Skip unrelated required checks without losing their names (#2542)

* fix(ci): skip unrelated required checks cleanly

Matrix jobs had to start no-op runners to preserve interpolated required-check names. Static named jobs let GitHub report genuine skipped conclusions while keeping those names stable.

* fix(ci): gate changes to install patching script

* fix(ci): route cross-package test contracts narrowly

* fix(ci): keep routed contracts merge-blocking

* fix(server): exclude nested test utilities from builds

* fix(ci): cover app-owned native and browser domains

* refactor(ci): align tests with runtime domains

Own browser specs, desktop specs, and Electron-only app code by stable directories so PR routing does not depend on filename conventions. Keep desktop integration coverage inside the required desktop check.

* fix(ci): keep routing and desktop suites isolated

The routing regression must run before dependency installation, and desktop Vitest must not collect Playwright-owned specs.

* fix(ci): isolate desktop e2e runtime

* perf(test): isolate Playwright workers

* perf(test): parallelize Playwright within specs

* fix(test): keep Playwright file scheduling

* fix(test): share dynamic Metro fixture

* fix(test): preserve own-host restart fixtures

* fix(ci): preserve routed contracts after rebase

* Stabilize Playwright wheel-scroll assertions

packages/cli/src/commands/hooks.test.ts

@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import { AGENT_HOOK_PROVIDERS } from "@getpaseo/server/agent-hooks";
 import { describe, expect, it } from "vitest";
 import { runHooksCommand } from "./hooks.js";
@@ -75,6 +76,14 @@ function expectPostedState(fetch: RecordingFetch, state: string) {
 }
 
 describe("runHooksCommand", () => {
+  it("keeps provider names out of the generic command", () => {
+    const source = readFileSync(new URL("./hooks.ts", import.meta.url), "utf8").toLowerCase();
+
+    for (const providerId of Object.keys(AGENT_HOOK_PROVIDERS)) {
+      expect(source).not.toContain(providerId);
+    }
+  });
+
   it.each([
     [claudeProvider.events[0].event, "running"],
     [claudeProvider.events[1].event, "idle"],

packages/cli/tests/26-daemon-launch-supervision.test.ts

@@ -1,124 +0,0 @@
-#!/usr/bin/env npx tsx
-
-/**
- * Regression: executable daemon launch commands must enter the supervisor.
- * The worker entry remains an implementation detail of supervisor-entrypoint.
- */
-
-import assert from "node:assert";
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-
-const repoRoot = join(import.meta.dirname, "../../..");
-const serverPackagePath = join(repoRoot, "packages/server/package.json");
-const appGlobalSetupPath = join(repoRoot, "packages/app/e2e/global-setup.ts");
-const serverConnectionOfferE2ePath = join(
-  repoRoot,
-  "packages/server/src/server/daemon-e2e/connection-offer.e2e.test.ts",
-);
-const desktopRuntimePathsPath = join(repoRoot, "packages/desktop/src/daemon/runtime-paths.ts");
-const nixPackagePath = join(repoRoot, "nix/package.nix");
-const nixModulePath = join(repoRoot, "nix/module.nix");
-
-function assertNoDirectWorkerLaunch(label: string, command: string): void {
-  assert(
-    !command.includes("src/server/index.ts"),
-    `${label} must not launch src/server/index.ts directly: ${command}`,
-  );
-  assert(
-    !command.includes("dist/server/server/index.js"),
-    `${label} must not launch dist/server/server/index.js directly: ${command}`,
-  );
-  assert(
-    !command.includes("src/server/daemon-worker.ts"),
-    `${label} must not launch src/server/daemon-worker.ts directly: ${command}`,
-  );
-  assert(
-    !command.includes("dist/server/server/daemon-worker.js"),
-    `${label} must not launch dist/server/server/daemon-worker.js directly: ${command}`,
-  );
-}
-
-function assertNoSpawnedWorkerEntrypoint(label: string, source: string): void {
-  assertNoDirectWorkerLaunch(label, source);
-  assert(
-    !/spawn\([^)]*["'`][^"'`]*\.\.\/index\.ts["'`]/s.test(source),
-    `${label} must not spawn ../index.ts directly`,
-  );
-}
-
-console.log("=== Daemon Launch Supervision Regression ===\n");
-
-console.log("Test 1: server package scripts launch supervisor-entrypoint");
-const serverPackage = JSON.parse(await readFile(serverPackagePath, "utf-8")) as {
-  scripts?: Record<string, string>;
-};
-const startScript = serverPackage.scripts?.start ?? "";
-const devScript = serverPackage.scripts?.dev ?? "";
-const devTsxScript = serverPackage.scripts?.["dev:tsx"] ?? "";
-
-assert(startScript.includes("dist/scripts/supervisor-entrypoint.js"), startScript);
-assertNoDirectWorkerLaunch("server start script", startScript);
-assert(devScript.includes("scripts/dev-runner.ts"), devScript);
-assertNoDirectWorkerLaunch("server dev script", devScript);
-assert(devTsxScript.includes("scripts/dev-runner.ts"), devTsxScript);
-assertNoDirectWorkerLaunch("server dev:tsx script", devTsxScript);
-console.log("✓ server package scripts enter supervisor\n");
-
-console.log("Test 2: app e2e global setup launches supervisor-entrypoint in dev mode");
-const appGlobalSetup = await readFile(appGlobalSetupPath, "utf-8");
-assert(
-  appGlobalSetup.includes('spawn(tsxBin, ["scripts/supervisor-entrypoint.ts", "--dev"]'),
-  "app e2e setup should spawn supervisor-entrypoint.ts with --dev",
-);
-assertNoSpawnedWorkerEntrypoint("app e2e global setup", appGlobalSetup);
-console.log("✓ app e2e setup enters supervisor\n");
-
-console.log("Test 3: server daemon e2e process launch enters supervisor");
-const serverConnectionOfferE2e = await readFile(serverConnectionOfferE2ePath, "utf-8");
-assert(
-  serverConnectionOfferE2e.includes("scripts/supervisor-entrypoint.ts"),
-  "server daemon e2e process launch should use supervisor-entrypoint.ts",
-);
-assertNoSpawnedWorkerEntrypoint("server daemon e2e process launch", serverConnectionOfferE2e);
-console.log("✓ server daemon e2e process launch enters supervisor\n");
-
-console.log("Test 4: desktop runtime and Nix wrapper point at supervisor-entrypoint");
-const desktopRuntimePaths = await readFile(desktopRuntimePathsPath, "utf-8");
-assert(
-  desktopRuntimePaths.includes('"dist", "scripts", "supervisor-entrypoint.js"'),
-  "desktop packaged daemon runner should resolve dist/scripts/supervisor-entrypoint.js",
-);
-assert(
-  desktopRuntimePaths.includes('"scripts", "supervisor-entrypoint.ts"'),
-  "desktop dev daemon runner should resolve scripts/supervisor-entrypoint.ts",
-);
-assertNoDirectWorkerLaunch("desktop runtime paths", desktopRuntimePaths);
-
-const nixPackage = await readFile(nixPackagePath, "utf-8");
-assert(
-  nixPackage.includes("dist/scripts/supervisor-entrypoint.js"),
-  "Nix paseo-server wrapper should use dist/scripts/supervisor-entrypoint.js",
-);
-assertNoDirectWorkerLaunch("Nix package wrapper", nixPackage);
-assert(
-  nixPackage.includes("--set PASEO_NODE_ENV production"),
-  "Nix paseo-server wrapper should keep the daemon runtime mode Paseo-scoped",
-);
-assert(
-  !/--set(-default)?\s+NODE_ENV\b/.test(nixPackage),
-  "Nix paseo-server wrapper must not leak NODE_ENV to external agent processes",
-);
-
-const nixModule = await readFile(nixModulePath, "utf-8");
-assert(
-  !/\bNODE_ENV\b\s*=/.test(nixModule),
-  "NixOS module must not leak NODE_ENV to external agent processes",
-);
-assert(
-  !/\bPASEO_NODE_ENV\b/.test(nixModule),
-  "NixOS module must not duplicate the packaged daemon runtime mode",
-);
-console.log("✓ desktop runtime and Nix wrapper enter supervisor without leaking runtime env\n");
-
-console.log("=== Daemon launch supervision regression test passed ===");

packages/cli/tests/34-daemon-status-auth.test.ts

@@ -1,35 +1,16 @@
 #!/usr/bin/env npx tsx
 
 import assert from "node:assert";
-import { writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { createTestPaseoDaemon } from "../../server/src/server/test-utils/paseo-daemon.ts";
 import { runLocalPaseo } from "./helpers/local-cli.ts";
+import { startTestDaemon } from "./helpers/test-daemon.ts";
 
 console.log("=== Daemon Status Auth ===\n");
 
-const CORRECT_PASSWORD_HASH = "$2b$12$GMhF7pN4QnMlHOQXOqjd1OitKWPSmAO3FwB0PHzKtcZR/sAMryz76";
-
-const daemon = await createTestPaseoDaemon({
-  auth: { password: CORRECT_PASSWORD_HASH },
+const daemon = await startTestDaemon({
+  env: { PASEO_PASSWORD: "shared-secret" },
 });
 
 try {
-  await writeFile(
-    join(daemon.paseoHome, "paseo.pid"),
-    `${JSON.stringify(
-      {
-        pid: process.pid,
-        startedAt: new Date().toISOString(),
-        hostname: "status-auth-test",
-        uid: process.getuid?.(),
-        listen: `0.0.0.0:${daemon.port}`,
-      },
-      null,
-      2,
-    )}\n`,
-  );
-
   {
     console.log("Test 1: status reports password requirement without marking daemon unreachable");
     const result = await runLocalPaseo(["daemon", "status", "--json"], {
@@ -86,7 +67,7 @@ try {
     console.log("✓ password-authenticated status remains reachable\n");
   }
 } finally {
-  await daemon.close();
+  await daemon.stop();
 }
 
 console.log("=== Daemon Status Auth Tests Passed ===");

packages/cli/tests/helpers/test-daemon.ts

@@ -169,7 +169,7 @@ export async function createTempDirs(): Promise<{ paseoHome: string; workDir: st
  * Wait for daemon to be ready by running `paseo agent ls`
  * This connects via WebSocket and ensures the daemon is responsive
  */
-async function probeDaemonReady(port: number): Promise<boolean> {
+async function probeDaemonReady(port: number, env?: NodeJS.ProcessEnv): Promise<boolean> {
   try {
     const { exitCode } = await runPaseoCli(
       {
@@ -182,6 +182,7 @@ async function probeDaemonReady(port: number): Promise<boolean> {
         stop: async () => {},
       },
       ["agent", "ls"],
+      { env },
     );
     return exitCode === 0;
   } catch {
@@ -189,11 +190,15 @@ async function probeDaemonReady(port: number): Promise<boolean> {
   }
 }
 
-async function waitForDaemonReady(port: number, timeout = 30000): Promise<void> {
+async function waitForDaemonReady(
+  port: number,
+  timeout = 30000,
+  env?: NodeJS.ProcessEnv,
+): Promise<void> {
   const deadline = Date.now() + timeout;
 
   async function poll(): Promise<void> {
-    if (await probeDaemonReady(port)) return;
+    if (await probeDaemonReady(port, env)) return;
     if (Date.now() >= deadline) {
       throw new Error(`Daemon failed to become ready on port ${port} within ${timeout}ms`);
     }
@@ -314,7 +319,7 @@ export async function startTestDaemon(options?: {
 
   // Wait for daemon to be ready
   try {
-    await waitForDaemonReady(port, timeout);
+    await waitForDaemonReady(port, timeout, options?.env);
     ctx.isReady = true;
   } catch (err) {
     // Daemon failed to start - clean up and rethrow