Repository navigation
Conversation
…term relay (stablyai#33495) Release queued startup input when a figterm-style relay (Kiro CLI's kiro-cli-term) exec-replaces the shell: if the pane's foreground process isn't a shell, accept a direct child that is the expected shell, foreground on its own tty, at an editable prompt. Startup with Kiro shell integration drops from a 15s timeout to <1s. Fixes stablyai#25586 Supersedes stablyai#25899 Co-authored-by: ggbdpq <67929842+ggbdpq@users.noreply.github.com>
…tablyai#33493) Codex sessions launched from an Orca-managed account home now honor the user's global ~/.codex/rules exec-policy files: each regular global .rules file is copied in as rules/_orca-global-<name> on launch (sorted before the account's own files so its saved decisions still win last-one-wins rules); approvals keep saving to the account's default.rules. Fixes stablyai#24431 Co-authored-by: Yuichi Uemura <82369+u-ichi@users.noreply.github.com>
…reattached (stablyai#33494) After Wake the window paints the restored history and then blanks its viewport, so the new shell's prompt starts on a clean screen. The daemon's own copy of the screen, seeded with the same history, skipped that step. A later reattach (a reload, a second window, the phone) therefore showed the new prompt beside the dead shell's last one: `p7/sub$ orca@awin:~/projects/p7$` (awin verify-11). The seed now ends with the same viewport blanking the window writes, built by one shared function, after the process-boundary ground, which still never moves the cursor. Co-authored-by: Claude <noreply@anthropic.com>
…lder when slept (stablyai#33496) After an app relaunch, the window reattaches a live pane without its spawn environment, so the daemon client never learned the pane's ORCA_PANE_KEY. Sleep then skipped the folder read for it, and the pane woke at its spawn folder. A move's kill-at-quiesced rollback also put a pane `cd`'d before the relaunch back at the project root (awin verify-11, 5e). Sleep now takes the pane key from the daemon's session list when it knows the session's distro but not its key. That is the same one `listSessions` the adoption of an unattached session already uses. Co-authored-by: Claude <noreply@anthropic.com>
…lyai#33498) * test: remove redundant checks and strengthen runtime assertions * test: prune resolved real-time wait baseline --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…ker's first dispatch (stablyai#33499) dsh worker dispatches (and other dsh agent-prompt sends) now get stablyai#33316's bounded Enter retry: dsh paints its launchpad before its session opens and refuses the first Enter with "still starting", so a fresh worker's task sat unsent. The retry only re-presses while the launchpad still holds the same prompt and stops once a turn starts. Fixes stablyai#30778 Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
…ine tail kept after the TUI erased it (stablyai#33485) A Codex (or Antigravity/Cline/Prime Agent) dialog drawn and erased in place no longer leaves the pane "blocked" forever when no hook/OSC 7501 clears it. The line tail still decides; the live screen may only clear a tail block when caught up, quiet 3s, no blocker anywhere on screen, and the agent's composer is ready — then the stale block stamp is cleared so the send's own echo doesn't re-block. Also defers the daemon re-attach seed's output sequence until the seed lands. Fixes stablyai#24187 Supersedes stablyai#24308 Co-authored-by: Wooseong Kim <2222333+innocarpe@users.noreply.github.com>
…#33503) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…d only by the login shell (stablyai#33506) Claude history, usage, native-chat lookup and worktree-retirement discovery now include the user's own CLAUDE_CONFIG_DIR read from the login shell, so sessions in a custom config folder show up even when Orca was launched from the Dock. Refs stablyai#23505
) * [comment audit] Align legacy failure-read counts with cached display * [comment audit] Condense shared provider lifecycle and browser recovery comments [skip ci] * [comment audit] Condense shared generation, path and preview comments [skip ci] * [comment audit] Condense host, file and Git contract rationale [skip ci] * [comment audit] Tighten Git lifecycle and provider contract comments [skip ci] * [comment audit] Clarify shared host authority and launch isolation [skip ci] * [comment audit] simplify local access mobile and native chat contracts [skip ci] * [comment audit] simplify native chat presentation and state contracts [skip ci] * [comment audit] simplify native runtime and provider contracts [skip ci] * [comment audit] simplify migration and orchestration contracts [skip ci] * [comment audit] simplify plugin trust and process capture rationale [skip ci] * [comment audit] simplify terminal delivery and remote compatibility rationale [skip ci] * [comment audit] clarify remote recovery and launch wire rationale [skip ci] * [comment audit] shorten shared RPC compatibility and runtime evidence comments [skip ci] * [comment audit] simplify secure storage shell startup and sidebar rationale [skip ci] * [comment audit] clarify sidebar, skill and SSH invariants [skip ci] * [comment audit] condense structured chat delivery and timing rationale [skip ci] * [comment audit] condense terminal replay and telemetry invariants [skip ci] * [comment audit] clarify launch permission and terminal delivery rationale [skip ci] * [comment audit] clarify workspace ownership and layout contracts [skip ci] * [comment audit] wait for fitted and painted SSH terminal links * [comment audit] clarify layout persistence and session ownership [skip ci] * [comment audit] clarify host routing and workspace lifecycle contracts [skip ci] * [comment audit] clarify startup persistence and app lifetime comments [skip ci] * [comment audit] clarify recovery and activity boundaries [skip ci] * [comment audit] condense activity and artifact invariants [skip ci] * [comment audit] condense automation authority contracts [skip ci] * [comment audit] simplify automation scheduling and history contracts [skip ci] * [comment audit] clarify browser chrome and annotation lifecycles [skip ci] * [comment audit] clarify browser routing and retained guest ownership [skip ci] * [comment audit] clarify browser recovery and document ownership comments [skip ci] * [comment audit] restore hosted runners required by native IME fixtures * [comment audit] shorten preview, palette and dashboard invariants [skip ci] * [comment audit] clarify terminal preview, dashboard and retention comments [skip ci] * [comment audit] clarify diff-note recovery and editor lifecycle comments [skip ci] * [comment audit] shorten rich-text and combined-diff ownership comments [skip ci] * [comment audit] shorten autosave, draft recovery and model ownership comments [skip ci] * [comment audit] shorten save-queue, notebook and Markdown constraints [skip ci] * [comment audit] shorten Monaco, PDF and rich Markdown safeguards [skip ci] * [comment audit] clarify rich Markdown source and selection safeguards [skip ci] * [comment audit] clarify editor loading and emulator stream lifetimes [skip ci] * [comment audit] trim emulator and feature tour narration [skip ci] * [comment audit] clarify floating workspace and GitHub cache ownership [skip ci] * [comment audit] trim provider controls and Linear filter explanations [skip ci] * [comment audit] clarify pairing and chat resume lifetimes [skip ci] * [comment audit] clarify chat delivery and transcript lifetimes [skip ci] * [comment audit] clarify session options and host-owned status [skip ci] * [comment audit] clarify draft durability and live-status precedence [skip ci] * [comment audit] Trim chat send and model ownership explanations [skip ci] * [comment audit] Shorten transcript ownership and send recovery comments [skip ci] * [comment audit] Simplify native chat composer and transcript hook comments [skip ci] * [comment audit] Shorten native chat scroll and structured session explanations [skip ci] * [comment audit] Trim workspace picker and onboarding commentary [skip ci] * [comment audit] Simplify pet rendering, review cache and quick open comments [skip ci] * [comment audit] Trim sidebar and session history explanations [skip ci] * [comment audit] Condense session resume and review checks comments [skip ci] * [comment audit] Shorten checks state and file explorer refresh comments [skip ci] * [comment audit] Trim plugin bridge and source-control action rationale [skip ci] * [comment audit] Trim source-control listing and review rationale [skip ci] * [comment audit] Shorten sidebar lifecycle and explorer safeguards [skip ci] * [comment audit] Condense Settings account and appearance rationale [skip ci] * [comment audit] Trim pairing and repository Settings explanations [skip ci] * [comment audit] Condense Settings search SSH and terminal safeguards [skip ci] * [comment audit] Shorten Settings voice and provider ownership comments [skip ci] * [comment audit] Condense Settings draft persistence and host-state rationale [skip ci] * [comment audit] Trim Settings hooks and sidebar setup rationale [skip ci] * [comment audit] Condense sidebar deletion and board-filter safeguards [skip ci] * [comment audit] Condense worktree cards, host ownership and Markdown contracts [skip ci] * [comment audit] Condense sidebar drag, folder and filtering contracts [skip ci] * [comment audit] Condense sidebar parity, sleep and host ownership contracts [skip ci] * [comment audit] Prune focus-read baseline after comment cleanup * [comment audit] Clarify sidebar visibility, board drops and agent evidence [skip ci] * [comment audit] Tighten sidebar listing, drag and reveal contracts [skip ci] * [comment audit] Clarify viewport geometry and skill update safeguards [skip ci] * [comment audit] Tighten skill inventory, usage and host status comments [skip ci] * [comment audit] Clarify usage ownership and resource kill safeguards [skip ci] * [comment audit] Tighten tab selection, rename and search contracts [skip ci] * [comment audit] Tighten tab-strip geometry and drag ownership comments [skip ci] * [comment audit] Tighten Tasks recovery, pagination and mutation comments [skip ci] * [comment audit] Tighten provider loading and terminal recovery comments [skip ci] * [comment audit] Tighten completion, cadence and PTY ownership comments [skip ci] * [comment audit] Clarify terminal restore and parked-pane boundaries [skip ci] * [comment audit] Tighten PTY startup and replay explanations [skip ci] * [comment audit] Clarify PTY identity and delivery ownership [skip ci] * [comment audit] Shorten remote reconnect and input replay rationale [skip ci] * [comment audit] Condense terminal parking clipboard and file link comments [skip ci] * [comment audit] Clarify IME ownership and trim trace history [skip ci] * [comment audit] Shorten pane recovery and parked watcher explanations [skip ci] * [comment audit] Condense snapshot replay and visibility recovery rationale [skip ci] * [comment audit] Shorten terminal parking and keyboard ownership rationale [skip ci] * [comment audit] Trim renderer lifecycle and menu rationale [skip ci] * [comment audit] Condense workspace cleanup ownership and settlement notes [skip ci] * [comment audit] Clarify renderer hook evidence and source ownership [skip ci] * [comment audit] Tighten IPC ownership and reconnect explanations [skip ci] * [comment audit] Trim renderer focus, paste and attention comments [skip ci] * [comment audit] Shorten scroll, locale and agent lifecycle comments [skip ci] * [comment audit] Trim agent launch, resume and ownership commentary [skip ci] * [comment audit] Shorten account, browser and editor comments [skip ci] * [comment audit] Clarify host-mirror waits, previews and input ownership [skip ci] * [comment audit] Condense launch recovery and editor tokenization comments [skip ci] * [comment audit] Condense workspace selection and terminal pane rationale [skip ci] * [comment audit] Condense terminal fitting and rendering recovery comments [skip ci] * [comment audit] Condense terminal input and host routing explanations [skip ci] * [comment audit] Condense ownership and sleeping-session recovery rationale [skip ci] * [comment audit] Condense structured launch and terminal link explanations [skip ci] * [comment audit] Condense terminal ownership and workspace file routing rationale [skip ci] * [comment audit] Condense session persistence and workspace activation rationale [skip ci] * [comment audit] Condense workspace routing and browser ownership rationale [skip ci] * [comment audit] Condense mirror recovery and layout authority rationale [skip ci] * [comment audit] Condense runtime transport and file safety rationale [skip ci] * [comment audit] Condense runtime graph and structured session rationale [skip ci] * [comment audit] Condense browser creation and remote tab recovery rationale [skip ci] * [comment audit] Condense snapshot authority and publisher recovery rationale [skip ci] * [comment audit] Condense frame, startup and provider cache rationale [skip ci] * [comment audit] Condense host twin and agent lifecycle rationale [skip ci] * [comment audit] Condense browser authority and editor cleanup rationale [skip ci] * [comment audit] Condense editor buffer identity and review cache rationale [skip ci] * [comment audit] Condense provider lifetime and repository ownership rationale [skip ci] * [comment audit] Condense reconnect, hydration and terminal retirement rationale [skip ci] * [comment audit] Condense recovery, reconciliation and persistence rationale [skip ci] * [comment audit] Condense cleanup ownership and listing admission rationale [skip ci] * [comment audit] Condense teardown ordering and terminal ownership rationale [skip ci] * [comment audit] Condense recovery ledger and web host-boundary rationale [skip ci] * [comment audit] Condense web reconnect and credential lifecycle rationale [skip ci] * [comment audit] Condense cloud rollout and assignment safety rationale [skip ci] * [comment audit] Condense relay session and database recovery rationale [skip ci] * [comment audit] Condense relay placement and protocol compatibility rationale [skip ci] * [comment audit] Condense build and packaging constraints [skip ci] * [comment audit] Condense CI gates and validation isolation rationale [skip ci] * [comment audit] Condense catalog identity and browser validation rationale [skip ci] * [comment audit] Condense mobile browser and frame-budget rationale [skip ci] * [comment audit] Shorten mobile route and browser test explanations [skip ci] * [comment audit] Condense editor and session seam test rationale [skip ci] * [comment audit] Trim session and terminal closure history [skip ci] * [comment audit] Shorten terminal browser and census explanations [skip ci] * [comment audit] Preserve root-only E2E diagnostic baseline * [comment audit] Condense mobile seam and HTML preview test rationale [skip ci] * [comment audit] Condense preview instrumentation and render harness rationale [skip ci] * [comment audit] Condense bundle contracts and native-build constraints [skip ci] * [comment audit] Shorten native packaging and CI routing rationale [skip ci] * [comment audit] Condense release tooling and benchmark constraints [skip ci] * [comment audit] Condense packaging and platform gate rationale [skip ci] * [comment audit] Shorten mobile route and history rationale [skip ci] * [comment audit] Condense mobile browser and component rationale [skip ci] * [comment audit] Shorten drawer and workspace-form rationale [skip ci] * [comment audit] Trim mobile review and editor-document explanations [skip ci] * [comment audit] Condense editor lifecycle and Markdown explanations [skip ci] * [comment audit] Trim mobile file, diagnostics and dictation commentary [skip ci] * [comment audit] Simplify mobile host-list and workspace-view explanations [skip ci] * [comment audit] Clarify mobile shell lifetime and bridge delivery constraints [skip ci] * [comment audit] Condense bridge stream, native request and audio rationale [skip ci] * [comment audit] Reduce bridge schema and page-client commentary [skip ci] * [comment audit] Tighten mobile page bridge contracts [skip ci] * [comment audit] Clarify mobile cache and session constraints [skip ci] * [comment audit] Condense mobile route and lifecycle rationale [skip ci] * [comment audit] Tighten mobile shell hook timing rationale [skip ci] * [comment audit] Clarify route handoff and notification compatibility [skip ci] * [comment audit] Clarify push registration and dictation cleanup constraints [skip ci] * [comment audit] Condense keyboard geometry and native media ownership rationale [skip ci] * [comment audit] Tighten mobile chat scroll and composer concurrency rationale [skip ci] * [comment audit] Condense mobile reply compatibility and upload ownership rationale [skip ci] * [comment audit] Condense optimistic echo and scroll ownership rationale [skip ci] * [comment audit] Tighten stream replay and queued session ownership rationale [skip ci] * [comment audit] Condense mobile composer and reply-schema constraints [skip ci] * [comment audit] Clarify mobile transcript recovery and session ownership [skip ci] * [comment audit] Clarify mobile queue and source-control compatibility [skip ci] * [comment audit] Condense storage and task launch constraints [skip ci] * [comment audit] Clarify task schemas and terminal document ownership [skip ci] * [comment audit] Tighten terminal input and viewport rationale [skip ci] * [comment audit] Shorten terminal and RPC recorder contracts [skip ci] * [comment audit] Condense recorder engine and connection contracts [skip ci] * [comment audit] Shorten host credential and relay recovery comments [skip ci] * [comment audit] Tighten pairing recovery and bundle transport rationale [skip ci] * [comment audit] Clarify RPC delivery and workspace catalog boundaries [skip ci] * [comment audit] Condense catalog and relay entry contracts [skip ci] * [comment audit] Shorten shutdown and SSH relay delivery contracts [skip ci] * [comment audit] Condense WSL relay and E2E regression rationale [skip ci] * [comment audit] Shorten cross-version harness and renderer fixture explanations [skip ci] * [comment audit] Condense paired-host and E2E lifecycle rationale [skip ci] * [comment audit] Shorten layout oracle and regression explanations [skip ci] * [comment audit] Condense paired recovery and ownership regression contracts [skip ci] * [comment audit] Shorten restart, sidebar and SSH lifecycle contracts [skip ci] * [comment audit] Condense terminal rendering and IME regression rationale [skip ci] * [comment audit] Shorten terminal recovery and benchmark contracts [skip ci] * [comment audit] Condense tooling and Windows lifecycle proof rationale [skip ci] * [comment audit] Condense workflow routing and release rationale [skip ci] * [comment audit] Condense mobile security and installer contracts [skip ci] * [comment audit] Shorten native rationale and stylesheet workarounds [skip ci] * [comment audit] Shorten Windows visibility probe rationale [skip ci] * [comment audit] Condense embedded release and signing rationale [skip ci] * [comment audit] Retain current main test behavior in final reconciliation [skip ci] * [comment audit] Complete final comment review across current source inventory * [comment audit] Handle consolidated audit reports before final CI * [comment audit] Preserve credential storage census detail [skip ci] * [comment audit] Scale broad changed E2E selections with verified timing shards * [comment audit] Align E2E assertions with browser close and settled session metadata * [comment audit] Match existing E2Es to current resource and windowing contracts * [comment audit] Observe the shared server outage notice in reconnect coverage * [comment audit] Make existing renderer probes measure settled tab and PTY work * [comment audit] Align palette E2E selector with task search * [comment audit] Refresh remaining palette search selectors * [comment audit] Keep selector correction within selected audit specs * [comment audit] Await emoji fixture settings inside renderer evaluation * [comment audit] Cancel fixture fit retries between terminal tests --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…blyai#33513) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…ession (stablyai#33514) Hermes panes resume their own conversation after an Orca restart: record the Hermes session id from Orca's Hermes plugin hooks and relaunch with `hermes --resume <id>` (remote hosts gated on agent-session.hermes-resume.v1). Delegate-child hooks no longer replace the pane's session id. Fixes stablyai#15808 Supersedes stablyai#31327, stablyai#15809, stablyai#12075 Co-authored-by: tomaszamoranoq <268064671+tomaszamoranoq@users.noreply.github.com> Co-authored-by: Yi Lok Enoch Lam <22125285+eloklam@users.noreply.github.com> Co-authored-by: GoodFarming <34622709+GoodFarming@users.noreply.github.com>
* test: remove mock-only cases and repair audit fixtures * test: use checked upload fetch mocks * test: assert upload MIME on actual multipart wire bytes --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…blyai#33518) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…chat runtime isn't installed (stablyai#33520) When Antigravity's Orca-managed chat runtime isn't installed, default-chat launches (orchestration workers, agent.launch from CLI/mobile/automations) fall back to a terminal running agy with reason chat_runtime_not_installed instead of failing at terminal_create; an explicit --surface chat is refused with an install hint. Desktop chat tabs still show the install card. Fixes stablyai#30973
…estart restores them (stablyai#33523) A woken sleeping agent keeps its launch config (flags like permission mode, model, custom args) so a later Orca restart restores it with the same flags; consuming the sleeping record no longer deletes the pane's launch config (retirement and launch-token/session matching still govern it). Supersedes stablyai#31756 Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
* test: strengthen CLI and mobile behavior checks * test: prune resolved host-edit wall-clock allowance --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test: strengthen CLI errors and mobile lifecycle checks * test: use preferred callback array type notation --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…tablyai#33534) Main built its copy of a hidden pane from the renderer's xterm at the phone's 1000-row limit, and the hidden-output reveal repaints the pane from that copy, so a restored pane with more history lost all but its last 1000 rows on first reveal.
…tablyai#33517) Claude panes show Needs You while a Claude Code MCP server's elicitation dialog is open: install Claude's Elicitation/ElicitationResult hooks (>=2.1.63), map Elicitation to waiting and restore the pre-dialog state on ElicitationResult (done when there is no prior record). Fixes stablyai#25020 Supersedes stablyai#25057 Co-authored-by: Wooseong Kim <2222333+innocarpe@users.noreply.github.com>
…lyai#33428) * fix(worktrees): one host's git status no longer rewrites a same-path twin's branch (stablyai#32918) * fix(worktrees): match a twin through its runtime alias and persist its review clear on the same copy * fix(worktrees): keep the id-only patch for a lone copy; background refreshes refuse an unplaced twin * fix(worktrees): a twin's identity patch skips the id-keyed review clear instead of reaching its sibling * fix(worktrees): count runtime provenance when finding twins; Source Control refresh refuses an unplaced twin * fix(worktrees): a twin's branch switch clears its own push target and review link on its host * fix(worktrees): a twin's review clear keeps its stale-refetch guard and relink check, scoped to its own copy * fix(worktrees): a twin tombstone names its full owner, and detected rows are stamped before sanitizing * fix(worktrees): each twin copy keeps its own review-clear tombstone * fix(worktrees): a rename carries each twin copy's review-clear tombstone * fix(worktrees): a copy's tombstone from its twin days still drives its clear retry * chore(worktrees): name why the existing review-link cast is safe * fix(worktrees): one resolver names the copy for every git-identity read and write * fix(worktrees): a Create PR run refuses when its copy no longer resolves; local null stays local * fix(worktrees): an unselected twin stays unplaced; a legacy row's guard survives its first stamp * fix(worktrees): a Create PR run keeps the copy it pinned at start; a legacy row's relink drops its stamped guard * fix(worktrees): key review clears by the full stamp the next listing gives the row * fix(worktrees): fill only missing stamp parts when keying review clears * fix(worktrees): stamp review-clear keys from repo registrations, not the focused host * fix(worktrees): a local row keeps its review-clear guard when discovery stamps it local * fix(worktrees): stamp review-clear keys from the sole repo registration first * fix(worktrees): a runtime-hosted copy's owner key ignores backfilled provenance * fix(worktrees): Create PR and post-generation refresh read the pinned copy's push target * fix(worktrees): a lone copy's push target still answers when the host index misses * fix(worktrees): the push-target fallback accepts only an unstamped lone copy for a named host * fix(worktrees): only SSH copies borrow a registration's provenance for review-clear keys
…s start folder (stablyai#33527) Resumed Claude/Codex agents come back in the folder they were started in: resume records save the agent's starting cwd from hooks (kept within a session and across Claude /clear and compact), persist it, and resume as `cd <folder> && <agent> --resume <id>` when it differs from the workspace root. A deleted folder now fails loudly at the cd instead of silently resuming in the root. Fixes stablyai#16960 Refs stablyai#15485
…emp path (stablyai#33540) On macOS the temp dir sits behind the /private symlink and the runtime stores the resolved path, so two existing-folder tests failed locally. realpath is a no-op on Linux CI.
…3538) * test: strengthen transport lifecycle and benchmark checks * test: attach mock cast rationale to the reported assertion --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
… waiting for Claude, not signed out (stablyai#33542) An idle saved Claude account whose ~8h access token lapsed (Orca never refreshes Claude logins; the CLI does on its next run) keeps its last-good usage for up to 24h and reads "Updates when Claude runs" instead of "signed out". Logins that can't recover (no refresh token, expired refresh token, or a revoked 401) still ask to sign in again, and the status bar keeps its warning icon when shown usage is over 30 minutes old. Kept snapshots drop windows whose reset has passed. Fixes stablyai#30289 Supersedes stablyai#31105 Co-authored-by: luijoc <96428056+luijoc@users.noreply.github.com>
…cribes (stablyai#33537) * fix(terminal): keep desktop history in main's copy after a phone or paired desktop subscribes A phone subscribe rebuilt main's hidden copy of a pane from the phone snapshot (at most 1000 rows, or the screen alone under the byte budget), so a later desktop reveal repainted the pane truncated again. Seed the copy from a desktop-depth renderer read of the same sequence instead, falling back to the phone snapshot if the renderer moved on. Paired desktop clients' initial snapshot now carries desktop depth within the 2 MB requested-snapshot budget, matching what their reveal snapshots already allow; phones keep 1000 rows and 512 KB. The headless emulator's default scrollback now names the shared desktop default. * fix(terminal): publish the phone recovery before deepening main's copy The desktop-depth read ran before the late-renderer recovery's sequence check, so output during that read aborted the phone recovery and left the phone blank. Keep the original order (check, seed from the phone snapshot, publish) and deepen main's copy afterwards, only while no output has followed. Paired desktop initial snapshots keep a margin under older clients' 2 MiB cap (1.75 MiB) and step down through 2500 rows. * revert(terminal): keep paired desktop initial snapshots at 1000 rows Deeper first snapshots cost every pane on every reconnect; a lazy background top-up is the follow-up design. This PR keeps the phone recovery's hidden-copy fix and the shared scrollback default. * test(terminal): build the late-renderer runtime fake with checked types
…stablyai#23840) * perf(mobile): a streaming reply re-renders only the rows that changed Every structured-chat batch rebuilt the mobile transcript: the fold cloned each historical tool run, image and echo rows rebuilt their blocks, each settled turn's status object was rebuilt, and the list's renderItem changed identity, so every mounted row re-rendered per batch. Move the desktop list's by-id row reuse into src/shared and apply it to the mobile list rows and to their derived turn props, and turn on FlatList strictMode so a stable renderItem skips unchanged cells. * perf(mobile): resolve native chat row props only when rows or turns change The view re-renders on every composer keystroke; the row-props pass walked the whole loaded transcript each time. Also drop a test that pinned a limit rather than behavior, and a turn-status comment the row reuse made stale. * refactor(native-chat): type the shared row reuse comparison * perf(native-chat): compare rebuilt block lists with an index loop Folding hands each tool-run assistant row a new block list every batch. Walking that list as a generic object allocated Object.keys arrays for both sides; comparing two arrays by length and element skips that. * fix(mobile): carry the not-sent notice through the reused chat rows Main added a per-row not-sent notice (stablyai#27936) after this branch's row reuse; it now travels in each row's reused props, so a rejection arriving redraws that row. Row reuse also compares only plain objects and arrays by value: a Set (the open subagent groups) keeps its contents off its own keys, so two different Sets read as equal and a toggled group kept its stale state. Restores the row-renderer hook and the shared message comparison the branch's merge commits carried. * perf(native-chat): keep the desktop list's row comparison as it was The deeper value comparison is only needed for mobile's re-derived rows; the desktop projection goes back to comparing block identity. * Restore main's files the pre-commit formatter rewrote during the merge * Allow the FlatList strictMode augmentation's interface * Pass FlatList strictMode through a spread instead of a type augmentation * Measure streaming row churn on the phone page against main * Keep unchanged phone chat row inputs stable during streaming * Project full-message recovery context with each phone chat row * Cover recovery updates and stale requests in streaming row contract * Inspect row messages through their recovery provider in view tests * Use a type-only module import in the recovery mock * Preserve chat recovery identity and skip unchanged row derivation * Keep transcript reuse at mounted rows and publish current recovery * Remove duplicate React type import from transcript parity test * Use static type imports in transcript streaming tests * Complete the streaming recovery output fixture * Temporarily expose failing mobile test compiler diagnostics * Correct streaming test callback and selector types --------- Co-authored-by: Neil <neil@stably.ai>
…lient in the background (stablyai#33828) Rolldown defaults to 1.5x physical cores Tokio workers plus a Rayon pool per logical CPU (24+24 here). Capping both at 8 on >8-core hosts cuts electron-vite build CPU 24% with byte-identical output. pnpm dev no longer blocks on a stale pairing web build; it stages into out/.web-next and swaps on success. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…lyai#33392) * fix(native-chat): remove misleading usage-limit Continue action Keep limit warnings, reset times and provider details without offering an immediate continuation or adding manual continuation guidance. Preserve restart-interruption Continue and provider detection. * fix(i18n): sync runtime catalog for removed notice fallback * fix(i18n): remove unused usage-limit action translations * test(native-chat): cover historical usage-limit wording * test: admit historical notice fixtures through journal reader * test(mobile): admit the old-host usage-limit fixture through the journal reader --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* Fix Codex goal Stop and selected model settings * Preserve settings evidence and captured Stop outcomes * Preserve refused goal pauses and bound Stop retry diagnostics * Use checked settings state in goal contract tests * Narrow captured Stop child and type its timing fixture * Coordinate Stop timing fixture with deferred phases * Fix typed mobile warning icon assertion * Align Stop tests with reconciled controls and owned shutdown * Check integration attach parameters without a type cast * Match restart offer close calls to optional observer contract
…tablyai#33834) Tests leak os.tmpdir() fixtures broadly (8.6k dirs from repeated prefixes on one shared dev host; orca-runtime-rpc alone 2,729). run-vitest.mjs now points TMPDIR/TEMP/TMP at a marked per-run dir, removes it after Vitest exits (including on SIGINT/SIGTERM), and sweeps marked dirs whose launcher died. On POSIX a root longer than 50 chars (macOS /var/folders) falls back to /tmp so Unix socket paths stay under sun_path limits. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…tablyai#33835) Local panes printed '[Orca skipped hidden terminal output because main recovery was unavailable.]' inside idle Codex/Claude Code frames and it stayed until a workspace swap, because the one-row redraw nudge from stablyai#31482 only ran for remote PTYs. Differential TUIs never rewrite cells they believe unchanged, so the banner row persisted. Local PTYs now get the same nudge, restoring the row on a timer since local main sends no desktop-fit confirmation.
…tablyai#33833) Concurrent new-PTY resolver probes shared the 'resolver-health-check' clientId, so the daemon evicted the older probe's control socket and that probe waited out the 3s timeout before its terminal could spawn. Use a per-probe UUID clientId and settle as 'unknown' as soon as the probe socket closes. Fixes stablyai#27751 Co-authored-by: outof-place <contact@outofplace.space>
…tablyai#33820) Each desktop socket to a WSL host's orcad, and the liveness watch, ran a Node process in the distro just to copy bytes (~42-50 MB RSS each). A bash /dev/tcp relay does the same with bash and two cats (~4.5 MB). The Node bridge stays as the fallback for hosts without bash 4.3+ or /dev/tcp and for refused dials, so refusal and missing-runtime signals are unchanged. SSH hosts keep the Node bridge.
…rvers (stablyai#33845) Only desktop requests reach a host's scanner child, which holds ~60 MB of RSS even idle, and the 10-minute default kept it alive most of the time. orcad now sets a 60 s idle timeout; the desktop keeps its default.
… mimalloc purge) (stablyai#33836) * perf(dev): size the dev server's Rolldown runtime for many parallel instances ~93% of idle electron-vite RSS is Rolldown's native mimalloc arenas. The dev wrapper now gives electron-vite MIMALLOC_PURGE_DELAY=0 and 4 Rolldown/Rayon threads; a serve-only renderer plugin strips exactly those keys before Electron spawns, so dev Orca's terminals never inherit them. * fix(dev): add the runtime-env plugin only when the dev wrapper set its keys Keeps createDevServeConfig returning the renderer config unchanged when there is no port and nothing to strip, as electron-vite-output-contract pins. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…ses (stablyai#33848) A killed Vitest left its node-runtime worker running the rest of the file (still alive after 150s). Exit on 'disconnect' with process.exit captured before Vitest replaces it with a throwing guard. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Grok's installer defaults to ~/.grok/bin and only symlinks into ~/.local/bin when that dir is already on PATH. A GUI-launched Orca never looked in ~/.grok/bin, so the Agents page reported Grok as not installed. Append ~/.grok/bin after ~/.vite-plus/bin in the three lists that must stay in step: the packaged PATH seed, the system install-dir lookup fallback, and the POSIX/WSL guest fallback prelude. Fixes stablyai#17590 Co-authored-by: brynnclaw <261708852+brynnclaw@users.noreply.github.com>
…stablyai#33783) * fix(terminal): answer queries in ACK-pending output a paused paired view discards Refs stablyai#32944 * fix(terminal): capture yielded-query ownership at ingestion and cap reply age Refs stablyai#32944 * fix(terminal): settle yielded queries by their own end seq across split frames Refs stablyai#32944 * test: use a fixed timestamp in the yielded-query responder test * test(cross-version-wire): stub yielded-query runtime methods on the host runtime Refs stablyai#32944
stablyai#33027) * test(e2e): a pane moved to a new tab on a paired server workspace stays moved * fix(terminal): keep a pane moved to a new tab on paired runtimes Moving a split pane to a new tab in a paired-runtime worktree changed only the window store. The host never learned about the move, so the next host snapshot rebuilt the old tab and the pane snapped back. Add a session.tabs.movePaneToNewTab RPC that commits the move in the host session through planTerminalLeafMove and republishes the session tabs. For a mirrored host tab, the renderer applies the move first under the mirrored id the host snapshot will use, then asks the host to commit it. An older host or a refused move falls back to the old local-only move. Fixes stablyai#32939 * fix(terminal): commit a host pane move through the existing leaf-move writer The layout-writer ratchet allows no new main-process layout writers. The headless host now hands the move to commitLeafMoveAndRekey, the same commit a local window uses, and keeps only the window check, validation, rehydrate and notify. * fix(terminal): gate the host pane move on a host capability An older host keeps today's window-only move under a local tab id instead of a mirrored one it never confirms. Adds a terminal.list check to the e2e. * test: drop type assertions from the pane-move tests * fix(terminal): the host keeps a moved pane's place, focus and live terminal After the host commits the move, the window gives it the drop position and focus through the existing tab move and activate calls; a refusal redraws the host's tabs. The host moves the live PTY's surface with its pane and checks the target tab id. The move lives in its own runtime module. * fix(terminal): hold a moved pane's drop order until the host has it The host's snapshot of the commit goes out before its reply and appends the tab, so the window records the drawn order as a reorder intent at the drop and sends that order, and the focus read then, once the host answers. * fix(terminal): route the moved tab's reorder to its owning host The follow-up names the worktree's host instead of reading the active-server setting (focus-read ratchet); the e2e narrows host rows to terminal tabs. * fix(terminal): the host places a moved pane's tab in the move itself; a refusal reverts The move carries the drop's group and index (optional; an older host appends) and the host places and selects the tab before its one publish, replacing the follow-up reorder and the drop-time order hold. A refused move closes the tab this window drew without stopping its terminal and redraws the host's tabs even when unchanged. E2e covers a same-group drop and a refusal; host unit tests cover same-group and cross-group placement. * fix(terminal): a refused pane move keeps its pane records; drop index in host order The revert hands the pane's status and launch records back to the source tab before closing the drawn tab. The host turns a projected client's drop index into its raw order with translateProjectedSessionTabMove, as session.tabs.move does. * fix(terminal): only an unknown drop group appends a moved pane's tab The host catches only target_group_not_found and invalid_tab_order from the index translation and rethrows anything else. * fix(terminal): settle a pane move by what the host holds when its reply is lost A lost reply is not a refusal: the window asks the host whether it holds the pane in the new tab before undoing anything, and waits for the next snapshot when it cannot ask. A move the host committed but this window could not draw takes the host's tabs. * fix(terminal): a lost transport on a pane move is unknown, not a refusal runtimeEnvironments.call answers a dropped or overloaded transport with an error envelope; those codes (the shared recoverable set) now ask the host instead of undoing a move it may have committed. * test(e2e): pane-move spec waits on real signals, not delays The source tab is created on the server and split once its shell is listed, so the split no longer races a desktop-seeded tab's first spawn (the CI failure). The stay check follows output from the moved pane; the refusal check waits for the drawn tab to appear and go. * test(e2e): read the refused move's tab counts without Reflect (anti-slop) * fix(terminal): a moved pane's tab joins the order the user had, not a rebuilt one The host inserts the new tab into the group order captured before the commit, appending without a drop position, so editors and pages keep their places. The shared group-move fallback is no longer used here. * fix(terminal): a moved pane's groups hold the host's current tabs, in the user's order Placement takes membership from the rebuild after the commit and only the order from before it, so a tab opened while the commit was pending stays (after the user's tabs) and no stale id is written. * fix(terminal): a moved pane's placement keeps a reorder made while it committed The order is read after the commit, from the host's current tabs, not before it. * fix(terminal): a moved pane keeps the lone group the user merged into A rebuild names a single group with the default id; placement keeps the user's id for it, so the drop position still applies after a split was merged back. * fix: import error classification from its new shared/remote-runtime path * fix(terminal): a pane or divider drag survives focus moving inside the window The drag's window blur listener was registered in the capture phase, so it also heard every element blur. A terminal attach or host snapshot that moved focus between panes mid-gesture ended the drag; in the paired pane-move e2e on CI it cancelled the drag before the drop. Only the window losing focus ends it now. * test: drive the focus-change drag test through a real pane manager, without casts * fix(terminal): a headless host moves a pane with its live terminal and never empties its source The host names the PTY it holds for the pane, so a session copy an SSH respawn left with an old id no longer refuses the move as a mismatch. A move that would leave its source tab with no pane (a sibling closed meanwhile) is refused, since no headless cleanup retires the emptied tab and it would publish as a phantom. The e2e fences its stays-moved check on a later server rename instead of sampling on a timer. --------- Co-authored-by: Ben Grynhaus <ben.grynhaus@wiz.io>
…blyai#29832) * fix(wsl-host): bind a WSL host record to its pairing's server key (R31) A valid but stale record could overlay WSL hosting onto a different loopback server re-paired under the same environment id and bridge port. The record now carries the paired orcad's host key; the overlay ignores a record whose key differs from the pairing's. Add writes the key and a pairing refresh rewrites it with the ports, so a relaunch that changes the key still matches. Records written before carry no key and keep port-only binding until their next refresh. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-host): validate a refreshed pairing before writing, and accept the previous key mid-refresh Review: the refresh wrote the record's new key before validating the pairing, so a refused or interrupted refresh could leave a real WSL host without its overlay. Validate first, and keep the replaced key as previousPairingPublicKeyB64 so the record stays bound across the two writes. Co-Authored-By: Claude <noreply@anthropic.com> * test(wsl-host): use a key distinct from the fixture's own in the R31 overlay tests Main gave the WSL fixture its own pairing key (stablyai#30676), the same one these tests used as the 'other server' key, so both cases inverted after the rebase. Production code is unchanged. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
stablyai#33819) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…hen its connect hangs (stablyai#33865)
…ps failing (stablyai#33841) * fix(agent-awake): keep sleep-assertion failures warn-once across respawns A successful spawn reset the failure streak, so a systemd-inhibit or caffeinate that exits right away re-warned on every 30s retry. * fix(agent-awake): back off sleep-assertion retries after consecutive failures * test(agent-awake): dispose the real-timer assertion
…, −75 MB after bursts) (stablyai#33837) * perf(daemon): cap the terminal daemon's young generation Idle terminal polling in the daemon allocates a few MB/s of short-lived strings (process-table captures), and V8 answers by growing the young generation to its 64 MB semispace maximum. Nothing is retained (heapUsed returns to ~12 MB after GC), but the committed semispaces held ~120 MB of resident memory per daemon. Launch the daemon with --max-semi-space-size=4 on the fork, direct and extracted-AppImage paths. The flag goes on the command line, not NODE_OPTIONS, because PTYs inherit the daemon's env. * perf(daemon): pass the young-generation cap through the macOS launchd job Release macOS builds start the terminal daemon from the signed helper bundle through a launchd job, not the fork path, so the flag must be in its ProgramArguments too. --------- Co-authored-by: m4air <m4air@Mac.localdomain>
…oo (stablyai#33829) A visible local shell pane with no agent evidence was inspected every 2 s forever. Each inspection is a full-system `ps -axo ...,tty=,lstart=,command=` capture in the terminal daemon (0.155 s of CPU at ~1,100 processes, ~1.15 s at ~1,950), which also churned ~2.7 MB/s of short-lived strings and grew the daemon's young generation to ~120 MB resident. Apply the existing no-evidence cadence (15 s while quiet; output, title or hook activity re-arms 2 s for 10 s; agent evidence returns to the active/idle tiers) to local POSIX panes, as it already is for Windows and remote panes. Co-authored-by: m4air <m4air@Mac.localdomain>
…tablyai#33786) V8 stores a script source as UTF-16 when any character is above U+00FF, so a single em dash in a hot chunk doubled that chunk's resident source. Emit ASCII (escaped) output for main, preload, renderer and worker bundles, escape the CJK sentence marks in the prose URL regex source, and fail the renderer boot-graph check if a boot chunk regresses to two-byte. Co-authored-by: m4air <m4air@Mac.localdomain>
…tablyai#33810) Monaco's TypeScript WorkerManager has no idle stop, so viewing a single .ts file kept a ~40 MB language worker alive for the rest of the session. After 60 s with no typescript/javascript model, re-apply the current compiler options, which makes Monaco dispose the worker; the next TS/JS model starts a fresh one lazily. Co-authored-by: m4air <m4air@Mac.localdomain>
…ver save (stablyai#33864) * fix(runtime): recover from a NUL-filled server list instead of blocking every save Fixes stablyai#18766 * fix(runtime): recover only crash-zeroed server lists; keep removal proofs fail-closed * fix(runtime): copy the blank server list aside on write instead of renaming it on read * fix(runtime): recover a crash-zeroed server list only when saving a server Plain reads stay fail-closed so startup cleanup cannot treat the zeroed file as 'every server was removed'; saving copies the bytes aside and publishes an empty store only if the file is still blank. * fix(runtime): publish the recovered server list only together with the saved server A failed save now leaves the zeroed file in place instead of an empty registry that startup cleanup would read as 'every server was removed'. * fix(runtime): let SSH and WSL server setup save over a crash-zeroed server list Their duplicate and conflict pre-checks read the list before the add and threw on the zeroed file. The blank-file backup is now taken only once the write is attempted. * test(runtime): give the fsynced interleaving property test room on slow disks * test(runtime): run three guard-killing seeds instead of raising the interleaving timeout The fsync on every store write made 40 seeds x 40 steps slow; seeds 1, 6 and 8 each fail when one of the three guards this test protects is removed.
…eady painted (stablyai#33766) (stablyai#33880) Main seeds its terminal model from the renderer's xterm and queues live chunks behind the seed. The renderer keeps parsing those chunks while it serializes, so they were in the seed and then written again, doubling TUI frames and splitting escapes (literal ';242m'). Hidden-pane reveals repaint from this model. Skip queued chunks at or below the seed's seq and carry any unfinished escape into the next chunk.
…ai#33876) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…n Linux (stablyai#33878) * feat(serve): keep macOS serve out of the Dock and opt in to the GPU on Linux On macOS, orca serve now runs as an accessory app with no Dock icon or Cmd-Tab entry, and gets them back only while it hosts a desktop window. On Linux, ORCA_SERVE_GPU=1 keeps hardware acceleration on for hosts that expose a GPU to the server. * fix(serve): restore the Dock only for real launches, after window services resolve Gate the restore on any background or E2E launch, since dock.show() activates the app, and run it just before the window is created so a services failure cannot leave a windowless Dock tile. Say in the docs what the GPU opt-in can't do on Orca's own Xvfb.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
1 task done
Author
|
Superseded by #58: head |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ELI5
Upstream Orca moved forward 210 commits since yesterday's sync (#56). This PR proposes merging them into
swaplabs/mainstraight from the fork's mirrormain.What Changed
Upstream range
0571e45107..33ddab70b7, 210 commits (compare). The head is the fork's mirrormain, so the PR adds no fork commit.A read-only
git merge-treeof33ddab70b7intoswaplabs/main(48d48683c3) reports 31 content conflicts, so this PR is expected to beCONFLICTING; the automation then moves the merge to async/upstream-20261026branch and closes this PR as superseded:config/electron-builder.config.cjsconfig/flaky-test-pattern-baseline.txtsrc/main/runtime/session-lifecycle/projection/restored-pane-materialize.tssrc/main/startup/first-window-deferral.tssrc/main/updater-prerelease-feed.test.tssrc/main/updater-prerelease-feed.tssrc/main/updater/updater-build-selection.tssrc/main/updater/updater-check-failure.tssrc/main/updater/updater-menu-checks.tssrc/main/updater/updater-release-feed.tssrc/main/updater/updater-scheduling.tssrc/renderer/src/components/settings/GeneralUpdateSettingsSection.tsxsrc/renderer/src/components/settings/ReleaseChannelSection.tsxsrc/renderer/src/components/settings/settings-project-list.tssrc/renderer/src/components/sidebar/RemoveFolderDialog.tsxsrc/renderer/src/components/sidebar/ssh-host-remove-workspaces.tssrc/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.tssrc/renderer/src/components/terminal-pane/pty-connection/pty-input-forward.tssrc/renderer/src/lib/workspace-session-host-persistence.tssrc/renderer/src/lib/workspace-session-host-split.tssrc/renderer/src/store/slices/agent-status/agent-status-live-facts.tssrc/renderer/src/store/slices/agent-status/agent-status-sleeping-records.tssrc/renderer/src/store/slices/repos-remove-missing-remote-project.test.tssrc/shared/agent-hook-listener.tssrc/shared/agent-hook-relay.tssrc/shared/release-channel.test.tssrc/shared/release-channel.tssrc/wsl-guest/agent-hook-request.tssrc/wsl-guest/agent-hook-server-contract.tssrc/wsl-guest/agent-hook-server.tssrc/wsl-guest/wsl-agent-hook-relay.tsWhy
Daily upstream sync.
Linked Issue
N/A: daily upstream sync.
Visual Proof
N/A: upstream code only.
Testing
None on this head:
mainis the mirror and takes no commits. Validation happens on the sync branch.AI Disclosure
Prepared by the "Orca upstream sync" automation (Claude Code, Claude Opus 5.5).
Agent skill upstream boundary
Notes
orca-fork-ops statusforswaplabs/main(48d48683c3) against upstream33ddab70b7:LOCAL:prefix and no upstream PR.Upstream release tag
v1.4.241was copied to the fork.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.