[brennanb2025]

	Files	Added	Deleted	Net
Test	5	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​42	$\color{#cf222e}{\Huge{\mathbf{−}}}$​56	$\color{#cf222e}{\Huge{\mathbf{−}}}$​14
Prod	5	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​59	$\color{#cf222e}{\Huge{\mathbf{−}}}$​51	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​8

ELI5

When you click an AI button such as "Fix checks", Orca opens a tab and asks the host to start the agent in it. Until now the host also wrote a bookkeeping entry for that click (a "launch record"). If that record store couldn't be opened, the click was silently dropped: its tab appeared and closed at once, with no agent and no message, even though nothing was wrong with the agent. Nothing ever reads that entry back, so this PR stops writing it, and the click no longer depends on it.

What Changed

The problem. Since #25624, an AI button's click is started by the host's agent.launch under an operation id, so the host writes a launch record for it. After #28043 (merged), nothing reads those records back for AI buttons:

• The record's job is to answer a resent request with the same result (admitAndClaimOperation, agent-launch-replay.ts:206-207). The window never resends: it makes one id per click and calls once (agent-launch-through-host.ts, one callRuntimeRpc, no retry).
• The only other reader was the restart path, which read the record to decide what a launch pane shows after a restart. After a restart, an agent tab asks the terminal host what is running, never "Couldn't confirm the agent started" #28043 deletes that reader.
• The chat readers (structured-agent-session-create.ts:100, structured-agent-session-agent-start.ts:232, structured-agent-session-failed-create-refusal.ts:203, structured-agent-session-create-adoption.ts:36) look up their own chat operations, never a terminal launch's. Session History, the phone's lists, the agent status store, worktree ps and the dashboard don't read launch records at all.

#25624 described the record as being for "replay after a restart", and said of AI buttons: "the window still delivers their prompt (main's paste), so for them delivery is not host-owned: no host receipt, no replay of the prompt after a restart." It also said "Bookkeeping never blocks the click", yet a record store that couldn't open still refused the click.

What you'll see differently.

• An AI button starts its agent even when the launch record store can't be opened. Before, the click was dropped silently: its tab appeared and closed at once, with no notice, no toast and no agent (seen in live QA).

• Temporary, until AI-button and OpenCode-model tabs start their agent in their own terminal #28210 lands: a failed AI-button launch closes its tab and shows "The agent couldn't start." with Copy prompt as a notice at the corner of the window, instead of inside the tab. The notice gives that short line without the reason the tab used to add (for example "Its command wasn't found on this machine.").

• Temporary, until AI-button and OpenCode-model tabs start their agent in their own terminal #28210 lands: an AI-button launch whose outcome can't be confirmed no longer shows "Couldn't confirm the agent started." inside the tab. If the agent's terminal had already appeared, the tab stays and the same words show as a corner notice with Copy prompt. If the start was lost before the terminal appeared, it reads as "The agent couldn't start." and the tab closes; an agent that did start after all is stopped, because the closed tab's record refuses its terminal (as main does for any closed tab).

• Temporary, until AI-button and OpenCode-model tabs start their agent in their own terminal #28210 lands: while this PR is on its own, when an AI button's agent appears, Orca switches to its workspace and focuses its terminal even if you moved on.

• Temporary, until AI-button and OpenCode-model tabs start their agent in their own terminal #28210 lands: an agent that starts after its failed tab was closed is stopped, not shown. AI-button and OpenCode-model tabs start their agent in their own terminal #28210 removes this: the tab's own terminal starts the agent, so there is no separate late start.

All four temporary changes end with #28210, where the tab's own terminal starts the agent and says again, inside the tab, how it ended. That includes the corner notice "Couldn't confirm the agent started." shown when the host fails after the agent's terminal appeared: it is temporary too.

Based on current main. This PR and #28210 merge together, this one first, so the temporary changes never ship alone.

Nothing else changes. "+" tabs, phone, CLI and orchestration launches still name an operation and keep their record. The prompt is still pasted by the window once the agent is ready, as before.

Mechanism.

• The window calls agent.launch with no operation id (it called agent.launchReplay with one). The host's existing no-id path runs: no record is opened or written, and no tab is shown ahead of the agent. The pane key is still sent, so the agent starts in the tab the window made, and the host's reveal of that terminal lets the tab's waiting pane attach, as it already does for a pane the host never showed early.
• The window drops the refusal codes that only a recorded launch can return (operation conflict, expiry, the 512-a-day cap).
• When the host answers, the tab's launch marker is cleared, as a settled launch leaves it.
• If the user closed the tab while it started, the window still stops the agent as its terminal appears (unchanged), and now says nothing more because the tab is gone.
• When the window closes a failed launch's tab itself, the close is not recorded as the user's: the tab isn't offered by Reopen Closed Tab. The close still records the tab as closed, so an agent that starts afterwards has its terminal refused and is stopped (terminal-surface-close.ts, pty-binding-refusals.ts).
• Bookkeeping only an early tab used is gone: the per-click prompt memory, the hold release in the tab-publication retry, and a stale comment.

Why

"Bookkeeping must never gate a user action": a record nothing reads should not be able to refuse a click. Dropping the operation id uses the host's existing no-id path instead of adding a fallback. The alternative, keeping the record and starting anyway when it can't be written, keeps writing entries that nothing reads.

What the window gives up: an answer to a resend it never makes; AI clicks no longer count toward the desktop's 512-a-day launch cap, and can no longer be refused by it.

Linked Issue

Part of the launch-convergence plan (restart step, follow-up 3 folded in). Builds on #28043 (merged); merges together with #28210, this one first.

Visual Proof

N/A in this PR alone: it ships together with #28210, whose live QA covers the AI-button rows.

Testing

• I manually tested these changes locally

• Automated tests added/updated

• Starts without a record. A reserved pane launched with no operation id starts its terminal in that pane and never opens the launch record store, which is unavailable in the test (agent-launch-pane-reservation.test.ts).

• No operation id sent. The AI button's request is agent.launch with the pane key and no operation id, and each click has its own pane (agent-launch-through-host.test.ts).

• Temporary failure surface. A failure before the agent's terminal appeared closes the tab and reports "couldn't start"; a failure after it appeared keeps the tab and reports "couldn't confirm"; a tab the user closed reports nothing (agent-launch-through-host.test.ts, launch-agent-new-tab-host-route*.test.ts). The shared launch test store now keeps a tab made with its own id, as the real store does, so the caller suites don't read every AI-button launch as closed by the user. The temporary surfaces get no further tests, since AI-button and OpenCode-model tabs start their agent in their own terminal #28210 removes them.

• Verified: tc:node, tc:web, the changed-code quality check, oxlint, and the layout-writer check pass; every test file that imports a changed module passes.

Size

Measured with git diff --numstat <base> HEAD -- src, TypeScript only; test files count as tests and locale JSON on its own. Against main: production −10, tests +4, locale strings 0.

AI Disclosure

Review

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

Ensure no issues in: Security, Cross-platoform support (Linux, Windows, Mac), Remote SSH, Mobile, general backwards compatibility, performance

• SSH: AI buttons on SSH workspaces take the same path as before, minus the record.
• Mixed versions: agent.launch without an id is the method's original contract, which every host supports.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason (ships with AI-button and OpenCode-model tabs start their agent in their own terminal #28210)
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)

[brennanb2025]

Closing and reopening to trigger CI after the retarget to main.

[brennanb2025]

Status: ready for review. Merge together with #28210, this one first. Head 328c23e62a3, based on current main (ed18c2c5800).

Reviews. Round 1 (fresh reviewers) found 1 P2 and 4 P3s:

• P2: a no-id launch moves focus to the agent's tab. This is listed as temporary in the body, and AI-button and OpenCode-model tabs start their agent in their own terminal #28210 removes it.
• P3s: the close was recorded as the user's; leftover bookkeeping. Both fixed. The temporary surfaces are untested by design.

Round 2 found one wording fix (an agent that starts late is stopped, not shown), now fixed. Then a CI fix: the shared launch-test store now keeps a tab made with its own id, as the real store does (test only). No open findings.

Syncs with main. Two syncs with main, approved by the lane owner: the first for #28351, the second for #27692, which #28210 needed. This PR needed no change in either. git range-diff shows the same patches, minus an empty commit that only re-ran CI. Size against main is unchanged: production −10, tests +4.

Checks on this head.

• tc:node, tc:web and the focus-read ratchet pass.
• Every test file that imports a changed module passes, plus the launch-parity and race suites: 21 files, 514 tests.
• orca-ci-checks passes 21 of 22 checks. The one failure is the local bun typecheck runner: bun can't find its check script on this machine, which is unrelated to the diff. The tsc typechecks above pass, and CI runs its own typecheck.
• CI: green on 328c23e62a3 (15 pass, 0 fail; the rest skip for a draft). No unresolved review threads.

Live QA. This PR ships together with #28210, so live QA ran on #28210's head, which contains this one. See #28210's status comment. This PR's own visible change was QA'd on an earlier head: an AI button starts even when the launch record store can't be opened. Main dropped the click silently: its tab appeared and closed, with no notice and no agent. On this PR, Claude started and answered the prompt.

Not verified. This PR alone, without #28210, was not QA'd live. It never ships alone.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a37d3d2f-9e4a-45c5-973b-f1cee806e000

📥 Commits

Reviewing files that changed from the base of the PR and between ba07bd7 and 328c23e.

📒 Files selected for processing: 10

• src/main/runtime/rpc/methods/agent-launch-pane-reservation.test.ts
• src/renderer/src/lib/agent-launch-funnel-test-harness.ts
• src/renderer/src/lib/agent-launch-pane-spawn-hold.ts
• src/renderer/src/lib/agent-launch-tab-publication.test.ts
• src/renderer/src/lib/agent-launch-tab-publication.ts
• src/renderer/src/lib/agent-launch-through-host.test.ts
• src/renderer/src/lib/agent-launch-through-host.ts
• src/renderer/src/lib/launch-agent-new-tab-host-route-readiness.test.ts
• src/renderer/src/lib/launch-agent-new-tab-host-route.test.ts
• src/renderer/src/lib/launch-agent-new-tab-host-route.ts

💤 Files with no reviewable changes: 1

• src/renderer/src/lib/agent-launch-tab-publication.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

📝 Walkthrough

The renderer now calls agent.launch without an operation ID or stored launch prompt. Launch settlement handles terminal and non-terminal results, user-closed tabs, and pane state cleanup. Existing-tab publication retries report created: false. Tests cover launches without a launch record store, unconfirmed results, and closed-tab outcomes.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 328c2

No actionable merge-blocking risk is established for the AI-button launch change. Merge after normal checks, in the planned order with #28210.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 35.71% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 9 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly summarizes the main change: AI-button launches no longer write launch records.
Description check		The description is detailed and covers the user impact, mechanism, rationale, linked work, testing, compatibility, and checklist. It does not provide a direct issue link and leaves the visual-proof ch…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}