Repository navigation
Native chat: record which agent run wrote each journal item (1/5, rebuild of #26867) - #28092
Merged
Merged
Conversation
Each journal item row, subagent roster entry and background-task entry now records ownerFence: the lease fence of the agent run whose output produced it. Optional, persisted, no row version bump and no migration. The journal's itemFence() returns it, so the turn-verdict rules and per-run provider activity read the producing run rather than the writer's fence.
This was referenced Oct 13, 2026
…wner checks into the main case Drops the epoch-replacement case (Part 2 rewind test reads the same values through the same rebuild) and the corrupt-value case (no version writes one).
…s as its row provenance Moved here from Part 4 so it sits beside stampJournalEntryProvenance.
…plit-1 # Conflicts: # src/main/acp/acp-timeline-grok-subagent-retention.test.ts # src/main/acp/acp-timeline-grok-subagents.test.ts
…n removed its body helper Main #27947 writes one row per subagent and deleted journal-subagent-group-body; a roster row from an older build is still what this case reads.
brennanb2025
marked this pull request as ready for review
October 14, 2026 04:07
…amping Main's #27947 writes one saved row per subagent, and each background task already has its own row, so an item's own ownerFence names the run of every entry a producer still writes. Per-entry stamps inside a row mattered only for the shared roster rows saved before #27947, and no run writes into those any more, so the row's own provenance settles them correctly. Removes the entry stamping, the optional ownerFence on roster entries and background tasks, and their tests.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Priority: ⬇️ Low Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 39.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 28 functions across 32 files. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
| Description check | |
The description is detailed and covers the change, rationale, testing, compatibility, and scope. However, the required Linked Issue section is not populated with an actual issue link; it only referenc… | Add the applicable issue link to the Linked Issue section or populate Fixes #. If the maintainer exception applies, state that clearly and reference the relevant existing issue. |
-
Check name Status Explanation Linked Issues check Issue #28529is closed and provides historical context only. No active directly linked issue remains. This pull request has no linked-issue coding requirements.Out of Scope Changes check The changes stay within the stated ownerFenceprovenance scope. They update journal rows, lifecycle batches, rewinds, legacy imports, provider activity, validation, and related tests and fixtures. N…Title check The title clearly identifies the main change: recording which agent run wrote each native-chat journal item. The stack and rebuild context are relevant and do not obscure the change.
Full details: Description check
-
Explanation
The description is detailed and covers the change, rationale, testing, compatibility, and scope. However, the required Linked Issue section is not populated with an actual issue link; it only references issue numbers in prose and leaves
Fixes #empty.
- Fix all pre-merge checks with AI
✨ Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to GitHub limitations.
🟡 Minor · Include provenance in the oversized-item no-op… · journal-lifecycle-batch-appender.ts:136-143
src/main/native-chat/agent-session-journal/journal-lifecycle-batch-appender.ts:136-143
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winInclude provenance in the oversized-item no-op check.
If a new generation writes an oversized item with the same body and linkage, this shortcut drops the write even when
only.ownerFencediffers. The item keeps the old generation’s fence, and the new observation records no provider activity. Skip the write only when an explicitonly.ownerFencealso matches the stored item fence.
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Repository UI
- Review profile: CHILL
- Plan: Advanced
- Run ID:
b7017b9b-495b-4da0-bbb8-9ec942deccbf
📒 Files selected for processing: 32
src/main/native-chat/agent-session-journal/journal-damage.test.tssrc/main/native-chat/agent-session-journal/journal-epoch-replacement.test.tssrc/main/native-chat/agent-session-journal/journal-epoch-replacement.tssrc/main/native-chat/agent-session-journal/journal-item-fold.tssrc/main/native-chat/agent-session-journal/journal-item-provenance.test.tssrc/main/native-chat/agent-session-journal/journal-item-provenance.tssrc/main/native-chat/agent-session-journal/journal-legacy-import.test.tssrc/main/native-chat/agent-session-journal/journal-legacy-import.tssrc/main/native-chat/agent-session-journal/journal-lifecycle-batch-appender.tssrc/main/native-chat/agent-session-journal/journal-lifecycle-batch-partition.test-fixture.tssrc/main/native-chat/agent-session-journal/journal-lifecycle-batch-partition.test.tssrc/main/native-chat/agent-session-journal/journal-lifecycle-batch-partition.tssrc/main/native-chat/agent-session-journal/journal-lifecycle-mutation.tssrc/main/native-chat/agent-session-journal/journal-provider-activity.tssrc/main/native-chat/agent-session-journal/journal-reducer.tssrc/main/native-chat/agent-session-journal/journal-row-builders.tssrc/main/native-chat/agent-session-journal/journal-row-schema.tssrc/main/native-chat/agent-session-journal/journal-row-unusable-annotations.tssrc/main/native-chat/agent-session-journal/journal-store-contracts.tssrc/main/native-chat/agent-session-journal/journal-submission-fold.tssrc/main/native-chat/agent-session-timeline/provider-timeline-assembler-attribution.test.tssrc/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.tssrc/main/native-chat/agent-session-wire/structured-agent-session-event-sink.tssrc/main/native-chat/agent-session-wire/structured-agent-session-journal-append-options.tssrc/main/native-chat/agent-session-wire/structured-agent-session-prompt-answer-receipts.test.tssrc/main/native-chat/agent-session-wire/structured-agent-session-rewind.tssrc/main/native-chat/agent-session-wire/structured-agent-session-stop-event-binding.test.tssrc/main/native-chat/agent-session-wire/structured-agent-session-transition.tssrc/main/native-chat/agent-session-wire/structured-rewind-retained-host-rows.tssrc/shared/agent-session-journal-schemas.tssrc/shared/agent-session-rewind.tssrc/shared/native-chat-types.ts
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.
…isions keep it A newer run's provider can revise an item an older run created: Pi's start and an ACP session/load both report context usage onto the newest saved turn. Restamping that turn with the newer run let the newer run's exit settle the older run's unverifiable turn as interrupted. Only creation states an owner now, as main's itemFences rule did.
AmethystLiang
added a commit
that referenced
this pull request
Oct 14, 2026
* fix(worktrees): never delete a folder git no longer tracks (#25075)
* fix(worktrees): a retried or resumed delete only removes the folder it started deleting
A failed worktree delete stays listed for a retry, and an interrupted one is
finished at the next start. Both later deletes force-deleted whatever was at
the recorded path, proven only by "git does not list it and it has no .git",
so an ordinary folder the user put at that path since was deleted with its
files, with no click needed in the startup case (STA-9338).
An accepted removal now records the checkout directory's identity (device,
inode, creation time) in its durable record. A retry, a startup finish, and
the in-slot check before the force-delete refuse any folder at the path that
is not that directory. Startup no longer rebuilds a missing .git for a
registered checkout unless the folder is the recorded one. Records without an
identity (older builds, or no creation time) are only finished through Git's
own checks and never force-deleted.
* fix(worktrees): identify the accepted checkout by inode and a real creation time only
The device number changes when an external volume is attached again, so a
genuine leftover read as a different folder. Windows reports a missing
creation time as a negative number rather than 0, which slipped past the
guard.
* refactor(worktrees): every background removal states the checkout identity it accepted
A new acceptance site that forgot the identity used to compile and silently
write records no retry or resume could ever finish. The resume tests also
assert the identity was read, so their refusals can't pass as unrecorded.
* fix(worktrees): a delete that leaves the user's folder in place also ends the workspace
When Orca decided the folder at a failed or interrupted delete's path was not
the one it started deleting, it dropped the removal record but kept the
workspace's metadata. That metadata still says Orca created a checkout there,
and with no record left, the next Delete of the same workspace (a runtime
Delete from mobile, the CLI or a paired client, or a second desktop Delete on a
row not yet refreshed) went to the cleanup that deletes an Orca-created folder
Git no longer lists, and removed the user's folder after all.
Now, when a removal ends without deleting while Git does not list the path (a
listing ends a failed delete, or a retry, resume or first delete fails with no
leftover to show), the host runs a finished delete's bookkeeping: metadata,
terminal history, caches and change events. The folder and the branch are left
alone, and nothing is ended while Git still lists the path.
* test(worktrees): cover the in-slot folder check when Git cannot remove a registered checkout
Reverting that check left every test green: only the unregistered branch's
check had a test where the folder changes during the delete-slot wait.
* fix(worktrees): a resumed or retried Git delete checks the folder inside the delete slot
The check that the folder at the path is still the one Orca accepted ran
before the watcher gate and the delete-slot wait, which can last minutes behind
other large deletes. A folder restored there meanwhile with a copy of the
checkout's .git file passes Git's own validation, so `git worktree remove
--force` deleted it. The resume and retry now repeat the check inside the slot,
right before Git deletes, as the non-Git branch already did; the refusal skips
the Windows recovery that could otherwise finish the delete itself. A normal
first delete is unchanged.
* test(worktrees): assert the second desktop Delete refuses the user's folder
The handler result is untyped, so the previous catch-all did not typecheck; the
assertion now names the refusal the Delete gets once the workspace has ended.
* test(worktrees): the desktop Delete test's stand-in host ends the workspace without a cast
* fix(worktrees): a listing asks Git before dropping a failed delete, and ends its workspace in the same step
* fix(worktrees): a failed delete Git cannot be asked about stays failed for the next listing to decide
* test(worktrees): the failed-delete record test states that Git still registers the checkout
* fix(worktrees): a restart keeps a failed delete whose checkout is gone, so the first listing ends its workspace
* fix(worktrees): a folder Orca cannot read keeps its failed delete and is never deleted
* fix(worktrees): a failed delete leaves the disk only after its workspace's end is saved
* fix(worktrees): a runtime Delete of a failed delete's row is told when Orca left the folder in place
* test(worktrees): the desktop Delete test's stand-in host returns nothing
* fix(worktrees): a Delete of a failed delete's leftover whose .git Orca cannot read says so
* Revert "fix(worktrees): a runtime Delete of a failed delete's row is told when Orca left the folder in place"
This reverts commit 68d65989def954d1831bfcb4fad673e3b9896f73.
The shortcut reaches no real client: the CLI and mobile list the workspace before deleting it, which ends the failed delete first, so they still answer not found (the folder is kept either way).
* fix(worktrees): a failed delete Git could not be asked about is dropped once Git says it still registers the checkout
* revert to main before the standard-model rework
* fix(worktrees): stop deleting Orca-created folders that have no .git and that Git no longer tracks
Deleting an Orca-created workspace whose folder Git no longer tracked and that had no `.git` force-
deleted the whole folder once the user confirmed force. "Orca made a workspace here once" and "there
is no .git" do not prove the folder still holds that checkout: an ordinary folder the user put at
the path was deleted.
Such a folder now gets the existing "Refusing to delete unregistered worktree path" answer, forced or
not. Once the user removes the folder, Delete takes the existing missing-path branch and drops the
workspace. An orphaned worktree whose `.git` file points back at this repo is still deleted after
the user confirms force, as before.
* fix(worktrees): delete a failed or interrupted workspace only through Git
A delete that failed partway (Git dropped the registration, files left) stays listed as "Delete
failed", and a delete a quit interrupted is finished at the next launch. Both later deletes removed
the folder with Orca's own file removal, proven only by "Git does not list it and there is no .git".
An ordinary folder the user put at that path was deleted, at startup without any click.
Orca now deletes a checkout only through Git, plus the existing cleanup right after a Git delete that
succeeded in the same operation:
- Delete on a failed row: if Git registers a checkout at the path, the normal delete runs. If the
folder is still there and Git does not register it, Delete refuses with "Git no longer tracks
<path>, so Orca won't delete it. Remove the folder yourself; Orca removes this workspace once the
folder is gone." and keeps the row. With the folder gone, Delete prunes Git's stale entry, deletes
the branch as recorded and drops the workspace.
- Startup finish of an interrupted delete: a checkout Git still registers is removed with
`git worktree remove` and the user's recorded force choice, no longer always forced. If Git refuses
or fails, the row shows Git's error. The step that rewrote a missing `.git` so Git could force the
delete is gone. A folder Git does not register becomes a failed row and is not deleted; with the
folder gone, the rest of the delete finishes.
Records written by earlier daily builds still load; fields this version does not know are ignored.
* test(worktrees): read Git's listing before the Delete call in the real-Git failed-delete suite
* docs(worktrees): say when a failed delete's record ends under the Git-only delete
* fix(worktrees): keep main's handling of a startup finish Git refuses, and say the listing drops the workspace
A startup finish that Git refuses for a checkout Git still registers now clears its record and
leaves Git's normal row, exactly as an in-session failure does on main; the resumed-only failed
record and the listing that put Git's error on Git's own row are gone, and the listing is main's
again. An unregistered folder that still exists is still a failed row, and nothing is deleted.
The refusal now reads: "Git no longer tracks <path>, so Orca won't delete it. Remove the folder
yourself, and Orca will drop this workspace from the list." The listing drops a failed record once
its folder is gone, as on main.
* fix(worktrees): finish a failed delete's branch and push-target remote when it fails
A delete Git fails partway keeps a "Delete failed" row for the folder Git left. The row's record
also carried the branch delete and the push-target remote cleanup for later, but the listing drops
the record once the user removes the folder, so both were silently left behind. Now, once Git no
longer registers the checkout, the failure runs that Git side right away (merged branch only,
stale admin entry, push-target remote), in the one settle path desktop and runtime share. It
deletes no files, and a failure of this bookkeeping is logged without touching the failed row.
* fix(worktrees): unregister an interrupted delete's checkout whose .git Git already deleted
A quit mid-delete can leave a checkout Git still registers but whose .git link Git already
deleted (Git deletes it first on Windows). No `git worktree remove` can validate it, so the startup
finish failed, the record was cleared, and the workspace came back as a normal row no Delete could
ever remove. The startup finish now has Git prune that registration (refused while locked; every
file kept) and then treats the folder as one Git no longer registers: the "Delete failed" row with
the remove-it-yourself message, ending once the user removes the folder. Adds the non-forced
partial-delete case: Git refuses, the files stay, and the row returns as before.
* fix(worktrees): name a worktree Git registers inside a failed delete's folder before asking the user to remove it
The refusal for a folder Git no longer tracks tells the user to remove the folder. When that folder
holds another worktree Git still registers, doing so would delete that worktree's files too. Delete
on the failed row and the startup finish now run the existing nested-worktree check first, so its
message ("contains another registered worktree: <path>") wins, as it did before this branch.
* fix(worktrees): don't prune other worktrees when a delete fails
The Git side of a failed delete started with a repo-wide `git worktree prune`. It did nothing for
the failed delete, whose admin entry Git had already dropped, but it unregistered any other
worktree whose folder was missing at that moment (an unmounted drive), so Orca dropped that
workspace too. The failure now runs only the branch step; the prune stays where it was on main,
in the folder-gone finish and at startup.
* test(worktrees): cover the push-target cleanup every delete job wires for a failed delete
A failed delete removes the push-target remote Orca added through the hook each job creator passes: desktop Delete, runtime Delete, and the startup finish. Nothing tested that wiring; these tests fail when any creator drops it.
* fix(worktrees): say the leftover folder was left on disk instead of what Orca won't do
* Shorten worker sub-dispatch instructions (#28565)
* Allow workers to dispatch one level of sub-workers by default
The default nested worker depth was 1, so a coordinator's workers were refused on their first dispatch. Raising it to 2 lets one generation of sub-workers run without changing any settings. The depth constant, the global settings default, and the affected tests now share that value, so they stay in step.
- Set NESTED_WORKER_MAX_DEPTH_DEFAULT and the settings default to 2.
- Pin the cap-1 refusal test to an explicit cap of 1, and point the depth-2 test at the default constant.
- Update the resolver and settings pane tests to expect 2 when unset.
* Keep worker depth at 1 and shorten sub-dispatch instructions
* fix(unread): a pane is read when it is on screen; closing a waiting tab clears its dot (#28637)
* test(unread): characterize today's workspace and pane unread transitions
Pins, against the real store, what every unread trigger does today: the workspace
flag per host row, the three tab/pane marker maps, persistence calls and payloads,
lastActivityAt and sortEpoch bumps, the Dock count and the floating launcher dot.
Events are replayed through one driver file so a later rewiring of who writes the
state changes only the driver, never these expectations.
* refactor(unread): one workspace-attention module owns every unread transition
Every write to the workspace unread flag and the tab/pane/completion markers now
goes through src/renderer/src/store/slices/workspace-attention: store operations
named by the triggering event (bell, agent attention, pane input, viewed-agent
auto-ack, manual mark read/unread) and pure transitions folded into other slices'
set() calls (activation, tab activation, close, sleep, hibernate, retire, rekey,
reconcile, mirror removal, purge, acknowledge). Behaviour, storage, readers,
persistence and wire format are unchanged; the characterization suites pass
without edits to their expectations.
* refactor(unread): review fixes for the workspace-attention module
- Ratchets: moved terminal-tab-attention baseline entries to terminal-tab-appearance; split
the characterization setup/observables into an exempt fixture so the driver holds only events.
- Removed the test-only writer seam; mocked-store tests assert the event they fire.
- The slice owns the experimental pane gate for completions too; groupAttentionEnabled is gone
from the attention request and write.
- Collapsed marker removals to removeTabsAttention / removePanesAttention /
removeCompletionAttention / removeTabMarkers / movePaneAttention; tab activation uses
omitRecordKeys.
- Mark read/unread is passed in like other store actions; readers of the workspace dot go
through isWorkspaceUnread.
* feat(unread): on screen means read; the workspace flag follows its markers
While Orca's window is visible and focused, the tabs on screen (active tab
of the active workspace, plus an open floating panel) are read: every tab,
pane and completion marker of each. One scan (the auto-ack hook, now
startViewedAttentionScan) replaces the keydown, pointerdown, tab
activation, group focus, workspace activation and auto-ack marker clears.
After a read, close, sleep, hibernate, retire or purge that removed a
marker, a workspace's flag is cleared once no tab or completion marker
remains on a live tab; a marker-less flag (Mark as unread, restart,
another client) is read when its workspace comes on screen. Mark as read
removes every marker in the workspace. Reads and removals dismiss the
affected panes' OS notifications in one IPC call.
* fix(unread): a bell or completion already on screen leaves no marker or flag write
Marking now asks the scan's own on-screen rule (isTabOnScreen: the window is
visible and focused and the tab is a scan target), so an on-screen bell no
longer persists the flag true then false. A completion in any split pane of
the tab on screen is viewed, matching the read. A superseded turn's
completion-marker removal settles the flag and dismisses like other removals.
* fix(unread): read the screen across hosts, groups and non-agent views; mark only for an absent user
- Arriving at a workspace in its own view settles its flag even when it shows an
editor, browser or nothing; Settings and other views read nothing.
- A bell or completion on screen skips marking only when the user is confirmed
present under the scan's own presence gate (input, or main reporting the
desktop active within the shared away threshold); otherwise it marks and the
gated scan reads it when the user returns.
- The active workspace's host is part of the screen, so switching same-id folder
rows between hosts is an arrival on the new host.
- Removal settles lower every same-id folder row and persist each host.
- Opening and closing the floating panel both rescan.
- Every visible tab group's active tab is on screen, not only the focused one.
- One pane-key parser, one marker-tab enumeration, one removal wrapper
(settleAttentionRemovedBy), one remove-and-dismiss; the hook is now
useReadOnScreenAttention over on-screen-attention-scan.ts, and terminal
keystrokes reach presence through a capture-phase window keydown.
* fix(unread): presence only from renderer input; host-exact folder flags; subjectless completions follow the screen
- Main's 'not away' answers only the scan that asked; presence is stamped
only by trusted input (wheel included), so it can't outlive the threshold.
- isWorkspaceViewed uses the on-screen rule (workspace view showing, focused
window, user present), so a subjectless completion marks under Settings or
while away.
- Folder flag writes resolve the row's host like updateFolderWorkspace does
(project-group fallback), so the row flipped and the owner persisted match.
- A runtime host purge dismisses but doesn't settle flags of surviving rows.
- DESKTOP_AWAY_SECONDS is the shared threshold's neutral name.
* test(unread): folder flag persists name the row's host
* test(unread): drop casts from the folder persistence seeds
* fix(unread): point the reliability gate and e2e fixture at the renamed on-screen hook
* refactor(unread): drop reshapes the follow-up deletes; keep the flag functions module-internal
Reverts the reconcile/mirror/activation/focus/group call sites and the isWorkspaceUnread
selector to main, removes removeTabMarkers, removeCompletionAttention and the activation
read helpers, and drives tests through public attention actions.
* test(unread): read the Dock badge flag down by putting its tab on screen
* fix(unread): keep the on-input read action removed after merging main
* fix(serve): restore a remote server's browser tabs after it restarts (#28166)
* feat(serve): keep browser tabs across an orca serve restart
A host with no window now saves the browser tabs it opens in the same shape a
desktop window saves its own, and restores them the same way: listed at once
with their last address, each page started when a client first opens or
drives it. A closed tab is forgotten; a page that ends with the process is not
a close.
* test(e2e): the server's published strip now holds its saved browser tab
* fix(serve): save browser addresses cheaply, open once, restore by page id
Review fixes: a page's address is written onto its saved records without
reloading the layout, and only on committed navigations; reopening a saved
page writes nothing; a command naming only the page finds the workspace that
saved it; a refused save no longer throws from a page event or a close. The
browser-tab map is renamed to say it lists saved tabs too.
* fix(serve): list, switch and close saved browser tabs from commands that name no page or worktree
* fix(serve): a tab list does not start saved pages; only a command acting on a page does
* fix(serve): a pageless command starts the browser tab the layout shows, not the first saved one
A host now records the browser tab a window would show: the one it just
opened, and the one a tab switch picks. With nothing running, a command
that names no page starts that tab; when the layout shows none it starts
nothing and reports no browser tab open.
* fix(serve): report the saved active browser tab as current
Claude-Session: p2-headless
* chore(ratchet): count the serve browser-tab save as a main-process layout writer
Claude-Session: p2-headless
* fix(serve): use the window's active browser tab rule, one scope, one active row
Claude-Session: p2-headless
* fix(browser): pick the active tab among tabs this host can start
A desktop document page or a remote page recorded as active no longer leaves a
pageless command with no tab. Adds a test for the first-saved-worktree scope.
Claude-Session: p2-headless
* refactor(browser): restore saved serve tabs through the page wake point
Saved serve browser tabs now start where a window would mount them: the two
existing wake helpers ask one host hook before messaging a window. The offscreen
backend reports opened and moved pages, so the command layer no longer threads
save, list, select or close hooks. No worktree named and no page running reports
no tab, as a window does.
Claude-Session: p2-headless
* fix(browser): only page creation opens a saved serve tab
A navigation now only updates an existing saved tab, so a late load after a close
cannot re-add it; a restored page sends no open, so its saved title stays.
Claude-Session: p2-headless
* refactor(browser): drop the restore mark the open/navigate split made redundant
Claude-Session: p2-headless
* refactor(browser): save serve tabs from the create command, list unstarted ones as tab rows
The create command saves the tab (it holds the group), so the backend reports only
navigations. Unstarted saved tabs are tab-info rows the existing listings take
as-is, the restore dedupe map goes (a created page registers before createTab
returns), and one lookup gives a page's unified tab id.
Claude-Session: p2-headless
* fix(browser): opening a serve browser tab no longer records it as active
Which tab shows is a view's choice; after a restart the active tab is the one a
window recorded, else the first.
Claude-Session: p2-headless
* fix(browser): give the composed browser command owners the saved-tab host member
Completes the forward merge of main's browser command split (#27576).
Claude-Session: p2-headless
* fix(terminal): store the Terminal shell setting trimmed so agent tabs start like plain tabs (#28635)
* fix(terminal): store the Terminal shell setting trimmed
The Settings field only stripped leading spaces and a hand-edited settings file loaded as-is, so a trailing space reached agent tabs, the CLI and other host-planned launches, while plain terminal tabs trimmed it in their own reader. Trim the setting when the field loses focus and when settings load (whitespace-only becomes unset), and drop the plain-tab reader's now-redundant trim.
* fix(terminal): trim the shell setting at the settings write too
A keystroke write could still store a padded shell, and Escape closes Settings without a blur, so a plain tab could launch the padded value once its own trim was gone. Trim at the settings write boundary (shared with load, like the machine name), and keep the typed text in a local draft while the field is focused.
* fix(settings): drop the shell field's draft when the field unmounts
The draft lived on the whole Terminal pane, so a field removed without a blur (another window switching to System shell, or the settings search hiding it) left a stale draft that showed later instead of the saved shell. Move it into a small input component so it is discarded with the field.
* refactor(pty): one failure cleanup and agent_error for both terminal spawn paths (#28613)
* test(pty): pin a failed provider start on both spawn lanes
Characterizes main before the two execute steps merge: the error is
rethrown, the pre-spawn hidden mark, pending registration, worktree spawn
gate, cached size and pane reservation are all undone, and only the window
lane records agent_error.
* refactor(pty): one failure cleanup and agent_error for both spawn lanes
The window (pty:spawn) and the host (runtime controller) each undid a failed
execute step with their own copy of the same cleanup: provisional execution
context, early-exit fence, pending registration, cached size and provider
state for a minted session id. Both now call failPtySpawnExecute, which also
records agent_error in one place.
recordsAgentError is TEMPORARY: host starts still record none, as on main,
until C5a-2 removes the input. The window's extra hidden-mark rollback in this
catch duplicated its outer catch, which still runs, and is gone.
* chore: re-run CI against current main
* fix(terminal): judge an agent's --shell against the runtime it runs in (#28234)
* fix(terminal): judge an agent's --shell against the runtime it runs in
`orca terminal create --shell` for an agent is now judged only against the runtime that agent
runs in, not also against the project's saved runtime. So --shell wsl.exe for an agent in a
\\wsl$ repo (saved as Windows host, or with no setting) runs instead of being refused.
* chore(ci): re-run checks against current main
* chore(ci): re-run checks against current main
* chore(ci): re-run checks against current main
* chore(ci): re-run checks against current main
* chore(ci): re-run checks against current main
* Keep CI failure excerpts bounded and strip malformed ANSI controls linearly (#28671)
* Bound and sanitize CI failure excerpts with linear ANSI stripping
* Fix excerpt regression checks and reduce bounded marker overhead
* Require signal proof for benchmark timeouts and load consumer fixtures portably
* Validate benchmark timeout framing and run required cases with a pinned CI baseline
* Strip dense generic ANSI escapes with bounded forward scanning
* Use the standard UTF8 encoder for byte-cap test oracles
* Gate CI log performance suites behind a dedicated job
The wall-clock performance suites run about 1k child workloads up to 63 MiB, so they were sharing runners with unit tests and could fail on noise. They now run only in their own `check_log_performance` job, opted in with `ORCA_CHECK_LOG_PERF=1`.
- Remove the pinned-baseline checkout and `ORCA_CHECK_LOG_BASELINE_DIR`. The baseline comparison is now a manual step that reads the pinned ref from local Git history.
- Run the current-implementation checks with `compareBaseline: false`, which skips baseline builds and audits.
* Inline check-log fixture and drop dedicated perf CI job
- Replace the captured failure-log JSON with a synthetic log built by `createCheckLogFixture()`, so no scraped job output or provenance metadata is kept in the repo.
- Remove the `check_log_performance` CI job. The log performance suites now run only when `ORCA_CHECK_LOG_PERF=1` is set, as a manual benchmark.
- Update the benchmark scripts and tests to use the new fixture helper and drop the `fixturePath` parameter.
* Remove Hermes automation support (#28519)
* Remove external cron history from the automation UI
* Simplify the automation editor
* Remove Hermes cron discovery and management
* test(cross-version): pin the ephemeral-key and source-fence downgrade tests to v1.4.224 (#28803)
v1.4.225 ships both capabilities, so the newest release no longer models an
old host. Pin each to the last release without its capability, as the other
downgrade tests in the suite already do.
* fix(terminal): name the fix that applies when --shell is refused (#28235)
A refusal names a \\wsl$ working directory first, since no runtime setting can move it out of
WSL, and names Settings > Project Runtime when the runtime comes from the global default.
* Native chat: record which agent run wrote each journal item (1/5, rebuild of #26867) (#28092)
* feat(native-chat): record which agent run wrote each journal item
Each journal item row, subagent roster entry and background-task entry now
records ownerFence: the lease fence of the agent run whose output produced it.
Optional, persisted, no row version bump and no migration. The journal's
itemFence() returns it, so the turn-verdict rules and per-run provider activity
read the producing run rather than the writer's fence.
* test(native-chat): fewer provenance tests: fold reopen and unstated-owner checks into the main case
Drops the epoch-replacement case (Part 2 rewind test reads the same values through the same rebuild) and the corrupt-value case (no version writes one).
* test(native-chat): an unstamped roster entry from an older build reads as its row provenance
Moved here from Part 4 so it sits beside stampJournalEntryProvenance.
* test(native-chat): build the older-build roster row inline, after main removed its body helper
Main #27947 writes one row per subagent and deleted journal-subagent-group-body; a roster row from an older build is still what this case reads.
* refactor(native-chat): provenance is per item only; drop per-entry stamping
Main's #27947 writes one saved row per subagent, and each background task already has its own row,
so an item's own ownerFence names the run of every entry a producer still writes. Per-entry stamps
inside a row mattered only for the shared roster rows saved before #27947, and no run writes into
those any more, so the row's own provenance settles them correctly. Removes the entry stamping,
the optional ownerFence on roster entries and background tasks, and their tests.
* fix(native-chat): an item's provenance is set when it is created; revisions keep it
A newer run's provider can revise an item an older run created: Pi's start and an ACP
session/load both report context usage onto the newest saved turn. Restamping that turn with
the newer run let the newer run's exit settle the older run's unverifiable turn as interrupted.
Only creation states an owner now, as main's itemFences rule did.
* test(native-chat): keep the provenance test below the production lines it covers
* refactor(native-chat): open a chat visual like any file (#28437)
* fix(files): never write through a dangling symlink
A path that doesn't exist yet was authorized by walking up to the nearest
existing folder. A dangling symlink fails realpath with ENOENT, so the walk
stepped over it and approved the link's own path; the write then followed
the link and created its target outside the allowed folders. The walk now
continues from the link's target, and returns that real destination.
* refactor(native-chat): rename the chat visuals folder to the chat scratch folder
The per-chat folder agents write into is the chat's scratch space, not only
a visuals folder. Its root becomes <state>/chat-scratch/<hash> (the hash is
unchanged) and the agent variable becomes ORCA_CHAT_SCRATCH_DIR. The old
ORCA_CHAT_VISUALS_DIR is never set and is still stripped from what every
agent child inherits, Pi included. The visuals skill names the new variable
and says the folder is temporary.
* test(native-chat): keep the delivery test to the rename
The launch parity snapshot already pins that every agent drops the
pre-rename variable.
* fix(files): refuse any dangling symlink in the missing-path walk
Following a dangling link by hand resolved relative targets against the
lexical parent, not the link's real folder: through a folder link the walk
could loop forever or authorize the wrong file. Refuse instead: realpath
can't say where a dangling link leads, but a write would follow it.
* feat(runtime-files): the host serves a chat's scratch folder as a file root
File commands accept `path:<this host's chat-scratch root>/<32 hex>` and
resolve it only when it names this host's own folder, at the file-commands
seam so the selector never reaches chat placement. They authorize against
the project roots plus the chat-scratch root, refuse files.open/openDiff
for the folder, and agentSession.readVisual's ok results carry the file's
absolute path so a client can build the selector.
* test(runtime-files): name the readVisual helper's parameter type
* test(files): drop the loop case that duplicated the dangling-link refusal
* test(runtime-files): run the readVisual RPC test, which opens a real SQLite store, under Node
* test(runtime-files): put the same-suffix folder inside the authorized root so only the selector refuses it
* refactor(native-chat): open a chat visual like any file
"Open in new tab" on an inline chat visual now opens the visual's file the
way any HTML file of the chat's workspace opens: a file:// browser tab for a
local chat (its overflow menu gains "Open source file"), the document
preview for a paired-host chat (with its existing source action and Share).
Edits save on the chat's host through the exact path: selector the host
serves, and a matching editor save re-reads the inline copy freshly. The
read-only chat-visual tab is removed.
* fix(native-chat): a visual read without a path is a malformed reply
A visual's path is always on the current host's readVisual answer, so the
inline Open needs no branch for a missing one. Also prune the deleted
chat-visual tab action from the layout-writer baseline.
* test(native-chat): give visual read replies their path without longer lines
* fix(native-chat): address a scratch file by its folder only outside every workspace
A workspace that contains the host's state folder keeps its own address, so
explorer drops, folder creation and renames inside it stay on one root.
Document preview Share reads a runtime grant's own selector and root
directly instead of passing the selector off as a workspace id.
* test(runtime-files): wait for the stores to close before removing the state folder
* fix(i18n): drop catalog strings left behind by the automation removal (#28810)
The automation removal deleted the screens but kept their strings in every
locale catalog. With no call site left, the boot-bundle catalog check counts
them as required and fails on main.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(wsl-mover): refuse edits to a project a WSL move is taking (D1b-5c-2) (#28761)
* feat(wsl-mover): refuse edits to a project a WSL move is taking, and drop its background bookkeeping quietly (D1b-5c-2)
* fix(wsl-mover): hide only local rows of a moved project; the host's own row keeps its id (D1b-5c-2)
* fix(wsl-mover): refuse a user's unread toggle, fence branch deletes, host setups and issue commands; settings unfreeze once the host owns a repo (D1b-5c-2)
* test(wsl-mover): the fence e2e refuses edits to moving projects and drops their bookkeeping quietly (D1b-5c-2)
* refactor(wsl-mover): name the update type the fence inspects (D1b-5c-2)
* test(wsl-mover): run the fence tests that open a real store in the Node runtime (D1b-5c-2)
* fix(wsl-mover): a host setup's own repo stays frozen once the host owns it; e2e pins the quiet drop (D1b-5c-2)
* Resume in New Native Chat for Pi (#28080)
* feat(chat): Resume in New Native Chat for Pi terminal conversations
A Pi conversation started in the terminal now offers "Resume in New Native Chat" in its Session
History row menu and its tab's right-click menu, like the other chat agents: a new Pi chat takes
it over, showing its history and continuing it.
Pi joins the shared adoption path. Its import finds the session file Session History lists under
the row id, and reads it with OMP's decoder, since OMP kept Pi's session format. A Pi chat's handle
names its session file, so the import says so and create mints the adopted handle from the found
file; the committed-create replay compares through the registration's row id, and the adopted
link id is kept to the link-id alphabet. A Pi chat forks a conversation recorded in another folder
instead of resuming it, so the workspace rule covers Pi too.
* fix(pi): preserve adopted session identity and active history
* Fix saved Pi adoption history and summary content
* test: keep only the tests that pin user-visible behavior
* feat(relay): measure each host hello's pre-auth time on the cell (#28695)
* feat(relay): measure each host hello's pre-auth time on the cell
Adds preAuthLatencyMs to the per-cell orca_relay_runtime_metrics line: per
admit path (db, reserve) and outcome (admitted, refused), a count plus
p50/p95/p99/max for the window. Each sample runs from the cell accepting the
host control WebSocket to the hello being admitted (proof verified) or
refused. Samples are kept in a bounded reservoir, shared with the control
round-trip metric. No behaviour, wire, or flag change.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* fix(relay): count abandoned hellos and publish mergeable pre-auth buckets
- Record a third outcome, abandoned, for a host that hangs up before a decision or before
the cell acts on one, so the slowest hellos no longer drop out of the window.
- Add non-cumulative bucket counts per group (bounds 50..5000 ms and +Inf, 450 exact) so
the share at or under 450 ms sums exactly across windows and cells.
- Split refusals that end before an admission check answers into a beforeCheck path.
- One refuse() closure per phase records the metric, and the path is passed to settle.
- Drop the half-used LatencyReservoir type; the shared reservoir function stays.
- Replace test casts with a typed accessor or SAFETY comments.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* docs(relay): note pre-auth path labels for late throws and the combined role
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* fix(relay): end the restart-safe quiet at the drain's pace window, not a window after it (#28677)
* fix(relay): end the restart-safe quiet at the drain's pace window, not a window after it
A paced drain tells its last host when the window ends, so the restart-safe
wait has to see an empty runtime reaching past that point. It counted a full
window of quiet samples from the first empty one instead, and the runtime only
empties as the window ends, so every same-cap cell waited the window twice:
about 25 minutes per Asia cell at 1200 s on 2026-10-13, and 5 minutes per
300 s cell.
The window is now measured from the verifier's own start, which runs after the
cell accepted the drain and so ends no earlier than the cell's own window. A
pass still needs two consecutive restart-safe samples, the last taken at or
after that end, and any non-zero runtime counter or open migration still
restarts the count. Progress lines report paceWindowRemainingMs in place of the
old sample target.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* fix(relay): drop the same-cap drain timeout's double-wait allowance and stale quiet wording
The drain step's timeout added the window's excess over 300000 only because
restart-safe used to wait a second window after the cell emptied, so it is
now the 15-minute migration lease plus the window for every pace (35 minutes
at 1200000, unchanged at 300000 and below). Docs, workflow comments and the
shadow gate's settledAfterSeconds note now describe the window-end rule. The
always-quiet test starts its clock late, so a window measured from zero
fails it, and the overlapping late-control test is folded away.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* docs(relay): state the restart-safe window-end rule exactly
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* docs(relay): the slowest restart-safe wait is now 35 minutes
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* ci: run the Electron browser probes serially, out of the unit shards (#28799)
The three popup compatibility probes ran in the parallel unit shards and
timed out at their 14s in-process deadline when other files starved the
runner. Move them into the package job's serial Electron lifecycle step,
and stop the six probes already in that step from also running in the
shards.
Claude-Session: p2-headless
* fix(pty): report agent start failures the same way from every launch path (#28724)
* feat(telemetry): count agent start failures from the host too
The host spawn path (CLI, phone, orchestration workers, headless automations,
worktree startup) now records agent_error when starting an agent fails, as the
window path already did. Removes C5a's TEMPORARY recordsAgentError input; the
host already threads each launch's telemetry, so failures get real kinds.
* fix(telemetry): count a claimed start that several requests joined once
Concurrent resumes of one agent session join one claimed start. When it
fails, every joined request ran the host catch and recorded agent_error, so
one failed start counted once per request. Only the request that ran the
start records it now; the others still clean up.
* fix(telemetry): only skip agent_error for a request that joined another start
The host marked a request as joined before calling ensure, so a claim that
refused the request on its own (conflict, capacity, unreachable owner) recorded
no agent_error. ensure now reports the join itself, right before awaiting the
other request's start.
* chore: re-run CI after main's localization fix (#28810)
* fix(new-tab): Enter on a visited site's name opens the site, not a file (#28804)
* Rank browser history above fuzzy file matches in the omnibox
Scattered-character fuzzy file matches are weak evidence, so a remembered
page should appear above them. Exact and literal file matches and typed
URLs still rank above history. Adds a test for typing a host like
linear.app, which should rank the page above unrelated fuzzy files.
* Anchor omnibox history on the typed URL instead of demoting fuzzy files
The real bug: after visiting https://linear.app/, typing `linear.app`
made Enter open an unrelated file. The history row removes the typed-URL
row it duplicates, but was then placed below every file match, so the
page lost the top slot the URL row had.
History now sits with the typed URL row (in its slot when it replaced
it). Queries with no typed URL keep the old rule: below every file match.
This replaces the previous commit's rule of ranking history above
"fuzzy" files. That label covers every non-exact match for queries with
a slash, a dot suffix or a space, so a code-host page whose title holds
the file path took Enter away from local rows for path queries (or left
nothing selected when pasted). It also left `localhost` broken when a
file name contained it.
* feat(wsl-mover): pause a moving project's terminals through Sleep and prove they exited (D1b-5d) (#28820)
* feat(wsl-mover): pause a moving project's terminals through Sleep and prove they exited (D1b-5d)
* fix(wsl-mover): gate again under the fence, swap journal phases atomically, keep sessions frozen through commit (D1b-5d)
* test(wsl-mover): the fence e2e walks the journal one phase at a time, as a move writes it (D1b-5d)
* feat(native-chat): Share a chat visual from the chat (#28479)
* fix(files): never write through a dangling symlink
A path that doesn't exist yet was authorized by walking up to the nearest
existing folder. A dangling symlink fails realpath with ENOENT, so the walk
stepped over it and approved the link's own path; the write then followed
the link and created its target outside the allowed folders. The walk now
continues from the link's target, and returns that real destination.
* refactor(native-chat): rename the chat visuals folder to the chat scratch folder
The per-chat folder agents write into is the chat's scratch space, not only
a visuals folder. Its root becomes <state>/chat-scratch/<hash> (the hash is
unchanged) and the agent variable becomes ORCA_CHAT_SCRATCH_DIR. The old
ORCA_CHAT_VISUALS_DIR is never set and is still stripped from what every
agent child inherits, Pi included. The visuals skill names the new variable
and says the folder is temporary.
* test(native-chat): keep the delivery test to the rename
The launch parity snapshot already pins that every agent drops the
pre-rename variable.
* fix(files): refuse any dangling symlink in the missing-path walk
Following a dangling link by hand resolved relative targets against the
lexical parent, not the link's real folder: through a folder link the walk
could loop forever or authorize the wrong file. Refuse instead: realpath
can't say where a dangling link leads, but a write would follow it.
* feat(runtime-files): the host serves a chat's scratch folder as a file root
File commands accept `path:<this host's chat-scratch root>/<32 hex>` and
resolve it only when it names this host's own folder, at the file-commands
seam so the selector never reaches chat placement. They authorize against
the project roots plus the chat-scratch root, refuse files.open/openDiff
for the folder, and agentSession.readVisual's ok results carry the file's
absolute path so a client can build the selector.
* test(runtime-files): name the readVisual helper's parameter type
* test(files): drop the loop case that duplicated the dangling-link refusal
* test(runtime-files): run the readVisual RPC test, which opens a real SQLite store, under Node
* test(runtime-files): put the same-suffix folder inside the authorized root so only the selector refuses it
* refactor(native-chat): open a chat visual like any file
"Open in new tab" on an inline chat visual now opens the visual's file the
way any HTML file of the chat's workspace opens: a file:// browser tab for a
local chat (its overflow menu gains "Open source file"), the document
preview for a paired-host chat (with its existing source action and Share).
Edits save on the chat's host through the exact path: selector the host
serves, and a matching editor save re-reads the inline copy freshly. The
read-only chat-visual tab is removed.
* feat(native-chat): share a chat visual from the chat
The inline visual's toolbar gains Share beside Open. It publishes under the
file's own key on the chat's host, the key the opened preview and editor use,
so every surface updates one link. The published text comes from a fresh read
begun after the click; a failed read publishes nothing and says the visual
couldn't be read. The toolbar stays shown while Share's popover is open.
* fix(native-chat): a visual read without a path is a malformed reply
A visual's path is always on the current host's readVisual answer, so the
inline Open needs no branch for a missing one. Also prune the deleted
chat-visual tab action from the layout-writer baseline.
* test(native-chat): give visual read replies their path without longer lines
* fix(native-chat): address a scratch file by its folder only outside every workspace
A workspace that contains the host's state folder keeps its own address, so
explorer drops, folder creation and renames inside it stay on one root.
Document preview Share reads a runtime grant's own selector and root
directly instead of passing the selector off as a workspace id.
* fix(native-chat): show a chat visual's Share whenever it shows
Every read now carries the visual's path, so Share no longer waits on one; its
key comes from the path the click's fresh read returns.
* test(runtime-files): wait for the stores to close before removing the state folder
* fix(opencode): refuse a picked OpenCode model in any \\wsl$ repo (#28236)
OpenCode in a \\wsl$ repo runs in WSL whatever the project's setting, and Orca can't verify a
model there yet, so picking one is refused, as it already is for a project set to WSL, instead
of being checked on Windows.
* fix(mobile): workspace list host badge, "workspaces" wording, and search keyboard on the page (#28824)
* fix(mobile): workspace list host badge, wording, and search keyboard on the page
- Host badge no longer shrinks to "m…"; the branch/path text gives up the space.
- Search placeholder, accessibility label, and empty states say "workspaces".
- The page's workspace list no longer closes the keyboard on each narrowing keystroke:
react-native-web dismisses on-drag on every scroll event, including the offset clamp.
* fix(mobile): let the row path take only the leftover space instead of pinning the host badge
A non-shrinking badge overflowed narrow, indented rows; a zero-basis path keeps a short host name whole and still lets the badge shrink when the row is genuinely too narrow.
* fix(mobile): reword the row path's layout comment
* refactor(mobile): inline the page's keyboard dismiss choice and use flex: 1 for the row path
Drop the platform split and its react-native-web test: an inline Platform.OS check states the
same choice where it is used. flex: 1 renders identically to flexBasis 0 + flexGrow 1.
* fix(relay): supersede a reserve seat from the feed once a later, newer join shows (#28716)
* test(relay): check invariant 4 (one demotion winner) in the step-5 simulation
Every demotion now names its winner (the newer booking, or the row). The model
flags a director that names a different winner for a divergence another already
named, and a host whose two seats are each demoted for the other. A fault where
directors break level ties by their own cell order shows the check fires.
Violations are capped per invariant so one flood cannot hide another class.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* test(relay): bound unseen duplicates by the silence close and assert all invariants on contested ties
A reserve seat the booking director's map had not seen (joined, then half-open within a poll)
is never superseded and has no lease to re-check, so it lasts until the cell's control silence
close (75 s + one 15 s ping). Invariant 3 now uses that bound for such seats, and the
level-divergence config asserts every invariant.
Stale maps now judge a divergence another director already demoted, so the config's
"contested" counter (divergences judged by two or more directors) is the case invariant 4
guards. The silence-close constant now matches production (90 s, not 100 s).
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* test(relay): raise the floor on map-judged demotes and count only level contests
A reconcile whose map has not seen another director's demotion still demotes in
production, which raises its epoch floor; the model now does too. The contested
counter counts only same-epoch pairs, the only ones invariant 4 can split. The
keep-this-seat rule is one helper.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* refactor(relay): name the simulation's fault-kept seat check for the fault
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* fix(relay): supersede a reserve seat from the feed once a later, newer join shows
A half-open seat the booking director's map had not yet seen was never demoted and held its
cell until the 75 s control silence close. Directors now demote it once both joins are in the
map; the simulation holds invariant 3 at the supersede bound for it.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* fix(relay): outrank only past cell clock skew, reuse demoteSeat, keep invariant 3's loose clock running
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* refactor(relay): share the outrank rule with the simulation, pin the skew boundary
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* fix(relay): count only confirmed level demotions and every second judgment, and bound duplicates by placement records alone
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* fix(relay): a drained seat keeps its drain grace under a demote, and the feed reports each seat once
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* refactor(relay): name the outranked-report bound and the reconcile backstop
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* refactor(tabs): delete unused copy-tab and merge-group store actions (#28836)
* refactor(tabs): delete unused copy-tab and merge-group store actions
copyUnifiedTabToGroup and mergeGroupIntoSibling had no callers outside
the store and its tests. Tests that used the copy action as a setup step
now create the duplicate tab directly, the same call the action made.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore(tabs): follow the split-ratio file rename in the layout-writer baseline
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf(layout): re-project only the written partition in the layout stream (#28845)
The layout stream (layout.subscribe, still unused) re-loaded every session
partition and ran the load's save-and-diff report after each write. A save
now names the partition it wrote, the stream re-loads only that partition
without the report, and the renderer layout client no longer re-subscribes
on a timer. Adds a latency spec variant with a subscriber attached.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(wsl-mover): background writers step aside for a project a WSL move is taking (D1b-5c-3) (#28835)
* feat(wsl-mover): background writers back off a project a WSL move is taking (D1b-5c-3)
* fix(wsl-mover): re-check before renames, quiet owned automations, stable folder ids (D1b-5c-3)
* test(wsl-mover): seed journals one phase at a time and advance existing moves (D1b-5c-3)
* fix(wsl-mover): a branch rename that already ran settles even when the move skips the folder (D1b-5c-3)
* fix(i18n): correct the Japanese label for the Cleaned browser identity (#28526)
The Japanese option read 掃除済み ("housekeeping done"), while the migration notice that points to the same setting already calls it クリーン. Use クリーン in the option and its settings-search keyword.
Also restore the literal CLI command in the reset hint, which translation had re-capitalised in ja, zh, and fr so it could not be copied and run.
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(i18n): use クリーンアップ in the Japanese VM cleanup stop dialog (#28533)
The dialog title and cancel button said 掃除 (household cleaning), while its own description and confirm button already say クリーンアップ. Use クリーンアップ throughout.
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* refactor(terminal): publish new tabs together with their startup command (#28848)
Seven call sites created a terminal tab and then queued its startup command
in a second store write. Pass the command through createTab's existing
pendingStartup option instead, so the tab and its command land in one write.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(daemon): keep every pane in main's layout through a terminal service restart (#28852)
Restarting the terminal service ends each session with a synthetic -1 exit. Main
read those as ordinary deaths and retired every terminal surface from the saved
layout, while the window kept drawing them. Phones and the CLI lost the tabs, and
the next launch restored a split as a single pane.
The restart now labels those exits as replaced, and main records them in its
existing intentional-stop register, the one terminal restarts already use. The
runtime keeps the surface and the window receives the same replaced label.
Claude-Session: p2-headless
* chore(relay): pin staging c4 to image G for E-pre (#28854)
G is main 2de73812 (relay sha256:07b5bf67…), which adds the cell's t_preauth latency metric.
Claude-Session: f2fe8cb5-4467-4a25-8aab-98598b70791f
* test(session): compare what the window shows before and after the shared session loader (#28842)
* test(session): compare what the window shows before and after the shared session loader
Boots the window's real startup hydration on each saved-profile fixture as
stored and as the shared loader rewrites it (load then save), and compares
tabs, groups, active tabs, pane trees, terminal bindings, editor and browser
tabs. Today's eight differences are listed with the loader rule behind each;
the list may only shrink, so any new difference fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(session): let the parity test own its store so the harness reads no host focus
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(session): restore the parity boot's UUID spy even when the boot throws
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(checks): add optional job log outcome
* fix(checks): preserve host capture lifetimes and safe outcomes
* fix(checks): retrieve and retry bounded failed-job logs
* test(checks): cover queued snapshots and captured error safety
* test(checks): verify sanitized host excerpts and paired failures
* test(checks): identify measurements and preserve paired cleanup
* fix(checks): hold check log lifetimes until processes exit
- Nested gh calls now stay registered until their child closes and their
scope seals, so a check-details request no longer reports terminated
while its process is still running.
- Failed-job log requests leave the shared in-flight cache only after the
result is delivered and the process has exited, so a replacement request
cannot start while the old child is still alive.
- Check-details metadata calls wait for their own termination in a
`finally`, replacing the chained `previous` promise that serialized calls
and could skip cleanup on error.
- Abort handling uses `assertCheckDetailsActive` directly, and the test
fixture moved to a shared config script.
* fix(checks): reuse job logs with pinned credentials across runtimes
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Sojiro.O <53679703+sojiro-o@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 1 of 5 of a stack that rebuilds #26867 as smaller PRs. Stack: Part 1 (this PR) → Part 2 #28103 → Part 3 #28104 → Part 4 #28111 → Part 5 #28122.
ELI5
A native chat's journal is the saved list of everything in the chat: replies, tool calls, approvals, subagents, background tasks. Today a row in it says which writer saved it, but not which run of the agent actually produced it. Later parts of this stack need to ask "is this item from the agent that is running now, or from one that already died?" This PR only records that fact on each row. Nothing reads it differently yet, apart from the few places that already read the item's "fence".
What Changed
The problem
Before and after, as you see it
0, so it is never "current work";0when the rewind record predates this field);How it works
ownerFence: the fence of the agent run whose output produced it (journal-item-provenance.ts). Since main's feat(chat): host writes one saved row per subagent #27947 every subagent has its own saved row, and every background task already had one, so a per-item value names each subagent's and each task's run.journalAppendOptions, the transition batch), or history carried into a new epoch. Every later revision keeps the item's value, Orca's bookkeeping and a newer run's provider alike. A newer run does revise older rows: Pi's start (src/main/pi/rpc-session.ts:152) and an ACPsession/load(src/main/acp/acp-context-usage.ts:34) both report context usage onto the newest saved turn (provider-timeline-turn-decisions.ts:283), and that must not make the newer run the turn's owner.itemFence()now returns this value, so main's existing readers (the turn-verdict rules and per-run provider activity) read the producing run.dropUnusableOwnerFence).ownerFence = MAX_SAFE_INTEGER, and its frozen receipts are regenerated for the new row shape.Why
The later parts decide what is "current work" from the lease (who may act now) plus this provenance, instead of from raw rows. Earlier rounds of this PR also stamped each entry inside the shared subagent roster row, because one roster row was revised across runs. Main's #27947 replaced that row with one saved row per subagent, and new runs no longer write the old shared row, so the per-entry stamp was removed: per-item provenance is enough. Recording it as an optional field keeps old and new Orca versions compatible with no migration.
Differences from main
0; rewind keeps the old run; provider activity keyed by the producing run).Linked Issue
Part of the rebuild of #26867 (root-cause follow-up to #26664).
Visual Proof
N/A: data-only change with no visible difference. The full stack's before/after screenshots and QA are in Part 5.
Testing
I manually tested these changes locally
Automated tests added/updated, or explained why not below
New
journal-item-provenance.test.ts: provenance is recorded by the creating write and kept by a newer run's provider revision, a bookkeeping revision and a reopen; a lifecycle batch keeps an item's earlier owner; a rewind record from an older build reads as run0. PlusownerFencein fixtures and expectations where rows now carry it, and regenerated frozen partition receipts.Tests kept to what a later part or an older build relies on: the epoch-replacement case (Part 2's rewind test reads the same values through the same rebuild) and a corrupt-value case (no version writes one) were dropped.
Merged main
b83a6f74be9. Main's feat(chat): host writes one saved row per subagent #27947 (one saved row per subagent) rewrote the two Grok subagent timeline tests; they now match main exactly.Local at
387d313a521:tc:node,tc:webandtc:clipass; under Node,src/main/native-chat(3711 tests), the agent groupssrc/main/claude|codex|acp|agent-hooks|pi(7152), runtime +src/shared(18704) and the native-chat renderer (3926) pass;orca-ci-checks --no-typecheckpasses apart from the known local-only buntypecheck:cired.CI at
387d313a521: green, full test workflow included. (The earlier head28edc8d90d5hit main's own red from fix(native-chat): drop the duplicate now key left by crossing fixes #28599; main fixed it in fix(i18n,test): drop setup-only keys and fix the default-tab test #28543 left red #28603 and this head merges that.)Size against main: production +160/-48, tests +157/-14.
What the reviewer should check
ownerFenceis optional everywhere, with no rowvbump; a value this build can't read is dropped.journalItemOwnerFence,upsertJournalItem). This is main'sitemFencesrule, plus carried history.ownerFence = MAX_SAFE_INTEGER, and the frozen receipts were regenerated for the new row shape.AI Disclosure
Review
Stacked: Part 1 of 5. Parts 2 to 5 build on this branch.
Agent skill upstream boundary
Notes
ownerFenceon items, no migration. Older builds ignore it.Author: Brennan Benson (@BrennanKB5).
Checklist
N/Awith reasonpnpm lint,pnpm typecheck,pnpm test, andpnpm buildpass (or CI will cover; local preferred)