feat(studio-bridge): add Linux/Wine support for headless Studio

Adds the ability to run Roblox Studio under Wine on Linux, enabling
headless CI testing and devcontainer workflows.

New modules:
- linux-config: environment-aware configuration resolution
- linux-wine-env: Wine process environment assembly
- linux-credential-writer: compile write-cred.c with MinGW, inject
  credentials into Wine's Credential Manager via Roblox API
- linux-display-manager: Xvfb/openbox lifecycle management
- linux-fflags: write ClientAppSettings.json with D3D11 renderer flags
- linux-shader-patcher: patch #version 150 → 420 in shader pack
- linux-studio-installer: download and extract Studio from CDN
- linux-version-resolver: resolve latest version via clientsettingscdn
- linux-prerequisites: dependency checker and installer

New CLI commands (studio-bridge linux <cmd>):
- setup: full environment provisioning (--install-deps for CI)
- auth: credential injection from ROBLOSECURITY cookie
- status: prerequisite health check

Also moves shared auth code from nevermore-cli to nevermore-cli-helpers
so studio-bridge can reuse cookie parsing and credential retrieval.

Includes unit tests, GitHub Actions E2E workflow, and README.

Author: Quenty

.github/workflows/studio-linux-e2e.yml

@@ -0,0 +1,110 @@
+name: studio-linux-e2e
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'tools/studio-bridge/src/linux/**'
+      - 'tools/studio-bridge/src/process/**'
+      - 'tools/studio-bridge/src/commands/linux/**'
+      - 'tools/nevermore-cli-helpers/src/auth/**'
+      - '.github/workflows/studio-linux-e2e.yml'
+
+jobs:
+  studio-linux-e2e:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '21'
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          cache: true
+
+      - name: Setup registries
+        run: |
+          echo -e "\n//npm.pkg.github.com/:_authToken=$GITHUB_TOKEN" >> .npmrc
+          echo -e "\n//npm.pkg.github.com/:_authToken=$GITHUB_TOKEN" >> ~/.npmrc
+          echo -e "\n//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> .npmrc
+          echo -e "\n//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build all tools
+        run: pnpm -r --filter './tools/**' run build
+
+      - name: Setup Linux environment
+        run: node tools/studio-bridge/dist/src/cli/cli.js linux setup --install-deps
+
+      - name: Verify environment health (pre-auth)
+        run: node tools/studio-bridge/dist/src/cli/cli.js linux status
+
+      - name: Inject authentication
+        if: ${{ env.ROBLOSECURITY != '' }}
+        run: node tools/studio-bridge/dist/src/cli/cli.js linux auth
+        env:
+          ROBLOSECURITY: ${{ secrets.ROBLOSECURITY }}
+
+      - name: Verify Studio launches under Wine
+        if: ${{ env.ROBLOSECURITY != '' }}
+        timeout-minutes: 5
+        env:
+          ROBLOSECURITY: ${{ secrets.ROBLOSECURITY }}
+        run: |
+          STUDIO_DIR="${STUDIO_DIR:-$HOME/roblox-studio}"
+          STUDIO_EXE="$STUDIO_DIR/RobloxStudioBeta.exe"
+          WINEPREFIX="${WINEPREFIX:-$HOME/.wine}"
+
+          export DISPLAY=:99
+          export WINEPREFIX
+          export WINEARCH=win64
+          export WINEDEBUG=-all
+          export WINEDLLOVERRIDES='mscoree=d;mshtml=d'
+          export MESA_GL_VERSION_OVERRIDE=4.5
+          export MESA_GLSL_VERSION_OVERRIDE=450
+
+          echo "Launching Studio: wine $STUDIO_EXE"
+          wine "$STUDIO_EXE" &
+          STUDIO_PID=$!
+
+          # Wait up to 30s for the process to stabilize (not crash immediately)
+          for i in $(seq 1 10); do
+            sleep 3
+            if ! kill -0 "$STUDIO_PID" 2>/dev/null; then
+              echo "Studio process exited prematurely after ~$((i * 3))s"
+              exit 1
+            fi
+            echo "Studio still running after $((i * 3))s..."
+          done
+
+          echo "Studio survived 30s — launch test passed"
+          kill "$STUDIO_PID" 2>/dev/null || true
+          wait "$STUDIO_PID" 2>/dev/null || true
+
+      - name: Take screenshot
+        if: always()
+        run: |
+          if command -v import &> /dev/null; then
+            DISPLAY=:99 import -window root e2e-screenshot.png 2>/dev/null || true
+          elif command -v xwd &> /dev/null; then
+            DISPLAY=:99 xwd -root | convert xwd:- e2e-screenshot.png 2>/dev/null || true
+          fi
+
+      - name: Upload screenshot
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: studio-screenshot
+          path: e2e-screenshot.png
+          if-no-files-found: ignore

docs/testing/testing.md

@@ -204,6 +204,23 @@ When tests fail in CI, the `post-test-results` command parses Jest-lua output an
 
 The resolver code lives in `tools/nevermore-cli/src/utils/sourcemap/` and is shared with the `strip-sourcemap-jest` command.
 
+## Linux headless testing
+
+Studio can run headlessly on Linux via Wine, enabling E2E tests in devcontainers and GitHub Actions without a display or GPU. The `studio-bridge` CLI handles all environment setup:
+
+```bash
+# One-time setup
+studio-bridge linux setup --install-deps
+studio-bridge linux auth  # reads $ROBLOSECURITY env var
+
+# Run tests the same as on Windows/macOS
+nevermore test
+```
+
+Prerequisites (Wine 11, Xvfb, openbox, Mesa llvmpipe) are documented in `tools/studio-bridge/src/linux/README.md`. The `linux setup --install-deps` flag installs everything on Debian/Ubuntu but is opt-in — it never runs sudo automatically.
+
+For CI, set `ROBLOSECURITY` as a repository or Codespace secret. The `.github/workflows/studio-linux-e2e.yml` workflow demonstrates the full flow.
+
 ## CI design principles
 
 - **Workflows should be thin.** All logic lives in `nevermore-cli` commands — GitHub Actions workflows just call them. This keeps CI debuggable locally.

pnpm-lock.yaml

@@ -23,6 +23,7 @@
   ],
   "dependencies": {
     "@quenty/cli-output-helpers": "workspace:*",
+    "inquirer": "^13.2.0",
     "latest-version": "^9.0.0",
     "semver": "^7.6.0"
   },
@@ -31,12 +32,15 @@
     "@types/semver": "^7.5.0",
     "prettier": "2.7.1",
     "typescript": "^5.9.3",
-    "typescript-memoize": "^1.1.1"
+    "typescript-memoize": "^1.1.1",
+    "vitest": "^3.0.0"
   },
   "scripts": {
     "build": "tsc --build",
     "build:watch": "tsc --build --watch",
     "build:clean": "tsc --build --clean",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "preinstall": "npx only-allow pnpm"
   },
   "publishConfig": {

tools/nevermore-cli-helpers/package.json

@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+import { COOKIE_NAME, parseStudioCookieValue } from './cookie-parser.js';
+
+describe('COOKIE_NAME', () => {
+  it('equals .ROBLOSECURITY', () => {
+    expect(COOKIE_NAME).toBe('.ROBLOSECURITY');
+  });
+});
+
+describe('parseStudioCookieValue', () => {
+  it('parses COOK::<value> format with angle brackets', () => {
+    const result = parseStudioCookieValue('COOK::<abc123>');
+    expect(result).toBe('abc123');
+  });
+
+  it('parses value from comma-separated list', () => {
+    const result = parseStudioCookieValue('OTHER::stuff,COOK::<secret>');
+    expect(result).toBe('secret');
+  });
+
+  it('returns undefined for plain text', () => {
+    expect(parseStudioCookieValue('just a string')).toBeUndefined();
+  });
+
+  it('returns undefined for COOK:: without angle brackets', () => {
+    expect(parseStudioCookieValue('COOK::noBrackets')).toBeUndefined();
+  });
+
+  it('returns undefined for empty string', () => {
+    expect(parseStudioCookieValue('')).toBeUndefined();
+  });
+
+  it('handles a realistic cookie value', () => {
+    const cookie = '_|WARNING:-DO-NOT-SHARE|_abc123def456';
+    const result = parseStudioCookieValue(`COOK::<${cookie}>`);
+    expect(result).toBe(cookie);
+  });
+});