[abruption]

ELI5

Orca installs a small remote CLI bridge on SSH hosts. Native Windows terminals could receive the bridge location without seeing it in their effective Path, so commands such as orca orchestration ... were unavailable inside the PTY. This makes the bridge discoverable in PowerShell and cmd while leaving WSL unchanged.

What Changed

Before, the Windows relay returned no shell-specific environment adjustment. If inherited PATH and client-provided Path casing collided during the final environment merge, the native shell could lose ORCA_REMOTE_CLI_BIN_DIR.

Now, immediately before native Windows PTY spawn, the relay:

• recognizes PowerShell 5.1, PowerShell 7, and cmd;
• finds the effective PATH/Path key case-insensitively;
• prepends ORCA_REMOTE_CLI_BIN_DIR;
• removes an existing case-insensitive duplicate; and
• does not inject the Windows launcher path into WSL.

Why

The relay is the last host-owned seam before ConPTY receives the environment, so it can repair the effective Windows path after all remote and inherited environment values have been combined. Doing this in POSIX startup wrappers would not cover native PowerShell or cmd and would incorrectly cross the WSL execution boundary.

Linked Issue

Fixes #22110

Visual Proof

N/A — this changes the native PTY environment and has no UI surface.

Testing

• I manually tested these changes locally
• Automated tests added/updated, or explained why not below

Validation:

• pnpm test src/relay/pty-shell-launch.test.ts: 29 passed
• pnpm tc:node: passed
• changed-code quality against current main: zero findings
• git diff --check: passed
• real Windows 10 x64 SSH relay/ConPTY validation restored remote CLI discovery with pwsh.exe
• a real Windows WSL PTY validation remained green and did not receive the native Windows path injection

The same host blocked Orca's compressed bootstrap under stock Windows PowerShell 5.1 with an access-denied policy result before PTY launch. Unit coverage exercises the PowerShell 5.1 shell path; the successful end-to-end native PTY run used PowerShell 7.

AI Disclosure

OpenAI Codex (GPT-6) assisted with implementation and test preparation. I reviewed the change and ran the reported validation.

Review

The change is limited to the relay's native Windows shell launch environment and its focused tests. It does not alter POSIX shell wrappers, WSL arguments, the remote bridge installer, or wire contracts.

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

The added value is a fixed Orca-managed directory, not user-provided command text, and is passed through the process environment without a shell. PATH-key matching and duplicate removal are case-insensitive for Windows. macOS and Linux behavior is unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 7d4330ba-5747-4132-b8c8-205660f89660

📥 Commits

Reviewing files that changed from the base of the PR and between 15472cd and 8447276.

📒 Files selected for processing (2)

• src/relay/pty-shell-launch.test.ts
• src/relay/pty-shell-launch.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The Windows relay launch configuration now prepends ORCA_REMOTE_CLI_BIN_DIR to the case-insensitive Path for PowerShell, pwsh, and cmd shells. Existing matching entries are removed before insertion. wsl.exe receives no Windows PATH injection. Tests cover PATH casing, duplicate removal, native shell handling, and WSL exclusion.

Priority: ➖ Normal

Severity of issue fixed: Medium

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: exposing the remote CLI in Windows SSH PTYs.
Description check	✅ Passed	The description includes all required sections, explains the user impact and implementation, links issue #22110, documents testing and platform coverage, and completes the checklist.
Linked Issues check	✅ Passed	Issue [#22110] requires native Windows PowerShell, PowerShell 7, and cmd PTYs to receive the remote CLI directory in the effective case-insensitive Path, without duplicates, while WSL remains unchan…
Out of Scope Changes check	✅ Passed	The changes are limited to the Windows PTY launch environment and focused tests in src/relay/pty-shell-launch.ts and src/relay/pty-shell-launch.test.ts. They directly implement and verify issue [#…

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

✅ No new issues found.

Reviewed changes

• Windows native-shell Path repair — getRelayShellLaunchConfig now returns a case-insensitively patched path for PowerShell/PowerShell 7/cmd, prepending ORCA_REMOTE_CLI_BIN_DIR and dropping a duplicate of that directory, instead of the previous env: {}.
• WSL and POSIX unchanged — the injection is gated to the same shell allowlist windowsShellArgs already uses, so wsl.exe and non-Windows platforms are untouched.
• Tests — three new cases cover prepend, duplicate removal for pwsh.exe/cmd.exe, and the WSL no-op; I confirmed the three PATH-injection cases fail against the base env: {} and pass with the change.

I dug into the case-collision root cause: buildSpawnEnv (src/relay/pty-handler.ts:786) can indeed hold both Path and PATH because the merge is a case-sensitive spread, but ConPTY passes the block through in object order and Win32 resolves the first case-insensitive match — exactly the key this function writes. The repo already encodes that rule in firstWindowsPathEnvKey (src/main/pty/windows-path-segment-merge.ts:18-28). I could not construct a realistic relay spawn that still loses the bridge directory.

ℹ️ Nitpicks

• The first-key lookup duplicates firstWindowsPathEnvKey, whose comment states the same "first case-insensitive key, block order preserved" rule. Reusing resolvePathEnvKey(env, 'win32') from src/main/pty/windows-path-segment-merge.ts would keep that assumption in one place.
• The tests cover a single path key; the issue's stated trigger is a Path/PATH collision, so one case passing both keys would pin that the injected key is the one Win32 resolves.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[OrcaWin]

SSH still works: Orca connects to the host over SSH and routes workspace operations through the managed remote Orca server (orcad). These merges remove the legacy SSH relay, not SSH support.

Closing as obsolete after the merged SSH relay retirement in #27214 and #27215. This PR concerns the SSH relay server and its relay-only handlers. #27214 removed the desktop relay connection/fallback path; #27215 deleted the SSH relay server, deployment assets, and relay-only tests. SSH hosts now use the managed Orca server (orcad), and unsupported hosts fail explicitly, so this relay-specific work is no longer planned. This closes the proposed relay implementation; it does not claim that any independent local, WSL, or managed-server behavior was fixed.

[OrcaWin]

Thanks @abruption — the managed server (orcad) now provides the orca CLI in Windows managed-host terminals (#27324), which covers what this PR set out to do. Closing as fixed.