hmmhmmhm · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -7,9 +7,17 @@
       - main
 
 jobs:
+  select-runner:
+    uses: ./.github/workflows/select-local-runner.yml
+    with:
+      cloud-runner: macos-latest
+    secrets:
+      status-token: ${{ secrets.LOCAL_RUNNER_STATUS_TOKEN }}
+
   release-check:
     name: Release readiness
-    runs-on: macos-latest
+    needs: select-runner
+    runs-on: ${{ fromJSON(needs.select-runner.outputs.runner) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4

diff --git a/.github/workflows/local-runner-smoke.yml b/.github/workflows/local-runner-smoke.yml
@@ -0,0 +1,56 @@
+name: Local runner smoke
+
+on:
+  push:
+    branches: [local-runner-fallback]
+    paths:
+      - .github/workflows/select-local-runner.yml
+      - .github/workflows/local-runner-smoke.yml
+  workflow_dispatch:
+    inputs:
+      force-cloud:
+        description: Exercise the cloud runner without stopping the Mac service
+        type: boolean
+        default: false
+      probe-local:
+        description: Owner-only installation check that requires the Mac to be online
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  select-runner:
+    uses: ./.github/workflows/select-local-runner.yml
+    with:
+      force-cloud: ${{ inputs.force-cloud || false }}
+    secrets:
+      status-token: ${{ secrets.LOCAL_RUNNER_STATUS_TOKEN }}
+  smoke:
+    needs: select-runner
+    runs-on: ${{ inputs.probe-local && github.actor == github.repository_owner && fromJSON('["self-hosted", "macOS", "ARM64", "personal-mac"]') || fromJSON(needs.select-runner.outputs.runner) }}
+    timeout-minutes: 10
+    steps:
+      - name: Check selected runner
+        shell: bash
+        env:
+          RUNNER_REASON: ${{ needs.select-runner.outputs.reason }}
+          EXPECT_LOCAL: ${{ (inputs.probe-local && github.actor == github.repository_owner) || needs.select-runner.outputs.local == 'true' }}
+          RUNNER_ENVIRONMENT: ${{ runner.environment }}
+          ACTUAL_RUNNER_NAME: ${{ runner.name }}
+          ACTUAL_RUNNER_OS: ${{ runner.os }}
+          ACTUAL_RUNNER_ARCH: ${{ runner.arch }}
+        run: |
+          echo "Selection: $RUNNER_REASON"
+          echo "Runner: $ACTUAL_RUNNER_NAME ($ACTUAL_RUNNER_OS/$ACTUAL_RUNNER_ARCH)"
+          if [ "$EXPECT_LOCAL" = "true" ]; then
+            test "$RUNNER_ENVIRONMENT" = "self-hosted"
+            test "$ACTUAL_RUNNER_OS" = "macOS"
+            test "$ACTUAL_RUNNER_ARCH" = "ARM64"
+          else
+            test "$RUNNER_ENVIRONMENT" = "github-hosted"
+          fi
+          printf 'Selection: %s\nRunner: %s (%s/%s)\n' \
+            "$RUNNER_REASON" "$ACTUAL_RUNNER_NAME" "$ACTUAL_RUNNER_OS" "$ACTUAL_RUNNER_ARCH" \
+            >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/select-local-runner.yml b/.github/workflows/select-local-runner.yml
@@ -0,0 +1,84 @@
+name: Select local runner
+
+on:
+  workflow_call:
+    inputs:
+      cloud-runner:
+        type: string
+        default: ubuntu-latest
+      force-cloud:
+        type: boolean
+        default: false
+    secrets:
+      status-token:
+        required: false
+    outputs:
+      runner:
+        value: ${{ jobs.select.outputs.runner }}
+      local:
+        value: ${{ jobs.select.outputs.local }}
+      reason:
+        value: ${{ jobs.select.outputs.reason }}
+
+permissions:
10BC8  contents: read
+
+jobs:
+  select:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      runner: ${{ steps.runner.outputs.runner }}
+      local: ${{ steps.runner.outputs.local }}
+      reason: ${{ steps.runner.outputs.reason }}
+    steps:
+      - name: Select local Mac when online
+        id: runner
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        env:
+          CLOUD_RUNNER: ${{ inputs.cloud-runner }}
+          FORCE_CLOUD: ${{ inputs.force-cloud }}
+          HAS_STATUS_TOKEN: ${{ secrets.status-token != '' }}
+        with:
+          github-token: ${{ secrets.status-token || github.token }}
+          script: |
+            const localLabels = ['self-hosted', 'macOS', 'ARM64', 'personal-mac'];
+            let labels = [process.env.CLOUD_RUNNER];
+            let reason = 'cloud';
+            const pr = context.payload.pull_request;
+            const trusted = context.actor === context.repo.owner &&
+              (!pr || (pr.user.login === context.repo.owner &&
+                pr.head.repo?.full_name === `${context.repo.owner}/${context.repo.repo}`));
+
+            if (process.env.FORCE_CLOUD === 'true') {
+              reason = 'forced-cloud';
+            } else if (!trusted) {
+              reason = 'untrusted-event';
+            } else if (process.env.HAS_STATUS_TOKEN !== 'true') {
+              reason = 'status-token-missing';
+              core.warning('LOCAL_RUNNER_STATUS_TOKEN is missing; using GitHub-hosted runner.');
+            } else {
+              try {
+                const runners = await github.paginate(github.rest.actions.listSelfHostedRunnersForRepo, {
+                  ...context.repo, per_page: 100,
+                });
+                const available = runners.some(runner =>
+                  runner.name === `personal-mac-${context.repo.repo}` &&
+                  runner.status === 'online' &&
+                  localLabels.every(label => runner.labels.some(item => item.name === label)));
+                if (available) {
+                  labels = localLabels;
+                  reason = 'local-online';
+                } else {
+                  reason = 'local-offline-or-absent';
+                }
+              } catch (error) {
+                reason = 'status-api-unavailable';
+                core.warning(`Runner status query failed (${error.status || 'network error'}); using GitHub-hosted runner.`);
+              }
+            }
+
+            core.info(`Runner selection: ${reason} -> ${JSON.stringify(labels)}`);
+            core.setOutput('runner', JSON.stringify(labels));
+            core.setOutput('local', String(reason === 'local-online'));
+            core.setOutput('reason', reason);
diff --git a/apps/browser/package.json b/apps/browser/package.json
@@ -43,20 +43,20 @@
     "concurrently": "^8.2.2",
     "cross-env": "^10.1.0",
     "dotenv": "^17.4.2",
-    "electron": "github:castlabs/electron-releases#v39.8.10+wvcus",
-    "electron-builder": "^26.8.1",
-    "electron-builder-squirrel-windows": "26.8.1",
-    "esbuild": "^0.28.0",
+    "electron": "github:castlabs/electron-releases#v42.11.10+wvcus",
+    "electron-builder": "^26.15.3",
+    "electron-builder-squirrel-windows": "26.15.3",
+    "esbuild": "^0.28.1",
     "tailwindcss": "^4.3.0",
     "typescript": "5.9.2",
-    "vite": "^8.0.13",
-    "vitest": "^3.2.4"
+    "vite": "8.0.16",
+    "vitest": "^4.1.11"
   },
   "build": {
     "appId": "com.aka-browser.app",
     "productName": "aka-browser",
     "electronDist": "node_modules/electron/dist",
-    "electronVersion": "39.8.10",
+    "electronVersion": "42.11.10",
     "npmRebuild": false,
     "asar": true,
     "asarUnpack": [

diff --git a/package.json b/package.json
@@ -17,18 +17,28 @@
   },
   "pnpm": {
     "overrides": {
-      "@isaacs/brace-expansion": "5.0.1",
-      "ajv": "6.14.0",
-      "brace-expansion@<1.1.13": "1.1.13",
-      "brace-expansion@>=2.0.0 <2.0.3": "2.0.3",
-      "js-yaml": "4.1.1",
+      "@isaacs/brace-expansion": "5.0.12",
+      "ajv@<7": "6.14.0",
+      "app-builder-lib@26.15.3>ajv": "8.18.0",
+      "js-yaml": "4.3.2",
       "lodash": "4.18.1",
       "minimatch@<3.1.4": "3.1.4",
       "minimatch@>=5.0.0 <5.1.8": "5.1.8",
       "minimatch@>=9.0.0 <9.0.6": "9.0.9",
       "minimatch@>=10.0.0 <10.2.1": "10.2.5",
-      "@xmldom/xmldom": "0.8.13",
-      "picomatch": "4.0.4"
+      "@xmldom/xmldom": "0.8.15",
+      "picomatch": "4.0.4",
+      "brace-expansion@<1.1.21": "1.1.21",
+      "brace-expansion@>=2.0.0 <2.1.7": "2.1.7",
+      "http-cache-semantics": "4.3.0",
+      "shell-quote@<1.9.0": "1.9.0",
+      "tar@<7.5.21": "7.5.21",
+      "form-data@<4.0.6": "4.0.6",
+      "undici@>=6.0.0 <6.28.1": "6.28.1",
+      "tmp@<0.2.7": "0.2.7",
+      "brace-expansion@>=3.0.0 <5.0.12": "5.0.12",
+      "source-map-js@<1.2.2": "1.2.2",
+      "global-agent@<4.1.3": "4.1.3"
     }
   },
   "packageManager": "pnpm@9.0.0",