feat: manage proxy cores

.github/actions/prepare-unit-storage/action.yml

@@ -0,0 +1,27 @@
+name: Prepare unit test storage
+description: Reclaim the unused Android SDK only on disposable hosted Linux runners, then install dependencies.
+inputs:
+  cache:
+    description: Restore the exact dependency cache for pull requests.
+    required: false
+    default: "false"
+runs:
+  using: composite
+  steps:
+    - name: Reserve disk space for raw V8 coverage
+      if: runner.environment == 'github-hosted' && runner.os == 'Linux'
+      shell: bash
+      run: |
+        set -euo pipefail
+        df -h "$GITHUB_WORKSPACE" "$RUNNER_TEMP"
+        # This Node-only job does not use Android; never remove shared runner toolchains.
+        if [ -d /usr/local/lib/android ] && [ ! -L /usr/local/lib/android ]; then
+          du -sh /usr/local/lib/android
+          timeout 120s sudo rm -rf -- /usr/local/lib/android
+        fi
+        df -h "$GITHUB_WORKSPACE" "$RUNNER_TEMP"
+    - uses: ./.github/actions/npm-ci-retry
+      with:
+        cache: ${{ inputs.cache }}
+    - shell: bash
+      run: npm run check:node-runtime

.github/workflows/ci.yml

@@ -1067,11 +1067,9 @@ jobs:
         with:
           package-manager-cache: false
           node-version: ${{ env.CI_NODE_VERSION }}
-      - uses: ./.github/actions/npm-ci-retry
+      - uses: ./.github/actions/prepare-unit-storage
         with:
-          # PR acceleration is not release-candidate provenance.
           cache: ${{ github.event_name == 'pull_request' }}
-      - run: npm run check:node-runtime
       # QW-d (plano mestre): fonte única — o MESMO npm script dos runs locais (adiciona o
       # setupPolyfill que o comando inline omitia; o glob canônico vive só no package.json).
       # D3 (plano mestre): a coverage é coletada NESTE mesmo run (c8/NODE_V8_COVERAGE propaga
@@ -1095,6 +1093,7 @@ jobs:
           # pelo job de merge de cobertura mais abaixo.
           NODE_OPTIONS: --max-old-space-size=8192
         run: |
+          trap 'status=$?; { df -h "$GITHUB_WORKSPACE" "$RUNNER_TEMP"; du -sh coverage-shard; } || :; exit "$status"' EXIT
           rm -rf coverage-shard coverage-shard-report
           npx c8 --merge-async \
             --temp-directory=coverage-shard \

.github/workflows/managed-proxy-cores.yml

@@ -0,0 +1,83 @@
+name: Managed proxy cores
+
+on:
+  pull_request:
+    paths:
+      - "src/lib/services/managedProxy/**"
+      - "src/lib/services/ServiceSupervisor.ts"
+      - "src/lib/services/healthCheck.ts"
+      - "src/lib/services/types.ts"
+      - "src/app/api/services/managed-proxy/**"
+      - "src/server/authz/**"
+      - "src/lib/api/*Proxy*.ts"
+      - "src/lib/api/proxyDeletionHandlers.ts"
+      - "src/app/api/settings/proxies/**"
+      - "tests/integration/managed-proxy/**"
+      - "src/shared/components/ProxyCustomFields.tsx"
+      - "tests/unit/managed-proxy-*.test.ts"
+      - "tests/unit/managed-proxy-*.test.tsx"
+      - "vitest.managed-proxy.config.ts"
+      - "tests/_setup/managedProxyFixture.mjs"
+      - "tests/_setup/managedProxyHttpBundle.ts"
+      - "tests/fixtures/managedProxyChild.mjs"
+      - "scripts/test/*managed-proxy*.mjs"
+      - "scripts/test/check-managed-proxy-native.ts"
+      - ".github/workflows/managed-proxy-cores.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  native-config:
+    timeout-minutes: 12
+    strategy:
+      fail-fast: false
+      max-parallel: 2
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24"
+          cache: npm
+      - run: npm ci
+      - name: Check official core configuration fixtures
+        run: node --import tsx/esm scripts/test/check-managed-proxy-native.ts
+        env:
+          CI: "true"
+          NODE_ENV: test
+          DATA_DIR: ${{ runner.temp }}/managed-core-data
+          HOME: ${{ runner.temp }}/managed-core-home
+          USERPROFILE: ${{ runner.temp }}/managed-core-home
+          APPDATA: ${{ runner.temp }}/managed-core-home
+          LOCALAPPDATA: ${{ runner.temp }}/managed-core-home
+          HOOKMAKER_MAX_TEST_WORKERS: "1"
+  isolated-runtime:
+    # Actual supervisor child lifecycle and management seams; no core listener/upstream traffic.
+    needs: native-config
+    timeout-minutes: 12
+    strategy:
+      fail-fast: false
+      max-parallel: 2
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24"
+          cache: npm
+      - run: npm ci
+      - name: Verify isolated lifecycle, rollback, deletion and existing-field save
+        timeout-minutes: 8
+        run: node scripts/test/run-managed-proxy-runtime.mjs
+        env:
+          HOOKMAKER_MAX_TEST_WORKERS: "1"