Repository navigation
Phase 3.7: fix SSH/remote failures found by adversarial real-host testing - #26847
Merged
Merged
Conversation
…age (P1-4) (#26625) * fix(remote-terminal): keep a reconnected pane's grid when its stale stream is reaped (P1-4) The host's width floor only handed ownership to viewers that had claimed since subscribing. A reconnecting desktop pane re-subscribes without claiming, so when the heartbeat later reaped the dead socket that owned the floor, the host reclaimed the PTY to its spawn size (120x40) and held the pane there. The owner's same-client replacement stream now inherits the floor, and a pane whose stream was reaped before it reconnected resumes ownership on re-register unless the host or another viewer claimed since. * fix(remote-terminal): host typing during an outage revokes the reaped owner's resume Host input reaches the PTY without a renderer viewport claim once the host has reclaimed its grid, so the orphaned-owner entitlement survived and a passive reconnect resized the host pane back to the remote grid. The host write path now clears that entitlement on driving input (query replies, focus reports and launch writes excluded). * test(pty): stub the runtime's host-input note in write-path handler tests --------- Co-authored-by: m4air <m4air@Mac.localdomain>
…sing the host connection (#26624) Expanding a folder with ~80k entries on a managed SSH host produced a files.readDir reply over the 4 MiB encrypted-reply cap. The channel treated that as a transport fault and closed the whole control socket (1013), and the explorer rendered the failed folder as empty. - The WebSocket RPC transport now answers an over-cap reply with a reply_too_large error for that request id, so the channel never sees it. - files.readDir checks remote listings against the request's content budget and names the entry count. - The explorer shows a subfolder's read error on its expanded row. Finding: HH-2 (Phase 3.7 hostile-host). Co-authored-by: m4air <m4air@Mac.localdomain>
…HH-3) (#26631) * fix(ssh): let a slow host finish installing the pinned Node runtime The POSIX promote (extract, hash, self-test and publish the ~110 MiB node binary) ran under the 30 s default exec timeout. On slow home storage it timed out, the remote work kept running, and the runtime store lock it held stayed until the 20-minute stale rule, so relay rung A queued behind it past its own deploy bound. Give both platforms the 300 s promote bound and have the host release the store lock itself when the promote exits, with owner-checked releases so a late release never removes a lock someone else took. (HH-3) * fix(ssh): let the host release the store lock after a slow under-lock re-hash The under-lock re-check of a sibling-published runtime hashed the ~110 MiB executable as its own command under the 30 s exec default and outside the host-side lock release. On slow storage it timed out, the client correctly kept the lock, and nothing on the host freed it until the 20-minute stale rule, so later installers ran out their deploy bound. Run the re-hash and the conditional promote as one host command wrapped in the host release, and give every full-runtime hash, including the initial probe, the slow-storage bound. (HH-3) * test(ssh): count the combined under-lock re-probe and promote as one host command --------- Co-authored-by: m4air <m4air@Mac.localdomain>
… (HH-1) (#26617) * fix(ssh): fence captured exec stdout so shell rc output cannot break connect sshd runs the user's login shell before Orca's /bin/sh wrapper, so any startup-file stdout (fish/tcsh/zsh/bash echo, or a bare terminal-title escape) was glued onto every captured answer. The home probe read "banner\n/home/u" and connect failed with "Remote home is not a valid path". execCommand now wraps wrapped POSIX commands in a per-call nonce fence and returns only the payload between the markers; the SSH folder browser gets the same fence. The fence is the existing WSL captured-login-shell fence, moved to src/shared/posix-stdout-fence.ts so both transports share it. Finding: HH-1 (phase 3.7 hostile-host). Refs #8324. * fix(ssh): fence the login-shell Node probe and fall back from a noisy SFTP handshake The login-shell 'command -v node' probe ran unwrapped, so output from sshd's shell and the nested login profile became the Node path. It now prints a one-line fence every login shell parses, inside that shell. An external sftp-server is started through the user's shell, so startup output corrupts the SFTP handshake. ssh2 reports that parse failure only before the session is ready, so SshConnection.sftp tags it, and relay install transfers treat it as SFTP unavailable and stream over exec stdin. Finding: HH-1 follow-up (phase 3.7 hostile-host). Refs #8324. * fix(ssh): keep the stdout fence marker out of the command text The runtime-store inventory lists processes with ps, which prints its own script, so a literal marker in the script was read as the fence and the store GC skipped every pass. printf now joins the marker from two halves. --------- Co-authored-by: m4air <m4air@Mac.localdomain>
…ers after a main-side re-pair (P1-A, P1-C) (#26635) * fix(orcad): finish an update or rollback its client abandoned, and tell renderers about main-side re-pairs P1-A: a wake that finds the activation fence now runs crash recovery, which takes only a stale, previous-boot or exited-own fence. Recovery of an activation interrupted after the candidate launched resumes it: the candidate commits if it passes the readiness gate, else the activation is undone as before. P1-C: invalidating a still-linked environment's transport restarts its status owner, and a renderer that sees status under a newer pairing revision re-reads the catalog before applying it. * fix(orcad): a resumed update keeps the app version that started it Recovery that commits an abandoned candidate stamped no activeAppVersion, so an older desktop read the host as pre-tracking and downgraded it over state the newer build had migrated. The activate journal now records the initiating app version; recovery stamps it, and a journal too old to carry it is undone instead of committed. * test(runtime-env): answer nothing for the status restart a re-pair now triggers * fix(orcad): recovery leaves running an update server a too-old journal cannot commit A journal without candidateAppVersion was sent to undo, which stopped a healthy candidate that had already migrated state and then refused to restart the incumbent, leaving the host serving nothing. Refuse instead, keeping the fence and the candidate, until the operator accepts Restore. --------- Co-authored-by: m4air <m4air@Mac.localdomain>
…e new screen (P2-5, P2-7) (#26647) * fix(terminal): a remote recovery never splices stale history above the new screen A pushed remote snapshot (overflow recovery, seq-gap resync, first attach) is sent because the client's stream broke, so the pane's own history ends before that image. Since #26319 a screen-only image kept that history, splicing a stale block directly above the final screen with a silent gap of up to ~270k lines (P2-5), and a first attach to an older host left silent holes (P2-7). - Host: the ACK-overflow recovery serializes up to 1000 history rows. - Client: the seq-gap resync asks for the same 1000 rows. - Client: a pushed snapshot always replaces the pane's scrollback; the keep-local-scrollback path is removed. A screen-only image from an older host now shows only its screen, which is lossy but never misleading. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(terminal): a pushed image replaces the normal buffer over a live alt screen too Over a pane already on the alternate screen, an image that also ended on alt repainted only its alt frame and kept the pane's normal buffer, inferring the two had frozen together. Inside the gap the TUI can exit, the shell print and a second TUI start, so once that TUI exited the pane showed its stale history where the host had the missed output. A pushed image now always rebuilds the normal buffer and history from the host before entering alt itself. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(terminal): bound recovery history by link slack and keep pre-TUI scrollback under screen-only images A recovery that carries history now goes out only when the stream's ACK window has drained; under a sustained flood recoveries stay screen-only and the owed history follows once the client catches up, so snapshot bytes no longer outgrow the client's intake. A pushed image without history (scrollbackRows absent or 0) over a live alt screen repaints only the alt frame again, so a reconnect to an older host no longer wipes the pane's pre-TUI scrollback. --------- Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…it the 1,000 cap (HH-4) (#26618) * fix(source-control): Stage All stages every change when the listing hit the 1,000 cap The status listing stops at 1,000 rows, but Stage All built its path list from those rows, so it staged 1,000 of 20,000 changes and the next commit was silently partial. When the listing is capped, Stage All (and the Changes header Stage all) now asks the host to stage the whole worktree via an optional scope on git.bulkStage; unresolved conflicts stay unstaged. Older hosts ignore the field and stage the listed paths. Fixes HH-4. * fix(source-control): whole-worktree Stage All needs a host receipt, skips shared links, and reaches mobile - Scoped stage sends no paths and requires a stagedScope receipt, so an older runtime or relay stages nothing and the client reports it instead of a silent partial stage. - Scoped 'all' skips Orca's shared symlinks (configured and really a link), matching the status listing. - The capped-listing banner offers Stage All, reachable when the visible prefix is entirely staged. - Mobile reads didHitLimit and uses the same scoped stage and receipt. * test(source-control): type the Stage All test stubs so lint and the mobile test typecheck pass * fix(source-control): match Shared Paths saved as ./name or name/ against git's spelling The Shared Paths setting keeps entries as typed, but git prints worktree paths without a leading ./ or trailing /. Stage All's conflict path compared the raw spelling to git's untracked list and staged the shared node_modules link, and an exclude pathspec ending in / made git refuse the add after tracked changes were already staged. Status listing had the same mismatch. getSafeRelativePath now returns git's spelling, so every caller gets it, including saved settings. --------- Co-authored-by: m4air <m4air@Mac.localdomain>
…ne whose host is gone (P1-D, P1-E) (#26628) * fix(ssh): redeploy a server another desktop stopped; let a dead managed host be forgotten P1-D: a connect whose linked server the host reports as not activated (another desktop stopped it) now goes on to the update check, which redeploys it in place. P1-E: add Forget (managedServer.forget, orca environment forget, Settings row) that runs Stop's local unlink without contacting the host; the verdict stays unverifiable. * test(ssh): type the forget test's hoisted store without an assertion * fix(ssh): never downgrade a stopped host; redeploy it mid-session and retry after a failure A stop now keeps the stopped build's Orca version, so an older desktop's reconnect skips as host-newer instead of starting an older server on a store a newer build migrated. A stop recorded without that version is not guessed at. A stopped host retries the redeploy on each connect instead of the once-per-version failure suppression, and a runtime call that finds the server stopped mid-session redeploys it before the call. * fix(ssh): rebuild the managed forward after redeploying a stopped host A redeploy can bind a different port than the reused forward targets. * fix(ssh): keep stop journals readable by older desktops and recheck version policy under the fence - The stop journal's recordAfter is the core deactivated record older peers compute; the committed record keeps activeAppVersion (which released planners already honour) and rolledBackFrom, rebuilt from recordBefore on recovery. - Auto-update re-applies its version policy to the record read under the host fence, and a census counted against another incumbent is treated as unverifiable. * fix(ssh): file a dispatched stop where older desktops cannot commit it, so their recovery never drops the version guard * fix(ssh): refuse a fresh deploy of an older orcad onto a host a newer desktop stopped The unlinked deploy path never consulted the stopped record's activeAppVersion, so a desktop without a link to the host could activate its older build over state a newer build migrated. Both the auto-update planner and the fresh deploy now apply one downgrade rule under the fence. --------- Co-authored-by: m4air <m4air@Mac.localdomain>
…rced deploy run over a newer one (#26766) A stopped activation record without activeAppVersion is what every Stop on main writes, so refusing it stranded those hosts behind an unforceable policy refusal. Only a provably newer host is now refused; a forced fresh deploy runs this version anyway, and the refusal names both versions. Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
… silent outage (P1-1, P1-2, P1-3) (#26630) * fix(remote-terminal): no keystroke lost, duplicated or split across a silent outage Remote pane input was fire-and-forget: keys handed to a socket that had silently died were gone, keys still in the 8 ms debounce at detection were cleared, and held keys were discarded when the auto-recovery window ran out. - New negotiated `inputAck` capability: the client names an input session and sequences Input frames (existing frame header `seq`); the host records the last applied sequence per (PTY, session) across connections, writes each sequence once and acks it with new opcode InputAck (18), sent only to clients that advertised the capability. - The pane keeps sent-but-unacked input and replays it to the same terminal on reattach; the host dedupes. Old hosts keep current behavior. - Debounced and claim-queued input at detection is held, not cleared. - Held input survives the 'disconnected' phase; the hold coalesces keys so minutes of typing do not hit the per-entry cap. - Banner copy no longer claims a one-minute retry window. Fixes P1-1, P1-2, P1-3 (phase 3.7 network findings). * fix(remote-terminal): never replay into a restarted runtime; keep Ctrl+C and validating paste in order - Host publishes inputLedgerId with inputAck; the client drops unacknowledged input sent to a different ledger (runtime restart with the same PTY) instead of running it twice. - A replayed duplicate is acked only after the original write settles. - Accepted input (Ctrl+C, Escape, paste) rides the sequenced stream and resolves on the host ack. - Keys typed while held queue behind a paste still in size validation. * fix(remote-terminal): parse subscribed capabilities into a typed shape instead of Reflect.get * fix(remote-terminal): ack only applied input; withdraw writes their caller gave up on - Host ledger records each write's outcome: a refused write is rolled back and never acked, so the client's replay writes it; nothing queued behind it runs or is acked. A write that threw is acked as delivery-unknown, so the client reports it failed and never replays it. - Paste and file-drop timeouts abort their accepted write: a copy still held for an outage is withdrawn, and a journaled copy is left out of the replay. - A batch of sequenced input keeps one endpoint and ledger, so a send that retires the stream mid-batch no longer discards earlier unacked input. * fix(remote-terminal): host writes sequenced input strictly in order and asks the live stream to resend after a refusal - The ledger admits only the next sequence; a refusal or gap answers with an InputAck resend request instead of WriteUnavailable, so the pane keeps its journal and resends on the same stream (no remount, no carrier bookkeeping). - Sequenced input uses the provider's settled write; an unverifiable handoff is delivery-unknown, not refused. - Replays fill given-up slots with empty input so the host can continue; the client remounts only after every resend backoff is refused. - Typing batched ahead of a paste goes out as its own sequences, so cancelling the paste keeps it. * refactor(remote-terminal): deliver sequenced input with standard go-back-N Replace the hand-built "block on refusal" bookkeeping with go-back-N: - Host: per (PTY, input session) the ledger keeps only appliedSeq, the highest contiguous confirmed write. Frames run one at a time in arrival order: a duplicate is re-acked, the next sequence is written and acked on confirmed success, and a refusal or gap is answered with a resend request carrying appliedSeq. No blocked state; every stream is equal. A settlement that proves no byte left is a refusal; one that may have written advances as delivery-unknown and is never retried. - Client: one journal keeps unacked input in order and resends from appliedSeq + 1 on a resend request (with backoff), on a new stream, or when acks stall. Refusals never remount the pane. Withdrawn pastes, stale query replies and over-budget bytes resend as empty slots. - The recovery hold pauses (keeps the rest) when a release is cut short by another outage, and keeps delivering typing after an accepted write a sequenced stream withdrew or could not confirm. - Add a seeded model-based test that drives the real pane transport, multiplexer and journal against the real host dispatcher and ledger through 2,000 random fault schedules. * test(remote-terminal): cover the refusal remount on a stream without sequenced input A sequenced stream now resends refused input on the same stream instead of remounting, so the end-to-end remount check negotiates no inputAck, as an older peer does. * fix(remote-terminal): escalate persistent input refusals, drop input once recovery gives up, and never report a lost unknown ack as applied - The pane falls back to its remount path when the host keeps refusing input past the resend backoff ladder. - Held and journaled input is discarded when auto-recovery gives up, and input typed under the disconnected banner is not held. - The host ledger answers a duplicate for its own sequence and remembers delivery-unknown outcomes; the client settles a write as applied only from its own ack. - The input model now requires a write reported applied to have reached the PTY whole, and covers a refusal that never clears. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local> Co-authored-by: Claude <noreply@anthropic.com>
# Conflicts: # src/main/ipc/runtime-environment-managed-tunnel.ts # src/renderer/src/components/right-sidebar/source-control-too-many-changes-banner.test.tsx # src/shared/wsl-login-shell-command.ts
…for the same terminal, within a bounded grace (P1-3) (#26832) The last round of #26630 discarded held and journaled input as soon as auto-recovery gave up, and refused input under the disconnected banner. On a real host a 200 s outage lost 102 of 120 keystrokes, although the pane reattached the same terminal on its own seconds later. Input now stays held for the same handle and incarnation while the pane is disconnected, for up to 5 minutes after it gave up. Past that grace it is discarded, and typing into the dead pane is refused, so stale keys never run at an arbitrary later reconnect. The grace is a timestamp checked when input moves, so a latched pane stays free of timers. Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: Claude <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review. 📝 WalkthroughWalkthroughThe changes add scoped Git staging for complete and capped status listings. Remote terminal input gains sequence acknowledgements, replay, cancellation, and recovery handling. Snapshot recovery distinguishes screen-only images from images carrying history. Managed-server changes add local forgetting and update activation, wake, and decommission recovery. SSH command output is fenced against startup noise, and runtime RPC handling adds response-size limits and catalog-aware status updates. Priority: ⬆️ High Merge Risk: 🔵 Low · up to In narrow cases, terminal ownership may not resume after a refused write, or staging may finish after the client reports a timeout. These risks are bounded but remain open; R1’s stale resize ownership concern is resolved. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
src/main/ssh/remote-node-runtime-store-lock.ts (1)
44-51: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueThe owner check and the
rm -rfdo not run as one atomic step.The command reads
.holder, then deletes the lock by path. A second holder can steal the lock and write its own token after the check passes. In that window, this release removes the new holder's lock. The window is small. Stealing also needs the 20-minute stale rule, so the trigger is unlikely. To close the window, rename the lock directory to a unique name before you check the token, then delete the renamed copy.Source: Learnings
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Repository UI
- Review profile: CHILL
- Plan: Advanced
- Run ID:
1bc1c238-a2c6-41c0-ab0d-ec043231059d
⛔ Files ignored due to path filters (1)
src/shared/rpc-contract/rpc-params-catalog.generated.tsis excluded by!**/*.generated.*
📒 Files selected for processing (235)
config/reliability-gates.jsoncmobile/src/source-control/MobileSourceControlContent.tsxmobile/src/source-control/mobile-source-control-capped-stage-all.test.tsxmobile/src/source-control/use-mobile-source-control-runners.tsmobile/src/source-control/use-mobile-stage-all-runner.tssrc/cli/handler-group-manifest.tssrc/cli/handlers/managed-server.test.tssrc/cli/handlers/managed-server.tssrc/cli/specs/managed-server.tssrc/main/codex/codex-trust-grant-host.test.tssrc/main/git/runner-wsl-direct-read.test.tssrc/main/git/runner-wsl-login-shell-capture.test.tssrc/main/git/runner-wsl-network-ssh-policy.test.tssrc/main/git/source-control/stage-worktree-changes.test.tssrc/main/git/source-control/staging.tssrc/main/git/source-control/wsl-tracked-pathspec-banner.test.tssrc/main/git/status-shared-symlinks.test.tssrc/main/git/status.tssrc/main/git/worktree-symlink-detection.test.tssrc/main/git/worktree-symlink-detection.tssrc/main/ipc/filesystem-git-status-staging.test.tssrc/main/ipc/filesystem-test-harness.tssrc/main/ipc/filesystem/filesystem-git-index-handlers.tssrc/main/ipc/managed-orcad-actions.tssrc/main/ipc/orcad-runtime-maintenance-handlers.tssrc/main/ipc/pty-runtime-ssh-binding-persistence.test.tssrc/main/ipc/pty-serializer-settlement-mapping.test.tssrc/main/ipc/pty/ipc/write-input-user-input.test.tssrc/main/ipc/pty/ipc/write-input.tssrc/main/ipc/runtime-environment-handler-channels.tssrc/main/ipc/runtime-environment-managed-tunnel.test.tssrc/main/ipc/runtime-environment-managed-tunnel.tssrc/main/ipc/runtime-environments-pairing.test.tssrc/main/ipc/runtime-environments-subscription-lifecycle.test.tssrc/main/ipc/runtime-environments-subscription-teardown.test.tssrc/main/ipc/runtime-environments.tssrc/main/ipc/ssh-browse.test.tssrc/main/ipc/ssh-browse.tssrc/main/ipc/ssh-target-crud-handlers.tssrc/main/providers/git-provider-contract.tssrc/main/providers/ssh-git-provider-staging.test.tssrc/main/providers/ssh-git-working-tree-provider.tssrc/main/runtime/managed-server-actions-registry.tssrc/main/runtime/orca-runtime-mark-pty-liveness-unverifiable.tssrc/main/runtime/remote-desktop-driver.test.tssrc/main/runtime/remote-desktop-terminal-floor-reconnect.test.tssrc/main/runtime/remote-desktop-terminal-floor.tssrc/main/runtime/rpc/methods/files-read-dir-remote-budget.test.tssrc/main/runtime/rpc/methods/files-remote-content-budget.tssrc/main/runtime/rpc/methods/files.tssrc/main/runtime/rpc/methods/git-params.tssrc/main/runtime/rpc/methods/git.tssrc/main/runtime/rpc/methods/managed-server.test.tssrc/main/runtime/rpc/methods/managed-server.tssrc/main/runtime/rpc/methods/terminal/stream-schemas.tssrc/main/runtime/rpc/methods/terminal/terminal-input-delivery.tssrc/main/runtime/rpc/methods/terminal/terminal-input-sequence-ledger.test.tssrc/main/runtime/rpc/methods/terminal/terminal-input-sequence-ledger.tssrc/main/runtime/rpc/methods/terminal/terminal-multiplex-cleanup.tssrc/main/runtime/rpc/methods/terminal/terminal-multiplex-connection.tssrc/main/runtime/rpc/methods/terminal/terminal-multiplex-flow-control.tssrc/main/runtime/rpc/methods/terminal/terminal-multiplex-frame-delivery.tssrc/main/runtime/rpc/methods/terminal/terminal-multiplex-initial-snapshot.tssrc/main/runtime/rpc/methods/terminal/terminal-multiplex-input-frame.tssrc/main/runtime/rpc/methods/terminal/terminal-multiplex-slot-frames.tssrc/main/runtime/rpc/methods/terminal/terminal-multiplex-stream-initialization.tssrc/main/runtime/rpc/methods/terminal/terminal-stream-types.tssrc/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery-history.test.tssrc/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.tssrc/main/runtime/rpc/terminal-multiplex-input-sequence-replay.test.tssrc/main/runtime/runtime-git-stage-worktree-scope.test.tssrc/main/runtime/runtime-git-staging-commands.tssrc/main/runtime/runtime-rpc-mobile-method-allowlist.test.tssrc/main/runtime/runtime-rpc-websocket-reply-size-limit.test.tssrc/main/runtime/runtime-rpc/runtime-rpc-reply-size-limit.tssrc/main/runtime/runtime-rpc/runtime-rpc-websocket-dispatch.tssrc/main/runtime/terminal-run-facts.tssrc/main/ssh/managed-server-fence-recheck.tssrc/main/ssh/managed-server-serving-gate.tssrc/main/ssh/orcad-activation-crash-recovery.test.tssrc/main/ssh/orcad-activation-record.test.tssrc/main/ssh/orcad-activation-record.tssrc/main/ssh/orcad-activation-recovery.tssrc/main/ssh/orcad-activation-transaction-schema.tssrc/main/ssh/orcad-activation-transaction-transitions.tssrc/main/ssh/orcad-activation-transaction.tssrc/main/ssh/orcad-decommission-released-peer-recovery.test.tssrc/main/ssh/orcad-decommission-transaction.test.tssrc/main/ssh/orcad-decommission-transaction.tssrc/main/ssh/orcad-host-version-admission.tssrc/main/ssh/orcad-installed-activation.tssrc/main/ssh/orcad-interrupted-candidate-resume.tssrc/main/ssh/orcad-managed-auto-update.test.tssrc/main/ssh/orcad-managed-auto-update.tssrc/main/ssh/orcad-managed-serving.tssrc/main/ssh/orcad-managed-tunnel-manager.tssrc/main/ssh/orcad-managed-tunnel.test.tssrc/main/ssh/orcad-managed-tunnel.tssrc/main/ssh/orcad-managed-update-on-restore.test.tssrc/main/ssh/orcad-managed-update-on-restore.tssrc/main/ssh/orcad-managed-wake.test.tssrc/main/ssh/orcad-managed-wake.tssrc/main/ssh/orcad-remote-deploy.test.tssrc/main/ssh/orcad-remote-deploy.tssrc/main/ssh/orcad-remote-node-runtime-promotion-lock.test.tssrc/main/ssh/orcad-remote-node-runtime-slow-hash.test.tssrc/main/ssh/orcad-remote-node-runtime-windows.test.tssrc/main/ssh/orcad-remote-node-runtime-windows.tssrc/main/ssh/orcad-remote-node-runtime.tssrc/main/ssh/orcad-remote-stop.tssrc/main/ssh/orcad-runtime-decommission.tssrc/main/ssh/orcad-runtime-deployment.test.tssrc/main/ssh/orcad-runtime-deployment.tssrc/main/ssh/orcad-runtime-forget.test.tssrc/main/ssh/orcad-runtime-lifecycle.tssrc/main/ssh/orcad-runtime-maintenance.tssrc/main/ssh/orcad-state-mutation-timeout.test.tssrc/main/ssh/orcad-unreachable-setup-release.tssrc/main/ssh/remote-node-runtime-store-lock-host-release.test.tssrc/main/ssh/remote-node-runtime-store-lock.tssrc/main/ssh/sftp-handshake-corruption.tssrc/main/ssh/ssh-connection.tssrc/main/ssh/ssh-exec-rc-stdout-noise.test.tssrc/main/ssh/ssh-host-server-on-connect-stopped-elsewhere.test.tssrc/main/ssh/ssh-host-server-on-connect.tssrc/main/ssh/ssh-login-shell-command.tssrc/main/ssh/ssh-relay-deploy-helpers.test.tssrc/main/ssh/ssh-relay-exec-command.tssrc/main/ssh/ssh-relay-install-noisy-sftp-wire.test.tssrc/main/ssh/ssh-relay-install-transfers-exec-fallback.test.tssrc/main/ssh/ssh-relay-install-transfers.tssrc/main/ssh/ssh-relay-opencode-runtime.test.tssrc/main/ssh/ssh-remote-node-resolution.test.tssrc/main/ssh/ssh-remote-node-resolution.tssrc/main/wsl/wsl-guest-environment.test.tssrc/main/wsl/wsl-runner.test.tssrc/preload/api/git-bridge.tssrc/preload/api/git-operation-api.tssrc/preload/api/managed-orcad-api.tssrc/relay/git-handler-stage-worktree-scope.test.tssrc/relay/git-handler-worktree-change-operations.tssrc/renderer/src/components/right-sidebar/FileExplorerRow.load-error.test.tsxsrc/renderer/src/components/right-sidebar/FileExplorerRow.tsxsrc/renderer/src/components/right-sidebar/FileExplorerVirtualRows.tsxsrc/renderer/src/components/right-sidebar/source-control-too-many-changes-banner.test.tsxsrc/renderer/src/components/right-sidebar/source-control/commit/use-bulk-actions-capped-stage.test.tsxsrc/renderer/src/components/right-sidebar/source-control/commit/use-bulk-actions.tssrc/renderer/src/components/right-sidebar/source-control/listing/content-status.tsxsrc/renderer/src/components/right-sidebar/source-control/listing/section-action-buttons.test.tsxsrc/renderer/src/components/right-sidebar/source-control/listing/too-many-changes-banner.tsxsrc/renderer/src/components/right-sidebar/source-control/listing/uncommitted-sections.tsxsrc/renderer/src/components/right-sidebar/source-control/listing/use-file-listing.tssrc/renderer/src/components/right-sidebar/source-control/panel/panel-content.tsxsrc/renderer/src/components/right-sidebar/source-control/panel/use-panel-foundation.tssrc/renderer/src/components/settings/ManagedServerRow.test.tsxsrc/renderer/src/components/settings/ManagedServerRow.tsxsrc/renderer/src/components/settings/SshHostDeltaMoveDialog.test.tsxsrc/renderer/src/components/terminal-pane/pty-connection/deferred-cold-restore-and-snapshot.tssrc/renderer/src/components/terminal-pane/pty-connection/replay-data-drain.tssrc/renderer/src/components/terminal-pane/pty-output-processor.tssrc/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.tssrc/renderer/src/components/terminal-pane/pty-transport-types.tssrc/renderer/src/components/terminal-pane/remote-reattach-input-buffer.tssrc/renderer/src/components/terminal-pane/remote-runtime-disconnected-input-grace.tssrc/renderer/src/components/terminal-pane/remote-runtime-input-journal.test.tssrc/renderer/src/components/terminal-pane/remote-runtime-input-journal.tssrc/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-source-grid.test.tssrc/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.tssrc/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.tssrc/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.tssrc/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-replay.test.tssrc/renderer/src/components/terminal-pane/remote-runtime-pty-transport-snapshot-replay.test.tssrc/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-fixtures.tssrc/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.tssrc/renderer/src/components/terminal-pane/remote-runtime-pty-transport.tssrc/renderer/src/components/terminal-pane/remote-runtime-recovery-input-hold.test.tssrc/renderer/src/components/terminal-pane/remote-runtime-recovery-input-hold.tssrc/renderer/src/components/terminal-pane/remote-snapshot-alt-screen-host-chain.test.tssrc/renderer/src/components/terminal-pane/remote-snapshot-history-seam.test.tssrc/renderer/src/components/terminal-pane/remote-snapshot-scrollback-preservation.test.tssrc/renderer/src/components/terminal-pane/terminal-drop-handler.test.tssrc/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.tssrc/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.tssrc/renderer/src/components/terminal-pane/terminal-drop-path-writer.tssrc/renderer/src/components/terminal-pane/terminal-pane-menu-paste.tssrc/renderer/src/components/terminal-pane/terminal-pane-paste-execution.tssrc/renderer/src/components/terminal-pane/terminal-paste-coordinator.test.tssrc/renderer/src/components/terminal-pane/terminal-paste-executor.tssrc/renderer/src/components/terminal-pane/terminal-paste-operation-timeout.tssrc/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.tssrc/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.tssrc/renderer/src/components/terminal-pane/terminal-pty-paste-writer.tssrc/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.tssrc/renderer/src/components/terminal-pane/terminal-startup-command-paste.tssrc/renderer/src/components/terminal-pane/use-terminal-pane-mobile-actions.tssrc/renderer/src/i18n/en-runtime-required.jsonsrc/renderer/src/i18n/locales/en.jsonsrc/renderer/src/i18n/locales/es.jsonsrc/renderer/src/i18n/locales/fr.jsonsrc/renderer/src/i18n/locales/ja.jsonsrc/renderer/src/i18n/locales/ko.jsonsrc/renderer/src/i18n/locales/zh.jsonsrc/renderer/src/runtime/remote-runtime-terminal-binary-controller.tssrc/renderer/src/runtime/remote-runtime-terminal-binary-snapshots.tssrc/renderer/src/runtime/remote-runtime-terminal-flow-controller.tssrc/renderer/src/runtime/remote-runtime-terminal-frame-drop-resync.test.tssrc/renderer/src/runtime/remote-runtime-terminal-multiplexer-base.tssrc/renderer/src/runtime/remote-runtime-terminal-multiplexer-implementation.tssrc/renderer/src/runtime/remote-runtime-terminal-multiplexer-types.tssrc/renderer/src/runtime/remote-runtime-terminal-response-controller.tssrc/renderer/src/runtime/remote-runtime-terminal-snapshot-controller.tssrc/renderer/src/runtime/remote-runtime-terminal-snapshot-state.tssrc/renderer/src/runtime/runtime-environment-pairing-refresh.tssrc/renderer/src/runtime/runtime-git-client.tssrc/renderer/src/runtime/runtime-git-working-tree-client.tssrc/renderer/src/runtime/runtime-git-worktree-scope-client.test.tssrc/renderer/src/runtime/runtime-terminal-stream.test.tssrc/renderer/src/store/slices/runtime-status-snapshot.test.tssrc/renderer/src/store/slices/runtime-status-snapshot.tssrc/renderer/src/store/slices/runtime-status.tssrc/renderer/src/web/preload-api/web-git-api.tssrc/renderer/src/web/preload-api/web-git-stage-scope.test.tssrc/shared/git-stage-worktree-scope.tssrc/shared/orcad-managed-runtime.tssrc/shared/posix-stdout-fence.tssrc/shared/rpc-contract/git-params.tssrc/shared/runtime-environment-store.tssrc/shared/terminal-mode-reset-profiles.tssrc/shared/terminal-multiplex-flow-control.tssrc/shared/terminal-stream-protocol.tssrc/shared/wsl-login-shell-command.tstests/e2e/cross-version-wire/host-terminal-runtime-stub.tstests/e2e/paired-runtime-rejected-input-remount.unit.test.tstests/e2e/remote-terminal-input-delivery-model.unit.test.tstests/e2e/remote-terminal-input-model-link.ts
💤 Files with no reviewable changes (4)
- src/main/ssh/orcad-remote-node-runtime-windows.ts
- src/renderer/src/components/terminal-pane/remote-snapshot-scrollback-preservation.test.ts
- src/renderer/src/runtime/remote-runtime-terminal-snapshot-state.ts
- src/renderer/src/i18n/en-runtime-required.json
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.
| lastInputAtByPty.set(args.id, performance.now()) | ||
| interactiveOutputCharsByPty.set(args.id, 0) | ||
| runtime?.terminalRunFacts?.recordInput(args.id, args.inputKind, args.data) | ||
| runtime?.noteRemoteDesktopHostInput(args.id, args.inputKind, args.data) |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Clear the pending owner resume only after an accepted host write.
If a provider refuses a write or the size check rejects input, this call still clears the pending resume before writeAndObserveInput returns false. A later passive reconnect then fails to restore the remote pane's grid even though the host input was not accepted. Move this notification to the accepted-write path.
Comment on lines
+206
to
+208
| if (this.owners.get(ptyId) === subscriptionKey) { | ||
| removedOwnerClientId = viewers.get(subscriptionKey)?.clientId ?? null | ||
| } |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Preserve the removed owner's client ID when a key repeats.
If subscriptionKeys contains the owner key twice, the first pass deletes its viewer. The second pass replaces removedOwnerClientId with null because owners still holds that key. The method then leaves a deleted subscription as owner, so remote resize suppression can remain active after the viewer is gone. Capture the client ID only while the viewer still exists.
Comment on lines
+67
to
+73
| const reply = await callRuntimeRpc<unknown>( | ||
| target, | ||
| 'git.bulkStage', | ||
| { worktree: toRuntimeWorktreeSelector(context.worktreeId), filePaths: [], scope }, | ||
| { timeoutMs: 15_000 } | ||
| ) | ||
| requireGitStageWorktreeScopeReceipt(reply, scope) |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
set -o pipefail
printf '%s\n' '--- changed file and related symbols ---'
sed -n '1,180p' src/renderer/src/runtime/runtime-git-working-tree-client.ts
printf '%s\n' '--- references ---'
rg -n -F --glob '!node_modules' --glob '!dist' -- 'stageRuntimeGitWorktreeScope|git.bulkStage|callRuntimeResult|forkSync|requireGitStageWorktreeScopeReceipt' src packages apps 2>/dev/null || true
printf '%s\n' '--- diff from required base ---'
git diff --stat e43997c015c265840b99e291348da933e1ee3344 fc4707bf8e689ea2640983cf78dfe25dc2a97d3b -- src/renderer/src/runtime/runtime-git-working-tree-client.ts
git diff --unified=30 e43997c015c265840b99e291348da933e1ee3344 fc4707bf8e689ea2640983cf78dfe25dc2a97d3b -- src/renderer/src/runtime/runtime-git-working-tree-client.ts
printf '%s\n' '--- timeout implementation candidates ---'
rg -n -F --glob '!node_modules' --glob '!dist' -- 'timeoutMs' src packages apps 2>/dev/null | head -200 || true
printf '%s\n' '--- git.bulkStage definitions ---'
rg -n -F --glob '!node_modules' --glob '!dist' -- 'bulkStage' . 2>/dev/null | head -200 || trueRepository: stablyai/orca
Length of output: 41422
🏁 Script executed:
set -o pipefail
sed -n '1,180p' src/renderer/src/runtime/runtime-git-working-tree-client.ts
rg -n -F --glob '!node_modules' --glob '!dist' -- 'stageRuntimeGitWorktreeScope|git.bulkStage|callRuntimeResult|forkSync|requireGitStageWorktreeScopeReceipt' . 2>/dev/null | head -300 || true
git diff --unified=30 e43997c015c265840b99e291348da933e1ee3344 fc4707bf8e689ea2640983cf78dfe25dc2a97d3b -- src/renderer/src/runtime/runtime-git-working-tree-client.tsRepository: stablyai/orca
Length of output: 9217
🏁 Script executed:
printf '%s\n' '--- client ---'
nl -ba src/renderer/src/runtime/runtime-git-working-tree-client.ts | sed -n '1,140p'
printf '%s\n' '--- exact references ---'
rg -n -F --glob '!node_modules' --glob '!dist' -- 'stageRuntimeGitWorktreeScope' . || true
rg -n -F --glob '!node_modules' --glob '!dist' -- 'git.bulkStage' . || true
rg -n -F --glob '!node_modules' --glob '!dist' -- 'callRuntimeResult' . | head -120 || true
printf '%s\n' '--- base-to-head diff ---'
git diff --unified=20 e43997c015c265840b99e291348da933e1ee3344 fc4707bf8e689ea2640983cf78dfe25dc2a97d3b -- src/renderer/src/runtime/runtime-git-working-tree-client.tsRepository: stablyai/orca
Length of output: 41296
🏁 Script executed:
set -o pipefail
printf '%s\n' '--- host runtime git method ---'
nl -ba src/main/runtime/rpc/methods/git.ts | sed -n '170,245p'
printf '%s\n' '--- runtime staging implementation ---'
rg -n -F --glob '*.ts' -- 'bulkStageRuntimeGitPaths|stageWorktreeChanges|bulkStageFiles' src/main/runtime src/main/git src/main/providers src/relay | head -120
printf '%s\n' '--- whole-worktree staging implementation/tests ---'
nl -ba src/main/git/source-control/staging.ts | sed -n '1,260p'
nl -ba src/main/runtime/runtime-git-stage-worktree-scope.test.ts | sed -n '1,150p'
printf '%s\n' '--- web staging and caller ---'
nl -ba src/renderer/src/web/preload-api/web-git-api.ts | sed -n '225,265p'
nl -ba src/renderer/src/web/preload-api/web-runtime-calls.ts | sed -n '1,180p'
printf '%s\n' '--- renderer RPC client and related budgets ---'
nl -ba src/renderer/src/runtime/runtime-rpc-client.ts | sed -n '1,220p'
rg -n -F --glob '*.ts' -- 'git.forkSync' src | head -40
rg -n -F --glob '*.ts' -- 'forkSync' src/main src/renderer/src | head -80
printf '%s\n' '--- scoped-stage caller and cap ---'
nl -ba src/renderer/src/components/right-sidebar/source-control/commit/use-bulk-actions.ts | sed -n '140,195p'
rg -n -F --glob '*.ts' --glob '*.tsx' -- 'status cap|statusCap|MAX.*STATUS|capped' src/renderer/src src/main | head -120Repository: stablyai/orca
Length of output: 39231
🏁 Script executed:
set -o pipefail
printf '%s\n' '--- runtime staging command binding ---'
nl -ba src/main/runtime/runtime-git-staging-commands.ts | sed -n '1,260p'
printf '%s\n' '--- shared scoped staging contract ---'
nl -ba src/shared/git-stage-worktree-scope.ts | sed -n '1,260p'
printf '%s\n' '--- git runner and timeout options ---'
rg -n -F --glob '*.ts' -- 'function gitExecFileAsync|const gitExecFileAsync|export async function gitExecFileAsync|gitCommandTimeoutMs|timeout:' src/main/git src/main | head -160
nl -ba src/main/git/runner.ts | sed -n '1,260p'
printf '%s\n' '--- runtime transport timeout path ---'
nl -ba src/renderer/src/runtime/runtime-rpc-environment-call.ts | sed -n '1,240p'
nl -ba src/cli/runtime/client.ts | sed -n '70,210p'
nl -ba src/cli/runtime/transport.ts | sed -n '1,100p'
printf '%s\n' '--- forkSync timeout ---'
nl -ba src/renderer/src/runtime/runtime-git-sync-client.ts | sed -n '80,125p'
nl -ba src/renderer/src/web/preload-api/web-git-api.ts | sed -n '140,175p'
printf '%s\n' '--- web/runtime timeout defaults ---'
rg -n -F --glob '*.ts' -- 'DEFAULT_TIMEOUT_MS|DEFAULT_REMOTE_RUNTIME_TIMEOUT_MS|resolveMethodTimeoutMs|methodTimeout' src/renderer/src src/cli src/main | head -180Repository: stablyai/orca
Length of output: 28633
🏁 Script executed:
set -o pipefail
printf '%s\n' '--- Git command runner implementation ---'
rg --files src/main/git/command-runner src/main | rg 'git-exec-file|git-command-timeout|git-spawn|runtime-environment|runtime.*call|request'
rg -n -F --glob '*.ts' -- 'gitExecFileAsync' src/main/git/command-runner | head -40
sed -n '1,260p' src/main/git/command-runner/git-exec-file.ts
sed -n '1,220p' src/main/git/command-runner/git-command-timeout.ts
printf '%s\n' '--- Git options and admission timeout ---'
rg -n -F --glob '*.ts' -- 'admissionTier|timeoutMs|timeout:' src/main/git/command-runner src/main/git/git-runtime-options.ts src/main/git | head -180
nl -ba src/main/git/git-runtime-options.ts | sed -n '1,220p'
printf '%s\n' '--- runtime client defaults/construction ---'
rg -n -F --glob '*.ts' -- 'requestTimeoutMs|new RuntimeClient|RuntimeClient(' src/cli src/main src/renderer/src | head -160
printf '%s\n' '--- runtime server request/disconnect handling ---'
rg -n -F --glob '*.ts' -- 'socket.on|close|dispatch|dispatchRequest|readline|RuntimeRpc' src/cli/runtime src/main/runtime | head -220Repository: stablyai/orca
Length of output: 30622
🏁 Script executed:
set -o pipefail
printf '%s\n' '--- shared Git timeout policy ---'
nl -ba src/shared/git-command-timeout.ts | sed -n '1,260p'
printf '%s\n' '--- timeout policy tests and callers ---'
nl -ba src/main/git/command-runner/git-command-timeout-behavior.test.ts | sed -n '1,180p'
rg -n -F --glob '*.ts' -- 'gitCommandTimeoutMs(' src | head -80Repository: stablyai/orca
Length of output: 7859
Give whole-worktree staging a longer timeout.
A capped listing requires the host to scan the worktree. Scoped staging can run several Git commands. The renderer waits only 15 seconds, while Git read commands allow 120 seconds and git add has no default command timeout. The client can therefore report a timeout while the host continues staging.
Use the existing 60-second Git budget in both remote callers.
Suggested fix
- { timeoutMs: 15_000 }
+ { timeoutMs: 60_000 }- })
+ }, 60_000)
Collaborator
Author
|
CI notes:
|
Meapri
added a commit
to Meapri/orca
that referenced
this pull request
Oct 9, 2026
Re-stacks every topic onto upstream 40716d7 (after stablyai#26483 Phase 3.5 and stablyai#26847 Phase 3.7) through the server sync; tree is exactly integrate/fork-2026-10-09-3. First parent is the previous main-update commit, which descends from main, so main still moves by fast-forward. Fork-Topic: sync-automation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
8 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ELI5
We attacked Orca's SSH and remote-host support on purpose with a bad network, unusual hosts, crashes mid-update and several desktops sharing one host, and wrote down everything that broke. This PR fixes the breakages that mattered most. After it:
Each fix landed and was reviewed separately on
OrcaWin/phase37. Everything was then re-tested together on a packaged build against a real SSH host.What Changed
Reliable remote input across an outage (P1-1, P1-2, P1-3): #26630, #26832
inputAck); an older peer gets the old unsequenced input.Fixes: Phase 3.7 findings P1-1, P1-2, P1-3 (no GitHub issue).
A reconnected pane keeps its size (P1-4): #26625
stty sizeprinted40 120).61 159.Fixes: Phase 3.7 finding P1-4 (no GitHub issue).
Interrupted updates finish themselves; renderers refresh after a re-pair (P1-A, P1-C): #26635
--accept-changed-state --yes, which rolled profile state back.Fixes: Phase 3.7 findings P1-A, P1-C (no GitHub issue).
One desktop's Stop no longer strands another; a deleted host can be removed (P1-D, P1-E): #26628, #26766
managedServer.forget, permissionhost-admin) unlinks a server whose host is gone, and the SSH host can then be removed.Fixes: Phase 3.7 findings P1-D, P1-E (no GitHub issue).
Shell startup output on stdout no longer breaks connect (HH-1): #26617
Remote home is not a valid path: <banner>. This covered fishconfig.fish, tcsh.tcshrc, zsh.zshenv, a bash.bashrcecho, and even a bare terminal-title escape.Refs #8324.
An oversized reply fails one request, not the whole connection (HH-2, HH-5): #26624
1013 Outbound reply buffer overflow). The same happened for an "Unlimited" agent-session list.reply_too_largeerror for that request id. It uses the same admission check the encrypted channel uses, so the channel's size close no longer fires for RPC replies.files.readDiralso checks remote callers against the request's content budget.Fixes: Phase 3.7 findings HH-2, HH-5 (no GitHub issue).
A slow host can finish installing Orca's Node runtime (HH-3): #26631
Fixes: Phase 3.7 finding HH-3 (no GitHub issue).
Stage All stages everything when the list was capped (HH-4): #26618
staged=20001 unstaged=0.git.bulkStagetakes ascope(all/tracked). With a scope, the host stages the whole worktree (git add --all -- ., or--update) instead of a listed subset. Unresolved conflicts are left out by name, and folder workspaces stay inside their folder. This works locally, over IPC, on the SSH relay and over runtime RPC, and in the mobile app.Fixes: Phase 3.7 finding HH-4 (no GitHub issue).
No stale scrollback spliced above a recovered screen (P2-5, P2-7): #26647
298942–300000in the re-test), and the stale block is cleared.Fixes: Phase 3.7 findings P2-5, P2-7 (no GitHub issue).
Sync with main: #26828, plus a second clean merge
Main was merged into the branch before this re-test. The conflicts were the managed-server status line, the WSL login-shell imports and a moved banner test; #26828 lists how each was resolved.
A second, conflict-free merge of main (
b3e5597878) picks up main's #26838, a fix to thessh-orcad-auto-convertcatalog-retry e2e test that failed on this PR's first CI run. The only Phase 3.7-adjacent change it brings is main's #26637: a live orcad PID now also has to answer a probe. It reports a different detail from #26628's "not activated" check, so the two don't interact.Why
These are the P0/P1 failures found by adversarial real-host testing of Phase 3.5. Each one is fixed at its root cause rather than patched in the UI:
The alternatives each fix PR considered are in that PR.
Linked Issue
Refs #8324. The other findings come from the Phase 3.7 adversarial test reports and have no GitHub issues.
Visual Proof
N/A for most fixes: they are transport, host and recovery behavior. The UI-visible changes are:
Screenshots of those are in the individual PRs. The integrated re-test evidence is listed below.
Testing
Integrated real-host re-test
Setup:
ORCA_BACKGROUND_LAUNCH=1, isolated profiles and HOME, tokens unset. Driven only through CDP and the bundled CLI.stty61 159; viewport at the bottomunlinked. A: reconnect redeployed in 1 s; new terminal worksECONNREFUSED; remove pointed to Forget; Forget gaveforgotten(verdictunverifiable); host removed298942–300000, contiguous, no stale blockofferMove, thenmovedin 3 s; new terminal on orcadAutomated
Each fix PR adds regression tests that fail on its base. After the main sync:
pnpm tc, oxlint,check:code-quality:changed,audit:anti-slop, the max-lines / reliability / ts-nocheck / runtime-Electron ratchets, the RPC params catalog and the localization verifiers pass;Platforms: macOS desktop against Linux SSH hosts (arm64 glibc). Windows-host code paths are unchanged, except that #26631 shares the promote bound with POSIX.
Review
Every fix went through independent review rounds (an Opus workflow plus a separate reviewer, P0/P1 only) before landing on
OrcaWin/phase37:What the rounds caught and fixed, among others:
The integrated re-test then caught one regression introduced by the last #26630 round, fixed in #26832.
Agent skill upstream boundary
Notes
Accepted limits
Compatibility
inputAck) or an optional field (git.bulkStagescope, thereply_too_largeerror), so mixed client and host versions keep working.managedServer.forget, declarespermission: 'host-admin'.live/unverifiable/exitedverdict vocabulary.Checklist
N/Awith reasonpnpm lint,pnpm typecheck,pnpm test, andpnpm buildpass (or CI will cover; local preferred)