Repository navigation
sync: upstream stablyai/orca bd2f4635 (2026-10-26) - #40
Merged
Merged
Conversation
…#33491) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…start (stablyai#31311) (stablyai#33489) Kimi sessions keep resuming across repeated Orca restarts: register Kimi's SessionStart hook (matcher ^resume$, so new sessions pay nothing) and map a resume to an idle session-start status that refreshes the resume record; recognise npm-installed Kimi (node_modules/@moonshot-ai/kimi-code/dist/main.mjs) on Windows so the pane isn't mistaken for a shell. Fixes stablyai#31311
…term relay (stablyai#33495) Release queued startup input when a figterm-style relay (Kiro CLI's kiro-cli-term) exec-replaces the shell: if the pane's foreground process isn't a shell, accept a direct child that is the expected shell, foreground on its own tty, at an editable prompt. Startup with Kiro shell integration drops from a 15s timeout to <1s. Fixes stablyai#25586 Supersedes stablyai#25899 Co-authored-by: ggbdpq <67929842+ggbdpq@users.noreply.github.com>
…tablyai#33493) Codex sessions launched from an Orca-managed account home now honor the user's global ~/.codex/rules exec-policy files: each regular global .rules file is copied in as rules/_orca-global-<name> on launch (sorted before the account's own files so its saved decisions still win last-one-wins rules); approvals keep saving to the account's default.rules. Fixes stablyai#24431 Co-authored-by: Yuichi Uemura <82369+u-ichi@users.noreply.github.com>
…reattached (stablyai#33494) After Wake the window paints the restored history and then blanks its viewport, so the new shell's prompt starts on a clean screen. The daemon's own copy of the screen, seeded with the same history, skipped that step. A later reattach (a reload, a second window, the phone) therefore showed the new prompt beside the dead shell's last one: `p7/sub$ orca@awin:~/projects/p7$` (awin verify-11). The seed now ends with the same viewport blanking the window writes, built by one shared function, after the process-boundary ground, which still never moves the cursor. Co-authored-by: Claude <noreply@anthropic.com>
…lder when slept (stablyai#33496) After an app relaunch, the window reattaches a live pane without its spawn environment, so the daemon client never learned the pane's ORCA_PANE_KEY. Sleep then skipped the folder read for it, and the pane woke at its spawn folder. A move's kill-at-quiesced rollback also put a pane `cd`'d before the relaunch back at the project root (awin verify-11, 5e). Sleep now takes the pane key from the daemon's session list when it knows the session's distro but not its key. That is the same one `listSessions` the adoption of an unattached session already uses. Co-authored-by: Claude <noreply@anthropic.com>
…lyai#33498) * test: remove redundant checks and strengthen runtime assertions * test: prune resolved real-time wait baseline --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…ker's first dispatch (stablyai#33499) dsh worker dispatches (and other dsh agent-prompt sends) now get stablyai#33316's bounded Enter retry: dsh paints its launchpad before its session opens and refuses the first Enter with "still starting", so a fresh worker's task sat unsent. The retry only re-presses while the launchpad still holds the same prompt and stops once a turn starts. Fixes stablyai#30778 Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
…ine tail kept after the TUI erased it (stablyai#33485) A Codex (or Antigravity/Cline/Prime Agent) dialog drawn and erased in place no longer leaves the pane "blocked" forever when no hook/OSC 7501 clears it. The line tail still decides; the live screen may only clear a tail block when caught up, quiet 3s, no blocker anywhere on screen, and the agent's composer is ready — then the stale block stamp is cleared so the send's own echo doesn't re-block. Also defers the daemon re-attach seed's output sequence until the seed lands. Fixes stablyai#24187 Supersedes stablyai#24308 Co-authored-by: Wooseong Kim <2222333+innocarpe@users.noreply.github.com>
…#33503) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…d only by the login shell (stablyai#33506) Claude history, usage, native-chat lookup and worktree-retirement discovery now include the user's own CLAUDE_CONFIG_DIR read from the login shell, so sessions in a custom config folder show up even when Orca was launched from the Dock. Refs stablyai#23505
) * [comment audit] Align legacy failure-read counts with cached display * [comment audit] Condense shared provider lifecycle and browser recovery comments [skip ci] * [comment audit] Condense shared generation, path and preview comments [skip ci] * [comment audit] Condense host, file and Git contract rationale [skip ci] * [comment audit] Tighten Git lifecycle and provider contract comments [skip ci] * [comment audit] Clarify shared host authority and launch isolation [skip ci] * [comment audit] simplify local access mobile and native chat contracts [skip ci] * [comment audit] simplify native chat presentation and state contracts [skip ci] * [comment audit] simplify native runtime and provider contracts [skip ci] * [comment audit] simplify migration and orchestration contracts [skip ci] * [comment audit] simplify plugin trust and process capture rationale [skip ci] * [comment audit] simplify terminal delivery and remote compatibility rationale [skip ci] * [comment audit] clarify remote recovery and launch wire rationale [skip ci] * [comment audit] shorten shared RPC compatibility and runtime evidence comments [skip ci] * [comment audit] simplify secure storage shell startup and sidebar rationale [skip ci] * [comment audit] clarify sidebar, skill and SSH invariants [skip ci] * [comment audit] condense structured chat delivery and timing rationale [skip ci] * [comment audit] condense terminal replay and telemetry invariants [skip ci] * [comment audit] clarify launch permission and terminal delivery rationale [skip ci] * [comment audit] clarify workspace ownership and layout contracts [skip ci] * [comment audit] wait for fitted and painted SSH terminal links * [comment audit] clarify layout persistence and session ownership [skip ci] * [comment audit] clarify host routing and workspace lifecycle contracts [skip ci] * [comment audit] clarify startup persistence and app lifetime comments [skip ci] * [comment audit] clarify recovery and activity boundaries [skip ci] * [comment audit] condense activity and artifact invariants [skip ci] * [comment audit] condense automation authority contracts [skip ci] * [comment audit] simplify automation scheduling and history contracts [skip ci] * [comment audit] clarify browser chrome and annotation lifecycles [skip ci] * [comment audit] clarify browser routing and retained guest ownership [skip ci] * [comment audit] clarify browser recovery and document ownership comments [skip ci] * [comment audit] restore hosted runners required by native IME fixtures * [comment audit] shorten preview, palette and dashboard invariants [skip ci] * [comment audit] clarify terminal preview, dashboard and retention comments [skip ci] * [comment audit] clarify diff-note recovery and editor lifecycle comments [skip ci] * [comment audit] shorten rich-text and combined-diff ownership comments [skip ci] * [comment audit] shorten autosave, draft recovery and model ownership comments [skip ci] * [comment audit] shorten save-queue, notebook and Markdown constraints [skip ci] * [comment audit] shorten Monaco, PDF and rich Markdown safeguards [skip ci] * [comment audit] clarify rich Markdown source and selection safeguards [skip ci] * [comment audit] clarify editor loading and emulator stream lifetimes [skip ci] * [comment audit] trim emulator and feature tour narration [skip ci] * [comment audit] clarify floating workspace and GitHub cache ownership [skip ci] * [comment audit] trim provider controls and Linear filter explanations [skip ci] * [comment audit] clarify pairing and chat resume lifetimes [skip ci] * [comment audit] clarify chat delivery and transcript lifetimes [skip ci] * [comment audit] clarify session options and host-owned status [skip ci] * [comment audit] clarify draft durability and live-status precedence [skip ci] * [comment audit] Trim chat send and model ownership explanations [skip ci] * [comment audit] Shorten transcript ownership and send recovery comments [skip ci] * [comment audit] Simplify native chat composer and transcript hook comments [skip ci] * [comment audit] Shorten native chat scroll and structured session explanations [skip ci] * [comment audit] Trim workspace picker and onboarding commentary [skip ci] * [comment audit] Simplify pet rendering, review cache and quick open comments [skip ci] * [comment audit] Trim sidebar and session history explanations [skip ci] * [comment audit] Condense session resume and review checks comments [skip ci] * [comment audit] Shorten checks state and file explorer refresh comments [skip ci] * [comment audit] Trim plugin bridge and source-control action rationale [skip ci] * [comment audit] Trim source-control listing and review rationale [skip ci] * [comment audit] Shorten sidebar lifecycle and explorer safeguards [skip ci] * [comment audit] Condense Settings account and appearance rationale [skip ci] * [comment audit] Trim pairing and repository Settings explanations [skip ci] * [comment audit] Condense Settings search SSH and terminal safeguards [skip ci] * [comment audit] Shorten Settings voice and provider ownership comments [skip ci] * [comment audit] Condense Settings draft persistence and host-state rationale [skip ci] * [comment audit] Trim Settings hooks and sidebar setup rationale [skip ci] * [comment audit] Condense sidebar deletion and board-filter safeguards [skip ci] * [comment audit] Condense worktree cards, host ownership and Markdown contracts [skip ci] * [comment audit] Condense sidebar drag, folder and filtering contracts [skip ci] * [comment audit] Condense sidebar parity, sleep and host ownership contracts [skip ci] * [comment audit] Prune focus-read baseline after comment cleanup * [comment audit] Clarify sidebar visibility, board drops and agent evidence [skip ci] * [comment audit] Tighten sidebar listing, drag and reveal contracts [skip ci] * [comment audit] Clarify viewport geometry and skill update safeguards [skip ci] * [comment audit] Tighten skill inventory, usage and host status comments [skip ci] * [comment audit] Clarify usage ownership and resource kill safeguards [skip ci] * [comment audit] Tighten tab selection, rename and search contracts [skip ci] * [comment audit] Tighten tab-strip geometry and drag ownership comments [skip ci] * [comment audit] Tighten Tasks recovery, pagination and mutation comments [skip ci] * [comment audit] Tighten provider loading and terminal recovery comments [skip ci] * [comment audit] Tighten completion, cadence and PTY ownership comments [skip ci] * [comment audit] Clarify terminal restore and parked-pane boundaries [skip ci] * [comment audit] Tighten PTY startup and replay explanations [skip ci] * [comment audit] Clarify PTY identity and delivery ownership [skip ci] * [comment audit] Shorten remote reconnect and input replay rationale [skip ci] * [comment audit] Condense terminal parking clipboard and file link comments [skip ci] * [comment audit] Clarify IME ownership and trim trace history [skip ci] * [comment audit] Shorten pane recovery and parked watcher explanations [skip ci] * [comment audit] Condense snapshot replay and visibility recovery rationale [skip ci] * [comment audit] Shorten terminal parking and keyboard ownership rationale [skip ci] * [comment audit] Trim renderer lifecycle and menu rationale [skip ci] * [comment audit] Condense workspace cleanup ownership and settlement notes [skip ci] * [comment audit] Clarify renderer hook evidence and source ownership [skip ci] * [comment audit] Tighten IPC ownership and reconnect explanations [skip ci] * [comment audit] Trim renderer focus, paste and attention comments [skip ci] * [comment audit] Shorten scroll, locale and agent lifecycle comments [skip ci] * [comment audit] Trim agent launch, resume and ownership commentary [skip ci] * [comment audit] Shorten account, browser and editor comments [skip ci] * [comment audit] Clarify host-mirror waits, previews and input ownership [skip ci] * [comment audit] Condense launch recovery and editor tokenization comments [skip ci] * [comment audit] Condense workspace selection and terminal pane rationale [skip ci] * [comment audit] Condense terminal fitting and rendering recovery comments [skip ci] * [comment audit] Condense terminal input and host routing explanations [skip ci] * [comment audit] Condense ownership and sleeping-session recovery rationale [skip ci] * [comment audit] Condense structured launch and terminal link explanations [skip ci] * [comment audit] Condense terminal ownership and workspace file routing rationale [skip ci] * [comment audit] Condense session persistence and workspace activation rationale [skip ci] * [comment audit] Condense workspace routing and browser ownership rationale [skip ci] * [comment audit] Condense mirror recovery and layout authority rationale [skip ci] * [comment audit] Condense runtime transport and file safety rationale [skip ci] * [comment audit] Condense runtime graph and structured session rationale [skip ci] * [comment audit] Condense browser creation and remote tab recovery rationale [skip ci] * [comment audit] Condense snapshot authority and publisher recovery rationale [skip ci] * [comment audit] Condense frame, startup and provider cache rationale [skip ci] * [comment audit] Condense host twin and agent lifecycle rationale [skip ci] * [comment audit] Condense browser authority and editor cleanup rationale [skip ci] * [comment audit] Condense editor buffer identity and review cache rationale [skip ci] * [comment audit] Condense provider lifetime and repository ownership rationale [skip ci] * [comment audit] Condense reconnect, hydration and terminal retirement rationale [skip ci] * [comment audit] Condense recovery, reconciliation and persistence rationale [skip ci] * [comment audit] Condense cleanup ownership and listing admission rationale [skip ci] * [comment audit] Condense teardown ordering and terminal ownership rationale [skip ci] * [comment audit] Condense recovery ledger and web host-boundary rationale [skip ci] * [comment audit] Condense web reconnect and credential lifecycle rationale [skip ci] * [comment audit] Condense cloud rollout and assignment safety rationale [skip ci] * [comment audit] Condense relay session and database recovery rationale [skip ci] * [comment audit] Condense relay placement and protocol compatibility rationale [skip ci] * [comment audit] Condense build and packaging constraints [skip ci] * [comment audit] Condense CI gates and validation isolation rationale [skip ci] * [comment audit] Condense catalog identity and browser validation rationale [skip ci] * [comment audit] Condense mobile browser and frame-budget rationale [skip ci] * [comment audit] Shorten mobile route and browser test explanations [skip ci] * [comment audit] Condense editor and session seam test rationale [skip ci] * [comment audit] Trim session and terminal closure history [skip ci] * [comment audit] Shorten terminal browser and census explanations [skip ci] * [comment audit] Preserve root-only E2E diagnostic baseline * [comment audit] Condense mobile seam and HTML preview test rationale [skip ci] * [comment audit] Condense preview instrumentation and render harness rationale [skip ci] * [comment audit] Condense bundle contracts and native-build constraints [skip ci] * [comment audit] Shorten native packaging and CI routing rationale [skip ci] * [comment audit] Condense release tooling and benchmark constraints [skip ci] * [comment audit] Condense packaging and platform gate rationale [skip ci] * [comment audit] Shorten mobile route and history rationale [skip ci] * [comment audit] Condense mobile browser and component rationale [skip ci] * [comment audit] Shorten drawer and workspace-form rationale [skip ci] * [comment audit] Trim mobile review and editor-document explanations [skip ci] * [comment audit] Condense editor lifecycle and Markdown explanations [skip ci] * [comment audit] Trim mobile file, diagnostics and dictation commentary [skip ci] * [comment audit] Simplify mobile host-list and workspace-view explanations [skip ci] * [comment audit] Clarify mobile shell lifetime and bridge delivery constraints [skip ci] * [comment audit] Condense bridge stream, native request and audio rationale [skip ci] * [comment audit] Reduce bridge schema and page-client commentary [skip ci] * [comment audit] Tighten mobile page bridge contracts [skip ci] * [comment audit] Clarify mobile cache and session constraints [skip ci] * [comment audit] Condense mobile route and lifecycle rationale [skip ci] * [comment audit] Tighten mobile shell hook timing rationale [skip ci] * [comment audit] Clarify route handoff and notification compatibility [skip ci] * [comment audit] Clarify push registration and dictation cleanup constraints [skip ci] * [comment audit] Condense keyboard geometry and native media ownership rationale [skip ci] * [comment audit] Tighten mobile chat scroll and composer concurrency rationale [skip ci] * [comment audit] Condense mobile reply compatibility and upload ownership rationale [skip ci] * [comment audit] Condense optimistic echo and scroll ownership rationale [skip ci] * [comment audit] Tighten stream replay and queued session ownership rationale [skip ci] * [comment audit] Condense mobile composer and reply-schema constraints [skip ci] * [comment audit] Clarify mobile transcript recovery and session ownership [skip ci] * [comment audit] Clarify mobile queue and source-control compatibility [skip ci] * [comment audit] Condense storage and task launch constraints [skip ci] * [comment audit] Clarify task schemas and terminal document ownership [skip ci] * [comment audit] Tighten terminal input and viewport rationale [skip ci] * [comment audit] Shorten terminal and RPC recorder contracts [skip ci] * [comment audit] Condense recorder engine and connection contracts [skip ci] * [comment audit] Shorten host credential and relay recovery comments [skip ci] * [comment audit] Tighten pairing recovery and bundle transport rationale [skip ci] * [comment audit] Clarify RPC delivery and workspace catalog boundaries [skip ci] * [comment audit] Condense catalog and relay entry contracts [skip ci] * [comment audit] Shorten shutdown and SSH relay delivery contracts [skip ci] * [comment audit] Condense WSL relay and E2E regression rationale [skip ci] * [comment audit] Shorten cross-version harness and renderer fixture explanations [skip ci] * [comment audit] Condense paired-host and E2E lifecycle rationale [skip ci] * [comment audit] Shorten layout oracle and regression explanations [skip ci] * [comment audit] Condense paired recovery and ownership regression contracts [skip ci] * [comment audit] Shorten restart, sidebar and SSH lifecycle contracts [skip ci] * [comment audit] Condense terminal rendering and IME regression rationale [skip ci] * [comment audit] Shorten terminal recovery and benchmark contracts [skip ci] * [comment audit] Condense tooling and Windows lifecycle proof rationale [skip ci] * [comment audit] Condense workflow routing and release rationale [skip ci] * [comment audit] Condense mobile security and installer contracts [skip ci] * [comment audit] Shorten native rationale and stylesheet workarounds [skip ci] * [comment audit] Shorten Windows visibility probe rationale [skip ci] * [comment audit] Condense embedded release and signing rationale [skip ci] * [comment audit] Retain current main test behavior in final reconciliation [skip ci] * [comment audit] Complete final comment review across current source inventory * [comment audit] Handle consolidated audit reports before final CI * [comment audit] Preserve credential storage census detail [skip ci] * [comment audit] Scale broad changed E2E selections with verified timing shards * [comment audit] Align E2E assertions with browser close and settled session metadata * [comment audit] Match existing E2Es to current resource and windowing contracts * [comment audit] Observe the shared server outage notice in reconnect coverage * [comment audit] Make existing renderer probes measure settled tab and PTY work * [comment audit] Align palette E2E selector with task search * [comment audit] Refresh remaining palette search selectors * [comment audit] Keep selector correction within selected audit specs * [comment audit] Await emoji fixture settings inside renderer evaluation * [comment audit] Cancel fixture fit retries between terminal tests --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…blyai#33513) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…ession (stablyai#33514) Hermes panes resume their own conversation after an Orca restart: record the Hermes session id from Orca's Hermes plugin hooks and relaunch with `hermes --resume <id>` (remote hosts gated on agent-session.hermes-resume.v1). Delegate-child hooks no longer replace the pane's session id. Fixes stablyai#15808 Supersedes stablyai#31327, stablyai#15809, stablyai#12075 Co-authored-by: tomaszamoranoq <268064671+tomaszamoranoq@users.noreply.github.com> Co-authored-by: Yi Lok Enoch Lam <22125285+eloklam@users.noreply.github.com> Co-authored-by: GoodFarming <34622709+GoodFarming@users.noreply.github.com>
* test: remove mock-only cases and repair audit fixtures * test: use checked upload fetch mocks * test: assert upload MIME on actual multipart wire bytes --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…blyai#33518) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…chat runtime isn't installed (stablyai#33520) When Antigravity's Orca-managed chat runtime isn't installed, default-chat launches (orchestration workers, agent.launch from CLI/mobile/automations) fall back to a terminal running agy with reason chat_runtime_not_installed instead of failing at terminal_create; an explicit --surface chat is refused with an install hint. Desktop chat tabs still show the install card. Fixes stablyai#30973
…estart restores them (stablyai#33523) A woken sleeping agent keeps its launch config (flags like permission mode, model, custom args) so a later Orca restart restores it with the same flags; consuming the sleeping record no longer deletes the pane's launch config (retirement and launch-token/session matching still govern it). Supersedes stablyai#31756 Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
* test: strengthen CLI and mobile behavior checks * test: prune resolved host-edit wall-clock allowance --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test: strengthen CLI errors and mobile lifecycle checks * test: use preferred callback array type notation --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
…tablyai#33534) Main built its copy of a hidden pane from the renderer's xterm at the phone's 1000-row limit, and the hidden-output reveal repaints the pane from that copy, so a restored pane with more history lost all but its last 1000 rows on first reveal.
…tablyai#33517) Claude panes show Needs You while a Claude Code MCP server's elicitation dialog is open: install Claude's Elicitation/ElicitationResult hooks (>=2.1.63), map Elicitation to waiting and restore the pre-dialog state on ElicitationResult (done when there is no prior record). Fixes stablyai#25020 Supersedes stablyai#25057 Co-authored-by: Wooseong Kim <2222333+innocarpe@users.noreply.github.com>
…lyai#33428) * fix(worktrees): one host's git status no longer rewrites a same-path twin's branch (stablyai#32918) * fix(worktrees): match a twin through its runtime alias and persist its review clear on the same copy * fix(worktrees): keep the id-only patch for a lone copy; background refreshes refuse an unplaced twin * fix(worktrees): a twin's identity patch skips the id-keyed review clear instead of reaching its sibling * fix(worktrees): count runtime provenance when finding twins; Source Control refresh refuses an unplaced twin * fix(worktrees): a twin's branch switch clears its own push target and review link on its host * fix(worktrees): a twin's review clear keeps its stale-refetch guard and relink check, scoped to its own copy * fix(worktrees): a twin tombstone names its full owner, and detected rows are stamped before sanitizing * fix(worktrees): each twin copy keeps its own review-clear tombstone * fix(worktrees): a rename carries each twin copy's review-clear tombstone * fix(worktrees): a copy's tombstone from its twin days still drives its clear retry * chore(worktrees): name why the existing review-link cast is safe * fix(worktrees): one resolver names the copy for every git-identity read and write * fix(worktrees): a Create PR run refuses when its copy no longer resolves; local null stays local * fix(worktrees): an unselected twin stays unplaced; a legacy row's guard survives its first stamp * fix(worktrees): a Create PR run keeps the copy it pinned at start; a legacy row's relink drops its stamped guard * fix(worktrees): key review clears by the full stamp the next listing gives the row * fix(worktrees): fill only missing stamp parts when keying review clears * fix(worktrees): stamp review-clear keys from repo registrations, not the focused host * fix(worktrees): a local row keeps its review-clear guard when discovery stamps it local * fix(worktrees): stamp review-clear keys from the sole repo registration first * fix(worktrees): a runtime-hosted copy's owner key ignores backfilled provenance * fix(worktrees): Create PR and post-generation refresh read the pinned copy's push target * fix(worktrees): a lone copy's push target still answers when the host index misses * fix(worktrees): the push-target fallback accepts only an unstamped lone copy for a named host * fix(worktrees): only SSH copies borrow a registration's provenance for review-clear keys
…s start folder (stablyai#33527) Resumed Claude/Codex agents come back in the folder they were started in: resume records save the agent's starting cwd from hooks (kept within a session and across Claude /clear and compact), persist it, and resume as `cd <folder> && <agent> --resume <id>` when it differs from the workspace root. A deleted folder now fails loudly at the cd instead of silently resuming in the root. Fixes stablyai#16960 Refs stablyai#15485
…emp path (stablyai#33540) On macOS the temp dir sits behind the /private symlink and the runtime stores the resolved path, so two existing-folder tests failed locally. realpath is a no-op on Linux CI.
…lds an unacknowledged batch (stablyai#33639) Fixes STA-11980 Fixes STA-11631 Supersedes stablyai#29006
… it was started in (stablyai#33659) Claude account-switch restarts now pass the folder the restarted shell opens in (tab start folder, else workspace), so stablyai#33527's `cd <start folder> &&` resume prefix applies and a session started in a subfolder resumes there. Codex account restarts benefit the same way. Refs stablyai#31545 Supersedes stablyai#32033 Co-authored-by: ASH <7201776+asunghong@users.noreply.github.com>
…d work inside pages (stablyai#31859)
* feat(agents): store each agent's permission itself instead of typing flags into Arguments Terminals and new chats read one stored choice per agent (Use the agent's own settings, Ask for approval, Accept edits, Approve for me, Full access). Orca adds the flag at launch; Arguments hold only the user's own text. A one-time move lifts Orca's flags out of saved Arguments. Older clients still see and write the flag as part of Arguments; the host translates. * fix(agents): say the all-agents switch resets agents set separately; keep primitives unstyled * test(agents): the one-time move returns every launch-profile field * Fix permission carrier ownership and surface-specific defaults * Preserve uncertain permission operands and name the option inventory * Check env entries without indexing typed agent maps * Combine Chat permission capability imports * Use folder execution-host platform for permission environment * Preserve launch map replacement and acknowledge permission saves * Keep permission feedback fallbacks statically discoverable * Provide preload platform to Agents settings render tests * Preserve Gemini approval arguments under Full access * fix(settings): retain complete environment edits through save outcomes * fix(settings): narrow local failure scope and preserve host messages * fix(settings): retire argument drafts after acknowledged saves * fix(settings): keep Goose environment editable after reset * fix(settings): show resolved arguments for legacy hosts * Preserve pending environment resets and bound launch settings work * Use agent permission choices for new chats * Let Claude resolve chat permissions from its own settings * Keep optional settings fallback in repository metadata reads * Consolidate permission report imports * Update permission choice contracts for own settings * Read repository visibility defaults through the raw settings fixtures * Match existing translated Agents settings labels * Update readback and legacy host test expectations * Align Chat behavior tests with host permission capability * Fix permission compatibility and host-owned descriptions * Prepare whole Environment edits and retire unchanged drafts * Handle null explicitly in permission report decoder * Keep Environment settings transitions in an acyclic module * Update raw settings reader test fixtures * Place test fixture safety notes on assertion starts * test: pin permission settings work and recovery contracts * test: type permission settings work fixtures * test: cover migrated permission inputs and captured CLI grammar * Publish permission reports and reuse host capability state * Combine mobile option state React imports * Honor mobile status feed capability for permission reports * test: preserve typed permissions in WSL Claude restarts * Correct permission report child and fixture type contracts * Delegate older-host chats to explicitly selected own settings * Avoid rebuilding live ACP option catalogs * test(chat): place cross-boundary permission contracts in integration project * Preserve existing chat capability gates and complete report test fixtures * fix(chat): preserve newer Claude startup permission reports * test(chat): clarify startup report fixture provenance * Show reported permission modes in chat menus * Keep reported permissions available after chat mode picks * Remove obsolete guard from concrete permission selection * Report the installed approval policy for ACP chat menus * test: keep accepted mobile mutation fixture on current fence * test: cover installed ACP approval report for own chats * test: align capability scaling contract with concrete permission menus * Ship required permission help in English runtime catalog * Adapt permission persistence test to shared menu
… state files (stablyai#20937) (stablyai#33662) Orca CLI commands inside a sandbox that blocks chmod (e.g. Claude Code's Bash sandbox) no longer fail with a misleading "file is invalid": the pre-read hardening of existing secure files ignores EPERM/EACCES/EROFS; writers still create files 0600. Fixes stablyai#20937
…tablyai#33532) * ci(wsl): rerun a WSL2 lane job once when its hosted runner freezes * ci(wsl): pin the retry to the lane workflow and keep a 30 min job cap
…default agent (stablyai#33660) Kiro's V3 engine (default from Kiro CLI 3.0) now reports status in Orca: Orca installs a global hooks file under KIRO_HOME/hooks (covering the built-in default agent, local and remote, never overwriting user files) and recognizes V3's PascalCase hook events. Fixes stablyai#31577 Supersedes stablyai#24937 Co-authored-by: Dongho Lee <126236161+LDH1103@users.noreply.github.com>
…oken (stablyai#33656) After agy silently refreshes its Google token (the new credential has no id_token), Orca still matches the saved Antigravity account by auth method + refresh token instead of refusing the launch with "native Antigravity account changed"; the vault accepts such refreshed snapshots while still rejecting one whose id_token names a different account. Fixes stablyai#31579 Supersedes stablyai#33204 Co-authored-by: biojuho <258838639+biojuho@users.noreply.github.com> Co-authored-by: Manan <100475418+thefrikidude@users.noreply.github.com>
… has no 5h/weekly window (stablyai#33655) Claude Enterprise seats (null 5h/weekly windows, limit in spend/extra_usage) now show their spend cap as a monthly usage bar in the status bar chip, tooltip and account switcher instead of an empty meter. Fixes stablyai#31061 Supersedes stablyai#31065 Co-authored-by: Frank Bernhardt <275327+frank-bee@users.noreply.github.com>
…hem after the tab closes (stablyai#31602) * Chat renames are saved as the chat's name, so Session History shows them after the tab closes Renaming a native chat tab only changed that window's tab. Session History, phones and other windows read the host's saved name, so the rename vanished from History once the tab closed or Orca restarted. A rename now goes to the host that owns the chat (agentSession.rename) and is saved as the chat's one name, the field History, tabs, sidebars and phones already read. The record remembers that the user chose it, so automatic naming never replaces it. A window's pre-upgrade tab rename is uploaded once and only fills a name Orca chose. Hosts without the new capability keep the old tab-only rename. Every native agent's History row now shows the chat's name once it has one. * Keep saved chat names consistent across readers and reconnects * Carry qualified chat names into cached readers * Reuse the history recorder context across platforms * Use recorded chat ownership for legacy name transfer * Transfer legacy chat names only from known catalog ownership * Correct recorder path matching and History subscription order * Require complete evidence for bridged parity exclusions * Preserve sparse array lengths in complete recording comparisons * Initialize History observation before loading workspace context * Integrate measured History recordings and scoped parity evidence * fix chat naming retries and certify both replay modes * fix ambiguous chat rename labels after navigation * preserve chat rename intent across tab updates * type dashboard snapshot fixtures without assertions * fix: align chat name observation with store contracts * test: update chat name consumer fixtures * test: distinguish sender naming metadata from status * Preserve saved Activity chat names across tab focus * Clarify Activity tab projection identity * Remove package-manager lockfile churn from main merge * fix(runtime): validate tab property edits before saving chat names * fix: refresh History ownership after conversation clear * fix: commit History request identity before refresh effects * Fix History scan scope typing and integration test placement * test: cover saved chat name reader contracts * test: make chat naming fixtures deterministic
…i#33643) * Bound cwd permission probes and share pending enumerations * Skip non-macOS cwd permission probes during session creation - Prevent stalled network paths from consuming filesystem workers
* Fix notification bell layout and isolate Vite tsconfig resolution * Move Vite tsconfig fix out of notification bell PR
…33675) * test(native-chat): split startup report coverage below line limit * test(native-chat): keep startup status reads synchronous * refactor(native-chat): move status child fields below line limit * test(native-chat): annotate exported startup mock types * test(chat-rename): import launch persistence from its current path
…keep stall telemetry (stablyai#33688) Reverts stablyai#29133 except its daemon async-I/O stall telemetry, so we can measure how often stalls happen on official Node before committing to a patched runtime. The macOS terminal host goes back to the official Node 24.22.1 download and the daemon protocol back to v51; no release or hourly build published v52.
…size rule (stablyai#33584) * fix(terminal): give the window and main's copy the daemon's ConPTY resize rule Every PTY a Windows machine owns is ConPTY, WSL shells included, and ConPTY repaints its own grid after a resize. The window applied xterm's ConPTY model only to native (non-WSL) panes, and main's copy for reveals and phones never did, so growing either pulled history into ConPTY's grid. Decide windowsPty from the PTY's owner backend everywhere, keeping the native-only cursor, CJK and keyboard workarounds behind isLocalNativeWindowsConpty. * fix(terminal): keep main's copy of an SSH relay PTY off the ConPTY model before its record exists Main's copy is built on the first byte, and a restored or adopted relay PTY can stream before its record carries a connection id.
* Guard managed server restarts with host work reservations * Protect legacy server update requests with host admission * Reserve chat-safe restarts in SSH and WSL server updates * Keep activation host fixtures within the module line limit * fix(orcad): preserve session queue timing during admission * Explain chat-safe update deferrals and superseded restarts * Clarify managed server Force upgrades and retry instructions * Separate chat entry delegates from conversation creation * Report child work through main's child evidence in the restart drain test * Drive main's snapshot-room tests through the restart reservation Main's room tests deployed over a serving incumbent with a census that has no chat work count and no restart admission, so the update deferred before the room probe ran. Give them the same idle census and slot admission as the other activation tests, and pin the probe before the reservation instead of before the recount it replaced. * fix(native-chat): an update keeps waiting on a chat start after its conversation is closed The restart check counted a start only while its conversation stayed open, so an idle close during a stalled start let a managed update through. Every tracked attach, create, start and open now counts as restart work in the same tracker that counts the session queue. * fix(native-chat): keep the structured session view within its line limit once formatted Main's copy sat at 400 lines only because one line was left unformatted; the merge's formatter pushed it to 401. Inlining the one-use question list keeps it at 400 with identical behavior. * fix(orcad): a recovery stop request stops the server; only an older client's empty request waits for idle Stopping a slot and restarting it for an older client's update were both an empty .orcad-stop-request file, so routing that file through restart admission let a crash recovery, stranded-setup release or rejected-candidate rollback leave the server running. New clients now write "stop-now" into the request (renamed in whole), which stops at once as before; an empty or unrecognized request takes the chat-safe restart, and a deferred restart logs why. Also gives the restart admission activation fixtures the now-required recount. * docs(orcad): say a directory at the stop-request path is refused, not restarted * docs(orcad): the plain stop request's comment states both of its meanings * style: format the restart admission files for the format check * test(wsl): count the incumbent's recount bridge after the reservation's * fix(orcad): a Windows stop request retries its rename while antivirus holds the new file Renaming the just-written stop-now request can briefly fail with EPERM, EACCES or EBUSY on Windows; the stop now retries those with the same bounded delays as record-publish instead of answering SIGNAL_FAILED and leaving the server up. * test(orcad): a real Windows host stops on the slot's stop-now request and relaunches * test(orcad): recovery stops a real server whose restart admission refuses * test(orcad): the recovery-stop cell tunnels over the cell's SSH connection * test(orcad): the recovery-stop cell names itself in the CI log * fix(settings): a deferred WSL update shows its full reason below the row * test(orcad): fixtures pass releaseIncumbentAdmission; the census test calls its own method * test(orcad): the capable-server census in the fence test reports idle chat work * Record server chat restart offers and desktop creation history * Offer interrupted chat recovery per managed runtime * Ship the remote chat resume action labels in the runtime catalog * Update removal contracts for desktop chat history cleanup * Scope remote chat recovery to each server occurrence * Preserve recovery choices and uncertain continuation outcomes * fix: preserve uncertain restart action outcomes * Fix restart recovery CI imports and fixtures * test: align resume assertions with unconfirmed outcomes * test: bound restart recovery work across scaled populations * fix(native-chat): title the remote resume dialog with the restart The dialog can appear out of nowhere when another desktop updates a shared server, so its title now says what happened: "<machine> restarted".
…e host (stablyai#33680) * fix(ssh): retry over system ssh when ssh2 shares no algorithm with the host ssh2 supports fewer algorithms than OpenSSH. A host that offers only certificate host keys (or only kex/cipher choices ssh2 lacks) fails the handshake with "Handshake failed: no matching ...", even though the system ssh binary connects fine. Treat any such negotiation failure as a client capability gap: probe system ssh once, and if that also fails, report its error, since ssh2 can never reach the host. Fixes stablyai#33582 Co-authored-by: Kyou12138 <kyou12138@gmail.com> * fix(ssh): keep hosts pinned in Orca's key store on ssh2 after a negotiation failure System OpenSSH never reads Orca's own host key store, so an on-path impostor could advertise algorithms ssh2 lacks to steer a pinned host onto system ssh and around its pin. Only fall back when Orca has no stored key for the endpoint. Co-authored-by: Kyou12138 <kyou12138@gmail.com> * fix(ssh): only the current attempt records an Orca host key pin A superseded attempt that finished its trust read late could overwrite the current attempt's pin marker, letting a negotiation failure on a pinned host fall back to system ssh. --------- Co-authored-by: Kyou12138 <kyou12138@gmail.com>
…ps propagation (stablyai#33679) * fix(link-actions): dismiss the link chooser when an outside click stops propagation * test(link-actions): wait for Radix to arm before the outside click
* Add custom font family setting for native chat * Preserve custom chat fonts in autocomplete * Preserve IME composition in font autocomplete
…al history (stablyai#33681) * fix(ssh): don't refuse a host's move over a pane that saved no terminal history A pane with an empty inline buffer, a deleted snapshot, or a zero-byte snapshot has no history to lose, but the move's projection filed it under "saved terminal history Orca could not read" and refused the whole host. Tell absent snapshots apart from unreadable ones and move the former without history; unreadable history still blocks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ssh): keep looking in the fallback root when a scrollback snapshot is empty A zero-byte snapshot in the primary root returned 'absent' without checking the fallback root, so a pane whose history lived there moved without it. Also check ENOENT inline rather than importing a window staging helper. * test(e2e): seed unreadable relay scrollback as an over-limit snapshot A missing snapshot file now means the pane saved no history, so the leave-behind spec needs history that exists but cannot be read. --------- Co-authored-by: Younghwan Chae <chyohw97@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…blyai#33700) The headless CLI bundle resolved jsonc-parser to its UMD build, whose relative requires fail beside the single-file bundle, so `orca agent hooks status|on|off` crashed with "Cannot find module './impl/format'". Every orcad bundle now shares one plugin list, and the build refuses any bundled UMD module. Fixes stablyai#33592
…tablyai#33701) * fix(orcad): drive Android emulators from headless orca serve hosts orcad never installed an EmulatorBridge, so every `orca emulator` verb failed with emulator_no_active once headless serve moved to orcad. The emulator modules now read host paths and HTTP through the host ports instead of importing Electron, and orcad installs the bridge and stops its managed sessions on shutdown like the desktop does. Fixes stablyai#33650 * fix(orcad): bound emulator teardown inside the shutdown deadline * fix(orcad): keep idle exit from stopping Orca-started emulators; update emulator skill scope * fix(orcad): count only still-running Orca-started emulators as idle-exit work * fix(emulator): prune managed sessions only on a successful adb census * fix(emulator): release a pruned device's stream and never prune a record reattached mid-census
…a fresh v52 daemon (stablyai#33705)
Plan B (Muse-approved 2026-10-26): upstream-first resolution, fork patches re-applied. 77 conflicted files / 112 hunks resolved; see /workspace/ops/reviews/2026-10-26-orca-sync-resolution.md. Local only; not pushed.
karlorz
added
the
allow-runtime-launcher-protocol-bump
- Move hook-payload provider session parsing out of shared/agent-session-resume.ts into agent-provider-session-extract.ts (max-lines 300); re-exported so call sites keep one import path. No behaviour change. - Replace two import() type annotations in structured-agent-session-host-mutations.ts with import type. - oxfmt explicit-terminal-close-pty-stops.ts.
Owner
Author
|
Tracking comment for the fork-main lint debt accepted at merge 45acf3c. It lives here because Issues are disabled on this repo. Lint debt on fork-main that was accepted as pre-existing when merging the upstream sync in #40 (merge commit 45acf3c). The Deadline: the max-lines (
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream sync of stablyai/orca
main@bd2f46359d1eintofork-main@e627bf5ee138(merge base0b28553093b8). Merge commit:469eec34b6fb.Resolution summary
electron-builderpackaging and publish config (ours).changed_e2e_shardsmatrix ine2e.yml.@orca/expo-pet-speech,expo-speech, codegen patch).mobile/pnpm-lock.yamlis identical to fork-main.openResumeTab.protocol-version.ts,daemon-protocol-version.tsand the pairing files are byte-identical to the clean merge result.RUNTIME_PROTOCOL_VERSIONstays at 3 (min 2/2). The daemonPROTOCOL_VERSION51 → 52 bump comes from upstream; 51 stays compatible, and this sync adds no bump of its own.allow-runtime-launcher-protocol-bumplabel (D7.1 R3 override for upstream syncs).src/renderer/src/store/slices/terminal-tab-retirement.ts. On explicit tab close,markClosedTabSessionsForExplicitResumenow also converts a doneworktree-sleeprecord toorigin: live. Without this, upstream fix(sleep): reopen a slept agent whose tab is gone in a fresh tab instead of stranding it stablyai/orca#33598 (stranded-sleep reopen) auto-relaunched completed workers that had been closed explicitly. The fork's test and upstream's stranded-sleep test both pass.realpathimport that the merge introduced.ci-e2e-job-selection.test.mjsnow asserts the dynamic shard wiring.Known items (tracked, not blockers per review)
fresh-spawn-start.tsandshared/agent-session-resume.ts.verify:localization-coverageflags strings from upstream Add custom font family setting for native chat stablyai/orca#33687.Approvals
ops/reviews/2026-10-26-orca-sync-resolution.md,-muse-summary.md).Merge with a merge commit only. No tags, no release.