Use the Node.js version in .nvmrc and run from the repository root:
npm ci
npm run build
npm test
npm run check:docs
npm audit --audit-level=high
npm audit --omit=dev --audit-level=moderate
npm run qa:maintenance
npm run qa:resilience
npm run qa:session-sync
npm run qa:audit
npm run qaShipped dependencies are held to moderate. The full tree, including build and test tools, is held to high: electron-builder (through roarr) and Vitest (through sprintf-js) carry moderate advisories that have no fixed release yet.
Run Electron harnesses sequentially. On headless Linux use xvfb-run; the multilingual window journeys also need a window manager (CI uses Openbox). Windows-only controls and native PTY checks are explicitly scoped to Windows.
qa:maintenance checks ordered threshold validation, settings rollback/retry, task revision conflicts and restart persistence, conflict draft review, and refusal of legacy unversioned task writes. qa:resilience covers the existing disk failure, machine switch, out-of-order responses and native-terminal cases. Unit integration tests also exercise two independently paired clients through real TLS on loopback.
Results and screenshots are written to qa/shots/maintenance/ and qa/shots/resilience/. An abnormal Electron exit fails the harness even if the visible assertions passed. Automated accessibility, boundary checks and screenshots are not human visual approval.
qa:link is a supervised two-app harness that may start installed provider CLIs. qa:close is a supervised two-app harness for the session close lifecycle (remote, offline, refused and bulk close, adoption focus, restart, Apply update); it starts the installed claude CLI in a throwaway repository and sends no prompts. npm run qa:perf -- 4 --allow-live-agents is a manual Windows benchmark and explicitly opts into real-agent startup. Performance QA refuses missing terminals, invisible workload, incomplete streaming/repaint activity and missing CPU samples instead of treating low CPU as success. It has not become a deterministic CI performance gate; that conversion remains a separate task.
Do not run these against a live development conversation. Do not equate a short loopback test with sleep/resume, VPN changes or multi-day field validation.
CI builds/tests on Windows, macOS and Linux using Node.js 24. Linux runs accessibility and multilingual journeys. Windows/Linux run resilience and maintenance regressions. Pull requests additionally exercise packaging through the Release workflow without publishing.
Tagged publication waits for the reusable quality workflow and all OS packages. The actual unpacked Windows executable must pass maintenance, resilience and three-app session synchronization harnesses before assets are published. This verifies the packaged layout, not the NSIS installer wizard, OS trust dialogs, macOS signing/notarization or every in-place upgrade scenario.
A version bump or passing local checks does not publish a release. Record the exact commit, OS/toolchain, commands, counts, failures and skipped/manual scope in a dated review. Dependency audit results can change without a code change; the scheduled audit checks that case. See the documentation index for the current candidate review and historical evidence.
Official checkout/setup-node/artifact actions use verified Node24-native releases pinned to full commit SHAs. Dependabot can propose reviewed updates; build-tool Node selection and the action runtime are separate concerns.
qa:session-sync is the deterministic Windows host/two-viewer test. It uses temporary profiles, homes and repositories, real TLS, fixture CLIs instead of paid agents, actual title controls, on-disk checks, conflict/failure recovery and restart. Source and packaged Windows CI both run it; evidence is saved under qa/shots/session-sync/. Run it sequentially with other Electron tests.
Read state consistency before adding or changing shared metadata. The source of truth is the owner commit, not one renderer's optimistic value or a successful send. Tests must inspect the owner, writer, another observer and persisted result, including failure and restart. See the synchronization review for the red-to-green case.