feat: replace Fiddle with the 2027 rewrite

.claude/skills/verify/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: verify
+description: Drive the real Electron Fiddle app (test build) to verify a change end to end, from a sandboxed agent session on macOS or in the Linux container.
+---
+
+# Verify a change in the running app
+
+The handle is the in-house driver (`packages/app/tools/driver.ts`, docs in
+`packages/app/e2e/README.md`). It builds `packages/app/out/test-build`, launches
+real Electron in test mode, and drives the page through CDP.
+
+## Where Electron can run
+
+- **Linux container:** run driver and e2e commands outside the Bash sandbox
+  (Xvfb per app). `yarn start:xvfb` gives a headless dev run with
+  `FIDDLE_DEV_SCREENSHOT`, `FIDDLE_DEV_QUIT`, `FIDDLE_DEV_MENU_DUMP`.
+- **macOS agent session (Claude desktop):** Electron cannot start inside the
+  Bash sandbox (mach port / `listen EPERM`). Run everything through the user's
+  Terminal panel (`mcp__terminal__run_in_terminal`, then `read_terminal` or a
+  tee'd log). Each call opens a tab and the panel has a small tab limit, so put
+  the whole drive in ONE script (see below). The test app runs as a background
+  accessory app and doesn't steal focus.
+
+## Recipe
+
+```bash
+cat > /tmp/drive.sh <<'SH'
+cd <repo>
+d() { yarn driver "$@" 2>&1; }          # NOT `yarn -s` (Yarn Berry has no -s)
+d launch                                 # builds the test build (~3 s) and starts the app
+d wait-idle
+d screenshot /tmp/01.png                 # capturePage: vibrancy areas render white
+d snapshot > /tmp/01-a11y.txt            # role "name" tree; use it to find targets
+d click button "Add file"                # role + accessible name (regex: "/^Electron [0-9]/")
+d eval "JSON.stringify(document.querySelector('input')?.value)"
+d press Escape
+d run-command view.toggleSplit           # any command ID from src/shared/commands.ts
+d stores > /tmp/stores.json              # App + Window store JSON
+d press "CmdOrCtrl+Shift+O"              # accelerators go through CDP key events
+d violations; d logs
+d quit
+FIDDLE_DEV_MENU_DUMP=1 FIDDLE_DEV_QUIT=1 yarn start:xvfb > /tmp/menu.log 2>&1   # native menu template
+SH
+```
+
+Run it with `run_in_terminal 'bash /tmp/drive.sh 2>&1 | tee /tmp/drive.log'`,
+poll `read_terminal`, then read the log and PNGs from the sandbox.
+
+## Gotchas
+
+- `press Shift` alone is not a key; tooltips can be opened by focusing a button
+  after any key press (keyboard modality) and measured with `eval` +
+  `getBoundingClientRect()`.
+- The menu dump prints before a window has focus, so most items show
+  `(disabled)`; structure and accelerators are what to read.
+- Fixture data is small (a few releases), so list virtualization is better judged
+  by the jsdom tests; the picker's look and width are visible here.
+- `yarn test:e2e <spec>` is the regression net; on macOS it also must run from
+  the Terminal panel.

.github/dependabot.yml

@@ -1,8 +1,16 @@
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
-      interval: "daily"
+      interval: 'daily'
+    cooldown:
+      default-days: 7
+  # Matches `npmMinimalAgeGate` in .yarnrc.yml. Forge, its plugins and Vite are
+  # pinned exactly, so each upgrade arrives as its own PR.
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
     cooldown:
       default-days: 7

.github/workflows/add-to-project.yml

@@ -12,6 +12,8 @@ permissions: {}
 
 jobs:
   add-to-project:
+    # The project and its app credentials exist only in the electron org.
+    if: github.repository_owner == 'electron'
     runs-on: ubuntu-latest
     steps:
       - name: Generate GitHub App token

.github/workflows/check-download-links.yml

@@ -51,4 +51,4 @@ jobs:
           name: audit-results
           path: audit-results.md
           archive: false
-          if-no-files-found: warn
+          if-no-files-found: warn

.github/workflows/ci.yml

@@ -5,25 +5,132 @@ on:
   push:
     branches:
       - main
+  # Called from release.yml, so tests gate every release.
+  workflow_call:
 
-permissions:
-  contents: read
+permissions: {}
+
+# A new push cancels the pull request run it supersedes. Runs on main and on
+# release tags are never cancelled.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   test:
+    name: Test (${{ matrix.os }})
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+    runs-on: ${{ matrix.os }}
     permissions:
       contents: read
-    uses: ./.github/workflows/test.yml
-  build:
+    steps:
+      - run: git config --global core.autocrlf input
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+      # The app's postinstall and `yarn package` download the same Electron zip.
+      - name: Cache the Electron download
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.cache/electron
+            ~/Library/Caches/electron
+            ~/AppData/Local/electron/Cache
+          key: electron-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
+          restore-keys: electron-${{ runner.os }}-
+      # The e2e tests need the Electron binary that the app's postinstall downloads.
+      - name: Install dependencies
+        run: yarn install --immutable
+      # `git add -N` makes a generated file that was never committed show up in
+      # the diff.
+      - name: Generated source is up to date
+        shell: bash
+        run: |
+          yarn generate
+          git add --intent-to-add .
+          git diff --exit-code
+      # Missing or unused keys, placeholder, tag and plural mismatches, and the
+      # translate script's own tests.
+      - name: i18n catalogs
+        shell: bash
+        run: |
+          yarn i18n:check
+          yarn i18n:test
+      - name: Format
+        run: yarn format:check
+      - name: Lint
+        run: yarn lint
+      - name: Typecheck
+        run: yarn typecheck
+      - name: Unit tests
+        run: yarn test
+      # Fiddles start through this helper on macOS. The self-check proves it
+      # disclaims responsibility on this macOS version.
+      - name: Privacy helper self-check (macOS)
+        if: runner.os == 'macOS'
+        run: |
+          packages/app/native/disclaim/build.sh
+          packages/app/native/disclaim/build/selfcheck packages/app/native/disclaim/build/fiddle-disclaim
+      # On Linux the e2e driver starts its own Xvfb display per app.
+      - name: End-to-end tests
+        run: yarn test:e2e
+      # Unsigned: no signing variables are set here.
+      - name: Package smoke test
+        run: yarn package
+      # Also checks that the e2e test build (out/test-build) still has every test-only marker.
+      - name: Test-only code stays out of the package and in the test build
+        run: node tools/release-check-asar.mjs packages/app/out --test-build
+      - name: Check the privacy helper in the package (macOS)
+        if: runner.os == 'macOS'
+        run: |
+          for app in packages/app/out/*/"Electron Fiddle.app"; do
+            packages/app/native/disclaim/check-packaged.sh "$app"
+          done
+
+  identity:
+    name: App identity
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
-    uses: ./.github/workflows/build.yml
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+      - name: Install dependencies
+        run: yarn install --immutable --mode=skip-build
+      # The identity must match the previous release, or its settings,
+      # credentials and installs aren't found.
+      - name: Check app identity
+        run: node tools/release-identity.mjs
+
   gha-done:
     name: GitHub Actions Completed
     runs-on: ubuntu-latest
-    needs: [test, build]
-    if: always() && !contains(needs.*.result, 'failure')
+    needs:
+      - test
+      - identity
+    if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
+    timeout-minutes: 5
+    permissions: {}
     steps:
-      - name: GitHub Actions Jobs Done
-        run: |
-          echo "All GitHub Actions Jobs are done"
+      - run: echo "All GitHub Actions jobs are done"

.github/workflows/refresh-data.yml

@@ -0,0 +1,47 @@
+name: Refresh bundled data
+
+# The Electron release list and the contributors list are committed snapshots
+# that this bot PR refreshes weekly. Run it by hand before a release.
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  refresh:
+    name: Refresh releases and contributors
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+      # Plain Node with no dependencies: nothing is installed, so no
+      # dependency code runs in a job that can push.
+      - name: Refresh data
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: node tools/release-data.mjs
+      # PRs opened with GITHUB_TOKEN don't trigger CI. Close and reopen the PR
+      # to run it.
+      - name: Open pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          branch: bot/refresh-data
+          delete-branch: true
+          commit-message: 'chore: refresh bundled Electron releases and contributors'
+          title: 'chore: refresh bundled Electron releases and contributors'
+          body: Automated refresh of `packages/app/static/releases.json` and `packages/app/static/contributors.json` by `tools/release-data.mjs`.
+          add-paths: |
+            packages/app/static/releases.json
+            packages/app/static/contributors.json