[OrcaWin]

	Files	Added	Deleted	Net
Test	3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​321	0	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​321
Prod	3	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​158	$\color{#cf222e}{\Huge{\mathbf{−}}}$​81	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​77

ELI5

On a computer you reach over SSH, Orca now runs a small Orca server. Since that change, clicking a web link in one of that computer's terminals only offered your normal web browser, not Orca's built-in browser. This PR brings the built-in browser back for those links. A link like http://localhost:3000 still opens the dev server running on the SSH computer, not one on your own machine.

What Changed

Before (1.4.225+): in a terminal on a managed SSH host, the link popover showed only "System Browser", and Cmd-click (Ctrl-click on Linux/Windows) opened the system browser, even with "open links in Orca" turned on.

After: the popover offers "Orca Browser" again, and Cmd/Ctrl-click opens the link in an Orca browser tab on this desktop. The page's traffic goes through the SSH host, so remote localhost URLs and hostnames that only the host can resolve both work.

Mechanism:

• Terminal, chat, and markdown links each record which machine printed them. Before the migration, an SSH pane's links were tagged as SSH links. Those opened in a desktop tab routed through the host.
• After the migration (refactor(ssh): connect fails for hosts orcad can't serve; remove the relay client path #27214 removed the old SSH path in 1.4.225), the same panes belong to the managed Orca server. Their links are tagged as server links.
• For a server link, Orca only offered its browser if that server could run and stream a browser page itself. A headless server on a Linux box cannot, so the in-app option disappeared.
• New tabs opened from the tab bar in the same workspace were already fixed (Keep new browser tabs on SSH routing after managed conversion #26570): they open on the desktop and route through the SSH host. Links never got that path.
• workspace-browser-tab-open.ts adds one more accepted route for a server link. It applies when the server is an SSH deployment, cannot provide its own browser, the desktop can host the tab, and SSH browser routing is on for that host. In that case the link opens a desktop tab, exactly like a tab-bar "new browser tab" in that workspace. The existing SSH-routed browser gate then sends its traffic through the host. (The tab title and error helpers moved to workspace-browser-tab-presentation.ts to keep the file under the line limit.)

Unchanged:

• Local panes.
• Paired-server panes whose server can stream a browser page still open on that server.
• Paired servers that cannot stream and are not SSH deployments (including WSL servers) still offer only the system browser.
• The paired web client has no in-app browser for these links.
• If you turned SSH browser routing off, or chose "browse from this device" for that host, links offer only the system browser. This matches 1.4.224, so a remote localhost link never silently opens your own machine's localhost.

Why

• The SSH-routed desktop browser is what these hosts used up to 1.4.224. It is also what new tabs in the same workspace already use, so links now land in the same kind of tab, with the same cookies and the same egress.
• Alternative 1: make the headless server advertise or run a browser. That needs a browser runtime on every SSH host and streams pixels over SSH. The issue reporters asked for the desktop browser.
• Alternative 2: drop the owner check entirely. That would send other paired servers' links into a local tab that browses from the wrong machine.
• No wire changes. This is renderer-only routing, so mixed client/server versions are unaffected.

Linked Issue

Fixes #29077
Fixes #27349

Visual Proof

N/A for screenshots in the PR body. The new Docker E2E (tests/e2e/ssh-orcad-terminal-browser-link.spec.ts) captures the link popover with "Orca Browser" and the opened page as test artifacts.

Testing

• workspace-browser-tab-open.test.ts covers these cases:

  • A managed SSH server without a browser backend offers the Orca Browser and opens an SSH-routed desktop tab.
  • A browser-capable server keeps its runtime browser.
  • Routing off, a per-host opt-out, or a WSL server offers only the system browser.
  • A link asserting another server is refused.
  • The paired web client is refused.

• Existing terminal-link (28 files), native-chat, markdown-link, and http-link-destinations tests pass.

• New E2E ssh-orcad-terminal-browser-link.spec.ts runs on the Docker managed-SSH lane. It converts a Docker SSH host to a managed server and prints a URL in its terminal. It clicks the link and checks the popover offers "Orca Browser", then opens it. It confirms the request reached a server that only the container can resolve. It then Ctrl/Cmd-clicks http://localhost:<port>/… and confirms that request was served by the container's localhost too. The spec is wired into PR e2e routing.

• pnpm tc:web, pnpm tc:node, and pnpm run check:code-quality:changed pass.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

Review

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

• Cross-platform: Cmd on Mac and Ctrl elsewhere come from the existing link activation code. The E2E uses Playwright's ControlOrMeta.
• SSH: this is the SSH case.
• Mobile/paired web: unchanged, because the paired web client is excluded.
• Backwards compatibility: no wire or persisted-state change.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 490100e3-3830-4167-9c41-82b359aac001

📥 Commits

Reviewing files that changed from the base of the PR and between 202a0dc and b4873a6.

📒 Files selected for processing: 3

• src/renderer/src/lib/workspace-browser-tab-open.test.ts
• src/renderer/src/lib/workspace-browser-tab-open.ts
• tests/e2e/ssh-orcad-terminal-browser-link.spec.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

📝 Walkthrough

Workspace browser-tab routing now accepts eligible SSH-deployed client routes. When the runtime lacks browser-streaming capability, opening a link can create a local client tab while retaining the runtime as owner. Deployments with screencast capability continue to use the runtime browser. Presentation, failure, and URL-validation helpers are in a separate module. Unit and end-to-end tests cover routing and terminal links. Source-routing configuration selects the end-to-end test for listed changes.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to b4873

No demonstrated issue blocks merging after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 21 functions across 12 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: restoring Orca Browser support for managed SSH terminal links.
Description check		The description is complete and follows the repository template. It explains the user impact, implementation, rationale, linked issues, testing, exclusions, visual proof, and compatibility considerati…
Linked Issues check		The PR meets the coding requirements for [#29077] and [#27349]. workspace-browser-tab-open.ts accepts an eligible managed SSH runtime when the runtime has no screencast capability and the client can…
Out of Scope Changes check		The changes stay within [#29077] and [#27349]. The production routing change restores managed SSH link behavior. The presentation-helper move preserves existing tab presentation and error behavior. Th…

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}