fix(daemon): bump the terminal daemon protocol to v40

[Jinwoo-H]

	Files	Added	Deleted	Net
Test	2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​3	$\color{#cf222e}{\Huge{\mathbf{−}}}$​3	0
Prod	3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​8	$\color{#cf222e}{\Huge{\mathbf{−}}}$​7	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1

ELI5

Orca's terminal background service (the daemon) keeps running across app updates. The app reuses a running daemon only if its protocol number matches. Several daemon-side fixes landed after v1.4.220 shipped protocol 39, without changing the number. So after an update, new terminals would keep running on the old v39 daemon and miss those fixes, and one resume path would fail. Bumping to 40 makes an updated app start a fresh daemon for new terminals. Existing terminals stay on their old daemon, as with every bump.

What Changed

PROTOCOL_VERSION goes from 39 to 40, and 39 joins PREVIOUS_DAEMON_PROTOCOL_VERSIONS, so v39 daemons stay attachable. The tests that pin the version are updated. No other change.

What a v39 daemon from v1.4.220 lacks (from the daemon bundle's import closure, src/main/daemon/daemon-entry.ts, compared between v1.4.220 and today's daily a5b8b7e2bb7):

Change	Effect if new tabs stay on the v1.4.220 daemon
#25130 (shell wrappers)	Startup files can still push Orca's CLI off the front of PATH. In zsh configs that clear the prompt-hook list, Orca's deferred startup never runs.
#24636 (managed accounts)	Managed OpenCode/Devin account panes don't get XDG_DATA_HOME / XDG_STATE_HOME / OPENCODE_DB restored after the user's startup files run.
jcode (4049e63), #24616, #24670, af13da5	The old daemon doesn't know jcode, qoder-cn or dsb, so it drops launchAgent. Those panes lose the git credential guard, child-process cleanup on kill, and agent detection.
Resume list (agent-session-resume.ts)	The app now claims resumes for qoder-cn, qwen-code, cursor and jcode, and the only gate is "protocol ≥ 26". The v39 daemon rejects those claims with agent_session_identity_required (daemon-terminal-admission.ts:71-76), which isn't the error that triggers the fallback, so the resume fails.
#24622	Windows panes don't get ORCA_AGENT_HOOK_NODE. Still works through the fallback path.

Why

• Why main: main has the same commits at the same v39. A bump made only on the v1.4.221 release branch would give "40" two meanings, and main's next build would reuse a release daemon it doesn't match.
• Why not per-agent gates: gating each new agent's resume claim in the local daemon adapter would also prevent the hard failure, and is worth doing separately. But it wouldn't deliver the wrapper fixes in Keep Orca CLI first after shell startup #25130 and Add host-owned OpenCode and Devin managed account profiles #24636, which run inside the daemon.
• Release: the v1.4.221 release branch will cherry-pick this exact commit.

Linked Issue

N/A (maintainer; v1.4.221 release prerequisite)

Visual Proof

N/A: protocol version only.

Testing

• Daemon, pty IPC and codex suites: 5,850 passed.
  • The 2 repro-13767 failures also fail on the unmodified daily, as known.
  • The protocol-version tests fail before their expectations are updated.
• Version-gate audit: every *_DAEMON_PROTOCOL_VERSION gate is unchanged, and the only gate at 39 (the fish codex function) is present in the v1.4.220 daemon.
• Not run: a live upgrade test (old daemon running → update → new tab).

Review

Agent skill upstream boundary

• Not applicable

Notes

• Cross-platform: same on all platforms. The daemon name and the Windows pipe name both carry the version.
• SSH: remote relays version agent capabilities separately (agent-resume-host-authority-capability.ts), so this doesn't change them.

Checklist

• This PR is small and focused
• I explained what changed and why
• N/A for visuals, with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered
• Tests pass locally for the touched contracts; CI covers the rest

[pullfrog]

Important

The PROTOCOL_VERSION bump leaves the packaged local-build compatibility contract at 39. local-build-compatibility-contract.test.ts now fails, and every macOS local build advertises the wrong set of attachable daemon protocols.

Reviewed changes

• Protocol bump — PROTOCOL_VERSION 39 → 40 and 39 appended to PREVIOUS_DAEMON_PROTOCOL_VERSIONS in src/main/daemon/daemon-protocol-version.ts, with the header comment rewritten to describe what v40 rolls up.
• Daemon protocol tests — the two version-pinning assertions updated to expect 40 / a 39-element history.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

AGENTS.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8dd06be3-a658-4a75-a7fc-be1fab1d2e32

📥 Commits

Reviewing files that changed from the base of the PR and between a9d4587 and f31de44.

📒 Files selected for processing (2)

• src/shared/local-build-compatibility-contract.json
• src/shared/local-build-compatibility-contract.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The current daemon protocol version changes from 39 to 40. The previous-version list adds version 39. The compatibility contracts add protocol 40 to their attachable versions. The protocol version tests and foreground confirmation protocol test now expect version 40.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to f31de

Existing v39 terminals remain attachable, while new terminals use v40. No actionable merge risk was identified in the reviewed change.

Security Architecture Review

Security architecture risk: 🔵 Low · up to f31de

The declarations consistently advance to protocol 40 while preserving existing version 39 terminals. No introduced authentication bypass was identified. Risk remains low rather than minimal because live upgrade, overlapping startup, and resume recovery behavior were not fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The evidenced exposure is local daemon endpoints and the terminal sessions they own. Adding protocol 40 enables selection of another versioned endpoint, but the compatibility metadata itself does not supply an authentication token or arbitrary endpoint address.

Trust Boundaries and Controls

• observed — Server hello handling checks the supplied protocol version, token, and connection role before installing a control or stream connection. The client sends the protocol and token and rejects missing or malformed daemon identity for modern protocols. Compatibility acceptance is distinct from these transport controls.

Resilience and Maintainability Implications

• observed — Endpoint publication writes the token with owner-only permissions, cleans up published PID ownership on token-publication failure, and uses ownership-aware artifact removal. Confirmed ownership loss triggers retirement rather than continued acceptance of fresh work. These controls provide counterevidence to an ownership bypass, but do not establish all concurrent-startup outcomes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 4 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the daemon protocol bump to v40.
Description check	✅ Passed	The description explains the change, its impact, rationale, testing, compatibility considerations, and why visual proof and a linked issue are not applicable. It also notes that a live upgrade test wa…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 4 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

✅ No new issues found.

Reviewed changes

This incremental re-review covers the delta since the prior pullfrog review: the packaged local-build compatibility contract catch-up to v40. The prior blocker is resolved.

• Daemon protocol bumped to v40 — PROTOCOL_VERSION 39 → 40 and 39 appended to PREVIOUS_DAEMON_PROTOCOL_VERSIONS, so an updated app starts a fresh daemon for new terminals while v39 daemons stay attachable.
• Local-build contract bumped to v40 — daemonProtocolVersion 39 → 40 and 40 appended to attachableDaemonProtocolVersions in both src/shared/local-build-compatibility-contract.ts and .json, matching the runtime constants. Verified pnpm test src/main/local-builds/local-build-compatibility-contract.test.ts passes.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}