fix(desktop): harden browser and runtime hygiene (#7152)

* fix(desktop): harden browser and runtime hygiene

* fix(desktop): close review edge cases

* fix(desktop): make server relaunch transactional

* fix(desktop): close final lifecycle edge cases

* fix(desktop): preserve committed relaunch recovery

* fix(desktop): make committed relaunch non-vetoable

Author: waleedlatif1

.github/workflows/desktop-e2e.yml

@@ -1,13 +1,27 @@
 name: Desktop E2E
 
-# Smoke coverage of the real Electron shell, plus an advisory canary leg
-# against electron@latest so Chromium-cadence breakage surfaces before an
-# upgrade is attempted (U18/U22).
-#
-# Manual-only for now: the desktop app is tested locally, so the
-# pull_request trigger is disabled until desktop CI is turned back on.
+# Smoke coverage of the real Electron shell on desktop changes, plus a weekly
+# advisory canary against electron@latest so Chromium-cadence breakage surfaces
+# before an upgrade is attempted.
 
 on:
+  pull_request:
+    paths:
+      - '.github/workflows/desktop-e2e.yml'
+      - '.github/workflows/desktop-release.yml'
+      - 'apps/desktop/**'
+      - 'apps/sim/public/brand/fonts/**'
+      - 'packages/desktop-bridge/**'
+      - 'packages/browser-protocol/**'
+      - 'packages/terminal-protocol/**'
+      - 'packages/logger/**'
+      - 'packages/security/**'
+      - 'packages/tsconfig/**'
+      - 'packages/utils/**'
+      - 'bun.lock'
+      - 'package.json'
+  schedule:
+    - cron: '23 9 * * 1'
   workflow_dispatch:
 
 permissions:
@@ -18,14 +32,10 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  e2e:
-    name: E2E (${{ matrix.electron }})
+  e2e-pinned:
+    name: E2E (pinned)
+    if: github.event_name != 'schedule'
     runs-on: macos-26
-    strategy:
-      fail-fast: false
-      matrix:
-        electron: [pinned, latest]
-    continue-on-error: ${{ matrix.electron == 'latest' }}
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -38,10 +48,42 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Switch to electron@latest (canary)
-        if: matrix.electron == 'latest'
+      - name: Bundle main and preload
+        working-directory: apps/desktop
+        run: bun run build
+
+      - name: Run Playwright _electron smoke suite
+        working-directory: apps/desktop
+        run: bunx playwright test
+
+      - name: Upload test results
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: desktop-e2e-results-pinned
+          path: apps/desktop/test-results
+          retention-days: 7
+
+  e2e-latest-canary:
+    name: E2E (electron@latest canary)
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: macos-26
+    continue-on-error: true
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Switch to electron@latest
         working-directory: apps/desktop
-        run: bun add -d electron@latest
+        run: bun add --no-save -d electron@latest
 
       - name: Bundle main and preload
         working-directory: apps/desktop
@@ -53,14 +95,15 @@ jobs:
 
       - name: Upload test results
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: desktop-e2e-results-${{ matrix.electron }}
+          name: desktop-e2e-results-latest
           path: apps/desktop/test-results
           retention-days: 7
 
   package-smoke:
     name: Unsigned package smoke
+    if: github.event_name != 'schedule'
     runs-on: macos-26
     steps:
       - name: Checkout code
@@ -72,7 +115,7 @@ jobs:
           bun-version: 1.3.14
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
 
@@ -85,4 +128,20 @@ jobs:
           CSC_IDENTITY_AUTO_DISCOVERY: 'false'
         run: |
           bun run build
-          bunx electron-builder --mac dir --publish never
+          bunx electron-builder --mac dir --universal --publish never \
+            -c.mac.identity=- -c.mac.hardenedRuntime=false
+
+      - name: Run packaged Electron smoke suite
+        working-directory: apps/desktop
+        run: |
+          APP_BUNDLE="$(find release -maxdepth 2 -name '*.app' -print -quit)"
+          if [ -z "$APP_BUNDLE" ]; then
+            echo "::error::Packaged app bundle was not found."
+            exit 1
+          fi
+          EXECUTABLE="$(find "$APP_BUNDLE/Contents/MacOS" -maxdepth 1 -type f -perm -111 -print -quit)"
+          if [ -z "$EXECUTABLE" ]; then
+            echo "::error::Packaged app executable was not found."
+            exit 1
+          fi
+          SIM_DESKTOP_EXECUTABLE="$EXECUTABLE" bunx playwright test e2e/packaged-smoke.spec.ts