Skip to content

Unify terminal starts under one host operation - #32076

Merged
brennanb2025 merged 21 commits into
mainfrom
brennanb2025/conv-c6-build
Oct 26, 2026
Merged

brennanb2025 merged 21 commits into
mainfrom
brennanb2025/conv-c6-build

Conversation

@brennanb2025

@brennanb2025 brennanb2025 commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor
Files Added Deleted Net
Test 17 $\color{#1a7f37}{\Huge{\mathbf{+}}}$​1875 $\color{#cf222e}{\Huge{\mathbf{−}}}$​133 $\color{#1a7f37}{\Huge{\mathbf{+}}}$​1742
Prod 43 $\color{#1a7f37}{\Huge{\mathbf{+}}}$​1223 $\color{#cf222e}{\Huge{\mathbf{−}}}$​1205 $\color{#1a7f37}{\Huge{\mathbf{+}}}$​18

The problem

Orca starts a terminal in two ways. The app window starts one when a terminal pane opens. Everything else (the orca command line, the phone app, agents and automations) asks Orca to start one directly. Each way had its own copy of the start-up code, and the two copies made their own decisions.

When both tried to start the same terminal at the same moment, whichever got there first decided what the other one saw. In practice:

  • If the program in the terminal quit immediately, the window and the command line could disagree about what happened. One might show nothing while the other reported success.
  • A start that was cancelled part-way could leave things reserved that nothing would ever release.
  • Fixes had to be made twice, and the two copies kept drifting apart.

What this changes

There is now a single start-up path for every terminal, whoever asks for it.

  • If two requests start the same terminal together, the second one joins the first. Only one program is started, and both callers get the same result.
  • If the program quits during start-up, the window still shows its last output, so you can read why it stopped. The command line, phone, agents and automations still get a clear start-up failure, as before.
  • A new terminal starts at the size that was asked for. Reconnecting to a terminal that is already running keeps its current size.
  • A cancelled or refused start now releases everything it reserved.
  • Main's recent change (A chat never starts writing a conversation a terminal is still writing, and restored panes respect open chats #30930) that stops a chat and a terminal from writing to the same saved conversation now runs inside this single path. The check happens once, and every caller that joined the start sees the same answer.

What stays the same

There are no new settings, no change to what gets saved, and no change to what Orca sends between machines. Older paired servers and older phone apps keep working as they do today. Remote (SSH) and multi-machine setups still start terminals on the machine that owns them. Commands people type, and the commands agents are launched with, are unchanged.

Linked issue

Tracked in https://linear.app/stably/issue/STA-11756.

How it was tested

  • An independent review ran three rounds over the whole change, compared it with the common pattern for this kind of code, and checked how it scales with many terminals.
  • Automated tests cover two starts racing each other, a program quitting during start-up, cancelled starts, terminal sizes, cleanup, and the phone, remote and automation callers.
  • Real-app testing on macOS, native Windows and Windows with WSL covered:
    • terminals started from the window and from the command line;
    • restarting Orca with terminals open, including upgrading from the published app with saved terminals;
    • hiding, showing and reloading panes;
    • cancelling starts and programs that quit at once;
    • Claude, Codex and OpenCode sessions continuing to work.
  • Since that testing, this branch has only merged in main. Main merges don't need retesting under our rules: CI checks the merged result.

Current CI and review status, with every screenshot, is in the review status comment.

Existing problems this PR does not fix

The same testing turned up four problems that already exist in the published app and that this PR doesn't change:

  • On WSL, a plain terminal forgets the folder you chose after Orca restarts. Tracked in STA-12099. The published app's screenshot of this timed out, so it is UNMEASURED; the saved data and the folder the terminal actually opened in show the behaviour.
  • A very short-lived terminal started from outside the window (for example by the command line) can lose its last line of output. Tracked in STA-12101.
  • On native Windows, after Restart, terminal rows can show an extra folder suffix. Tracked in STA-12029. This PR · published app.
  • Reconnecting to a terminal can repeat a little output when the saved picture of the screen already contains it. This is temporary, tracked in STA-11855. This PR keeps the existing protection against losing newer output.

One observation stayed unexplained: Once, on native Windows after Restart, two whole-window screenshots showed rows from the previous terminal; it did not recur in a paired rerun on the same build and on the previous build, and its cause is unknown.

Differences from the common pattern

  • Intended: Orca still chooses which machine runs each terminal, still refuses to reuse a terminal that has been replaced, and still supports older servers and phones. This product needs all three: it runs terminals on several machines, and clients and servers update at different times.
  • Intended: a window shows the final output when a start fails, while other callers get an error. A window has a screen to show output on; the others don't.
  • Temporary: how hidden terminals receive output still depends on who started them. Follow-up: STA-12188.
  • Temporary: the window still prepares part of its launch settings itself. Follow-up: STA-11757.
  • Temporary: each caller still works out where to run a terminal in its own way. Being unified in fix(terminal): match Windows workspace runtime across launch paths #31980.

Agent skill upstream boundary

  • This change copies or mechanically translates no upstream skill-installer material.

@brennanb2025
brennanb2025 marked this pull request as ready for review October 22, 2026 17:56
@coderabbitai

coderabbitai Bot commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review.

ℹ️ Recent review info
⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c759490b-c8ee-4e80-9045-366ddef555bd
📥 Commits

Reviewing files that changed from the base of the PR and between 62c15b5 and 0f9abfc.

📒 Files selected for processing: 6
  • src/main/ipc/pty-launch-race-parity.test.ts
  • src/main/ipc/pty-pane-materialization-race.test.ts
  • src/main/ipc/pty/spawn-outcome.ts
  • src/main/runtime/cli-terminal-create-host-session-binding.test.ts
  • src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
  • src/shared/terminal-attach-result.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

Walkthrough

The change adds shared orchestration for IPC and runtime PTY spawns, with committed, adopted, and registration-exited outcomes. Pane reservations retain spawn operations and outcomes for adoption and registration-exit handling. IPC and runtime entry points use the shared lifecycle and new-incarnation ownership state. Terminal creation tracks agent-team launch allocations through spawn outcomes. Tests cover spawn races, pane restoration, failure cleanup, and outcome handling.

Priority: Normal

Merge Risk: Minimal · up to 0f9ab

The previously reported lint blocker is fixed. No remaining issue identified in these changes prevents merging after normal checks.

Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 33.93% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 56 functions across 46 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks: 4 passed
Check name Status Explanation
Title check Passed The title clearly summarizes the primary change: consolidating terminal starts under one host operation.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Description check Passed The description is detailed and covers the problem, changes, rationale, linked issue, testing, compatibility, known limitations, and upstream boundary. It does not include every template heading or ch…
Full details: Description check

Explanation

The description is detailed and covers the problem, changes, rationale, linked issue, testing, compatibility, known limitations, and upstream boundary. It does not include every template heading or checklist item, but the required information is mostly present, including references to review screenshots and outstanding validation.

✨ Finishing Touches: 💡 2
📝 Generate docstrings: 💡
  • Commit to this branch
  • Create a new PR
🛠️ Fix failing CI checks: 💡
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1


ℹ️ Review info
⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 6ba21a05-cb6b-4796-b77c-30c3493efc45
📥 Commits

Reviewing files that changed from the base of the PR and between a45bd06 and d1156f5.

📒 Files selected for processing: 44
  • src/main/ipc/pty-hidden-at-spawn-mark.test.ts
  • src/main/ipc/pty-launch-race-parity.test.ts
  • src/main/ipc/pty-pane-materialization-race.test.ts
  • src/main/ipc/pty/ipc/spawn-begin.ts
  • src/main/ipc/pty/ipc/spawn-commit-run-facts.test.ts
  • src/main/ipc/pty/ipc/spawn-commit.ts
  • src/main/ipc/pty/ipc/spawn-env-codex.ts
  • src/main/ipc/pty/ipc/spawn-execute.ts
  • src/main/ipc/pty/ipc/spawn-options.ts
  • src/main/ipc/pty/ipc/spawn-preflight.ts
  • src/main/ipc/pty/ipc/spawn-reattach-size-cache.test.ts
  • src/main/ipc/pty/ipc/spawn-run.ts
  • src/main/ipc/pty/ipc/spawn-state.ts
  • src/main/ipc/pty/ipc/spawn-types.ts
  • src/main/ipc/pty/pane/adopt-stable.ts
  • src/main/ipc/pty/pane/complete-pane-adoption.ts
  • src/main/ipc/pty/pane/pane-spawn-operation.ts
  • src/main/ipc/pty/pane/spawn-reservation.ts
  • src/main/ipc/pty/runtime/spawn-commit-response.ts
  • src/main/ipc/pty/runtime/spawn-commit.ts
  • src/main/ipc/pty/runtime/spawn-early.ts
  • src/main/ipc/pty/runtime/spawn-hidden-delivery.ts
  • src/main/ipc/pty/runtime/spawn-options.ts
  • src/main/ipc/pty/runtime/spawn-preflight.ts
  • src/main/ipc/pty/runtime/spawn-state.ts
  • src/main/ipc/pty/runtime/spawn.ts
  • src/main/ipc/pty/spawn-begin.ts
  • src/main/ipc/pty/spawn-commit-assembly.ts
  • src/main/ipc/pty/spawn-commit-publication.ts
  • src/main/ipc/pty/spawn-execute-failure.ts
  • src/main/ipc/pty/spawn-execute.ts
  • src/main/ipc/pty/spawn-operation-state.ts
  • src/main/ipc/pty/spawn-operation.ts
  • src/main/ipc/pty/spawn-options-assembly.ts
  • src/main/ipc/pty/spawn-outcome.ts
  • src/main/opencode/opencode-startup-prompt-owner.ts
  • src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts
  • src/main/runtime/claude-agent-teams-service.ts
  • src/main/runtime/cli-terminal-create-host-session-binding.test.ts
  • src/main/runtime/runtime-pane-admission.ts
  • src/main/runtime/runtime-pty-controller-contract.ts
  • src/main/runtime/terminal/launch/terminal-create-team-allocation.ts
  • src/main/runtime/terminal/launch/terminal-create.ts
  • src/main/runtime/terminal/launch/terminal-split-source-authority.ts
💤 Files with no reviewable changes: 3
  • src/main/ipc/pty/ipc/spawn-commit-run-facts.test.ts
  • src/main/ipc/pty/runtime/spawn-commit-response.ts
  • src/main/ipc/pty/ipc/spawn-execute.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to GitHub limitations.

⚠️ Outside diff range comments (1)

🟡 Minor · Restore provisional PTY size on every post-preparation exit. · spawn-operation.ts:86-89

src/main/ipc/pty/spawn-operation.ts:86-89
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Restore provisional PTY size on every post-preparation exit.

After preparation succeeds, the outer error handler and the registration-exited path release preparation without restoring the provisional PTY size. Route these paths through one guarded retirement helper. Keep release-only cleanup when preparation is not active.

Suggested fix
   let prepared = false
+  const releasePrepared = (reattachId?: string) => {
+    if (prepared) {
+      retirePreparation(adapter, reattachId)
+      prepared = false
+    } else {
+      adapter.releasePreparation?.()
+    }
+  }
   const finish = (outcome: PtySpawnOutcome) => {
     ctx.paneSpawnOperation?.acquisition?.settle(outcome)
     if (outcome.kind === 'registration-exited') {
-      adapter.releasePreparation?.()
+      releasePrepared()
       adapter.releaseHiddenMark?.()
     }
@@
           .catch((error: unknown) => {
             restoreProvisionalPtySize({
               sessionId: adapter.facts().sessionId,
@@
               sessionSizeBeforeAttach: ctx.sessionSizeBeforeAttach
             })
+            prepared = false
             throw error
           })
@@
     if (prepared) {
-      retirePreparation(adapter, adopted.result.id)
+      releasePrepared(adopted.result.id)
     }
@@
     if (prepared) {
-      retirePreparation(adapter)
+      releasePrepared()
     }
@@
       restoreProvisionalPtySize({
         sessionId: adapter.facts().sessionId,
@@
         sessionSizeBeforeAttach: ctx.sessionSizeBeforeAttach
       })
+      prepared = false
       throw error
@@
-          retirePreparation(adapter, adopted.result.id)
+          releasePrepared(adopted.result.id)
@@
-    adapter.releasePreparation?.()
+    releasePrepared()

ℹ️ Review info
⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 40de8e2e-4aba-42dc-8da7-d6522e9139fc
📥 Commits

Reviewing files that changed from the base of the PR and between 04b4271 and a311773.

📒 Files selected for processing: 4
  • src/main/ipc/pty-agent-pane-launch.test.ts
  • src/main/ipc/pty-launch-race-parity.test.ts
  • src/main/ipc/pty/pane/adopt-stable.ts
  • src/main/ipc/pty/spawn-operation.ts
🚧 Files skipped from review as they are similar to previous changes: 2
  • src/main/ipc/pty-launch-race-parity.test.ts
  • src/main/ipc/pty/pane/adopt-stable.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

@brennanb2025

brennanb2025 commented Oct 25, 2026 •

Copy link
Copy Markdown
Contributor Author

Concurrent desktop and host terminal starts had separate lifecycle owners. A caller could settle or clean up the same pane differently from its concurrent caller. This PR gives both entries one host operation, retains final output for eligible desktop registration exits, and preserves startup refusal for host callers.

Independent review completed three correctness rounds, the final whole-mechanism comparison, scaling review and readiness checklist. Fixes cover closed-pane dispatch, canonical exited outcomes, acquired geometry rollback, exact team allocation cleanup and OpenCode prompt cancellation. No open introduced P0/P1 remains. Deterministic tests cover both winner orders, registration durability, withdrawn/successor refusal, proof-carrying snapshots and cleanup; these are distinct from the live observations below.

Main integration commits 72940396e117d07c7f56ce3d4df7676179557577, f7f4feafbd5bb2288b477ac5902f241e2360abee, 8a71108c05019ff1e8ec91e2767589dab14c5e53, be1251a66737012f8a6aa64839f6a3570b635bbe, bbea78e80f1687255af875688628567d025558c5 and fa3a98d3630f89b47774bb857a318d63d9b1ad1d integrate main through 5ca8881871788ada5b3ef2bb4a3530e0faa2423e. The latest merge includes #33715’s localization repair, which superseded the closed #33711 / #33710. It merged automatically without conflicts or manual source edits, retained main’s lockfile, and passed every task of node_modules/.bin/lint-staged --diff=MERGE_HEAD --concurrent false. The common spawn-operation files are unchanged by this merge. Accepted QA at 9393ee021de039b455773758e580e6221f9c75ee carries across the merges; no new QA run is claimed. Fresh CI passed on fa3a98d3630f89b47774bb857a318d63d9b1ad1d: all seven workflows succeeded, with 41 passing and 17 skipped checks. Static analysis and all compiler projects passed, including localization coverage. macOS Intel persistence passed in 6m30s; the previous head’s artifact-download ENOTFOUND failure supplied no test verdict and did not recur. WSL Fedora passed on attempt 2 after CI’s automatic frozen-runner recovery cancelled its first attempt at the time cap and retried that job; the other WSL jobs retained their successful results. No manual CI rerun was started. Skipped checks are not counted as passes.

The #30930 composition makes physical fresh starts decide saved-conversation admission, unwinds a refused claim before its plain shell starts, and gives joined views one completed result. Cleanup retains the existing IPC-drain versus runtime-rejection distinction. Actual-owner launch metadata and remembered restore decisions survive producer finalization. Targeted connected, race, geometry, cleanup, consumer, hidden-delivery and scaling tests passed. Narrow resolved-hunk review returned AGREE / PASS at be1251a66737012f8a6aa64839f6a3570b635bbe, with no proved composition regression or targeted QA trigger.

Test-only commit 7eec8f7a6a1fc7cb76fafccaa9b66e7f2081d6af consolidated duplicate mock imports in two test files without changing assertions or shipped code. Type-contract correction fd0fb1ad27d25ee05b294371c15ef49b4d8b706f retained the IPC boundary’s existing unknown token/origin input types in the common declaration. Existing validators remain at use; the correction contains only types and changes no executable behavior or run-row flow. Its unbiased corrected-hunk review returned AGREE; five named files / 58 tests and all four compiler projects passed before the latest main merge. Both normal pre-commit hooks passed. QA9393 carries across these corrections. The merged head is clean and conflict-free; the final readiness helper is run after this status update.

One real QA campaign, with targeted completions of unfinished flows:

Platform Observed result
macOS Real Claude, Codex and OpenCode useful replies; shipped 1.4.237 state through graceful upgrade; desktop/CLI starts and input/output, saved restore/reveal/reload, geometry/wrapping, hidden terminals, restart/exit, continued teams and a main-layout subset.
Native Windows Shipped 1.4.205 state through graceful same-profile upgrade; Claude/Codex useful second/post-reload replies, ConPTY/daemon identity, CLI create/read/send/reveal, 101×31→135×60 geometry, retained exit7 output and useful Restart successor.
Protected WSL Published 1.4.237 state through graceful upgrade; Claude/Codex useful replies and reload, guest identity, desktop/loopback CLI, hidden/reveal, cancellation/successor. Explicit 120×40 before-view observation retained the same guest/count through reveal/input (later89×44); outer exit7 kept final marker/output/code7.

Unchanged phone, automation, remote/mixed-version and multi-host consumers are covered by read/write-to-result contracts; mobile CI exercised 27 launch, 19 action and 7 history tests. No additional phone/emulator/physical SSH or all-agent campaign is claimed. Scaling tests vary callers/panes/tabs/layout from4 to40 and verify operation/pending-retention bounds; all11 assertions passed on Ubuntu/macOS/Windows on the QA head. Compiler checks and all seven CI workflows passed on the latest main merge.

Known results and limits remain explicit:

  • WSL saved cwd was lost on the target and on a distinct published 1.4.237→1.4.237 control, while title/tab/leaf/layout survived. Tracked in STA-12099. The baseline restore screenshot timed out at 5s and 30s and is UNMEASURED; raw saved-state and actual guest pwd establish the stated observation. Baseline agreement neither repairs the target nor identifies a source cause.
  • Short-lived host-created terminals returned success but lost their final marker on both target and baseline; WSL tracking is STA-12101. The corresponding macOS comparison also matched. Ordinary desktop exit 0 closure is distinct from retained exit 7 output. Provider byte-zero and registration timing were not measured live; exact registration/withdrawal/rollback/sequence/team race contracts use deterministic tests.
  • Once, on native Windows after Restart, two whole-window screenshots showed rows from the previous terminal; it did not recur in a paired rerun on the same build and on the previous build, and its cause is unknown.
  • The narrower native extra-cwd suffix matched the baseline and target and is tracked separately in STA-12029. It does not explain the preceding unknown observation. Target control: Target native Restart control Baseline control: Baseline native Restart control.
  • Pre-existing image-ahead replay duplication remains temporary, tracked in STA-11855. This PR keeps the newer-output protection without implementing that separate fix. Hidden-delivery lifetimes remain temporary to STA-12188; base/assembled launch environments remain with STA-11757; runtime-resolution inputs remain owned by fix(terminal): match Windows workspace runtime across launch paths #31980. Selected-host/incarnation/mixed-version behavior and window final-output versus host-refusal projection are intended requirements.

Claude required an absolute same-session resume/manual --continue path where its configured installed shim was missing; useful replies and reload continuity were then observed. Main-layout Mac execution began after ticket 1979 had reported expiry; the later 2071 admission is not retroactive. Main-layout shell continuity was not established merely by later usability. Native Settings had DOM/pre-upgrade image evidence but no assigned post-upgrade Settings PNG; this PR changes no Settings appearance. Original native QA-profile inspection created SQLite sidecars/touched metadata; DB and 29 selected source hashes stayed unchanged, so full metadata preservation is not claimed. The native paired baseline package had stale metadata; provenance used checkout/API/rebuild/hash evidence. Exact scheduler ordering, heap/CPU/RSS/latency and every old-client/device combination are not claimed as live measurements.

Recorded test copies stopped through their owned graceful/recorded-identity paths; gate tickets, leads and collection shells are closed. WSL protected cleanup includes the launcher's guest-cleanup receipt and idle distro never-started check, not an inferred guest census. Target package/source integrity and retained evidence were checked. Real config hashes were unchanged during WSL2161; a Codex-config difference already present versus2093 and the Mac config difference are report-only observations with unknown attribution.

For Brennan’s review

The whole-window images below show the observed flows; static images do not establish scheduler ordering or source attribution. Baseline images accompany the actual paired comparisons above and below.

macOS

Evidence Screenshot
Fresh Claude folder pwd/reply QA1979_FRESH_FOLDER_CLAUDE_OK; no visible credential. QA screenshot
Fresh Codex git pwd/reply QA1979_FRESH_CODEX_OK; no visible credential. QA screenshot
Saved Claude conversation shows old reply and both current replies through QA1979_CURRENT_CLAUDE_2; no visible credential. QA screenshot
Saved Codex conversation shows old reply and both current replies through QA1979_CURRENT_CODEX_2; no visible credential. QA screenshot
Attached host shell visibly shows QA1979_HOST_ONCE, QA1979_HOST_ATTACHED and 63x133 grid; no visible credential. QA screenshot
Fresh shell reports 63x133, wraps QA1979_FRESH_GRID long output and prints checkout cwd; no visible credential. QA screenshot
Host and split panes show CLI_SEND_OK, SPLIT_ONCE and split's earlier 24x80 checkpoint; static image does not prove scheduling/counts; no visible credential. QA screenshot
Old/restored shell history, QA1979_OLD_SHELL_FINAL7 and Terminal exited code 7 with output preserved/Restart control; visible CLI IDs are runtime identifiers, no visible credential. QA screenshot
OpenCode Kimi K3.1 Pro shows pwd result and QA1979_OPENCODE_STARTUP_OK; no visible credential. QA screenshot
Claude team leader pwd/reply and continued reply with nonsecret ORCA_AGENT_TEAMS_TEAM_ID; no visible credential. QA screenshot
Overlap pane shows QA1979_OVERLAP_ONCE, continued ATTACHED command, cwd and 63x133; exact scheduler ordering is not proved; no visible credential. QA screenshot
Saved Claude conversation includes QA1979_MAIN_CLAUDE_OK and QA1979_MAIN_RELOAD_OK; image alone does not establish compile mode or lease admission; no visible credential. QA screenshot
Baseline 92dfb4f QA1979_HOST_EXIT tab displays empty live shell prompt, without final marker or exit overlay; relevant failure comparison, no visible credential. QA screenshot
Target 9393ee0 short-exit host tab displays empty live shell prompt, without final marker or exit overlay; relevant failure comparison, no visible credential. QA screenshot

Native Windows

Evidence Screenshot
Whole app; shipped-state Codex SAVED WIN2162-CODEX-1046 in folder workspace with model banner and history. Notices present. QA screenshot
Whole app Settings Terminal; PowerShell selected. Pre-upgrade image only; scrollback row is offscreen. QA screenshot
Whole app restored Native2162-Shell prints WIN2162-RESTORED-SHELL-1100, PID19596, checkout cwd,135,60. QA screenshot
Whole app Terminal3 split; separate WIN2162-NEW-LEFT-1103/PID3548 and WIN2162-NEW-RIGHT-1103/PID2220 in adjacent panes. QA screenshot
Whole app Native2162-Host shows WIN2162-HOST-FIRST and WIN2162-HOST-CLI-SEND-1105/PID19396. QA screenshot
Whole app Terminal5 displays original geometry marker101/31/PID10228 and completed AFTER-RELOAD marker135/60/samePID10228. QA screenshot
Whole app Native2162-Claude; historical shell parser error retained, Claude2.1.221/Opus5; SAVED, token-free RESTORED, SECOND explanation, POSTRELOAD marker and useful history-continuity explanation all visible. QA screenshot
Whole app folder workspace; Codex0.162.1/GPT6.1Sol high, SAVED/RESTORED/SECOND42 and completed POSTRELOAD42 plus continuity explanation all visible. QA screenshot
Whole app right predecessor retains WIN2162-EXIT-TAIL-RIGHT-1124/PID2220 and Terminal exited/exit code7/output preserved/Close/Restart overlay. QA screenshot
Whole app Terminal3 successor shows WIN2162-RESTART-SUCCESS-1125/PID14372/cwd/42 mixed with stale WIN2162-NEW-RIGHT-1103 and WIN2162-EXIT-TAIL-RIGHT-1124 rows; visible row overlap/joins. Independently confirms reported captured display failure, not byte-delivery cause. QA screenshot
Whole app Terminal3 retains old WIN2162-EXIT-TAIL-RIGHT-1124 and predecessor command intermixed with successor WIN2162-RESTART-SUCCESS-1125/PID14372 after hide/reveal. Direct visual confirmation; cause not established. QA screenshot
Whole app new Terminal3 displays clean WIN2162-UI-REPLACEMENT-1126/PID7936/cwd/42 with no predecessor rows visible. QA screenshot

Protected WSL

Evidence Screenshot
Requested120×40/same guest after reveal, then89×44 QA screenshot
Outer exit7 final marker/output/code7 QA screenshot
Codex useful target/reload replies QA screenshot
Child geometry command/exit0 (not outer-PTY proof) QA screenshot
Claude useful target/reload replies QA screenshot
Claude host reply/post-reload QA screenshot
Hidden/reload; chosen-cwd history versus restored root QA screenshot
Useful successor QA screenshot
Usable restored shell; root cwd QA screenshot

Judgment points: one operation owns acquisition and cleanup, durable exit retirement before outcome, proof-bound reply projection.

@brennanb2025
brennanb2025 merged commit 407069b into main Oct 26, 2026
63 of 64 checks passed
@brennanb2025
brennanb2025 deleted the brennanb2025/conv-c6-build branch October 26, 2026 07:36
nwparker added a commit that referenced this pull request Oct 26, 2026
…indow's source tab (#33032)

* fix(terminal): a pane another client moves to a new tab leaves this window's source tab

When a phone, another desktop or the host moved a pane out of a split, this
window kept drawing the same live terminal in both tabs. Orphan recovery read
the source tab's binding as an orphan and kept it, and the pane reconciler
only closes panes whose PTY ended. A binding whose terminal the host publishes
in another tab is now stale rather than orphaned, and a live pane whose PTY
another tab now binds is detached with its PTY left running.

* fix(terminal): keep this window's pending pane move through pre-move snapshots; retire the moved pane's agent records

A host snapshot taken before the host processed this window's own move still
lists the terminal in the source tab, so the stale-binding rule would drop the
new tab's pane. A pending host move now exempts its target pane until it
settles. An externally moved pane's agent records are retired with the source
pane, and only leaves in a tab's tree count as binding a PTY.

* fix(terminal): an externally moved pane's cleanup never retires a target this window already moved it to

If a pre-move snapshot redraws the source pane after this window's own move,
the source key already aliases the live target; retiring it would delete the
target's agent status and launch records.

* fix(wsl): keep a UNC drive-folder repo's worktrees in its own spelling (#33706)

A repo saved as \\wsl.localhost\<distro>\mnt\c\... runs Git in WSL, which
lists its worktrees as /mnt/c/.... The listing mapped those to C:\..., so the
primary worktree got the id <repo>::C:\... instead of the saved
<repo>::\\wsl.localhost\...\mnt\c\.... Its tabs, agents and terminal history
are keyed by the saved id: the renderer dropped them as belonging to no
worktree, and the C:\ row showed up as a hidden discovered worktree.

Map drvfs output to the distro's UNC view when the repo itself is saved
under it. Repos saved as drive paths (Git routed to WSL) and in-distro repos
keep today's drive mapping.

* refactor(cloud): share push's database layer as a package (#33714)

Moves the push gateway's database layer into a shared cloud/packages/cloud-database package (service name and schema passed in). Push's behaviour, log names, SQLite file and tests are unchanged.

* refactor(renderer): group agent-status records and reducers (#33665)

* refactor(renderer): group agent-status records and reducers

* refactor(renderer): consolidate concrete type owner imports

* feat(connector): connector service skeleton that checks auth-service tokens (#33723)

* feat(tools): resize the PTY mid-capture with --resize-at (#33781)

* feat(connector): inbox with held long poll, two confirmations and expiry, on connector tokens (#33734)

* fix(codex): resume a thread with the permissions it was last given, not Orca's launch flag (#33460)

* fix(codex): resume a thread with the permissions it was last given, not Orca's launch flag

Codex restores a resumed thread's saved approval/sandbox settings unless the
launch passes a permission flag. Orca replayed its launch-time recipe
(--dangerously-bypass-approvals-and-sandbox, --approve-for-me, or the Ask
flags) on every resume, so a session switched to "Approve for me" came back
as Full Access after a restart, and that override was saved to the thread.

Fixes #10886

Co-authored-by: mys <4546173+wowpotato@users.noreply.github.com>

* test(mobile): Codex AI Vault resume no longer replays Orca's permission flag

The mobile AI Vault resume builds its command through the shared resume plan,
so it now omits --dangerously-bypass-approvals-and-sandbox like desktop does.

Co-authored-by: mys <4546173+wowpotato@users.noreply.github.com>

---------

Co-authored-by: mys <4546173+wowpotato@users.noreply.github.com>

* Clip retained panes until their anchors resolve (#33788)

* fix(agent-resume): keep a background agent launch's flags when it is resumed (#33776)

* fix(agent-resume): record a background agent launch's recipe so resume keeps its flags

* test: narrow the reveal's notifier so the test needs no cast

* refactor(agent-resume): one recipe registration path; skip adopted panes

* test: add the launch-recipe listener to the remaining window mocks

* test: remove low-value predicates, inventories and helper echoes (#33778)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* test(e2e): the moved-by-another-client spec splits a server-made tab once its shell is up

A desktop-seeded first tab in an empty paired workspace is still settling its
first spawn when a split lands right after it opens, which can leave the split
pane unbound; the spec now has the server make the source tab, as #33027's does.
Its timeout bump says why.

* Fix native chat hover colors for live theme changes (#33791)

* perf(daemon): skip drain-waiter filter when none are pending (#30996)

releaseDrainWaiters runs on every stream-socket read, but waiters only exist
while a disconnect drains. Return early when the list is empty so each read
no longer allocates a throwaway filter array and callback closure.

Co-authored-by: OrcaWin <alpha-eng@stably.ai>

* build(deps): bump vite 8.3.5, oxlint 1.89.0, oxlint-tsgolint 7.0.2005 (#33794)

oxlint 1.89 adds eslint(no-setter-return), which flagged one test setter.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* test: remove low-value inventories, passthroughs and redundant cases (#33796)

* test: remove low-value inventories, passthroughs and redundant cases

* style: format test suites after pruning redundant cases

* test: remove obsolete workflow and flaky-test references

* test: prune deleted builder test from Windows shim allowlist

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(agent-awake): warn once while the Linux lid sleep assertion keeps failing (#24839)

* fix(agent-awake): back off and warn once when the Linux lid sleep assertion keeps failing

On a headless Linux host, systemd-inhibit starts and then exits with code 1.
start() reset the failure streak right after the spawn, so every 30 s retry
logged a fresh warning and the retry never backed off.

Keep the streak until an intentional stop or until an inhibitor has held for
a full retry interval, and double the retry delay on consecutive failures
(30 s up to 30 min).

Fixes #20739

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(agent-awake): keep the lid assertion failure streak across idle/active cycles

stop() reset the warn-once dedupe and backoff, so a host where logind denies
the inhibitor still warned once per agent turn. Reset only after an inhibitor
was actually held for a retry interval.

* fix(agent-awake): keep the 30s lid assertion retry instead of backing off

Backoff delayed re-acquiring the lid inhibitor on laptops after transient
failures; warning once per failure streak already fixes the log flood.

---------

Co-authored-by: brynnclaw <261708852+brynnclaw@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(computer-use): probe Linux editables via get_editable_text_iface (#10586)

set_value looked up node.is_editable_text before attempt() ran. GI bindings
from at-spi2-core < 2.53 (e.g. Ubuntu 24.04) do not expose that function, so
the AttributeError escaped and every set-value failed. Probe with
get_editable_text_iface, which has been bound since 2.9.2 and checks the same
interface.

Closes #10569

Co-authored-by: bbingz <zzb@gxsmjx.com>

* fix(updater): probe latest-linux-arm64.yml on Linux arm64 (#18339)

* fix(updater): probe latest-linux-arm64.yml on Linux arm64

Preflight HEAD of the Linux updater manifest used latest-linux.yml on
every arch, so arm64 could pin a tag whose arm64 yml was still missing
(or skip a tag that was arm64-ready). Match electron-updater and probe
latest-linux-arm64.yml when process.arch is not x64.

* test(updater): accept arch-suffixed Linux manifests in updater feed mocks

On a Linux arm64 runner the feed now requests latest-linux-arm64.yml, which the
[a-z]+ suffix in these mocks rejected (12 failures with process.arch=arm64).

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* test: remove low-value renderer predicates and wrapper suites (#33811)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* refactor: colocate task page composition hooks (#33808)

* perf(lint): skip JS plugin rules on files that cannot match (#33813)

Each custom oxlint JS rule now checks the file text first and returns no
visitors when it cannot report, so oxlint skips the AST transfer to JS.
app-store-performance only resolves scopes for tracked hook names.
anti-slop rules are wrapped with per-rule text prefilters. react-doctor
rules are off for folders without React (the old cloud/** ignore never
matched: config/ globs need a leading **/).

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(computer-use): send correct named keys and hotkey letters on Linux (#22494)

* fix(computer-use): send correct named keys and hotkey letters on Linux

press_key passed the keysym for named keys (Return, Tab, arrows, Escape)
to AT-SPI as PRESSRELEASE, which expects a hardware keycode, so a
different key was pressed. Synthesize with SYM instead.

hotkey forwarded upper-case letters such as CmdOrCtrl+A to xdotool,
which reads them as shifted keysyms and sends Ctrl+Shift+A. Lower-case
single letters in key combinations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(computer-use): drop the unreachable lone-key hotkey case

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* Unify terminal starts under one host operation (#32076)

* Unify terminal starts under one host operation

* Pin winning geometry across a late terminal join

* Use terminal creation options type in launch race test

* Check closed panes after acquiring the terminal spawn lease

* Preserve terminal start resource and join boundaries

* Keep terminal attach regression within project boundaries

* Capture terminal spawn authority and preserve image coverage

* Use checked fixtures for terminal image replay regression

* test: expose persisted pane to main layout in attach race

* test: contract terminal spawn scaling and retention

* test: correct spawn scaling fixture types and CI selection

* test(terminal): cover exited prompt claims and adopted team cleanup

* test(pty): consolidate mock registry imports

* fix(pty): retain untyped IPC resume inputs in common contract

* fix(worktrees): an unqualified id two hosts share resolves to nothing, not the first copy (#33818)

A worktree id or project host setup id repeats across hosts. Lookups that
named no host picked the first match, so a delete or setup mutation could
land on the other host's copy. They now go through one sole-copy rule and
refuse when the matches span more than one host; callers that know the
host (settings Remove, ephemeral VM rollback) now name it.

Co-authored-by: fettpl <38704082+fettpl@users.noreply.github.com>

* fix(native-chat): stop retrying final startup answers (#33685)

* fix(native): pin node-pty cfset*speed with legacy baud codes for glibc 2.42+ (#33803)

* fix(native): pin node-pty cfset*speed with legacy baud codes for glibc 2.42+

glibc 2.42 versioned cfsetispeed/cfsetospeed (GLIBC_2.42) to take literal
rates and redefined B38400 as 38400U, so node-pty built on 2.42+ fails the
Ubuntu 20.04 floor gate. Pin both to the compat version alongside the
existing openpty/forkpty/pthread_sigmask pins, and pass the legacy CBAUD
code (__B38400 on 2.42+ headers, B38400 otherwise): the compat setters
reject literal rates with EINVAL, which left every PTY at speed 0.

Fixes #19420. Supersedes #19421.

Co-authored-by: MK <mkjung.github@gmail.com>

* fix(native): fail the build if pinned cfset*speed would get a non-legacy baud code

A 2.42+ header set without __B38400 would otherwise silently pass 38400U to the
compat setters and open every terminal at B0.

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: MK <mkjung.github@gmail.com>

* Give native chats a fresh automatic name after /clear (#32287)

* Chat renames are saved as the chat's name, so Session History shows them after the tab closes

Renaming a native chat tab only changed that window's tab. Session History, phones and other windows read the host's saved name, so the rename vanished from History once the tab closed or Orca restarted.

A rename now goes to the host that owns the chat (agentSession.rename) and is saved as the chat's one name, the field History, tabs, sidebars and phones already read. The record remembers that the user chose it, so automatic naming never replaces it. A window's pre-upgrade tab rename is uploaded once and only fills a name Orca chose. Hosts without the new capability keep the old tab-only rename. Every native agent's History row now shows the chat's name once it has one.

* Keep saved chat names consistent across readers and reconnects

* Carry qualified chat names into cached readers

* Reuse the history recorder context across platforms

* Use recorded chat ownership for legacy name transfer

* Transfer legacy chat names only from known catalog ownership

* Correct recorder path matching and History subscription order

* Require complete evidence for bridged parity exclusions

* Preserve sparse array lengths in complete recording comparisons

* Initialize History observation before loading workspace context

* Integrate measured History recordings and scoped parity evidence

* fix chat naming retries and certify both replay modes

* fix ambiguous chat rename labels after navigation

* preserve chat rename intent across tab updates

* type dashboard snapshot fixtures without assertions

* fix: align chat name observation with store contracts

* test: update chat name consumer fixtures

* test: distinguish sender naming metadata from status

* Preserve saved Activity chat names across tab focus

* Clarify Activity tab projection identity

* Remove package-manager lockfile churn from main merge

* Refresh automatic chat names after clearing context

* fix(runtime): validate tab property edits before saving chat names

* Preserve naming eligibility and refresh cleared chat titles

* Fix checked naming projection types and logging metadata

* Supply context floor in status-feed journal fixtures

* fix: refresh History ownership after conversation clear

* fix: commit History request identity before refresh effects

* Fix History scan scope typing and integration test placement

* test: cover saved chat name reader contracts

* fix: bound chat naming work through generation settlement

* Remove duplicate History name-transition refresh

* Restore cache option in tab History test

* Consolidate naming test imports

* test: align naming fixtures with checked contracts

* test: name the discovery child fixture contract

* test: initialize writable child fixture streams

* test: account for ownership head and key reads

* fix(agents): re-list a host's terminal agents when contact returns (#33816)

* fix(agents): re-list a host's terminal agents when contact returns after a failed probe

* fix(agents): list recordKey in the detection effect's dependencies

* perf(devex): parallel pnpm lint (169s → 50s), capped typecheck threads, fresh shard timings (#33817)

* perf(devex): parallel lint, capped typecheck threads, fresh shard timings

- pnpm lint runs its 37 steps in a bounded pool (run-lint.mjs).
- tsrs defaults to 8 checkers; check:changed --maxWorkers=N passes 2N.
- ci-shard-timings refreshed from an 8-vCPU PR run (old one lacked 1,976 files).
- tc/typecheck/dev/postinstall call node directly instead of nested pnpm run.

* fix(typecheck): keep resolveTypecheckCommand args inferred for mobile's strict test typecheck

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(chat-rename): skip invisible legacy tab names during rename migration (#33678)

* fix(chat-rename): skip invisible legacy tab names during rename migration

* test(chat-rename): bound legacy migration reconciliation work

* fix(terminal): an externally moved pane's agent records follow it to its new tab

The reconcile hands the source pane's status, unread marks, launch and sleeping
records to the pane that now binds its PTY (transferAgentPaneAuthority, as a
local move does) instead of retiring them; a key this window already moved is a
no-op transfer. A throw while drawing this window's own move releases its
pending-move mark, and the reconcile effect lists the tab ids it reads.

* Revert "fix(native-chat): preserve Claude approval choices across model chang…" (#33823)

This reverts commit 4833b736f713b3f94ed12396e637712a70ad3a5e.

* Stop workers from taking over the Run they work for (#29008)

* fix(orchestration): refuse run-use by a worker on the Run it works for

A worker holding an active Dispatch in a Run could bind that Run as its coordinator.
That silently unbound the real coordinator, remembered the worker's address as a
coordinator address (so the worker's own mail in that Run routed to the Run mailbox
from then on), and when the worker later bound its own sub-Run, left the parent Run
with no coordinator at all.

bindRun now refuses a caller whose handle holds an active Dispatch in the Run, with
worker_cannot_coordinate_own_run, before any effect. Creating its own Run for
sub-workers is unchanged.

* fix(orchestration): tell a worker naming its own Run where its mail is

Workers that made a sub-Run ran `check --run <parent>`, were told "This
coordinator terminal is bound to X, not Y", and ran run-use on the parent
to "switch back", unbinding their coordinator. That refusal now says the
Run belongs to their coordinator, that their own mail arrives through
plain `check`, and that they report with `send`; it never mentions run-use.

The run-use refusal now matches the caller the way check and send do
(address, then pane, so a reminted terminal handle is still caught),
also covers Runs above the caller's own through recorded creator_dispatch_id
lineage, skips context-only self-dispatches so a coordinator can still
rebind its own Run, and passes its code through the RPC wire.

* feat(orchestration): refuse run-use over a live coordinator without --takeover

run-use silently took a Run from whoever coordinated it, even a chat or
agent that was still running. It now refuses with run_coordinator_live
when there is positive evidence the current coordinator is running (its
chat is still reachable, or the agent hooks prove its terminal agent
live) unless the caller passes --takeover. Anything unproven (closed chat,
exited or unhooked terminal, another host) rebinds as before, so restart
handoffs need no flag. The probe is async in the RPC handler; bindRun
enforces it only if the Run is still bound to the probed party.

A caller working a Dispatch can never take over, with or without the
flag (worker_cannot_take_over_run). The help text now says run-use is
for resuming a Run and that workers never use it.

* fix(orchestration): stop pointing workers at run-use

Workers learned run-use from error text: "No Run is bound. Use run-create
or run-use first", "Rebind with orchestration run-use", and "Rebind this
terminal with orchestration run-use". Each now says what the caller can
do instead. An unbound worker is told its mail arrives through plain
check and it reports with send; a displaced coordinator is told to stop
and take the Run back only if the user asks. The orchestration skill now
says run-use resumes your own Run, --takeover needs the user's word, and
workers never run it.

* fix(orchestration): stop routing mail to addresses that grabbed a Run's seat

Every address that ever bound a Run is remembered as one of its
coordinator addresses, so mail to it routes to the Run mailbox. When a
worker bound the Run it was working for, its own address joined that
list for good, and its direct mail in that Run kept landing in the
coordinator's inbox. The live database has 45 such rows since
2026-08-20.

All four readers of the remembered addresses now skip one that was first
bound while it worked an unsettled, delegated Dispatch in the same Run.
It is derived from existing rows, so no migration or delete is needed and
rows written by older builds stop mattering. The active-Dispatch check
also matches a worker's orca_session_id spelling, not only its handle.

* fix(cli): keep the orchestration spec file within its line limit

* fix(orchestration): read remembered coordinator Run ids without a type assertion

* fix(orchestration): compare seat-grab times at whole seconds

first_bound_at has no milliseconds, so a worker bound in the same second its
Dispatch settled was counted as grabbing the seat. Compare completed_at at
whole seconds with a strict >.

* fix(orchestration): a worker coordinates only Runs it created

The worker refusals depended on proving the target's coordinator alive, so
a worker could still take any Run whose coordinator was closed, unhooked,
remote or headless. Replace them with one rule derived from existing rows:
a caller working a Dispatch may bind only a Run it legitimately
coordinated before (a remembered, non-seat-grab address of that Run, or a
Run it dispatched work into), never the Run it works for, and never with
--takeover. A same-binding no-op is never refused, and workers are
classified before the legacy gate so they never see its
--takeover-legacy hint. The refusal names the Dispatch and how to end it
with worker-abandon if it is stale. The ancestor walk is gone.

run-use now records which coordinator it probed. If the binding moved
before the transaction, it probes again (three tries) and then refuses
with a retryable run_binding_changed instead of binding over a party
nobody probed. run_coordinator_live names the chat by its title and
worktree, or the terminal by its title and worktree, says it is still
open, and that closing it clears the refusal.

* fix(orchestration): say what happens to mail on takeover and stop naming run-use to readers

The help now says --takeover replaces the coordinator and replays its
unacknowledged mail to you. A replaced mailbox reader is told only that
another session coordinates the Run and to stop reading it.

* refactor(orchestration): throw one non-null refusal from the live gate

* refactor(runtime): host the coordinator presence probe beside the hook presence seam

Main moved the orphan-adoption runtime file; keeping the one-line probe next
to checkHookAgentPresenceFn leaves this PR off that file.

* fix(orchestration): use findLast for the worktree name

* refactor(runtime): move the coordinator presence probe beside the pty presence recheck

Main is moving the runtime construction files; the probe now sits with
recheckHookAgentPresenceForPty, which reads the same seam, so this PR stays
off the files being moved.

* fix(orchestration): keep workers out of their own Run seat

* fix(orchestration): clarify worker Run handoffs in skill

* test: align explicit Run gate refusal wording

* Move coordinator presence beside terminal presence checks

* Walk complete worker creator lineage when binding Runs

* Restore main documentation after merge hook formatting

* perf(orchestration): check run bindings without terminal snapshots

* test(orchestration): narrow SQLite instrumentation before access

* test(orchestration): import the explicit RPC methods module

* test: cover orchestration restart and continued Run handoff

* test: place orchestration CLI integration in CLI project

* test(cli): use explicit module extensions in restart handoff test

* test(orchestration): isolate source CLI integration in subprocesses

* refactor(orchestration): leave the live-coordinator takeover rule to #29292

#29008 is the worker fix: a worker cannot bind the Run it works for or an
ancestor, cannot abandon itself to get around that, and addresses it held while
grabbing a seat stop redirecting its mail. The separate rule that refuses any
second coordinator while the first is still open (the presence probe, the
--takeover flag and the run_coordinator_live / run_binding_changed refusals)
moves to #29292, which models Run ownership and hand-over and already builds on
it. run-use binds synchronously again, as on main.

* test(orchestration): cover delegated worker legacy takeover refusal

* test(orchestration): explain source CLI integration timeout

* perf(mobile): a streaming reply re-renders only the rows that changed (#23840)

* perf(mobile): a streaming reply re-renders only the rows that changed

Every structured-chat batch rebuilt the mobile transcript: the fold cloned each
historical tool run, image and echo rows rebuilt their blocks, each settled
turn's status object was rebuilt, and the list's renderItem changed identity,
so every mounted row re-rendered per batch.

Move the desktop list's by-id row reuse into src/shared and apply it to the
mobile list rows and to their derived turn props, and turn on FlatList
strictMode so a stable renderItem skips unchanged cells.

* perf(mobile): resolve native chat row props only when rows or turns change

The view re-renders on every composer keystroke; the row-props pass walked the
whole loaded transcript each time. Also drop a test that pinned a limit rather
than behavior, and a turn-status comment the row reuse made stale.

* refactor(native-chat): type the shared row reuse comparison

* perf(native-chat): compare rebuilt block lists with an index loop

Folding hands each tool-run assistant row a new block list every batch.
Walking that list as a generic object allocated Object.keys arrays for
both sides; comparing two arrays by length and element skips that.

* fix(mobile): carry the not-sent notice through the reused chat rows

Main added a per-row not-sent notice (#27936) after this branch's row reuse;
it now travels in each row's reused props, so a rejection arriving redraws
that row. Row reuse also compares only plain objects and arrays by value: a
Set (the open subagent groups) keeps its contents off its own keys, so two
different Sets read as equal and a toggled group kept its stale state.
Restores the row-renderer hook and the shared message comparison the
branch's merge commits carried.

* perf(native-chat): keep the desktop list's row comparison as it was

The deeper value comparison is only needed for mobile's re-derived rows; the
desktop projection goes back to comparing block identity.

* Restore main's files the pre-commit formatter rewrote during the merge

* Allow the FlatList strictMode augmentation's interface

* Pass FlatList strictMode through a spread instead of a type augmentation

* Measure streaming row churn on the phone page against main

* Keep unchanged phone chat row inputs stable during streaming

* Project full-message recovery context with each phone chat row

* Cover recovery updates and stale requests in streaming row contract

* Inspect row messages through their recovery provider in view tests

* Use a type-only module import in the recovery mock

* Preserve chat recovery identity and skip unchanged row derivation

* Keep transcript reuse at mounted rows and publish current recovery

* Remove duplicate React type import from transcript parity test

* Use static type imports in transcript streaming tests

* Complete the streaming recovery output fixture

* Temporarily expose failing mobile test compiler diagnostics

* Correct streaming test callback and selector types

---------

Co-authored-by: Neil <neil@stably.ai>

* perf(build): cap Rolldown threads on large hosts; build pairing web client in the background (#33828)

Rolldown defaults to 1.5x physical cores Tokio workers plus a Rayon pool per
logical CPU (24+24 here). Capping both at 8 on >8-core hosts cuts electron-vite
build CPU 24% with byte-identical output. pnpm dev no longer blocks on a stale
pairing web build; it stages into out/.web-next and swaps on success.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(native-chat): remove misleading usage-limit Continue action (#33392)

* fix(native-chat): remove misleading usage-limit Continue action

Keep limit warnings, reset times and provider details without offering an immediate continuation or adding manual continuation guidance. Preserve restart-interruption Continue and provider detection.

* fix(i18n): sync runtime catalog for removed notice fallback

* fix(i18n): remove unused usage-limit action translations

* test(native-chat): cover historical usage-limit wording

* test: admit historical notice fixtures through journal reader

* test(mobile): admit the old-host usage-limit fixture through the journal reader

---------

Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>

* Fix Codex goal Stop and selected model settings (#33631)

* Fix Codex goal Stop and selected model settings

* Preserve settings evidence and captured Stop outcomes

* Preserve refused goal pauses and bound Stop retry diagnostics

* Use checked settings state in goal contract tests

* Narrow captured Stop child and type its timing fixture

* Coordinate Stop timing fixture with deferred phases

* Fix typed mobile warning icon assertion

* Align Stop tests with reconciled controls and owned shutdown

* Check integration attach parameters without a type cast

* Match restart offer close calls to optional observer contract

* test(vitest): give each run its own temp dir and remove it on exit (#33834)

Tests leak os.tmpdir() fixtures broadly (8.6k dirs from repeated prefixes on
one shared dev host; orca-runtime-rpc alone 2,729). run-vitest.mjs now points
TMPDIR/TEMP/TMP at a marked per-run dir, removes it after Vitest exits
(including on SIGINT/SIGTERM), and sweeps marked dirs whose launcher died.
On POSIX a root longer than 50 chars (macOS /var/folders) falls back to /tmp
so Unix socket paths stay under sun_path limits.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(terminal): repaint local TUIs over the hidden-output loss banner (#33835)

Local panes printed '[Orca skipped hidden terminal output because main
recovery was unavailable.]' inside idle Codex/Claude Code frames and it
stayed until a workspace swap, because the one-row redraw nudge from
#31482 only ran for remote PTYs. Differential TUIs never rewrite cells
they believe unchanged, so the banner row persisted. Local PTYs now get
the same nudge, restoring the row on a timer since local main sends no
desktop-fit confirmation.

* fix(daemon): give each macOS resolver health probe a unique clientId (#33833)

Concurrent new-PTY resolver probes shared the 'resolver-health-check'
clientId, so the daemon evicted the older probe's control socket and that
probe waited out the 3s timeout before its terminal could spawn. Use a
per-probe UUID clientId and settle as 'unknown' as soon as the probe
socket closes.

Fixes #27751

Co-authored-by: outof-place <contact@outofplace.space>

* perf(wsl): relay orcad sockets through bash instead of a Node bridge (#33820)

Each desktop socket to a WSL host's orcad, and the liveness watch, ran a
Node process in the distro just to copy bytes (~42-50 MB RSS each). A bash
/dev/tcp relay does the same with bash and two cats (~4.5 MB). The Node
bridge stays as the fallback for hosts without bash 4.3+ or /dev/tcp and
for refused dials, so refusal and missing-runtime signals are unchanged.
SSH hosts keep the Node bridge.

* perf(orcad): retire an idle session scanner after a minute on host servers (#33845)

Only desktop requests reach a host's scanner child, which holds ~60 MB of
RSS even idle, and the 10-minute default kept it alive most of the time.
orcad now sets a 60 s idle timeout; the desktop keeps its default.

* perf(dev): −1.2 GB idle RSS per pnpm dev instance (Rolldown threads + mimalloc purge) (#33836)

* perf(dev): size the dev server's Rolldown runtime for many parallel instances

~93% of idle electron-vite RSS is Rolldown's native mimalloc arenas. The dev
wrapper now gives electron-vite MIMALLOC_PURGE_DELAY=0 and 4 Rolldown/Rayon
threads; a serve-only renderer plugin strips exactly those keys before
Electron spawns, so dev Orca's terminals never inherit them.

* fix(dev): add the runtime-env plugin only when the dev wrapper set its keys

Keeps createDevServeConfig returning the renderer config unchanged when there
is no port and nothing to strip, as electron-vite-output-contract pins.

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* test(vitest): node-runtime worker exits when Vitest's IPC channel closes (#33848)

A killed Vitest left its node-runtime worker running the rest of the file
(still alive after 150s). Exit on 'disconnect' with process.exit captured
before Vitest replaces it with a throwing guard.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(terminal): a moved pane keeps its records when its source is parked, and a committed move stays fenced until its snapshot

Every host frame the mirror reconciles now hands a pane another client moved to
its new tab's key, whether or not its source tab is mounted; the stale-binding
rule lives in one module both paths use. This window's own move the host
committed stays pending until a host snapshot shows it in its new tab, since the
reply can beat that snapshot and an older one must not drop it.

* fix(preflight): detect Grok installed in ~/.grok/bin (#25324)

Grok's installer defaults to ~/.grok/bin and only symlinks into
~/.local/bin when that dir is already on PATH. A GUI-launched Orca never
looked in ~/.grok/bin, so the Agents page reported Grok as not installed.

Append ~/.grok/bin after ~/.vite-plus/bin in the three lists that must
stay in step: the packaged PATH seed, the system install-dir lookup
fallback, and the POSIX/WSL guest fallback prelude.

Fixes #17590

Co-authored-by: brynnclaw <261708852+brynnclaw@users.noreply.github.com>

* fix(terminal): answer queries in output a paused paired view discards (#33783)

* fix(terminal): answer queries in ACK-pending output a paused paired view discards

Refs #32944

* fix(terminal): capture yielded-query ownership at ingestion and cap reply age

Refs #32944

* fix(terminal): settle yielded queries by their own end seq across split frames

Refs #32944

* test: use a fixed timestamp in the yielded-query responder test

* test(cross-version-wire): stub yielded-query runtime methods on the host runtime

Refs #32944

* fix(terminal): a pane moved to a new tab stays moved on paired servers (#33027)

* test(e2e): a pane moved to a new tab on a paired server workspace stays moved

* fix(terminal): keep a pane moved to a new tab on paired runtimes

Moving a split pane to a new tab in a paired-runtime worktree changed only
the window store. The host never learned about the move, so the next host
snapshot rebuilt the old tab and the pane snapped back.

Add a session.tabs.movePaneToNewTab RPC that commits the move in the host
session through planTerminalLeafMove and republishes the session tabs.
For a mirrored host tab, the renderer applies the move first under the
mirrored id the host snapshot will use, then asks the host to commit it.
An older host or a refused move falls back to the old local-only move.

Fixes #32939

* fix(terminal): commit a host pane move through the existing leaf-move writer

The layout-writer ratchet allows no new main-process layout writers. The
headless host now hands the move to commitLeafMoveAndRekey, the same
commit a local window uses, and keeps only the window check, validation,
rehydrate and notify.

* fix(terminal): gate the host pane move on a host capability

An older host keeps today's window-only move under a local tab id instead of
a mirrored one it never confirms. Adds a terminal.list check to the e2e.

* test: drop type assertions from the pane-move tests

* fix(terminal): the host keeps a moved pane's place, focus and live terminal

After the host commits the move, the window gives it the drop position and
focus through the existing tab move and activate calls; a refusal redraws the
host's tabs. The host moves the live PTY's surface with its pane and checks the
target tab id. The move lives in its own runtime module.

* fix(terminal): hold a moved pane's drop order until the host has it

The host's snapshot of the commit goes out before its reply and appends the
tab, so the window records the drawn order as a reorder intent at the drop and
sends that order, and the focus read then, once the host answers.

* fix(terminal): route the moved tab's reorder to its owning host

The follow-up names the worktree's host instead of reading the active-server
setting (focus-read ratchet); the e2e narrows host rows to terminal tabs.

* fix(terminal): the host places a moved pane's tab in the move itself; a refusal reverts

The move carries the drop's group and index (optional; an older host appends)
and the host places and selects the tab before its one publish, replacing the
follow-up reorder and the drop-time order hold. A refused move closes the tab
this window drew without stopping its terminal and redraws the host's tabs even
when unchanged. E2e covers a same-group drop and a refusal; host unit tests cover
same-group and cross-group placement.

* fix(terminal): a refused pane move keeps its pane records; drop index in host order

The revert hands the pane's status and launch records back to the source tab
before closing the drawn tab. The host turns a projected client's drop index
into its raw order with translateProjectedSessionTabMove, as session.tabs.move does.

* fix(terminal): only an unknown drop group appends a moved pane's tab

The host catches only target_group_not_found and invalid_tab_order from the index
translation and rethrows anything else.

* fix(terminal): settle a pane move by what the host holds when its reply is lost

A lost reply is not a refusal: the window asks the host whether it holds the
pane in the new tab before undoing anything, and waits for the next snapshot
when it cannot ask. A move the host committed but this window could not draw
takes the host's tabs.

* fix(terminal): a lost transport on a pane move is unknown, not a refusal

runtimeEnvironments.call answers a dropped or overloaded transport with an error
envelope; those codes (the shared recoverable set) now ask the host instead of
undoing a move it may have committed.

* test(e2e): pane-move spec waits on real signals, not delays

The source tab is created on the server and split once its shell is listed, so
the split no longer races a desktop-seeded tab's first spawn (the CI failure).
The stay check follows output from the moved pane; the refusal check waits for
the drawn tab to appear and go.

* test(e2e): read the refused move's tab counts without Reflect (anti-slop)

* fix(terminal): a moved pane's tab joins the order the user had, not a rebuilt one

The host inserts the new tab into the group order captured before the commit,
appending without a drop position, so editors and pages keep their places. The
shared group-move fallback is no longer used here.

* fix(terminal): a moved pane's groups hold the host's current tabs, in the user's order

Placement takes membership from the rebuild after the commit and only the order
from before it, so a tab opened while the commit was pending stays (after the
user's tabs) and no stale id is written.

* fix(terminal): a moved pane's placement keeps a reorder made while it committed

The order is read after the commit, from the host's current tabs, not before it.

* fix(terminal): a moved pane keeps the lone group the user merged into

A rebuild names a single group with the default id; placement keeps the user's
id for it, so the drop position still applies after a split was merged back.

* fix: import error classification from its new shared/remote-runtime path

* fix(terminal): a pane or divider drag survives focus moving inside the window

The drag's window blur listener was registered in the capture phase, so it also
heard every element blur. A terminal attach or host snapshot that moved focus
between panes mid-gesture ended the drag; in the paired pane-move e2e on CI it
cancelled the drag before the drop. Only the window losing focus ends it now.

* test: drive the focus-change drag test through a real pane manager, without casts

* fix(terminal): a headless host moves a pane with its live terminal and never empties its source

The host names the PTY it holds for the pane, so a session copy an SSH respawn
left with an old id no longer refuses the move as a mismatch. A move that would
leave its source tab with no pane (a sibling closed meanwhile) is refused, since
no headless cleanup retires the emptied tab and it would publish as a phantom.
The e2e fences its stays-moved check on a later server rename instead of
sampling on a timer.

---------

Co-authored-by: Ben Grynhaus <ben.grynhaus@wiz.io>

* fix(terminal): a moved pane's records move only for a host snapshot this window accepts

The transfer for a pane another client moved now runs where a host snapshot is
accepted, reading the bindings from before it applies, so a delayed older list
reply that the window drops moves nothing. A move whose snapshot arrived before
its reply is not held again by that reply.

* fix(wsl-host): tie each WSL host record to its pairing key (R31) (#29832)

* fix(wsl-host): bind a WSL host record to its pairing's server key (R31)

A valid but stale record could overlay WSL hosting onto a different loopback server re-paired
under the same environment id and bridge port. The record now carries the paired orcad's host key;
the overlay ignores a record whose key differs from the pairing's. Add writes the key and a
pairing refresh rewrites it with the ports, so a relaunch that changes the key still matches.
Records written before carry no key and keep port-only binding until their next refresh.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-host): validate a refreshed pairing before writing, and accept the previous key mid-refresh

Review: the refresh wrote the record's new key before validating the pairing, so a refused or
interrupted refresh could leave a real WSL host without its overlay. Validate first, and keep the
replaced key as previousPairingPublicKeyB64 so the record stays bound across the two writes.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-host): use a key distinct from the fixture's own in the R31 overlay tests

Main gave the WSL fixture its own pairing key (#30676), the same one these tests used as the
'other server' key, so both cases inverted after the rebase. Production code is unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

* test: remove low-value renderer suites and redundant shared test cases (#33819)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(terminal): typing held for a starting agent still arms recovery when its connect hangs (#33865)

* fix(agent-awake): warn once and back off when the sleep assertion keeps failing (#33841)

* fix(agent-awake): keep sleep-assertion failures warn-once across respawns

A successful spawn reset the failure streak, so a systemd-inhibit or caffeinate that
exits right away re-warned on every 30s retry.

* fix(agent-awake): back off sleep-assertion retries after consecutive failures

* test(agent-awake): dispose the real-timer assertion

* perf(daemon): cap the terminal daemon's young generation (−51 MB idle, −75 MB after bursts) (#33837)

* perf(daemon): cap the terminal daemon's young generation

Idle terminal polling in the daemon allocates a few MB/s of short-lived
strings (process-table captures), and V8 answers by growing the young
generation to its 64 MB semispace maximum. Nothing is retained (heapUsed
returns to ~12 MB after GC), but the committed semispaces held ~120 MB of
resident memory per daemon. Launch the daemon with --max-semi-space-size=4
on the fork, direct and extracted-AppImage paths. The flag goes on the
command line, not NODE_OPTIONS, because PTYs inherit the daemon's env.

* perf(daemon): pass the young-generation cap through the macOS launchd job

Release macOS builds start the terminal daemon from the signed helper bundle
through a launchd job, not the fork path, so the flag must be in its
ProgramArguments too.

---------

Co-authored-by: m4air <m4air@Mac.localdomain>

* perf(terminal): relax idle process inspection for local POSIX panes too (#33829)

A visible local shell pane with no agent evidence was inspected every 2 s
forever. Each inspection is a full-system `ps -axo ...,tty=,lstart=,command=`
capture in the terminal daemon (0.155 s of CPU at ~1,100 processes, ~1.15 s
at ~1,950), which also churned ~2.7 MB/s of short-lived strings and grew the
daemon's young generation to ~120 MB resident. Apply the existing no-evidence
cadence (15 s while quiet; output, title or hook activity re-arms 2 s for
10 s; agent evidence returns to the active/idle tiers) to local POSIX panes,
as it already is for Windows and remote panes.

Co-authored-by: m4air <m4air@Mac.localdomain>

* perf(build): keep bundled scripts one-byte in V8 to cut idle memory (#33786)

V8 stores a script source as UTF-16 when any character is above U+00FF, so a
single em dash in a hot chunk doubled that chunk's resident source. Emit ASCII
(escaped) output for main, preload, renderer and worker bundles, escape the
CJK sentence marks in the prose URL regex source, and fail the renderer
boot-graph check if a boot chunk regresses to two-byte.

Co-authored-by: m4air <m4air@Mac.localdomain>

* perf(editor): stop Monaco's TS/JS worker when no TS/JS model is open (#33810)

Monaco's TypeScript WorkerManager has no idle stop, so viewing a single .ts
file kept a ~40 MB language worker alive for the rest of the session. After
60 s with no typescript/javascript model, re-apply the current compiler
options, which makes Monaco dispose the worker; the next TS/JS model starts
a fresh one lazily.

Co-authored-by: m4air <m4air@Mac.localdomain>

* fix(runtime): stop a crash-zeroed server list from blocking every server save (#33864)

* fix(runtime): recover from a NUL-filled server list instead of blocking every save

Fixes #18766

* fix(runtime): recover only crash-zeroed server lists; keep removal proofs fail-closed

* fix(runtime): copy the blank server list aside on write instead of renaming it on read

* fix(runtime): recover a crash-zeroed server list only when saving a server

Plain reads stay fail-closed so startup cleanup cannot treat the zeroed file as
'every server was removed'; saving copies the bytes aside and publishes an empty
store only if the file is still blank.

* fix(runtime): publish the recovered server list only together with the saved server

A failed save now leaves the zeroed file in place instead of an empty registry that
startup cleanup would read as 'every server was removed'.

* fix(runtime): let SSH and WSL server setup save over a crash-zeroed server list

Their duplicate and conflict pre-checks read the list before the add and threw on the
zeroed file. The blank-file backup is now taken only once the write is attempted.

* test(runtime): give the fsynced interleaving property test room on slow disks

* test(runtime): run three guard-killing seeds instead of raising the interleaving timeout

The fsync on every store write made 40 seeds x 40 steps slow; seeds 1, 6 and 8 each
fail when one of the three guards this test protects is removed.

* fix(terminal): don't rewrite live bytes a renderer hydration seed already painted (#33766) (#33880)

Main seeds its terminal model from the renderer's xterm and queues live
chunks behind the seed. The renderer keeps parsing those chunks while it
serializes, so they were in the seed and then written again, doubling TUI
frames and splitting escapes (literal ';242m'). Hidden-pane reveals repaint
from this model. Skip queued chunks at or below the seed's seq and carry
any unfinished escape into the next chunk.

* test: remove low-value renderer helper and presentation tests (#33876)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* feat(serve): keep macOS serve out of the Dock and opt in to the GPU on Linux (#33878)

* feat(serve): keep macOS serve out of the Dock and opt in to the GPU on Linux

On macOS, orca serve now runs as an accessory app with no Dock icon or
Cmd-Tab entry, and gets them back only while it hosts a desktop window.
On Linux, ORCA_SERVE_GPU=1 keeps hardware acceleration on for hosts that
expose a GPU to the server.

* fix(serve): restore the Dock only for real launches, after window services resolve

Gate the restore on any background or E2E launch, since dock.show() activates
the app, and run it just before the window is created so a services failure
cannot leave a windowless Dock tile. Say in the docs what the GPU opt-in can't
do on Orca's own Xvfb.

* refactor: colocate task page list presentation rules (#33830)

* fix(build): pin the native SwiftPM build system for the computer-use universal binary (#21146)

SwiftPM 6.4 (Xcode 27) defaults to the swiftbuild build system, which writes
products to an xcodebuild-style layout instead of .build/<triple>/release, so
the lipo step in build-computer-macos.mjs finds no inputs. Pass
--build-system native to both per-triple builds.

Fixes #21145

* fix(ssh): refuse a second Orca server from a host cloned with the same machine-id (#33775)

* fix(ssh): keep machines cloned with one machine-id off each other's Orca server data (#32918)

Machines cloned from one image share /etc/machine-id. On a shared home both
got the same machine key, so both managed servers ran in ~/.orca, and each
judged the other's PID locally and reclaimed its live instance lock.

- Record the claiming hostname in the shared-home claim and machine homes;
  a Linux machine whose machine-id matches but hostname differs gets its own
  machine home. Older claims fall back to data-root owner records.
- orcad's instance lock no longer treats a holder with this machine-id but
  another hostname as local, and refuses to start when an older clone's
  profile-state owner record shows it is using the data root.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(ssh): keep a clone's established machine home, and let a host renamed within its boot restart

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(ssh): call a machine a clone only with positive evidence

A renamed host keeps its boot and a local disk has one machine, so only
another host and boot with this machine-id on a shared filesystem counts as
a clone, on Linux only. When both clones already write the login home, stay
and let the server lock refuse the second writer. Drop the machine-home
owner markers.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(ssh): refuse a second server from a cloned host instead of relocating data

Drop the inferred clone relocation. orcad refuses to start when a holder or
profile-state owner on a shared filesystem reports this machine-id from another
hostname and boot, naming that host and the fixes. Add ORCA_MACHINE_NAME, an
explicit host-env name that gives a managed SSH host its own machine home.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(ssh): judge cloned machines by boot and freshness, not hostname

A peer with this machine-id is another live machine only when its record is
from another boot, was written after this boot began, and is fresh. The orcad
lock now heartbeats its mtime. That drops the hostname test, which renames
broke and same-hostname clones evaded. It also drops the participant-owner
precheck that stale records could block forever, and keeps profile-state
owner cleanup from deleting a live clone's owner. stale-lock reclaim uses the
same rule. ORCA_MACHINE_NAME now rejects invalid names and keeps a host on
the home its running server or own machine-id already uses. Hints are
role-specific and aimed only at the clone.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(orcad): stale-lock reclaim waits out the lock freshness window

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(orcad): log a failed lock heartbeat and say a crashed clone's lock frees itself

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(orcad): align reclaim help, age evidence and clone hint with the freshness window

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(ssh): ORCA_MACHINE_NAME always selects its own home

Inferring which home to keep from running owners flipped after shutdown or
reboot and couldn't see macOS boots. A name now deterministically selects
its home, and a multi-line name is refused.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(ssh): refuse a whitespace-only ORCA_MACHINE_NAME, and pin reclaim test clocks

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

* revert(terminal): an externally moved pane retires its source records again

Back to the reviewed behaviour: the source tab's agent records are retired and
the host republishes the agent under its new tab. Keeps the independent fixes:
a committed move stays fenced until a host snapshot shows it (confirmed on the
raw frame, and not re-held by a reply that arrives after its snapshot), the
draw-before-reply release on a throw, and the reconcile effect's tab ids.

* perf(ci): overlap preflight's serial tail; parallel ratchets; allow 2-10 unit shards (#33887)

- Plan unit selection starts after setup (overlaps lint) instead of last.
- Localization extraction starts with the typecheck; test-file-runners is background.
- run-ratchets.mjs runs ratchets in a pool (19s serial -> 8s locally).
- pnpm lint uses CI's single-parse check-import-boundaries.mjs.
- ORCA_UNIT_FULL_SHARD_COUNT accepts 2-10 (default stays 5).

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(github): send issue bodies to gh over stdin instead of argv (#25215)

Issue create (including the empty-body fallback and follow-up PATCH),
issue body edits, and issue comments passed the body as
`--raw-field body=...` on argv. Windows caps the command line at
32,767 chars, so bodies with pasted inline images failed with
`spawn ENAMETOOLONG` before reaching GitHub.

These calls now use `gh api -X <METHOD> <endpoint> --input -` with a
JSON payload on stdin. ghExecFileWithScopeAsync also now forwards
`options.stdin` to the child process; it was previously dropped.

Fixes #15832

Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>

* fix(open-in): strip the AppImage runtime env from editors launched on Linux (#31675)

Open in started editors with Orca's full environment, so an AppImage
launch leaked ARGV0/APPDIR/APPIMAGE/OWD/APPIMAGE_LIBRARY_PATH and the
mount-path PATH and LD_LIBRARY_PATH entries into the editor's integrated
shells (zsh then runs host commands like cargo under the AppImage name).

Add envWithoutAppImageRuntime() next to removeAppImageRuntimeEnv and pass
its result to every editor spawn path on Linux; macOS and Windows keep
inheriting the env unchanged. The clipboard publisher and both AppImage
daemon command builders reuse the same helper instead of their own
copy-and-scrub loops.

Fixes #31455

Co-authored-by: Neil <neil@stably.ai>

* fix(automations): step schedule scans by calendar day so DST changes don't skip dates (#19086)

The RRULE day scan stepped local midnight by a fixed 24h. Walking back
over a 23-hour spring-forward day landed at 23:00 two dates earlier, so
the latest-occurrence lookup used for catch-up runs skipped a date. It
returned a run a day too old for daily schedules, and a week too old for
weekly ones.

Step with setDate via a shared addLocalDays helper, in both the RRULE
scan and the cron feasibility scan. Add a regression test for
America/New_York and Australia/Lord_Howe. The test is skipped on Windows,
where unstubbing TZ doesn't restore the OS zone.

Co-authored-by: liutian <liutian.6000@bytedance.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>

* fix(orchestration): keep the transcript handle open when a forward page fills (#32894)

Returning early from the for-await over the forward-page ReadStream
destroyed the stream, which closed the shared FileHandle before the
boundary checkpoint read, so any forward page that hit its limit failed
with transcript_parse_failed. Scan with positional handle.read calls
instead so the handle stays open and read errors reject inside the
caller's try/finally.

Fixes #32892

Co-authored-by: Kim Kaznowski <kim@doubledashstudios.com>
Co-authored-by: Neil <neil@stably.ai>

* fix(browser): accept an empty --value in fill and select commands (#16030)

`orca fill --value ""` and `orca select --value ""` were rejected client-side
with "Missing required --value" even though the browser.fill/browser.select RPC
schemas already accept an empty string. Read --value with the existing
getRequiredStringFlagAllowingEmpty helper so an empty value clears a field or
picks the blank option, while an absent --value is still rejected.

Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>

* fix(telemetry): send an errno code, not the raw message, in agent_hook_install_failed (#25287)

agent_hook_install_failed sent up to 200 chars of the raw installer error,
which embeds home-directory paths (and so the OS user name) and can echo
config contents. Send only the error's errno code or 'unknown', and enforce
that in the event schema. The anchored, capped errno pattern now lives in
src/shared/errno-code.ts and is shared with the renderer launch probe and the
file-write precondition instead of their own copies.

Fixes #21492

Co-authored-by: brynnclaw <261708852+brynnclaw@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>

* fix(notifications): use the real macOS default sound for the System notification option (#26321)

On macOS the System sound option passed sound: "default" to Electron, which
the UNUserNotificationCenter backend resolves via soundNamed:"default" (a file
lookup) instead of UNNotificationSound.defaultSound, so banners were silent.
Leave sound unset so Electron plays the OS default, and drop the now-dead
sound field from the notification options type.

Fixes #26043

Co-authored-by: Neil <neil@stably.ai>

* fix(shell): resolve VS Code CLI from standard app installs when `code` is not on PATH (#14010)

GUI-launched Orca often inherits a minimal PATH, so bare `code` fails with
spawn ENOENT for Open in VS Code, including Remote-SSH worktrees. When PATH
and install-dir lookup leave `code`/`code-insiders` unresolved, fall back to
the CLI bundled in the standard macOS app bundle (/Applications or
~/Applications) or the Windows user/system install. Linux packages already
link the CLI onto PATH, so no Linux candidates are added.

Fixes #14008

Co-authored-by: Neil <neil@stably.ai>

* fix(build): keep index.js source map aligned with the bootstrap banner (#33899)

The main bootstrap banner was prepended to index.js in generateBundle,
after Rolldown had already emitted index.js.map, so every main-process
crash trace decoded ~200 lines off. Emit it via Rolldown's output.postBanner
instead, which shifts the source map natively.

Co-authored-by: outof-place <contact@outofplace.space>

* docs: stop promising cross-worktree split panes and Shift-Enter split in Jump Palette (#33902)

Panes are scoped to a single worktree and the Jump Palette has no
Shift-Enter handler, so replace those promises with the real flow:
watch sidebar status indicators and jump between worktrees with
Cmd-J (macOS) / Ctrl-Shift-J (Windows / Linux).

Fixes #10477

* refactor: colocate task page PR presentation rules (#33890)

* fix(drops): keep remote drops out of git and say why drops or file opens fail (#33831)

* fix(drops): keep files dropped onto a remote workspace out of git status

Uploads into `.orca/drops` now write `.orca/drops/.gitignore` (`*`) the first
time it is missing, so dropped files no longer block a plain workspace delete
or get committed by `git add -A`. Callers share one constant for the folder.

Fixes #23856

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Re-check the import session after the drop staging ignore step

The ignore step swallows its own errors, including a stale session. When
nothing was staged the loop never asserted again, so the caller got
skipped/failed results instead of the retry error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(drops): say why a remote drop or file open failed

Co-authored-by: Jae Heo <83424878+jae-heo@users.noreply.github.com>
Co-authored-by: Bing.Z <zzb@gxsmjx.com>

* fix(drops): keep paths out of failure toasts and reuse the too-large classifier

* fix(drops): shorten whole quoted paths in failure toasts

* fix(drops): describe upload failures by category instead of host text

* fix(drops): match failure categories on unquoted text and name manual disconnects

---------

Co-authored-by: Younghwan Chae <chyohw97@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Jae Heo <83424878+jae-heo@users.noreply.github.com>
Co-authored-by: Bing.Z <zzb@gxsmjx.com>

* perf(lint): one ast-grep scan feeds both the lint gate and the flaky-test ratchet (#33903)

lint:ast-grep and check-flaky-test-pattern-ratchet each parsed the whole tree.
ast-grep-gates.mjs scans once; the lint gate re-runs ast-grep only on files with
warning-or-error findings (ast-grep's own report and exit code), and the flaky
ratchet counts test-* matches from the shared scan.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

* fix(diff): keep the collapsed section header in view (#24466)

Collapsing the section the View all diff viewport was inside kept the
scroll anchor's within-section offset, which pointed into the removed
body, so the structural restore landed on later sections. Pin the anchor
to the section header before the collapse is published.

Fixes #20665

* fix(process-table): pin macOS ps to en_US.UTF-8 so lstart and argv parse under any locale (#33898)

macOS ps formats lstart with the user's locale (%c) and vis-encodes
non-ASCII argv when no UTF-8 locale is set. Under de_DE/en_NZ/ja_JP the
process-table parsers dropped tty/startTime and folded them into command,
breaking agent recognition, pane fingerprints, agent-session start times
and daemon identity. Run those ps readers with LC_ALL=en_US.UTF-8 on
macOS; other platforms keep the inherited env.

Fixes #27004

Co-authored-by: outof-place <contact@outofplace.space>

* fix(editor): match external file changes across Windows path spellings (#14812)

On drive and `\\` UNC roots, an open tab whose filePath used a different
separator or drive-letter spelling than the watcher event (for example
`c:\Repo\File.ts` vs `C:/Repo/File.ts`) never matched, so external edits
did not reload the tab or raise the changed-on-disk banner.

Both direct-match sites (the indexed batch lookup and the non-indexed
fallback in getOpenFilesForExternalFileChange) now compare through
externalChangePathKeyFor(root), which reuses editorBufferPathKey to fold
separators, the drive letter, and the UNC server only. Path-tail case stays
exact, and WSL, POSIX, SSH, and `//` roots keep byte-exact keys.

Fixes #14801

Co-authored-by: VXNCXNX <VXNCXNX@users.noreply.github.com>

Co-authored-by: Neil <neil@stably.ai>

* fix(memory): show Activity Monitor's footprint in the resource panel on macOS (#33901)

The resource panel summed RSS. On macOS that counts the Electron framework's
shared pages once per helper process, so main and renderer read 2-8x too
high, while the GPU process read 3-5x too low because RSS excludes graphics
memory. The detached terminal daemon was also missing from the app total.

On macOS, sample per-process phys_footprint from top (the figure Activity
Monitor shows) at most every 10 s while the panel is open, and fall back to
RSS when top is unavailable. Count the local terminal daemon in the app's
'other' bucket; its PTY children stay attributed to their worktrees. Linux
and Windows keep RSS/working set.

Co-authored-by: m4air <m4air@Mac.localdomain>

* fix(wsl-host): keep the bridge port across app restarts so the host isn't re-paired (#33109)

A WSL host's bridge listened on a fresh port each launch, which changed the saved
pairing endpoint. The renderer treats a changed WSL pairing as a different machine
and purges the host's workspaces, tabs and selection, then rebuilds them once the
host relists its projects.

* fix(cli): show orphaned state in human-readable terminal list/show output (#33910)

Fixes #15313

* test(wsl): cover the bash bridge's argv, backpressure, fallbacks and cleanup (#33907)

Prove the relay reaches wsl.exe through --exec unchanged, carries every byte
value both ways, holds the desktop back under a stalled reader on either
side, falls back to Node for no bash, old bash, no /dev/tcp and refused
dials with unchanged sentinels, and leaves no bash or cat behind when
either side goes away.

* fix(termina…
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant