2e` — Playwright `_electron` smoke suite against a fixture origin (macOS, real Electron window).
 - `bun run type-check` / `lint:check` — standard workspace checks; CI picks these up automatically via `turbo run`.
 - `SIM_DESKTOP_USER_DATA=<dir>` isolates settings/partition state (used by e2e).