do not wipe actions

- Add --here position option to insert steps before the current step
- Add --id option to specify custom step IDs for expression references
- Add --help flag support for all step commands with detailed usage info
- Update browser extension UI with ID field and improved position dropdown

.devcontainer/devcontainer.json

@@ -4,10 +4,10 @@
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:1": {},
     "ghcr.io/devcontainers/features/dotnet": {
-      "version": "6.0.419"
+      "version": "8.0.417"
     },
     "ghcr.io/devcontainers/features/node:1": {
-      "version": "16"
+      "version": "20"
     },
     "ghcr.io/devcontainers/features/sshd:1": {
       "version": "latest"

.github/ISSUE_TEMPLATE/config.yml

@@ -1,13 +1,13 @@
 blank_issues_enabled: false
 contact_links:
   - name: 🛑 Request a feature in the runner application
-    url: https://github.com/orgs/community/discussions/categories/actions-and-packages
-    about: If you have feature requests for GitHub Actions, please use the Actions and Packages section on the Github Product Feedback page.
+    url: https://github.com/orgs/community/discussions/categories/actions
+    about: If you have feature requests for GitHub Actions, please use the Actions section on the Github Product Feedback page.
   - name: ✅ Support for GitHub Actions
     url: https://github.community/c/code-to-cloud/52
     about: If you have questions about GitHub Actions or need support writing workflows, please ask in the GitHub Community Support forum.
   - name: ✅ Feedback and suggestions for GitHub Actions
-    url: https://github.com/github/feedback/discussions/categories/actions-and-packages-feedback
+    url: https://github.com/github/feedback/discussions/categories/actions
     about: If you have feedback or suggestions about GitHub Actions, please open a discussion (or add to an existing one) in the GitHub Actions Feedback.  GitHub Actions Product Managers and Engineers monitor the feedback forum.
   - name: ‼️ GitHub Security Bug Bounty
     url: https://bounty.github.com/

.github/copilot-instructions.md

@@ -0,0 +1,25 @@
+## Making changes
+
+### Tests
+
+Whenever possible, changes should be accompanied by non-trivial tests that meaningfully exercise the core functionality of the new code being introduced.
+
+All tests are in the `Test/` directory at the repo root. Fast unit tests are in the `Test/L0` directory and by convention have the suffix `L0.cs`. For example: unit tests for a hypothetical `src/Runner.Worker/Foo.cs` would go in `src/Test/L0/Worker/FooL0.cs`.
+
+Run tests using this command:
+
+```sh
+cd src && ./dev.sh test
+```
+
+### Formatting
+
+After editing .cs files, always format the code using this command:
+
+```sh
+cd src && ./dev.sh format
+```
+
+### Feature Flags
+
+Wherever possible, all changes should be safeguarded by a feature flag; `Features` are declared in [Constants.cs](src/Runner.Common/Constants.cs).

.github/dependabot.yml

@@ -5,6 +5,11 @@ updates:
   schedule:
     interval: "daily" 
   target-branch: "main" 
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "daily" 
+  target-branch: "main" 
 - package-ecosystem: "nuget"
   directory: "/src"
   schedule:

.github/workflows/build.yml

@@ -14,6 +14,9 @@ on:
     paths-ignore:
     - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -41,7 +44,7 @@ jobs:
           devScript: ./dev.sh
 
         - runtime: win-x64
-          os: windows-2019
+          os: windows-latest
           devScript: ./dev
 
         - runtime: win-arm64
@@ -50,7 +53,7 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
 
     # Build runner layout
     - name: Build & Layout Release
@@ -69,14 +72,59 @@ jobs:
     - name: Package Release
       if: github.event_name != 'pull_request'
       run: |
-        ${{ matrix.devScript }} package Release
+        ${{ matrix.devScript }} package Release ${{ matrix.runtime }}
       working-directory: src
 
     # Upload runner package tar.gz/zip as artifact
     - name: Publish Artifact
       if: github.event_name != 'pull_request'
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v6
       with:
         name: runner-package-${{ matrix.runtime }}
         path: |
           _package
+
+  docker:
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, ubuntu-24.04-arm ]
+        include:
+          - os: ubuntu-latest
+            docker_platform: linux/amd64
+          - os: ubuntu-24.04-arm
+            docker_platform: linux/arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Get latest runner version
+      id: latest_runner
+      uses: actions/github-script@v8
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          const release = await github.rest.repos.getLatestRelease({
+            owner: 'actions',
+            repo: 'runner',
+          });
+          const version = release.data.tag_name.replace(/^v/, '');
+          core.setOutput('version', version);
+
+    - name: Setup Docker buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build Docker image
+      uses: docker/build-push-action@v6
+      with:
+        context: ./images
+        load: true
+        platforms: ${{ matrix.docker_platform }}
+        tags: |
+          ${{ github.sha }}:latest
+        build-args: |
+          RUNNER_VERSION=${{ steps.latest_runner.outputs.version }}
+
+    - name: Test Docker image
+      run: |
+        docker run --rm ${{ github.sha }}:latest ./run.sh --version
+  

.github/workflows/close-bugs-bot.yml

@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@v10
         with:
           close-issue-message: "This issue does not seem to be a problem with the runner application, it concerns the GitHub actions platform more generally. Could you please post your feedback on the [GitHub Community Support Forum](https://github.com/orgs/community/discussions/categories/actions) which is actively monitored. Using the forum ensures that we route your problem to the correct team. 😃"
           exempt-issue-labels: "keep"

.github/workflows/close-features-bot.yml

@@ -7,9 +7,9 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@v10
         with:
-          close-issue-message: "Thank you for your interest in the runner application and taking the time to provide your valuable feedback. We kindly ask you to redirect this feedback to the [GitHub Community Support Forum](https://github.com/orgs/community/discussions/categories/actions-and-packages) which our team actively monitors and would be a better place to start a discussion for new feature requests in GitHub Actions. For more information on this policy please [read our contribution guidelines](https://github.com/actions/runner#contribute). 😃"
+          close-issue-message: "Thank you for your interest in the runner application and taking the time to provide your valuable feedback. We kindly ask you to redirect this feedback to the [GitHub Community Support Forum](https://github.com/orgs/community/discussions/categories/actions) which our team actively monitors and would be a better place to start a discussion for new feature requests in GitHub Actions. For more information on this policy please [read our contribution guidelines](https://github.com/actions/runner#contribute). 😃"
           exempt-issue-labels: "keep"
           stale-issue-label: "actions-feature"
           only-labels: "actions-feature"

.github/workflows/codeql.yml

@@ -23,11 +23,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v4
       # Override language selection by uncommenting this and choosing your languages
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
@@ -38,4 +38,4 @@ jobs:
       working-directory: src
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v4

.github/workflows/dependency-check.yml

@@ -0,0 +1,211 @@
+name: Dependency Status Check
+
+on:
+  workflow_dispatch:
+    inputs:
+      check_type:
+        description: "Type of dependency check"
+        required: false
+        default: "all"
+        type: choice
+        options:
+          - all
+          - node
+          - dotnet
+          - docker
+          - npm
+  schedule:
+    - cron: "0 11 * * 1" # Weekly on Monday at 11 AM
+
+jobs:
+  dependency-status:
+    runs-on: ubuntu-latest
+    outputs:
+      node20-status: ${{ steps.check-versions.outputs.node20-status }}
+      node24-status: ${{ steps.check-versions.outputs.node24-status }}
+      dotnet-status: ${{ steps.check-versions.outputs.dotnet-status }}
+      docker-status: ${{ steps.check-versions.outputs.docker-status }}
+      buildx-status: ${{ steps.check-versions.outputs.buildx-status }}
+      npm-vulnerabilities: ${{ steps.check-versions.outputs.npm-vulnerabilities }}
+      open-dependency-prs: ${{ steps.check-prs.outputs.open-dependency-prs }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "20"
+
+      - name: Check dependency versions
+        id: check-versions
+        run: |
+          echo "## Dependency Status Report" >> $GITHUB_STEP_SUMMARY
+          echo "Generated on: $(date)" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          # Check Node versions
+          if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "node" ]]; then
+            echo "### Node.js Versions" >> $GITHUB_STEP_SUMMARY
+            
+            VERSIONS_JSON=$(curl -s https://raw.githubusercontent.com/actions/node-versions/main/versions-manifest.json)
+            LATEST_NODE20=$(echo "$VERSIONS_JSON" | jq -r '.[] | select(.version | startswith("20.")) | .version' | head -1)
+            LATEST_NODE24=$(echo "$VERSIONS_JSON" | jq -r '.[] | select(.version | startswith("24.")) | .version' | head -1)
+            
+            CURRENT_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+            CURRENT_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+            
+            NODE20_STATUS="✅ up-to-date"
+            NODE24_STATUS="✅ up-to-date"
+            
+            if [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then
+              NODE20_STATUS="⚠️ outdated"
+            fi
+            
+            if [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then
+              NODE24_STATUS="⚠️ outdated"
+            fi
+            
+            echo "| Version | Current | Latest | Status |" >> $GITHUB_STEP_SUMMARY
+            echo "|---------|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY
+            echo "| Node 20 | $CURRENT_NODE20 | $LATEST_NODE20 | $NODE20_STATUS |" >> $GITHUB_STEP_SUMMARY
+            echo "| Node 24 | $CURRENT_NODE24 | $LATEST_NODE24 | $NODE24_STATUS |" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            
+            echo "node20-status=$NODE20_STATUS" >> $GITHUB_OUTPUT
+            echo "node24-status=$NODE24_STATUS" >> $GITHUB_OUTPUT
+          fi
+
+          # Check .NET version
+          if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "dotnet" ]]; then
+            echo "### .NET SDK Version" >> $GITHUB_STEP_SUMMARY
+            
+            current_dotnet_version=$(jq -r .sdk.version ./src/global.json)
+            current_major_minor=$(echo "$current_dotnet_version" | cut -d '.' -f 1,2)
+            latest_dotnet_version=$(curl -sb -H "Accept: application/json" "https://dotnetcli.blob.core.windows.net/dotnet/Sdk/$current_major_minor/latest.version")
+            
+            DOTNET_STATUS="✅ up-to-date"
+            if [ "$current_dotnet_version" != "$latest_dotnet_version" ]; then
+              DOTNET_STATUS="⚠️ outdated"
+            fi
+            
+            echo "| Component | Current | Latest | Status |" >> $GITHUB_STEP_SUMMARY
+            echo "|-----------|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY
+            echo "| .NET SDK | $current_dotnet_version | $latest_dotnet_version | $DOTNET_STATUS |" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            
+            echo "dotnet-status=$DOTNET_STATUS" >> $GITHUB_OUTPUT
+          fi
+
+          # Check Docker versions
+          if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "docker" ]]; then
+            echo "### Docker Versions" >> $GITHUB_STEP_SUMMARY
+            
+            current_docker=$(grep "ARG DOCKER_VERSION=" ./images/Dockerfile | cut -d'=' -f2)
+            current_buildx=$(grep "ARG BUILDX_VERSION=" ./images/Dockerfile | cut -d'=' -f2)
+            
+            latest_docker=$(curl -s https://download.docker.com/linux/static/stable/x86_64/ | grep -o 'docker-[0-9]*\.[0-9]*\.[0-9]*\.tgz' | sort -V | tail -n 1 | sed 's/docker-\(.*\)\.tgz/\1/')
+            latest_buildx=$(curl -s https://api.github.com/repos/docker/buildx/releases/latest | jq -r '.tag_name' | sed 's/^v//')
+            
+            DOCKER_STATUS="✅ up-to-date"
+            BUILDX_STATUS="✅ up-to-date"
+            
+            if [ "$current_docker" != "$latest_docker" ]; then
+              DOCKER_STATUS="⚠️ outdated"
+            fi
+            
+            if [ "$current_buildx" != "$latest_buildx" ]; then
+              BUILDX_STATUS="⚠️ outdated"
+            fi
+            
+            echo "| Component | Current | Latest | Status |" >> $GITHUB_STEP_SUMMARY
+            echo "|-----------|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY
+            echo "| Docker | $current_docker | $latest_docker | $DOCKER_STATUS |" >> $GITHUB_STEP_SUMMARY
+            echo "| Docker Buildx | $current_buildx | $latest_buildx | $BUILDX_STATUS |" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            
+            echo "docker-status=$DOCKER_STATUS" >> $GITHUB_OUTPUT
+            echo "buildx-status=$BUILDX_STATUS" >> $GITHUB_OUTPUT
+          fi
+
+          # Check npm vulnerabilities
+          if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "npm" ]]; then
+            echo "### NPM Security Audit" >> $GITHUB_STEP_SUMMARY
+            
+            cd src/Misc/expressionFunc/hashFiles
+            npm install --silent
+            
+            AUDIT_OUTPUT=""
+            AUDIT_EXIT_CODE=0
+            # Run npm audit and capture output and exit code
+            if ! AUDIT_OUTPUT=$(npm audit --json 2>&1); then
+              AUDIT_EXIT_CODE=$?
+            fi
+            
+            # Check if output is valid JSON
+            if echo "$AUDIT_OUTPUT" | jq . >/dev/null 2>&1; then
+              VULN_COUNT=$(echo "$AUDIT_OUTPUT" | jq '.metadata.vulnerabilities.total // 0')
+              # Ensure VULN_COUNT is a number
+              VULN_COUNT=$(echo "$VULN_COUNT" | grep -o '[0-9]*' | head -1)
+              VULN_COUNT=${VULN_COUNT:-0}
+              
+              NPM_STATUS="✅ no vulnerabilities"
+              if [ "$VULN_COUNT" -gt 0 ] 2>/dev/null; then
+                NPM_STATUS="⚠️ $VULN_COUNT vulnerabilities found"
+                
+                # Get vulnerability details
+                HIGH_VULNS=$(echo "$AUDIT_OUTPUT" | jq '.metadata.vulnerabilities.high // 0')
+                CRITICAL_VULNS=$(echo "$AUDIT_OUTPUT" | jq '.metadata.vulnerabilities.critical // 0')
+                
+                echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY
+                echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
+                echo "| Critical | $CRITICAL_VULNS |" >> $GITHUB_STEP_SUMMARY
+                echo "| High | $HIGH_VULNS |" >> $GITHUB_STEP_SUMMARY
+                echo "" >> $GITHUB_STEP_SUMMARY
+              else
+                echo "No npm vulnerabilities found ✅" >> $GITHUB_STEP_SUMMARY
+                echo "" >> $GITHUB_STEP_SUMMARY
+              fi
+            else
+              NPM_STATUS="❌ npm audit failed"
+              echo "npm audit failed to run or returned invalid JSON ❌" >> $GITHUB_STEP_SUMMARY
+              echo "Exit code: $AUDIT_EXIT_CODE" >> $GITHUB_STEP_SUMMARY
+              echo "Output: $AUDIT_OUTPUT" >> $GITHUB_STEP_SUMMARY
+              echo "" >> $GITHUB_STEP_SUMMARY
+            fi
+            
+            echo "npm-vulnerabilities=$NPM_STATUS" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Check for open dependency PRs
+        id: check-prs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "### Open Dependency PRs" >> $GITHUB_STEP_SUMMARY
+
+          # Get open PRs with dependency label
+          OPEN_PRS=$(gh pr list --label "dependencies" --state open --json number,title,url)
+          PR_COUNT=$(echo "$OPEN_PRS" | jq '. | length')
+
+          if [ "$PR_COUNT" -gt 0 ]; then
+            echo "Found $PR_COUNT open dependency PR(s):" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "$OPEN_PRS" | jq -r '.[] | "- [#\(.number)](\(.url)) \(.title)"' >> $GITHUB_STEP_SUMMARY
+          else
+            echo "No open dependency PRs found ✅" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "open-dependency-prs=$PR_COUNT" >> $GITHUB_OUTPUT
+
+      - name: Summary
+        run: |
+          echo "### Summary" >> $GITHUB_STEP_SUMMARY
+          echo "- Check for open PRs with the \`dependency\` label before releases" >> $GITHUB_STEP_SUMMARY
+          echo "- Review and merge dependency updates regularly" >> $GITHUB_STEP_SUMMARY
+          echo "- Critical vulnerabilities should be addressed immediately" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Automated workflows run weekly to check for updates:**" >> $GITHUB_STEP_SUMMARY
+          echo "- Node.js versions (Mondays at 6 AM)" >> $GITHUB_STEP_SUMMARY
+          echo "- NPM audit fix (Mondays at 7 AM)" >> $GITHUB_STEP_SUMMARY
+          echo "- .NET SDK updates (Mondays at midnight)" >> $GITHUB_STEP_SUMMARY
+          echo "- Docker/Buildx updates (Mondays at midnight)" >> $GITHUB_STEP_SUMMARY

.github/workflows/docker-buildx-upgrade.yml

@@ -0,0 +1,166 @@
+name: "Docker/Buildx Version Upgrade"
+
+on:
+  schedule:
+    - cron: "0 0 * * 1" # Run every Monday at midnight
+  workflow_dispatch: # Allow manual triggering
+
+jobs:
+  check-versions:
+    runs-on: ubuntu-latest
+    outputs:
+      DOCKER_SHOULD_UPDATE: ${{ steps.check_docker_version.outputs.SHOULD_UPDATE }}
+      DOCKER_LATEST_VERSION: ${{ steps.check_docker_version.outputs.LATEST_VERSION }}
+      DOCKER_CURRENT_VERSION: ${{ steps.check_docker_version.outputs.CURRENT_VERSION }}
+      BUILDX_SHOULD_UPDATE: ${{ steps.check_buildx_version.outputs.SHOULD_UPDATE }}
+      BUILDX_LATEST_VERSION: ${{ steps.check_buildx_version.outputs.LATEST_VERSION }}
+      BUILDX_CURRENT_VERSION: ${{ steps.check_buildx_version.outputs.CURRENT_VERSION }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Check Docker version
+        id: check_docker_version
+        shell: bash
+        run: |
+          # Extract current Docker version from Dockerfile
+          current_version=$(grep "ARG DOCKER_VERSION=" ./images/Dockerfile | cut -d'=' -f2)
+
+          # Fetch latest Docker Engine version from Docker's download site
+          # This gets the latest Linux static binary version which matches what's used in the Dockerfile
+          latest_version=$(curl -s https://download.docker.com/linux/static/stable/x86_64/ | grep -o 'docker-[0-9]*\.[0-9]*\.[0-9]*\.tgz' | sort -V | tail -n 1 | sed 's/docker-\(.*\)\.tgz/\1/')
+
+          # Extra check to ensure we got a valid version
+          if [[ ! $latest_version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Failed to retrieve a valid Docker version"
+            exit 1
+          fi
+
+          should_update=0
+          [ "$current_version" != "$latest_version" ] && should_update=1
+
+          echo "CURRENT_VERSION=${current_version}" >> $GITHUB_OUTPUT
+          echo "LATEST_VERSION=${latest_version}" >> $GITHUB_OUTPUT
+          echo "SHOULD_UPDATE=${should_update}" >> $GITHUB_OUTPUT
+
+      - name: Check Buildx version
+        id: check_buildx_version
+        shell: bash
+        run: |
+          # Extract current Buildx version from Dockerfile
+          current_version=$(grep "ARG BUILDX_VERSION=" ./images/Dockerfile | cut -d'=' -f2)
+
+          # Fetch latest Buildx version
+          latest_version=$(curl -s https://api.github.com/repos/docker/buildx/releases/latest | jq -r '.tag_name' | sed 's/^v//')
+
+          should_update=0
+          [ "$current_version" != "$latest_version" ] && should_update=1
+
+          echo "CURRENT_VERSION=${current_version}" >> $GITHUB_OUTPUT
+          echo "LATEST_VERSION=${latest_version}" >> $GITHUB_OUTPUT
+          echo "SHOULD_UPDATE=${should_update}" >> $GITHUB_OUTPUT
+
+      - name: Create annotations for versions
+        run: |
+          docker_should_update="${{ steps.check_docker_version.outputs.SHOULD_UPDATE }}"
+          buildx_should_update="${{ steps.check_buildx_version.outputs.SHOULD_UPDATE }}"
+
+          # Show annotation if only Docker needs update
+          if [[ "$docker_should_update" == "1" && "$buildx_should_update" == "0" ]]; then
+            echo "::warning ::Docker version (${{ steps.check_docker_version.outputs.LATEST_VERSION }}) needs update but Buildx is current. Only updating when both need updates."
+          fi
+
+          # Show annotation if only Buildx needs update
+          if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "1" ]]; then
+            echo "::warning ::Buildx version (${{ steps.check_buildx_version.outputs.LATEST_VERSION }}) needs update but Docker is current. Only updating when both need updates."
+          fi
+
+          # Show annotation when both are current
+          if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "0" ]]; then
+            echo "::warning ::Latest Docker version is ${{ steps.check_docker_version.outputs.LATEST_VERSION }} and Buildx version is ${{ steps.check_buildx_version.outputs.LATEST_VERSION }}. No updates needed."
+          fi
+
+  update-versions:
+    permissions:
+      pull-requests: write
+      contents: write
+    needs: [check-versions]
+    if: ${{ needs.check-versions.outputs.DOCKER_SHOULD_UPDATE == 1 && needs.check-versions.outputs.BUILDX_SHOULD_UPDATE == 1 }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Update Docker version
+        shell: bash
+        run: |
+          latest_version="${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}"
+          current_version="${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }}"
+
+          # Update version in Dockerfile
+          sed -i "s/ARG DOCKER_VERSION=$current_version/ARG DOCKER_VERSION=$latest_version/g" ./images/Dockerfile
+
+      - name: Update Buildx version
+        shell: bash
+        run: |
+          latest_version="${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
+          current_version="${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }}"
+
+          # Update version in Dockerfile
+          sed -i "s/ARG BUILDX_VERSION=$current_version/ARG BUILDX_VERSION=$latest_version/g" ./images/Dockerfile
+
+      - name: Commit changes and create Pull Request
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Setup branch and commit information
+          branch_name="feature/docker-buildx-upgrade"
+          commit_message="Upgrade Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
+          pr_title="Update Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
+
+          # Configure git
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
+
+          # Create branch or switch to it if it exists
+          if git show-ref --quiet refs/remotes/origin/$branch_name; then
+            git fetch origin
+            git checkout -B "$branch_name" origin/$branch_name
+          else
+            git checkout -b "$branch_name"
+          fi
+
+          # Commit and push changes
+          git commit -a -m "$commit_message"
+          git push --force origin "$branch_name"
+
+          # Create PR body using here-doc for proper formatting
+          cat > pr_body.txt << 'EOF'
+          Automated Docker and Buildx version update:
+          
+          - Docker: ${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}
+          - Buildx: ${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}
+          
+          This update ensures we're using the latest stable Docker and Buildx versions for security and performance improvements.
+          
+          **Release notes:** https://docs.docker.com/engine/release-notes/
+          
+          **Next steps:**
+          - Review the version changes
+          - Verify container builds work as expected
+          - Test multi-platform builds if applicable
+          - Merge when ready
+          
+          ---
+          
+          Autogenerated by [Docker/Buildx Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/docker-buildx-upgrade.yml)
+          EOF
+
+          # Create PR
+          gh pr create -B main -H "$branch_name" \
+            --title "$pr_title" \
+            --label "dependencies" \
+            --label "dependencies-weekly-check" \
+            --label "dependencies-not-dependabot" \
+            --label "docker" \
+            --body-file pr_body.txt

.github/workflows/docker-publish.yml

@@ -1,48 +1,47 @@
-name: Publish Runner Image
+name: Publish DockerImage from Release Branch
 
 on:
   workflow_dispatch:
     inputs:
-      runnerVersion:
-        type: string
-        description: Version of the runner being installed
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
+      releaseBranch:
+        description: 'Release Branch (releases/mXXX)'
+        required: true
 
 jobs:
-  build:
+  publish-image:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
-
+      id-token: write
+      attestations: write
+    env:
+      REGISTRY: ghcr.io
+      IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.releaseBranch }}
 
       - name: Compute image version
         id: image
-        uses: actions/github-script@v6
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
-            const inputRunnerVersion = "${{ github.event.inputs.runnerVersion }}"
-            if (inputRunnerVersion) {
-              console.log(`Using input runner version ${inputRunnerVersion}`)
-              core.setOutput('version', inputRunnerVersion);
-              return
+            const runnerVersion = fs.readFileSync('${{ github.workspace }}/releaseVersion', 'utf8').replace(/\n$/g, '');
+            console.log(`Using runner version ${runnerVersion}`);
+            if (!/^\d+\.\d+\.\d+$/.test(runnerVersion)) {
+              throw new Error(`Invalid runner version: ${runnerVersion}`);
             }
-            const runnerVersion = fs.readFileSync('${{ github.workspace }}/src/runnerversion', 'utf8').replace(/\n$/g, '')
-            console.log(`Using runner version ${runnerVersion}`)
             core.setOutput('version', runnerVersion);
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -50,7 +49,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           context: ./images
           platforms: |
@@ -64,5 +63,13 @@ jobs:
           push: true
           labels: |
             org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
-            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
             org.opencontainers.image.licenses=MIT
+          annotations: |
+            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
+
+      - name: Generate attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.build-and-push.outputs.digest }}
+          push-to-registry: true

.github/workflows/dotnet-upgrade.yml

@@ -2,20 +2,20 @@ name: "DotNet SDK Upgrade"
 
 on:
   schedule:
-    - cron: '0 0 * * 1'
+    - cron: "0 8 * * 1" # Weekly on Monday at 8 AM UTC (independent of Node.js/NPM)
   workflow_dispatch:
 
 jobs:
   dotnet-update:
     runs-on: ubuntu-latest
-    outputs: 
+    outputs:
       SHOULD_UPDATE: ${{ steps.fetch_latest_version.outputs.SHOULD_UPDATE }}
       BRANCH_EXISTS: ${{ steps.fetch_latest_version.outputs.BRANCH_EXISTS }}
       DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION: ${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
       DOTNET_CURRENT_MAJOR_MINOR_VERSION: ${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
       - name: Get current major minor version
         id: fetch_current_version
         shell: bash
@@ -37,7 +37,7 @@ jobs:
 
           # check if git branch already exists for the upgrade
           branch_already_exists=0
-          
+
           if git ls-remote --heads --exit-code origin refs/heads/feature/dotnetsdk-upgrade/${latest_patch_version};
           then 
             branch_already_exists=1
@@ -51,7 +51,7 @@ jobs:
         run: echo "::error links::feature/dotnet-sdk-upgrade${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} https://github.com/actions/runner/tree/feature/dotnet-sdk-upgrade${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}::Branch feature/dotnetsdk-upgrade/${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} already exists. Please take a look and delete that branch if you wish to recreate"
       - name: Create a warning annotation if no need to update
         if: ${{ steps.fetch_latest_version.outputs.SHOULD_UPDATE == 0 && steps.fetch_latest_version.outputs.BRANCH_EXISTS == 0 }}
-        run: echo "::warning ::Latest DotNet SDK patch is ${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}, and we are on ${{ steps.fetch_latest_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_PATCH_VERSION }}. No need to update"
+        run: echo "::warning ::Latest DotNet SDK patch is ${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}, and we are on ${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_PATCH_VERSION }}. No need to update"
       - name: Update patch version
         if: ${{ steps.fetch_latest_version.outputs.SHOULD_UPDATE == 1 && steps.fetch_latest_version.outputs.BRANCH_EXISTS == 0 }}
         shell: bash
@@ -89,17 +89,17 @@ jobs:
     if: ${{ needs.dotnet-update.outputs.SHOULD_UPDATE == 1 && needs.dotnet-update.outputs.BRANCH_EXISTS == 0 }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-      with:
-        ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
-    - name: Create Pull Request
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh pr create -B main -H feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} --title "Update dotnet sdk to latest version @${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}" --body "
-          https://dotnetcli.blob.core.windows.net/dotnet/Sdk/${{ needs.dotnet-update.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}/latest.version
-          
+      - uses: actions/checkout@v6
+        with:
+          ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
+      - name: Create Pull Request
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr create -B main -H feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} --title "Update dotnet sdk to latest version @${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}" --label "dependencies" --label "dependencies-weekly-check" --label "dependencies-not-dependabot" --label "dotnet" --body "
+            https://dotnetcli.blob.core.windows.net/dotnet/Sdk/${{ needs.dotnet-update.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}/latest.version
             
-          ---
-            
-          Autogenerated by [DotNet SDK Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/dotnet-upgrade.yml)"
+              
+            ---
+              
+            Autogenerated by [DotNet SDK Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/dotnet-upgrade.yml)"

.github/workflows/lint.yml

@@ -1,24 +0,0 @@
-name: Lint
-
-on:
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  build:
-    name: Lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-        with:
-          # Ensure full list of changed files within `super-linter`
-          fetch-depth: 0
-      - name: Run linters
-        uses: github/super-linter@v4
-        env:
-          DEFAULT_BRANCH: ${{ github.base_ref }}
-          EDITORCONFIG_FILE_NAME: .editorconfig
-          LINTER_RULES_PATH: /src/
-          VALIDATE_ALL_CODEBASE: false
-          VALIDATE_CSHARP: true

.github/workflows/node-upgrade.yml

@@ -0,0 +1,194 @@
+name: Auto Update Node Version
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # Weekly, every Monday
+  workflow_dispatch:
+
+jobs:
+  update-node:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Get latest Node versions
+        id: node-versions
+        run: |
+          # Get latest Node.js releases from official GitHub releases
+          echo "Fetching latest Node.js releases..."
+
+          # Get latest v20.x release
+          LATEST_NODE20=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
+            jq -r '.[] | select(.tag_name | startswith("v20.")) | .tag_name' | \
+            head -1 | sed 's/^v//')
+
+          # Get latest v24.x release  
+          LATEST_NODE24=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
+            jq -r '.[] | select(.tag_name | startswith("v24.")) | .tag_name' | \
+            head -1 | sed 's/^v//')
+
+          echo "Found Node.js releases: 20=$LATEST_NODE20, 24=$LATEST_NODE24"
+
+          # Verify these versions are available in alpine_nodejs releases
+          echo "Verifying availability in alpine_nodejs..."
+          ALPINE_RELEASES=$(curl -s https://api.github.com/repos/actions/alpine_nodejs/releases | jq -r '.[].tag_name')
+
+          if ! echo "$ALPINE_RELEASES" | grep -q "^v$LATEST_NODE20$"; then
+            echo "::warning title=Node 20 Fallback::Node 20 version $LATEST_NODE20 not found in alpine_nodejs releases, using fallback"
+            # Fall back to latest available alpine_nodejs v20 release
+            LATEST_NODE20=$(echo "$ALPINE_RELEASES" | grep "^v20\." | head -1 | sed 's/^v//')
+            echo "Using latest available alpine_nodejs Node 20: $LATEST_NODE20"
+          fi
+
+          if ! echo "$ALPINE_RELEASES" | grep -q "^v$LATEST_NODE24$"; then
+            echo "::warning title=Node 24 Fallback::Node 24 version $LATEST_NODE24 not found in alpine_nodejs releases, using fallback"
+            # Fall back to latest available alpine_nodejs v24 release
+            LATEST_NODE24=$(echo "$ALPINE_RELEASES" | grep "^v24\." | head -1 | sed 's/^v//')
+            echo "Using latest available alpine_nodejs Node 24: $LATEST_NODE24"
+          fi
+
+          # Validate that we have non-empty version numbers
+          if [ -z "$LATEST_NODE20" ] || [ "$LATEST_NODE20" = "" ]; then
+            echo "::error title=Invalid Node 20 Version::Failed to determine valid Node 20 version. Got: '$LATEST_NODE20'"
+            echo "Available alpine_nodejs releases:"
+            echo "$ALPINE_RELEASES" | head -10
+            exit 1
+          fi
+
+          if [ -z "$LATEST_NODE24" ] || [ "$LATEST_NODE24" = "" ]; then
+            echo "::error title=Invalid Node 24 Version::Failed to determine valid Node 24 version. Got: '$LATEST_NODE24'"
+            echo "Available alpine_nodejs releases:"
+            echo "$ALPINE_RELEASES" | head -10
+            exit 1
+          fi
+
+          # Additional validation: ensure versions match expected format (x.y.z)
+          if ! echo "$LATEST_NODE20" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error title=Invalid Node 20 Format::Node 20 version '$LATEST_NODE20' does not match expected format (x.y.z)"
+            exit 1
+          fi
+
+          if ! echo "$LATEST_NODE24" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error title=Invalid Node 24 Format::Node 24 version '$LATEST_NODE24' does not match expected format (x.y.z)"
+            exit 1
+          fi
+
+          echo "✅ Validated Node versions: 20=$LATEST_NODE20, 24=$LATEST_NODE24"
+          echo "latest_node20=$LATEST_NODE20" >> $GITHUB_OUTPUT
+          echo "latest_node24=$LATEST_NODE24" >> $GITHUB_OUTPUT
+
+          # Check current versions in externals.sh
+          CURRENT_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+          CURRENT_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+
+          echo "current_node20=$CURRENT_NODE20" >> $GITHUB_OUTPUT
+          echo "current_node24=$CURRENT_NODE24" >> $GITHUB_OUTPUT
+
+          # Determine if updates are needed
+          NEEDS_UPDATE20="false"
+          NEEDS_UPDATE24="false"
+
+          if [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then
+            NEEDS_UPDATE20="true"
+            echo "::notice title=Node 20 Update Available::Current: $CURRENT_NODE20 → Latest: $LATEST_NODE20"
+          fi
+
+          if [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then
+            NEEDS_UPDATE24="true"
+            echo "::notice title=Node 24 Update Available::Current: $CURRENT_NODE24 → Latest: $LATEST_NODE24"
+          fi
+
+          if [ "$NEEDS_UPDATE20" == "false" ] && [ "$NEEDS_UPDATE24" == "false" ]; then
+            echo "::notice title=No Updates Needed::All Node.js versions are up to date"
+          fi
+
+          echo "needs_update20=$NEEDS_UPDATE20" >> $GITHUB_OUTPUT
+          echo "needs_update24=$NEEDS_UPDATE24" >> $GITHUB_OUTPUT
+
+      - name: Update externals.sh and create PR
+        if: steps.node-versions.outputs.needs_update20 == 'true' || steps.node-versions.outputs.needs_update24 == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Final validation before making changes
+          NODE20_VERSION="${{ steps.node-versions.outputs.latest_node20 }}"
+          NODE24_VERSION="${{ steps.node-versions.outputs.latest_node24 }}"
+          
+          echo "Final validation of versions before PR creation:"
+          echo "Node 20: '$NODE20_VERSION'"
+          echo "Node 24: '$NODE24_VERSION'"
+          
+          # Validate versions are not empty and match expected format
+          if [ -z "$NODE20_VERSION" ] || ! echo "$NODE20_VERSION" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error title=Invalid Node 20 Version::Refusing to create PR with invalid Node 20 version: '$NODE20_VERSION'"
+            exit 1
+          fi
+          
+          if [ -z "$NODE24_VERSION" ] || ! echo "$NODE24_VERSION" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error title=Invalid Node 24 Version::Refusing to create PR with invalid Node 24 version: '$NODE24_VERSION'"
+            exit 1
+          fi
+          
+          echo "✅ All versions validated successfully"
+
+          # Update the files
+          if [ "${{ steps.node-versions.outputs.needs_update20 }}" == "true" ]; then
+            sed -i 's/NODE20_VERSION="[^"]*"/NODE20_VERSION="'"$NODE20_VERSION"'"/' src/Misc/externals.sh
+          fi
+
+          if [ "${{ steps.node-versions.outputs.needs_update24 }}" == "true" ]; then
+            sed -i 's/NODE24_VERSION="[^"]*"/NODE24_VERSION="'"$NODE24_VERSION"'"/' src/Misc/externals.sh
+          fi
+
+          # Verify the changes were applied correctly
+          echo "Verifying changes in externals.sh:"
+          grep "NODE20_VERSION=" src/Misc/externals.sh
+          grep "NODE24_VERSION=" src/Misc/externals.sh
+          
+          # Ensure we actually have valid versions in the file
+          UPDATED_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+          UPDATED_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+          
+          if [ -z "$UPDATED_NODE20" ] || [ -z "$UPDATED_NODE24" ]; then
+            echo "::error title=Update Failed::Failed to properly update externals.sh"
+            echo "Updated Node 20: '$UPDATED_NODE20'"
+            echo "Updated Node 24: '$UPDATED_NODE24'"
+            exit 1
+          fi
+
+          # Configure git
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
+
+          # Create branch and commit changes
+          branch_name="chore/update-node"
+          git checkout -b "$branch_name"
+          git commit -a -m "chore: update Node versions (20: $NODE20_VERSION, 24: $NODE24_VERSION)"
+          git push --force origin "$branch_name"
+
+          # Create PR body using here-doc for proper formatting
+          cat > pr_body.txt << EOF
+          Automated Node.js version update:
+
+          - Node 20: ${{ steps.node-versions.outputs.current_node20 }} → $NODE20_VERSION
+          - Node 24: ${{ steps.node-versions.outputs.current_node24 }} → $NODE24_VERSION
+
+          This update ensures we're using the latest stable Node.js versions for security and performance improvements.
+
+          **Note**: When updating Node versions, remember to also create a new release of alpine_nodejs at the updated version following the instructions at: https://github.com/actions/alpine_nodejs
+
+          ---
+
+          Autogenerated by [Node Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/node-upgrade.yml)
+          EOF
+
+          # Create PR
+          gh pr create -B main -H "$branch_name" \
+            --title "chore: update Node versions" \
+            --label "dependencies" \
+            --label "dependencies-weekly-check" \
+            --label "dependencies-not-dependabot" \
+            --label "node" \
+            --label "javascript" \
+            --body-file pr_body.txt
+
+          echo "::notice title=PR Created::Successfully created Node.js version update PR on branch $branch_name"

.github/workflows/npm-audit-typescript.yml

@@ -0,0 +1,235 @@
+name: NPM Audit Fix with TypeScript Auto-Fix
+
+on:
+  workflow_dispatch:
+
+jobs:
+  npm-audit-with-ts-fix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "20"
+      - name: NPM install and audit fix with TypeScript auto-repair
+        working-directory: src/Misc/expressionFunc/hashFiles
+        run: |
+          npm install
+
+          # Check for vulnerabilities first
+          echo "Checking for npm vulnerabilities..."
+          if npm audit --audit-level=moderate; then
+            echo "✅ No moderate or higher vulnerabilities found"
+            exit 0
+          fi
+
+          echo "⚠️ Vulnerabilities found, attempting npm audit fix..."
+
+          # Attempt audit fix and capture the result
+          if npm audit fix; then
+            echo "✅ npm audit fix completed successfully"
+            AUDIT_FIX_STATUS="success"
+          else
+            echo "⚠️ npm audit fix failed or had issues"
+            AUDIT_FIX_STATUS="failed"
+            
+            # Try audit fix with --force as a last resort for critical/high vulns only
+            echo "Checking if critical/high vulnerabilities remain..."
+            if ! npm audit --audit-level=high; then
+              echo "🚨 Critical/high vulnerabilities remain, attempting --force fix..."
+              if npm audit fix --force; then
+                echo "⚠️ npm audit fix --force completed (may have breaking changes)"
+                AUDIT_FIX_STATUS="force-fixed"
+              else
+                echo "❌ npm audit fix --force also failed"
+                AUDIT_FIX_STATUS="force-failed"
+              fi
+            else
+              echo "✅ Only moderate/low vulnerabilities remain after failed fix"
+              AUDIT_FIX_STATUS="partial-success"
+            fi
+          fi
+
+          echo "AUDIT_FIX_STATUS=$AUDIT_FIX_STATUS" >> $GITHUB_ENV
+
+          # Try to fix TypeScript issues automatically
+          echo "Attempting to fix TypeScript compatibility issues..."
+
+          # Check if build fails
+          if ! npm run build 2>/dev/null; then
+            echo "Build failed, attempting automated fixes..."
+            
+            # Common fix 1: Update @types/node to latest compatible version
+            echo "Trying to update @types/node to latest version..."
+            npm update @types/node
+            
+            # Common fix 2: If that doesn't work, try installing a specific known-good version
+            if ! npm run build 2>/dev/null; then
+              echo "Trying specific @types/node version..."
+              # Try Node 20 compatible version
+              npm install --save-dev @types/node@^20.0.0
+            fi
+            
+            # Common fix 3: Clear node_modules and reinstall if still failing
+            if ! npm run build 2>/dev/null; then
+              echo "Clearing node_modules and reinstalling..."
+              rm -rf node_modules package-lock.json
+              npm install
+              
+              # Re-run audit fix after clean install if it was successful before
+              if [[ "$AUDIT_FIX_STATUS" == "success" || "$AUDIT_FIX_STATUS" == "force-fixed" ]]; then
+                echo "Re-running npm audit fix after clean install..."
+                npm audit fix || echo "Audit fix failed on second attempt"
+              fi
+            fi
+            
+            # Common fix 4: Try updating TypeScript itself
+            if ! npm run build 2>/dev/null; then
+              echo "Trying to update TypeScript..."
+              npm update typescript
+            fi
+            
+            # Final check
+            if npm run build 2>/dev/null; then
+              echo "✅ Successfully fixed TypeScript issues automatically"
+            else
+              echo "⚠️ Could not automatically fix TypeScript issues"
+            fi
+          else
+            echo "✅ Build passes after audit fix"
+          fi
+
+      - name: Create PR if changes exist
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HUSKY: 0 # Disable husky hooks for automated commits
+        run: |
+          # Check if there are any changes
+          if [ -n "$(git status --porcelain)" ]; then
+            # Configure git
+            git config --global user.name "github-actions[bot]"
+            git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
+
+            # Create branch and commit changes
+            branch_name="chore/npm-audit-fix-with-ts-repair"
+            git checkout -b "$branch_name"
+            
+            # Commit with --no-verify to skip husky hooks
+            git commit -a -m "chore: npm audit fix with automated TypeScript compatibility fixes" --no-verify
+            git push --force origin "$branch_name"
+            
+            # Check final build status and gather info about what was changed
+            build_status="✅ Build passes"
+            fixes_applied=""
+            cd src/Misc/expressionFunc/hashFiles
+            
+            # Check what packages were updated
+            if git diff HEAD~1 package.json | grep -q "@types/node"; then
+              fixes_applied+="\n- Updated @types/node version for TypeScript compatibility"
+            fi
+            if git diff HEAD~1 package.json | grep -q "typescript"; then
+              fixes_applied+="\n- Updated TypeScript version"
+            fi
+            if git diff HEAD~1 package-lock.json | grep -q "resolved"; then
+              fixes_applied+="\n- Updated package dependencies via npm audit fix"
+            fi
+            
+            if ! npm run build 2>/dev/null; then
+              build_status="⚠️ Build fails - manual review required"
+            fi
+            cd - > /dev/null
+            
+            # Create enhanced PR body using here-doc for proper formatting
+            audit_status_msg=""
+            case "$AUDIT_FIX_STATUS" in
+              "success")
+                audit_status_msg="✅ **Audit Fix**: Completed successfully"
+                ;;
+              "partial-success")
+                audit_status_msg="⚠️ **Audit Fix**: Partial success (only moderate/low vulnerabilities remain)"
+                ;;
+              "force-fixed")
+                audit_status_msg="⚠️ **Audit Fix**: Completed with --force (may have breaking changes)"
+                ;;
+              "failed"|"force-failed")
+                audit_status_msg="❌ **Audit Fix**: Failed to resolve vulnerabilities"
+                ;;
+              *)
+                audit_status_msg="❓ **Audit Fix**: Status unknown"
+                ;;
+            esac
+            
+            if [[ "$build_status" == *"fails"* ]]; then
+              cat > pr_body.txt << EOF
+          Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies.
+
+          **Build Status**: ⚠️ Build fails - manual review required
+          $audit_status_msg
+
+          This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes.
+
+          ⚠️ **Manual Review Required**: The build is currently failing after automated fixes were attempted.
+
+          Common issues and solutions:
+          - Check for TypeScript version compatibility with Node.js types
+          - Review breaking changes in updated dependencies
+          - Consider pinning problematic dependency versions temporarily
+          - Review tsconfig.json for compatibility settings
+
+          **Automated Fix Strategy**:
+          1. Run npm audit fix with proper error handling
+          2. Update @types/node to latest compatible version
+          3. Try Node 20 specific @types/node version if needed
+          4. Clean reinstall dependencies if conflicts persist
+          5. Update TypeScript compiler if necessary
+
+          ---
+
+          Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml)
+          EOF
+            else
+              cat > pr_body.txt << EOF
+          Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies.
+
+          **Build Status**: ✅ Build passes
+          $audit_status_msg
+
+          This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes.
+
+          ✅ **Ready to Merge**: All automated fixes were successful and the build passes.
+
+          **Automated Fix Strategy**:
+          1. Run npm audit fix with proper error handling
+          2. Update @types/node to latest compatible version
+          3. Try Node 20 specific @types/node version if needed
+          4. Clean reinstall dependencies if conflicts persist
+          5. Update TypeScript compiler if necessary
+
+          ---
+
+          Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml)
+          EOF
+            fi
+            
+            if [ -n "$fixes_applied" ]; then
+              # Add the fixes applied section to the file
+              sed -i "/This workflow attempts/a\\
+          \\
+          **Automated Fixes Applied**:$fixes_applied" pr_body.txt
+            fi
+            
+            # Create PR with appropriate labels
+            labels="dependencies,dependencies-not-dependabot,typescript,npm,security"
+            if [[ "$build_status" == *"fails"* ]]; then
+              labels="dependencies,dependencies-not-dependabot,typescript,npm,security,needs-manual-review"
+            fi
+            
+            # Create PR
+            gh pr create -B main -H "$branch_name" \
+              --title "chore: npm audit fix with TypeScript auto-repair" \
+              --label "$labels" \
+              --body-file pr_body.txt
+          else
+            echo "No changes to commit"
+          fi

.github/workflows/npm-audit.yml

@@ -0,0 +1,137 @@
+name: NPM Audit Fix
+
+on:
+  schedule:
+    - cron: "0 7 * * 1" # Weekly on Monday at 7 AM UTC
+  workflow_dispatch:
+
+jobs:
+  npm-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "20"
+          
+      - name: NPM install and audit fix
+        working-directory: src/Misc/expressionFunc/hashFiles
+        run: |
+          npm install
+          
+          # Check what vulnerabilities exist
+          echo "=== Checking current vulnerabilities ==="
+          npm audit || true
+          
+          # Apply audit fix --force to get security updates
+          echo "=== Applying npm audit fix --force ==="
+          npm audit fix --force
+          
+          # Test if build still works and set status
+          echo "=== Testing build compatibility ==="
+          if npm run all; then
+            echo "✅ Build successful after audit fix"
+            echo "AUDIT_FIX_STATUS=success" >> $GITHUB_ENV
+          else
+            echo "❌ Build failed after audit fix - will create PR with fix instructions"
+            echo "AUDIT_FIX_STATUS=build_failed" >> $GITHUB_ENV
+          fi
+          
+      - name: Create PR if changes exist
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Check if there are any changes
+          if [ -n "$(git status --porcelain)" ]; then
+            # Configure git
+            git config --global user.name "github-actions[bot]"
+            git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            
+            # Create branch and commit changes
+            branch_name="chore/npm-audit-fix-$(date +%Y%m%d)"
+            git checkout -b "$branch_name"
+            git add .
+            git commit -m "chore: npm audit fix for hashFiles dependencies" --no-verify
+            git push origin "$branch_name"
+            
+            # Create PR body based on what actually happened
+            if [ "$AUDIT_FIX_STATUS" = "success" ]; then
+              cat > pr_body.txt << 'EOF'
+          Automated npm audit fix for security vulnerabilities in hashFiles dependencies.
+          
+          **✅ Full Fix Applied Successfully**
+          This update addresses npm security advisories and ensures dependencies are secure and up-to-date.
+          
+          **Changes made:**
+          - Applied `npm audit fix --force` to resolve security vulnerabilities
+          - Updated package-lock.json with security patches
+          - Verified build compatibility with `npm run all`
+          
+          **Next steps:**
+          - Review the dependency changes  
+          - Verify the hashFiles functionality still works as expected
+          - Merge when ready
+          
+          ---
+          
+          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
+          EOF
+            elif [ "$AUDIT_FIX_STATUS" = "build_failed" ]; then
+              cat > pr_body.txt << 'EOF'
+          Automated npm audit fix for security vulnerabilities in hashFiles dependencies.
+          
+          **⚠️ Security Fixes Applied - Build Issues Need Manual Resolution**
+          This update applies important security patches but causes build failures that require manual fixes.
+          
+          **Changes made:**
+          - Applied `npm audit fix --force` to resolve security vulnerabilities
+          - Updated package-lock.json with security patches
+          
+          **⚠️ Build Issues Detected:**
+          The build fails after applying security fixes, likely due to TypeScript compatibility issues with updated `@types/node`.
+          
+          **Required Manual Fixes:**
+          1. Review TypeScript compilation errors in the build output
+          2. Update TypeScript configuration if needed
+          3. Consider pinning `@types/node` to a compatible version
+          4. Run `npm run all` locally to verify fixes
+          
+          **Next steps:**
+          - **DO NOT merge until build issues are resolved**
+          - Apply manual fixes for TypeScript compatibility
+          - Test the hashFiles functionality still works as expected
+          - Merge when build passes
+          
+          ---
+          
+          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
+          EOF
+            else
+              # Fallback case
+              cat > pr_body.txt << 'EOF'
+          Automated npm audit attempted for security vulnerabilities in hashFiles dependencies.
+          
+          **ℹ️ No Changes Applied**
+          No security vulnerabilities were found or no changes were needed.
+          
+          ---
+          
+          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
+          EOF
+            fi
+            
+            # Create PR
+            gh pr create -B main -H "$branch_name" \
+              --title "chore: npm audit fix for hashFiles dependencies" \
+              --label "dependencies" \
+              --label "dependencies-weekly-check" \
+              --label "dependencies-not-dependabot" \
+              --label "npm" \
+              --label "typescript" \
+              --label "security" \
+              --body-file pr_body.txt
+          else
+            echo "✅ No changes to commit - npm audit fix did not modify any files"
+          fi

.github/workflows/release.yml

@@ -11,16 +11,15 @@ jobs:
     if: startsWith(github.ref, 'refs/heads/releases/') || github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
 
     # Make sure ./releaseVersion match ./src/runnerversion
     # Query GitHub release ensure version is not used
     - name: Check version
-      uses: actions/github-script@0.3.0
+      uses: actions/github-script@v8
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |
-          const core = require('@actions/core')
           const fs = require('fs');
           const runnerVersion = fs.readFileSync('${{ github.workspace }}/src/runnerversion', 'utf8').replace(/\n$/g, '')
           const releaseVersion = fs.readFileSync('${{ github.workspace }}/releaseVersion', 'utf8').replace(/\n$/g, '')
@@ -30,7 +29,7 @@ jobs:
             return
           }
           try {
-            const release = await github.repos.getReleaseByTag({
+            const release = await github.rest.repos.getReleaseByTag({
               owner: '${{ github.event.repository.owner.name }}',
               repo: '${{ github.event.repository.name }}',
               tag: 'v' + runnerVersion
@@ -78,7 +77,7 @@ jobs:
           devScript: ./dev.sh
 
         - runtime: win-x64
-          os: windows-2019
+          os: windows-latest
           devScript: ./dev
 
         - runtime: win-arm64
@@ -87,7 +86,7 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
 
     # Build runner layout
     - name: Build & Layout Release
@@ -117,12 +116,11 @@ jobs:
       working-directory: _package
 
     # Upload runner package tar.gz/zip as artifact.
-    # Since each package name is unique, so we don't need to put ${{matrix}} info into artifact name
     - name: Publish Artifact
       if: github.event_name != 'pull_request'
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v6
       with:
-        name: runner-packages
+        name: runner-packages-${{ matrix.runtime }}
         path: |
           _package
 
@@ -131,23 +129,52 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
 
     # Download runner package tar.gz/zip produced by 'build' job
-    - name: Download Artifact
-      uses: actions/download-artifact@v1
+    - name: Download Artifact (win-x64)
+      uses: actions/download-artifact@v7
       with:
-        name: runner-packages
+        name: runner-packages-win-x64
+        path: ./
+    - name: Download Artifact (win-arm64)
+      uses: actions/download-artifact@v7
+      with:
+        name: runner-packages-win-arm64
+        path: ./
+    - name: Download Artifact (osx-x64)
+      uses: actions/download-artifact@v7
+      with:
+        name: runner-packages-osx-x64
+        path: ./
+    - name: Download Artifact (osx-arm64)
+      uses: actions/download-artifact@v7
+      with:
+        name: runner-packages-osx-arm64
+        path: ./
+    - name: Download Artifact (linux-x64)
+      uses: actions/download-artifact@v7
+      with:
+        name: runner-packages-linux-x64
+        path: ./
+    - name: Download Artifact (linux-arm)
+      uses: actions/download-artifact@v7
+      with:
+        name: runner-packages-linux-arm
+        path: ./
+    - name: Download Artifact (linux-arm64)
+      uses: actions/download-artifact@v7
+      with:
+        name: runner-packages-linux-arm64
         path: ./
 
     # Create ReleaseNote file
     - name: Create ReleaseNote
       id: releaseNote
-      uses: actions/github-script@0.3.0
+      uses: actions/github-script@v8
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |
-          const core = require('@actions/core')
           const fs = require('fs');
           const runnerVersion = fs.readFileSync('${{ github.workspace }}/src/runnerversion', 'utf8').replace(/\n$/g, '')
           var releaseNote = fs.readFileSync('${{ github.workspace }}/releaseNote.md', 'utf8').replace(/<RUNNER_VERSION>/g, runnerVersion)
@@ -187,7 +214,7 @@ jobs:
 
     # Upload release assets (full runner packages)
     - name: Upload Release Asset (win-x64)
-      uses: actions/upload-release-asset@v1.0.1
+      uses: actions/upload-release-asset@v1.0.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
@@ -197,7 +224,7 @@ jobs:
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (win-arm64)
-      uses: actions/upload-release-asset@v1.0.1
+      uses: actions/upload-release-asset@v1.0.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
@@ -207,7 +234,7 @@ jobs:
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (linux-x64)
-      uses: actions/upload-release-asset@v1.0.1
+      uses: actions/upload-release-asset@v1.0.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
@@ -217,7 +244,7 @@ jobs:
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (osx-x64)
-      uses: actions/upload-release-asset@v1.0.1
+      uses: actions/upload-release-asset@v1.0.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
@@ -227,7 +254,7 @@ jobs:
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (osx-arm64)
-      uses: actions/upload-release-asset@v1.0.1
+      uses: actions/upload-release-asset@v1.0.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
@@ -237,7 +264,7 @@ jobs:
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (linux-arm)
-      uses: actions/upload-release-asset@v1.0.1
+      uses: actions/upload-release-asset@v1.0.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
@@ -247,7 +274,7 @@ jobs:
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (linux-arm64)
-      uses: actions/upload-release-asset@v1.0.1
+      uses: actions/upload-release-asset@v1.0.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
@@ -262,16 +289,18 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
+      attestations: write
     env:
       REGISTRY: ghcr.io
       IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       - name: Compute image version
         id: image
-        uses: actions/github-script@v6
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -280,10 +309,10 @@ jobs:
             core.setOutput('version', runnerVersion);
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -291,7 +320,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           context: ./images
           platforms: |
@@ -305,5 +334,13 @@ jobs:
           push: true
           labels: |
             org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
-            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
             org.opencontainers.image.licenses=MIT
+          annotations: |
+            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
+
+      - name: Generate attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.build-and-push.outputs.digest }}
+          push-to-registry: true

.github/workflows/stale-bot.yml

@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@v10
         with:
           stale-issue-message: "This issue is stale because it has been open 365 days with no activity. Remove stale label or comment or this will be closed in 15 days."
           close-issue-message: "This issue was closed because it has been stalled for 15 days with no activity."

.gitignore

@@ -14,6 +14,7 @@
 .vscode
 !.vscode/launch.json
 !.vscode/tasks.json
+!browser-ext/lib
 
 # output
 node_modules
@@ -26,4 +27,5 @@ _dotnetsdk
 TestResults
 TestLogs
 .DS_Store
-**/*.DotSettings.user
+.mono
+**/*.DotSettings.user

.husky/pre-commit

@@ -1,6 +1 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-cd src/Misc/expressionFunc/hashFiles
-
-npx lint-staged
+cd src/Misc/expressionFunc/hashFiles && npx lint-staged

.opencode/plans/dap-browser-extension-ui-improvements.md

@@ -0,0 +1,214 @@
+# DAP Browser Extension UI Improvements
+
+**Status:** Implemented  
+**Date:** January 2026  
+**Related:** [dap-browser-extension.md](./dap-browser-extension.md), [dap-debugging.md](./dap-debugging.md)
+
+## Overview
+
+This document describes UI improvements made to the DAP browser extension debugger based on designer feedback. The original implementation inserted the debugger pane inline between workflow steps, causing it to "bounce around" as the user stepped through the job. The new implementation uses fixed positioning with two layout options.
+
+## Problem Statement
+
+The original debugger UI had these issues:
+1. **Bouncing pane**: The debugger pane was inserted between steps in the DOM, so it moved position each time the user stepped to a new step
+2. **No layout flexibility**: Users couldn't choose where they wanted the debugger positioned
+3. **No breakpoint indicator**: There was no visual indication of which step the debugger was currently paused at
+
+## Solution
+
+Implemented two fixed-position layout options inspired by browser DevTools:
+
+### 1. Bottom Panel Layout (Default)
+- Fixed at the bottom of the viewport
+- Height: 280px
+- Variables panel on left (33%), Console on right (67%)
+- Control buttons in the header row (right side)
+- Similar to Chrome/Firefox DevTools
+
+```
++------------------------------------------------------------------+
+| Debugger   [step info]              [controls] [layout] [X]      |
++------------------------------------------------------------------+
+|  Variables (1/3)      |  Console (2/3)                           |
+|  > github             |  Welcome message...                      |
+|  > env                |  > command output                        |
+|  > runner             |                                          |
+|                       |  [input field                         ]  |
++------------------------------------------------------------------+
+```
+
+### 2. Sidebar Layout
+- Fixed on the right side of the viewport
+- Width: 350px
+- Full height of viewport
+- Variables on top, Console in middle, Controls at bottom
+
+```
++------------------+
+| Debugger     [X] |
+| [layout btns]    |
++------------------+
+| Variables        |
+| > github         |
+| > env            |
++------------------+
+| Console          |
+| output...        |
+|                  |
+| [input        ]  |
++------------------+
+| [  controls   ]  |
++------------------+
+```
+
+### 3. Breakpoint Indicator
+Visual marker showing the current step where the debugger is paused:
+- Red accent bar on the right edge of the step row
+- Red bottom border on the step header
+- Triangle pointer pointing toward the debugger panel
+- Subtle gradient background highlight
+
+## Implementation Details
+
+### Files Modified
+
+| File | Changes |
+|------|---------|
+| `browser-ext/content/content.js` | Complete refactor: new layout system, breakpoint indicator, layout toggle |
+| `browser-ext/content/content.css` | New styles for layouts, breakpoint indicator, toggle buttons |
+
+### Key Functions Added (`content.js`)
+
+#### Layout Management
+```javascript
+// Load layout preference from chrome.storage.local
+async function loadLayoutPreference()
+
+// Save layout preference to chrome.storage.local  
+function saveLayoutPreference(layout)
+
+// Switch between 'bottom' and 'sidebar' layouts
+// Preserves console output and variable tree state during switch
+function switchLayout(newLayout)
+
+// Create the bottom panel HTML structure
+function createBottomPaneHTML()
+
+// Create the sidebar panel HTML structure
+function createSidebarPaneHTML()
+```
+
+#### Breakpoint Indicator
+```javascript
+// Highlights the current step with CSS class 'dap-current-step'
+function updateBreakpointIndicator(stepElement)
+
+// Clears the indicator from all steps
+function clearBreakpointIndicator()
+```
+
+#### Panel Controls
+```javascript
+// Close the debugger panel and clear indicators
+function closeDebuggerPane()
+
+// Update layout toggle button active states
+function updateLayoutToggleButtons()
+```
+
+### CSS Classes Added (`content.css`)
+
+| Class | Purpose |
+|-------|---------|
+| `.dap-debugger-bottom` | Bottom panel layout (fixed position) |
+| `.dap-debugger-sidebar` | Sidebar layout (fixed position) |
+| `.dap-layout-toggles` | Container for layout toggle buttons |
+| `.dap-layout-btn` | Individual layout toggle button |
+| `.dap-layout-btn.active` | Active state for selected layout |
+| `.dap-close-btn` | Close button styling |
+| `check-step.dap-current-step` | Breakpoint indicator on step element |
+
+### State Variables
+
+```javascript
+let currentLayout = 'bottom';      // 'bottom' | 'sidebar'
+let currentStepElement = null;     // Track current step for breakpoint indicator
+```
+
+### Storage
+
+Layout preference is persisted to `chrome.storage.local` under the key `debuggerLayout`.
+
+## Removed Functionality
+
+- `moveDebuggerPane()` - No longer needed since debugger uses fixed positioning
+- Inline pane injection between steps - Replaced with fixed position panels
+
+## Design Mockups Reference
+
+The implementation was based on these mockup frames:
+- **Frame 4/5/6**: Sidebar layout on right side
+- **Frame 7**: Bottom panel layout with controls in header
+- All frames showed the breakpoint indicator as a red/orange accent on the current step
+
+## Future Improvements
+
+Potential enhancements for future iterations:
+
+1. **Resizable panels**: Allow users to drag to resize the panel width/height
+2. **Minimize/maximize**: Add ability to minimize the panel to just a header bar
+3. **Detached window**: Option to pop out debugger into separate browser window
+4. **Keyboard shortcuts**: Add shortcuts for layout switching and panel toggle
+5. **Remember panel size**: Persist user's preferred panel dimensions
+6. **Breakpoint list**: Show list of all breakpoints with ability to navigate
+7. **Step indicator in panel**: Show step name/number in the panel header with prev/next navigation
+
+## Testing Checklist
+
+- [ ] Bottom panel displays correctly at viewport bottom
+- [ ] Sidebar panel displays correctly on right side
+- [ ] Layout toggle buttons switch between layouts
+- [ ] Layout preference persists across page reloads
+- [ ] Close button removes panel and updates Debug button state
+- [ ] Breakpoint indicator appears on current step when paused
+- [ ] Breakpoint indicator moves when stepping to next step
+- [ ] Breakpoint indicator clears when disconnected/terminated
+- [ ] Console output preserves when switching layouts
+- [ ] Variables tree preserves when switching layouts
+- [ ] Works correctly in both light and dark mode
+- [ ] Panel doesn't interfere with page scrolling
+- [ ] Step scrolls into view when breakpoint changes
+
+## Architecture Notes
+
+### Why Fixed Positioning?
+
+The original inline injection approach had issues:
+1. Required complex DOM manipulation to move the pane between steps
+2. Caused layout shifts in the GitHub page
+3. Made it difficult to maintain console scroll position
+4. Required finding the correct insertion point for each step
+
+Fixed positioning solves these:
+1. Panel stays in place - no DOM movement needed
+2. No layout shifts in the main page content
+3. Panel state (console, variables) naturally preserved
+4. Simpler CSS and JavaScript
+
+### Layout Toggle UX
+
+The toggle is a button group in the panel header showing both layout options:
+- Sidebar icon (vertical split)
+- Bottom icon (horizontal split)
+
+The active layout is highlighted. Clicking the other option triggers `switchLayout()`.
+
+### Breakpoint Indicator Implementation
+
+Uses CSS class `.dap-current-step` added to the `<check-step>` element:
+- `::after` pseudo-element creates the red accent bar
+- `::before` pseudo-element creates the triangle pointer
+- Direct child selectors style the step header background and border
+
+The indicator is updated in `handleStoppedEvent()` when the debugger pauses at a new step.

.opencode/plans/dap-cancellation-support.md

@@ -0,0 +1,346 @@
+# DAP Cancellation Support
+
+**Status:** Implemented  
+**Author:** OpenCode  
+**Date:** January 2026
+
+## Problem
+
+When a cancellation signal for the current job comes in from the server, the DAP debugging session doesn't properly respond. If the runner is paused at a breakpoint waiting for debugger commands (or if a debugger never connects), the job gets stuck forever and requires manually deleting the runner.
+
+### Root Cause
+
+The `DapDebugSession.WaitForCommandAsync()` method uses a `TaskCompletionSource` that only completes when a DAP command arrives from the debugger. There's no mechanism to interrupt this wait when the job is cancelled externally.
+
+Additionally, REPL shell commands use `CancellationToken.None`, so they also ignore job cancellation.
+
+## Solution
+
+Add proper cancellation token support throughout the DAP debugging flow:
+
+1. Pass the job cancellation token to `OnStepStartingAsync` and `WaitForCommandAsync`
+2. Register cancellation callbacks to release blocking waits
+3. Add a `CancelSession()` method for external cancellation
+4. Send DAP `terminated` and `exited` events to notify the debugger before cancelling
+5. Use the cancellation token for REPL shell command execution
+
+## Progress Checklist
+
+- [x] **Phase 1:** Update IDapDebugSession interface
+- [x] **Phase 2:** Update DapDebugSession implementation
+- [x] **Phase 3:** Update StepsRunner to pass cancellation token
+- [x] **Phase 4:** Update JobRunner to register cancellation handler
+- [ ] **Phase 5:** Testing
+
+## Files to Modify
+
+| File | Changes |
+|------|---------|
+| `src/Runner.Worker/Dap/DapDebugSession.cs` | Add cancellation support to `OnStepStartingAsync`, `WaitForCommandAsync`, `ExecuteShellCommandAsync`, add `CancelSession` method |
+| `src/Runner.Worker/StepsRunner.cs` | Pass `jobContext.CancellationToken` to `OnStepStartingAsync` |
+| `src/Runner.Worker/JobRunner.cs` | Register cancellation callback to call `CancelSession` on the debug session |
+
+## Detailed Implementation
+
+### Phase 1: Update IDapDebugSession Interface
+
+**File:** `src/Runner.Worker/Dap/DapDebugSession.cs` (lines ~144-242)
+
+Add new method to interface:
+
+```csharp
+/// <summary>
+/// Cancels the debug session externally (e.g., job cancellation).
+/// Sends terminated event to debugger and releases any blocking waits.
+/// </summary>
+void CancelSession();
+```
+
+Update existing method signature:
+
+```csharp
+// Change from:
+Task OnStepStartingAsync(IStep step, IExecutionContext jobContext, bool isFirstStep);
+
+// Change to:
+Task OnStepStartingAsync(IStep step, IExecutionContext jobContext, bool isFirstStep, CancellationToken cancellationToken);
+```
+
+### Phase 2: Update DapDebugSession Implementation
+
+#### 2.1 Add cancellation token field
+
+**Location:** Around line 260-300 (field declarations section)
+
+```csharp
+// Add field to store the job cancellation token for use by REPL commands
+private CancellationToken _jobCancellationToken;
+```
+
+#### 2.2 Update OnStepStartingAsync
+
+**Location:** Line 1159
+
+```csharp
+public async Task OnStepStartingAsync(IStep step, IExecutionContext jobContext, bool isFirstStep, CancellationToken cancellationToken)
+{
+    if (!IsActive)
+    {
+        return;
+    }
+
+    _currentStep = step;
+    _jobContext = jobContext;
+    _jobCancellationToken = cancellationToken; // Store for REPL commands
+
+    // ... rest of existing implementation ...
+
+    // Update the WaitForCommandAsync call at line 1212:
+    await WaitForCommandAsync(cancellationToken);
+}
+```
+
+#### 2.3 Update WaitForCommandAsync
+
+**Location:** Line 1288
+
+```csharp
+private async Task WaitForCommandAsync(CancellationToken cancellationToken)
+{
+    lock (_stateLock)
+    {
+        _state = DapSessionState.Paused;
+        _commandTcs = new TaskCompletionSource<DapCommand>(TaskCreationOptions.RunContinuationsAsynchronously);
+    }
+
+    Trace.Info("Waiting for debugger command...");
+
+    // Register cancellation to release the wait
+    using (cancellationToken.Register(() =>
+    {
+        Trace.Info("Job cancellation detected, releasing debugger wait");
+        _commandTcs?.TrySetResult(DapCommand.Disconnect);
+    }))
+    {
+        var command = await _commandTcs.Task;
+
+        Trace.Info($"Received command: {command}");
+
+        lock (_stateLock)
+        {
+            if (_state == DapSessionState.Paused)
+            {
+                _state = DapSessionState.Running;
+            }
+        }
+
+        // Send continued event (only for normal commands, not cancellation)
+        if (!cancellationToken.IsCancellationRequested && 
+            (command == DapCommand.Continue || command == DapCommand.Next))
+        {
+            _server?.SendEvent(new Event
+            {
+                EventType = "continued",
+                Body = new ContinuedEventBody
+                {
+                    ThreadId = JobThreadId,
+                    AllThreadsContinued = true
+                }
+            });
+        }
+    }
+}
+```
+
+#### 2.4 Add CancelSession method
+
+**Location:** After `OnJobCompleted()` method, around line 1286
+
+```csharp
+/// <summary>
+/// Cancels the debug session externally (e.g., job cancellation).
+/// Sends terminated/exited events to debugger and releases any blocking waits.
+/// </summary>
+public void CancelSession()
+{
+    Trace.Info("CancelSession called - terminating debug session");
+
+    lock (_stateLock)
+    {
+        if (_state == DapSessionState.Terminated)
+        {
+            Trace.Info("Session already terminated, ignoring CancelSession");
+            return;
+        }
+        _state = DapSessionState.Terminated;
+    }
+
+    // Send terminated event to debugger so it updates its UI
+    _server?.SendEvent(new Event
+    {
+        EventType = "terminated",
+        Body = new TerminatedEventBody()
+    });
+
+    // Send exited event with cancellation exit code (130 = SIGINT convention)
+    _server?.SendEvent(new Event
+    {
+        EventType = "exited",
+        Body = new ExitedEventBody { ExitCode = 130 }
+    });
+
+    // Release any pending command waits
+    _commandTcs?.TrySetResult(DapCommand.Disconnect);
+
+    Trace.Info("Debug session cancelled");
+}
+```
+
+#### 2.5 Update ExecuteShellCommandAsync
+
+**Location:** Line 889-895
+
+Change the `ExecuteAsync` call to use the stored cancellation token:
+
+```csharp
+int exitCode;
+try
+{
+    exitCode = await processInvoker.ExecuteAsync(
+        workingDirectory: workingDirectory,
+        fileName: shell,
+        arguments: string.Format(shellArgs, command),
+        environment: env,
+        requireExitCodeZero: false,
+        cancellationToken: _jobCancellationToken);  // Changed from CancellationToken.None
+}
+catch (OperationCanceledException)
+{
+    Trace.Info("Shell command cancelled due to job cancellation");
+    return new EvaluateResponseBody
+    {
+        Result = "(cancelled)",
+        Type = "error",
+        VariablesReference = 0
+    };
+}
+catch (Exception ex)
+{
+    Trace.Error($"Shell execution failed: {ex}");
+    return new EvaluateResponseBody
+    {
+        Result = $"Error: {ex.Message}",
+        Type = "error",
+        VariablesReference = 0
+    };
+}
+```
+
+### Phase 3: Update StepsRunner
+
+**File:** `src/Runner.Worker/StepsRunner.cs`
+**Location:** Line 204
+
+Change:
+```csharp
+await debugSession.OnStepStartingAsync(step, jobContext, isFirstStep);
+```
+
+To:
+```csharp
+await debugSession.OnStepStartingAsync(step, jobContext, isFirstStep, jobContext.CancellationToken);
+```
+
+### Phase 4: Update JobRunner
+
+**File:** `src/Runner.Worker/JobRunner.cs`
+
+#### 4.1 Add cancellation registration
+
+**Location:** After line 191 (after "Debugger connected" output), inside the debug mode block:
+
+```csharp
+// Register cancellation handler to properly terminate DAP session on job cancellation
+CancellationTokenRegistration? dapCancellationRegistration = null;
+try
+{
+    dapCancellationRegistration = jobRequestCancellationToken.Register(() =>
+    {
+        Trace.Info("Job cancelled - terminating DAP session");
+        debugSession.CancelSession();
+    });
+}
+catch (Exception ex)
+{
+    Trace.Warning($"Failed to register DAP cancellation handler: {ex.Message}");
+}
+```
+
+Note: The `dapCancellationRegistration` variable should be declared at a higher scope (around line 116 with other declarations) so it can be disposed in the finally block.
+
+#### 4.2 Dispose the registration
+
+**Location:** In the finally block (after line 316, alongside dapServer cleanup):
+
+```csharp
+// Dispose DAP cancellation registration
+dapCancellationRegistration?.Dispose();
+```
+
+## Behavior Summary
+
+| Scenario | Before | After |
+|----------|--------|-------|
+| Paused at breakpoint, job cancelled | **Stuck forever** | DAP terminated event sent, wait released, job cancels normally |
+| REPL command running, job cancelled | Command runs forever | Command cancelled, job cancels normally |
+| Waiting for debugger connection, job cancelled | Already handled | No change (already works) |
+| Debugger disconnects voluntarily | Works | No change |
+| Normal step execution, job cancelled | Works | No change (existing cancellation logic handles this) |
+
+## Exit Code Semantics
+
+The `exited` event uses these exit codes:
+- `0` = job succeeded
+- `1` = job failed  
+- `130` = job cancelled (standard Unix convention for SIGINT/Ctrl+C)
+
+## Testing Scenarios
+
+1. **Basic cancellation while paused:**
+   - Start a debug job, let it pause at first step
+   - Cancel the job from GitHub UI
+   - Verify: DAP client receives terminated event, runner exits cleanly
+
+2. **Cancellation during REPL command:**
+   - Pause at a step, run `!sleep 60` in REPL
+   - Cancel the job from GitHub UI
+   - Verify: Sleep command terminates, DAP client receives terminated event, runner exits cleanly
+
+3. **Cancellation before debugger connects:**
+   - Start a debug job (it waits for connection)
+   - Cancel the job before connecting a debugger
+   - Verify: Runner exits cleanly (this already works, just verify no regression)
+
+4. **Normal operation (no cancellation):**
+   - Run through a debug session normally with step/continue
+   - Verify: No change in behavior
+
+5. **Debugger disconnect:**
+   - Connect debugger, then disconnect it manually
+   - Verify: Job continues to completion (existing behavior preserved)
+
+## Estimated Effort
+
+| Phase | Effort |
+|-------|--------|
+| Phase 1: Interface update | 15 min |
+| Phase 2: DapDebugSession implementation | 45 min |
+| Phase 3: StepsRunner update | 5 min |
+| Phase 4: JobRunner update | 15 min |
+| Phase 5: Testing | 30 min |
+| **Total** | **~2 hours** |
+
+## References
+
+- DAP Specification: https://microsoft.github.io/debug-adapter-protocol/specification
+- Related plan: `dap-debugging.md` (original DAP implementation)

.opencode/plans/dap-debug-logging.md

@@ -0,0 +1,511 @@
+# DAP Debug Logging Feature
+
+**Status:** Implemented  
+**Date:** January 2026  
+**Related:** [dap-debugging.md](./dap-debugging.md), [dap-step-backwards.md](./dap-step-backwards.md)
+
+## Overview
+
+Add comprehensive debug logging to the DAP debugging infrastructure that can be toggled from the DAP client. This helps diagnose issues like step conclusions not updating correctly after step-back operations.
+
+## Features
+
+### 1. Debug Log Levels
+
+| Level | Value | What Gets Logged |
+|-------|-------|------------------|
+| `Off` | 0 | Nothing |
+| `Minimal` | 1 | Errors, critical state changes |
+| `Normal` | 2 | Step lifecycle, checkpoint operations |
+| `Verbose` | 3 | Everything including outputs, expressions |
+
+### 2. Enabling Debug Logging
+
+#### Via Attach Arguments (nvim-dap config)
+
+```lua
+{
+  type = "runner",
+  request = "attach",
+  debugLogging = true,           -- Enable debug logging (defaults to "normal" level)
+  debugLogLevel = "verbose",     -- Optional: "off", "minimal", "normal", "verbose"
+}
+```
+
+#### Via REPL Commands (runtime toggle)
+
+| Command | Description |
+|---------|-------------|
+| `!debug on` | Enable debug logging (level: normal) |
+| `!debug off` | Disable debug logging |
+| `!debug minimal` | Set level to minimal |
+| `!debug normal` | Set level to normal |
+| `!debug verbose` | Set level to verbose |
+| `!debug status` | Show current debug settings |
+
+### 3. Log Output Format
+
+All debug logs are sent to the DAP console with the format:
+
+```
+[DEBUG] [Category] Message
+```
+
+Categories include:
+- `[Step]` - Step lifecycle events
+- `[Checkpoint]` - Checkpoint creation/restoration
+- `[StepsContext]` - Steps context mutations (SetOutcome, SetConclusion, SetOutput, ClearScope)
+
+### 4. Example Output
+
+With `!debug verbose` enabled:
+
+```
+[DEBUG] [Step] Starting: 'cat doesnotexist' (index=2)
+[DEBUG] [Step] Checkpoints available: 2
+[DEBUG] [StepsContext] SetOutcome: step='thecat', outcome=failure
+[DEBUG] [StepsContext] SetConclusion: step='thecat', conclusion=failure
+[DEBUG] [Step] Completed: 'cat doesnotexist', result=Failed
+[DEBUG] [Step] Context state: outcome=failure, conclusion=failure
+
+# After step-back:
+[DEBUG] [Checkpoint] Restoring checkpoint [1] for step 'cat doesnotexist'
+[DEBUG] [StepsContext] ClearScope: scope='(root)'
+[DEBUG] [StepsContext] Restoring: clearing scope '(root)', restoring 2 step(s)
+[DEBUG] [StepsContext] Restored: step='thefoo', outcome=success, conclusion=success
+
+# After re-running with file created:
+[DEBUG] [Step] Starting: 'cat doesnotexist' (index=2)
+[DEBUG] [StepsContext] SetOutcome: step='thecat', outcome=success
+[DEBUG] [StepsContext] SetConclusion: step='thecat', conclusion=success
+[DEBUG] [Step] Completed: 'cat doesnotexist', result=Succeeded
+[DEBUG] [Step] Context state: outcome=success, conclusion=success
+```
+
+## Implementation
+
+### Progress Checklist
+
+- [x] **Phase 1:** Add debug logging infrastructure to DapDebugSession
+- [x] **Phase 2:** Add REPL `!debug` command handling
+- [x] **Phase 3:** Add OnDebugLog callback to StepsContext
+- [x] **Phase 4:** Add debug logging calls throughout DapDebugSession
+- [x] **Phase 5:** Hook up StepsContext logging to DapDebugSession
+- [ ] **Phase 6:** Testing
+
+---
+
+### Phase 1: Debug Logging Infrastructure
+
+**File:** `src/Runner.Worker/Dap/DapDebugSession.cs`
+
+Add enum and helper method:
+
+```csharp
+// Add enum for debug log levels (near top of file with other enums)
+public enum DebugLogLevel
+{
+    Off = 0,
+    Minimal = 1,    // Errors, critical state changes
+    Normal = 2,     // Step lifecycle, checkpoints
+    Verbose = 3     // Everything including outputs, expressions
+}
+
+// Add field (with other private fields)
+private DebugLogLevel _debugLogLevel = DebugLogLevel.Off;
+
+// Add helper method (in a #region Debug Logging)
+private void DebugLog(string message, DebugLogLevel minLevel = DebugLogLevel.Normal)
+{
+    if (_debugLogLevel >= minLevel)
+    {
+        _server?.SendEvent(new Event
+        {
+            EventType = "output",
+            Body = new OutputEventBody
+            {
+                Category = "console",
+                Output = $"[DEBUG] {message}\n"
+            }
+        });
+    }
+}
+```
+
+Update `HandleAttach` to parse debug logging arguments:
+
+```csharp
+private Response HandleAttach(Request request)
+{
+    Trace.Info("Attach request handled");
+
+    // Parse debug logging from attach args
+    if (request.Arguments is JsonElement args)
+    {
+        if (args.TryGetProperty("debugLogging", out var debugLogging))
+        {
+            if (debugLogging.ValueKind == JsonValueKind.True)
+            {
+                _debugLogLevel = DebugLogLevel.Normal;
+                Trace.Info("Debug logging enabled via attach args (level: normal)");
+            }
+        }
+        if (args.TryGetProperty("debugLogLevel", out var level) && level.ValueKind == JsonValueKind.String)
+        {
+            _debugLogLevel = level.GetString()?.ToLower() switch
+            {
+                "minimal" => DebugLogLevel.Minimal,
+                "normal" => DebugLogLevel.Normal,
+                "verbose" => DebugLogLevel.Verbose,
+                "off" => DebugLogLevel.Off,
+                _ => _debugLogLevel
+            };
+            Trace.Info($"Debug log level set via attach args: {_debugLogLevel}");
+        }
+    }
+
+    return CreateSuccessResponse(null);
+}
+```
+
+---
+
+### Phase 2: REPL `!debug` Command
+
+**File:** `src/Runner.Worker/Dap/DapDebugSession.cs`
+
+In `HandleEvaluateAsync`, add handling for `!debug` command before other shell command handling:
+
+```csharp
+// Near the start of HandleEvaluateAsync, after getting the expression:
+
+// Check for debug command
+if (expression.StartsWith("!debug", StringComparison.OrdinalIgnoreCase))
+{
+    return HandleDebugCommand(expression);
+}
+
+// ... rest of existing HandleEvaluateAsync code
+```
+
+Add the handler method:
+
+```csharp
+private Response HandleDebugCommand(string command)
+{
+    var parts = command.Split(' ', StringSplitOptions.RemoveEmptyEntries);
+    var arg = parts.Length > 1 ? parts[1].ToLower() : "status";
+    
+    string result;
+    switch (arg)
+    {
+        case "on":
+            _debugLogLevel = DebugLogLevel.Normal;
+            result = "Debug logging enabled (level: normal)";
+            break;
+        case "off":
+            _debugLogLevel = DebugLogLevel.Off;
+            result = "Debug logging disabled";
+            break;
+        case "minimal":
+            _debugLogLevel = DebugLogLevel.Minimal;
+            result = "Debug logging set to minimal";
+            break;
+        case "normal":
+            _debugLogLevel = DebugLogLevel.Normal;
+            result = "Debug logging set to normal";
+            break;
+        case "verbose":
+            _debugLogLevel = DebugLogLevel.Verbose;
+            result = "Debug logging set to verbose";
+            break;
+        case "status":
+        default:
+            result = $"Debug logging: {_debugLogLevel}";
+            break;
+    }
+
+    return CreateSuccessResponse(new EvaluateResponseBody
+    {
+        Result = result,
+        VariablesReference = 0
+    });
+}
+```
+
+---
+
+### Phase 3: StepsContext OnDebugLog Callback
+
+**File:** `src/Runner.Worker/StepsContext.cs`
+
+Add callback property and helper:
+
+```csharp
+public sealed class StepsContext
+{
+    private static readonly Regex _propertyRegex = new("^[a-zA-Z_][a-zA-Z0-9_]*$", RegexOptions.Compiled);
+    private readonly DictionaryContextData _contextData = new();
+
+    /// <summary>
+    /// Optional callback for debug logging. When set, will be called with debug messages
+    /// for all StepsContext mutations.
+    /// </summary>
+    public Action<string> OnDebugLog { get; set; }
+
+    private void DebugLog(string message)
+    {
+        OnDebugLog?.Invoke(message);
+    }
+
+    // ... rest of class
+}
+```
+
+Update `ClearScope`:
+
+```csharp
+public void ClearScope(string scopeName)
+{
+    DebugLog($"[StepsContext] ClearScope: scope='{scopeName ?? "(root)"}'");
+    if (_contextData.TryGetValue(scopeName, out _))
+    {
+        _contextData[scopeName] = new DictionaryContextData();
+    }
+}
+```
+
+Update `SetOutput`:
+
+```csharp
+public void SetOutput(
+    string scopeName,
+    string stepName,
+    string outputName,
+    string value,
+    out string reference)
+{
+    var step = GetStep(scopeName, stepName);
+    var outputs = step["outputs"].AssertDictionary("outputs");
+    outputs[outputName] = new StringContextData(value);
+    if (_propertyRegex.IsMatch(outputName))
+    {
+        reference = $"steps.{stepName}.outputs.{outputName}";
+    }
+    else
+    {
+        reference = $"steps['{stepName}']['outputs']['{outputName}']";
+    }
+    DebugLog($"[StepsContext] SetOutput: step='{stepName}', output='{outputName}', value='{TruncateValue(value)}'");
+}
+
+private static string TruncateValue(string value, int maxLength = 50)
+{
+    if (string.IsNullOrEmpty(value)) return "(empty)";
+    if (value.Length <= maxLength) return value;
+    return value.Substring(0, maxLength) + "...";
+}
+```
+
+Update `SetConclusion`:
+
+```csharp
+public void SetConclusion(
+    string scopeName,
+    string stepName,
+    ActionResult conclusion)
+{
+    var step = GetStep(scopeName, stepName);
+    var conclusionStr = conclusion.ToString().ToLowerInvariant();
+    step["conclusion"] = new StringContextData(conclusionStr);
+    DebugLog($"[StepsContext] SetConclusion: step='{stepName}', conclusion={conclusionStr}");
+}
+```
+
+Update `SetOutcome`:
+
+```csharp
+public void SetOutcome(
+    string scopeName,
+    string stepName,
+    ActionResult outcome)
+{
+    var step = GetStep(scopeName, stepName);
+    var outcomeStr = outcome.ToString().ToLowerInvariant();
+    step["outcome"] = new StringContextData(outcomeStr);
+    DebugLog($"[StepsContext] SetOutcome: step='{stepName}', outcome={outcomeStr}");
+}
+```
+
+---
+
+### Phase 4: DapDebugSession Logging Calls
+
+**File:** `src/Runner.Worker/Dap/DapDebugSession.cs`
+
+#### In `OnStepStartingAsync` (after setting `_currentStep` and `_jobContext`):
+
+```csharp
+DebugLog($"[Step] Starting: '{step.DisplayName}' (index={stepIndex})");
+DebugLog($"[Step] Checkpoints available: {_checkpoints.Count}");
+```
+
+#### In `OnStepCompleted` (after logging to Trace):
+
+```csharp
+DebugLog($"[Step] Completed: '{step.DisplayName}', result={result}");
+
+// Log current steps context state for this step
+if (_debugLogLevel >= DebugLogLevel.Normal)
+{
+    var stepsScope = step.ExecutionContext?.Global?.StepsContext?.GetScope(step.ExecutionContext.ScopeName);
+    if (stepsScope != null && !string.IsNullOrEmpty(step.ExecutionContext?.ContextName))
+    {
+        if (stepsScope.TryGetValue(step.ExecutionContext.ContextName, out var stepData) && stepData is DictionaryContextData sd)
+        {
+            var outcome = sd.TryGetValue("outcome", out var o) && o is StringContextData os ? os.Value : "null";
+            var conclusion = sd.TryGetValue("conclusion", out var c) && c is StringContextData cs ? cs.Value : "null";
+            DebugLog($"[Step] Context state: outcome={outcome}, conclusion={conclusion}");
+        }
+    }
+}
+```
+
+#### In `CreateCheckpointForPendingStep` (after creating checkpoint):
+
+```csharp
+DebugLog($"[Checkpoint] Created [{_checkpoints.Count - 1}] for step '{_pendingStep.DisplayName}'");
+if (_debugLogLevel >= DebugLogLevel.Verbose)
+{
+    DebugLog($"[Checkpoint] Snapshot contains {checkpoint.StepsSnapshot.Count} step(s)", DebugLogLevel.Verbose);
+    foreach (var entry in checkpoint.StepsSnapshot)
+    {
+        DebugLog($"[Checkpoint]   {entry.Key}: outcome={entry.Value.Outcome}, conclusion={entry.Value.Conclusion}", DebugLogLevel.Verbose);
+    }
+}
+```
+
+#### In `RestoreCheckpoint` (at start of method):
+
+```csharp
+DebugLog($"[Checkpoint] Restoring [{checkpointIndex}] for step '{checkpoint.StepDisplayName}'");
+if (_debugLogLevel >= DebugLogLevel.Verbose)
+{
+    DebugLog($"[Checkpoint] Snapshot has {checkpoint.StepsSnapshot.Count} step(s)", DebugLogLevel.Verbose);
+}
+```
+
+#### In `RestoreStepsContext` (update existing method):
+
+```csharp
+private void RestoreStepsContext(StepsContext stepsContext, Dictionary<string, StepStateSnapshot> snapshot, string scopeName)
+{
+    scopeName = scopeName ?? string.Empty;
+
+    DebugLog($"[StepsContext] Restoring: clearing scope '{(string.IsNullOrEmpty(scopeName) ? "(root)" : scopeName)}', will restore {snapshot.Count} step(s)");
+
+    stepsContext.ClearScope(scopeName);
+
+    foreach (var entry in snapshot)
+    {
+        var key = entry.Key;
+        var slashIndex = key.IndexOf('/');
+
+        if (slashIndex >= 0)
+        {
+            var snapshotScopeName = slashIndex > 0 ? key.Substring(0, slashIndex) : string.Empty;
+            var stepName = key.Substring(slashIndex + 1);
+
+            if (snapshotScopeName == scopeName)
+            {
+                var state = entry.Value;
+
+                if (state.Outcome.HasValue)
+                {
+                    stepsContext.SetOutcome(scopeName, stepName, state.Outcome.Value);
+                }
+                if (state.Conclusion.HasValue)
+                {
+                    stepsContext.SetConclusion(scopeName, stepName, state.Conclusion.Value);
+                }
+
+                if (state.Outputs != null)
+                {
+                    foreach (var output in state.Outputs)
+                    {
+                        stepsContext.SetOutput(scopeName, stepName, output.Key, output.Value, out _);
+                    }
+                }
+
+                DebugLog($"[StepsContext] Restored: step='{stepName}', outcome={state.Outcome}, conclusion={state.Conclusion}", DebugLogLevel.Verbose);
+            }
+        }
+    }
+
+    Trace.Info($"Steps context restored: cleared scope '{scopeName}' and restored {snapshot.Count} step(s) from snapshot");
+}
+```
+
+---
+
+### Phase 5: Hook Up StepsContext Logging
+
+**File:** `src/Runner.Worker/Dap/DapDebugSession.cs`
+
+In `OnStepStartingAsync`, after setting `_jobContext`, hook up the callback (only once):
+
+```csharp
+// Hook up StepsContext debug logging (do this once when we first get jobContext)
+if (jobContext.Global.StepsContext.OnDebugLog == null)
+{
+    jobContext.Global.StepsContext.OnDebugLog = (msg) => DebugLog(msg, DebugLogLevel.Verbose);
+}
+```
+
+**Note:** StepsContext logging is set to `Verbose` level since `SetOutput` can be noisy. `SetConclusion` and `SetOutcome` will still appear at `Verbose` level, but all the important state changes are also logged directly in `OnStepCompleted` at `Normal` level.
+
+---
+
+### Phase 6: Testing
+
+#### Manual Testing Checklist
+
+- [ ] `!debug status` shows "Off" by default
+- [ ] `!debug on` enables logging, shows step lifecycle
+- [ ] `!debug verbose` shows StepsContext mutations
+- [ ] `!debug off` disables logging
+- [ ] Attach with `debugLogging: true` enables logging on connect
+- [ ] Attach with `debugLogLevel: "verbose"` sets correct level
+- [ ] Step-back scenario shows restoration logs
+- [ ] Logs help identify why conclusion might not update
+
+#### Test Workflow
+
+Use the test workflow with `thecat` step:
+1. Run workflow, let `thecat` fail
+2. Enable `!debug verbose`
+3. Step back
+4. Create the missing file
+5. Step forward
+6. Observe logs to see if `SetConclusion` is called with `success`
+
+---
+
+## Files Summary
+
+### Modified Files
+
+| File | Changes |
+|------|---------|
+| `src/Runner.Worker/Dap/DapDebugSession.cs` | Add `DebugLogLevel` enum, `_debugLogLevel` field, `DebugLog()` helper, `HandleDebugCommand()`, update `HandleAttach`, add logging calls throughout, hook up StepsContext callback |
+| `src/Runner.Worker/StepsContext.cs` | Add `OnDebugLog` callback, `DebugLog()` helper, `TruncateValue()` helper, add logging to `ClearScope`, `SetOutput`, `SetConclusion`, `SetOutcome` |
+
+---
+
+## Future Enhancements (Out of Scope)
+
+- Additional debug commands (`!debug checkpoints`, `!debug steps`, `!debug env`)
+- Log to file option
+- Structured logging with timestamps
+- Category-based filtering (e.g., only show `[StepsContext]` logs)
+- Integration with nvim-dap's virtual text for inline debug info

.opencode/plans/dap-debugging-fixes.md

@@ -0,0 +1,299 @@
+# DAP Debugging - Bug Fixes and Enhancements
+
+**Status:** Planned  
+**Date:** January 2026  
+**Related:** [dap-debugging.md](./dap-debugging.md)
+
+## Overview
+
+This document tracks bug fixes and enhancements for the DAP debugging implementation after the initial phases were completed.
+
+## Issues
+
+### Bug 1: Double Output in REPL Shell Commands
+
+**Symptom:** Running commands in the REPL shell produces double output - the first one unmasked, the second one with secrets masked.
+
+**Root Cause:** In `DapDebugSession.ExecuteShellCommandAsync()` (lines 670-773), output is sent to the debugger twice:
+
+1. **Real-time streaming (unmasked):** Lines 678-712 stream output via DAP `output` events as data arrives from the process - but this output is NOT masked
+2. **Final result (masked):** Lines 765-769 return the combined output as `EvaluateResponseBody.Result` with secrets masked
+
+The DAP client displays both the streamed events AND the evaluate response result, causing duplication.
+
+**Fix:**
+1. Mask secrets in the real-time streaming output (add `HostContext.SecretMasker.MaskSecrets()` to lines ~690 and ~708)
+2. Change the final `Result` to only show exit code summary instead of full output
+
+---
+
+### Bug 2: Expressions Interpreted as Shell Commands
+
+**Symptom:** Evaluating expressions like `${{github.event_name}} == 'push'` in the Watch/Expressions pane results in them being executed as shell commands instead of being evaluated as GitHub Actions expressions.
+
+**Root Cause:** In `DapDebugSession.HandleEvaluateAsync()` (line 514), the condition to detect shell commands is too broad:
+
+```csharp
+if (evalContext == "repl" || expression.StartsWith("!") || expression.StartsWith("$"))
+```
+
+Since `${{github.event_name}}` starts with `$`, it gets routed to shell execution instead of expression evaluation.
+
+**Fix:**
+1. Check for `${{` prefix first - these are always GitHub Actions expressions
+2. Remove the `expression.StartsWith("$")` condition entirely (ambiguous and unnecessary since REPL context handles shell commands)
+3. Keep `expression.StartsWith("!")` for explicit shell override in non-REPL contexts
+
+---
+
+### Enhancement: Expression Interpolation in REPL Commands
+
+**Request:** When running REPL commands like `echo ${{github.event_name}}`, the `${{ }}` expressions should be expanded before shell execution, similar to how `run:` steps work.
+
+**Approach:** Add a helper method that uses the existing `PipelineTemplateEvaluator` infrastructure to expand expressions in the command string before passing it to the shell.
+
+---
+
+## Implementation Details
+
+### File: `src/Runner.Worker/Dap/DapDebugSession.cs`
+
+#### Change 1: Mask Real-Time Streaming Output
+
+**Location:** Lines ~678-712 (OutputDataReceived and ErrorDataReceived handlers)
+
+**Before:**
+```csharp
+processInvoker.OutputDataReceived += (sender, args) =>
+{
+    if (!string.IsNullOrEmpty(args.Data))
+    {
+        output.AppendLine(args.Data);
+        _server?.SendEvent(new Event
+        {
+            EventType = "output",
+            Body = new OutputEventBody
+            {
+                Category = "stdout",
+                Output = args.Data + "\n"  // NOT MASKED
+            }
+        });
+    }
+};
+```
+
+**After:**
+```csharp
+processInvoker.OutputDataReceived += (sender, args) =>
+{
+    if (!string.IsNullOrEmpty(args.Data))
+    {
+        output.AppendLine(args.Data);
+        var maskedData = HostContext.SecretMasker.MaskSecrets(args.Data);
+        _server?.SendEvent(new Event
+        {
+            EventType = "output",
+            Body = new OutputEventBody
+            {
+                Category = "stdout",
+                Output = maskedData + "\n"
+            }
+        });
+    }
+};
+```
+
+Apply the same change to `ErrorDataReceived` handler (~lines 696-712).
+
+---
+
+#### Change 2: Return Only Exit Code in Result
+
+**Location:** Lines ~767-772 (return statement in ExecuteShellCommandAsync)
+
+**Before:**
+```csharp
+return new EvaluateResponseBody
+{
+    Result = result.TrimEnd('\r', '\n'),
+    Type = exitCode == 0 ? "string" : "error",
+    VariablesReference = 0
+};
+```
+
+**After:**
+```csharp
+return new EvaluateResponseBody
+{
+    Result = $"(exit code: {exitCode})",
+    Type = exitCode == 0 ? "string" : "error",
+    VariablesReference = 0
+};
+```
+
+Also remove the result combination logic (lines ~747-762) since we no longer need to build the full result string for the response.
+
+---
+
+#### Change 3: Fix Expression vs Shell Routing
+
+**Location:** Lines ~511-536 (HandleEvaluateAsync method)
+
+**Before:**
+```csharp
+try
+{
+    // Check if this is a REPL/shell command (context: "repl") or starts with shell prefix
+    if (evalContext == "repl" || expression.StartsWith("!") || expression.StartsWith("$"))
+    {
+        // Shell execution mode
+        var command = expression.TrimStart('!', '$').Trim();
+        // ...
+    }
+    else
+    {
+        // Expression evaluation mode
+        var result = EvaluateExpression(expression, executionContext);
+        return CreateSuccessResponse(result);
+    }
+}
+```
+
+**After:**
+```csharp
+try
+{
+    // GitHub Actions expressions start with "${{" - always evaluate as expressions
+    if (expression.StartsWith("${{"))
+    {
+        var result = EvaluateExpression(expression, executionContext);
+        return CreateSuccessResponse(result);
+    }
+
+    // Check if this is a REPL/shell command:
+    // - context is "repl" (from Debug Console pane)
+    // - expression starts with "!" (explicit shell prefix for Watch pane)
+    if (evalContext == "repl" || expression.StartsWith("!"))
+    {
+        // Shell execution mode
+        var command = expression.TrimStart('!').Trim();
+        if (string.IsNullOrEmpty(command))
+        {
+            return CreateSuccessResponse(new EvaluateResponseBody
+            {
+                Result = "(empty command)",
+                Type = "string",
+                VariablesReference = 0
+            });
+        }
+
+        var result = await ExecuteShellCommandAsync(command, executionContext);
+        return CreateSuccessResponse(result);
+    }
+    else
+    {
+        // Expression evaluation mode (Watch pane, hover, etc.)
+        var result = EvaluateExpression(expression, executionContext);
+        return CreateSuccessResponse(result);
+    }
+}
+```
+
+---
+
+#### Change 4: Add Expression Expansion Helper Method
+
+**Location:** Add new method before `ExecuteShellCommandAsync` (~line 667)
+
+```csharp
+/// <summary>
+/// Expands ${{ }} expressions within a command string.
+/// For example: "echo ${{github.event_name}}" -> "echo push"
+/// </summary>
+private string ExpandExpressionsInCommand(string command, IExecutionContext context)
+{
+    if (string.IsNullOrEmpty(command) || !command.Contains("${{"))
+    {
+        return command;
+    }
+
+    try
+    {
+        // Create a StringToken with the command
+        var token = new StringToken(null, null, null, command);
+
+        // Use the template evaluator to expand expressions
+        var templateEvaluator = context.ToPipelineTemplateEvaluator();
+        var result = templateEvaluator.EvaluateStepDisplayName(
+            token,
+            context.ExpressionValues,
+            context.ExpressionFunctions);
+
+        // Mask secrets in the expanded command
+        result = HostContext.SecretMasker.MaskSecrets(result ?? command);
+
+        Trace.Info($"Expanded command: {result}");
+        return result;
+    }
+    catch (Exception ex)
+    {
+        Trace.Info($"Expression expansion failed, using original command: {ex.Message}");
+        return command;
+    }
+}
+```
+
+**Required import:** Add `using GitHub.DistributedTask.ObjectTemplating.Tokens;` at the top of the file if not already present.
+
+---
+
+#### Change 5: Use Expression Expansion in Shell Execution
+
+**Location:** Beginning of `ExecuteShellCommandAsync` method (~line 670)
+
+**Before:**
+```csharp
+private async Task<EvaluateResponseBody> ExecuteShellCommandAsync(string command, IExecutionContext context)
+{
+    Trace.Info($"Executing shell command: {command}");
+    // ...
+}
+```
+
+**After:**
+```csharp
+private async Task<EvaluateResponseBody> ExecuteShellCommandAsync(string command, IExecutionContext context)
+{
+    // Expand ${{ }} expressions in the command first
+    command = ExpandExpressionsInCommand(command, context);
+
+    Trace.Info($"Executing shell command: {command}");
+    // ...
+}
+```
+
+---
+
+## DAP Context Reference
+
+For future reference, these are the DAP evaluate context values:
+
+| DAP Context | Source UI | Behavior |
+|-------------|-----------|----------|
+| `"repl"` | Debug Console / REPL pane | Shell execution (with expression expansion) |
+| `"watch"` | Watch / Expressions pane | Expression evaluation |
+| `"hover"` | Editor hover (default) | Expression evaluation |
+| `"variables"` | Variables pane | Expression evaluation |
+| `"clipboard"` | Copy to clipboard | Expression evaluation |
+
+---
+
+## Testing Checklist
+
+- [ ] REPL command output is masked and appears only once
+- [ ] REPL command shows exit code in result field
+- [ ] Expression `${{github.event_name}}` evaluates correctly in Watch pane
+- [ ] Expression `${{github.event_name}} == 'push'` evaluates correctly
+- [ ] REPL command `echo ${{github.event_name}}` expands and executes correctly
+- [ ] REPL command `!ls -la` from Watch pane works (explicit shell prefix)
+- [ ] Secrets are masked in all outputs (streaming and expanded commands)

.opencode/plans/dap-debugging.md

@@ -0,0 +1,536 @@
+# DAP-Based Debugging for GitHub Actions Runner
+
+**Status:** Draft  
+**Author:** GitHub Actions Team  
+**Date:** January 2026
+
+## Progress Checklist
+
+- [x] **Phase 1:** DAP Protocol Infrastructure (DapMessages.cs, DapServer.cs, basic DapDebugSession.cs)
+- [x] **Phase 2:** Debug Session Logic (DapVariableProvider.cs, variable inspection, step history tracking)
+- [x] **Phase 3:** StepsRunner Integration (pause hooks before/after step execution)
+- [x] **Phase 4:** Expression Evaluation & Shell (REPL)
+- [x] **Phase 5:** Startup Integration (JobRunner.cs modifications)
+
+## Overview
+
+This document describes the implementation of Debug Adapter Protocol (DAP) support in the GitHub Actions runner, enabling rich debugging of workflow jobs from any DAP-compatible editor (nvim-dap, VS Code, etc.).
+
+## Goals
+
+- **Primary:** Create a working demo to demonstrate the feasibility of DAP-based workflow debugging
+- **Non-goal:** Production-ready, polished implementation (this is proof-of-concept)
+
+## User Experience
+
+1. User re-runs a failed job with "Enable debug logging" checked in GitHub UI
+2. Runner (running locally) detects debug mode and starts DAP server on port 4711
+3. Runner prints "Waiting for debugger on port 4711..." and pauses
+4. User opens editor (nvim with nvim-dap), connects to debugger
+5. Job execution begins, pausing before the first step
+6. User can:
+   - **Inspect variables:** View `github`, `env`, `inputs`, `steps`, `secrets` (redacted), `runner`, `job` contexts
+   - **Evaluate expressions:** `${{ github.event.pull_request.title }}`
+   - **Execute shell commands:** Run arbitrary commands in the job's environment (REPL)
+   - **Step through job:** `next` moves to next step, `continue` runs to end
+   - **Pause after steps:** Inspect step outputs before continuing
+
+## Activation
+
+DAP debugging activates automatically when the job is in debug mode:
+
+- User enables "Enable debug logging" when re-running a job in GitHub UI
+- Server sends `ACTIONS_STEP_DEBUG=true` in job variables
+- Runner sets `Global.WriteDebug = true` and `runner.debug = "1"`
+- DAP server starts on port 4711
+
+**No additional configuration required.**
+
+### Optional Configuration
+
+| Environment Variable | Default | Description |
+|---------------------|---------|-------------|
+| `ACTIONS_DAP_PORT` | `4711` | TCP port for DAP server (optional override) |
+
+## Architecture
+
+```
+┌─────────────────────┐                    ┌─────────────────────────────────────────┐
+│     nvim-dap        │                    │           Runner.Worker                 │
+│   (DAP Client)      │◄───TCP:4711───────►│  ┌─────────────────────────────────┐   │
+│                     │                    │  │     DapServer                    │   │
+└─────────────────────┘                    │  │  - TCP listener                  │   │
+                                           │  │  - DAP JSON protocol             │   │
+                                           │  └──────────────┬──────────────────┘   │
+                                           │                 │                       │
+                                           │  ┌──────────────▼──────────────────┐   │
+                                           │  │     DapDebugSession              │   │
+                                           │  │  - Debug state management        │   │
+                                           │  │  - Step coordination             │   │
+                                           │  │  - Variable exposure             │   │
+                                           │  │  - Expression evaluation         │   │
+                                           │  │  - Shell execution (REPL)        │   │
+                                           │  └──────────────┬──────────────────┘   │
+                                           │                 │                       │
+                                           │  ┌──────────────▼──────────────────┐   │
+                                           │  │     StepsRunner (modified)       │   │
+                                           │  │  - Pause before/after steps      │   │
+                                           │  │  - Notify debug session          │   │
+                                           │  └─────────────────────────────────┘   │
+                                           └─────────────────────────────────────────┘
+```
+
+## DAP Concept Mapping
+
+| DAP Concept | Actions Runner Equivalent |
+|-------------|---------------------------|
+| Thread | Single job execution |
+| Stack Frame | Current step + completed steps (step history) |
+| Scope | Context category: `github`, `env`, `inputs`, `steps`, `secrets`, `runner`, `job` |
+| Variable | Individual context values |
+| Breakpoint | Pause before specific step (future enhancement) |
+| Step Over (Next) | Execute current step, pause before next |
+| Continue | Run until job end |
+| Evaluate | Evaluate `${{ }}` expressions OR execute shell commands (REPL) |
+
+## File Structure
+
+```
+src/Runner.Worker/
+├── Dap/
+│   ├── DapServer.cs              # TCP listener, JSON protocol handling
+│   ├── DapDebugSession.cs        # Debug state, step coordination  
+│   ├── DapMessages.cs            # DAP protocol message types
+│   └── DapVariableProvider.cs    # Converts ExecutionContext to DAP variables
+```
+
+## Implementation Phases
+
+### Phase 1: DAP Protocol Infrastructure
+
+#### 1.1 Protocol Messages (`Dap/DapMessages.cs`)
+
+Base message types following DAP spec:
+
+```csharp
+public abstract class ProtocolMessage
+{
+    public int seq { get; set; }
+    public string type { get; set; }  // "request", "response", "event"
+}
+
+public class Request : ProtocolMessage
+{
+    public string command { get; set; }
+    public object arguments { get; set; }
+}
+
+public class Response : ProtocolMessage
+{
+    public int request_seq { get; set; }
+    public bool success { get; set; }
+    public string command { get; set; }
+    public string message { get; set; }
+    public object body { get; set; }
+}
+
+public class Event : ProtocolMessage
+{
+    public string @event { get; set; }
+    public object body { get; set; }
+}
+```
+
+Message framing: `Content-Length: N\r\n\r\n{json}`
+
+#### 1.2 DAP Server (`Dap/DapServer.cs`)
+
+```csharp
+[ServiceLocator(Default = typeof(DapServer))]
+public interface IDapServer : IRunnerService
+{
+    Task StartAsync(int port);
+    Task WaitForConnectionAsync();
+    Task StopAsync();
+    void SendEvent(Event evt);
+}
+
+public sealed class DapServer : RunnerService, IDapServer
+{
+    private TcpListener _listener;
+    private TcpClient _client;
+    private IDapDebugSession _session;
+    
+    // TCP listener on configurable port
+    // Single-client connection
+    // Async read/write loop
+    // Dispatch requests to DapDebugSession
+}
+```
+
+### Phase 2: Debug Session Logic
+
+#### 2.1 Debug Session (`Dap/DapDebugSession.cs`)
+
+```csharp
+public enum DapCommand { Continue, Next, Pause, Disconnect }
+public enum PauseReason { Entry, Step, Breakpoint, Pause }
+
+[ServiceLocator(Default = typeof(DapDebugSession))]
+public interface IDapDebugSession : IRunnerService
+{
+    bool IsActive { get; }
+    
+    // Called by DapServer
+    void Initialize(InitializeRequestArguments args);
+    void Attach(AttachRequestArguments args);
+    void ConfigurationDone();
+    Task<DapCommand> WaitForCommandAsync();
+    
+    // Called by StepsRunner
+    Task OnStepStartingAsync(IStep step, IExecutionContext jobContext);
+    void OnStepCompleted(IStep step);
+    
+    // DAP requests
+    ThreadsResponse GetThreads();
+    StackTraceResponse GetStackTrace(int threadId);
+    ScopesResponse GetScopes(int frameId);
+    VariablesResponse GetVariables(int variablesReference);
+    EvaluateResponse Evaluate(string expression, string context);
+}
+
+public sealed class DapDebugSession : RunnerService, IDapDebugSession
+{
+    private IExecutionContext _jobContext;
+    private IStep _currentStep;
+    private readonly List<IStep> _completedSteps = new();
+    private TaskCompletionSource<DapCommand> _commandTcs;
+    private bool _pauseAfterStep = false;
+    
+    // Object reference management for nested variables
+    private int _nextVariableReference = 1;
+    private readonly Dictionary<int, object> _variableReferences = new();
+}
+```
+
+Core state machine:
+1. **Waiting for client:** Server started, no client connected
+2. **Initializing:** Client connected, exchanging capabilities
+3. **Ready:** `configurationDone` received, waiting to start
+4. **Paused (before step):** Stopped before step execution, waiting for command
+5. **Running:** Executing a step
+6. **Paused (after step):** Stopped after step execution, waiting for command
+
+#### 2.2 Variable Provider (`Dap/DapVariableProvider.cs`)
+
+Maps `ExecutionContext.ExpressionValues` to DAP scopes and variables:
+
+| Scope | Source | Notes |
+|-------|--------|-------|
+| `github` | `ExpressionValues["github"]` | Full github context |
+| `env` | `ExpressionValues["env"]` | Environment variables |
+| `inputs` | `ExpressionValues["inputs"]` | Step inputs (when available) |
+| `steps` | `Global.StepsContext.GetScope()` | Completed step outputs |
+| `secrets` | `ExpressionValues["secrets"]` | Keys shown, values = `[REDACTED]` |
+| `runner` | `ExpressionValues["runner"]` | Runner context |
+| `job` | `ExpressionValues["job"]` | Job status |
+
+Nested objects (e.g., `github.event.pull_request`) become expandable variables with child references.
+
+### Phase 3: StepsRunner Integration
+
+#### 3.1 Modify `StepsRunner.cs`
+
+Add debug hooks at step boundaries:
+
+```csharp
+public async Task RunAsync(IExecutionContext jobContext)
+{
+    // Get debug session if available
+    var debugSession = HostContext.TryGetService<IDapDebugSession>();
+    bool isFirstStep = true;
+    
+    while (jobContext.JobSteps.Count > 0 || !checkPostJobActions)
+    {
+        // ... existing dequeue logic ...
+        
+        var step = jobContext.JobSteps.Dequeue();
+        
+        // Pause BEFORE step execution
+        if (debugSession?.IsActive == true)
+        {
+            var reason = isFirstStep ? PauseReason.Entry : PauseReason.Step;
+            await debugSession.OnStepStartingAsync(step, jobContext, reason);
+            isFirstStep = false;
+        }
+        
+        // ... existing step execution (condition eval, RunStepAsync, etc.) ...
+        
+        // Pause AFTER step execution (if requested)
+        if (debugSession?.IsActive == true)
+        {
+            debugSession.OnStepCompleted(step);
+            // Session may pause here to let user inspect outputs
+        }
+    }
+}
+```
+
+### Phase 4: Expression Evaluation & Shell (REPL)
+
+#### 4.1 Expression Evaluation
+
+Reuse existing `PipelineTemplateEvaluator`:
+
+```csharp
+private EvaluateResponseBody EvaluateExpression(string expression, IExecutionContext context)
+{
+    // Strip ${{ }} wrapper if present
+    var expr = expression.Trim();
+    if (expr.StartsWith("${{") && expr.EndsWith("}}"))
+    {
+        expr = expr.Substring(3, expr.Length - 5).Trim();
+    }
+    
+    var expressionToken = new BasicExpressionToken(fileId: null, line: null, column: null, expression: expr);
+    var templateEvaluator = context.ToPipelineTemplateEvaluator();
+    
+    var result = templateEvaluator.EvaluateStepDisplayName(
+        expressionToken, 
+        context.ExpressionValues, 
+        context.ExpressionFunctions
+    );
+    
+    // Mask secrets and determine type
+    result = HostContext.SecretMasker.MaskSecrets(result ?? "null");
+    
+    return new EvaluateResponseBody
+    {
+        Result = result,
+        Type = DetermineResultType(result),
+        VariablesReference = 0
+    };
+}
+```
+
+**Supported expression formats:**
+- Plain expression: `github.ref`, `steps.build.outputs.result`
+- Wrapped expression: `${{ github.event.pull_request.title }}`
+
+#### 4.2 Shell Execution (REPL)
+
+Shell execution is triggered when:
+1. The evaluate request has `context: "repl"`, OR
+2. The expression starts with `!` (e.g., `!ls -la`), OR  
+3. The expression starts with `$` followed by a shell command (e.g., `$env`)
+
+**Usage examples in debug console:**
+```
+!ls -la                          # List files in workspace
+!env | grep GITHUB               # Show GitHub environment variables
+!cat $GITHUB_EVENT_PATH          # View the event payload
+!echo ${{ github.ref }}          # Mix shell and expression (evaluated first)
+```
+
+**Implementation:**
+
+```csharp
+private async Task<EvaluateResponseBody> ExecuteShellCommandAsync(string command, IExecutionContext context)
+{
+    var processInvoker = HostContext.CreateService<IProcessInvoker>();
+    var output = new StringBuilder();
+    
+    processInvoker.OutputDataReceived += (sender, args) =>
+    {
+        output.AppendLine(args.Data);
+        // Stream to client in real-time via DAP output event
+        _server?.SendEvent(new Event
+        {
+            EventType = "output",
+            Body = new OutputEventBody { Category = "stdout", Output = args.Data + "\n" }
+        });
+    };
+    
+    processInvoker.ErrorDataReceived += (sender, args) =>
+    {
+        _server?.SendEvent(new Event
+        {
+            EventType = "output",
+            Body = new OutputEventBody { Category = "stderr", Output = args.Data + "\n" }
+        });
+    };
+    
+    // Build environment from job context (includes GITHUB_*, env context, prepend path)
+    var env = BuildShellEnvironment(context);
+    var workDir = GetWorkingDirectory(context);  // Uses github.workspace
+    var (shell, shellArgs) = GetDefaultShell();  // Platform-specific detection
+    
+    int exitCode = await processInvoker.ExecuteAsync(
+        workingDirectory: workDir,
+        fileName: shell,
+        arguments: string.Format(shellArgs, command),
+        environment: env,
+        requireExitCodeZero: false,
+        cancellationToken: CancellationToken.None
+    );
+    
+    return new EvaluateResponseBody
+    {
+        Result = HostContext.SecretMasker.MaskSecrets(output.ToString()),
+        Type = exitCode == 0 ? "string" : "error",
+        VariablesReference = 0
+    };
+}
+```
+
+**Shell detection by platform:**
+
+| Platform | Priority | Shell | Arguments |
+|----------|----------|-------|-----------|
+| Windows | 1 | `pwsh` | `-NoProfile -NonInteractive -Command "{0}"` |
+| Windows | 2 | `powershell` | `-NoProfile -NonInteractive -Command "{0}"` |
+| Windows | 3 | `cmd.exe` | `/C "{0}"` |
+| Unix | 1 | `bash` | `-c "{0}"` |
+| Unix | 2 | `sh` | `-c "{0}"` |
+
+**Environment built for shell commands:**
+- Current system environment variables
+- GitHub Actions context variables (from `IEnvironmentContextData.GetRuntimeEnvironmentVariables()`)
+- Prepend path from job context added to `PATH`
+
+### Phase 5: Startup Integration
+
+#### 5.1 Modify `JobRunner.cs`
+
+Add DAP server startup after debug mode is detected (around line 159):
+
+```csharp
+if (jobContext.Global.WriteDebug)
+{
+    jobContext.SetRunnerContext("debug", "1");
+    
+    // Start DAP server for interactive debugging
+    var dapServer = HostContext.GetService<IDapServer>();
+    var port = int.Parse(
+        Environment.GetEnvironmentVariable("ACTIONS_DAP_PORT") ?? "4711");
+    
+    await dapServer.StartAsync(port);
+    Trace.Info($"DAP server listening on port {port}");
+    jobContext.Output($"DAP debugger waiting for connection on port {port}...");
+    
+    // Block until debugger connects
+    await dapServer.WaitForConnectionAsync();
+    Trace.Info("DAP client connected, continuing job execution");
+}
+```
+
+## DAP Capabilities
+
+Capabilities to advertise in `InitializeResponse`:
+
+```json
+{
+    "supportsConfigurationDoneRequest": true,
+    "supportsEvaluateForHovers": true,
+    "supportsTerminateDebuggee": true,
+    "supportsStepBack": false,
+    "supportsSetVariable": false,
+    "supportsRestartFrame": false,
+    "supportsGotoTargetsRequest": false,
+    "supportsStepInTargetsRequest": false,
+    "supportsCompletionsRequest": false,
+    "supportsModulesRequest": false,
+    "supportsExceptionOptions": false,
+    "supportsValueFormattingOptions": false,
+    "supportsExceptionInfoRequest": false,
+    "supportsDelayedStackTraceLoading": false,
+    "supportsLoadedSourcesRequest": false,
+    "supportsProgressReporting": false,
+    "supportsRunInTerminalRequest": false
+}
+```
+
+## Client Configuration (nvim-dap)
+
+Example configuration for nvim-dap:
+
+```lua
+local dap = require('dap')
+
+dap.adapters.actions = {
+    type = 'server',
+    host = '127.0.0.1',
+    port = 4711,
+}
+
+dap.configurations.yaml = {
+    {
+        type = 'actions',
+        request = 'attach',
+        name = 'Attach to Actions Runner',
+    }
+}
+```
+
+## Demo Flow
+
+1. Trigger job re-run with "Enable debug logging" checked in GitHub UI
+2. Runner starts, detects debug mode (`Global.WriteDebug == true`)
+3. DAP server starts, console shows: `DAP debugger waiting for connection on port 4711...`
+4. In nvim: `:lua require('dap').continue()`
+5. Connection established, capabilities exchanged
+6. Job begins, pauses before first step
+7. nvim shows "stopped" state, variables panel shows contexts
+8. User explores variables, evaluates expressions, runs shell commands
+9. User presses `n` (next) to advance to next step
+10. After step completes, user can inspect outputs before continuing
+11. Repeat until job completes
+
+## Testing Strategy
+
+1. **Unit tests:** DAP protocol serialization, variable provider mapping
+2. **Integration tests:** Mock DAP client verifying request/response sequences
+3. **Manual testing:** Real job with nvim-dap attached
+
+## Future Enhancements (Out of Scope for Demo)
+
+- Composite action step-in (expand into sub-steps)
+- Breakpoints on specific step names
+- Watch expressions
+- Conditional breakpoints
+- Remote debugging (runner not on localhost)
+- VS Code extension
+
+## Estimated Effort
+
+| Phase | Effort |
+|-------|--------|
+| Phase 1: Protocol Infrastructure | 4-6 hours |
+| Phase 2: Debug Session Logic | 4-6 hours |
+| Phase 3: StepsRunner Integration | 2-3 hours |
+| Phase 4: Expression & Shell | 3-4 hours |
+| Phase 5: Startup & Polish | 2-3 hours |
+| **Total** | **~2-3 days** |
+
+## Key Files to Modify
+
+| File | Changes |
+|------|---------|
+| `src/Runner.Worker/JobRunner.cs` | Start DAP server when debug mode enabled |
+| `src/Runner.Worker/StepsRunner.cs` | Add pause hooks before/after step execution |
+| `src/Runner.Worker/Runner.Worker.csproj` | Add new Dap/ folder files |
+
+## Key Files to Create
+
+| File | Purpose |
+|------|---------|
+| `src/Runner.Worker/Dap/DapServer.cs` | TCP server, protocol framing |
+| `src/Runner.Worker/Dap/DapDebugSession.cs` | Debug state machine, command handling |
+| `src/Runner.Worker/Dap/DapMessages.cs` | Protocol message types |
+| `src/Runner.Worker/Dap/DapVariableProvider.cs` | Context → DAP variable conversion |
+
+## Reference Links
+
+- [DAP Overview](https://microsoft.github.io/debug-adapter-protocol/overview)
+- [DAP Specification](https://microsoft.github.io/debug-adapter-protocol/specification)
+- [Enable Debug Logging (GitHub Docs)](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging)

.opencode/plans/dap-step-backward-duplicate-function-fix.md

@@ -0,0 +1,155 @@
+# DAP Step Backward: Duplicate Expression Function Fix
+
+**Status:** Ready for Implementation  
+**Date:** January 2026  
+**Related:** [dap-step-backwards.md](./dap-step-backwards.md)
+
+## Problem
+
+When stepping backward and then forward again during DAP debugging, the runner crashes with:
+
+```
+System.ArgumentException: An item with the same key has already been added. Key: always
+   at System.Collections.Generic.Dictionary`2.TryInsert(...)
+   at GitHub.DistributedTask.Expressions2.ExpressionParser.ParseContext..ctor(...)
+```
+
+### Reproduction Steps
+
+1. Run a workflow with DAP debugging enabled
+2. Let a step execute (e.g., `cat doesnotexist`)
+3. Before the next step runs, step backward
+4. Optionally run REPL commands
+5. Step forward to re-run the step
+6. Step forward again → **CRASH**
+
+## Root Cause Analysis
+
+### The Bug
+
+In `StepsRunner.cs:89-93`, expression functions are added to `step.ExecutionContext.ExpressionFunctions` every time a step is processed:
+
+```csharp
+// Expression functions
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<AlwaysFunction>(PipelineTemplateConstants.Always, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<CancelledFunction>(PipelineTemplateConstants.Cancelled, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<FailureFunction>(PipelineTemplateConstants.Failure, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<SuccessFunction>(PipelineTemplateConstants.Success, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<HashFilesFunction>(PipelineTemplateConstants.HashFiles, 1, byte.MaxValue));
+```
+
+### Why It Fails on Step-Back
+
+1. **First execution:** Step is dequeued, functions added to `ExpressionFunctions`, step runs
+2. **Checkpoint created:** Stores a **reference** to the `IStep` object (not a deep copy) - see `StepCheckpoint.cs:65`
+3. **Step backward:** Checkpoint is restored, the **same** `IStep` object is re-queued to `jobContext.JobSteps`
+4. **Second execution:** Step is dequeued again, functions added **again** to the same `ExpressionFunctions` list
+5. **Duplicate entries:** The list now has two `AlwaysFunction` entries, two `CancelledFunction` entries, etc.
+6. **Crash:** When `ExpressionParser.ParseContext` constructor iterates over functions and adds them to a `Dictionary` (`ExpressionParser.cs:460-465`), it throws on the duplicate key "always"
+
+### Key Insight
+
+The `ExpressionFunctions` property on `ExecutionContext` is a `List<IFunctionInfo>` (`ExecutionContext.cs:199`). `List<T>.Add()` doesn't check for duplicates, so the functions get added twice. The error only manifests later when the expression parser builds its internal dictionary.
+
+## Solution
+
+### Chosen Approach: Clear ExpressionFunctions Before Adding
+
+Clear the `ExpressionFunctions` list before adding the functions. This ensures a known state regardless of how the step arrived in the queue (fresh or restored from checkpoint).
+
+### Why This Approach
+
+| Approach | Pros | Cons |
+|----------|------|------|
+| **Clear before adding (chosen)** | Simple, explicit, ensures known state, works for any re-processing scenario | Slightly more work than strictly necessary on first run |
+| Check before adding | Defensive | More complex, multiple conditions to check |
+| Reset on checkpoint restore | Localized to DAP | Requires changes in multiple places, easy to miss edge cases |
+
+The "clear before adding" approach is:
+- **Simple:** One line of code
+- **Robust:** Works regardless of why the step is being re-processed
+- **Safe:** The functions are always the same set, so clearing and re-adding has no side effects
+- **Future-proof:** If other code paths ever re-queue steps, this handles it automatically
+
+## Implementation
+
+### File to Modify
+
+`src/Runner.Worker/StepsRunner.cs`
+
+### Change
+
+```csharp
+// Before line 88, add:
+step.ExecutionContext.ExpressionFunctions.Clear();
+
+// Expression functions
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<AlwaysFunction>(PipelineTemplateConstants.Always, 0, 0));
+// ... rest of the adds
+```
+
+### Full Context (lines ~85-94)
+
+**Before:**
+```csharp
+// Start
+step.ExecutionContext.Start();
+
+// Expression functions
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<AlwaysFunction>(PipelineTemplateConstants.Always, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<CancelledFunction>(PipelineTemplateConstants.Cancelled, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<FailureFunction>(PipelineTemplateConstants.Failure, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<SuccessFunction>(PipelineTemplateConstants.Success, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<HashFilesFunction>(PipelineTemplateConstants.HashFiles, 1, byte.MaxValue));
+```
+
+**After:**
+```csharp
+// Start
+step.ExecutionContext.Start();
+
+// Expression functions
+// Clear first to handle step-back scenarios where the same step may be re-processed
+step.ExecutionContext.ExpressionFunctions.Clear();
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<AlwaysFunction>(PipelineTemplateConstants.Always, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<CancelledFunction>(PipelineTemplateConstants.Cancelled, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<FailureFunction>(PipelineTemplateConstants.Failure, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<SuccessFunction>(PipelineTemplateConstants.Success, 0, 0));
+step.ExecutionContext.ExpressionFunctions.Add(new FunctionInfo<HashFilesFunction>(PipelineTemplateConstants.HashFiles, 1, byte.MaxValue));
+```
+
+## Testing
+
+### Manual Test Scenario
+
+1. Create a workflow with multiple steps
+2. Enable DAP debugging
+3. Let step 1 execute
+4. Pause before step 2
+5. Step backward (restore to before step 1)
+6. Step forward (re-run step 1)
+7. Step forward again (run step 2)
+8. **Verify:** No crash, step 2's condition evaluates correctly
+
+### Edge Cases to Verify
+
+- [ ] Step backward multiple times in a row
+- [ ] Step backward then run REPL commands, then step forward
+- [ ] `reverseContinue` to beginning, then step through all steps again
+- [ ] Steps with `if: always()` condition (the specific function that was failing)
+- [ ] Steps with `if: failure()` or `if: cancelled()` conditions
+
+## Risk Assessment
+
+**Risk: Low**
+
+- The fix is minimal (one line)
+- `ExpressionFunctions` is always populated with the same 5 functions at this point
+- No other code depends on functions being accumulated across step re-runs
+- Normal (non-DAP) execution is unaffected since steps are never re-queued
+
+## Files Summary
+
+| File | Change |
+|------|--------|
+| `src/Runner.Worker/StepsRunner.cs` | Add `Clear()` call before adding expression functions |

.opencode/plans/dap-step-commands-refinements.md

@@ -0,0 +1,853 @@
+# Step Commands Refinements: --here, --id, and Help
+
+**Status:** Draft  
+**Author:** GitHub Actions Team  
+**Date:** January 2026  
+**Prerequisites:** dap-step-manipulation.md (completed)
+
+## Progress Checklist
+
+- [x] **Chunk 1:** `--here` Position Option
+- [x] **Chunk 2:** `--id` Option for Step Identification
+- [x] **Chunk 3:** Help Commands (`--help`)
+- [x] **Chunk 4:** Browser Extension UI Updates
+
+## Overview
+
+This plan addresses three refinements to the step manipulation commands based on user feedback:
+
+1. **`--here` position option**: Insert a step before the current step (the one you're paused at), so it runs immediately when stepping forward
+2. **`--id` option**: Allow users to specify a custom step ID for later reference (e.g., `steps.<id>.outputs`)
+3. **Help commands**: Add `--help` flag support to all step commands for discoverability
+
+## Problem Statement
+
+### Issue 1: "First pending position" inserts in the wrong place
+
+When paused before a step (e.g., checkout at position 1), using `--first` inserts the new step *after* the current step, not before it:
+
+```
+Before (paused at step 1):
+▶ 1. Checkout
+
+After "steps add run 'echo hello' --first":
+▶ 1. Checkout
+  2. hello [ADDED]    <-- Wrong! Should be before Checkout
+```
+
+**Root cause:** `PositionType.First` returns index 0 of the `JobSteps` queue, which contains steps *after* the current step. The current step is held separately in `_currentStep`.
+
+**Expected behavior:** User wants to insert a step that will run immediately when they continue, i.e., before the current step.
+
+### Issue 2: No way to specify step ID
+
+Dynamically added steps get auto-generated IDs like `_dynamic_<guid>`, making them impossible to reference in expressions like `steps.<id>.outputs.foo`.
+
+### Issue 3: Command options are hard to remember
+
+With growing options (`--name`, `--shell`, `--after`, `--before`, `--at`, `--first`, `--last`, etc.), users need a way to quickly see available options without consulting documentation.
+
+---
+
+## Chunk 1: `--here` Position Option
+
+**Goal:** Add a new position option that inserts a step before the current step (the one paused at a breakpoint).
+
+### Design
+
+| Flag | Meaning |
+|------|---------|
+| `--here` | Insert before the current step, so it becomes the next step to run |
+
+**Behavior:**
+- Only valid when paused at a breakpoint
+- Returns error if not paused: "Can only use --here when paused at a breakpoint"
+- Inserts the new step such that it will execute immediately when the user continues/steps forward
+
+**Example:**
+```
+Before (paused at step 1):
+▶ 1. Checkout
+  2. Build
+  3. Test
+
+After "steps add run 'echo hello' --here":
+▶ 1. hello [ADDED]    <-- New step runs next
+  2. Checkout
+  3. Build
+  4. Test
+```
+
+### Files to Modify
+
+| File | Changes |
+|------|---------|
+| `StepCommandParser.cs` | Add `Here` to `PositionType` enum; add `StepPosition.Here()` factory; parse `--here` flag in add/move commands |
+| `StepManipulator.cs` | Handle `PositionType.Here` in `CalculateInsertIndex()` and `CalculateMoveTargetIndex()` |
+
+### Implementation Details
+
+**StepCommandParser.cs:**
+
+```csharp
+// Add to PositionType enum
+public enum PositionType
+{
+    At,
+    After,
+    Before,
+    First,
+    Last,
+    Here  // NEW: Insert before current step (requires paused state)
+}
+
+// Add factory method to StepPosition
+public static StepPosition Here() => new StepPosition { Type = PositionType.Here };
+
+// Update ToString()
+PositionType.Here => "here",
+
+// In ParseReplAddRunCommand and ParseReplAddUsesCommand, add case:
+case "--here":
+    cmd.Position = StepPosition.Here();
+    break;
+
+// Same for ParseReplMoveCommand
+```
+
+**StepManipulator.cs:**
+
+```csharp
+// In CalculateInsertIndex():
+case PositionType.Here:
+{
+    // "Here" means before the current step
+    // Since current step is held separately (not in JobSteps queue),
+    // we need to:
+    // 1. Verify we're paused (have a current step)
+    // 2. Insert at position 0 of pending AND move current step after it
+    
+    if (_currentStep == null)
+    {
+        throw new StepCommandException(StepCommandErrors.InvalidPosition,
+            "Can only use --here when paused at a breakpoint.");
+    }
+    
+    // The new step goes at index 0, and we need to re-queue the current step
+    // Actually, we need a different approach - see "Special handling" below
+}
+```
+
+**Special handling for `--here`:**
+
+The current architecture has `_currentStep` held separately from `JobSteps`. To insert "before" the current step, we need to:
+
+1. Insert the new step at position 0 of `JobSteps`
+2. Move `_currentStep` back into `JobSteps` at position 1
+3. Set the new step as `_currentStep`
+
+Alternative (simpler): Modify `InsertStep` to handle `Here` specially:
+
+```csharp
+public int InsertStep(IStep step, StepPosition position)
+{
+    // Special case: --here inserts before current step
+    if (position.Type == PositionType.Here)
+    {
+        if (_currentStep == null)
+        {
+            throw new StepCommandException(StepCommandErrors.InvalidPosition,
+                "Can only use --here when paused at a breakpoint.");
+        }
+        
+        // Re-queue current step at the front
+        var pending = _jobContext.JobSteps.ToList();
+        pending.Insert(0, _currentStep);
+        
+        // Insert new step before it (at position 0)
+        pending.Insert(0, step);
+        
+        // Clear and re-queue
+        _jobContext.JobSteps.Clear();
+        foreach (var s in pending)
+            _jobContext.JobSteps.Enqueue(s);
+        
+        // New step becomes current
+        _currentStep = step;
+        
+        // Track change and return index
+        var newIndex = _completedSteps.Count + 1;
+        // ... track change ...
+        return newIndex;
+    }
+    
+    // ... existing logic for other position types ...
+}
+```
+
+### Testing
+
+- [ ] `steps add run "echo test" --here` when paused at step 1 inserts at position 1
+- [ ] New step becomes the current step (shows as `▶` in list)
+- [ ] Original current step moves to position 2
+- [ ] Stepping forward runs the new step first
+- [ ] `--here` when not paused returns appropriate error
+- [ ] `steps move 3 --here` moves step 3 to before current step
+
+---
+
+## Chunk 2: `--id` Option for Step Identification
+
+**Goal:** Allow users to specify a custom ID for dynamically added steps.
+
+### Design
+
+| Flag | Meaning |
+|------|---------|
+| `--id <identifier>` | Set the step's ID (used in `steps.<id>.outputs`, etc.) |
+
+**Validation:**
+- ID must be a non-empty string
+- No format restrictions (matches YAML behavior - users can use any string)
+
+**Duplicate handling:**
+- If a step with the same ID already exists, return error: "Step with ID '<id>' already exists"
+
+**Default behavior (unchanged):**
+- If `--id` is not provided, auto-generate `_dynamic_<guid>` as before
+
+### Files to Modify
+
+| File | Changes |
+|------|---------|
+| `StepCommandParser.cs` | Add `Id` property to `AddRunCommand` and `AddUsesCommand`; parse `--id` flag |
+| `StepFactory.cs` | Add `id` parameter to `CreateRunStep()` and `CreateUsesStep()`; use provided ID or generate one |
+| `StepCommandHandler.cs` | Pass `Id` from command to factory; validate uniqueness |
+| `StepManipulator.cs` | Add `HasStepWithId(string id)` method for uniqueness check |
+
+### Implementation Details
+
+**StepCommandParser.cs:**
+
+```csharp
+// Add to AddRunCommand and AddUsesCommand classes:
+public string Id { get; set; }
+
+// In ParseReplAddRunCommand and ParseReplAddUsesCommand:
+case "--id":
+    cmd.Id = GetNextArg(tokens, ref i, "--id");
+    break;
+```
+
+**StepFactory.cs:**
+
+```csharp
+// Update method signatures:
+ActionStep CreateRunStep(
+    string script,
+    string id = null,        // NEW
+    string name = null,
+    // ... rest unchanged
+);
+
+ActionStep CreateUsesStep(
+    string actionReference,
+    string id = null,        // NEW  
+    string name = null,
+    // ... rest unchanged
+);
+
+// In implementation:
+public ActionStep CreateRunStep(string script, string id = null, ...)
+{
+    var stepId = Guid.NewGuid();
+    var step = new ActionStep
+    {
+        Id = stepId,
+        Name = id ?? $"_dynamic_{stepId:N}",  // Use provided ID or generate
+        DisplayName = name ?? "Run script",
+        // ...
+    };
+    // ...
+}
+```
+
+**StepManipulator.cs:**
+
+```csharp
+// Add method to check for duplicate IDs:
+public bool HasStepWithId(string id)
+{
+    if (string.IsNullOrEmpty(id))
+        return false;
+        
+    // Check completed steps
+    foreach (var step in _completedSteps)
+    {
+        if (step is IActionRunner runner && runner.Action?.Name == id)
+            return true;
+    }
+    
+    // Check current step
+    if (_currentStep is IActionRunner currentRunner && currentRunner.Action?.Name == id)
+        return true;
+    
+    // Check pending steps
+    foreach (var step in _jobContext.JobSteps)
+    {
+        if (step is IActionRunner pendingRunner && pendingRunner.Action?.Name == id)
+            return true;
+    }
+    
+    return false;
+}
+```
+
+**StepCommandHandler.cs:**
+
+```csharp
+// In HandleAddRunCommand and HandleAddUsesCommand:
+if (!string.IsNullOrEmpty(cmd.Id) && _manipulator.HasStepWithId(cmd.Id))
+{
+    throw new StepCommandException(StepCommandErrors.DuplicateId,
+        $"Step with ID '{cmd.Id}' already exists.");
+}
+
+var actionStep = _factory.CreateRunStep(
+    cmd.Script,
+    cmd.Id,        // NEW
+    cmd.Name,
+    // ...
+);
+```
+
+### Command Examples
+
+```bash
+# Add step with custom ID
+steps add run "echo hello" --id greet --name "Greeting"
+
+# Reference in later step
+steps add run "echo ${{ steps.greet.outputs.result }}"
+
+# Duplicate ID returns error
+steps add run "echo bye" --id greet
+# Error: Step with ID 'greet' already exists
+```
+
+### Testing
+
+- [ ] `steps add run "echo test" --id my_step` creates step with ID `my_step`
+- [ ] Step ID appears correctly in `steps list` output
+- [ ] Attempting duplicate ID returns clear error
+- [ ] Omitting `--id` still generates `_dynamic_<guid>` IDs
+- [ ] ID is correctly set on the underlying `ActionStep.Name` property
+
+---
+
+## Chunk 3: Help Commands (`--help`)
+
+**Goal:** Add `--help` flag support to provide usage information for all step commands.
+
+### Design
+
+| Command | Output |
+|---------|--------|
+| `steps` | List of available subcommands |
+| `steps --help` | Same as above |
+| `steps add --help` | Help for `add` command (shows `run` and `uses` subcommands) |
+| `steps add run --help` | Help for `add run` with all options |
+| `steps add uses --help` | Help for `add uses` with all options |
+| `steps edit --help` | Help for `edit` command |
+| `steps remove --help` | Help for `remove` command |
+| `steps move --help` | Help for `move` command |
+| `steps list --help` | Help for `list` command |
+| `steps export --help` | Help for `export` command |
+
+**Output format:** Text only (no JSON support needed)
+
+### Files to Modify
+
+| File | Changes |
+|------|---------|
+| `StepCommandParser.cs` | Add `HelpCommand` class; detect `--help` flag and return appropriate help command |
+| `StepCommandHandler.cs` | Add `HandleHelpCommand()` with help text for each command |
+
+### Implementation Details
+
+**StepCommandParser.cs:**
+
+```csharp
+// Add new command class:
+public class HelpCommand : StepCommand
+{
+    /// <summary>
+    /// The command to show help for (null = top-level help)
+    /// </summary>
+    public string Command { get; set; }
+    
+    /// <summary>
+    /// Sub-command if applicable (e.g., "run" for "steps add run --help")
+    /// </summary>
+    public string SubCommand { get; set; }
+}
+
+// Modify ParseReplCommand to detect --help:
+private StepCommand ParseReplCommand(string input)
+{
+    var tokens = Tokenize(input);
+    
+    // Handle bare "steps" command
+    if (tokens.Count == 1 && tokens[0].Equals("steps", StringComparison.OrdinalIgnoreCase))
+    {
+        return new HelpCommand { Command = null };
+    }
+    
+    if (tokens.Count < 2 || !tokens[0].Equals("steps", StringComparison.OrdinalIgnoreCase))
+    {
+        throw new StepCommandException(StepCommandErrors.ParseError,
+            "Invalid command format. Expected: steps <command> [args...]");
+    }
+    
+    // Check for --help anywhere in tokens
+    if (tokens.Contains("--help") || tokens.Contains("-h"))
+    {
+        return ParseHelpCommand(tokens);
+    }
+    
+    var subCommand = tokens[1].ToLower();
+    // ... existing switch ...
+}
+
+private HelpCommand ParseHelpCommand(List<string> tokens)
+{
+    // Remove --help/-h from tokens
+    tokens.RemoveAll(t => t == "--help" || t == "-h");
+    
+    // "steps --help" or "steps"
+    if (tokens.Count == 1)
+    {
+        return new HelpCommand { Command = null };
+    }
+    
+    // "steps add --help"
+    var cmd = tokens[1].ToLower();
+    
+    // "steps add run --help"
+    string subCmd = null;
+    if (tokens.Count >= 3 && (cmd == "add"))
+    {
+        subCmd = tokens[2].ToLower();
+        if (subCmd != "run" && subCmd != "uses")
+            subCmd = null;
+    }
+    
+    return new HelpCommand { Command = cmd, SubCommand = subCmd };
+}
+```
+
+**StepCommandHandler.cs:**
+
+```csharp
+private StepCommandResult HandleHelpCommand(HelpCommand cmd)
+{
+    string helpText = (cmd.Command, cmd.SubCommand) switch
+    {
+        (null, _) => GetTopLevelHelp(),
+        ("add", null) => GetAddHelp(),
+        ("add", "run") => GetAddRunHelp(),
+        ("add", "uses") => GetAddUsesHelp(),
+        ("edit", _) => GetEditHelp(),
+        ("remove", _) => GetRemoveHelp(),
+        ("move", _) => GetMoveHelp(),
+        ("list", _) => GetListHelp(),
+        ("export", _) => GetExportHelp(),
+        _ => $"Unknown command: {cmd.Command}"
+    };
+    
+    return new StepCommandResult
+    {
+        Success = true,
+        Message = helpText
+    };
+}
+
+private string GetTopLevelHelp() => @"
+steps - Manipulate job steps during debug session
+
+COMMANDS:
+  list      Show all steps with status
+  add       Add a new step (run or uses)
+  edit      Modify a pending step
+  remove    Delete a pending step
+  move      Reorder a pending step
+  export    Generate YAML for modified steps
+
+Use 'steps <command> --help' for more information about a command.
+".Trim();
+
+private string GetAddHelp() => @"
+steps add - Add a new step to the job
+
+USAGE:
+  steps add run <script> [options]     Add a shell command step
+  steps add uses <action> [options]    Add an action step
+
+Use 'steps add run --help' or 'steps add uses --help' for detailed options.
+".Trim();
+
+private string GetAddRunHelp() => @"
+steps add run - Add a shell command step
+
+USAGE:
+  steps add run ""<script>"" [options]
+
+OPTIONS:
+  --id <id>                  Step ID for referencing in expressions
+  --name ""<name>""            Display name for the step
+  --shell <shell>            Shell to use (bash, sh, pwsh, python, cmd)
+  --working-directory <dir>  Working directory for the script
+  --if ""<condition>""         Condition expression (default: success())
+  --env KEY=value            Environment variable (can repeat)
+  --continue-on-error        Don't fail job if step fails
+  --timeout <minutes>        Step timeout in minutes
+
+POSITION OPTIONS:
+  --here                     Insert before current step (default)
+  --after <index>            Insert after step at index
+  --before <index>           Insert before step at index  
+  --at <index>               Insert at specific index
+  --first                    Insert at first pending position
+  --last                     Insert at end of job
+
+EXAMPLES:
+  steps add run ""npm test""
+  steps add run ""echo hello"" --name ""Greeting"" --id greet
+  steps add run ""./build.sh"" --shell bash --after 3
+".Trim();
+
+private string GetAddUsesHelp() => @"
+steps add uses - Add an action step
+
+USAGE:
+  steps add uses <action@ref> [options]
+
+OPTIONS:
+  --id <id>                  Step ID for referencing in expressions
+  --name ""<name>""            Display name for the step
+  --with key=value           Action input (can repeat)
+  --env KEY=value            Environment variable (can repeat)
+  --if ""<condition>""         Condition expression (default: success())
+  --continue-on-error        Don't fail job if step fails
+  --timeout <minutes>        Step timeout in minutes
+
+POSITION OPTIONS:
+  --here                     Insert before current step (default)
+  --after <index>            Insert after step at index
+  --before <index>           Insert before step at index
+  --at <index>               Insert at specific index
+  --first                    Insert at first pending position
+  --last                     Insert at end of job
+
+EXAMPLES:
+  steps add uses actions/checkout@v4
+  steps add uses actions/setup-node@v4 --with node-version=20
+  steps add uses ./my-action --name ""Local Action"" --after 2
+".Trim();
+
+private string GetEditHelp() => @"
+steps edit - Modify a pending step
+
+USAGE:
+  steps edit <index> [modifications]
+
+MODIFICATIONS:
+  --name ""<name>""            Change display name
+  --script ""<script>""        Change script (run steps only)
+  --shell <shell>            Change shell (run steps only)
+  --working-directory <dir>  Change working directory
+  --if ""<condition>""         Change condition expression
+  --with key=value           Set/update action input (uses steps only)
+  --env KEY=value            Set/update environment variable
+  --remove-with <key>        Remove action input
+  --remove-env <key>         Remove environment variable
+  --continue-on-error        Enable continue-on-error
+  --no-continue-on-error     Disable continue-on-error
+  --timeout <minutes>        Change timeout
+
+EXAMPLES:
+  steps edit 3 --name ""Updated Name""
+  steps edit 4 --script ""npm run test:ci""
+  steps edit 2 --env DEBUG=true --timeout 30
+".Trim();
+
+private string GetRemoveHelp() => @"
+steps remove - Delete a pending step
+
+USAGE:
+  steps remove <index>
+
+ARGUMENTS:
+  <index>    1-based index of the step to remove (must be pending)
+
+EXAMPLES:
+  steps remove 5
+  steps remove 3
+".Trim();
+
+private string GetMoveHelp() => @"
+steps move - Reorder a pending step
+
+USAGE:
+  steps move <from> <position>
+
+ARGUMENTS:
+  <from>     1-based index of the step to move (must be pending)
+
+POSITION OPTIONS:
+  --here                     Move before current step
+  --after <index>            Move after step at index
+  --before <index>           Move before step at index
+  --to <index>               Move to specific index
+  --first                    Move to first pending position
+  --last                     Move to end of job
+
+EXAMPLES:
+  steps move 5 --after 2
+  steps move 4 --first
+  steps move 3 --here
+".Trim();
+
+private string GetListHelp() => @"
+steps list - Show all steps with status
+
+USAGE:
+  steps list [options]
+
+OPTIONS:
+  --verbose                  Show additional step details
+  --output json|text         Output format (default: text)
+
+OUTPUT:
+  Shows all steps with:
+  - Index number
+  - Status indicator (completed, current, pending)
+  - Step name
+  - Step type (run/uses) and details
+  - Change indicator ([ADDED], [MODIFIED], [MOVED])
+".Trim();
+
+private string GetExportHelp() => @"
+steps export - Generate YAML for modified steps
+
+USAGE:
+  steps export [options]
+
+OPTIONS:
+  --changes-only             Only export added/modified steps
+  --with-comments            Include change markers as YAML comments
+  --output json|text         Output format (default: text)
+
+OUTPUT:
+  Generates valid YAML that can be pasted into a workflow file.
+  
+EXAMPLES:
+  steps export
+  steps export --changes-only --with-comments
+".Trim();
+```
+
+### Testing
+
+- [ ] `steps` shows top-level help
+- [ ] `steps --help` shows top-level help  
+- [ ] `steps -h` shows top-level help
+- [ ] `steps add --help` shows add command help
+- [ ] `steps add run --help` shows add run help with all options
+- [ ] `steps add uses --help` shows add uses help with all options
+- [ ] `steps edit --help` shows edit help
+- [ ] `steps remove --help` shows remove help
+- [ ] `steps move --help` shows move help
+- [ ] `steps list --help` shows list help
+- [ ] `steps export --help` shows export help
+- [ ] `--help` can appear anywhere in command (e.g., `steps add --help run`)
+
+---
+
+## Chunk 4: Browser Extension UI Updates
+
+**Goal:** Update the Add Step form to use `--here` as default and add the ID field.
+
+### Changes to `browser-ext/content/content.js`
+
+#### 1. Update Position Dropdown
+
+**Current options:**
+- "At end (default)"
+- "At first pending position"  
+- "After current step"
+
+**New options:**
+- "Before next step" (default) - uses `--here`
+- "At end"
+- "After current step"
+
+```javascript
+// In showAddStepDialog():
+<div class="dap-form-group">
+  <label class="dap-label">Position</label>
+  <select class="form-control dap-position-select">
+    <option value="here" selected>Before next step</option>
+    <option value="last">At end</option>
+    <option value="after">After current step</option>
+  </select>
+</div>
+```
+
+#### 2. Add ID Field
+
+Add after the Name field:
+
+```javascript
+<div class="dap-form-group">
+  <label class="dap-label">ID (optional)</label>
+  <input type="text" class="form-control dap-id-input" 
+         placeholder="my_step_id">
+  <span class="dap-help-text">Used to reference step outputs: steps.&lt;id&gt;.outputs</span>
+</div>
+```
+
+#### 3. Update `handleAddStep()`
+
+```javascript
+async function handleAddStep(modal) {
+  const type = modal.querySelector('.dap-step-type-select').value;
+  const name = modal.querySelector('.dap-name-input').value.trim() || undefined;
+  const id = modal.querySelector('.dap-id-input').value.trim() || undefined;  // NEW
+  const positionSelect = modal.querySelector('.dap-position-select').value;
+
+  let position = {};
+  if (positionSelect === 'here') {
+    position.here = true;  // NEW
+  } else if (positionSelect === 'after') {
+    const currentStep = stepsList.find((s) => s.status === 'current');
+    if (currentStep) {
+      position.after = currentStep.index;
+    } else {
+      position.here = true;
+    }
+  } else {
+    position.last = true;
+  }
+
+  // Pass id to sendStepCommand
+  result = await sendStepCommand('step.add', {
+    type: 'run',
+    script,
+    id,        // NEW
+    name,
+    shell,
+    position,
+  });
+  // ...
+}
+```
+
+#### 4. Update `buildAddStepCommand()`
+
+```javascript
+function buildAddStepCommand(options) {
+  let cmd = 'steps add';
+
+  if (options.type === 'run') {
+    cmd += ` run ${quoteString(options.script)}`;
+    if (options.shell) cmd += ` --shell ${options.shell}`;
+    if (options.workingDirectory) cmd += ` --working-directory ${quoteString(options.workingDirectory)}`;
+  } else if (options.type === 'uses') {
+    cmd += ` uses ${options.action}`;
+    if (options.with) {
+      for (const [key, value] of Object.entries(options.with)) {
+        cmd += ` --with ${key}=${value}`;
+      }
+    }
+  }
+
+  if (options.id) cmd += ` --id ${quoteString(options.id)}`;  // NEW
+  if (options.name) cmd += ` --name ${quoteString(options.name)}`;
+  if (options.if) cmd += ` --if ${quoteString(options.if)}`;
+  // ... rest of options ...
+
+  // Position
+  if (options.position) {
+    if (options.position.here) cmd += ' --here';  // NEW
+    else if (options.position.after !== undefined) cmd += ` --after ${options.position.after}`;
+    else if (options.position.before !== undefined) cmd += ` --before ${options.position.before}`;
+    else if (options.position.at !== undefined) cmd += ` --at ${options.position.at}`;
+    else if (options.position.first) cmd += ' --first';
+    // --last is default, no need to specify
+  }
+
+  return cmd;
+}
+```
+
+### CSS Updates (`browser-ext/content/content.css`)
+
+```css
+.dap-help-text {
+  font-size: 11px;
+  color: var(--fgColor-muted, #8b949e);
+  margin-top: 4px;
+  display: block;
+}
+```
+
+### Testing
+
+- [ ] Position dropdown defaults to "Before next step"
+- [ ] ID field is visible and optional
+- [ ] ID placeholder text is helpful
+- [ ] Help text explains the purpose of ID
+- [ ] Adding step with ID works correctly
+- [ ] Adding step with "Before next step" uses `--here` flag
+- [ ] Form validation doesn't require ID
+
+---
+
+## File Summary
+
+### Files to Create
+
+None - all changes are modifications to existing files.
+
+### Files to Modify
+
+| File | Chunks | Changes |
+|------|--------|---------|
+| `src/Runner.Worker/Dap/StepCommands/StepCommandParser.cs` | 1, 2, 3 | Add `Here` position type, `Id` property, `HelpCommand` class |
+| `src/Runner.Worker/Dap/StepCommands/StepManipulator.cs` | 1, 2 | Handle `Here` position, add `HasStepWithId()` method |
+| `src/Runner.Worker/Dap/StepCommands/StepFactory.cs` | 2 | Add `id` parameter to create methods |
+| `src/Runner.Worker/Dap/StepCommands/StepCommandHandler.cs` | 2, 3 | Pass ID to factory, add help text handlers |
+| `browser-ext/content/content.js` | 4 | Update form with ID field and position options |
+| `browser-ext/content/content.css` | 4 | Add help text styling |
+
+---
+
+## Error Messages
+
+| Code | Message |
+|------|---------|
+| `INVALID_POSITION` | Can only use --here when paused at a breakpoint |
+| `DUPLICATE_ID` | Step with ID '<id>' already exists |
+
+---
+
+## Estimated Effort
+
+| Chunk | Effort |
+|-------|--------|
+| Chunk 1: `--here` position | ~1-2 hours |
+| Chunk 2: `--id` option | ~1 hour |
+| Chunk 3: Help commands | ~1-2 hours |
+| Chunk 4: Browser extension UI | ~30 min |
+| **Total** | **~4-5 hours** |

.opencode/plans/dap-step-commands-simplification.md

@@ -0,0 +1,650 @@
+# Plan: Simplify Step Commands to Use REPL Format
+
+**Status:** Complete  
+**Date:** January 2026  
+**Prerequisites:** dap-step-manipulation.md (Chunks 1-9 completed)
+
+## Overview
+
+Remove the JSON API for step commands and use a single REPL command format (`steps <command>`) for both human input and browser extension UI. Add `--output` flag for controlling response format.
+
+## Problem
+
+Currently the step command system has two input formats:
+1. REPL format: `!step list` (for humans typing in console)
+2. JSON format: `{"cmd":"step.list"}` (for browser extension UI)
+
+This causes issues:
+- The `!` prefix is awkward for humans typing commands
+- The JSON API is unnecessary complexity (browser extension is just another DAP client)
+- Debugging is harder because UI sends different format than humans would type
+- Two code paths to maintain and test
+
+## Goals
+
+1. Replace `!step` prefix with `steps` (more ergonomic, no special character)
+2. Remove JSON command parsing (unnecessary complexity)
+3. Add `--output` flag for response format control (`text` or `json`)
+4. Browser extension sends same command strings a human would type
+5. Single code path for all step command input
+
+## Progress Checklist
+
+- [x] **Chunk 1:** Update StepCommandParser - `steps` prefix, `--output` flag, remove JSON parsing
+- [x] **Chunk 2:** Update StepCommandHandler - format responses based on OutputFormat
+- [x] **Chunk 3:** Update Browser Extension - build REPL command strings
+- [x] **Chunk 4:** Update REPL context detection in browser extension
+- [x] **Chunk 5:** Update/remove tests
+- [x] **Chunk 6:** Update plan documentation
+
+---
+
+## Implementation Chunks
+
+### Chunk 1: Update StepCommandParser to Use `steps` Prefix
+
+**Files to modify:**
+- `src/Runner.Worker/Dap/StepCommands/StepCommandParser.cs`
+
+**Changes:**
+
+1. **Add `OutputFormat` enum and update `StepCommand` base class:**
+   ```csharp
+   public enum OutputFormat
+   {
+       Text,
+       Json
+   }
+
+   public abstract class StepCommand
+   {
+       /// <summary>
+       /// Output format for the command response.
+       /// </summary>
+       public OutputFormat Output { get; set; } = OutputFormat.Text;
+   }
+   ```
+   
+   Remove the `WasJsonInput` property (replaced by `OutputFormat`).
+
+2. **Update `IsStepCommand()`** - recognize `steps` prefix, remove JSON detection:
+   ```csharp
+   public bool IsStepCommand(string input)
+   {
+       if (string.IsNullOrWhiteSpace(input))
+           return false;
+
+       var trimmed = input.Trim();
+
+       // Command format: steps ...
+       if (trimmed.StartsWith("steps ", StringComparison.OrdinalIgnoreCase) ||
+           trimmed.Equals("steps", StringComparison.OrdinalIgnoreCase))
+           return true;
+
+       return false;
+   }
+   ```
+
+3. **Update `Parse()`** - remove JSON branch:
+   ```csharp
+   public StepCommand Parse(string input)
+   {
+       var trimmed = input?.Trim() ?? "";
+       return ParseReplCommand(trimmed);
+   }
+   ```
+
+4. **Update `ParseReplCommand()`** - expect `steps` as first token:
+   ```csharp
+   if (tokens.Count < 2 || !tokens[0].Equals("steps", StringComparison.OrdinalIgnoreCase))
+   {
+       throw new StepCommandException(StepCommandErrors.ParseError,
+           "Invalid command format. Expected: steps <command> [args...]");
+   }
+   ```
+
+5. **Add `--output` flag parsing** - create a helper method and call it in each Parse*Command method:
+   ```csharp
+   private OutputFormat ParseOutputFlag(List<string> tokens, ref int index)
+   {
+       // Look for --output, --output=json, --output=text, -o json, -o text
+       for (int i = index; i < tokens.Count; i++)
+       {
+           var token = tokens[i].ToLower();
+           if (token == "--output" || token == "-o")
+           {
+               if (i + 1 < tokens.Count)
+               {
+                   var format = tokens[i + 1].ToLower();
+                   tokens.RemoveAt(i); // Remove flag
+                   tokens.RemoveAt(i); // Remove value
+                   return format == "json" ? OutputFormat.Json : OutputFormat.Text;
+               }
+           }
+           else if (token.StartsWith("--output="))
+           {
+               var format = token.Substring("--output=".Length);
+               tokens.RemoveAt(i);
+               return format == "json" ? OutputFormat.Json : OutputFormat.Text;
+           }
+       }
+       return OutputFormat.Text;
+   }
+   ```
+
+   Apply to each command parser before processing other flags.
+
+6. **Delete all JSON parsing methods:**
+   - `ParseJsonCommand()`
+   - `ParseJsonListCommand()`
+   - `ParseJsonAddCommand()`
+   - `ParseJsonEditCommand()`
+   - `ParseJsonRemoveCommand()`
+   - `ParseJsonMoveCommand()`
+   - `ParseJsonExportCommand()`
+   - `ParseJsonPosition()`
+   - `ParseJsonDictionary()`
+   - `ParseJsonStringList()`
+
+7. **Update error messages** to reference `steps <command>` format.
+
+**Estimated effort:** Small-medium
+
+---
+
+### Chunk 2: Update StepCommandHandler Response Format
+
+**Files to modify:**
+- `src/Runner.Worker/Dap/StepCommands/StepCommandHandler.cs`
+
+**Changes:**
+
+1. **Update each command handler** to format response based on `command.Output`:
+
+   For `ListCommand`:
+   ```csharp
+   if (command.Output == OutputFormat.Json)
+   {
+       return new StepCommandResult
+       {
+           Success = true,
+           Message = JsonConvert.SerializeObject(new { Success = true, Result = steps }),
+           Result = steps
+       };
+   }
+   else
+   {
+       return new StepCommandResult
+       {
+           Success = true,
+           Message = FormatStepListAsText(steps),
+           Result = steps
+       };
+   }
+   ```
+
+2. **Add text formatting helpers:**
+   ```csharp
+   private string FormatStepListAsText(IReadOnlyList<StepInfo> steps)
+   {
+       var sb = new StringBuilder();
+       sb.AppendLine("Steps:");
+       foreach (var step in steps)
+       {
+           var statusIcon = step.Status switch
+           {
+               StepStatus.Completed => "✓",
+               StepStatus.Current => "▶",
+               _ => " "
+           };
+           var changeBadge = step.Change.HasValue ? $"[{step.Change}]" : "";
+           sb.AppendLine($"  {statusIcon} {step.Index}. {step.Name,-30} {changeBadge,-12} {step.Type,-5} {step.TypeDetail}");
+       }
+       sb.AppendLine();
+       sb.AppendLine("Legend: ✓ = completed, ▶ = current, [ADDED] = new, [MODIFIED] = edited");
+       return sb.ToString();
+   }
+   ```
+
+3. **Update error responses** to also respect output format.
+
+4. **Remove `WasJsonInput` checks** throughout the handler.
+
+**Estimated effort:** Small
+
+---
+
+### Chunk 3: Update Browser Extension - Build Command Strings
+
+**Files to modify:**
+- `browser-ext/content/content.js`
+
+**Changes:**
+
+1. **Replace `sendStepCommand()` implementation:**
+
+   ```javascript
+   /**
+    * Send step command via REPL format
+    */
+   async function sendStepCommand(action, options = {}) {
+     const expression = buildStepCommand(action, options);
+     try {
+       const response = await sendDapRequest('evaluate', {
+         expression,
+         frameId: currentFrameId,
+         context: 'repl',
+       });
+
+       if (response.result) {
+         try {
+           return JSON.parse(response.result);
+         } catch (e) {
+           // Response might be plain text for non-JSON output
+           return { Success: true, Message: response.result };
+         }
+       }
+       return { Success: false, Error: 'NO_RESPONSE', Message: 'No response from server' };
+     } catch (error) {
+       return { Success: false, Error: 'REQUEST_FAILED', Message: error.message };
+     }
+   }
+   ```
+
+2. **Add `buildStepCommand()` function:**
+
+   ```javascript
+   /**
+    * Build REPL command string from action and options
+    */
+   function buildStepCommand(action, options) {
+     let cmd;
+     switch (action) {
+       case 'step.list':
+         cmd = options.verbose ? 'steps list --verbose' : 'steps list';
+         break;
+       case 'step.add':
+         cmd = buildAddStepCommand(options);
+         break;
+       case 'step.edit':
+         cmd = buildEditStepCommand(options);
+         break;
+       case 'step.remove':
+         cmd = `steps remove ${options.index}`;
+         break;
+       case 'step.move':
+         cmd = buildMoveStepCommand(options);
+         break;
+       case 'step.export':
+         cmd = buildExportCommand(options);
+         break;
+       default:
+         throw new Error(`Unknown step command: ${action}`);
+     }
+     // Always request JSON output for programmatic use
+     return cmd + ' --output json';
+   }
+   ```
+
+3. **Add command builder helpers:**
+
+   ```javascript
+   function buildAddStepCommand(options) {
+     let cmd = 'steps add';
+     
+     if (options.type === 'run') {
+       cmd += ` run ${quoteString(options.script)}`;
+       if (options.shell) cmd += ` --shell ${options.shell}`;
+       if (options.workingDirectory) cmd += ` --working-directory ${quoteString(options.workingDirectory)}`;
+     } else if (options.type === 'uses') {
+       cmd += ` uses ${options.action}`;
+       if (options.with) {
+         for (const [key, value] of Object.entries(options.with)) {
+           cmd += ` --with ${key}=${value}`;
+         }
+       }
+     }
+     
+     if (options.name) cmd += ` --name ${quoteString(options.name)}`;
+     if (options.if) cmd += ` --if ${quoteString(options.if)}`;
+     if (options.env) {
+       for (const [key, value] of Object.entries(options.env)) {
+         cmd += ` --env ${key}=${value}`;
+       }
+     }
+     if (options.continueOnError) cmd += ' --continue-on-error';
+     if (options.timeout) cmd += ` --timeout ${options.timeout}`;
+     
+     // Position
+     if (options.position) {
+       if (options.position.after) cmd += ` --after ${options.position.after}`;
+       else if (options.position.before) cmd += ` --before ${options.position.before}`;
+       else if (options.position.at) cmd += ` --at ${options.position.at}`;
+       else if (options.position.first) cmd += ' --first';
+       // --last is default, no need to specify
+     }
+     
+     return cmd;
+   }
+
+   function buildEditStepCommand(options) {
+     let cmd = `steps edit ${options.index}`;
+     if (options.name) cmd += ` --name ${quoteString(options.name)}`;
+     if (options.script) cmd += ` --script ${quoteString(options.script)}`;
+     if (options.if) cmd += ` --if ${quoteString(options.if)}`;
+     if (options.shell) cmd += ` --shell ${options.shell}`;
+     if (options.workingDirectory) cmd += ` --working-directory ${quoteString(options.workingDirectory)}`;
+     return cmd;
+   }
+
+   function buildMoveStepCommand(options) {
+     let cmd = `steps move ${options.from}`;
+     const pos = options.position;
+     if (pos.after) cmd += ` --after ${pos.after}`;
+     else if (pos.before) cmd += ` --before ${pos.before}`;
+     else if (pos.at) cmd += ` --to ${pos.at}`;
+     else if (pos.first) cmd += ' --first';
+     else if (pos.last) cmd += ' --last';
+     return cmd;
+   }
+
+   function buildExportCommand(options) {
+     let cmd = 'steps export';
+     if (options.changesOnly) cmd += ' --changes-only';
+     if (options.withComments) cmd += ' --with-comments';
+     return cmd;
+   }
+
+   /**
+    * Quote a string for use in command, escaping as needed
+    */
+   function quoteString(str) {
+     // Escape backslashes and quotes, wrap in quotes
+     return `"${str.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+   }
+   ```
+
+4. **Update `loadSteps()`:**
+   ```javascript
+   async function loadSteps() {
+     try {
+       const response = await sendDapRequest('evaluate', {
+         expression: 'steps list --output json',
+         frameId: currentFrameId,
+         context: 'repl',
+       });
+       // ... rest of parsing logic unchanged
+     }
+   }
+   ```
+
+**Estimated effort:** Medium
+
+---
+
+### Chunk 4: Update REPL Context Detection
+
+**Files to modify:**
+- `browser-ext/content/content.js`
+
+**Changes:**
+
+Update `handleReplKeydown()` to set context to 'repl' for `steps` commands:
+
+```javascript
+async function handleReplKeydown(e) {
+  const input = e.target;
+
+  if (e.key === 'Enter') {
+    const command = input.value.trim();
+    if (!command) return;
+
+    replHistory.push(command);
+    replHistoryIndex = replHistory.length;
+    input.value = '';
+
+    // Show command
+    appendOutput(`> ${command}`, 'input');
+
+    // Send to DAP
+    try {
+      const response = await sendDapRequest('evaluate', {
+        expression: command,
+        frameId: currentFrameId,
+        // Use 'repl' context for shell commands (!) and step commands
+        context: (command.startsWith('!') || command.startsWith('steps')) ? 'repl' : 'watch',
+      });
+      // ... rest unchanged
+    }
+  }
+  // ... arrow key handling unchanged
+}
+```
+
+**Estimated effort:** Trivial
+
+---
+
+### Chunk 5: Update/Remove Tests
+
+**Files to modify:**
+- `src/Test/L0/Worker/Dap/StepCommands/StepCommandParserJsonL0.cs` - **Delete**
+- `src/Test/L0/Worker/Dap/StepCommands/StepCommandParserL0.cs` - Modify
+
+**Changes:**
+
+1. **Delete `StepCommandParserJsonL0.cs`** entirely (JSON parsing tests no longer needed)
+
+2. **Update `StepCommandParserL0.cs`:**
+
+   a. Update `IsStepCommand` tests:
+   ```csharp
+   [Fact]
+   public void IsStepCommand_DetectsStepsPrefix()
+   {
+       Assert.True(_parser.IsStepCommand("steps list"));
+       Assert.True(_parser.IsStepCommand("steps add run \"test\""));
+       Assert.True(_parser.IsStepCommand("STEPS LIST")); // case insensitive
+       Assert.True(_parser.IsStepCommand("  steps list  ")); // whitespace
+   }
+
+   [Fact]
+   public void IsStepCommand_RejectsInvalid()
+   {
+       Assert.False(_parser.IsStepCommand("step list")); // missing 's'
+       Assert.False(_parser.IsStepCommand("!step list")); // old format
+       Assert.False(_parser.IsStepCommand("stepslist")); // no space
+       Assert.False(_parser.IsStepCommand(""));
+       Assert.False(_parser.IsStepCommand(null));
+   }
+   ```
+
+   b. Change all `!step` to `steps` in existing test cases:
+   ```csharp
+   // Before:
+   var cmd = _parser.Parse("!step list --verbose");
+   
+   // After:
+   var cmd = _parser.Parse("steps list --verbose");
+   ```
+
+   c. Add tests for `--output` flag:
+   ```csharp
+   [Fact]
+   public void Parse_ListCommand_WithOutputJson()
+   {
+       var cmd = _parser.Parse("steps list --output json") as ListCommand;
+       Assert.NotNull(cmd);
+       Assert.Equal(OutputFormat.Json, cmd.Output);
+   }
+
+   [Fact]
+   public void Parse_ListCommand_WithOutputText()
+   {
+       var cmd = _parser.Parse("steps list --output text") as ListCommand;
+       Assert.NotNull(cmd);
+       Assert.Equal(OutputFormat.Text, cmd.Output);
+   }
+
+   [Fact]
+   public void Parse_ListCommand_DefaultOutputIsText()
+   {
+       var cmd = _parser.Parse("steps list") as ListCommand;
+       Assert.NotNull(cmd);
+       Assert.Equal(OutputFormat.Text, cmd.Output);
+   }
+
+   [Fact]
+   public void Parse_AddCommand_WithOutputFlag()
+   {
+       var cmd = _parser.Parse("steps add run \"echo test\" --output json") as AddRunCommand;
+       Assert.NotNull(cmd);
+       Assert.Equal(OutputFormat.Json, cmd.Output);
+       Assert.Equal("echo test", cmd.Script);
+   }
+
+   [Fact]
+   public void Parse_OutputFlag_ShortForm()
+   {
+       var cmd = _parser.Parse("steps list -o json") as ListCommand;
+       Assert.NotNull(cmd);
+       Assert.Equal(OutputFormat.Json, cmd.Output);
+   }
+
+   [Fact]
+   public void Parse_OutputFlag_EqualsForm()
+   {
+       var cmd = _parser.Parse("steps list --output=json") as ListCommand;
+       Assert.NotNull(cmd);
+       Assert.Equal(OutputFormat.Json, cmd.Output);
+   }
+   ```
+
+   d. Update error message expectations to reference `steps` format.
+
+**Estimated effort:** Small
+
+---
+
+### Chunk 6: Update Plan Documentation
+
+**Files to modify:**
+- `.opencode/plans/dap-step-manipulation.md`
+
+**Changes:**
+
+1. **Update command format documentation** - change all `!step` references to `steps`
+
+2. **Document `--output` flag** in command reference:
+   ```
+   ### Output Format
+   
+   All commands support the `--output` flag to control response format:
+   - `--output text` (default) - Human-readable text output
+   - `--output json` - JSON output for programmatic use
+   - Short form: `-o json`, `-o text`
+   - Equals form: `--output=json`, `--output=text`
+   ```
+
+3. **Update Chunk 8 description** - note that JSON API was replaced with `--output` flag
+
+4. **Update command reference table:**
+   ```
+   | Command | Purpose | Example |
+   |---------|---------|---------|
+   | `steps list` | Show all steps | `steps list --verbose` |
+   | `steps add` | Add new step | `steps add run "npm test" --after 3` |
+   | `steps edit` | Modify step | `steps edit 4 --script "npm run test:ci"` |
+   | `steps remove` | Delete step | `steps remove 5` |
+   | `steps move` | Reorder step | `steps move 5 --after 2` |
+   | `steps export` | Generate YAML | `steps export --with-comments` |
+   ```
+
+**Estimated effort:** Trivial
+
+---
+
+## File Summary
+
+| File | Action | Chunk | Description |
+|------|--------|-------|-------------|
+| `src/Runner.Worker/Dap/StepCommands/StepCommandParser.cs` | Modify | 1 | Change prefix to `steps`, add `--output` flag, remove JSON parsing |
+| `src/Runner.Worker/Dap/StepCommands/StepCommandHandler.cs` | Modify | 2 | Format responses based on `OutputFormat` |
+| `browser-ext/content/content.js` | Modify | 3, 4 | Build REPL command strings, update context detection |
+| `src/Test/L0/Worker/Dap/StepCommands/StepCommandParserJsonL0.cs` | Delete | 5 | No longer needed |
+| `src/Test/L0/Worker/Dap/StepCommands/StepCommandParserL0.cs` | Modify | 5 | Update for `steps` prefix, add `--output` tests |
+| `.opencode/plans/dap-step-manipulation.md` | Modify | 6 | Update documentation |
+
+---
+
+## Command Reference (After Changes)
+
+### Human Usage (text output, default)
+
+| Action | Command |
+|--------|---------|
+| List steps | `steps list` |
+| List verbose | `steps list --verbose` |
+| Add run step | `steps add run "echo hello"` |
+| Add run with options | `steps add run "npm test" --name "Run tests" --shell bash` |
+| Add uses step | `steps add uses actions/checkout@v4` |
+| Add uses with inputs | `steps add uses actions/setup-node@v4 --with node-version=20` |
+| Edit step | `steps edit 4 --name "New name" --script "new script"` |
+| Remove step | `steps remove 5` |
+| Move step | `steps move 5 --after 2` |
+| Export | `steps export` |
+| Export with options | `steps export --changes-only --with-comments` |
+
+### Browser Extension (JSON output)
+
+The browser extension appends `--output json` to all commands:
+
+| Action | Command Sent |
+|--------|--------------|
+| List steps | `steps list --output json` |
+| Add step | `steps add uses actions/checkout@v4 --output json` |
+| Remove step | `steps remove 5 --output json` |
+
+---
+
+## Output Format Examples
+
+**`steps list` (text, default):**
+```
+Steps:
+  ✓ 1. Checkout                          uses  actions/checkout@v4
+  ✓ 2. Setup Node                        uses  actions/setup-node@v4
+  ▶ 3. Install deps                      run   npm ci
+    4. Run tests           [MODIFIED]    run   npm test
+    5. Build               [ADDED]       run   npm run build
+
+Legend: ✓ = completed, ▶ = current, [ADDED] = new, [MODIFIED] = edited
+```
+
+**`steps list --output json`:**
+```json
+{
+  "Success": true,
+  "Result": [
+    {"index": 1, "name": "Checkout", "type": "uses", "typeDetail": "actions/checkout@v4", "status": "completed"},
+    {"index": 2, "name": "Setup Node", "type": "uses", "typeDetail": "actions/setup-node@v4", "status": "completed"},
+    {"index": 3, "name": "Install deps", "type": "run", "typeDetail": "npm ci", "status": "current"},
+    {"index": 4, "name": "Run tests", "type": "run", "typeDetail": "npm test", "status": "pending", "change": "MODIFIED"},
+    {"index": 5, "name": "Build", "type": "run", "typeDetail": "npm run build", "status": "pending", "change": "ADDED"}
+  ]
+}
+```
+
+**`steps add run "echo hello" --name "Greeting"` (text):**
+```
+Step added at position 6: Greeting
+```
+
+**`steps add run "echo hello" --name "Greeting" --output json`:**
+```json
+{
+  "Success": true,
+  "Message": "Step added at position 6",
+  "Result": {"index": 6, "name": "Greeting", "type": "run", "typeDetail": "echo hello", "status": "pending", "change": "ADDED"}
+}
+```

.opencode/plans/fix-step-back-duplicate-in-steps-list.md

@@ -0,0 +1,179 @@
+# Fix Step-Back Duplicating Steps in `steps list`
+
+**Status:** Ready for Implementation  
+**Date:** January 2026  
+**Related:** [dap-step-backwards.md](./dap-step-backwards.md)
+
+## Problem Summary
+
+When stepping backwards during DAP debugging, the step that should be re-run appears **twice** in `steps list`:
+1. Once as a **completed** step (from `StepManipulator._completedSteps`)
+2. Once as a **pending** step (from the re-queued `JobSteps`)
+
+### Reproduction Steps
+
+1. Run a workflow with DAP debugging enabled
+2. Let steps 1-4 execute (checkpoints created)
+3. Pause at step 5
+4. Step backward
+5. Run `steps list`
+
+**Expected:**
+```
+✓ 1. hello
+✓ 2. Run actions/checkout@v6
+✓ 3. Run echo "foo=bar" >> "$GITHUB_OUTPUT"
+▶ 4. Run cat doesnotexist
+5. Run a one-line script
+6. Run a multi-line script
+```
+
+**Actual (bug):**
+```
+✓ 1. hello
+✓ 2. Run actions/checkout@v6
+✓ 3. Run echo "foo=bar" >> "$GITHUB_OUTPUT"
+✓ 4. Run cat doesnotexist        ← Still in _completedSteps!
+▶ 5. Run cat doesnotexist        ← Re-queued as current
+6. Run a one-line script
+7. Run a multi-line script
+```
+
+## Root Cause
+
+In `DapDebugSession.RestoreCheckpoint()` (line 1713), the session's `_completedSteps` and `_completedStepsTracker` lists are trimmed to match the checkpoint index:
+
+```csharp
+// Clear completed steps list for frames after this checkpoint
+while (_completedSteps.Count > checkpointIndex)
+{
+    _completedSteps.RemoveAt(_completedSteps.Count - 1);
+}
+
+// Also clear the step tracker for manipulator sync
+while (_completedStepsTracker.Count > checkpointIndex)
+{
+    _completedStepsTracker.RemoveAt(_completedStepsTracker.Count - 1);
+}
+```
+
+However, **`StepManipulator` has its own separate `_completedSteps` list** that is **not** being synced. When `ClearChanges()` is called (line 1774), it only clears change tracking data (`_changes`, `_modifiedStepIds`, `_addedStepIds`, `_originalSteps`), not the `_completedSteps` list.
+
+### Data Flow During Step-Back
+
+1. Steps 1-4 complete → `StepManipulator._completedSteps` = [step1, step2, step3, step4]
+2. Paused at step 5
+3. Step back → `RestoreCheckpoint(3, ...)` is called (checkpoint index 3 = before step 4)
+4. `DapDebugSession._completedSteps` trimmed to 3 items ✓
+5. `DapDebugSession._completedStepsTracker` trimmed to 3 items ✓
+6. `StepManipulator._completedSteps` **NOT trimmed** ✗ (still has 4 items)
+7. Step 4 and remaining steps re-queued to `JobSteps`
+8. `steps list` called → `GetAllSteps()` combines:
+   - `_completedSteps` (4 items) + queue (step4, step5, step6, step7)
+   - Result: step4 appears twice
+
+## Solution
+
+Add a method to `IStepManipulator` interface to trim completed steps to a specific count, then call it from `RestoreCheckpoint`.
+
+## Files to Modify
+
+| File | Changes |
+|------|---------|
+| `src/Runner.Worker/Dap/StepCommands/StepManipulator.cs` | Add `TrimCompletedSteps(int count)` method to interface and implementation |
+| `src/Runner.Worker/Dap/DapDebugSession.cs` | Call `TrimCompletedSteps` in `RestoreCheckpoint()` |
+
+## Detailed Changes
+
+### 1. `StepManipulator.cs` - Add Interface Method and Implementation
+
+**Add to `IStepManipulator` interface (around line 115, after `ClearChanges`):**
+
+```csharp
+/// <summary>
+/// Trims the completed steps list to the specified count.
+/// Used when restoring a checkpoint to sync state with the debug session.
+/// </summary>
+/// <param name="count">The number of completed steps to keep.</param>
+void TrimCompletedSteps(int count);
+```
+
+**Add implementation to `StepManipulator` class (after `ClearChanges()` method, around line 577):**
+
+```csharp
+/// <inheritdoc/>
+public void TrimCompletedSteps(int count)
+{
+    var originalCount = _completedSteps.Count;
+    while (_completedSteps.Count > count)
+    {
+        _completedSteps.RemoveAt(_completedSteps.Count - 1);
+    }
+    Trace.Info($"Trimmed completed steps from {originalCount} to {_completedSteps.Count}");
+}
+```
+
+### 2. `DapDebugSession.cs` - Call TrimCompletedSteps in RestoreCheckpoint
+
+**Modify `RestoreCheckpoint()` (around line 1774), change:**
+
+```csharp
+// Reset the step manipulator to match the restored state
+// It will be re-initialized when the restored step starts
+_stepManipulator?.ClearChanges();
+```
+
+**To:**
+
+```csharp
+// Reset the step manipulator to match the restored state
+_stepManipulator?.ClearChanges();
+_stepManipulator?.TrimCompletedSteps(checkpointIndex);
+```
+
+## Why This Approach
+
+| Approach | Pros | Cons |
+|----------|------|------|
+| **Add `TrimCompletedSteps()` (chosen)** | Minimal change, explicit, mirrors existing DapDebugSession pattern | Requires new interface method |
+| Re-initialize StepManipulator completely | Clean slate | Would lose all state, more disruptive, harder to reason about |
+| Share completed steps list between DapDebugSession and StepManipulator | Single source of truth | Major refactoring, tight coupling between components |
+
+The chosen approach is the least invasive and follows the existing pattern used by `DapDebugSession` for its own `_completedSteps` list.
+
+## Test Scenarios
+
+After implementing this fix, verify:
+
+1. **Basic step-back:**
+   - Run steps 1, 2, 3, 4
+   - Pause at step 5
+   - Step back
+   - `steps list` should show: ✓ 1-3 completed, ▶ 4 current, 5-6 pending (no duplicates)
+
+2. **Multiple step-backs:**
+   - Run steps 1, 2, 3
+   - Step back twice (back to step 1)
+   - `steps list` should show: ▶ 1 current, 2-N pending (no completed steps)
+
+3. **Step back then forward:**
+   - Run steps 1, 2
+   - Step back (to step 2)
+   - Step forward, let step 2 re-run and complete
+   - Step forward again
+   - `steps list` should show correct state without duplicates at any point
+
+4. **Reverse continue:**
+   - Run steps 1, 2, 3, 4
+   - Reverse continue (back to step 1)
+   - `steps list` should show: ▶ 1 current, 2-N pending (no completed steps)
+
+## Implementation Checklist
+
+- [ ] Add `TrimCompletedSteps(int count)` to `IStepManipulator` interface
+- [ ] Implement `TrimCompletedSteps` in `StepManipulator` class
+- [ ] Call `TrimCompletedSteps(checkpointIndex)` in `DapDebugSession.RestoreCheckpoint()`
+- [ ] Test basic step-back scenario
+- [ ] Test multiple step-backs
+- [ ] Test step back then forward
+- [ ] Test reverse continue

.opencode/plans/fix-step-here-insertion.md

@@ -0,0 +1,281 @@
+# Fix Step Addition with `--here` Position
+
+## Problem Summary
+
+When adding a step with `--here` position, two bugs occur:
+
+1. **Duplicate display**: The newly added step appears twice in `steps list` - once as "current" and once in "pending"
+2. **Wrong execution order**: After stepping over, the original step (checkout) runs instead of the newly added step
+
+### Root Cause
+
+When paused at a breakpoint, the current step has already been dequeued from `JobSteps` by `StepsRunner`. The `InsertStepHere` function:
+1. Incorrectly re-inserts `_currentStep` back into the queue
+2. Sets `_currentStep = newStep`, but newStep is also in the queue → duplicate
+3. When execution continues, the loop iteration that already dequeued the original step continues to execute it, not the new step
+
+### Why This Matters
+
+The ability to insert a step that runs BEFORE the current step is essential for debugging workflows. Example scenario:
+- Debugging a job, a step fails because it's missing something
+- Step backwards in the debugger
+- Need to add a new step here that downloads a dependency to fix the failing step
+- Without proper `--here` support, you'd have to go back two steps (what if you don't have them?)
+
+## Solution Overview
+
+Implement a mechanism similar to step-back: when a step is inserted "here", signal `StepsRunner` to skip the current step execution and re-process from the modified queue.
+
+## Files to Modify
+
+| File | Changes |
+|------|---------|
+| `src/Runner.Worker/Dap/DapDebugSession.cs` | Add `HasStepInsertedHere` flag and `ConsumeStepInsertedHere()` method |
+| `src/Runner.Worker/Dap/StepCommands/StepManipulator.cs` | Fix `InsertStepHere()` logic |
+| `src/Runner.Worker/StepsRunner.cs` | Add check for `HasStepInsertedHere` after `OnStepStartingAsync` |
+
+## Detailed Changes
+
+### 1. `DapDebugSession.cs` - Add Interface and Implementation
+
+**Add to `IDapDebugSession` interface (around line 166):**
+```csharp
+/// <summary>
+/// Gets whether a step was inserted "here" (before current step) while paused.
+/// When true, StepsRunner should skip current step execution and re-process from queue.
+/// </summary>
+bool HasStepInsertedHere { get; }
+
+/// <summary>
+/// Consumes the "step inserted here" flag (resets it to false).
+/// Called by StepsRunner after handling the insertion.
+/// </summary>
+void ConsumeStepInsertedHere();
+
+/// <summary>
+/// Sets the "step inserted here" flag.
+/// Called by StepManipulator when --here insertion occurs.
+/// </summary>
+void SetStepInsertedHere();
+```
+
+**Add field (around line 299):**
+```csharp
+private bool _hasStepInsertedHere;
+```
+
+**Add property implementation (around line 329):**
+```csharp
+public bool HasStepInsertedHere => _hasStepInsertedHere;
+```
+
+**Add methods:**
+```csharp
+public void ConsumeStepInsertedHere()
+{
+    _hasStepInsertedHere = false;
+}
+
+public void SetStepInsertedHere()
+{
+    _hasStepInsertedHere = true;
+}
+```
+
+### 2. `StepManipulator.cs` - Fix `InsertStepHere()`
+
+The manipulator needs access to the debug session to set the `HasStepInsertedHere` flag. Access via HostContext since `DapDebugSession` is already registered as a service.
+
+**Modify `InsertStepHere()` method (lines 307-350):**
+
+```csharp
+private int InsertStepHere(IStep step)
+{
+    if (_currentStep == null)
+    {
+        throw new StepCommandException(StepCommandErrors.InvalidPosition,
+            "Can only use --here when paused at a breakpoint.");
+    }
+
+    // Convert queue to list for manipulation
+    var pending = _jobContext.JobSteps.ToList();
+    _jobContext.JobSteps.Clear();
+
+    // Insert the new step at the front (it will run first)
+    pending.Insert(0, step);
+    
+    // Insert the original current step after it (it will run second)
+    // This re-queues the step that was already dequeued by StepsRunner
+    pending.Insert(1, _currentStep);
+
+    // Re-queue all steps
+    foreach (var s in pending)
+    {
+        _jobContext.JobSteps.Enqueue(s);
+    }
+
+    // Signal to StepsRunner that it should skip the current iteration
+    // and re-process from the queue (which now has our new step first)
+    var debugSession = HostContext.GetService<IDapDebugSession>();
+    debugSession?.SetStepInsertedHere();
+
+    // Calculate the 1-based index (new step takes position after completed steps)
+    var newIndex = _completedSteps.Count + 1;
+
+    // Track the change
+    var stepInfo = StepInfo.FromStep(step, newIndex, StepStatus.Pending);
+    stepInfo.Change = ChangeType.Added;
+
+    if (step is IActionRunner runner && runner.Action != null)
+    {
+        _addedStepIds.Add(runner.Action.Id);
+    }
+
+    _changes.Add(StepChange.Added(stepInfo, newIndex));
+
+    // Note: We do NOT update _currentStep here. The StepsRunner will
+    // pick up the new step from the queue and that will become current.
+
+    Trace.Info($"Inserted step '{step.DisplayName}' at position {newIndex} (--here, before current step)");
+    return newIndex;
+}
+```
+
+### 3. `StepsRunner.cs` - Handle the Flag
+
+**Add check after `OnStepStartingAsync` (after line 243, following the step-back pattern):**
+
+```csharp
+// Check if a step was inserted "here" (before current step)
+if (debugSession.HasStepInsertedHere)
+{
+    debugSession.ConsumeStepInsertedHere();
+    
+    // The queue now contains: [new step, original current step, rest...]
+    // We need to skip this iteration and let the loop pick up the new step
+    
+    // Clear pending step info since we're not executing this step now
+    debugSession.ClearPendingStepInfo();
+    
+    // Don't increment stepIndex - the new step takes this position
+    
+    Trace.Info("Step inserted here - skipping current iteration to process new step");
+    
+    // Skip to next iteration - will dequeue and process the new step
+    continue;
+}
+```
+
+### 4. Fix `GetAllSteps()` Display in `StepManipulator.cs`
+
+After the changes above, when `InsertStepHere` is called:
+- `_currentStep` is NOT changed (still points to original step)
+- Queue contains: [new step, original step, rest...]
+- The `HasStepInsertedHere` flag is set
+
+When `GetAllSteps()` is called while paused (before `continue` in StepsRunner):
+- completed = []
+- current = original step (from `_currentStep`)
+- pending = [new step, original step, rest...] (from queue)
+
+This would show the original step twice (as current AND in pending). Need to handle this.
+
+**Modify `GetAllSteps()` to check the flag:**
+
+```csharp
+public IReadOnlyList<StepInfo> GetAllSteps()
+{
+    var result = new List<StepInfo>();
+    int index = 1;
+
+    // Add completed steps
+    foreach (var step in _completedSteps)
+    {
+        // ... existing code ...
+    }
+
+    // Check if we're in "step inserted here" state
+    var debugSession = HostContext.GetService<IDapDebugSession>();
+    var stepInsertedHere = debugSession?.HasStepInsertedHere ?? false;
+
+    // Add current step if present AND not in "step inserted here" state
+    // (In that state, the current step has been re-queued and will show in pending)
+    if (_currentStep != null && !stepInsertedHere)
+    {
+        var info = StepInfo.FromStep(_currentStep, index, StepStatus.Current);
+        ApplyChangeInfo(info);
+        result.Add(info);
+        index++;
+    }
+
+    // Add pending steps from queue
+    if (_jobContext?.JobSteps != null)
+    {
+        bool isFirstPending = true;
+        foreach (var step in _jobContext.JobSteps)
+        {
+            // In "step inserted here" state, mark the first pending step as current
+            var status = (stepInsertedHere && isFirstPending) 
+                ? StepStatus.Current 
+                : StepStatus.Pending;
+            
+            var info = StepInfo.FromStep(step, index, status);
+            ApplyChangeInfo(info);
+            result.Add(info);
+            index++;
+            isFirstPending = false;
+        }
+    }
+
+    return result;
+}
+```
+
+## Execution Context Handling
+
+The new step needs a proper execution context. `StepFactory.WrapInRunner()` creates a child context via `jobContext.CreateChild()`. 
+
+When `StepsRunner` picks up the new step from the queue, it goes through the normal initialization (lines 86-137 in StepsRunner.cs) which sets up expression values, env context, etc. This should work correctly because the new step already has an `ExecutionContext` from `WrapInRunner()`.
+
+The `Start()` method on ExecutionContext just sets up timing and state, so dynamically created steps should work fine.
+
+## Test Scenarios
+
+After implementing this fix, verify:
+
+1. **Basic `--here` insertion**: 
+   - Pause at step 1 (checkout)
+   - `steps add run "echo hello" --here`
+   - `steps list` shows: `▶ 1. hello [ADDED]`, `2. checkout`, `3. ...`
+   - Step over → hello runs
+   - `steps list` shows: `✓ 1. hello`, `▶ 2. checkout`, `3. ...`
+
+2. **Multiple `--here` insertions**:
+   - Pause at step 1
+   - Add step A with `--here`
+   - Add step B with `--here` (should insert before A)
+   - Verify order: B, A, original
+
+3. **`--here` after step-back**:
+   - Run step 1, pause at step 2
+   - Step back to step 1
+   - Add new step with `--here`
+   - Verify new step runs before step 1
+
+4. **Other position options still work**:
+   - `--first`, `--last`, `--after N`, `--before N` should be unaffected
+
+## Implementation Checklist
+
+- [ ] Add `HasStepInsertedHere` flag and methods to `IDapDebugSession` interface
+- [ ] Implement the flag and methods in `DapDebugSession` class
+- [ ] Modify `InsertStepHere()` in `StepManipulator` to set the flag and NOT modify `_currentStep`
+- [ ] Add check in `StepsRunner` to handle `HasStepInsertedHere` with `continue`
+- [ ] Update `GetAllSteps()` to correctly display steps when flag is set
+- [ ] Test the scenarios listed above
+
+## Additional Note: Default Position
+
+There's also a documentation inconsistency: the help text says `--here` is the default, but the code defaults to `--last` (see `AddRunCommand` and `AddUsesCommand` in `StepCommandParser.cs`). This should be reviewed and either:
+- Update the code to default to `--here` (matches docs)
+- Update the docs to say `--last` is the default (matches code)

README.md

@@ -20,6 +20,20 @@ Runner releases:
 
 ![linux](docs/res/linux_sm.png)  [Pre-reqs](docs/start/envlinux.md) | [Download](https://github.com/actions/runner/releases)
 
-## Contribute
+### Note
 
-We accept contributions in the form of issues and pull requests. The runner typically requires changes across the entire system and we aim for issues in the runner to be entirely self contained and fixable here. Therefore, we will primarily handle bug issues opened in this repo and we kindly request you to create all feature and enhancement requests on the [GitHub Feedback](https://github.com/community/community/discussions/categories/actions-and-packages) page. [Read more about our guidelines here](docs/contribute.md) before contributing.
+Thank you for your interest in this GitHub repo, however, right now we are not taking contributions. 
+
+We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.
+
+We are taking the following steps to better direct requests related to GitHub Actions, including:
+
+1. We will be directing questions and support requests to our [Community Discussions area](https://github.com/orgs/community/discussions/categories/actions)
+
+2. High Priority bugs can be reported through Community Discussions or you can report these to our support team https://support.github.com/contact/bug-report.
+
+3. Security Issues should be handled as per our [security.md](security.md)
+
+We will still provide security updates for this project and fix major breaking changes during this time.
+
+You are welcome to still raise bugs in this repo.

browser-ext/README.md

@@ -0,0 +1,176 @@
+# Actions DAP Debugger - Browser Extension
+
+A Chrome extension that enables interactive debugging of GitHub Actions workflows directly in the browser. Connects to the runner's DAP server via a WebSocket proxy.
+
+## Features
+
+- **Variable Inspection**: Browse workflow context variables (`github`, `env`, `steps`, etc.)
+- **REPL Console**: Evaluate expressions and run shell commands
+- **Step Control**: Step forward, step back, continue, and reverse continue
+- **GitHub Integration**: Debugger pane injects directly into the job page
+
+## Quick Start
+
+### 1. Start the WebSocket Proxy
+
+The proxy bridges WebSocket connections from the browser to the DAP TCP server.
+
+```bash
+cd browser-ext/proxy
+npm install
+node proxy.js
+```
+
+The proxy listens on `ws://localhost:4712` and connects to the DAP server at `tcp://localhost:4711`.
+
+### 2. Load the Extension in Chrome
+
+1. Open Chrome and navigate to `chrome://extensions/`
+2. Enable "Developer mode" (toggle in top right)
+3. Click "Load unpacked"
+4. Select the `browser-ext` directory
+
+### 3. Start a Debug Session
+
+1. Go to your GitHub repository
+2. Navigate to Actions and select a workflow run
+3. Click "Re-run jobs" → check "Enable debug logging"
+4. Wait for the runner to display "DAP debugger waiting for connection..."
+
+### 4. Connect the Extension
+
+1. Navigate to the job page (`github.com/.../actions/runs/.../job/...`)
+2. Click the extension icon in Chrome toolbar
+3. Click "Connect"
+4. The debugger pane will appear above the first workflow step
+
+## Usage
+
+### Variable Browser (Left Panel)
+
+Click on scope names to expand and view variables:
+- **Globals**: `github`, `env`, `runner` contexts
+- **Job Outputs**: Outputs from previous jobs
+- **Step Outputs**: Outputs from previous steps
+
+### Console (Right Panel)
+
+Enter expressions or commands:
+
+```bash
+# Evaluate expressions
+${{ github.ref }}
+${{ github.event_name }}
+${{ env.MY_VAR }}
+
+# Run shell commands (prefix with !)
+!ls -la
+!cat package.json
+!env | grep GITHUB
+
+# Modify variables
+!export MY_VAR=new_value
+```
+
+### Control Buttons
+
+| Button | Action | Description |
+|--------|--------|-------------|
+| ⏮ | Reverse Continue | Go back to first checkpoint |
+| ◀ | Step Back | Go to previous checkpoint |
+| ▶ | Continue | Run until next breakpoint/end |
+| ⏭ | Step (Next) | Step to next workflow step |
+
+## Architecture
+
+```
+Browser Extension ──WebSocket──► Proxy ──TCP──► Runner DAP Server
+    (port 4712)                              (port 4711)
+```
+
+The WebSocket proxy handles DAP message framing (Content-Length headers) and provides a browser-compatible connection.
+
+## Configuration
+
+### Proxy Settings
+
+| Environment Variable | Default | Description |
+|---------------------|---------|-------------|
+| `WS_PORT` | 4712 | WebSocket server port |
+| `DAP_HOST` | 127.0.0.1 | DAP server host |
+| `DAP_PORT` | 4711 | DAP server port |
+
+Or use CLI arguments:
+```bash
+node proxy.js --ws-port 4712 --dap-host 127.0.0.1 --dap-port 4711
+```
+
+### Extension Settings
+
+Click the extension popup to configure:
+- **Proxy Host**: Default `localhost`
+- **Proxy Port**: Default `4712`
+
+## File Structure
+
+```
+browser-ext/
+├── manifest.json           # Extension configuration
+├── background/
+│   └── background.js       # Service worker - DAP client
+├── content/
+│   ├── content.js          # UI injection and interaction
+│   └── content.css         # Debugger pane styling
+├── popup/
+│   ├── popup.html          # Extension popup UI
+│   ├── popup.js            # Popup logic
+│   └── popup.css           # Popup styling
+├── lib/
+│   └── dap-protocol.js     # DAP message helpers
+├── proxy/
+│   ├── proxy.js            # WebSocket-to-TCP bridge
+│   └── package.json        # Proxy dependencies
+└── icons/
+    ├── icon16.png
+    ├── icon48.png
+    └── icon128.png
+```
+
+## Troubleshooting
+
+### "Failed to connect to DAP server"
+
+1. Ensure the proxy is running: `node proxy.js`
+2. Ensure the runner is waiting for a debugger connection
+3. Check that debug logging is enabled for the job
+
+### Debugger pane doesn't appear
+
+1. Verify you're on a job page (`/actions/runs/*/job/*`)
+2. Open DevTools and check for console errors
+3. Reload the page after loading the extension
+
+### Variables don't load
+
+1. Wait for the "stopped" event (status shows PAUSED)
+2. Click on a scope to expand it
+3. Check the console for error messages
+
+## Development
+
+### Modifying the Extension
+
+After making changes:
+1. Go to `chrome://extensions/`
+2. Click the refresh icon on the extension card
+3. Reload the GitHub job page
+
+### Debugging
+
+- **Background script**: Inspect via `chrome://extensions/` → "Inspect views: service worker"
+- **Content script**: Use DevTools on the GitHub page
+- **Proxy**: Watch terminal output for message logs
+
+## Security Note
+
+The proxy and extension are designed for local development. The proxy only accepts connections from localhost. Do not expose the proxy to the network without additional security measures.

browser-ext/background/background.js

@@ -0,0 +1,528 @@
+/**
+ * Background Script - DAP Client
+ *
+ * Service worker that manages WebSocket connection to the proxy
+ * and handles DAP protocol communication.
+ *
+ * NOTE: Chrome MV3 service workers can be terminated after ~30s of inactivity.
+ * We handle this with:
+ * 1. Keepalive pings to keep the WebSocket active
+ * 2. Automatic reconnection when the service worker restarts
+ * 3. Storing connection state in chrome.storage.session
+ */
+
+// Connection state
+let ws = null;
+let connectionStatus = 'disconnected'; // disconnected, connecting, connected, paused, running, error
+let sequenceNumber = 1;
+const pendingRequests = new Map(); // seq -> { resolve, reject, command, timeout }
+
+// Reconnection state
+let reconnectAttempts = 0;
+const MAX_RECONNECT_ATTEMPTS = 10;
+const RECONNECT_BASE_DELAY = 1000; // Start with 1s, exponential backoff
+let reconnectTimer = null;
+let lastConnectedUrl = null;
+let wasConnectedBeforeIdle = false;
+
+// Keepalive interval - send ping every 15s to keep service worker AND WebSocket alive
+// Chrome MV3 service workers get suspended after ~30s of inactivity
+// We need to send actual WebSocket messages to keep both alive
+const KEEPALIVE_INTERVAL = 15000;
+let keepaliveTimer = null;
+
+// Default configuration
+const DEFAULT_URL = 'ws://localhost:4712';
+
+/**
+ * Initialize on service worker startup - check if we should reconnect
+ */
+async function initializeOnStartup() {
+  console.log('[Background] Service worker starting up...');
+
+  try {
+    // Restore state from session storage
+    const data = await chrome.storage.session.get(['connectionUrl', 'shouldBeConnected', 'lastStatus']);
+
+    if (data.shouldBeConnected && data.connectionUrl) {
+      console.log('[Background] Restoring connection after service worker restart');
+      lastConnectedUrl = data.connectionUrl;
+      wasConnectedBeforeIdle = true;
+
+      // Small delay to let things settle
+      setTimeout(() => {
+        connect(data.connectionUrl);
+      }, 500);
+    }
+  } catch (e) {
+    console.log('[Background] No session state to restore');
+  }
+}
+
+/**
+ * Save connection state to session storage (survives service worker restart)
+ */
+async function saveConnectionState() {
+  try {
+    await chrome.storage.session.set({
+      connectionUrl: lastConnectedUrl,
+      shouldBeConnected: connectionStatus !== 'disconnected' && connectionStatus !== 'error',
+      lastStatus: connectionStatus,
+    });
+  } catch (e) {
+    console.warn('[Background] Failed to save connection state:', e);
+  }
+}
+
+/**
+ * Clear connection state from session storage
+ */
+async function clearConnectionState() {
+  try {
+    await chrome.storage.session.remove(['connectionUrl', 'shouldBeConnected', 'lastStatus']);
+  } catch (e) {
+    console.warn('[Background] Failed to clear connection state:', e);
+  }
+}
+
+/**
+ * Start keepalive ping to prevent service worker termination
+ * CRITICAL: We must send actual WebSocket messages to keep the connection alive.
+ * Just having a timer is not enough - Chrome will suspend the service worker
+ * and close the WebSocket with code 1001 after ~30s of inactivity.
+ */
+function startKeepalive() {
+  stopKeepalive();
+
+  keepaliveTimer = setInterval(() => {
+    if (ws && ws.readyState === WebSocket.OPEN) {
+      try {
+        // Send a lightweight keepalive message over WebSocket
+        // This does two things:
+        // 1. Keeps the WebSocket connection active (prevents proxy timeout)
+        // 2. Creates activity that keeps the Chrome service worker alive
+        const keepaliveMsg = JSON.stringify({ type: 'keepalive', timestamp: Date.now() });
+        ws.send(keepaliveMsg);
+        console.log('[Background] Keepalive sent');
+      } catch (e) {
+        console.error('[Background] Keepalive error:', e);
+        handleUnexpectedClose();
+      }
+    } else if (wasConnectedBeforeIdle || lastConnectedUrl) {
+      // Connection was lost, try to reconnect
+      console.log('[Background] Connection lost during keepalive check');
+      handleUnexpectedClose();
+    }
+  }, KEEPALIVE_INTERVAL);
+
+  console.log('[Background] Keepalive timer started (interval: ' + KEEPALIVE_INTERVAL + 'ms)');
+}
+
+/**
+ * Stop keepalive ping
+ */
+function stopKeepalive() {
+  if (keepaliveTimer) {
+    clearInterval(keepaliveTimer);
+    keepaliveTimer = null;
+    console.log('[Background] Keepalive timer stopped');
+  }
+}
+
+/**
+ * Handle unexpected connection close - attempt reconnection
+ */
+function handleUnexpectedClose() {
+  if (reconnectTimer) {
+    return; // Already trying to reconnect
+  }
+
+  if (!lastConnectedUrl) {
+    console.log('[Background] No URL to reconnect to');
+    return;
+  }
+
+  if (reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) {
+    console.error('[Background] Max reconnection attempts reached');
+    connectionStatus = 'error';
+    broadcastStatus();
+    clearConnectionState();
+    return;
+  }
+
+  const delay = Math.min(RECONNECT_BASE_DELAY * Math.pow(2, reconnectAttempts), 30000);
+  reconnectAttempts++;
+
+  console.log(`[Background] Scheduling reconnect attempt ${reconnectAttempts}/${MAX_RECONNECT_ATTEMPTS} in ${delay}ms`);
+  connectionStatus = 'connecting';
+  broadcastStatus();
+
+  reconnectTimer = setTimeout(() => {
+    reconnectTimer = null;
+    if (connectionStatus !== 'connected' && connectionStatus !== 'paused' && connectionStatus !== 'running') {
+      connect(lastConnectedUrl);
+    }
+  }, delay);
+}
+
+/**
+ * Connect to the WebSocket proxy
+ */
+function connect(url) {
+  // Clean up existing connection
+  if (ws) {
+    try {
+      ws.onclose = null; // Prevent triggering reconnect
+      ws.close(1000, 'Reconnecting');
+    } catch (e) {
+      // Ignore
+    }
+    ws = null;
+  }
+
+  // Clear any pending reconnect
+  if (reconnectTimer) {
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
+  }
+
+  connectionStatus = 'connecting';
+  broadcastStatus();
+
+  // Use provided URL or default
+  const wsUrl = url || DEFAULT_URL;
+  lastConnectedUrl = wsUrl;
+  console.log(`[Background] Connecting to ${wsUrl}`);
+
+  try {
+    ws = new WebSocket(wsUrl);
+  } catch (e) {
+    console.error('[Background] Failed to create WebSocket:', e);
+    connectionStatus = 'error';
+    broadcastStatus();
+    handleUnexpectedClose();
+    return;
+  }
+
+  ws.onopen = async () => {
+    console.log('[Background] WebSocket connected');
+    connectionStatus = 'connected';
+    reconnectAttempts = 0; // Reset on successful connection
+    wasConnectedBeforeIdle = true;
+    broadcastStatus();
+    saveConnectionState();
+    startKeepalive();
+
+    // Initialize DAP session
+    try {
+      await initializeDapSession();
+    } catch (error) {
+      console.error('[Background] Failed to initialize DAP session:', error);
+      // Don't set error status - the connection might still be usable
+      // The DAP server might just need the job to progress
+    }
+  };
+
+  ws.onmessage = (event) => {
+    try {
+      const message = JSON.parse(event.data);
+      handleDapMessage(message);
+    } catch (error) {
+      console.error('[Background] Failed to parse message:', error);
+    }
+  };
+
+  ws.onclose = (event) => {
+    console.log(`[Background] WebSocket closed: ${event.code} ${event.reason || '(no reason)'}`);
+    ws = null;
+    stopKeepalive();
+
+    // Reject any pending requests
+    for (const [seq, pending] of pendingRequests) {
+      if (pending.timeout) clearTimeout(pending.timeout);
+      pending.reject(new Error('Connection closed'));
+    }
+    pendingRequests.clear();
+
+    // Determine if we should reconnect
+    // Code 1000 = normal closure (user initiated)
+    // Code 1001 = going away (service worker idle, browser closing, etc.)
+    // Code 1006 = abnormal closure (connection lost)
+    // Code 1011 = server error
+    const shouldReconnect = event.code !== 1000;
+
+    if (shouldReconnect && wasConnectedBeforeIdle) {
+      console.log('[Background] Unexpected close, will attempt reconnect');
+      connectionStatus = 'connecting';
+      broadcastStatus();
+      handleUnexpectedClose();
+    } else {
+      connectionStatus = 'disconnected';
+      wasConnectedBeforeIdle = false;
+      broadcastStatus();
+      clearConnectionState();
+    }
+  };
+
+  ws.onerror = (event) => {
+    console.error('[Background] WebSocket error:', event);
+    // onclose will be called after onerror, so we handle reconnection there
+  };
+}
+
+/**
+ * Disconnect from the WebSocket proxy
+ */
+function disconnect() {
+  // Stop any reconnection attempts
+  if (reconnectTimer) {
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
+  }
+  reconnectAttempts = 0;
+  wasConnectedBeforeIdle = false;
+  stopKeepalive();
+
+  if (ws) {
+    // Send disconnect request to DAP server first
+    sendDapRequest('disconnect', {}).catch(() => {});
+
+    // Prevent reconnection on this close
+    const socket = ws;
+    ws = null;
+    socket.onclose = null;
+
+    try {
+      socket.close(1000, 'User disconnected');
+    } catch (e) {
+      // Ignore
+    }
+  }
+
+  connectionStatus = 'disconnected';
+  broadcastStatus();
+  clearConnectionState();
+}
+
+/**
+ * Initialize DAP session (initialize + attach + configurationDone)
+ */
+async function initializeDapSession() {
+  // 1. Initialize
+  const initResponse = await sendDapRequest('initialize', {
+    clientID: 'browser-extension',
+    clientName: 'Actions DAP Debugger',
+    adapterID: 'github-actions-runner',
+    pathFormat: 'path',
+    linesStartAt1: true,
+    columnsStartAt1: true,
+    supportsVariableType: true,
+    supportsVariablePaging: true,
+    supportsRunInTerminalRequest: false,
+    supportsProgressReporting: false,
+    supportsInvalidatedEvent: true,
+  });
+
+  console.log('[Background] Initialize response:', initResponse);
+
+  // 2. Attach to running session
+  const attachResponse = await sendDapRequest('attach', {});
+  console.log('[Background] Attach response:', attachResponse);
+
+  // 3. Configuration done
+  const configResponse = await sendDapRequest('configurationDone', {});
+  console.log('[Background] ConfigurationDone response:', configResponse);
+}
+
+/**
+ * Send a DAP request and return a promise for the response
+ */
+function sendDapRequest(command, args = {}) {
+  return new Promise((resolve, reject) => {
+    if (!ws || ws.readyState !== WebSocket.OPEN) {
+      reject(new Error('Not connected'));
+      return;
+    }
+
+    const seq = sequenceNumber++;
+    const request = {
+      seq,
+      type: 'request',
+      command,
+      arguments: args,
+    };
+
+    console.log(`[Background] Sending DAP request: ${command} (seq: ${seq})`);
+
+    // Set timeout for request
+    const timeout = setTimeout(() => {
+      if (pendingRequests.has(seq)) {
+        pendingRequests.delete(seq);
+        reject(new Error(`Request timed out: ${command}`));
+      }
+    }, 30000);
+
+    pendingRequests.set(seq, { resolve, reject, command, timeout });
+
+    try {
+      ws.send(JSON.stringify(request));
+    } catch (e) {
+      pendingRequests.delete(seq);
+      clearTimeout(timeout);
+      reject(new Error(`Failed to send request: ${e.message}`));
+    }
+  });
+}
+
+/**
+ * Handle incoming DAP message (response or event)
+ */
+function handleDapMessage(message) {
+  if (message.type === 'response') {
+    handleDapResponse(message);
+  } else if (message.type === 'event') {
+    handleDapEvent(message);
+  } else if (message.type === 'proxy-error') {
+    console.error('[Background] Proxy error:', message.message);
+    // Don't immediately set error status - might be transient
+  } else if (message.type === 'keepalive-ack') {
+    // Keepalive acknowledged by proxy - connection is healthy
+    console.log('[Background] Keepalive acknowledged');
+  }
+}
+
+/**
+ * Handle DAP response
+ */
+function handleDapResponse(response) {
+  const pending = pendingRequests.get(response.request_seq);
+  if (!pending) {
+    console.warn(`[Background] No pending request for seq ${response.request_seq}`);
+    return;
+  }
+
+  pendingRequests.delete(response.request_seq);
+  if (pending.timeout) clearTimeout(pending.timeout);
+
+  if (response.success) {
+    console.log(`[Background] DAP response success: ${response.command}`);
+    pending.resolve(response.body || {});
+  } else {
+    console.error(`[Background] DAP response error: ${response.command} - ${response.message}`);
+    pending.reject(new Error(response.message || 'Unknown error'));
+  }
+}
+
+/**
+ * Handle DAP event
+ */
+function handleDapEvent(event) {
+  console.log(`[Background] DAP event: ${event.event}`, event.body);
+
+  switch (event.event) {
+    case 'initialized':
+      // DAP server is ready
+      break;
+
+    case 'stopped':
+      connectionStatus = 'paused';
+      broadcastStatus();
+      saveConnectionState();
+      break;
+
+    case 'continued':
+      connectionStatus = 'running';
+      broadcastStatus();
+      saveConnectionState();
+      break;
+
+    case 'terminated':
+      connectionStatus = 'disconnected';
+      wasConnectedBeforeIdle = false;
+      broadcastStatus();
+      clearConnectionState();
+      break;
+
+    case 'output':
+      // Output event - forward to content scripts
+      break;
+  }
+
+  // Broadcast event to all content scripts
+  broadcastEvent(event);
+}
+
+/**
+ * Broadcast connection status to popup and content scripts
+ */
+function broadcastStatus() {
+  const statusMessage = { type: 'status-changed', status: connectionStatus };
+
+  // Broadcast to all extension contexts (popup)
+  chrome.runtime.sendMessage(statusMessage).catch(() => {});
+
+  // Broadcast to content scripts
+  chrome.tabs.query({ url: 'https://github.com/*/*/actions/runs/*/job/*' }, (tabs) => {
+    if (chrome.runtime.lastError) return;
+    tabs.forEach((tab) => {
+      chrome.tabs.sendMessage(tab.id, statusMessage).catch(() => {});
+    });
+  });
+}
+
+/**
+ * Broadcast DAP event to content scripts
+ */
+function broadcastEvent(event) {
+  chrome.tabs.query({ url: 'https://github.com/*/*/actions/runs/*/job/*' }, (tabs) => {
+    if (chrome.runtime.lastError) return;
+    tabs.forEach((tab) => {
+      chrome.tabs.sendMessage(tab.id, { type: 'dap-event', event }).catch(() => {});
+    });
+  });
+}
+
+/**
+ * Message handler for requests from popup and content scripts
+ */
+chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
+  console.log('[Background] Received message:', message.type);
+
+  switch (message.type) {
+    case 'get-status':
+      sendResponse({ status: connectionStatus, reconnecting: reconnectTimer !== null });
+      return false;
+
+    case 'connect':
+      reconnectAttempts = 0; // Reset attempts on manual connect
+      connect(message.url || DEFAULT_URL);
+      sendResponse({ status: connectionStatus });
+      return false;
+
+    case 'disconnect':
+      disconnect();
+      sendResponse({ status: connectionStatus });
+      return false;
+
+    case 'dap-request':
+      // Handle DAP request from content script
+      sendDapRequest(message.command, message.args || {})
+        .then((body) => {
+          sendResponse({ success: true, body });
+        })
+        .catch((error) => {
+          sendResponse({ success: false, error: error.message });
+        });
+      return true; // Will respond asynchronously
+
+    default:
+      console.warn('[Background] Unknown message type:', message.type);
+      return false;
+  }
+});
+
+// Initialize on startup
+initializeOnStartup();
+
+// Log startup
+console.log('[Background] Actions DAP Debugger background script loaded');

browser-ext/icons/generate.js

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+/**
+ * Create simple green circle PNG icons
+ * No dependencies required - uses pure JavaScript to create valid PNG files
+ */
+
+const fs = require('fs');
+const path = require('path');
+const zlib = require('zlib');
+
+function createPNG(size) {
+  // PNG uses RGBA format, one pixel = 4 bytes
+  const pixelData = [];
+
+  const centerX = size / 2;
+  const centerY = size / 2;
+  const radius = size / 2 - 1;
+  const innerRadius = radius * 0.4;
+
+  for (let y = 0; y < size; y++) {
+    pixelData.push(0); // Filter byte for each row
+    for (let x = 0; x < size; x++) {
+      const dx = x - centerX;
+      const dy = y - centerY;
+      const dist = Math.sqrt(dx * dx + dy * dy);
+
+      if (dist <= radius) {
+        // Green circle (#238636)
+        pixelData.push(35, 134, 54, 255);
+      } else {
+        // Transparent
+        pixelData.push(0, 0, 0, 0);
+      }
+    }
+  }
+
+  // Add a white "bug" shape in the center
+  for (let y = 0; y < size; y++) {
+    for (let x = 0; x < size; x++) {
+      const dx = x - centerX;
+      const dy = y - centerY;
+      const dist = Math.sqrt(dx * dx + dy * dy);
+
+      // Bug body (oval)
+      const bodyDx = dx;
+      const bodyDy = (dy - size * 0.05) / 1.3;
+      const bodyDist = Math.sqrt(bodyDx * bodyDx + bodyDy * bodyDy);
+
+      // Bug head (circle above body)
+      const headDx = dx;
+      const headDy = dy + size * 0.15;
+      const headDist = Math.sqrt(headDx * headDx + headDy * headDy);
+
+      if (bodyDist < innerRadius || headDist < innerRadius * 0.6) {
+        const idx = 1 + y * (1 + size * 4) + x * 4;
+        pixelData[idx] = 255;
+        pixelData[idx + 1] = 255;
+        pixelData[idx + 2] = 255;
+        pixelData[idx + 3] = 255;
+      }
+    }
+  }
+
+  const rawData = Buffer.from(pixelData);
+  const compressed = zlib.deflateSync(rawData);
+
+  // Build PNG file
+  const chunks = [];
+
+  // PNG signature
+  chunks.push(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]));
+
+  // IHDR chunk
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(size, 0); // width
+  ihdr.writeUInt32BE(size, 4); // height
+  ihdr.writeUInt8(8, 8); // bit depth
+  ihdr.writeUInt8(6, 9); // color type (RGBA)
+  ihdr.writeUInt8(0, 10); // compression
+  ihdr.writeUInt8(0, 11); // filter
+  ihdr.writeUInt8(0, 12); // interlace
+  chunks.push(createChunk('IHDR', ihdr));
+
+  // IDAT chunk
+  chunks.push(createChunk('IDAT', compressed));
+
+  // IEND chunk
+  chunks.push(createChunk('IEND', Buffer.alloc(0)));
+
+  return Buffer.concat(chunks);
+}
+
+function createChunk(type, data) {
+  const typeBuffer = Buffer.from(type);
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(data.length, 0);
+
+  const crcData = Buffer.concat([typeBuffer, data]);
+  const crc = Buffer.alloc(4);
+  crc.writeUInt32BE(crc32(crcData), 0);
+
+  return Buffer.concat([length, typeBuffer, data, crc]);
+}
+
+// CRC32 implementation
+function crc32(buf) {
+  let crc = 0xffffffff;
+  for (let i = 0; i < buf.length; i++) {
+    crc = crc32Table[(crc ^ buf[i]) & 0xff] ^ (crc >>> 8);
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+// CRC32 lookup table
+const crc32Table = new Uint32Array(256);
+for (let i = 0; i < 256; i++) {
+  let c = i;
+  for (let j = 0; j < 8; j++) {
+    c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+  }
+  crc32Table[i] = c;
+}
+
+// Generate icons
+const iconsDir = path.join(__dirname);
+const sizes = [16, 48, 128];
+
+sizes.forEach((size) => {
+  const png = createPNG(size);
+  const filename = `icon${size}.png`;
+  fs.writeFileSync(path.join(iconsDir, filename), png);
+  console.log(`Created ${filename} (${size}x${size})`);
+});
+
+console.log('Done!');

browser-ext/lib/dap-protocol.js

@@ -0,0 +1,226 @@
+/**
+ * DAP Protocol Helpers
+ *
+ * Type definitions and utilities for the Debug Adapter Protocol.
+ * Used by both content and background scripts.
+ */
+
+// DAP Request Commands
+const DapCommands = {
+  // Lifecycle
+  INITIALIZE: 'initialize',
+  ATTACH: 'attach',
+  CONFIGURATION_DONE: 'configurationDone',
+  DISCONNECT: 'disconnect',
+
+  // Execution Control
+  CONTINUE: 'continue',
+  NEXT: 'next',
+  STEP_IN: 'stepIn',
+  STEP_OUT: 'stepOut',
+  PAUSE: 'pause',
+  TERMINATE: 'terminate',
+
+  // Reverse Execution
+  STEP_BACK: 'stepBack',
+  REVERSE_CONTINUE: 'reverseContinue',
+
+  // Information
+  THREADS: 'threads',
+  STACK_TRACE: 'stackTrace',
+  SCOPES: 'scopes',
+  VARIABLES: 'variables',
+  SOURCE: 'source',
+
+  // Evaluation
+  EVALUATE: 'evaluate',
+  SET_VARIABLE: 'setVariable',
+
+  // Breakpoints
+  SET_BREAKPOINTS: 'setBreakpoints',
+  SET_FUNCTION_BREAKPOINTS: 'setFunctionBreakpoints',
+  SET_EXCEPTION_BREAKPOINTS: 'setExceptionBreakpoints',
+};
+
+// DAP Event Types
+const DapEvents = {
+  // Lifecycle
+  INITIALIZED: 'initialized',
+  TERMINATED: 'terminated',
+  EXITED: 'exited',
+
+  // Execution
+  STOPPED: 'stopped',
+  CONTINUED: 'continued',
+
+  // Output
+  OUTPUT: 'output',
+
+  // Other
+  THREAD: 'thread',
+  BREAKPOINT: 'breakpoint',
+  MODULE: 'module',
+  LOADED_SOURCE: 'loadedSource',
+  PROCESS: 'process',
+  CAPABILITIES: 'capabilities',
+  PROGRESS_START: 'progressStart',
+  PROGRESS_UPDATE: 'progressUpdate',
+  PROGRESS_END: 'progressEnd',
+  INVALIDATED: 'invalidated',
+  MEMORY: 'memory',
+};
+
+// Stopped Event Reasons
+const StoppedReasons = {
+  STEP: 'step',
+  BREAKPOINT: 'breakpoint',
+  EXCEPTION: 'exception',
+  PAUSE: 'pause',
+  ENTRY: 'entry',
+  GOTO: 'goto',
+  FUNCTION_BREAKPOINT: 'function breakpoint',
+  DATA_BREAKPOINT: 'data breakpoint',
+  INSTRUCTION_BREAKPOINT: 'instruction breakpoint',
+};
+
+// Output Categories
+const OutputCategories = {
+  CONSOLE: 'console',
+  IMPORTANT: 'important',
+  STDOUT: 'stdout',
+  STDERR: 'stderr',
+  TELEMETRY: 'telemetry',
+};
+
+// Evaluate Contexts
+const EvaluateContexts = {
+  WATCH: 'watch',
+  REPL: 'repl',
+  HOVER: 'hover',
+  CLIPBOARD: 'clipboard',
+  VARIABLES: 'variables',
+};
+
+/**
+ * Create a DAP request message
+ *
+ * @param {number} seq - Sequence number
+ * @param {string} command - DAP command name
+ * @param {object} args - Command arguments
+ * @returns {object} DAP request message
+ */
+function createDapRequest(seq, command, args = {}) {
+  return {
+    seq,
+    type: 'request',
+    command,
+    arguments: args,
+  };
+}
+
+/**
+ * Create a DAP response message
+ *
+ * @param {number} seq - Sequence number
+ * @param {number} requestSeq - Original request sequence number
+ * @param {string} command - DAP command name
+ * @param {boolean} success - Whether request succeeded
+ * @param {object} body - Response body
+ * @param {string} message - Error message (if success is false)
+ * @returns {object} DAP response message
+ */
+function createDapResponse(seq, requestSeq, command, success, body = {}, message = '') {
+  return {
+    seq,
+    type: 'response',
+    request_seq: requestSeq,
+    command,
+    success,
+    body,
+    message: success ? undefined : message,
+  };
+}
+
+/**
+ * Create a DAP event message
+ *
+ * @param {number} seq - Sequence number
+ * @param {string} event - Event type
+ * @param {object} body - Event body
+ * @returns {object} DAP event message
+ */
+function createDapEvent(seq, event, body = {}) {
+  return {
+    seq,
+    type: 'event',
+    event,
+    body,
+  };
+}
+
+/**
+ * Parse a DAP message
+ *
+ * @param {string|object} message - JSON string or parsed object
+ * @returns {object} Parsed message with helper properties
+ */
+function parseDapMessage(message) {
+  const msg = typeof message === 'string' ? JSON.parse(message) : message;
+
+  return {
+    raw: msg,
+    isRequest: msg.type === 'request',
+    isResponse: msg.type === 'response',
+    isEvent: msg.type === 'event',
+    seq: msg.seq,
+    requestSeq: msg.request_seq,
+    command: msg.command,
+    event: msg.event,
+    success: msg.success,
+    body: msg.body || {},
+    message: msg.message,
+  };
+}
+
+/**
+ * Check if a message indicates a capability
+ *
+ * @param {object} capabilities - Capabilities object from initialize response
+ * @param {string} name - Capability name
+ * @returns {boolean}
+ */
+function hasCapability(capabilities, name) {
+  return capabilities && capabilities[name] === true;
+}
+
+// Export for use in other modules
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = {
+    DapCommands,
+    DapEvents,
+    StoppedReasons,
+    OutputCategories,
+    EvaluateContexts,
+    createDapRequest,
+    createDapResponse,
+    createDapEvent,
+    parseDapMessage,
+    hasCapability,
+  };
+}
+
+// Make available globally for browser scripts
+if (typeof window !== 'undefined') {
+  window.DapProtocol = {
+    DapCommands,
+    DapEvents,
+    StoppedReasons,
+    OutputCategories,
+    EvaluateContexts,
+    createDapRequest,
+    createDapResponse,
+    createDapEvent,
+    parseDapMessage,
+    hasCapability,
+  };
+}

browser-ext/manifest.json

@@ -0,0 +1,32 @@
+{
+  "manifest_version": 3,
+  "name": "Actions DAP Debugger",
+  "version": "0.1.0",
+  "description": "Debug GitHub Actions workflows with DAP - interactive debugging directly in the browser",
+  "permissions": ["activeTab", "storage"],
+  "host_permissions": ["https://github.com/*"],
+  "background": {
+    "service_worker": "background/background.js"
+  },
+  "content_scripts": [
+    {
+      "matches": ["https://github.com/*/*/actions/runs/*/job/*"],
+      "js": ["lib/dap-protocol.js", "content/content.js"],
+      "css": ["content/content.css"],
+      "run_at": "document_idle"
+    }
+  ],
+  "action": {
+    "default_popup": "popup/popup.html",
+    "default_icon": {
+      "16": "icons/icon16.png",
+      "48": "icons/icon48.png",
+      "128": "icons/icon128.png"
+    }
+  },
+  "icons": {
+    "16": "icons/icon16.png",
+    "48": "icons/icon48.png",
+    "128": "icons/icon128.png"
+  }
+}

browser-ext/popup/popup.css

@@ -0,0 +1,228 @@
+/**
+ * Popup Styles
+ * 
+ * GitHub-inspired dark theme for the extension popup.
+ */
+
+* {
+  box-sizing: border-box;
+  margin: 0;
+  padding: 0;
+}
+
+body {
+  width: 320px;
+  padding: 16px;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif;
+  font-size: 14px;
+  background-color: #0d1117;
+  color: #e6edf3;
+}
+
+h3 {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin: 0 0 16px 0;
+  font-size: 16px;
+  font-weight: 600;
+}
+
+h3 .icon {
+  flex-shrink: 0;
+}
+
+/* Status Section */
+.status-section {
+  display: flex;
+  align-items: center;
+  margin-bottom: 16px;
+  padding: 12px;
+  background-color: #161b22;
+  border-radius: 6px;
+  border: 1px solid #30363d;
+}
+
+.status-indicator {
+  width: 10px;
+  height: 10px;
+  border-radius: 50%;
+  margin-right: 10px;
+  flex-shrink: 0;
+}
+
+.status-disconnected {
+  background-color: #6e7681;
+}
+
+.status-connecting {
+  background-color: #9e6a03;
+  animation: pulse 1.5s ease-in-out infinite;
+}
+
+.status-connected {
+  background-color: #238636;
+}
+
+.status-paused {
+  background-color: #9e6a03;
+}
+
+.status-running {
+  background-color: #238636;
+  animation: pulse 1.5s ease-in-out infinite;
+}
+
+.status-error {
+  background-color: #da3633;
+}
+
+@keyframes pulse {
+  0%, 100% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.5;
+  }
+}
+
+#status-text {
+  font-weight: 500;
+}
+
+/* Config Section */
+.config-section {
+  margin-bottom: 16px;
+}
+
+.config-section label {
+  display: block;
+  margin-bottom: 12px;
+  font-size: 12px;
+  font-weight: 500;
+  color: #8b949e;
+}
+
+.config-section input {
+  display: block;
+  width: 100%;
+  padding: 8px 12px;
+  margin-top: 6px;
+  background-color: #0d1117;
+  border: 1px solid #30363d;
+  border-radius: 6px;
+  color: #e6edf3;
+  font-size: 14px;
+}
+
+.config-section input:focus {
+  border-color: #1f6feb;
+  outline: none;
+  box-shadow: 0 0 0 3px rgba(31, 111, 235, 0.3);
+}
+
+.config-section input:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.config-hint {
+  font-size: 11px;
+  color: #6e7681;
+  margin-top: 4px;
+}
+
+/* Actions Section */
+.actions-section {
+  display: flex;
+  gap: 8px;
+  margin-bottom: 16px;
+}
+
+button {
+  flex: 1;
+  padding: 10px 16px;
+  border: none;
+  border-radius: 6px;
+  font-size: 14px;
+  font-weight: 500;
+  cursor: pointer;
+  transition: background-color 0.15s ease;
+}
+
+button:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.btn-primary {
+  background-color: #238636;
+  color: white;
+}
+
+.btn-primary:hover:not(:disabled) {
+  background-color: #2ea043;
+}
+
+.btn-secondary {
+  background-color: #21262d;
+  color: #e6edf3;
+  border: 1px solid #30363d;
+}
+
+.btn-secondary:hover:not(:disabled) {
+  background-color: #30363d;
+}
+
+/* Help Section */
+.help-section {
+  font-size: 12px;
+  color: #8b949e;
+  background-color: #161b22;
+  border: 1px solid #30363d;
+  border-radius: 6px;
+  padding: 12px;
+  margin-bottom: 12px;
+}
+
+.help-section p {
+  margin: 6px 0;
+  line-height: 1.5;
+}
+
+.help-section p:first-child {
+  margin-top: 0;
+}
+
+.help-section strong {
+  color: #e6edf3;
+}
+
+.help-section code {
+  display: block;
+  background-color: #0d1117;
+  padding: 8px;
+  border-radius: 4px;
+  font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
+  font-size: 11px;
+  overflow-x: auto;
+  margin: 8px 0;
+  white-space: nowrap;
+}
+
+/* Footer */
+.footer {
+  text-align: center;
+  padding-top: 8px;
+  border-top: 1px solid #21262d;
+}
+
+.footer a {
+  color: #58a6ff;
+  text-decoration: none;
+  font-size: 12px;
+}
+
+.footer a:hover {
+  text-decoration: underline;
+}

browser-ext/popup/popup.html

@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <link rel="stylesheet" href="popup.css">
+</head>
+<body>
+  <div class="popup-container">
+    <h3>
+      <svg class="icon" viewBox="0 0 16 16" width="16" height="16">
+        <path fill="currentColor" d="M4.72.22a.75.75 0 0 1 1.06 0l1 1a.75.75 0 0 1-1.06 1.06l-.22-.22-.22.22a.75.75 0 0 1-1.06-1.06l1-1Z"/>
+        <path fill="currentColor" d="M11.28.22a.75.75 0 0 0-1.06 0l-1 1a.75.75 0 0 0 1.06 1.06l.22-.22.22.22a.75.75 0 0 0 1.06-1.06l-1-1Z"/>
+        <path fill="currentColor" d="M8 4a4 4 0 0 0-4 4v1h1v2.5a2.5 2.5 0 0 0 2.5 2.5h1a2.5 2.5 0 0 0 2.5-2.5V9h1V8a4 4 0 0 0-4-4Z"/>
+        <path fill="currentColor" d="M5 9H3.5a.5.5 0 0 0-.5.5v2a.5.5 0 0 0 .5.5H5V9ZM11 9h1.5a.5.5 0 0 1 .5.5v2a.5.5 0 0 1-.5.5H11V9Z"/>
+      </svg>
+      Actions DAP Debugger
+    </h3>
+    
+    <div class="status-section">
+      <div class="status-indicator" id="status-indicator"></div>
+      <span id="status-text">Disconnected</span>
+    </div>
+    
+    <div class="config-section">
+      <label>
+        Proxy URL
+        <input type="text" id="proxy-url" value="ws://localhost:4712" 
+               placeholder="ws://localhost:4712 or wss://...">
+      </label>
+      <p class="config-hint">For codespaces, use the forwarded URL (wss://...)</p>
+    </div>
+    
+    <div class="actions-section">
+      <button id="connect-btn" class="btn-primary">Connect</button>
+      <button id="disconnect-btn" class="btn-secondary" disabled>Disconnect</button>
+    </div>
+    
+    <div class="help-section">
+      <p><strong>Quick Start:</strong></p>
+      <p>1. Start the proxy:</p>
+      <code>cd browser-ext/proxy && npm install && node proxy.js</code>
+      <p>2. Re-run your GitHub Actions job with "Enable debug logging"</p>
+      <p>3. Click Connect when the job is waiting for debugger</p>
+    </div>
+    
+    <div class="footer">
+      <a href="https://github.com/actions/runner" target="_blank">Documentation</a>
+    </div>
+  </div>
+  <script src="popup.js"></script>
+</body>
+</html>

browser-ext/popup/popup.js

@@ -0,0 +1,95 @@
+/**
+ * Popup Script
+ * 
+ * Handles extension popup UI and connection management.
+ */
+
+document.addEventListener('DOMContentLoaded', () => {
+  const statusIndicator = document.getElementById('status-indicator');
+  const statusText = document.getElementById('status-text');
+  const connectBtn = document.getElementById('connect-btn');
+  const disconnectBtn = document.getElementById('disconnect-btn');
+  const urlInput = document.getElementById('proxy-url');
+
+  // Load saved config
+  chrome.storage.local.get(['proxyUrl'], (data) => {
+    if (data.proxyUrl) urlInput.value = data.proxyUrl;
+  });
+
+  // Get current status from background
+  chrome.runtime.sendMessage({ type: 'get-status' }, (response) => {
+    if (response) {
+      updateStatusUI(response.status, response.reconnecting);
+    }
+  });
+
+  // Listen for status changes
+  chrome.runtime.onMessage.addListener((message) => {
+    if (message.type === 'status-changed') {
+      updateStatusUI(message.status, message.reconnecting);
+    }
+  });
+
+  // Connect button
+  connectBtn.addEventListener('click', () => {
+    const url = urlInput.value.trim() || 'ws://localhost:4712';
+
+    // Save config
+    chrome.storage.local.set({ proxyUrl: url });
+
+    // Update UI immediately
+    updateStatusUI('connecting');
+
+    // Connect
+    chrome.runtime.sendMessage({ type: 'connect', url }, (response) => {
+      if (response && response.status) {
+        updateStatusUI(response.status);
+      }
+    });
+  });
+
+  // Disconnect button
+  disconnectBtn.addEventListener('click', () => {
+    chrome.runtime.sendMessage({ type: 'disconnect' }, (response) => {
+      if (response && response.status) {
+        updateStatusUI(response.status);
+      }
+    });
+  });
+
+  /**
+   * Update the UI to reflect current status
+   */
+  function updateStatusUI(status, reconnecting = false) {
+    // Update text
+    const statusNames = {
+      disconnected: 'Disconnected',
+      connecting: reconnecting ? 'Reconnecting...' : 'Connecting...',
+      connected: 'Connected',
+      paused: 'Paused',
+      running: 'Running',
+      error: 'Connection Error',
+    };
+    statusText.textContent = statusNames[status] || status;
+
+    // Update indicator color
+    statusIndicator.className = 'status-indicator status-' + status;
+
+    // Update button states
+    const isConnected = ['connected', 'paused', 'running'].includes(status);
+    const isConnecting = status === 'connecting';
+
+    connectBtn.disabled = isConnected || isConnecting;
+    disconnectBtn.disabled = status === 'disconnected';
+
+    // Update connect button text
+    if (isConnecting) {
+      connectBtn.textContent = reconnecting ? 'Reconnecting...' : 'Connecting...';
+    } else {
+      connectBtn.textContent = 'Connect';
+    }
+
+    // Disable inputs when connected
+    urlInput.disabled = isConnected || isConnecting;
+  }
+});

browser-ext/proxy/package-lock.json

@@ -0,0 +1,36 @@
+{
+  "name": "dap-websocket-proxy",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "dap-websocket-proxy",
+      "version": "1.0.0",
+      "dependencies": {
+        "ws": "^8.16.0"
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.19.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
+      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    }
+  }
+}

browser-ext/proxy/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "dap-websocket-proxy",
+  "version": "1.0.0",
+  "description": "WebSocket-to-TCP bridge for DAP debugging",
+  "main": "proxy.js",
+  "scripts": {
+    "start": "node proxy.js"
+  },
+  "dependencies": {
+    "ws": "^8.16.0"
+  }
+}

browser-ext/proxy/proxy.js

@@ -0,0 +1,220 @@
+/**
+ * DAP WebSocket-to-TCP Proxy
+ *
+ * Bridges WebSocket connections from browser extensions to the DAP TCP server.
+ * Handles DAP message framing (Content-Length headers).
+ *
+ * Usage: node proxy.js [--ws-port 4712] [--dap-host 127.0.0.1] [--dap-port 4711]
+ */
+
+const WebSocket = require('ws');
+const net = require('net');
+
+// Configuration (can be overridden via CLI args)
+const config = {
+  wsPort: parseInt(process.env.WS_PORT) || 4712,
+  dapHost: process.env.DAP_HOST || '127.0.0.1',
+  dapPort: parseInt(process.env.DAP_PORT) || 4711,
+};
+
+// Parse CLI arguments
+for (let i = 2; i < process.argv.length; i++) {
+  switch (process.argv[i]) {
+    case '--ws-port':
+      config.wsPort = parseInt(process.argv[++i]);
+      break;
+    case '--dap-host':
+      config.dapHost = process.argv[++i];
+      break;
+    case '--dap-port':
+      config.dapPort = parseInt(process.argv[++i]);
+      break;
+  }
+}
+
+console.log(`[Proxy] Starting WebSocket-to-TCP proxy`);
+console.log(`[Proxy] WebSocket: ws://localhost:${config.wsPort}`);
+console.log(`[Proxy] DAP Server: tcp://${config.dapHost}:${config.dapPort}`);
+
+const wss = new WebSocket.Server({
+  port: config.wsPort,
+  // Enable ping/pong for connection health checks
+  clientTracking: true,
+});
+
+console.log(`[Proxy] WebSocket server listening on port ${config.wsPort}`);
+
+// Ping all clients every 25 seconds to detect dead connections
+// This is shorter than Chrome's service worker timeout (~30s)
+const PING_INTERVAL = 25000;
+const pingInterval = setInterval(() => {
+  wss.clients.forEach((ws) => {
+    if (ws.isAlive === false) {
+      console.log(`[Proxy] Client failed to respond to ping, terminating`);
+      return ws.terminate();
+    }
+    ws.isAlive = false;
+    ws.ping();
+  });
+}, PING_INTERVAL);
+
+wss.on('connection', (ws, req) => {
+  const clientId = `${req.socket.remoteAddress}:${req.socket.remotePort}`;
+  console.log(`[Proxy] WebSocket client connected: ${clientId}`);
+
+  // Mark as alive for ping/pong tracking
+  ws.isAlive = true;
+  ws.on('pong', () => {
+    ws.isAlive = true;
+  });
+
+  // Connect to DAP TCP server
+  const tcp = net.createConnection({
+    host: config.dapHost,
+    port: config.dapPort,
+  });
+
+  let tcpBuffer = Buffer.alloc(0);
+  let tcpConnected = false;
+
+  tcp.on('connect', () => {
+    tcpConnected = true;
+    console.log(`[Proxy] Connected to DAP server at ${config.dapHost}:${config.dapPort}`);
+  });
+
+  tcp.on('error', (err) => {
+    console.error(`[Proxy] TCP error: ${err.message}`);
+    if (ws.readyState === WebSocket.OPEN) {
+      ws.send(
+        JSON.stringify({
+          type: 'proxy-error',
+          message: `Failed to connect to DAP server: ${err.message}`,
+        })
+      );
+      ws.close(1011, 'DAP server connection failed');
+    }
+  });
+
+  tcp.on('close', () => {
+    console.log(`[Proxy] TCP connection closed`);
+    if (ws.readyState === WebSocket.OPEN) {
+      ws.close(1000, 'DAP server disconnected');
+    }
+  });
+
+  // WebSocket → TCP: Add Content-Length framing
+  ws.on('message', (data) => {
+    const json = data.toString();
+    try {
+      // Validate it's valid JSON
+      const parsed = JSON.parse(json);
+
+      // Handle keepalive messages from the browser extension - don't forward to DAP server
+      if (parsed.type === 'keepalive') {
+        console.log(`[Proxy] Keepalive received from client`);
+        // Respond with a keepalive-ack to confirm the connection is alive
+        if (ws.readyState === WebSocket.OPEN) {
+          ws.send(JSON.stringify({ type: 'keepalive-ack', timestamp: Date.now() }));
+        }
+        return;
+      }
+
+      if (!tcpConnected) {
+        console.warn(`[Proxy] TCP not connected, dropping message`);
+        return;
+      }
+
+      console.log(`[Proxy] WS→TCP: ${parsed.command || parsed.event || 'message'}`);
+
+      // Add DAP framing
+      const framed = `Content-Length: ${Buffer.byteLength(json)}\r\n\r\n${json}`;
+      tcp.write(framed);
+    } catch (err) {
+      console.error(`[Proxy] Invalid JSON from WebSocket: ${err.message}`);
+    }
+  });
+
+  // TCP → WebSocket: Parse Content-Length framing
+  // IMPORTANT: We use Buffer (byte-based) operations because DAP's Content-Length
+  // header specifies the message length in bytes, not characters. Using string
+  // operations would cause buffer misalignment when the JSON contains multi-byte
+  // UTF-8 characters.
+  tcp.on('data', (chunk) => {
+    // Append chunk to buffer (chunk is already a Buffer)
+    tcpBuffer = Buffer.concat([tcpBuffer, chunk]);
+
+    // Process complete DAP messages from buffer
+    const headerEndMarker = Buffer.from('\r\n\r\n');
+
+    while (true) {
+      // Look for header end (\r\n\r\n)
+      const headerEnd = tcpBuffer.indexOf(headerEndMarker);
+      if (headerEnd === -1) break;
+
+      // Extract header as string to parse Content-Length
+      const header = tcpBuffer.slice(0, headerEnd).toString('utf8');
+      const match = header.match(/Content-Length:\s*(\d+)/i);
+      if (!match) {
+        console.error(`[Proxy] Invalid DAP header: ${header}`);
+        // Skip past the invalid header
+        tcpBuffer = tcpBuffer.slice(headerEnd + 4);
+        continue;
+      }
+
+      const contentLength = parseInt(match[1], 10);
+      const messageStart = headerEnd + 4; // After \r\n\r\n
+      const messageEnd = messageStart + contentLength;
+
+      // Check if we have the complete message (in bytes)
+      if (tcpBuffer.length < messageEnd) break;
+
+      // Extract the JSON message (as bytes, then decode to string)
+      const jsonBuffer = tcpBuffer.slice(messageStart, messageEnd);
+      const json = jsonBuffer.toString('utf8');
+
+      // Remove processed message from buffer
+      tcpBuffer = tcpBuffer.slice(messageEnd);
+
+      // Send to WebSocket
+      try {
+        const parsed = JSON.parse(json);
+        console.log(
+          `[Proxy] TCP→WS: ${parsed.type} ${parsed.command || parsed.event || ''} ${parsed.request_seq ? `(req_seq: ${parsed.request_seq})` : ''}`
+        );
+
+        if (ws.readyState === WebSocket.OPEN) {
+          ws.send(json);
+        }
+      } catch (err) {
+        console.error(`[Proxy] Invalid JSON from TCP: ${err.message}`);
+        console.error(`[Proxy] JSON content (first 200 chars): ${json.substring(0, 200)}`);
+      }
+    }
+  });
+
+  // Handle WebSocket close
+  ws.on('close', (code, reason) => {
+    console.log(`[Proxy] WebSocket closed: ${code} ${reason}`);
+    tcp.end();
+  });
+
+  ws.on('error', (err) => {
+    console.error(`[Proxy] WebSocket error: ${err.message}`);
+    tcp.end();
+  });
+});
+
+wss.on('error', (err) => {
+  console.error(`[Proxy] WebSocket server error: ${err.message}`);
+});
+
+// Graceful shutdown
+process.on('SIGINT', () => {
+  console.log(`\n[Proxy] Shutting down...`);
+  clearInterval(pingInterval);
+  wss.clients.forEach((ws) => ws.close(1001, 'Server shutting down'));
+  wss.close(() => {
+    console.log(`[Proxy] Goodbye!`);
+    process.exit(0);
+  });
+});

docs/adrs/0276-problem-matchers.md

@@ -250,6 +250,42 @@ Two problem matchers can be used:
 }
 ```
 
+#### Default from path
+
+The problem matcher can specify a `fromPath` property at the top level, which applies when a specific pattern doesn't provide a value for `fromPath`. This is useful for tools that don't include project file information in their output.
+
+For example, given the following compiler output that doesn't include project file information:
+
+```
+ClassLibrary.cs(16,24): warning CS0612: 'ClassLibrary.Helpers.MyHelper.Name' is obsolete
+```
+
+A problem matcher with a default from path can be used:
+
+```json
+{
+    "problemMatcher": [
+        {
+            "owner": "csc-minimal",
+            "fromPath": "ClassLibrary/ClassLibrary.csproj",
+            "pattern": [
+                {
+                    "regexp": "^(.+)\\((\\d+),(\\d+)\\): (error|warning) (.+): (.*)$",
+                    "file": 1,
+                    "line": 2,
+                    "column": 3,
+                    "severity": 4,
+                    "code": 5,
+                    "message": 6
+                }
+            ]
+        }
+    ]
+}
+```
+
+This ensures that the file is rooted to the correct path when there's not enough information in the error messages to extract a `fromPath`.
+
 #### Mitigate regular expression denial of service (ReDos)
 
 If a matcher exceeds a 1 second timeout when processing a line, retry up to two three times total.

docs/adrs/1751-runner-job-hooks.md

@@ -23,7 +23,7 @@ This feature is mainly intended for self hosted runner administrators.
   - `ACTIONS_RUNNER_HOOK_JOB_STARTED`
   - `ACTIONS_RUNNER_HOOK_JOB_COMPLETED`
 
-You can set these variables to the **absolute** path of a a `.sh` or `.ps1` file.
+You can set these variables to the **absolute** path of a `.sh` or `.ps1` file.
 
 We will execute `pwsh` (fallback to `powershell`) or `bash` (fallback to `sh`) as appropriate.
 - `.sh` files will execute with the args `-e {pathtofile}`

docs/checks/nodejs.md

@@ -4,9 +4,9 @@
 
 Make sure the built-in node.js has access to GitHub.com or GitHub Enterprise Server.
 
-The runner carries its own copy of node.js executable under `<runner_root>/externals/node16/`.
+The runner carries its own copies of node.js executables under `<runner_root>/externals/node20/` and `<runner_root>/externals/node24/`.
 
-All javascript base Actions will get executed by the built-in `node` at `<runner_root>/externals/node16/`.
+All javascript base Actions will get executed by the built-in `node` at either `<runner_root>/externals/node20/` or `<runner_root>/externals/node24/` depending on the version specified in the action's metadata.
 
 > Not the `node` from `$PATH`
 

docs/contribute.md

@@ -1,6 +1,6 @@
 # Contributions
 
-We welcome contributions in the form of issues and pull requests. We view the contributions and the process as the same for github and external contributors.Please note the runner typically requires changes across the entire system and we aim for issues in the runner to be entirely self contained and fixable here. Therefore, we will primarily handle bug issues opened in this repo and we kindly request you to create all feature and enhancement requests on the [GitHub Feedback](https://github.com/community/community/discussions/categories/actions-and-packages) page. 
+We welcome contributions in the form of issues and pull requests. We view the contributions and the process as the same for github and external contributors. Please note the runner typically requires changes across the entire system and we aim for issues in the runner to be entirely self contained and fixable here. Therefore, we will primarily handle bug issues opened in this repo and we kindly request you to create all feature and enhancement requests on the [GitHub Feedback](https://github.com/community/community/discussions/categories/actions-and-packages) page. 
 
 > IMPORTANT: Building your own runner is critical for the dev inner loop process when contributing changes.  However, only runners built and distributed by GitHub (releases) are supported in production.  Be aware that workflows and orchestrations run service side with the runner being a remote process to run steps.  For that reason, the service can pull the runner forward so customizations can be lost.
 

docs/dependency-management.md

@@ -0,0 +1,217 @@
+# Runner Dependency Management Process
+
+## Overview
+
+This document outlines the automated dependency management process for the GitHub Actions Runner, designed to ensure we maintain up-to-date and secure dependencies while providing predictable release cycles.
+
+## Release Schedule
+
+- **Monthly Runner Releases**: New runner versions are released monthly
+- **Weekly Dependency Checks**: Automated workflows check for dependency updates every Monday
+- **Security Patches**: Critical security vulnerabilities are addressed immediately outside the regular schedule
+
+## Automated Workflows
+
+**Note**: These workflows are implemented across separate PRs for easier review and independent deployment. Each workflow includes comprehensive error handling and security-focused vulnerability detection.
+
+### 1. Foundation Labels
+
+- **Workflow**: `.github/workflows/setup-labels.yml` (PR #4024)
+- **Purpose**: Creates consistent dependency labels for all automation workflows
+- **Labels**: `dependencies`, `security`, `typescript`, `needs-manual-review`
+- **Prerequisite**: Must be merged before other workflows for proper labeling
+
+### 2. Node.js Version Updates
+
+- **Workflow**: `.github/workflows/node-upgrade.yml`
+- **Schedule**: Mondays at 6:00 AM UTC
+- **Purpose**: Updates Node.js 20 and 24 versions in `src/Misc/externals.sh`
+- **Source**: [nodejs.org](https://nodejs.org) and [actions/alpine_nodejs](https://github.com/actions/alpine_nodejs)
+- **Priority**: First (NPM depends on current Node.js versions)
+
+### 3. NPM Security Audit
+
+- **Primary Workflow**: `.github/workflows/npm-audit.yml` ("NPM Audit Fix")
+  - **Schedule**: Mondays at 7:00 AM UTC
+  - **Purpose**: Automated security vulnerability detection and basic fixes
+  - **Location**: `src/Misc/expressionFunc/hashFiles/`
+  - **Features**: npm audit, security patch application, PR creation
+  - **Dependency**: Runs after Node.js updates for optimal compatibility
+
+- **Fallback Workflow**: `.github/workflows/npm-audit-typescript.yml` ("NPM Audit Fix with TypeScript Auto-Fix")
+  - **Trigger**: Manual dispatch only
+  - **Purpose**: Manual security audit with TypeScript compatibility fixes
+  - **Use Case**: When scheduled workflow fails or needs custom intervention
+  - **Features**: Enhanced TypeScript auto-repair, graduated security response
+  - **How to Use**:
+    1. If the scheduled "NPM Audit Fix" workflow fails, go to Actions tab
+    2. Select "NPM Audit Fix with TypeScript Auto-Fix" workflow
+    3. Click "Run workflow" and optionally specify fix level (auto/manual)
+    4. Review the generated PR for TypeScript compatibility issues
+
+### 4. .NET SDK Updates
+
+- **Workflow**: `.github/workflows/dotnet-upgrade.yml`
+- **Schedule**: Mondays at midnight UTC
+- **Purpose**: Updates .NET SDK and package versions with build validation
+- **Features**: Global.json updates, NuGet package management, compatibility checking
+- **Independence**: Runs independently of Node.js/NPM updates
+
+### 5. Docker/Buildx Updates
+
+- **Workflow**: `.github/workflows/docker-buildx-upgrade.yml` ("Docker/Buildx Version Upgrade")
+- **Schedule**: Mondays at midnight UTC
+- **Purpose**: Updates Docker and Docker Buildx versions with multi-platform validation
+- **Features**: Container security scanning, multi-architecture build testing
+- **Independence**: Runs independently of other dependency updates
+
+### 6. Dependency Monitoring
+
+- **Workflow**: `.github/workflows/dependency-check.yml` ("Dependency Status Check")
+- **Schedule**: Mondays at 11:00 AM UTC
+- **Purpose**: Comprehensive status report of all dependencies with security audit
+- **Features**: Multi-dependency checking, npm audit status, build validation, choice of specific component checks
+- **Summary**: Runs last to capture results from all morning dependency updates
+
+## Release Process Integration
+
+### Pre-Release Checklist
+
+Before each monthly runner release:
+
+1. **Check Dependency PRs**:
+
+   ```bash
+   # List all open dependency PRs
+   gh pr list --label "dependencies" --state open
+   
+   # List only automated weekly dependency updates
+   gh pr list --label "dependencies-weekly-check" --state open
+   
+   # List only custom dependency automation (not dependabot)
+   gh pr list --label "dependencies-not-dependabot" --state open
+   ```
+
+2. **Run Manual Dependency Check**:
+   - Go to Actions tab → "Dependency Status Check" → "Run workflow"
+   - Review the summary for any outdated dependencies
+
+3. **Review and Merge Updates**:
+   - Prioritize security-related updates
+   - Test dependency updates in development environment
+   - Merge approved dependency PRs
+
+### Vulnerability Response
+
+#### Critical Security Vulnerabilities
+
+- **Response Time**: Within 24 hours
+- **Process**:
+  1. Assess impact on runner security
+  2. Create hotfix branch if runner data security is affected
+  3. Expedite patch release if necessary
+  4. Document in security advisory if applicable
+
+#### Non-Critical Vulnerabilities
+
+- **Response Time**: Next monthly release
+- **Process**:
+  1. Evaluate if vulnerability affects runner functionality
+  2. Include fix in regular dependency update cycle
+  3. Document in release notes
+
+## Monitoring and Alerts
+
+### GitHub Actions Workflow Status
+
+- All dependency workflows create PRs with the `dependencies` label
+- Failed workflows should be investigated immediately
+- Weekly dependency status reports are generated automatically
+
+### Manual Checks
+
+You can manually trigger dependency checks:
+
+- **Full Status**: Run "Dependency Status Check" workflow
+- **Specific Component**: Use the dropdown to check individual dependencies
+
+## Dependency Labels
+
+All automated dependency PRs are tagged with labels for easy filtering and management:
+
+### Primary Labels
+
+- **`dependencies`**: All automated dependency-related PRs
+- **`dependencies-weekly-check`**: Automated weekly dependency updates from scheduled workflows
+- **`dependencies-not-dependabot`**: Custom dependency automation (not created by dependabot)
+- **`security`**: Security vulnerability fixes and patches  
+- **`typescript`**: TypeScript compatibility and type definition updates
+- **`needs-manual-review`**: Complex updates requiring human verification
+
+### Technology-Specific Labels
+
+- **`node`**: Node.js version updates
+- **`javascript`**: JavaScript runtime and tooling updates
+- **`npm`**: NPM package and security updates
+- **`dotnet`**: .NET SDK and NuGet package updates
+- **`docker`**: Docker and container tooling updates
+
+### Workflow-Specific Branches
+
+- **Node.js updates**: `chore/update-node` branch
+- **NPM security fixes**: `chore/npm-audit-fix-YYYYMMDD` and `chore/npm-audit-fix-with-ts-repair` branches
+- **NuGet/.NET updates**: `feature/dotnetsdk-upgrade/{version}` branches
+- **Docker updates**: `feature/docker-buildx-upgrade` branch
+
+## Special Considerations
+
+### Node.js Updates
+
+When updating Node.js versions, remember to:
+
+1. Create a corresponding release in [actions/alpine_nodejs](https://github.com/actions/alpine_nodejs)
+2. Follow the alpine_nodejs getting started guide
+3. Test container builds with new Node versions
+
+### .NET SDK Updates
+
+- Only patch versions are auto-updated within the same major.minor version
+- Major/minor version updates require manual review and testing
+
+### Docker Updates
+
+- Updates include both Docker Engine and Docker Buildx
+- Verify compatibility with runner container workflows
+
+## Troubleshooting
+
+### Common Issues
+
+1. **NPM Audit Workflow Fails**:
+   - Check if `package.json` exists in `src/Misc/expressionFunc/hashFiles/`
+   - Verify Node.js setup step succeeded
+
+2. **Version Detection Fails**:
+   - Check if upstream APIs are available
+   - Verify parsing logic for version extraction
+
+3. **PR Creation Fails**:
+   - Ensure `GITHUB_TOKEN` has sufficient permissions
+   - Check if branch already exists
+
+### Contact
+
+For questions about the dependency management process:
+
+- Create an issue with the `dependencies` label
+- Review existing dependency management workflows
+- Consult the runner team for security-related concerns
+
+## Metrics and KPIs
+
+Track these metrics to measure dependency management effectiveness:
+
+- Number of open dependency PRs at release time
+- Time to merge dependency updates
+- Number of security vulnerabilities by severity
+- Release cycle adherence (monthly target)

docs/start/envlinux.md

@@ -4,16 +4,7 @@
 
 ## Supported Distributions and Versions
 
-x64
-  - Red Hat Enterprise Linux 7+
-  - CentOS 7+
-  - Oracle Linux 7+
-  - Fedora 29+
-  - Debian 9+
-  - Ubuntu 16.04+
-  - Linux Mint 18+
-  - openSUSE 15+
-  - SUSE Enterprise Linux (SLES) 12 SP2+
+Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/reference/runners/self-hosted-runners#linux)."
 
 ## Install .Net Core 3.x Linux Dependencies
 

docs/start/envosx.md

@@ -4,7 +4,6 @@
 
 ## Supported Versions
 
-  - macOS High Sierra (10.13) and later versions
-  - x64 and arm64 (Apple Silicon)
+Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/reference/runners/self-hosted-runners#macos)."
 
 ## [More .Net Core Prerequisites Information](https://docs.microsoft.com/en-us/dotnet/core/macos-prerequisites?tabs=netcore30)

docs/start/envwin.md

@@ -2,11 +2,6 @@
 
 ## Supported Versions
 
- - Windows 7 64-bit
- - Windows 8.1 64-bit
- - Windows 10 64-bit
- - Windows Server 2012 R2 64-bit
- - Windows Server 2016 64-bit
- - Windows Server 2019 64-bit
+Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/reference/runners/self-hosted-runners#windows)."
 
 ## [More .NET Core Prerequisites Information](https://docs.microsoft.com/en-us/dotnet/core/windows-prerequisites?tabs=netcore30)

images/Dockerfile

@@ -1,12 +1,12 @@
 # Source: https://github.com/dotnet/dotnet-docker
-FROM mcr.microsoft.com/dotnet/runtime-deps:6.0-jammy as build
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble AS build
 
 ARG TARGETOS
 ARG TARGETARCH
 ARG RUNNER_VERSION
-ARG RUNNER_CONTAINER_HOOKS_VERSION=0.5.1
-ARG DOCKER_VERSION=25.0.2
-ARG BUILDX_VERSION=0.12.1
+ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
+ARG DOCKER_VERSION=29.0.2
+ARG BUILDX_VERSION=0.30.1
 
 RUN apt update -y && apt install curl unzip -y
 
@@ -21,6 +21,10 @@ RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-c
     && unzip ./runner-container-hooks.zip -d ./k8s \
     && rm runner-container-hooks.zip
 
+RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v0.8.0/actions-runner-hooks-k8s-0.8.0.zip \
+    && unzip ./runner-container-hooks.zip -d ./k8s-novolume \
+    && rm runner-container-hooks.zip
+
 RUN export RUNNER_ARCH=${TARGETARCH} \
     && if [ "$RUNNER_ARCH" = "amd64" ]; then export DOCKER_ARCH=x86_64 ; fi \
     && if [ "$RUNNER_ARCH" = "arm64" ]; then export DOCKER_ARCH=aarch64 ; fi \
@@ -29,20 +33,25 @@ RUN export RUNNER_ARCH=${TARGETARCH} \
     && rm -rf docker.tgz \
     && mkdir -p /usr/local/lib/docker/cli-plugins \
     && curl -fLo /usr/local/lib/docker/cli-plugins/docker-buildx \
-        "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
+    "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
     && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
 
-FROM mcr.microsoft.com/dotnet/runtime-deps:6.0-jammy
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV RUNNER_MANUALLY_TRAP_SIG=1
 ENV ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT=1
-ENV ImageOS=ubuntu22
+ENV ImageOS=ubuntu24
 
-RUN apt-get update -y \
-    && apt-get install -y --no-install-recommends \
-    sudo \
-    lsb-release \
+# 'gpg-agent' and 'software-properties-common' are needed for the 'add-apt-repository' command that follows
+RUN apt update -y \
+    && apt install -y --no-install-recommends sudo lsb-release gpg-agent software-properties-common curl jq unzip \
+    && rm -rf /var/lib/apt/lists/*
+
+# Configure git-core/ppa based on guidance here:  https://git-scm.com/download/linux
+RUN add-apt-repository ppa:git-core/ppa \
+    && apt update -y \
+    && apt install -y git \
     && rm -rf /var/lib/apt/lists/*
 
 RUN adduser --disabled-password --gecos "" --uid 1001 runner \
@@ -50,7 +59,8 @@ RUN adduser --disabled-password --gecos "" --uid 1001 runner \
     && usermod -aG sudo runner \
     && usermod -aG docker runner \
     && echo "%sudo   ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers \
-    && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers
+    && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers \
+    && chmod 777 /home/runner
 
 WORKDIR /home/runner
 

instructions.md

@@ -0,0 +1,57 @@
+## How to demo
+
+Create a new codespace for actions/runner, then
+
+```bash
+git pull
+git checkout rentziass/dap
+```
+
+Then build the runner:
+
+```bash
+cd src && ./dev.sh layout && cd ..
+```
+
+Then register your runner (grab registration command from [here](https://github.com/organizations/galactic-potatoes/settings/actions/runners/new)):
+
+```bash
+cd _layout
+```
+
+```
+./config.sh --url <REPO_URL> --token <TOKEN> ## the command from above
+```
+
+Then start the runner:
+```bash
+./run.sh
+```
+
+### WebSocket Proxy
+
+In a new terminal we need to start the WebSocket proxy:
+
+```bash
+cd ./browser-ext/proxy && npm install && node proxy.js
+```
+
+After that starts, in VS Code we need to add the port forwarding for port `4712`
+(whereas the TCP DAP server will be on `4711`, but we don't need to forward that
+one).
+
+### Browser Extension
+
+For this I'd recommend cloning the repo (`gh repo clone actions/runner`) locally
+for simplicity, then loading the `browser-ext` folder as an unpacked extension
+in Chrome/Edge.
+
+### Debugging a job
+
+Now we want to re-run a failed job for [this workflow](https://github.com/galactic-potatoes/rentziass-test/actions/workflows/self-hosted.yaml) with debug logging enabled. **Once we're on the new job page** we can open the extension and connect. Upon successful connection we'll see steps appear, and clicking the `Debug` button will launch the debugger in page. If anything goes south with connection here simply cancelling the job allows to try again.
+
+> IMPORTANT: after job cleanup is currently broken, after each job make sure to
+> open a new terminal in the codespace and run
+```bash
+cd _layout/_work/rentziass-test/rentziass-test && rm -rf .git .github README.md doesnotexist result
+```

releaseNote.md

@@ -1,30 +1,39 @@
 ## What's Changed
-* Prepare v2.313.0 Release by @luketomlinson in https://github.com/actions/runner/pull/3137
-* Pass RunnerOS during job acquire. by @TingluoHuang in https://github.com/actions/runner/pull/3140
-* Process `snapshot` tokens by @davidomid in https://github.com/actions/runner/pull/3135
-* Update dotnet sdk to latest version @6.0.419 by @github-actions in https://github.com/actions/runner/pull/3158
-* handle broker run service exception handling by @yaananth in https://github.com/actions/runner/pull/3163
-* Add a retry logic to docker login operation by @enescakir in https://github.com/actions/runner/pull/3089
-* Broker fixes for token refreshes and AccessDeniedException by @luketomlinson in https://github.com/actions/runner/pull/3161
-* Remove USE_BROKER_FLOW by @luketomlinson in https://github.com/actions/runner/pull/3162
-* Refresh Token for BrokerServer by @luketomlinson in https://github.com/actions/runner/pull/3167
-* Better step timeout message. by @TingluoHuang in https://github.com/actions/runner/pull/3166
+* Fix owner of /home/runner directory by @nikola-jokic in https://github.com/actions/runner/pull/4132
+* Update Docker to v29.0.2 and Buildx to v0.30.1 by @github-actions[bot] in https://github.com/actions/runner/pull/4135
+* Update workflow around runner docker image. by @TingluoHuang in https://github.com/actions/runner/pull/4133
+* Fix regex for validating runner version format by @TingluoHuang in https://github.com/actions/runner/pull/4136
+* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4144
+* Ensure safe_sleep tries alternative approaches by @TingluoHuang in https://github.com/actions/runner/pull/4146
+* Bump actions/github-script from 7 to 8 by @dependabot[bot] in https://github.com/actions/runner/pull/4137
+* Bump actions/checkout from 5 to 6 by @dependabot[bot] in https://github.com/actions/runner/pull/4130
+* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4149
+* Bump docker image to use ubuntu 24.04 by @TingluoHuang in https://github.com/actions/runner/pull/4018
+* Add support for case function by @AllanGuigou in https://github.com/actions/runner/pull/4147
+* Cleanup feature flag actions_container_action_runner_temp by @ericsciple in https://github.com/actions/runner/pull/4163
+* Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in https://github.com/actions/runner/pull/4155
+* Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in https://github.com/actions/runner/pull/4157
+* Set ACTIONS_ORCHESTRATION_ID as env to actions. by @TingluoHuang in https://github.com/actions/runner/pull/4178
+* Allow hosted VM report job telemetry via .setup_info file. by @TingluoHuang in https://github.com/actions/runner/pull/4186
+* Bump typescript from 5.9.2 to 5.9.3 in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/4184
+* Bump Azure.Storage.Blobs from 12.26.0 to 12.27.0 by @dependabot[bot] in https://github.com/actions/runner/pull/4189
 
 ## New Contributors
-* @davidomid made their first contribution in https://github.com/actions/runner/pull/3135
-* @enescakir made their first contribution in https://github.com/actions/runner/pull/3089
+* @AllanGuigou made their first contribution in https://github.com/actions/runner/pull/4147
 
-**Full Changelog**: https://github.com/actions/runner/compare/v2.313.0...v2.314.0
+**Full Changelog**: https://github.com/actions/runner/compare/v2.330.0...v2.331.0
 
 _Note: Actions Runner follows a progressive release policy, so the latest release might not be available to your enterprise, organization, or repository yet.
 To confirm which version of the Actions Runner you should expect, please view the download instructions for your enterprise, organization, or repository.
 See https://docs.github.com/en/enterprise-cloud@latest/actions/hosting-your-own-runners/adding-self-hosted-runners_
 
 ## Windows x64
+
 We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows.
 
 The following snipped needs to be run on `powershell`:
-``` powershell
+
+```powershell
 # Create a folder under the drive root
 mkdir \actions-runner ; cd \actions-runner
 # Download the latest runner package
@@ -34,13 +43,13 @@ Add-Type -AssemblyName System.IO.Compression.FileSystem ;
 [System.IO.Compression.ZipFile]::ExtractToDirectory("$PWD\actions-runner-win-x64-<RUNNER_VERSION>.zip", "$PWD")
 ```
 
-## [Pre-release] Windows arm64
-**Warning:** Windows arm64 runners are currently in preview status and use [unofficial versions of nodejs](https://unofficial-builds.nodejs.org/). They are not intended for production workflows.
+## Windows arm64
 
 We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows.
 
 The following snipped needs to be run on `powershell`:
-``` powershell
+
+```powershell
 # Create a folder under the drive root
 mkdir \actions-runner ; cd \actions-runner
 # Download the latest runner package
@@ -52,7 +61,7 @@ Add-Type -AssemblyName System.IO.Compression.FileSystem ;
 
 ## OSX x64
 
-``` bash
+```bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -63,7 +72,7 @@ tar xzf ./actions-runner-osx-x64-<RUNNER_VERSION>.tar.gz
 
 ## OSX arm64 (Apple silicon)
 
-``` bash
+```bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -74,7 +83,7 @@ tar xzf ./actions-runner-osx-arm64-<RUNNER_VERSION>.tar.gz
 
 ## Linux x64
 
-``` bash
+```bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -85,7 +94,7 @@ tar xzf ./actions-runner-linux-x64-<RUNNER_VERSION>.tar.gz
 
 ## Linux arm64
 
-``` bash
+```bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -96,7 +105,7 @@ tar xzf ./actions-runner-linux-arm64-<RUNNER_VERSION>.tar.gz
 
 ## Linux arm
 
-``` bash
+```bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -106,6 +115,7 @@ tar xzf ./actions-runner-linux-arm-<RUNNER_VERSION>.tar.gz
 ```
 
 ## Using your self hosted runner
+
 For additional details about configuring, running, or shutting down the runner please check out our [product docs.](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/adding-self-hosted-runners)
 
 ## SHA-256 Checksums

src/Directory.Build.props

@@ -57,4 +57,13 @@
   <PropertyGroup>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
+
+  <PropertyGroup>
+    <!-- Enable NuGet package auditing -->
+    <NuGetAudit>true</NuGetAudit>
+    <!-- Audit direct and transitive packages -->
+    <NuGetAuditMode>all</NuGetAuditMode>
+    <!-- Report low, moderate, high and critical advisories -->
+    <NuGetAuditLevel>moderate</NuGetAuditLevel>
+  </PropertyGroup>
 </Project>

src/Misc/contentHash/dotnetRuntime/linux-arm

@@ -1 +0,0 @@
-54d95a44d118dba852395991224a6b9c1abe916858c87138656f80c619e85331

src/Misc/contentHash/dotnetRuntime/linux-arm64

@@ -1 +0,0 @@
-68015af17f06a824fa478e62ae7393766ce627fd5599ab916432a14656a19a52

src/Misc/contentHash/dotnetRuntime/linux-x64

@@ -1 +0,0 @@
-a2628119ca419cb54e279103ffae7986cdbd0814d57c73ff0dc74c38be08b9ae

src/Misc/contentHash/dotnetRuntime/osx-arm64

@@ -1 +0,0 @@
-de71ca09ead807e1a2ce9df0a5b23eb7690cb71fff51169a77e4c3992be53dda

src/Misc/contentHash/dotnetRuntime/osx-x64

@@ -1 +0,0 @@
-d009e05e6b26d614d65be736a15d1bd151932121c16a9ff1b986deadecc982b9

src/Misc/contentHash/dotnetRuntime/win-arm64

@@ -1 +0,0 @@
-f730db39c2305800b4653795360ba9c10c68f384a46b85d808f1f9f0ed3c42e4

src/Misc/contentHash/dotnetRuntime/win-x64

@@ -1 +0,0 @@
-a35b5722375490e9473cdcccb5e18b41eba3dbf4344fe31abc9821e21f18ea5a

src/Misc/contentHash/externals/linux-arm

@@ -1 +0,0 @@
-4bf3e1af0d482af1b2eaf9f08250248a8c1aea8ec20a3c5be116d58cdd930009

src/Misc/contentHash/externals/linux-arm64

@@ -1 +0,0 @@
-ec1719a8cb4d8687328aa64f4aa7c4e3498a715d8939117874782e3e6e63a14b

src/Misc/contentHash/externals/linux-x64

@@ -1 +0,0 @@
-50538de29f173bb73f708c4ed2c8328a62b8795829b97b2a6cb57197e2305287

src/Misc/contentHash/externals/osx-arm64

@@ -1 +0,0 @@
-a0a96cbb7593643b69e669bf14d7b29b7f27800b3a00bb3305aebe041456c701

src/Misc/contentHash/externals/osx-x64

@@ -1 +0,0 @@
-6255b22692779467047ecebd60ad46984866d75cdfe10421d593a7b51d620b09

src/Misc/contentHash/externals/win-arm64

@@ -1 +0,0 @@
-6ff1abd055dc35bfbf06f75c2f08908f660346f66ad1d8f81c910068e9ba029d

src/Misc/contentHash/externals/win-x64

@@ -1 +0,0 @@
-433a6d748742d12abd20dc2a79b62ac3d9718ae47ef26f8e84dc8c180eea3659

src/Misc/expressionFunc/hashFiles/.eslintrc.json

@@ -1,5 +1,5 @@
 {
-    "plugins": ["@typescript-eslint"],
+    "plugins": ["@typescript-eslint", "@stylistic"],
     "extends": ["plugin:github/recommended"],
     "parser": "@typescript-eslint/parser",
     "parserOptions": {
@@ -26,7 +26,7 @@
       ],
       "camelcase": "off",
       "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
-      "@typescript-eslint/func-call-spacing": ["error", "never"],
+      "@stylistic/func-call-spacing": ["error", "never"],
       "@typescript-eslint/no-array-constructor": "error",
       "@typescript-eslint/no-empty-interface": "error",
       "@typescript-eslint/no-explicit-any": "error",
@@ -47,8 +47,8 @@
       "@typescript-eslint/promise-function-async": "error",
       "@typescript-eslint/require-array-sort-compare": "error",
       "@typescript-eslint/restrict-plus-operands": "error",
-      "@typescript-eslint/semi": ["error", "never"],
-      "@typescript-eslint/type-annotation-spacing": "error",
+      "@stylistic/semi": ["error", "never"],
+      "@stylistic/type-annotation-spacing": "error",
       "@typescript-eslint/unbound-method": "error",
       "filenames/match-regex" : "off",
       "github/no-then" : 1, // warning

src/Misc/expressionFunc/hashFiles/package.json

@@ -10,8 +10,7 @@
     "lint": "eslint src/**/*.ts",
     "pack": "ncc build -o ../../layoutbin/hashFiles",
     "all": "npm run format && npm run lint && npm run build && npm run pack",
-    "prepare": "cd ../../../../ && husky install"
-
+    "prepare": "cd ../../../../ && husky"
   },
   "repository": {
     "type": "git",
@@ -36,16 +35,17 @@
     "@actions/glob": "^0.4.0"
   },
   "devDependencies": {
-    "@types/node": "^20.6.2",
-    "@typescript-eslint/eslint-plugin": "^6.7.2",
-    "@typescript-eslint/parser": "^6.7.2",
-    "@vercel/ncc": "^0.38.0",
+    "@stylistic/eslint-plugin": "^3.1.0",
+    "@types/node": "^22.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.0.0",
+    "@typescript-eslint/parser": "^8.0.0",
+    "@vercel/ncc": "^0.38.3",
     "eslint": "^8.47.0",
-    "eslint-plugin-github": "^4.10.0",
+    "eslint-plugin-github": "^4.10.2",
     "eslint-plugin-prettier": "^5.0.0",
+    "husky": "^9.1.7",
+    "lint-staged": "^15.5.0",
     "prettier": "^3.0.3",
-    "typescript": "^5.2.2",
-    "husky": "^8.0.3",
-    "lint-staged": "^14.0.0"
+    "typescript": "^5.9.3"
   }
-}
+}

src/Misc/externals.sh

@@ -3,12 +3,11 @@ PACKAGERUNTIME=$1
 PRECACHE=$2
 
 NODE_URL=https://nodejs.org/dist
-UNOFFICIAL_NODE_URL=https://unofficial-builds.nodejs.org/download/release
 NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
-NODE16_VERSION="16.20.2"
-NODE20_VERSION="20.8.1"
-# used only for win-arm64, remove node16 unofficial version when official version is available
-NODE16_UNOFFICIAL_VERSION="16.20.0"
+# When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
+# Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
+NODE20_VERSION="20.20.0"
+NODE24_VERSION="24.13.0"
 
 get_abs_path() {
   # exploits the fact that pwd will print abs path when no args
@@ -139,10 +138,10 @@ function acquireExternalTool() {
 
 # Download the external tools only for Windows.
 if [[ "$PACKAGERUNTIME" == "win-x64" || "$PACKAGERUNTIME" == "win-x86" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/$PACKAGERUNTIME/node.exe" node16/bin
-    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/$PACKAGERUNTIME/node.lib" node16/bin
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.exe" node20/bin
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.lib" node20/bin
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.exe" node24/bin
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.lib" node24/bin
     if [[ "$PRECACHE" != "" ]]; then
         acquireExternalTool "https://github.com/microsoft/vswhere/releases/download/2.6.7/vswhere.exe" vswhere
     fi
@@ -151,10 +150,10 @@ fi
 # Download the external tools only for Windows.
 if [[ "$PACKAGERUNTIME" == "win-arm64" ]]; then
     # todo: replace these with official release when available
-    acquireExternalTool "$UNOFFICIAL_NODE_URL/v${NODE16_UNOFFICIAL_VERSION}/$PACKAGERUNTIME/node.exe" node16/bin
-    acquireExternalTool "$UNOFFICIAL_NODE_URL/v${NODE16_UNOFFICIAL_VERSION}/$PACKAGERUNTIME/node.lib" node16/bin
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.exe" node20/bin
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.lib" node20/bin
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.exe" node24/bin
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.lib" node24/bin
     if [[ "$PRECACHE" != "" ]]; then
         acquireExternalTool "https://github.com/microsoft/vswhere/releases/download/2.6.7/vswhere.exe" vswhere
     fi
@@ -162,30 +161,29 @@ fi
 
 # Download the external tools only for OSX.
 if [[ "$PACKAGERUNTIME" == "osx-x64" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-darwin-x64.tar.gz" node16 fix_nested_dir
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-darwin-x64.tar.gz" node20 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-darwin-x64.tar.gz" node24 fix_nested_dir
 fi
 
 if [[ "$PACKAGERUNTIME" == "osx-arm64" ]]; then
     # node.js v12 doesn't support macOS on arm64.
-    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-darwin-arm64.tar.gz" node16 fix_nested_dir
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-darwin-arm64.tar.gz" node20 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-darwin-arm64.tar.gz" node24 fix_nested_dir
 fi
 
 # Download the external tools for Linux PACKAGERUNTIMEs.
 if [[ "$PACKAGERUNTIME" == "linux-x64" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-linux-x64.tar.gz" node16 fix_nested_dir
-    acquireExternalTool "$NODE_ALPINE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-alpine-x64.tar.gz" node16_alpine
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-linux-x64.tar.gz" node20 fix_nested_dir
     acquireExternalTool "$NODE_ALPINE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-alpine-x64.tar.gz" node20_alpine
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-linux-x64.tar.gz" node24 fix_nested_dir
+    acquireExternalTool "$NODE_ALPINE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-alpine-x64.tar.gz" node24_alpine
 fi
 
 if [[ "$PACKAGERUNTIME" == "linux-arm64" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-linux-arm64.tar.gz" node16 fix_nested_dir
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-linux-arm64.tar.gz" node20 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-linux-arm64.tar.gz" node24 fix_nested_dir
 fi
 
 if [[ "$PACKAGERUNTIME" == "linux-arm" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-linux-armv7l.tar.gz" node16 fix_nested_dir
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-linux-armv7l.tar.gz" node20 fix_nested_dir
 fi

src/Misc/layoutbin/RunnerService.js

@@ -114,6 +114,11 @@ var runService = function () {
             );
             stopping = true;
           }
+        } else if (code === 5) {
+          console.log(
+            "Runner listener exit with Session Conflict error, stop the service, no retry needed."
+          );
+          stopping = true;
         } else {
           var messagePrefix = "Runner listener exit with undefined return code";
           unknownFailureRetryCount++;

src/Misc/layoutbin/actions.runner.service.template

@@ -1,6 +1,6 @@
 [Unit]
 Description={{Description}}
-After=network.target
+After=network-online.target
 
 [Service]
 ExecStart={{RunnerRoot}}/runsvc.sh

src/Misc/layoutbin/hashFiles/index.js

@@ -1,7 +1,7 @@
 /******/ (() => { // webpackBootstrap
 /******/ 	var __webpack_modules__ = ({
 
-/***/ 2627:
+/***/ 4711:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -22,13 +22,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -46,15 +56,15 @@ var __asyncValues = (this && this.__asyncValues) || function (o) {
     function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-const crypto = __importStar(__nccwpck_require__(6113));
-const fs = __importStar(__nccwpck_require__(7147));
-const glob = __importStar(__nccwpck_require__(8090));
-const path = __importStar(__nccwpck_require__(1017));
-const stream = __importStar(__nccwpck_require__(2781));
-const util = __importStar(__nccwpck_require__(3837));
+const crypto = __importStar(__nccwpck_require__(6982));
+const fs = __importStar(__nccwpck_require__(9896));
+const glob = __importStar(__nccwpck_require__(7206));
+const path = __importStar(__nccwpck_require__(6928));
+const stream = __importStar(__nccwpck_require__(2203));
+const util = __importStar(__nccwpck_require__(9023));
 function run() {
-    var _a, e_1, _b, _c;
     return __awaiter(this, void 0, void 0, function* () {
+        var _a, e_1, _b, _c;
         // arg0 -> node
         // arg1 -> hashFiles.js
         // env[followSymbolicLinks] = true/null
@@ -128,7 +138,7 @@ function run() {
 
 /***/ }),
 
-/***/ 7351:
+/***/ 4914:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -154,8 +164,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.issue = exports.issueCommand = void 0;
-const os = __importStar(__nccwpck_require__(2037));
-const utils_1 = __nccwpck_require__(5278);
+const os = __importStar(__nccwpck_require__(857));
+const utils_1 = __nccwpck_require__(302);
 /**
  * Commands
  *
@@ -227,7 +237,7 @@ function escapeProperty(s) {
 
 /***/ }),
 
-/***/ 2186:
+/***/ 7484:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -262,12 +272,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getIDToken = exports.getState = exports.saveState = exports.group = exports.endGroup = exports.startGroup = exports.info = exports.notice = exports.warning = exports.error = exports.debug = exports.isDebug = exports.setFailed = exports.setCommandEcho = exports.setOutput = exports.getBooleanInput = exports.getMultilineInput = exports.getInput = exports.addPath = exports.setSecret = exports.exportVariable = exports.ExitCode = void 0;
-const command_1 = __nccwpck_require__(7351);
-const file_command_1 = __nccwpck_require__(717);
-const utils_1 = __nccwpck_require__(5278);
-const os = __importStar(__nccwpck_require__(2037));
-const path = __importStar(__nccwpck_require__(1017));
-const oidc_utils_1 = __nccwpck_require__(8041);
+const command_1 = __nccwpck_require__(4914);
+const file_command_1 = __nccwpck_require__(4753);
+const utils_1 = __nccwpck_require__(302);
+const os = __importStar(__nccwpck_require__(857));
+const path = __importStar(__nccwpck_require__(6928));
+const oidc_utils_1 = __nccwpck_require__(5306);
 /**
  * The code to exit an action
  */
@@ -552,17 +562,17 @@ exports.getIDToken = getIDToken;
 /**
  * Summary exports
  */
-var summary_1 = __nccwpck_require__(1327);
+var summary_1 = __nccwpck_require__(1847);
 Object.defineProperty(exports, "summary", ({ enumerable: true, get: function () { return summary_1.summary; } }));
 /**
  * @deprecated use core.summary
  */
-var summary_2 = __nccwpck_require__(1327);
+var summary_2 = __nccwpck_require__(1847);
 Object.defineProperty(exports, "markdownSummary", ({ enumerable: true, get: function () { return summary_2.markdownSummary; } }));
 /**
  * Path exports
  */
-var path_utils_1 = __nccwpck_require__(2981);
+var path_utils_1 = __nccwpck_require__(1976);
 Object.defineProperty(exports, "toPosixPath", ({ enumerable: true, get: function () { return path_utils_1.toPosixPath; } }));
 Object.defineProperty(exports, "toWin32Path", ({ enumerable: true, get: function () { return path_utils_1.toWin32Path; } }));
 Object.defineProperty(exports, "toPlatformPath", ({ enumerable: true, get: function () { return path_utils_1.toPlatformPath; } }));
@@ -570,7 +580,7 @@ Object.defineProperty(exports, "toPlatformPath", ({ enumerable: true, get: funct
 
 /***/ }),
 
-/***/ 717:
+/***/ 4753:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -599,10 +609,10 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.prepareKeyValueMessage = exports.issueFileCommand = void 0;
 // We use any as a valid input type
 /* eslint-disable @typescript-eslint/no-explicit-any */
-const fs = __importStar(__nccwpck_require__(7147));
-const os = __importStar(__nccwpck_require__(2037));
-const uuid_1 = __nccwpck_require__(5840);
-const utils_1 = __nccwpck_require__(5278);
+const fs = __importStar(__nccwpck_require__(9896));
+const os = __importStar(__nccwpck_require__(857));
+const uuid_1 = __nccwpck_require__(2048);
+const utils_1 = __nccwpck_require__(302);
 function issueFileCommand(command, message) {
     const filePath = process.env[`GITHUB_${command}`];
     if (!filePath) {
@@ -635,7 +645,7 @@ exports.prepareKeyValueMessage = prepareKeyValueMessage;
 
 /***/ }),
 
-/***/ 8041:
+/***/ 5306:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -651,9 +661,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.OidcClient = void 0;
-const http_client_1 = __nccwpck_require__(6255);
-const auth_1 = __nccwpck_require__(5526);
-const core_1 = __nccwpck_require__(2186);
+const http_client_1 = __nccwpck_require__(4844);
+const auth_1 = __nccwpck_require__(4552);
+const core_1 = __nccwpck_require__(7484);
 class OidcClient {
     static createHttpClient(allowRetry = true, maxRetry = 10) {
         const requestOptions = {
@@ -719,7 +729,7 @@ exports.OidcClient = OidcClient;
 
 /***/ }),
 
-/***/ 2981:
+/***/ 1976:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -745,7 +755,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.toPlatformPath = exports.toWin32Path = exports.toPosixPath = void 0;
-const path = __importStar(__nccwpck_require__(1017));
+const path = __importStar(__nccwpck_require__(6928));
 /**
  * toPosixPath converts the given path to the posix form. On Windows, \\ will be
  * replaced with /.
@@ -784,7 +794,7 @@ exports.toPlatformPath = toPlatformPath;
 
 /***/ }),
 
-/***/ 1327:
+/***/ 1847:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -800,8 +810,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.summary = exports.markdownSummary = exports.SUMMARY_DOCS_URL = exports.SUMMARY_ENV_VAR = void 0;
-const os_1 = __nccwpck_require__(2037);
-const fs_1 = __nccwpck_require__(7147);
+const os_1 = __nccwpck_require__(857);
+const fs_1 = __nccwpck_require__(9896);
 const { access, appendFile, writeFile } = fs_1.promises;
 exports.SUMMARY_ENV_VAR = 'GITHUB_STEP_SUMMARY';
 exports.SUMMARY_DOCS_URL = 'https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-job-summary';
@@ -1074,7 +1084,7 @@ exports.summary = _summary;
 
 /***/ }),
 
-/***/ 5278:
+/***/ 302:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -1121,7 +1131,7 @@ exports.toCommandProperties = toCommandProperties;
 
 /***/ }),
 
-/***/ 8090:
+/***/ 7206:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1137,8 +1147,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.hashFiles = exports.create = void 0;
-const internal_globber_1 = __nccwpck_require__(8298);
-const internal_hash_files_1 = __nccwpck_require__(2448);
+const internal_globber_1 = __nccwpck_require__(103);
+const internal_hash_files_1 = __nccwpck_require__(3608);
 /**
  * Constructs a globber
  *
@@ -1174,7 +1184,7 @@ exports.hashFiles = hashFiles;
 
 /***/ }),
 
-/***/ 1026:
+/***/ 8164:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1200,7 +1210,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getOptions = void 0;
-const core = __importStar(__nccwpck_require__(2186));
+const core = __importStar(__nccwpck_require__(7484));
 /**
  * Returns a copy with defaults filled in.
  */
@@ -1236,7 +1246,7 @@ exports.getOptions = getOptions;
 
 /***/ }),
 
-/***/ 8298:
+/***/ 103:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1290,14 +1300,14 @@ var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _ar
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DefaultGlobber = void 0;
-const core = __importStar(__nccwpck_require__(2186));
-const fs = __importStar(__nccwpck_require__(7147));
-const globOptionsHelper = __importStar(__nccwpck_require__(1026));
-const path = __importStar(__nccwpck_require__(1017));
-const patternHelper = __importStar(__nccwpck_require__(9005));
-const internal_match_kind_1 = __nccwpck_require__(1063);
-const internal_pattern_1 = __nccwpck_require__(4536);
-const internal_search_state_1 = __nccwpck_require__(9117);
+const core = __importStar(__nccwpck_require__(7484));
+const fs = __importStar(__nccwpck_require__(9896));
+const globOptionsHelper = __importStar(__nccwpck_require__(8164));
+const path = __importStar(__nccwpck_require__(6928));
+const patternHelper = __importStar(__nccwpck_require__(8891));
+const internal_match_kind_1 = __nccwpck_require__(2644);
+const internal_pattern_1 = __nccwpck_require__(5370);
+const internal_search_state_1 = __nccwpck_require__(9890);
 const IS_WINDOWS = process.platform === 'win32';
 class DefaultGlobber {
     constructor(options) {
@@ -1478,7 +1488,7 @@ exports.DefaultGlobber = DefaultGlobber;
 
 /***/ }),
 
-/***/ 2448:
+/***/ 3608:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1520,12 +1530,12 @@ var __asyncValues = (this && this.__asyncValues) || function (o) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.hashFiles = void 0;
-const crypto = __importStar(__nccwpck_require__(6113));
-const core = __importStar(__nccwpck_require__(2186));
-const fs = __importStar(__nccwpck_require__(7147));
-const stream = __importStar(__nccwpck_require__(2781));
-const util = __importStar(__nccwpck_require__(3837));
-const path = __importStar(__nccwpck_require__(1017));
+const crypto = __importStar(__nccwpck_require__(6982));
+const core = __importStar(__nccwpck_require__(7484));
+const fs = __importStar(__nccwpck_require__(9896));
+const stream = __importStar(__nccwpck_require__(2203));
+const util = __importStar(__nccwpck_require__(9023));
+const path = __importStar(__nccwpck_require__(6928));
 function hashFiles(globber, currentWorkspace, verbose = false) {
     var e_1, _a;
     var _b;
@@ -1582,7 +1592,7 @@ exports.hashFiles = hashFiles;
 
 /***/ }),
 
-/***/ 1063:
+/***/ 2644:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -1607,7 +1617,7 @@ var MatchKind;
 
 /***/ }),
 
-/***/ 1849:
+/***/ 4138:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1636,8 +1646,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.safeTrimTrailingSeparator = exports.normalizeSeparators = exports.hasRoot = exports.hasAbsoluteRoot = exports.ensureAbsoluteRoot = exports.dirname = void 0;
-const path = __importStar(__nccwpck_require__(1017));
-const assert_1 = __importDefault(__nccwpck_require__(9491));
+const path = __importStar(__nccwpck_require__(6928));
+const assert_1 = __importDefault(__nccwpck_require__(2613));
 const IS_WINDOWS = process.platform === 'win32';
 /**
  * Similar to path.dirname except normalizes the path separators and slightly better handling for Windows UNC paths.
@@ -1812,7 +1822,7 @@ exports.safeTrimTrailingSeparator = safeTrimTrailingSeparator;
 
 /***/ }),
 
-/***/ 6836:
+/***/ 6617:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1841,9 +1851,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.Path = void 0;
-const path = __importStar(__nccwpck_require__(1017));
-const pathHelper = __importStar(__nccwpck_require__(1849));
-const assert_1 = __importDefault(__nccwpck_require__(9491));
+const path = __importStar(__nccwpck_require__(6928));
+const pathHelper = __importStar(__nccwpck_require__(4138));
+const assert_1 = __importDefault(__nccwpck_require__(2613));
 const IS_WINDOWS = process.platform === 'win32';
 /**
  * Helper class for parsing paths into segments
@@ -1932,7 +1942,7 @@ exports.Path = Path;
 
 /***/ }),
 
-/***/ 9005:
+/***/ 8891:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1958,8 +1968,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.partialMatch = exports.match = exports.getSearchPaths = void 0;
-const pathHelper = __importStar(__nccwpck_require__(1849));
-const internal_match_kind_1 = __nccwpck_require__(1063);
+const pathHelper = __importStar(__nccwpck_require__(4138));
+const internal_match_kind_1 = __nccwpck_require__(2644);
 const IS_WINDOWS = process.platform === 'win32';
 /**
  * Given an array of patterns, returns an array of paths to search.
@@ -2033,7 +2043,7 @@ exports.partialMatch = partialMatch;
 
 /***/ }),
 
-/***/ 4536:
+/***/ 5370:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -2062,13 +2072,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.Pattern = void 0;
-const os = __importStar(__nccwpck_require__(2037));
-const path = __importStar(__nccwpck_require__(1017));
-const pathHelper = __importStar(__nccwpck_require__(1849));
-const assert_1 = __importDefault(__nccwpck_require__(9491));
-const minimatch_1 = __nccwpck_require__(3973);
-const internal_match_kind_1 = __nccwpck_require__(1063);
-const internal_path_1 = __nccwpck_require__(6836);
+const os = __importStar(__nccwpck_require__(857));
+const path = __importStar(__nccwpck_require__(6928));
+const pathHelper = __importStar(__nccwpck_require__(4138));
+const assert_1 = __importDefault(__nccwpck_require__(2613));
+const minimatch_1 = __nccwpck_require__(3772);
+const internal_match_kind_1 = __nccwpck_require__(2644);
+const internal_path_1 = __nccwpck_require__(6617);
 const IS_WINDOWS = process.platform === 'win32';
 class Pattern {
     constructor(patternOrNegate, isImplicitPattern = false, segments, homedir) {
@@ -2295,7 +2305,7 @@ exports.Pattern = Pattern;
 
 /***/ }),
 
-/***/ 9117:
+/***/ 9890:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -2313,7 +2323,7 @@ exports.SearchState = SearchState;
 
 /***/ }),
 
-/***/ 5526:
+/***/ 4552:
 /***/ (function(__unused_webpack_module, exports) {
 
 "use strict";
@@ -2401,7 +2411,7 @@ exports.PersonalAccessTokenCredentialHandler = PersonalAccessTokenCredentialHand
 
 /***/ }),
 
-/***/ 6255:
+/***/ 4844:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -2437,10 +2447,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.HttpClient = exports.isHttps = exports.HttpClientResponse = exports.HttpClientError = exports.getProxyUrl = exports.MediaTypes = exports.Headers = exports.HttpCodes = void 0;
-const http = __importStar(__nccwpck_require__(3685));
-const https = __importStar(__nccwpck_require__(5687));
-const pm = __importStar(__nccwpck_require__(9835));
-const tunnel = __importStar(__nccwpck_require__(4294));
+const http = __importStar(__nccwpck_require__(8611));
+const https = __importStar(__nccwpck_require__(5692));
+const pm = __importStar(__nccwpck_require__(4988));
+const tunnel = __importStar(__nccwpck_require__(770));
 var HttpCodes;
 (function (HttpCodes) {
     HttpCodes[HttpCodes["OK"] = 200] = "OK";
@@ -3026,7 +3036,7 @@ const lowercaseKeys = (obj) => Object.keys(obj).reduce((c, k) => ((c[k.toLowerCa
 
 /***/ }),
 
-/***/ 9835:
+/***/ 4988:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -3115,7 +3125,7 @@ function isLoopbackAddress(host) {
 
 /***/ }),
 
-/***/ 9417:
+/***/ 9380:
 /***/ ((module) => {
 
 "use strict";
@@ -3185,11 +3195,11 @@ function range(a, b, str) {
 
 /***/ }),
 
-/***/ 3717:
+/***/ 4691:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-var concatMap = __nccwpck_require__(6891);
-var balanced = __nccwpck_require__(9417);
+var concatMap = __nccwpck_require__(7087);
+var balanced = __nccwpck_require__(9380);
 
 module.exports = expandTop;
 
@@ -3299,7 +3309,7 @@ function expand(str, isTop) {
   var isOptions = m.body.indexOf(',') >= 0;
   if (!isSequence && !isOptions) {
     // {a},b}
-    if (m.post.match(/,.*\}/)) {
+    if (m.post.match(/,(?!,).*\}/)) {
       str = m.pre + '{' + m.body + escClose + m.post;
       return expand(str);
     }
@@ -3393,7 +3403,7 @@ function expand(str, isTop) {
 
 /***/ }),
 
-/***/ 6891:
+/***/ 7087:
 /***/ ((module) => {
 
 module.exports = function (xs, fn) {
@@ -3413,19 +3423,19 @@ var isArray = Array.isArray || function (xs) {
 
 /***/ }),
 
-/***/ 3973:
+/***/ 3772:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 module.exports = minimatch
 minimatch.Minimatch = Minimatch
 
-var path = (function () { try { return __nccwpck_require__(1017) } catch (e) {}}()) || {
+var path = (function () { try { return __nccwpck_require__(6928) } catch (e) {}}()) || {
   sep: '/'
 }
 minimatch.sep = path.sep
 
 var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {}
-var expand = __nccwpck_require__(3717)
+var expand = __nccwpck_require__(4691)
 
 var plTypes = {
   '!': { open: '(?:(?!(?:', close: '))[^/]*?)'},
@@ -4367,27 +4377,27 @@ function regExpEscape (s) {
 
 /***/ }),
 
-/***/ 4294:
+/***/ 770:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-module.exports = __nccwpck_require__(4219);
+module.exports = __nccwpck_require__(218);
 
 
 /***/ }),
 
-/***/ 4219:
+/***/ 218:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 
-var net = __nccwpck_require__(1808);
-var tls = __nccwpck_require__(4404);
-var http = __nccwpck_require__(3685);
-var https = __nccwpck_require__(5687);
-var events = __nccwpck_require__(2361);
-var assert = __nccwpck_require__(9491);
-var util = __nccwpck_require__(3837);
+var net = __nccwpck_require__(9278);
+var tls = __nccwpck_require__(4756);
+var http = __nccwpck_require__(8611);
+var https = __nccwpck_require__(5692);
+var events = __nccwpck_require__(4434);
+var assert = __nccwpck_require__(2613);
+var util = __nccwpck_require__(9023);
 
 
 exports.httpOverHttp = httpOverHttp;
@@ -4647,7 +4657,7 @@ exports.debug = debug; // for test
 
 /***/ }),
 
-/***/ 5840:
+/***/ 2048:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4711,29 +4721,29 @@ Object.defineProperty(exports, "parse", ({
   }
 }));
 
-var _v = _interopRequireDefault(__nccwpck_require__(8628));
+var _v = _interopRequireDefault(__nccwpck_require__(6415));
 
-var _v2 = _interopRequireDefault(__nccwpck_require__(6409));
+var _v2 = _interopRequireDefault(__nccwpck_require__(1697));
 
-var _v3 = _interopRequireDefault(__nccwpck_require__(5122));
+var _v3 = _interopRequireDefault(__nccwpck_require__(4676));
 
-var _v4 = _interopRequireDefault(__nccwpck_require__(9120));
+var _v4 = _interopRequireDefault(__nccwpck_require__(9771));
 
-var _nil = _interopRequireDefault(__nccwpck_require__(5332));
+var _nil = _interopRequireDefault(__nccwpck_require__(7723));
 
-var _version = _interopRequireDefault(__nccwpck_require__(1595));
+var _version = _interopRequireDefault(__nccwpck_require__(5868));
 
-var _validate = _interopRequireDefault(__nccwpck_require__(6900));
+var _validate = _interopRequireDefault(__nccwpck_require__(6200));
 
-var _stringify = _interopRequireDefault(__nccwpck_require__(8950));
+var _stringify = _interopRequireDefault(__nccwpck_require__(7597));
 
-var _parse = _interopRequireDefault(__nccwpck_require__(2746));
+var _parse = _interopRequireDefault(__nccwpck_require__(7267));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 /***/ }),
 
-/***/ 4569:
+/***/ 216:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4744,7 +4754,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _crypto = _interopRequireDefault(__nccwpck_require__(6113));
+var _crypto = _interopRequireDefault(__nccwpck_require__(6982));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4763,7 +4773,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 5332:
+/***/ 7723:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -4778,7 +4788,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 2746:
+/***/ 7267:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4789,7 +4799,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _validate = _interopRequireDefault(__nccwpck_require__(6900));
+var _validate = _interopRequireDefault(__nccwpck_require__(6200));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4830,7 +4840,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 814:
+/***/ 7879:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -4845,7 +4855,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 807:
+/***/ 2973:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4856,7 +4866,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = rng;
 
-var _crypto = _interopRequireDefault(__nccwpck_require__(6113));
+var _crypto = _interopRequireDefault(__nccwpck_require__(6982));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4876,7 +4886,7 @@ function rng() {
 
 /***/ }),
 
-/***/ 5274:
+/***/ 507:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4887,7 +4897,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _crypto = _interopRequireDefault(__nccwpck_require__(6113));
+var _crypto = _interopRequireDefault(__nccwpck_require__(6982));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4906,7 +4916,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 8950:
+/***/ 7597:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4917,7 +4927,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _validate = _interopRequireDefault(__nccwpck_require__(6900));
+var _validate = _interopRequireDefault(__nccwpck_require__(6200));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4952,7 +4962,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 8628:
+/***/ 6415:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4963,9 +4973,9 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _rng = _interopRequireDefault(__nccwpck_require__(807));
+var _rng = _interopRequireDefault(__nccwpck_require__(2973));
 
-var _stringify = _interopRequireDefault(__nccwpck_require__(8950));
+var _stringify = _interopRequireDefault(__nccwpck_require__(7597));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5066,7 +5076,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 6409:
+/***/ 1697:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5077,9 +5087,9 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _v = _interopRequireDefault(__nccwpck_require__(5998));
+var _v = _interopRequireDefault(__nccwpck_require__(2930));
 
-var _md = _interopRequireDefault(__nccwpck_require__(4569));
+var _md = _interopRequireDefault(__nccwpck_require__(216));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5089,7 +5099,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 5998:
+/***/ 2930:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5101,9 +5111,9 @@ Object.defineProperty(exports, "__esModule", ({
 exports["default"] = _default;
 exports.URL = exports.DNS = void 0;
 
-var _stringify = _interopRequireDefault(__nccwpck_require__(8950));
+var _stringify = _interopRequireDefault(__nccwpck_require__(7597));
 
-var _parse = _interopRequireDefault(__nccwpck_require__(2746));
+var _parse = _interopRequireDefault(__nccwpck_require__(7267));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5174,7 +5184,7 @@ function _default(name, version, hashfunc) {
 
 /***/ }),
 
-/***/ 5122:
+/***/ 4676:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5185,9 +5195,9 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _rng = _interopRequireDefault(__nccwpck_require__(807));
+var _rng = _interopRequireDefault(__nccwpck_require__(2973));
 
-var _stringify = _interopRequireDefault(__nccwpck_require__(8950));
+var _stringify = _interopRequireDefault(__nccwpck_require__(7597));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5218,7 +5228,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 9120:
+/***/ 9771:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5229,9 +5239,9 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _v = _interopRequireDefault(__nccwpck_require__(5998));
+var _v = _interopRequireDefault(__nccwpck_require__(2930));
 
-var _sha = _interopRequireDefault(__nccwpck_require__(5274));
+var _sha = _interopRequireDefault(__nccwpck_require__(507));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5241,7 +5251,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 6900:
+/***/ 6200:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5252,7 +5262,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _regex = _interopRequireDefault(__nccwpck_require__(814));
+var _regex = _interopRequireDefault(__nccwpck_require__(7879));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5265,7 +5275,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 1595:
+/***/ 5868:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5276,7 +5286,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _validate = _interopRequireDefault(__nccwpck_require__(6900));
+var _validate = _interopRequireDefault(__nccwpck_require__(6200));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5293,7 +5303,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 9491:
+/***/ 2613:
 /***/ ((module) => {
 
 "use strict";
@@ -5301,7 +5311,7 @@ module.exports = require("assert");
 
 /***/ }),
 
-/***/ 6113:
+/***/ 6982:
 /***/ ((module) => {
 
 "use strict";
@@ -5309,7 +5319,7 @@ module.exports = require("crypto");
 
 /***/ }),
 
-/***/ 2361:
+/***/ 4434:
 /***/ ((module) => {
 
 "use strict";
@@ -5317,7 +5327,7 @@ module.exports = require("events");
 
 /***/ }),
 
-/***/ 7147:
+/***/ 9896:
 /***/ ((module) => {
 
 "use strict";
@@ -5325,7 +5335,7 @@ module.exports = require("fs");
 
 /***/ }),
 
-/***/ 3685:
+/***/ 8611:
 /***/ ((module) => {
 
 "use strict";
@@ -5333,7 +5343,7 @@ module.exports = require("http");
 
 /***/ }),
 
-/***/ 5687:
+/***/ 5692:
 /***/ ((module) => {
 
 "use strict";
@@ -5341,7 +5351,7 @@ module.exports = require("https");
 
 /***/ }),
 
-/***/ 1808:
+/***/ 9278:
 /***/ ((module) => {
 
 "use strict";
@@ -5349,7 +5359,7 @@ module.exports = require("net");
 
 /***/ }),
 
-/***/ 2037:
+/***/ 857:
 /***/ ((module) => {
 
 "use strict";
@@ -5357,7 +5367,7 @@ module.exports = require("os");
 
 /***/ }),
 
-/***/ 1017:
+/***/ 6928:
 /***/ ((module) => {
 
 "use strict";
@@ -5365,7 +5375,7 @@ module.exports = require("path");
 
 /***/ }),
 
-/***/ 2781:
+/***/ 2203:
 /***/ ((module) => {
 
 "use strict";
@@ -5373,7 +5383,7 @@ module.exports = require("stream");
 
 /***/ }),
 
-/***/ 4404:
+/***/ 4756:
 /***/ ((module) => {
 
 "use strict";
@@ -5381,7 +5391,7 @@ module.exports = require("tls");
 
 /***/ }),
 
-/***/ 3837:
+/***/ 9023:
 /***/ ((module) => {
 
 "use strict";
@@ -5431,7 +5441,7 @@ module.exports = require("util");
 /******/ 	// startup
 /******/ 	// Load entry module and return exports
 /******/ 	// This entry module is referenced by other modules so it can't be inlined
-/******/ 	var __webpack_exports__ = __nccwpck_require__(2627);
+/******/ 	var __webpack_exports__ = __nccwpck_require__(4711);
 /******/ 	module.exports = __webpack_exports__;
 /******/ 	
 /******/ })()

src/Misc/layoutbin/installdependencies.sh

@@ -110,7 +110,7 @@ then
             exit 1
         fi
 
-        apt_get_with_fallbacks libicu72 libicu71 libicu70 libicu69 libicu68 libicu67 libicu66 libicu65 libicu63 libicu60 libicu57 libicu55 libicu52
+        apt_get_with_fallbacks libicu76 libicu75 libicu74 libicu73 libicu72 libicu71 libicu70 libicu69 libicu68 libicu67 libicu66 libicu65 libicu63 libicu60 libicu57 libicu55 libicu52
         if [ $? -ne 0 ]
         then
             echo "'$apt_get' failed with exit code '$?'"

src/Misc/layoutbin/runsvc.sh

@@ -10,7 +10,7 @@ if [ -f ".path" ]; then
     echo ".path=${PATH}"
 fi
 
-nodever=${GITHUB_ACTIONS_RUNNER_FORCED_NODE_VERSION:-node16}
+nodever="node20"
 
 # insert anything to setup env when running as a service
 # run the host process which keep the listener alive

src/Misc/layoutbin/update.sh.template

@@ -123,7 +123,7 @@ fi
 # fix upgrade issue with macOS when running as a service
 attemptedtargetedfix=0
 currentplatform=$(uname | awk '{print tolower($0)}')
-if [[ "$currentplatform" == 'darwin'  && restartinteractiverunner -eq 0 ]]; then
+if [[ "$currentplatform" == 'darwin'  && $restartinteractiverunner -eq 0 ]]; then
     # We needed a fix for https://github.com/actions/runner/issues/743
     # We will recreate the ./externals/nodeXY/bin/node of the past runner version that launched the runnerlistener service
     # Otherwise mac gatekeeper kills the processes we spawn on creation as we are running a process with no backing file
@@ -135,12 +135,23 @@ if [[ "$currentplatform" == 'darwin'  && restartinteractiverunner -eq 0 ]]; then
     then
         # inspect the open file handles to find the node process
         # we can't actually inspect the process using ps because it uses relative paths and doesn't follow symlinks
-        nodever="node16"
+        # Try finding node24 first, then fallback to earlier versions if needed
+        nodever="node24"
         path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
-        if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node12
+        if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node20
         then
-            nodever="node12"
+            nodever="node20"
             path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
+            if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node16
+            then
+                nodever="node16"
+                path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
+                if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node12
+                then
+                    nodever="node12"
+                    path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
+                fi
+            fi
         fi
         if [[ $? -eq 0 && -n "$path" ]]
         then
@@ -178,6 +189,19 @@ if [[ "$currentplatform" == 'darwin'  && restartinteractiverunner -eq 0 ]]; then
     fi
 fi
 
+# update runsvc.sh
+if [ -f "$rootfolder/runsvc.sh" ]
+then
+    date "+[%F %T-%4N] Update runsvc.sh" >> "$logfile" 2>&1
+    cat "$rootfolder/bin/runsvc.sh" > "$rootfolder/runsvc.sh"
+    if [ $? -ne 0 ]
+    then
+        date "+[%F %T-%4N] Can't update $rootfolder/runsvc.sh using $rootfolder/bin/runsvc.sh" >> "$logfile" 2>&1
+        mv -fv "$logfile" "$logfile.failed"
+        exit 1
+    fi
+fi
+
 date "+[%F %T-%4N] Update succeed" >> "$logfile"
 
 touch update.finished

src/Misc/layoutroot/run-helper.cmd.template

@@ -49,5 +49,10 @@ if %ERRORLEVEL% EQU 4 (
   exit /b 1
 )
 
+if %ERRORLEVEL% EQU 5 (
+  echo "Runner listener exit with Session Conflict error, stop the service, no retry needed."
+  exit /b 0
+)
+
 echo "Exiting after unknown error code: %ERRORLEVEL%"
 exit /b 0

src/Misc/layoutroot/run-helper.sh.template

@@ -70,6 +70,9 @@ elif [[ $returnCode == 4 ]]; then
         "$DIR"/safe_sleep.sh 1
     done
     exit 2
+elif [[ $returnCode == 5 ]]; then
+    echo "Runner listener exit with Session Conflict error, stop the service, no retry needed."
+    exit 0
 else
     echo "Exiting with unknown error code: ${returnCode}"
     exit 0

src/Misc/layoutroot/safe_sleep.sh

@@ -1,6 +1,37 @@
 #!/bin/bash
 
+# try to use sleep if available
+if [ -x "$(command -v sleep)" ]; then
+    sleep "$1"
+    exit 0
+fi
+
+# try to use ping if available
+if [ -x "$(command -v ping)" ]; then
+    ping -c $(( $1 + 1 )) 127.0.0.1 > /dev/null
+    exit 0
+fi
+
+# try to use read -t from stdin/stdout/stderr if we are in bash
+if [ -n "$BASH_VERSION" ]; then
+    if command -v read >/dev/null 2>&1; then
+        if [ -t 0 ]; then
+            read -t "$1" -u 0 || :;
+            exit 0
+        fi
+        if [ -t 1 ]; then
+            read -t "$1" -u 1 || :;
+            exit 0
+        fi
+        if [ -t 2 ]; then
+            read -t "$1" -u 2 || :;
+            exit 0
+        fi
+    fi
+fi
+
+# fallback to a busy wait
 SECONDS=0
-while [[ $SECONDS != $1 ]]; do
+while [[ $SECONDS -lt $1 ]]; do
     :
 done

src/Runner.Common/ActionsRunServer.cs

@@ -20,12 +20,12 @@ namespace GitHub.Runner.Common
     {
         private bool _hasConnection;
         private VssConnection _connection;
-        private TaskAgentHttpClient _taskAgentClient;
+        private ActionsRunServerHttpClient _actionsRunServerClient;
 
         public async Task ConnectAsync(Uri serverUrl, VssCredentials credentials)
         {
             _connection = await EstablishVssConnection(serverUrl, credentials, TimeSpan.FromSeconds(100));
-            _taskAgentClient = _connection.GetClient<TaskAgentHttpClient>();
+            _actionsRunServerClient = _connection.GetClient<ActionsRunServerHttpClient>();
             _hasConnection = true;
         }
 
@@ -42,7 +42,7 @@ namespace GitHub.Runner.Common
             CheckConnection();
             var jobMessage = RetryRequest<AgentJobRequestMessage>(async () =>
                                                     {
-                                                        return await _taskAgentClient.GetJobMessageAsync(id, cancellationToken);
+                                                        return await _actionsRunServerClient.GetJobMessageAsync(id, cancellationToken);
                                                     }, cancellationToken);
 
             return jobMessage;

src/Runner.Common/AuthMigration.cs

@@ -0,0 +1,13 @@
+using System;
+
+namespace GitHub.Runner.Common
+{
+    public class AuthMigrationEventArgs : EventArgs
+    {
+        public AuthMigrationEventArgs(string trace)
+        {
+            Trace = trace;
+        }
+        public string Trace { get; private set; }
+    }
+}

src/Runner.Common/BrokerServer.cs

@@ -7,6 +7,7 @@ using GitHub.DistributedTask.Pipelines;
 using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Sdk;
 using GitHub.Services.Common;
+using GitHub.Services.WebApi;
 using Sdk.RSWebApi.Contracts;
 using Sdk.WebApi.WebApi.RawClient;
 
@@ -22,6 +23,8 @@ namespace GitHub.Runner.Common
 
         Task<TaskAgentMessage> GetRunnerMessageAsync(Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, bool disableUpdate, CancellationToken token);
 
+        Task AcknowledgeRunnerRequestAsync(string runnerRequestId, Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, CancellationToken token);
+
         Task UpdateConnectionIfNeeded(Uri serverUri, VssCredentials credentials);
 
         Task ForceRefreshConnection(VssCredentials credentials);
@@ -36,6 +39,7 @@ namespace GitHub.Runner.Common
 
         public async Task ConnectAsync(Uri serverUri, VssCredentials credentials)
         {
+            Trace.Entering();
             _brokerUri = serverUri;
 
             _connection = VssUtil.CreateRawConnection(serverUri, credentials);
@@ -65,10 +69,17 @@ namespace GitHub.Runner.Common
             var brokerSession = RetryRequest<TaskAgentMessage>(
                 async () => await _brokerHttpClient.GetRunnerMessageAsync(sessionId, version, status, os, architecture, disableUpdate, cancellationToken), cancellationToken, shouldRetry: ShouldRetryException);
 
-
             return brokerSession;
         }
 
+        public async Task AcknowledgeRunnerRequestAsync(string runnerRequestId, Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, CancellationToken cancellationToken)
+        {
+            CheckConnection();
+
+            // No retries
+            await _brokerHttpClient.AcknowledgeRunnerRequestAsync(runnerRequestId, sessionId, version, status, os, architecture, cancellationToken);
+        }
+
         public async Task DeleteSessionAsync(CancellationToken cancellationToken)
         {
             CheckConnection();
@@ -87,12 +98,17 @@ namespace GitHub.Runner.Common
 
         public Task ForceRefreshConnection(VssCredentials credentials)
         {
-            return ConnectAsync(_brokerUri, credentials);
+            if (!string.IsNullOrEmpty(_brokerUri?.AbsoluteUri))
+            {
+                return ConnectAsync(_brokerUri, credentials);
+            }
+
+            return Task.CompletedTask;
         }
 
         public bool ShouldRetryException(Exception ex)
         {
-            if (ex is AccessDeniedException ade && ade.ErrorCode == 1)
+            if (ex is AccessDeniedException || ex is RunnerNotFoundException || ex is HostedRunnerDeprovisionedException)
             {
                 return false;
             }

src/Runner.Common/ConfigurationStore.cs

@@ -1,10 +1,10 @@
-using GitHub.Runner.Sdk;
-using System;
+using System;
 using System.IO;
 using System.Linq;
 using System.Runtime.Serialization;
 using System.Text;
 using System.Threading;
+using GitHub.Runner.Sdk;
 
 namespace GitHub.Runner.Common
 {
@@ -53,6 +53,9 @@ namespace GitHub.Runner.Common
         [DataMember(EmitDefaultValue = false)]
         public bool UseV2Flow { get; set; }
 
+        [DataMember(EmitDefaultValue = false)]
+        public bool UseRunnerAdminFlow { get; set; }
+
         [DataMember(EmitDefaultValue = false)]
         public string ServerUrlV2 { get; set; }
 
@@ -61,8 +64,20 @@ namespace GitHub.Runner.Common
         {
             get
             {
-                // Old runners do not have this property. Hosted runners likely don't have this property either.
-                return _isHostedServer ?? true;
+                // If the value has been explicitly set, return it.
+                if (_isHostedServer.HasValue)
+                {
+                    return _isHostedServer.Value;
+                }
+
+                // Otherwise, try to infer it from the GitHubUrl.
+                if (!string.IsNullOrEmpty(GitHubUrl))
+                {
+                    return UrlUtil.IsHostedServer(new UriBuilder(GitHubUrl));
+                }
+
+                // Default to true since Hosted runners likely don't have this property set.
+                return true;
             }
 
             set
@@ -116,11 +131,15 @@ namespace GitHub.Runner.Common
         bool IsConfigured();
         bool IsServiceConfigured();
         bool HasCredentials();
+        bool IsMigratedConfigured();
         CredentialData GetCredentials();
         CredentialData GetMigratedCredentials();
         RunnerSettings GetSettings();
+        RunnerSettings GetMigratedSettings();
         void SaveCredential(CredentialData credential);
+        void SaveMigratedCredential(CredentialData credential);
         void SaveSettings(RunnerSettings settings);
+        void SaveMigratedSettings(RunnerSettings settings);
         void DeleteCredential();
         void DeleteMigratedCredential();
         void DeleteSettings();
@@ -130,6 +149,7 @@ namespace GitHub.Runner.Common
     {
         private string _binPath;
         private string _configFilePath;
+        private string _migratedConfigFilePath;
         private string _credFilePath;
         private string _migratedCredFilePath;
         private string _serviceConfigFilePath;
@@ -137,6 +157,7 @@ namespace GitHub.Runner.Common
         private CredentialData _creds;
         private CredentialData _migratedCreds;
         private RunnerSettings _settings;
+        private RunnerSettings _migratedSettings;
 
         public override void Initialize(IHostContext hostContext)
         {
@@ -154,6 +175,9 @@ namespace GitHub.Runner.Common
             _configFilePath = hostContext.GetConfigFile(WellKnownConfigFile.Runner);
             Trace.Info("ConfigFilePath: {0}", _configFilePath);
 
+            _migratedConfigFilePath = hostContext.GetConfigFile(WellKnownConfigFile.MigratedRunner);
+            Trace.Info("MigratedConfigFilePath: {0}", _migratedConfigFilePath);
+
             _credFilePath = hostContext.GetConfigFile(WellKnownConfigFile.Credentials);
             Trace.Info("CredFilePath: {0}", _credFilePath);
 
@@ -169,7 +193,7 @@ namespace GitHub.Runner.Common
         public bool HasCredentials()
         {
             Trace.Info("HasCredentials()");
-            bool credsStored = (new FileInfo(_credFilePath)).Exists || (new FileInfo(_migratedCredFilePath)).Exists;
+            bool credsStored = new FileInfo(_credFilePath).Exists || new FileInfo(_migratedCredFilePath).Exists;
             Trace.Info("stored {0}", credsStored);
             return credsStored;
         }
@@ -177,7 +201,7 @@ namespace GitHub.Runner.Common
         public bool IsConfigured()
         {
             Trace.Info("IsConfigured()");
-            bool configured = new FileInfo(_configFilePath).Exists;
+            bool configured = new FileInfo(_configFilePath).Exists || new FileInfo(_migratedConfigFilePath).Exists;
             Trace.Info("IsConfigured: {0}", configured);
             return configured;
         }
@@ -185,11 +209,19 @@ namespace GitHub.Runner.Common
         public bool IsServiceConfigured()
         {
             Trace.Info("IsServiceConfigured()");
-            bool serviceConfigured = (new FileInfo(_serviceConfigFilePath)).Exists;
+            bool serviceConfigured = new FileInfo(_serviceConfigFilePath).Exists;
             Trace.Info($"IsServiceConfigured: {serviceConfigured}");
             return serviceConfigured;
         }
 
+        public bool IsMigratedConfigured()
+        {
+            Trace.Info("IsMigratedConfigured()");
+            bool configured = new FileInfo(_migratedConfigFilePath).Exists;
+            Trace.Info("IsMigratedConfigured: {0}", configured);
+            return configured;
+        }
+
         public CredentialData GetCredentials()
         {
             if (_creds == null)
@@ -229,6 +261,25 @@ namespace GitHub.Runner.Common
             return _settings;
         }
 
+        public RunnerSettings GetMigratedSettings()
+        {
+            if (_migratedSettings == null)
+            {
+                RunnerSettings configuredSettings = null;
+                if (File.Exists(_migratedConfigFilePath))
+                {
+                    string json = File.ReadAllText(_migratedConfigFilePath, Encoding.UTF8);
+                    Trace.Info($"Read migrated setting file: {json.Length} chars");
+                    configuredSettings = StringUtil.ConvertFromJson<RunnerSettings>(json);
+                }
+
+                ArgUtil.NotNull(configuredSettings, nameof(configuredSettings));
+                _migratedSettings = configuredSettings;
+            }
+
+            return _migratedSettings;
+        }
+
         public void SaveCredential(CredentialData credential)
         {
             Trace.Info("Saving {0} credential @ {1}", credential.Scheme, _credFilePath);
@@ -244,6 +295,21 @@ namespace GitHub.Runner.Common
             File.SetAttributes(_credFilePath, File.GetAttributes(_credFilePath) | FileAttributes.Hidden);
         }
 
+        public void SaveMigratedCredential(CredentialData credential)
+        {
+            Trace.Info("Saving {0} migrated credential @ {1}", credential.Scheme, _migratedCredFilePath);
+            if (File.Exists(_migratedCredFilePath))
+            {
+                // Delete existing credential file first, since the file is hidden and not able to overwrite.
+                Trace.Info("Delete exist runner migrated credential file.");
+                IOUtil.DeleteFile(_migratedCredFilePath);
+            }
+
+            IOUtil.SaveObject(credential, _migratedCredFilePath);
+            Trace.Info("Migrated Credentials Saved.");
+            File.SetAttributes(_migratedCredFilePath, File.GetAttributes(_migratedCredFilePath) | FileAttributes.Hidden);
+        }
+
         public void SaveSettings(RunnerSettings settings)
         {
             Trace.Info("Saving runner settings.");
@@ -259,6 +325,21 @@ namespace GitHub.Runner.Common
             File.SetAttributes(_configFilePath, File.GetAttributes(_configFilePath) | FileAttributes.Hidden);
         }
 
+        public void SaveMigratedSettings(RunnerSettings settings)
+        {
+            Trace.Info("Saving runner migrated settings");
+            if (File.Exists(_migratedConfigFilePath))
+            {
+                // Delete existing settings file first, since the file is hidden and not able to overwrite.
+                Trace.Info("Delete exist runner migrated settings file.");
+                IOUtil.DeleteFile(_migratedConfigFilePath);
+            }
+
+            IOUtil.SaveObject(settings, _migratedConfigFilePath);
+            Trace.Info("Migrated Settings Saved.");
+            File.SetAttributes(_migratedConfigFilePath, File.GetAttributes(_migratedConfigFilePath) | FileAttributes.Hidden);
+        }
+
         public void DeleteCredential()
         {
             IOUtil.Delete(_credFilePath, default(CancellationToken));
@@ -273,6 +354,12 @@ namespace GitHub.Runner.Common
         public void DeleteSettings()
         {
             IOUtil.Delete(_configFilePath, default(CancellationToken));
+            IOUtil.Delete(_migratedConfigFilePath, default(CancellationToken));
+        }
+
+        public void DeleteMigratedSettings()
+        {
+            IOUtil.Delete(_migratedConfigFilePath, default(CancellationToken));
         }
     }
 }

src/Runner.Common/Constants.cs

@@ -18,6 +18,7 @@ namespace GitHub.Runner.Common
     public enum WellKnownConfigFile
     {
         Runner,
+        MigratedRunner,
         Credentials,
         MigratedCredentials,
         RSACredentials,
@@ -153,15 +154,41 @@ namespace GitHub.Runner.Common
                 public const int RetryableError = 2;
                 public const int RunnerUpdating = 3;
                 public const int RunOnceRunnerUpdating = 4;
+                public const int SessionConflict = 5;
+                // Temporary error code to indicate that the runner configuration has been refreshed
+                // and the runner should be restarted. This is a temporary code and will be removed in the future after
+                // the runner is migrated to runner admin.
+                public const int RunnerConfigurationRefreshed = 6;
             }
 
             public static class Features
             {
                 public static readonly string DiskSpaceWarning = "runner.diskspace.warning";
-                public static readonly string Node16Warning = "DistributedTask.AddWarningToNode16Action";
                 public static readonly string LogTemplateErrorsAsDebugMessages = "DistributedTask.LogTemplateErrorsAsDebugMessages";
                 public static readonly string UseContainerPathForTemplate = "DistributedTask.UseContainerPathForTemplate";
                 public static readonly string AllowRunnerContainerHooks = "DistributedTask.AllowRunnerContainerHooks";
+                public static readonly string AddCheckRunIdToJobContext = "actions_add_check_run_id_to_job_context";
+                public static readonly string DisplayHelpfulActionsDownloadErrors = "actions_display_helpful_actions_download_errors";
+                public static readonly string SnapshotPreflightHostedRunnerCheck = "actions_snapshot_preflight_hosted_runner_check";
+                public static readonly string SnapshotPreflightImageGenPoolCheck = "actions_snapshot_preflight_image_gen_pool_check";
+                public static readonly string CompareWorkflowParser = "actions_runner_compare_workflow_parser";
+                public static readonly string SetOrchestrationIdEnvForActions = "actions_set_orchestration_id_env_for_actions";
+            }
+
+            // Node version migration related constants
+            public static class NodeMigration
+            {
+                // Node versions
+                public static readonly string Node20 = "node20";
+                public static readonly string Node24 = "node24";
+
+                // Environment variables for controlling node version selection
+                public static readonly string ForceNode24Variable = "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24";
+                public static readonly string AllowUnsecureNodeVersionVariable = "ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION";
+
+                // Feature flags for controlling the migration phases
+                public static readonly string UseNode24ByDefaultFlag = "actions.runner.usenode24bydefault";
+                public static readonly string RequireNode24Flag = "actions.runner.requirenode24";
             }
 
             public static readonly string InternalTelemetryIssueDataKey = "_internal_telemetry";
@@ -175,14 +202,6 @@ namespace GitHub.Runner.Common
             public static readonly string UnsupportedStopCommandTokenDisabled = "You cannot use a endToken that is an empty string, the string 'pause-logging', or another workflow command. For more information see: https://docs.github.com/actions/learn-github-actions/workflow-commands-for-github-actions#example-stopping-and-starting-workflow-commands or opt into insecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_STOPCOMMAND_TOKENS` environment variable to `true`.";
             public static readonly string UnsupportedSummarySize = "$GITHUB_STEP_SUMMARY upload aborted, supports content up to a size of {0}k, got {1}k. For more information see: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-markdown-summary";
             public static readonly string SummaryUploadError = "$GITHUB_STEP_SUMMARY upload aborted, an error occurred when uploading the summary. For more information see: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-markdown-summary";
-            public static readonly string DetectedNodeAfterEndOfLifeMessage = "Node.js 16 actions are deprecated. Please update the following actions to use Node.js 20: {0}. For more information see: https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/.";
-            public static readonly string DeprecatedNodeDetectedAfterEndOfLifeActions = "DeprecatedNodeActionsMessageWarnings";
-            public static readonly string DeprecatedNodeVersion = "node16";
-            public static readonly string EnforcedNode12DetectedAfterEndOfLife = "The following actions uses node12 which is deprecated and will be forced to run on node16: {0}. For more info: https://github.blog/changelog/2023-06-13-github-actions-all-actions-will-run-on-node16-instead-of-node12-by-default/";
-            public static readonly string EnforcedNode12DetectedAfterEndOfLifeEnvVariable = "Node16ForceActionsWarnings";
-            public static readonly string EnforcedNode16DetectedAfterEndOfLife = "The following actions uses Node.js version which is deprecated and will be forced to run on node20: {0}. For more info: https://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/";
-            public static readonly string EnforcedNode16DetectedAfterEndOfLifeEnvVariable = "Node20ForceActionsWarnings";
-
         }
 
         public static class RunnerEvent
@@ -253,20 +272,17 @@ namespace GitHub.Runner.Common
                 public static readonly string RequireJobContainer = "ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER";
                 public static readonly string RunnerDebug = "ACTIONS_RUNNER_DEBUG";
                 public static readonly string StepDebug = "ACTIONS_STEP_DEBUG";
-                public static readonly string AllowActionsUseUnsecureNodeVersion = "ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION";
-                public static readonly string ManualForceActionsToNode20 = "FORCE_JAVASCRIPT_ACTIONS_TO_NODE20";
             }
 
             public static class Agent
             {
                 public static readonly string ToolsDirectory = "agent.ToolsDirectory";
 
-                // Set this env var to "node12" to downgrade the node version for internal functions (e.g hashfiles). This does NOT affect the version of node actions.
+                // Set this env var to "nodeXY" to downgrade the node version for internal functions (e.g hashfiles). This does NOT affect the version of node actions.
                 public static readonly string ForcedInternalNodeVersion = "ACTIONS_RUNNER_FORCED_INTERNAL_NODE_VERSION";
                 public static readonly string ForcedActionsNodeVersion = "ACTIONS_RUNNER_FORCE_ACTIONS_NODE_VERSION";
                 public static readonly string PrintLogToStdout = "ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT";
                 public static readonly string ActionArchiveCacheDirectory = "ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE";
-                public static readonly string ManualForceActionsToNode20 = "FORCE_JAVASCRIPT_ACTIONS_TO_NODE20";
             }
 
             public static class System

src/Runner.Common/HostContext.cs

@@ -15,6 +15,7 @@ using System.Threading.Tasks;
 using GitHub.DistributedTask.Logging;
 using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
+using GitHub.Services.WebApi.Jwt;
 
 namespace GitHub.Runner.Common
 {
@@ -36,6 +37,12 @@ namespace GitHub.Runner.Common
         event EventHandler Unloading;
         void ShutdownRunner(ShutdownReason reason);
         void WritePerfCounter(string counter);
+        void LoadDefaultUserAgents();
+
+        bool AllowAuthMigration { get; }
+        void EnableAuthMigration(string trace);
+        void DeferAuthMigration(TimeSpan deferred, string trace);
+        event EventHandler<AuthMigrationEventArgs> AuthMigrationChanged;
     }
 
     public enum StartupType
@@ -67,17 +74,28 @@ namespace GitHub.Runner.Common
         private StartupType _startupType;
         private string _perfFile;
         private RunnerWebProxy _webProxy = new();
+        private string _hostType = string.Empty;
+
+        // disable auth migration by default
+        private readonly ManualResetEventSlim _allowAuthMigration = new ManualResetEventSlim(false);
+        private DateTime _deferredAuthMigrationTime = DateTime.MaxValue;
+        private readonly object _authMigrationLock = new object();
+        private CancellationTokenSource _authMigrationAutoReenableTaskCancellationTokenSource = new();
+        private Task _authMigrationAutoReenableTask;
 
         public event EventHandler Unloading;
+        public event EventHandler<AuthMigrationEventArgs> AuthMigrationChanged;
         public CancellationToken RunnerShutdownToken => _runnerShutdownTokenSource.Token;
         public ShutdownReason RunnerShutdownReason { get; private set; }
         public ISecretMasker SecretMasker => _secretMasker;
         public List<ProductInfoHeaderValue> UserAgents => _userAgents;
         public RunnerWebProxy WebProxy => _webProxy;
+        public bool AllowAuthMigration => _allowAuthMigration.IsSet;
         public HostContext(string hostType, string logFile = null)
         {
             // Validate args.
             ArgUtil.NotNullOrEmpty(hostType, nameof(hostType));
+            _hostType = hostType;
 
             _loadContext = AssemblyLoadContext.GetLoadContext(typeof(HostContext).GetTypeInfo().Assembly);
             _loadContext.Unloading += LoadContext_Unloading;
@@ -196,6 +214,81 @@ namespace GitHub.Runner.Common
                 }
             }
 
+            if (StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("GITHUB_ACTIONS_RUNNER_TLS_NO_VERIFY")))
+            {
+                _trace.Warning($"Runner is running under insecure mode: HTTPS server certificate validation has been turned off by GITHUB_ACTIONS_RUNNER_TLS_NO_VERIFY environment variable.");
+            }
+
+            LoadDefaultUserAgents();
+        }
+
+        // marked as internal for testing
+        internal async Task AuthMigrationAuthReenableAsync(TimeSpan refreshInterval, CancellationToken token)
+        {
+            try
+            {
+                while (!token.IsCancellationRequested)
+                {
+                    _trace.Verbose($"Auth migration defer timer is set to expire at {_deferredAuthMigrationTime.ToString("O")}. AllowAuthMigration: {_allowAuthMigration.IsSet}.");
+                    await Task.Delay(refreshInterval, token);
+                    if (!_allowAuthMigration.IsSet && DateTime.UtcNow > _deferredAuthMigrationTime)
+                    {
+                        _trace.Info($"Auth migration defer timer expired. Allowing auth migration.");
+                        EnableAuthMigration("Auth migration defer timer expired.");
+                    }
+                }
+            }
+            catch (TaskCanceledException)
+            {
+                // Task was cancelled, exit the loop.
+            }
+            catch (Exception ex)
+            {
+                _trace.Info("Error in auth migration reenable task.");
+                _trace.Error(ex);
+            }
+        }
+
+        public void EnableAuthMigration(string trace)
+        {
+            _allowAuthMigration.Set();
+
+            lock (_authMigrationLock)
+            {
+                if (_authMigrationAutoReenableTask == null)
+                {
+                    var refreshIntervalInMS = 60 * 1000;
+#if DEBUG
+                    // For L0, we will refresh faster
+                    if (!string.IsNullOrEmpty(Environment.GetEnvironmentVariable("_GITHUB_ACTION_AUTH_MIGRATION_REFRESH_INTERVAL")))
+                    {
+                        refreshIntervalInMS = int.Parse(Environment.GetEnvironmentVariable("_GITHUB_ACTION_AUTH_MIGRATION_REFRESH_INTERVAL"));
+                    }
+#endif
+                    _authMigrationAutoReenableTask = AuthMigrationAuthReenableAsync(TimeSpan.FromMilliseconds(refreshIntervalInMS), _authMigrationAutoReenableTaskCancellationTokenSource.Token);
+                }
+            }
+
+            _trace.Info($"Enable auth migration at {DateTime.UtcNow.ToString("O")}.");
+            AuthMigrationChanged?.Invoke(this, new AuthMigrationEventArgs(trace));
+        }
+
+        public void DeferAuthMigration(TimeSpan deferred, string trace)
+        {
+            _allowAuthMigration.Reset();
+
+            // defer migration for a while
+            lock (_authMigrationLock)
+            {
+                _deferredAuthMigrationTime = DateTime.UtcNow.Add(deferred);
+            }
+
+            _trace.Info($"Disabled auth migration until {_deferredAuthMigrationTime.ToString("O")}.");
+            AuthMigrationChanged?.Invoke(this, new AuthMigrationEventArgs(trace));
+        }
+
+        public void LoadDefaultUserAgents()
+        {
             if (string.IsNullOrEmpty(WebProxy.HttpProxyAddress) && string.IsNullOrEmpty(WebProxy.HttpsProxyAddress))
             {
                 _trace.Info($"No proxy settings were found based on environmental variables (http_proxy/https_proxy/HTTP_PROXY/HTTPS_PROXY)");
@@ -205,11 +298,6 @@ namespace GitHub.Runner.Common
                 _userAgents.Add(new ProductInfoHeaderValue("HttpProxyConfigured", bool.TrueString));
             }
 
-            if (StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("GITHUB_ACTIONS_RUNNER_TLS_NO_VERIFY")))
-            {
-                _trace.Warning($"Runner is running under insecure mode: HTTPS server certificate validation has been turned off by GITHUB_ACTIONS_RUNNER_TLS_NO_VERIFY environment variable.");
-            }
-
             var credFile = GetConfigFile(WellKnownConfigFile.Credentials);
             if (File.Exists(credFile))
             {
@@ -219,6 +307,36 @@ namespace GitHub.Runner.Common
                 {
                     _userAgents.Add(new ProductInfoHeaderValue("ClientId", clientId));
                 }
+
+                // for Hosted runner, we can pull orchestrationId from JWT claims of the runner listening token.
+                if (credData != null &&
+                    credData.Scheme == Constants.Configuration.OAuthAccessToken &&
+                    credData.Data.TryGetValue(Constants.Runner.CommandLine.Args.Token, out var accessToken) &&
+                    !string.IsNullOrEmpty(accessToken))
+                {
+                    try
+                    {
+                        var jwt = JsonWebToken.Create(accessToken);
+                        var claims = jwt.ExtractClaims();
+                        var orchestrationId = claims.FirstOrDefault(x => string.Equals(x.Type, "orch_id", StringComparison.OrdinalIgnoreCase))?.Value;
+                        if (string.IsNullOrEmpty(orchestrationId))
+                        {
+                            // fallback to orchid for C# actions-service
+                            orchestrationId = claims.FirstOrDefault(x => string.Equals(x.Type, "orchid", StringComparison.OrdinalIgnoreCase))?.Value;
+                        }
+
+                        if (!string.IsNullOrEmpty(orchestrationId))
+                        {
+                            _trace.Info($"Pull OrchestrationId {orchestrationId} from runner JWT claims");
+                            _userAgents.Insert(0, new ProductInfoHeaderValue("OrchestrationId", orchestrationId));
+                        }
+                    }
+                    catch (Exception ex)
+                    {
+                        _trace.Error("Fail to extract OrchestrationId from runner JWT claims");
+                        _trace.Error(ex);
+                    }
+                }
             }
 
             var runnerFile = GetConfigFile(WellKnownConfigFile.Runner);
@@ -244,6 +362,11 @@ namespace GitHub.Runner.Common
                 _trace.Info($"Adding extra user agent '{extraUserAgentHeader}' to all HTTP requests.");
                 _userAgents.Add(extraUserAgentHeader);
             }
+
+            var currentProcess = Process.GetCurrentProcess();
+            _userAgents.Add(new ProductInfoHeaderValue("Pid", currentProcess.Id.ToString()));
+            _userAgents.Add(new ProductInfoHeaderValue("CreationTime", Uri.EscapeDataString(DateTime.UtcNow.ToString("O"))));
+            _userAgents.Add(new ProductInfoHeaderValue($"({_hostType})"));
         }
 
         public string GetDirectory(WellKnownDirectory directory)
@@ -330,6 +453,12 @@ namespace GitHub.Runner.Common
                         ".runner");
                     break;
 
+                case WellKnownConfigFile.MigratedRunner:
+                    path = Path.Combine(
+                        GetDirectory(WellKnownDirectory.Root),
+                        ".runner_migrated");
+                    break;
+
                 case WellKnownConfigFile.Credentials:
                     path = Path.Combine(
                         GetDirectory(WellKnownDirectory.Root),
@@ -530,6 +659,18 @@ namespace GitHub.Runner.Common
                     _loadContext.Unloading -= LoadContext_Unloading;
                     _loadContext = null;
                 }
+
+                if (_authMigrationAutoReenableTask != null)
+                {
+                    _authMigrationAutoReenableTaskCancellationTokenSource?.Cancel();
+                }
+
+                if (_authMigrationAutoReenableTaskCancellationTokenSource != null)
+                {
+                    _authMigrationAutoReenableTaskCancellationTokenSource?.Dispose();
+                    _authMigrationAutoReenableTaskCancellationTokenSource = null;
+                }
+
                 _httpTraceSubscription?.Dispose();
                 _diagListenerSubscription?.Dispose();
                 _traceManager?.Dispose();
@@ -616,7 +757,7 @@ namespace GitHub.Runner.Common
                     payload[0] = Enum.Parse(typeof(GitHub.Services.Common.VssCredentialsType), ((int)payload[0]).ToString());
                 }
 
-                if (payload.Length > 0)
+                if (payload.Length > 0 && !string.IsNullOrEmpty(eventData.Message))
                 {
                     message = String.Format(eventData.Message.Replace("%n", Environment.NewLine), payload);
                 }

src/Runner.Common/JobServer.cs

@@ -4,6 +4,7 @@ using System.IO;
 using System.Linq;
 using System.Net.Http;
 using System.Net.Http.Headers;
+using System.Net.Security;
 using System.Net.WebSockets;
 using System.Text;
 using System.Threading;
@@ -179,6 +180,10 @@ namespace GitHub.Runner.Common
                     userAgentValues.AddRange(UserAgentUtility.GetDefaultRestUserAgent());
                     userAgentValues.AddRange(HostContext.UserAgents);
                     this._websocketClient.Options.SetRequestHeader("User-Agent", string.Join(" ", userAgentValues.Select(x => x.ToString())));
+                    if (StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("GITHUB_ACTIONS_RUNNER_TLS_NO_VERIFY")))
+                    {
+                        this._websocketClient.Options.RemoteCertificateValidationCallback = (_, _, _, _) => true;
+                    }
 
                     this._websocketConnectTask = ConnectWebSocketClient(feedStreamUrl, delay);
                 }

src/Runner.Common/JobServerQueue.cs

@@ -19,7 +19,7 @@ namespace GitHub.Runner.Common
         TaskCompletionSource<int> JobRecordUpdated { get; }
         event EventHandler<ThrottlingEventArgs> JobServerQueueThrottling;
         Task ShutdownAsync();
-        void Start(Pipelines.AgentJobRequestMessage jobRequest, bool resultsServiceOnly = false, bool enableTelemetry = false);
+        void Start(Pipelines.AgentJobRequestMessage jobRequest, bool resultsServiceOnly = false);
         void QueueWebConsoleLine(Guid stepRecordId, string line, long? lineNumber = null);
         void QueueFileUpload(Guid timelineId, Guid timelineRecordId, string type, string name, string path, bool deleteSource);
         void QueueResultsUpload(Guid timelineRecordId, string name, string path, string type, bool deleteSource, bool finalize, bool firstBlock, long totalLines);
@@ -74,6 +74,7 @@ namespace GitHub.Runner.Common
         private readonly List<JobTelemetry> _jobTelemetries = new();
         private bool _queueInProcess = false;
         private bool _resultsServiceOnly = false;
+        private int _resultsServiceExceptionsCount = 0;
         private Stopwatch _resultsUploadTimer = new();
         private Stopwatch _actionsUploadTimer = new();
 
@@ -104,11 +105,10 @@ namespace GitHub.Runner.Common
             _resultsServer = hostContext.GetService<IResultsServer>();
         }
 
-        public void Start(Pipelines.AgentJobRequestMessage jobRequest, bool resultsServiceOnly = false, bool enableTelemetry = false)
+        public void Start(Pipelines.AgentJobRequestMessage jobRequest, bool resultsServiceOnly = false)
         {
             Trace.Entering();
             _resultsServiceOnly = resultsServiceOnly;
-            _enableTelemetry = enableTelemetry;
 
             var serviceEndPoint = jobRequest.Resources.Endpoints.Single(x => string.Equals(x.Name, WellKnownServiceEndpointNames.SystemVssConnection, StringComparison.OrdinalIgnoreCase));
 
@@ -139,6 +139,12 @@ namespace GitHub.Runner.Common
                 _resultsClientInitiated = true;
             }
 
+            // Enable telemetry if we have both results service and actions service
+            if (_resultsClientInitiated && !_resultsServiceOnly)
+            {
+                _enableTelemetry = true;
+            }
+
             if (_queueInProcess)
             {
                 Trace.Info("No-opt, all queue process tasks are running.");
@@ -574,9 +580,9 @@ namespace GitHub.Runner.Common
                             Trace.Info("Catch exception during file upload to results, keep going since the process is best effort.");
                             Trace.Error(ex);
                             errorCount++;
-
+                            _resultsServiceExceptionsCount++;
                             // If we hit any exceptions uploading to Results, let's skip any additional uploads to Results unless Results is serving logs
-                            if (!_resultsServiceOnly)
+                            if (!_resultsServiceOnly && _resultsServiceExceptionsCount > 3)
                             {
                                 _resultsClientInitiated = false;
                                 SendResultsTelemetry(ex);
@@ -607,7 +613,7 @@ namespace GitHub.Runner.Common
 
         private void SendResultsTelemetry(Exception ex)
         {
-            var issue = new Issue() { Type = IssueType.Warning, Message = $"Caught exception with results. {ex.Message}" };
+            var issue = new Issue() { Type = IssueType.Warning, Message = $"Caught exception with results. {HostContext.SecretMasker.MaskSecrets(ex.Message)}" };
             issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = Constants.Runner.ResultsUploadFailure;
 
             var telemetryRecord = new TimelineRecord()
@@ -703,7 +709,9 @@ namespace GitHub.Runner.Common
                             {
                                 Trace.Info("Catch exception during update steps, skip update Results.");
                                 Trace.Error(e);
-                                if (!_resultsServiceOnly)
+                                _resultsServiceExceptionsCount++;
+                                // If we hit any exceptions uploading to Results, let's skip any additional uploads to Results unless Results is serving logs
+                                if (!_resultsServiceOnly && _resultsServiceExceptionsCount > 3)
                                 {
                                     _resultsClientInitiated = false;
                                     SendResultsTelemetry(e);

src/Runner.Common/LaunchServer.cs

@@ -1,11 +1,12 @@
 using System;
 using System.Collections.Generic;
-using System.Linq;
+using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
 using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Sdk;
+using GitHub.Services.Common;
 using GitHub.Services.Launch.Client;
-using GitHub.Services.WebApi;
 
 namespace GitHub.Runner.Common
 {
@@ -14,7 +15,7 @@ namespace GitHub.Runner.Common
     {
         void InitializeLaunchClient(Uri uri, string token);
 
-        Task<ActionDownloadInfoCollection> ResolveActionsDownloadInfoAsync(Guid planId, Guid jobId, ActionReferenceList actionReferenceList, CancellationToken cancellationToken);
+        Task<ActionDownloadInfoCollection> ResolveActionsDownloadInfoAsync(Guid planId, Guid jobId, ActionReferenceList actionReferenceList, CancellationToken cancellationToken, bool displayHelpfulActionsDownloadErrors);
     }
 
     public sealed class LaunchServer : RunnerService, ILaunchServer
@@ -23,17 +24,34 @@ namespace GitHub.Runner.Common
 
         public void InitializeLaunchClient(Uri uri, string token)
         {
-            var httpMessageHandler = HostContext.CreateHttpClientHandler();
-            this._launchClient = new LaunchHttpClient(uri, httpMessageHandler, token, disposeHandler: true);
+            // Using default 100 timeout
+            RawClientHttpRequestSettings settings = VssUtil.GetHttpRequestSettings(null);
+
+            // Create retry handler
+            IEnumerable<DelegatingHandler> delegatingHandlers = new List<DelegatingHandler>();
+            if (settings.MaxRetryRequest > 0)
+            {
+                delegatingHandlers = new DelegatingHandler[] { new VssHttpRetryMessageHandler(settings.MaxRetryRequest) };
+            }
+
+            // Setup RawHttpMessageHandler without credentials
+            var httpMessageHandler = new RawHttpMessageHandler(new NoOpCredentials(null), settings);
+            var pipeline = HttpClientFactory.CreatePipeline(httpMessageHandler, delegatingHandlers);
+
+            this._launchClient = new LaunchHttpClient(uri, pipeline, token, disposeHandler: true);
         }
 
         public Task<ActionDownloadInfoCollection> ResolveActionsDownloadInfoAsync(Guid planId, Guid jobId, ActionReferenceList actionReferenceList,
-            CancellationToken cancellationToken)
+            CancellationToken cancellationToken, bool displayHelpfulActionsDownloadErrors)
         {
             if (_launchClient != null)
             {
-                return _launchClient.GetResolveActionsDownloadInfoAsync(planId, jobId, actionReferenceList,
-                    cancellationToken: cancellationToken);
+                if (!displayHelpfulActionsDownloadErrors)
+                {
+                    return _launchClient.GetResolveActionsDownloadInfoAsync(planId, jobId, actionReferenceList,
+                        cancellationToken: cancellationToken);
+                }
+                return _launchClient.GetResolveActionsDownloadInfoAsyncV2(planId, jobId, actionReferenceList, cancellationToken);
             }
 
             throw new InvalidOperationException("Launch client is not initialized.");