ci(nix): retain Xvfb diagnostics for capture probes - #707

Summary

Every run_cli invocation in the Nix smoke test starts a fresh Xvfb, and two things about that server are currently invisible: the display xvfb-run -a allocated for it, and the server's own output — xvfb-run's default error file is /dev/null. So when a source-enumeration call hangs (#462), the invocation number is known but nothing below the Electron API is, which is exactly the layer that issue names as the next thing to observe.

This change records both, keyed by the existing RUN_CLI_N counter:

• the actual display, written from inside the environment xvfb-run exported to the command — a shim writes $DISPLAY and then execs the CLI, so argv, environment and process tree after startup are unchanged;
• the Xvfb server's own output for that invocation, through xvfb-run's -e error-file channel.

Both files are written before the CLI can hang, so a timeout kill cannot lose them. Allocation stays xvfb-run -a's to make — no fixed server number, no display guessed from the invocation index. An empty server log is a valid result; what matters is that the file exists and correlates.

The smoke step prints an allocation index (invocation → display → server log), and an if: always() artifact (xvfb-diagnostics, small text files only) keeps the evidence once the runner is gone — including on the runs where the smoke step itself failed.

Related issue

Refs #462 — observability only. This does not claim to fix or explain the enumeration hangs; it closes the first blind spot the issue lists under "what would move it".

Type of change

• Bug fix
• Feature
• Enhancement
• Documentation
• Refactor / maintenance
• Performance
• Security

Release impact

• Patch
• Minor
• Major / breaking change
• No release note needed

Desktop impact

• Windows
• macOS
• Linux
• Installer / packaging
• Not platform-specific (CI-only change)

Screenshots / video

None — no UI change.

Testing

• actionlint on the modified workflow: clean; bash -n on the extracted smoke-step script: clean; git diff --check: clean.
• Deterministic harness (local, not committed): real xvfb-run -a and a real Xvfb, with run_cli reproduced verbatim for current main and for this change, driving a fake CLI that can succeed, exit non-zero, or hang.
  • Current main: after success, non-zero and timeout outcomes, no per-invocation evidence files exist — the invocation → display → server-log mapping cannot be built. 17 passing assertions.
  • This change: every outcome leaves the display file and the server log; exit codes are preserved exactly (0 / 7 / 124); the recorded display equals the display the child process actually saw; and three mixed invocations map one-to-one onto three display/log file pairs. 35 passing assertions.
• Hosted validation: a fork run of this same workflow (the paths filter includes the workflow itself) went green end to end — build, smoke, upload. Its smoke step made 11 run_cli invocations, the index mapped every one to its actual display (:99 on eight, :100 on three — the auto-allocation genuinely varies), and the xvfb-diagnostics artifact carried the full 22-file set. No enumeration hang occurred in that run, so it validates the evidence path, not a fix.

Summary by CodeRabbit

• Bug Fixes
  • Smoke tests now continue long enough to record diagnostic output when a CLI command times out or fails.
  • Original command results are preserved for accurate HUNG, OK, and FAILED reporting.
• Diagnostics
  • Xvfb display and server logs continue to be recorded and uploaded as workflow artifacts.
  • Diagnostic uploads warn instead of failing when no files are available.