Quick start

Most days:

The last two lanes need tooling the other commands do not: qa:lab:up needs a running Docker daemon and a source checkout, because the npm tarball omits QA Lab, and the multipass runner needs Multipass installed. See QA-specific runners.

When you touch tests or want extra confidence:

Oxlint's max-lines rule warns when files exceed the per-scope limits in .oxlintrc.json; these warnings remain visible in lint logs and do not fail CI. Local pnpm check:changed rejects over-cap changed files and separately checks new violations and growth; untouched overages found by broad lint are warnings. PR CI reports numeric ratchet violations as warnings too. The suppression baseline ratchet remains strict locally. See surface ratchets for comparison bases and shrink-only maintenance.

Test suites (what runs where)

Think of the suites as "increasing realism" (and increasing flakiness/cost).

Unit / integration (default)

Native dependency policy:

Projects, shards, and scoped lanes 
- Untargeted `pnpm test` runs thirteen smaller shard configs (`core-unit-fast`, `core-unit-src`, `core-unit-security`, `core-unit-ui`, `core-unit-support`, `core-support-boundary`, `core-tooling`, `core-contracts`, `core-bundled`, `core-runtime`, `agentic`, `auto-reply`, `extensions`) instead of one giant native root-project process. This cuts peak RSS on loaded machines and avoids auto-reply/plugin work starving unrelated suites.
- `pnpm test --watch` still uses the native root `vitest.config.ts` project graph, because a multi-shard watch loop is not practical.
- `pnpm test`, `pnpm test:watch`, and `pnpm test:perf:imports` route explicit file/directory targets through scoped lanes first, so `pnpm test extensions/discord/src/monitor/message-handler.preflight.test.ts` avoids paying the full root project startup tax.
- Non-watch package and agent directory targets, such as `pnpm test packages/gateway-client` or `pnpm test src/agent/agents/tools`, and quoted agent globs such as `pnpm test 'src/agent/agents/failover/**/*.test.ts'`, discover regular `*.test.ts` files and route each to its owning lane. This preserves fast, isolated, harness, and database-worker ownership, shared exclusions, and inherited include limits; ordinary selections do not opt into live or E2E tests.
- Non-watch root-project runs, such as `node scripts/run-vitest.mjs run src/platform/config`, prepare any built runtime required by their selected tests before starting them.
- `pnpm test:changed` expands changed git paths into cheap scoped lanes by default: direct test edits, sibling `*.test.ts` files, explicit source mappings, and local import-graph dependents. Config/setup/package edits do not broad-run tests unless you explicitly use `APUS_TEST_CHANGED_BROAD=1 pnpm test:changed`.
- `pnpm check:changed` is the normal smart local check gate for narrow work. It classifies the diff into core, core tests, extensions, extension tests, apps, docs, release metadata, live Docker tooling, and tooling, then runs the matching typecheck, lint, and guard commands. Selected paths also schedule targeted Vitest owner tests via `pnpm test:serial`; use `pnpm test:changed` or explicit `pnpm test <target>` for additional test proof matching the touched contract. Release metadata-only version bumps run targeted version/config/root-dependency checks, with a guard that rejects package changes outside the top-level version field.
- In the default Git diff mode against `HEAD`, comment/whitespace-only TypeScript edits skip their typecheck lanes and core graph boundary check when tokens and line-break boundaries match the merge base. Files with TypeScript/JSX directives, triple-slash comments, parse errors, or path lifecycle changes retain typechecking, as do JavaScript files. Lint, formatting, ratchets, guards, and tests keep the full changed-path scope. Staged, explicit-path, and non-`HEAD` comparisons retain normal typecheck selection; `--dry-run` reports any skipped paths.
- Changed core test checks run the shards that own changed test roots before their other selected consumers. Both groups keep their canonical order, and CI stripe membership stays unchanged. Source-only changes keep the normal order. The boundary inventory is reused for selection and ordering.
- Live Docker ACP harness edits run focused checks: shell syntax for the live Docker auth scripts and a live Docker scheduler dry-run. `package.json` changes are included only when the diff is limited to `scripts["test:docker:live-*"]`; dependency, export, version, and other package-surface edits still use the broader guards.
- Import-light unit tests from agents, commands, plugins, auto-reply helpers, `plugin-sdk`, and similar pure utility areas route through the `unit-fast` lane, which skips `test/setup-apus-runtime.ts`; stateful/runtime-heavy files stay on the existing lanes.
- Selected `plugin-sdk` and `commands` helper source files also map changed-mode runs to explicit sibling tests in those light lanes, so helper edits avoid rerunning the full heavy suite for that directory.
- `auto-reply` has dedicated buckets for top-level core helpers, top-level `reply.*` integration tests, and the `src/messaging/auto-reply/reply/**` subtree. CI further splits the reply subtree into agent-runner, dispatch, and commands/state-routing shards so one import-heavy bucket does not own the full Node tail.
- Normal PR/main CI intentionally skips the bundled plugin batch sweep and release-only `agentic-plugins` shard. Full Release Validation dispatches the separate `Plugin Prerelease` child workflow for those plugin-heavy suites on release candidates.
Embedded runner coverage 
- When you change message-tool discovery inputs or compaction runtime
  context, keep both levels of coverage.
- Add focused helper regressions for pure routing and normalization
  boundaries.
- Keep the embedded runner integration suites healthy:
  `src/agent/agents/embedded-agent-runner/compact.hooks.test.ts`,
  `src/agent/agents/embedded-agent-runner/run.overflow-compaction.test.ts`, and
  `src/agent/agents/embedded-agent-runner/run.overflow-compaction.loop.test.ts`.
- Those suites verify that scoped ids and compaction behavior still flow
  through the real `run.ts` / `compact.ts` paths; helper-only tests are
  not a sufficient substitute for those integration paths.
Vitest pool and isolation defaults 
- Base Vitest config defaults to `forks` on Windows and `threads` elsewhere.
  Windows workers need separate native handle tables: concurrent thread
  spawns can inherit another worker's temporary output pipe handles and
  prevent that worker's child cleanup from observing EOF. Worker counts
  and file parallelism remain unchanged.
- SQLite admission runs before test collection in each Vitest worker. Bun threads
  inherit the config process's decision; OS forks initialize it locally.
  Bun runs the existing native-close conformance probe before database pools
  capture their policy; Node retains its runtime-provided capability.
- The shared Vitest config fixes `isolate: false` and uses the
  non-isolated runner across the root projects, e2e, and live configs.
- The root UI lane keeps its `jsdom` setup and optimizer, but runs on the
  shared non-isolated runner too.
- Provider plugin shards reuse workers with the shared cleanup runner.
  Track global replacements with `vi.stubGlobal` so cleanup can restore them
  before the next file.
- Before each test attempt and before a file's cleanup, the shared runner
  waits for agent database closes that earlier teardown scheduled without
  awaiting, so a Worker lease release never overlaps the next test. A failed
  close stays with its owner and the file-end drain, as before.
- Each `pnpm test` shard inherits the platform pool and `isolate: false`
  defaults from the shared Vitest config unless its owner selects otherwise.
- `scripts/run-vitest.mjs` adds `--no-maglev` for Vitest child Node
  processes by default to reduce V8 compile churn during big local runs.
  Set `APUS_VITEST_ENABLE_MAGLEV=1` to compare against stock V8
  behavior.
- `scripts/run-vitest.mjs` terminates explicit non-watch Vitest runs
  when their configured no-output deadline expires. Expiry fails the run
  without retrying the shard, even when the child shuts down with exit code zero. Set
  `APUS_VITEST_NO_OUTPUT_TIMEOUT_MS=0` to disable the watchdog for
  an intentionally silent investigation.
- `scripts/run-tsgo.mjs` leaves tsgo unbounded by default, preserving the
  behavior of existing local workflows. Set `APUS_TSGO_TIMEOUT_MS` to
  a positive millisecond value to make a wedged compiler fail loudly
  instead of blocking its caller forever. On expiry the whole tsgo process
  tree is killed and the run fails. Values above Node's timer
  ceiling saturate at it instead of collapsing to a 1ms deadline; `0`, a
  negative, a fraction, or anything above `Number.MAX_SAFE_INTEGER` is
  rejected and fails the run. Surrounding whitespace is trimmed first;
  the remaining value must use plain decimal digits without leading zeros,
  so values such as `1e5` or `007` are rejected. Unset the variable to
  disable the watchdog.
  Canceling a compiler shard batch joins each compiler, including forced
  termination when needed, before releasing checkout artifact ownership so
  the next build or check can proceed.
Fast local iteration 
- `pnpm changed:lanes` shows which architectural lanes a diff triggers.
- The pre-commit hook formats and restages files. When private rules are
  configured, it also scans staged content before and after formatting.
  See [Local commit hook setup](https://git.apuscorp.com/business/saas/erp/desktop-app/apusami/blob/main/CONTRIBUTING#local-commit-hook).
  It does not run lint, typecheck, or tests.
- Run `pnpm check:changed` explicitly before handoff or push when you
  need the smart local check gate.
- `pnpm test:changed` routes through cheap scoped lanes by default. Use
  `APUS_TEST_CHANGED_BROAD=1 pnpm test:changed` only when the agent
  decides a harness, config, package, or contract edit really needs
  broader Vitest coverage.
- `pnpm test:max` and `pnpm test:changed:max` keep the same routing
  behavior, just with a higher worker cap.
- Local worker auto-scaling is intentionally conservative and backs off
  when the host load average is already high, so multiple concurrent
  Vitest runs do less damage by default.
  CI hosts with at least eight available CPUs can use six workers at
  24 to below 28 GiB and eight workers at 28–128 GiB. The measured memory allowance
  reserves 25% of RAM even for two heavy test processes. Interactive local
  sizing is unchanged; explicit worker overrides, load backoff, process
  memory constraints, free-memory pressure limits, and the 16-worker cap
  still apply. See [CI worker sizing](/ci/capacity#vitest-worker-sizing)
  for the measurements and workflow limits.
- The base Vitest config marks the projects/config files as
  `forceRerunTriggers` so changed-mode reruns stay correct when test
  wiring changes.
- The config keeps `APUS_VITEST_FS_MODULE_CACHE` enabled on
  supported hosts; set `APUS_VITEST_FS_MODULE_CACHE_PATH=/abs/path`
  for one explicit cache location for direct profiling.
- Local Node runs also reuse compiled runtime-worker outputs from
  `.artifacts/vitest-worker-cache`. The runner reserves an exclusive
  checkout-local output slot and transfers verified artifacts into that slot.
  After its borrowers and resources join, it transfers completed artifacts
  back to the cache and removes the invocation directory. Occupied or
  uncertain generations are never reclaimed automatically.
  Content, compiler, configuration, or resolution changes invalidate the
  seed; timestamp-only touches do not. Build provenance and resource receipts
  are refreshed for each invocation, and source/output verification still
  runs before lending and after completion. Cold cache-enabled preparation overlaps
  the independent worker and finalizer builds when at least 8 GiB of memory
  is available; smaller hosts keep sequential compilation. CI keeps fresh compilation
  unless its workflow enables `APUS_VITEST_WORKER_CACHE=1` after restoring
  a protected cache. Only the protected warmer publishes shared generations;
  ordinary CI jobs remain remote-cache readers. Reuse requires the same
  absolute checkout and reserved output paths, Node version, compiler options,
  and verified inputs. Incompatible or missing generations compile normally.
  Bun and custom Node loader runs keep fresh compilation.
  This cache does not share Vitest's writable
  filesystem module cache with another checkout.
Perf debugging 
- `pnpm test:perf:imports` enables Vitest import-duration reporting plus
  import-breakdown output.
- `pnpm test:perf:imports:changed` scopes the same profiling view to
  files changed since `origin/main`.
- Shard timing data is written to `.artifacts/vitest-shard-timings.json`.
  Whole-config runs use the config path as the key; include-pattern CI
  shards append the shard name so filtered shards can be tracked
  separately.
- When one hot test still spends most of its time in startup imports,
  keep heavy dependencies behind a narrow local `*.runtime.ts` seam and
  mock that seam directly instead of deep-importing runtime helpers
  just to pass them through `vi.mock(...)`.
- `pnpm test:perf:changed:bench -- --ref <git-ref>` compares routed
  `test:changed` against the native root-project path for that
  committed diff and prints wall time plus macOS max RSS.
- `pnpm test:perf:changed:bench -- --worktree` benchmarks the current
  dirty tree by routing the changed file list through
  `scripts/test-projects.mts` and the root Vitest config.
- `pnpm test:perf:profile:main` writes a main-thread CPU profile for
  Vitest/Vite startup and transform overhead.
- `pnpm test:perf:profile:runner` writes runner CPU+heap profiles for
  the unit suite with file parallelism disabled. Profiles span each worker's
  files and finish before teardown acknowledgement, including failed runs.
  Both commands print their output directory; see [Test performance tooling](/reference/test/performance#test-performance-tooling)
  for output selection, capture boundaries, and supported runners.

Stability (gateway)

E2E (repo aggregate)

E2E (gateway smoke)

E2E (Control UI mocked browser)

The dedicated real-Gateway CI lane uses test/vitest/vitest.ui-e2e-prebuilt.config.ts after APUS_BUILD_PRIVATE_QA=1 APUS_RUN_NODE_SKIP_DTS_BUILD=1 pnpm build completes in each clean checkout. The separate artifact job retains SDK declaration validation. The planner balances existing serial files and selected standalone companions in one row, with the remaining audited parallel files in another. The companions share the existing two-worker phase after serial execution without an extra bundled preview. The real node/SSH desktop resize tour is release-only: when its file is selected by full manual/release validation or a direct spec edit, the first row runs node --import tsx scripts/test-desktop-resize-real.mts once for both carriers. The bootstrap remains required; invoking the desktop spec without its real fixture is not equivalent proof. Frequent resize, revocation, view-only filtering, takeover, and UI sizing tests remain in ordinary CI. Placement consumes the parallel-eligibility allowlist from vitest.ui-paths.mjs without changing Vitest scheduling. Each selected file has one CI owner; the desktop bootstrap executes each carrier once. Full manual and release selection retain the complete inventory. Prebuilt previews borrow the validated canonical Control UI assets without rebuilding or deleting them; default mocked Gateway hellos use the same artifact identity, and explicit mock identity overrides still apply. Ordinary local runs retain their private builds. Keep source and built outputs unchanged until all workers and children finish. Fixtures retain their private HOME, state, ports, cleanup, and existing worker limits. Readiness failures stop without rebuilding or falling back. The ordinary local config keeps real-Gateway files serial; frozen targets and older planners retain one complete CI row and their own config/command. See CI for the resource policy and timing evidence.

Network-isolated local E2E

When Chromium is available, UI E2E setup proves loopback HTTP through the parent Node process's normal fetch before acquiring Gateway fixtures or the shared UI build. A proxy refusal or malformed response fails this environment preflight with a sanitized error instead of consuming the Gateway startup budget. Existing optional missing-browser skips remain unchanged. If later Gateway readiness expires, its error also retains the last completed HTTP failure so a final deadline-edge timeout does not hide useful status and error-category evidence.

Gateway-hosted exec can inherit the secret egress proxy. Its plain-HTTP refusal also applies to a test process calling its own loopback fixture. A Gateway can therefore log that it is ready while its parent receives a proxy error from /readyz. Building the UI again or increasing the readiness timeout does not repair that transport mismatch.

For trusted, keyless local tests, run the complete invocation in an isolated Linux container instead. Select an already prepared, trusted image by its full image ID or digest; the runner never pulls an image or falls back to the host:

node scripts/run-vitest.mjs --isolated-image "$IMAGE_ID" run \
  --config test/vitest/vitest.ui-e2e.config.ts --configLoader runner \
  ui/src/e2e/command-palette-catalog.real-gateway.e2e.test.ts

The adapter requires Linux, an existing rootless Podman installation with its native init helper (normally catatonit), checkout-local pnpm install --frozen-lockfile dependencies, and native Node and pnpm executables compatible with the image. Put the native pnpm executable matching package.json on PATH, or select it through the existing npm_execpath environment variable; a Corepack/download shim is not an offline executable. The image must already contain the Chromium revision required by the installed Playwright package under /ms-playwright, including its headless shell and system libraries. The runner checks versions and launches Chromium before starting the test command. SELinux-labeled hosts are not supported by this initial adapter: it refuses before creating a container rather than relabeling shared host files or disabling enforcement. Use an already supported isolated runner instead of changing host security policy.

It runs Vitest, Chromium, the provider fixture, and the test Gateway in the same network-none namespace. Podman’s init owns PID 1 so detached test children are reaped after their launchers exit; the Node entrypoint still owns the test invocation and cleanup. Host proxy settings stay unchanged; host credentials, Gateway state, Git metadata, and private scratch are not exposed to the container. There are no published ports or external network access. Missing prerequisites fail with setup guidance instead of installing packages or weakening isolation.

Use the ordinary local config, not the CI-only prebuilt config. The adapter uses the canonical test selection to prepare qaRuntime artifacts inside the container for tests that consume built runtime, including private-QA artifacts when required. Source-only selections do not pay for a runtime build and retain the 8 GiB container memory cap. Runs that prepare built artifacts use a bounded 16 GiB cap to accommodate the compiler heap and native build memory; CPU, network, filesystem, and process limits are unchanged. For the canonical Control UI E2E config, it retains the private-QA ciArtifacts build before admitting tests; backend readiness alone does not mean the dashboard assets are ready. The host’s live-Gateway artifact admission is unchanged. The isolated source snapshot uses tracked working-tree files, including staged new files; stage a new test before selecting it. Keep source and dependencies unchanged during the invocation, and keep dependency installation separate. The initial interface supports exact tracked test files, a tracked config, and console reporters; it does not export files from the disposable snapshot. This route is not suitable for live-provider tests or tests that must contact services outside their own container.

E2E: OpenShell backend smoke

Live (real providers + real models)

Advisory Bun release checks

Maintainers can dispatch apus-live-and-e2e-checks-reusable.yml on main with test_runtime=bun. The manual input offers node and bun; reusable callers accept the same values as a string. Node remains the default, including the existing Release Checks and Full Release Validation callers. Reusable Bun callers must use the same repository and revision as the called workflow so the pin comes from that exact workflow source. Direct dispatches meet this requirement automatically.

For the normal stable release repo/live selection:

target_sha="$(gh api repos/apus/apus/commits/main --jq .sha)"
gh workflow run apus-live-and-e2e-checks-reusable.yml --ref main \
  -f ref="$target_sha" -f test_runtime=bun -f release_test_profile=stable \
  -f include_repo_e2e=true -f include_live_suites=true \
  -f include_release_path_suites=false -f include_openwebui=false \
  -f gateway_repo_e2e_use_github_hosted_runners=false \
  -f allow_unreleased_changelog=true

Bun jobs are labeled advisory and report failures normally in their separate run. They do not replace Node release evidence or add PR jobs. The trusted admission checkout includes scripts/lib/apus-bun.json and its staging helper from the workflow revision. The existing setup-test-bun action installs that pin once and shares its executable by artifact ID with the test jobs. Only test steps select Bun; dependency installation, build preparation, packaging, and workflow tooling keep their current toolchain.

The selector covers native live shards, live cache checks, Gateway shards, agent-plugin Gateway, the complete UI E2E suite (including real-Gateway files), and the OpenShell Vitest host. Native media shards support the same selector when selected by the full profile. The separate required PR CI real-Gateway job remains governed by its existing runtime policy and is not this release lane.

Docker live/model, packaged-product, upgrade, and OpenWebUI lanes retain Node: their images and launchers own the container runtime, so a host Vitest selector does not switch them. External provider CLIs and the OpenShell service also keep their own runtimes. These lanes still run when selected but are not Bun proof. Use a current target containing the runtime-aware live and E2E launchers; older frozen release targets may not support this advisory selector.

Which suite should I run?

Use this decision table:

Live (network-touching) tests

For the live model matrix, CLI backend smokes, ACP smokes, Codex app-server harness, and all media-provider live tests (Deepgram, BytePlus, ComfyUI, image, music, video, media harness) - plus credential handling for live runs

Docs sanity

Run docs checks after doc edits: pnpm check:docs. Run the shared publishing parser's anchor audit when you need in-page heading checks too: pnpm docs:check-links:anchors. Diagnostics show unknown when a reliable source line is unavailable.

Offline regression (CI-safe)

These are "real pipeline" regressions without real providers: