From 3d6d6dd67d87717e527358e27743f4df3120f30b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=98=A4=EC=98=81=ED=83=9D?= <89302528+Jaeyoung22@users.noreply.github.com> Date: Tue, 4 Aug 2026 13:21:03 +0900 Subject: [PATCH 01/72] fix(orchestration): scope agent lineage to its owning run (#11203) Use durable Task-to-Run ownership and current pane, process-incarnation, and Run-generation authority for sidebar agent lineage. Add schema migrations, bounded lookup indexes, fail-closed renderer cleanup, and runtime/RPC regression coverage. Co-authored-by: Jaeyoung22 <89302528+Jaeyoung22@users.noreply.github.com> --- config/reliability-gates.jsonc | 15 +- src/main/runtime/orca-runtime.test.ts | 522 +++++++++++++++++- src/main/runtime/orca-runtime.ts | 102 +++- .../runtime/orchestration/coordinator.test.ts | 36 ++ src/main/runtime/orchestration/coordinator.ts | 19 +- src/main/runtime/orchestration/db.ts | 102 +++- ...tion-creator-authority-performance.test.ts | 156 ++++++ ...hestration-db-retention-pagination.test.ts | 86 ++- src/main/runtime/orchestration/types.ts | 3 + .../runtime/rpc/methods/orchestration.test.ts | 47 +- src/main/runtime/rpc/methods/orchestration.ts | 34 +- ...hestration-legacy-coordinator-race.test.ts | 10 + .../src/store/slices/agent-status.test.ts | 36 ++ src/renderer/src/store/slices/agent-status.ts | 3 + 14 files changed, 1118 insertions(+), 53 deletions(-) create mode 100644 src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc index c84075e6c04..c4f70fb7aea 100644 --- a/config/reliability-gates.jsonc +++ b/config/reliability-gates.jsonc @@ -6646,15 +6646,16 @@ "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"], "coveredPlatforms": ["macos"], "coveredProviders": ["local", "daemon", "ssh"], - "coverageNotes": "A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, exact legacy worker identity planning, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, the SSH in-process CLI fallback, and federated non-reveal. Two isolated macOS Electron journeys launch fake Codex workers through the real RPC path and record append-only spawn/interruption ledgers. They assert immediate inactive presentation, one live agent PID, stable PTY/incarnation/tab/leaf/worktree/Task/Dispatch identity, and no interruption after workspace re-entry; the restart journey additionally removes renderer ownership, marks the Dispatch legacy, retains the daemon process across an app restart, and proves exact background adoption with readable ACK output and no resume replay. Distinct A/B artifacts plus live SSH, WSL, folder, remote-runtime, Linux, and Windows cutover journeys remain explicit gaps.", + "coverageNotes": "A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, exact legacy worker identity planning, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, and federated non-reveal. Two isolated macOS Electron journeys launch fake Codex workers through the real RPC path and record append-only spawn/interruption ledgers. They assert immediate inactive presentation, one live agent PID, stable PTY/incarnation/tab/leaf/worktree/Task/Dispatch identity, and no interruption after workspace re-entry; the restart journey additionally removes renderer ownership, marks the Dispatch legacy, retains the daemon process across an app restart, and proves exact background adoption with readable ACK output and no resume replay. Distinct A/B artifacts plus live SSH, WSL, folder, remote-runtime, Linux, and Windows cutover journeys remain explicit gaps.", "motivatingLinks": ["https://github.com/stablyai/orca/pull/11107#discussion_r3663321387"], - "invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata, explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.", - "oracle": "Drive Run create, Task create, and worker-start through production Electron runtimes with a deterministic Codex fixture. Require append-only ledgers with one still-live PID and no interruption, a visible inactive worker tab while the coordinator stays active, Run delivery through stable pane identity, and stable PTY/incarnation, tab, leaf, worktree, Task, and Dispatch across workspace re-entry. In a restart journey, retain the original daemon PTY and PID, remove renderer ownership, retain sleeping-session evidence, mark the Dispatch legacy, relaunch, and require exact inactive tab adoption, readable ACK output, cleared resume state, one spawn, and no resume argv or Conversation interrupted text after another workspace round trip. The service oracle removes renderer lookup identity from current-contract callers while retaining real restored-PTY and hook commitments, replays authenticated completion and takeover across fresh runtimes, and requires one Task, Dispatch, terminal authority, message, mutation, ordinary-mail delivery, remote process fencing, and unchanged fixture marker bytes while foreign pane evidence remains rejected. Unit tests separately assert authority-specific legacy affordances, exact identity and owner matching, retained-output fallback, pane-stable routing, federated non-activation, and SSH fallback parity.", + "invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.", + "oracle": "Drive Run create, Task create, and worker-start through production Electron runtimes with a deterministic Codex fixture. Require append-only ledgers with one still-live PID and no interruption, a visible inactive worker tab while the coordinator stays active, Run delivery through stable pane identity, and stable PTY/incarnation, tab, leaf, worktree, Task, and Dispatch across workspace re-entry. In a restart journey, retain the original daemon PTY and PID, remove renderer ownership, retain sleeping-session evidence, mark the Dispatch legacy, relaunch, and require exact inactive tab adoption, readable ACK output, cleared resume state, one spawn, and no resume argv or Conversation interrupted text after another workspace round trip. The service oracle removes renderer lookup identity from current-contract callers while retaining real restored-PTY and hook commitments, replays authenticated completion and takeover across fresh runtimes, and requires one Task, Dispatch, terminal authority, message, mutation, ordinary-mail delivery, remote process fencing, and unchanged fixture marker bytes while foreign pane evidence remains rejected. Unit tests separately remint a creator pane and process from Run A into Run B, require the nested Run A worker to fall back to its current coordinator, require indexed query plans, and bound 300 Task reads with 50,000 retained Runs. They also assert authority-specific legacy affordances, exact identity and owner matching, retained-output fallback, pane-stable routing, federated non-activation, and SSH fallback parity.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot", "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/ssh/ssh-remote-orca-cli.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/rpc/methods/orchestration-federation.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts", + "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts", "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts", "pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1", "pnpm run test:e2e -- tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts --workers=1" @@ -6663,6 +6664,7 @@ "src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts", "src/main/runtime/orchestration/formatter.test.ts", "src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts", + "src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts", "src/main/runtime/orca-runtime.test.ts", "src/cli/handlers/orchestration.test.ts", "src/cli/handlers/orchestration-check-identity.test.ts", @@ -6684,6 +6686,13 @@ "ordinary mail and remote attachments use the same attested pane and process authority" ] }, + { + "file": "src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts", + "assertions": [ + "creator lookup uses the assignee-handle and pane-leaf indexes without a retained-Run scan", + "300 Task reads remain bounded with 50,000 unrelated retained Runs" + ] + }, { "file": "src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts", "assertions": [ diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts index d8c94367098..3aa249a0d99 100644 --- a/src/main/runtime/orca-runtime.test.ts +++ b/src/main/runtime/orca-runtime.test.ts @@ -37942,6 +37942,7 @@ describe('OrcaRuntimeService', () => { handle === workerHandle ? { id: 'ctx-1', + run_id: 'run-1', task_id: 'task-1', assignee_handle: workerHandle, status: 'dispatched' @@ -37952,6 +37953,7 @@ describe('OrcaRuntimeService', () => { handle === workerHandle ? { id: 'ctx-done', + run_id: 'run-1', task_id: 'task-done', assignee_handle: workerHandle, status: 'completed', @@ -37961,14 +37963,16 @@ describe('OrcaRuntimeService', () => { ), getTask: vi.fn(() => ({ id: 'task-1', + run_id: 'run-1', task_title: 'Dispatch prompt work', display_name: 'Review dispatch prompts and make worker labels distinct', spec: 'Review dispatch prompts\n\nand make worker labels distinct', created_by_terminal_handle: coordinatorHandle })), - getActiveCoordinatorRun: vi.fn(() => ({ + getRun: vi.fn(() => ({ id: 'run-1', - coordinator_handle: coordinatorHandle + coordinator_handle: coordinatorHandle, + legacy: 0 })) } as never) runtime.attachWindow(1) @@ -38023,6 +38027,513 @@ describe('OrcaRuntimeService', () => { }) }) + it.each([ + ['fails closed when a modern dispatch owning Run is missing', 'run-missing', 'run-missing'], + ['fails closed when Task and Dispatch Runs disagree', 'run-dispatch', 'run-task'] + ])('%s', (_name, dispatchRunId, taskRunId) => { + const runtime = new OrcaRuntimeService(store) + const workerLeafId = '77777777-7777-4777-8777-777777777777' + const coordinatorLeafId = '88888888-8888-4888-8888-888888888888' + const workerPaneKey = makePaneKey('tab-worker', workerLeafId) + const workerHandle = runtime.preAllocateHandleForPty('pty-worker') + const coordinatorHandle = runtime.preAllocateHandleForPty('pty-coordinator') + const getActiveCoordinatorRun = vi.fn(() => ({ + id: 'run-legacy-unrelated', + coordinator_handle: coordinatorHandle + })) + runtime.setOrchestrationDb({ + getActiveDispatchForTerminal: vi.fn((handle: string) => + handle === workerHandle + ? { + id: 'ctx-missing-run', + run_id: dispatchRunId, + task_id: 'task-missing-run', + assignee_handle: workerHandle, + status: 'dispatched' + } + : undefined + ), + getLatestDispatchForTerminal: vi.fn(() => undefined), + getTask: vi.fn(() => ({ + id: 'task-missing-run', + run_id: taskRunId, + spec: 'modern task without proven Run', + created_by_terminal_handle: coordinatorHandle + })), + getRun: vi.fn(() => undefined), + getActiveCoordinatorRun + } as never) + runtime.attachWindow(1) + + const result = runtime.syncWindowGraph(1, { + tabs: [ + { + tabId: 'tab-worker', + worktreeId: TEST_WORKTREE_ID, + title: 'Worker', + activeLeafId: workerLeafId, + layout: null + }, + { + tabId: 'tab-coordinator', + worktreeId: TEST_WORKTREE_ID, + title: 'Coordinator', + activeLeafId: coordinatorLeafId, + layout: null + } + ], + leaves: [ + { + tabId: 'tab-worker', + worktreeId: TEST_WORKTREE_ID, + leafId: workerLeafId, + paneRuntimeId: 1, + ptyId: 'pty-worker', + paneTitle: null + }, + { + tabId: 'tab-coordinator', + worktreeId: TEST_WORKTREE_ID, + leafId: coordinatorLeafId, + paneRuntimeId: 2, + ptyId: 'pty-coordinator', + paneTitle: null + } + ] + }) + + expect(result.agentOrchestrationByPaneKey?.[workerPaneKey]).toEqual({ + taskId: 'task-missing-run', + dispatchId: 'ctx-missing-run', + dispatchStatus: 'dispatched', + taskTitle: 'modern task without proven Run', + displayName: 'modern task without proven Run' + }) + expect(getActiveCoordinatorRun).not.toHaveBeenCalled() + }) + + it('uses durable Run ownership before worktree-scoped legacy attribution', () => { + const childWorktreeId = `${TEST_REPO_ID}::${join(tmpdir(), 'workspaces', 'run-a-worker')}` + const folderWorktreeId = `${TEST_REPO_ID}::${join(tmpdir(), 'folder')}${FOLDER_WORKSPACE_INSTANCE_SEPARATOR}11111111-1111-4111-8111-111111111111` + const meta = store.getAllWorktreeMeta()[TEST_WORKTREE_ID] + const metaById = { + ...store.getAllWorktreeMeta(), + [childWorktreeId]: meta, + [folderWorktreeId]: meta + } + const runtime = new OrcaRuntimeService({ + ...store, + getAllWorktreeMeta: () => metaById, + getWorktreeMeta: (worktreeId: string) => metaById[worktreeId] + } as never) + const terminals = [ + { + name: 'coordinator-a', + worktreeId: TEST_WORKTREE_ID, + leafId: '11111111-1111-4111-8111-111111111111' + }, + { + name: 'coordinator-b', + worktreeId: TEST_WORKTREE_ID, + leafId: '22222222-2222-4222-8222-222222222222' + }, + { + name: 'worker-cross-worktree', + worktreeId: childWorktreeId, + leafId: '33333333-3333-4333-8333-333333333333' + }, + { + name: 'worker-same-worktree', + worktreeId: TEST_WORKTREE_ID, + leafId: '44444444-4444-4444-8444-444444444444' + }, + { + name: 'worker-folder', + worktreeId: folderWorktreeId, + leafId: '55555555-5555-4555-8555-555555555555' + }, + { + name: 'legacy-worker', + worktreeId: childWorktreeId, + leafId: '66666666-6666-4666-8666-666666666666' + } + ].map((terminal, index) => ({ + ...terminal, + tabId: `tab-${terminal.name}`, + ptyId: `pty-${terminal.name}`, + paneRuntimeId: index + 1 + })) + const terminalByName = Object.fromEntries( + terminals.map((terminal) => [terminal.name, terminal]) + ) + const handles = Object.fromEntries( + terminals.map((terminal) => [terminal.name, runtime.preAllocateHandleForPty(terminal.ptyId)]) + ) + const paneKey = (name: string): string => { + const terminal = terminalByName[name] + return makePaneKey(terminal.tabId, terminal.leafId) + } + const db = new OrchestrationDb(':memory:') + try { + const runA = db.createRun({ + objective: 'coordinate run A', + coordinatorHandle: handles['coordinator-a'], + coordinatorPaneKey: paneKey('coordinator-a') + }) + const runB = db.createRun({ + objective: 'coordinate run B', + coordinatorHandle: handles['coordinator-b'], + coordinatorPaneKey: paneKey('coordinator-b') + }) + const dispatches = Object.fromEntries( + [ + ['worker-cross-worktree', runA.id], + ['worker-same-worktree', runA.id], + ['worker-folder', runB.id] + ].map(([name, runId]) => { + const task = db.createTask({ spec: name, runId }) + return [name, db.createDispatchContext(task.id, handles[name], paneKey(name))] + }) + ) + const legacyTask = db.createTask({ spec: 'legacy worker' }) + const legacyDispatch = db.createDispatchContext( + legacyTask.id, + handles['legacy-worker'], + paneKey('legacy-worker') + ) + db.createCoordinatorRun({ + spec: 'unrelated legacy coordinator', + coordinatorHandle: handles['coordinator-b'] + }) + const getActiveCoordinatorRun = vi.spyOn(db, 'getActiveCoordinatorRun') + runtime.setOrchestrationDb(db) + runtime.attachWindow(1) + + const result = runtime.syncWindowGraph(1, { + tabs: terminals.map((terminal) => ({ + tabId: terminal.tabId, + worktreeId: terminal.worktreeId, + title: terminal.name, + activeLeafId: terminal.leafId, + layout: null + })), + leaves: terminals.map((terminal) => ({ + tabId: terminal.tabId, + worktreeId: terminal.worktreeId, + leafId: terminal.leafId, + paneRuntimeId: terminal.paneRuntimeId, + ptyId: terminal.ptyId, + paneTitle: null + })) + }) + + for (const [name, run, coordinator] of [ + ['worker-cross-worktree', runA, 'coordinator-a'], + ['worker-same-worktree', runA, 'coordinator-a'], + ['worker-folder', runB, 'coordinator-b'] + ] as const) { + expect(result.agentOrchestrationByPaneKey?.[paneKey(name)]).toMatchObject({ + taskId: dispatches[name].task_id, + dispatchId: dispatches[name].id, + dispatchStatus: 'dispatched', + parentTerminalHandle: handles[coordinator], + parentPaneKey: paneKey(coordinator), + coordinatorHandle: handles[coordinator], + orchestrationRunId: run.id + }) + } + const legacyContext = result.agentOrchestrationByPaneKey?.[paneKey('legacy-worker')] + expect(legacyContext).toMatchObject({ + taskId: legacyTask.id, + dispatchId: legacyDispatch.id, + dispatchStatus: 'dispatched' + }) + expect(legacyContext).not.toHaveProperty('parentTerminalHandle') + expect(legacyContext).not.toHaveProperty('coordinatorHandle') + expect(legacyContext).not.toHaveProperty('orchestrationRunId') + expect(getActiveCoordinatorRun).toHaveBeenCalledOnce() + } finally { + db.close() + } + }) + + it('uses the still-bound owning Run coordinator after a creator pane rebinds', () => { + const runtime = new OrcaRuntimeService(store) + const terminals = [ + { + name: 'coordinator', + leafId: '11111111-1111-4111-8111-111111111111' + }, + { + name: 'creator', + leafId: '22222222-2222-4222-8222-222222222222' + }, + { + name: 'worker', + leafId: '33333333-3333-4333-8333-333333333333' + }, + { + name: 'coordinator-created-worker', + leafId: '44444444-4444-4444-8444-444444444444' + } + ].map((terminal, index) => ({ + ...terminal, + tabId: `tab-${terminal.name}`, + ptyId: `pty-${terminal.name}`, + paneRuntimeId: index + 1 + })) + const terminalByName = Object.fromEntries( + terminals.map((terminal) => [terminal.name, terminal]) + ) + const handles = Object.fromEntries( + terminals.map((terminal) => [terminal.name, runtime.preAllocateHandleForPty(terminal.ptyId)]) + ) + const paneKey = (name: string): string => { + const terminal = terminalByName[name] + return makePaneKey(terminal.tabId, terminal.leafId) + } + const graph = () => ({ + tabs: terminals.map((terminal) => ({ + tabId: terminal.tabId, + worktreeId: TEST_WORKTREE_ID, + title: terminal.name, + activeLeafId: terminal.leafId, + layout: null + })), + leaves: terminals.map((terminal) => ({ + tabId: terminal.tabId, + worktreeId: TEST_WORKTREE_ID, + leafId: terminal.leafId, + paneRuntimeId: terminal.paneRuntimeId, + ptyId: terminal.ptyId, + paneTitle: null + })) + }) + const db = new OrchestrationDb(':memory:') + try { + runtime.setOrchestrationDb(db) + runtime.attachWindow(1) + runtime.syncWindowGraph(1, graph()) + const runA = db.createRun({ + objective: 'own the nested worker', + coordinatorHandle: handles.coordinator, + coordinatorPaneKey: paneKey('coordinator') + }) + const creatorAuthority = runtime.getOrchestrationDispatchAuthority(handles.creator) + const coordinatorAuthority = runtime.getOrchestrationDispatchAuthority(handles.coordinator) + expect(creatorAuthority?.processIncarnation).toBeTruthy() + expect(coordinatorAuthority?.processIncarnation).toBeTruthy() + const creatorTask = db.createTask({ spec: 'create nested work', runId: runA.id }) + db.createDispatchContext( + creatorTask.id, + handles.creator, + paneKey('creator'), + undefined, + creatorAuthority?.processIncarnation ?? undefined + ) + const workerTask = db.createTask({ + spec: 'nested work', + runId: runA.id, + createdByTerminalHandle: handles.creator, + createdByPaneKey: paneKey('creator'), + createdByProcessIncarnation: creatorAuthority?.processIncarnation ?? undefined, + createdByRunGeneration: runA.consumer_generation + }) + const workerDispatch = db.createDispatchContext( + workerTask.id, + handles.worker, + paneKey('worker') + ) + const coordinatorCreatedTask = db.createTask({ + spec: 'coordinator-created work', + runId: runA.id, + createdByTerminalHandle: handles.coordinator, + createdByPaneKey: paneKey('coordinator'), + createdByProcessIncarnation: coordinatorAuthority?.processIncarnation ?? undefined, + createdByRunGeneration: runA.consumer_generation + }) + const coordinatorCreatedDispatch = db.createDispatchContext( + coordinatorCreatedTask.id, + handles['coordinator-created-worker'], + paneKey('coordinator-created-worker') + ) + expect( + runtime.syncWindowGraph(1, graph()).agentOrchestrationByPaneKey?.[paneKey('worker')] + ).toMatchObject({ + parentTerminalHandle: handles.creator, + parentPaneKey: paneKey('creator'), + coordinatorHandle: handles.coordinator, + orchestrationRunId: runA.id + }) + + const oldCreatorPaneKey = paneKey('creator') + terminalByName.creator.tabId = 'tab-creator-reminted' + terminalByName.creator.ptyId = 'pty-creator-reminted' + const remintedCreatorHandle = runtime.preAllocateHandleForPty(terminalByName.creator.ptyId) + runtime.syncWindowGraph(1, graph()) + const runB = db.createRun({ + objective: 'rebind the creator pane', + coordinatorHandle: remintedCreatorHandle, + coordinatorPaneKey: paneKey('creator') + }) + const reboundContext = runtime.syncWindowGraph(1, graph()).agentOrchestrationByPaneKey?.[ + paneKey('worker') + ] + + expect(db.getRun(runA.id)).toMatchObject({ + coordinator_handle: handles.coordinator, + consumer_generation: 1 + }) + expect(oldCreatorPaneKey).not.toBe(paneKey('creator')) + expect(db.getRun(runB.id)).toMatchObject({ coordinator_handle: remintedCreatorHandle }) + expect(reboundContext).toMatchObject({ + taskId: workerTask.id, + dispatchId: workerDispatch.id, + dispatchStatus: 'dispatched', + parentTerminalHandle: handles.coordinator, + parentPaneKey: paneKey('coordinator'), + coordinatorHandle: handles.coordinator, + orchestrationRunId: runA.id + }) + + db.createRun({ + objective: 'rebind the original coordinator pane', + coordinatorHandle: handles.coordinator, + coordinatorPaneKey: paneKey('coordinator') + }) + const unboundContext = runtime.syncWindowGraph(1, graph()).agentOrchestrationByPaneKey?.[ + paneKey('coordinator-created-worker') + ] + + expect(db.getRun(runA.id)).toMatchObject({ + coordinator_handle: null, + coordinator_pane_key: null, + consumer_generation: 2 + }) + expect(unboundContext).toEqual({ + taskId: coordinatorCreatedTask.id, + dispatchId: coordinatorCreatedDispatch.id, + dispatchStatus: 'dispatched', + taskTitle: 'coordinator-created work', + displayName: 'coordinator-created work', + orchestrationRunId: runA.id + }) + } finally { + db.close() + } + }) + + it('queries each stable terminal handle once while publishing orchestration context', () => { + const runtime = new OrcaRuntimeService(store) + const terminals = Array.from({ length: 100 }, (_, index) => ({ + tabId: `tab-query-${index}`, + leafId: `00000000-0000-4000-8000-${String(index).padStart(12, '0')}`, + ptyId: `pty-query-${index}`, + paneRuntimeId: index + 1 + })) + const handles = terminals.map((terminal) => runtime.preAllocateHandleForPty(terminal.ptyId)) + const db = new OrchestrationDb(':memory:') + try { + const run = db.createRun({ + objective: 'query count oracle', + coordinatorHandle: handles[99], + coordinatorPaneKey: makePaneKey(terminals[99].tabId, terminals[99].leafId) + }) + const task = db.createTask({ spec: 'one dispatched terminal', runId: run.id }) + const dispatch = db.createDispatchContext( + task.id, + handles[0], + makePaneKey(terminals[0].tabId, terminals[0].leafId) + ) + const getActiveDispatchForTerminal = vi.spyOn(db, 'getActiveDispatchForTerminal') + const getLatestDispatchForTerminal = vi.spyOn(db, 'getLatestDispatchForTerminal') + const getTask = vi.spyOn(db, 'getTask') + const getRun = vi.spyOn(db, 'getRun') + const getActiveCoordinatorRun = vi.spyOn(db, 'getActiveCoordinatorRun') + runtime.setOrchestrationDb(db) + runtime.attachWindow(1) + + const graph = { + tabs: terminals.map((terminal) => ({ + tabId: terminal.tabId, + worktreeId: TEST_WORKTREE_ID, + title: terminal.tabId, + activeLeafId: terminal.leafId, + layout: null + })), + leaves: terminals.map((terminal) => ({ + tabId: terminal.tabId, + worktreeId: TEST_WORKTREE_ID, + leafId: terminal.leafId, + paneRuntimeId: terminal.paneRuntimeId, + ptyId: terminal.ptyId, + paneTitle: null + })) + } + runtime.syncWindowGraph(1, graph) + + const queryCounts = { + activeDispatch: getActiveDispatchForTerminal.mock.calls.length, + latestDispatch: getLatestDispatchForTerminal.mock.calls.length, + task: getTask.mock.calls.length, + run: getRun.mock.calls.length, + legacyCoordinator: getActiveCoordinatorRun.mock.calls.length + } + + db.completeDispatch(dispatch.id) + vi.useFakeTimers() + vi.setSystemTime(Date.now() + AGENT_STATUS_STALE_AFTER_MS + 5_000) + for (const query of [ + getActiveDispatchForTerminal, + getLatestDispatchForTerminal, + getTask, + getRun, + getActiveCoordinatorRun + ]) { + query.mockClear() + } + runtime.syncWindowGraph(1, graph) + + const historicalQueryCounts = { + activeDispatch: getActiveDispatchForTerminal.mock.calls.length, + latestDispatch: getLatestDispatchForTerminal.mock.calls.length, + task: getTask.mock.calls.length, + run: getRun.mock.calls.length, + legacyCoordinator: getActiveCoordinatorRun.mock.calls.length + } + expect({ + active: { + ...queryCounts, + total: Object.values(queryCounts).reduce((sum, n) => sum + n) + }, + historical: { + ...historicalQueryCounts, + total: Object.values(historicalQueryCounts).reduce((sum, n) => sum + n) + } + }).toEqual({ + active: { + activeDispatch: 100, + latestDispatch: 99, + task: 1, + run: 1, + legacyCoordinator: 0, + total: 201 + }, + historical: { + activeDispatch: 100, + latestDispatch: 100, + task: 0, + run: 0, + legacyCoordinator: 0, + total: 200 + } + }) + } finally { + vi.useRealTimers() + db.close() + } + }) + it('returns completed orchestration context for renderer-synced terminal leaves', () => { const runtime = new OrcaRuntimeService(store) const workerLeafId = '33333333-3333-4333-8333-333333333333' @@ -38037,6 +38548,7 @@ describe('OrcaRuntimeService', () => { handle === workerHandle ? { id: 'ctx-done', + run_id: 'run-1', task_id: 'task-done', assignee_handle: workerHandle, status: 'completed', @@ -38046,7 +38558,13 @@ describe('OrcaRuntimeService', () => { ), getTask: vi.fn(() => ({ id: 'task-done', + run_id: 'run-1', created_by_terminal_handle: coordinatorHandle + })), + getRun: vi.fn(() => ({ + id: 'run-1', + coordinator_handle: coordinatorHandle, + legacy: 0 })) } as never) runtime.attachWindow(1) diff --git a/src/main/runtime/orca-runtime.ts b/src/main/runtime/orca-runtime.ts index 8cca2232985..c94d222de37 100644 --- a/src/main/runtime/orca-runtime.ts +++ b/src/main/runtime/orca-runtime.ts @@ -29977,11 +29977,13 @@ export class OrcaRuntimeService { return undefined } const contexts: Record = {} + const queriedHandles = new Set() for (const leaf of this.leaves.values()) { if (!leaf.ptyId) { continue } const handle = this.issueHandle(leaf) + queriedHandles.add(handle) const context = this.getAgentStatusOrchestrationContextForHandle(handle, db) if (context) { contexts[this.makeRuntimePaneKey(leaf)] = context @@ -29992,6 +29994,10 @@ export class OrcaRuntimeService { continue } const handle = this.issuePtyHandle(pty) + if (queriedHandles.has(handle)) { + continue + } + queriedHandles.add(handle) const context = this.getAgentStatusOrchestrationContextForHandle(handle, db) if (context) { contexts[pty.paneKey] = context @@ -30011,7 +30017,7 @@ export class OrcaRuntimeService { if (!dispatch) { return undefined } - const task = db?.getTask?.(dispatch.task_id) + const task = db?.getTask?.(dispatch.task_id, dispatch.run_id) const display = typeof task?.spec === 'string' ? buildOrchestrationTaskDisplayMetadata({ @@ -30020,15 +30026,68 @@ export class OrcaRuntimeService { displayName: task.display_name }) : { taskTitle: '', displayName: '' } - const activeRun = - dispatch.status === 'pending' || dispatch.status === 'dispatched' + const owningRun = + task?.run_id && task.run_id === dispatch.run_id ? db?.getRun?.(dispatch.run_id) : undefined + const runCoordinatorHandle = owningRun?.coordinator_handle ?? undefined + const legacyActiveRun = + owningRun?.legacy === 1 && (dispatch.status === 'pending' || dispatch.status === 'dispatched') ? db?.getActiveCoordinatorRun?.() : undefined + // Why: legacy coordinator runs have no durable task ownership, so fail closed across worktrees. + const handleWorktreeId = legacyActiveRun ? this.getWorktreeIdForTerminalHandle(handle) : null + const legacyCoordinatorWorktreeId = legacyActiveRun + ? this.getWorktreeIdForTerminalHandle(legacyActiveRun.coordinator_handle) + : null + const scopedLegacyActiveRun = + legacyActiveRun && + handleWorktreeId && + legacyCoordinatorWorktreeId && + runtimeWorktreeIdsEqual(legacyCoordinatorWorktreeId, handleWorktreeId) + ? legacyActiveRun + : undefined + const coordinatorHandle = runCoordinatorHandle ?? scopedLegacyActiveRun?.coordinator_handle + const orchestrationRunId = owningRun?.legacy === 0 ? owningRun.id : scopedLegacyActiveRun?.id + const creatorPaneKey = task?.created_by_pane_key + const creatorPaneHandle = creatorPaneKey + ? this.getTerminalHandleForPaneKey(creatorPaneKey) + : null + const creatorAuthority = creatorPaneHandle + ? this.getOrchestrationDispatchAuthority(creatorPaneHandle) + : null + const storedCreatorPane = creatorPaneKey ? parsePaneKey(creatorPaneKey) : null + const currentCreatorPane = creatorAuthority?.paneKey + ? parsePaneKey(creatorAuthority.paneKey) + : null + const sameCreatorPane = Boolean( + creatorPaneKey && + creatorAuthority?.paneKey && + (creatorPaneKey === creatorAuthority.paneKey || + (storedCreatorPane && + currentCreatorPane && + storedCreatorPane.leafId === currentCreatorPane.leafId)) + ) + const paneRun = creatorPaneKey ? db?.getCurrentRunForPane?.(creatorPaneKey) : undefined + const sameRunCreatorDispatch = Boolean( + task?.creator_dispatch_id && + task.creator_dispatch_run_id === owningRun?.id && + task.creator_dispatch_pane_key && + task.creator_dispatch_process_incarnation === task.created_by_process_incarnation && + parsePaneKey(task.creator_dispatch_pane_key)?.leafId === storedCreatorPane?.leafId + ) + const currentCreatorHandle = + owningRun?.legacy === 0 && + task?.created_by_run_generation === owningRun.consumer_generation && + task.created_by_process_incarnation === creatorAuthority?.processIncarnation && + sameCreatorPane && + (paneRun + ? paneRun.id === owningRun.id && + paneRun.consumer_generation === task.created_by_run_generation + : sameRunCreatorDispatch) + ? (creatorPaneHandle ?? undefined) + : undefined const parentTerminalHandle = - task?.created_by_terminal_handle ?? - (activeRun?.coordinator_handle && activeRun.coordinator_handle !== handle - ? activeRun.coordinator_handle - : undefined) + currentCreatorHandle ?? + (coordinatorHandle && coordinatorHandle !== handle ? coordinatorHandle : undefined) const parentPaneKey = parentTerminalHandle ? this.getPaneKeyForTerminalHandle(parentTerminalHandle) : undefined @@ -30041,8 +30100,8 @@ export class OrcaRuntimeService { ...(display.displayName ? { displayName: display.displayName } : {}), ...(parentTerminalHandle ? { parentTerminalHandle } : {}), ...(parentPaneKey ? { parentPaneKey } : {}), - ...(activeRun?.coordinator_handle ? { coordinatorHandle: activeRun.coordinator_handle } : {}), - ...(activeRun?.id ? { orchestrationRunId: activeRun.id } : {}) + ...(coordinatorHandle ? { coordinatorHandle } : {}), + ...(orchestrationRunId ? { orchestrationRunId } : {}) } } @@ -30095,10 +30154,21 @@ export class OrcaRuntimeService { return pty } leafPty = pty ?? null + for (const candidate of this.leaves.values()) { + if (candidate.leafId !== parsed.leafId || !candidate.ptyId) { + continue + } + const remintedPty = this.ptysById.get(candidate.ptyId) + if (remintedPty?.connected) { + return remintedPty + } + leafPty ??= remintedPty ?? null + } } let newestMatch: RuntimePtyWorktreeRecord | null = null for (const pty of this.ptysById.values()) { - if (pty.paneKey === paneKey) { + const ptyPane = parsePaneKey(pty.paneKey ?? '') + if (pty.paneKey === paneKey || (parsed && ptyPane && parsed.leafId === ptyPane.leafId)) { if (pty.connected) { return pty } @@ -30123,6 +30193,18 @@ export class OrcaRuntimeService { return makePaneKey(record.tabId, record.leafId) } + private getWorktreeIdForTerminalHandle(handle: string): string | null { + const livePty = this.getLivePtyForHandle(handle) + if (livePty?.pty.worktreeId) { + return livePty.pty.worktreeId + } + const record = this.handles.get(handle) + if (!record || record.runtimeId !== this.runtimeId) { + return null + } + return record.worktreeId + } + private setPtyManagementTitleFromObservedTitle( pty: RuntimePtyWorktreeRecord, title: string | null | undefined, diff --git a/src/main/runtime/orchestration/coordinator.test.ts b/src/main/runtime/orchestration/coordinator.test.ts index 31e9180c93e..cbb3c3f8011 100644 --- a/src/main/runtime/orchestration/coordinator.test.ts +++ b/src/main/runtime/orchestration/coordinator.test.ts @@ -177,6 +177,42 @@ describe('Coordinator', () => { }) expect(db.getDispatchContext(task.id)?.assignee_pane_key).toBe('tab_a:leaf_a') + expect(db.getDispatchContext(task.id)?.process_incarnation).toBeNull() + + insertWorkerDone(db, { taskId: task.id }) + await runPromise + }) + + it('records authenticated process authority for automatic dispatch', async () => { + db = new OrchestrationDb(':memory:') + const runtime = createMockRuntime() + runtime.terminals = [{ handle: 'term_a', worktreeId: 'wt1', connected: true, writable: true }] + const withAuthority = Object.assign(runtime, { + getOrchestrationDispatchAuthority: (handle: string) => + handle === 'term_a' + ? { + paneKey: 'tab_a:leaf_a', + processIncarnation: 'pty_a:incarnation-a', + launchTokenHash: 'launch-token-hash' + } + : null + }) + const task = db.createTask({ spec: 'implement feature' }) + const coordinator = new Coordinator(db, withAuthority, { + spec: 'build it', + coordinatorHandle: 'coord', + pollIntervalMs: 50 + }) + const runPromise = coordinator.run() + await new Promise((r) => { + setTimeout(r, 100) + }) + + expect(db.getDispatchContext(task.id)).toMatchObject({ + assignee_pane_key: 'tab_a:leaf_a', + process_incarnation: 'pty_a:incarnation-a', + launch_token_hash: 'launch-token-hash' + }) insertWorkerDone(db, { taskId: task.id }) await runPromise diff --git a/src/main/runtime/orchestration/coordinator.ts b/src/main/runtime/orchestration/coordinator.ts index 7fcd5288f5d..df69ed9ef7b 100644 --- a/src/main/runtime/orchestration/coordinator.ts +++ b/src/main/runtime/orchestration/coordinator.ts @@ -26,8 +26,14 @@ export type CoordinatorRuntime = { behind: number recentSubjects: string[] } | null> - // Why: optional so lightweight runtime fakes keep compiling; when present, dispatch records the assignee's remint-stable pane identity. + // Why: pane-only fallback preserves reservation identity for lightweight runtime fakes. getTerminalPaneKey?(handle: string): string | null + // Why: automatic dispatch persists the same authenticated pane/process tuple as manual dispatch. + getOrchestrationDispatchAuthority?(handle: string): { + paneKey: string | null + processIncarnation: string | null + launchTokenHash: string | null + } | null // Why: Windows can host native and WSL workers at once, so the worker pane (not the coordinator) picks the packaged CLI name. getTerminalOrchestrationCliCommand?(handle: string): 'orca' | 'orca-ide' } @@ -419,10 +425,19 @@ export class Coordinator { } } + const dispatchAuthority = this.runtime.getOrchestrationDispatchAuthority?.(targetHandle) + const assigneePaneKey = + dispatchAuthority?.paneKey ?? this.runtime.getTerminalPaneKey?.(targetHandle) ?? undefined + const processIncarnation = + dispatchAuthority?.paneKey && dispatchAuthority.processIncarnation + ? dispatchAuthority.processIncarnation + : undefined const dispatch = this.db.createDispatchContext( task.id, targetHandle, - this.runtime.getTerminalPaneKey?.(targetHandle) ?? undefined + assigneePaneKey, + dispatchAuthority?.launchTokenHash ?? undefined, + processIncarnation ) // Why: dispatched agents use orca-dev in dev mode to reach the dev runtime's socket, not production (Section 6.4). diff --git a/src/main/runtime/orchestration/db.ts b/src/main/runtime/orchestration/db.ts index 5cdfccc31e5..3608ee7d754 100644 --- a/src/main/runtime/orchestration/db.ts +++ b/src/main/runtime/orchestration/db.ts @@ -66,8 +66,10 @@ function isEquivalentPaneKey(a: string, b: string): boolean { // Why: indexable pre-filter for isEquivalentPaneKey — equal strings and equal leaves both share the // text after the first ':', so this narrows candidates without deciding equivalence itself. -const PANE_KEY_MATCH_SUFFIX_SQL = +const RUN_PANE_KEY_MATCH_SUFFIX_SQL = "substr(coordinator_pane_key, instr(coordinator_pane_key, ':') + 1)" +const DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL = + "substr(assignee_pane_key, instr(assignee_pane_key, ':') + 1)" function paneKeyMatchSuffix(paneKey: string): string { const colon = paneKey.indexOf(':') @@ -263,13 +265,20 @@ export type RunListPage = { nextCursor: string | null } +export type TaskRuntimeLineageRow = TaskRow & { + creator_dispatch_id: string | null + creator_dispatch_run_id: string | null + creator_dispatch_pane_key: string | null + creator_dispatch_process_incarnation: string | null +} + type RunListCursor = { createdAt: string id: string } -// Schema versions: v2 'heartbeat'+last_heartbeat_at, v3 delivered_at, v4 task-creator terminal, v5 task_title/display_name, v6 pane identity, v7 lightweight Runs, v8 crash-safe Run deliveries, v9 durable question threads, v10 Dispatch capabilities, v11 durable mutation receipts, v12 composed worker state, v18 post-v6 version-skew repair, v19 adopted legacy Runs and compatibility receipts, v20 legacy question backfill, v21 legacy scheduler-loss provenance, v22 dispatch assignee lookup, v23 worker terminal resource ownership. -const SCHEMA_VERSION = 23 +// Schema versions: v2 'heartbeat'+last_heartbeat_at, v3 delivered_at, v4 task-creator terminal, v5 task_title/display_name, v6 pane identity, v7 lightweight Runs, v8 crash-safe Run deliveries, v9 durable question threads, v10 Dispatch capabilities, v11 durable mutation receipts, v12 composed worker state, v18 post-v6 version-skew repair, v19 adopted legacy Runs and compatibility receipts, v20 legacy question backfill, v21 legacy scheduler-loss provenance, v22 dispatch assignee lookup, v23 worker terminal resource ownership, v24 creator-incarnation authority, v25 active Dispatch handle lookup. +const SCHEMA_VERSION = 25 function hardenOrchestrationDatabaseFiles(dbPath: string | ':memory:'): void { if (dbPath === ':memory:' || process.platform === 'win32') { @@ -517,6 +526,9 @@ export class OrchestrationDb { run_id TEXT NOT NULL DEFAULT '${LEGACY_RUN_ID}', parent_id TEXT, created_by_terminal_handle TEXT, + created_by_pane_key TEXT, + created_by_process_incarnation TEXT, + created_by_run_generation INTEGER, task_title TEXT, display_name TEXT, spec TEXT NOT NULL, @@ -576,7 +588,7 @@ export class OrchestrationDb { CREATE INDEX IF NOT EXISTS idx_gates_status ON decision_gates(status); CREATE INDEX IF NOT EXISTS idx_runs_coordinator_pane_leaf - ON runs(${PANE_KEY_MATCH_SUFFIX_SQL}) + ON runs(${RUN_PANE_KEY_MATCH_SUFFIX_SQL}) WHERE coordinator_pane_key IS NOT NULL; CREATE TABLE IF NOT EXISTS coordinator_runs ( @@ -949,6 +961,29 @@ export class OrchestrationDb { if (current < 23) { this.backfillWorkerTerminalResources() } + if (current < 24) { + if (!this.hasColumn('tasks', 'created_by_pane_key')) { + this.db.exec('ALTER TABLE tasks ADD COLUMN created_by_pane_key TEXT') + } + if (!this.hasColumn('tasks', 'created_by_process_incarnation')) { + this.db.exec('ALTER TABLE tasks ADD COLUMN created_by_process_incarnation TEXT') + } + if (!this.hasColumn('tasks', 'created_by_run_generation')) { + this.db.exec('ALTER TABLE tasks ADD COLUMN created_by_run_generation INTEGER') + } + } + if (current < 25) { + this.db.exec(` + CREATE INDEX IF NOT EXISTS idx_dispatch_active_assignee_handle + ON dispatch_contexts(assignee_handle) + WHERE assignee_handle IS NOT NULL AND status IN ('pending', 'dispatched'); + `) + } + this.db.exec(` + CREATE INDEX IF NOT EXISTS idx_dispatch_assignee_pane_leaf + ON dispatch_contexts(${DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL}) + WHERE assignee_pane_key IS NOT NULL AND status IN ('pending', 'dispatched'); + `) this.createUndeliveredInboxIndexIfPossible() this.db.pragma(`user_version = ${SCHEMA_VERSION}`) @@ -2423,7 +2458,7 @@ export class OrchestrationDb { .prepare( `SELECT * FROM runs WHERE coordinator_pane_key IS NOT NULL AND legacy = 0 - AND ${PANE_KEY_MATCH_SUFFIX_SQL} = ? + AND ${RUN_PANE_KEY_MATCH_SUFFIX_SQL} = ? ORDER BY rowid` ) .all(paneKeyMatchSuffix(paneKey)) as RunRow[] @@ -3743,6 +3778,9 @@ export class OrchestrationDb { deps?: string[] parentId?: string createdByTerminalHandle?: string + createdByPaneKey?: string + createdByProcessIncarnation?: string + createdByRunGeneration?: number runId?: string }): TaskRow { const runId = task.runId ?? LEGACY_RUN_ID @@ -3770,13 +3808,20 @@ export class OrchestrationDb { }) this.db .prepare( - 'INSERT INTO tasks (id, run_id, parent_id, created_by_terminal_handle, task_title, display_name, spec, status, deps) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)' + `INSERT INTO tasks ( + id, run_id, parent_id, created_by_terminal_handle, created_by_pane_key, + created_by_process_incarnation, created_by_run_generation, + task_title, display_name, spec, status, deps + ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)` ) .run( id, runId, task.parentId ?? null, task.createdByTerminalHandle ?? null, + task.createdByPaneKey ?? null, + task.createdByProcessIncarnation ?? null, + task.createdByRunGeneration ?? null, display.taskTitle || null, display.displayName || null, task.spec, @@ -3786,8 +3831,33 @@ export class OrchestrationDb { return this.db.prepare('SELECT * FROM tasks WHERE id = ?').get(id) as TaskRow } - getTask(id: string): TaskRow | undefined { - return this.db.prepare('SELECT * FROM tasks WHERE id = ?').get(id) as TaskRow | undefined + // Why: return the active creator Dispatch proof with the Task read; runtime still owns pane/process currency. + getTask(id: string): TaskRow | undefined + getTask(id: string, dispatchRunId: string): TaskRuntimeLineageRow | undefined + getTask(id: string, dispatchRunId?: string): TaskRow | TaskRuntimeLineageRow | undefined { + if (dispatchRunId === undefined) { + return this.db.prepare('SELECT * FROM tasks WHERE id = ?').get(id) as TaskRow | undefined + } + return this.db + .prepare( + `SELECT t.*, + creator.id AS creator_dispatch_id, + creator.run_id AS creator_dispatch_run_id, + creator.assignee_pane_key AS creator_dispatch_pane_key, + creator.process_incarnation AS creator_dispatch_process_incarnation + FROM tasks t + LEFT JOIN dispatch_contexts creator ON creator.rowid = ( + SELECT candidate.rowid + FROM dispatch_contexts candidate + WHERE candidate.assignee_handle = t.created_by_terminal_handle + AND candidate.run_id = ? + AND candidate.status IN ('pending', 'dispatched') + ORDER BY candidate.rowid DESC + LIMIT 1 + ) + WHERE t.id = ?` + ) + .get(dispatchRunId, id) as TaskRuntimeLineageRow | undefined } listTasks(filter?: { status?: TaskStatus; ready?: boolean; runId?: string }): TaskRow[] { @@ -6088,7 +6158,8 @@ export class OrchestrationDb { assigneeHandle: string, // Why: pane key is the remint-stable identity behind the handle — lets worker_done ownership survive handle reissue. assigneePaneKey?: string, - launchTokenHash?: string + launchTokenHash?: string, + processIncarnation?: string ): DispatchContextRow { const task = this.getTask(taskId) if (!task) { @@ -6118,8 +6189,9 @@ export class OrchestrationDb { .prepare( `INSERT INTO dispatch_contexts ( id, run_id, task_id, contract_version, launch_token_hash, - assignee_handle, assignee_pane_key, status, failure_count, dispatched_at - ) VALUES (?, ?, ?, ?, ?, ?, ?, 'dispatched', ?, datetime('now'))` + assignee_handle, assignee_pane_key, process_incarnation, + status, failure_count, dispatched_at + ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'dispatched', ?, datetime('now'))` ) .run( id, @@ -6129,6 +6201,7 @@ export class OrchestrationDb { launchTokenHash ?? null, assigneeHandle, assigneePaneKey ?? null, + processIncarnation ?? null, priorFailures ) this.hasAnyDispatchContextsCache = true @@ -6300,9 +6373,12 @@ export class OrchestrationDb { const actives = this.db .prepare( - "SELECT * FROM dispatch_contexts WHERE assignee_pane_key IS NOT NULL AND status IN ('pending', 'dispatched')" + `SELECT * FROM dispatch_contexts + WHERE assignee_pane_key IS NOT NULL + AND status IN ('pending', 'dispatched') + AND ${DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL} = ?` ) - .all() as DispatchContextRow[] + .all(paneKeyMatchSuffix(assigneePaneKey)) as DispatchContextRow[] for (const row of actives) { if (row.assignee_pane_key && isEquivalentPaneKey(row.assignee_pane_key, assigneePaneKey)) { diff --git a/src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts b/src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts new file mode 100644 index 00000000000..d13344004c3 --- /dev/null +++ b/src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts @@ -0,0 +1,156 @@ +import { afterEach, describe, expect, it } from 'vitest' +import type Database from '../../sqlite/sync-database' +import { OrchestrationDb } from './db' + +const CREATOR_PANE = 'tab-creator:11111111-1111-4111-8111-111111111111' +const CREATOR_PROCESS = 'pty-creator:incarnation-a' + +function sqliteFor(db: OrchestrationDb): Database.Database { + return (db as unknown as { db: Database.Database }).db +} + +describe('creator authority lookup performance', () => { + let db: OrchestrationDb | undefined + + afterEach(() => db?.close()) + + it('uses bounded creator-handle and pane-leaf indexes', () => { + db = new OrchestrationDb(':memory:') + const sqlite = sqliteFor(db) + const taskPlan = sqlite + .prepare( + `EXPLAIN QUERY PLAN + SELECT t.*, creator.id + FROM tasks t + LEFT JOIN dispatch_contexts creator ON creator.rowid = ( + SELECT candidate.rowid + FROM dispatch_contexts candidate + WHERE candidate.assignee_handle = t.created_by_terminal_handle + AND candidate.run_id = ? + AND candidate.status IN ('pending', 'dispatched') + ORDER BY candidate.rowid DESC LIMIT 1 + ) + WHERE t.id = ?` + ) + .all('run-owner', 'task-worker') as { detail: string }[] + const panePlan = sqlite + .prepare( + `EXPLAIN QUERY PLAN + SELECT * FROM dispatch_contexts + WHERE assignee_pane_key IS NOT NULL + AND status IN ('pending', 'dispatched') + AND substr(assignee_pane_key, instr(assignee_pane_key, ':') + 1) = ?` + ) + .all('11111111-1111-4111-8111-111111111111') as { detail: string }[] + const taskDetails = taskPlan.map((row) => row.detail).join(' | ') + const paneDetails = panePlan.map((row) => row.detail).join(' | ') + + expect(taskDetails).toContain('idx_dispatch_active_assignee_handle') + expect(taskDetails).not.toMatch(/SCAN (?:runs|rebound)/) + expect(paneDetails).toContain('idx_dispatch_assignee_pane_leaf') + }) + + it('keeps 300 Task reads bounded with 50,000 retained Runs', () => { + db = new OrchestrationDb(':memory:') + const run = db.createRun({ + objective: 'owner', + coordinatorHandle: 'term-coordinator', + coordinatorPaneKey: 'tab-coordinator:22222222-2222-4222-8222-222222222222' + }) + const creatorTask = db.createTask({ spec: 'creator', runId: run.id }) + db.createDispatchContext( + creatorTask.id, + 'term-creator', + CREATOR_PANE, + undefined, + CREATOR_PROCESS + ) + const workerTask = db.createTask({ + spec: 'worker', + runId: run.id, + createdByTerminalHandle: 'term-creator', + createdByPaneKey: CREATOR_PANE, + createdByProcessIncarnation: CREATOR_PROCESS, + createdByRunGeneration: run.consumer_generation + }) + sqliteFor(db) + .prepare( + `WITH RECURSIVE run_numbers(value) AS ( + VALUES (1) UNION ALL SELECT value + 1 FROM run_numbers WHERE value < ? + ) + INSERT INTO runs (id, objective, coordinator_handle, consumer_generation, legacy) + SELECT printf('retained_%05d', value), 'retained', printf('term_%05d', value), 1, 0 + FROM run_numbers` + ) + .run(50_000) + + for (let index = 0; index < 10; index += 1) { + db.getTask(workerTask.id, run.id) + } + const startedAt = performance.now() + for (let index = 0; index < 300; index += 1) { + expect(db.getTask(workerTask.id, run.id)?.creator_dispatch_run_id).toBe(run.id) + } + const elapsedMs = performance.now() - startedAt + + expect(elapsedMs).toBeLessThan(200) + }) + + it.each([20_000, 50_000])( + 'keeps active creator lookup bounded with %i retained same-handle Dispatches', + (retainedDispatchCount) => { + db = new OrchestrationDb(':memory:') + const run = db.createRun({ + objective: 'owner', + coordinatorHandle: 'term-coordinator', + coordinatorPaneKey: 'tab-coordinator:22222222-2222-4222-8222-222222222222' + }) + sqliteFor(db) + .prepare( + `WITH RECURSIVE dispatch_numbers(value) AS ( + VALUES (1) UNION ALL SELECT value + 1 FROM dispatch_numbers WHERE value < ? + ) + INSERT INTO dispatch_contexts ( + id, run_id, task_id, assignee_handle, status, completed_at + ) + SELECT printf('retained_ctx_%05d', value), ?, printf('retained_task_%05d', value), + 'term-creator', 'completed', datetime('now') + FROM dispatch_numbers` + ) + .run(retainedDispatchCount, run.id) + const creatorTask = db.createTask({ spec: 'creator', runId: run.id }) + const creatorDispatch = db.createDispatchContext( + creatorTask.id, + 'term-creator', + CREATOR_PANE, + undefined, + CREATOR_PROCESS + ) + const workerTask = db.createTask({ + spec: 'worker', + runId: run.id, + createdByTerminalHandle: 'term-creator', + createdByPaneKey: CREATOR_PANE, + createdByProcessIncarnation: CREATOR_PROCESS, + createdByRunGeneration: run.consumer_generation + }) + + for (let index = 0; index < 10; index += 1) { + db.getTask(workerTask.id, run.id) + db.getActiveDispatchForTerminal('term-creator') + } + const startedAt = performance.now() + for (let index = 0; index < 300; index += 1) { + expect(db.getTask(workerTask.id, run.id)?.creator_dispatch_id).toBe(creatorDispatch.id) + expect(db.getActiveDispatchForTerminal('term-creator')?.id).toBe(creatorDispatch.id) + } + const elapsedMs = performance.now() - startedAt + + const competingTask = db.createTask({ spec: 'competing creator', runId: run.id }) + expect(() => db!.createDispatchContext(competingTask.id, 'term-creator')).toThrow( + `Terminal term-creator already has an active dispatch (${creatorDispatch.id}` + ) + expect(elapsedMs).toBeLessThan(200) + } + ) +}) diff --git a/src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts b/src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts index 0b78eaebdd6..8cb0547ee27 100644 --- a/src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts +++ b/src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts @@ -218,7 +218,7 @@ describe('OrchestrationDb dispatch assignee index migration', () => { } }) - it('migrates a populated v21 database idempotently', () => { + it('migrates a populated upstream v23 database idempotently', () => { tempDir = mkdtempSync(join(tmpdir(), 'orca-dispatch-index-migration-')) const dbPath = join(tempDir, 'orchestration.db') db = new OrchestrationDb(dbPath) @@ -228,14 +228,25 @@ describe('OrchestrationDb dispatch assignee index migration', () => { db = undefined const oldDb = new Database(dbPath) - oldDb.exec('DROP INDEX IF EXISTS idx_dispatch_assignee_handle') - oldDb.pragma('user_version = 21') + oldDb.exec(` + DROP INDEX IF EXISTS idx_dispatch_active_assignee_handle; + DROP INDEX IF EXISTS idx_dispatch_assignee_pane_leaf; + ALTER TABLE tasks DROP COLUMN created_by_pane_key; + ALTER TABLE tasks DROP COLUMN created_by_process_incarnation; + ALTER TABLE tasks DROP COLUMN created_by_run_generation; + `) + oldDb.pragma('user_version = 23') oldDb.close() db = new OrchestrationDb(dbPath) const sqlite = sqliteFor(db) - expect(sqlite.pragma('user_version', { simple: true })).toBe(23) + expect(sqlite.pragma('user_version', { simple: true })).toBe(25) expect(db.getDispatchContextById(dispatch.id)).toMatchObject({ assignee_handle: 'term_worker' }) + expect(db.getTask(task.id)).toMatchObject({ + created_by_pane_key: null, + created_by_process_incarnation: null, + created_by_run_generation: null + }) expect( sqlite .prepare("SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?") @@ -249,12 +260,75 @@ describe('OrchestrationDb dispatch assignee index migration', () => { ) .all('term_worker') as { detail: string }[] expect(plan.map((row) => row.detail).join('\n')).toContain( - 'USING INDEX idx_dispatch_assignee_handle' + 'USING INDEX idx_dispatch_active_assignee_handle' ) + expect( + sqlite + .prepare("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = ?") + .get('idx_dispatch_active_assignee_handle') + ).toMatchObject({ + sql: expect.stringContaining("status IN ('pending', 'dispatched')") + }) + expect( + sqlite + .prepare("SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?") + .get('idx_dispatch_assignee_pane_leaf') + ).toBeDefined() db.close() db = new OrchestrationDb(dbPath) - expect(sqliteFor(db).pragma('user_version', { simple: true })).toBe(23) + expect(sqliteFor(db).pragma('user_version', { simple: true })).toBe(25) expect(db.getDispatchContextById(dispatch.id)).toBeDefined() }) + + it('adds the active-handle index to a populated v24 database idempotently', () => { + tempDir = mkdtempSync(join(tmpdir(), 'orca-active-dispatch-index-migration-')) + const dbPath = join(tempDir, 'orchestration.db') + db = new OrchestrationDb(dbPath) + const run = db.createRun({ + objective: 'retained v24 authority', + coordinatorHandle: 'term_coord', + coordinatorPaneKey: 'tab_coord:leaf_coord' + }) + const task = db.createTask({ + spec: 'indexed lookup', + runId: run.id, + createdByTerminalHandle: 'term_creator', + createdByPaneKey: 'tab_creator:leaf_creator', + createdByProcessIncarnation: 'pty_creator:incarnation-a', + createdByRunGeneration: run.consumer_generation + }) + const dispatch = db.createDispatchContext(task.id, 'term_worker') + db.close() + db = undefined + + const oldDb = new Database(dbPath) + oldDb.exec('DROP INDEX IF EXISTS idx_dispatch_active_assignee_handle') + oldDb.pragma('user_version = 24') + oldDb.close() + + db = new OrchestrationDb(dbPath) + const sqlite = sqliteFor(db) + expect(sqlite.pragma('user_version', { simple: true })).toBe(25) + expect(db.getTask(task.id)).toMatchObject({ + created_by_pane_key: 'tab_creator:leaf_creator', + created_by_process_incarnation: 'pty_creator:incarnation-a', + created_by_run_generation: 1 + }) + expect(db.getDispatchContextById(dispatch.id)).toMatchObject({ + assignee_handle: 'term_worker' + }) + expect( + sqlite + .prepare("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = ?") + .get('idx_dispatch_active_assignee_handle') + ).toMatchObject({ + sql: expect.stringContaining('assignee_handle IS NOT NULL') + }) + + db.close() + db = new OrchestrationDb(dbPath) + expect(sqliteFor(db).pragma('user_version', { simple: true })).toBe(25) + expect(db.getTask(task.id)?.created_by_process_incarnation).toBe('pty_creator:incarnation-a') + }) }) diff --git a/src/main/runtime/orchestration/types.ts b/src/main/runtime/orchestration/types.ts index 76b3d536fe8..e399b13ce49 100644 --- a/src/main/runtime/orchestration/types.ts +++ b/src/main/runtime/orchestration/types.ts @@ -246,6 +246,9 @@ export type TaskRow = { run_id: string parent_id: string | null created_by_terminal_handle: string | null + created_by_pane_key: string | null + created_by_process_incarnation: string | null + created_by_run_generation: number | null task_title: string | null display_name: string | null spec: string diff --git a/src/main/runtime/rpc/methods/orchestration.test.ts b/src/main/runtime/rpc/methods/orchestration.test.ts index e2aaf31b6eb..8ba154c48f7 100644 --- a/src/main/runtime/rpc/methods/orchestration.test.ts +++ b/src/main/runtime/rpc/methods/orchestration.test.ts @@ -1763,17 +1763,27 @@ describe('orchestration RPC methods', () => { expect(result.task.status).toBe('pending') }) - it('records the caller terminal handle when creating a task', async () => { + it('records the caller pane, process, and Run generation when creating a task', async () => { setup() vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) => handle === 'term_creator' ? coordinatorPaneKey : null ) + vi.spyOn(runtime, 'getOrchestrationDispatchAuthority').mockReturnValue({ + terminalHandle: 'term_creator', + paneKey: coordinatorPaneKey, + processIncarnation: 'pty-creator:incarnation-a' + } as never) const result = (await call('orchestration.taskCreate', { spec: 'spawn related workspace', callerTerminalHandle: 'term_creator' })) as { task: { id: string } } - expect(db.getTask(result.task.id)?.created_by_terminal_handle).toBe('term_creator') + expect(db.getTask(result.task.id)).toMatchObject({ + created_by_terminal_handle: 'term_creator', + created_by_pane_key: coordinatorPaneKey, + created_by_process_incarnation: 'pty-creator:incarnation-a', + created_by_run_generation: 1 + }) }) it('rejects invalid deps JSON', async () => { @@ -1898,6 +1908,16 @@ describe('orchestration RPC methods', () => { vi.mocked(runtime.getTerminalPaneKey).mockImplementation((candidate) => candidate === handle ? `tab_worker:${handle}` : coordinatorPaneKey ) + vi.spyOn(runtime, 'getOrchestrationDispatchAuthority').mockImplementation((candidate) => + candidate === handle + ? ({ + terminalHandle: handle, + paneKey: `tab_worker:${handle}`, + processIncarnation: `runtime_test:${handle}:1`, + launchTokenHash: null + } as never) + : null + ) } it('dispatches a task to a terminal', async () => { @@ -1929,7 +1949,7 @@ describe('orchestration RPC methods', () => { expect(db.getDispatchContextById(result.dispatch.id)?.assignee_pane_key).toBe('tab_w:leaf_w') }) - it('commits the target process launch token on a manual dispatch', async () => { + it('commits authenticated process authority on a manual dispatch', async () => { setup() vi.spyOn(runtime, 'getOrchestrationDispatchAuthority').mockReturnValue({ runtimeId: runtime.getRuntimeId(), @@ -1948,9 +1968,24 @@ describe('orchestration RPC methods', () => { to: 'term_a' })) as { dispatch: { id: string } } - expect(db.getDispatchContextById(result.dispatch.id)?.launch_token_hash).toBe( - 'launch-token-hash' - ) + expect(db.getDispatchContextById(result.dispatch.id)).toMatchObject({ + assignee_pane_key: 'tab_w:leaf_w', + process_incarnation: 'runtime_test:term_a:1', + launch_token_hash: 'launch-token-hash' + }) + }) + + it('does not infer manual process authority from an unauthenticated handle', async () => { + setup() + const task = db.createTask({ spec: 'work' }) + + const result = (await call('orchestration.dispatch', { + task: task.id, + to: 'term_a' + })) as { dispatch: { id: string } } + + expect(runtime.getTerminalProcessIncarnation('term_a')).toBe('runtime_test:term_a:1') + expect(db.getDispatchContextById(result.dispatch.id)?.process_incarnation).toBeNull() }) it('rejects dispatch for a pending task', async () => { diff --git a/src/main/runtime/rpc/methods/orchestration.ts b/src/main/runtime/rpc/methods/orchestration.ts index 34ea1f36860..0bdb24543a7 100644 --- a/src/main/runtime/rpc/methods/orchestration.ts +++ b/src/main/runtime/rpc/methods/orchestration.ts @@ -1100,6 +1100,16 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [ throw new Error('Invalid --deps: must be a JSON array of task IDs') } } + const run = resolveRunScope(runtime, { + runId: params.run, + callerTerminalHandle: params.callerTerminalHandle, + requireCurrentConsumer: true, + legacyCoordinatorRunId, + callerEvidence: orchestrationCompatibilityEvidence + }) + const creatorAuthority = params.callerTerminalHandle + ? runtime.getOrchestrationDispatchAuthority(params.callerTerminalHandle) + : null const task = db.createTask({ spec: params.spec, taskTitle: params.taskTitle, @@ -1107,13 +1117,14 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [ deps, parentId: params.parent, createdByTerminalHandle: params.callerTerminalHandle, - runId: resolveRunScope(runtime, { - runId: params.run, - callerTerminalHandle: params.callerTerminalHandle, - requireCurrentConsumer: true, - legacyCoordinatorRunId, - callerEvidence: orchestrationCompatibilityEvidence - }).id + ...(creatorAuthority?.paneKey && creatorAuthority.processIncarnation + ? { + createdByPaneKey: creatorAuthority.paneKey, + createdByProcessIncarnation: creatorAuthority.processIncarnation, + createdByRunGeneration: run.consumer_generation + } + : {}), + runId: run.id }) return { task } } @@ -1256,9 +1267,9 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [ const assigneePaneKey = dispatchAuthority?.paneKey ?? runtime.getTerminalPaneKey(to) ?? undefined const processIncarnation = - dispatchAuthority?.processIncarnation ?? - runtime.getTerminalProcessIncarnation(to) ?? - undefined + dispatchAuthority?.paneKey && dispatchAuthority.processIncarnation + ? dispatchAuthority.processIncarnation + : undefined if (params.inject && (!assigneePaneKey || !processIncarnation)) { throw new OrchestrationError( 'stable_pane_required', @@ -1271,7 +1282,8 @@ export const ORCHESTRATION_METHODS: RpcMethod[] = [ params.task, to, assigneePaneKey, - dispatchAuthority?.launchTokenHash ?? undefined + dispatchAuthority?.launchTokenHash ?? undefined, + processIncarnation ) const dispatchCapability = params.inject ? db.mintDispatchCapability({ diff --git a/src/main/runtime/rpc/orchestration-legacy-coordinator-race.test.ts b/src/main/runtime/rpc/orchestration-legacy-coordinator-race.test.ts index be5628df496..468f261b725 100644 --- a/src/main/runtime/rpc/orchestration-legacy-coordinator-race.test.ts +++ b/src/main/runtime/rpc/orchestration-legacy-coordinator-race.test.ts @@ -628,6 +628,16 @@ describe('legacy coordinator takeover races', () => { handle === COORDINATOR_HANDLE ? COORDINATOR_PANE : handle === targetHandle ? targetPane : null ) vi.spyOn(harness.runtime, 'getTerminalProcessIncarnation').mockReturnValue('current-process') + vi.spyOn(harness.runtime, 'getOrchestrationDispatchAuthority').mockImplementation((handle) => + handle === targetHandle + ? ({ + terminalHandle: targetHandle, + paneKey: targetPane, + processIncarnation: 'current-process', + launchTokenHash: null + } as never) + : null + ) let resolveDetection: ((detected: boolean) => void) | undefined let signalDetectionStarted: (() => void) | undefined const detectionStarted = new Promise((resolve) => { diff --git a/src/renderer/src/store/slices/agent-status.test.ts b/src/renderer/src/store/slices/agent-status.test.ts index 70c334eae1a..b6b2976e26b 100644 --- a/src/renderer/src/store/slices/agent-status.test.ts +++ b/src/renderer/src/store/slices/agent-status.test.ts @@ -265,6 +265,42 @@ describe('agent status runtime orchestration metadata', () => { }) }) + it('clears stale lineage when the authoritative runtime snapshot loses its Run binding', () => { + vi.useFakeTimers() + const store = createTestStore() + const childPaneKey = 'tab-child:11111111-1111-4111-8111-111111111111' + + store.getState().setAgentStatus(childPaneKey, { + state: 'working', + prompt: 'child agent', + agentType: 'codex', + orchestration: { + taskId: 'task-1', + dispatchId: 'ctx-1', + dispatchStatus: 'dispatched', + parentTerminalHandle: 'term-old-coordinator', + parentPaneKey: 'tab-parent:22222222-2222-4222-8222-222222222222', + coordinatorHandle: 'term-old-coordinator', + orchestrationRunId: 'run-1' + } + }) + store.getState().setRuntimeAgentOrchestrationByPaneKey({ + [childPaneKey]: { + taskId: 'task-1', + dispatchId: 'ctx-1', + dispatchStatus: 'dispatched', + orchestrationRunId: 'run-1' + } + }) + + expect(store.getState().agentStatusByPaneKey[childPaneKey].orchestration).toEqual({ + taskId: 'task-1', + dispatchId: 'ctx-1', + dispatchStatus: 'dispatched', + orchestrationRunId: 'run-1' + }) + }) + it('updates runtime status for the same dispatch', () => { vi.useFakeTimers() const store = createTestStore() diff --git a/src/renderer/src/store/slices/agent-status.ts b/src/renderer/src/store/slices/agent-status.ts index d8c87362edc..921cc58d02a 100644 --- a/src/renderer/src/store/slices/agent-status.ts +++ b/src/renderer/src/store/slices/agent-status.ts @@ -1125,6 +1125,9 @@ function mergeCurrentOrchestrationContext( if (!sameDispatch) { return current } + if (current.dispatchStatus !== undefined) { + return orchestrationContextsEqual(existing, current) ? existing : current + } const merged = { ...existing, ...current } return orchestrationContextsEqual(existing, merged) ? existing : merged } From 9ba293cb74c05e11e87fb934d3907be553dcb0a3 Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 21:37:29 -0700 Subject: [PATCH 02/72] fix(mobile): keep relay runtime recovery alive without direct connectivity (#12374) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(mobile): keep relay runtime recovery alive without direct connectivity A phone paired over the relay whose direct LAN endpoint is unreachable (e.g. a Tailscale IP with Tailscale off) could lose the runtime channel permanently: the reconnect controller's recovery gates parked with no timer and no logs, the supervisor snapshotted relay credentials once at start (dying silently if the read failed and dialing stale tokens after rotation), and the only path that cleared a rejected-credential gate required a working direct connection. Field symptom: home card shows "Connected - Orca Relay" (or "Can't connect - check Tailscale") while the host page sits at zero worktrees forever. - gates (fresh-credential, external-signal) now arm a slow 60s reprobe instead of parking; each gated attempt re-reads the durable credential bundle and adopts it when its version is fresher than the rejected one - supervisor start no longer dies for the process lifetime when the initial Keychain read fails or the bundle is expired - every recovery decision now reaches logcat and the in-app connection log ([relay] lines); previously the whole relay dial path was silent - direct-return probing extracted to mobile-direct-return-probe.ts, credential selection to mobile-relay-credential-selection.ts Regression suite mirrors the field failure (rejected outer credential, unreadable bundle at start, expired bundle, E2EE rejection without a UI nudge) plus real-rpc-client failover integration tests; the four deterministic scenarios fail on the previous code. * fix(mobile): adopt durable relay credentials by outcome, not version Adversarial review caught two blockers in the version-comparison rule: renewals extend expiresAt without bumping current.version, and a re-pair restarts the version counter — both left the durable bundle unadopted and reproduced the original outage. Selection now adopts the disk bundle exactly when it yields a dialable (unexpired, non-rejected) credential while memory does not, which also keeps revoked versions unresurrectable. Also from review: the gate reprobe cadence now escalates 60s -> 15min ceiling with 0.75-1.25x jitter (no fleet phase-alignment, no permanent one-minute beacon); clearing a gate drops its timer, pending tick, and cadence so an orphaned reprobe cannot swallow the next fast backoff; the reprobe tick token is only minted while its gate still holds; and a merely missing/expired bundle uses a plain cooldown instead of the fresh-credential gate so it cannot force rotations on direct reconnects. New regression tests (all red on the previous code): renewal without a version bump, re-pair with a restarted counter, orphaned-timer backoff swallowing, escalating gated cadence, and background/foreground recovery after an E2EE rejection. * fix(mobile): reset gated relay cadence on app resume Review round 2: an escalated fresh-credential gate kept its cadence across background/foreground, so reopening the app could wait out a 15-minute tick (measured 11.25min to first attempt after a 2h background) — indistinguishable from the outage itself. A resume now resets the streak even when it cannot lift the credential gate, and a successful direct connection does the same in resetForDirectConnection. Also: the streak now advances once per fired tick instead of once per armed-delay computation (three arms per cycle escalated 60s -> ceiling in ~7 minutes instead of the documented eight steps); delay computation is a pure read. * fix(mobile): rotate relay sessions on resume expiry, not attach deadline Live phone verification of the failover fix exposed a second defect the old latch had been masking: the relay-hello's leaseExpiresAt is the cell's attach-reservation deadline (now + 10s for resumes, credential-store.ts:213 server-side), but the supervisor scheduled proactive rotation from it with a 30s margin clamped to 1s — so every relay runtime session force-replaced itself ~1s after connecting (measured every ~2.5s on device, 253 dials per 5 simulated minutes in the red test). Any RPC slower than the cycle could never complete, which is the "Worktree list unavailable" symptom. The session now captures resumeExpiresAt from the hello (updated by the resume confirmation) and rotation keys off it. Test fakes previously used a 120s lease, which is why no suite ever reproduced the loop; they now mirror the production 10s attach deadline, and a churn regression holds one session across 5 minutes with direct unreachable. * fix(mobile): clamp lease rotation delay on both ends Adversarial review of the resume-expiry rotation fix caught an int32 setTimeout overflow: production resumeTtlMs is 30 days, and 30d - 30s = 2,591,970,000ms exceeds INT32_MAX, so Node (and vitest's fake timers) clamp the timer to 1ms — 3001 relay dials and credential writes in 3 simulated seconds, ~2500x worse than the churn being fixed. The delay is now clamped to [60s, 6h]: the ceiling makes overflow unreachable regardless of server TTL (a harmless re-resume every 6h on long sessions), and the floor bounds any bad deadline to one forced rotation per minute instead of a sub-second loop — which also disarms the Math.max(1000, ...) landmine for return-unchanged-grace resumes whose stored expiry can be arbitrarily near. Also from review: getLeaseExpiresAt is renamed getAttachDeadlineAt (it had zero production callers left; the plausible name is how the churn bug happened), the expired-vs-missing bundle cases now log distinct strings, and both test fakes use production constants (10s attach deadline, 30-day resume TTL) — fictional fake values hid all three defects in this subsystem. The four forced-rotation lease tests are retimed to the 60s floor with direct pinned unreachable so return probes cannot race their windows. * style(mobile): merge duplicate imports in relay failover test * style(mobile): use T[] array syntax in credential selection --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- .../transport/mobile-direct-return-probe.ts | 83 ++++ .../transport/mobile-endpoint-lifecycle.ts | 1 + .../mobile-endpoint-supervisor-contract.ts | 3 +- .../mobile-endpoint-supervisor.test.ts | 26 +- .../transport/mobile-endpoint-supervisor.ts | 160 +++--- .../mobile-relay-credential-selection.ts | 42 ++ .../mobile-relay-lease-rotation-timer.ts | 16 +- .../mobile-relay-reconnect-controller.test.ts | 98 +++- .../mobile-relay-reconnect-controller.ts | 111 ++++- .../transport/mobile-relay-recovery-log.ts | 22 + .../mobile-relay-rpc-session.test.ts | 2 +- .../src/transport/mobile-relay-rpc-session.ts | 15 +- .../mobile-relay-runtime-failover.test.ts | 454 ++++++++++++++++++ 13 files changed, 917 insertions(+), 116 deletions(-) create mode 100644 mobile/src/transport/mobile-direct-return-probe.ts create mode 100644 mobile/src/transport/mobile-relay-credential-selection.ts create mode 100644 mobile/src/transport/mobile-relay-recovery-log.ts create mode 100644 mobile/src/transport/mobile-relay-runtime-failover.test.ts diff --git a/mobile/src/transport/mobile-direct-return-probe.ts b/mobile/src/transport/mobile-direct-return-probe.ts new file mode 100644 index 00000000000..dfb0572aa38 --- /dev/null +++ b/mobile/src/transport/mobile-direct-return-probe.ts @@ -0,0 +1,83 @@ +import { openAuthenticatedDirectEndpoint } from './mobile-direct-endpoint-probe' +import type { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis' +import type { RpcClient } from './rpc-client' +import type { HostProfile } from './types' +import type { MobileConnectionPath } from './stable-logical-rpc-client' + +const DIRECT_PROBE_INTERVAL_MS = 15_000 + +// While the runtime channel rides the relay, periodically probe the direct +// endpoint and migrate back once hysteresis proves it stable. +export class DirectReturnProbe { + private timer: ReturnType | null = null + + constructor( + private readonly deps: { + now: () => number + setTimer: typeof setTimeout + clearTimer: typeof clearTimeout + openDirect: (endpoint: string) => RpcClient + }, + private readonly hooks: { + hysteresis: MobileEndpointHysteresis + host: () => HostProfile + canSchedule: () => boolean + canAttempt: () => boolean + beginOperation: () => void + migrate: (client: RpcClient, path: MobileConnectionPath) => Promise + onDirectMigrated: () => Promise + afterProbe: () => void + } + ) {} + + schedule(delayMs = DIRECT_PROBE_INTERVAL_MS): void { + if (!this.hooks.canSchedule() || this.timer) { + return + } + this.timer = this.deps.setTimer(() => { + this.timer = null + void this.probe() + }, delayMs) + } + + clear(): void { + if (this.timer) { + this.deps.clearTimer(this.timer) + this.timer = null + } + } + + private async probe(): Promise { + if (!this.hooks.canAttempt() || !this.hooks.hysteresis.canProbe(this.deps.now())) { + this.schedule() + return + } + this.hooks.beginOperation() + let successful: Awaited> = null + try { + successful = await openAuthenticatedDirectEndpoint( + this.hooks.host(), + this.deps.openDirect, + 12_000 + ) + if (!successful) { + this.hooks.hysteresis.recordDirectFailure(this.deps.now()) + return + } + if (!this.hooks.hysteresis.recordDirectSuccess(this.deps.now())) { + successful.client.close() + return + } + await this.hooks.migrate(successful.client, successful.path) + successful = null + this.hooks.hysteresis.recordMigration(this.deps.now()) + await this.hooks.onDirectMigrated() + } finally { + successful?.client.close() + // Why: a relay drop or backoff timer can arrive while the probe owns the + // operation mutex; afterProbe releases it and replays deferred recovery. + this.hooks.afterProbe() + this.schedule() + } + } +} diff --git a/mobile/src/transport/mobile-endpoint-lifecycle.ts b/mobile/src/transport/mobile-endpoint-lifecycle.ts index 57881022a56..d41898152c3 100644 --- a/mobile/src/transport/mobile-endpoint-lifecycle.ts +++ b/mobile/src/transport/mobile-endpoint-lifecycle.ts @@ -90,6 +90,7 @@ function createSupervisor( readBundle: readMobileRelayCredentialBundle, writeBundle: writeMobileRelayCredentialBundle, saveHost, + onLog, now: Date.now, randomBytes: ExpoCrypto.getRandomBytes, setTimer: setTimeout, diff --git a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts index d26e0706f70..0098de6e079 100644 --- a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts +++ b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts @@ -3,7 +3,7 @@ import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bund import type { MobileRelayRpcSession } from './mobile-relay-rpc-session' import type { resolveMobileRelayEndpoint } from './mobile-relay-resume-director' import type { RpcClient } from './rpc-client' -import type { HostProfile } from './types' +import type { ConnectionLogSink, HostProfile } from './types' export type MobileEndpointSupervisorDependencies = { openDirect: (endpoint: string) => RpcClient @@ -20,4 +20,5 @@ export type MobileEndpointSupervisorDependencies = { randomBytes: (length: number) => Uint8Array setTimer: typeof setTimeout clearTimer: typeof clearTimeout + onLog?: ConnectionLogSink } diff --git a/mobile/src/transport/mobile-endpoint-supervisor.test.ts b/mobile/src/transport/mobile-endpoint-supervisor.test.ts index 3ec05f5ef1e..e6d0ff8bb32 100644 --- a/mobile/src/transport/mobile-endpoint-supervisor.test.ts +++ b/mobile/src/transport/mobile-endpoint-supervisor.test.ts @@ -52,18 +52,21 @@ class FakeRelaySession extends FakeSession implements MobileRelayRpcSession { constructor( state: ConnectionState, private readonly failure: Error | null = null, - private readonly lease = Date.now() + 120_000 + private readonly resumeExpiry = Date.now() + 30 * 24 * 3_600_000 ) { super(state) } - getLeaseExpiresAt = () => this.lease + // Why: production-realistic defaults — fictional fake values hid three + // live defects in this subsystem (latch, churn, int32 timer overflow). + getAttachDeadlineAt = () => Date.now() + 10_000 + getResumeExpiresAt = () => this.resumeExpiry getResumeConfirmation = () => ({ v: 1 as const, reqId: 'confirm-1', currentVersion: 2, acceptedAs: 'current' as const, renewed: true, - resumeExpiresAt: Date.now() + 300_000 + resumeExpiresAt: this.resumeExpiry }) getFailure = () => this.failure } @@ -716,6 +719,7 @@ describe('mobile endpoint supervisor', () => { .mockReturnValueOnce(new FakeRelaySession('disconnected', new RelayOuterError(4408))) const deps = dependencies({ openRelay, + openDirect: vi.fn(() => new FakeSession('disconnected')), resolveRelay: vi.fn(() => resolvePending) }) const supervisor = new MobileEndpointSupervisor(logical, host, deps) @@ -744,12 +748,13 @@ describe('mobile endpoint supervisor', () => { .mockReturnValueOnce(new FakeRelaySession('disconnected', new RelayOuterError(4408))) const deps = dependencies({ openRelay, + openDirect: vi.fn(() => new FakeSession('disconnected')), resolveRelay: vi.fn(() => resolvePending) }) const supervisor = new MobileEndpointSupervisor(logical, host, deps) await supervisor.start() - await vi.advanceTimersByTimeAsync(1000) + await vi.advanceTimersByTimeAsync(60_000) await vi.waitFor(() => expect(deps.resolveRelay).toHaveBeenCalledOnce()) supervisor.setForeground(false) finishResolve?.(relay) @@ -785,11 +790,14 @@ describe('mobile endpoint supervisor', () => { .fn() .mockReturnValueOnce(new FakeRelaySession('connected', null, Date.now() + 31_000)) .mockImplementation(() => new FakeRelaySession('disconnected', new RelayOuterError(4404))) - const deps = dependencies({ openRelay }) + const deps = dependencies({ + openRelay, + openDirect: vi.fn(() => new FakeSession('disconnected')) + }) const supervisor = new MobileEndpointSupervisor(logical, host, deps) await supervisor.start() - await vi.advanceTimersByTimeAsync(1000) + await vi.advanceTimersByTimeAsync(60_000) expect(openRelay).toHaveBeenCalledTimes(2) await vi.advanceTimersByTimeAsync(5000) @@ -808,12 +816,13 @@ describe('mobile endpoint supervisor', () => { .mockImplementation(() => new FakeRelaySession('connected')) const deps = dependencies({ openRelay, + openDirect: vi.fn(() => new FakeSession('disconnected')), randomBytes: () => new Uint8Array([128, 0]) }) const supervisor = new MobileEndpointSupervisor(logical, host, deps) await supervisor.start() - await vi.advanceTimersByTimeAsync(1000) + await vi.advanceTimersByTimeAsync(60_000) expect(openRelay).toHaveBeenCalledTimes(2) // The old relay can outlive its rejected lease replacement, then close separately. @@ -833,12 +842,13 @@ describe('mobile endpoint supervisor', () => { .mockImplementation(() => new FakeRelaySession('connected')) const deps = dependencies({ openRelay, + openDirect: vi.fn(() => new FakeSession('disconnected')), randomBytes: () => new Uint8Array([128, 0]) }) const supervisor = new MobileEndpointSupervisor(logical, host, deps) await supervisor.start() - await vi.advanceTimersByTimeAsync(1000) + await vi.advanceTimersByTimeAsync(60_000) expect(openRelay).toHaveBeenCalledTimes(2) supervisor.setForeground(true) diff --git a/mobile/src/transport/mobile-endpoint-supervisor.ts b/mobile/src/transport/mobile-endpoint-supervisor.ts index c8b3cdbcfb1..77ffbbde3db 100644 --- a/mobile/src/transport/mobile-endpoint-supervisor.ts +++ b/mobile/src/transport/mobile-endpoint-supervisor.ts @@ -1,5 +1,5 @@ -import { openAuthenticatedDirectEndpoint } from './mobile-direct-endpoint-probe' import type { MobileEndpointSupervisorDependencies } from './mobile-endpoint-supervisor-contract' +import { DirectReturnProbe } from './mobile-direct-return-probe' import { RelayReconnectController } from './mobile-relay-reconnect-controller' import { RelayLeaseRotationTimer } from './mobile-relay-lease-rotation-timer' import { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis' @@ -9,6 +9,8 @@ import { persistRelayHost, toError } from './mobile-endpoint-supervisor-support' +import { selectDialableRelayCredentials } from './mobile-relay-credential-selection' +import { createRelayRecoveryLog, type RelayRecoveryLog } from './mobile-relay-recovery-log' import { applyResumeConfirmation, mobileRelayCredentialNeedsRotation, @@ -20,7 +22,6 @@ import type { HostProfile } from './types' export type { MobileEndpointSupervisorDependencies } from './mobile-endpoint-supervisor-contract' -const DIRECT_PROBE_INTERVAL_MS = 15_000 const DIRECT_OBSERVATION_MS = 30_000 const MINIMUM_DWELL_MS = 60_000 const FAILURE_COOLDOWN_MS = 60_000 @@ -32,11 +33,12 @@ export class MobileEndpointSupervisor { private operationInFlight = false private credentialRotationInFlight = false private relayRotationPending = false - private probeTimer: ReturnType | null = null private unsubscribeState: (() => void) | null = null private readonly hysteresis: MobileEndpointHysteresis private readonly relayReconnect: RelayReconnectController private readonly leaseRotation: RelayLeaseRotationTimer + private readonly logRelay: RelayRecoveryLog + private readonly directProbe: DirectReturnProbe constructor( private readonly logical: StableLogicalRpcClient, @@ -49,24 +51,52 @@ export class MobileEndpointSupervisor { failureCooldownMs: FAILURE_COOLDOWN_MS, minimumDwellMs: MINIMUM_DWELL_MS }) + this.logRelay = createRelayRecoveryLog(dependencies.now, dependencies.onLog) this.relayReconnect = new RelayReconnectController(dependencies, this.recoverRelay.bind(this)) this.leaseRotation = new RelayLeaseRotationTimer(dependencies, () => { this.relayRotationPending = true void this.recoverRelay(true) }) + this.directProbe = new DirectReturnProbe(dependencies, { + hysteresis: this.hysteresis, + host: () => this.host, + canSchedule: () => + !this.stopped && this.foreground && this.logical.getActivePath() === 'relay', + canAttempt: () => !this.stopped && this.foreground && !this.operationInFlight, + beginOperation: () => { + this.operationInFlight = true + }, + migrate: (client, path) => this.logical.migrateTo(client, path), + onDirectMigrated: async () => { + this.leaseRotation.clear() + this.relayRotationPending = false + await this.rotateCredentialIfNeeded(this.relayReconnect.resetForDirectConnection()) + }, + afterProbe: () => { + this.operationInFlight = false + if (this.relayRotationPending || this.logical.getState() !== 'connected') { + void this.recoverRelay(this.relayRotationPending) + } + } + }) } async start(): Promise { this.bundle = await this.dependencies.readBundle(this.host.id).catch(() => null) - if (this.stopped || !this.bundle || !this.host.relay) { + if (this.stopped || !this.host.relay) { return } + if (!this.bundle) { + // Why: a Keychain race at open must not kill relay recovery for the whole + // process lifetime; each recovery attempt re-reads the durable bundle. + this.logRelay('credential bundle unavailable at start; recovery will re-read') + } this.unsubscribeState = this.logical.onStateChange((state) => { if (state === 'connected') { if (this.logical.getActivePath() !== 'relay') { void this.rotateCredentialIfNeeded(this.relayReconnect.resetForDirectConnection()) } - this.scheduleDirectProbe() + this.directProbe.schedule() } else { // Why: the direct client enters reconnecting after its first failed // dial and may never publish disconnected while its retry loop lives. @@ -78,7 +108,7 @@ export class MobileEndpointSupervisor { // are still loading, before the supervisor subscribes to state changes. await this.recoverRelay() } else { - this.scheduleDirectProbe() + this.directProbe.schedule() } } @@ -87,11 +117,11 @@ export class MobileEndpointSupervisor { this.foreground = foreground if (foreground) { this.relayReconnect.handleForeground(this.logical, wasForeground) - this.scheduleDirectProbe(0) + this.directProbe.schedule(0) } else { // Why: background phones must not hold billed relay data splices. this.relayReconnect.suspendActiveRelay(this.logical) - this.clearDirectProbeTimer() + this.directProbe.clear() this.relayReconnect.clear() this.leaseRotation.clear() } @@ -101,7 +131,7 @@ export class MobileEndpointSupervisor { this.stopped = true this.unsubscribeState?.() this.unsubscribeState = null - this.clearDirectProbeTimer() + this.directProbe.clear() this.relayReconnect.clear() this.leaseRotation.clear() } @@ -112,7 +142,6 @@ export class MobileEndpointSupervisor { this.stopped || !this.foreground || this.operationInFlight || - !this.bundle || !this.host.relay || (!forceReplacement && !this.relayReconnect.needsRecovery(this.logical.getState())) ) { @@ -121,23 +150,42 @@ export class MobileEndpointSupervisor { // Why: revival and lease timers can overlap resume failures; one shared cooldown // prevents PEER_DROPPED/LIMIT_EXCEEDED reconnect churn. if (this.relayReconnect.shouldDefer()) { + this.logRelay('recovery deferred by cooldown or gate') return } this.operationInFlight = true let lastError: Error | null = null let retryAfterOperation = false try { - const credentials = this.relayReconnect.eligibleCredentials( - this.bundle.current, - this.bundle.grace - ) - for (const credential of credentials) { + const selection = await selectDialableRelayCredentials({ + bundle: this.bundle, + controller: this.relayReconnect, + readBundle: () => this.dependencies.readBundle(this.host.id), + onAdoptedFresherBundle: () => this.logRelay('adopted fresher durable credential bundle') + }) + this.bundle = selection.bundle + if (selection.credentials.length === 0) { + // Why: "expired" vs "missing" separates a sleep-past-expiry phone + // (needs re-pair or LAN) from a Keychain failure in field reports. + this.logRelay( + selection.bundle + ? 'relay credential expired or rejected; slow reprobe armed' + : 'no relay credential bundle; slow reprobe armed' + ) + this.relayReconnect.armCredentialReprobe() + return + } + for (const credential of selection.credentials) { const result = await this.tryRelayCredential(credential) if (result.ok) { retryAfterOperation = this.logical.getState() !== 'connected' return } lastError = result.error + this.logRelay( + 'relay dial failed', + `${result.error.name}: ${String(result.error.message).slice(0, 80)}` + ) if (this.relayReconnect.shouldTryGraceAfterRelayFailure(result.error)) { // Why: a rejected version stays invalid; retry only the grace credential. this.relayReconnect.recordRejectedCredential(credential.version) @@ -145,12 +193,10 @@ export class MobileEndpointSupervisor { break } } - if (credentials.length > 0) { - // Why: cleanup may happen while a relay dial is awaiting the network; - // record its outcome without recreating a foreground retry timer. - const scheduleRetry = !forceReplacement && this.foreground && !this.stopped - this.relayReconnect.registerFailure(lastError, scheduleRetry) - } + // Why: cleanup may happen while a relay dial is awaiting the network; + // record its outcome without recreating a foreground retry timer. + const scheduleRetry = !forceReplacement && this.foreground && !this.stopped + this.relayReconnect.registerFailure(lastError, scheduleRetry) } finally { this.operationInFlight = false if (forceReplacement && this.relayRotationPending && !this.stopped && this.foreground) { @@ -207,6 +253,7 @@ export class MobileEndpointSupervisor { } this.relayRotationPending = false this.hysteresis.recordMigration(this.dependencies.now()) + this.logRelay('runtime channel migrated to relay') const confirmation = session.getResumeConfirmation() if (confirmation) { this.bundle = applyResumeConfirmation(this.bundle, credential.version, confirmation) @@ -215,71 +262,21 @@ export class MobileEndpointSupervisor { await this.dependencies.writeBundle(this.bundle).catch(() => {}) } // Why: async persistence can finish after stop/background; never recreate a stale timer. + // Why: rotate against the resume credential's expiry, never the hello's + // leaseExpiresAt — that field is the cell's ~10s attach-reservation + // deadline, and using it forced a session replacement every second. this.leaseRotation.scheduleFromLease( - this.stopped || !this.foreground ? null : session.getLeaseExpiresAt() + this.stopped || !this.foreground + ? null + : (confirmation?.resumeExpiresAt ?? session.getResumeExpiresAt()) ) - this.scheduleDirectProbe() + this.directProbe.schedule() return { ok: true } } catch (error) { return { ok: false, error: session.getFailure() ?? toError(error) } } } - private scheduleDirectProbe(delayMs = DIRECT_PROBE_INTERVAL_MS): void { - if ( - this.stopped || - !this.foreground || - this.logical.getActivePath() !== 'relay' || - this.probeTimer - ) { - return - } - this.probeTimer = this.dependencies.setTimer(() => { - this.probeTimer = null - void this.probeDirect() - }, delayMs) - } - - private async probeDirect(): Promise { - if ( - this.stopped || - !this.foreground || - this.operationInFlight || - !this.hysteresis.canProbe(this.dependencies.now()) - ) { - this.scheduleDirectProbe() - return - } - this.operationInFlight = true - let successful: Awaited> = null - try { - const openDirect = this.dependencies.openDirect - successful = await openAuthenticatedDirectEndpoint(this.host, openDirect, 12_000) - if (!successful) { - this.hysteresis.recordDirectFailure(this.dependencies.now()) - return - } - if (!this.hysteresis.recordDirectSuccess(this.dependencies.now())) { - successful.client.close() - return - } - await this.logical.migrateTo(successful.client, successful.path) - successful = null - this.hysteresis.recordMigration(this.dependencies.now()) - this.leaseRotation.clear() - this.relayRotationPending = false - await this.rotateCredentialIfNeeded(this.relayReconnect.resetForDirectConnection()) - } finally { - successful?.client.close() - this.operationInFlight = false - // Why: a relay drop or backoff timer can arrive while the direct probe owns the mutex. - if (this.relayRotationPending || this.logical.getState() !== 'connected') { - void this.recoverRelay(this.relayRotationPending) - } - this.scheduleDirectProbe() - } - } - private async rotateCredentialIfNeeded(force = false): Promise { if ( this.stopped || @@ -321,11 +318,4 @@ export class MobileEndpointSupervisor { } } } - - private clearDirectProbeTimer(): void { - if (this.probeTimer) { - this.dependencies.clearTimer(this.probeTimer) - this.probeTimer = null - } - } } diff --git a/mobile/src/transport/mobile-relay-credential-selection.ts b/mobile/src/transport/mobile-relay-credential-selection.ts new file mode 100644 index 00000000000..dcaca2080dd --- /dev/null +++ b/mobile/src/transport/mobile-relay-credential-selection.ts @@ -0,0 +1,42 @@ +import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bundle' +import type { RelayReconnectController } from './mobile-relay-reconnect-controller' + +// Why: pairing recovery, re-pairing, or a raced rotation can land a fresh +// durable bundle after the supervisor snapshotted its copy; a gated retry must +// see it instead of dialing (or refusing to dial) on stale state forever. +// +// Adoption is decided by OUTCOME, not by version: renewals extend expiresAt +// without bumping current.version, and a re-pair restarts the version counter, +// so version comparison cannot tell fresh from stale. The durable bundle is +// adopted exactly when it yields a dialable (unexpired, non-rejected) +// credential while the in-memory one does not — which also means a revoked +// version can never be resurrected from a stale disk copy. +export async function selectDialableRelayCredentials(args: { + bundle: MobileRelayCredentialBundle | null + controller: RelayReconnectController + readBundle: () => Promise + onAdoptedFresherBundle: () => void +}): Promise<{ + bundle: MobileRelayCredentialBundle | null + credentials: MobileRelayCredentialBundle['current'][] +}> { + const memory = args.bundle + const memoryCredentials = memory + ? args.controller.eligibleCredentials(memory.current, memory.grace) + : [] + if (memoryCredentials.length > 0) { + // Why: in-memory can be newer than disk (a resume confirmation whose + // durable write failed); never let a stale disk copy shadow it. + return { bundle: memory, credentials: memoryCredentials } + } + const disk = await args.readBundle().catch(() => null) + if (disk) { + const diskCredentials = args.controller.eligibleCredentials(disk.current, disk.grace) + if (diskCredentials.length > 0) { + args.controller.acceptFreshCredential(disk.current.version) + args.onAdoptedFresherBundle() + return { bundle: disk, credentials: diskCredentials } + } + } + return { bundle: memory ?? disk, credentials: [] } +} diff --git a/mobile/src/transport/mobile-relay-lease-rotation-timer.ts b/mobile/src/transport/mobile-relay-lease-rotation-timer.ts index bf2a3dd4d1c..19aedfe8be1 100644 --- a/mobile/src/transport/mobile-relay-lease-rotation-timer.ts +++ b/mobile/src/transport/mobile-relay-lease-rotation-timer.ts @@ -2,6 +2,13 @@ // little before the deadline (and retry shortly if a forced rotation didn't land) // so the session never lapses. Owns the single lease/rotation timer slot. const LEASE_ROTATION_MARGIN_MS = 30_000 +// Why: both ends must be clamped. The floor bounds any bad deadline to one +// forced rotation per minute instead of a sub-second loop; the ceiling keeps +// the delay far below setTimeout's 32-bit limit (a 30-day resume TTL minus the +// margin overflows int32 and fires at 1ms), at the cost of a harmless +// re-resume every few hours on long-lived sessions. +const LEASE_ROTATION_MIN_DELAY_MS = 60_000 +const LEASE_ROTATION_MAX_DELAY_MS = 6 * 60 * 60 * 1000 export type RelayLeaseRotationDependencies = { now: () => number @@ -23,9 +30,12 @@ export class RelayLeaseRotationTimer { if (!leaseExpiresAt) { return } - const delay = Math.max( - 1000, - leaseExpiresAt - this.dependencies.now() - LEASE_ROTATION_MARGIN_MS + const delay = Math.min( + LEASE_ROTATION_MAX_DELAY_MS, + Math.max( + LEASE_ROTATION_MIN_DELAY_MS, + leaseExpiresAt - this.dependencies.now() - LEASE_ROTATION_MARGIN_MS + ) ) this.arm(delay) } diff --git a/mobile/src/transport/mobile-relay-reconnect-controller.test.ts b/mobile/src/transport/mobile-relay-reconnect-controller.test.ts index d630f0db68b..cc640d4d7e7 100644 --- a/mobile/src/transport/mobile-relay-reconnect-controller.test.ts +++ b/mobile/src/transport/mobile-relay-reconnect-controller.test.ts @@ -6,7 +6,9 @@ import { RelayReconnectController } from './mobile-relay-reconnect-controller' import type { StableLogicalRpcClient } from './stable-logical-rpc-client' vi.mock('react-native', () => ({ Platform: { OS: 'ios' } })) -vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) })) +vi.mock('expo-crypto', () => ({ + getRandomBytes: (length: number) => new Uint8Array(length) +})) describe('relay reconnect controller', () => { beforeEach(() => { @@ -47,16 +49,104 @@ describe('relay reconnect controller', () => { expect(onRetry).not.toHaveBeenCalled() }) - it('waits for an external signal after rejected E2EE authentication', () => { + it('reprobes slowly after rejected E2EE authentication instead of parking forever', () => { + // Why: on a relay-only phone a permanent gate is a permanent outage — the + // desktop can commit pairing credentials moments after the first rejection. const onRetry = vi.fn() const reconnect = createController(onRetry) reconnect.registerFailure(new MobileE2EEAuthenticationError()) expect(reconnect.shouldDefer()).toBe(true) - expect(vi.getTimerCount()).toBe(0) - vi.advanceTimersByTime(60_000) expect(onRetry).not.toHaveBeenCalled() + vi.advanceTimersByTime(59_000) + expect(onRetry).not.toHaveBeenCalled() + vi.advanceTimersByTime(1_000) + expect(onRetry).toHaveBeenCalledTimes(1) + // The reprobe tick passes the gate exactly once, then defers again. + expect(reconnect.shouldDefer()).toBe(false) + expect(reconnect.shouldDefer()).toBe(true) + }) + + it('keeps the fresh-credential gate reprobing after each failed gated attempt', () => { + const onRetry = vi.fn() + const reconnect = createController(onRetry) + + reconnect.registerFailure(new RelayOuterError(4401)) + expect(reconnect.shouldDefer()).toBe(true) + + vi.advanceTimersByTime(60_000) + expect(onRetry).toHaveBeenCalledTimes(1) + expect(reconnect.shouldDefer()).toBe(false) + // The gated attempt fails again with only rejected credentials on hand. + reconnect.registerFailure(new RelayOuterError(4401)) + + // The gated cadence escalates: the second reprobe waits twice as long. + vi.advanceTimersByTime(60_000) + expect(onRetry).toHaveBeenCalledTimes(1) + vi.advanceTimersByTime(60_000) + expect(onRetry).toHaveBeenCalledTimes(2) + }) + + it('resets the gated cadence when the app returns to the foreground', () => { + // Why: reopening the app is the strongest "conditions changed" signal a + // phone produces — it must not wait out an escalated 15-minute tick even + // when it cannot lift the credential gate itself. + const onRetry = vi.fn() + const reconnect = createController(onRetry) + const logical = { getState: () => 'disconnected' } as never + + reconnect.registerFailure(new RelayOuterError(4401)) + vi.advanceTimersByTime(60_000) + expect(onRetry).toHaveBeenCalledTimes(1) + // A failed gated attempt escalates the next tick beyond the base cadence. + reconnect.registerFailure(new RelayOuterError(4401)) + + reconnect.clear() + reconnect.handleForeground(logical, false) + expect(onRetry).toHaveBeenCalledTimes(2) + + expect(reconnect.shouldDefer()).toBe(true) + vi.advanceTimersByTime(60_000) + expect(onRetry).toHaveBeenCalledTimes(3) + }) + + it('does not let an orphaned reprobe timer swallow the next fast backoff', () => { + const onRetry = vi.fn() + const reconnect = createController(onRetry) + const logical = { getState: () => 'disconnected' } as never + + reconnect.registerFailure(new MobileE2EEAuthenticationError()) + // A foreground revival nudge clears the external-signal gate and its timer. + reconnect.handleForeground(logical, true) + expect(onRetry).toHaveBeenCalledTimes(1) + + // A plain transport failure must schedule its own fast retry, not wait + // out a leftover 60s reprobe timer. + reconnect.registerFailure(new RelayOuterError(4429)) + vi.advanceTimersByTime(600) + expect(onRetry).toHaveBeenCalledTimes(2) + }) + + it('lifts the fresh-credential gate when a durable bundle carries a new version', () => { + const onRetry = vi.fn() + const reconnect = createController(onRetry) + + reconnect.recordRejectedCredential(2) + reconnect.armCredentialReprobe() + expect(reconnect.shouldDefer()).toBe(true) + + reconnect.acceptFreshCredential(2) + expect(reconnect.shouldDefer()).toBe(true) + + reconnect.acceptFreshCredential(3) + expect(reconnect.shouldDefer()).toBe(false) + expect( + reconnect.eligibleCredentials( + { token: 'fresh', version: 3, expiresAt: Number.MAX_SAFE_INTEGER }, + null + ) + ).toHaveLength(1) }) it('upgrades host-revival gating to fresh credentials without later downgrading it', () => { diff --git a/mobile/src/transport/mobile-relay-reconnect-controller.ts b/mobile/src/transport/mobile-relay-reconnect-controller.ts index 6f586c17499..f2a7cad6b05 100644 --- a/mobile/src/transport/mobile-relay-reconnect-controller.ts +++ b/mobile/src/transport/mobile-relay-reconnect-controller.ts @@ -17,6 +17,12 @@ const RELAY_BACKOFF_CEILING_MS = 30_000 const RELAY_STABLE_CONNECTION_MS = RELAY_BACKOFF_CEILING_MS const RELAY_HOST_OFFLINE_RETRY_MIN_MS = 5_000 const RELAY_HOST_OFFLINE_RETRY_MAX_MS = 15_000 +// Why: gates must slow recovery down, never end it — a relay-only phone has no +// direct path to refresh credentials, so a timerless gate is a permanent outage. +// The cadence escalates and jitters so a permanently revoked device is not a +// forever one-minute beacon and a fleet-wide gating event cannot phase-align. +const RELAY_GATE_REPROBE_BASE_MS = 60_000 +const RELAY_GATE_REPROBE_CEILING_MS = 15 * 60_000 export type RelayReconnectDependencies = { now: () => number @@ -34,6 +40,8 @@ export class RelayReconnectController { private timer: ReturnType | null = null private activeSession: MobileRelayRpcSession | null = null private recoveryGate: RecoveryGate | null = null + private gateReprobePending = false + private gateReprobeStreak = 0 private readonly rejectedCredentialVersions = new Set() constructor( @@ -43,12 +51,15 @@ export class RelayReconnectController { handleForeground(logical: StableLogicalRpcClient, wasForeground: boolean): void { if (!wasForeground) { - // Why: an app resume is a fresh signal, unlike repeated network-flap nudges. + // Why: an app resume is a fresh signal, unlike repeated network-flap + // nudges — it resets the gated cadence even when it cannot lift the + // credential gate, so reopening the app never waits out a 15min tick. + this.gateReprobeStreak = 0 if (this.recoveryGate !== 'fresh-credential') { this.reset() } } else if (this.recoveryGate === 'external-signal') { - this.recoveryGate = null + this.liftGate() } if ( wasForeground && @@ -87,8 +98,7 @@ export class RelayReconnectController { this.activeSession = session this.activeRelayConnectedAt = this.dependencies.now() this.nextAttemptAt = 0 - this.recoveryGate = null - this.clearTimer() + this.liftGate() } resetForDirectConnection(): boolean { @@ -97,10 +107,14 @@ export class RelayReconnectController { this.activeSession = null this.activeRelayConnectedAt = null if (needsCredentialRefresh) { - // Why: the rejected credential stays unusable until its replacement is durable. + // Why: the rejected credential stays unusable until its replacement is + // durable. No reprobe timer here — direct is live, rotation over it + // clears the gate, and any later state failure re-arms via shouldDefer. this.consecutiveFailures = 0 this.nextAttemptAt = 0 this.recoveryGate = 'fresh-credential' + this.gateReprobePending = false + this.gateReprobeStreak = 0 this.clearTimer() } else { this.reset() @@ -128,10 +142,36 @@ export class RelayReconnectController { if (eligible.length === 0 && this.rejectedCredentialVersions.size > 0) { this.recoveryGate = 'fresh-credential' this.clearTimer() + this.scheduleGateReprobe() } return eligible } + // For callers that found no dialable credential at all: keep a slow retry + // alive so a later durable write can recover. + armCredentialReprobe(): void { + if (this.rejectedCredentialVersions.size > 0) { + this.recoveryGate = 'fresh-credential' + this.clearTimer() + this.scheduleGateReprobe() + return + } + // Why: a merely missing or expired bundle must not enter the credential + // gate — that gate forces a rotation on the next direct connect. A plain + // cooldown retries the read on the same escalating cadence. + const delay = this.gateReprobeDelayMs() + this.nextAttemptAt = this.dependencies.now() + delay + this.clearTimer() + this.scheduleReprobeTick(delay, false) + } + + // A durable bundle whose current version is not rejected reopens the gate. + acceptFreshCredential(version: number): void { + if (this.recoveryGate === 'fresh-credential' && !this.rejectedCredentialVersions.has(version)) { + this.liftGate() + } + } + recordRejectedCredential(version: number): void { this.rejectedCredentialVersions.add(version) } @@ -154,6 +194,12 @@ export class RelayReconnectController { // re-dial. Arms the self-scheduled retry so recovery still happens on its own. shouldDefer(): boolean { if (this.recoveryGate) { + if (this.gateReprobePending) { + // Why: the slow reprobe tick gets exactly one attempt through the gate. + this.gateReprobePending = false + return false + } + this.scheduleGateReprobe() return true } if (this.dependencies.now() < this.nextAttemptAt) { @@ -173,8 +219,9 @@ export class RelayReconnectController { this.recoveryGate === 'fresh-credential' || (this.recoveryGate === 'external-signal' && recovery?.kind !== 'disable-relay-credential') ) { - // Why: only the gate's external signal can make a known-fatal recovery retryable. + // Why: a failed reprobe stays gated, but the slow cadence must keep going. this.clearTimer() + this.scheduleGateReprobe() return } const now = this.dependencies.now() @@ -192,15 +239,20 @@ export class RelayReconnectController { recovery?.kind === 'retry-after-host-offline' ? this.hostOfflineDelayMs() : this.delayMs() this.nextAttemptAt = now + delay if (error instanceof MobileE2EEAuthenticationError) { - // Why: pairing state cannot change on a timer; polling only wakes the radio. + // Why: an E2EE rejection is usually pairing revocation, but it also fires + // transiently right after pairing while the desktop commits credentials — + // reprobe slowly instead of waiting forever for a UI nudge. this.recoveryGate = 'external-signal' this.clearTimer() + this.scheduleGateReprobe() return } if (recovery?.kind === 'disable-relay-credential') { - // Why: a rejected outer credential cannot recover until direct connectivity refreshes it. + // Why: never redial a rejected credential fast, but keep a slow reprobe + // alive — the caller re-reads durable state before each gated attempt. this.recoveryGate = 'fresh-credential' this.clearTimer() + this.scheduleGateReprobe() return } if (recovery?.kind === 'retry-after-host-offline') { @@ -235,12 +287,12 @@ export class RelayReconnectController { this.consecutiveFailures = 0 this.activeRelayConnectedAt = null this.nextAttemptAt = 0 - this.recoveryGate = null - this.clearTimer() + this.liftGate() } clear(): void { this.clearTimer() + this.gateReprobePending = false this.activeSession = null this.activeRelayConnectedAt = null } @@ -263,6 +315,45 @@ export class RelayReconnectController { }, delay) } + private scheduleGateReprobe(): void { + this.scheduleReprobeTick(this.gateReprobeDelayMs(), true) + } + + private scheduleReprobeTick(delay: number, mintToken: boolean): void { + if (this.timer) { + return + } + this.timer = this.dependencies.setTimer(() => { + this.timer = null + // Why: the streak advances once per fired tick — arm attempts within one + // cycle recompute the same delay instead of triple-escalating it. + this.gateReprobeStreak = Math.min(this.gateReprobeStreak + 1, 8) + // Why: the tick token is only minted while its gate still holds; a later + // gate must not spend a stale token and bypass its own cooldown. + if (mintToken && this.recoveryGate) { + this.gateReprobePending = true + } + this.onRetry() + }, delay) + } + + private gateReprobeDelayMs(): number { + const base = Math.min( + RELAY_GATE_REPROBE_CEILING_MS, + RELAY_GATE_REPROBE_BASE_MS * 2 ** Math.min(this.gateReprobeStreak, 8) + ) + return Math.floor(base * (0.75 + 0.5 * this.jitterFraction())) + } + + // Why: clearing a gate must also drop its timer, pending tick, and cadence — + // an orphaned reprobe timer would otherwise swallow the next fast backoff. + private liftGate(): void { + this.recoveryGate = null + this.gateReprobePending = false + this.gateReprobeStreak = 0 + this.clearTimer() + } + private delayMs(): number { const exponent = Math.max(0, this.consecutiveFailures - 1) const cap = Math.min(RELAY_BACKOFF_CEILING_MS, RELAY_BACKOFF_BASE_MS * 2 ** exponent) diff --git a/mobile/src/transport/mobile-relay-recovery-log.ts b/mobile/src/transport/mobile-relay-recovery-log.ts new file mode 100644 index 00000000000..9b373cd112a --- /dev/null +++ b/mobile/src/transport/mobile-relay-recovery-log.ts @@ -0,0 +1,22 @@ +import type { ConnectionLogSink } from './types' + +export type RelayRecoveryLog = (message: string, detail?: string) => void + +// Why: relay recovery failed silently in production for weeks; every decision +// must reach logcat and the in-app connection log. +export function createRelayRecoveryLog( + now: () => number, + onLog?: ConnectionLogSink +): RelayRecoveryLog { + let sequence = 0 + return (message, detail) => { + console.log(`[relay] ${message}`, detail ?? '') + onLog?.({ + id: `relay-${++sequence}`, + ts: now(), + level: 'info', + message: `Relay: ${message}`, + ...(detail ? { detail } : {}) + }) + } +} diff --git a/mobile/src/transport/mobile-relay-rpc-session.test.ts b/mobile/src/transport/mobile-relay-rpc-session.test.ts index 54ae8387411..f5fa49a785e 100644 --- a/mobile/src/transport/mobile-relay-rpc-session.test.ts +++ b/mobile/src/transport/mobile-relay-rpc-session.test.ts @@ -119,7 +119,7 @@ describe('mobile relay RPC session', () => { }) expect(confirmationRequest.params).not.toHaveProperty('relayDeviceId') expect(confirmationRequest.params).not.toHaveProperty('acceptedCredentialVersion') - expect(session.getLeaseExpiresAt()).toEqual(expect.any(Number)) + expect(session.getAttachDeadlineAt()).toEqual(expect.any(Number)) }) it('rejects a mismatched outer credential version and closes the physical link', () => { diff --git a/mobile/src/transport/mobile-relay-rpc-session.ts b/mobile/src/transport/mobile-relay-rpc-session.ts index a614e833387..ac065012203 100644 --- a/mobile/src/transport/mobile-relay-rpc-session.ts +++ b/mobile/src/transport/mobile-relay-rpc-session.ts @@ -19,7 +19,10 @@ type PendingRequest = { } export type MobileRelayRpcSession = RpcClient & { - getLeaseExpiresAt(): number | null + // The cell's attach-reservation deadline (~10s). Diagnostics only — never + // schedule anything from it; rotation keys off getResumeExpiresAt(). + getAttachDeadlineAt(): number | null + getResumeExpiresAt(): number | null getResumeConfirmation(): DeviceResumeConfirmed | null getFailure(): Error | null } @@ -40,7 +43,8 @@ export function connectMobileRelayRpcSession(args: { let state: ConnectionState = 'connecting' let requestCounter = 0 let lastConnectedAt: number | null = null - let leaseExpiresAt: number | null = null + let attachDeadlineAt: number | null = null + let resumeExpiresAt: number | null = null let resumeConfirmation: DeviceResumeConfirmed | null = null let failure: Error | null = null let closed = false @@ -65,7 +69,8 @@ export function connectMobileRelayRpcSession(args: { fail(new Error('relay resume credential version mismatch')) return } - leaseExpiresAt = hello.leaseExpiresAt + attachDeadlineAt = hello.leaseExpiresAt + resumeExpiresAt = hello.resumeExpiresAt publishState('handshaking') }, onAuthenticated: () => void confirmResume(), @@ -109,7 +114,8 @@ export function connectMobileRelayRpcSession(args: { streams.clear() publishState('disconnected') }, - getLeaseExpiresAt: () => leaseExpiresAt, + getAttachDeadlineAt: () => attachDeadlineAt, + getResumeExpiresAt: () => resumeExpiresAt, getResumeConfirmation: () => resumeConfirmation, getFailure: () => failure } @@ -131,6 +137,7 @@ export function connectMobileRelayRpcSession(args: { throw new Error('relay resume confirmation missing') } resumeConfirmation = result.resumeConfirmation + resumeExpiresAt = result.resumeConfirmation.resumeExpiresAt lastConnectedAt = Date.now() publishState('connected') } catch (error) { diff --git a/mobile/src/transport/mobile-relay-runtime-failover.test.ts b/mobile/src/transport/mobile-relay-runtime-failover.test.ts new file mode 100644 index 00000000000..dcb8ba194e2 --- /dev/null +++ b/mobile/src/transport/mobile-relay-runtime-failover.test.ts @@ -0,0 +1,454 @@ +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { connect, type RpcClient } from './rpc-client' +import { + createStableLogicalRpcClient, + type MobileConnectionPath, + type StableLogicalRpcClient +} from './stable-logical-rpc-client' +import { MobileE2EEAuthenticationError } from './mobile-e2ee-v2-physical-channel' +import { RelayOuterError } from './mobile-relay-e2ee-link' +import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bundle' +import type { MobileRelayRpcSession } from './mobile-relay-rpc-session' +import { + MobileEndpointSupervisor, + type MobileEndpointSupervisorDependencies +} from './mobile-endpoint-supervisor' +import type { ConnectionState, HostProfile, RpcResponse } from './types' + +// Regression suite for the 2026-08 field failure: a phone paired over the +// relay whose direct LAN endpoint is unreachable (Tailscale off) dialed the +// LAN endpoint forever and never recovered a relay runtime session. + +vi.mock('react-native', () => ({ Platform: { OS: 'android' } })) +vi.mock('expo-secure-store', () => ({ + WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'when-unlocked' +})) +vi.mock('expo-crypto', () => ({ + getRandomBytes: (length: number) => new Uint8Array(length) +})) + +vi.mock('./e2ee', () => ({ + generateKeyPair: () => ({ + publicKey: new Uint8Array(32), + secretKey: new Uint8Array(32) + }), + deriveSharedKey: () => new Uint8Array(32), + publicKeyFromBase64: () => new Uint8Array(32), + publicKeyToBase64: () => 'client-public-key', + encrypt: (plaintext: string) => plaintext, + decrypt: (raw: string) => raw, + decryptBytes: (bytes: Uint8Array) => bytes +})) + +class FakeSession implements RpcClient { + readonly sendRequest = vi.fn( + async (): Promise => ({ + id: 'rpc-1', + ok: true, + result: {}, + _meta: { runtimeId: 'runtime-1' } + }) + ) + readonly subscribe = vi.fn(() => () => {}) + readonly updateTerminalSubscriptionViewport = vi.fn() + readonly notifyForeground = vi.fn() + readonly close = vi.fn() + private readonly listeners = new Set<(state: ConnectionState) => void>() + + constructor(private state: ConnectionState) {} + + getState = () => this.state + getReconnectAttempt = () => 0 + getLastConnectedAt = () => null + onStateChange = (listener: (state: ConnectionState) => void) => { + this.listeners.add(listener) + return () => this.listeners.delete(listener) + } + + publishState(state: ConnectionState): void { + this.state = state + for (const listener of this.listeners) { + listener(state) + } + } +} + +class FakeRelaySession extends FakeSession implements MobileRelayRpcSession { + constructor( + state: ConnectionState, + private readonly failure: Error | null = null + ) { + super(state) + } + // Why: production-realistic constants — fictional fake values hid three + // live defects in this subsystem (latch, churn, int32 timer overflow). + getAttachDeadlineAt = () => Date.now() + 10_000 + getResumeExpiresAt = () => Date.now() + 30 * 24 * 3_600_000 + getResumeConfirmation = () => null + getFailure = () => this.failure +} + +class FakeLogicalClient extends FakeSession implements StableLogicalRpcClient { + private path: MobileConnectionPath + + constructor(state: ConnectionState, path: MobileConnectionPath) { + super(state) + this.path = path + } + + migrateTo = vi.fn(async (session: RpcClient, path: MobileConnectionPath) => { + if (session.getState() !== 'connected') { + session.close() + throw new Error(`replacement session ${session.getState()}`) + } + this.path = path + this.publishState('connected') + }) + suspendActiveSession = vi.fn(() => this.publishState('disconnected')) + getActivePath = () => this.path +} + +const relay = { + v: 1 as const, + directorUrl: 'https://relay.onorca.dev', + cellUrl: 'https://relay-c1.onorca.dev', + assignmentEpoch: 7, + relayHostId: 'AbCdEf0123_-xyZ9', + e2eeFraming: 2 as const +} + +const DIRECT_ENDPOINT = 'ws://100.88.90.25:6768' + +const host: HostProfile = { + id: 'host-1', + name: 'Blue Whale', + endpoint: DIRECT_ENDPOINT, + deviceToken: 'device-token', + publicKeyB64: 'A'.repeat(44), + lastConnected: 1, + endpoints: [ + { id: 'direct-primary', kind: 'lan', url: DIRECT_ENDPOINT }, + { + id: 'relay-primary', + kind: 'relay', + url: 'wss://relay-c1.onorca.dev/v1/connect/id' + } + ], + relayHostId: relay.relayHostId, + relay +} + +function bundleWith(version: number, expiresAt: number): MobileRelayCredentialBundle { + return { + v: 1, + hostId: host.id, + deviceToken: host.deviceToken, + current: { + token: `token-v${version}`.padEnd(43, 'A'), + hash: 'B'.repeat(43), + version, + expiresAt + } + } +} + +function dependencies( + overrides: Partial = {} +): MobileEndpointSupervisorDependencies { + return { + openDirect: vi.fn(() => new FakeSession('connected')), + openRelay: vi.fn(() => new FakeRelaySession('connected')), + resolveRelay: vi.fn(async ({ relay }) => relay), + readBundle: vi.fn(async () => bundleWith(2, Number.MAX_SAFE_INTEGER)), + writeBundle: vi.fn(async () => {}), + saveHost: vi.fn(async () => {}), + now: Date.now, + randomBytes: (length: number) => new Uint8Array(length), + setTimer: setTimeout, + clearTimer: clearTimeout, + ...overrides + } +} + +describe('relay runtime recovery without direct connectivity', () => { + beforeEach(() => { + vi.spyOn(console, 'log').mockImplementation(() => {}) + vi.useFakeTimers() + vi.setSystemTime(new Date('2026-08-02T12:00:00Z')) + }) + + afterEach(() => { + vi.useRealTimers() + vi.restoreAllMocks() + }) + + it('recovers from a rejected outer credential once a fresher bundle is durable', async () => { + const logical = new FakeLogicalClient('disconnected', 'lan') + const openRelay = vi + .fn() + .mockReturnValueOnce(new FakeRelaySession('disconnected', new RelayOuterError(4401))) + .mockImplementation(() => new FakeRelaySession('connected')) + const readBundle = vi + .fn(async () => bundleWith(3, Number.MAX_SAFE_INTEGER)) + .mockResolvedValueOnce(bundleWith(2, Number.MAX_SAFE_INTEGER)) + const deps = dependencies({ openRelay, readBundle }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + await supervisor.start() + await vi.advanceTimersByTimeAsync(0) + expect(openRelay).toHaveBeenCalledOnce() + + // Pre-fix, the fresh-credential gate latched here with no timer and no exit. + await vi.advanceTimersByTimeAsync(60_000) + expect(openRelay).toHaveBeenCalledTimes(2) + expect(openRelay).toHaveBeenLastCalledWith( + relay, + expect.objectContaining({ version: 3 }), + expect.any(String) + ) + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + }) + + it('recovers when the credential bundle was unreadable at supervisor start', async () => { + const logical = new FakeLogicalClient('disconnected', 'lan') + const readBundle = vi + .fn(async () => bundleWith(2, Number.MAX_SAFE_INTEGER)) + .mockResolvedValueOnce(null) + const deps = dependencies({ readBundle }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + // Pre-fix, a null first read killed relay recovery for the process lifetime. + await supervisor.start() + await vi.advanceTimersByTimeAsync(0) + + expect(deps.openRelay).toHaveBeenCalled() + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + }) + + it('recovers from an expired-at-start bundle after a fresh credential lands', async () => { + const logical = new FakeLogicalClient('disconnected', 'lan') + const expired = bundleWith(2, Date.now() - 1) + const readBundle = vi.fn(async () => expired) + const deps = dependencies({ readBundle }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + await supervisor.start() + await vi.advanceTimersByTimeAsync(0) + expect(deps.openRelay).not.toHaveBeenCalled() + + readBundle.mockImplementation(async () => bundleWith(3, Number.MAX_SAFE_INTEGER)) + // Pre-fix, an expired bundle produced a silent no-op with nothing scheduled. + await vi.advanceTimersByTimeAsync(60_000) + + expect(deps.openRelay).toHaveBeenCalledOnce() + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + }) + + it('retries after an E2EE authentication rejection without a UI nudge', async () => { + const logical = new FakeLogicalClient('disconnected', 'lan') + const openRelay = vi + .fn() + .mockReturnValueOnce( + new FakeRelaySession('disconnected', new MobileE2EEAuthenticationError()) + ) + .mockImplementation(() => new FakeRelaySession('connected')) + const deps = dependencies({ openRelay }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + await supervisor.start() + await vi.advanceTimersByTimeAsync(0) + expect(openRelay).toHaveBeenCalledOnce() + + // Pre-fix, this state waited indefinitely for a foreground/navigation event. + await vi.advanceTimersByTimeAsync(60_000) + expect(openRelay).toHaveBeenCalledTimes(2) + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + }) + + it('adopts a durable renewal that extends expiry without bumping the version', async () => { + // Why: resume confirmations and pairing recovery renew expiresAt while + // keeping current.version — version comparison cannot see this freshness. + const logical = new FakeLogicalClient('disconnected', 'lan') + const expired = bundleWith(2, Date.now() - 1) + const readBundle = vi + .fn(async () => bundleWith(2, Number.MAX_SAFE_INTEGER)) + .mockResolvedValueOnce(expired) + .mockResolvedValueOnce(expired) + const deps = dependencies({ readBundle }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + await supervisor.start() + await vi.advanceTimersByTimeAsync(0) + expect(deps.openRelay).not.toHaveBeenCalled() + + await vi.advanceTimersByTimeAsync(60_000) + expect(deps.openRelay).toHaveBeenCalledOnce() + expect(deps.openRelay).toHaveBeenLastCalledWith( + relay, + expect.objectContaining({ version: 2 }), + expect.any(String) + ) + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + }) + + it('adopts a re-paired credential whose version counter restarted', async () => { + // Why: re-pairing overwrites the same keychain slot with a NEW credential + // record whose counter restarts at 1 — lower than the rejected version. + const logical = new FakeLogicalClient('disconnected', 'lan') + const openRelay = vi + .fn() + .mockReturnValueOnce(new FakeRelaySession('disconnected', new RelayOuterError(4401))) + .mockImplementation(() => new FakeRelaySession('connected')) + const readBundle = vi + .fn(async () => bundleWith(1, Number.MAX_SAFE_INTEGER)) + .mockResolvedValueOnce(bundleWith(4, Number.MAX_SAFE_INTEGER)) + const deps = dependencies({ openRelay, readBundle }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + await supervisor.start() + await vi.advanceTimersByTimeAsync(0) + expect(openRelay).toHaveBeenCalledOnce() + + await vi.advanceTimersByTimeAsync(60_000) + expect(openRelay).toHaveBeenCalledTimes(2) + expect(openRelay).toHaveBeenLastCalledWith( + relay, + expect.objectContaining({ version: 1 }), + expect.any(String) + ) + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + }) + + it('does not churn relay sessions off the cell attach-reservation deadline', async () => { + // Why: the relay-hello's leaseExpiresAt is a ~10s attach deadline. Keying + // rotation off it replaced the session every second, killing any RPC + // slower than the cycle (the field symptom: "Worktree list unavailable"). + const logical = new FakeLogicalClient('disconnected', 'lan') + const openRelay = vi.fn(() => new FakeRelaySession('connected')) + // Direct stays unreachable, as in the field — return probes must not + // confuse the churn measurement by migrating back to direct. + const openDirect = vi.fn(() => new FakeSession('disconnected')) + const deps = dependencies({ openRelay, openDirect }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + await supervisor.start() + await vi.advanceTimersByTimeAsync(0) + expect(openRelay).toHaveBeenCalledOnce() + + await vi.advanceTimersByTimeAsync(5 * 60_000) + expect(openRelay).toHaveBeenCalledOnce() + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + }) + + it('recovers immediately on a background/foreground cycle after an E2EE rejection', async () => { + const logical = new FakeLogicalClient('disconnected', 'lan') + const openRelay = vi + .fn() + .mockReturnValueOnce( + new FakeRelaySession('disconnected', new MobileE2EEAuthenticationError()) + ) + .mockImplementation(() => new FakeRelaySession('connected')) + const deps = dependencies({ openRelay }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + await supervisor.start() + await vi.advanceTimersByTimeAsync(0) + expect(openRelay).toHaveBeenCalledOnce() + + supervisor.setForeground(false) + supervisor.setForeground(true) + await vi.advanceTimersByTimeAsync(0) + + expect(openRelay).toHaveBeenCalledTimes(2) + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + }) +}) + +// The field failure's first symptom: a real direct rpc-client dialing an +// unroutable LAN endpoint (instant 1006) while relay credentials sit unused. +class DeadSocket { + static constructed: string[] = [] + onopen: (() => void) | null = null + onclose: ((event: { code?: number; reason?: string }) => void) | null = null + onerror: ((event: unknown) => void) | null = null + onmessage: ((event: { data: unknown }) => void) | null = null + readyState = 0 + + constructor(readonly url: string) { + DeadSocket.constructed.push(url) + setTimeout(() => { + this.readyState = 3 + this.onclose?.({ code: 1006, reason: '' }) + }, 50) + } + + send(): void {} + close(): void { + this.readyState = 3 + } +} + +describe('failover with a real direct rpc-client', () => { + beforeEach(() => { + DeadSocket.constructed = [] + vi.stubGlobal('WebSocket', DeadSocket) + vi.spyOn(console, 'log').mockImplementation(() => {}) + vi.useFakeTimers() + vi.setSystemTime(new Date('2026-08-02T12:00:00Z')) + }) + + afterEach(() => { + vi.useRealTimers() + vi.unstubAllGlobals() + vi.restoreAllMocks() + }) + + it('migrates the logical client to relay after the direct dial fails', async () => { + const logical = createStableLogicalRpcClient( + connect(DIRECT_ENDPOINT, host.deviceToken, host.publicKeyB64), + 'tailscale' as MobileConnectionPath + ) + const deps = dependencies() + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + await supervisor.start() + await vi.advanceTimersByTimeAsync(3_000) + + expect(deps.openRelay).toHaveBeenCalled() + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + logical.close() + }) + + it('reaches relay even when the bundle read settles after the first direct failure', async () => { + const logical = createStableLogicalRpcClient( + connect(DIRECT_ENDPOINT, host.deviceToken, host.publicKeyB64), + 'tailscale' as MobileConnectionPath + ) + const deps = dependencies({ + readBundle: vi.fn(async () => { + await new Promise((resolve) => setTimeout(resolve, 200)) + return bundleWith(2, Number.MAX_SAFE_INTEGER) + }) + }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + const started = supervisor.start() + await vi.advanceTimersByTimeAsync(300) + await started + await vi.advanceTimersByTimeAsync(3_000) + + expect(deps.openRelay).toHaveBeenCalled() + expect(logical.getActivePath()).toBe('relay') + supervisor.stop() + logical.close() + }) +}) From 5bd2f59d297d0374736be1ed91df9c4d1ab9d9d9 Mon Sep 17 00:00:00 2001 From: Jihwan Kim Date: Tue, 4 Aug 2026 13:41:58 +0900 Subject: [PATCH 03/72] fix(runtime): open files from sibling workspaces (#11369) * feat(runtime): match files to workspace owners * fix(runtime): resolve terminal paths through sibling workspaces * fix(editor): route restored sibling workspace files * fix remote sibling file ownership routing * fix(editor): migrate restored sibling file owners * fix(editor): revalidate restored owner activation * docs(review): record PR 11369 correction evidence * fix(editor): reject collision before activation prep * docs(review): record PR 11369 final correction * fix(editor): retain projected reconciliation narrowing * chore(review): keep verification artifacts out of PR * fix(editor): harden restored owner migration * fix(runtime): resolve workspace root terminal paths --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- config/reliability-gates.jsonc | 95 +++ .../mobile-native-chat-open-file.test.ts | 3 +- .../session/mobile-native-chat-open-file.ts | 38 +- .../mobile-terminal-file-tap-open.test.ts | 50 ++ .../session/mobile-terminal-file-tap-open.ts | 20 +- src/main/runtime/orca-runtime-files.test.ts | 232 +++++- src/main/runtime/orca-runtime-files.ts | 51 +- src/main/runtime/orca-runtime.ts | 71 +- .../editor/editor-autosave-controller.test.ts | 47 ++ .../editor/editor-autosave-controller.ts | 11 + .../src/components/editor/editor-autosave.ts | 8 +- .../migrate-restored-editor-file-owner.ts | 87 +++ ...stored-editor-owner-save-lifecycle.test.ts | 287 ++++++++ .../useEditorPanelContentState.test.tsx | 4 + .../editor/useEditorPanelContentState.ts | 67 +- ...torPanelRemoteSiblingContentState.test.tsx | 168 +++++ .../useEditorExternalWatch-targets.test.ts | 2 + .../src/hooks/useEditorExternalWatch.ts | 33 +- .../lib/runtime-workspace-file-route.test.ts | 114 +++ .../src/lib/runtime-workspace-file-route.ts | 76 ++ src/renderer/src/store/slices/editor.ts | 383 +++++++++- .../restored-editor-owner-reparent.test.ts | 683 ++++++++++++++++++ src/renderer/src/store/slices/tabs.ts | 426 +++++------ .../src/store/slices/worktree-helpers.ts | 13 +- src/renderer/src/store/slices/worktrees.ts | 54 +- src/shared/runtime-types.ts | 4 +- .../runtime-workspace-file-owner.test.ts | 74 ++ src/shared/runtime-workspace-file-owner.ts | 43 ++ 28 files changed, 2866 insertions(+), 278 deletions(-) create mode 100644 src/renderer/src/components/editor/migrate-restored-editor-file-owner.ts create mode 100644 src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts create mode 100644 src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx create mode 100644 src/renderer/src/lib/runtime-workspace-file-route.test.ts create mode 100644 src/renderer/src/lib/runtime-workspace-file-route.ts create mode 100644 src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts create mode 100644 src/shared/runtime-workspace-file-owner.test.ts create mode 100644 src/shared/runtime-workspace-file-owner.ts diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc index c4f70fb7aea..ad6fdd1550c 100644 --- a/config/reliability-gates.jsonc +++ b/config/reliability-gates.jsonc @@ -10,6 +10,101 @@ } }, "gates": [ + { + "id": "editor.restored-sibling-owner-reparent", + "title": "Restored sibling tabs migrate filesystem authority before becoming editable", + "maturity": "experimental", + "protection": "partial", + "owner": "editor-runtime", + "layer": "renderer-store-controller-contract", + "surfaces": [ + "restored editor tabs", + "editor save and autosave", + "filesystem watches and hot-exit persistence" + ], + "platforms": ["macos", "linux", "windows"], + "providers": ["local", "ssh", "paired-runtime"], + "coveredPlatforms": ["macos"], + "coveredProviders": ["local", "ssh", "paired-runtime"], + "coverageNotes": "Deterministic store/controller tests cover local, direct-SSH, paired-runtime identity, folder workspaces, queue quiescence, stale route and connection-generation rejection, authoritative active-workspace projection, owner-derived IDs, drafts and editor maps, tab/group placement, exact watch replacement, change/delete/rename correlation, explicit save, autosave, collision refusal without activation reconciliation, provenance, and restart hot-exit persistence. Live headed/headless paired-runtime and post-establish Electron IPC remain uncollected.", + "motivatingLinks": [ + "https://github.com/stablyai/orca/issues/11304", + "https://github.com/stablyai/orca/pull/11369" + ], + "invariant": "A restored absolute path owned by a same-host sibling workspace cannot read, save, watch, or persist until old saves drain, the exact route and host generations are revalidated, and one authoritative activation transaction installs the sibling owner, target projection, editor state, reconciliation, and first-activation terminal preparation; collisions and stale routes fail before activation preparation or reconciliation.", + "oracle": "Hold an old-owner save in flight, start migration, then remove the sibling, change a folder root, or reconnect SSH and require owner migration to fail closed after quiescence. On a stable route require one coherent target-workspace projection, first-activation terminal generation preparation, destination authority for explicit save and autosave, exact watch replacement, destination-only change/delete/rename handling, owner-derived state rekeys, and hot-exit restart ownership. Seed an invalid destination tab/group model before a collision and require the target projection to remain byte-identical.", + "commands": [ + "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts src/renderer/src/lib/runtime-workspace-file-route.test.ts" + ], + "testFiles": [ + "src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts", + "src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts", + "src/renderer/src/lib/runtime-workspace-file-route.test.ts" + ], + "assertionRefs": [ + { + "file": "src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts", + "assertions": [ + "one atomic commit rekeys owner-derived editor, preview, draft, cursor, view, tab, group, active, reveal, focus, provenance, and persistence state", + "active reparenting uses the centralized workspace activation transaction for terminal, browser, pending-creation, explorer, first-activation, and post-commit state", + "source watch unsubscribes once, destination watch subscribes once, and only destination change/delete/rename events reach the file", + "dirty and clean destination collisions fail closed without changing either open session or reconciling destination tabs and groups", + "folder and direct-SSH owners retain exact root, host, target, and connection-generation authority" + ] + }, + { + "file": "src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts", + "assertions": [ + "migration waits for the old save queue and routes later explicit and automatic saves through the destination worktree", + "a removed sibling, changed folder root, or changed direct-SSH generation after quiescence rejects migration without changing ownership" + ] + }, + { + "file": "src/renderer/src/lib/runtime-workspace-file-route.test.ts", + "assertions": [ + "same-host runtime, folder, local, and direct-SSH roots resolve without cross-host fallback" + ] + } + ], + "evidenceRuns": [ + { + "date": "2026-08-03", + "runner": "local", + "platform": "macos", + "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts src/renderer/src/lib/runtime-workspace-file-route.test.ts", + "result": "passed", + "durationSeconds": 3, + "summary": "Three deterministic files passed 20 lifecycle, stale-route, activation, ownership, host, collision, persistence, watch, and save tests." + } + ], + "runtimeBudget": { + "p95Seconds": 5, + "scope": "focused renderer store/controller contract on a local development runner" + }, + "flakeHistory": { + "status": "unknown", + "evidence": "One local deterministic run is recorded; CI and soak history have not started." + }, + "redGreenEvidence": { + "status": "complete", + "evidence": "The final2 verifier's byte-identical post-quiescence lifecycle scope passed 21/21 on 7890271160 and failed 7 tests on f92db196a1; base e08eba674c, published 1bcfe3bcb0, and revert b3627461ab were structurally red. The permanent collision oracle is in test blob ac62a89c671a0c8f081ebf06736715bd2150ce9f (SHA-256 a61970ace80be1cb56f781aee6f878a8446c6c4527f9eb0cd0c151d8df96bf50). The same byte-identical blob is structurally red on base, published, and revert, behaviorally red on rejected final2 candidate 7890271160 because pre-commit reconciliation removes the stale destination tab, and green on implementation b72a838cdc; the full permanent gate passes 20/20." + }, + "performanceBudget": { + "required": true, + "evidence": "Route lookup scans only the already-indexed renderer workspace catalog, while migration is O(open editor files + source/destination tabs/groups) and performs no provider call, Git scan, polling, retry, subprocess, or global fanout beyond the required old/new watch delta." + }, + "promotionCriteria": [ + "Collect two fresh child-verifier decisions against the correction candidate.", + "Collect headed and headless paired-runtime coverage after the post-establish Electron IPC gap is fixed.", + "Collect physical Windows or WSL path/host evidence and CI soak history." + ], + "knownGaps": [ + "Headed Electron post-establish IPC, paired headless, reconnect, and physical Windows/WSL journeys are uncollected.", + "Cold many-repo main-process sibling discovery remains a separately measured follow-up.", + "Registered-workspace symlink policy remains inherited and unchanged." + ], + "demotionRule": "Keep experimental or demote if migration can race a save, retain source authority, fan out watches, lose dirty/editor state, accept an owner-generation change, merge a collision, or the focused contract flakes without a product or harness bug." + }, { "id": "terminal-provider.login-session-retirement", "title": "macOS login-session retirement preserves live daemons through transient rejection bursts", diff --git a/mobile/src/session/mobile-native-chat-open-file.test.ts b/mobile/src/session/mobile-native-chat-open-file.test.ts index 2f8ceb936a7..e2bf001ffdf 100644 --- a/mobile/src/session/mobile-native-chat-open-file.test.ts +++ b/mobile/src/session/mobile-native-chat-open-file.test.ts @@ -36,6 +36,7 @@ describe('resolveMobileNativeChatWorktreePath', () => { .mockResolvedValueOnce({ ok: true, result: { + worktree: 'sibling-worktree', exists: true, isDirectory: false, openTarget: { kind: 'worktree-file', relativePath: 'src/app.ts' } @@ -51,7 +52,7 @@ describe('resolveMobileNativeChatWorktreePath', () => { }) expect(sendRequest).toHaveBeenLastCalledWith('files.open', { - worktree: 'id:worktree', + worktree: 'id:sibling-worktree', relativePath: 'src/app.ts' }) }) diff --git a/mobile/src/session/mobile-native-chat-open-file.ts b/mobile/src/session/mobile-native-chat-open-file.ts index 44d6d23c066..6460c82849c 100644 --- a/mobile/src/session/mobile-native-chat-open-file.ts +++ b/mobile/src/session/mobile-native-chat-open-file.ts @@ -1,12 +1,17 @@ import type { RuntimeTerminalPathResolution } from '../../../src/shared/runtime-types' import type { RpcClient } from '../transport/rpc-client' -export async function resolveMobileNativeChatWorktreePath(args: { +type MobileNativeChatWorktreeTarget = { + worktreeId: string + relativePath: string +} + +async function resolveMobileNativeChatWorktreeTarget(args: { client: RpcClient worktreeId: string pathText: string terminal: string | null -}): Promise { +}): Promise { try { const response = await args.client.sendRequest('files.resolveTerminalPath', { worktree: `id:${args.worktreeId}`, @@ -20,28 +25,39 @@ export async function resolveMobileNativeChatWorktreePath(args: { if (!resolved.exists || resolved.isDirectory) { return null } - return resolved.openTarget?.kind === 'worktree-file' - ? resolved.openTarget.relativePath - : (resolved.relativePath ?? null) + const relativePath = + resolved.openTarget?.kind === 'worktree-file' + ? resolved.openTarget.relativePath + : (resolved.relativePath ?? null) + return relativePath + ? { worktreeId: resolved.worktree?.trim() || args.worktreeId, relativePath } + : null } catch { - // Callers fire-and-forget file opens; a disconnect/timeout must not become - // an unhandled rejection. return null } } +export async function resolveMobileNativeChatWorktreePath(args: { + client: RpcClient + worktreeId: string + pathText: string + terminal: string | null +}): Promise { + return (await resolveMobileNativeChatWorktreeTarget(args))?.relativePath ?? null +} + export async function openMobileNativeChatFile(args: { client: RpcClient worktreeId: string pathText: string terminal: string | null }): Promise { - const relativePath = await resolveMobileNativeChatWorktreePath(args) - if (relativePath) { + const target = await resolveMobileNativeChatWorktreeTarget(args) + if (target) { try { await args.client.sendRequest('files.open', { - worktree: `id:${args.worktreeId}`, - relativePath + worktree: `id:${target.worktreeId}`, + relativePath: target.relativePath }) } catch { // Best-effort open; failures surface as a no-op rather than an diff --git a/mobile/src/session/mobile-terminal-file-tap-open.test.ts b/mobile/src/session/mobile-terminal-file-tap-open.test.ts index fec1b5b663c..a958b977260 100644 --- a/mobile/src/session/mobile-terminal-file-tap-open.test.ts +++ b/mobile/src/session/mobile-terminal-file-tap-open.test.ts @@ -135,6 +135,56 @@ describe('openMobileTerminalFileTap', () => { expect(switchSessionTab).toHaveBeenCalledWith(openedTab) }) + it('opens a sibling terminal path through the resolved owning worktree', async () => { + const client = createClient([ + ok({ + worktree: 'wt-2', + relativePath: 'docs/readme.md', + absolutePath: '/repo-b/docs/readme.md', + exists: true, + isDirectory: false, + openTarget: { + kind: 'worktree-file', + provider: 'local', + relativePath: 'docs/readme.md', + absolutePath: '/repo-b/docs/readme.md' + } + }) + ]) + const pushPreviewRoute = vi.fn() + + openMobileTerminalFileTap({ + client, + hostId: 'host-1', + worktreeId: 'wt-1', + pathText: '/repo-b/docs/readme.md', + line: null, + column: null, + pushPreviewRoute, + openBrowser: vi.fn(), + triggerOpenFeedback: vi.fn(), + fetchSessionTabs: vi.fn(), + getSessionTabs: () => [], + getActiveSessionTabId: () => null, + getActivationState: activeTerminalState, + switchSessionTab: vi.fn(), + scheduleDelayedAction: vi.fn() + }) + await Promise.resolve() + await Promise.resolve() + + expect(pushPreviewRoute).toHaveBeenCalledWith({ + pathname: '/h/[hostId]/files/preview/[worktreeId]', + params: expect.objectContaining({ + hostId: 'host-1', + worktreeId: 'wt-2', + source: 'worktree', + relativePath: 'docs/readme.md' + }) + }) + expect(client.sendRequest).not.toHaveBeenCalledWith('files.open', expect.anything()) + }) + it('opens worktree-contained line references through the preview route', async () => { const client = createClient([ ok({ diff --git a/mobile/src/session/mobile-terminal-file-tap-open.ts b/mobile/src/session/mobile-terminal-file-tap-open.ts index 31a5c892d75..8d6e681b0f4 100644 --- a/mobile/src/session/mobile-terminal-file-tap-open.ts +++ b/mobile/src/session/mobile-terminal-file-tap-open.ts @@ -74,13 +74,17 @@ async function openMobileTerminalFileTapAsync) { function createRuntimeFileCommands(options?: { path?: string + hostId?: string openFile?: ReturnType openDiff?: ReturnType resolveRuntimeFileTarget?: ReturnType + resolveKnownWorkspaceFileTarget?: ReturnType resolveRuntimeGitTarget?: ReturnType resolveTerminalCwd?: ReturnType resolveTerminalContext?: ReturnType @@ -157,7 +159,8 @@ function createRuntimeFileCommands(options?: { const worktree = { id: 'wt-1', repoId: 'repo-1', - path + path, + ...(options?.hostId ? { hostId: options.hostId } : {}) } const commands = new RuntimeFileCommands({ getRuntimeId: () => 'runtime-1', @@ -169,6 +172,9 @@ function createRuntimeFileCommands(options?: { worktree, connectionId: store.getRepo(worktree.repoId)?.connectionId })), + ...(options?.resolveKnownWorkspaceFileTarget + ? { resolveKnownWorkspaceFileTarget: options.resolveKnownWorkspaceFileTarget } + : {}), resolveTerminalCwd: options?.resolveTerminalCwd ?? vi.fn(() => path), resolveTerminalContext: options?.resolveTerminalContext ?? @@ -882,6 +888,194 @@ describe('RuntimeFileCommands', () => { }) }) + it('resolves an absolute path through a known sibling workspace', async () => { + const sibling = { + id: 'wt-2', + repoId: 'repo-2', + path: '/sibling', + git: { + path: '/sibling', + head: '', + branch: '', + isBare: false, + isMainWorktree: true + } + } + const resolveKnownWorkspaceFileTarget = vi.fn(async () => ({ + worktree: sibling, + relativePath: 'docs/readme.md' + })) + const { commands } = createRuntimeFileCommands({ + path: '/repo', + resolveKnownWorkspaceFileTarget + }) + statAsFile() + + const result = await commands.resolveTerminalPath('id:wt-1', '/sibling/docs/readme.md') + + expect(resolveKnownWorkspaceFileTarget).toHaveBeenCalledWith( + '/sibling/docs/readme.md', + 'local' + ) + expect(result).toEqual({ + worktree: 'wt-2', + relativePath: 'docs/readme.md', + absolutePath: '/sibling/docs/readme.md', + exists: true, + isDirectory: false, + openTarget: { + kind: 'worktree-file', + provider: 'local', + relativePath: 'docs/readme.md', + absolutePath: '/sibling/docs/readme.md' + } + }) + }) + + it('resolves an exact local sibling workspace root as a directory without a grant', async () => { + const sibling = { + id: 'wt-2', + repoId: 'repo-2', + path: '/sibling', + git: { + path: '/sibling', + head: '', + branch: '', + isBare: false, + isMainWorktree: true + } + } + const resolveKnownWorkspaceFileTarget = vi.fn(async () => ({ + worktree: sibling, + relativePath: '' + })) + const hasRecentTerminalOutputPath = vi.fn(() => true) + const { commands } = createRuntimeFileCommands({ + path: '/repo', + resolveKnownWorkspaceFileTarget, + hasRecentTerminalOutputPath + }) + resolveAuthorizedPathMock.mockImplementation(async (p: string) => p) + statMock.mockResolvedValue({ isDirectory: () => true }) + + const result = await resolveTerminalArtifactPath(commands, '/sibling') + + expect(resolveKnownWorkspaceFileTarget).toHaveBeenCalledWith('/sibling', 'local') + expect(result).toEqual({ + worktree: 'wt-2', + relativePath: '', + absolutePath: '/sibling', + exists: true, + isDirectory: true, + openTarget: undefined + }) + expect(hasRecentTerminalOutputPath).not.toHaveBeenCalled() + }) + + it('stats a sibling SSH workspace through its owning provider', async () => { + const sibling = { + id: 'wt-2', + repoId: 'repo-2', + path: '/sibling', + hostId: 'ssh:ssh-1', + git: { + path: '/sibling', + head: '', + branch: '', + isBare: false, + isMainWorktree: true + } + } + const resolveKnownWorkspaceFileTarget = vi.fn(async () => ({ + worktree: sibling, + connectionId: 'ssh-1', + relativePath: 'docs/readme.md' + })) + const { commands, store } = createRuntimeFileCommands({ + path: '/repo', + resolveKnownWorkspaceFileTarget + }) + store.getRepo.mockReturnValue({ connectionId: 'ssh-1' }) + const remoteStat = vi.fn().mockResolvedValue({ type: 'file', size: 12, mtime: 3 }) + vi.mocked(getSshFilesystemProvider).mockReturnValue({ stat: remoteStat } as never) + + const result = await commands.resolveTerminalPath('id:wt-1', '/sibling/docs/readme.md') + + expect(resolveKnownWorkspaceFileTarget).toHaveBeenCalledWith( + '/sibling/docs/readme.md', + 'ssh:ssh-1' + ) + expect(remoteStat).toHaveBeenCalledWith('/sibling/docs/readme.md') + expect(statMock).not.toHaveBeenCalled() + expect(result).toMatchObject({ + worktree: 'wt-2', + relativePath: 'docs/readme.md', + exists: true, + openTarget: { provider: 'ssh' } + }) + }) + + it('stats an exact SSH sibling root as a directory through its owning provider', async () => { + const sibling = { + id: 'wt-2', + repoId: 'repo-2', + path: '/sibling', + hostId: 'ssh:ssh-1', + git: { + path: '/sibling', + head: '', + branch: '', + isBare: false, + isMainWorktree: true + } + } + const resolveKnownWorkspaceFileTarget = vi.fn(async () => ({ + worktree: sibling, + connectionId: 'ssh-1', + relativePath: '' + })) + const hasRecentTerminalOutputPath = vi.fn(() => true) + const { commands, store } = createRuntimeFileCommands({ + path: '/repo', + resolveKnownWorkspaceFileTarget, + hasRecentTerminalOutputPath + }) + store.getRepo.mockReturnValue({ connectionId: 'ssh-1' }) + const remoteStat = vi.fn().mockResolvedValue({ type: 'directory', size: 0, mtime: 3 }) + vi.mocked(getSshFilesystemProvider).mockReturnValue({ stat: remoteStat } as never) + + const result = await resolveTerminalArtifactPath(commands, '/sibling') + + expect(resolveKnownWorkspaceFileTarget).toHaveBeenCalledWith('/sibling', 'ssh:ssh-1') + expect(remoteStat).toHaveBeenCalledWith('/sibling') + expect(statMock).not.toHaveBeenCalled() + expect(result).toEqual({ + worktree: 'wt-2', + relativePath: '', + absolutePath: '/sibling', + exists: true, + isDirectory: true, + openTarget: undefined + }) + expect(hasRecentTerminalOutputPath).not.toHaveBeenCalled() + }) + + it('scopes sibling lookup to the selected worktree execution host', async () => { + const resolveKnownWorkspaceFileTarget = vi.fn(async () => null) + const { commands } = createRuntimeFileCommands({ + path: '/repo-a', + hostId: 'runtime:env-a', + resolveKnownWorkspaceFileTarget + }) + + await commands.resolveTerminalPath('id:wt-1', '/repo-b/docs/readme.md') + + expect(resolveKnownWorkspaceFileTarget).toHaveBeenCalledWith( + '/repo-b/docs/readme.md', + 'runtime:env-a' + ) + }) + it('resolves a relative path against the provided cwd', async () => { const { commands } = createRuntimeFileCommands({ path: '/repo' }) statAsFile() @@ -950,14 +1144,44 @@ describe('RuntimeFileCommands', () => { expect(result).toMatchObject({ relativePath: 'docs/readme.md', exists: true }) }) - it('reports a directory', async () => { + it('reports directories including the workspace root', async () => { const { commands } = createRuntimeFileCommands({ path: '/repo' }) resolveAuthorizedPathMock.mockImplementation(async (p: string) => p) statMock.mockResolvedValue({ isDirectory: () => true }) - const result = await commands.resolveTerminalPath('id:wt-1', '/repo/src') + const nestedResult = await commands.resolveTerminalPath('id:wt-1', '/repo/src') + const rootResult = await commands.resolveTerminalPath('id:wt-1', '/repo') - expect(result).toMatchObject({ relativePath: 'src', isDirectory: true, exists: true }) + expect(nestedResult).toMatchObject({ relativePath: 'src', isDirectory: true, exists: true }) + expect(rootResult).toMatchObject({ + relativePath: '', + isDirectory: true, + exists: true, + openTarget: undefined + }) + }) + + it('keeps an exact selected nested root instead of resolving it to a parent workspace', async () => { + const resolveKnownWorkspaceFileTarget = vi.fn(async () => ({ + worktree: { id: 'wt-parent', repoId: 'repo-parent', path: '/repo' }, + relativePath: 'nested' + })) + const { commands } = createRuntimeFileCommands({ + path: '/repo/nested', + resolveKnownWorkspaceFileTarget + }) + resolveAuthorizedPathMock.mockImplementation(async (p: string) => p) + statMock.mockResolvedValue({ isDirectory: () => true }) + + const result = await commands.resolveTerminalPath('id:wt-1', '/repo/nested') + + expect(resolveKnownWorkspaceFileTarget).not.toHaveBeenCalled() + expect(result).toMatchObject({ + worktree: 'wt-1', + relativePath: '', + isDirectory: true, + openTarget: undefined + }) }) it('returns an absolute open target for an existing local temp path outside the worktree', async () => { diff --git a/src/main/runtime/orca-runtime-files.ts b/src/main/runtime/orca-runtime-files.ts index 1ea6769ff4c..08f18da2de0 100644 --- a/src/main/runtime/orca-runtime-files.ts +++ b/src/main/runtime/orca-runtime-files.ts @@ -87,7 +87,7 @@ import { } from './runtime-mobile-file-path-search' import { beginWatcherInstall } from '../ipc/watcher-removal-gate' import { assertSshMutationExpectation } from '../ssh/ssh-connection-generation' -import { toSshExecutionHostId } from '../../shared/execution-host' +import { toSshExecutionHostId, type ExecutionHostId } from '../../shared/execution-host' import { renameLocalPathSerializedByDestination } from '../destination-serialized-local-rename' const MOBILE_FILE_LIST_LIMIT = 5000 @@ -490,11 +490,24 @@ export type ResolvedRuntimeFileTarget = { connectionId?: string } +export function getRuntimeFileTargetExecutionHostId( + target: ResolvedRuntimeFileTarget +): ExecutionHostId { + return ( + target.worktree.hostId ?? + (target.connectionId ? toSshExecutionHostId(target.connectionId) : 'local') + ) +} + export type RuntimeFileCommandHost = { getRuntimeId(): string requireStore(): Store resolveWorktreeSelector(selector: string): Promise resolveRuntimeFileTarget(selector: string): Promise + resolveKnownWorkspaceFileTarget?( + absolutePath: string, + executionHostId: ExecutionHostId + ): Promise<(ResolvedRuntimeFileTarget & { relativePath: string }) | null> resolveTerminalCwd?(terminalHandle: string): string | null | Promise resolveTerminalContext?( terminalHandle: string @@ -744,15 +757,28 @@ export class RuntimeFileCommands { terminalFileUriHostname }) const relativePath = relativePathInsideRoot(worktree.path, absolutePath) + const knownWorkspaceTarget = + relativePath === null + ? await this.host.resolveKnownWorkspaceFileTarget?.( + absolutePath, + getRuntimeFileTargetExecutionHostId(target) + ) + : null + const ownedWorktree = knownWorkspaceTarget?.worktree ?? worktree + const ownedConnectionId = knownWorkspaceTarget?.connectionId ?? connectionId + const ownedRelativePath = knownWorkspaceTarget?.relativePath ?? relativePath try { - if (relativePath !== null && relativePath !== '' && isSafeMobileRelativePath(relativePath)) { - const stats = connectionId - ? await this.statRemoteTerminalPath(absolutePath, connectionId) + if ( + ownedRelativePath !== null && + (ownedRelativePath === '' || isSafeMobileRelativePath(ownedRelativePath)) + ) { + const stats = ownedConnectionId + ? await this.statRemoteTerminalPath(absolutePath, ownedConnectionId) : await stat(await resolveAuthorizedPath(absolutePath, store)) return { - worktree: worktree.id, - relativePath, + worktree: ownedWorktree.id, + relativePath: ownedRelativePath, absolutePath, exists: true, isDirectory: stats.isDirectory(), @@ -760,8 +786,8 @@ export class RuntimeFileCommands { ? undefined : { kind: 'worktree-file', - provider: connectionId ? 'ssh' : 'local', - relativePath, + provider: ownedConnectionId ? 'ssh' : 'local', + relativePath: ownedRelativePath, absolutePath } } @@ -832,9 +858,14 @@ export class RuntimeFileCommands { // Report genuine not-found as missing; let transport/permission errors surface so remote taps aren't all reported missing. if ( isENOENT(error) || - (connectionId && RuntimeFileCommands.isRemoteNotFoundErrorMessage(error)) + (ownedConnectionId && RuntimeFileCommands.isRemoteNotFoundErrorMessage(error)) ) { - return { ...empty, relativePath, absolutePath } + return { + ...empty, + worktree: ownedWorktree.id, + relativePath: ownedRelativePath, + absolutePath + } } throw error } diff --git a/src/main/runtime/orca-runtime.ts b/src/main/runtime/orca-runtime.ts index c94d222de37..088f52d5b26 100644 --- a/src/main/runtime/orca-runtime.ts +++ b/src/main/runtime/orca-runtime.ts @@ -425,6 +425,7 @@ import { isPathInsideOrEqual, normalizeRuntimePathForComparison } from '../../shared/cross-platform-path' +import { findRuntimeWorkspaceFileOwner } from '../../shared/runtime-workspace-file-owner' import { resolveTerminalStartupCwd } from '../../shared/terminal-startup-cwd' import { isWslUncPath, parseWslUncPath } from '../../shared/wsl-paths' import { @@ -515,7 +516,7 @@ import { } from './workspace-session-terminal-membership-authority' import { RuntimeEmulatorCommands } from './orca-runtime-emulator' import type { EmulatorBridge } from '../emulator/emulator-bridge' -import { RuntimeFileCommands } from './orca-runtime-files' +import { getRuntimeFileTargetExecutionHostId, RuntimeFileCommands } from './orca-runtime-files' import { RuntimeGitCommands } from './orca-runtime-git' import { activateClientSessionTabSelection, @@ -8542,6 +8543,8 @@ export class OrcaRuntimeService { requireStore: () => this.requireStore(), resolveWorktreeSelector: (selector) => this.resolveWorktreeSelector(selector), resolveRuntimeFileTarget: (selector) => this.resolveRuntimeFileTarget(selector), + resolveKnownWorkspaceFileTarget: (absolutePath, connectionId) => + this.resolveKnownWorkspaceFileTarget(absolutePath, connectionId), resolveTerminalCwd: (terminalHandle) => this.resolveTerminalCwd(terminalHandle), resolveTerminalContext: (terminalHandle) => this.resolveTerminalContext(terminalHandle), resolveTerminalFileUriHostname: (terminalHandle) => @@ -8859,6 +8862,72 @@ export class OrcaRuntimeService { return { worktree, connectionId: repo?.connectionId ?? undefined } } + private async resolveKnownWorkspaceFileTarget( + absolutePath: string, + executionHostId: ExecutionHostId + ): Promise<{ + worktree: ResolvedWorktree + connectionId?: string + relativePath: string + } | null> { + const targets = new Map< + string, + { + worktree: ResolvedWorktree + connectionId?: string + executionHostId: ExecutionHostId + } + >() + for (const worktree of await this.listResolvedWorktrees()) { + if (!this.isRuntimeWorktreeVisible(worktree)) { + continue + } + const candidateConnectionId = this.store?.getRepo(worktree.repoId)?.connectionId ?? undefined + const target = { + worktree, + executionHostId: getRuntimeFileTargetExecutionHostId({ + worktree, + connectionId: candidateConnectionId + }), + ...(candidateConnectionId ? { connectionId: candidateConnectionId } : {}) + } + targets.set(`${target.executionHostId}\0${worktree.id}`, target) + } + for (const folderWorkspace of this.store?.getFolderWorkspaces?.() ?? []) { + try { + const candidateConnectionId = + this.resolveFolderWorkspaceConnectionId(folderWorkspace) ?? undefined + const worktree = this.folderWorkspaceToResolvedWorktree(folderWorkspace) + const target = { + worktree, + executionHostId: getRuntimeFileTargetExecutionHostId({ + worktree, + connectionId: candidateConnectionId + }), + ...(candidateConnectionId ? { connectionId: candidateConnectionId } : {}) + } + targets.set(`${target.executionHostId}\0${worktree.id}`, target) + } catch { + // An ambiguous folder workspace has no single filesystem authority. + } + } + + const owner = findRuntimeWorkspaceFileOwner( + [...targets.values()].map((target) => ({ + workspaceId: target.worktree.id, + rootPath: target.worktree.path, + executionHostId: target.executionHostId + })), + absolutePath, + executionHostId + ) + if (!owner) { + return null + } + const target = targets.get(`${owner.executionHostId}\0${owner.workspaceId}`) + return target ? { ...target, relativePath: owner.relativePath } : null + } + onMobileSessionTabsChanged( listener: (snapshot: RuntimeMobileSessionTabsResult) => void, clientNavigationId?: string diff --git a/src/renderer/src/components/editor/editor-autosave-controller.test.ts b/src/renderer/src/components/editor/editor-autosave-controller.test.ts index 5020bf5e8f8..78e83706e52 100644 --- a/src/renderer/src/components/editor/editor-autosave-controller.test.ts +++ b/src/renderer/src/components/editor/editor-autosave-controller.test.ts @@ -511,6 +511,53 @@ describe('attachEditorAutosaveController', () => { } }) + it('drops an autosave already queued when owner migration starts', async () => { + let releaseFirstWrite!: () => void + const firstWrite = new Promise((resolve) => { + releaseFirstWrite = resolve + }) + const writeFile = vi.fn().mockReturnValueOnce(firstWrite).mockResolvedValue(undefined) + const eventTarget = new EventTarget() + vi.stubGlobal('window', { + addEventListener: eventTarget.addEventListener.bind(eventTarget), + removeEventListener: eventTarget.removeEventListener.bind(eventTarget), + dispatchEvent: eventTarget.dispatchEvent.bind(eventTarget), + setTimeout: globalThis.setTimeout.bind(globalThis), + clearTimeout: globalThis.clearTimeout.bind(globalThis), + api: { fs: { writeFile } } + } satisfies WindowStub) + + const store = createEditorStore() + store.getState().openFile({ + filePath: '/repo/file.ts', + relativePath: 'file.ts', + worktreeId: 'wt-1', + language: 'typescript', + mode: 'edit' + }) + const cleanup = attachEditorAutosaveController(store) + try { + store.getState().setEditorDraft('/repo/file.ts', 'first autosave') + store.getState().markFileDirty('/repo/file.ts', true) + await vi.advanceTimersByTimeAsync(1000) + expect(writeFile).toHaveBeenCalledTimes(1) + + store.getState().setEditorDraft('/repo/file.ts', 'queued autosave') + store.getState().markFileDirty('/repo/file.ts', true) + await vi.advanceTimersByTimeAsync(1000) + store.getState().setRestoredEditorOwnerMigrationPending('/repo/file.ts', true) + releaseFirstWrite() + for (let index = 0; index < 6; index += 1) { + await Promise.resolve() + } + + expect(writeFile).toHaveBeenCalledTimes(1) + expect(store.getState().editorDrafts['/repo/file.ts']).toBe('queued autosave') + } finally { + cleanup() + } + }) + it('leaves dirty editor drafts ready for the combined hot-exit checkpoint', async () => { const writeFile = vi.fn().mockResolvedValue(undefined) const setSync = vi.fn() diff --git a/src/renderer/src/components/editor/editor-autosave-controller.ts b/src/renderer/src/components/editor/editor-autosave-controller.ts index 3326d93492d..271786a74c1 100644 --- a/src/renderer/src/components/editor/editor-autosave-controller.ts +++ b/src/renderer/src/components/editor/editor-autosave-controller.ts @@ -92,6 +92,13 @@ export function attachEditorAutosaveController(store: AppStoreApi): () => void { return } + if (liveFile.pendingOwnerMigration === true) { + if (trigger === 'autosave') { + return + } + throw new Error('This file is still restoring its workspace owner. Try saving again.') + } + // Why: only autosave is blocked while suspended; explicit user saves proceed (the banner warned). if (trigger === 'autosave' && isAutosaveSuspendedForFile(liveFile)) { return @@ -341,6 +348,10 @@ export function attachEditorAutosaveController(store: AppStoreApi): () => void { detail.resolve() return } + if (file.pendingOwnerMigration === true) { + detail.reject('This file is still restoring its workspace owner. Try saving again.') + return + } flushPendingEditorChange(file.id) diff --git a/src/renderer/src/components/editor/editor-autosave.ts b/src/renderer/src/components/editor/editor-autosave.ts index 01ac40151e5..efeda658724 100644 --- a/src/renderer/src/components/editor/editor-autosave.ts +++ b/src/renderer/src/components/editor/editor-autosave.ts @@ -89,13 +89,17 @@ export function canAutoSaveOpenFile(file: OpenFile): boolean { export function isAutosaveSuspendedForFile( file: Pick< OpenFile, - 'externalMutation' | 'pendingDiskBaselineVerification' | 'pendingLiveDiskVerification' + | 'externalMutation' + | 'pendingDiskBaselineVerification' + | 'pendingLiveDiskVerification' + | 'pendingOwnerMigration' > ): boolean { return ( file.externalMutation === 'changed' || file.pendingDiskBaselineVerification === true || - file.pendingLiveDiskVerification === true + file.pendingLiveDiskVerification === true || + file.pendingOwnerMigration === true ) } diff --git a/src/renderer/src/components/editor/migrate-restored-editor-file-owner.ts b/src/renderer/src/components/editor/migrate-restored-editor-file-owner.ts new file mode 100644 index 00000000000..86fbbfa63f1 --- /dev/null +++ b/src/renderer/src/components/editor/migrate-restored-editor-file-owner.ts @@ -0,0 +1,87 @@ +import { useAppStore } from '@/store' +import { + findWorkspaceFileRoute, + type RuntimeWorkspaceFileRoute +} from '@/lib/runtime-workspace-file-route' +import { + assertEditorFileOperationCurrent, + captureEditorFileOperationProvenance, + type EditorFileOperationProvenance +} from '@/lib/editor-file-operation-owner' +import { requestEditorSaveQuiesce } from './editor-autosave' +import type { RestoredEditorOwnerResult } from '@/store/slices/editor' + +export type RestoredEditorOwnerMigrationResult = RestoredEditorOwnerResult + +export async function migrateRestoredEditorFileOwner( + fileId: string, + route: RuntimeWorkspaceFileRoute, + runtimeEnvironmentId: string | null +): Promise { + const state = useAppStore.getState() + const source = state.openFiles.find((file) => file.id === fileId) + const initialRoute = source + ? findWorkspaceFileRoute(state, route.executionHostId, source.filePath) + : null + if (!source || !routesMatch(initialRoute, route)) { + return { ok: false, reason: 'stale' } + } + let targetOperationProvenance: EditorFileOperationProvenance + try { + targetOperationProvenance = captureEditorFileOperationProvenance( + state, + route.worktreeId, + runtimeEnvironmentId, + true + ) + } catch { + return { ok: false, reason: 'owner-changed' } + } + if (!state.setRestoredEditorOwnerMigrationPending(fileId, true)) { + return { ok: false, reason: 'stale' } + } + + try { + await requestEditorSaveQuiesce({ fileId }) + } catch (error) { + useAppStore.getState().setRestoredEditorOwnerMigrationPending(fileId, false) + throw error + } + const currentState = useAppStore.getState() + const currentSource = currentState.openFiles.find((file) => file.id === fileId) + const currentRoute = currentSource + ? findWorkspaceFileRoute(currentState, route.executionHostId, currentSource.filePath) + : null + try { + if ( + currentSource?.filePath !== source.filePath || + !routesMatch(currentRoute, route) || + assertEditorFileOperationCurrent(currentState, route.worktreeId, targetOperationProvenance) + .runtimeEnvironmentId !== runtimeEnvironmentId + ) { + throw new Error('stale route') + } + } catch { + currentState.setRestoredEditorOwnerMigrationPending(fileId, false) + return { ok: false, reason: 'owner-changed' } + } + return currentState.reparentRestoredEditorFileOwner({ + fileId, + targetWorktreeId: route.worktreeId, + targetRelativePath: route.relativePath, + targetExecutionHostId: route.executionHostId, + targetRuntimeEnvironmentId: runtimeEnvironmentId, + targetOperationProvenance + }) +} + +function routesMatch( + current: RuntimeWorkspaceFileRoute | null, + expected: RuntimeWorkspaceFileRoute +): boolean { + return ( + current?.worktreeId === expected.worktreeId && + current.relativePath === expected.relativePath && + current.executionHostId === expected.executionHostId + ) +} diff --git a/src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts b/src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts new file mode 100644 index 00000000000..1d5ccf262b3 --- /dev/null +++ b/src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts @@ -0,0 +1,287 @@ +// @vitest-environment happy-dom + +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import type * as RuntimeFileClient from '@/runtime/runtime-file-client' +import { useAppStore } from '@/store' +import type { AppState } from '@/store/types' +import { attachEditorAutosaveController } from './editor-autosave-controller' +import { requestEditorFileSave } from './editor-autosave' +import { migrateRestoredEditorFileOwner } from './migrate-restored-editor-file-owner' + +const mocks = vi.hoisted(() => ({ writeRuntimeFile: vi.fn() })) + +vi.mock('@/runtime/runtime-file-client', async (importOriginal) => ({ + ...(await importOriginal()), + writeRuntimeFile: mocks.writeRuntimeFile +})) + +const SOURCE = 'repo-a::/repo-a' +const TARGET = 'repo-b::/repo-b' +const FILE_PATH = '/repo-b/file.md' + +function deferred(): { promise: Promise; resolve: () => void } { + let resolve!: () => void + const promise = new Promise((done) => { + resolve = done + }) + return { promise, resolve } +} + +function seed(filePath = FILE_PATH): string { + useAppStore.setState(useAppStore.getInitialState(), true) + useAppStore.setState({ + activeWorktreeId: SOURCE, + settings: { editorAutoSave: true, editorAutoSaveDelayMs: 250 }, + repos: [ + { id: 'repo-a', path: '/repo-a', kind: 'git', executionHostId: 'local' }, + { id: 'repo-b', path: '/repo-b', kind: 'git', executionHostId: 'local' } + ], + worktreesByRepo: { + 'repo-a': [{ id: SOURCE, repoId: 'repo-a', path: '/repo-a', hostId: 'local', branch: '' }], + 'repo-b': [{ id: TARGET, repoId: 'repo-b', path: '/repo-b', hostId: 'local', branch: '' }] + }, + detectedWorktreesByRepo: {}, + runtimeEnvironments: [], + runtimeEnvironmentCatalogHydrated: true, + removedRuntimeEnvironmentIds: new Set(), + sshConnectionStates: new Map(), + sshStateByEnvironment: new Map() + } as unknown as Partial) + return useAppStore.getState().openFile( + { + filePath, + relativePath: filePath, + worktreeId: SOURCE, + runtimeEnvironmentId: null, + language: 'markdown', + mode: 'edit' + }, + { suppressActiveRuntimeFallback: true } + ) +} + +describe('restored editor owner save lifecycle', () => { + let detach: (() => void) | null = null + + beforeEach(() => { + vi.useFakeTimers() + mocks.writeRuntimeFile.mockReset() + }) + + afterEach(() => { + detach?.() + detach = null + vi.useRealTimers() + }) + + it('drains the old save before reparent, then routes explicit save and autosave to the destination', async () => { + const oldId = seed() + const firstWrite = deferred() + mocks.writeRuntimeFile.mockReturnValueOnce(firstWrite.promise).mockResolvedValue(undefined) + detach = attachEditorAutosaveController(useAppStore) + useAppStore.getState().setEditorDraft(oldId, 'source save') + useAppStore.getState().markFileDirty(oldId, true) + + const sourceSave = requestEditorFileSave({ fileId: oldId }) + await vi.waitFor(() => expect(mocks.writeRuntimeFile).toHaveBeenCalledTimes(1)) + const migration = migrateRestoredEditorFileOwner( + oldId, + { + worktreeId: TARGET, + relativePath: 'file.md', + executionHostId: 'local' + }, + null + ) + await Promise.resolve() + expect(useAppStore.getState().openFiles[0]?.pendingOwnerMigration).toBe(true) + expect(useAppStore.getState().openFiles[0]?.worktreeId).toBe(SOURCE) + await expect(requestEditorFileSave({ fileId: oldId })).rejects.toThrow( + 'still restoring its workspace owner' + ) + + firstWrite.resolve() + await sourceSave + const migrated = await migration + expect(migrated.ok).toBe(true) + if (!migrated.ok) { + return + } + expect(mocks.writeRuntimeFile.mock.calls[0]?.[0]).toMatchObject({ worktreeId: SOURCE }) + + useAppStore.getState().setEditorDraft(migrated.fileId, 'explicit destination save') + useAppStore.getState().markFileDirty(migrated.fileId, true) + await requestEditorFileSave({ fileId: migrated.fileId }) + expect(mocks.writeRuntimeFile.mock.calls[1]?.[0]).toMatchObject({ worktreeId: TARGET }) + + useAppStore.getState().setEditorDraft(migrated.fileId, 'autosave destination') + useAppStore.getState().markFileDirty(migrated.fileId, true) + await vi.advanceTimersByTimeAsync(250) + await vi.waitFor(() => expect(mocks.writeRuntimeFile).toHaveBeenCalledTimes(3)) + expect(mocks.writeRuntimeFile.mock.calls[2]?.[0]).toMatchObject({ worktreeId: TARGET }) + expect(mocks.writeRuntimeFile.mock.calls[2]?.[2]).toBe('autosave destination') + }) + + it('rejects a concurrent migration without clearing the active migration gate', async () => { + const oldId = seed() + const firstWrite = deferred() + mocks.writeRuntimeFile.mockReturnValueOnce(firstWrite.promise) + detach = attachEditorAutosaveController(useAppStore) + useAppStore.getState().setEditorDraft(oldId, 'source save') + useAppStore.getState().markFileDirty(oldId, true) + + const sourceSave = requestEditorFileSave({ fileId: oldId }) + await vi.waitFor(() => expect(mocks.writeRuntimeFile).toHaveBeenCalledTimes(1)) + const route = { worktreeId: TARGET, relativePath: 'file.md', executionHostId: 'local' as const } + const firstMigration = migrateRestoredEditorFileOwner(oldId, route, null) + await Promise.resolve() + expect(useAppStore.getState().openFiles[0]?.pendingOwnerMigration).toBe(true) + + await expect(migrateRestoredEditorFileOwner(oldId, route, null)).resolves.toEqual({ + ok: false, + reason: 'stale' + }) + expect(useAppStore.getState().openFiles[0]?.pendingOwnerMigration).toBe(true) + + firstWrite.resolve() + await sourceSave + await expect(firstMigration).resolves.toMatchObject({ ok: true }) + }) + + it('fails closed when the sibling workspace disappears during save quiescence', async () => { + const oldId = seed() + const firstWrite = deferred() + mocks.writeRuntimeFile.mockReturnValueOnce(firstWrite.promise) + detach = attachEditorAutosaveController(useAppStore) + useAppStore.getState().setEditorDraft(oldId, 'source save') + useAppStore.getState().markFileDirty(oldId, true) + + const sourceSave = requestEditorFileSave({ fileId: oldId }) + await vi.waitFor(() => expect(mocks.writeRuntimeFile).toHaveBeenCalledTimes(1)) + const migration = migrateRestoredEditorFileOwner( + oldId, + { worktreeId: TARGET, relativePath: 'file.md', executionHostId: 'local' }, + null + ) + await Promise.resolve() + useAppStore.setState((state) => ({ + worktreesByRepo: { ...state.worktreesByRepo, 'repo-b': [] } + })) + + firstWrite.resolve() + await sourceSave + await expect(migration).resolves.toEqual({ ok: false, reason: 'owner-changed' }) + expect(useAppStore.getState().openFiles[0]).toMatchObject({ + id: oldId, + worktreeId: SOURCE + }) + expect(useAppStore.getState().openFiles[0]?.pendingOwnerMigration).toBeUndefined() + }) + + it('fails closed when a folder root changes during save quiescence', async () => { + const oldId = seed('/notes/todo.md') + useAppStore.setState({ + folderWorkspaces: [ + { + id: 'notes', + projectGroupId: 'notes-group', + folderPath: '/notes', + connectionId: null, + executionHostId: 'local' + } + ], + projectGroups: [{ id: 'notes-group', name: 'Notes', executionHostId: 'local' }] + } as unknown as Partial) + const firstWrite = deferred() + mocks.writeRuntimeFile.mockReturnValueOnce(firstWrite.promise) + detach = attachEditorAutosaveController(useAppStore) + useAppStore.getState().setEditorDraft(oldId, 'source save') + useAppStore.getState().markFileDirty(oldId, true) + + const sourceSave = requestEditorFileSave({ fileId: oldId }) + await vi.waitFor(() => expect(mocks.writeRuntimeFile).toHaveBeenCalledTimes(1)) + const migration = migrateRestoredEditorFileOwner( + oldId, + { worktreeId: 'folder:notes', relativePath: 'todo.md', executionHostId: 'local' }, + null + ) + await Promise.resolve() + useAppStore.setState((state) => ({ + folderWorkspaces: state.folderWorkspaces.map((workspace) => ({ + ...workspace, + folderPath: '/renamed-notes' + })) + })) + + firstWrite.resolve() + await sourceSave + await expect(migration).resolves.toEqual({ ok: false, reason: 'owner-changed' }) + expect(useAppStore.getState().openFiles[0]).toMatchObject({ + id: oldId, + worktreeId: SOURCE + }) + expect(useAppStore.getState().openFiles[0]?.pendingOwnerMigration).toBeUndefined() + }) + + it('fails closed when direct-SSH authority reconnects during save quiescence', async () => { + const oldId = seed() + useAppStore.setState((state) => ({ + repos: state.repos.map((repo) => + repo.id === 'repo-b' + ? { ...repo, connectionId: 'ssh-1', executionHostId: 'ssh:ssh-1' } + : repo + ), + worktreesByRepo: { + ...state.worktreesByRepo, + 'repo-b': state.worktreesByRepo['repo-b'].map((worktree) => ({ + ...worktree, + hostId: 'ssh:ssh-1' + })) + } + })) + useAppStore.getState().setSshConnectionState('ssh-1', { + targetId: 'ssh-1', + status: 'connected', + error: null, + reconnectAttempt: 0, + connectionGeneration: 1 + }) + const firstWrite = deferred() + mocks.writeRuntimeFile.mockReturnValueOnce(firstWrite.promise) + detach = attachEditorAutosaveController(useAppStore) + useAppStore.getState().setEditorDraft(oldId, 'source save') + useAppStore.getState().markFileDirty(oldId, true) + + const sourceSave = requestEditorFileSave({ fileId: oldId }) + await vi.waitFor(() => expect(mocks.writeRuntimeFile).toHaveBeenCalledTimes(1)) + const migration = migrateRestoredEditorFileOwner( + oldId, + { worktreeId: TARGET, relativePath: 'file.md', executionHostId: 'ssh:ssh-1' }, + null + ) + await Promise.resolve() + useAppStore.getState().setSshConnectionState('ssh-1', { + targetId: 'ssh-1', + status: 'disconnected', + error: null, + reconnectAttempt: 0, + connectionGeneration: 1 + }) + useAppStore.getState().setSshConnectionState('ssh-1', { + targetId: 'ssh-1', + status: 'connected', + error: null, + reconnectAttempt: 0, + connectionGeneration: 2 + }) + + firstWrite.resolve() + await sourceSave + await expect(migration).resolves.toEqual({ ok: false, reason: 'owner-changed' }) + expect(useAppStore.getState().openFiles[0]).toMatchObject({ + id: oldId, + worktreeId: SOURCE + }) + expect(useAppStore.getState().openFiles[0]?.pendingOwnerMigration).toBeUndefined() + }) +}) diff --git a/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx index 3920caa89a8..3a5ed862d8e 100644 --- a/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx +++ b/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx @@ -41,6 +41,10 @@ vi.mock('@/lib/connection-context', () => ({ isWorktreeConnectionResolved: mocks.isWorktreeConnectionResolved })) +vi.mock('@/lib/runtime-workspace-file-route', () => ({ + findWorkspaceFileRoute: vi.fn(() => null) +})) + vi.mock('@/store', () => ({ useAppStore: { getState: mocks.getState diff --git a/src/renderer/src/components/editor/useEditorPanelContentState.ts b/src/renderer/src/components/editor/useEditorPanelContentState.ts index d7c62b6e6ed..f9cda5dc753 100644 --- a/src/renderer/src/components/editor/useEditorPanelContentState.ts +++ b/src/renderer/src/components/editor/useEditorPanelContentState.ts @@ -9,6 +9,12 @@ import { useAppStore } from '@/store' import { getDiskBaselineSignature } from './diff-content-signature' import { getRuntimeFileReadScope, readRuntimeFileContent } from '@/runtime/runtime-file-client' import { settingsForRuntimeOwner } from '@/runtime/runtime-rpc-client' +import { findWorkspaceFileRoute } from '@/lib/runtime-workspace-file-route' +import { + LOCAL_EXECUTION_HOST_ID, + toRuntimeExecutionHostId, + toSshExecutionHostId +} from '../../../../shared/execution-host' import { getRuntimeGitBranchDiff, getRuntimeGitCommitDiff, @@ -31,6 +37,7 @@ import { } from './useEditorPanelExternalContentEvents' import { useEditorPanelFileLoadRetry } from './useEditorPanelFileLoadRetry' import { useLocalLogTail } from './useLocalLogTail' +import { migrateRestoredEditorFileOwner } from './migrate-restored-editor-file-owner' const inFlightFileReads = new Map>() const inFlightDiffReads = new Map>() @@ -143,6 +150,8 @@ export function useEditorPanelContentState({ const isLiveTailLogTab = restoredOpenFile?.readOnly === true && restoredOpenFile.liveTail === true let readConnectionId = connectionId + let readWorktreeId = worktreeId + let readRelativePath = restoredOpenFile?.relativePath ?? relativePath if ( resolvedConnectionId === undefined && !readSettings?.activeRuntimeEnvironmentId?.trim() && @@ -160,18 +169,52 @@ export function useEditorPanelContentState({ const externalSshOwnerId = restoredOpenFile.externalSshTargetId?.trim() || (isLiveTailLogTab ? undefined : connectionId) - if (!externalSshOwnerId && readSettings?.activeRuntimeEnvironmentId?.trim()) { - // Why: runtime file RPCs are worktree-scoped, so a client-local absolute - // path has no route into a remote runtime workspace. - throw new Error('External local files are not available for remote workspaces.') - } - if (!externalSshOwnerId) { - // Why: client-local external tabs need their main-process path grant - // refreshed because that authorization is only held in memory. + const runtimeEnvironmentId = isLiveTailLogTab + ? undefined + : readSettings?.activeRuntimeEnvironmentId?.trim() + if (isLiveTailLogTab) { await window.api.fs.authorizeExternalPath({ targetPath: filePath }) - // Why: that grant covers the client path, so this read must stay off the - // worktree's SSH host. readConnectionId = undefined + } else { + const currentState = useAppStore.getState() + const executionHostId = externalSshOwnerId + ? toSshExecutionHostId(externalSshOwnerId) + : runtimeEnvironmentId + ? toRuntimeExecutionHostId(runtimeEnvironmentId) + : LOCAL_EXECUTION_HOST_ID + const route = findWorkspaceFileRoute(currentState, executionHostId, filePath) + if (route && route.worktreeId !== worktreeId) { + const migration = await migrateRestoredEditorFileOwner( + id, + route, + runtimeEnvironmentId ?? null + ) + fileReadGenerationRef.current[id] = ++fileReadGenerationCounterRef.current + if (!migration.ok) { + throw new Error( + migration.reason === 'collision' + ? 'The sibling file is already open; close one tab before restoring it.' + : 'The sibling file owner changed while the tab was restoring.' + ) + } + setFileContents((prev) => { + const next = { ...prev } + delete next[id] + return next + }) + return + } + if (runtimeEnvironmentId && !route) { + throw new Error('External local files are not available for remote workspaces.') + } + if (!externalSshOwnerId) { + // Why: client-local external tabs need their main-process path grant + // refreshed because that authorization is only held in memory. + await window.api.fs.authorizeExternalPath({ targetPath: filePath }) + // Why: that grant covers the client path, so this read must stay off the + // worktree's SSH host. + readConnectionId = undefined + } } } const readScope = getRuntimeFileReadScope(readSettings, readConnectionId) @@ -186,8 +229,8 @@ export function useEditorPanelContentState({ pending = readRuntimeFileContent({ settings: readSettings, filePath, - relativePath: restoredOpenFile?.relativePath ?? relativePath, - worktreeId, + relativePath: readRelativePath, + worktreeId: readWorktreeId, connectionId: readConnectionId, expectedExternalSshTargetId: restoredOpenFile?.externalSshTargetId, includeLocalLogMetadata: isLiveTailLogTab diff --git a/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx new file mode 100644 index 00000000000..4576b137432 --- /dev/null +++ b/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx @@ -0,0 +1,168 @@ +// @vitest-environment happy-dom + +import { act } from 'react' +import { createRoot, type Root } from 'react-dom/client' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import type { OpenFile } from '@/store/slices/editor' +import type { FileContent } from './editor-panel-content-types' + +const mocks = vi.hoisted(() => ({ + readRuntimeFileContent: vi.fn(), + findWorkspaceFileRoute: vi.fn(), + migrateRestoredEditorFileOwner: vi.fn(), + getState: vi.fn() +})) + +vi.mock('@/runtime/runtime-file-client', () => ({ + getRuntimeFileReadScope: vi.fn( + ( + settings: { activeRuntimeEnvironmentId?: string | null } | null | undefined, + connectionId?: string + ) => connectionId ?? settings?.activeRuntimeEnvironmentId ?? null + ), + readRuntimeFileContent: mocks.readRuntimeFileContent, + subscribeRuntimeFileChanges: vi.fn() +})) + +vi.mock('@/runtime/runtime-git-client', () => ({ + getRuntimeGitBranchDiff: vi.fn(), + getRuntimeGitCommitDiff: vi.fn(), + getRuntimeGitDiff: vi.fn(), + getRuntimeGitScope: vi.fn(() => null) +})) + +vi.mock('@/lib/connection-context', () => ({ + getConnectionId: vi.fn(), + getConnectionIdForFile: vi.fn(), + isWorktreeConnectionResolved: vi.fn(() => true) +})) + +vi.mock('@/lib/runtime-workspace-file-route', () => ({ + findWorkspaceFileRoute: mocks.findWorkspaceFileRoute +})) + +vi.mock('./migrate-restored-editor-file-owner', () => ({ + migrateRestoredEditorFileOwner: mocks.migrateRestoredEditorFileOwner +})) + +vi.mock('@/lib/worktree-runtime-owner', () => ({ + getExecutionHostIdForWorktree: vi.fn(() => 'local') +})) + +vi.mock('@/store', () => ({ useAppStore: { getState: mocks.getState } })) + +vi.mock('./useEditorPanelExternalContentEvents', () => ({ + useEditorPanelExternalContentEvents: vi.fn(), + usePruneClosedEditorContent: vi.fn() +})) + +vi.mock('./useEditorPanelFileLoadRetry', () => ({ useEditorPanelFileLoadRetry: vi.fn() })) +vi.mock('./useLocalLogTail', () => ({ useLocalLogTail: vi.fn() })) + +import { useEditorPanelContentState } from './useEditorPanelContentState' + +const authorizeExternalPath = vi.fn() +let latestFileContents: Record = {} + +function createOpenFile(overrides: Partial): OpenFile { + return { + id: '/repo/file.ts', + filePath: '/repo/file.ts', + relativePath: 'file.ts', + worktreeId: 'wt-1', + language: 'typescript', + isDirty: false, + mode: 'edit', + ...overrides + } +} + +function HookProbe({ activeFile }: { activeFile: OpenFile }): null { + latestFileContents = useEditorPanelContentState({ + activeFile, + isChangesMode: false, + openFiles: [activeFile], + gitStatusEntries: undefined, + editorViewMode: {} + }).fileContents + return null +} + +describe('remote sibling editor content routing', () => { + let container: HTMLDivElement | null = null + let root: Root | null = null + + beforeEach(() => { + latestFileContents = {} + authorizeExternalPath.mockReset() + authorizeExternalPath.mockResolvedValue(undefined) + ;(window as unknown as { api: unknown }).api = { fs: { authorizeExternalPath } } + mocks.readRuntimeFileContent.mockReset() + mocks.findWorkspaceFileRoute.mockReset() + mocks.findWorkspaceFileRoute.mockReturnValue(null) + mocks.migrateRestoredEditorFileOwner.mockReset() + mocks.migrateRestoredEditorFileOwner.mockResolvedValue({ ok: true, fileId: 'owned-file' }) + mocks.getState.mockReset() + mocks.getState.mockReturnValue({ + settings: { activeRuntimeEnvironmentId: 'runtime-1' }, + openFiles: [], + setLastKnownDiskSignature: vi.fn() + }) + container = document.body.appendChild(document.createElement('div')) + root = createRoot(container) + }) + + afterEach(() => { + act(() => root?.unmount()) + container?.remove() + }) + + it('keeps a client-local live-tail log on the client', async () => { + const logPath = '/Users/me/.codex/sessions/session.jsonl' + const activeFile = createOpenFile({ + id: logPath, + filePath: logPath, + relativePath: logPath, + worktreeId: 'repo-runtime::/work/demo-project', + readOnly: true, + liveTail: true + }) + mocks.readRuntimeFileContent.mockResolvedValue({ content: 'log line', isBinary: false }) + + await act(async () => root?.render()) + + await vi.waitFor(() => expect(latestFileContents[activeFile.id]?.content).toBe('log line')) + expect(mocks.findWorkspaceFileRoute).not.toHaveBeenCalled() + expect(authorizeExternalPath).toHaveBeenCalledWith({ targetPath: logPath }) + expect(mocks.readRuntimeFileContent).toHaveBeenCalledWith( + expect.objectContaining({ connectionId: undefined, includeLocalLogMetadata: true }) + ) + }) + + it('atomically reparents an unstamped sibling file before reading', async () => { + const activeFile = createOpenFile({ + id: '/work/repo-b/docs/readme.md', + filePath: '/work/repo-b/docs/readme.md', + relativePath: '/work/repo-b/docs/readme.md', + worktreeId: 'repo-a::/work/repo-a' + }) + const route = { + worktreeId: 'repo-b::/work/repo-b', + relativePath: 'docs/readme.md', + executionHostId: 'runtime:runtime-1' + } as const + mocks.findWorkspaceFileRoute.mockReturnValue(route) + + await act(async () => root?.render()) + + await vi.waitFor(() => + expect(mocks.migrateRestoredEditorFileOwner).toHaveBeenCalledWith( + activeFile.id, + route, + 'runtime-1' + ) + ) + expect(authorizeExternalPath).not.toHaveBeenCalled() + expect(mocks.readRuntimeFileContent).not.toHaveBeenCalled() + }) +}) diff --git a/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts b/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts index 1e5f5e45e35..b2367e33721 100644 --- a/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts +++ b/src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts @@ -73,6 +73,8 @@ describe('getEditorExternalWatchTargets', () => { rightSidebarExplorerView: args.rightSidebarExplorerView ?? 'files', gitStatusHugeByWorktree: args.gitStatusHugeByWorktree ?? {}, sshConnectionStates: args.sshConnectionStates ?? new Map(), + folderWorkspaces: [], + projectGroups: [], settings: args.runtimeEnvironmentId === undefined ? null diff --git a/src/renderer/src/hooks/useEditorExternalWatch.ts b/src/renderer/src/hooks/useEditorExternalWatch.ts index 6ac41b3b6be..1b4ff62a44d 100644 --- a/src/renderer/src/hooks/useEditorExternalWatch.ts +++ b/src/renderer/src/hooks/useEditorExternalWatch.ts @@ -32,6 +32,8 @@ import { import { isGitRepoKind } from '../../../shared/repo-kind' import { markFileChangedOnDisk } from '@/components/editor/editor-changed-on-disk-mark' import { getDiskBaselineSignature } from '@/components/editor/diff-content-signature' +import { parseWorkspaceKey } from '../../../shared/workspace-scope' +import { getFolderWorkspaceConnectionId } from '@/lib/folder-workspace-connection' // Why: atomic writes burst same-path events; one reload dispatch each fans out into N EditorPanel rebuilds that can wedge the renderer (issue #826), so debounce per (worktreeId+path). const EXTERNAL_RELOAD_DEBOUNCE_MS = 75 @@ -95,6 +97,8 @@ export type EditorExternalWatchTargetState = Pick< | 'rightSidebarExplorerView' | 'gitStatusHugeByWorktree' | 'sshConnectionStates' + | 'folderWorkspaces' + | 'projectGroups' > let cachedOpenFiles: AppState['openFiles'] | null = null @@ -107,6 +111,8 @@ let cachedRightSidebarTab: AppState['rightSidebarTab'] | null = null let cachedRightSidebarExplorerView: AppState['rightSidebarExplorerView'] | null = null let cachedGitStatusHugeByWorktree: AppState['gitStatusHugeByWorktree'] | null = null let cachedSshConnectionStates: AppState['sshConnectionStates'] | null = null +let cachedFolderWorkspaces: AppState['folderWorkspaces'] | null = null +let cachedProjectGroups: AppState['projectGroups'] | null = null let cachedWatchedTargetsSnapshot: WatchedTargetsSnapshot = { targets: [], targetsKey: '' } export function getWatchedTargetKey(target: WatchedTarget): string { @@ -132,7 +138,9 @@ export function getEditorExternalWatchTargets( cachedRightSidebarTab === state.rightSidebarTab && cachedRightSidebarExplorerView === state.rightSidebarExplorerView && cachedGitStatusHugeByWorktree === state.gitStatusHugeByWorktree && - cachedSshConnectionStates === state.sshConnectionStates + cachedSshConnectionStates === state.sshConnectionStates && + cachedFolderWorkspaces === state.folderWorkspaces && + cachedProjectGroups === state.projectGroups ) { return cachedWatchedTargetsSnapshot } @@ -183,18 +191,31 @@ export function getEditorExternalWatchTargets( const sortedWorktreeIds = Array.from(targetOwnersByWorktreeId.keys()).sort() for (const id of sortedWorktreeIds) { const wt = findWorktreeById(state.worktreesByRepo, id) - if (!wt) { + const workspaceScope = parseWorkspaceKey(id) + const folderWorkspace = + workspaceScope?.type === 'folder' + ? state.folderWorkspaces.find( + (workspace) => workspace.id === workspaceScope.folderWorkspaceId + ) + : undefined + if (!wt && !folderWorkspace) { + continue + } + const repo = wt ? state.repos.find((r) => r.id === wt.repoId) : undefined + const connectionId = folderWorkspace + ? getFolderWorkspaceConnectionId(state, folderWorkspace.id) + : repo?.connectionId + if (connectionId === undefined && folderWorkspace) { continue } - const repo = state.repos.find((r) => r.id === wt.repoId) const owners = Array.from(targetOwnersByWorktreeId.get(id) ?? []).sort((a, b) => (a ?? '').localeCompare(b ?? '') ) for (const owner of owners) { const target = { worktreeId: id, - worktreePath: wt.path, - connectionId: repo?.connectionId ?? undefined, + worktreePath: wt?.path ?? folderWorkspace!.folderPath, + connectionId: connectionId ?? undefined, runtimeEnvironmentId: owner } nextTargets.push(target) @@ -213,6 +234,8 @@ export function getEditorExternalWatchTargets( cachedRightSidebarExplorerView = state.rightSidebarExplorerView cachedGitStatusHugeByWorktree = state.gitStatusHugeByWorktree cachedSshConnectionStates = state.sshConnectionStates + cachedFolderWorkspaces = state.folderWorkspaces + cachedProjectGroups = state.projectGroups if (targetsKey === cachedWatchedTargetsSnapshot.targetsKey) { return cachedWatchedTargetsSnapshot diff --git a/src/renderer/src/lib/runtime-workspace-file-route.test.ts b/src/renderer/src/lib/runtime-workspace-file-route.test.ts new file mode 100644 index 00000000000..74f36c81cbb --- /dev/null +++ b/src/renderer/src/lib/runtime-workspace-file-route.test.ts @@ -0,0 +1,114 @@ +import { describe, expect, it } from 'vitest' +import type { AppState } from '@/store/types' +import { + findRuntimeWorkspaceFileRoute, + findWorkspaceFileRoute +} from './runtime-workspace-file-route' + +function state(): AppState { + return { + settings: { activeRuntimeEnvironmentId: 'runtime-a' }, + repos: [], + detectedWorktreesByRepo: {}, + worktreesByRepo: { + repoA: [ + { + id: 'repo-a::/srv/repo-a', + repoId: 'repo-a', + path: '/srv/repo-a', + runtimeOwnerEnvironmentId: 'runtime-a' + } + ], + repoB: [ + { + id: 'repo-b::/srv/repo-b', + repoId: 'repo-b', + path: '/srv/repo-b', + runtimeOwnerEnvironmentId: 'runtime-a' + }, + { + id: 'repo-b::/srv/repo-b/docs', + repoId: 'repo-b', + path: '/srv/repo-b/docs', + runtimeOwnerEnvironmentId: 'runtime-b' + } + ] + }, + folderWorkspaces: [ + { + id: 'notes', + projectGroupId: 'group-a', + folderPath: '/srv/notes', + connectionId: null + } + ], + projectGroups: [ + { + id: 'group-a', + connectionId: null, + executionHostId: 'runtime:runtime-a' + } + ] + } as unknown as AppState +} + +describe('findRuntimeWorkspaceFileRoute', () => { + it('routes a file through its sibling worktree on the same runtime', () => { + expect(findRuntimeWorkspaceFileRoute(state(), 'runtime-a', '/srv/repo-b/src/index.ts')).toEqual( + { + worktreeId: 'repo-b::/srv/repo-b', + relativePath: 'src/index.ts', + executionHostId: 'runtime:runtime-a' + } + ) + }) + + it('does not use a more specific workspace owned by another runtime', () => { + expect( + findRuntimeWorkspaceFileRoute(state(), 'runtime-a', '/srv/repo-b/docs/guide.md') + ).toEqual({ + worktreeId: 'repo-b::/srv/repo-b', + relativePath: 'docs/guide.md', + executionHostId: 'runtime:runtime-a' + }) + }) + + it('includes folder workspaces owned by the runtime', () => { + expect(findRuntimeWorkspaceFileRoute(state(), 'runtime-a', '/srv/notes/todo.md')).toEqual({ + worktreeId: 'folder:notes', + relativePath: 'todo.md', + executionHostId: 'runtime:runtime-a' + }) + }) + + it('rejects paths outside every workspace owned by the runtime', () => { + expect(findRuntimeWorkspaceFileRoute(state(), 'runtime-a', '/etc/passwd')).toBeNull() + }) + + it('does not route workspace directories as editor files', () => { + expect(findRuntimeWorkspaceFileRoute(state(), 'runtime-a', '/srv/repo-b')).toBeNull() + expect(findRuntimeWorkspaceFileRoute(state(), 'runtime-a', '/srv/notes')).toBeNull() + }) + + it('routes direct SSH siblings only on the exact SSH host', () => { + const sshState = state() + sshState.repos = [ + { id: 'repo-a', connectionId: 'ssh-1', executionHostId: 'ssh:ssh-1' }, + { id: 'repo-b', connectionId: 'ssh-1', executionHostId: 'ssh:ssh-1' }, + { id: 'repo-c', connectionId: 'ssh-2', executionHostId: 'ssh:ssh-2' } + ] as never + sshState.worktreesByRepo = { + repoA: [{ id: 'a', repoId: 'repo-a', path: '/srv/a', hostId: 'ssh:ssh-1' }], + repoB: [{ id: 'b', repoId: 'repo-b', path: '/srv/b', hostId: 'ssh:ssh-1' }], + repoC: [{ id: 'c', repoId: 'repo-c', path: '/srv/b/nested', hostId: 'ssh:ssh-2' }] + } as never + sshState.folderWorkspaces = [] + + expect(findWorkspaceFileRoute(sshState, 'ssh:ssh-1', '/srv/b/nested/file.ts')).toEqual({ + worktreeId: 'b', + relativePath: 'nested/file.ts', + executionHostId: 'ssh:ssh-1' + }) + expect(findWorkspaceFileRoute(sshState, 'ssh:ssh-2', '/srv/a/file.ts')).toBeNull() + }) +}) diff --git a/src/renderer/src/lib/runtime-workspace-file-route.ts b/src/renderer/src/lib/runtime-workspace-file-route.ts new file mode 100644 index 00000000000..af30b70fefd --- /dev/null +++ b/src/renderer/src/lib/runtime-workspace-file-route.ts @@ -0,0 +1,76 @@ +import { + parseExecutionHostId, + toRuntimeExecutionHostId, + type ExecutionHostId +} from '../../../shared/execution-host' +import { findRuntimeWorkspaceFileOwner } from '../../../shared/runtime-workspace-file-owner' +import { folderWorkspaceKey } from '../../../shared/workspace-scope' +import type { AppState } from '@/store/types' +import { getIndexedAllWorktrees } from '@/store/worktree-repo-index' +import { + getExecutionHostIdForWorktree, + getExplicitRuntimeEnvironmentIdForWorktree +} from './worktree-runtime-owner' +import { resolveExplicitWorktreeOperationRouteResult } from './worktree-operation-route' + +export type RuntimeWorkspaceFileRoute = { + worktreeId: string + relativePath: string + executionHostId: ExecutionHostId +} + +function workspaceMatchesExecutionHost( + state: AppState, + workspaceId: string, + executionHostId: ExecutionHostId +): boolean { + const parsedHost = parseExecutionHostId(executionHostId) + if (parsedHost?.kind === 'runtime') { + return ( + getExplicitRuntimeEnvironmentIdForWorktree(state, workspaceId) === parsedHost.environmentId + ) + } + const explicit = resolveExplicitWorktreeOperationRouteResult(state, workspaceId) + if (explicit.kind === 'resolved') { + return explicit.route.executionHostId === executionHostId + } + return ( + executionHostId === 'local' && getExecutionHostIdForWorktree(state, workspaceId) === 'local' + ) +} + +export function findWorkspaceFileRoute( + state: AppState, + executionHostId: ExecutionHostId, + absolutePath: string +): RuntimeWorkspaceFileRoute | null { + const roots = getIndexedAllWorktrees(state.worktreesByRepo).flatMap((worktree) => + workspaceMatchesExecutionHost(state, worktree.id, executionHostId) + ? [{ workspaceId: worktree.id, rootPath: worktree.path, executionHostId }] + : [] + ) + for (const workspace of state.folderWorkspaces) { + const workspaceId = folderWorkspaceKey(workspace.id) + if (workspaceMatchesExecutionHost(state, workspaceId, executionHostId)) { + roots.push({ workspaceId, rootPath: workspace.folderPath, executionHostId }) + } + } + + const owner = findRuntimeWorkspaceFileOwner(roots, absolutePath, executionHostId) + return owner && owner.relativePath !== '' + ? { worktreeId: owner.workspaceId, relativePath: owner.relativePath, executionHostId } + : null +} + +export function findRuntimeWorkspaceFileRoute( + state: AppState, + runtimeEnvironmentId: string, + absolutePath: string +): RuntimeWorkspaceFileRoute | null { + const ownerId = runtimeEnvironmentId.trim() + if (!ownerId) { + return null + } + const executionHostId = toRuntimeExecutionHostId(ownerId) + return findWorkspaceFileRoute(state, executionHostId, absolutePath) +} diff --git a/src/renderer/src/store/slices/editor.ts b/src/renderer/src/store/slices/editor.ts index c3c2d630710..ace5cace0fe 100644 --- a/src/renderer/src/store/slices/editor.ts +++ b/src/renderer/src/store/slices/editor.ts @@ -49,6 +49,7 @@ import { COMBINED_DIFF_FILE_TREE_DEFAULT_WIDTH } from '../../../../shared/combined-diff-file-tree-width' import { folderWorkspaceKey } from '../../../../shared/workspace-scope' +import { parseExecutionHostId, type ExecutionHostId } from '../../../../shared/execution-host' import type { RemoteOpKind } from '@/components/right-sidebar/source-control-primary-action' import { invalidateAutomaticPushTargetUpstreamStatusCache } from '@/components/right-sidebar/push-target-upstream-refresh-cache' import { @@ -72,7 +73,11 @@ import { } from '@/runtime/runtime-file-client' import { settingsForRuntimeOwner } from '@/runtime/runtime-rpc-client' import { notifyHostOfMirroredEditorClose } from '@/runtime/close-mirrored-editor-tab' -import { findWorktreeById, getRepoIdFromWorktreeId } from './worktree-helpers' +import { + findWorktreeById, + getRepoIdFromWorktreeId, + type ActiveWorktreeStateTransition +} from './worktree-helpers' import { getExplicitRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner' import { addAdditionalValidWorkspaceKeys, @@ -89,6 +94,9 @@ import { captureEditorFileOperationProvenance, getEditorFileOperationContext } from '@/lib/editor-file-operation-owner' +import { createBrowserUuid } from '@/lib/browser-uuid' +import { pruneTabGroupLayoutForGroups } from './tabs-hydration' +import { sanitizeRecentTabIds } from './tab-group-state' export type { ActiveRightSidebarTab, @@ -257,6 +265,8 @@ export type OpenFile = { pendingDiskBaselineVerification?: boolean /** Why: gates autosave during a live self-move echo's disk verification; separate flag from the restored scan's so the two can't clear each other's gate. Not persisted. */ pendingLiveDiskVerification?: boolean + /** Blocks saves while a restored tab's filesystem authority is being replaced. */ + pendingOwnerMigration?: boolean /** Why: routes an Orca-owned move's destination-watcher echo into content verification. On the tab so it survives the atomic rekey; operationId supersedes a stale verification on re-move. Not persisted. */ pendingSelfMoveEcho?: { operationId: string; targetPath: string } /** Why: diff bodies are cached in EditorPanel; bump this on re-select so the panel refetches instead of reusing a stale snapshot. */ @@ -521,6 +531,8 @@ export type EditorSlice = { /** When set, dirty autosave-capable destinations get move-echo provenance + a synchronous autosave gate so the watcher can content-verify the echo. */ moveOperationId?: string }) => RekeyOpenFilesResult + setRestoredEditorOwnerMigrationPending: (fileId: string, pending: boolean) => boolean + reparentRestoredEditorFileOwner: (args: RestoredEditorOwnerMigration) => RestoredEditorOwnerResult clearUntitled: (fileId: string) => void openDiff: ( worktreeId: string, @@ -1306,6 +1318,19 @@ export type OpenFilePathRekey = { export type RekeyOpenFilesResult = { ok: true } | { ok: false; reason: 'collision' | 'stale' } +export type RestoredEditorOwnerMigration = { + fileId: string + targetWorktreeId: string + targetRelativePath: string + targetExecutionHostId: ExecutionHostId + targetRuntimeEnvironmentId: string | null + targetOperationProvenance: EditorFileOperationProvenance +} + +export type RestoredEditorOwnerResult = + | { ok: true; fileId: string } + | { ok: false; reason: 'collision' | 'owner-changed' | 'stale' } + function rekeyFileIdRecord( record: Record, migrations: ReadonlyMap @@ -1324,6 +1349,41 @@ function rekeyFileIdRecord( return changed ? next : record } +function nextActiveIdAfterRemoval( + ids: readonly string[], + recentIds: readonly string[] | undefined, + removedIds: ReadonlySet +): string | null { + const recent = (recentIds ?? []).toReversed().find((id) => !removedIds.has(id)) + return recent ?? ids.find((id) => !removedIds.has(id)) ?? null +} + +function removeEmptyEditorGroups( + previousGroups: TabGroup[], + groups: TabGroup[], + movedTabIds: ReadonlySet, + layout: AppState['layoutByWorktree'][string] | undefined +): { groups: TabGroup[]; layout: AppState['layoutByWorktree'][string] | undefined } { + const emptiedGroupIds = new Set( + previousGroups + .filter( + (group) => + group.tabOrder.some((id) => movedTabIds.has(id)) && + groups.find((candidate) => candidate.id === group.id)?.tabOrder.length === 0 + ) + .map((group) => group.id) + ) + const remaining = groups.filter((group) => !emptiedGroupIds.has(group.id)) + if (remaining.length === 0) { + return { groups: [], layout: undefined } + } + const validIds = new Set(remaining.map((group) => group.id)) + return { + groups: remaining, + layout: layout ? (pruneTabGroupLayoutForGroups(layout, validIds) ?? undefined) : undefined + } +} + function deleteUntouchedUntitledFile(state: AppState, file: OpenFile): void { const worktree = findWorktreeById(state.worktreesByRepo, file.worktreeId) const owningRuntimeEnvironmentId = file.runtimeEnvironmentId?.trim() @@ -2635,6 +2695,327 @@ export const createEditorSlice: StateCreator = (s } }), + setRestoredEditorOwnerMigrationPending: (fileId, pending) => { + let changed = false + set((s) => { + const file = s.openFiles.find((candidate) => candidate.id === fileId) + const next = pending || undefined + if (!file || file.pendingOwnerMigration === next) { + return s + } + changed = true + return { + openFiles: s.openFiles.map((candidate) => + candidate.id === fileId ? { ...candidate, pendingOwnerMigration: next } : candidate + ) + } + }) + return changed + }, + + reparentRestoredEditorFileOwner: (args) => { + let result: RestoredEditorOwnerResult = { ok: false, reason: 'stale' } + const projectReparent: ActiveWorktreeStateTransition = (s) => { + const source = s.openFiles.find((file) => file.id === args.fileId) + if (!source) { + return { patch: {}, activate: false } + } + + try { + const currentRoute = assertEditorFileOperationCurrent( + s, + args.targetWorktreeId, + args.targetOperationProvenance + ) + if ( + currentRoute.executionHostId !== args.targetExecutionHostId || + currentRoute.runtimeEnvironmentId !== args.targetRuntimeEnvironmentId + ) { + throw new Error('owner changed') + } + } catch { + result = { ok: false, reason: 'owner-changed' } + return { + patch: { + openFiles: s.openFiles.map((file) => + file.id === args.fileId ? { ...file, pendingOwnerMigration: undefined } : file + ) + }, + activate: false + } + } + const operationProvenance = args.targetOperationProvenance + + const destinationCollision = s.openFiles.some( + (file) => + file.id !== source.id && + file.filePath === source.filePath && + file.worktreeId === args.targetWorktreeId && + (file.runtimeEnvironmentId?.trim() || null) === args.targetRuntimeEnvironmentId + ) + const newFileId = buildOwnedEditorFileId( + source.filePath, + args.targetWorktreeId, + args.targetRuntimeEnvironmentId + ) + const dependentPreviews = s.openFiles.filter( + (file) => file.markdownPreviewSourceFileId === source.id + ) + const previewIdMigrations = new Map( + dependentPreviews.map((preview) => [preview.id, `markdown-preview::${newFileId}`]) + ) + const destinationIds = new Set([newFileId, ...previewIdMigrations.values()]) + if ( + destinationCollision || + s.openFiles.some( + (file) => + destinationIds.has(file.id) && + file.id !== source.id && + !previewIdMigrations.has(file.id) + ) + ) { + result = { ok: false, reason: 'collision' } + return { + patch: { + openFiles: s.openFiles.map((file) => + file.id === args.fileId ? { ...file, pendingOwnerMigration: undefined } : file + ) + }, + activate: false + } + } + + const parsedHost = parseExecutionHostId(args.targetExecutionHostId) + const externalSshTargetId = + parsedHost?.kind === 'ssh' && args.targetRuntimeEnvironmentId === null + ? parsedHost.targetId + : undefined + const migrations = new Map([[source.id, newFileId], ...previewIdMigrations]) + const movedFileIds = new Set(migrations.keys()) + const sourceWorktreeId = source.worktreeId + const targetWorktreeId = args.targetWorktreeId + const movedTabs = (s.unifiedTabsByWorktree[sourceWorktreeId] ?? []).filter((tab) => + movedFileIds.has(tab.entityId) + ) + const movedTabIds = new Set(movedTabs.map((tab) => tab.id)) + const tabIdMigration = new Map( + movedTabs.map((tab) => [tab.id, migrations.get(tab.id) ?? tab.id]) + ) + const mappedMovedTabIds = movedTabs.map((tab) => tabIdMigration.get(tab.id) ?? tab.id) + const mappedMovedTabBarIds = movedTabs.map( + (tab) => migrations.get(tab.entityId) ?? tab.entityId + ) + const targetGroups = s.groupsByWorktree[targetWorktreeId] ?? [] + const targetGroupId = + s.activeGroupIdByWorktree[targetWorktreeId] ?? targetGroups[0]?.id ?? createBrowserUuid() + const targetGroup = targetGroups.find((group) => group.id === targetGroupId) ?? { + id: targetGroupId, + worktreeId: targetWorktreeId, + activeTabId: null, + tabOrder: [] + } + + const previousSourceGroups = s.groupsByWorktree[sourceWorktreeId] ?? [] + const updatedSourceGroups = previousSourceGroups.map((group) => { + const tabOrder = group.tabOrder.filter((id) => !movedTabIds.has(id)) + const activeTabId = + group.activeTabId && movedTabIds.has(group.activeTabId) + ? nextActiveIdAfterRemoval(group.tabOrder, group.recentTabIds, movedTabIds) + : group.activeTabId + return { + ...group, + activeTabId, + tabOrder, + recentTabIds: sanitizeRecentTabIds( + (group.recentTabIds ?? []).filter((id) => !movedTabIds.has(id)), + tabOrder + ) + } + }) + const sourceGroupState = removeEmptyEditorGroups( + previousSourceGroups, + updatedSourceGroups, + movedTabIds, + s.layoutByWorktree[sourceWorktreeId] + ) + const destinationOrder = [ + ...targetGroup.tabOrder.filter((id) => !mappedMovedTabIds.includes(id)), + ...mappedMovedTabIds + ] + const updatedTargetGroup: TabGroup = { + ...targetGroup, + activeTabId: mappedMovedTabIds.at(-1) ?? targetGroup.activeTabId, + tabOrder: destinationOrder, + recentTabIds: sanitizeRecentTabIds( + [...(targetGroup.recentTabIds ?? []), ...mappedMovedTabIds], + destinationOrder + ) + } + const nextTargetGroups = targetGroups.some((group) => group.id === targetGroupId) + ? targetGroups.map((group) => (group.id === targetGroupId ? updatedTargetGroup : group)) + : [...targetGroups, updatedTargetGroup] + + const nextUnifiedTabsByWorktree = { ...s.unifiedTabsByWorktree } + nextUnifiedTabsByWorktree[sourceWorktreeId] = ( + nextUnifiedTabsByWorktree[sourceWorktreeId] ?? [] + ).filter((tab) => !movedTabIds.has(tab.id)) + nextUnifiedTabsByWorktree[targetWorktreeId] = [ + ...(nextUnifiedTabsByWorktree[targetWorktreeId] ?? []), + ...movedTabs.map((tab) => ({ + ...tab, + id: tabIdMigration.get(tab.id) ?? tab.id, + entityId: migrations.get(tab.entityId) ?? tab.entityId, + groupId: targetGroupId + })) + ] + + const nextGroupsByWorktree = { + ...s.groupsByWorktree, + [sourceWorktreeId]: sourceGroupState.groups, + [targetWorktreeId]: nextTargetGroups + } + const nextLayoutByWorktree = { ...s.layoutByWorktree } + if (sourceGroupState.layout) { + nextLayoutByWorktree[sourceWorktreeId] = sourceGroupState.layout + } else { + delete nextLayoutByWorktree[sourceWorktreeId] + } + if (targetGroups.length === 0 || !nextLayoutByWorktree[targetWorktreeId]) { + nextLayoutByWorktree[targetWorktreeId] = { type: 'leaf', groupId: targetGroupId } + } + + const nextActiveFileIdByWorktree = { ...s.activeFileIdByWorktree } + const sourceActiveFileId = nextActiveFileIdByWorktree[sourceWorktreeId] + if (sourceActiveFileId && movedFileIds.has(sourceActiveFileId)) { + nextActiveFileIdByWorktree[sourceWorktreeId] = + s.openFiles.find( + (file) => !movedFileIds.has(file.id) && file.worktreeId === sourceWorktreeId + )?.id ?? null + } + nextActiveFileIdByWorktree[targetWorktreeId] = newFileId + const nextTabBarOrderByWorktree = { ...s.tabBarOrderByWorktree } + nextTabBarOrderByWorktree[sourceWorktreeId] = ( + nextTabBarOrderByWorktree[sourceWorktreeId] ?? [] + ).filter((id) => !movedFileIds.has(id) && !movedTabIds.has(id)) + nextTabBarOrderByWorktree[targetWorktreeId] = [ + ...(nextTabBarOrderByWorktree[targetWorktreeId] ?? []).filter( + (id) => !mappedMovedTabBarIds.includes(id) + ), + ...mappedMovedTabBarIds + ] + const nextActiveGroupIdByWorktree = { ...s.activeGroupIdByWorktree } + if (sourceGroupState.groups.length > 0) { + const previousActiveGroupId = nextActiveGroupIdByWorktree[sourceWorktreeId] + nextActiveGroupIdByWorktree[sourceWorktreeId] = sourceGroupState.groups.some( + (group) => group.id === previousActiveGroupId + ) + ? previousActiveGroupId + : sourceGroupState.groups[0].id + } else { + delete nextActiveGroupIdByWorktree[sourceWorktreeId] + } + nextActiveGroupIdByWorktree[targetWorktreeId] = targetGroupId + + result = { ok: true, fileId: newFileId } + return { + patch: { + openFiles: s.openFiles.map((file) => + file.id === source.id + ? { + ...file, + id: newFileId, + worktreeId: targetWorktreeId, + relativePath: args.targetRelativePath, + runtimeEnvironmentId: args.targetRuntimeEnvironmentId, + externalSshTargetId, + operationProvenance, + pendingOwnerMigration: undefined, + mirroredFromRuntimeSession: undefined + } + : file.markdownPreviewSourceFileId === source.id + ? { + ...file, + id: previewIdMigrations.get(file.id) ?? file.id, + worktreeId: targetWorktreeId, + relativePath: args.targetRelativePath, + runtimeEnvironmentId: args.targetRuntimeEnvironmentId, + externalSshTargetId, + operationProvenance, + markdownPreviewSourceFileId: newFileId, + pendingOwnerMigration: undefined, + mirroredFromRuntimeSession: undefined + } + : file + ), + editorDrafts: rekeyFileIdRecord(s.editorDrafts, migrations), + editorCursorLine: rekeyFileIdRecord(s.editorCursorLine, migrations), + markdownViewMode: rekeyFileIdRecord(s.markdownViewMode, migrations), + editorViewMode: rekeyFileIdRecord(s.editorViewMode, migrations), + markdownFrontmatterVisible: rekeyFileIdRecord(s.markdownFrontmatterVisible, migrations), + markdownTableOfContentsVisible: rekeyFileIdRecord( + s.markdownTableOfContentsVisible, + migrations + ), + activeFileId: s.activeFileId ? (migrations.get(s.activeFileId) ?? s.activeFileId) : null, + activeFileIdByWorktree: nextActiveFileIdByWorktree, + activeTabTypeByWorktree: { + ...s.activeTabTypeByWorktree, + [targetWorktreeId]: 'editor' + }, + unifiedTabsByWorktree: nextUnifiedTabsByWorktree, + groupsByWorktree: nextGroupsByWorktree, + layoutByWorktree: nextLayoutByWorktree, + activeGroupIdByWorktree: nextActiveGroupIdByWorktree, + tabBarOrderByWorktree: nextTabBarOrderByWorktree, + ...(s.pendingEditorReveal?.fileId && migrations.has(s.pendingEditorReveal.fileId) + ? { + pendingEditorReveal: { + ...s.pendingEditorReveal, + fileId: migrations.get(s.pendingEditorReveal.fileId)!, + filePath: source.filePath + } + } + : {}), + ...(s.pendingEditorFocusRequest?.fileId && + migrations.has(s.pendingEditorFocusRequest.fileId) + ? { + pendingEditorFocusRequest: { + ...s.pendingEditorFocusRequest, + fileId: migrations.get(s.pendingEditorFocusRequest.fileId)!, + worktreeId: targetWorktreeId + } + } + : {}), + ...(s.pendingExplorerReveal?.filePath === source.filePath && + s.pendingExplorerReveal.worktreeId === sourceWorktreeId + ? { + pendingExplorerReveal: { + ...s.pendingExplorerReveal, + worktreeId: targetWorktreeId + } + } + : {}) + }, + activate: true, + preferredActiveUnifiedTabId: mappedMovedTabIds.at(-1) + } + } + const initialSource = get().openFiles.find((file) => file.id === args.fileId) + const activatesTargetWorkspace = Boolean( + initialSource && + get().activeWorktreeId === initialSource.worktreeId && + get().activeFileId === initialSource.id + ) + if (activatesTargetWorkspace) { + get().setActiveWorktree(args.targetWorktreeId, args.targetExecutionHostId, { + stateTransition: projectReparent + }) + } else { + set((state) => projectReparent(state).patch) + } + return result + }, + rekeyOpenFilesForPathChange: ({ rekeys, moveOperationId }) => { if (rekeys.length === 0) { return { ok: true } diff --git a/src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts b/src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts new file mode 100644 index 00000000000..d3e8f37f15f --- /dev/null +++ b/src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts @@ -0,0 +1,683 @@ +// @vitest-environment happy-dom + +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { act, createElement } from 'react' +import { createRoot } from 'react-dom/client' +import { useAppStore } from '@/store' +import { buildEditorSessionData } from '@/lib/workspace-session' +import { + createExternalWatchEventHandler, + getEditorExternalWatchTargets, + useEditorExternalWatch +} from '@/hooks/useEditorExternalWatch' +import { + captureEditorFileOperationProvenance, + getEditorFileOperationContext +} from '@/lib/editor-file-operation-owner' +import type { AppState } from '@/store/types' +import type { WorkspaceSessionState } from '../../../../shared/types' + +const SOURCE = 'repo-a::/repo-a' +const TARGET = 'repo-b::/repo-b' +const FILE_PATH = '/repo-b/docs/readme.md' + +function WatchProbe(): null { + useEditorExternalWatch() + return null +} + +function installWorkspaceState(): void { + useAppStore.setState(useAppStore.getInitialState(), true) + useAppStore.setState({ + activeWorktreeId: SOURCE, + settings: { editorAutoSave: false }, + repos: [ + { id: 'repo-a', path: '/repo-a', kind: 'git', executionHostId: 'local' }, + { id: 'repo-b', path: '/repo-b', kind: 'git', executionHostId: 'local' } + ], + worktreesByRepo: { + 'repo-a': [{ id: SOURCE, repoId: 'repo-a', path: '/repo-a', hostId: 'local', branch: '' }], + 'repo-b': [{ id: TARGET, repoId: 'repo-b', path: '/repo-b', hostId: 'local', branch: '' }] + }, + detectedWorktreesByRepo: {}, + runtimeEnvironments: [], + runtimeEnvironmentCatalogHydrated: true, + removedRuntimeEnvironmentIds: new Set(), + sshConnectionStates: new Map(), + sshStateByEnvironment: new Map(), + folderWorkspaces: [], + projectGroups: [], + rightSidebarOpen: false, + rightSidebarTab: 'explorer', + rightSidebarExplorerView: 'files', + gitStatusHugeByWorktree: {} + } as unknown as Partial) +} + +function openRestoredSource(): string { + return useAppStore.getState().openFile( + { + filePath: FILE_PATH, + relativePath: FILE_PATH, + worktreeId: SOURCE, + runtimeEnvironmentId: null, + language: 'markdown', + mode: 'edit', + pendingDiskBaselineVerification: true + }, + { suppressActiveRuntimeFallback: true } + ) +} + +function reparent(fileId: string) { + const state = useAppStore.getState() + state.setRestoredEditorOwnerMigrationPending(fileId, true) + return state.reparentRestoredEditorFileOwner({ + fileId, + targetWorktreeId: TARGET, + targetRelativePath: 'docs/readme.md', + targetExecutionHostId: 'local', + targetRuntimeEnvironmentId: null, + targetOperationProvenance: captureEditorFileOperationProvenance(state, TARGET, null, true) + }) +} + +describe('restored editor owner reparent', () => { + beforeEach(() => { + vi.restoreAllMocks() + installWorkspaceState() + }) + + afterEach(() => vi.useRealTimers()) + + it('atomically migrates ownership, ids, placement, views, previews, and provenance', () => { + const oldId = openRestoredSource() + const state = useAppStore.getState() + state.setEditorDraft(oldId, 'edited draft') + state.markFileDirty(oldId, true) + state.setEditorCursorLine(oldId, 37) + state.setMarkdownViewMode(oldId, 'rich') + state.setEditorViewMode(oldId, 'changes') + state.setMarkdownFrontmatterVisible(oldId, false) + state.setMarkdownTableOfContentsVisible(oldId, true) + useAppStore.setState((current) => ({ + pendingEditorReveal: { + fileId: oldId, + filePath: FILE_PATH, + line: 4, + column: 2, + matchLength: 0 + }, + pendingEditorFocusRequest: { + fileId: oldId, + worktreeId: SOURCE, + viewStateId: 'view-1', + expiresAt: Date.now() + 1_000, + token: 1 + }, + pendingExplorerReveal: { worktreeId: SOURCE, filePath: FILE_PATH, requestId: 1 }, + openFiles: [ + ...current.openFiles, + { + ...current.openFiles[0], + id: 'preview-1', + mode: 'markdown-preview' as const, + markdownPreviewSourceFileId: oldId, + isDirty: false + } + ] + })) + + const result = reparent(oldId) + + expect(result.ok).toBe(true) + if (!result.ok) { + return + } + const next = useAppStore.getState() + const moved = next.openFiles.find((file) => file.id === result.fileId)! + expect(moved).toMatchObject({ + filePath: FILE_PATH, + relativePath: 'docs/readme.md', + worktreeId: TARGET, + runtimeEnvironmentId: null, + isDirty: true, + pendingDiskBaselineVerification: true + }) + expect(moved.pendingOwnerMigration).toBeUndefined() + expect(moved.operationProvenance?.generation.route).toEqual({ + executionHostId: 'local', + runtimeEnvironmentId: null + }) + expect(getEditorFileOperationContext(next, moved, '/repo-b').worktreeId).toBe(TARGET) + expect(next.editorDrafts).toEqual({ [result.fileId]: 'edited draft' }) + expect(next.editorCursorLine[result.fileId]).toBe(37) + expect(next.markdownViewMode[result.fileId]).toBe('rich') + expect(next.editorViewMode[result.fileId]).toBe('changes') + expect(next.markdownFrontmatterVisible[result.fileId]).toBe(false) + expect(next.markdownTableOfContentsVisible[result.fileId]).toBe(true) + expect(next.openFiles.find((file) => file.mode === 'markdown-preview')).toMatchObject({ + id: `markdown-preview::${result.fileId}`, + markdownPreviewSourceFileId: result.fileId, + worktreeId: TARGET, + relativePath: 'docs/readme.md' + }) + expect(next.unifiedTabsByWorktree[SOURCE]).toEqual([]) + const movedTabId = next.unifiedTabsByWorktree[TARGET]?.[0]?.id + expect(next.unifiedTabsByWorktree[TARGET]?.[0]?.entityId).toBe(result.fileId) + expect(next.groupsByWorktree[TARGET]?.[0]).toMatchObject({ + activeTabId: movedTabId, + tabOrder: [movedTabId] + }) + expect(next.tabBarOrderByWorktree[TARGET]).toEqual([result.fileId]) + expect(next.activeFileIdByWorktree[SOURCE]).toBeNull() + expect(next.activeFileIdByWorktree[TARGET]).toBe(result.fileId) + expect(next.activeWorktreeId).toBe(TARGET) + expect(next.activeWorkspaceExecutionHostId).toBe('local') + expect(next.activeRepoId).toBe('repo-b') + expect(next.activeGroupIdByWorktree[SOURCE]).toBeUndefined() + expect(next.pendingEditorReveal?.fileId).toBe(result.fileId) + expect(next.pendingEditorFocusRequest).toMatchObject({ + fileId: result.fileId, + worktreeId: TARGET + }) + expect(next.pendingExplorerReveal?.worktreeId).toBe(TARGET) + }) + + it('does not retarget an explorer reveal owned by another workspace', () => { + const oldId = openRestoredSource() + useAppStore.setState({ + pendingExplorerReveal: { worktreeId: 'other-workspace', filePath: FILE_PATH, requestId: 1 } + }) + + expect(reparent(oldId).ok).toBe(true) + expect(useAppStore.getState().pendingExplorerReveal?.worktreeId).toBe('other-workspace') + }) + + it('commits active reparenting through the complete workspace activation projection', () => { + const oldId = openRestoredSource() + const refreshGitHubForWorktreeIfStale = vi.fn() + useAppStore.setState({ + activeTabId: 'source-terminal', + activeBrowserTabId: 'source-browser', + activePendingCreationId: 'source-creation', + rightSidebarExplorerView: 'files', + rightSidebarExplorerViewByWorktree: { [TARGET]: 'search' }, + tabsByWorktree: { + [SOURCE]: [ + { + id: 'source-terminal', + ptyId: null, + worktreeId: SOURCE, + title: 'Source terminal', + customTitle: null, + color: null, + sortOrder: 0, + createdAt: 1, + generation: 1 + } + ], + [TARGET]: [ + { + id: 'target-terminal', + ptyId: null, + worktreeId: TARGET, + title: 'Target terminal', + customTitle: null, + color: null, + sortOrder: 0, + createdAt: 1, + generation: 4 + } + ] + }, + activeTabIdByWorktree: { + [SOURCE]: 'source-terminal', + [TARGET]: 'target-terminal' + }, + unifiedTabsByWorktree: { + ...useAppStore.getState().unifiedTabsByWorktree, + [TARGET]: [ + { + id: 'target-terminal', + entityId: 'target-terminal', + groupId: 'target-group', + worktreeId: TARGET, + contentType: 'terminal', + label: 'Target terminal', + customLabel: null, + color: null, + sortOrder: 0, + createdAt: 1 + } + ] + }, + groupsByWorktree: { + ...useAppStore.getState().groupsByWorktree, + [TARGET]: [ + { + id: 'target-group', + worktreeId: TARGET, + activeTabId: 'target-terminal', + tabOrder: ['target-terminal'] + } + ] + }, + layoutByWorktree: { + ...useAppStore.getState().layoutByWorktree, + [TARGET]: { type: 'leaf', groupId: 'target-group' } + }, + activeGroupIdByWorktree: { + ...useAppStore.getState().activeGroupIdByWorktree, + [TARGET]: 'target-group' + }, + browserTabsByWorktree: { + [SOURCE]: [{ id: 'source-browser' }], + [TARGET]: [{ id: 'target-browser' }] + }, + activeBrowserTabIdByWorktree: { + [SOURCE]: 'source-browser', + [TARGET]: 'target-browser' + }, + everActivatedWorktreeIds: new Set([SOURCE]), + refreshGitHubForWorktreeIfStale + } as unknown as Partial) + const targetSnapshots: AppState[] = [] + const unsubscribe = useAppStore.subscribe((state) => { + if (state.activeWorktreeId === TARGET) { + targetSnapshots.push(state) + } + }) + + const result = reparent(oldId) + unsubscribe() + + expect(result.ok).toBe(true) + expect(targetSnapshots).toHaveLength(1) + const activated = targetSnapshots[0] + expect(activated).toMatchObject({ + activeWorktreeId: TARGET, + activeRepoId: 'repo-b', + activeWorkspaceExecutionHostId: 'local', + activeTabId: 'target-terminal', + activeBrowserTabId: 'target-browser', + activePendingCreationId: null, + rightSidebarExplorerView: 'search', + activeTabType: 'editor' + }) + expect(activated.activeFileId).toBe(result.ok ? result.fileId : null) + expect(activated.everActivatedWorktreeIds).toEqual(new Set([SOURCE, TARGET])) + expect(activated.tabsByWorktree[TARGET]?.[0]).toMatchObject({ + id: 'target-terminal', + generation: 5 + }) + expect(refreshGitHubForWorktreeIfStale).toHaveBeenCalledOnce() + expect(refreshGitHubForWorktreeIfStale).toHaveBeenCalledWith(TARGET) + }) + + it('persists and restores the destination owner and dirty hot-exit draft', () => { + const oldId = openRestoredSource() + useAppStore.getState().setEditorDraft(oldId, 'hot exit') + useAppStore.getState().markFileDirty(oldId, true) + const result = reparent(oldId) + expect(result.ok).toBe(true) + + const state = useAppStore.getState() + const session = buildEditorSessionData( + state.openFiles, + state.editorDrafts, + state.markdownFrontmatterVisible, + state.activeFileIdByWorktree, + state.activeTabTypeByWorktree + ) + expect(session.openFilesByWorktree?.[SOURCE]).toBeUndefined() + expect(session.openFilesByWorktree?.[TARGET]?.[0]).toMatchObject({ + relativePath: 'docs/readme.md', + dirtyDraftContent: 'hot exit' + }) + + installWorkspaceState() + useAppStore.getState().hydrateEditorSession(session as WorkspaceSessionState) + const restored = useAppStore.getState().openFiles[0] + expect(restored).toMatchObject({ + worktreeId: TARGET, + relativePath: 'docs/readme.md', + isDirty: true + }) + expect(useAppStore.getState().editorDrafts[restored.id]).toBe('hot exit') + }) + + it.each([false, true])('fails closed on a %s destination collision', (dirtyDestination) => { + const sourceId = openRestoredSource() + const destinationId = useAppStore.getState().openFile( + { + filePath: FILE_PATH, + relativePath: 'docs/readme.md', + worktreeId: TARGET, + runtimeEnvironmentId: null, + language: 'markdown', + mode: 'edit' + }, + { suppressActiveRuntimeFallback: true } + ) + if (dirtyDestination) { + useAppStore.getState().setEditorDraft(destinationId, 'destination draft') + useAppStore.getState().markFileDirty(destinationId, true) + } + const before = useAppStore.getState().openFiles + + expect(reparent(sourceId)).toEqual({ ok: false, reason: 'collision' }) + expect(useAppStore.getState().openFiles.map((file) => file.id)).toEqual( + before.map((file) => file.id) + ) + expect(useAppStore.getState().openFiles.find((file) => file.id === sourceId)?.worktreeId).toBe( + SOURCE + ) + }) + + it('leaves destination tabs and groups byte-identical when activation hits a collision', () => { + const sourceId = openRestoredSource() + const destinationId = useAppStore.getState().openFile( + { + filePath: FILE_PATH, + relativePath: 'docs/readme.md', + worktreeId: TARGET, + runtimeEnvironmentId: null, + language: 'markdown', + mode: 'edit' + }, + { suppressActiveRuntimeFallback: true } + ) + const destinationTab = useAppStore + .getState() + .unifiedTabsByWorktree[TARGET]?.find((tab) => tab.entityId === destinationId) + expect(destinationTab).toBeDefined() + const staleTab = { + ...destinationTab!, + id: 'stale-target-tab', + entityId: 'stale-target-file' + } + useAppStore.setState((state) => ({ + activeWorktreeId: SOURCE, + activeFileId: sourceId, + unifiedTabsByWorktree: { + ...state.unifiedTabsByWorktree, + [TARGET]: [...(state.unifiedTabsByWorktree[TARGET] ?? []), staleTab] + }, + groupsByWorktree: { + ...state.groupsByWorktree, + [TARGET]: (state.groupsByWorktree[TARGET] ?? []).map((group) => + group.id === staleTab.groupId + ? { + ...group, + activeTabId: staleTab.id, + tabOrder: [...group.tabOrder, staleTab.id], + recentTabIds: [...(group.recentTabIds ?? []), staleTab.id] + } + : group + ) + } + })) + const state = useAppStore.getState() + state.setRestoredEditorOwnerMigrationPending(sourceId, true) + const before = useAppStore.getState() + + const result = before.reparentRestoredEditorFileOwner({ + fileId: sourceId, + targetWorktreeId: TARGET, + targetRelativePath: 'docs/readme.md', + targetExecutionHostId: 'local', + targetRuntimeEnvironmentId: null, + targetOperationProvenance: captureEditorFileOperationProvenance(before, TARGET, null, true) + }) + + expect(result).toEqual({ ok: false, reason: 'collision' }) + const after = useAppStore.getState() + expect(after.unifiedTabsByWorktree).toBe(before.unifiedTabsByWorktree) + expect(after.groupsByWorktree).toBe(before.groupsByWorktree) + expect(after.layoutByWorktree).toBe(before.layoutByWorktree) + expect(after.activeGroupIdByWorktree).toBe(before.activeGroupIdByWorktree) + expect(after.activeWorktreeId).toBe(SOURCE) + expect(after.activeFileId).toBe(sourceId) + }) + + it('moves the watcher projection from source to destination without fanout', () => { + const oldId = openRestoredSource() + const before = getEditorExternalWatchTargets(useAppStore.getState()) + const result = reparent(oldId) + expect(result.ok).toBe(true) + const after = getEditorExternalWatchTargets(useAppStore.getState()) + + expect(before.targets.map((target) => target.worktreeId)).toEqual([SOURCE]) + expect(after.targets).toEqual([ + { + worktreeId: TARGET, + worktreePath: '/repo-b', + connectionId: undefined, + runtimeEnvironmentId: null + } + ]) + }) + + it('unsubscribes the source watch once and subscribes the destination once', async () => { + const watchWorktree = vi.fn().mockResolvedValue(undefined) + const unwatchWorktree = vi.fn().mockResolvedValue(undefined) + const previousApi = (window as unknown as { api?: unknown }).api + ;(window as unknown as { api: unknown }).api = { + fs: { + watchWorktree, + unwatchWorktree, + onFsChanged: vi.fn(() => vi.fn()) + } + } + const oldId = openRestoredSource() + const container = document.body.appendChild(document.createElement('div')) + const root = createRoot(container) + await act(async () => root.render(createElement(WatchProbe))) + await vi.waitFor(() => expect(watchWorktree).toHaveBeenCalledTimes(1)) + expect(watchWorktree).toHaveBeenLastCalledWith({ + worktreePath: '/repo-a', + connectionId: undefined + }) + + await act(async () => { + expect(reparent(oldId).ok).toBe(true) + }) + await vi.waitFor(() => { + expect(unwatchWorktree).toHaveBeenCalledTimes(1) + expect(watchWorktree).toHaveBeenCalledTimes(2) + }) + expect(unwatchWorktree).toHaveBeenLastCalledWith({ + worktreePath: '/repo-a', + connectionId: undefined + }) + expect(watchWorktree).toHaveBeenLastCalledWith({ + worktreePath: '/repo-b', + connectionId: undefined + }) + + await act(async () => root.unmount()) + container.remove() + ;(window as unknown as { api?: unknown }).api = previousApi + }) + + it('reparents into a folder workspace with local save and watch authority', () => { + useAppStore.setState({ + folderWorkspaces: [ + { + id: 'notes', + projectGroupId: 'group-notes', + folderPath: '/notes', + connectionId: null, + executionHostId: 'local' + } + ], + projectGroups: [{ id: 'group-notes', name: 'Notes', executionHostId: 'local' }] + } as unknown as Partial) + const oldId = useAppStore.getState().openFile( + { + filePath: '/notes/todo.md', + relativePath: '/notes/todo.md', + worktreeId: SOURCE, + runtimeEnvironmentId: null, + language: 'markdown', + mode: 'edit' + }, + { suppressActiveRuntimeFallback: true } + ) + useAppStore.getState().setRestoredEditorOwnerMigrationPending(oldId, true) + const result = useAppStore.getState().reparentRestoredEditorFileOwner({ + fileId: oldId, + targetWorktreeId: 'folder:notes', + targetRelativePath: 'todo.md', + targetExecutionHostId: 'local', + targetRuntimeEnvironmentId: null, + targetOperationProvenance: captureEditorFileOperationProvenance( + useAppStore.getState(), + 'folder:notes', + null, + true + ) + }) + + expect(result.ok).toBe(true) + if (!result.ok) { + return + } + const state = useAppStore.getState() + const moved = state.openFiles.find((file) => file.id === result.fileId)! + expect(getEditorFileOperationContext(state, moved, null)).toMatchObject({ + worktreeId: 'folder:notes', + worktreePath: '/notes', + expectedExecutionHostId: 'local' + }) + expect(getEditorExternalWatchTargets(state).targets).toEqual([ + { + worktreeId: 'folder:notes', + worktreePath: '/notes', + connectionId: undefined, + runtimeEnvironmentId: null + } + ]) + }) + + it('captures exact direct-SSH host and connection-generation authority', () => { + useAppStore.setState((state) => ({ + repos: state.repos.map((repo) => ({ + ...repo, + connectionId: 'ssh-1', + executionHostId: 'ssh:ssh-1' + })), + worktreesByRepo: Object.fromEntries( + Object.entries(state.worktreesByRepo).map(([repoId, worktrees]) => [ + repoId, + worktrees.map((worktree) => ({ ...worktree, hostId: 'ssh:ssh-1' as const })) + ]) + ), + sshConnectionStates: new Map([ + [ + 'ssh-1', + { + targetId: 'ssh-1', + status: 'connected' as const, + error: null, + reconnectAttempt: 0, + connectionGeneration: 7 + } + ] + ]) + })) + const oldId = openRestoredSource() + useAppStore.getState().setRestoredEditorOwnerMigrationPending(oldId, true) + const result = useAppStore.getState().reparentRestoredEditorFileOwner({ + fileId: oldId, + targetWorktreeId: TARGET, + targetRelativePath: 'docs/readme.md', + targetExecutionHostId: 'ssh:ssh-1', + targetRuntimeEnvironmentId: null, + targetOperationProvenance: captureEditorFileOperationProvenance( + useAppStore.getState(), + TARGET, + null, + true + ) + }) + + expect(result.ok).toBe(true) + if (!result.ok) { + return + } + expect( + useAppStore.getState().openFiles.find((file) => file.id === result.fileId) + ).toMatchObject({ + externalSshTargetId: 'ssh-1', + operationProvenance: { + expectedSshConnectionGeneration: 7, + generation: { + route: { executionHostId: 'ssh:ssh-1', runtimeEnvironmentId: null } + } + } + }) + }) + + it('correlates destination change, delete, and rename events after reparent', () => { + vi.useFakeTimers() + const oldId = openRestoredSource() + const result = reparent(oldId) + expect(result.ok).toBe(true) + if (!result.ok) { + return + } + const target = { + worktreeId: TARGET, + worktreePath: '/repo-b', + connectionId: undefined, + runtimeEnvironmentId: null + } + const externalChanges: unknown[] = [] + const listener = (event: Event): void => { + externalChanges.push((event as CustomEvent).detail) + } + window.addEventListener('orca:editor-external-file-change', listener) + const watcher = createExternalWatchEventHandler((path, owner) => + path === target.worktreePath && owner === null ? target : undefined + ) + + watcher.handleFsChanged({ + worktreePath: '/repo-b', + events: [{ kind: 'update', absolutePath: FILE_PATH }] + }) + vi.advanceTimersByTime(100) + expect(externalChanges).toContainEqual({ + worktreeId: TARGET, + worktreePath: '/repo-b', + relativePath: 'docs/readme.md', + runtimeEnvironmentId: null + }) + + watcher.handleFsChanged({ + worktreePath: '/repo-b', + events: [{ kind: 'delete', absolutePath: FILE_PATH }] + }) + vi.advanceTimersByTime(100) + expect( + useAppStore.getState().openFiles.find((file) => file.id === result.fileId)?.externalMutation + ).toBe('deleted') + useAppStore.getState().setExternalMutation(result.fileId, null) + + watcher.handleFsChanged({ + worktreePath: '/repo-b', + events: [ + { kind: 'delete', absolutePath: FILE_PATH }, + { kind: 'create', absolutePath: '/repo-b/archive/readme.md' } + ] + }) + expect( + useAppStore.getState().openFiles.find((file) => file.id === result.fileId)?.externalMutation + ).toBe('renamed') + + watcher.dispose() + window.removeEventListener('orca:editor-external-file-change', listener) + vi.useRealTimers() + }) +}) diff --git a/src/renderer/src/store/slices/tabs.ts b/src/renderer/src/store/slices/tabs.ts index 72e22adc136..5a2456c24c0 100644 --- a/src/renderer/src/store/slices/tabs.ts +++ b/src/renderer/src/store/slices/tabs.ts @@ -616,6 +616,215 @@ function activeSurfacePatchMatchesState( ) } +export type WorktreeTabModelReconciliation = { + patch: Partial + renderableTabCount: number + activeRenderableTabId: string | null +} + +export function projectWorktreeTabModelReconciliation( + state: AppState, + worktreeId: string +): WorktreeTabModelReconciliation { + const unifiedTabs = state.unifiedTabsByWorktree[worktreeId] ?? [] + const groups = state.groupsByWorktree[worktreeId] ?? [] + const runtimeTerminalTabs = state.tabsByWorktree[worktreeId] ?? [] + const unifiedTerminalEntityIds = new Set( + unifiedTabs.filter((tab) => tab.contentType === 'terminal').map((tab) => tab.entityId) + ) + const legacyRuntimeTerminalTabs = runtimeTerminalTabs.filter((tab) => { + if (unifiedTerminalEntityIds.has(tab.id)) { + return false + } + // Why: reconnectable legacy tabs must re-enter the unified model instead of being orphaned. + return terminalTabHasReconnectablePty(state, tab.id, tab.ptyId) + }) + const orphanTerminalIds = getOrphanTerminalIds(state, worktreeId) + const ensuredGroupState = + legacyRuntimeTerminalTabs.length > 0 + ? ensureGroup( + state.groupsByWorktree, + state.activeGroupIdByWorktree, + worktreeId, + state.activeGroupIdByWorktree[worktreeId] + ) + : null + const reconciliationGroup = ensuredGroupState?.group ?? groups[0] ?? null + const restoredLegacyTabs = + reconciliationGroup == null + ? [] + : legacyRuntimeTerminalTabs + .sort((a, b) => a.sortOrder - b.sortOrder || a.createdAt - b.createdAt) + .map((tab) => ({ + id: tab.id, + entityId: tab.id, + groupId: reconciliationGroup.id, + worktreeId, + contentType: 'terminal' as const, + label: tab.title, + ...(tab.quickCommandLabel?.trim() + ? { quickCommandLabel: tab.quickCommandLabel.trim() } + : {}), + ...(tab.generatedTitle?.trim() ? { generatedLabel: tab.generatedTitle.trim() } : {}), + customLabel: tab.customTitle, + color: tab.color, + sortOrder: tab.sortOrder, + createdAt: tab.createdAt + })) + const reconciledUnifiedTabs = + restoredLegacyTabs.length > 0 ? [...unifiedTabs, ...restoredLegacyTabs] : unifiedTabs + const rememberedLegacyActiveTabId = state.activeTabIdByWorktree[worktreeId] + const restoredLegacyTabIds = new Set(restoredLegacyTabs.map((tab) => tab.id)) + const legacyFallbackActiveTabId = + rememberedLegacyActiveTabId && restoredLegacyTabIds.has(rememberedLegacyActiveTabId) + ? rememberedLegacyActiveTabId + : (restoredLegacyTabs[0]?.id ?? null) + const reconciledGroups = + restoredLegacyTabs.length > 0 && reconciliationGroup + ? updateGroup(ensuredGroupState!.groupsByWorktree[worktreeId] ?? [], { + ...reconciliationGroup, + // Why: restore runtime tabs into the active/root group so reattach cannot spawn a duplicate. + activeTabId: reconciliationGroup.activeTabId ?? legacyFallbackActiveTabId, + tabOrder: dedupeTabOrder([ + ...reconciliationGroup.tabOrder, + ...restoredLegacyTabs.map((tab) => tab.id) + ]) + }) + : groups + const liveTerminalIds = new Set( + runtimeTerminalTabs.filter((tab) => !orphanTerminalIds.has(tab.id)).map((tab) => tab.id) + ) + const liveEditorIds = new Set( + state.openFiles.filter((file) => file.worktreeId === worktreeId).map((file) => file.id) + ) + const liveBrowserIds = new Set( + (state.browserTabsByWorktree[worktreeId] ?? []).map((browserTab) => browserTab.id) + ) + + const isRenderableTab = (tab: Tab): boolean => { + if (tab.contentType === 'terminal') { + return liveTerminalIds.has(tab.entityId) + } + if (tab.contentType === 'browser') { + return liveBrowserIds.has(tab.entityId) + } + if (tab.contentType === 'simulator') { + return true + } + return liveEditorIds.has(tab.entityId) + } + + const validTabs = reconciledUnifiedTabs.filter(isRenderableTab) + const validTabIds = new Set(validTabs.map((tab) => tab.id)) + const nextGroupsWithEmpty = reconciledGroups.map((group) => { + const tabOrder = group.tabOrder.filter((tabId) => validTabIds.has(tabId)) + const activeTabId = + group.activeTabId && validTabIds.has(group.activeTabId) + ? group.activeTabId + : (tabOrder[0] ?? null) + const tabOrderUnchanged = + tabOrder.length === group.tabOrder.length && + tabOrder.every((tabId, index) => tabId === group.tabOrder[index]) + const recentTabIds = sanitizeRecentTabIds(group.recentTabIds, tabOrder) + const recentUnchanged = + recentTabIds.length === (group.recentTabIds ?? []).length && + recentTabIds.every((id, index) => id === (group.recentTabIds ?? [])[index]) + return tabOrderUnchanged && activeTabId === group.activeTabId && recentUnchanged + ? group + : { ...group, tabOrder, activeTabId, recentTabIds } + }) + const nextGroups = + validTabs.length > 0 + ? nextGroupsWithEmpty.filter((group) => group.tabOrder.length > 0) + : nextGroupsWithEmpty + const currentActiveGroupId = + state.activeGroupIdByWorktree[worktreeId] ?? + ensuredGroupState?.activeGroupIdByWorktree[worktreeId] + const activeGroupStillExists = nextGroups.some((group) => group.id === currentActiveGroupId) + const nextActiveGroupId = activeGroupStillExists + ? currentActiveGroupId + : (nextGroups.find((group) => group.activeTabId !== null)?.id ?? + nextGroups[0]?.id ?? + currentActiveGroupId) + const groupsChanged = + nextGroups.length !== groups.length || + nextGroups.some((group, index) => group !== groups[index]) + const tabsChanged = validTabs.length !== unifiedTabs.length || restoredLegacyTabs.length > 0 + const activeGroupChanged = nextActiveGroupId !== currentActiveGroupId + const baseNextLayout = + restoredLegacyTabs.length > 0 && reconciliationGroup + ? (state.layoutByWorktree[worktreeId] ?? { type: 'leaf', groupId: reconciliationGroup.id }) + : state.layoutByWorktree[worktreeId] + const validGroupIds = new Set(nextGroups.map((group) => group.id)) + const prunedNextLayout = + baseNextLayout && validGroupIds.size > 0 + ? pruneTabGroupLayoutForGroups(baseNextLayout, validGroupIds) + : baseNextLayout + const nextLayout = + prunedNextLayout ?? (nextGroups[0] ? { type: 'leaf', groupId: nextGroups[0].id } : undefined) + const currentLayout = state.layoutByWorktree[worktreeId] + const layoutChanged = nextLayout !== currentLayout + let patch: Partial = {} + + if ( + tabsChanged || + groupsChanged || + activeGroupChanged || + layoutChanged || + orphanTerminalIds.size > 0 + ) { + const droppedTerminalEntityIds = unifiedTabs.flatMap((tab) => + tab.contentType === 'terminal' && !validTabIds.has(tab.id) ? [tab.entityId] : [] + ) + let nextUnreadTerminalTabs = state.unreadTerminalTabs + if (droppedTerminalEntityIds.length > 0) { + const copy = { ...state.unreadTerminalTabs } + let changed = false + for (const entityId of droppedTerminalEntityIds) { + if (copy[entityId]) { + delete copy[entityId] + changed = true + } + } + if (changed) { + nextUnreadTerminalTabs = copy + } + } + patch = { + unifiedTabsByWorktree: { ...state.unifiedTabsByWorktree, [worktreeId]: validTabs }, + groupsByWorktree: { ...state.groupsByWorktree, [worktreeId]: nextGroups }, + activeGroupIdByWorktree: { + ...state.activeGroupIdByWorktree, + [worktreeId]: nextActiveGroupId + }, + ...(nextUnreadTerminalTabs !== state.unreadTerminalTabs + ? { unreadTerminalTabs: nextUnreadTerminalTabs } + : {}), + ...(nextLayout && layoutChanged + ? { + layoutByWorktree: { + ...state.layoutByWorktree, + // Why: restored runtime terminals need a concrete leaf before activation. + [worktreeId]: nextLayout + } + } + : {}), + ...(orphanTerminalIds.size > 0 + ? buildOrphanTerminalCleanupPatch(state, worktreeId, orphanTerminalIds) + : {}) + } + } + + return { + patch, + renderableTabCount: validTabs.length, + activeRenderableTabId: + nextGroups.find((group) => group.id === nextActiveGroupId)?.activeTabId ?? + nextGroups.find((group) => group.activeTabId !== null)?.activeTabId ?? + null + } +} + export const createTabsSlice: StateCreator = (set, get) => ({ unifiedTabsByWorktree: {}, renamingTabId: null, @@ -1807,220 +2016,13 @@ export const createTabsSlice: StateCreator = (set, }, reconcileWorktreeTabModel: (worktreeId) => { - const state = get() - const unifiedTabs = state.unifiedTabsByWorktree[worktreeId] ?? [] - const groups = state.groupsByWorktree[worktreeId] ?? [] - const runtimeTerminalTabs = state.tabsByWorktree[worktreeId] ?? [] - const unifiedTerminalEntityIds = new Set( - unifiedTabs.filter((tab) => tab.contentType === 'terminal').map((tab) => tab.entityId) - ) - const legacyRuntimeTerminalTabs = runtimeTerminalTabs.filter((tab) => { - if (unifiedTerminalEntityIds.has(tab.id)) { - return false - } - // Why: migration filter — keep any tab still owning a live/reconnecting - // PTY (preserved sessionId or a reconnect-map session) so it re-enters the - // unified model for wake/reconnect reattach instead of vanishing (#9911). - return terminalTabHasReconnectablePty(state, tab.id, tab.ptyId) - }) - const orphanTerminalIds = getOrphanTerminalIds(state, worktreeId) - const ensuredGroupState = - legacyRuntimeTerminalTabs.length > 0 - ? ensureGroup( - state.groupsByWorktree, - state.activeGroupIdByWorktree, - worktreeId, - state.activeGroupIdByWorktree[worktreeId] - ) - : null - const reconciliationGroup = ensuredGroupState?.group ?? groups[0] ?? null - const restoredLegacyTabs = - reconciliationGroup == null - ? [] - : legacyRuntimeTerminalTabs - .sort((a, b) => a.sortOrder - b.sortOrder || a.createdAt - b.createdAt) - .map((tab) => ({ - id: tab.id, - entityId: tab.id, - groupId: reconciliationGroup.id, - worktreeId, - contentType: 'terminal' as const, - label: tab.title, - ...(tab.quickCommandLabel?.trim() - ? { quickCommandLabel: tab.quickCommandLabel.trim() } - : {}), - ...(tab.generatedTitle?.trim() ? { generatedLabel: tab.generatedTitle.trim() } : {}), - customLabel: tab.customTitle, - color: tab.color, - sortOrder: tab.sortOrder, - createdAt: tab.createdAt - })) - const reconciledUnifiedTabs = - restoredLegacyTabs.length > 0 ? [...unifiedTabs, ...restoredLegacyTabs] : unifiedTabs - // Why: seed a freshly-ensured group's active tab from the remembered selection, else the worktree always reopens on Terminal 1. - const rememberedLegacyActiveTabId = state.activeTabIdByWorktree[worktreeId] - const restoredLegacyTabIds = new Set(restoredLegacyTabs.map((tab) => tab.id)) - const legacyFallbackActiveTabId = - rememberedLegacyActiveTabId && restoredLegacyTabIds.has(rememberedLegacyActiveTabId) - ? rememberedLegacyActiveTabId - : (restoredLegacyTabs[0]?.id ?? null) - const reconciledGroups = - restoredLegacyTabs.length > 0 && reconciliationGroup - ? updateGroup(ensuredGroupState!.groupsByWorktree[worktreeId] ?? [], { - ...reconciliationGroup, - // Why: restore runtime-slice legacy tabs into the active/root group so live PTYs stay reachable instead of spawning a duplicate. - activeTabId: reconciliationGroup.activeTabId ?? legacyFallbackActiveTabId, - tabOrder: dedupeTabOrder([ - ...reconciliationGroup.tabOrder, - ...restoredLegacyTabs.map((tab) => tab.id) - ]) - }) - : groups - const liveTerminalIds = new Set( - runtimeTerminalTabs.filter((tab) => !orphanTerminalIds.has(tab.id)).map((tab) => tab.id) - ) - const liveEditorIds = new Set( - state.openFiles.filter((file) => file.worktreeId === worktreeId).map((file) => file.id) - ) - const liveBrowserIds = new Set( - (state.browserTabsByWorktree[worktreeId] ?? []).map((browserTab) => browserTab.id) - ) - - const isRenderableTab = (tab: Tab): boolean => { - if (tab.contentType === 'terminal') { - return liveTerminalIds.has(tab.entityId) - } - if (tab.contentType === 'browser') { - return liveBrowserIds.has(tab.entityId) - } - if (tab.contentType === 'simulator') { - return true - } - return liveEditorIds.has(tab.entityId) + const reconciliation = projectWorktreeTabModelReconciliation(get(), worktreeId) + if (Object.keys(reconciliation.patch).length > 0) { + set(reconciliation.patch) } - - const validTabs = reconciledUnifiedTabs.filter(isRenderableTab) - const validTabIds = new Set(validTabs.map((tab) => tab.id)) - - const nextGroupsWithEmpty = reconciledGroups.map((group) => { - const tabOrder = group.tabOrder.filter((tabId) => validTabIds.has(tabId)) - const activeTabId = - group.activeTabId && validTabIds.has(group.activeTabId) - ? group.activeTabId - : (tabOrder[0] ?? null) - const tabOrderUnchanged = - tabOrder.length === group.tabOrder.length && - tabOrder.every((tabId, index) => tabId === group.tabOrder[index]) - // Why: keep the MRU stack in sync with dropped tabs so the next close doesn't activate one the renderer no longer owns. - const recentTabIds = sanitizeRecentTabIds(group.recentTabIds, tabOrder) - const recentUnchanged = - recentTabIds.length === (group.recentTabIds ?? []).length && - recentTabIds.every((id, index) => id === (group.recentTabIds ?? [])[index]) - return tabOrderUnchanged && activeTabId === group.activeTabId && recentUnchanged - ? group - : { ...group, tabOrder, activeTabId, recentTabIds } - }) - const nextGroups = - validTabs.length > 0 - ? nextGroupsWithEmpty.filter((group) => group.tabOrder.length > 0) - : nextGroupsWithEmpty - - const currentActiveGroupId = - state.activeGroupIdByWorktree[worktreeId] ?? - ensuredGroupState?.activeGroupIdByWorktree[worktreeId] - const activeGroupStillExists = nextGroups.some((group) => group.id === currentActiveGroupId) - const nextActiveGroupId = activeGroupStillExists - ? currentActiveGroupId - : (nextGroups.find((group) => group.activeTabId !== null)?.id ?? - nextGroups[0]?.id ?? - currentActiveGroupId) - - const groupsChanged = - nextGroups.length !== groups.length || - nextGroups.some((group, index) => group !== groups[index]) - const tabsChanged = validTabs.length !== unifiedTabs.length || restoredLegacyTabs.length > 0 - const activeGroupChanged = nextActiveGroupId !== currentActiveGroupId - - const baseNextLayout = - restoredLegacyTabs.length > 0 && reconciliationGroup - ? (state.layoutByWorktree[worktreeId] ?? { type: 'leaf', groupId: reconciliationGroup.id }) - : state.layoutByWorktree[worktreeId] - const validGroupIds = new Set(nextGroups.map((group) => group.id)) - const prunedNextLayout = - baseNextLayout && validGroupIds.size > 0 - ? pruneTabGroupLayoutForGroups(baseNextLayout, validGroupIds) - : baseNextLayout - const nextLayout = - prunedNextLayout ?? (nextGroups[0] ? { type: 'leaf', groupId: nextGroups[0].id } : undefined) - const currentLayout = state.layoutByWorktree[worktreeId] - const layoutChanged = nextLayout !== currentLayout - - if ( - tabsChanged || - groupsChanged || - activeGroupChanged || - layoutChanged || - orphanTerminalIds.size > 0 - ) { - // Why: drop unreadTerminalTabs entries (keyed by entityId) for terminal tabs reconcile removed, or the stale flag lingers forever. - const droppedTerminalEntityIds: string[] = [] - for (const tab of unifiedTabs) { - if (tab.contentType !== 'terminal') { - continue - } - if (!validTabIds.has(tab.id)) { - droppedTerminalEntityIds.push(tab.entityId) - } - } - set((current) => { - let nextUnreadTerminalTabs = current.unreadTerminalTabs - if (droppedTerminalEntityIds.length > 0) { - let changed = false - const copy = { ...current.unreadTerminalTabs } - for (const entityId of droppedTerminalEntityIds) { - if (copy[entityId]) { - delete copy[entityId] - changed = true - } - } - if (changed) { - nextUnreadTerminalTabs = copy - } - } - return { - unifiedTabsByWorktree: { ...current.unifiedTabsByWorktree, [worktreeId]: validTabs }, - groupsByWorktree: { ...current.groupsByWorktree, [worktreeId]: nextGroups }, - activeGroupIdByWorktree: { - ...current.activeGroupIdByWorktree, - [worktreeId]: nextActiveGroupId - }, - ...(nextUnreadTerminalTabs !== current.unreadTerminalTabs - ? { unreadTerminalTabs: nextUnreadTerminalTabs } - : {}), - ...(nextLayout && layoutChanged - ? { - layoutByWorktree: { - ...current.layoutByWorktree, - // Why: restored runtime terminal needs a concrete leaf before activation, else the fallback spawns a duplicate "Terminal 2". - [worktreeId]: nextLayout! - } - } - : {}), - ...(orphanTerminalIds.size > 0 - ? buildOrphanTerminalCleanupPatch(current, worktreeId, orphanTerminalIds) - : {}) - } - }) - } - - const activeRenderableTabId = - nextGroups.find((group) => group.id === nextActiveGroupId)?.activeTabId ?? - nextGroups.find((group) => group.activeTabId !== null)?.activeTabId ?? - null - return { - renderableTabCount: validTabs.length, - activeRenderableTabId + renderableTabCount: reconciliation.renderableTabCount, + activeRenderableTabId: reconciliation.activeRenderableTabId } }, diff --git a/src/renderer/src/store/slices/worktree-helpers.ts b/src/renderer/src/store/slices/worktree-helpers.ts index fd548c91e04..75ad5985153 100644 --- a/src/renderer/src/store/slices/worktree-helpers.ts +++ b/src/renderer/src/store/slices/worktree-helpers.ts @@ -35,6 +35,7 @@ import type { WorktreeCreationPhase } from '@/lib/pending-worktree-creation' import { getRepoIdFromWorktreeId } from '../../../../shared/worktree-id' +import type { AppState } from '../types' export { getRepoIdFromWorktreeId } from '../../../../shared/worktree-id' export type WorktreeDeleteState = { @@ -70,6 +71,12 @@ export type WorktreeRenameRequest = { rowKey?: string } +export type ActiveWorktreeStateTransition = (state: AppState) => { + patch: Partial + activate: boolean + preferredActiveUnifiedTabId?: string +} + export type WorktreeSlice = { worktreesByRepo: Record detectedWorktreesByRepo: Record @@ -280,7 +287,11 @@ export type WorktreeSlice = { * fresh visit. */ seedActiveWorktreeLastVisitedIfMissing: () => void - setActiveWorktree: (worktreeId: string | null, executionHostId?: ExecutionHostId) => void + setActiveWorktree: ( + worktreeId: string | null, + executionHostId?: ExecutionHostId, + options?: { stateTransition?: ActiveWorktreeStateTransition } + ) => boolean /** * Health-driven remount of one terminal tab: bumps the tab's generation so * TerminalPane unmounts, detaches (preserving a live PTY), and remounts with diff --git a/src/renderer/src/store/slices/worktrees.ts b/src/renderer/src/store/slices/worktrees.ts index 66bf295a715..310e3e82d8d 100644 --- a/src/renderer/src/store/slices/worktrees.ts +++ b/src/renderer/src/store/slices/worktrees.ts @@ -26,6 +26,7 @@ import { type WorktreeFetchOptions, type WorktreeSlice } from './worktree-helpers' +import { projectWorktreeTabModelReconciliation } from './tabs' import { splitWorktreeIdForFilesystem } from '../../../../shared/worktree-id' import { areWorkspaceLinkedItemsEqual } from '../../../../shared/workspace-linked-item' import { areTaskSourceContextsEqual } from '../../../../shared/task-source-context' @@ -5238,7 +5239,14 @@ export const createWorktreeSlice: StateCreator return remounted }, - setActiveWorktree: (worktreeId, executionHostId) => { + setActiveWorktree: (worktreeId, executionHostId, options) => { + const stateTransition = options?.stateTransition?.(get()) + if (stateTransition && !stateTransition.activate) { + if (Object.keys(stateTransition.patch).length > 0) { + set(stateTransition.patch) + } + return false + } const workspaceScope = worktreeId ? parseWorkspaceKey(worktreeId) : null if (worktreeId && shouldDeferActivationTerminalPrep()) { markInputQuietSchedulerInput() @@ -5247,15 +5255,27 @@ export const createWorktreeSlice: StateCreator if (get().activeWorktreeId !== worktreeId) { moveFocusToRendererBeforeFocusedWebviewHidden() } - const reconciledActiveTabId = worktreeId - ? get().reconcileWorktreeTabModel(worktreeId).activeRenderableTabId - : null let shouldClearUnread = false let shouldPrepareTerminalTabs = false let shouldTagTerminalTabs = false - set((s) => { + set((current) => { + const transitioned = stateTransition + ? ({ ...current, ...stateTransition.patch } as AppState) + : current + const reconciliation = worktreeId + ? projectWorktreeTabModelReconciliation(transitioned, worktreeId) + : null + const reconciliationChanged = Boolean( + reconciliation && Object.keys(reconciliation.patch).length > 0 + ) + const s = + reconciliation && reconciliationChanged + ? ({ ...transitioned, ...reconciliation.patch } as AppState) + : transitioned + const reconciledActiveTabId = reconciliation?.activeRenderableTabId ?? null if (!worktreeId) { return { + ...stateTransition?.patch, activeWorktreeId: null, activeWorkspaceKey: null, activeWorkspaceExecutionHostId: null, @@ -5279,7 +5299,11 @@ export const createWorktreeSlice: StateCreator ? ((s.groupsByWorktree[worktreeId] ?? []).find((group) => group.id === activeGroupId) ?? null) : null - const activeUnifiedTabId = reconciledActiveTabId ?? activeGroup?.activeTabId ?? null + const activeUnifiedTabId = + stateTransition?.preferredActiveUnifiedTabId ?? + reconciledActiveTabId ?? + activeGroup?.activeTabId ?? + null const activeUnifiedTab = activeUnifiedTabId != null ? ((s.unifiedTabsByWorktree[worktreeId] ?? []).find( @@ -5408,7 +5432,12 @@ export const createWorktreeSlice: StateCreator : workspace ) : s.folderWorkspaces - const nextActiveRepoId = workspaceScope?.type === 'folder' ? null : s.activeRepoId + const nextActiveRepoId = + workspaceScope?.type === 'folder' + ? null + : stateTransition + ? (worktree?.repoId ?? s.activeRepoId) + : s.activeRepoId const tabsByWorktreeUpdate = allDead && worktreeId != null ? { @@ -5444,13 +5473,17 @@ export const createWorktreeSlice: StateCreator nextWorktrees !== s.worktreesByRepo || nextDetectedWorktrees !== s.detectedWorktreesByRepo || nextFolderWorkspaces !== s.folderWorkspaces || - nextActiveRepoId !== s.activeRepoId + nextActiveRepoId !== s.activeRepoId || + reconciliationChanged || + stateTransition !== undefined if (!hasStateChange) { // Why: preserve the root Zustand reference on a no-op re-activation so session persistence/runtime sync don't fan out. return s } return { + ...stateTransition?.patch, + ...reconciliation?.patch, activeRepoId: nextActiveRepoId, activeWorktreeId: worktreeId, activeWorkspaceKey: isWorkspaceKey(worktreeId) @@ -5531,13 +5564,13 @@ export const createWorktreeSlice: StateCreator } if (!worktreeId || !get().getKnownWorktreeById(worktreeId, executionHostId)) { - return + return true } if (shouldClearUnread) { if (workspaceScope?.type === 'folder') { void get().updateFolderWorkspace(workspaceScope.folderWorkspaceId, { isUnread: false }) - return + return true } persistPassiveWorktreeMetaForOwner( get, @@ -5546,6 +5579,7 @@ export const createWorktreeSlice: StateCreator 'persist worktree activation state' ) } + return true }, setActiveFolderWorkspace: (folderWorkspaceId, executionHostId) => { diff --git a/src/shared/runtime-types.ts b/src/shared/runtime-types.ts index d4d0efc1ad8..6e012e60b42 100644 --- a/src/shared/runtime-types.ts +++ b/src/shared/runtime-types.ts @@ -409,8 +409,8 @@ export type RuntimeTerminalPathOpenTarget = } /** Result of resolving a file path tapped in the mobile terminal against the - * worktree root (+ optional cwd). relativePath is null when the path resolves - * outside the worktree (not openable via the worktree-scoped file RPCs). */ + * selected or sibling workspace root (+ optional cwd). relativePath is null + * when no workspace on the same execution host owns the path. */ export type RuntimeTerminalPathResolution = { worktree: string relativePath: string | null diff --git a/src/shared/runtime-workspace-file-owner.test.ts b/src/shared/runtime-workspace-file-owner.test.ts new file mode 100644 index 00000000000..c6d003b8ea6 --- /dev/null +++ b/src/shared/runtime-workspace-file-owner.test.ts @@ -0,0 +1,74 @@ +import { describe, expect, it } from 'vitest' +import { findRuntimeWorkspaceFileOwner } from './runtime-workspace-file-owner' + +describe('findRuntimeWorkspaceFileOwner', () => { + const roots = [ + { workspaceId: 'repo-a', rootPath: '/srv/repo-a', executionHostId: 'runtime:host-a' as const }, + { workspaceId: 'repo-b', rootPath: '/srv/repo-b', executionHostId: 'runtime:host-a' as const }, + { + workspaceId: 'repo-b-docs', + rootPath: '/srv/repo-b/docs', + executionHostId: 'runtime:host-a' as const + }, + { + workspaceId: 'other-host', + rootPath: '/srv/repo-b', + executionHostId: 'runtime:host-b' as const + } + ] + + it('finds a sibling workspace on the same execution host', () => { + expect( + findRuntimeWorkspaceFileOwner(roots, '/srv/repo-b/src/index.ts', 'runtime:host-a') + ).toMatchObject({ + workspaceId: 'repo-b', + relativePath: 'src/index.ts' + }) + }) + + it('uses the most specific nested workspace root', () => { + expect( + findRuntimeWorkspaceFileOwner(roots, '/srv/repo-b/docs/guide.md', 'runtime:host-a') + ).toMatchObject({ + workspaceId: 'repo-b-docs', + relativePath: 'guide.md' + }) + }) + + it('uses an exact nested workspace root instead of its parent', () => { + expect( + findRuntimeWorkspaceFileOwner(roots, '/srv/repo-b/docs', 'runtime:host-a') + ).toMatchObject({ + workspaceId: 'repo-b-docs', + relativePath: '' + }) + }) + + it('does not cross execution-host boundaries', () => { + expect( + findRuntimeWorkspaceFileOwner(roots, '/srv/repo-b/src/index.ts', 'runtime:host-b') + ).toMatchObject({ + workspaceId: 'other-host' + }) + expect(findRuntimeWorkspaceFileOwner(roots, '/srv/repo-a/file.ts', 'runtime:host-b')).toBeNull() + }) + + it('matches Windows roots without case-sensitive drive assumptions', () => { + expect( + findRuntimeWorkspaceFileOwner( + [ + { + workspaceId: 'windows-repo', + rootPath: 'C:\\Work\\Repo', + executionHostId: 'runtime:windows' + } + ], + 'c:\\work\\repo\\src\\index.ts', + 'runtime:windows' + ) + ).toMatchObject({ + workspaceId: 'windows-repo', + relativePath: 'src/index.ts' + }) + }) +}) diff --git a/src/shared/runtime-workspace-file-owner.ts b/src/shared/runtime-workspace-file-owner.ts new file mode 100644 index 00000000000..1edacb07bbc --- /dev/null +++ b/src/shared/runtime-workspace-file-owner.ts @@ -0,0 +1,43 @@ +import type { ExecutionHostId } from './execution-host' +import { normalizeRuntimePathForComparison, relativePathInsideRoot } from './cross-platform-path' + +export type RuntimeWorkspaceFileRoot = { + workspaceId: string + rootPath: string + executionHostId: ExecutionHostId +} + +export type RuntimeWorkspaceFileOwner = RuntimeWorkspaceFileRoot & { + relativePath: string +} + +export function findRuntimeWorkspaceFileOwner( + roots: readonly RuntimeWorkspaceFileRoot[], + absolutePath: string, + executionHostId: ExecutionHostId +): RuntimeWorkspaceFileOwner | null { + let best: RuntimeWorkspaceFileOwner | null = null + let bestRootLength = -1 + + for (const root of roots) { + if (root.executionHostId !== executionHostId) { + continue + } + const relativePath = relativePathInsideRoot(root.rootPath, absolutePath) + if (relativePath === null) { + continue + } + const rootLength = normalizeRuntimePathForComparison(root.rootPath).length + if ( + rootLength > bestRootLength || + (rootLength === bestRootLength && + best !== null && + root.workspaceId.localeCompare(best.workspaceId) < 0) + ) { + best = { ...root, relativePath } + bestRootLength = rootLength + } + } + + return best +} From e43bd6c4adb1f1073c928e8788d4efbc834f3646 Mon Sep 17 00:00:00 2001 From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Date: Mon, 3 Aug 2026 22:29:19 -0700 Subject: [PATCH 04/72] fix(worktrees): preserve folder PTY owner scope (#12429) --- src/main/ipc/worktrees.test.ts | 33 +++++++++++++++++++++++++++ src/main/ipc/worktrees.ts | 6 ++--- src/main/runtime/orca-runtime.test.ts | 4 +++- src/main/runtime/orca-runtime.ts | 24 ++++++++----------- 4 files changed, 48 insertions(+), 19 deletions(-) diff --git a/src/main/ipc/worktrees.test.ts b/src/main/ipc/worktrees.test.ts index 8d576b965ee..c83eece63b6 100644 --- a/src/main/ipc/worktrees.test.ts +++ b/src/main/ipc/worktrees.test.ts @@ -8380,6 +8380,8 @@ describe('registerWorktreeHandlers', () => { connectionId: 'conn-1' }) getSshPtyProviderMock.mockReturnValue(sshPtyProvider) + // One global meta key can describe the same-id local copy; the resolved repo still owns this delete. + store.getWorktreeMeta.mockReturnValue(makeWorktreeMeta({ hostId: 'local' })) await handlers['worktrees:remove'](null, { worktreeId }) @@ -8395,6 +8397,37 @@ describe('registerWorktreeHandlers', () => { }) }) + it('fences a mirrored runtime folder workspace sweep to its environment', async () => { + const runtimePtyProvider = {} as never + const worktreeId = 'repo-folder::/runtime/folder::workspace:child-1' + store.getRepo.mockReturnValue({ + id: 'repo-folder', + path: '/runtime/folder', + displayName: 'folder', + badgeColor: '#000', + addedAt: 0, + kind: 'folder', + executionHostId: 'runtime:env-1' + }) + getLocalPtyProviderMock.mockReturnValue(runtimePtyProvider) + + await handlers['worktrees:remove'](null, { + worktreeId, + hostId: 'runtime:env-1' + }) + + expect(killAllProcessesForWorktreeMock).toHaveBeenCalledWith(worktreeId, { + runtime: runtimeStub, + resolvedWorktreeId: worktreeId, + resolvedRuntimeEnvironmentId: 'env-1', + localProvider: runtimePtyProvider, + onPtyStopped: clearProviderPtyStateMock, + includeProviderInventory: false, + includeLocalRegistry: false + }) + expect(getSshPtyProviderMock).not.toHaveBeenCalled() + }) + it('runs the archive hook on remove when skipArchive is not set', async () => { mockKnownFeatureWorktree() removeWorktreeMock.mockResolvedValue(undefined) diff --git a/src/main/ipc/worktrees.ts b/src/main/ipc/worktrees.ts index dde33ca7628..c8dceec6bed 100644 --- a/src/main/ipc/worktrees.ts +++ b/src/main/ipc/worktrees.ts @@ -2297,9 +2297,9 @@ export function registerWorktreeHandlers( await withWorktreeRemoveStageSpan('pty_sweep', 'folder', async () => { // Folder projects can be SSH-backed, so fence the sweep to the owning host exactly // like the git paths — the local inventory must never reach a remote workspace's id. - const ownerHost = parseExecutionHostId( - resolveWorktreeRemovalOwnerHostId(store, args.worktreeId, repo, args.hostId) - ) + // The resolved repo is authoritative here: path-derived metadata is shared by + // same-id host copies and can describe a different owner's workspace. + const ownerHost = parseExecutionHostId(removalHostId) const sshPtyProvider = ownerHost?.kind === 'ssh' ? getSshPtyProvider(ownerHost.targetId) : undefined const externalHost = ownerHost?.kind === 'ssh' || ownerHost?.kind === 'runtime' diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts index 3aa249a0d99..722acf67937 100644 --- a/src/main/runtime/orca-runtime.test.ts +++ b/src/main/runtime/orca-runtime.test.ts @@ -3943,7 +3943,9 @@ describe('OrcaRuntimeService', () => { displayName: 'Folder', badgeColor: 'blue', addedAt: 1, - kind: 'folder' as const + kind: 'folder' as const, + // removeManagedWorktree executes inside this selected runtime, where PTYs are local ids. + executionHostId: 'runtime:env-1' as const } const rootWorktreeId = 'folder-repo::/workspace/folder' const rootPriorWorktreeIds = ['folder-repo::/workspace/old-folder'] diff --git a/src/main/runtime/orca-runtime.ts b/src/main/runtime/orca-runtime.ts index 088f52d5b26..849cfdc9c72 100644 --- a/src/main/runtime/orca-runtime.ts +++ b/src/main/runtime/orca-runtime.ts @@ -23511,31 +23511,25 @@ export class OrcaRuntimeService { 'Cannot delete the project root workspace. Remove the folder project instead.' ) } - // Folder projects can be SSH-backed, so resolve the owner before sweeping. - const folderHost = parseExecutionHostId( - store.getWorktreeMeta(removalTarget.id)?.hostId ?? getRepoExecutionHostId(repo) - ) - const folderSshPtyProvider = - folderHost?.kind === 'ssh' ? this.getSshProviderFn?.(folderHost.targetId) : undefined - const externalFolderHost = folderHost?.kind === 'ssh' || folderHost?.kind === 'runtime' + // This service runs inside the selected runtime, so runtime-stamped repos use its + // local PTY namespace; only a direct SSH connection is external from here. + const folderConnectionId = repo.connectionId?.trim() || null + const folderSshPtyProvider = folderConnectionId + ? this.getSshProviderFn?.(folderConnectionId) + : undefined const folderPtyProvider = folderSshPtyProvider ?? this.getLocalProvider() if (folderPtyProvider) { // Why: folder workspace deletion has no Git removal phase where PTYs // would otherwise be swept; tear them down before hiding the workspace. await killAllProcessesForWorktree(removalTarget.id, { runtime: this, - // External host inventories must never sweep a same-id local workspace. resolvedWorktreeId: removalTarget.id, - ...(folderHost?.kind === 'ssh' ? { resolvedConnectionId: folderHost.targetId } : {}), - ...(folderHost?.kind === 'runtime' - ? { resolvedRuntimeEnvironmentId: folderHost.environmentId } - : {}), + ...(folderConnectionId ? { resolvedConnectionId: folderConnectionId } : {}), localProvider: folderPtyProvider, onPtyStopped: this.onPtyStopped ?? undefined, - ...(externalFolderHost + ...(folderConnectionId ? { - includeProviderInventory: - folderHost?.kind === 'ssh' && Boolean(folderSshPtyProvider), + includeProviderInventory: Boolean(folderSshPtyProvider), includeLocalRegistry: false } : {}) From 086a5d6495fc47b5a234fa399e71565851979124 Mon Sep 17 00:00:00 2001 From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Date: Mon, 3 Aug 2026 22:41:14 -0700 Subject: [PATCH 05/72] fix(browser): rerun guest retention after veto release (#12430) --- src/renderer/src/components/Terminal.tsx | 24 +++++++++++- .../browser-automation-visibility.test.ts | 8 ++++ .../browser-automation-visibility.ts | 4 ++ .../browser-page-download-activity.test.ts | 9 ++++- .../browser-page-download-activity.ts | 37 +++++++++++++------ 5 files changed, 67 insertions(+), 15 deletions(-) diff --git a/src/renderer/src/components/Terminal.tsx b/src/renderer/src/components/Terminal.tsx index deae7c9d1a8..6eaf0afc78b 100644 --- a/src/renderer/src/components/Terminal.tsx +++ b/src/renderer/src/components/Terminal.tsx @@ -49,10 +49,12 @@ import { RetainedBrowserPaneOverlayLayer } from './browser-pane/BrowserPaneOverl import EmulatorPaneOverlayLayer from './emulator-pane/EmulatorPaneOverlayLayer' import { isBrowserAutomationVisible, + onBrowserAutomationVisibilityChange, useBrowserAutomationVisibilityForAny } from './browser-pane/browser-automation-visibility' import { isBrowserPageMobileDriven, + onBrowserDriverChange, useBrowserMobileDriverForAny } from '@/lib/pane-manager/browser-mobile-driver-state' import TerminalPaneOverlayLayer from './terminal-pane/TerminalPaneOverlayLayer' @@ -788,6 +790,7 @@ function Terminal(): React.JSX.Element | null { const measurableBackgroundWorktreeTimersRef = useRef(new Map()) const [backgroundMountRevision, setBackgroundMountRevision] = useState(0) const [terminalParkingRevision, setTerminalParkingRevision] = useState(0) + const [browserGuestRetentionRevision, setBrowserGuestRetentionRevision] = useState(0) const [parkedTerminalWorktreeIds, setParkedTerminalWorktreeIds] = useState>( () => new Set() ) @@ -1166,7 +1169,19 @@ function Terminal(): React.JSX.Element | null { ]) // Why here: downloads outlive the pane-local state of hidden (unmounted) // BrowserPanes, and the eviction veto below must see them. - useEffect(() => installBrowserPageDownloadActivityTracking(), []) + useEffect(() => { + const invalidateRetention = (): void => { + setBrowserGuestRetentionRevision((revision) => revision + 1) + } + const removeDownloadTracking = installBrowserPageDownloadActivityTracking(invalidateRetention) + const removeAutomationTracking = onBrowserAutomationVisibilityChange(invalidateRetention) + const removeMobileTracking = onBrowserDriverChange(invalidateRetention) + return () => { + removeDownloadTracking() + removeAutomationTracking() + removeMobileTracking() + } + }, []) // Browser-guest retention budget (#12137 follow-up): hidden worktrees keep // webview guests alive for instant revisits, but only the most recently // activated few. Older ones have every guest FULLY destroyed through the @@ -1231,7 +1246,12 @@ function Terminal(): React.JSX.Element | null { worktreeId ) } - }, [renderedActiveWorktreeId, workspaceSurfaces, browserGuestRetentionBudgetEnabled]) + }, [ + renderedActiveWorktreeId, + workspaceSurfaces, + browserGuestRetentionBudgetEnabled, + browserGuestRetentionRevision + ]) // Why: a slow post-reconnect step exposes workspaceSessionReady before hydration can populate snapshot capabilities. if ( renderedActiveWorktreeId && diff --git a/src/renderer/src/components/browser-pane/browser-automation-visibility.test.ts b/src/renderer/src/components/browser-pane/browser-automation-visibility.test.ts index dd15257ac87..14f4d8c9976 100644 --- a/src/renderer/src/components/browser-pane/browser-automation-visibility.test.ts +++ b/src/renderer/src/components/browser-pane/browser-automation-visibility.test.ts @@ -19,8 +19,11 @@ describe('browser automation visibility leases', () => { const { acquireBrowserAutomationVisibility, isBrowserAutomationVisible, + onBrowserAutomationVisibilityChange, releaseBrowserAutomationVisibility } = await import('./browser-automation-visibility') + const listener = vi.fn() + const unsubscribe = onBrowserAutomationVisibilityChange(listener) const first = acquireBrowserAutomationVisibility('page-1') const second = acquireBrowserAutomationVisibility('page-1') @@ -32,6 +35,11 @@ describe('browser automation visibility leases', () => { expect(releaseBrowserAutomationVisibility(second)).toBe(true) expect(isBrowserAutomationVisible('page-1')).toBe(false) + expect(listener).toHaveBeenCalledTimes(4) + + unsubscribe() + acquireBrowserAutomationVisibility('page-2') + expect(listener).toHaveBeenCalledTimes(4) }) it('installs a main-process bridge that keeps the page visible while waiting for paint', async () => { diff --git a/src/renderer/src/components/browser-pane/browser-automation-visibility.ts b/src/renderer/src/components/browser-pane/browser-automation-visibility.ts index 6b092f2c950..f810d22f024 100644 --- a/src/renderer/src/components/browser-pane/browser-automation-visibility.ts +++ b/src/renderer/src/components/browser-pane/browser-automation-visibility.ts @@ -34,6 +34,10 @@ function subscribe(listener: () => void): () => void { } } +export function onBrowserAutomationVisibilityChange(listener: () => void): () => void { + return subscribe(listener) +} + function getSnapshot(): number { return version } diff --git a/src/renderer/src/components/browser-pane/browser-page-download-activity.test.ts b/src/renderer/src/components/browser-pane/browser-page-download-activity.test.ts index d428f20b409..cfd9c3f2e0c 100644 --- a/src/renderer/src/components/browser-pane/browser-page-download-activity.test.ts +++ b/src/renderer/src/components/browser-pane/browser-page-download-activity.test.ts @@ -74,21 +74,26 @@ describe('browser page download activity', () => { it('deactivates an interrupted download (no finished event ever fires) and reactivates on resume', async () => { const { hasActiveBrowserPageDownload, installBrowserPageDownloadActivityTracking } = await import('./browser-page-download-activity') - installBrowserPageDownloadActivityTracking() + const onEvictionVetoChange = vi.fn() + installBrowserPageDownloadActivityTracking(onEvictionVetoChange) requestedCallbacks[0]({ downloadId: 'dl-1', browserPageId: 'page-1' }) progressCallbacks[0]({ downloadId: 'dl-1', state: 'interrupted' }) expect(hasActiveBrowserPageDownload('page-1')).toBe(false) + expect(onEvictionVetoChange).toHaveBeenCalledTimes(2) progressCallbacks[0]({ downloadId: 'dl-1', state: 'progressing' }) expect(hasActiveBrowserPageDownload('page-1')).toBe(true) - // A null state is transport noise, not a transition. + // Duplicate progress and null transport noise are not transitions. + progressCallbacks[0]({ downloadId: 'dl-1', state: 'progressing' }) progressCallbacks[0]({ downloadId: 'dl-1', state: null }) expect(hasActiveBrowserPageDownload('page-1')).toBe(true) + expect(onEvictionVetoChange).toHaveBeenCalledTimes(3) finishedCallbacks[0]({ downloadId: 'dl-1' }) expect(hasActiveBrowserPageDownload('page-1')).toBe(false) + expect(onEvictionVetoChange).toHaveBeenCalledTimes(4) }) it('ignores duplicate start events, unknown progress and unknown finish events', async () => { diff --git a/src/renderer/src/components/browser-pane/browser-page-download-activity.ts b/src/renderer/src/components/browser-pane/browser-page-download-activity.ts index 0b3e1af2895..4c2b270ed8c 100644 --- a/src/renderer/src/components/browser-pane/browser-page-download-activity.ts +++ b/src/renderer/src/components/browser-pane/browser-page-download-activity.ts @@ -12,7 +12,11 @@ export function hasActiveBrowserPageDownload(browserPageId: string): boolean { return (activeDownloadCountByPageId.get(browserPageId) ?? 0) > 0 } -function setDownloadActive(download: TrackedDownload, active: boolean): void { +function setDownloadActive( + download: TrackedDownload, + active: boolean, + onEvictionVetoChange: () => void +): void { if (download.active === active) { return } @@ -23,50 +27,61 @@ function setDownloadActive(download: TrackedDownload, active: boolean): void { } else { activeDownloadCountByPageId.set(download.browserPageId, count) } + onEvictionVetoChange() } -function trackDownloadStarted(downloadId: string, browserPageId: string): void { +function trackDownloadStarted( + downloadId: string, + browserPageId: string, + onEvictionVetoChange: () => void +): void { if (trackedDownloadsById.has(downloadId)) { return } const download: TrackedDownload = { browserPageId, active: false } trackedDownloadsById.set(downloadId, download) - setDownloadActive(download, true) + setDownloadActive(download, true, onEvictionVetoChange) } // Why: an interrupted-resumable download never fires Chromium's 'done' (no // finished event), and Orca has no resume path — without this transition the // veto would outlive the download for the whole session. A resumed download // re-actives on its next 'progressing' tick, restoring the veto. -function trackDownloadProgress(downloadId: string, state: 'progressing' | 'interrupted' | null): void { +function trackDownloadProgress( + downloadId: string, + state: 'progressing' | 'interrupted' | null, + onEvictionVetoChange: () => void +): void { const download = trackedDownloadsById.get(downloadId) if (!download || state === null) { return } - setDownloadActive(download, state === 'progressing') + setDownloadActive(download, state === 'progressing', onEvictionVetoChange) } -function trackDownloadFinished(downloadId: string): void { +function trackDownloadFinished(downloadId: string, onEvictionVetoChange: () => void): void { const download = trackedDownloadsById.get(downloadId) if (!download) { return } - setDownloadActive(download, false) + setDownloadActive(download, false, onEvictionVetoChange) trackedDownloadsById.delete(downloadId) } /** App-lifetime tracking; install once from the surface host (Terminal). The * cleanup clears tracked state — a host unmount tears down every guest, so * stale entries must not veto eviction after a remount. */ -export function installBrowserPageDownloadActivityTracking(): () => void { +export function installBrowserPageDownloadActivityTracking( + onEvictionVetoChange: () => void = () => {} +): () => void { const removeRequested = window.api.browser.onDownloadRequested((event) => { - trackDownloadStarted(event.downloadId, event.browserPageId) + trackDownloadStarted(event.downloadId, event.browserPageId, onEvictionVetoChange) }) const removeProgress = window.api.browser.onDownloadProgress((event) => { - trackDownloadProgress(event.downloadId, event.state) + trackDownloadProgress(event.downloadId, event.state, onEvictionVetoChange) }) const removeFinished = window.api.browser.onDownloadFinished((event) => { - trackDownloadFinished(event.downloadId) + trackDownloadFinished(event.downloadId, onEvictionVetoChange) }) return () => { removeRequested() From ba83a71e302f98d1831af9673b2cd5300f1050a1 Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Mon, 3 Aug 2026 22:48:22 -0700 Subject: [PATCH 06/72] fix(terminal): apply the running-process close confirmation to every tab close path (#10142) (#12272) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * test(repro): demonstrate #10142 tab X close bypasses running-process confirmation Unit repro: closeTerminalTab (the X-button/middle-click entry) never consults inspectRuntimeTerminalProcess and drops a tab with a live child. E2E repro: Cmd+W shows 'Stop running command?' for a tab running sleep 300; cancelling then clicking the tab X closes it silently. Co-authored-by: Orca * fix(terminal): confirm running-process close on every tab close path (#10142) The tab-strip X button, middle-click and the tab context menu closed a terminal with a live child process without asking, while Cmd+W raised "Stop running command?" for the same tab. The probe lived only in TerminalPane's pane-level close handler; every mouse entry point reaches closeTerminalTab(), which guarded pinned tabs and nothing else. Move the decision into closeTerminalTab, above the web-runtime branch so paired/remote host-backed tabs are covered too, and give the last-pane keyboard close back to it instead of probing twice: - running-terminal-close-guard.ts probes every live PTY of the tab and fails open on a rejected probe or a stale remote handle, matching what Cmd+W already did. No live PTY ids => fully synchronous close, so idle, parked and hibernated tabs keep today's behavior. - shouldConfirmRunningTerminalClose keeps lifecycle echoes, bulk closes, CLI/RPC closes and the post-confirmation re-entry off the modal path. - A standalone confirm store drives RunningTerminalCloseDialog, which reuses the existing CloseTerminalDialog (no new user-visible strings). The request carries the tab label because a tab-strip close can target a tab the user is not looking at, and dedupes by tab id. - TerminalPane.handleRequestClosePane now delegates the last pane to closeTerminalTab. Its transport ptyId is nullable by design, so the old path silently skipped the prompt mid-reattach; the pane keeps its own probe only for closing one pane of a split. - Agent panes win the dialog copy when a split has both an agent and a plain command busy, instead of depending on PTY spawn order. - Tab-group closeItem ran leaveWorktreeIfEmpty synchronously after a close that can now defer; it moves to onClosed and still honors skipEmptyCheck. Co-authored-by: Orca * fix(terminal): close the running-process confirmation gaps on every path (#10142) Follow-up hardening on the tab-close confirmation, from review of the first pass: - A pinned tab with `confirmClosePinnedTab` off never got the running-process prompt on any path, including Cmd+W, which is a regression against the old pane-level behavior: the pinned branch short-circuited on pinned-ness alone and re-entered with `force`, which the running guard excludes. The pin prompt now supersedes only when it will actually appear; with the setting off the close falls through to the running guard. - The probe chain had no `.catch`, so a throw in the decision (a copy-kind lookup on a tab id makePaneKey rejects, a store subscriber) left the tab silently unclosed with no user feedback. It now fails open, as the pane path it replaced did. - A wedged remote inspect RPC could leave the X button looking dead for its full 15s timeout. The probe is now bounded; every close path shares the bound, so keyboard and mouse still behave identically. - The agent-vs-command copy had two resolvers on exactly the keyboard/mouse seam this issue is about. terminal-close-copy-kind.ts is now the single policy; TerminalPane and the tab-strip guard both call it. - The running queue is async while the pinned queue is synchronous, so both could be pending at once and stack two modal overlays. The running dialog now waits for a visible pinned confirmation. - Deduping a repeat close request dropped the second caller's callbacks; it now folds them in, so both closes resolve from one prompt. Ticking "don't ask again" also drains queued prompts instead of showing one the user just opted out of, and a queued prompt no longer inherits the previous tab's tick. closeTerminalTab drops its private pinned predicate for the shared isUnifiedTabPinned, whose only consumer the previous commit had removed. * test(e2e): wait for `sleep` to own the terminal before closing it (#10142) The running-process close specs polled `hasChildProcesses` to decide the tab was busy, but macOS starts the shell under `login`, so an initialising terminal already reports a child before `sleep 300` runs. Both specs could therefore press close against a shell that never started the command: the probe correctly saw an idle terminal and closed without asking, and the adjudicated repro failed against a correct fix. Wait for `foregroundProcess === 'sleep'` instead. Assertions are unchanged, and the repro still fails at the pre-fix baseline (a92d8e0b0d). * fix(terminal): ask instead of closing when the close probe times out (#10142) Round-1 review follow-ups. - The 4s probe bound closed the tab outright, but `inspectRuntimeTerminalProcess` gives remote runtimes a 15s RPC timeout: any probe taking 4-15s silently killed a running remote command that Cmd+W used to prompt about, and the pane path now delegates its last-pane close to this guard. An unanswered probe is unknown, not idle, so the timeout raises the confirmation with every pty treated as a candidate. Failing open still applies to an *answered* probe (rejection, stale remote handle), which is the pre-existing pane behavior. - The split-pane Cmd+W probe had no bound at all; it now shares the same one, so the two paths give the same answer to the same question. - The renamed regression spec dropped its repro scaffolding: the hardcoded /tmp screenshot directory (also a cross-platform path violation) and the title/docblock that still described the bug as open. * fix(terminal): adopt the double-activation guard and layout pty lookup from #10167 (#10142) Cross-referenced against @innocarpe's #10167, which solved the same issue. Two things it got right that this branch did not: - Queue actions now hold off for 350ms after a queued request replaces the visible one, matching the sibling pinned-tab confirmation. Without it the second click of a double-click aimed at one tab lands on the next tab's prompt and kills a running process the user never saw asked about — the exact bug class this PR exists to close. - The pty lookup unions the layout bindings with ptyIdsByTabId. A mounting pane is bound into the layout before the liveness map catches up, and the store's own teardown collector unions both for that reason, so reading only the map let a close slip through that window with no prompt. Also replaces the render-time ref write that failed React Doctor's "Ref mutated during render" rule: the queued-request checkbox reset now goes through CloseTerminalDialog's existing subject-change reset instead of remounting via key, which keeps the exit animation on one element. Co-authored-by: Orca --------- Co-authored-by: Orca --- src/renderer/src/App.tsx | 2 + src/renderer/src/components/Terminal.tsx | 3 +- .../tab-group/useTabGroupWorkspaceModel.ts | 13 +- .../terminal-pane/CloseTerminalDialog.tsx | 25 ++ .../RunningTerminalCloseDialog.test.tsx | 247 +++++++++++ .../RunningTerminalCloseDialog.tsx | 45 ++ .../components/terminal-pane/TerminalPane.tsx | 66 +-- .../use-terminal-pane-lifecycle.ts | 3 +- .../running-terminal-close-guard.test.ts | 409 ++++++++++++++++++ .../terminal/running-terminal-close-guard.ts | 154 +++++++ ...al-close-confirm-keyboard-vs-mouse.test.ts | 131 ++++++ .../terminal/terminal-close-copy-kind.test.ts | 67 +++ .../terminal/terminal-close-copy-kind.ts | 38 ++ .../terminal/terminal-tab-actions.ts | 56 ++- ...terminal-tab-close-running-confirm.test.ts | 263 +++++++++++ src/renderer/src/hooks/useIpcEvents.test.ts | 5 +- src/renderer/src/hooks/useIpcEvents.ts | 3 +- .../src/store/pinned-tab-close-guard.ts | 10 +- .../running-terminal-close-confirm.test.ts | 226 ++++++++++ .../store/running-terminal-close-confirm.ts | 132 ++++++ ...al-tab-close-running-confirm-mouse.spec.ts | 101 +++++ ...terminal-tab-close-running-confirm.spec.ts | 90 ++++ 22 files changed, 2033 insertions(+), 56 deletions(-) create mode 100644 src/renderer/src/components/terminal-pane/RunningTerminalCloseDialog.test.tsx create mode 100644 src/renderer/src/components/terminal-pane/RunningTerminalCloseDialog.tsx create mode 100644 src/renderer/src/components/terminal/running-terminal-close-guard.test.ts create mode 100644 src/renderer/src/components/terminal/running-terminal-close-guard.ts create mode 100644 src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts create mode 100644 src/renderer/src/components/terminal/terminal-close-copy-kind.test.ts create mode 100644 src/renderer/src/components/terminal/terminal-close-copy-kind.ts create mode 100644 src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts create mode 100644 src/renderer/src/store/running-terminal-close-confirm.test.ts create mode 100644 src/renderer/src/store/running-terminal-close-confirm.ts create mode 100644 tests/e2e/terminal-tab-close-running-confirm-mouse.spec.ts create mode 100644 tests/e2e/terminal-tab-close-running-confirm.spec.ts diff --git a/src/renderer/src/App.tsx b/src/renderer/src/App.tsx index b9765d9149c..81f72be49d8 100644 --- a/src/renderer/src/App.tsx +++ b/src/renderer/src/App.tsx @@ -207,6 +207,7 @@ import { showTerminalShortcutCaptureNotification } from '@/lib/terminal-shortcut import { resolveMountedLazyModalIds, type LazyModalId } from './lazy-modal-mount-state' import { translate } from '@/i18n/i18n' import PinnedTabCloseDialog from './components/terminal-pane/PinnedTabCloseDialog' +import RunningTerminalCloseDialog from './components/terminal-pane/RunningTerminalCloseDialog' import WorktreeBaseFallbackDialog from './components/WorktreeBaseFallbackDialog' import { useOsc52ClipboardDefaultOnNotice } from './components/terminal-pane/osc52-clipboard-default-on-notice' import { @@ -2789,6 +2790,7 @@ function App(): React.JSX.Element { + {/* Why: Electron's drag-region hit-test is DOM-order-based (ignores z-index); render last so WindowControls stay clickable. */} {hasCustomTitleBar && } diff --git a/src/renderer/src/components/Terminal.tsx b/src/renderer/src/components/Terminal.tsx index 6eaf0afc78b..dc39c3a0644 100644 --- a/src/renderer/src/components/Terminal.tsx +++ b/src/renderer/src/components/Terminal.tsx @@ -1797,7 +1797,8 @@ function Terminal(): React.JSX.Element | null { ) { if (unifiedTab.contentType === 'terminal') { // Why: paired-host bulk close must revoke renderer resume and hook authority, not just remove the host session tab. - closeTerminalTab(unifiedTab.entityId) + // No running-process prompt: "Close Others" over N busy tabs would be a modal storm. + closeTerminalTab(unifiedTab.entityId, { skipRunningProcessConfirm: true }) } else { void closeWebRuntimeSessionTab({ worktreeId: activeWorktreeId, diff --git a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts index 4bb234b9764..f493f2e5807 100644 --- a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts +++ b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.ts @@ -235,10 +235,12 @@ export function useTabGroupWorkspaceModel({ worktreeId ) if (item.contentType === 'terminal') { - closeTerminalTab(item.entityId) - if (!opts?.skipEmptyCheck) { - leaveWorktreeIfEmpty() - } + // Why: closeTerminalTab can defer behind a pin / running-process dialog, so the + // empty check has to run on the actual close — never on cancel. + closeTerminalTab( + item.entityId, + opts?.skipEmptyCheck ? undefined : { onClosed: leaveWorktreeIfEmpty } + ) return } if (item.contentType === 'browser') { @@ -296,7 +298,8 @@ export function useTabGroupWorkspaceModel({ ) if (item.contentType === 'terminal' && isWebRuntimeSessionActive(runtimeEnvironmentId)) { // Why: revoke local resume + hook authority before the host removes its canonical tab. - closeTerminalTab(item.entityId) + // No running-process prompt: a bulk close of N busy tabs would be a modal storm. + closeTerminalTab(item.entityId, { skipRunningProcessConfirm: true }) continue } if (item.contentType === 'browser') { diff --git a/src/renderer/src/components/terminal-pane/CloseTerminalDialog.tsx b/src/renderer/src/components/terminal-pane/CloseTerminalDialog.tsx index 771d5e15e77..c4da5244457 100644 --- a/src/renderer/src/components/terminal-pane/CloseTerminalDialog.tsx +++ b/src/renderer/src/components/terminal-pane/CloseTerminalDialog.tsx @@ -17,17 +17,26 @@ export type CloseTerminalDialogCopyKind = 'command' | 'agent' export default function CloseTerminalDialog({ open, copyKind = 'command', + tabLabel, + subjectKey, onCancel, onConfirm }: { open: boolean copyKind?: CloseTerminalDialogCopyKind + /** Names the tab when the prompt can target a tab the user is not looking at + * (tab-strip X, middle-click). Omitted for the focused-pane keyboard path. */ + tabLabel?: string + /** Identifies what is being closed, for hosts that reuse one open dialog across a queue + * of confirmations. Changing it clears the previous subject's "don't ask again" tick. */ + subjectKey?: string onCancel: () => void onConfirm: (dontAskAgain: boolean) => void }): React.JSX.Element { const checkboxId = useId() const [dontAskAgain, setDontAskAgain] = useState(false) const [previousOpen, setPreviousOpen] = useState(open) + const [previousSubjectKey, setPreviousSubjectKey] = useState(subjectKey) // Why: each reopen represents a fresh confirmation, so clear the old choice // during render rather than briefly painting it while the dialog opens. @@ -38,7 +47,18 @@ export default function CloseTerminalDialog({ } } + // Why: a queued confirmation swaps the subject without ever closing the dialog, so the + // reopen reset above never fires. Ignore the swap to undefined as the dialog closes — + // clearing the tick mid-exit-animation would be visible for no reason. + if (subjectKey !== previousSubjectKey) { + setPreviousSubjectKey(subjectKey) + if (subjectKey !== undefined) { + setDontAskAgain(false) + } + } + const isAgent = copyKind === 'agent' + const trimmedTabLabel = tabLabel?.trim() return ( + {trimmedTabLabel ? ( +

+ {trimmedTabLabel} +

+ ) : null}
& { onConfirm: () => void }, + updateSettings: AppState['updateSettings'] +): Promise { + useAppStore.setState({ updateSettings }) + useRunningTerminalCloseConfirmStore.getState().requestRunningTerminalCloseConfirm({ + terminalTabId: 'tab-1', + tabLabel: 'dev server', + copyKind: 'command', + ...request + }) + + const container = document.createElement('div') + document.body.appendChild(container) + const root = createRoot(container) + mountedRoots.push(root) + + await act(async () => { + root.render() + }) +} + +function getButton(label: string): HTMLButtonElement { + const button = [...document.body.querySelectorAll('button')].find( + (candidate) => candidate.textContent === label + ) + if (!button) { + throw new Error(`Button not found: ${label}`) + } + return button +} + +function getCheckbox(): HTMLButtonElement { + const checkbox = document.body.querySelector('[role="checkbox"]') + if (!checkbox) { + throw new Error('Checkbox not found') + } + return checkbox +} + +describe('RunningTerminalCloseDialog', () => { + beforeEach(() => { + useAppStore.setState(initialState, true) + // Monotonic across tests: the store is a singleton, so winding the clock back would + // leave a previous test's guard deadline in the future and block every action. + clock += 10_000 + vi.spyOn(Date, 'now').mockImplementation(() => clock) + }) + + afterEach(async () => { + while (useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm !== null) { + advancePastGuard() + useRunningTerminalCloseConfirmStore.getState().dismissRunningTerminalClose() + } + vi.mocked(Date.now).mockRestore() + await act(async () => { + for (const root of mountedRoots.splice(0)) { + root.unmount() + } + }) + document.body.innerHTML = '' + useAppStore.setState(initialState, true) + }) + + it('names the tab so a background close is not ambiguous', async () => { + const onConfirm = vi.fn() + const updateSettings = vi.fn().mockResolvedValue(undefined) + + await renderDialog({ onConfirm }, updateSettings) + + expect(document.body.textContent).toContain('Stop running command?') + expect(document.body.textContent).toContain('dev server') + + await act(async () => { + getButton('Stop and Close').click() + }) + + expect(updateSettings).not.toHaveBeenCalled() + expect(onConfirm).toHaveBeenCalledTimes(1) + }) + + it('uses the agent copy for an agent pane', async () => { + const updateSettings = vi.fn().mockResolvedValue(undefined) + + await renderDialog({ onConfirm: vi.fn(), copyKind: 'agent' }, updateSettings) + + expect(document.body.textContent).toContain('Stop this agent?') + expect(getButton('Stop Agent')).toBeTruthy() + }) + + it('persists the opt-out when "don\'t ask again" is checked', async () => { + const onConfirm = vi.fn() + const updateSettings = vi.fn().mockResolvedValue(undefined) + + await renderDialog({ onConfirm }, updateSettings) + + await act(async () => { + getCheckbox().click() + }) + await act(async () => { + getButton('Stop and Close').click() + }) + + expect(updateSettings).toHaveBeenCalledWith({ + skipCloseTerminalWithRunningProcessConfirm: true + }) + expect(onConfirm).toHaveBeenCalledTimes(1) + }) + + // Why: this queue opens after an async probe while the pinned queue opens synchronously, + // so both can be pending at once. Two modal overlays + focus traps is the bug. + it('waits for a visible pinned confirmation instead of stacking a second modal', async () => { + const updateSettings = vi.fn().mockResolvedValue(undefined) + useAppStore.setState({ + pinnedTabCloseConfirm: { tabLabel: 'pinned tab', onConfirm: vi.fn() } + }) + + await renderDialog({ onConfirm: vi.fn() }, updateSettings) + + expect(document.body.textContent).not.toContain('Stop running command?') + + await act(async () => { + useAppStore.setState({ pinnedTabCloseConfirm: null }) + }) + + expect(document.body.textContent).toContain('Stop running command?') + }) + + it('does not carry the opt-out tick over to the next queued tab', async () => { + const updateSettings = vi.fn().mockResolvedValue(undefined) + const nextOnConfirm = vi.fn() + + await renderDialog({ onConfirm: vi.fn(), onCancel: vi.fn() }, updateSettings) + await act(async () => { + useRunningTerminalCloseConfirmStore.getState().requestRunningTerminalCloseConfirm({ + terminalTabId: 'tab-2', + tabLabel: 'build watcher', + copyKind: 'command', + onConfirm: nextOnConfirm + }) + }) + + await act(async () => { + getCheckbox().click() + }) + await act(async () => { + getButton('Cancel').click() + }) + + expect(document.body.textContent).toContain('build watcher') + expect(getCheckbox().getAttribute('data-state')).toBe('unchecked') + + advancePastGuard() + await act(async () => { + getButton('Stop and Close').click() + }) + + expect(updateSettings).not.toHaveBeenCalled() + expect(nextOnConfirm).toHaveBeenCalledTimes(1) + }) + + it('drops a queued prompt once the user opts out of asking again', async () => { + const updateSettings = vi.fn().mockResolvedValue(undefined) + const onConfirm = vi.fn() + const nextOnConfirm = vi.fn() + + await renderDialog({ onConfirm }, updateSettings) + await act(async () => { + useRunningTerminalCloseConfirmStore.getState().requestRunningTerminalCloseConfirm({ + terminalTabId: 'tab-2', + tabLabel: 'build watcher', + copyKind: 'command', + onConfirm: nextOnConfirm + }) + }) + + await act(async () => { + getCheckbox().click() + }) + await act(async () => { + getButton('Stop and Close').click() + }) + + expect(updateSettings).toHaveBeenCalledWith({ + skipCloseTerminalWithRunningProcessConfirm: true + }) + expect(onConfirm).toHaveBeenCalledTimes(1) + expect(nextOnConfirm).toHaveBeenCalledTimes(1) + expect(document.body.textContent).not.toContain('build watcher') + }) + + it('cancels without closing and shows the next queued tab', async () => { + const onConfirm = vi.fn() + const onCancel = vi.fn() + const nextOnConfirm = vi.fn() + const updateSettings = vi.fn().mockResolvedValue(undefined) + + await renderDialog({ onConfirm, onCancel }, updateSettings) + await act(async () => { + useRunningTerminalCloseConfirmStore.getState().requestRunningTerminalCloseConfirm({ + terminalTabId: 'tab-2', + tabLabel: 'build watcher', + copyKind: 'command', + onConfirm: nextOnConfirm + }) + }) + + await act(async () => { + getButton('Cancel').click() + }) + + expect(onCancel).toHaveBeenCalledTimes(1) + expect(onConfirm).not.toHaveBeenCalled() + expect(document.body.textContent).toContain('build watcher') + + advancePastGuard() + await act(async () => { + getButton('Stop and Close').click() + }) + + expect(nextOnConfirm).toHaveBeenCalledTimes(1) + }) +}) diff --git a/src/renderer/src/components/terminal-pane/RunningTerminalCloseDialog.tsx b/src/renderer/src/components/terminal-pane/RunningTerminalCloseDialog.tsx new file mode 100644 index 00000000000..cf93fa77207 --- /dev/null +++ b/src/renderer/src/components/terminal-pane/RunningTerminalCloseDialog.tsx @@ -0,0 +1,45 @@ +import { useAppStore } from '@/store' +import { useRunningTerminalCloseConfirmStore } from '@/store/running-terminal-close-confirm' +import CloseTerminalDialog from './CloseTerminalDialog' + +/** Hosts the running-process close confirmation for tab-level closes (tab-strip X, + * middle-click, tab menu, tab groups, floating panel) so they share the prompt Cmd+W + * already raised. Store-driven, like PinnedTabCloseDialog, because those closes run + * outside any pane's React tree. */ +export default function RunningTerminalCloseDialog(): React.JSX.Element { + const request = useRunningTerminalCloseConfirmStore((state) => state.runningTerminalCloseConfirm) + const confirmClose = useRunningTerminalCloseConfirmStore( + (state) => state.confirmRunningTerminalClose + ) + const confirmAllCloses = useRunningTerminalCloseConfirmStore( + (state) => state.confirmAllRunningTerminalCloses + ) + const dismissClose = useRunningTerminalCloseConfirmStore( + (state) => state.dismissRunningTerminalClose + ) + const updateSettings = useAppStore((state) => state.updateSettings) + // Why: this queue is async (it opens after a probe) while the pinned queue is synchronous, + // so both can be pending at once. Wait rather than stack two modal overlays and focus traps. + const pinnedRequest = useAppStore((state) => state.pinnedTabCloseConfirm) + + return ( + { + if (dontAskAgain) { + void updateSettings({ skipCloseTerminalWithRunningProcessConfirm: true }) + // Why: the user just opted out of this prompt; a queued one must not still appear. + confirmAllCloses() + return + } + confirmClose() + }} + /> + ) +} diff --git a/src/renderer/src/components/terminal-pane/TerminalPane.tsx b/src/renderer/src/components/terminal-pane/TerminalPane.tsx index 9666ae98e53..c2b2149ba03 100644 --- a/src/renderer/src/components/terminal-pane/TerminalPane.tsx +++ b/src/renderer/src/components/terminal-pane/TerminalPane.tsx @@ -14,7 +14,6 @@ import { createPortal } from 'react-dom' import type { CSSProperties } from 'react' import type { IDisposable } from '@xterm/xterm' import { useAppStore } from '../../store' -import { isUnifiedTabPinned } from '@/store/pinned-tab-close-guard' import { useLinkRoutingPreferenceDialog } from '@/components/link-routing-preference-dialog' import { DaemonActionDialog, useDaemonActions } from '@/components/shared/useDaemonActions' import { @@ -64,6 +63,8 @@ import type { MacOptionAsAlt } from './terminal-shortcut-policy' import { useEffectiveMacOptionAsAlt } from '@/lib/keyboard-layout/use-effective-mac-option-as-alt' import { useTerminalFontZoom } from './useTerminalFontZoom' import CloseTerminalDialog, { type CloseTerminalDialogCopyKind } from './CloseTerminalDialog' +import { resolveLeafCloseCopyKind } from '../terminal/terminal-close-copy-kind' +import { RUNNING_CLOSE_PROBE_TIMEOUT_MS } from '../terminal/running-terminal-close-guard' import CodexRestartChip from '../CodexRestartChip' import { MobileDriverOverlay } from './MobileDriverOverlay' import { stripSshReconnectOwnedErrorLines, TerminalErrorToast } from './TerminalErrorToast' @@ -1288,30 +1289,21 @@ function TerminalPane( ) // Cmd+W confirms before killing a shell with a running child (e.g. npm run dev); idle prompts close immediately, and Ctrl+D bypasses by design. + // Why: the agent-vs-command rule is shared with the tab-strip prompt so the two close paths cannot word the same close differently (#10142). const getCloseDialogCopyKind = useCallback( - (paneId: number): CloseTerminalDialogCopyKind => { - const leafId = managerRef.current?.getLeafId(paneId) - if (!leafId) { - return 'command' - } - const agentType = - useAppStore.getState().agentStatusByPaneKey[makePaneKey(tabId, leafId)]?.agentType - return agentType && agentType !== 'unknown' ? 'agent' : 'command' - }, + (paneId: number): CloseTerminalDialogCopyKind => + resolveLeafCloseCopyKind(tabId, managerRef.current?.getLeafId(paneId)), [tabId] ) const handleRequestClosePane = useCallback( (paneId: number) => { - // Why: closing the last pane of a pinned tab prefers the pin dialog over the running-process prompt; non-pinned tabs keep the process prompt. - const isLastPane = (managerRef.current?.getPanes().length ?? 0) <= 1 - if (isLastPane) { - const state = useAppStore.getState() - const confirmPinned = state.settings?.confirmClosePinnedTab ?? true - if (confirmPinned && isUnifiedTabPinned(state, worktreeId, tabId)) { - executeClosePane(paneId) - return - } + // Why: the last pane closes the whole tab, and closeTerminalTab owns both the pinned + // and running-process guards. Probing here too would double-prompt, and its nullable + // transport ptyId would silently skip the prompt the mouse paths now get (#10142). + if ((managerRef.current?.getPanes().length ?? 0) <= 1) { + executeClosePane(paneId) + return } const transport = paneTransportsRef.current.get(paneId) const ptyId = transport?.getPtyId() @@ -1320,18 +1312,40 @@ function TerminalPane( return } const settings = useAppStore.getState().settings + // Why: same bound as the whole-tab guard, so a wedged remote probe never leaves Cmd+W + // looking dead for the full 15s RPC timeout; unanswered means ask, not close (#10142). + let decided = false + const decide = (act: () => void): void => { + if (decided) { + return + } + decided = true + act() + } + const confirmClose = (): void => + setPendingCloseConfirmation({ paneId, copyKind: getCloseDialogCopyKind(paneId) }) + const probeTimeout = setTimeout(() => decide(confirmClose), RUNNING_CLOSE_PROBE_TIMEOUT_MS) void inspectRuntimeTerminalProcess(settings, ptyId) .then((process) => { - if (!process.hasChildProcesses || settings?.skipCloseTerminalWithRunningProcessConfirm) { - executeClosePane(paneId) - } else { - setPendingCloseConfirmation({ paneId, copyKind: getCloseDialogCopyKind(paneId) }) - } + clearTimeout(probeTimeout) + decide(() => { + if ( + !process.hasChildProcesses || + settings?.skipCloseTerminalWithRunningProcessConfirm + ) { + executeClosePane(paneId) + } else { + confirmClose() + } + }) }) // Why: if the child-process probe rejects (wedged IPC, legacy provider), close anyway — Cmd+W doing nothing is worse than closing a pane with a child. - .catch(() => executeClosePane(paneId)) + .catch(() => { + clearTimeout(probeTimeout) + decide(() => executeClosePane(paneId)) + }) }, - [executeClosePane, tabId, worktreeId, getCloseDialogCopyKind] + [executeClosePane, getCloseDialogCopyKind] ) useImperativeHandle( diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts index 23a7475f5dc..bc230ecd419 100644 --- a/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts +++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.ts @@ -1664,7 +1664,8 @@ export function useTerminalPaneLifecycle({ manager: mgr, getPtyIdForLeaf: (leafId) => useAppStore.getState().terminalLayoutsByTabId[tabId]?.ptyIdsByLeafId?.[leafId], - closeTab: () => closeTerminalTab(tabId), + // Why: CLI-driven pane close; its caller is answered immediately and cannot wait on a modal. + closeTab: () => closeTerminalTab(tabId, { skipRunningProcessConfirm: true }), closeTabPreservingPty: () => { const store = useAppStore.getState() if (detail.retireSurface && detail.leafId) { diff --git a/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts b/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts new file mode 100644 index 00000000000..3dc808e6abc --- /dev/null +++ b/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts @@ -0,0 +1,409 @@ +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' + +const { getStateMock, inspectRuntimeTerminalProcessMock } = vi.hoisted(() => ({ + getStateMock: vi.fn(), + inspectRuntimeTerminalProcessMock: vi.fn() +})) + +vi.mock('@/store', () => ({ + useAppStore: { getState: getStateMock } +})) + +vi.mock('@/runtime/runtime-terminal-inspection', () => ({ + inspectRuntimeTerminalProcess: inspectRuntimeTerminalProcessMock +})) + +import { useRunningTerminalCloseConfirmStore } from '@/store/running-terminal-close-confirm' +import { + guardRunningTerminalClose, + shouldConfirmRunningTerminalClose, + RUNNING_CLOSE_PROBE_TIMEOUT_MS +} from './running-terminal-close-guard' + +const LEAF_A = '11111111-1111-4111-8111-111111111111' +const LEAF_B = '22222222-2222-4222-8222-222222222222' + +function setState(overrides: Record = {}): void { + getStateMock.mockReturnValue({ + settings: { activeRuntimeEnvironmentId: null }, + ptyIdsByTabId: { 'tab-1': ['pty-a'] }, + terminalLayoutsByTabId: { 'tab-1': { ptyIdsByLeafId: { [LEAF_A]: 'pty-a' } } }, + agentStatusByPaneKey: {}, + ...overrides + }) +} + +function guard(onClose = vi.fn(), onCancel?: () => void): void { + guardRunningTerminalClose({ + terminalTabId: 'tab-1', + tabLabel: 'npm run dev', + onClose, + ...(onCancel ? { onCancel } : {}) + }) +} + +function visibleRequest() { + return useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm +} + +async function settleProbe(): Promise { + await Promise.resolve() + await Promise.resolve() + await Promise.resolve() +} + +describe('shouldConfirmRunningTerminalClose', () => { + it('confirms a plain interactive close', () => { + expect(shouldConfirmRunningTerminalClose(undefined)).toBe(true) + expect(shouldConfirmRunningTerminalClose({})).toBe(true) + expect(shouldConfirmRunningTerminalClose({ reason: 'user' })).toBe(true) + expect(shouldConfirmRunningTerminalClose({ hostCloseReason: 'user' })).toBe(true) + }) + + it.each([ + ['post-confirmation re-entry', { force: true }], + ['non-interactive CLI reject', { rejectPinned: true }], + ['bulk/CLI opt-out', { skipRunningProcessConfirm: true }], + ['pty lifecycle echo', { reason: 'pty-exit' as const }], + ['cleanup teardown', { reason: 'cleanup' as const }], + ['host-only pty lifecycle echo', { hostCloseReason: 'pty-exit' as const }], + ['pty-scoped lifecycle close', { lifecyclePtyId: 'pty-a' }] + ])('never prompts for a %s', (_label, options) => { + expect(shouldConfirmRunningTerminalClose(options)).toBe(false) + }) +}) + +describe('guardRunningTerminalClose', () => { + beforeEach(() => { + vi.clearAllMocks() + setState() + inspectRuntimeTerminalProcessMock.mockResolvedValue({ + foregroundProcess: 'sleep', + hasChildProcesses: true + }) + }) + + afterEach(() => { + const store = useRunningTerminalCloseConfirmStore.getState() + while (visibleRequest()) { + store.dismissRunningTerminalClose() + } + }) + + it('closes synchronously and never probes when the tab has no live pty', () => { + setState({ ptyIdsByTabId: {}, terminalLayoutsByTabId: {} }) + const onClose = vi.fn() + + guard(onClose) + + expect(onClose).toHaveBeenCalledTimes(1) + expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled() + }) + + // Why: a mounting pane is bound into the layout before ptyIdsByTabId catches up. Reading + // only the liveness map would let a close slip through that window with no prompt. + it('prompts for a pane the layout has bound but the liveness map has not', async () => { + setState({ ptyIdsByTabId: { 'tab-1': [] } }) + const onClose = vi.fn() + + guard(onClose) + await settleProbe() + + expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledWith(expect.anything(), 'pty-a') + expect(onClose).not.toHaveBeenCalled() + expect(visibleRequest()).toMatchObject({ terminalTabId: 'tab-1' }) + }) + + it('probes each pty once when the map and the layout name the same one', async () => { + guard() + await settleProbe() + + expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledTimes(1) + }) + + it('closes without probing when the user turned the prompt off', () => { + setState({ + settings: { + activeRuntimeEnvironmentId: null, + skipCloseTerminalWithRunningProcessConfirm: true + } + }) + const onClose = vi.fn() + + guard(onClose) + + expect(onClose).toHaveBeenCalledTimes(1) + expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled() + expect(visibleRequest()).toBeNull() + }) + + it('closes an idle terminal without a prompt', async () => { + inspectRuntimeTerminalProcessMock.mockResolvedValue({ + foregroundProcess: 'zsh', + hasChildProcesses: false + }) + const onClose = vi.fn() + + guard(onClose) + await settleProbe() + + expect(onClose).toHaveBeenCalledTimes(1) + expect(visibleRequest()).toBeNull() + }) + + it('defers a busy terminal behind a confirmation that carries the tab label', async () => { + const onClose = vi.fn() + + guard(onClose) + expect(onClose).not.toHaveBeenCalled() + await settleProbe() + + expect(onClose).not.toHaveBeenCalled() + expect(visibleRequest()).toMatchObject({ + terminalTabId: 'tab-1', + tabLabel: 'npm run dev', + copyKind: 'command' + }) + + useRunningTerminalCloseConfirmStore.getState().confirmRunningTerminalClose() + expect(onClose).toHaveBeenCalledTimes(1) + }) + + it('runs onCancel and keeps the tab when the confirmation is dismissed', async () => { + const onClose = vi.fn() + const onCancel = vi.fn() + + guard(onClose, onCancel) + await settleProbe() + useRunningTerminalCloseConfirmStore.getState().dismissRunningTerminalClose() + + expect(onCancel).toHaveBeenCalledTimes(1) + expect(onClose).not.toHaveBeenCalled() + }) + + it('fails open and closes when the probe rejects (wedged relay / legacy provider)', async () => { + inspectRuntimeTerminalProcessMock.mockRejectedValue(new Error('rpc_timeout')) + const onClose = vi.fn() + + guard(onClose) + await settleProbe() + + expect(onClose).toHaveBeenCalledTimes(1) + expect(visibleRequest()).toBeNull() + }) + + it('fails open when a remote handle reports the inspection as unavailable', async () => { + inspectRuntimeTerminalProcessMock.mockResolvedValue({ + foregroundProcess: null, + hasChildProcesses: true, + unavailable: true + }) + const onClose = vi.fn() + + guard(onClose) + await settleProbe() + + expect(onClose).toHaveBeenCalledTimes(1) + expect(visibleRequest()).toBeNull() + }) + + it('prompts once for a split tab where only the second pane is busy', async () => { + setState({ + ptyIdsByTabId: { 'tab-1': ['pty-a', 'pty-b'] }, + terminalLayoutsByTabId: { + 'tab-1': { ptyIdsByLeafId: { [LEAF_A]: 'pty-a', [LEAF_B]: 'pty-b' } } + }, + agentStatusByPaneKey: { [`tab-1:${LEAF_B}`]: { agentType: 'claude' } } + }) + inspectRuntimeTerminalProcessMock.mockImplementation(async (_settings, ptyId: string) => ({ + foregroundProcess: ptyId === 'pty-b' ? 'claude' : 'zsh', + hasChildProcesses: ptyId === 'pty-b' + })) + const onClose = vi.fn() + + guard(onClose) + await settleProbe() + + expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledTimes(2) + expect(visibleRequest()).toMatchObject({ terminalTabId: 'tab-1', copyKind: 'agent' }) + expect(onClose).not.toHaveBeenCalled() + }) + + it('does not use an idle sibling pane to pick the agent copy', async () => { + setState({ + ptyIdsByTabId: { 'tab-1': ['pty-a', 'pty-b'] }, + terminalLayoutsByTabId: { + 'tab-1': { ptyIdsByLeafId: { [LEAF_A]: 'pty-a', [LEAF_B]: 'pty-b' } } + }, + agentStatusByPaneKey: { [`tab-1:${LEAF_B}`]: { agentType: 'claude' } } + }) + inspectRuntimeTerminalProcessMock.mockImplementation(async (_settings, ptyId: string) => ({ + foregroundProcess: ptyId === 'pty-a' ? 'npm' : 'zsh', + hasChildProcesses: ptyId === 'pty-a' + })) + + guard() + await settleProbe() + + expect(visibleRequest()?.copyKind).toBe('command') + }) + + it('prefers the agent copy regardless of pty spawn order when both panes are busy', async () => { + setState({ + ptyIdsByTabId: { 'tab-1': ['pty-a', 'pty-b'] }, + terminalLayoutsByTabId: { + 'tab-1': { ptyIdsByLeafId: { [LEAF_A]: 'pty-a', [LEAF_B]: 'pty-b' } } + }, + agentStatusByPaneKey: { [`tab-1:${LEAF_B}`]: { agentType: 'codex' } } + }) + + guard() + await settleProbe() + + expect(visibleRequest()?.copyKind).toBe('agent') + }) + + it('ignores a pane whose agent status is unknown', async () => { + setState({ agentStatusByPaneKey: { [`tab-1:${LEAF_A}`]: { agentType: 'unknown' } } }) + + guard() + await settleProbe() + + expect(visibleRequest()?.copyKind).toBe('command') + }) + + it('survives legacy layout leaf ids that are not stable pane uuids', async () => { + setState({ terminalLayoutsByTabId: { 'tab-1': { ptyIdsByLeafId: { leaf: 'pty-a' } } } }) + const onClose = vi.fn() + + guard(onClose) + await settleProbe() + + expect(visibleRequest()).toMatchObject({ copyKind: 'command' }) + expect(onClose).not.toHaveBeenCalled() + }) + + // Why: makePaneKey throws on a tab id containing ':'; the dialog must never be the + // reason a close silently stops happening. + it('closes rather than wedging when the copy-kind lookup throws', async () => { + getStateMock.mockReturnValue({ + settings: { activeRuntimeEnvironmentId: null }, + ptyIdsByTabId: { 'tab:1': ['pty-a'] }, + terminalLayoutsByTabId: { 'tab:1': { ptyIdsByLeafId: { [LEAF_A]: 'pty-a' } } }, + agentStatusByPaneKey: {} + }) + const onClose = vi.fn() + + guardRunningTerminalClose({ terminalTabId: 'tab:1', tabLabel: 'weird', onClose }) + await settleProbe() + + expect(visibleRequest()).toMatchObject({ terminalTabId: 'tab:1', copyKind: 'command' }) + expect(onClose).not.toHaveBeenCalled() + }) + + it('closes rather than wedging when raising the confirmation throws', async () => { + const requestSpy = vi + .spyOn(useRunningTerminalCloseConfirmStore.getState(), 'requestRunningTerminalCloseConfirm') + .mockImplementation(() => { + throw new Error('subscriber blew up') + }) + const onClose = vi.fn() + + guard(onClose) + await settleProbe() + requestSpy.mockRestore() + + expect(onClose).toHaveBeenCalledTimes(1) + }) + + // Why: a remote inspect can take its full 15s RPC timeout. Closing at 4s would kill a + // running remote command with no prompt — the exact failure this guard exists to stop. + it('prompts instead of closing when a wedged remote probe never settles', async () => { + vi.useFakeTimers() + inspectRuntimeTerminalProcessMock.mockReturnValue(new Promise(() => {})) + const onClose = vi.fn() + + guard(onClose) + expect(onClose).not.toHaveBeenCalled() + + vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS) + vi.useRealTimers() + + expect(onClose).not.toHaveBeenCalled() + expect(visibleRequest()).toMatchObject({ terminalTabId: 'tab-1', tabLabel: 'npm run dev' }) + + useRunningTerminalCloseConfirmStore.getState().confirmRunningTerminalClose() + expect(onClose).toHaveBeenCalledTimes(1) + }) + + it('treats every pane as a candidate when picking the copy for a timed-out probe', async () => { + setState({ + ptyIdsByTabId: { 'tab-1': ['pty-a', 'pty-b'] }, + terminalLayoutsByTabId: { + 'tab-1': { ptyIdsByLeafId: { [LEAF_A]: 'pty-a', [LEAF_B]: 'pty-b' } } + }, + agentStatusByPaneKey: { [`tab-1:${LEAF_B}`]: { agentType: 'claude' } } + }) + vi.useFakeTimers() + inspectRuntimeTerminalProcessMock.mockReturnValue(new Promise(() => {})) + + guard() + vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS) + vi.useRealTimers() + + expect(visibleRequest()?.copyKind).toBe('agent') + }) + + it('closes rather than wedging when the timed-out prompt throws', async () => { + const requestSpy = vi + .spyOn(useRunningTerminalCloseConfirmStore.getState(), 'requestRunningTerminalCloseConfirm') + .mockImplementation(() => { + throw new Error('subscriber blew up') + }) + vi.useFakeTimers() + inspectRuntimeTerminalProcessMock.mockReturnValue(new Promise(() => {})) + const onClose = vi.fn() + + guard(onClose) + vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS) + vi.useRealTimers() + requestSpy.mockRestore() + + expect(onClose).toHaveBeenCalledTimes(1) + }) + + it('ignores a slow probe that resolves after the timeout already prompted', async () => { + vi.useFakeTimers() + inspectRuntimeTerminalProcessMock.mockResolvedValue({ + foregroundProcess: 'sleep', + hasChildProcesses: true + }) + const onClose = vi.fn() + + guard(onClose) + vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS) + vi.useRealTimers() + await settleProbe() + + expect(onClose).not.toHaveBeenCalled() + useRunningTerminalCloseConfirmStore.getState().confirmRunningTerminalClose() + expect(onClose).toHaveBeenCalledTimes(1) + expect(visibleRequest()).toBeNull() + }) + + // Why: an SSH drop zeroes ptyIdsByTabId while the layout still names the pane. The stale + // binding is probed, that probe fails on the dead link, and the close falls open — so a + // reconnecting tab stays closable instead of being blocked behind a prompt for a pty + // nobody can reach. Documented so the behavior is a decision, not an accident. + it('closes a reconnecting ssh tab whose pty ids were already zeroed', async () => { + setState({ ptyIdsByTabId: { 'tab-1': [] } }) + inspectRuntimeTerminalProcessMock.mockRejectedValue(new Error('ssh_disconnected')) + const onClose = vi.fn() + + guard(onClose) + await settleProbe() + + expect(onClose).toHaveBeenCalledTimes(1) + expect(visibleRequest()).toBeNull() + }) +}) diff --git a/src/renderer/src/components/terminal/running-terminal-close-guard.ts b/src/renderer/src/components/terminal/running-terminal-close-guard.ts new file mode 100644 index 00000000000..73f63fc85f7 --- /dev/null +++ b/src/renderer/src/components/terminal/running-terminal-close-guard.ts @@ -0,0 +1,154 @@ +import { useAppStore } from '@/store' +import { inspectRuntimeTerminalProcess } from '@/runtime/runtime-terminal-inspection' +import { useRunningTerminalCloseConfirmStore } from '@/store/running-terminal-close-confirm' +import type { TerminalTabCloseReason } from '@/store/slices/terminal-tab-retirement' +import type { AppState } from '@/store/types' +import { resolveBusyPtyCloseCopyKind } from './terminal-close-copy-kind' + +export type RunningTerminalCloseGuardOptions = { + force?: boolean + rejectPinned?: boolean + reason?: TerminalTabCloseReason + hostCloseReason?: TerminalTabCloseReason + lifecyclePtyId?: string + skipRunningProcessConfirm?: boolean +} + +/** Upper bound on how long a close may wait on the probe before it asks instead. A remote + * inspect RPC can hang for its full 15s timeout, and an X button that looks dead for 15s + * is the same class of bug as one that never asks — but an unanswered probe is not + * evidence of an idle shell, so the timeout raises the prompt rather than killing a + * possibly-running remote command (#10142). */ +export const RUNNING_CLOSE_PROBE_TIMEOUT_MS = 4_000 + +/** Whether this close is an interactive user action that should stop and ask before + * killing a live child process. Lifecycle echoes, bulk closes, CLI/RPC closes and the + * post-confirmation re-entry are all excluded. */ +export function shouldConfirmRunningTerminalClose( + options?: RunningTerminalCloseGuardOptions +): boolean { + if (options?.force === true || options?.rejectPinned === true) { + return false + } + if (options?.skipRunningProcessConfirm === true || options?.lifecyclePtyId !== undefined) { + return false + } + const isUserReason = (reason: TerminalTabCloseReason | undefined): boolean => + reason === undefined || reason === 'user' + return isUserReason(options?.reason) && isUserReason(options?.hostCloseReason) +} + +/** Every PTY the tab could still own. `ptyIdsByTabId` is the liveness map the rest of the + * app reads, but a mounting pane is bound into the layout before the map catches up, and + * the store's own teardown collector unions both for exactly that reason — reading only + * the map would let a close slip through the window with no prompt. A stale id costs + * nothing: its probe fails and the guard falls open. */ +function collectTabPtyIds( + state: Pick, + terminalTabId: string +): string[] { + const ptyIds = new Set() + for (const ptyId of state.ptyIdsByTabId?.[terminalTabId] ?? []) { + if (ptyId) { + ptyIds.add(ptyId) + } + } + const ptyIdsByLeafId = state.terminalLayoutsByTabId?.[terminalTabId]?.ptyIdsByLeafId ?? {} + for (const ptyId of Object.values(ptyIdsByLeafId)) { + if (typeof ptyId === 'string' && ptyId) { + ptyIds.add(ptyId) + } + } + return [...ptyIds] +} + +/** + * Routes an interactive terminal-tab close through the running-process confirmation. + * Closes immediately when nothing is running, so idle tabs keep today's behavior. + */ +export function guardRunningTerminalClose(params: { + terminalTabId: string + tabLabel: string + onClose: () => void + onCancel?: () => void +}): void { + const { terminalTabId, tabLabel, onClose, onCancel } = params + const state = useAppStore.getState() + const settings = state.settings + const ptyIds = collectTabPtyIds(state, terminalTabId) + // Why: no PTY at all means there is nothing to probe (parked/hibernated tab, or a + // teardown that already cleared both maps), and the opt-out setting means the answer is + // already known. Both keep the close fully synchronous. + if (ptyIds.length === 0 || settings?.skipCloseTerminalWithRunningProcessConfirm === true) { + onClose() + return + } + + // Why: the timeout, the probe result and the error path race to decide this close, so the + // first one to land owns it instead of trusting those races to stay mutually exclusive. + let decided = false + const closeNow = (): void => { + if (decided) { + return + } + decided = true + onClose() + } + const confirmClose = (busyPtyIds: readonly string[]): void => { + if (decided) { + return + } + const copyKind = resolveBusyPtyCloseCopyKind(terminalTabId, busyPtyIds) + useRunningTerminalCloseConfirmStore.getState().requestRunningTerminalCloseConfirm({ + terminalTabId, + tabLabel, + copyKind, + onConfirm: onClose, + ...(onCancel ? { onCancel } : {}) + }) + // Why: only once the prompt is actually up — if either call above throws, the close must + // still be free to fall through and happen. + decided = true + } + + const probeTimeout = setTimeout(() => { + try { + // Why: a probe that has not answered yet is unknown, not idle. Ask, treating every pty + // as a candidate, so a degraded relay costs a click instead of a killed remote command. + confirmClose(ptyIds) + } catch { + closeNow() + } + }, RUNNING_CLOSE_PROBE_TIMEOUT_MS) + + void Promise.allSettled(ptyIds.map((ptyId) => inspectRuntimeTerminalProcess(settings, ptyId))) + .then((results) => { + clearTimeout(probeTimeout) + if (decided) { + return + } + // Why: fail open on an *answered* probe, matching the Cmd+W pane path — a rejection + // (wedged relay, legacy provider) or a stale remote handle is not evidence of a live + // child, and a close button that silently does nothing is worse than closing a busy tab. + const busyPtyIds = ptyIds.filter((_, index) => { + const result = results[index] + return ( + result?.status === 'fulfilled' && + result.value.hasChildProcesses && + result.value.unavailable !== true + ) + }) + if (busyPtyIds.length === 0) { + closeNow() + return + } + confirmClose(busyPtyIds) + }) + // Why: allSettled never rejects, so this only fires when the decision above throws (a + // copy-kind lookup, a store subscriber). Without it the tab would silently never close + // and the user would get no feedback at all; the pane path it replaced had this catch. + .catch(() => { + clearTimeout(probeTimeout) + closeNow() + }) +} diff --git a/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts b/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts new file mode 100644 index 00000000000..3ad4229e233 --- /dev/null +++ b/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts @@ -0,0 +1,131 @@ +/** + * Regression for #10142: the tab X button / middle-click used to bypass the + * running-process close confirmation that Cmd+W enforces. Assertions unchanged + * from the adjudicated repro. + * + * Mouse close path: SortableTab (X onClick / onAuxClick button===1) -> onClose + * -> Terminal.tsx handleCloseTab -> closeTerminalTab() -> running-process guard. + * Keyboard path: Cmd+W -> TerminalPane.handleRequestClosePane -> inspectRuntimeTerminalProcess + * (split panes) or closeTerminalTab's guard (last pane) -> CloseTerminalDialog. + */ +import { readFileSync } from 'node:fs' +import { join } from 'node:path' +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const { + requestPinnedTabCloseConfirmMock, + getStateMock, + inspectRuntimeTerminalProcessMock, + isWebRuntimeSessionActiveMock, + resolveHostSessionTabIdForWebSessionTabMock +} = vi.hoisted(() => ({ + requestPinnedTabCloseConfirmMock: vi.fn(), + getStateMock: vi.fn(), + inspectRuntimeTerminalProcessMock: vi.fn(), + isWebRuntimeSessionActiveMock: vi.fn(() => false), + resolveHostSessionTabIdForWebSessionTabMock: vi.fn<() => string | null>(() => null) +})) + +vi.mock('@/store', () => ({ + useAppStore: { getState: getStateMock } +})) + +vi.mock('@/runtime/web-runtime-session', () => ({ + activateWebRuntimeSessionTab: vi.fn(), + closeWebRuntimeSessionTab: vi.fn(), + createWebRuntimeSessionTerminal: vi.fn(), + isWebRuntimeSessionActive: isWebRuntimeSessionActiveMock, + isWebTerminalSurfaceTabId: vi.fn(() => false), + toHostSessionTabId: vi.fn((tabId: string) => tabId) +})) + +vi.mock('@/runtime/web-session-tabs-sync', () => ({ + getLatestWebSessionTabsPublicationEpoch: vi.fn(() => 'epoch-1'), + resolveHostSessionTabIdForWebSessionTab: resolveHostSessionTabIdForWebSessionTabMock +})) + +vi.mock('@/runtime/runtime-terminal-inspection', () => ({ + inspectRuntimeTerminalProcess: inspectRuntimeTerminalProcessMock +})) + +import { closeTerminalTab } from './terminal-tab-actions' + +// A non-pinned terminal tab whose PTY has a live child process (e.g. `sleep 300`). +function stateWithBusyTerminalTab(closeTab: () => void): Record { + return { + settings: { activeRuntimeEnvironmentId: null, confirmClosePinnedTab: true }, + tabsByWorktree: { 'wt-1': [{ id: 'tab-busy' }, { id: 'tab-other' }] }, + unifiedTabsByWorktree: { + 'wt-1': [ + { id: 'tab-busy', entityId: 'tab-busy', contentType: 'terminal', isPinned: false }, + { id: 'tab-other', entityId: 'tab-other', contentType: 'terminal', isPinned: false } + ] + }, + ptyIdsByTabId: { 'tab-busy': ['pty-busy'] }, + terminalLayoutsByTabId: { 'tab-busy': { ptyIdsByLeafId: { leaf: 'pty-busy' } } }, + agentStatusByPaneKey: {}, + openFiles: [], + browserTabsByWorktree: {}, + activeWorktreeId: 'wt-1', + activeTabId: 'tab-busy', + closeTab, + requestPinnedTabCloseConfirm: requestPinnedTabCloseConfirmMock, + setActiveTab: vi.fn(), + setActiveFile: vi.fn(), + setActiveTabType: vi.fn(), + setActiveBrowserTab: vi.fn(), + setActiveWorktree: vi.fn() + } +} + +describe('#10142 close confirmation policy is the same for keyboard and mouse', () => { + const closeTab = vi.fn() + + beforeEach(() => { + vi.clearAllMocks() + getStateMock.mockReturnValue(stateWithBusyTerminalTab(closeTab)) + isWebRuntimeSessionActiveMock.mockReturnValue(false) + resolveHostSessionTabIdForWebSessionTabMock.mockReturnValue(null) + inspectRuntimeTerminalProcessMock.mockResolvedValue({ + foregroundProcess: 'sleep', + hasChildProcesses: true + }) + }) + + // Control: the keyboard entry point does probe for running children. + it('keyboard Cmd+W path probes for running child processes before closing', () => { + const source = readFileSync(join(__dirname, '../terminal-pane/TerminalPane.tsx'), 'utf8') + const handler = source.slice(source.indexOf('const handleRequestClosePane')) + expect(handler.slice(0, handler.indexOf('useImperativeHandle'))).toContain( + 'inspectRuntimeTerminalProcess' + ) + }) + + // Control: the harness does observe a guard when one exists — pinning blocks the same mouse close. + it('mouse close routes a pinned tab through its confirmation guard', () => { + const state = stateWithBusyTerminalTab(closeTab) + ;(state.unifiedTabsByWorktree as Record)[ + 'wt-1' + ]![0]!.isPinned = true + getStateMock.mockReturnValue(state) + + closeTerminalTab('tab-busy') + + expect(requestPinnedTabCloseConfirmMock).toHaveBeenCalled() + expect(closeTab).not.toHaveBeenCalled() + }) + + it('mouse close (X button / middle-click) consults the running-process probe', async () => { + closeTerminalTab('tab-busy') + await Promise.resolve() + + expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalled() + }) + + it('mouse close (X button / middle-click) does not drop a busy tab without confirmation', async () => { + closeTerminalTab('tab-busy') + await Promise.resolve() + + expect(closeTab).not.toHaveBeenCalled() + }) +}) diff --git a/src/renderer/src/components/terminal/terminal-close-copy-kind.test.ts b/src/renderer/src/components/terminal/terminal-close-copy-kind.test.ts new file mode 100644 index 00000000000..960eaaa8c9c --- /dev/null +++ b/src/renderer/src/components/terminal/terminal-close-copy-kind.test.ts @@ -0,0 +1,67 @@ +/** + * The keyboard (pane-scoped) and tab-strip (pty-scoped) close prompts must word the same + * close the same way, so both resolve their copy through this module (#10142). + */ +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const { getStateMock } = vi.hoisted(() => ({ getStateMock: vi.fn() })) + +vi.mock('@/store', () => ({ useAppStore: { getState: getStateMock } })) + +import { resolveBusyPtyCloseCopyKind, resolveLeafCloseCopyKind } from './terminal-close-copy-kind' + +const LEAF_A = '11111111-1111-4111-8111-111111111111' +const LEAF_B = '22222222-2222-4222-8222-222222222222' + +function setState(overrides: Record = {}): void { + getStateMock.mockReturnValue({ + terminalLayoutsByTabId: { + 'tab-1': { ptyIdsByLeafId: { [LEAF_A]: 'pty-a', [LEAF_B]: 'pty-b' } } + }, + agentStatusByPaneKey: { [`tab-1:${LEAF_B}`]: { agentType: 'claude' } }, + ...overrides + }) +} + +describe('terminal close copy kind', () => { + beforeEach(() => { + vi.clearAllMocks() + setState() + }) + + it('agrees between the pane lookup and the busy-pty lookup for the same pane', () => { + expect(resolveLeafCloseCopyKind('tab-1', LEAF_B)).toBe('agent') + expect(resolveBusyPtyCloseCopyKind('tab-1', ['pty-b'])).toBe('agent') + + expect(resolveLeafCloseCopyKind('tab-1', LEAF_A)).toBe('command') + expect(resolveBusyPtyCloseCopyKind('tab-1', ['pty-a'])).toBe('command') + }) + + it('prefers the agent copy when a split has both busy', () => { + expect(resolveBusyPtyCloseCopyKind('tab-1', ['pty-a', 'pty-b'])).toBe('agent') + }) + + it.each([ + ['a missing leaf id', undefined], + ['a null leaf id', null], + ['a legacy non-uuid leaf id', 'leaf'] + ])('falls back to the command copy for %s', (_label, leafId) => { + expect(resolveLeafCloseCopyKind('tab-1', leafId)).toBe('command') + }) + + it('never throws on a tab id that makePaneKey would reject', () => { + setState({ + terminalLayoutsByTabId: { 'tab:1': { ptyIdsByLeafId: { [LEAF_B]: 'pty-b' } } } + }) + + expect(resolveLeafCloseCopyKind('tab:1', LEAF_B)).toBe('command') + expect(resolveBusyPtyCloseCopyKind('tab:1', ['pty-b'])).toBe('command') + }) + + it('ignores an unknown agent type', () => { + setState({ agentStatusByPaneKey: { [`tab-1:${LEAF_B}`]: { agentType: 'unknown' } } }) + + expect(resolveLeafCloseCopyKind('tab-1', LEAF_B)).toBe('command') + expect(resolveBusyPtyCloseCopyKind('tab-1', ['pty-b'])).toBe('command') + }) +}) diff --git a/src/renderer/src/components/terminal/terminal-close-copy-kind.ts b/src/renderer/src/components/terminal/terminal-close-copy-kind.ts new file mode 100644 index 00000000000..e012987ba4d --- /dev/null +++ b/src/renderer/src/components/terminal/terminal-close-copy-kind.ts @@ -0,0 +1,38 @@ +import { useAppStore } from '@/store' +import type { CloseTerminalDialogCopyKind } from '../terminal-pane/CloseTerminalDialog' +import { isTerminalLeafId, makePaneKey } from '../../../../shared/stable-pane-id' + +/** + * Single source of truth for "is this pane an agent?" in the close confirmation, so the + * keyboard (pane-scoped) and tab-strip (pty-scoped) prompts cannot word the same close + * differently. Each caller resolves its own leaf id; only the policy is shared. + */ +export function resolveLeafCloseCopyKind( + tabId: string, + leafId: string | null | undefined +): CloseTerminalDialogCopyKind { + // Why: legacy layouts and mid-attach panes carry non-UUID or missing leaf ids, and + // makePaneKey throws on those — a dialog must never be the thing that breaks a close. + if (!leafId || !isTerminalLeafId(leafId) || !tabId || tabId.includes(':')) { + return 'command' + } + const agentStatusByPaneKey = useAppStore.getState().agentStatusByPaneKey ?? {} + const agentType = agentStatusByPaneKey[makePaneKey(tabId, leafId)]?.agentType + return agentType && agentType !== 'unknown' ? 'agent' : 'command' +} + +/** Copy for a whole-tab close, given the PTYs that reported a live child. Agent panes win + * in a mixed split: stopping an agent mid-task is the costlier surprise. */ +export function resolveBusyPtyCloseCopyKind( + tabId: string, + busyPtyIds: readonly string[] +): CloseTerminalDialogCopyKind { + const ptyIdsByLeafId = + useAppStore.getState().terminalLayoutsByTabId?.[tabId]?.ptyIdsByLeafId ?? {} + for (const [leafId, ptyId] of Object.entries(ptyIdsByLeafId)) { + if (busyPtyIds.includes(ptyId) && resolveLeafCloseCopyKind(tabId, leafId) === 'agent') { + return 'agent' + } + } + return 'command' +} diff --git a/src/renderer/src/components/terminal/terminal-tab-actions.ts b/src/renderer/src/components/terminal/terminal-tab-actions.ts index 3dd2762f7f3..55934e7ae88 100644 --- a/src/renderer/src/components/terminal/terminal-tab-actions.ts +++ b/src/renderer/src/components/terminal/terminal-tab-actions.ts @@ -9,11 +9,20 @@ import { resolveHostSessionTabIdForWebSessionTab } from '@/runtime/web-session-tabs-sync' import { resolveTerminalWorktreeRoute } from '@/lib/terminal-worktree-route' -import { guardPinnedTabClose, resolvePinnedTabLabel } from '@/store/pinned-tab-close-guard' +import { + guardPinnedTabClose, + isUnifiedTabPinned, + resolvePinnedTabLabel, + shouldConfirmPinnedTabClose +} from '@/store/pinned-tab-close-guard' import type { TerminalTabCloseReason, TerminalTabRetirementPlan } from '@/store/slices/terminal-tab-retirement' +import { + guardRunningTerminalClose, + shouldConfirmRunningTerminalClose +} from './running-terminal-close-guard' import { closeLocalTerminalTabState } from './close-local-terminal-tab-state' import { getTerminalIncarnationHandle } from './terminal-close-incarnation' import { @@ -25,20 +34,6 @@ import { export type { PrecomputedTerminalCloseState } from './terminal-close-target' export { closeOtherTerminalTabs, closeTerminalTabsToRight } from './terminal-tab-bulk-actions' -type TerminalTabActionState = ReturnType - -function isPinnedVisibleTab( - state: TerminalTabActionState, - worktreeId: string, - visibleId: string -): boolean { - return ( - (state.unifiedTabsByWorktree?.[worktreeId] ?? []).some( - (tab) => (tab.id === visibleId || tab.entityId === visibleId) && tab.isPinned - ) ?? false - ) -} - export function closeTerminalTab( tabId: string, options?: { @@ -51,6 +46,9 @@ export function closeTerminalTab( hostCloseReason?: TerminalTabCloseReason /** PTY whose lifecycle event initiated the host close. */ lifecyclePtyId?: string + /** Set by callers that must never raise a modal (bulk closes, CLI/RPC, lifecycle + * fallbacks) and by the re-entry that runs once the user confirmed. */ + skipRunningProcessConfirm?: boolean captureRecentlyClosed?: boolean localPtyTeardownOwnedExternally?: boolean precomputedRetirementPlan?: TerminalTabRetirementPlan @@ -82,7 +80,7 @@ export function closeTerminalTab( if ( options?.reason !== 'pty-exit' && !options?.force && - isPinnedVisibleTab(state, owningWorktreeId, terminalTabId) + isUnifiedTabPinned(state, owningWorktreeId, terminalTabId) ) { // Why: background lifecycle callers cannot safely wait on a modal whose // owner may be unattended; reject pinned tabs without bypassing the guard. @@ -90,10 +88,30 @@ export function closeTerminalTab( options.onCancel?.() return } - guardPinnedTabClose({ - isPinned: true, + // Why: the pin prompt supersedes the running-process one only when it actually + // appears. With `confirmClosePinnedTab` off it says nothing, so fall through and let + // a busy pinned tab still get asked — Cmd+W did exactly that before #10142. + if (shouldConfirmPinnedTabClose(state)) { + guardPinnedTabClose({ + isPinned: true, + tabLabel: resolvePinnedTabLabel(state, owningWorktreeId, terminalTabId), + onClose: () => closeTerminalTab(tabId, { ...options, force: true }), + ...(options?.onCancel ? { onCancel: options.onCancel } : {}) + }) + return + } + } + + // Why: the X button, middle-click and the tab menu used to skip the running-process + // prompt that Cmd+W enforced (#10142). Guarding here — above the web-runtime branch so + // host-backed tabs are covered too — gives every close path one shared policy. + if (shouldConfirmRunningTerminalClose(options)) { + guardRunningTerminalClose({ + terminalTabId, tabLabel: resolvePinnedTabLabel(state, owningWorktreeId, terminalTabId), - onClose: () => closeTerminalTab(tabId, { ...options, force: true }), + // Why: re-enter instead of continuing inline so pinned/route/precomputed state is + // re-validated against fresh state after an arbitrarily long dialog. + onClose: () => closeTerminalTab(tabId, { ...options, skipRunningProcessConfirm: true }), ...(options?.onCancel ? { onCancel: options.onCancel } : {}) }) return diff --git a/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts b/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts new file mode 100644 index 00000000000..066c5795ef9 --- /dev/null +++ b/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts @@ -0,0 +1,263 @@ +/** + * Which `closeTerminalTab` callers reach the running-process confirmation (#10142). + * Kept out of terminal-tab-actions.test.ts, which is already at its max-lines budget. + */ +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' + +const { + closeWebRuntimeSessionTabMock, + getStateMock, + inspectRuntimeTerminalProcessMock, + isWebRuntimeSessionActiveMock, + requestPinnedTabCloseConfirmMock, + resolveHostSessionTabIdForWebSessionTabMock +} = vi.hoisted(() => ({ + closeWebRuntimeSessionTabMock: vi.fn(), + getStateMock: vi.fn(), + inspectRuntimeTerminalProcessMock: vi.fn(), + isWebRuntimeSessionActiveMock: vi.fn(() => false), + requestPinnedTabCloseConfirmMock: vi.fn(), + resolveHostSessionTabIdForWebSessionTabMock: vi.fn<() => string | null>(() => null) +})) + +vi.mock('@/store', () => ({ + useAppStore: { getState: getStateMock } +})) + +vi.mock('@/runtime/web-runtime-session', () => ({ + activateWebRuntimeSessionTab: vi.fn(), + closeWebRuntimeSessionTab: closeWebRuntimeSessionTabMock, + createWebRuntimeSessionTerminal: vi.fn(), + isWebRuntimeSessionActive: isWebRuntimeSessionActiveMock, + isWebTerminalSurfaceTabId: vi.fn(() => false), + toHostSessionTabId: vi.fn((tabId: string) => tabId) +})) + +vi.mock('@/runtime/web-session-tabs-sync', () => ({ + getLatestWebSessionTabsPublicationEpoch: vi.fn(() => 'epoch-1'), + resolveHostSessionTabIdForWebSessionTab: resolveHostSessionTabIdForWebSessionTabMock +})) + +vi.mock('@/runtime/runtime-terminal-inspection', () => ({ + inspectRuntimeTerminalProcess: inspectRuntimeTerminalProcessMock +})) + +import { useRunningTerminalCloseConfirmStore } from '@/store/running-terminal-close-confirm' +import { closeTerminalTab } from './terminal-tab-actions' + +const LEAF = '33333333-3333-4333-8333-333333333333' + +const closeTab = vi.fn() + +function busyTabState(overrides: Record = {}): Record { + return { + settings: { activeRuntimeEnvironmentId: null, confirmClosePinnedTab: true }, + tabsByWorktree: { 'wt-1': [{ id: 'tab-busy' }, { id: 'tab-other' }] }, + unifiedTabsByWorktree: { + 'wt-1': [ + { + id: 'tab-busy', + entityId: 'tab-busy', + contentType: 'terminal', + isPinned: false, + label: 'dev server' + }, + { id: 'tab-other', entityId: 'tab-other', contentType: 'terminal', isPinned: false } + ] + }, + ptyIdsByTabId: { 'tab-busy': ['pty-busy'] }, + terminalLayoutsByTabId: { 'tab-busy': { ptyIdsByLeafId: { [LEAF]: 'pty-busy' } } }, + agentStatusByPaneKey: {}, + openFiles: [], + browserTabsByWorktree: {}, + activeWorktreeId: 'wt-1', + activeTabId: 'tab-busy', + closeTab, + requestPinnedTabCloseConfirm: requestPinnedTabCloseConfirmMock, + setActiveTab: vi.fn(), + setActiveFile: vi.fn(), + setActiveTabType: vi.fn(), + setActiveBrowserTab: vi.fn(), + setActiveWorktree: vi.fn(), + ...overrides + } +} + +function visibleRequest() { + return useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm +} + +async function settleProbe(): Promise { + await Promise.resolve() + await Promise.resolve() + await Promise.resolve() +} + +describe('closeTerminalTab running-process confirmation', () => { + beforeEach(() => { + vi.clearAllMocks() + getStateMock.mockReturnValue(busyTabState()) + isWebRuntimeSessionActiveMock.mockReturnValue(false) + resolveHostSessionTabIdForWebSessionTabMock.mockReturnValue(null) + inspectRuntimeTerminalProcessMock.mockResolvedValue({ + foregroundProcess: 'npm', + hasChildProcesses: true + }) + }) + + afterEach(() => { + const store = useRunningTerminalCloseConfirmStore.getState() + while (visibleRequest()) { + store.dismissRunningTerminalClose() + } + }) + + it('closes a busy tab only after the confirmation is accepted', async () => { + closeTerminalTab('tab-busy') + await settleProbe() + + expect(closeTab).not.toHaveBeenCalled() + expect(visibleRequest()).toMatchObject({ + terminalTabId: 'tab-busy', + tabLabel: 'dev server', + copyKind: 'command' + }) + + useRunningTerminalCloseConfirmStore.getState().confirmRunningTerminalClose() + + expect(closeTab).toHaveBeenCalledWith('tab-busy') + }) + + it('keeps the tab and runs onCancel when the confirmation is dismissed', async () => { + const onCancel = vi.fn() + const onClosed = vi.fn() + + closeTerminalTab('tab-busy', { onCancel, onClosed }) + await settleProbe() + useRunningTerminalCloseConfirmStore.getState().dismissRunningTerminalClose() + + expect(onCancel).toHaveBeenCalledTimes(1) + expect(onClosed).not.toHaveBeenCalled() + expect(closeTab).not.toHaveBeenCalled() + }) + + it('still reports the close through onClosed after the confirmation', async () => { + const onClosed = vi.fn() + + closeTerminalTab('tab-busy', { onClosed }) + await settleProbe() + useRunningTerminalCloseConfirmStore.getState().confirmRunningTerminalClose() + + expect(onClosed).toHaveBeenCalledTimes(1) + }) + + it('stays fully synchronous for a tab with no live pty', () => { + getStateMock.mockReturnValue(busyTabState({ ptyIdsByTabId: {}, terminalLayoutsByTabId: {} })) + + closeTerminalTab('tab-busy') + + expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled() + expect(closeTab).toHaveBeenCalledWith('tab-busy') + }) + + it.each([ + ['force (post-confirmation re-entry)', { force: true }], + ['rejectPinned (CLI tab close request)', { rejectPinned: true }], + ['skipRunningProcessConfirm (bulk / CLI)', { skipRunningProcessConfirm: true }], + ['reason pty-exit', { reason: 'pty-exit' as const }], + ['reason cleanup', { reason: 'cleanup' as const }], + ['hostCloseReason pty-exit', { hostCloseReason: 'pty-exit' as const }], + ['lifecyclePtyId', { lifecyclePtyId: 'pty-busy' }] + ])('never probes for a close carrying %s', (_label, options) => { + closeTerminalTab('tab-busy', options) + + expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled() + }) + + it('shows only the pinned dialog for a pinned busy tab, and its confirm does not probe', () => { + const state = busyTabState() + ;(state.unifiedTabsByWorktree as Record)[ + 'wt-1' + ]![0]!.isPinned = true + getStateMock.mockReturnValue(state) + + closeTerminalTab('tab-busy') + + expect(requestPinnedTabCloseConfirmMock).toHaveBeenCalledTimes(1) + expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled() + + const onConfirm = requestPinnedTabCloseConfirmMock.mock.calls[0]![0].onConfirm as () => void + onConfirm() + + expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled() + expect(closeTab).toHaveBeenCalledWith('tab-busy') + }) + + // Why: the pin prompt supersedes this one only when it actually appears. With the pin + // confirmation off it says nothing, and the running command must still be announced. + it('still asks about a running command on a pinned tab when pin confirmation is off', async () => { + const state = busyTabState({ + settings: { activeRuntimeEnvironmentId: null, confirmClosePinnedTab: false } + }) + ;(state.unifiedTabsByWorktree as Record)[ + 'wt-1' + ]![0]!.isPinned = true + getStateMock.mockReturnValue(state) + + closeTerminalTab('tab-busy') + await settleProbe() + + expect(requestPinnedTabCloseConfirmMock).not.toHaveBeenCalled() + expect(closeTab).not.toHaveBeenCalled() + expect(visibleRequest()).toMatchObject({ terminalTabId: 'tab-busy' }) + + useRunningTerminalCloseConfirmStore.getState().confirmRunningTerminalClose() + + expect(closeTab).toHaveBeenCalledWith('tab-busy') + }) + + it('rejects a pinned tab for a CLI close even when pin confirmation is off', () => { + const state = busyTabState({ + settings: { activeRuntimeEnvironmentId: null, confirmClosePinnedTab: false } + }) + ;(state.unifiedTabsByWorktree as Record)[ + 'wt-1' + ]![0]!.isPinned = true + getStateMock.mockReturnValue(state) + const onCancel = vi.fn() + + closeTerminalTab('tab-busy', { rejectPinned: true, onCancel }) + + expect(onCancel).toHaveBeenCalledTimes(1) + expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled() + expect(closeTab).not.toHaveBeenCalled() + }) + + it('confirms before telling a paired host to close its busy tab', async () => { + isWebRuntimeSessionActiveMock.mockReturnValue(true) + getStateMock.mockReturnValue( + busyTabState({ settings: { activeRuntimeEnvironmentId: 'web-runtime' } }) + ) + + closeTerminalTab('tab-busy') + await settleProbe() + + expect(closeWebRuntimeSessionTabMock).not.toHaveBeenCalled() + expect(closeTab).not.toHaveBeenCalled() + + useRunningTerminalCloseConfirmStore.getState().confirmRunningTerminalClose() + + expect(closeWebRuntimeSessionTabMock).toHaveBeenCalledTimes(1) + }) + + it('picks the agent copy for a busy agent pane', async () => { + getStateMock.mockReturnValue( + busyTabState({ agentStatusByPaneKey: { [`tab-busy:${LEAF}`]: { agentType: 'claude' } } }) + ) + + closeTerminalTab('tab-busy') + await settleProbe() + + expect(visibleRequest()?.copyKind).toBe('agent') + }) +}) diff --git a/src/renderer/src/hooks/useIpcEvents.test.ts b/src/renderer/src/hooks/useIpcEvents.test.ts index e59b6db6b95..c13cf20057a 100644 --- a/src/renderer/src/hooks/useIpcEvents.test.ts +++ b/src/renderer/src/hooks/useIpcEvents.test.ts @@ -3382,7 +3382,10 @@ describe('useIpcEvents browser tab close routing', () => { closeTerminalListenerRef.current?.({ tabId: 'terminal-1' }) - expect(closeTerminalTabMock).toHaveBeenCalledWith('terminal-1') + // The CLI/RPC caller is answered immediately, so this close must never raise a modal. + expect(closeTerminalTabMock).toHaveBeenCalledWith('terminal-1', { + skipRunningProcessConfirm: true + }) }) it('acknowledges whole-tab close only after the fresh session is durably persisted', async () => { diff --git a/src/renderer/src/hooks/useIpcEvents.ts b/src/renderer/src/hooks/useIpcEvents.ts index be6a5e4b2d3..35c48344e63 100644 --- a/src/renderer/src/hooks/useIpcEvents.ts +++ b/src/renderer/src/hooks/useIpcEvents.ts @@ -1965,7 +1965,8 @@ export function useIpcEvents(): void { const detail: CloseTerminalPaneDetail = { tabId, paneRuntimeId } window.dispatchEvent(new CustomEvent(CLOSE_TERMINAL_PANE_EVENT, { detail })) } else { - closeTerminalTab(tabId) + // Why: the CLI/RPC caller is answered immediately, so it cannot wait on a modal. + closeTerminalTab(tabId, { skipRunningProcessConfirm: true }) } }) ) diff --git a/src/renderer/src/store/pinned-tab-close-guard.ts b/src/renderer/src/store/pinned-tab-close-guard.ts index 9603abd60f1..75a7db4fcc8 100644 --- a/src/renderer/src/store/pinned-tab-close-guard.ts +++ b/src/renderer/src/store/pinned-tab-close-guard.ts @@ -23,6 +23,13 @@ export function isUnifiedTabPinned(state: AppState, worktreeId: string, tabId: s ) } +/** Whether a pinned close will actually raise the pin dialog. Callers that let the pin + * prompt supersede another confirmation must know this: with the setting off the pin + * has nothing to say, so it must not swallow the other prompt (#10142). */ +export function shouldConfirmPinnedTabClose(state: AppState): boolean { + return state.settings?.confirmClosePinnedTab ?? true +} + /** Routes a pinned-tab close attempt through the confirmation dialog when the * setting is on. Non-pinned tabs (and pinned tabs when the setting is off) * close immediately. Keeping every close path behind this single helper is why @@ -40,8 +47,7 @@ export function guardPinnedTabClose(params: { } const state = useAppStore.getState() - const shouldConfirm = state.settings?.confirmClosePinnedTab ?? true - if (!shouldConfirm) { + if (!shouldConfirmPinnedTabClose(state)) { onClose() return } diff --git a/src/renderer/src/store/running-terminal-close-confirm.test.ts b/src/renderer/src/store/running-terminal-close-confirm.test.ts new file mode 100644 index 00000000000..b597923a148 --- /dev/null +++ b/src/renderer/src/store/running-terminal-close-confirm.test.ts @@ -0,0 +1,226 @@ +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { useRunningTerminalCloseConfirmStore } from './running-terminal-close-confirm' + +// The store rejects a second action within 350 ms of revealing a queued request, so these +// tests drive a clock rather than letting wall time decide whether an action lands. +let clock = 1_000 + +function advancePastGuard(): void { + clock += 400 +} + +function drainRequests(): void { + const store = useRunningTerminalCloseConfirmStore.getState() + while (useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm) { + advancePastGuard() + store.dismissRunningTerminalClose() + } +} + +function request(terminalTabId: string, onConfirm: () => void = vi.fn(), onCancel?: () => void) { + return { + terminalTabId, + tabLabel: terminalTabId, + copyKind: 'command' as const, + onConfirm, + ...(onCancel ? { onCancel } : {}) + } +} + +describe('running terminal close confirmation store', () => { + beforeEach(() => { + // Monotonic across tests: the store is a singleton, so winding the clock back would + // leave a previous test's guard deadline in the future and block every action. + clock += 10_000 + vi.spyOn(Date, 'now').mockImplementation(() => clock) + }) + + afterEach(() => { + drainRequests() + vi.mocked(Date.now).mockRestore() + }) + + it('shows the first request and queues the next one', () => { + const first = vi.fn() + const second = vi.fn() + const store = useRunningTerminalCloseConfirmStore.getState() + + store.requestRunningTerminalCloseConfirm(request('tab-1', first)) + store.requestRunningTerminalCloseConfirm(request('tab-2', second)) + + expect( + useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm?.terminalTabId + ).toBe('tab-1') + + store.confirmRunningTerminalClose() + + expect(first).toHaveBeenCalledTimes(1) + expect(second).not.toHaveBeenCalled() + expect( + useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm?.terminalTabId + ).toBe('tab-2') + }) + + it('shows one prompt for a repeat request but still resolves both closes', () => { + const first = vi.fn() + const duplicate = vi.fn() + const store = useRunningTerminalCloseConfirmStore.getState() + + store.requestRunningTerminalCloseConfirm(request('tab-1', first)) + store.requestRunningTerminalCloseConfirm(request('tab-1', duplicate)) + store.confirmRunningTerminalClose() + + expect(first).toHaveBeenCalledTimes(1) + expect(duplicate).toHaveBeenCalledTimes(1) + expect(useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm).toBeNull() + }) + + it('cancels both callers when a folded repeat request is dismissed', () => { + const store = useRunningTerminalCloseConfirmStore.getState() + const firstCancel = vi.fn() + const duplicateCancel = vi.fn() + + store.requestRunningTerminalCloseConfirm(request('tab-1', vi.fn(), firstCancel)) + store.requestRunningTerminalCloseConfirm(request('tab-1', vi.fn(), duplicateCancel)) + store.dismissRunningTerminalClose() + + expect(firstCancel).toHaveBeenCalledTimes(1) + expect(duplicateCancel).toHaveBeenCalledTimes(1) + }) + + it('folds a repeat request into the one already waiting in the queue', () => { + const store = useRunningTerminalCloseConfirmStore.getState() + const queued = vi.fn() + const duplicate = vi.fn() + + store.requestRunningTerminalCloseConfirm(request('tab-1')) + store.requestRunningTerminalCloseConfirm(request('tab-2', queued)) + store.requestRunningTerminalCloseConfirm(request('tab-2', duplicate)) + + store.confirmRunningTerminalClose() + advancePastGuard() + store.confirmRunningTerminalClose() + + expect(queued).toHaveBeenCalledTimes(1) + expect(duplicate).toHaveBeenCalledTimes(1) + expect(useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm).toBeNull() + }) + + it('confirms every pending request once the user opts out of the prompt', () => { + const store = useRunningTerminalCloseConfirmStore.getState() + const visible = vi.fn() + const queued = vi.fn() + + store.requestRunningTerminalCloseConfirm(request('tab-1', visible)) + store.requestRunningTerminalCloseConfirm(request('tab-2', queued)) + store.confirmAllRunningTerminalCloses() + + expect(visible).toHaveBeenCalledTimes(1) + expect(queued).toHaveBeenCalledTimes(1) + expect(useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm).toBeNull() + }) + + it('runs onCancel on dismiss and never the close', () => { + const onConfirm = vi.fn() + const onCancel = vi.fn() + const store = useRunningTerminalCloseConfirmStore.getState() + + store.requestRunningTerminalCloseConfirm(request('tab-1', onConfirm, onCancel)) + store.dismissRunningTerminalClose() + + expect(onCancel).toHaveBeenCalledTimes(1) + expect(onConfirm).not.toHaveBeenCalled() + expect(useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm).toBeNull() + }) + + it('is inert when there is nothing to confirm', () => { + const store = useRunningTerminalCloseConfirmStore.getState() + + expect(() => store.confirmRunningTerminalClose()).not.toThrow() + expect(() => store.dismissRunningTerminalClose()).not.toThrow() + }) + + it('lets a re-entrant close from onConfirm queue behind the next request', () => { + const store = useRunningTerminalCloseConfirmStore.getState() + const reentrant = vi.fn() + const second = vi.fn() + + store.requestRunningTerminalCloseConfirm( + request('tab-1', () => { + // Why: the real onConfirm re-enters closeTerminalTab, which may request again. + store.requestRunningTerminalCloseConfirm(request('tab-3', reentrant)) + }) + ) + store.requestRunningTerminalCloseConfirm(request('tab-2', second)) + store.confirmRunningTerminalClose() + + expect( + useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm?.terminalTabId + ).toBe('tab-2') + + advancePastGuard() + store.confirmRunningTerminalClose() + expect(second).toHaveBeenCalledTimes(1) + expect( + useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm?.terminalTabId + ).toBe('tab-3') + + advancePastGuard() + store.confirmRunningTerminalClose() + expect(reentrant).toHaveBeenCalledTimes(1) + }) + + // Why: a queued request replaces the visible one in place. Without this window, the second + // click of a double-click aimed at one tab lands on the next tab's prompt and kills a + // running process the user never saw asked about — the bug class this PR exists to close. + it('ignores a second action that lands on the freshly revealed request', () => { + const store = useRunningTerminalCloseConfirmStore.getState() + const first = vi.fn() + const second = vi.fn() + + store.requestRunningTerminalCloseConfirm(request('tab-1', first)) + store.requestRunningTerminalCloseConfirm(request('tab-2', second)) + + store.confirmRunningTerminalClose() + store.confirmRunningTerminalClose() + + expect(first).toHaveBeenCalledTimes(1) + expect(second).not.toHaveBeenCalled() + expect( + useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm?.terminalTabId + ).toBe('tab-2') + + advancePastGuard() + store.confirmRunningTerminalClose() + expect(second).toHaveBeenCalledTimes(1) + }) + + it('also holds off a dismiss that lands on the freshly revealed request', () => { + const store = useRunningTerminalCloseConfirmStore.getState() + const secondCancel = vi.fn() + + store.requestRunningTerminalCloseConfirm(request('tab-1')) + store.requestRunningTerminalCloseConfirm(request('tab-2', vi.fn(), secondCancel)) + + store.confirmRunningTerminalClose() + store.dismissRunningTerminalClose() + + expect(secondCancel).not.toHaveBeenCalled() + expect( + useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm?.terminalTabId + ).toBe('tab-2') + }) + + // Why: emptying the queue leaves nothing to mis-click, so the opt-out must not be delayed. + it('arms no guard when the last request leaves the queue empty', () => { + const store = useRunningTerminalCloseConfirmStore.getState() + const onConfirm = vi.fn() + + store.requestRunningTerminalCloseConfirm(request('tab-1')) + store.confirmRunningTerminalClose() + store.requestRunningTerminalCloseConfirm(request('tab-2', onConfirm)) + store.confirmRunningTerminalClose() + + expect(onConfirm).toHaveBeenCalledTimes(1) + }) +}) diff --git a/src/renderer/src/store/running-terminal-close-confirm.ts b/src/renderer/src/store/running-terminal-close-confirm.ts new file mode 100644 index 00000000000..618d30c98c5 --- /dev/null +++ b/src/renderer/src/store/running-terminal-close-confirm.ts @@ -0,0 +1,132 @@ +import { create } from 'zustand' +import type { CloseTerminalDialogCopyKind } from '@/components/terminal-pane/CloseTerminalDialog' + +/** A pending confirmation for closing a terminal tab whose shell still has a + * running child process. `onConfirm` performs the original close. */ +export type RunningTerminalCloseConfirmRequest = { + terminalTabId: string + tabLabel: string + copyKind: CloseTerminalDialogCopyKind + onConfirm: () => void + onCancel?: () => void +} + +export type RunningTerminalCloseConfirmState = { + runningTerminalCloseConfirm: RunningTerminalCloseConfirmRequest | null + requestRunningTerminalCloseConfirm: (request: RunningTerminalCloseConfirmRequest) => void + confirmRunningTerminalClose: () => void + /** Accepts the visible request and every queued one. Used when the user ticks "don't ask + * again": a prompt they just opted out of must not still be waiting behind this one. */ + confirmAllRunningTerminalCloses: () => void + dismissRunningTerminalClose: () => void +} + +/** Folds a duplicate request for the same tab into the pending one instead of dropping it, + * so two surfaces closing the same tab both get their callback. */ +function mergeRequests( + pending: RunningTerminalCloseConfirmRequest, + duplicate: RunningTerminalCloseConfirmRequest +): RunningTerminalCloseConfirmRequest { + return { + ...pending, + onConfirm: () => { + pending.onConfirm() + duplicate.onConfirm() + }, + onCancel: () => { + pending.onCancel?.() + duplicate.onCancel?.() + } + } +} + +// Why a standalone store instead of an AppState slice (which is what the sibling +// pinned-tab confirmation uses): the request is raised from closeTerminalTab, a plain +// module whose unit fixtures build partial app-state objects, so dispatching through +// useAppStore.getState() would throw there. Nothing outside the dialog reads this state, +// so the AppState coupling would buy nothing. +export const useRunningTerminalCloseConfirmStore = create()(( + set, + get +) => { + const queuedRequests: RunningTerminalCloseConfirmRequest[] = [] + // Why: a queued request replaces the visible one in place, so a double-click or held + // Enter meant for the tab the user was looking at would land on the next tab's prompt and + // kill a second running process unseen. Matches the sibling pinned-tab confirmation. + const INTER_REQUEST_ACTION_GUARD_MS = 350 + let nextRequestActionAllowedAt = 0 + + /** Reveals the next queued request, and reports whether one took the visible slot. */ + const advanceRequest = (): boolean => { + const next = queuedRequests.shift() ?? null + set({ runningTerminalCloseConfirm: next }) + return next !== null + } + + const guardNextAction = (revealedNextRequest: boolean): void => { + if (revealedNextRequest) { + nextRequestActionAllowedAt = Date.now() + INTER_REQUEST_ACTION_GUARD_MS + } + } + + return { + runningTerminalCloseConfirm: null, + + requestRunningTerminalCloseConfirm: (request) => { + const visible = get().runningTerminalCloseConfirm + // Why: the probe is async, so a second click on the same tab arrives before the + // dialog opens. One prompt, but both closes still resolve. + if (visible?.terminalTabId === request.terminalTabId) { + set({ runningTerminalCloseConfirm: mergeRequests(visible, request) }) + return + } + const queuedIndex = queuedRequests.findIndex( + (queued) => queued.terminalTabId === request.terminalTabId + ) + if (queuedIndex >= 0) { + queuedRequests[queuedIndex] = mergeRequests(queuedRequests[queuedIndex]!, request) + return + } + if (visible) { + // Why: closing two busy tabs in quick succession must not strand the second + // tab's close callback behind a replaced request. + queuedRequests.push(request) + return + } + set({ runningTerminalCloseConfirm: request }) + }, + + confirmRunningTerminalClose: () => { + const request = get().runningTerminalCloseConfirm + if (!request || Date.now() < nextRequestActionAllowedAt) { + return + } + // Why: advance before running onConfirm so a re-entrant close queues behind the + // next real request instead of seeing the stale one. + guardNextAction(advanceRequest()) + request.onConfirm() + }, + + confirmAllRunningTerminalCloses: () => { + if (Date.now() < nextRequestActionAllowedAt) { + return + } + const pending = [get().runningTerminalCloseConfirm, ...queuedRequests.splice(0)] + set({ runningTerminalCloseConfirm: null }) + // No guard to arm: the queue is empty, so there is no next prompt to mis-click. + for (const request of pending) { + request?.onConfirm() + } + }, + + dismissRunningTerminalClose: () => { + const request = get().runningTerminalCloseConfirm + if (!request || Date.now() < nextRequestActionAllowedAt) { + return + } + guardNextAction(advanceRequest()) + // Why: callers such as the tab-group model resume their own cleanup on cancel. + request.onCancel?.() + } + } +}) diff --git a/tests/e2e/terminal-tab-close-running-confirm-mouse.spec.ts b/tests/e2e/terminal-tab-close-running-confirm-mouse.spec.ts new file mode 100644 index 00000000000..c854c8ba798 --- /dev/null +++ b/tests/e2e/terminal-tab-close-running-confirm-mouse.spec.ts @@ -0,0 +1,101 @@ +/** + * #10142 follow-ups to the X-button regression: middle-click prompts too, confirming + * actually closes, and Cmd+W raises exactly one dialog (the pane path delegates the + * last-pane close to closeTerminalTab instead of probing a second time). + */ +import { test, expect } from './helpers/orca-app' +import type { Page } from '@stablyai/playwright-test' +import { + waitForSessionReady, + waitForActiveWorktree, + getActiveTabId, + ensureTerminalVisible +} from './helpers/store' +import { + execInTerminal, + focusActiveTerminalInput, + waitForActivePanePtyId, + waitForActiveTerminalManager, + waitForPaneCount, + waitForTerminalOutput +} from './helpers/terminal' + +const SORTABLE_TAB = '[data-testid="sortable-tab"]' + +function closeDialogTitle(page: Page) { + return page.getByText(/Stop running command\?|Stop this agent\?/) +} + +async function startBusyTerminal(page: Page): Promise { + await waitForSessionReady(page) + await waitForActiveWorktree(page) + await ensureTerminalVisible(page) + const hasPaneManager = await waitForActiveTerminalManager(page, 30_000) + .then(() => true) + .catch(() => false) + test.skip(!hasPaneManager, 'Electron automation never mounted the live TerminalPane manager.') + await waitForPaneCount(page, 1, 30_000) + + const ptyId = await waitForActivePanePtyId(page) + await execInTerminal(page, ptyId, 'echo close-confirm-ready') + await waitForTerminalOutput(page, 'close-confirm-ready', 20_000) + await execInTerminal(page, ptyId, 'sleep 300') + // Why: `hasChildProcesses` is already true while macOS's `login` wrapper starts the + // shell, so wait for `sleep` itself or the close legitimately sees an idle terminal. + await expect + .poll( + async () => + (await page.evaluate((id) => window.api.pty.inspectProcess(id), ptyId)).foregroundProcess, + { timeout: 20_000, message: 'sleep 300 never became the foreground process' } + ) + .toBe('sleep') + return (await getActiveTabId(page))! +} + +test.describe.configure({ mode: 'serial' }) + +test('middle-clicking a busy tab prompts, and cancelling keeps the tab', async ({ orcaPage }) => { + test.setTimeout(120_000) + const busyTabId = await startBusyTerminal(orcaPage) + const busyTab = orcaPage.locator(`${SORTABLE_TAB}[data-tab-id="${busyTabId}"]`).first() + const tabsBefore = await orcaPage.locator(SORTABLE_TAB).count() + + await busyTab.click({ button: 'middle' }) + + await expect(closeDialogTitle(orcaPage)).toBeVisible({ timeout: 15_000 }) + await orcaPage.getByRole('button', { name: /^Cancel$/ }).click() + await expect(closeDialogTitle(orcaPage)).toBeHidden() + await expect(busyTab).toBeVisible() + expect(await orcaPage.locator(SORTABLE_TAB).count()).toBe(tabsBefore) +}) + +test('confirming the X-button prompt closes the busy tab', async ({ orcaPage }) => { + test.setTimeout(120_000) + const busyTabId = await startBusyTerminal(orcaPage) + const busyTab = orcaPage.locator(`${SORTABLE_TAB}[data-tab-id="${busyTabId}"]`).first() + + await busyTab.hover() + await busyTab.getByRole('button', { name: /^Close tab /i }).click() + await expect(closeDialogTitle(orcaPage)).toBeVisible({ timeout: 15_000 }) + await orcaPage.getByRole('button', { name: /^Stop and Close$/ }).click() + + await expect(busyTab).toHaveCount(0, { timeout: 15_000 }) + await expect(closeDialogTitle(orcaPage)).toBeHidden() +}) + +test('Cmd+W on a busy single-pane tab raises exactly one dialog', async ({ orcaPage }) => { + test.setTimeout(120_000) + const busyTabId = await startBusyTerminal(orcaPage) + const busyTab = orcaPage.locator(`${SORTABLE_TAB}[data-tab-id="${busyTabId}"]`).first() + + await focusActiveTerminalInput(orcaPage) + await orcaPage.keyboard.press(process.platform === 'darwin' ? 'Meta+w' : 'Control+w') + await expect(closeDialogTitle(orcaPage)).toBeVisible({ timeout: 15_000 }) + await orcaPage.getByRole('button', { name: /^Stop and Close$/ }).click() + + await expect(busyTab).toHaveCount(0, { timeout: 15_000 }) + // Why: the pane used to probe and prompt on its own before delegating to + // closeTerminalTab, which now prompts too — a second dialog would mean a double prompt. + await orcaPage.waitForTimeout(1_500) + await expect(closeDialogTitle(orcaPage)).toBeHidden() +}) diff --git a/tests/e2e/terminal-tab-close-running-confirm.spec.ts b/tests/e2e/terminal-tab-close-running-confirm.spec.ts new file mode 100644 index 00000000000..68182eb4798 --- /dev/null +++ b/tests/e2e/terminal-tab-close-running-confirm.spec.ts @@ -0,0 +1,90 @@ +/** + * Regression for #10142: keyboard and mouse enforce the same running-process close + * confirmation. Both halves run against one tab with a live `sleep 300` child: + * 1. Cmd/Ctrl+W -> "Stop running command?" dialog (cancelled, tab survives). + * 2. X click -> the same dialog, and the tab is still there behind it. + */ +import { test, expect } from './helpers/orca-app' +import type { Page } from '@stablyai/playwright-test' +import { + waitForSessionReady, + waitForActiveWorktree, + getActiveTabId, + ensureTerminalVisible +} from './helpers/store' +import { + execInTerminal, + focusActiveTerminalInput, + waitForActivePanePtyId, + waitForActiveTerminalManager, + waitForPaneCount, + waitForTerminalOutput +} from './helpers/terminal' + +const SORTABLE_TAB = '[data-testid="sortable-tab"]' + +function countRenderedTabs(page: Page): Promise { + return page.locator(SORTABLE_TAB).count() +} + +function closeDialogTitle(page: Page) { + return page.getByText(/Stop running command\?|Stop this agent\?/) +} + +test.describe.configure({ mode: 'serial' }) + +test('the tab X button applies the same running-process confirmation as Cmd+W', async ({ + orcaPage +}) => { + test.setTimeout(120_000) + await waitForSessionReady(orcaPage) + await waitForActiveWorktree(orcaPage) + await ensureTerminalVisible(orcaPage) + const hasPaneManager = await waitForActiveTerminalManager(orcaPage, 30_000) + .then(() => true) + .catch(() => false) + test.skip(!hasPaneManager, 'Electron automation never mounted the live TerminalPane manager.') + await waitForPaneCount(orcaPage, 1, 30_000) + + const ptyId = await waitForActivePanePtyId(orcaPage) + await execInTerminal(orcaPage, ptyId, 'echo repro-10142-ready') + await waitForTerminalOutput(orcaPage, 'repro-10142-ready', 20_000) + await execInTerminal(orcaPage, ptyId, 'sleep 300') + // Only press close once `sleep` is the foreground process; otherwise the probe + // legitimately sees an idle shell and closing is correct. `hasChildProcesses` alone is + // not enough: macOS spawns the shell under `login`, so a still-initialising terminal + // reports a child before `sleep 300` has run. + await expect + .poll( + async () => + (await orcaPage.evaluate((id) => window.api.pty.inspectProcess(id), ptyId)) + .foregroundProcess, + { timeout: 20_000, message: 'sleep 300 never became the foreground process' } + ) + .toBe('sleep') + + const busyTabId = (await getActiveTabId(orcaPage))! + const busyTab = orcaPage.locator(`${SORTABLE_TAB}[data-tab-id="${busyTabId}"]`).first() + + // 1. Keyboard close prompts. + await focusActiveTerminalInput(orcaPage) + await orcaPage.keyboard.press(process.platform === 'darwin' ? 'Meta+w' : 'Control+w') + await expect(closeDialogTitle(orcaPage)).toBeVisible({ timeout: 15_000 }) + await orcaPage.getByRole('button', { name: /^Cancel$/ }).click() + await expect(closeDialogTitle(orcaPage)).toBeHidden() + await expect(busyTab).toBeVisible() + const tabsBefore = await countRenderedTabs(orcaPage) + + // 2. Same tab, same running child, mouse close. + await busyTab.hover() + await busyTab.getByRole('button', { name: /^Close tab /i }).click() + await orcaPage.waitForTimeout(1_500) + + expect( + { + confirmDialogVisible: await closeDialogTitle(orcaPage).isVisible(), + tabStillPresent: (await countRenderedTabs(orcaPage)) === tabsBefore + }, + 'X-button close must apply the same running-process confirmation as Cmd+W' + ).toEqual({ confirmDialogVisible: true, tabStillPresent: true }) +}) From 0927b9c156a86e9610cd00538d057b17a0c9f4fe Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Mon, 3 Aug 2026 22:48:37 -0700 Subject: [PATCH 07/72] fix(gitlab): load pipeline job traces in the Checks side panel (#7732) (#12266) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * test(repro): demonstrate #7732 GitLab pipeline job details never load in Checks panel Co-authored-by: Orca * fix(gitlab): load pipeline job traces in the Checks side panel (#7732) Expanding a GitLab pipeline job in the Checks panel always showed "No inline details are available for this check.": the mapper dropped the numeric job id, `PRCheckDetail` had nowhere to carry it, and every consumer called the GitHub check-runs API, which returns null for a GitLab job. - carry `gitlabJobId` on `PRCheckDetail` and add the `gitlab-job:` branch to all three identity ladders (panel rows, editor tabs, fix-prompt keys) so same-stage jobs with no web_url stop colliding - add a runtime-routed trace client so SSH/remote workspaces work, not just local IPC, and thread the MR's `projectRef` for fork pipelines - bound the trace in main via the existing `sliceCheckLogTail` (now shared, not GitHub-only) so a multi-megabyte CI log never crosses the 1 MB transport frame cap; strip ANSI/section markers up to the CR only, which keeps each section's visible header and command echo - render the excerpt inline instead of "Log tail available in full details." - feed GitLab traces to "Fix with AI", which previously sent bare check names - skip the fetch for jobs that cannot have a trace (created/manual/skipped) so GitLab's 404 does not replace the benign empty state, and re-arm a failed load when the job's state changes since the panel has no retry Co-authored-by: Orca * fix(gitlab): treat a missing job log as an empty log, not an error (#7732) Round-1 review follow-up. - a job canceled before it started (or whose log was erased/expired) is `completed`/`cancelled`, so the panel fetched its trace, GitLab answered 404, and `classifyGlabError`'s issue-edit copy ("Issue not found — it may have been deleted.") landed verbatim on the auto-expanded check row; main now maps that 404 to an empty trace so the row keeps its benign empty state - keep a missing project a real error (GitLab masks unauthorized projects as 404) and add `classifyJobLogError` so 403/unknown failures stop borrowing issue-edit wording on a job-log read - broaden the empty-log copy in all five catalogs: it now covers erased and expired logs, not only jobs that never ran - e2e: derive the repro screenshot dir from `process.cwd()` (or an env override) instead of a hardcoded POSIX path to a throwaway worktree - bound the raw trace before the ANSI/section passes so a multi-megabyte log is not scanned in full on the main-process event loop - drop the redundant `if (repo)` in `handleFixChecksWithAI` and the now-dead "Log tail available in full details." catalog entry Co-authored-by: Orca * fix(gitlab): address review — project ref on reload, retry re-arm, IPC timeout - Carry the MR's GitLab project ref on the check-details tab so reloading a fork/cross-project job tab fetches the trace from the pipeline's own project. - Re-arm the sidebar retry when a details load resolves to null, not only when it throws; a detail-less row otherwise never retried after the job moved on. - Bound the local `gl.jobTrace` IPC call with the same 30s timeout the runtime RPC path uses — glab runs without a subprocess timeout in main. - Document that the trace 404 -> empty-log mapping is deliberately broad. Co-authored-by: Orca --------- Co-authored-by: Orca --- src/main/github/client.ts | 2 +- src/main/gitlab/client-mr.test.ts | 26 +++ src/main/gitlab/client.ts | 9 +- src/main/gitlab/gl-utils.test.ts | 14 ++ src/main/gitlab/gl-utils.ts | 7 +- src/main/gitlab/glab-error-classification.ts | 35 ++++ src/main/ipc/gitlab.test.ts | 28 +++ src/main/ipc/gitlab.ts | 10 +- src/main/runtime/rpc/methods/gitlab.test.ts | 28 +++ src/main/runtime/rpc/methods/gitlab.ts | 20 +- src/preload/api-types.ts | 2 + src/preload/gitlab.ts | 2 +- .../automation-run-output-snapshot.ts | 22 +-- .../editor/check-run-details-tab.test.ts | 12 ++ .../editor/check-run-details-tab.ts | 20 ++ .../components/pr-checks-fix-prompt.test.ts | 21 ++ .../components/right-sidebar/ChecksPanel.tsx | 92 ++++++--- .../checks-list-expanded-details.test.tsx | 148 +++++++++++++- .../right-sidebar/checks-panel-content.tsx | 81 ++++++-- src/renderer/src/i18n/locales/en.json | 9 +- src/renderer/src/i18n/locales/es.json | 9 +- src/renderer/src/i18n/locales/ja.json | 9 +- src/renderer/src/i18n/locales/ko.json | 9 +- src/renderer/src/i18n/locales/zh.json | 9 +- .../runtime/gitlab-job-trace-client.test.ts | 184 ++++++++++++++++++ .../src/runtime/gitlab-job-trace-client.ts | 105 ++++++++++ src/renderer/src/store/slices/editor.test.ts | 149 ++++++++++++++ src/renderer/src/store/slices/editor.ts | 71 ++++--- src/shared/ansi-escape-sequences.ts | 27 +++ .../check-job-log-tail-slice.test.ts | 0 .../check-job-log-tail-slice.ts | 20 +- src/shared/gitlab-job-log-excerpt.test.ts | 90 +++++++++ src/shared/gitlab-job-log-excerpt.ts | 52 +++++ .../gitlab-job-trace-check-details.test.ts | 97 +++++++++ src/shared/gitlab-job-trace-check-details.ts | 70 +++++++ src/shared/gitlab-pipeline-checks.test.ts | 24 ++- src/shared/gitlab-pipeline-checks.ts | 4 +- src/shared/pr-checks-fix-prompt.ts | 5 + .../repro-7732-gitlab-job-id-dropped.test.ts | 29 +++ src/shared/types.ts | 3 + ...pro-7732-gitlab-checks-job-details.spec.ts | 160 +++++++++++++++ 41 files changed, 1595 insertions(+), 119 deletions(-) create mode 100644 src/renderer/src/runtime/gitlab-job-trace-client.test.ts create mode 100644 src/renderer/src/runtime/gitlab-job-trace-client.ts create mode 100644 src/shared/ansi-escape-sequences.ts rename src/{main/github => shared}/check-job-log-tail-slice.test.ts (100%) rename src/{main/github => shared}/check-job-log-tail-slice.ts (82%) create mode 100644 src/shared/gitlab-job-log-excerpt.test.ts create mode 100644 src/shared/gitlab-job-log-excerpt.ts create mode 100644 src/shared/gitlab-job-trace-check-details.test.ts create mode 100644 src/shared/gitlab-job-trace-check-details.ts create mode 100644 src/shared/repro-7732-gitlab-job-id-dropped.test.ts create mode 100644 tests/e2e/repro-7732-gitlab-checks-job-details.spec.ts diff --git a/src/main/github/client.ts b/src/main/github/client.ts index 24772ebee4b..07472e5c096 100644 --- a/src/main/github/client.ts +++ b/src/main/github/client.ts @@ -38,7 +38,7 @@ import { import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises' import { join } from 'node:path' import { tmpdir } from 'node:os' -import { sliceCheckLogTail } from './check-job-log-tail-slice' +import { sliceCheckLogTail } from '../../shared/check-job-log-tail-slice' import { classifyPRRefreshError, safePRRefreshErrorMessage diff --git a/src/main/gitlab/client-mr.test.ts b/src/main/gitlab/client-mr.test.ts index de8d36494d8..c3c4de25a3f 100644 --- a/src/main/gitlab/client-mr.test.ts +++ b/src/main/gitlab/client-mr.test.ts @@ -1090,6 +1090,32 @@ describe('gitlab client — MR operations', () => { ) }) + // #7732: a job canceled before it started 404s; the Checks panel must show its + // benign empty state, not the issue-edit copy classifyGlabError would produce. + it('reports a 404 trace as an empty log rather than an error', async () => { + glabExecFileAsyncMock.mockRejectedValueOnce(new Error('HTTP 404 Not Found')) + + await expect(getJobTrace('/repo', 99, 'upstream', 'conn-1')).resolves.toEqual({ + ok: true, + trace: '' + }) + }) + + it('keeps a missing project and a scope failure as errors, in job-log wording', async () => { + glabExecFileAsyncMock.mockRejectedValueOnce(new Error('HTTP 404: Project Not Found')) + await expect(getJobTrace('/repo', 99, 'upstream', 'conn-1')).resolves.toEqual({ + ok: false, + error: "Could not find this job's GitLab project." + }) + + glabExecFileAsyncMock.mockRejectedValueOnce(new Error('HTTP 403 insufficient_scope')) + const forbidden = await getJobTrace('/repo', 99, 'upstream', 'conn-1') + expect(forbidden).toEqual({ + ok: false, + error: "You don't have permission to read this job's log. Check your GitLab token scopes." + }) + }) + it('retries a job through the selected SSH GitLab host', async () => { glabExecFileAsyncMock.mockResolvedValueOnce({ stdout: JSON.stringify({ diff --git a/src/main/gitlab/client.ts b/src/main/gitlab/client.ts index 2ff7f618488..74815729ebc 100644 --- a/src/main/gitlab/client.ts +++ b/src/main/gitlab/client.ts @@ -25,7 +25,9 @@ import { derivePipelineStatus, mapIssueToWorkItem, mapMRInfo, mapMRToWorkItem } import { acquire, classifyGlabError, + classifyJobLogError, classifyListIssuesError, + isMissingJobLogError, getGlabKnownHosts, getProjectRef, getProjectRefForRemote, @@ -1236,7 +1238,12 @@ export async function getJobTrace( return { ok: true, trace: stdout } } catch (err) { const msg = err instanceof Error ? err.message : String(err) - return { ok: false, error: classifyGlabError(msg).message } + // A job with no log is an empty log, not a failure: surfacing the 404 would + // pin an error on the Checks row for a job canceled before it started. + if (isMissingJobLogError(msg)) { + return { ok: true, trace: '' } + } + return { ok: false, error: classifyJobLogError(msg).message } } finally { release() } diff --git a/src/main/gitlab/gl-utils.test.ts b/src/main/gitlab/gl-utils.test.ts index e1937f3f2aa..c2396c9aa7d 100644 --- a/src/main/gitlab/gl-utils.test.ts +++ b/src/main/gitlab/gl-utils.test.ts @@ -16,8 +16,10 @@ import { _resetKnownHostsCache, _resetProjectRefCache, classifyGlabError, + classifyJobLogError, classifyListIssuesError, getIssueProjectRef, + isMissingJobLogError, getGlabKnownHosts, getProjectRef, getProjectRefForRemote, @@ -421,6 +423,18 @@ describe('glab error classification', () => { expect(classifyListIssuesError('HTTP 403').message).toMatch(/permission to read issues/i) expect(classifyListIssuesError('HTTP 404').message).toBe('Project not found.') }) + + it('rewrites issue-edit copy for job logs via classifyJobLogError', () => { + expect(classifyJobLogError('HTTP 403').message).toMatch(/permission to read this job's log/i) + expect(classifyJobLogError('HTTP 403').message).not.toMatch(/issue/i) + expect(classifyJobLogError('boom').message).toBe('Failed to load the job log: boom') + }) + + it('treats a 404 job log as missing, but keeps a missing project an error', () => { + expect(isMissingJobLogError('HTTP 404 Not Found')).toBe(true) + expect(isMissingJobLogError('HTTP 404: Project Not Found')).toBe(false) + expect(isMissingJobLogError('HTTP 403 Forbidden')).toBe(false) + }) }) describe('glab auth status host parsing', () => { diff --git a/src/main/gitlab/gl-utils.ts b/src/main/gitlab/gl-utils.ts index a8a7b5705a0..6531793dac6 100644 --- a/src/main/gitlab/gl-utils.ts +++ b/src/main/gitlab/gl-utils.ts @@ -2,7 +2,12 @@ import { gitExecFileAsync, glabExecFileAsync } from '../git/runner' import { parseGlabApiResponse, type GlabApiResponse } from './glab-api-response' export { glabExecFileAsync, gitExecFileAsync } -export { classifyGlabError, classifyListIssuesError } from './glab-error-classification' +export { + classifyGlabError, + classifyJobLogError, + classifyListIssuesError, + isMissingJobLogError +} from './glab-error-classification' export { DEFAULT_GITLAB_HOSTS, _getProjectRefCacheSize, diff --git a/src/main/gitlab/glab-error-classification.ts b/src/main/gitlab/glab-error-classification.ts index e1f740749e0..d769bdd108c 100644 --- a/src/main/gitlab/glab-error-classification.ts +++ b/src/main/gitlab/glab-error-classification.ts @@ -50,3 +50,38 @@ export function classifyListIssuesError(stderr: string): ClassifiedError { } return { type: c.type, message: readMessages[c.type] } } + +// Why: a job trace is a read on a pipeline job, so classifyGlabError's issue-edit +// copy ("permission to edit this issue") would land verbatim on a Checks row. +export function classifyJobLogError(stderr: string): ClassifiedError { + const c = classifyGlabError(stderr) + const trimmed = stderr.trim() + const logMessages: Record = { + permission_denied: + "You don't have permission to read this job's log. Check your GitLab token scopes.", + // A missing log is already reported as an empty log, so a 404 that reaches here + // means the project itself is gone or invisible to this token. + not_found: "Could not find this job's GitLab project.", + issues_disabled: `Failed to load the job log: ${trimmed}`, + validation_error: `Invalid request — ${trimmed}`, + rate_limited: 'GitLab rate limit hit. Try again in a few minutes.', + network_error: 'Network error — check your connection.', + unknown: `Failed to load the job log: ${trimmed}` + } + return { type: c.type, message: logMessages[c.type] } +} + +/** + * Whether a failed trace fetch means "this job has no log", not "the fetch broke". + * + * GitLab 404s the trace endpoint for a job canceled before it started and for a log + * that was erased or expired. A missing *project* is a real failure, and GitLab also + * masks unauthorized projects as 404, so keep that one an error. + * + * Deliberately broad: GitLab returns the same bare 404 for an unknown job id, so a + * stale/foreign id reads as an empty log rather than an error. Losing that diagnostic + * beats pinning "not found" on every job that was canceled before it produced a log. + */ +export function isMissingJobLogError(stderr: string): boolean { + return classifyGlabError(stderr).type === 'not_found' && !/project\s+not\s+found/i.test(stderr) +} diff --git a/src/main/ipc/gitlab.test.ts b/src/main/ipc/gitlab.test.ts index 7002f31d853..2ff888a7bd8 100644 --- a/src/main/ipc/gitlab.test.ts +++ b/src/main/ipc/gitlab.test.ts @@ -675,4 +675,32 @@ describe('GitLab IPC handlers', () => { localGitOptions ) }) + + // Regression for #7732: raw CI traces routinely exceed the 1 MB runtime transport + // frame cap, so the Checks panel opts into a main-side excerpt. + it('bounds the job trace in main when the caller asks for a log excerpt', async () => { + const noisyTrace = [ + 'section_start:1699000000:build\r\u001b[0K$ pnpm build', + ...Array.from({ length: 400 }, (_, index) => `line ${index}`), + '\u001b[0;31mERROR: Job failed: exit code 1\u001b[0m' + ].join('\n') + getJobTraceMock.mockResolvedValue({ ok: true, trace: noisyTrace }) + registerGitLabHandlers(storeWithRepos([repo()]) as Store) + + const raw = (await ipcHandlers.get('gitlab:jobTrace')?.(null, { + repoPath: '/local/orca', + jobId: 99 + })) as { ok: true; trace: string } + const excerpt = (await ipcHandlers.get('gitlab:jobTrace')?.(null, { + repoPath: '/local/orca', + jobId: 99, + logExcerpt: true + })) as { ok: true; trace: string } + + expect(raw.trace).toBe(noisyTrace) + expect(excerpt.trace).toContain('ERROR: Job failed: exit code 1') + expect(excerpt.trace).not.toContain('section_start') + expect(excerpt.trace).not.toContain('line 0\n') + expect(excerpt.trace.length).toBeLessThan(noisyTrace.length) + }) }) diff --git a/src/main/ipc/gitlab.ts b/src/main/ipc/gitlab.ts index f400ce7a5ce..e68c4b8f6d8 100644 --- a/src/main/ipc/gitlab.ts +++ b/src/main/ipc/gitlab.ts @@ -3,6 +3,7 @@ GitLab IPC handlers co-located keeps the repo-path validation pattern reviewable as one surface. */ import { ipcMain } from 'electron' import { resolve } from 'node:path' +import { toGitLabJobLogExcerptResult } from '../../shared/gitlab-job-log-excerpt' import type { GitLabIssueUpdate, GitLabMRInlineCommentInput, @@ -520,10 +521,14 @@ export function registerGitLabHandlers(store: Store): void { 'gitlab:jobTrace', async ( _event, - args: GitLabRepoSelectorArgs & { jobId: number; projectRef?: ProjectRef | null } + args: GitLabRepoSelectorArgs & { + jobId: number + projectRef?: ProjectRef | null + logExcerpt?: boolean + } ) => { const repo = assertRegisteredRepo(args, store) - return getJobTrace( + const result = await getJobTrace( repo.path, args.jobId, repo.issueSourcePreference, @@ -531,6 +536,7 @@ export function registerGitLabHandlers(store: Store): void { args.projectRef, ...localGitOptionArgs(store, repo) ) + return args.logExcerpt ? toGitLabJobLogExcerptResult(result) : result } ) diff --git a/src/main/runtime/rpc/methods/gitlab.test.ts b/src/main/runtime/rpc/methods/gitlab.test.ts index ca429f3d492..fe1ecd113c7 100644 --- a/src/main/runtime/rpc/methods/gitlab.test.ts +++ b/src/main/runtime/rpc/methods/gitlab.test.ts @@ -313,4 +313,32 @@ describe('gitlab RPC methods', () => { ) expect(runtime.listGitLabRepoIssues).toHaveBeenNthCalledWith(2, 'id:repo-1', 'opened', '@me', 1) }) + + // Regression for #7732: the WS/relay transports close the connection on frames + // over 1 MB, so the excerpt must be produced before the response is serialised. + it('bounds the job trace before it crosses the transport when logExcerpt is set', async () => { + const noisyTrace = [ + 'section_start:1699000000:build\r\u001b[0K$ pnpm build', + ...Array.from({ length: 400 }, (_, index) => `line ${index}`), + 'ERROR: Job failed: exit code 1' + ].join('\n') + const runtime = { + getRuntimeId: () => 'test-runtime', + getGitLabRepoJobTrace: vi.fn().mockResolvedValue({ ok: true, trace: noisyTrace }) + } as unknown as OrcaRuntimeService + const dispatcher = new RpcDispatcher({ runtime, methods: GITLAB_METHODS }) + + const raw = await dispatcher.dispatch( + makeRequest('gitlab.jobTrace', { repo: 'id:repo-1', jobId: 99 }) + ) + const excerpt = await dispatcher.dispatch( + makeRequest('gitlab.jobTrace', { repo: 'id:repo-1', jobId: 99, logExcerpt: true }) + ) + + expect((raw as { result: { trace: string } }).result.trace).toBe(noisyTrace) + const bounded = (excerpt as { result: { trace: string } }).result.trace + expect(bounded).toContain('ERROR: Job failed: exit code 1') + expect(bounded).not.toContain('section_start') + expect(bounded).not.toContain('line 0\n') + }) }) diff --git a/src/main/runtime/rpc/methods/gitlab.ts b/src/main/runtime/rpc/methods/gitlab.ts index c10a7eee7b5..81c298d57bb 100644 --- a/src/main/runtime/rpc/methods/gitlab.ts +++ b/src/main/runtime/rpc/methods/gitlab.ts @@ -2,6 +2,7 @@ import { z } from 'zod' import { defineMethod, type RpcMethod } from '../core' import { OptionalFiniteNumber, OptionalString, requiredString } from '../schemas' import { normalizeGitLabIssueListArgs } from '../../../gitlab/gitlab-preload-args' +import { toGitLabJobLogExcerptResult } from '../../../../shared/gitlab-job-log-excerpt' const RepoSelector = z.object({ repo: requiredString('Missing repo selector') @@ -16,12 +17,14 @@ const GitLabRateLimit = z .optional() .default({}) +// nullish, not optional: renderer callers normalise a missing ref to `null` +// (`item.projectRef ?? null`), which a bare `.optional()` would reject outright. const GitLabProjectRef = z .object({ host: requiredString('Missing GitLab host'), path: requiredString('Missing GitLab project path') }) - .optional() + .nullish() const WorkItemsList = RepoSelector.extend({ state: z.enum(['opened', 'merged', 'closed', 'all']).optional(), @@ -121,7 +124,10 @@ const ResolveMRDiscussion = RepoSelector.extend({ const JobTrace = RepoSelector.extend({ jobId: z.number().int().positive(), - projectRef: GitLabProjectRef + projectRef: GitLabProjectRef, + // Why: raw CI traces routinely exceed the 1 MB transport frame cap, so callers + // that only render an excerpt ask main to bound it before it crosses the wire. + logExcerpt: z.boolean().optional() }) const RetryJob = RepoSelector.extend({ @@ -245,8 +251,14 @@ export const GITLAB_METHODS: RpcMethod[] = [ defineMethod({ name: 'gitlab.jobTrace', params: JobTrace, - handler: async (params, { runtime }) => - runtime.getGitLabRepoJobTrace(params.repo, params.jobId, params.projectRef) + handler: async (params, { runtime }) => { + const result = await runtime.getGitLabRepoJobTrace( + params.repo, + params.jobId, + params.projectRef + ) + return params.logExcerpt ? toGitLabJobLogExcerptResult(result) : result + } }), defineMethod({ name: 'gitlab.retryJob', diff --git a/src/preload/api-types.ts b/src/preload/api-types.ts index 7f60af7e8e3..859be396e2e 100644 --- a/src/preload/api-types.ts +++ b/src/preload/api-types.ts @@ -2129,6 +2129,8 @@ export type PreloadApi = { args: GitLabRepoSelectorArgs & { jobId: number projectRef?: GitLabProjectRef | null + /** Bound the trace in main to a readable excerpt (see gitLabJobTraceToLogExcerpt). */ + logExcerpt?: boolean } ) => Promise retryJob: ( diff --git a/src/preload/gitlab.ts b/src/preload/gitlab.ts index 28c6f763e0f..8fbe1105af8 100644 --- a/src/preload/gitlab.ts +++ b/src/preload/gitlab.ts @@ -154,7 +154,7 @@ export const glApi = { ): Promise => ipcRenderer.invoke('gitlab:resolveMRDiscussion', args), jobTrace: ( - args: GitLabRepoSelectorArgs & { jobId: number; projectRef?: unknown } + args: GitLabRepoSelectorArgs & { jobId: number; projectRef?: unknown; logExcerpt?: boolean } ): Promise => ipcRenderer.invoke('gitlab:jobTrace', args), retryJob: ( diff --git a/src/renderer/src/components/automations/automation-run-output-snapshot.ts b/src/renderer/src/components/automations/automation-run-output-snapshot.ts index a7b9151fbfc..91c9e88c592 100644 --- a/src/renderer/src/components/automations/automation-run-output-snapshot.ts +++ b/src/renderer/src/components/automations/automation-run-output-snapshot.ts @@ -1,17 +1,11 @@ -/* eslint-disable no-control-regex -- terminal snapshots normalize ANSI/control output. */ import type { AutomationRunOutputSnapshot } from '../../../../shared/automations-types' +import { + stripAnsiEscapeSequences, + TERMINAL_CONTROL_CHARACTER_PATTERN +} from '../../../../shared/ansi-escape-sequences' const MAX_OUTPUT_SNAPSHOT_CHARS = 256 * 1024 -// Why: Codex/Claude TUIs emit OSC title/progress frames in hidden automation -// PTYs; saved run output should keep command text, not terminal metadata. -const OSC_SEQUENCE_PATTERN = /(?:\u001b\]|\u009d)[\s\S]*?(?:\u0007|\u001b\\|\u009c)/g -const STRING_SEQUENCE_PATTERN = - /(?:\u001b[P_^X]|\u0090|\u0098|\u009e|\u009f)[\s\S]*?(?:\u001b\\|\u009c)/g -const CSI_SEQUENCE_PATTERN = /(?:\u001b\[|\u009b)[0-?]*[ -/]*[@-~]/g -const ESCAPE_SEQUENCE_PATTERN = /\u001b[ -/]*[0-~]/g -const CONTROL_PATTERN = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g - export type AutomationRunOutputSnapshotBuffer = { append: (chunk: string) => void snapshot: () => AutomationRunOutputSnapshot | null @@ -43,14 +37,10 @@ export function selectAutomationRunOutputSnapshot( } function stripTerminalControls(value: string): string { - return value - .replace(OSC_SEQUENCE_PATTERN, '') - .replace(STRING_SEQUENCE_PATTERN, '') - .replace(CSI_SEQUENCE_PATTERN, '') - .replace(ESCAPE_SEQUENCE_PATTERN, '') + return stripAnsiEscapeSequences(value) .replace(/\r\n/g, '\n') .replace(/\r/g, '\n') - .replace(CONTROL_PATTERN, '') + .replace(TERMINAL_CONTROL_CHARACTER_PATTERN, '') } export function createAutomationRunOutputSnapshotBuffer(): AutomationRunOutputSnapshotBuffer { diff --git a/src/renderer/src/components/editor/check-run-details-tab.test.ts b/src/renderer/src/components/editor/check-run-details-tab.test.ts index c6beb882802..5646f523263 100644 --- a/src/renderer/src/components/editor/check-run-details-tab.test.ts +++ b/src/renderer/src/components/editor/check-run-details-tab.test.ts @@ -38,6 +38,18 @@ describe('check-run-details-tab', () => { ).toBe('url:https://github.com/acme/widgets/actions/runs/1') }) + it('keys GitLab jobs by job id so same-named stages do not share one tab', () => { + const base = { status: 'completed', conclusion: 'failure', url: null } as const + + expect(getCheckRunTabIdentity({ ...base, name: 'test: unit', gitlabJobId: 42 })).toBe( + 'gitlab-job:42' + ) + // Why: GitLab reuses `stage: name` across pipeline runs, so the name alone collides. + expect( + buildCheckRunDetailsTabId('wt-1', { ...base, name: 'test: unit', gitlabJobId: 42 }) + ).not.toBe(buildCheckRunDetailsTabId('wt-1', { ...base, name: 'test: unit', gitlabJobId: 43 })) + }) + it('uses the check name for the tab label', () => { expect( getCheckRunDetailsTabLabel({ diff --git a/src/renderer/src/components/editor/check-run-details-tab.ts b/src/renderer/src/components/editor/check-run-details-tab.ts index 0acd550f7b2..bbc8fc1180b 100644 --- a/src/renderer/src/components/editor/check-run-details-tab.ts +++ b/src/renderer/src/components/editor/check-run-details-tab.ts @@ -1,3 +1,4 @@ +import type { GitLabProjectRef } from '../../../../shared/gitlab-types' import type { PRCheckDetail, PRCheckRunDetails } from '../../../../shared/types' export type OpenCheckRunDetailsState = { @@ -6,6 +7,20 @@ export type OpenCheckRunDetailsState = { details: PRCheckRunDetails | null loading: boolean error: string | null + /** Why: fork/cross-project MR jobs live outside the repo's own project, so reloads need the pipeline's project. */ + gitlabProjectRef?: GitLabProjectRef | null +} + +export type CheckRunDetailsTabPatch = Pick< + OpenCheckRunDetailsState, + 'details' | 'loading' | 'error' | 'gitlabProjectRef' +> + +export function isSameGitLabProjectRef( + a: GitLabProjectRef | null, + b: GitLabProjectRef | null +): boolean { + return a === b || (a?.host === b?.host && a?.path === b?.path) } export function getCheckRunTabIdentity(check: PRCheckDetail): string { @@ -15,6 +30,11 @@ export function getCheckRunTabIdentity(check: PRCheckDetail): string { if (check.workflowRunId) { return `workflow-run:${check.workflowRunId}` } + // Why: GitLab jobs reuse `stage: name` across pipeline runs and can lack a web_url, + // so the numeric job id is the only stable per-job tab identity. + if (check.gitlabJobId) { + return `gitlab-job:${check.gitlabJobId}` + } if (check.url) { return `url:${check.url}` } diff --git a/src/renderer/src/components/pr-checks-fix-prompt.test.ts b/src/renderer/src/components/pr-checks-fix-prompt.test.ts index 2884138c0ef..b3f2eadf600 100644 --- a/src/renderer/src/components/pr-checks-fix-prompt.test.ts +++ b/src/renderer/src/components/pr-checks-fix-prompt.test.ts @@ -34,6 +34,27 @@ afterEach(() => { vi.restoreAllMocks() }) +describe('getCheckDetailsPromptKey', () => { + // Regression for #7732: a GitLab job with no web_url would otherwise key on its + // list index, so its freshly loaded log would never reach the fix prompt. + it('keys GitLab jobs by job id ahead of the index fallback', () => { + const manualJob: PRCheckDetail = { + name: 'deploy: production', + status: 'completed', + conclusion: 'failure', + url: null, + gitlabJobId: 987654 + } + + expect(getCheckDetailsPromptKey(manualJob, 0)).toBe('gitlab-job:987654:deploy: production') + expect(getCheckDetailsPromptKey(manualJob, 3)).toBe(getCheckDetailsPromptKey(manualJob, 0)) + }) + + it('leaves GitHub check identities untouched', () => { + expect(getCheckDetailsPromptKey(failingCheck, 0)).toBe('check-run:11') + }) +}) + describe('buildFixBrokenChecksPrompt', () => { it('keeps names-only broken check data when no details are provided', () => { const prompt = buildPrompt({}) diff --git a/src/renderer/src/components/right-sidebar/ChecksPanel.tsx b/src/renderer/src/components/right-sidebar/ChecksPanel.tsx index 0dc26aa38c2..2a1412cde94 100644 --- a/src/renderer/src/components/right-sidebar/ChecksPanel.tsx +++ b/src/renderer/src/components/right-sidebar/ChecksPanel.tsx @@ -58,6 +58,7 @@ import { import { ENTRY_REFRESH_GRACE_MS, shouldEntryRefresh } from './checks-entry-refresh' import type { GitLabDiscussionResolveResult, + GitLabProjectRef, GitLabWorkItemDetails, PRInfo, PRCheckDetail, @@ -159,6 +160,7 @@ import { import { installWindowVisibilityInterval } from '@/lib/window-visibility-interval' import { useMountedRef } from '@/hooks/useMountedRef' import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client' +import { loadGitLabJobLogDetails } from '@/runtime/gitlab-job-trace-client' import { gitLabPipelineJobsToPRChecks } from '../../../../shared/gitlab-pipeline-checks' import { getWorktreeGitIdentityDisplay } from '@/lib/worktree-git-identity-display' import { SourceControlAgentActionDialog } from './SourceControlAgentActionDialog' @@ -370,6 +372,10 @@ function isGitLabChecksPanelReview( return review?.provider === 'gitlab' } +function hasGitHubCheckHandle(check: PRCheckDetail): boolean { + return Boolean(check.checkRunId || check.workflowRunId || check.url) +} + function gitLabMRCommentsToPRComments( comments: GitLabWorkItemDetails['comments'] | undefined ): PRComment[] { @@ -564,6 +570,9 @@ export default function ChecksPanel(): React.JSX.Element { const mountedRef = useMountedRef() const confirm = useConfirmationDialog() const prevChecksRef = useRef('') + // Why: a fork MR's pipeline lives in the source project, so job traces must be + // fetched against the MR's own project rather than this repo's default remote. + const gitLabProjectRefRef = useRef(null) const conflictSummaryRefreshKeyRef = useRef(null) const panelVisibleSinceRef = useRef(null) const foregroundedUnrenderedReviewKeyRef = useRef(null) @@ -1925,6 +1934,7 @@ export default function ChecksPanel(): React.JSX.Element { if (!isCurrentAsyncResult(requestKey)) { return } + gitLabProjectRefRef.current = details?.item.projectRef ?? null const result = gitLabPipelineJobsToPRChecks(details?.pipelineJobs ?? []) setChecks(result) setComments(gitLabMRCommentsToPRComments(details?.comments)) @@ -2063,6 +2073,17 @@ export default function ChecksPanel(): React.JSX.Element { if (!repo) { return Promise.resolve(null) } + if (check.gitlabJobId) { + // Why: `settings` (not ownerSettings) is what fetched the job list, so the + // job id and its trace always resolve against the same host. + return loadGitLabJobLogDetails({ + repoPath: repo.path, + repoId: repo.id, + settings, + check, + projectRef: gitLabProjectRefRef.current + }) + } return fetchPRCheckDetails( repo.path, { @@ -2075,9 +2096,12 @@ export default function ChecksPanel(): React.JSX.Element { { repoId: repo.id } ) }, - [fetchPRCheckDetails, pr?.prRepo, repo] + [fetchPRCheckDetails, pr?.prRepo, repo, settings] ) + // Why: read at call time — the ref is filled by an async MR fetch, so a value prop would be stale. + const getGitLabProjectRef = useCallback(() => gitLabProjectRefRef.current, []) + useEffect(() => { if (activeGitLabReview) { return @@ -3417,33 +3441,45 @@ export default function ChecksPanel(): React.JSX.Element { setIsFixingChecksWithAI(true) try { const checkRunDetailsByCheckKey: Record = {} - if (activeReview.provider !== 'gitlab' && repo) { - await Promise.all( - broken.slice(0, 5).map(async (check, index) => { - if (!check.checkRunId && !check.workflowRunId && !check.url) { - return + await Promise.all( + broken.slice(0, 5).map(async (check, index) => { + const isGitLabJob = Boolean(check.gitlabJobId) + if ( + !isGitLabJob && + (activeReview.provider === 'gitlab' || !hasGitHubCheckHandle(check)) + ) { + return + } + try { + // Why: GitLab job logs are now loadable, so the fix prompt gets the same + // failure context the sidebar shows instead of check names alone. + const details = isGitLabJob + ? await loadGitLabJobLogDetails({ + repoPath: repo.path, + repoId: repo.id, + settings, + check, + projectRef: gitLabProjectRefRef.current + }) + : await fetchPRCheckDetails( + repo.path, + { + checkRunId: check.checkRunId, + workflowRunId: check.workflowRunId, + checkName: check.name, + url: check.url, + prRepo: pr?.prRepo ?? null + }, + { repoId: repo.id } + ) + if (details) { + checkRunDetailsByCheckKey[getCheckDetailsPromptKey(check, index)] = details } - try { - const details = await fetchPRCheckDetails( - repo.path, - { - checkRunId: check.checkRunId, - workflowRunId: check.workflowRunId, - checkName: check.name, - url: check.url, - prRepo: pr?.prRepo ?? null - }, - { repoId: repo.id } - ) - if (details) { - checkRunDetailsByCheckKey[getCheckDetailsPromptKey(check, index)] = details - } - } catch (error) { - console.warn('[ChecksPanel] failed to load check details for AI fix prompt', error) - } - }) - ) - } + } catch (error) { + console.warn('[ChecksPanel] failed to load check details for AI fix prompt', error) + } + }) + ) if (!isCurrentAsyncResult(requestKey)) { return } @@ -3482,6 +3518,7 @@ export default function ChecksPanel(): React.JSX.Element { isFixingChecksWithAI, pr?.prRepo, repo, + settings, sourceControlAiActionsVisible, stateRequestKey ]) @@ -4445,6 +4482,7 @@ export default function ChecksPanel(): React.JSX.Element { checksLoading={checksLoading} checkDetailsContextKey={stateRequestKey} onLoadCheckDetails={handleLoadCheckDetails} + getGitLabProjectRef={getGitLabProjectRef} /> )} Promise }> = {} ): void { @@ -91,7 +92,7 @@ function renderChecksList( root.render( { expect(container.textContent).toContain('manual action on GitHub') expect(container.textContent).not.toContain('No inline details are available') }) + + it('renders the log excerpt inline instead of deferring it to the full-details tab', async () => { + renderChecksList({ worktreeId: 'wt-child-1' }) + + await act(async () => { + await Promise.resolve() + }) + + expect(container.textContent).toContain('Error: assertion failed') + expect(container.textContent).not.toContain('Log tail available in full details') + }) + + // Regression for #7732: manual/created GitLab jobs carry no web_url and no GitHub + // handles, so the panel used to short-circuit before ever asking for their log. + it('loads details for a GitLab job that only carries a job id', async () => { + const gitLabCheck: PRCheckDetail = { + name: 'deploy: production', + status: 'completed', + conclusion: 'failure', + url: null, + gitlabJobId: 987654 + } + const onLoadCheckDetails = vi.fn(async () => ({ + ...checkDetails, + name: gitLabCheck.name, + jobs: [{ ...checkDetails.jobs[0]!, id: 987654, logTail: 'ERROR: Job failed: exit code 1' }] + })) + + renderChecksList({ worktreeId: 'wt-child-1', checks: [gitLabCheck], onLoadCheckDetails }) + + await act(async () => { + await Promise.resolve() + }) + + expect(onLoadCheckDetails).toHaveBeenCalledWith(gitLabCheck) + expect(container.textContent).toContain('ERROR: Job failed: exit code 1') + expect(container.textContent).not.toContain('No inline details are available') + expect(container.querySelector('.sticky.top-0')?.textContent).toContain('View full logs') + }) + + // GitLab trace fetches fail for reasons GitHub's never do (auth, 404, self-hosted + // host resolution) and the panel has no retry button, so a transient failure must + // not pin its error on the row for the rest of the session. + it('retries a failed detail load once the check state moves on', async () => { + const runningCheck: PRCheckDetail = { + name: 'test: unit', + status: 'in_progress', + conclusion: 'failure', + url: null, + gitlabJobId: 5150 + } + const onLoadCheckDetails = vi + .fn<(check: PRCheckDetail) => Promise>() + .mockRejectedValueOnce(new Error('401 Unauthorized')) + .mockResolvedValueOnce({ + ...checkDetails, + name: runningCheck.name, + status: 'completed', + conclusion: 'failure', + jobs: [{ ...checkDetails.jobs[0]!, id: 5150, logTail: 'ERROR: Job failed: exit code 1' }] + }) + + renderChecksList({ worktreeId: 'wt-child-1', checks: [runningCheck], onLoadCheckDetails }) + await act(async () => { + await Promise.resolve() + }) + + expect(container.textContent).toContain('401 Unauthorized') + expect(onLoadCheckDetails).toHaveBeenCalledTimes(1) + + const finishedCheck: PRCheckDetail = { ...runningCheck, status: 'completed' } + renderChecksList({ worktreeId: 'wt-child-1', checks: [finishedCheck], onLoadCheckDetails }) + await act(async () => { + await Promise.resolve() + }) + + expect(onLoadCheckDetails).toHaveBeenCalledTimes(2) + expect(container.textContent).not.toContain('401 Unauthorized') + expect(container.textContent).toContain('ERROR: Job failed: exit code 1') + }) + + // A running GitLab job has no trace yet, so the first load legitimately resolves to + // null — without re-arming, the row stays "no inline details" after the job finishes. + it('retries a detail load that resolved to null once the check state moves on', async () => { + const runningCheck: PRCheckDetail = { + name: 'test: unit', + status: 'in_progress', + conclusion: 'failure', + url: null, + gitlabJobId: 5150 + } + const onLoadCheckDetails = vi + .fn<(check: PRCheckDetail) => Promise>() + .mockResolvedValueOnce(null) + .mockResolvedValueOnce({ + ...checkDetails, + name: runningCheck.name, + jobs: [{ ...checkDetails.jobs[0]!, id: 5150, logTail: 'ERROR: Job failed: exit code 1' }] + }) + + renderChecksList({ worktreeId: 'wt-child-1', checks: [runningCheck], onLoadCheckDetails }) + await act(async () => { + await Promise.resolve() + }) + + expect(onLoadCheckDetails).toHaveBeenCalledTimes(1) + expect(container.textContent).toContain('No inline details are available') + + const finishedCheck: PRCheckDetail = { ...runningCheck, status: 'completed' } + renderChecksList({ worktreeId: 'wt-child-1', checks: [finishedCheck], onLoadCheckDetails }) + await act(async () => { + await Promise.resolve() + }) + + expect(onLoadCheckDetails).toHaveBeenCalledTimes(2) + expect(container.textContent).not.toContain('No inline details are available') + expect(container.textContent).toContain('ERROR: Job failed: exit code 1') + }) + + it('keeps a failed detail load pinned while the check state is unchanged', async () => { + const onLoadCheckDetails = vi + .fn<(check: PRCheckDetail) => Promise>() + .mockRejectedValue(new Error('401 Unauthorized')) + const gitLabCheck: PRCheckDetail = { + name: 'test: unit', + status: 'completed', + conclusion: 'failure', + url: null, + gitlabJobId: 5150 + } + + renderChecksList({ worktreeId: 'wt-child-1', checks: [gitLabCheck], onLoadCheckDetails }) + await act(async () => { + await Promise.resolve() + }) + // Re-render with an equal-but-new row array, as every 30s poll tick does. + renderChecksList({ worktreeId: 'wt-child-1', checks: [{ ...gitLabCheck }], onLoadCheckDetails }) + await act(async () => { + await Promise.resolve() + }) + + // Why: re-arming on row identity alone would refetch on every poll tick. + expect(onLoadCheckDetails).toHaveBeenCalledTimes(1) + expect(container.textContent).toContain('401 Unauthorized') + }) }) diff --git a/src/renderer/src/components/right-sidebar/checks-panel-content.tsx b/src/renderer/src/components/right-sidebar/checks-panel-content.tsx index b6353e9380a..2b51b03f7b2 100644 --- a/src/renderer/src/components/right-sidebar/checks-panel-content.tsx +++ b/src/renderer/src/components/right-sidebar/checks-panel-content.tsx @@ -55,6 +55,7 @@ import { } from '@/components/ui/context-menu' import { cn } from '@/lib/utils' import CommentMarkdown from '@/components/sidebar/CommentMarkdown' +import { CheckJobLogTail } from './check-job-log-tail' import { filterPRCommentsByAudience, getPRCommentAudienceCounts, @@ -79,6 +80,7 @@ import { getPRCommentGroupSurfaceClasses, type PRCommentPresentationClasses } from './pr-comment-presentation' +import type { GitLabProjectRef } from '../../../../shared/gitlab-types' import type { PRInfo, PRCheckDetail, @@ -541,6 +543,8 @@ type CheckDetailsLoadState = { loading: boolean details: PRCheckRunDetails | null error: string | null + /** Check state when the load failed or returned nothing, so a later state change can retry it. */ + errorAt?: { status: PRCheckDetail['status']; conclusion: PRCheckDetail['conclusion'] } } function getCheckIdentityKey(check: PRCheckDetail, index: number): string { @@ -550,6 +554,11 @@ function getCheckIdentityKey(check: PRCheckDetail, index: number): string { if (check.workflowRunId) { return `workflow-run:${check.workflowRunId}` } + // Why: manual/created GitLab jobs have no web_url, so they would otherwise key on + // the list index and lose their cached log whenever the pipeline re-sorts. + if (check.gitlabJobId) { + return `gitlab-job:${check.gitlabJobId}` + } if (check.url) { return `url:${check.url}` } @@ -661,13 +670,16 @@ function CheckRunDetails({ state, checkDetailsContextKey, worktreeId, - detailsStickySurface = 'sidebar' + detailsStickySurface = 'sidebar', + getGitLabProjectRef }: { check: PRCheckDetail state: CheckDetailsLoadState | undefined checkDetailsContextKey: string worktreeId: string | null detailsStickySurface?: CheckDetailsStickySurface + /** Why: a getter, not a value — the source ref is filled by an async fetch and would read stale during render. */ + getGitLabProjectRef?: () => GitLabProjectRef | null }): React.JSX.Element { const openCheckRunDetails = useAppStore((s) => s.openCheckRunDetails) const details = state?.details @@ -706,7 +718,8 @@ function CheckRunDetails({ openCheckRunDetails(worktreeId, checkDetailsContextKey, check, { details: state?.details ?? null, loading: state?.loading ?? false, - error: state?.error ?? null + error: state?.error ?? null, + gitlabProjectRef: getGitLabProjectRef?.() ?? null }) } @@ -914,6 +927,7 @@ function CheckRunDetails({ ))}
)} + {job.logTail && } ))} @@ -928,15 +942,6 @@ function CheckRunDetails({ )} - {hasLogTail && ( -
- {translate( - 'auto.components.right.sidebar.checks.panel.content.2524d1fb83', - 'Log tail available in full details.' - )} -
- )} - {!state?.error && !hasOutput && !hasAnnotations && !hasJobs && (
{getCheckConclusion(detailsStatusCheck) === 'action_required' @@ -965,7 +970,8 @@ export function ChecksList({ checkDetailsContextKey, onLoadCheckDetails, worktreeId: worktreeIdOverride, - detailsStickySurface = 'sidebar' + detailsStickySurface = 'sidebar', + getGitLabProjectRef }: { checks: PRCheckDetail[] checksLoading: boolean @@ -974,6 +980,8 @@ export function ChecksList({ /** Why: folder-workspace PR checks render rows for attached worktrees, not the active one. */ worktreeId?: string detailsStickySurface?: CheckDetailsStickySurface + /** Why: a getter, not a value — the source ref is filled by an async fetch and would read stale during render. */ + getGitLabProjectRef?: () => GitLabProjectRef | null }): React.JSX.Element { const activeWorktree = useActiveWorktree() const resolvedWorktreeId = worktreeIdOverride ?? activeWorktree?.id ?? null @@ -1041,13 +1049,20 @@ export function ChecksList({ const next: Record = { ...current } for (const row of rows) { const cached = next[row.key] - if (!cached?.details) { + if (!cached || cached.loading) { continue } - if ( - cached.details.status !== row.check.status || - cached.details.conclusion !== row.check.conclusion - ) { + // Why: a failed load (GitLab auth blip, 404, offline) otherwise pins its error + // forever — there is no retry affordance — so re-arm it once the job moves on. + const stale = cached.details + ? cached.details.status !== row.check.status || + cached.details.conclusion !== row.check.conclusion + : Boolean( + cached.errorAt && + (cached.errorAt.status !== row.check.status || + cached.errorAt.conclusion !== row.check.conclusion) + ) + if (stale) { delete next[row.key] changed = true } @@ -1061,7 +1076,12 @@ export function ChecksList({ if (detailsByCheckKey[row.key]?.loading || detailsByCheckKey[row.key]?.details) { return } - if (!row.check.checkRunId && !row.check.workflowRunId && !row.check.url) { + if ( + !row.check.checkRunId && + !row.check.workflowRunId && + !row.check.url && + !row.check.gitlabJobId + ) { setDetailsByCheckKey((current) => ({ ...current, [row.key]: { @@ -1104,7 +1124,16 @@ export function ChecksList({ [row.key]: { loading: false, details, - error: details ? null : 'No inline details are available for this check.' + error: details + ? null + : translate( + 'auto.components.right.sidebar.checks.panel.content.e15a8b77ef', + 'No inline details are available for this check.' + ), + // Why: a detail-less result is only final for this status — re-arm the retry once the job moves on. + errorAt: details + ? undefined + : { status: row.check.status, conclusion: row.check.conclusion } } })) }) @@ -1117,7 +1146,14 @@ export function ChecksList({ [row.key]: { loading: false, details: null, - error: err instanceof Error ? err.message : 'Failed to load check details.' + error: + err instanceof Error + ? err.message + : translate( + 'auto.components.right.sidebar.checks.panel.content.checkDetailsLoadFailed', + 'Failed to load check details.' + ), + errorAt: { status: row.check.status, conclusion: row.check.conclusion } } })) }) @@ -1148,12 +1184,14 @@ export function ChecksList({ patchOpenCheckRunDetails(resolvedWorktreeId, checkDetailsContextKey, row.check, { details: detailsState.details ?? null, loading: detailsState.loading ?? false, - error: detailsState.error ?? null + error: detailsState.error ?? null, + gitlabProjectRef: getGitLabProjectRef?.() ?? null }) } }, [ checkDetailsContextKey, detailsByCheckKey, + getGitLabProjectRef, patchOpenCheckRunDetails, resolvedWorktreeId, rows @@ -1329,6 +1367,7 @@ export function ChecksList({ checkDetailsContextKey={checkDetailsContextKey} worktreeId={resolvedWorktreeId} detailsStickySurface={detailsStickySurface} + getGitLabProjectRef={getGitLabProjectRef} /> )}
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json index b8580ef27f2..d0511b2ca4e 100644 --- a/src/renderer/src/i18n/locales/en.json +++ b/src/renderer/src/i18n/locales/en.json @@ -10804,7 +10804,6 @@ "a54ae21c6f": "Status:", "e4e3af15ee": "View full details", "b8c4e2a1f7": "View full logs", - "2524d1fb83": "Log tail available in full details.", "a2fb3f4408": "Showing first 100 jobs", "df137989b3": "Showing first 20 annotations", "1f2b980522": "Loading check details…", @@ -10856,7 +10855,8 @@ "5e6e5a13fa": "View", "actionRequiredHint": "This check needs a manual action on GitHub (for example, approving the workflow run) before merging is unblocked.", "b3195cba33": "Unmark author as bot", - "f588b46a6c": "Mark author as bot" + "f588b46a6c": "Mark author as bot", + "checkDetailsLoadFailed": "Failed to load check details." }, "empty": { "state": { @@ -14559,6 +14559,11 @@ }, "webRuntimeSession": { "remoteHostDisconnected": "The workspace is not connected to a remote Orca host." + }, + "gitlabJobTraceClient": { + "loadFailed": "Failed to load the GitLab job log.", + "emptyTrace": "No log is available for this GitLab job.", + "timedOut": "Timed out loading the GitLab job log." } } }, diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json index b9d562579e3..9797580ad75 100644 --- a/src/renderer/src/i18n/locales/es.json +++ b/src/renderer/src/i18n/locales/es.json @@ -10636,7 +10636,6 @@ "fd46a70f1a": "Iniciado", "a54ae21c6f": "Estado:", "e4e3af15ee": "Ver detalles completos", - "2524d1fb83": "Cola del log disponible en los detalles completos.", "a2fb3f4408": "Mostrando los primeros 100 jobs", "df137989b3": "Mostrando las primeras 20 anotaciones", "1f2b980522": "Cargando detalles del check…", @@ -10689,7 +10688,8 @@ "5e6e5a13fa": "Vista", "actionRequiredHint": "Este check requiere una acción manual en GitHub (por ejemplo, aprobar la ejecución del workflow) antes de que el merge quede desbloqueado.", "b3195cba33": "Desmarcar autor como bot", - "f588b46a6c": "Marcar autor como bot" + "f588b46a6c": "Marcar autor como bot", + "checkDetailsLoadFailed": "No se pudieron cargar los detalles del check." }, "empty": { "state": { @@ -14348,6 +14348,11 @@ }, "webRuntimeSession": { "remoteHostDisconnected": "The workspace is not connected to a remote Orca host." + }, + "gitlabJobTraceClient": { + "loadFailed": "No se pudo cargar el registro del job de GitLab.", + "emptyTrace": "No hay ningún registro disponible para este job de GitLab.", + "timedOut": "Se agotó el tiempo de espera al cargar el registro del job de GitLab." } } }, diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json index f45c99439bd..eab737f2541 100644 --- a/src/renderer/src/i18n/locales/ja.json +++ b/src/renderer/src/i18n/locales/ja.json @@ -10636,7 +10636,6 @@ "fd46a70f1a": "開始しました", "a54ae21c6f": "状態：", "e4e3af15ee": "詳細を表示", - "2524d1fb83": "ログテールで詳細を確認できます。", "a2fb3f4408": "最初の 100 件のジョブを表示しています", "df137989b3": "最初の 20 個の注釈を表示", "1f2b980522": "チェックの詳細を読み込んでいます…", @@ -10689,7 +10688,8 @@ "5e6e5a13fa": "表示", "actionRequiredHint": "マージが解除される前に、GitHubで手動アクションが必要です（例：ワークフロー実行の承認）。", "b3195cba33": "作成者のボット指定を解除", - "f588b46a6c": "作成者をボットとして指定" + "f588b46a6c": "作成者をボットとして指定", + "checkDetailsLoadFailed": "チェック詳細の読み込みに失敗しました。" }, "empty": { "state": { @@ -14348,6 +14348,11 @@ }, "webRuntimeSession": { "remoteHostDisconnected": "The workspace is not connected to a remote Orca host." + }, + "gitlabJobTraceClient": { + "loadFailed": "GitLab ジョブのログを読み込めませんでした。", + "emptyTrace": "この GitLab ジョブのログはありません。", + "timedOut": "GitLab ジョブのログの読み込みがタイムアウトしました。" } } }, diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json index 1241301c0a8..6e49c537664 100644 --- a/src/renderer/src/i18n/locales/ko.json +++ b/src/renderer/src/i18n/locales/ko.json @@ -10636,7 +10636,6 @@ "fd46a70f1a": "시작됨", "a54ae21c6f": "상태:", "e4e3af15ee": "전체 세부정보 보기", - "2524d1fb83": "자세한 내용을 로그 테일에서 확인할 수 있습니다.", "a2fb3f4408": "처음 100개 작업 표시", "df137989b3": "처음 20개의 주석 표시 중", "1f2b980522": "검사 세부 정보 로드 중…", @@ -10689,7 +10688,8 @@ "5e6e5a13fa": "보기", "actionRequiredHint": "이 검사는 병합 차단이 해제되기 전에 GitHub에서 수동 작업(예: 워크플로 실행 승인)이 필요합니다.", "b3195cba33": "작성자의 봇 지정 해제", - "f588b46a6c": "작성자를 봇으로 지정" + "f588b46a6c": "작성자를 봇으로 지정", + "checkDetailsLoadFailed": "체크 세부 정보를 불러오지 못했습니다." }, "empty": { "state": { @@ -14348,6 +14348,11 @@ }, "webRuntimeSession": { "remoteHostDisconnected": "The workspace is not connected to a remote Orca host." + }, + "gitlabJobTraceClient": { + "loadFailed": "GitLab 작업 로그를 불러오지 못했습니다.", + "emptyTrace": "이 GitLab 작업의 로그를 사용할 수 없습니다.", + "timedOut": "GitLab 작업 로그를 불러오는 중 시간이 초과되었습니다." } } }, diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json index 04117976acc..10f601cfed2 100644 --- a/src/renderer/src/i18n/locales/zh.json +++ b/src/renderer/src/i18n/locales/zh.json @@ -10648,7 +10648,6 @@ "fd46a70f1a": "开始", "a54ae21c6f": "状态：", "e4e3af15ee": "查看完整详细信息", - "2524d1fb83": "日志尾部提供完整详细信息。", "a2fb3f4408": "显示前 100 个作业", "df137989b3": "显示前 20 个注释", "1f2b980522": "正在加载检查详细信息...", @@ -10701,7 +10700,8 @@ "5e6e5a13fa": "查看", "actionRequiredHint": "此检查需要在 GitHub 上执行手动操作（例如批准工作流运行）后才能解除合并阻止。", "b3195cba33": "取消将作者标记为机器人", - "f588b46a6c": "将作者标记为机器人" + "f588b46a6c": "将作者标记为机器人", + "checkDetailsLoadFailed": "加载检查详细信息失败。" }, "empty": { "state": { @@ -14360,6 +14360,11 @@ }, "webRuntimeSession": { "remoteHostDisconnected": "The workspace is not connected to a remote Orca host." + }, + "gitlabJobTraceClient": { + "loadFailed": "加载 GitLab 作业日志失败。", + "emptyTrace": "此 GitLab 作业没有可用的日志。", + "timedOut": "加载 GitLab 作业日志超时。" } } }, diff --git a/src/renderer/src/runtime/gitlab-job-trace-client.test.ts b/src/renderer/src/runtime/gitlab-job-trace-client.test.ts new file mode 100644 index 00000000000..10ecd88884c --- /dev/null +++ b/src/renderer/src/runtime/gitlab-job-trace-client.test.ts @@ -0,0 +1,184 @@ +import { beforeEach, describe, expect, it, vi } from 'vitest' +import type { PRCheckDetail } from '../../../shared/types' +import { loadGitLabJobLogDetails } from './gitlab-job-trace-client' + +const callRuntimeRpc = vi.hoisted(() => vi.fn()) +vi.mock('./runtime-rpc-client', () => ({ callRuntimeRpc })) + +const jobTrace = vi.fn() + +const gitLabCheck: PRCheckDetail = { + name: 'Component Tests: Purchase API', + status: 'completed', + conclusion: 'failure', + url: null, + gitlabJobId: 42 +} + +beforeEach(() => { + callRuntimeRpc.mockReset() + jobTrace.mockReset() + ;(globalThis as { window?: unknown }).window = { api: { gl: { jobTrace } } } +}) + +describe('loadGitLabJobLogDetails', () => { + it('returns null for a check that is not a GitLab job, touching no transport', async () => { + const githubCheck: PRCheckDetail = { + name: 'verify', + status: 'completed', + conclusion: 'failure', + url: 'https://github.com/acme/orca/runs/1', + checkRunId: 7 + } + + await expect( + loadGitLabJobLogDetails({ repoPath: '/repo', settings: null, check: githubCheck }) + ).resolves.toBeNull() + expect(jobTrace).not.toHaveBeenCalled() + expect(callRuntimeRpc).not.toHaveBeenCalled() + }) + + it('asks main for a bounded excerpt over local IPC', async () => { + jobTrace.mockResolvedValue({ ok: true, trace: 'ERROR: Job failed: exit code 1' }) + + const details = await loadGitLabJobLogDetails({ + repoPath: '/repo', + repoId: 'repo-1', + settings: { activeRuntimeEnvironmentId: null }, + check: gitLabCheck + }) + + expect(jobTrace).toHaveBeenCalledWith({ + repoPath: '/repo', + repoId: 'repo-1', + jobId: 42, + projectRef: null, + logExcerpt: true + }) + expect(details?.jobs[0]?.logTail).toContain('ERROR: Job failed: exit code 1') + }) + + it('targets the MR project so a fork pipeline trace is not looked up in the wrong project', async () => { + jobTrace.mockResolvedValue({ ok: true, trace: 'boom' }) + + await loadGitLabJobLogDetails({ + repoPath: '/repo', + repoId: 'repo-1', + settings: { activeRuntimeEnvironmentId: null }, + check: gitLabCheck, + projectRef: { host: 'gitlab.example.test', path: 'contributor/orca' } + }) + + expect(jobTrace).toHaveBeenCalledWith( + expect.objectContaining({ + projectRef: { host: 'gitlab.example.test', path: 'contributor/orca' } + }) + ) + }) + + it('does not request a trace for a manual job that cannot have one', async () => { + const manualCheck: PRCheckDetail = { + name: 'deploy: production', + status: 'completed', + conclusion: 'neutral', + url: null, + gitlabJobId: 77 + } + + const details = await loadGitLabJobLogDetails({ + repoPath: '/repo', + settings: { activeRuntimeEnvironmentId: null }, + check: manualCheck + }) + + // Why: GitLab 404s on a job with no trace, so skip the round trip entirely. + expect(jobTrace).not.toHaveBeenCalled() + expect(callRuntimeRpc).not.toHaveBeenCalled() + expect(details?.jobs).toEqual([]) + expect(details?.summary).toBe('No log is available for this GitLab job.') + }) + + // #7732 round 1: a job canceled before it started is `completed`/`cancelled`, so it is + // fetched; main answers with an empty trace and the row must show that, not an error. + it('explains an empty trace for a job canceled before it produced output', async () => { + jobTrace.mockResolvedValue({ ok: true, trace: '' }) + const canceledCheck: PRCheckDetail = { + name: 'unit', + status: 'completed', + conclusion: 'cancelled', + url: null, + gitlabJobId: 5 + } + + const details = await loadGitLabJobLogDetails({ + repoPath: '/repo', + settings: { activeRuntimeEnvironmentId: null }, + check: canceledCheck + }) + + expect(details?.jobs).toEqual([]) + expect(details?.summary).toBe('No log is available for this GitLab job.') + }) + + it('routes to the owning runtime environment and still requests the excerpt', async () => { + callRuntimeRpc.mockResolvedValue({ ok: true, trace: 'remote failure' }) + + await loadGitLabJobLogDetails({ + repoPath: '/repo', + repoId: 'repo-1', + settings: { activeRuntimeEnvironmentId: 'env-9' }, + check: gitLabCheck + }) + + expect(jobTrace).not.toHaveBeenCalled() + expect(callRuntimeRpc).toHaveBeenCalledWith( + { kind: 'environment', environmentId: 'env-9' }, + 'gitlab.jobTrace', + // Why: bounding in main keeps the response under the 1 MB transport frame cap. + { repo: 'repo-1', jobId: 42, projectRef: undefined, logExcerpt: true }, + { timeoutMs: 30_000 } + ) + }) + + it('surfaces the GitLab error verbatim so the panel does not claim "no details"', async () => { + jobTrace.mockResolvedValue({ ok: false, error: '403 Forbidden' }) + + await expect( + loadGitLabJobLogDetails({ + repoPath: '/repo', + settings: { activeRuntimeEnvironmentId: null }, + check: gitLabCheck + }) + ).rejects.toThrow('403 Forbidden') + }) + + it('gives up on a local IPC call that never settles, matching the remote timeout', async () => { + vi.useFakeTimers() + try { + jobTrace.mockReturnValue(new Promise(() => {})) + + const pending = loadGitLabJobLogDetails({ + repoPath: '/repo', + settings: { activeRuntimeEnvironmentId: null }, + check: gitLabCheck + }) + const assertion = expect(pending).rejects.toThrow('Timed out loading the GitLab job log.') + await vi.advanceTimersByTimeAsync(30_000) + await assertion + } finally { + vi.useRealTimers() + } + }) + + it('falls back to a translated message when GitLab reports a blank error', async () => { + jobTrace.mockResolvedValue({ ok: false, error: ' ' }) + + await expect( + loadGitLabJobLogDetails({ + repoPath: '/repo', + settings: { activeRuntimeEnvironmentId: null }, + check: gitLabCheck + }) + ).rejects.toThrow('Failed to load the GitLab job log.') + }) +}) diff --git a/src/renderer/src/runtime/gitlab-job-trace-client.ts b/src/renderer/src/runtime/gitlab-job-trace-client.ts new file mode 100644 index 00000000000..929c8581c1f --- /dev/null +++ b/src/renderer/src/runtime/gitlab-job-trace-client.ts @@ -0,0 +1,105 @@ +import { translate } from '@/i18n/i18n' +import { + gitLabJobCanHaveTrace, + gitLabJobTraceToCheckRunDetails +} from '../../../shared/gitlab-job-trace-check-details' +import type { GitLabJobTraceResult, GitLabProjectRef } from '../../../shared/gitlab-types' +import type { PRCheckDetail, PRCheckRunDetails } from '../../../shared/types' +import { getActiveRuntimeTarget } from './runtime-client-target' +import { callRuntimeRpc } from './runtime-rpc-client' + +const JOB_TRACE_TIMEOUT_MS = 30_000 + +/** + * Load a GitLab pipeline job log as provider-neutral check details. + * + * Returns null for checks that are not GitLab jobs so callers can fall through to + * their existing provider path. Throws on a GitLab-reported failure so the caller's + * error handling surfaces the message instead of showing "no details available". + */ +export async function loadGitLabJobLogDetails(args: { + repoPath: string + repoId?: string + settings: Parameters[0] + check: PRCheckDetail + /** Fork/cross-project MRs run their pipeline outside the repo's own project. */ + projectRef?: GitLabProjectRef | null +}): Promise { + const jobId = args.check.gitlabJobId + if (!jobId) { + return null + } + if (!gitLabJobCanHaveTrace(args.check)) { + return gitLabJobTraceToCheckRunDetails(args.check, '', emptyTraceStrings()) + } + const target = getActiveRuntimeTarget(args.settings) + const result = + target.kind === 'environment' + ? await callRuntimeRpc( + target, + 'gitlab.jobTrace', + { + repo: args.repoId ?? args.repoPath, + jobId, + projectRef: args.projectRef ?? undefined, + logExcerpt: true + }, + { timeoutMs: JOB_TRACE_TIMEOUT_MS } + ) + : await withJobTraceTimeout( + window.api.gl.jobTrace({ + repoPath: args.repoPath, + repoId: args.repoId, + jobId, + projectRef: args.projectRef ?? null, + logExcerpt: true + }) + ) + if (!result?.ok) { + throw new Error( + result?.error?.trim() || + translate( + 'auto.runtime.gitlabJobTraceClient.loadFailed', + 'Failed to load the GitLab job log.' + ) + ) + } + return gitLabJobTraceToCheckRunDetails(args.check, result.trace, emptyTraceStrings()) +} + +/** + * Bound the local IPC call the way `callRuntimeRpc` bounds the remote one. + * + * `glab` runs without a subprocess timeout in main, so an unreachable GitLab host + * would otherwise leave the expanded Checks row spinning forever. + */ +function withJobTraceTimeout(pending: Promise): Promise { + let timer: ReturnType | undefined + return Promise.race([ + pending, + new Promise((_, reject) => { + timer = setTimeout(() => { + reject( + new Error( + translate( + 'auto.runtime.gitlabJobTraceClient.timedOut', + 'Timed out loading the GitLab job log.' + ) + ) + ) + }, JOB_TRACE_TIMEOUT_MS) + }) + ]).finally(() => { + clearTimeout(timer) + }) +} + +// Called per-request, not at module scope, so the active locale applies. +function emptyTraceStrings(): { emptyTrace: string } { + return { + emptyTrace: translate( + 'auto.runtime.gitlabJobTraceClient.emptyTrace', + 'No log is available for this GitLab job.' + ) + } +} diff --git a/src/renderer/src/store/slices/editor.test.ts b/src/renderer/src/store/slices/editor.test.ts index d8a554a5197..1f2c8474641 100644 --- a/src/renderer/src/store/slices/editor.test.ts +++ b/src/renderer/src/store/slices/editor.test.ts @@ -39,6 +39,10 @@ vi.mock('@/runtime/close-mirrored-editor-tab', () => ({ notifyHostOfMirroredEditorClose: (...args: unknown[]) => notifyHostOfMirroredEditorCloseMock(...args) })) +const loadGitLabJobLogDetailsMock = vi.hoisted(() => vi.fn()) +vi.mock('@/runtime/gitlab-job-trace-client', () => ({ + loadGitLabJobLogDetails: loadGitLabJobLogDetailsMock +})) function createEditorStore(): StoreApi { // Only the editor slice + activeWorktreeId are needed for these tests. @@ -2998,6 +3002,151 @@ describe('createEditorSlice conflict status reconciliation', () => { ) }) + // Regression for #7732: refreshing a GitLab job tab through the GitHub check-runs + // API returns null and blanks the tab the user just asked to reload. + it('reloads an open GitLab job tab through the job trace client', async () => { + loadGitLabJobLogDetailsMock.mockReset() + loadGitLabJobLogDetailsMock.mockResolvedValue({ + name: 'test: unit', + status: 'completed', + conclusion: 'failure', + url: null, + detailsUrl: null, + startedAt: null, + completedAt: null, + title: null, + summary: null, + text: null, + annotations: [], + jobs: [ + { + id: 42, + name: 'test: unit', + status: 'completed', + conclusion: 'failure', + startedAt: null, + completedAt: null, + url: null, + logTail: 'ERROR: Job failed: exit code 1', + steps: [] + } + ] + }) + const fetchPRCheckDetails = vi.fn().mockResolvedValue(null) + // eslint-disable-next-line @typescript-eslint/no-explicit-any + const store = createStore()((...args: any[]) => ({ + activeWorktreeId: 'wt-1', + repos: [{ id: 'repo-1', path: '/repo' }], + worktreesByRepo: { 'repo-1': [{ id: 'wt-1', repoId: 'repo-1', path: '/repo' }] }, + settings: { activeRuntimeEnvironmentId: null }, + fetchPRCheckDetails, + ...createEditorSlice(...(args as Parameters)) + })) as unknown as StoreApi + const check = { + name: 'test: unit', + status: 'completed' as const, + conclusion: 'failure' as const, + url: null, + gitlabJobId: 42 + } + + store.getState().openCheckRunDetails('wt-1', 'repo:99', check, { + details: null, + loading: false, + error: null + }) + + await store.getState().reloadOpenCheckRunDetailsTab('wt-1::check-details::gitlab-job:42') + + expect(fetchPRCheckDetails).not.toHaveBeenCalled() + expect(loadGitLabJobLogDetailsMock).toHaveBeenCalledWith( + expect.objectContaining({ repoPath: '/repo', repoId: 'repo-1', check }) + ) + expect(store.getState().openFiles).toContainEqual( + expect.objectContaining({ + id: 'wt-1::check-details::gitlab-job:42', + checkRunDetails: expect.objectContaining({ + loading: false, + error: null, + details: expect.objectContaining({ + jobs: [expect.objectContaining({ logTail: 'ERROR: Job failed: exit code 1' })] + }) + }) + }) + ) + }) + + // Regression for #7732: a fork MR's job lives in the source project, so reloading + // without the stored project ref requests the trace from the wrong project. + it('reloads a fork MR job tab with the stored GitLab project ref', async () => { + loadGitLabJobLogDetailsMock.mockReset() + loadGitLabJobLogDetailsMock.mockResolvedValue(null) + // eslint-disable-next-line @typescript-eslint/no-explicit-any + const store = createStore()((...args: any[]) => ({ + activeWorktreeId: 'wt-1', + repos: [{ id: 'repo-1', path: '/repo' }], + worktreesByRepo: { 'repo-1': [{ id: 'wt-1', repoId: 'repo-1', path: '/repo' }] }, + settings: { activeRuntimeEnvironmentId: null }, + fetchPRCheckDetails: vi.fn().mockResolvedValue(null), + ...createEditorSlice(...(args as Parameters)) + })) as unknown as StoreApi + const check = { + name: 'test: unit', + status: 'completed' as const, + conclusion: 'failure' as const, + url: null, + gitlabJobId: 77 + } + const projectRef = { host: 'gitlab.com', path: 'contributor/fork' } + + store.getState().openCheckRunDetails('wt-1', 'repo:99', check, { + details: null, + loading: false, + error: null, + gitlabProjectRef: projectRef + }) + + await store.getState().reloadOpenCheckRunDetailsTab('wt-1::check-details::gitlab-job:77') + + expect(loadGitLabJobLogDetailsMock).toHaveBeenCalledWith( + expect.objectContaining({ check, projectRef }) + ) + }) + + it('keeps a stored GitLab project ref when a patch omits it', () => { + // eslint-disable-next-line @typescript-eslint/no-explicit-any + const store = createStore()((...args: any[]) => ({ + activeWorktreeId: 'wt-1', + ...createEditorSlice(...(args as Parameters)) + })) as unknown as StoreApi + const check = { + name: 'test: unit', + status: 'completed' as const, + conclusion: 'failure' as const, + url: null, + gitlabJobId: 77 + } + const projectRef = { host: 'gitlab.com', path: 'contributor/fork' } + + store.getState().openCheckRunDetails('wt-1', 'repo:99', check, { + details: null, + loading: false, + error: null, + gitlabProjectRef: projectRef + }) + store.getState().patchOpenCheckRunDetails('wt-1', 'repo:99', check, { + details: null, + loading: true, + error: null, + gitlabProjectRef: null + }) + + expect( + store.getState().openFiles.find((file) => file.id === 'wt-1::check-details::gitlab-job:77') + ?.checkRunDetails?.gitlabProjectRef + ).toEqual(projectRef) + }) + it('patches an open check-details tab without changing the active file', () => { const store = createEditorTabsStore() const check = { diff --git a/src/renderer/src/store/slices/editor.ts b/src/renderer/src/store/slices/editor.ts index ace5cace0fe..b8d5faa39dd 100644 --- a/src/renderer/src/store/slices/editor.ts +++ b/src/renderer/src/store/slices/editor.ts @@ -14,6 +14,8 @@ import { resolveMarkdownLinkTarget } from '@/components/editor/markdown-internal import { buildCheckRunDetailsTabId, getCheckRunDetailsTabLabel, + isSameGitLabProjectRef, + type CheckRunDetailsTabPatch, type OpenCheckRunDetailsState } from '@/components/editor/check-run-details-tab' import { openHttpLink, type HttpLinkSourceOwner } from '@/lib/http-link-routing' @@ -78,7 +80,11 @@ import { getRepoIdFromWorktreeId, type ActiveWorktreeStateTransition } from './worktree-helpers' -import { getExplicitRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner' +import { + getExplicitRuntimeEnvironmentIdForWorktree, + getSettingsForWorktreeRuntimeOwner +} from '@/lib/worktree-runtime-owner' +import { loadGitLabJobLogDetails } from '@/runtime/gitlab-job-trace-client' import { addAdditionalValidWorkspaceKeys, type WorkspaceSessionHydrationOptions @@ -589,13 +595,13 @@ export type EditorSlice = { worktreeId: string, contextKey: string, check: OpenCheckRunDetailsState['check'], - state: Pick + state: CheckRunDetailsTabPatch ) => void patchOpenCheckRunDetails: ( worktreeId: string, contextKey: string, check: OpenCheckRunDetailsState['check'], - state: Pick + state: CheckRunDetailsTabPatch ) => void reloadOpenCheckRunDetailsTab: (fileId: string) => Promise openBranchAllDiffs: ( @@ -3790,7 +3796,8 @@ export const createEditorSlice: StateCreator = (s check, details: state.details, loading: state.loading, - error: state.error + error: state.error, + gitlabProjectRef: state.gitlabProjectRef ?? null } set((s) => { const existing = s.openFiles.find((f) => f.id === id) @@ -3839,26 +3846,31 @@ export const createEditorSlice: StateCreator = (s // Why: sidebar detail fetches can finish after the full-details tab is open; update the snapshot without stealing focus. patchOpenCheckRunDetails: (worktreeId, contextKey, check, state) => { const id = buildCheckRunDetailsTabId(worktreeId, check) - const nextCheckRunDetails: OpenCheckRunDetailsState = { - contextKey, - check, - details: state.details, - loading: state.loading, - error: state.error - } set((s) => { const existing = s.openFiles.find((f) => f.id === id) if (!existing?.checkRunDetails) { return s } const current = existing.checkRunDetails + // Why: the sidebar resolves the MR's project asynchronously, so an early patch + // must not blank a ref we already know. + const gitlabProjectRef = state.gitlabProjectRef ?? current.gitlabProjectRef ?? null + const nextCheckRunDetails: OpenCheckRunDetailsState = { + contextKey, + check, + details: state.details, + loading: state.loading, + error: state.error, + gitlabProjectRef + } if ( current.contextKey === nextCheckRunDetails.contextKey && current.check.status === nextCheckRunDetails.check.status && current.check.conclusion === nextCheckRunDetails.check.conclusion && current.loading === nextCheckRunDetails.loading && current.error === nextCheckRunDetails.error && - current.details === nextCheckRunDetails.details + current.details === nextCheckRunDetails.details && + isSameGitLabProjectRef(current.gitlabProjectRef ?? null, gitlabProjectRef) ) { return s } @@ -3884,22 +3896,33 @@ export const createEditorSlice: StateCreator = (s return } const { contextKey, check } = checkRunDetails - const patch = (next: Pick): void => { + const patch = (next: CheckRunDetailsTabPatch): void => { get().patchOpenCheckRunDetails(file.worktreeId, contextKey, check, next) } patch({ details: checkRunDetails.details, loading: true, error: null }) try { - const details = await get().fetchPRCheckDetails( - repo.path, - { - checkRunId: check.checkRunId, - workflowRunId: check.workflowRunId, - checkName: check.name, - url: check.url, - prRepo: null - }, - { repoId: repo.id } - ) + // Why: refreshing a GitLab job tab through the GitHub check-runs API returns + // null and would blank the tab the user just asked to reload. + const details = check.gitlabJobId + ? await loadGitLabJobLogDetails({ + repoPath: repo.path, + repoId: repo.id, + settings: getSettingsForWorktreeRuntimeOwner(state, file.worktreeId), + check, + // Why: a fork MR's job lives in the source project, not the repo's own. + projectRef: checkRunDetails.gitlabProjectRef ?? null + }) + : await get().fetchPRCheckDetails( + repo.path, + { + checkRunId: check.checkRunId, + workflowRunId: check.workflowRunId, + checkName: check.name, + url: check.url, + prRepo: null + }, + { repoId: repo.id } + ) patch({ details, loading: false, diff --git a/src/shared/ansi-escape-sequences.ts b/src/shared/ansi-escape-sequences.ts new file mode 100644 index 00000000000..1d914900c24 --- /dev/null +++ b/src/shared/ansi-escape-sequences.ts @@ -0,0 +1,27 @@ +/* eslint-disable no-control-regex -- these patterns exist to match terminal control bytes. */ + +/** OSC title/progress frames, 7-bit (ESC ]) and 8-bit (U+009D) introducers. */ +export const OSC_SEQUENCE_PATTERN = /(?:\u001b\]|\u009d)[\s\S]*?(?:\u0007|\u001b\\|\u009c)/g +/** DCS/APC/PM/SOS string sequences terminated by ST. */ +export const STRING_SEQUENCE_PATTERN = + /(?:\u001b[P_^X]|\u0090|\u0098|\u009e|\u009f)[\s\S]*?(?:\u001b\\|\u009c)/g +/** CSI sequences (colors, cursor moves, `\u001b[0K` erase-to-EOL). */ +export const CSI_SEQUENCE_PATTERN = /(?:\u001b\[|\u009b)[0-?]*[ -/]*[@-~]/g +/** Remaining two/three-byte escape sequences (charset selection, RIS, ...). */ +export const ESCAPE_SEQUENCE_PATTERN = /\u001b[ -/]*[0-~]/g +/** C0/C1 control bytes except tab, line feed and carriage return. */ +export const TERMINAL_CONTROL_CHARACTER_PATTERN = + /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g + +/** + * Remove ANSI escape sequences while preserving text, tabs and line breaks. + * Ordering matters: OSC/string sequences must be consumed before the generic + * escape pattern, which would otherwise eat only their introducer. + */ +export function stripAnsiEscapeSequences(value: string): string { + return value + .replace(OSC_SEQUENCE_PATTERN, '') + .replace(STRING_SEQUENCE_PATTERN, '') + .replace(CSI_SEQUENCE_PATTERN, '') + .replace(ESCAPE_SEQUENCE_PATTERN, '') +} diff --git a/src/main/github/check-job-log-tail-slice.test.ts b/src/shared/check-job-log-tail-slice.test.ts similarity index 100% rename from src/main/github/check-job-log-tail-slice.test.ts rename to src/shared/check-job-log-tail-slice.test.ts diff --git a/src/main/github/check-job-log-tail-slice.ts b/src/shared/check-job-log-tail-slice.ts similarity index 82% rename from src/main/github/check-job-log-tail-slice.ts rename to src/shared/check-job-log-tail-slice.ts index 694a5dfec99..a5a9f483b1f 100644 --- a/src/main/github/check-job-log-tail-slice.ts +++ b/src/shared/check-job-log-tail-slice.ts @@ -10,8 +10,19 @@ export const PR_CHECK_LOG_TAIL_EARLIER_SEPARATOR = '… earlier errors …' const ERROR_LINE_PATTERN = /(?:##\[error\]|::error::|::error\b|\berror:|FAILED|exit code|ENOENT|EACCES|panic:|AssertionError)/i +// Why: this slicer runs in main (GitHub/GitLab log fetches) and in the renderer +// (defensive re-slice of traces from older remote runtimes), so no Buffer. +function utf8ByteLength(text: string): number { + let bytes = 0 + for (const character of text) { + const codePoint = character.codePointAt(0) ?? 0 + bytes += codePoint < 0x80 ? 1 : codePoint < 0x800 ? 2 : codePoint < 0x10000 ? 3 : 4 + } + return bytes +} + function applyLogTailByteCap(text: string): string { - if (Buffer.byteLength(text, 'utf8') <= PR_CHECK_LOG_TAIL_BYTES) { + if (utf8ByteLength(text) <= PR_CHECK_LOG_TAIL_BYTES) { return text } return sliceTrailingTextByUtf8Bytes(text, PR_CHECK_LOG_TAIL_BYTES) @@ -21,7 +32,7 @@ function sliceTrailingTextByUtf8Bytes(text: string, byteLimit: number): string { let byteLength = 0 const characters = Array.from(text) for (let index = characters.length - 1; index >= 0; index -= 1) { - const characterByteLength = Buffer.byteLength(characters[index] ?? '', 'utf8') + const characterByteLength = utf8ByteLength(characters[index] ?? '') if (byteLength + characterByteLength > byteLimit) { return characters.slice(index + 1).join('') } @@ -32,14 +43,13 @@ function sliceTrailingTextByUtf8Bytes(text: string, byteLimit: number): string { function joinLogExcerptWithByteCap(prefixLines: string[], recentLines: string[]): string { const prefix = prefixLines.join('\n') - const prefixByteLength = Buffer.byteLength(prefix, 'utf8') + const prefixByteLength = utf8ByteLength(prefix) if (prefixByteLength >= PR_CHECK_LOG_TAIL_BYTES) { return sliceTrailingTextByUtf8Bytes(prefix, PR_CHECK_LOG_TAIL_BYTES) } const separator = prefix.length > 0 && recentLines.length > 0 ? '\n' : '' - const recentBudget = - PR_CHECK_LOG_TAIL_BYTES - prefixByteLength - Buffer.byteLength(separator, 'utf8') + const recentBudget = PR_CHECK_LOG_TAIL_BYTES - prefixByteLength - utf8ByteLength(separator) const recentTail = sliceTrailingTextByUtf8Bytes(recentLines.join('\n'), recentBudget) return `${prefix}${separator}${recentTail}` } diff --git a/src/shared/gitlab-job-log-excerpt.test.ts b/src/shared/gitlab-job-log-excerpt.test.ts new file mode 100644 index 00000000000..d477f9f094b --- /dev/null +++ b/src/shared/gitlab-job-log-excerpt.test.ts @@ -0,0 +1,90 @@ +import { describe, expect, it } from 'vitest' +import { gitLabJobTraceToLogExcerpt, toGitLabJobLogExcerptResult } from './gitlab-job-log-excerpt' +import { PR_CHECK_LOG_TAIL_BYTES } from './check-job-log-tail-slice' + +const CSI_ERASE = '\u001b[0K' +const RESET = '\u001b[0;m' +const CR = '\r' + +describe('gitLabJobTraceToLogExcerpt', () => { + it('keeps the visible header of a section marker and drops the marker itself', () => { + const trace = [ + `section_start:1699000000:build_script${CR}${CSI_ERASE}$ pnpm build`, + 'built in 3s', + `section_end:1699000030:build_script${CR}${CSI_ERASE}` + ].join('\n') + + const excerpt = gitLabJobTraceToLogExcerpt(trace) + + expect(excerpt).toContain('$ pnpm build') + expect(excerpt).toContain('built in 3s') + expect(excerpt).not.toContain('section_start') + expect(excerpt).not.toContain('section_end') + }) + + it('strips ANSI colour sequences', () => { + const excerpt = gitLabJobTraceToLogExcerpt(`${RESET}ERROR: Job failed${RESET}`) + + expect(excerpt).toBe('ERROR: Job failed') + expect(excerpt).not.toContain('[0;m') + }) + + it('splits carriage-return progress output so the line tail still applies', () => { + const progress = Array.from({ length: 5_000 }, (_, index) => `downloading ${index}%`).join('\r') + + const excerpt = gitLabJobTraceToLogExcerpt(`${progress}\nERROR: Job failed: exit code 1`) + + expect(excerpt).toContain('ERROR: Job failed: exit code 1') + expect(excerpt).not.toContain('downloading 0%') + expect(excerpt.length).toBeLessThanOrEqual(PR_CHECK_LOG_TAIL_BYTES) + }) + + it('bounds a multi-megabyte trace below the 1 MB runtime transport frame cap', () => { + const huge = Array.from( + { length: 60_000 }, + (_, index) => `line ${index} ${'x'.repeat(60)}` + ).join('\n') + + const excerpt = gitLabJobTraceToLogExcerpt(huge) + + expect(huge.length).toBeGreaterThan(1024 * 1024) + expect(Buffer.byteLength(excerpt, 'utf8')).toBeLessThanOrEqual(PR_CHECK_LOG_TAIL_BYTES) + expect(excerpt).toContain('line 59999') + }) + + it('preserves earlier error context buried under trailing noise', () => { + const trace = [ + ...Array.from({ length: 150 }, (_, index) => `Installing package ${index}`), + 'ERROR: Job failed: exit code 1', + ...Array.from({ length: 90 }, (_, index) => `Uploading artifact ${index}`) + ].join('\n') + + const excerpt = gitLabJobTraceToLogExcerpt(trace) + + expect(excerpt).toContain('ERROR: Job failed: exit code 1') + expect(excerpt).toContain('Uploading artifact 89') + }) + + it('bounds the raw trace before stripping so a huge log is not scanned in full', () => { + const filler = `${'x'.repeat(200)}\n`.repeat(6_000) // ~1.2 MB, above the raw cap + const excerpt = gitLabJobTraceToLogExcerpt(`head marker\n${filler}ERROR: Job failed`) + + expect(excerpt).toContain('ERROR: Job failed') + expect(excerpt).not.toContain('head marker') + }) + + it('returns an empty excerpt for a job that never produced a log', () => { + expect(gitLabJobTraceToLogExcerpt('')).toBe('') + expect(gitLabJobTraceToLogExcerpt(` \n${CSI_ERASE}\n `)).toBe('') + }) +}) + +describe('toGitLabJobLogExcerptResult', () => { + it('bounds a successful trace and passes errors through untouched', () => { + const bounded = toGitLabJobLogExcerptResult({ ok: true, trace: `${RESET}done` }) + expect(bounded).toEqual({ ok: true, trace: 'done' }) + + const failure = { ok: false, error: '403 Forbidden' } as const + expect(toGitLabJobLogExcerptResult(failure)).toBe(failure) + }) +}) diff --git a/src/shared/gitlab-job-log-excerpt.ts b/src/shared/gitlab-job-log-excerpt.ts new file mode 100644 index 00000000000..66754edb751 --- /dev/null +++ b/src/shared/gitlab-job-log-excerpt.ts @@ -0,0 +1,52 @@ +import { stripAnsiEscapeSequences } from './ansi-escape-sequences' +import { sliceCheckLogTail } from './check-job-log-tail-slice' +import type { GitLabJobTraceResult } from './gitlab-types' + +// GitLab wraps collapsible sections in `section_start::\r0K`; +// strip only through the CR so the human-readable header on the same line survives. +const SECTION_MARKER_PREFIX_PATTERN = /^section_(?:start|end):\d+:[^\r\n]*?\r/gm +// Sections without a visible header leave a marker-only line; drop it whole. +const SECTION_MARKER_LINE_PATTERN = /^section_(?:start|end):\d+:[^\r\n]*\n?/gm + +// Why: stripping makes several full passes over the input, so a multi-megabyte CI log +// would stall the main-process event loop before the tail is trimmed to 16 KB anyway. +// 512 K chars is far more than the excerpt can keep, even with markup removed. +const MAX_RAW_TRACE_CHARS = 512 * 1024 + +function rawTraceTail(trace: string): string { + if (trace.length <= MAX_RAW_TRACE_CHARS) { + return trace + } + const tail = trace.slice(trace.length - MAX_RAW_TRACE_CHARS) + // Drop the partial first line so a marker or escape cut in half cannot survive stripping. + const firstLineBreak = tail.indexOf('\n') + return firstLineBreak === -1 ? tail : tail.slice(firstLineBreak + 1) +} + +/** + * Turn a raw `glab api .../jobs/:id/trace` body into a bounded, readable excerpt. + * + * Bounding is not cosmetic: the runtime RPC transports drop frames over 1 MB + * (`MAX_WS_MESSAGE_BYTES` / `MAX_RELAY_MESSAGE_BYTES`), so a multi-megabyte CI + * log must be cut before it crosses the wire, not after. + */ +export function gitLabJobTraceToLogExcerpt(trace: string): string { + if (!trace) { + return '' + } + // Order matters: ANSI first so the erase-to-EOL sequence between the marker's CR + // and its header text is gone, CR normalisation last so the marker patterns can + // still see the CR that separates a marker from its visible header. + const readable = stripAnsiEscapeSequences(rawTraceTail(trace)) + .replace(SECTION_MARKER_PREFIX_PATTERN, '') + .replace(SECTION_MARKER_LINE_PATTERN, '') + // Why: progress output redraws with bare CR, which would otherwise make the + // whole job log a single line and defeat the line-based tail. + .replace(/\r\n?/g, '\n') + return sliceCheckLogTail(readable).trim() +} + +/** Applied in main so only the excerpt crosses IPC / the runtime RPC socket. */ +export function toGitLabJobLogExcerptResult(result: GitLabJobTraceResult): GitLabJobTraceResult { + return result.ok ? { ok: true, trace: gitLabJobTraceToLogExcerpt(result.trace) } : result +} diff --git a/src/shared/gitlab-job-trace-check-details.test.ts b/src/shared/gitlab-job-trace-check-details.test.ts new file mode 100644 index 00000000000..59cf24cbf79 --- /dev/null +++ b/src/shared/gitlab-job-trace-check-details.test.ts @@ -0,0 +1,97 @@ +import { describe, expect, it } from 'vitest' +import { + gitLabJobCanHaveTrace, + gitLabJobTraceToCheckRunDetails +} from './gitlab-job-trace-check-details' +import { gitLabPipelineJobsToPRChecks } from './gitlab-pipeline-checks' +import type { GitLabPipelineJob } from './gitlab-types' +import type { PRCheckDetail } from './types' + +const STRINGS = { emptyTrace: 'No log is available for this GitLab job.' } + +const failedJob: PRCheckDetail = { + name: 'Component Tests: Purchase API', + status: 'completed', + conclusion: 'failure', + url: 'https://gitlab.example.test/acme/orca/-/jobs/42', + gitlabJobId: 42 +} + +describe('gitLabJobTraceToCheckRunDetails', () => { + it('renders the trace as a single job log tail', () => { + const details = gitLabJobTraceToCheckRunDetails( + failedJob, + 'FAIL src/purchase/refund.spec.ts\nERROR: Job failed: exit code 1', + STRINGS + ) + + expect(details.jobs).toHaveLength(1) + expect(details.jobs[0]?.id).toBe(42) + expect(details.jobs[0]?.conclusion).toBe('failure') + expect(details.jobs[0]?.logTail).toContain('ERROR: Job failed: exit code 1') + expect(details.summary).toBeNull() + }) + + it('copies status and conclusion from the row so the poll cache is not evicted', () => { + const details = gitLabJobTraceToCheckRunDetails(failedJob, 'boom', STRINGS) + + expect(details.status).toBe(failedJob.status) + expect(details.conclusion).toBe(failedJob.conclusion) + }) + + it('explains an empty trace instead of falling back to "no inline details"', () => { + const manualJob: PRCheckDetail = { + name: 'deploy: production', + status: 'completed', + conclusion: 'neutral', + url: null, + gitlabJobId: 77 + } + + const details = gitLabJobTraceToCheckRunDetails(manualJob, '', STRINGS) + + expect(details.jobs).toEqual([]) + expect(details.summary).toBe(STRINGS.emptyTrace) + }) + + it('re-slices a raw trace from an older remote runtime that ignored logExcerpt', () => { + const raw = Array.from({ length: 5_000 }, (_, index) => `line ${index}`).join('\n') + + const details = gitLabJobTraceToCheckRunDetails(failedJob, raw, STRINGS) + + expect(details.jobs[0]?.logTail).toContain('line 4999') + expect(details.jobs[0]?.logTail).not.toContain('line 0\n') + }) +}) + +describe('gitLabJobCanHaveTrace', () => { + // Why: GitLab answers 404 for a job that never ran, so skip the round trip. Jobs that + // may have run are still asked; main turns a missing log into an empty trace. + const cases: { status: string; expected: boolean }[] = [ + { status: 'failed', expected: true }, + { status: 'success', expected: true }, + { status: 'running', expected: true }, + { status: 'canceled', expected: true }, + { status: 'created', expected: false }, + { status: 'pending', expected: false }, + { status: 'scheduled', expected: false }, + { status: 'manual', expected: false }, + { status: 'skipped', expected: false } + ] + + for (const { status, expected } of cases) { + it(`${expected ? 'requests' : 'skips'} a trace for a ${status} job`, () => { + const job = { + id: 5, + name: 'unit', + stage: 'test', + status, + webUrl: '', + duration: null + } as unknown as GitLabPipelineJob + const [check] = gitLabPipelineJobsToPRChecks([job]) + + expect(gitLabJobCanHaveTrace(check)).toBe(expected) + }) + } +}) diff --git a/src/shared/gitlab-job-trace-check-details.ts b/src/shared/gitlab-job-trace-check-details.ts new file mode 100644 index 00000000000..fd81789bc0a --- /dev/null +++ b/src/shared/gitlab-job-trace-check-details.ts @@ -0,0 +1,70 @@ +import { gitLabJobTraceToLogExcerpt } from './gitlab-job-log-excerpt' +import type { PRCheckDetail, PRCheckRunDetails } from './types' + +export type GitLabJobTraceCheckDetailsStrings = { + /** Shown for a job with no log: never ran, waiting on a human, or log erased/expired. */ + emptyTrace: string +} + +/** + * Whether GitLab can have a trace for this job yet. + * + * Jobs that never started (`created`/`pending` -> queued) and jobs waiting on a human + * (`manual` -> neutral) or bypassed (`skipped`) have no trace, so skip the round trip. + * Other jobs may still lack a log (canceled before start, erased); main maps that 404 + * to an empty trace rather than an error. + */ +export function gitLabJobCanHaveTrace(check: PRCheckDetail): boolean { + if (check.status === 'queued') { + return false + } + return check.conclusion !== 'neutral' && check.conclusion !== 'skipped' +} + +/** + * Adapt a GitLab job trace to the provider-neutral check-details shape the Checks + * panel and the full-details tab already render. GitLab exposes one flat trace per + * job rather than GitHub's step/annotation breakdown, so it lands in a single job's + * `logTail`. + */ +export function gitLabJobTraceToCheckRunDetails( + check: PRCheckDetail, + trace: string, + strings: GitLabJobTraceCheckDetailsStrings +): PRCheckRunDetails { + // Re-slice defensively: an older remote runtime returns the raw trace because it + // does not understand the `logExcerpt` request flag. + const logTail = gitLabJobTraceToLogExcerpt(trace) + return { + name: check.name, + // Why: copying the row's own state keeps the panel's status/conclusion cache + // invalidation from evicting this entry on every poll tick. + status: check.status, + conclusion: check.conclusion, + url: check.url, + detailsUrl: check.url, + startedAt: null, + completedAt: null, + title: null, + // Why: a job with no log still needs a distinct explanation, otherwise it falls + // back to the generic "no inline details" text this feature exists to remove. + summary: logTail ? null : strings.emptyTrace, + text: null, + annotations: [], + jobs: logTail + ? [ + { + id: check.gitlabJobId ?? null, + name: check.name, + status: check.status, + conclusion: check.conclusion, + startedAt: null, + completedAt: null, + url: check.url, + logTail, + steps: [] + } + ] + : [] + } +} diff --git a/src/shared/gitlab-pipeline-checks.test.ts b/src/shared/gitlab-pipeline-checks.test.ts index 673fcf3cd16..71f2be73d8d 100644 --- a/src/shared/gitlab-pipeline-checks.test.ts +++ b/src/shared/gitlab-pipeline-checks.test.ts @@ -44,26 +44,42 @@ describe('gitLabPipelineJobsToPRChecks', () => { name: 'test: unit', status: 'completed', conclusion: 'failure', - url: 'https://gitlab.com/acme/orca/-/jobs/1' + url: 'https://gitlab.com/acme/orca/-/jobs/1', + gitlabJobId: 1 }, { name: 'deploy: deploy', status: 'completed', conclusion: 'neutral', - url: null + url: null, + gitlabJobId: 2 }, { name: 'deploy: delayed deploy', status: 'queued', conclusion: 'pending', - url: 'https://gitlab.com/acme/orca/-/jobs/3' + url: 'https://gitlab.com/acme/orca/-/jobs/3', + gitlabJobId: 3 }, { name: 'integration: external callback', status: 'queued', conclusion: 'pending', - url: 'https://gitlab.com/acme/orca/-/jobs/4' + url: 'https://gitlab.com/acme/orca/-/jobs/4', + gitlabJobId: 4 } ]) }) + + it('omits the job id when GitLab does not report a usable one', () => { + const jobs = [ + { id: 0, name: 'zero', stage: '', status: 'failed', webUrl: '', duration: null }, + { name: 'missing', stage: '', status: 'failed', webUrl: '', duration: null } + ] as unknown as GitLabPipelineJob[] + + // Why: the runtime RPC schema requires a positive int, so a falsy id must not be forwarded. + for (const check of gitLabPipelineJobsToPRChecks(jobs)) { + expect(check).not.toHaveProperty('gitlabJobId') + } + }) }) diff --git a/src/shared/gitlab-pipeline-checks.ts b/src/shared/gitlab-pipeline-checks.ts index f993be157a3..9cb9a2b1ebd 100644 --- a/src/shared/gitlab-pipeline-checks.ts +++ b/src/shared/gitlab-pipeline-checks.ts @@ -62,6 +62,8 @@ export function gitLabPipelineJobsToPRChecks(jobs: GitLabPipelineJob[]): PRCheck name: job.stage ? `${job.stage}: ${job.name}` : job.name, status: mapGitLabPipelineJobStatusToCheckStatus(job.status), conclusion: mapGitLabPipelineJobStatusToConclusion(job.status), - url: job.webUrl || null + url: job.webUrl || null, + // Truthiness, not != null: the runtime RPC schema requires a positive int. + ...(job.id ? { gitlabJobId: job.id } : {}) })) } diff --git a/src/shared/pr-checks-fix-prompt.ts b/src/shared/pr-checks-fix-prompt.ts index e31a9fbbf80..ff50a410942 100644 --- a/src/shared/pr-checks-fix-prompt.ts +++ b/src/shared/pr-checks-fix-prompt.ts @@ -82,6 +82,11 @@ export function getCheckDetailsPromptKey(check: PRCheckDetail, index: number): s if (check.workflowRunId) { return `workflow-run:${check.workflowRunId}:${check.name}` } + // Keep in step with getCheckIdentityKey / getCheckRunTabIdentity: a GitLab job + // without a web_url would otherwise key on its index and miss its loaded log. + if (check.gitlabJobId) { + return `gitlab-job:${check.gitlabJobId}:${check.name}` + } if (check.url) { return `url:${check.url}:${check.name}` } diff --git a/src/shared/repro-7732-gitlab-job-id-dropped.test.ts b/src/shared/repro-7732-gitlab-job-id-dropped.test.ts new file mode 100644 index 00000000000..4f1130f26f2 --- /dev/null +++ b/src/shared/repro-7732-gitlab-job-id-dropped.test.ts @@ -0,0 +1,29 @@ +import { describe, expect, it } from 'vitest' +import { gitLabPipelineJobsToPRChecks } from './gitlab-pipeline-checks' +import type { GitLabPipelineJob } from './types' + +// Repro for #7732: the Checks side panel can only ask for a GitLab job trace if the mapped +// check row still carries the numeric GitLab job id (gitlab:jobTrace takes { jobId }). +function numericHandles(value: object): number[] { + return Object.values(value).filter((v): v is number => typeof v === 'number') +} + +describe('#7732 GitLab pipeline job -> check row mapping', () => { + const failedJob: GitLabPipelineJob = { + id: 42, + name: 'Purchase API Component Tests', + stage: 'Component Tests', + status: 'failed', + webUrl: 'https://gitlab.com/acme/orca/-/jobs/42', + duration: 31 + } + + it('keeps the GitLab job id so the panel can fetch the job trace', () => { + const [check] = gitLabPipelineJobsToPRChecks([failedJob]) + + expect(check.name).toBe('Component Tests: Purchase API Component Tests') + expect(check.conclusion).toBe('failure') + // The id is the only handle gitlab:jobTrace accepts; without it the expand path has nothing to send. + expect(numericHandles(check)).toContain(42) + }) +}) diff --git a/src/shared/types.ts b/src/shared/types.ts index bc88d4d6d6c..b4e1a243242 100644 --- a/src/shared/types.ts +++ b/src/shared/types.ts @@ -1408,6 +1408,9 @@ export type PRCheckDetail = { url: string | null checkRunId?: number workflowRunId?: number + // Why: the GitLab job trace API is addressed by numeric job id only, so the + // Checks panel cannot load a job log without carrying it on the row. + gitlabJobId?: number } export type PRCheckAnnotation = { diff --git a/tests/e2e/repro-7732-gitlab-checks-job-details.spec.ts b/tests/e2e/repro-7732-gitlab-checks-job-details.spec.ts new file mode 100644 index 00000000000..c7f87dee9e3 --- /dev/null +++ b/tests/e2e/repro-7732-gitlab-checks-job-details.spec.ts @@ -0,0 +1,160 @@ +import type { ElectronApplication, Page } from '@stablyai/playwright-test' +import { mkdirSync } from 'node:fs' +import path from 'node:path' +import { test, expect } from './helpers/orca-app' +import { waitForActiveWorktree, waitForSessionReady } from './helpers/store' +import { openChecks } from './helpers/source-control-ai-generation' + +// Repro for #7732: expanding a GitLab pipeline job in the Checks panel must show its log, +// not "No inline details are available for this check." All fixture data is synthetic. +const FIXTURE = { + mrNumber: 4242, + jobId: 987654, + jobName: 'Purchase API Component Tests', + stage: 'Component Tests', + webUrl: 'https://gitlab.example.test/acme/orca/-/jobs/987654', + mrUrl: 'https://gitlab.example.test/acme/orca/-/merge_requests/4242', + headSha: 'e2ee2ee2ee2ee2ee2ee2ee2ee2ee2ee2ee2ee2e', + trace: [ + '$ pnpm test:component --project purchase-api', + 'FAIL src/purchase/refund.spec.ts', + ' AssertionError: expected refunded amount 4200 to equal 4250', + 'ERROR: Job failed: exit code 1' + ].join('\n') +} as const + +const SCREENSHOT_DIR = + process.env.ORCA_GITLAB_CHECKS_JOB_DETAILS_SCREENSHOT_DIR ?? + path.join(process.cwd(), 'test-results', 'gitlab-checks-job-details') + +// contextIsolation makes window.api non-writable, so stub at the IPC boundary in main. +async function installGitLabChecksBackend(electronApp: ElectronApplication): Promise { + await electronApp.evaluate(({ ipcMain }, fx) => { + ipcMain.removeHandler('hostedReview:forBranch') + ipcMain.handle('hostedReview:forBranch', async () => ({ + provider: 'gitlab', + number: fx.mrNumber, + title: 'Add purchase API component test coverage', + state: 'open', + url: fx.mrUrl, + status: 'failure', + updatedAt: '2026-07-07T12:00:00.000Z', + mergeable: 'MERGEABLE', + headSha: fx.headSha + })) + + ipcMain.removeHandler('gitlab:workItemDetails') + ipcMain.handle('gitlab:workItemDetails', async () => ({ + item: { + id: `gitlab-mr-${fx.mrNumber}`, + type: 'mr', + number: fx.mrNumber, + title: 'Add purchase API component test coverage', + state: 'opened', + url: fx.mrUrl, + labels: [], + updatedAt: '2026-07-07T12:00:00.000Z', + author: 'e2e-bot' + }, + body: 'Synthetic MR used for #7732 repro evidence.', + comments: [], + headSha: fx.headSha, + pipelineJobs: [ + { + id: fx.jobId, + pipelineId: 55, + name: fx.jobName, + stage: fx.stage, + status: 'failed', + webUrl: fx.webUrl, + duration: 87 + } + ], + reviewers: [] + })) + + ipcMain.removeHandler('gitlab:jobTrace') + ;(globalThis as { __repro7732JobTraceCalls?: number }).__repro7732JobTraceCalls = 0 + ipcMain.handle('gitlab:jobTrace', async () => { + const g = globalThis as { __repro7732JobTraceCalls?: number } + g.__repro7732JobTraceCalls = (g.__repro7732JobTraceCalls ?? 0) + 1 + return { ok: true, trace: fx.trace } + }) + }, FIXTURE) +} + +async function readJobTraceCallCount(electronApp: ElectronApplication): Promise { + return electronApp.evaluate( + () => (globalThis as { __repro7732JobTraceCalls?: number }).__repro7732JobTraceCalls ?? 0 + ) +} + +async function linkGitLabMRToWorktree(page: Page, worktreeId: string): Promise { + await page.evaluate( + ({ worktreeId, mrNumber }) => { + const store = window.__store + if (!store) { + throw new Error('window.__store is not available') + } + store.setState((current) => ({ + worktreesByRepo: Object.fromEntries( + Object.entries(current.worktreesByRepo).map(([repoId, worktrees]) => [ + repoId, + worktrees.map((worktree) => + worktree.id === worktreeId ? { ...worktree, linkedGitLabMR: mrNumber } : worktree + ) + ]) + ), + gitStatusByWorktree: { ...current.gitStatusByWorktree, [worktreeId]: [] } + })) + }, + { worktreeId, mrNumber: FIXTURE.mrNumber } + ) +} + +test.describe('#7732 GitLab Checks panel job details', () => { + test('expanding a failed pipeline job shows its log, not "No inline details"', async ({ + orcaPage, + electronApp + }) => { + await waitForSessionReady(orcaPage) + await waitForActiveWorktree(orcaPage) + await installGitLabChecksBackend(electronApp) + + const worktreeId = await orcaPage.evaluate( + () => window.__store?.getState().activeWorktreeId ?? null + ) + if (!worktreeId) { + throw new Error('E2E fixture did not expose an active worktree') + } + // Late startup UI hydration resets the active workspace + sidebar route; let it settle first. + await orcaPage.waitForTimeout(8_000) + + const jobRow = orcaPage.getByText(`${FIXTURE.stage}: ${FIXTURE.jobName}`, { exact: true }) + for (let attempt = 0; attempt < 40 && (await jobRow.count()) === 0; attempt++) { + await linkGitLabMRToWorktree(orcaPage, worktreeId) + await openChecks(orcaPage, worktreeId) + await orcaPage.waitForTimeout(500) + } + await expect(jobRow).toBeVisible({ timeout: 15_000 }) + + mkdirSync(SCREENSHOT_DIR, { recursive: true }) + await jobRow.click() + const noDetails = orcaPage.getByText('No inline details are available for this check.') + const viewFullLogs = orcaPage.getByRole('button', { name: 'View full logs' }) + for (let attempt = 0; attempt < 20; attempt++) { + if ((await noDetails.count()) > 0 || (await viewFullLogs.count()) > 0) { + break + } + await orcaPage.waitForTimeout(500) + } + await orcaPage.screenshot({ + path: path.join(SCREENSHOT_DIR, 'gitlab-checks-job-expanded.png') + }) + + // Correct behavior: the stubbed gitlab:jobTrace log renders instead of the "no details" fallback. + expect(await readJobTraceCallCount(electronApp)).toBeGreaterThan(0) + await expect(noDetails).toHaveCount(0) + await expect(viewFullLogs).toBeVisible({ timeout: 10_000 }) + }) +}) From e59a319ffe1817bef6590a1e77c2e8ffaef1a6eb Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Mon, 3 Aug 2026 22:55:17 -0700 Subject: [PATCH 08/72] fix(sidebar): keep each project's entry-point workspace visible under "Hide sleeping" (#12257) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "Hide sleeping" swept each project's main workspace out of the sidebar as soon as it had no live PTY, browser tab or agent — even with "Hide default branch" off. For a project whose only row is that workspace (a folder workspace, a fresh clone, a detached-HEAD main), the entire project vanished with no in-place way back. Adds a shared `isSleepingSweepExemptWorkspace` predicate keyed on `isMainWorktree` rather than the branch name, so folder workspaces (no branch), detached-HEAD mains, and SSH rows whose head/branch are blanked while a provider is disconnected all stay put. Wired into `computeVisibleWorktreeIds` (sidebar, Cmd+1-9, workspace board), the jump palette's duplicate inline pass, and mobile's `filterWorktrees`. Ships default-on with an escape hatch: a persisted `alwaysShowDefaultBranchWorkspace` setting surfaced as "Except default branch" under "Hide sleeping". Explicit "Hide default branch" still wins, since it filters before the sleeping sweep. Mobile reads the setting but never writes it back, so a desktop opt-out can't be clobbered by a filter tap before the ui.get roundtrip lands. Combines the two PRs open against #8873. #8966's exempt set is a strict subset of this one, so its production diff was subsumed rather than ported; its jump-palette render harness and e2e spec were carried over, and are the only such coverage here. Fixes #8873 Closes #8966 Co-authored-by: Rod Boev Co-authored-by: Orca --- mobile/app/h/[hostId]/index.tsx | 11 +- .../worktree/workspace-list-sections.test.ts | 89 +++++ .../src/worktree/workspace-list-sections.ts | 17 +- mobile/src/worktree/workspace-list-types.ts | 2 + .../src/worktree/workspace-view-settings.ts | 4 + .../runtime/rpc/methods/client-ui-schemas.ts | 1 + .../runtime/rpc/methods/client-ui.test.ts | 4 +- src/renderer/src/App.tsx | 3 + .../components/WorktreeJumpPalette.test.tsx | 351 ++++++++++++++++++ .../src/components/WorktreeJumpPalette.tsx | 8 +- .../components/sidebar/FilterToggleRow.tsx | 71 ++++ .../src/components/sidebar/SidebarFilter.tsx | 73 ++-- .../sidebar/SidebarWorkspaceFilterSection.tsx | 61 +-- .../sidebar/SidebarWorkspaceOptionsMenu.tsx | 3 + .../src/components/sidebar/WorktreeList.tsx | 12 + .../add-repo-skip-finalization.test.ts | 45 +++ .../sidebar/add-repo-skip-finalization.ts | 13 + ...branch-visible-under-hide-sleeping.test.ts | 205 ++++++++++ .../sidebar/sidebar-filter-state.test.ts | 34 ++ ...e-visible-workspace-kanban-worktree-ids.ts | 3 + .../sidebar/visible-worktrees.test.ts | 63 ++++ .../components/sidebar/visible-worktrees.ts | 35 ++ ...ktree-jump-palette-sleeping-filter.test.ts | 69 ++++ src/renderer/src/i18n/locales/en.json | 8 +- src/renderer/src/i18n/locales/es.json | 8 +- src/renderer/src/i18n/locales/ja.json | 8 +- src/renderer/src/i18n/locales/ko.json | 8 +- src/renderer/src/i18n/locales/zh.json | 8 +- src/renderer/src/lib/startup-ui-hydration.ts | 1 + src/renderer/src/store/slices/ui.test.ts | 27 ++ src/renderer/src/store/slices/ui.ts | 7 + src/shared/constants.ts | 1 + src/shared/types.ts | 2 + tests/e2e/default-branch-visibility.spec.ts | 165 ++++++++ 34 files changed, 1315 insertions(+), 105 deletions(-) create mode 100644 src/renderer/src/components/WorktreeJumpPalette.test.tsx create mode 100644 src/renderer/src/components/sidebar/FilterToggleRow.tsx create mode 100644 src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts create mode 100644 src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts create mode 100644 tests/e2e/default-branch-visibility.spec.ts diff --git a/mobile/app/h/[hostId]/index.tsx b/mobile/app/h/[hostId]/index.tsx index 24da552eafe..b71f171ceb8 100644 --- a/mobile/app/h/[hostId]/index.tsx +++ b/mobile/app/h/[hostId]/index.tsx @@ -164,7 +164,8 @@ export function HostScreen({ const [filters, setFilters] = useState({ filterRepoIds: new Set(), hideSleeping: false, - hideDefaultBranch: false + hideDefaultBranch: false, + alwaysShowDefaultBranch: true }) const [groupMode, setGroupMode] = useState('repo') const [workspaceStatuses, setWorkspaceStatuses] = useState( @@ -195,6 +196,7 @@ export function HostScreen({ sortMode: 'recent', hideSleeping: false, hideDefaultBranch: false, + alwaysShowDefaultBranch: true, filterRepoIds: [], collapsedGroups: [], workspaceStatuses: DEFAULT_MOBILE_WORKSPACE_STATUSES @@ -206,6 +208,7 @@ export function HostScreen({ sortMode, hideSleeping: filters.hideSleeping, hideDefaultBranch: filters.hideDefaultBranch, + alwaysShowDefaultBranch: filters.alwaysShowDefaultBranch !== false, filterRepoIds: [...filters.filterRepoIds], collapsedGroups: [...collapsedGroups], workspaceStatuses @@ -222,7 +225,8 @@ export function HostScreen({ setFilters({ filterRepoIds: new Set(next.filterRepoIds), hideSleeping: next.hideSleeping, - hideDefaultBranch: next.hideDefaultBranch + hideDefaultBranch: next.hideDefaultBranch, + alwaysShowDefaultBranch: next.alwaysShowDefaultBranch }) }, []) @@ -234,6 +238,9 @@ export function HostScreen({ if (!client) { return } + // alwaysShowDefaultBranchWorkspace is deliberately absent: mobile reads it + // but has no toggle, so echoing its local default would silently revert a + // desktop opt-out on the first filter tap before ui.get lands (#8873). const payload: WorkspaceViewSettings = { groupBy: groupModeToDesktop(next.groupMode), sortBy: next.sortMode, diff --git a/mobile/src/worktree/workspace-list-sections.test.ts b/mobile/src/worktree/workspace-list-sections.test.ts index d6d04d43d3e..d1fc267c09f 100644 --- a/mobile/src/worktree/workspace-list-sections.test.ts +++ b/mobile/src/worktree/workspace-list-sections.test.ts @@ -106,6 +106,95 @@ describe('filterWorktrees', () => { ).toEqual([featureNamedMain]) }) + it('keeps a sleeping main worktree visible under hide-sleeping by default (#8873)', () => { + const main = worktree({ worktreeId: 'main', branch: 'main', isMainWorktree: true }) + const feature = worktree({ worktreeId: 'feature', isMainWorktree: false }) + + expect( + filterWorktrees( + [main, feature], + { filterRepoIds: new Set(), hideSleeping: true, hideDefaultBranch: false }, + '' + ) + ).toEqual([main]) + }) + + it('keeps a sleeping folder workspace visible under hide-sleeping', () => { + const folder = worktree({ + workspaceKind: 'folder-workspace', + worktreeId: 'folder:workspace-1', + branch: '', + isMainWorktree: true + }) + + expect( + filterWorktrees( + [folder], + { filterRepoIds: new Set(), hideSleeping: true, hideDefaultBranch: false }, + '' + ) + ).toEqual([folder]) + }) + + it('re-hides the sleeping main worktree when the desktop setting is off', () => { + const main = worktree({ worktreeId: 'main', branch: 'main', isMainWorktree: true }) + + expect( + filterWorktrees( + [main], + { + filterRepoIds: new Set(), + hideSleeping: true, + hideDefaultBranch: false, + alwaysShowDefaultBranch: false + }, + '' + ) + ).toEqual([]) + }) + + it('falls back to the branch heuristic for hosts that omit isMainWorktree', () => { + const legacyMain = worktree({ worktreeId: 'legacy-main', branch: 'refs/heads/master' }) + + expect( + filterWorktrees( + [legacyMain], + { filterRepoIds: new Set(), hideSleeping: true, hideDefaultBranch: false }, + '' + ) + ).toEqual([legacyMain]) + }) + + it('keeps a sleeping folder workspace on hosts that omit isMainWorktree', () => { + // A folder workspace has no branch, so the legacy branch heuristic can never + // recognise it — without its own arm, #8873 still reproduces on old desktops. + const legacyFolder = worktree({ + workspaceKind: 'folder-workspace', + worktreeId: 'folder:legacy-1', + branch: '' + }) + + expect( + filterWorktrees( + [legacyFolder], + { filterRepoIds: new Set(), hideSleeping: true, hideDefaultBranch: false }, + '' + ) + ).toEqual([legacyFolder]) + }) + + it('lets hide-default-branch still win over the sleeping exemption', () => { + const main = worktree({ worktreeId: 'main', branch: 'main', isMainWorktree: true }) + + expect( + filterWorktrees( + [main], + { filterRepoIds: new Set(), hideSleeping: true, hideDefaultBranch: true }, + '' + ) + ).toEqual([]) + }) + it('keeps folder workspaces when default branch hiding is enabled', () => { const folder = worktree({ workspaceKind: 'folder-workspace', diff --git a/mobile/src/worktree/workspace-list-sections.ts b/mobile/src/worktree/workspace-list-sections.ts index bdb9e4783e3..d798a7fe5fa 100644 --- a/mobile/src/worktree/workspace-list-sections.ts +++ b/mobile/src/worktree/workspace-list-sections.ts @@ -65,6 +65,19 @@ function isDefaultBranchWorkspace(w: Worktree): boolean { return branch === 'main' || branch === 'master' } +/** + * Whether "Hide sleeping" must keep this row — the project's entry point (#8873). + * Falls back to the branch heuristic for hosts that predate isMainWorktree; a + * folder workspace is always its project's entry point, and isDefaultBranchWorkspace + * rejects it by design, so it needs its own legacy arm or #8873 still reproduces. + */ +function isSleepingSweepExempt(w: Worktree, alwaysShowDefaultBranch: boolean | undefined): boolean { + if (alwaysShowDefaultBranch === false) { + return false + } + return w.isMainWorktree ?? (w.workspaceKind === 'folder-workspace' || isDefaultBranchWorkspace(w)) +} + function orderMainWorktreeFirst(worktrees: Worktree[]): Worktree[] { const mainWorktrees = worktrees.filter((worktree) => worktree.isMainWorktree) if (mainWorktrees.length === 0) { @@ -80,7 +93,9 @@ export function filterWorktrees( ): Worktree[] { let result = worktrees.filter((w) => !w.isArchived) if (filters.hideSleeping) { - result = result.filter(isWorktreeActive) + result = result.filter( + (w) => isSleepingSweepExempt(w, filters.alwaysShowDefaultBranch) || isWorktreeActive(w) + ) } if (filters.hideDefaultBranch) { result = result.filter((w) => !isDefaultBranchWorkspace(w)) diff --git a/mobile/src/worktree/workspace-list-types.ts b/mobile/src/worktree/workspace-list-types.ts index 4dfbc74fa53..4ddb135affe 100644 --- a/mobile/src/worktree/workspace-list-types.ts +++ b/mobile/src/worktree/workspace-list-types.ts @@ -52,6 +52,8 @@ export type FilterState = { filterRepoIds: Set hideSleeping: boolean hideDefaultBranch: boolean + /** Absent means on: #8873's exemption must fail open on older host payloads. */ + alwaysShowDefaultBranch?: boolean } export type Section = { key: string; title: string; icon?: 'pin'; data: Worktree[] } diff --git a/mobile/src/worktree/workspace-view-settings.ts b/mobile/src/worktree/workspace-view-settings.ts index 0987915645a..32a4ac73a63 100644 --- a/mobile/src/worktree/workspace-view-settings.ts +++ b/mobile/src/worktree/workspace-view-settings.ts @@ -16,6 +16,7 @@ export type WorkspaceViewSettings = { sortBy?: 'name' | 'smart' | 'recent' | 'repo' | 'manual' hideSleepingWorkspaces?: boolean hideDefaultBranchWorkspace?: boolean + alwaysShowDefaultBranchWorkspace?: boolean filterRepoIds?: string[] collapsedGroups?: string[] workspaceStatuses?: WorkspaceStatusDefinition[] @@ -60,6 +61,7 @@ export type MobileViewState = { sortMode: MobileSortMode hideSleeping: boolean hideDefaultBranch: boolean + alwaysShowDefaultBranch: boolean filterRepoIds: string[] collapsedGroups: string[] workspaceStatuses: readonly WorkspaceStatusDefinition[] @@ -83,6 +85,8 @@ export function applyDesktopViewSettings( sortMode: sortMode ?? current.sortMode, hideSleeping: settings.hideSleepingWorkspaces ?? current.hideSleeping, hideDefaultBranch: settings.hideDefaultBranchWorkspace ?? current.hideDefaultBranch, + alwaysShowDefaultBranch: + settings.alwaysShowDefaultBranchWorkspace ?? current.alwaysShowDefaultBranch, filterRepoIds: settings.filterRepoIds ?? current.filterRepoIds, collapsedGroups: settings.collapsedGroups ?? current.collapsedGroups, workspaceStatuses diff --git a/src/main/runtime/rpc/methods/client-ui-schemas.ts b/src/main/runtime/rpc/methods/client-ui-schemas.ts index af254ca02e5..0e07476b2e6 100644 --- a/src/main/runtime/rpc/methods/client-ui-schemas.ts +++ b/src/main/runtime/rpc/methods/client-ui-schemas.ts @@ -223,6 +223,7 @@ const UiUpdateFields = z showDotfilesByWorktree: z.record(z.string(), z.boolean()).optional(), hideCliCreatedWorkspaces: z.boolean().optional(), hideDetachedHeadWorkspaces: z.boolean().optional(), + alwaysShowDefaultBranchWorkspace: z.boolean().optional(), filterRepoIds: StringArray.optional(), collapsedGroups: StringArray.optional(), uiZoomLevel: z.number().finite().optional(), diff --git a/src/main/runtime/rpc/methods/client-ui.test.ts b/src/main/runtime/rpc/methods/client-ui.test.ts index 3e3bbd9ba35..2a4b17b455e 100644 --- a/src/main/runtime/rpc/methods/client-ui.test.ts +++ b/src/main/runtime/rpc/methods/client-ui.test.ts @@ -555,7 +555,8 @@ describe('client UI RPC methods', () => { ], ['browserImportHintHidden', { browserImportHintHidden: true }], ['mobileEmulatorTabIntroDismissed', { mobileEmulatorTabIntroDismissed: true }], - ['mobileEmulatorAgentSetupDismissed', { mobileEmulatorAgentSetupDismissed: true }] + ['mobileEmulatorAgentSetupDismissed', { mobileEmulatorAgentSetupDismissed: true }], + ['alwaysShowDefaultBranchWorkspace', { alwaysShowDefaultBranchWorkspace: false }] ])('accepts %s, which the renderer persists through ui.set', async (_label, payload) => { const runtime = { getRuntimeId: () => 'test-runtime', @@ -592,6 +593,7 @@ describe('client UI RPC methods', () => { showSleepingWorkspaces: true, hideDefaultBranchWorkspace: false, hideAutomationGeneratedWorkspaces: false, + alwaysShowDefaultBranchWorkspace: true, showDotfilesByWorktree: { 'repo::/worktree': true }, filterRepoIds: ['repo-1'], acknowledgedAgentsByPaneKey: { 'pane-1': 123 } diff --git a/src/renderer/src/App.tsx b/src/renderer/src/App.tsx index 81f72be49d8..9874acecd66 100644 --- a/src/renderer/src/App.tsx +++ b/src/renderer/src/App.tsx @@ -661,6 +661,7 @@ function App(): React.JSX.Element { const hideAutomationGeneratedWorkspaces = useAppStore((s) => s.hideAutomationGeneratedWorkspaces) const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces) const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces) + const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace) const showDotfilesByWorktree = useAppStore((s) => s.showDotfilesByWorktree) const filterRepoIds = useAppStore((s) => s.filterRepoIds) const acknowledgedAgentsByPaneKey = useAppStore((s) => s.acknowledgedAgentsByPaneKey) @@ -1391,6 +1392,7 @@ function App(): React.JSX.Element { hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces, hideDetachedHeadWorkspaces, + alwaysShowDefaultBranchWorkspace, showDotfilesByWorktree, filterRepoIds, // Why (#9002): activeView is deliberately NOT included here. It used to @@ -1424,6 +1426,7 @@ function App(): React.JSX.Element { hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces, hideDetachedHeadWorkspaces, + alwaysShowDefaultBranchWorkspace, showDotfilesByWorktree, filterRepoIds, acknowledgedAgentsByPaneKey diff --git a/src/renderer/src/components/WorktreeJumpPalette.test.tsx b/src/renderer/src/components/WorktreeJumpPalette.test.tsx new file mode 100644 index 00000000000..7d84be81be1 --- /dev/null +++ b/src/renderer/src/components/WorktreeJumpPalette.test.tsx @@ -0,0 +1,351 @@ +// @vitest-environment happy-dom + +import { act } from 'react' +import { createRoot, type Root } from 'react-dom/client' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import type * as ReactI18Next from 'react-i18next' +import type { Repo, Worktree } from '../../../shared/types' +import { useAppStore } from '@/store' +import type { AppState } from '@/store/types' +import WorktreeJumpPalette from './WorktreeJumpPalette' + +vi.mock('react-i18next', async (importOriginal) => { + const actual = await importOriginal() + return { + ...actual, + useTranslation: () => ({ t: (_key: string, fallback?: string) => fallback ?? _key }) + } +}) + +vi.mock('sonner', () => ({ + toast: { + success: vi.fn(), + error: vi.fn(), + info: vi.fn(), + warning: vi.fn(), + message: vi.fn() + } +})) + +vi.mock('@/hooks/useSettingsNavigationMetadata', () => ({ + useSettingsNavigationMetadata: () => [] +})) + +vi.mock('@/components/sidebar/StatusIndicator', () => ({ + default: () => +})) + +vi.mock('@/components/repo/RepoBadgeLabel', () => ({ + RepoBadgeMark: () => +})) + +vi.mock('@/components/cmd-j/palette-host-badge', () => ({ + getPaletteHostBadge: () => null +})) + +vi.mock('@/components/ui/command', async () => { + const React = await import('react') + return { + CommandDialog: ({ children, open }: { children: React.ReactNode; open?: boolean }) => + open ?
{children}
: null, + CommandInput: ({ + value, + onValueChange, + placeholder + }: { + value?: string + onValueChange?: (next: string) => void + placeholder?: string + }) => { + setCommandQuery = onValueChange ?? null + return ( + onValueChange?.(event.currentTarget.value)} + /> + ) + }, + CommandList: React.forwardRef(function CommandList( + { children }: { children: React.ReactNode }, + ref: React.ForwardedRef + ) { + return ( +
+ {children} +
+ ) + }), + CommandEmpty: ({ children }: { children: React.ReactNode }) => ( +
{children}
+ ), + CommandItem: ({ + children, + onSelect, + value + }: { + children: React.ReactNode + onSelect?: (value: string) => void + value?: string + }) => ( + + ) + } +}) + +const initialAppState = useAppStore.getInitialState() +let testRoot: Root +let testContainer: HTMLDivElement +let setCommandQuery: ((next: string) => void) | null = null + +function makeRepo(): Repo { + return { + id: 'repo-1', + path: '/repos/repo-1', + displayName: 'Repo 1', + badgeColor: '#000000', + addedAt: 0 + } +} + +function makeWorktree( + id: string, + displayName: string, + overrides: Partial = {} +): Worktree { + return { + id, + repoId: 'repo-1', + path: `/tmp/${id}`, + head: 'abc123', + branch: 'refs/heads/main', + isBare: false, + isMainWorktree: false, + displayName, + comment: '', + linkedIssue: null, + linkedPR: null, + linkedLinearIssue: null, + isArchived: false, + isUnread: false, + isPinned: false, + sortOrder: 0, + lastActivityAt: 0, + ...overrides + } +} + +async function flushEffects(): Promise { + await act(async () => { + await Promise.resolve() + await Promise.resolve() + }) +} + +async function renderPalette(overrides: Partial): Promise { + useAppStore.setState({ + activeModal: 'worktree-palette', + activeWorktreeId: null, + repos: [makeRepo()], + tabsByWorktree: {}, + browserTabsByWorktree: {}, + browserPagesByWorkspace: {}, + unifiedTabsByWorktree: {}, + hideDefaultBranchWorkspace: false, + hideAutomationGeneratedWorkspaces: false, + // Why explicit: the sweep exemption is what these cases probe, so it must + // not ride on whatever the store default happens to be. + alwaysShowDefaultBranchWorkspace: true, + lastVisitedAtByWorktreeId: {}, + ...overrides + } as Partial) + + await act(async () => { + testRoot.render() + }) + await flushEffects() +} + +function getWorktreeRows(): string[] { + return [...testContainer.querySelectorAll('[data-command-item^="worktree:"]')].map( + (node) => node.textContent ?? '' + ) +} + +describe('WorktreeJumpPalette', () => { + beforeEach(() => { + globalThis.IS_REACT_ACT_ENVIRONMENT = true + setCommandQuery = null + useAppStore.setState(initialAppState, true) + testContainer = document.createElement('div') + document.body.appendChild(testContainer) + testRoot = createRoot(testContainer) + }) + + afterEach(async () => { + await act(async () => { + testRoot.unmount() + }) + document.body.replaceChildren() + useAppStore.setState(initialAppState, true) + }) + + it('keeps every inactive main workspace visible when sleeping workspaces are hidden', async () => { + const defaultBranch = makeWorktree('default-branch', 'Default branch workspace', { + isMainWorktree: true, + branch: 'refs/heads/main' + }) + const feature = makeWorktree('feature', 'Feature workspace', { + branch: 'refs/heads/feature' + }) + const folderMain = makeWorktree('folder-main', 'Folder workspace', { + isMainWorktree: true, + branch: '' + }) + + await renderPalette({ + worktreesByRepo: { 'repo-1': [defaultBranch, feature, folderMain] }, + showSleepingWorkspaces: false + }) + + expect(testContainer.textContent).toContain('Default branch workspace') + expect(testContainer.textContent).not.toContain('Feature workspace') + // Why kept: the exemption keys on isMainWorktree, not the branch name, so a + // branchless folder workspace is the project's entry point too. + expect(testContainer.textContent).toContain('Folder workspace') + }) + + it('keeps the explicit default-branch filter authoritative', async () => { + const defaultBranch = makeWorktree('default-branch', 'Default branch workspace', { + isMainWorktree: true, + branch: 'refs/heads/main' + }) + + await renderPalette({ + worktreesByRepo: { 'repo-1': [defaultBranch] }, + showSleepingWorkspaces: false, + hideDefaultBranchWorkspace: true + }) + + expect(testContainer.textContent).not.toContain('Default branch workspace') + }) + + it('keeps an active non-default workspace visible when sleeping workspaces are hidden', async () => { + const defaultBranch = makeWorktree('default-branch', 'Default branch workspace', { + isMainWorktree: true, + branch: 'refs/heads/main' + }) + const feature = makeWorktree('feature', 'Feature workspace', { + branch: 'refs/heads/feature' + }) + const folderMain = makeWorktree('folder-main', 'Folder workspace', { + isMainWorktree: true, + branch: '' + }) + + await renderPalette({ + worktreesByRepo: { 'repo-1': [defaultBranch, feature, folderMain] }, + showSleepingWorkspaces: false, + browserTabsByWorktree: { + feature: [ + { + id: 'browser-tab-1', + worktreeId: 'feature', + url: 'https://example.com', + title: 'example.com', + loading: false, + faviconUrl: null, + canGoBack: false, + canGoForward: false, + loadError: null, + createdAt: 0 + } + ] + } + }) + + expect(testContainer.textContent).toContain('Feature workspace') + expect(testContainer.textContent).toContain('Default branch workspace') + // Why kept: same isMainWorktree exemption — folder workspaces are covered. + expect(testContainer.textContent).toContain('Folder workspace') + }) + + it('sweeps the sleeping main workspace once the exemption is opted out', async () => { + const defaultBranch = makeWorktree('default-branch', 'Default branch workspace', { + isMainWorktree: true, + branch: 'refs/heads/main' + }) + const feature = makeWorktree('feature', 'Feature workspace', { + branch: 'refs/heads/feature' + }) + + await renderPalette({ + worktreesByRepo: { 'repo-1': [defaultBranch, feature] }, + showSleepingWorkspaces: false, + alwaysShowDefaultBranchWorkspace: false + }) + + expect(getWorktreeRows()).toEqual([]) + expect(testContainer.textContent).not.toContain('Default branch workspace') + expect(testContainer.textContent).not.toContain('Feature workspace') + }) + + it('keeps the show-sleeping baseline and empty-query ordering intact', async () => { + const defaultBranch = makeWorktree('default-branch', 'Default branch workspace', { + isMainWorktree: true, + branch: 'refs/heads/main' + }) + const feature = makeWorktree('feature', 'Feature workspace', { + branch: 'refs/heads/feature' + }) + const folderMain = makeWorktree('folder-main', 'Folder workspace', { + isMainWorktree: true, + branch: '' + }) + + await renderPalette({ + worktreesByRepo: { 'repo-1': [defaultBranch, feature, folderMain] }, + showSleepingWorkspaces: true, + lastVisitedAtByWorktreeId: { + feature: 300, + 'default-branch': 200, + 'folder-main': 100 + } + }) + + expect(getWorktreeRows()).toEqual([ + expect.stringContaining('Feature workspace'), + expect.stringContaining('Default branch workspace'), + expect.stringContaining('Folder workspace') + ]) + }) + + it('keeps typed-query results on the full non-archived scope', async () => { + const defaultBranch = makeWorktree('default-branch', 'Default branch workspace', { + isMainWorktree: true, + branch: 'refs/heads/main' + }) + const feature = makeWorktree('feature', 'Feature workspace', { + branch: 'refs/heads/feature' + }) + + await renderPalette({ + worktreesByRepo: { 'repo-1': [defaultBranch, feature] }, + showSleepingWorkspaces: false + }) + + expect(testContainer.textContent).not.toContain('Feature workspace') + + expect(setCommandQuery).not.toBeNull() + + await act(async () => { + setCommandQuery?.('Feature') + }) + await flushEffects() + + expect(testContainer.textContent).toContain('Feature workspace') + }) +}) diff --git a/src/renderer/src/components/WorktreeJumpPalette.tsx b/src/renderer/src/components/WorktreeJumpPalette.tsx index c85a2d700e7..19e352f7669 100644 --- a/src/renderer/src/components/WorktreeJumpPalette.tsx +++ b/src/renderer/src/components/WorktreeJumpPalette.tsx @@ -31,7 +31,8 @@ import { isAutomationGeneratedWorkspace, isCliCreatedWorkspace, isDetachedHeadWorkspace, - isDefaultBranchWorkspace + isDefaultBranchWorkspace, + isSleepingSweepExemptWorkspace } from '@/components/sidebar/visible-worktrees' import { getLiveAgentStatusByWorktreeId, isInactiveWorkspace } from '@/lib/worktree-activity-state' import { orderEmptyQueryWorktrees } from '@/lib/order-empty-query-worktrees' @@ -404,6 +405,7 @@ export default function WorktreeJumpPalette(): React.JSX.Element | null { const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces) const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces) const showSleepingWorkspaces = useAppStore((s) => s.showSleepingWorkspaces) + const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace) const lastVisitedAtByWorktreeId = useAppStore((s) => s.lastVisitedAtByWorktreeId) const workspacePortScan = useAppStore((s) => s.workspacePortScan?.result ?? null) const openNewBrowserTabInActiveWorkspace = useAppStore( @@ -501,6 +503,9 @@ export default function WorktreeJumpPalette(): React.JSX.Element | null { } if ( !showSleepingWorkspaces && + // Why the exemption here too: Cmd+J re-implements the sidebar's + // filter pass, so the shared predicate is what keeps them in step. + !isSleepingSweepExemptWorkspace(worktree, alwaysShowDefaultBranchWorkspace) && isInactiveWorkspace( worktree.id, tabsByWorktree, @@ -515,6 +520,7 @@ export default function WorktreeJumpPalette(): React.JSX.Element | null { }), [ allWorktrees, + alwaysShowDefaultBranchWorkspace, browserTabsByWorktree, hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces, diff --git a/src/renderer/src/components/sidebar/FilterToggleRow.tsx b/src/renderer/src/components/sidebar/FilterToggleRow.tsx new file mode 100644 index 00000000000..60930a19c44 --- /dev/null +++ b/src/renderer/src/components/sidebar/FilterToggleRow.tsx @@ -0,0 +1,71 @@ +import React from 'react' +import { DropdownMenuShortcut } from '@/components/ui/dropdown-menu' +import { cn } from '@/lib/utils' + +/** + * Switch row shared by the two workspace-filter surfaces (the sidebar filter + * dropdown and the workspace options menu). Extracted so the two copies cannot + * drift as rows are added. + */ +export function FilterToggleRow({ + icon, + label, + ariaLabel, + checked, + onChange, + shortcutLabel, + indented = false +}: { + icon: React.ReactNode + label: string + /** Full sentence for assistive tech when `label` only reads in visual context. */ + ariaLabel?: string + checked: boolean + onChange: (next: boolean) => void + shortcutLabel?: string + /** Renders the row as a sub-option of the row above it. */ + indented?: boolean +}) { + return ( + + ) +} + +export default FilterToggleRow diff --git a/src/renderer/src/components/sidebar/SidebarFilter.tsx b/src/renderer/src/components/sidebar/SidebarFilter.tsx index 06c445564a7..1efbf6d0016 100644 --- a/src/renderer/src/components/sidebar/SidebarFilter.tsx +++ b/src/renderer/src/components/sidebar/SidebarFilter.tsx @@ -23,14 +23,13 @@ import { DropdownMenu, DropdownMenuContent, DropdownMenuSeparator, - DropdownMenuShortcut, DropdownMenuTrigger } from '@/components/ui/dropdown-menu' import { Tooltip, TooltipTrigger, TooltipContent } from '@/components/ui/tooltip' import RepoBadgeLabel from '@/components/repo/RepoBadgeLabel' +import { FilterToggleRow } from './FilterToggleRow' import { useShortcutLabel } from '@/hooks/useShortcutLabel' import { searchRepos } from '@/lib/repo-search' -import { cn } from '@/lib/utils' import { DEFAULT_SHOW_SLEEPING_WORKSPACES } from '../../../../shared/constants' import { translate } from '@/i18n/i18n' @@ -62,6 +61,10 @@ const SidebarFilter = React.memo(function SidebarFilter({ const setHideCliCreatedWorkspaces = useAppStore((s) => s.setHideCliCreatedWorkspaces) const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces) const setHideDetachedHeadWorkspaces = useAppStore((s) => s.setHideDetachedHeadWorkspaces) + const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace) + const setAlwaysShowDefaultBranchWorkspace = useAppStore( + (s) => s.setAlwaysShowDefaultBranchWorkspace + ) const filterRepoIds = useAppStore((s) => s.filterRepoIds) const setFilterRepoIds = useAppStore((s) => s.setFilterRepoIds) const repos = useAppStore((s) => s.repos) @@ -114,6 +117,9 @@ const SidebarFilter = React.memo(function SidebarFilter({ hideAutomationGeneratedWorkspaces || hideCliCreatedWorkspaces || hideDetachedHeadWorkspaces || + // Why counted: turning the exemption off is the only way this row narrows + // the list, so the badge and Reset filters must both notice it. + !alwaysShowDefaultBranchWorkspace || hasRepoFilter const activeFilterCount = (hasSleepingFilter ? 1 : 0) + @@ -121,6 +127,7 @@ const SidebarFilter = React.memo(function SidebarFilter({ (hideAutomationGeneratedWorkspaces ? 1 : 0) + (hideCliCreatedWorkspaces ? 1 : 0) + (hideDetachedHeadWorkspaces ? 1 : 0) + + (alwaysShowDefaultBranchWorkspace ? 0 : 1) + selectedCount const filteredRepos = useMemo(() => searchRepos(repos, query), [repos, query]) @@ -136,6 +143,7 @@ const SidebarFilter = React.memo(function SidebarFilter({ setHideAutomationGeneratedWorkspaces(false) setHideCliCreatedWorkspaces(false) setHideDetachedHeadWorkspaces(false) + setAlwaysShowDefaultBranchWorkspace(true) setFilterRepoIds([]) }, [ setShowSleepingWorkspaces, @@ -143,6 +151,7 @@ const SidebarFilter = React.memo(function SidebarFilter({ setHideAutomationGeneratedWorkspaces, setHideCliCreatedWorkspaces, setHideDetachedHeadWorkspaces, + setAlwaysShowDefaultBranchWorkspace, setFilterRepoIds ]) @@ -212,6 +221,20 @@ const SidebarFilter = React.memo(function SidebarFilter({ onChange={(hideSleeping) => setShowSleepingWorkspaces(!hideSleeping)} shortcutLabel={sleepingShortcut === 'Unassigned' ? undefined : sleepingShortcut} /> + } + label={translate( + 'auto.components.sidebar.SidebarFilter.keepDefaultBranch', + 'Except default branch' + )} + ariaLabel={translate( + 'auto.components.sidebar.SidebarFilter.keepDefaultBranchAria', + 'Keep the default branch visible while hiding sleeping workspaces' + )} + checked={alwaysShowDefaultBranchWorkspace} + onChange={setAlwaysShowDefaultBranchWorkspace} + /> } label={translate( @@ -372,50 +395,4 @@ const SidebarFilter = React.memo(function SidebarFilter({ ) }) -function FilterToggleRow({ - icon, - label, - checked, - onChange, - shortcutLabel -}: { - icon: React.ReactNode - label: string - checked: boolean - onChange: (next: boolean) => void - shortcutLabel?: string -}) { - return ( - - ) -} - export default SidebarFilter diff --git a/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.tsx b/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.tsx index 20cddcfae49..e06f81420fb 100644 --- a/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.tsx +++ b/src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.tsx @@ -1,8 +1,8 @@ import React from 'react' import { CalendarClock, GitBranch, GitCommitHorizontal, Moon, SquareTerminal } from 'lucide-react' import { useAppStore } from '@/store' -import { cn } from '@/lib/utils' import { translate } from '@/i18n/i18n' +import { FilterToggleRow } from './FilterToggleRow' const SidebarWorkspaceFilterSection = React.memo(function SidebarWorkspaceFilterSection() { const showSleepingWorkspaces = useAppStore((s) => s.showSleepingWorkspaces) @@ -17,6 +17,10 @@ const SidebarWorkspaceFilterSection = React.memo(function SidebarWorkspaceFilter const setHideCliCreatedWorkspaces = useAppStore((s) => s.setHideCliCreatedWorkspaces) const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces) const setHideDetachedHeadWorkspaces = useAppStore((s) => s.setHideDetachedHeadWorkspaces) + const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace) + const setAlwaysShowDefaultBranchWorkspace = useAppStore( + (s) => s.setAlwaysShowDefaultBranchWorkspace + ) return ( <> @@ -34,6 +38,20 @@ const SidebarWorkspaceFilterSection = React.memo(function SidebarWorkspaceFilter checked={!showSleepingWorkspaces} onChange={(hideSleeping) => setShowSleepingWorkspaces(!hideSleeping)} /> + } + label={translate( + 'auto.components.sidebar.SidebarWorkspaceFilterSection.keepDefaultBranch', + 'Except default branch' + )} + ariaLabel={translate( + 'auto.components.sidebar.SidebarWorkspaceFilterSection.keepDefaultBranchAria', + 'Keep the default branch visible while hiding sleeping workspaces' + )} + checked={alwaysShowDefaultBranchWorkspace} + onChange={setAlwaysShowDefaultBranchWorkspace} + /> } label={translate( @@ -74,45 +92,4 @@ const SidebarWorkspaceFilterSection = React.memo(function SidebarWorkspaceFilter ) }) -function FilterToggleRow({ - icon, - label, - checked, - onChange -}: { - icon: React.ReactNode - label: string - checked: boolean - onChange: (next: boolean) => void -}) { - return ( - - ) -} - export default SidebarWorkspaceFilterSection diff --git a/src/renderer/src/components/sidebar/SidebarWorkspaceOptionsMenu.tsx b/src/renderer/src/components/sidebar/SidebarWorkspaceOptionsMenu.tsx index b087a3fb8f5..5f3f65dcea6 100644 --- a/src/renderer/src/components/sidebar/SidebarWorkspaceOptionsMenu.tsx +++ b/src/renderer/src/components/sidebar/SidebarWorkspaceOptionsMenu.tsx @@ -40,6 +40,7 @@ const SidebarWorkspaceOptionsMenu = React.memo(function SidebarWorkspaceOptionsM const hideAutomationGeneratedWorkspaces = useAppStore((s) => s.hideAutomationGeneratedWorkspaces) const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces) const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces) + const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace) const filterRepoIds = useAppStore((s) => s.filterRepoIds) const repos = useAppStore((s) => s.repos) const setWorkspaceHostScope = useAppStore((s) => s.setWorkspaceHostScope) @@ -84,6 +85,7 @@ const SidebarWorkspaceOptionsMenu = React.memo(function SidebarWorkspaceOptionsM hideAutomationGeneratedWorkspaces || hideCliCreatedWorkspaces || hideDetachedHeadWorkspaces || + !alwaysShowDefaultBranchWorkspace || hasRepoFilter || hasHostVisibilityFilter const activeFilterCount = @@ -92,6 +94,7 @@ const SidebarWorkspaceOptionsMenu = React.memo(function SidebarWorkspaceOptionsM (hideAutomationGeneratedWorkspaces ? 1 : 0) + (hideCliCreatedWorkspaces ? 1 : 0) + (hideDetachedHeadWorkspaces ? 1 : 0) + + (alwaysShowDefaultBranchWorkspace ? 0 : 1) + (hasHostVisibilityFilter ? 1 : 0) + selectedCount const activeFilterLabel = `${activeFilterCount} ${activeFilterCount === 1 ? 'filter' : 'filters'}` diff --git a/src/renderer/src/components/sidebar/WorktreeList.tsx b/src/renderer/src/components/sidebar/WorktreeList.tsx index e21ccdd01e9..422b765f082 100644 --- a/src/renderer/src/components/sidebar/WorktreeList.tsx +++ b/src/renderer/src/components/sidebar/WorktreeList.tsx @@ -5222,6 +5222,7 @@ const WorktreeList = React.memo(function WorktreeList({ const hideAutomationGeneratedWorkspaces = useAppStore((s) => s.hideAutomationGeneratedWorkspaces) const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces) const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces) + const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace) const filterRepoIds = useAppStore((s) => s.filterRepoIds) const openModal = useAppStore((s) => s.openModal) const openSettingsPage = useAppStore((s) => s.openSettingsPage) @@ -5509,6 +5510,7 @@ const WorktreeList = React.memo(function WorktreeList({ hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces, hideDetachedHeadWorkspaces, + alwaysShowDefaultBranchWorkspace, repoMap, workspaceHostScope, visibleWorkspaceHostIds, @@ -5526,6 +5528,7 @@ const WorktreeList = React.memo(function WorktreeList({ hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces, hideDetachedHeadWorkspaces, + alwaysShowDefaultBranchWorkspace, workspaceHostScope, visibleWorkspaceHostIds, settings, @@ -6487,6 +6490,7 @@ const WorktreeList = React.memo(function WorktreeList({ hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces, hideDetachedHeadWorkspaces, + alwaysShowDefaultBranchWorkspace, visibleWorkspaceHostIds, workspaceHostScope }), @@ -6497,6 +6501,7 @@ const WorktreeList = React.memo(function WorktreeList({ hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces, hideDetachedHeadWorkspaces, + alwaysShowDefaultBranchWorkspace, visibleWorkspaceHostIds, workspaceHostScope ] @@ -6509,6 +6514,9 @@ const WorktreeList = React.memo(function WorktreeList({ ) const setHideCliCreatedWorkspaces = useAppStore((s) => s.setHideCliCreatedWorkspaces) const setHideDetachedHeadWorkspaces = useAppStore((s) => s.setHideDetachedHeadWorkspaces) + const setAlwaysShowDefaultBranchWorkspace = useAppStore( + (s) => s.setAlwaysShowDefaultBranchWorkspace + ) const setFilterRepoIds = useAppStore((s) => s.setFilterRepoIds) const setVisibleWorkspaceHostIds = useAppStore((s) => s.setVisibleWorkspaceHostIds) @@ -6532,6 +6540,9 @@ const WorktreeList = React.memo(function WorktreeList({ if (actions.resetHideDetachedHeadWorkspaces) { setHideDetachedHeadWorkspaces(false) } + if (actions.resetAlwaysShowDefaultBranchWorkspace) { + setAlwaysShowDefaultBranchWorkspace(true) + } if (actions.resetVisibleWorkspaceHostIds) { setVisibleWorkspaceHostIds(null) } @@ -6542,6 +6553,7 @@ const WorktreeList = React.memo(function WorktreeList({ setHideAutomationGeneratedWorkspaces, setHideCliCreatedWorkspaces, setHideDetachedHeadWorkspaces, + setAlwaysShowDefaultBranchWorkspace, setVisibleWorkspaceHostIds, filterState ]) diff --git a/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts b/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts index 6a42c461926..de9c6f430cf 100644 --- a/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts +++ b/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts @@ -34,11 +34,14 @@ function makeState(overrides: Partial): AddRepoSki filterRepoIds: [], showActiveOnly: false, hideDefaultBranchWorkspace: false, + showSleepingWorkspaces: true, + alwaysShowDefaultBranchWorkspace: true, worktreesByRepo: {}, setActiveRepo: vi.fn(), setFilterRepoIds: vi.fn(), setShowActiveOnly: vi.fn(), setHideDefaultBranchWorkspace: vi.fn(), + setAlwaysShowDefaultBranchWorkspace: vi.fn(), ...overrides } } @@ -83,6 +86,48 @@ describe('finalizeImportedRepoAfterSkip', () => { expect(state.setHideDefaultBranchWorkspace).toHaveBeenCalledWith(false) }) + it('re-enables the default-branch exemption when the import would land asleep and hidden', () => { + const state = makeState({ + showSleepingWorkspaces: false, + alwaysShowDefaultBranchWorkspace: false, + worktreesByRepo: { + 'repo-new': [ + makeWorktree({ + id: 'repo-new::/repo/main', + repoId: 'repo-new', + isMainWorktree: true, + branch: 'refs/heads/main' + }) + ] + } + }) + + finalizeImportedRepoAfterSkip(state, 'repo-new') + + expect(state.setAlwaysShowDefaultBranchWorkspace).toHaveBeenCalledWith(true) + }) + + it('leaves the default-branch exemption alone when sleeping workspaces are shown', () => { + const state = makeState({ + showSleepingWorkspaces: true, + alwaysShowDefaultBranchWorkspace: false, + worktreesByRepo: { + 'repo-new': [ + makeWorktree({ + id: 'repo-new::/repo/main', + repoId: 'repo-new', + isMainWorktree: true, + branch: 'refs/heads/main' + }) + ] + } + }) + + finalizeImportedRepoAfterSkip(state, 'repo-new') + + expect(state.setAlwaysShowDefaultBranchWorkspace).not.toHaveBeenCalled() + }) + it('still reveals the imported repo when it has no discovered worktrees yet', () => { const state = makeState({ activeRepoId: 'repo-old', diff --git a/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts b/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts index 4c5e28d543b..4161f3bb6f9 100644 --- a/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts +++ b/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts @@ -6,11 +6,14 @@ export type AddRepoSkipFinalizationState = { filterRepoIds: string[] showActiveOnly: boolean hideDefaultBranchWorkspace: boolean + showSleepingWorkspaces: boolean + alwaysShowDefaultBranchWorkspace: boolean worktreesByRepo: Record setActiveRepo: (repoId: string | null) => void setFilterRepoIds: (repoIds: string[]) => void setShowActiveOnly: (value: boolean) => void setHideDefaultBranchWorkspace: (value: boolean) => void + setAlwaysShowDefaultBranchWorkspace: (value: boolean) => void } export function finalizeImportedRepoAfterSkip( @@ -37,4 +40,14 @@ export function finalizeImportedRepoAfterSkip( ) { state.setHideDefaultBranchWorkspace(false) } + // Why: with "Hide sleeping" on, a freshly imported project has no live PTY + // yet, so the opted-out exemption would leave it invisible on arrival. + if ( + importedWorktrees.length > 0 && + state.alwaysShowDefaultBranchWorkspace === false && + !state.showSleepingWorkspaces && + importedWorktrees.every((worktree) => worktree.isMainWorktree) + ) { + state.setAlwaysShowDefaultBranchWorkspace(true) + } } diff --git a/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts b/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts new file mode 100644 index 00000000000..9187dd02e13 --- /dev/null +++ b/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts @@ -0,0 +1,205 @@ +import { describe, expect, it } from 'vitest' +import { + computeVisibleWorktreeIds, + isDefaultBranchWorkspace, + type SidebarFilterState +} from './visible-worktrees' +import type { Repo, Worktree } from '../../../../shared/types' +import { LOCAL_EXECUTION_HOST_ID } from '../../../../shared/execution-host' + +/** + * Repro for #8873 — "[Feature]: Display default branch". + * + * Reporter: turning "Hide default branch" OFF does not keep the repo's + * default-branch workspace in the sidebar; once it has no live PTY/browser/agent + * it counts as sleeping and "Hide sleeping" sweeps it away. There is no + * "Always display default branch" escape hatch. + */ + +function makeRepo(id: string): Repo { + return { id, path: `/${id}`, displayName: id, badgeColor: '#000', addedAt: 0 } +} + +function makeDefaultBranchWorktree(): Worktree { + return { + id: 'wt-main', + repoId: 'repo1', + path: '/tmp/repo1', + head: 'abc123', + branch: 'refs/heads/main', + isBare: false, + isMainWorktree: true, + displayName: 'main', + comment: '', + linkedIssue: null, + linkedPR: null, + linkedLinearIssue: null, + isArchived: false, + isUnread: false, + isPinned: false, + sortOrder: 0, + lastActivityAt: 0 + } +} + +const repoMap = new Map([['repo1', makeRepo('repo1')]]) + +type VisibleOptions = Parameters[2] + +function visibleOptions(overrides: Partial = {}): VisibleOptions { + return { + filterRepoIds: [], + showSleepingWorkspaces: true, + tabsByWorktree: {}, + ptyIdsByTabId: {}, + browserTabsByWorktree: {}, + worktreeIdsWithLiveAgent: new Set(), + hideDefaultBranchWorkspace: false, + hideAutomationGeneratedWorkspaces: false, + hideCliCreatedWorkspaces: false, + hideDetachedHeadWorkspaces: false, + repoMap, + workspaceHostScope: 'all', + defaultHostId: LOCAL_EXECUTION_HOST_ID, + worktreeLineageById: {}, + ...overrides + } +} + +describe('#8873 default-branch workspace under "Hide sleeping"', () => { + it('is genuinely the default-branch row the "Hide default branch" toggle targets', () => { + expect(isDefaultBranchWorkspace(makeDefaultBranchWorktree())).toBe(true) + }) + + it('stays in the sidebar when it is sleeping and "Hide sleeping" is on', () => { + const worktree = makeDefaultBranchWorktree() + + const visible = computeVisibleWorktreeIds({ repo1: [worktree] }, [worktree.id], { + ...visibleOptions({ + // "Hide sleeping" ON, "Hide default branch" OFF — exactly the reporter's setup. + showSleepingWorkspaces: false, + hideDefaultBranchWorkspace: false + }) + }) + + expect(visible).toEqual([worktree.id]) + }) + + it('exposes an opt-in that keeps the default branch visible under "Hide sleeping"', () => { + // The issue asks for an "Always display default branch" flag. Prove the + // sidebar filter contract has no such knob today. + const filterKeys: readonly (keyof SidebarFilterState)[] = [ + 'showSleepingWorkspaces', + 'filterRepoIds', + 'hideDefaultBranchWorkspace', + 'hideAutomationGeneratedWorkspaces', + 'hideCliCreatedWorkspaces', + 'hideDetachedHeadWorkspaces', + 'alwaysShowDefaultBranchWorkspace', + 'visibleWorkspaceHostIds', + 'workspaceHostScope' + ] + const optionKeys = Object.keys(visibleOptions()) + + const alwaysShowKnob = [...filterKeys, ...optionKeys].find((key) => + /always.*default|default.*always|pinDefaultBranch/i.test(key) + ) + + expect(alwaysShowKnob).toBeDefined() + }) +}) + +describe('the "Hide sleeping" exemption for project entry-point rows', () => { + function visible(worktrees: Worktree[], overrides: Partial): string[] { + return computeVisibleWorktreeIds( + { repo1: worktrees }, + worktrees.map((w) => w.id), + visibleOptions({ showSleepingWorkspaces: false, ...overrides }) + ) + } + + it('re-hides the sleeping default branch when the user opts out', () => { + const worktree = makeDefaultBranchWorktree() + + expect(visible([worktree], { alwaysShowDefaultBranchWorkspace: false })).toEqual([]) + }) + + it('keeps the sleeping default branch when the option is explicitly on', () => { + const worktree = makeDefaultBranchWorktree() + + expect(visible([worktree], { alwaysShowDefaultBranchWorkspace: true })).toEqual([worktree.id]) + }) + + it('lets an explicit "Hide default branch" still win over the exemption', () => { + const worktree = makeDefaultBranchWorktree() + + expect( + visible([worktree], { + hideDefaultBranchWorkspace: true, + alwaysShowDefaultBranchWorkspace: true + }) + ).toEqual([]) + }) + + it('still sweeps sleeping non-main workspaces', () => { + const feature: Worktree = { + ...makeDefaultBranchWorktree(), + id: 'wt-feature', + branch: 'refs/heads/feature', + isMainWorktree: false + } + + expect(visible([feature], { alwaysShowDefaultBranchWorkspace: true })).toEqual([]) + }) + + it('keeps a sleeping folder workspace, which has no sibling row to fall back to', () => { + // Folder-mode projects are main worktrees with an empty branch/head, so the + // default-branch predicate rejects them; sweeping them drops the whole project. + const folder: Worktree = { + ...makeDefaultBranchWorktree(), + id: 'wt-folder', + branch: '', + head: '' + } + expect(isDefaultBranchWorkspace(folder)).toBe(false) + + expect(visible([folder], { alwaysShowDefaultBranchWorkspace: true })).toEqual([folder.id]) + }) + + it('keeps a sleeping detached-HEAD main worktree', () => { + const detachedMain: Worktree = { ...makeDefaultBranchWorktree(), id: 'wt-detached', branch: '' } + + expect(visible([detachedMain], { alwaysShowDefaultBranchWorkspace: true })).toEqual([ + detachedMain.id + ]) + }) + + it('lets "Hide detached HEAD" still win over the exemption', () => { + const detachedMain: Worktree = { ...makeDefaultBranchWorktree(), id: 'wt-detached', branch: '' } + + expect( + visible([detachedMain], { + hideDetachedHeadWorkspaces: true, + alwaysShowDefaultBranchWorkspace: true + }) + ).toEqual([]) + }) + + it('keeps every project’s entry point, not just the first', () => { + const mainA = makeDefaultBranchWorktree() + const mainB: Worktree = { ...makeDefaultBranchWorktree(), id: 'wt-main-b' } + + expect(visible([mainA, mainB], {})).toEqual([mainA.id, mainB.id]) + }) + + it('does not flicker out while an SSH host is offline', () => { + // A disconnected SSH provider re-synthesizes persisted worktrees with empty + // head/branch (orca-runtime.ts) while isMainWorktree stays a path compare — + // and the dead PTYs make the row read as sleeping at exactly that moment. + const awake = makeDefaultBranchWorktree() + const offline: Worktree = { ...awake, head: '', branch: '' } + + expect(visible([offline], {})).toEqual([offline.id]) + expect(visible([awake], {})).toEqual([awake.id]) + }) +}) diff --git a/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts b/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts index 0d27355c45a..317f0e6204e 100644 --- a/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts +++ b/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts @@ -38,6 +38,7 @@ function filterState(overrides: Partial = {}): FilterState { hideAutomationGeneratedWorkspaces: false, hideCliCreatedWorkspaces: false, hideDetachedHeadWorkspaces: false, + alwaysShowDefaultBranchWorkspace: true, workspaceHostScope: 'all', ...overrides } @@ -97,6 +98,17 @@ describe('sidebarHasActiveFilters', () => { expect(sidebarHasActiveFilters(filterState({ filterRepoIds: ['repo1'] }))).toBe(true) }) + it('counts an opted-out default-branch exemption as an active filter', () => { + expect(sidebarHasActiveFilters(filterState({ alwaysShowDefaultBranchWorkspace: false }))).toBe( + true + ) + }) + + it('treats a missing default-branch exemption as the default, not a filter', () => { + const { alwaysShowDefaultBranchWorkspace: _omitted, ...withoutFlag } = filterState() + expect(sidebarHasActiveFilters(withoutFlag)).toBe(false) + }) + it('returns true when only host visibility is narrowed', () => { expect(sidebarHasActiveFilters(filterState({ visibleWorkspaceHostIds: ['local'] }))).toBe(true) }) @@ -111,6 +123,7 @@ describe('computeClearFilterActions', () => { resetHideAutomationGeneratedWorkspaces: false, resetHideCliCreatedWorkspaces: false, resetHideDetachedHeadWorkspaces: false, + resetAlwaysShowDefaultBranchWorkspace: false, resetVisibleWorkspaceHostIds: false }) }) @@ -126,6 +139,7 @@ describe('computeClearFilterActions', () => { resetHideAutomationGeneratedWorkspaces: false, resetHideCliCreatedWorkspaces: false, resetHideDetachedHeadWorkspaces: false, + resetAlwaysShowDefaultBranchWorkspace: false, resetVisibleWorkspaceHostIds: false }) }) @@ -140,6 +154,7 @@ describe('computeClearFilterActions', () => { resetHideAutomationGeneratedWorkspaces: true, resetHideCliCreatedWorkspaces: false, resetHideDetachedHeadWorkspaces: false, + resetAlwaysShowDefaultBranchWorkspace: false, resetVisibleWorkspaceHostIds: false }) }) @@ -152,6 +167,7 @@ describe('computeClearFilterActions', () => { resetHideAutomationGeneratedWorkspaces: false, resetHideCliCreatedWorkspaces: true, resetHideDetachedHeadWorkspaces: false, + resetAlwaysShowDefaultBranchWorkspace: false, resetVisibleWorkspaceHostIds: false }) }) @@ -164,6 +180,7 @@ describe('computeClearFilterActions', () => { resetHideAutomationGeneratedWorkspaces: false, resetHideCliCreatedWorkspaces: false, resetHideDetachedHeadWorkspaces: true, + resetAlwaysShowDefaultBranchWorkspace: false, resetVisibleWorkspaceHostIds: false }) }) @@ -189,10 +206,26 @@ describe('computeClearFilterActions', () => { resetHideAutomationGeneratedWorkspaces: false, resetHideCliCreatedWorkspaces: false, resetHideDetachedHeadWorkspaces: false, + resetAlwaysShowDefaultBranchWorkspace: false, resetVisibleWorkspaceHostIds: true }) }) + it('flags only the default-branch exemption for reset when it is the sole filter', () => { + expect( + computeClearFilterActions(filterState({ alwaysShowDefaultBranchWorkspace: false })) + ).toEqual({ + resetShowSleepingWorkspaces: false, + resetFilterRepoIds: false, + resetHideDefaultBranchWorkspace: false, + resetHideAutomationGeneratedWorkspaces: false, + resetHideCliCreatedWorkspaces: false, + resetHideDetachedHeadWorkspaces: false, + resetAlwaysShowDefaultBranchWorkspace: true, + resetVisibleWorkspaceHostIds: false + }) + }) + it('flags every active filter simultaneously', () => { expect( computeClearFilterActions( @@ -211,6 +244,7 @@ describe('computeClearFilterActions', () => { resetHideAutomationGeneratedWorkspaces: true, resetHideCliCreatedWorkspaces: false, resetHideDetachedHeadWorkspaces: false, + resetAlwaysShowDefaultBranchWorkspace: false, resetVisibleWorkspaceHostIds: true }) }) diff --git a/src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.ts b/src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.ts index 15e3ec6de43..0e565018667 100644 --- a/src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.ts +++ b/src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.ts @@ -22,6 +22,7 @@ export function useVisibleWorkspaceKanbanWorktreeIds({ const hideAutomationGeneratedWorkspaces = useAppStore((s) => s.hideAutomationGeneratedWorkspaces) const hideCliCreatedWorkspaces = useAppStore((s) => s.hideCliCreatedWorkspaces) const hideDetachedHeadWorkspaces = useAppStore((s) => s.hideDetachedHeadWorkspaces) + const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace) const workspaceHostScope = useAppStore((s) => s.workspaceHostScope) const visibleWorkspaceHostIds = useAppStore((s) => s.visibleWorkspaceHostIds) const settings = useAppStore((s) => s.settings) @@ -61,6 +62,7 @@ export function useVisibleWorkspaceKanbanWorktreeIds({ hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces, hideDetachedHeadWorkspaces, + alwaysShowDefaultBranchWorkspace, repoMap, workspaceHostScope, visibleWorkspaceHostIds, @@ -79,6 +81,7 @@ export function useVisibleWorkspaceKanbanWorktreeIds({ hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces, hideDetachedHeadWorkspaces, + alwaysShowDefaultBranchWorkspace, workspaceHostScope, visibleWorkspaceHostIds, settings, diff --git a/src/renderer/src/components/sidebar/visible-worktrees.test.ts b/src/renderer/src/components/sidebar/visible-worktrees.test.ts index f54dcef60e7..ee212e44ec9 100644 --- a/src/renderer/src/components/sidebar/visible-worktrees.test.ts +++ b/src/renderer/src/components/sidebar/visible-worktrees.test.ts @@ -553,6 +553,69 @@ describe('computeVisibleWorktreeIds', () => { expect(result).toEqual([parent.id, child.id]) }) + it('gives a sleeping-exempt main its cached-sort slot, not a position at the end', () => { + // #8873: the exempted main enters `all` and is sorted with everyone else, + // so Cmd+1-9 numbers it where the sidebar actually renders it. + const awakeA = makeWorktree('awake-a') + const main = { ...makeWorktree('main'), isMainWorktree: true } + const awakeB = makeWorktree('awake-b') + + const options = { + showSleepingWorkspaces: false, + tabsByWorktree: { + [awakeA.id]: [makeTab('t-a', awakeA.id, 'p-a')], + [awakeB.id]: [makeTab('t-b', awakeB.id, 'p-b')] + }, + ptyIdsByTabId: { 't-a': ['p-a'], 't-b': ['p-b'] } + } + const byRepo = { repo1: [awakeA, main, awakeB] } + const sortedIds = [awakeA.id, main.id, awakeB.id] + + expect( + computeVisibleWorktreeIds( + byRepo, + sortedIds, + visibleOptions({ ...options, alwaysShowDefaultBranchWorkspace: true }) + ) + ).toEqual([awakeA.id, main.id, awakeB.id]) + + expect( + computeVisibleWorktreeIds( + byRepo, + sortedIds, + visibleOptions({ ...options, alwaysShowDefaultBranchWorkspace: false }) + ) + ).toEqual([awakeA.id, awakeB.id]) + }) + + it('leaves lineage ordering untouched when the exempted main is also a parent', () => { + // The parent used to arrive via addVisibleLineageAncestors and now arrives + // on its own; either way it must render immediately above its child. + const parent = { ...makeWorktree('parent'), isMainWorktree: true } + const child = makeWorktree('child') + const sibling = makeWorktree('sibling') + const lineage = makeWorktreeLineage(child, parent) + + const run = (alwaysShowDefaultBranchWorkspace: boolean): string[] => + computeVisibleWorktreeIds( + { repo1: [parent, child, sibling] }, + [sibling.id, child.id, parent.id], + visibleOptions({ + showSleepingWorkspaces: false, + alwaysShowDefaultBranchWorkspace, + tabsByWorktree: { + [child.id]: [makeTab('t-child', child.id, 'p-child')], + [sibling.id]: [makeTab('t-sib', sibling.id, 'p-sib')] + }, + ptyIdsByTabId: { 't-child': ['p-child'], 't-sib': ['p-sib'] }, + worktreeLineageById: { [child.id]: lineage } + }) + ) + + expect(run(true)).toEqual([sibling.id, parent.id, child.id]) + expect(run(false)).toEqual(run(true)) + }) + it('includes a filtered parent from resolved inline lineage when hydration has no side-map entry', () => { const parent = makeWorktree('parent') const child = makeWorktree('child') diff --git a/src/renderer/src/components/sidebar/visible-worktrees.ts b/src/renderer/src/components/sidebar/visible-worktrees.ts index 9c44d8587e3..10aa72bcf1f 100644 --- a/src/renderer/src/components/sidebar/visible-worktrees.ts +++ b/src/renderer/src/components/sidebar/visible-worktrees.ts @@ -35,6 +35,25 @@ export function isDefaultBranchWorkspace(worktree: Worktree): boolean { return worktree.isMainWorktree && worktree.branch.trim() !== '' } +/** + * Whether the "Hide sleeping" sweep must keep this row (#8873). + * + * Why isMainWorktree and not isDefaultBranchWorkspace: the project's primary + * checkout is the repo's only guaranteed entry point. Folder workspaces and + * detached-HEAD mains fail the default-branch predicate yet often have no + * sibling row at all, so sweeping them drops the entire project out of the + * sidebar, Cmd+J and the board with no way back except changing a filter. + * + * Why shared: the sidebar pipeline and the jump palette both apply this, and a + * second copy is how the two surfaces drift. + */ +export function isSleepingSweepExemptWorkspace( + worktree: Worktree, + alwaysShowDefaultBranchWorkspace: boolean | undefined +): boolean { + return alwaysShowDefaultBranchWorkspace !== false && worktree.isMainWorktree +} + export function isAutomationGeneratedWorkspace(worktree: Worktree): boolean { return worktree.automationProvenance?.kind === 'created-by-automation' } @@ -63,6 +82,8 @@ export type SidebarFilterState = { hideAutomationGeneratedWorkspaces: boolean hideCliCreatedWorkspaces: boolean hideDetachedHeadWorkspaces: boolean + /** Keeps each project's main workspace out of the "Hide sleeping" sweep; absent means on. */ + alwaysShowDefaultBranchWorkspace?: boolean visibleWorkspaceHostIds?: readonly ExecutionHostId[] | null workspaceHostScope?: ExecutionHostScope } @@ -84,6 +105,9 @@ export function sidebarHasActiveFilters(state: SidebarFilterState): boolean { state.hideAutomationGeneratedWorkspaces || state.hideCliCreatedWorkspaces || state.hideDetachedHeadWorkspaces || + // Why: turning this off is the only way to narrow the list below the + // default, so Clear Filters must be able to undo it like any other filter. + state.alwaysShowDefaultBranchWorkspace === false || state.visibleWorkspaceHostIds != null || (state.workspaceHostScope != null && state.workspaceHostScope !== ALL_EXECUTION_HOSTS_SCOPE) ) @@ -98,6 +122,7 @@ export type ClearFilterActions = { resetHideAutomationGeneratedWorkspaces: boolean resetHideCliCreatedWorkspaces: boolean resetHideDetachedHeadWorkspaces: boolean + resetAlwaysShowDefaultBranchWorkspace: boolean resetVisibleWorkspaceHostIds: boolean } @@ -119,6 +144,7 @@ export function computeClearFilterActions(state: SidebarFilterState): ClearFilte resetHideAutomationGeneratedWorkspaces: state.hideAutomationGeneratedWorkspaces, resetHideCliCreatedWorkspaces: state.hideCliCreatedWorkspaces, resetHideDetachedHeadWorkspaces: state.hideDetachedHeadWorkspaces, + resetAlwaysShowDefaultBranchWorkspace: state.alwaysShowDefaultBranchWorkspace === false, resetVisibleWorkspaceHostIds: state.visibleWorkspaceHostIds != null || (state.workspaceHostScope != null && state.workspaceHostScope !== ALL_EXECUTION_HOSTS_SCOPE) @@ -155,6 +181,11 @@ export function computeVisibleWorktreeIds( hideAutomationGeneratedWorkspaces: boolean hideCliCreatedWorkspaces: boolean hideDetachedHeadWorkspaces: boolean + // Why optional here, against the "why required" rule above: omitting it + // must fail *open*. A caller that forgets the flag then shows an extra row + // instead of silently re-hiding the project's entry point, which is the + // exact regression #8873 reports. + alwaysShowDefaultBranchWorkspace?: boolean repoMap: Map workspaceHostScope: ExecutionHostScope visibleWorkspaceHostIds?: readonly ExecutionHostId[] | null @@ -211,8 +242,11 @@ export function computeVisibleWorktreeIds( } if (!opts.showSleepingWorkspaces) { + // Why no !hideDefaultBranchWorkspace term: that filter already ran above, so + // an explicit hide still wins over the exemption. all = all.filter( (w) => + isSleepingSweepExemptWorkspace(w, opts.alwaysShowDefaultBranchWorkspace) || !isInactiveWorkspace( w.id, opts.tabsByWorktree, @@ -370,6 +404,7 @@ export function getVisibleWorktreeIds(): string[] { hideAutomationGeneratedWorkspaces: state.hideAutomationGeneratedWorkspaces, hideCliCreatedWorkspaces: state.hideCliCreatedWorkspaces, hideDetachedHeadWorkspaces: state.hideDetachedHeadWorkspaces, + alwaysShowDefaultBranchWorkspace: state.alwaysShowDefaultBranchWorkspace, repoMap, workspaceHostScope: state.workspaceHostScope, visibleWorkspaceHostIds: state.visibleWorkspaceHostIds, diff --git a/src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts b/src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts new file mode 100644 index 00000000000..05ac5130e36 --- /dev/null +++ b/src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts @@ -0,0 +1,69 @@ +import { readFileSync } from 'node:fs' +import { join } from 'node:path' +import { describe, expect, it } from 'vitest' +import { isSleepingSweepExemptWorkspace } from './sidebar/visible-worktrees' +import type { Worktree } from '../../../shared/types' + +const source = readFileSync(join(__dirname, 'WorktreeJumpPalette.tsx'), 'utf8') + +function makeWorktree(overrides: Partial = {}): Worktree { + return { + id: 'wt-main', + repoId: 'repo1', + path: '/tmp/repo1', + head: 'abc123', + branch: 'refs/heads/main', + isBare: false, + isMainWorktree: true, + displayName: 'main', + comment: '', + linkedIssue: null, + linkedPR: null, + linkedLinearIssue: null, + isArchived: false, + isUnread: false, + isPinned: false, + sortOrder: 0, + lastActivityAt: 0, + ...overrides + } +} + +describe('Cmd+J empty-query "Hide sleeping" pass (#8873)', () => { + // Why source-level: the palette re-implements the sidebar's filter pass + // inline, so the only structural guarantee that the two agree is that both + // call the shared predicate. A behavioral copy here would not catch a + // hand-rolled duplicate creeping back in. + it('routes the sleeping sweep through the shared exemption predicate', () => { + const start = source.indexOf('const emptyQueryVisibleWorktrees = useMemo(') + expect(start).toBeGreaterThanOrEqual(0) + const end = source.indexOf('const { visibleWorktreesForState', start) + const filterPass = source.slice(start, end) + + expect(filterPass).toContain( + '!isSleepingSweepExemptWorkspace(worktree, alwaysShowDefaultBranchWorkspace)' + ) + expect(filterPass).toContain('alwaysShowDefaultBranchWorkspace,') + }) + + it('reads the flag from the same store field the sidebar uses', () => { + expect(source).toContain( + 'const alwaysShowDefaultBranchWorkspace = useAppStore((s) => s.alwaysShowDefaultBranchWorkspace)' + ) + }) + + it('exempts a project entry point by default and honours an explicit opt-out', () => { + const main = makeWorktree() + + expect(isSleepingSweepExemptWorkspace(main, undefined)).toBe(true) + expect(isSleepingSweepExemptWorkspace(main, true)).toBe(true) + expect(isSleepingSweepExemptWorkspace(main, false)).toBe(false) + }) + + it('never exempts a non-main workspace', () => { + const feature = makeWorktree({ id: 'wt-feature', isMainWorktree: false }) + + expect(isSleepingSweepExemptWorkspace(feature, true)).toBe(false) + expect(isSleepingSweepExemptWorkspace(feature, undefined)).toBe(false) + }) +}) diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json index d0511b2ca4e..7b55bf13367 100644 --- a/src/renderer/src/i18n/locales/en.json +++ b/src/renderer/src/i18n/locales/en.json @@ -4309,7 +4309,9 @@ "ee240a39eb": "Edit filters", "automationCreated": "Hide automation-created", "cliCreated": "Hide CLI-created", - "detachedHead": "Hide detached HEAD" + "detachedHead": "Hide detached HEAD", + "keepDefaultBranch": "Except default branch", + "keepDefaultBranchAria": "Keep the default branch visible while hiding sleeping workspaces" }, "SidebarHeader": { "25a95899c9": "Add Project", @@ -4374,7 +4376,9 @@ "82594419ba": "Filters", "automationCreated": "Hide automation-created", "cliCreated": "Hide CLI-created", - "detachedHead": "Hide detached HEAD" + "detachedHead": "Hide detached HEAD", + "keepDefaultBranch": "Except default branch", + "keepDefaultBranchAria": "Keep the default branch visible while hiding sleeping workspaces" }, "sidebarHostOptions": { "3e102f111c": "All hosts", diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json index 9797580ad75..904beaa9d16 100644 --- a/src/renderer/src/i18n/locales/es.json +++ b/src/renderer/src/i18n/locales/es.json @@ -4227,7 +4227,9 @@ "ee240a39eb": "Editar filtros", "automationCreated": "Ocultar creados por automatizaciones", "cliCreated": "Hide CLI-created", - "detachedHead": "Ocultar HEAD desacoplado" + "detachedHead": "Ocultar HEAD desacoplado", + "keepDefaultBranch": "Excepto la rama predeterminada", + "keepDefaultBranchAria": "Mantener visible la rama predeterminada al ocultar los espacios de trabajo en reposo" }, "SidebarHeader": { "92154beb7e": "Nuevo espacio de trabajo", @@ -4292,7 +4294,9 @@ "82594419ba": "Filtros", "automationCreated": "Ocultar creados por automatizaciones", "cliCreated": "Hide CLI-created", - "detachedHead": "Ocultar HEAD desacoplado" + "detachedHead": "Ocultar HEAD desacoplado", + "keepDefaultBranch": "Excepto la rama predeterminada", + "keepDefaultBranchAria": "Mantener visible la rama predeterminada al ocultar los espacios de trabajo en reposo" }, "SidebarWorkspaceOptionsMenu": { "95c9754653": "Diseño de actividad del Agent", diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json index eab737f2541..3d5f8588d72 100644 --- a/src/renderer/src/i18n/locales/ja.json +++ b/src/renderer/src/i18n/locales/ja.json @@ -4208,7 +4208,9 @@ "ee240a39eb": "フィルターの編集", "automationCreated": "自動化で作成されたワークスペースを非表示", "cliCreated": "Hide CLI-created", - "detachedHead": "分離HEADを非表示" + "detachedHead": "分離HEADを非表示", + "keepDefaultBranch": "デフォルトのブランチを除く", + "keepDefaultBranchAria": "スリープ中のワークスペースを非表示にしてもデフォルトのブランチは表示したままにする" }, "SidebarHeader": { "92154beb7e": "新規ワークスペース", @@ -4273,7 +4275,9 @@ "82594419ba": "フィルター", "automationCreated": "自動化で作成されたワークスペースを非表示", "cliCreated": "Hide CLI-created", - "detachedHead": "分離HEADを非表示" + "detachedHead": "分離HEADを非表示", + "keepDefaultBranch": "デフォルトのブランチを除く", + "keepDefaultBranchAria": "スリープ中のワークスペースを非表示にしてもデフォルトのブランチは表示したままにする" }, "SidebarWorkspaceOptionsMenu": { "95c9754653": "Agent アクティビティのレイアウト", diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json index 6e49c537664..aa4bc49ce93 100644 --- a/src/renderer/src/i18n/locales/ko.json +++ b/src/renderer/src/i18n/locales/ko.json @@ -4208,7 +4208,9 @@ "ee240a39eb": "필터 편집", "automationCreated": "자동화로 생성된 워크스페이스 숨기기", "cliCreated": "Hide CLI-created", - "detachedHead": "분리된 HEAD 숨기기" + "detachedHead": "분리된 HEAD 숨기기", + "keepDefaultBranch": "기본 브랜치는 제외", + "keepDefaultBranchAria": "슬립 중인 워크스페이스를 숨겨도 기본 브랜치는 계속 표시" }, "SidebarHeader": { "92154beb7e": "새로운 워크스페이스", @@ -4273,7 +4275,9 @@ "82594419ba": "필터", "automationCreated": "자동화로 생성된 워크스페이스 숨기기", "cliCreated": "Hide CLI-created", - "detachedHead": "분리된 HEAD 숨기기" + "detachedHead": "분리된 HEAD 숨기기", + "keepDefaultBranch": "기본 브랜치는 제외", + "keepDefaultBranchAria": "슬립 중인 워크스페이스를 숨겨도 기본 브랜치는 계속 표시" }, "SidebarWorkspaceOptionsMenu": { "95c9754653": "Agent 활동 레이아웃", diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json index 10f601cfed2..05a13abd266 100644 --- a/src/renderer/src/i18n/locales/zh.json +++ b/src/renderer/src/i18n/locales/zh.json @@ -4220,7 +4220,9 @@ "ee240a39eb": "编辑筛选条件", "automationCreated": "隐藏自动化创建的工作区", "cliCreated": "Hide CLI-created", - "detachedHead": "隐藏分离 HEAD" + "detachedHead": "隐藏分离 HEAD", + "keepDefaultBranch": "默认分支除外", + "keepDefaultBranchAria": "隐藏休眠工作区时仍显示默认分支" }, "SidebarHeader": { "92154beb7e": "新工作区", @@ -4285,7 +4287,9 @@ "82594419ba": "筛选条件", "automationCreated": "隐藏自动化创建的工作区", "cliCreated": "Hide CLI-created", - "detachedHead": "隐藏分离 HEAD" + "detachedHead": "隐藏分离 HEAD", + "keepDefaultBranch": "默认分支除外", + "keepDefaultBranchAria": "隐藏休眠工作区时仍显示默认分支" }, "SidebarWorkspaceOptionsMenu": { "95c9754653": "智能体活动布局", diff --git a/src/renderer/src/lib/startup-ui-hydration.ts b/src/renderer/src/lib/startup-ui-hydration.ts index 6daa375c8ed..aeb14f9c73e 100644 --- a/src/renderer/src/lib/startup-ui-hydration.ts +++ b/src/renderer/src/lib/startup-ui-hydration.ts @@ -51,6 +51,7 @@ export function getStartupErrorFallbackUI(uiHydrated: boolean): PersistedUIState hideDefaultBranchWorkspace: false, hideCliCreatedWorkspaces: false, hideDetachedHeadWorkspaces: false, + alwaysShowDefaultBranchWorkspace: true, hideAutomationGeneratedWorkspaces: false, filterRepoIds: [], collapsedGroups: [], diff --git a/src/renderer/src/store/slices/ui.test.ts b/src/renderer/src/store/slices/ui.test.ts index 2e0e48546e2..dbd81acee9f 100644 --- a/src/renderer/src/store/slices/ui.test.ts +++ b/src/renderer/src/store/slices/ui.test.ts @@ -721,6 +721,33 @@ describe('createUISlice hydratePersistedUI', () => { expect(store.getState().showSleepingWorkspaces).toBe(true) }) + it('defaults the default-branch sleeping exemption to on', () => { + expect(getDefaultUIState().alwaysShowDefaultBranchWorkspace).toBe(true) + expect(createUIStore().getState().alwaysShowDefaultBranchWorkspace).toBe(true) + }) + + it('treats a legacy profile with no default-branch exemption key as opted in', () => { + // Why: profiles written before #8873 are exactly the ones showing the bug, + // so an absent key must hydrate to on rather than silently re-hiding main. + const store = createUIStore() + const legacy = makePersistedUI() + delete (legacy as Partial).alwaysShowDefaultBranchWorkspace + + store.getState().hydratePersistedUI(legacy, 'startup') + + expect(store.getState().alwaysShowDefaultBranchWorkspace).toBe(true) + }) + + it('preserves an explicit default-branch exemption opt-out on hydration', () => { + const store = createUIStore() + + store + .getState() + .hydratePersistedUI(makePersistedUI({ alwaysShowDefaultBranchWorkspace: false }), 'startup') + + expect(store.getState().alwaysShowDefaultBranchWorkspace).toBe(false) + }) + it('defaults workspace host scope to all hosts', () => { expect(getDefaultUIState().workspaceHostScope).toBe('all') expect(createUIStore().getState().workspaceHostScope).toBe('all') diff --git a/src/renderer/src/store/slices/ui.ts b/src/renderer/src/store/slices/ui.ts index 625a8e9aba0..d926a100f2f 100644 --- a/src/renderer/src/store/slices/ui.ts +++ b/src/renderer/src/store/slices/ui.ts @@ -875,6 +875,8 @@ export type UISlice = { setHideCliCreatedWorkspaces: (v: boolean) => void hideDetachedHeadWorkspaces: boolean setHideDetachedHeadWorkspaces: (v: boolean) => void + alwaysShowDefaultBranchWorkspace: boolean + setAlwaysShowDefaultBranchWorkspace: (v: boolean) => void showDotfilesByWorktree: Record setShowDotfilesForWorktree: (worktreeId: string, showDotfiles: boolean) => void toggleShowDotfilesForWorktree: (worktreeId: string) => void @@ -2053,6 +2055,8 @@ export const createUISlice: StateCreator = (set, get) setHideCliCreatedWorkspaces: (v) => set({ hideCliCreatedWorkspaces: v }), hideDetachedHeadWorkspaces: false, setHideDetachedHeadWorkspaces: (v) => set({ hideDetachedHeadWorkspaces: v }), + alwaysShowDefaultBranchWorkspace: true, + setAlwaysShowDefaultBranchWorkspace: (v) => set({ alwaysShowDefaultBranchWorkspace: v }), showDotfilesByWorktree: {}, setShowDotfilesForWorktree: (worktreeId, showDotfiles) => @@ -2459,6 +2463,9 @@ export const createUISlice: StateCreator = (set, get) hideAutomationGeneratedWorkspaces: ui.hideAutomationGeneratedWorkspaces === true, hideCliCreatedWorkspaces: ui.hideCliCreatedWorkspaces === true, hideDetachedHeadWorkspaces: ui.hideDetachedHeadWorkspaces === true, + // Why !== false: profiles written before #8873 have no key, and they are + // precisely the ones showing the bug, so absence must mean "exempt". + alwaysShowDefaultBranchWorkspace: ui.alwaysShowDefaultBranchWorkspace !== false, showDotfilesByWorktree: sanitizeShowDotfilesByWorktree(ui.showDotfilesByWorktree), // Why: startup hydrates UI before repo catalogs, so defer repo-filter validation to the all-host refresh. filterRepoIds: diff --git a/src/shared/constants.ts b/src/shared/constants.ts index 9645d3ba3b6..80fca73c828 100644 --- a/src/shared/constants.ts +++ b/src/shared/constants.ts @@ -479,6 +479,7 @@ export function getDefaultUIState(): PersistedUIState { hideAutomationGeneratedWorkspaces: false, hideCliCreatedWorkspaces: false, hideDetachedHeadWorkspaces: false, + alwaysShowDefaultBranchWorkspace: true, showDotfilesByWorktree: {}, filterRepoIds: [], collapsedGroups: [], diff --git a/src/shared/types.ts b/src/shared/types.ts index b4e1a243242..1ba5aeb7919 100644 --- a/src/shared/types.ts +++ b/src/shared/types.ts @@ -3396,6 +3396,8 @@ export type PersistedUIState = { hideCliCreatedWorkspaces?: boolean /** Hide workspaces sitting on a detached HEAD; folder workspaces (no head at all) are unaffected. */ hideDetachedHeadWorkspaces?: boolean + /** Keep each project's main workspace out of the "Hide sleeping" sweep. Absent means on (#8873). */ + alwaysShowDefaultBranchWorkspace?: boolean /** Per-worktree Explorer dotfile visibility. Missing entries inherit the default: show. */ showDotfilesByWorktree?: Record filterRepoIds: string[] diff --git a/tests/e2e/default-branch-visibility.spec.ts b/tests/e2e/default-branch-visibility.spec.ts new file mode 100644 index 00000000000..166dc419431 --- /dev/null +++ b/tests/e2e/default-branch-visibility.spec.ts @@ -0,0 +1,165 @@ +/** + * Regression #8873: with "Hide sleeping" on, the project's main workspace must + * stay in the sidebar — it is the only guaranteed way back into the project — + * while a sleeping feature workspace is still swept. + */ + +import type { Page } from '@stablyai/playwright-test' +import { test, expect } from './helpers/orca-app' +import { waitForActiveWorktree, waitForSessionReady } from './helpers/store' +import { worktreeRow } from './worktree-row-locators' + +type SidebarVisibilityScenario = { + defaultBranchId: string + featureId: string +} + +async function seedSidebarVisibilityScenario(page: Page): Promise { + return page.evaluate(() => { + const store = window.__store + if (!store) { + throw new Error('window.__store is not available') + } + + const state = store.getState() + const repo = state.repos[0] + if (!repo) { + throw new Error('Sidebar visibility E2E needs a seeded repo') + } + + const currentWorktree = (state.worktreesByRepo[repo.id] ?? [])[0] + if (!currentWorktree) { + throw new Error('Sidebar visibility E2E needs a seeded worktree') + } + + const defaultBranchId = 'e2e-default-branch-visibility-main' + const featureId = 'e2e-default-branch-visibility-feature' + const currentId = currentWorktree.id + + store.setState((current) => ({ + worktreesByRepo: { + ...current.worktreesByRepo, + [repo.id]: [ + { + ...currentWorktree, + id: currentId, + displayName: 'Current workspace', + isMainWorktree: false, + branch: 'refs/heads/current', + lastActivityAt: 3 + }, + { + ...currentWorktree, + id: defaultBranchId, + displayName: 'Default branch workspace', + isMainWorktree: true, + branch: 'refs/heads/main', + lastActivityAt: 2 + }, + { + ...currentWorktree, + id: featureId, + displayName: 'Feature workspace', + isMainWorktree: false, + branch: 'refs/heads/feature', + lastActivityAt: 1 + } + ] + }, + tabsByWorktree: { + ...current.tabsByWorktree, + [defaultBranchId]: [], + [featureId]: [] + }, + browserTabsByWorktree: { + ...current.browserTabsByWorktree, + [defaultBranchId]: [], + [featureId]: [] + } + })) + + const nextState = store.getState() + nextState.setActiveView('terminal') + nextState.setSidebarOpen(true) + nextState.setGroupBy('none') + nextState.setSortBy('recent') + nextState.setShowActiveOnly(false) + nextState.setFilterRepoIds([]) + + return { defaultBranchId, featureId } + }) +} + +test.describe('Default branch visibility', () => { + test.beforeEach(async ({ orcaPage }) => { + await waitForSessionReady(orcaPage) + await waitForActiveWorktree(orcaPage) + }) + + test('keeps the default branch visible when sleeping workspaces are hidden', async ({ + orcaPage + }) => { + const { defaultBranchId, featureId } = await seedSidebarVisibilityScenario(orcaPage) + const defaultBranchRow = worktreeRow(orcaPage, defaultBranchId) + const featureRow = worktreeRow(orcaPage, featureId) + + // Poll rather than set once: hydration can land after the seed and reset the filters. + await expect + .poll(() => + orcaPage.evaluate( + ({ defaultBranchId, featureId }) => { + const state = window.__store?.getState() + state?.setShowSleepingWorkspaces(false) + state?.setHideDefaultBranchWorkspace(false) + state?.setAlwaysShowDefaultBranchWorkspace(true) + const featureTabs = state?.tabsByWorktree[featureId] ?? [] + return { + alwaysShowDefaultBranchWorkspace: state?.alwaysShowDefaultBranchWorkspace ?? null, + defaultBranchTabs: state?.tabsByWorktree[defaultBranchId]?.length ?? 0, + featureBrowserTabs: state?.browserTabsByWorktree[featureId]?.length ?? 0, + featureHasLivePty: featureTabs.some( + (tab) => (state?.ptyIdsByTabId[tab.id] ?? []).length > 0 + ), + featureTabs: featureTabs.length, + hideDefaultBranchWorkspace: state?.hideDefaultBranchWorkspace ?? null, + showSleepingWorkspaces: state?.showSleepingWorkspaces ?? null + } + }, + { defaultBranchId, featureId } + ) + ) + .toEqual({ + alwaysShowDefaultBranchWorkspace: true, + defaultBranchTabs: 0, + featureBrowserTabs: 0, + featureHasLivePty: false, + featureTabs: 0, + hideDefaultBranchWorkspace: false, + showSleepingWorkspaces: false + }) + + await expect(defaultBranchRow).toBeVisible() + await expect(defaultBranchRow).toContainText('Default branch workspace') + await expect(featureRow).toHaveCount(0) + + // Opting out of the exemption is the only way back to the pre-#8873 sweep. + await orcaPage.evaluate(() => { + window.__store?.getState().setAlwaysShowDefaultBranchWorkspace(false) + }) + + await expect(defaultBranchRow).toHaveCount(0) + + await orcaPage.evaluate(() => { + window.__store?.getState().setAlwaysShowDefaultBranchWorkspace(true) + }) + + await expect(defaultBranchRow).toBeVisible() + + // The explicit hide filter still outranks the exemption. + await orcaPage.evaluate(() => { + window.__store?.getState().setHideDefaultBranchWorkspace(true) + }) + + await expect(defaultBranchRow).toHaveCount(0) + }) +}) From dc0cb1806a376216ff8015ccead50e16265b3348 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=99=B8=EA=B3=84=EA=B3=B5=EB=A3=A1?= <56211193+chucoding@users.noreply.github.com> Date: Tue, 4 Aug 2026 15:00:02 +0900 Subject: [PATCH 09/72] feat(repo-icon): expand the project emoji picker (#7989) (#12058) Replace the hardcoded 12-emoji grid in the repo icon settings with the full searchable, category-navigable emoji picker, reusing the existing emoji-picker-react dependency in a lazily-loaded chunk. Every pick is re-validated through sanitizeRepoIcon, so an over-cap ZWJ/skin-tone sequence surfaces a toast instead of silently no-op'ing. Skin tones stay selectable. Maintainer follow-up: use lazyWithRetry so a failed chunk cannot permanently blank the Settings page, disable autoFocusSearch on this inline picker, scope font-family to descendants (the library sets sans-serif on every child), cover the uncovered dark-mode picker variables, match the app scrollbar, and assert the result in the DOM per tests/e2e/AGENTS.md. New strings are translated in es/ja/ko/zh. Co-authored-by: chucoding --- src/renderer/src/assets/main.css | 24 ++++ .../RepositoryIconEmojiPicker.test.tsx | 129 ++++++++++++++++++ .../settings/RepositoryIconEmojiPicker.tsx | 76 +++++++++++ .../settings/RepositoryIconTabs.tsx | 34 ++--- src/renderer/src/i18n/locales/en.json | 5 +- src/renderer/src/i18n/locales/es.json | 5 +- src/renderer/src/i18n/locales/ja.json | 5 +- src/renderer/src/i18n/locales/ko.json | 5 +- src/renderer/src/i18n/locales/zh.json | 5 +- tests/e2e/repo-icon-emoji-picker.spec.ts | 80 +++++++++++ 10 files changed, 343 insertions(+), 25 deletions(-) create mode 100644 src/renderer/src/components/settings/RepositoryIconEmojiPicker.test.tsx create mode 100644 src/renderer/src/components/settings/RepositoryIconEmojiPicker.tsx create mode 100644 tests/e2e/repo-icon-emoji-picker.spec.ts diff --git a/src/renderer/src/assets/main.css b/src/renderer/src/assets/main.css index 47d81257dde..85d6a2c116a 100644 --- a/src/renderer/src/assets/main.css +++ b/src/renderer/src/assets/main.css @@ -1648,6 +1648,30 @@ html.native-shell .app-layout { animation: settings-shell-enter 180ms ease-out; } +.repo-icon-emoji-picker .EmojiPickerReact { + --epr-bg-color: var(--card); + --epr-category-label-bg-color: var(--card); + --epr-text-color: var(--card-foreground); + --epr-search-input-bg-color: var(--input); + --epr-search-input-bg-color-active: var(--input); + --epr-search-border-color: var(--border); + --epr-search-border-color-active: var(--ring); + --epr-hover-bg-color: var(--accent); + --epr-highlight-color: var(--ring); + --epr-picker-border-color: var(--border); + border: none; +} + +/* The library sets `font-family: sans-serif` on every descendant, so inheriting from the root never lands. */ +.repo-icon-emoji-picker .EmojiPickerReact * { + font-family: var(--font-sans); +} + +.repo-icon-emoji-picker .epr-body { + scrollbar-width: thin; + scrollbar-color: color-mix(in srgb, var(--muted-foreground, #737373) 34%, transparent) transparent; +} + .collapsible-height-content { overflow: hidden; } diff --git a/src/renderer/src/components/settings/RepositoryIconEmojiPicker.test.tsx b/src/renderer/src/components/settings/RepositoryIconEmojiPicker.test.tsx new file mode 100644 index 00000000000..da0292e631b --- /dev/null +++ b/src/renderer/src/components/settings/RepositoryIconEmojiPicker.test.tsx @@ -0,0 +1,129 @@ +// @vitest-environment happy-dom + +import { act } from 'react' +import { createRoot, type Root } from 'react-dom/client' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import type { AppState } from '@/store' +import { RepositoryIconEmojiPicker } from './RepositoryIconEmojiPicker' + +const toastMocks = vi.hoisted(() => ({ + error: vi.fn() +})) + +vi.mock('sonner', () => ({ + toast: { error: toastMocks.error } +})) + +// Mock store exposing only the theme value, to verify the minimal-selector subscription. +const storeMocks = vi.hoisted(() => ({ + state: { settings: { theme: 'light' } } as Partial +})) + +vi.mock('@/store', () => ({ + useAppStore: (selector: (state: Partial) => unknown) => selector(storeMocks.state) +})) + +vi.mock('@/components/terminal-pane/use-system-prefers-dark', () => ({ + useSystemPrefersDark: () => false +})) + +/** Signature of the onEmojiClick callback captured by the emoji-picker-react mock. */ +type MockEmojiClickHandler = (data: { emoji: string }) => void + +const emojiPickerMocks = vi.hoisted(() => ({ + onEmojiClick: null as MockEmojiClickHandler | null, + searchPlaceholder: null as string | null +})) + +vi.mock('emoji-picker-react', () => ({ + __esModule: true, + default: (props: { onEmojiClick: MockEmojiClickHandler; searchPlaceholder: string }) => { + emojiPickerMocks.onEmojiClick = props.onEmojiClick + emojiPickerMocks.searchPlaceholder = props.searchPlaceholder + return null + }, + EmojiStyle: { NATIVE: 'native' }, + Theme: { DARK: 'dark', LIGHT: 'light' } +})) + +let container: HTMLDivElement +let root: Root + +/** Renders RepositoryIconEmojiPicker with default props and returns the spy callback. */ +function renderPicker(overrides: Partial[0]> = {}) { + const onSetIcon = vi.fn() + act(() => { + root.render() + }) + return { onSetIcon } +} + +describe('RepositoryIconEmojiPicker', () => { + beforeEach(() => { + container = document.createElement('div') + document.body.appendChild(container) + root = createRoot(container) + emojiPickerMocks.onEmojiClick = null + emojiPickerMocks.searchPlaceholder = null + toastMocks.error.mockReset() + }) + + afterEach(() => { + act(() => root.unmount()) + container.remove() + document.body.replaceChildren() + }) + + it('renders the full native emoji picker in place of the static grid', () => { + renderPicker() + expect(emojiPickerMocks.onEmojiClick).not.toBeNull() + expect(emojiPickerMocks.searchPlaceholder).toBe('Search emoji') + expect(container.querySelector('.repo-icon-emoji-picker')).not.toBeNull() + }) + + it('saves a valid emoji click through the existing RepoIcon contract', () => { + const { onSetIcon } = renderPicker() + act(() => { + emojiPickerMocks.onEmojiClick?.({ emoji: '🚀' }) + }) + expect(onSetIcon).toHaveBeenCalledExactlyOnceWith({ type: 'emoji', emoji: '🚀' }) + expect(toastMocks.error).not.toHaveBeenCalled() + }) + + it('rejects an emoji sequence over the sanitizeRepoIcon 16-char cap instead of silently dropping it', () => { + const { onSetIcon } = renderPicker() + // Two ZWJ family sequences back to back: valid codepoints, well over 16 UTF-16 units. + const overlong = '👨‍👩‍👧‍👦👨‍👩‍👧‍👦' + expect(overlong.length).toBeGreaterThan(16) + + act(() => { + emojiPickerMocks.onEmojiClick?.({ emoji: overlong }) + }) + + expect(onSetIcon).not.toHaveBeenCalled() + expect(toastMocks.error).toHaveBeenCalledTimes(1) + }) + + // Guards the skinTonesDisabled removal: skin-toned picks must save like any other emoji, not be blocked. + it('saves a valid skin-tone emoji selection instead of blocking it for global inclusivity', () => { + const { onSetIcon } = renderPicker() + // Base emoji + skin-tone modifier: well within the 16 UTF-16 unit cap. + const thumbsUpMediumSkinTone = '👍🏽' + expect(thumbsUpMediumSkinTone.length).toBeLessThanOrEqual(16) + + act(() => { + emojiPickerMocks.onEmojiClick?.({ emoji: thumbsUpMediumSkinTone }) + }) + + expect(onSetIcon).toHaveBeenCalledExactlyOnceWith({ + type: 'emoji', + emoji: thumbsUpMediumSkinTone + }) + expect(toastMocks.error).not.toHaveBeenCalled() + }) + + it('shows the currently selected emoji as trailing metadata', () => { + renderPicker({ selectedEmoji: '🎨' }) + expect(container.textContent).toContain('🎨') + }) +}) diff --git a/src/renderer/src/components/settings/RepositoryIconEmojiPicker.tsx b/src/renderer/src/components/settings/RepositoryIconEmojiPicker.tsx new file mode 100644 index 00000000000..9a97d07fbf6 --- /dev/null +++ b/src/renderer/src/components/settings/RepositoryIconEmojiPicker.tsx @@ -0,0 +1,76 @@ +import { toast } from 'sonner' +import EmojiPicker, { EmojiStyle, Theme, type EmojiClickData } from 'emoji-picker-react' +import type { RepoIcon } from '../../../../shared/repo-icon' +import { sanitizeRepoIcon } from '../../../../shared/repo-icon' +import { useAppStore } from '../../store' +import { useSystemPrefersDark } from '@/components/terminal-pane/use-system-prefers-dark' +import { translate } from '@/i18n/i18n' + +type RepositoryIconEmojiPickerProps = { + selectedEmoji: string + onSetIcon: (repoIcon: RepoIcon | null) => void +} + +/** + * Full native emoji picker for the repo icon "Emoji" tab. Kept in its own + * module (lazy-loaded by RepositoryIconTabs) so emoji-picker-react's ~500KB + * chunk only loads once this tab actually renders. + */ +export function RepositoryIconEmojiPicker({ + selectedEmoji, + onSetIcon +}: RepositoryIconEmojiPickerProps): React.JSX.Element { + // Minimal selector: only the theme string is needed; default to system before settings load. + const settingsTheme = useAppStore((state) => state.settings?.theme ?? 'system') + const systemPrefersDark = useSystemPrefersDark() + // Theme.AUTO only follows the OS setting, which can disagree with Orca's manual theme. + const isDarkTheme = settingsTheme === 'dark' || (settingsTheme === 'system' && systemPrefersDark) + + /** Saves the picked emoji, rejecting anything over sanitizeRepoIcon's 16-char cap. */ + const handleEmojiClick = (emojiData: EmojiClickData): void => { + // ZWJ/skin-tone sequences can exceed the 16-char cap even without skinTonesDisabled. + const repoIcon = sanitizeRepoIcon({ type: 'emoji', emoji: emojiData.emoji }) + if (!repoIcon) { + toast.error( + translate( + 'auto.components.settings.RepositoryIconPicker.emojiTooLongForRepoIcon', + "This emoji can't be used as a repo icon." + ) + ) + return + } + onSetIcon(repoIcon) + } + + return ( + <> +
+ +
+ {selectedEmoji ? ( +

+ {translate( + 'auto.components.settings.RepositoryIconPicker.currentEmojiSelection', + 'Current: {{value0}}', + { value0: selectedEmoji } + )} +

+ ) : null} + + ) +} diff --git a/src/renderer/src/components/settings/RepositoryIconTabs.tsx b/src/renderer/src/components/settings/RepositoryIconTabs.tsx index d0507a89db4..1d695da6085 100644 --- a/src/renderer/src/components/settings/RepositoryIconTabs.tsx +++ b/src/renderer/src/components/settings/RepositoryIconTabs.tsx @@ -1,4 +1,4 @@ -import { useState } from 'react' +import { Suspense, useState } from 'react' import { toast } from 'sonner' import { Github, Image, Link2 } from 'lucide-react' import type { RepoIcon } from '../../../../shared/repo-icon' @@ -10,8 +10,16 @@ import { Tooltip, TooltipContent, TooltipTrigger } from '../ui/tooltip' import { getRepoLucideIconOptions } from '../repo/repo-icon' import { useMountedRef } from '@/hooks/useMountedRef' import { translate } from '@/i18n/i18n' +import { lazyWithRetry } from '@/lib/lazy-with-retry' -const EMOJI_OPTIONS = ['🚀', '✨', '💻', '🧠', '📦', '🔧', '🎨', '🌐', '📊', '🔒', '⚡', '✅'] +// Deferred so emoji-picker-react's ~500KB chunk only loads once the Emoji tab renders. +const RepositoryIconEmojiPicker = lazyWithRetry( + () => + import('./RepositoryIconEmojiPicker').then((module) => ({ + default: module.RepositoryIconEmojiPicker + })), + { reloadKey: 'repo-icon-emoji-picker' } +) type RepositoryIconTabsProps = { initialTab: 'avatar' | 'icon' | 'emoji' @@ -180,24 +188,10 @@ export function RepositoryIconTabs({ - - {EMOJI_OPTIONS.map((emoji) => ( - - ))} + + + + ) diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json index 7b55bf13367..05082ae9ba8 100644 --- a/src/renderer/src/i18n/locales/en.json +++ b/src/renderer/src/i18n/locales/en.json @@ -6644,7 +6644,10 @@ "f79972271a": "No GitHub remote found for this repo.", "4d039317f4": "Website favicon", "acf31559a0": "Enter a valid website URL.", - "868c5c9b56": "Failed to import repo icon" + "868c5c9b56": "Failed to import repo icon", + "emojiTooLongForRepoIcon": "This emoji can't be used as a repo icon.", + "currentEmojiSelection": "Current: {{value0}}", + "searchEmojiPlaceholder": "Search emoji" }, "RepositoryPane": { "15a99d9b9f": "Relative paths resolve from this project root.", diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json index 904beaa9d16..14dd169539e 100644 --- a/src/renderer/src/i18n/locales/es.json +++ b/src/renderer/src/i18n/locales/es.json @@ -6483,7 +6483,10 @@ "f79972271a": "No se encontró ningún control remoto de GitHub para este repositorio.", "4d039317f4": "Favicon del sitio web", "acf31559a0": "Ingresa una URL de sitio web válida.", - "868c5c9b56": "No se pudo importar el icono del repositorio" + "868c5c9b56": "No se pudo importar el icono del repositorio", + "emojiTooLongForRepoIcon": "Este emoji no se puede usar como icono del repositorio.", + "currentEmojiSelection": "Actual: {{value0}}", + "searchEmojiPlaceholder": "Buscar emoji" }, "RepositoryPane": { "15a99d9b9f": "Las rutas relativas se resuelven desde la raíz de este proyecto.", diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json index 3d5f8588d72..9ec2f14a80d 100644 --- a/src/renderer/src/i18n/locales/ja.json +++ b/src/renderer/src/i18n/locales/ja.json @@ -6505,7 +6505,10 @@ "f79972271a": "この repo の GitHub リモートが見つかりません。", "4d039317f4": "ウェブサイトのファビコン", "acf31559a0": "有効な Web サイトの URL を入力。", - "868c5c9b56": "repo のインポートに失敗しましたアイコン" + "868c5c9b56": "repo のインポートに失敗しましたアイコン", + "emojiTooLongForRepoIcon": "この絵文字は repo アイコンとして使用できません。", + "currentEmojiSelection": "現在: {{value0}}", + "searchEmojiPlaceholder": "絵文字を検索" }, "RepositoryPane": { "15a99d9b9f": "相対パスは、このプロジェクトのルートから解決されます。", diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json index aa4bc49ce93..152e6a771dc 100644 --- a/src/renderer/src/i18n/locales/ko.json +++ b/src/renderer/src/i18n/locales/ko.json @@ -6468,7 +6468,10 @@ "f79972271a": "이 repo에 대한 GitHub 원격을 찾을 수 없습니다.", "4d039317f4": "웹사이트 파비콘", "acf31559a0": "유효한 웹사이트 URL을 입력하세요.", - "868c5c9b56": "repo 아이콘을 가져오지 못했습니다." + "868c5c9b56": "repo 아이콘을 가져오지 못했습니다.", + "emojiTooLongForRepoIcon": "이 이모티콘은 repo 아이콘으로 사용할 수 없습니다.", + "currentEmojiSelection": "현재: {{value0}}", + "searchEmojiPlaceholder": "이모티콘 검색" }, "RepositoryPane": { "15a99d9b9f": "상대 경로는 이 프로젝트 루트에서 확인됩니다.", diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json index 05a13abd266..7f9907ab181 100644 --- a/src/renderer/src/i18n/locales/zh.json +++ b/src/renderer/src/i18n/locales/zh.json @@ -6480,7 +6480,10 @@ "f79972271a": "找不到此仓库的 GitHub 远程。", "4d039317f4": "网站图标", "acf31559a0": "输入有效的网站 URL。", - "868c5c9b56": "无法导入仓库图标" + "868c5c9b56": "无法导入仓库图标", + "emojiTooLongForRepoIcon": "此表情符号无法用作仓库图标。", + "currentEmojiSelection": "当前：{{value0}}", + "searchEmojiPlaceholder": "搜索表情符号" }, "RepositoryPane": { "15a99d9b9f": "相对路径从该项目根解析。", diff --git a/tests/e2e/repo-icon-emoji-picker.spec.ts b/tests/e2e/repo-icon-emoji-picker.spec.ts new file mode 100644 index 00000000000..2698615b881 --- /dev/null +++ b/tests/e2e/repo-icon-emoji-picker.spec.ts @@ -0,0 +1,80 @@ +/** + * Coverage for the full native emoji picker that replaced the hardcoded + * 12-emoji grid in the repo icon settings (RepositoryIconTabs "Emoji" tab). + * Verifies search + selection persist through the existing RepoIcon + * contract, and captures the new picker for the PR screenshot record. + */ +import type { Page, TestInfo } from '@stablyai/playwright-test' +import { expect, test } from './helpers/orca-app' +import { getStoreState, waitForSessionReady } from './helpers/store' +import type { Repo } from '../../src/shared/types' + +/** Opens the repo settings panel and pins the UI language to English. */ +async function openRepoSettings(page: Page, repoId: string): Promise { + // Why: the host OS locale (e.g. ko-KR) drives Orca's default UI language. + // Pin English so this spec's locators are stable across dev machines and CI. + await page.evaluate(() => window.__store!.getState().updateSettings({ uiLanguage: 'en' })) + await page.evaluate((repoId) => { + const state = window.__store!.getState() + state.openSettingsTarget({ pane: 'repo', repoId }) + state.openSettingsPage() + }, repoId) + await expect(page.getByPlaceholder('Search settings')).toBeVisible({ timeout: 10_000 }) + const maybeLaterButton = page.getByRole('button', { name: 'Maybe Later' }) + if (await maybeLaterButton.isVisible({ timeout: 1_000 }).catch(() => false)) { + await maybeLaterButton.click() + } +} + +/** Captures a full-page screenshot and attaches it to the test report. */ +async function attachScreenshot(page: Page, testInfo: TestInfo, name: string): Promise { + const screenshotPath = testInfo.outputPath(`${name}.png`) + await page.screenshot({ path: screenshotPath }) + await testInfo.attach(name, { path: screenshotPath, contentType: 'image/png' }) +} + +test.describe('Repository icon emoji picker', () => { + test('search selects a native emoji and persists it as the repo icon', async ({ + orcaPage + }, testInfo) => { + await waitForSessionReady(orcaPage) + + const repos = await getStoreState(orcaPage, 'repos') + expect(repos.length).toBeGreaterThan(0) + const repo = repos[0] + + await openRepoSettings(orcaPage, repo.id) + + const repoSection = orcaPage.locator(`[data-settings-section="repo-${repo.id}"]`) + await repoSection.getByRole('tab', { name: 'Emoji' }).click() + + const picker = repoSection.locator('.repo-icon-emoji-picker') + await expect(picker).toBeVisible({ timeout: 10_000 }) + + // Full catalog with search — the removed grid only ever offered 12 fixed emoji. + const searchInput = picker.getByPlaceholder('Search emoji') + await expect(searchInput).toBeVisible() + await searchInput.fill('rocket') + + await attachScreenshot(orcaPage, testInfo, 'repo-icon-emoji-picker-search') + + const rocketResult = picker.getByRole('button', { name: /rocket/i }).first() + await expect(rocketResult).toBeVisible({ timeout: 10_000 }) + await rocketResult.click() + + await expect + .poll( + async () => { + const current = await getStoreState(orcaPage, 'repos') + return current.find((entry) => entry.id === repo.id)?.repoIcon + }, + { timeout: 5_000, message: 'repo icon did not persist the picked emoji' } + ) + .toEqual({ type: 'emoji', emoji: '🚀' }) + + // The store round-trip alone would pass even if the panel rendered nothing. + await expect(repoSection.getByText('Current: 🚀')).toBeVisible() + + await attachScreenshot(orcaPage, testInfo, 'repo-icon-emoji-picker-selected') + }) +}) From dbbeca091644b0e577eb19e4e8c3363604d5bb4e Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:05:22 -0700 Subject: [PATCH 10/72] Let a timed-out remote terminal pane reconnect when the host session is still alive (#12213) * fix(terminal): let a timed-out remote terminal pane reconnect again A remote-runtime PTY pane that missed the 60s auto-recovery window latched to "disconnected" permanently, even while the host kept the session alive and streaming. The cutoff destroyed every path back at once: it dropped the pending retry and evicted the pane from the shared retry registry (so window `online` and system-resume became no-ops), and the transport tore down the accepted host-snapshot listener. The listener was also inert for the common case, since a host that keeps publishing the same live handle never rotates it. The cutoff now only stops the retry timer; the pane keeps its pending retry and stays revivable. The accepted-snapshot listener survives the latch, and a post-cutoff snapshot is accepted as reattach evidence whether the host rotated the handle or republished the same one. The require-replacement published-wait guard is scoped to its own recovery epoch so Reconnect and online/resume are no longer swallowed. No new polling: a latched pane still issues zero self-initiated RPCs, and the same-handle reattach consumes a snapshot the client already receives. Closes #12097 * fix(terminal): drop the settled attach retry when the recovery cutoff lands The recovery cutoff now keeps a pending retry so online/resume can revive a latched pane, but the host-session attach wait schedules a single-shot closure that the cutoff itself resolves. Retaining it left the pane registered as revivable work: 'online' would bump the epoch, arm a fresh 60s deadline and flip the phase to 'recovering' while invoking a no-op, hiding the working Reconnect button and the same-handle snapshot reattach for a full minute. The attach wait now discards its own scheduled retry as it settles, so a pane latched on that path stays 'disconnected' and Reconnect keeps working. Retries scheduled by the resubscribe paths re-enter real work and are unaffected. Co-authored-by: Orca * fix(test): type the reattach host snapshot factory so status narrows to 'ready' Co-authored-by: Orca * fix(terminal): keep an exhausted remote pane reattachable through Reconnect and resume Reconnect and the online/system-resume trigger both opened a fresh recovery epoch, which switched off the accepted-snapshot reattach path (gated on the 'disconnected' phase) for 60s while the require-replacement inventory wait dead-ended without scheduling anything. Gate the same-handle reattach on a spent auto-recovery window instead of the live phase, consumed once per window, and park an unarmed retry at the require-replacement dead end so online/resume/Reconnect have work to revive. Co-authored-by: Orca * test(terminal): pin latched-pane retention to one listener and one registry entry The recovery cutoff now keeps the retry-registry entry and the accepted-snapshot listener alive, so cover the two module-global collections that could accumulate: destroy/detach cycles, concurrent latched panes, revive storms and snapshot churn all return to baseline. Co-authored-by: Orca * refactor(terminal): use the returned reattach epoch and pin the no-RPC claim Addresses both CodeRabbit nitpicks: subscribeToHandle now takes the epoch begin() returned rather than re-reading currentEpoch, and the latched attach-wait test asserts the runtime call count is unchanged instead of only the advanced count. Co-authored-by: Orca --------- Co-authored-by: Orca --- ...mote-runtime-pty-deadline-reattach.test.ts | 381 ++++++++++++++++++ ...runtime-pty-latched-pane-retention.test.ts | 358 ++++++++++++++++ .../remote-runtime-pty-recovery-state.test.ts | 51 ++- .../remote-runtime-pty-recovery-state.ts | 46 ++- .../remote-runtime-pty-transport.ts | 58 ++- 5 files changed, 880 insertions(+), 14 deletions(-) create mode 100644 src/renderer/src/components/terminal-pane/remote-runtime-pty-deadline-reattach.test.ts create mode 100644 src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-deadline-reattach.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-deadline-reattach.test.ts new file mode 100644 index 00000000000..886516414ca --- /dev/null +++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-deadline-reattach.test.ts @@ -0,0 +1,381 @@ +import { beforeEach, describe, expect, it, vi } from 'vitest' +import { + TerminalStreamOpcode, + decodeTerminalStreamFrame, + decodeTerminalStreamJson, + encodeTerminalStreamFrame, + encodeTerminalStreamJson, + encodeTerminalStreamText +} from '../../../../shared/terminal-stream-protocol' +import type { RuntimeMobileSessionTabsResult } from '../../../../shared/runtime-types' + +describe('remote runtime pty reattach after the bounded recovery window', () => { + const runtimeCall = vi.fn() + const runtimeSubscribe = vi.fn() + const refreshSessionTabsSnapshot = vi.fn(async () => {}) + const subscriptionSendBinary = vi.fn() + let subscriptionCallbacks: { + onResponse: (response: unknown) => void + onBinary?: (bytes: Uint8Array) => void + onError?: (error: { code: string; message: string }) => void + onClose?: () => void + } | null = null + let hostListCalls = 0 + + function emitMultiplexReady(): void { + subscriptionCallbacks?.onResponse({ ok: true, result: { type: 'ready' } }) + } + + function latestSubscribePayload(): { streamId: number; terminal: string } { + const frame = subscriptionSendBinary.mock.calls + .map((call) => decodeTerminalStreamFrame(call[0])) + .findLast((candidate) => candidate?.opcode === TerminalStreamOpcode.Subscribe) + if (!frame) { + throw new Error('missing terminal subscribe frame') + } + const payload = decodeTerminalStreamJson<{ streamId: number; terminal: string }>(frame.payload) + if (!payload) { + throw new Error('invalid terminal subscribe payload') + } + return payload + } + + function subscribedTerminalHandles(): string[] { + return subscriptionSendBinary.mock.calls + .map((call) => decodeTerminalStreamFrame(call[0])) + .flatMap((frame) => { + if (frame?.opcode !== TerminalStreamOpcode.Subscribe) { + return [] + } + const payload = decodeTerminalStreamJson<{ terminal: string }>(frame.payload) + return payload ? [payload.terminal] : [] + }) + } + + function emitSnapshot(streamId: number, data: string): void { + subscriptionCallbacks?.onBinary?.( + encodeTerminalStreamFrame({ + opcode: TerminalStreamOpcode.SnapshotStart, + streamId, + seq: 1, + payload: encodeTerminalStreamJson({ kind: 'scrollback' }) + }) + ) + subscriptionCallbacks?.onBinary?.( + encodeTerminalStreamFrame({ + opcode: TerminalStreamOpcode.SnapshotChunk, + streamId, + seq: 2, + payload: encodeTerminalStreamText(data) + }) + ) + subscriptionCallbacks?.onBinary?.( + encodeTerminalStreamFrame({ + opcode: TerminalStreamOpcode.SnapshotEnd, + streamId, + seq: 3, + payload: new Uint8Array() + }) + ) + } + + function hostSnapshot( + terminal: string, + snapshotVersion: number, + publicationEpoch: string + ): RuntimeMobileSessionTabsResult { + return { + worktree: 'wt-1', + publicationEpoch, + snapshotVersion, + activeGroupId: null, + activeTabId: 'tab-1::pane:1', + activeTabType: 'terminal' as const, + tabs: [ + { + type: 'terminal' as const, + id: 'tab-1::pane:1', + parentTabId: 'tab-1', + leafId: 'pane:1', + title: 'Claude Code', + isActive: true, + status: 'ready', + terminal + } + ] + } + } + + async function attachStalePane() { + const { createRemoteRuntimePtyTransport } = await import('./remote-runtime-pty-transport') + const onError = vi.fn() + const onPtyExit = vi.fn() + const transport = createRemoteRuntimePtyTransport('env-1', { + worktreeId: 'wt-1', + tabId: 'web-terminal-tab-1', + leafId: 'pane:1', + onPtyExit, + onPtyRebind: vi.fn() + }) + transport.attach({ + existingPtyId: 'remote:env-1@@terminal-stale', + cols: 80, + rows: 24, + callbacks: { onError } + }) + await vi.waitFor(() => expect(subscriptionSendBinary).toHaveBeenCalled()) + + // The host keeps publishing the same live handle, so bounded replacement polling finds + // no replacement and stops quietly without retiring the pane. + runtimeCall.mockImplementation(async (args: { method: string }) => { + if (args.method !== 'session.tabs.list') { + return { ok: true, result: {} } + } + hostListCalls += 1 + return { ok: true, result: hostSnapshot('terminal-stale', hostListCalls + 1, 'epoch-1') } + }) + subscriptionCallbacks?.onResponse({ + ok: true, + result: { + type: 'error', + streamId: latestSubscribePayload().streamId, + message: 'terminal_handle_stale' + } + }) + return { transport, onError, onPtyExit } + } + + beforeEach(() => { + vi.resetModules() + vi.doUnmock('../../runtime/remote-runtime-terminal-multiplexer') + vi.doMock('@/runtime/web-runtime-session', () => ({ + refreshWebRuntimeSessionTabsSnapshot: refreshSessionTabsSnapshot + })) + vi.clearAllMocks() + subscriptionCallbacks = null + hostListCalls = 0 + subscriptionSendBinary.mockReset() + runtimeCall.mockImplementation(async (request: { method: string; params?: unknown }) => { + if (request.method === 'session.tabs.activate') { + return { ok: true, result: hostSnapshot('terminal-stale', 1, 'epoch-1') } + } + if (request.method === 'terminal.resolvePane') { + const params = request.params as { paneKey: string; worktreeId: string } + const separator = params.paneKey.indexOf(':') + return { + ok: true, + result: { + terminal: { + handle: 'terminal-stale', + tabId: params.paneKey.slice(0, separator), + leafId: params.paneKey.slice(separator + 1), + worktreeId: params.worktreeId + } + } + } + } + return { ok: true, result: { terminal: { handle: 'terminal-stale' } } } + }) + runtimeSubscribe.mockImplementation( + async (_args: unknown, callbacks: typeof subscriptionCallbacks) => { + subscriptionCallbacks = callbacks + queueMicrotask(emitMultiplexReady) + return { unsubscribe: vi.fn(), sendBinary: subscriptionSendBinary } + } + ) + vi.stubGlobal('window', { + api: { runtimeEnvironments: { call: runtimeCall, subscribe: runtimeSubscribe } } + }) + }) + + it('reattaches from a rotated host handle published after the recovery cutoff', async () => { + vi.useFakeTimers() + try { + const { transport, onPtyExit } = await attachStalePane() + const handleEvents = await import('../../runtime/web-session-terminal-handle-events') + + await vi.advanceTimersByTimeAsync(16_000) + expect(handleEvents.getWebSessionTerminalHandleSubscriberCountForTests()).toBe(1) + expect(transport.getRecoveryState?.().phase).not.toBe('disconnected') + + await vi.advanceTimersByTimeAsync(50_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + // The cutoff must not tear down the accepted-snapshot listener; it is the only path back. + expect(handleEvents.getWebSessionTerminalHandleSubscriberCountForTests()).toBe(1) + + handleEvents.queueAcceptedWebSessionTerminalSnapshot( + hostSnapshot('terminal-after-timeout', 3, 'epoch-2'), + 'env-1' + ) + await vi.waitFor(() => + expect(latestSubscribePayload()).toMatchObject({ terminal: 'terminal-after-timeout' }) + ) + + emitSnapshot(latestSubscribePayload().streamId, 'reattached') + expect(transport.isConnected()).toBe(true) + expect(transport.getPtyId()).toBe('remote:env-1@@terminal-after-timeout') + expect(onPtyExit).not.toHaveBeenCalled() + transport.destroy?.() + } finally { + vi.useRealTimers() + } + }) + + it('reattaches when the post-cutoff snapshot republishes the same live handle', async () => { + vi.useFakeTimers() + try { + const { transport, onError } = await attachStalePane() + const handleEvents = await import('../../runtime/web-session-terminal-handle-events') + + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + const listCallsAtCutoff = hostListCalls + + handleEvents.queueAcceptedWebSessionTerminalSnapshot( + hostSnapshot('terminal-stale', 3, 'epoch-2'), + 'env-1' + ) + await vi.waitFor(() => expect(subscribedTerminalHandles()).toHaveLength(2)) + + expect(subscribedTerminalHandles()).toEqual(['terminal-stale', 'terminal-stale']) + // The snapshot is already-received host evidence; reattaching must cost no inventory RPC. + expect(hostListCalls).toBe(listCallsAtCutoff) + emitSnapshot(latestSubscribePayload().streamId, 'reattached') + expect(transport.isConnected()).toBe(true) + expect(onError).not.toHaveBeenCalled() + transport.destroy?.() + } finally { + vi.useRealTimers() + } + }) + + it('ignores a same-handle snapshot while automatic recovery is still running', async () => { + vi.useFakeTimers() + try { + const { transport } = await attachStalePane() + const handleEvents = await import('../../runtime/web-session-terminal-handle-events') + + await vi.advanceTimersByTimeAsync(16_000) + expect(transport.getRecoveryState?.().phase).not.toBe('disconnected') + + handleEvents.queueAcceptedWebSessionTerminalSnapshot( + hostSnapshot('terminal-stale', 3, 'epoch-2'), + 'env-1' + ) + await vi.advanceTimersByTimeAsync(1_000) + + expect(subscribedTerminalHandles()).toEqual(['terminal-stale']) + transport.destroy?.() + } finally { + vi.useRealTimers() + } + }) + + it('reattaches from a same-handle snapshot delivered inside the Reconnect window', async () => { + vi.useFakeTimers() + try { + const { transport, onError } = await attachStalePane() + const handleEvents = await import('../../runtime/web-session-terminal-handle-events') + + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + expect(handleEvents.getWebSessionTerminalHandleSubscriberCountForTests()).toBe(1) + const listCallsAtCutoff = hostListCalls + + expect(transport.retryRecovery?.()).toBe(true) + await vi.advanceTimersByTimeAsync(1_000) + expect(hostListCalls).toBeGreaterThan(listCallsAtCutoff) + + // Reconnect must not disarm the only path back: the click opens a window, it does not spend one. + handleEvents.queueAcceptedWebSessionTerminalSnapshot( + hostSnapshot('terminal-stale', 4, 'epoch-3'), + 'env-1' + ) + await vi.waitFor(() => expect(subscribedTerminalHandles()).toHaveLength(2)) + + emitSnapshot(latestSubscribePayload().streamId, 'reattached') + expect(transport.isConnected()).toBe(true) + expect(onError).not.toHaveBeenCalled() + transport.destroy?.() + } finally { + vi.useRealTimers() + } + }) + + it('revives a latched require-replacement pane when online or system resume fires', async () => { + vi.useFakeTimers() + try { + const { transport, onError } = await attachStalePane() + const handleEvents = await import('../../runtime/web-session-terminal-handle-events') + const { retryAllRemoteRuntimePtyRecoveriesNow } = + await import('./remote-runtime-pty-recovery-state') + + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + const listCallsAtCutoff = hostListCalls + + expect(retryAllRemoteRuntimePtyRecoveriesNow()).toBe(1) + await vi.advanceTimersByTimeAsync(1_000) + expect(hostListCalls).toBeGreaterThan(listCallsAtCutoff) + + handleEvents.queueAcceptedWebSessionTerminalSnapshot( + hostSnapshot('terminal-stale', 4, 'epoch-3'), + 'env-1' + ) + await vi.waitFor(() => expect(subscribedTerminalHandles()).toHaveLength(2)) + + emitSnapshot(latestSubscribePayload().streamId, 'reattached') + expect(transport.isConnected()).toBe(true) + expect(onError).not.toHaveBeenCalled() + transport.destroy?.() + } finally { + vi.useRealTimers() + } + }) + + it('leaves Reconnect available when online fires on a pane latched during the attach wait', async () => { + vi.useFakeTimers() + try { + const { createRemoteRuntimePtyTransport } = await import('./remote-runtime-pty-transport') + const { retryAllRemoteRuntimePtyRecoveriesNow } = + await import('./remote-runtime-pty-recovery-state') + runtimeCall.mockImplementation(async (request: { method: string }) => { + if (request.method === 'session.tabs.activate') { + return { + ok: false, + error: { + code: 'remote_runtime_unavailable', + message: 'Remote Orca runtime connection closed' + } + } + } + return { ok: true, result: {} } + }) + const transport = createRemoteRuntimePtyTransport('env-1', { + worktreeId: 'wt-1', + tabId: 'web-terminal-tab-1', + leafId: 'pane:1', + onPtyExit: vi.fn(), + onPtyRebind: vi.fn() + }) + transport.attach({ + existingPtyId: 'remote:env-1@@terminal-stale', + cols: 80, + rows: 24, + callbacks: { onError: vi.fn() } + }) + + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + + const callsBeforeRetry = runtimeCall.mock.calls.length + // The attach wait is single-shot and the cutoff already settled it; replaying it would spin the banner with no RPC in flight. + expect(retryAllRemoteRuntimePtyRecoveriesNow()).toBe(0) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + expect(runtimeCall.mock.calls.length).toBe(callsBeforeRetry) + transport.destroy?.() + } finally { + vi.useRealTimers() + } + }) +}) diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts new file mode 100644 index 00000000000..e9c83bf6718 --- /dev/null +++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts @@ -0,0 +1,358 @@ +import { beforeEach, describe, expect, it, vi } from 'vitest' +import { + TerminalStreamOpcode, + decodeTerminalStreamFrame, + decodeTerminalStreamJson +} from '../../../../shared/terminal-stream-protocol' +import type { RuntimeMobileSessionTabsResult } from '../../../../shared/runtime-types' + +// Why: the recovery cutoff no longer tears down the retry registry entry or the accepted-snapshot +// listener, so those two module-global collections are the only places a latched pane can accumulate. +describe('remote runtime pty latched-pane retention', () => { + const runtimeCall = vi.fn() + const runtimeSubscribe = vi.fn() + const refreshSessionTabsSnapshot = vi.fn(async () => {}) + const subscriptionSendBinary = vi.fn() + let subscriptionCallbacks: { + onResponse: (response: unknown) => void + onBinary?: (bytes: Uint8Array) => void + onError?: (error: { code: string; message: string }) => void + onClose?: () => void + } | null = null + let hostListCalls = 0 + + function emitMultiplexReady(): void { + subscriptionCallbacks?.onResponse({ ok: true, result: { type: 'ready' } }) + } + + function latestSubscribePayload(): { streamId: number; terminal: string } { + const frame = subscriptionSendBinary.mock.calls + .map((call) => decodeTerminalStreamFrame(call[0])) + .findLast((candidate) => candidate?.opcode === TerminalStreamOpcode.Subscribe) + if (!frame) { + throw new Error('missing terminal subscribe frame') + } + const payload = decodeTerminalStreamJson<{ streamId: number; terminal: string }>(frame.payload) + if (!payload) { + throw new Error('invalid terminal subscribe payload') + } + return payload + } + + function subscribeFrameCount(): number { + return subscriptionSendBinary.mock.calls + .map((call) => decodeTerminalStreamFrame(call[0])) + .filter((frame) => frame?.opcode === TerminalStreamOpcode.Subscribe).length + } + + // Why: every pane needs its own host surface, otherwise a later pane reuses the earlier pane's + // multiplexed stream and never enters recovery at all. + const paneIdentity = (pane: number) => ({ + hostTabId: `tab-${pane}`, + tabId: `web-terminal-tab-${pane}`, + leafId: `pane:${pane}`, + handle: `terminal-stale-${pane}` + }) + + const PANE_COUNT = 24 + + // Why: one payload carries every pane's surface, matching the real per-worktree session.tabs + // response that any polling pane receives. + function hostSnapshot( + snapshotVersion: number, + publicationEpoch: string + ): RuntimeMobileSessionTabsResult { + return { + worktree: 'wt-1', + publicationEpoch, + snapshotVersion, + activeGroupId: null, + activeTabId: `${paneIdentity(0).hostTabId}::${paneIdentity(0).leafId}`, + activeTabType: 'terminal' as const, + tabs: Array.from({ length: PANE_COUNT }, (_unused, pane) => { + const identity = paneIdentity(pane) + return { + type: 'terminal' as const, + id: `${identity.hostTabId}::${identity.leafId}`, + parentTabId: identity.hostTabId, + leafId: identity.leafId, + title: 'Claude Code', + isActive: pane === 0, + status: 'ready' as const, + terminal: identity.handle + } + }) + } + } + + async function attachStalePane(pane: number) { + const identity = paneIdentity(pane) + const { createRemoteRuntimePtyTransport } = await import('./remote-runtime-pty-transport') + const transport = createRemoteRuntimePtyTransport('env-1', { + worktreeId: 'wt-1', + tabId: identity.tabId, + leafId: identity.leafId, + onPtyExit: vi.fn(), + onPtyRebind: vi.fn() + }) + const subscribesBefore = subscribeFrameCount() + transport.attach({ + existingPtyId: `remote:env-1@@${identity.handle}`, + cols: 80, + rows: 24, + callbacks: { onError: vi.fn() } + }) + await vi.waitFor(() => expect(subscribeFrameCount()).toBeGreaterThan(subscribesBefore)) + + // The host keeps publishing the same live handle, so bounded replacement polling finds no + // replacement and stops quietly: the exact shape that leaves the pane latched but revivable. + subscriptionCallbacks?.onResponse({ + ok: true, + result: { + type: 'error', + streamId: latestSubscribePayload().streamId, + message: 'terminal_handle_stale' + } + }) + return transport + } + + async function registries() { + const handleEvents = await import('../../runtime/web-session-terminal-handle-events') + const recoveryState = await import('./remote-runtime-pty-recovery-state') + return { + subscribers: handleEvents.getWebSessionTerminalHandleSubscriberCountForTests(), + scheduled: recoveryState.getScheduledRemoteRuntimePtyRecoveryCountForTests() + } + } + + beforeEach(() => { + vi.resetModules() + vi.doUnmock('../../runtime/remote-runtime-terminal-multiplexer') + vi.doMock('@/runtime/web-runtime-session', () => ({ + refreshWebRuntimeSessionTabsSnapshot: refreshSessionTabsSnapshot + })) + vi.clearAllMocks() + subscriptionCallbacks = null + hostListCalls = 0 + subscriptionSendBinary.mockReset() + runtimeCall.mockImplementation(async (request: { method: string; params?: unknown }) => { + if (request.method === 'session.tabs.list') { + hostListCalls += 1 + return { ok: true, result: hostSnapshot(hostListCalls + 1, 'epoch-1') } + } + if (request.method === 'session.tabs.activate') { + return { ok: true, result: hostSnapshot(1, 'epoch-1') } + } + if (request.method === 'terminal.resolvePane') { + const params = request.params as { paneKey: string; worktreeId: string } + const separator = params.paneKey.indexOf(':') + const paneTabId = params.paneKey.slice(0, separator) + const pane = Number(paneTabId.slice(paneTabId.lastIndexOf('-') + 1)) + return { + ok: true, + result: { + terminal: { + handle: paneIdentity(pane).handle, + tabId: paneTabId, + leafId: params.paneKey.slice(separator + 1), + worktreeId: params.worktreeId + } + } + } + } + return { ok: true, result: {} } + }) + runtimeSubscribe.mockImplementation( + async (_args: unknown, callbacks: typeof subscriptionCallbacks) => { + subscriptionCallbacks = callbacks + queueMicrotask(emitMultiplexReady) + return { unsubscribe: vi.fn(), sendBinary: subscriptionSendBinary } + } + ) + vi.stubGlobal('window', { + api: { runtimeEnvironments: { call: runtimeCall, subscribe: runtimeSubscribe } } + }) + }) + + it('returns listener and retry-registry counts to baseline across destroy cycles', async () => { + vi.useFakeTimers() + try { + expect(await registries()).toEqual({ subscribers: 0, scheduled: 0 }) + const latched: { subscribers: number; scheduled: number }[] = [] + const settled: { subscribers: number; scheduled: number }[] = [] + + for (let cycle = 0; cycle < 20; cycle += 1) { + const transport = await attachStalePane(cycle) + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + latched.push(await registries()) + transport.destroy?.() + await vi.advanceTimersByTimeAsync(1_000) + settled.push(await registries()) + } + + // A latched pane deliberately holds exactly one listener and one registry entry... + expect(latched).toEqual(Array.from({ length: 20 }, () => ({ subscribers: 1, scheduled: 1 }))) + // ...and destroy releases both, so twenty cycles do not accumulate anything. + expect(settled).toEqual(Array.from({ length: 20 }, () => ({ subscribers: 0, scheduled: 0 }))) + expect(vi.getTimerCount()).toBe(0) + } finally { + vi.useRealTimers() + } + }) + + it('returns to baseline when a latched pane is detached rather than destroyed', async () => { + vi.useFakeTimers() + try { + const settled: { subscribers: number; scheduled: number }[] = [] + for (let cycle = 0; cycle < 20; cycle += 1) { + const transport = await attachStalePane(cycle) + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + transport.detach?.() + await vi.advanceTimersByTimeAsync(1_000) + settled.push(await registries()) + } + expect(settled).toEqual(Array.from({ length: 20 }, () => ({ subscribers: 0, scheduled: 0 }))) + expect(vi.getTimerCount()).toBe(0) + } finally { + vi.useRealTimers() + } + }) + + it('holds one listener and one registry entry per concurrently latched pane', async () => { + vi.useFakeTimers() + try { + const transports: Awaited>[] = [] + for (let pane = 0; pane < 8; pane += 1) { + transports.push(await attachStalePane(pane)) + await vi.advanceTimersByTimeAsync(66_000) + } + // Retention is per live pane, not per timeout: eight latched panes hold eight of each. + expect(await registries()).toEqual({ subscribers: 8, scheduled: 8 }) + + for (const transport of transports) { + transport.destroy?.() + } + await vi.advanceTimersByTimeAsync(1_000) + expect(await registries()).toEqual({ subscribers: 0, scheduled: 0 }) + expect(vi.getTimerCount()).toBe(0) + } finally { + vi.useRealTimers() + } + }) + + it('leaves a latched pane fully quiescent — no timers, no RPCs, no growth', async () => { + vi.useFakeTimers() + try { + const transport = await attachStalePane(0) + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + + const baseline = await registries() + const callsAtLatch = runtimeCall.mock.calls.length + const timersAtLatch = vi.getTimerCount() + // Nothing is armed once the window is spent: the pane costs one listener and one registry + // entry, and nothing else, no matter how long it stays latched. + expect(timersAtLatch).toBe(0) + + await vi.advanceTimersByTimeAsync(10 * 60_000) + + expect(runtimeCall.mock.calls.length).toBe(callsAtLatch) + expect(vi.getTimerCount()).toBe(0) + expect(await registries()).toEqual(baseline) + + transport.destroy?.() + await vi.advanceTimersByTimeAsync(1_000) + expect(await registries()).toEqual({ subscribers: 0, scheduled: 0 }) + } finally { + vi.useRealTimers() + } + }) + + it('does not stack listeners, registry entries or timers across repeated revive cycles', async () => { + vi.useFakeTimers() + try { + const { retryAllRemoteRuntimePtyRecoveriesNow } = await import( + './remote-runtime-pty-recovery-state' + ) + const transport = await attachStalePane(0) + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + + const baseline = await registries() + const timersAtFirstLatch = vi.getTimerCount() + const subscribesAtFirstLatch = subscribeFrameCount() + const observed: { + subscribers: number + scheduled: number + timers: number + revived: number + }[] = [] + + for (let cycle = 0; cycle < 25; cycle += 1) { + const revived = retryAllRemoteRuntimePtyRecoveriesNow() + // A second trigger in the same window must find nothing to advance, so an online/resume + // storm cannot stack fresh recovery epochs on one pane. + expect(retryAllRemoteRuntimePtyRecoveriesNow()).toBe(0) + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + observed.push({ ...(await registries()), timers: vi.getTimerCount(), revived }) + } + + expect(observed).toEqual( + Array.from({ length: 25 }, () => ({ + subscribers: baseline.subscribers, + scheduled: baseline.scheduled, + timers: timersAtFirstLatch, + revived: 1 + })) + ) + // Each revive re-derives the handle; it must not leave extra live stream subscriptions behind. + expect(subscribeFrameCount()).toBe(subscribesAtFirstLatch) + + transport.destroy?.() + await vi.advanceTimersByTimeAsync(1_000) + expect(await registries()).toEqual({ subscribers: 0, scheduled: 0 }) + expect(vi.getTimerCount()).toBe(0) + } finally { + vi.useRealTimers() + } + }) + + it('does not stack anything when host snapshots arrive repeatedly at a latched pane', async () => { + vi.useFakeTimers() + try { + const handleEvents = await import('../../runtime/web-session-terminal-handle-events') + const transport = await attachStalePane(0) + await vi.advanceTimersByTimeAsync(66_000) + expect(transport.getRecoveryState?.().phase).toBe('disconnected') + const baseline = await registries() + + const subscribesAtLatch = subscribeFrameCount() + + for (let cycle = 0; cycle < 50; cycle += 1) { + handleEvents.queueAcceptedWebSessionTerminalSnapshot( + hostSnapshot(10 + cycle, `epoch-${cycle}`), + 'env-1' + ) + await vi.advanceTimersByTimeAsync(100) + } + + const after = await registries() + expect(after.subscribers).toBeLessThanOrEqual(baseline.subscribers) + expect(after.scheduled).toBeLessThanOrEqual(baseline.scheduled) + // At most one same-handle resubscribe per spent window: 50 snapshots inside one window + // must not become 50 subscribes. + expect(subscribeFrameCount() - subscribesAtLatch).toBeLessThanOrEqual(1) + + transport.destroy?.() + await vi.advanceTimersByTimeAsync(1_000) + expect(await registries()).toEqual({ subscribers: 0, scheduled: 0 }) + expect(vi.getTimerCount()).toBe(0) + } finally { + vi.useRealTimers() + } + }) +}) diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts index f2556b737b0..07a9199d307 100644 --- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts +++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts @@ -69,6 +69,7 @@ describe('RemoteRuntimePtyRecoveryState', () => { expect(state.isActive).toBe(false) expect(state.isCurrent(epoch)).toBe(false) expect(onChange).toHaveBeenCalled() + state.dispose() }) it('advances a pending backoff immediately via retryNow and the active registry', async () => { @@ -154,16 +155,56 @@ describe('RemoteRuntimePtyRecoveryState', () => { expect(retryNow).not.toHaveBeenCalled() }) - it('removes timed-out panes from the scheduled recovery registry', async () => { + it('keeps a timed-out pane revivable through the scheduled recovery registry', async () => { + vi.useFakeTimers() + const state = new RemoteRuntimePtyRecoveryState() + const retry = vi.fn() + const firstEpoch = state.begin() + // Why: the backoff ladder outlasts the recovery window, so a retry is still armed when the cutoff lands. + await vi.advanceTimersByTimeAsync(REMOTE_RUNTIME_AUTO_RECOVERY_TIMEOUT_MS - 100) + state.schedule(firstEpoch, retry) + + await vi.advanceTimersByTimeAsync(100) + expect(state.currentPhase).toBe('disconnected') + + await vi.advanceTimersByTimeAsync(300_000) + expect(retry).not.toHaveBeenCalled() + + expect(retryAllRemoteRuntimePtyRecoveriesNow()).toBe(1) + expect(retry).toHaveBeenCalledWith(firstEpoch + 1) + expect(state.currentPhase).toBe('recovering') + state.dispose() + }) + + it('revives a parked retry that never armed a backoff timer', async () => { + vi.useFakeTimers() + const state = new RemoteRuntimePtyRecoveryState() + const retry = vi.fn() + const firstEpoch = state.begin() + expect(state.parkRetryForExternalTrigger(firstEpoch, retry)).toBe(true) + + // Why: parking must not fire on its own, so the pane still latches at the cutoff. + await vi.advanceTimersByTimeAsync(REMOTE_RUNTIME_AUTO_RECOVERY_TIMEOUT_MS + 300_000) + expect(state.currentPhase).toBe('disconnected') + expect(retry).not.toHaveBeenCalled() + + expect(retryAllRemoteRuntimePtyRecoveriesNow()).toBe(1) + expect(retry).toHaveBeenCalledWith(firstEpoch + 1) + expect(state.currentPhase).toBe('recovering') + state.dispose() + }) + + it('refuses to park over an armed backoff or a stale epoch', () => { vi.useFakeTimers() const state = new RemoteRuntimePtyRecoveryState() const epoch = state.begin() state.schedule(epoch, vi.fn()) - const retryNow = vi.spyOn(state, 'retryNow') - await vi.advanceTimersByTimeAsync(REMOTE_RUNTIME_AUTO_RECOVERY_TIMEOUT_MS) - retryAllRemoteRuntimePtyRecoveriesNow() + expect(state.parkRetryForExternalTrigger(epoch, vi.fn())).toBe(false) - expect(retryNow).not.toHaveBeenCalled() + state.cancel() + expect(state.parkRetryForExternalTrigger(epoch, vi.fn())).toBe(false) + expect(retryAllRemoteRuntimePtyRecoveriesNow()).toBe(0) + state.dispose() }) }) diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.ts index df6814a4028..0b609ff876c 100644 --- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.ts +++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.ts @@ -11,6 +11,10 @@ export type RemoteRuntimePtyRecoveryPhase = // Why: system resume / network online need to advance pending pane backoffs without a second coordinator. const scheduledRecoveries = new Set() +export function getScheduledRemoteRuntimePtyRecoveryCountForTests(): number { + return scheduledRecoveries.size +} + export function retryAllRemoteRuntimePtyRecoveriesNow(): number { let advanced = 0 // Why: a synchronous retry failure can schedule the same state again. @@ -101,14 +105,43 @@ export class RemoteRuntimePtyRecoveryState { return true } + // Why: a wait that ends with no liveness evidence arms no timer, so park a retry or online/resume/reconnect find nothing to revive. + parkRetryForExternalTrigger(epoch: number, retry: (epoch: number) => void): boolean { + if (!this.isCurrent(epoch) || this.pendingRetry !== null) { + return false + } + this.pendingRetry = retry + this.pendingEpoch = epoch + scheduledRecoveries.add(this) + return true + } + + // Why: a one-shot retry whose owner already resolved elsewhere would otherwise survive the cutoff as fake revivable work. + discardPendingRetry(retry: (epoch: number) => void): void { + if (this.pendingRetry !== retry) { + return + } + this.clearRetryTimer() + } + // Why: resume/online should fire an already-scheduled backoff immediately, not start a new epoch. retryNow(): boolean { - if (this.phase !== 'backoff' || this.pendingRetry === null || this.pendingEpoch === null) { + if (this.pendingRetry === null || this.pendingEpoch === null) { + return false + } + if (this.phase !== 'backoff' && this.phase !== 'disconnected') { return false } const retry = this.pendingRetry - const epoch = this.pendingEpoch + const latched = this.phase === 'disconnected' this.clearRetryTimer() + if (latched) { + // Why: the deadline only stops auto-retry; an explicit trigger opens a fresh recovery window. + this.epoch += 1 + this.attempt = 0 + this.armDeadline(this.epoch) + } + const epoch = this.epoch this.phase = 'recovering' this.onChange?.() retry(epoch) @@ -159,7 +192,8 @@ export class RemoteRuntimePtyRecoveryState { return } this.deadlineTimer = null - this.clearRetryTimer() + // Why: the cutoff stops self-initiated retries but must keep the pane revivable by online/resume/reconnect. + this.stopRetryTimer() this.phase = 'disconnected' this.onChange?.() }, REMOTE_RUNTIME_AUTO_RECOVERY_TIMEOUT_MS) @@ -172,11 +206,15 @@ export class RemoteRuntimePtyRecoveryState { this.clearDeadlineTimer() } - private clearRetryTimer(): void { + private stopRetryTimer(): void { if (this.retryTimer) { clearTimeout(this.retryTimer) this.retryTimer = null } + } + + private clearRetryTimer(): void { + this.stopRetryTimer() this.pendingRetry = null this.pendingEpoch = null scheduledRecoveries.delete(this) diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts index eedd195c71e..c9e0ea4352f 100644 --- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts +++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts @@ -187,6 +187,9 @@ export function createRemoteRuntimePtyTransport( let recoveryReplacementPolicy: HostHandleReplacementPolicy = 'reuse' let recoveryReplacementPolicyHandle: string | null = null let stopWaitingForPublishedHandle: (() => void) | null = null + let publishedHandleWaitEpoch: number | null = null + // Why: a spent auto-recovery window is the evidence that licenses reattaching the fenced handle; explicit retries must not erase it. + let autoRecoveryWindowSpent = false let settleHostSessionAttachRetry: ((retry: boolean) => void) | null = null let resubscribeInventoryEpoch: number | null = null let resubscribeInventoryWindows = 0 @@ -236,12 +239,18 @@ export function createRemoteRuntimePtyTransport( } const recovery = new RemoteRuntimePtyRecoveryState(() => { - if (recovery.currentPhase === 'disconnected') { + if (recovery.currentPhase === 'disposed') { clearPublishedHandleWait() + } + if (recovery.currentPhase === 'disconnected') { + autoRecoveryWindowSpent = true // Why: cached pixels may remain, but no stream from the exhausted epoch may keep delivering or accepting terminal traffic. subscriptionGeneration += 1 closeMultiplexedStream() } + if (recovery.currentPhase === 'idle') { + autoRecoveryWindowSpent = false + } if ( recovery.currentPhase === 'disconnected' || recovery.currentPhase === 'disposed' || @@ -562,11 +571,16 @@ export function createRemoteRuntimePtyTransport( if (settleHostSessionAttachRetry === settle) { settleHostSessionAttachRetry = null } + // Why: this wait is single-shot, so replaying it after the cutoff would strand the pane in 'recovering' with no RPC in flight. + recovery.discardPendingRetry(scheduledRetry) resolve(retry) } + const scheduledRetry = (): void => { + settle(true) + } settleHostSessionAttachRetry?.(false) settleHostSessionAttachRetry = settle - if (!recovery.schedule(recoveryEpoch, () => settle(true))) { + if (!recovery.schedule(recoveryEpoch, scheduledRetry)) { settle(false) } }) @@ -1257,6 +1271,7 @@ export function createRemoteRuntimePtyTransport( function clearPublishedHandleWait(): void { stopWaitingForPublishedHandle?.() stopWaitingForPublishedHandle = null + publishedHandleWaitEpoch = null } function isCurrentRemoteTerminal(targetHandle: string, targetPtyId: string | null): boolean { @@ -1329,9 +1344,30 @@ export function createRemoteRuntimePtyTransport( retireRemoteTerminalId() return } - if (!update.terminalHandle || update.terminalHandle === previousHandle) { + if (!update.terminalHandle) { return } + if (update.terminalHandle === previousHandle) { + // Why: once the auto-recovery window is spent, a host still publishing this surface is evidence the fenced handle outlived the stale error. + if (!autoRecoveryWindowSpent || getCurrentMultiplexedStream(previousHandle)) { + return + } + // Why: one reattach per spent window, so a handle that really is dead is not retried on every host snapshot. + autoRecoveryWindowSpent = false + const reattachEpoch = recovery.begin() + clearPublishedHandleWait() + const reusedPtyId = remotePtyId + void subscribeToHandle(reattachEpoch, true).catch((error) => { + if (!recoverAfterSubscribeFailure(error, previousHandle, reusedPtyId)) { + handleRemoteTerminalError(error) + } + }) + return + } + if (recovery.currentPhase === 'disconnected') { + // Why: without a live epoch a failed resubscribe is swallowed as already-latched, leaving a pane with no handle and no way back. + recovery.begin() + } rebindRemoteTerminalHandle(update.terminalHandle) const reboundHandle = handle const reboundPtyId = remotePtyId @@ -1440,6 +1476,13 @@ export function createRemoteRuntimePtyTransport( code: 'remote_runtime_unavailable' }) } + // Why: liveness is unknown, so auto-retry stops here; keep an unarmed retry parked for online/resume/reconnect to fire. + recovery.parkRetryForExternalTrigger(recoveryEpoch, (nextEpoch) => { + scheduleResubscribeAfterTransportClose( + handle ? getRecoveryReplacementPolicy(handle) : 'reuse', + nextEpoch + ) + }) return } if (!nextHandle) { @@ -1507,8 +1550,12 @@ export function createRemoteRuntimePtyTransport( clearPendingViewportClaim() } strengthenRecoveryReplacementPolicy(handle, replacementPolicy) - if (replacementPolicy === 'require-replacement' && stopWaitingForPublishedHandle) { - // Why: once recovery is handed to accepted snapshots, repeated sends to the stale handle must not re-arm inventory RPCs. + if ( + replacementPolicy === 'require-replacement' && + stopWaitingForPublishedHandle && + // Why: only the epoch that handed recovery to accepted snapshots is blocked; a newer epoch is a fresh attempt, not a repeated stale send. + publishedHandleWaitEpoch === recoveryEpoch + ) { return } if (resubscribeEpoch === recoveryEpoch) { @@ -1529,6 +1576,7 @@ export function createRemoteRuntimePtyTransport( if (tabId && isWebTerminalSurfaceTabId(tabId)) { // Why: subscribe before polling so a fresh host snapshot can't land in the gap between the inventory loop and its event-driven fallback. waitForPublishedHostSessionHandle(toHostSessionTabId(tabId), resubscribeHandle) + publishedHandleWaitEpoch = recoveryEpoch } resubscribeEpoch = recoveryEpoch resubscribeRequestedHandle = null From ed4d6979b13c05bc0d5ff066b334a2efcec43d74 Mon Sep 17 00:00:00 2001 From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:11:36 -0700 Subject: [PATCH 11/72] fix(app): await durable checkpoints before restart actions (#12433) * fix(app): await durable checkpoints before restart actions * fix(app): clear restart latch after refused reload * fix(persistence): invalidate hash after stale rename --- .../ipc/renderer-shutdown-checkpoint.test.ts | 2 +- src/main/ipc/renderer-shutdown-checkpoint.ts | 4 +- .../persistence-async-write-syscalls.test.ts | 272 ++++++++++-------- src/main/persistence.ts | 30 +- .../app-restart-checkpoint-routing.test.ts | 93 ++++++ src/preload/index.ts | 45 ++- src/preload/renderer-restart-wiring.test.ts | 8 +- src/preload/renderer-restart-wiring.ts | 21 ++ .../github-project/GhAuthErrorHelp.test.ts | 25 +- .../github-project/GhAuthErrorHelp.tsx | 14 +- 10 files changed, 346 insertions(+), 168 deletions(-) create mode 100644 src/preload/app-restart-checkpoint-routing.test.ts diff --git a/src/main/ipc/renderer-shutdown-checkpoint.test.ts b/src/main/ipc/renderer-shutdown-checkpoint.test.ts index 76fc0509eea..abbb77ab087 100644 --- a/src/main/ipc/renderer-shutdown-checkpoint.test.ts +++ b/src/main/ipc/renderer-shutdown-checkpoint.test.ts @@ -74,7 +74,7 @@ describe('registerRendererShutdownCheckpointHandler', () => { ) expect(store.updateUI).toHaveBeenCalledWith({ activeView: 'settings' }) expect(store.flushPendingOrThrowAsync).toHaveBeenCalledTimes(1) - // Why: a live app keeps mutating state, so draining to a stable generation would livelock. + // Why: Store fences the staged generation without draining unrelated live mutations. expect(store.flushPendingOrThrowAsync).toHaveBeenCalledWith( expect.objectContaining({ drainToStableGeneration: false }) ) diff --git a/src/main/ipc/renderer-shutdown-checkpoint.ts b/src/main/ipc/renderer-shutdown-checkpoint.ts index e875f950d75..121ff86b2e3 100644 --- a/src/main/ipc/renderer-shutdown-checkpoint.ts +++ b/src/main/ipc/renderer-shutdown-checkpoint.ts @@ -23,8 +23,8 @@ function flushStagedStateWithDeadline(store: Store): Promise ({ ok: true })) diff --git a/src/main/persistence-async-write-syscalls.test.ts b/src/main/persistence-async-write-syscalls.test.ts index 2b3a6ea68b1..2d6d581599e 100644 --- a/src/main/persistence-async-write-syscalls.test.ts +++ b/src/main/persistence-async-write-syscalls.test.ts @@ -143,7 +143,7 @@ type TestStore = { waitForPendingWrite(): Promise flushOrThrow(): void flushPendingAsync(): Promise - flushPendingOrThrowAsync(): Promise + flushPendingOrThrowAsync(options?: { drainToStableGeneration?: boolean }): Promise upsertSshPtyConsumerRecovery(record: { targetId: string clientInstanceId: string @@ -185,6 +185,36 @@ function dataFile(dir: string): string { return join(dir, 'orca-data.json') } +function deferred(): { promise: Promise; resolve: () => void } { + let resolve!: () => void + const promise = new Promise((next) => { + resolve = next + }) + return { promise, resolve } +} + +function recordFsCalls(dir: string): void { + fsCalls.dirPrefix = dir + fsCalls.recording = true +} + +function delayNextDataFileRename(dir: string): ReturnType & { + started: Promise +} { + const release = deferred() + const started = deferred() + let held = false + fsCalls.waitAsync = (fn, target) => { + if (held || fn !== 'rename' || !target.startsWith(dataFile(dir))) { + return null + } + held = true + started.resolve() + return release.promise + } + return { ...release, started: started.promise } +} + function seedStaleBackup(dir: string): void { const path = `${dataFile(dir)}.bak.0` writeFileSync(path, '{"stale":true}', 'utf-8') @@ -232,8 +262,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { sidebarWidth: number ): Promise { store.updateUI({ sidebarWidth }) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) try { vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS) await store.waitForPendingWrite() @@ -322,8 +351,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { const staleBackup = readFileSync(`${dataFile(dir)}.bak.0`, 'utf-8') store.updateUI({ sidebarWidth: 361 }) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) let flushed = false fsCalls.beforeAsync = (fn, target) => { if (flushed || fn !== 'stat' || !target.endsWith('.bak.0')) { @@ -351,34 +379,19 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { it('a sync checkpoint vetoes an async write already parked on rename', async () => { const dir = makeDir() const store = await createStore(dir) - let releaseRename!: () => void - const renameRelease = new Promise((resolve) => { - releaseRename = resolve - }) - let signalRename!: () => void - const renameStarted = new Promise((resolve) => { - signalRename = resolve - }) - fsCalls.waitAsync = (fn, target) => { - if (fn !== 'rename' || target === dataFile(dir) || !target.startsWith(dataFile(dir))) { - return null - } - signalRename() - return renameRelease - } + const rename = delayNextDataFileRename(dir) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) store.updateUI({ sidebarWidth: 501 }) vi.advanceTimersByTime(SAVE_DEBOUNCE_MS) const pending = store.waitForPendingWrite() - await renameStarted + await rename.started store.updateUI({ sidebarWidth: 502 }) store.flushOrThrow() expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(502) - releaseRename() + rename.resolve() await pending fsCalls.recording = false fsCalls.waitAsync = null @@ -391,8 +404,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { const dir = makeDir() const store = await createStore(dir) const errors = vi.spyOn(console, 'error').mockImplementation(() => {}) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) fsCalls.failAsync = (fn, target) => fn === 'rename' && target.startsWith(dataFile(dir)) && !target.includes('.bak.') ? Object.assign(new Error('mount disappeared'), { code: 'ENOENT' }) @@ -413,31 +425,14 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { it('the throwing async barrier drains mutations made during its write', async () => { const dir = makeDir() const store = await createStore(dir) - let releaseRename!: () => void - const renameRelease = new Promise((resolve) => { - releaseRename = resolve - }) - let signalRename!: () => void - const renameStarted = new Promise((resolve) => { - signalRename = resolve - }) - let held = false - fsCalls.waitAsync = (fn, target) => { - if (held || fn !== 'rename' || !target.startsWith(dataFile(dir))) { - return null - } - held = true - signalRename() - return renameRelease - } - fsCalls.dirPrefix = dir - fsCalls.recording = true + const rename = delayNextDataFileRename(dir) + recordFsCalls(dir) store.updateUI({ sidebarWidth: 601 }) const barrier = store.flushPendingOrThrowAsync() - await renameStarted + await rename.started store.updateUI({ sidebarWidth: 602 }) - releaseRename() + rename.resolve() await barrier fsCalls.recording = false @@ -447,31 +442,14 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { it('bounds a best-effort flush to one state generation', async () => { const dir = makeDir() const store = await createStore(dir) - let releaseRename!: () => void - const renameRelease = new Promise((resolve) => { - releaseRename = resolve - }) - let signalRename!: () => void - const renameStarted = new Promise((resolve) => { - signalRename = resolve - }) - let held = false - fsCalls.waitAsync = (fn, target) => { - if (held || fn !== 'rename' || !target.startsWith(dataFile(dir))) { - return null - } - held = true - signalRename() - return renameRelease - } - fsCalls.dirPrefix = dir - fsCalls.recording = true + const rename = delayNextDataFileRename(dir) + recordFsCalls(dir) store.updateUI({ sidebarWidth: 621 }) const flush = store.flushPendingAsync() - await renameStarted + await rename.started store.updateUI({ sidebarWidth: 622 }) - releaseRename() + rename.resolve() await flush fsCalls.recording = false @@ -481,33 +459,96 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(622) }) + it('keeps a bounded barrier open when its staged writer is superseded before rename', async () => { + const dir = makeDir() + const store = await createStore(dir) + const openRelease = deferred() + const openStarted = deferred() + const renameRelease = deferred() + const renameStarted = deferred() + let heldOpen = false + let heldRename = false + fsCalls.waitAsync = (fn, target) => { + if ( + !heldOpen && + fn === 'open' && + target.startsWith(dataFile(dir)) && + target.endsWith('.tmp') + ) { + heldOpen = true + openStarted.resolve() + return openRelease.promise + } + if (!heldRename && fn === 'rename' && target.startsWith(dataFile(dir))) { + heldRename = true + renameStarted.resolve() + return renameRelease.promise + } + return null + } + recordFsCalls(dir) + + store.updateUI({ sidebarWidth: 631 }) + const barrier = store.flushPendingOrThrowAsync({ drainToStableGeneration: false }) + await openStarted.promise + store.updateUI({ sidebarWidth: 632 }) + openRelease.resolve() + const firstOutcome = await Promise.race([ + barrier.then(() => 'settled' as const), + renameStarted.promise.then(() => 'retrying' as const) + ]) + + expect(firstOutcome).toBe('retrying') + renameRelease.resolve() + await barrier + fsCalls.recording = false + + expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(632) + }) + + it('rewrites a matching hash after a superseded rename installed stale state', async () => { + const dir = makeDir() + const store = await createStore(dir) + store.updateUI({ sidebarWidth: 641 }) + await store.flushPendingOrThrowAsync() + const rename = delayNextDataFileRename(dir) + recordFsCalls(dir) + + store.updateUI({ sidebarWidth: 642 }) + vi.advanceTimersByTime(SAVE_DEBOUNCE_MS) + const staleWrite = store.waitForPendingWrite() + await rename.started + store.updateUI({ sidebarWidth: 641 }) + rename.resolve() + await staleWrite + + expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(642) + await store.flushPendingOrThrowAsync({ drainToStableGeneration: false }) + fsCalls.recording = false + + expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(641) + }) + it('the throwing async barrier drains mutations made during sidecar I/O', async () => { const dir = makeDir() const store = await createStore(dir) - let releaseRename!: () => void - const renameRelease = new Promise((resolve) => { - releaseRename = resolve - }) - let signalRename!: () => void - const renameStarted = new Promise((resolve) => { - signalRename = resolve - }) + const renameRelease = deferred() + const renameStarted = deferred() fsCalls.waitAsync = (fn, target) => { if (fn !== 'rename' || !target.includes('orca-github-cache.json.')) { return null } - signalRename() - return renameRelease + renameStarted.resolve() + return renameRelease.promise } - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) store.updateUI({ sidebarWidth: 611 }) store.setGitHubCache({ pr: {}, issue: {} }) const barrier = store.flushPendingOrThrowAsync() - await renameStarted + await renameStarted.promise store.updateUI({ sidebarWidth: 612 }) - releaseRename() + renameRelease.resolve() await barrier fsCalls.recording = false @@ -522,42 +563,35 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { utimesSync(`${dataFile(dir)}.bak.0`, almostDueSeconds, almostDueSeconds) const staleBackup = readFileSync(`${dataFile(dir)}.bak.0`, 'utf-8') const statCall = `stat:${dataFile(dir)}.bak.0` - let releaseRotation!: () => void - const rotationRelease = new Promise((resolve) => { - releaseRotation = resolve - }) - let signalRotation!: () => void - const rotationStarted = new Promise((resolve) => { - signalRotation = resolve - }) + const rotationRelease = deferred() + const rotationStarted = deferred() let held = false fsCalls.waitAsync = (fn, target) => { if (held || fn !== 'stat' || target !== `${dataFile(dir)}.bak.0`) { return null } held = true - signalRotation() - return rotationRelease + rotationStarted.resolve() + return rotationRelease.promise } - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) store.updateUI({ sidebarWidth: 371 }) vi.advanceTimersByTime(SAVE_DEBOUNCE_MS) const firstWrite = store.waitForPendingWrite() let allWrites = firstWrite try { - await rotationStarted + await rotationStarted.promise store.updateUI({ sidebarWidth: 372 }) store.flushOrThrow() store.updateUI({ sidebarWidth: 373 }) vi.advanceTimersByTime(SAVE_DEBOUNCE_MS) allWrites = store.waitForPendingWrite() expect(fsCalls.asyncCalls.filter((call) => call === statCall)).toHaveLength(1) - releaseRotation() + rotationRelease.resolve() await Promise.all([firstWrite, allWrites]) } finally { - releaseRotation() + rotationRelease.resolve() await allWrites fsCalls.recording = false fsCalls.waitAsync = null @@ -579,8 +613,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { const expectedTarget = `${dataFile(dir)}${targetSuffix}` store.updateUI({ sidebarWidth: 363 }) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) let flushed = false fsCalls.beforeAsync = (fn, target) => { if (flushed || fn !== expectedFn || target !== expectedTarget) { @@ -688,8 +721,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { const dir = makeDir() const store = await createStore(dir) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) try { await store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1')) } finally { @@ -710,8 +742,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { const store = await createStore(dir) const writeError = Object.assign(new Error('profile mount rejected write'), { code: 'EIO' }) const errors = vi.spyOn(console, 'error').mockImplementation(() => {}) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) fsCalls.failAsync = (fn, target) => fn === 'open' && target.startsWith(`${dataFile(dir)}.`) ? writeError : null @@ -730,8 +761,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { const store = await createStore(dir) await store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1')) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) try { await store.removeSshPtyConsumerRecovery('ssh-1') } finally { @@ -750,8 +780,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { const store = await createStore(dir) store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-1', state: 'attached' }) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) try { await store.markSshRemotePtyLeasesAsync('ssh-1', 'detached') } finally { @@ -774,8 +803,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { // Why: a PTY that exits mid-reattach is terminated before the batch write lands; it must stay dead. store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-4', state: 'terminated' }) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) try { await store.markSshRemotePtyLeasesAttachedAsync('ssh-1', ['pty-1', 'pty-2', 'pty-4']) } finally { @@ -799,39 +827,32 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { it('keeps async writers serialized across a synchronous shutdown flush', async () => { const dir = makeDir() const store = await createStore(dir) - let signalFirstOpen!: () => void - const firstOpen = new Promise((resolve) => { - signalFirstOpen = resolve - }) - let releaseFirstOpen!: () => void - const firstOpenRelease = new Promise((resolve) => { - releaseFirstOpen = resolve - }) + const firstOpen = deferred() + const firstOpenRelease = deferred() let held = false fsCalls.waitAsync = (fn, target) => { if (held || fn !== 'open' || !target.endsWith('.tmp')) { return null } held = true - signalFirstOpen() - return firstOpenRelease + firstOpen.resolve() + return firstOpenRelease.promise } - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) try { const firstWrite = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1')) - await firstOpen + await firstOpen.promise store.flushOrThrow() const secondWrite = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-2')) await Promise.resolve() await Promise.resolve() expect(fsCalls.asyncCalls.filter((call) => call.startsWith('open:'))).toHaveLength(1) - releaseFirstOpen() + firstOpenRelease.resolve() await Promise.all([firstWrite, secondWrite]) } finally { - releaseFirstOpen() + firstOpenRelease.resolve() fsCalls.recording = false fsCalls.waitAsync = null } @@ -885,8 +906,7 @@ describe('async persistence write path avoids synchronous fs syscalls', () => { seedStaleBackup(dir) store.updateUI({ sidebarWidth: 331 }) - fsCalls.dirPrefix = dir - fsCalls.recording = true + recordFsCalls(dir) try { store.flushOrThrow() } finally { diff --git a/src/main/persistence.ts b/src/main/persistence.ts index 077d9b871a7..f74f5d92644 100644 --- a/src/main/persistence.ts +++ b/src/main/persistence.ts @@ -2786,6 +2786,7 @@ export class Store { private quitFlushPromise: Promise | null = null // Content hash at last write, to skip no-op writes; derived from the payload with encrypted blobs normalized back to plaintext (see buildStateToSave), since encrypt() uses a random IV per call. private lastWrittenStateHash: string | null = null + private lastDurableWriteGeneration = -1 private firstPendingSaveAt: number | null = null private githubCacheDirty = false private githubCacheGeneration = 0 @@ -3941,6 +3942,7 @@ export class Store { const { payload, stateHash } = this.buildStateToSave() // Why: don't rewrite a byte-identical multi-MB file when state nets out to already-persisted. if (stateHash === this.lastWrittenStateHash) { + this.lastDurableWriteGeneration = Math.max(this.lastDurableWriteGeneration, gen) return } const dataFile = this.dataFile @@ -3976,9 +3978,14 @@ export class Store { this.inFlightAsyncTmpFile = null } } - // Why re-check gen: a sync flush during the rename await may have written fresher state; don't record a stale hash over it. + // Why re-check gen: a mutation or sync flush during rename makes the installed hash ambiguous; invalidate the no-op guard. if (renamed && this.writeGeneration === gen) { this.lastWrittenStateHash = stateHash + } else if (renamed) { + this.lastWrittenStateHash = null + } + if (renamed) { + this.lastDurableWriteGeneration = Math.max(this.lastDurableWriteGeneration, gen) } } finally { if (!renamed) { @@ -4020,6 +4027,10 @@ export class Store { writeFileDurableSync(tmpFile, dataFile, payload) renamed = true this.lastWrittenStateHash = stateHash + this.lastDurableWriteGeneration = Math.max( + this.lastDurableWriteGeneration, + this.writeGeneration + ) } finally { if (!renamed) { try { @@ -7297,7 +7308,7 @@ export class Store { if (this.writesFrozen || this.quitFlushStarted) { return Promise.reject(new Error('Cannot flush while persistence is finalized')) } - return this.flushCurrentStateAsync(false, options.signal, options.drainToStableGeneration) + return this.flushCurrentStateAsync(false, options.signal, options.drainToStableGeneration, true) } // Async twin of flushOrThrow: durable state only. Active-view and GitHub sidecars are @@ -7323,8 +7334,10 @@ export class Store { private async flushCurrentStateAsync( final: boolean, signal?: AbortSignal, - drainToStableGeneration = true + drainToStableGeneration = true, + requireInitialGenerationDurable = false ): Promise { + const requiredDurableGeneration = requireInitialGenerationDurable ? this.writeGeneration : null for (;;) { if (signal?.aborted) { throw new Error('Persistence flush aborted') @@ -7351,7 +7364,16 @@ export class Store { if (signal?.aborted) { throw new Error('Persistence flush aborted') } - if (!drainToStableGeneration || generation === this.writeGeneration) { + if (!drainToStableGeneration) { + if ( + requiredDurableGeneration === null || + this.lastDurableWriteGeneration >= requiredDurableGeneration + ) { + break + } + continue + } + if (generation === this.writeGeneration) { break } } diff --git a/src/preload/app-restart-checkpoint-routing.test.ts b/src/preload/app-restart-checkpoint-routing.test.ts new file mode 100644 index 00000000000..9f64569e3ca --- /dev/null +++ b/src/preload/app-restart-checkpoint-routing.test.ts @@ -0,0 +1,93 @@ +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import type { PreloadApi } from './api-types' +import { + ORCA_APP_RESTART_ABORTED_EVENT, + ORCA_APP_RESTART_STARTED_EVENT +} from '../shared/updater-renderer-events' + +const { exposeInMainWorld, invoke, on, removeListener, send, sendSync } = vi.hoisted(() => ({ + exposeInMainWorld: vi.fn(), + invoke: vi.fn(), + on: vi.fn(), + removeListener: vi.fn(), + send: vi.fn(), + sendSync: vi.fn() +})) + +vi.mock('electron', () => ({ + contextBridge: { exposeInMainWorld }, + ipcRenderer: { invoke, on, removeListener, send, sendSync }, + webFrame: { + getZoomFactor: vi.fn(() => 1), + setZoomFactor: vi.fn(), + setVisualZoomLevelLimits: vi.fn() + }, + webUtils: { getPathForFile: vi.fn(() => '') } +})) + +vi.mock('@electron-toolkit/preload', () => ({ electronAPI: {} })) + +describe('native preload destructive app actions', () => { + const originalContextIsolated = Object.getOwnPropertyDescriptor(process, 'contextIsolated') + let eventTarget: EventTarget + + beforeEach(() => { + vi.resetModules() + exposeInMainWorld.mockReset() + invoke.mockReset() + on.mockReset() + removeListener.mockReset() + send.mockReset() + sendSync.mockReset() + Object.defineProperty(process, 'contextIsolated', { configurable: true, value: true }) + eventTarget = new EventTarget() + vi.stubGlobal('window', eventTarget) + vi.stubGlobal('document', { addEventListener: vi.fn() }) + }) + + afterEach(() => { + vi.unstubAllGlobals() + if (originalContextIsolated) { + Object.defineProperty(process, 'contextIsolated', originalContextIsolated) + } else { + Reflect.deleteProperty(process, 'contextIsolated') + } + }) + + const loadApi = async (): Promise => { + await import('./index') + return exposeInMainWorld.mock.calls.find(([name]) => name === 'api')?.[1] as PreloadApi + } + + for (const action of ['reload', 'relaunch'] as const) { + it(`prepares and awaits durability before ${action}`, async () => { + const api = await loadApi() + const calls: string[] = [] + eventTarget.addEventListener(ORCA_APP_RESTART_STARTED_EVENT, () => calls.push('prepared')) + invoke.mockImplementation(async (channel: string) => { + calls.push(channel) + return channel === 'app:await-before-unload-checkpoint' ? { ok: true } : undefined + }) + + await api.app[action]() + + expect(calls).toEqual(['prepared', 'app:await-before-unload-checkpoint', `app:${action}`]) + }) + + it(`refuses ${action} when the durable checkpoint fails`, async () => { + const api = await loadApi() + const aborted = vi.fn() + eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, aborted) + invoke.mockImplementation(async (channel: string) => + channel === 'app:await-before-unload-checkpoint' ? { ok: false } : undefined + ) + + await expect(api.app[action]()).rejects.toThrow( + 'Failed to persist renderer state before unload.' + ) + + expect(invoke).not.toHaveBeenCalledWith(`app:${action}`) + expect(aborted).toHaveBeenCalledTimes(1) + }) + } +}) diff --git a/src/preload/index.ts b/src/preload/index.ts index de829aafe37..13a450bce83 100644 --- a/src/preload/index.ts +++ b/src/preload/index.ts @@ -241,11 +241,7 @@ import type { } from '../shared/ai-vault-types' import type { AiVaultPrepareSessionResumeArgs } from '../shared/ai-vault-resume-preparation' import type { AgentType } from '../shared/native-chat-types' -import { - ORCA_APP_RESTART_ABORTED_EVENT, - ORCA_APP_RESTART_STARTED_EVENT, - ORCA_UPDATER_QUIT_AND_INSTALL_ABORTED_EVENT -} from '../shared/updater-renderer-events' +import { ORCA_UPDATER_QUIT_AND_INSTALL_ABORTED_EVENT } from '../shared/updater-renderer-events' import { ORCA_INTERNAL_FILE_DRAG_TYPE, createNativeFileDropPayload, @@ -281,11 +277,9 @@ import type { } from '../shared/crash-reporting' import type { RendererHeapStatistics } from '../shared/renderer-heap-statistics' import { readRendererHeapStatistics } from './renderer-heap-statistics-reader' +import { createUpdaterQuitAbortRelay } from '../shared/renderer-restart-preparation' import { - createUpdaterQuitAbortRelay, - prepareRendererForAppRestart -} from '../shared/renderer-restart-preparation' -import { + prepareAndInvokeAppRestart, prepareAndInvokeUpdaterInstall, registerRendererRestartIpcRelays } from './renderer-restart-wiring' @@ -486,21 +480,24 @@ const api = { getIdentity: (): Promise => ipcRenderer.invoke('app:getIdentity'), getFeatureWallAssetBaseUrl: (): Promise => ipcRenderer.invoke('app:getFeatureWallAssetBaseUrl'), - relaunch: (): Promise => ipcRenderer.invoke('app:relaunch'), - restart: async (): Promise => { - await prepareRendererForAppRestart(window, { - startedEventName: ORCA_APP_RESTART_STARTED_EVENT, - abortedEventName: ORCA_APP_RESTART_ABORTED_EVENT, - awaitCheckpoint: awaitBeforeUnloadCheckpoint - }) - try { - return await ipcRenderer.invoke('app:restart') - } catch (error) { - window.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT)) - throw error - } - }, - reload: (): Promise => ipcRenderer.invoke('app:reload'), + relaunch: (): Promise => + prepareAndInvokeAppRestart( + window, + () => ipcRenderer.invoke('app:relaunch'), + awaitBeforeUnloadCheckpoint + ), + restart: (): Promise => + prepareAndInvokeAppRestart( + window, + () => ipcRenderer.invoke('app:restart'), + awaitBeforeUnloadCheckpoint + ), + reload: (): Promise => + prepareAndInvokeAppRestart( + window, + () => ipcRenderer.invoke('app:reload'), + awaitBeforeUnloadCheckpoint + ), stageBeforeUnloadSync: (args: Parameters[0]) => { const result = ipcRenderer.sendSync('app:stage-before-unload-sync', args) as { ok?: unknown diff --git a/src/preload/renderer-restart-wiring.test.ts b/src/preload/renderer-restart-wiring.test.ts index 0198c72a44f..06be6537fcb 100644 --- a/src/preload/renderer-restart-wiring.test.ts +++ b/src/preload/renderer-restart-wiring.test.ts @@ -1,6 +1,9 @@ import { describe, expect, it, vi } from 'vitest' import { ORCA_RENDERER_UNLOAD_PREVENTED_EVENT } from '../shared/renderer-shutdown-events' -import { ORCA_UPDATER_QUIT_AND_INSTALL_STARTED_EVENT } from '../shared/updater-renderer-events' +import { + ORCA_APP_RESTART_ABORTED_EVENT, + ORCA_UPDATER_QUIT_AND_INSTALL_STARTED_EVENT +} from '../shared/updater-renderer-events' import { prepareAndInvokeUpdaterInstall, registerRendererRestartIpcRelays @@ -10,6 +13,7 @@ describe('renderer restart wiring', () => { it('relays updater status and prevented unload events', () => { const eventTarget = new EventTarget() const unloadPrevented = vi.fn() + const restartAborted = vi.fn() const handleStatus = vi.fn() const listeners = new Map void>() const ipcRenderer = { @@ -19,6 +23,7 @@ describe('renderer restart wiring', () => { }) } as unknown as Parameters[0] eventTarget.addEventListener(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT, unloadPrevented) + eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, restartAborted) registerRendererRestartIpcRelays(ipcRenderer, eventTarget, { handleStatus }) listeners.get('updater:status')?.({}, { state: 'error', message: 'install failed' }) @@ -27,6 +32,7 @@ describe('renderer restart wiring', () => { expect(ipcRenderer.on).toHaveBeenCalledTimes(2) expect(handleStatus).toHaveBeenCalledWith({ state: 'error', message: 'install failed' }) expect(unloadPrevented).toHaveBeenCalledTimes(1) + expect(restartAborted).toHaveBeenCalledTimes(1) }) it('marks preparation before invoking main and aborts on IPC failure', async () => { diff --git a/src/preload/renderer-restart-wiring.ts b/src/preload/renderer-restart-wiring.ts index 254d386403a..9b140e7116b 100644 --- a/src/preload/renderer-restart-wiring.ts +++ b/src/preload/renderer-restart-wiring.ts @@ -6,6 +6,8 @@ import { } from '../shared/renderer-restart-preparation' import type { UpdateStatus } from '../shared/types' import { + ORCA_APP_RESTART_ABORTED_EVENT, + ORCA_APP_RESTART_STARTED_EVENT, ORCA_UPDATER_QUIT_AND_INSTALL_ABORTED_EVENT, ORCA_UPDATER_QUIT_AND_INSTALL_STARTED_EVENT } from '../shared/updater-renderer-events' @@ -20,6 +22,7 @@ export function registerRendererRestartIpcRelays( }) ipcRenderer.on('window:unload-prevented', () => { eventTarget.dispatchEvent(new Event(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT)) + eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT)) }) } @@ -42,3 +45,21 @@ export async function prepareAndInvokeUpdaterInstall( throw error } } + +export async function prepareAndInvokeAppRestart( + eventTarget: EventTarget, + invoke: () => Promise, + awaitCheckpoint: () => Promise +): Promise { + await prepareRendererForAppRestart(eventTarget, { + startedEventName: ORCA_APP_RESTART_STARTED_EVENT, + abortedEventName: ORCA_APP_RESTART_ABORTED_EVENT, + awaitCheckpoint + }) + try { + await invoke() + } catch (error) { + eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT)) + throw error + } +} diff --git a/src/renderer/src/components/github-project/GhAuthErrorHelp.test.ts b/src/renderer/src/components/github-project/GhAuthErrorHelp.test.ts index da666d54523..248783de9e0 100644 --- a/src/renderer/src/components/github-project/GhAuthErrorHelp.test.ts +++ b/src/renderer/src/components/github-project/GhAuthErrorHelp.test.ts @@ -1,11 +1,16 @@ -import { describe, expect, it, vi } from 'vitest' +import { afterEach, describe, expect, it, vi } from 'vitest' import type { GhAuthDiagnostic } from '../../../../shared/github-auth-types' vi.mock('@/i18n/i18n', () => ({ translate: (_key: string, fallback: string) => fallback })) -import { buildRemediation } from './GhAuthErrorHelp' +import { buildRemediation, reloadOrcaRenderer } from './GhAuthErrorHelp' + +afterEach(() => { + vi.restoreAllMocks() + vi.unstubAllGlobals() +}) function diagnostic(overrides: Partial = {}): GhAuthDiagnostic { return { @@ -57,4 +62,20 @@ describe('GitHub Project auth remediation host routing', () => { } ]) }) + + it('does not force navigation when the checkpointed reload is refused', async () => { + const reload = vi.fn(() => Promise.reject(new Error('checkpoint failed'))) + const locationReload = vi.fn() + const errors = vi.spyOn(console, 'error').mockImplementation(() => {}) + vi.stubGlobal('window', { + api: { app: { reload } }, + location: { reload: locationReload } + }) + + reloadOrcaRenderer() + await vi.waitFor(() => expect(errors).toHaveBeenCalledTimes(1)) + + expect(reload).toHaveBeenCalledTimes(1) + expect(locationReload).not.toHaveBeenCalled() + }) }) diff --git a/src/renderer/src/components/github-project/GhAuthErrorHelp.tsx b/src/renderer/src/components/github-project/GhAuthErrorHelp.tsx index 30d1ea61b16..7bbeff291d7 100644 --- a/src/renderer/src/components/github-project/GhAuthErrorHelp.tsx +++ b/src/renderer/src/components/github-project/GhAuthErrorHelp.tsx @@ -40,14 +40,12 @@ function refreshCommandForHost(host: string | null | undefined): string { // macOS/Linux vs PowerShell on Windows. const IS_WINDOWS = typeof navigator !== 'undefined' && /Win(dows|32|64)/i.test(navigator.userAgent) -function reloadOrcaRenderer(): void { - const reload = window.api.app.reload - if (typeof reload !== 'function') { - window.location.reload() - return - } - void reload().catch(() => { - window.location.reload() +export function reloadOrcaRenderer(): void { + void window.api.app.reload().catch((error) => { + console.error( + '[github-projects] Renderer reload refused:', + error instanceof Error ? error.name : typeof error + ) }) } From e8d4818b5a0b4e349ab7360acff602e5459adc40 Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:18:15 -0700 Subject: [PATCH 12/72] test(env): keep happy-dom MutationObserver callbacks alive across GC (#12438) happy-dom holds each observer's internal callback in a WeakRef, so a GC pause under sharded CI load permanently kills a still-connected observer. That is what made the activity portal readiness test flake: once the observer died, no amount of re-applying ready DOM could release the latch. Co-authored-by: Orca --- ...py-dom-mutation-observer-retention.test.ts | 72 +++++++++++++++++ .../happy-dom-mutation-observer-retention.ts | 81 +++++++++++++++++++ config/vitest.config.ts | 2 + 3 files changed, 155 insertions(+) create mode 100644 config/scripts/happy-dom-mutation-observer-retention.test.ts create mode 100644 config/scripts/happy-dom-mutation-observer-retention.ts diff --git a/config/scripts/happy-dom-mutation-observer-retention.test.ts b/config/scripts/happy-dom-mutation-observer-retention.test.ts new file mode 100644 index 00000000000..475a84c9b31 --- /dev/null +++ b/config/scripts/happy-dom-mutation-observer-retention.test.ts @@ -0,0 +1,72 @@ +/** @vitest-environment happy-dom */ +import { describe, expect, it } from 'vitest' + +import { + installHappyDomMutationObserverRetention, + retainedMutationCallbackCount +} from './happy-dom-mutation-observer-retention' + +function readListenerCallbacks(target: Node): unknown[] { + const listenersSymbol = Object.getOwnPropertySymbols(target).find( + (candidate) => candidate.description === 'mutationListeners' + ) + const listeners = listenersSymbol + ? (target as unknown as Record)[listenersSymbol] + : [] + if (!Array.isArray(listeners)) { + return [] + } + return listeners.map((listener: { callback?: { deref: () => unknown } }) => + listener.callback?.deref() + ) +} + +describe('happy-dom MutationObserver retention', () => { + it('pins the internal callback that happy-dom only holds weakly', () => { + expect(installHappyDomMutationObserverRetention()).toBe(true) + const target = document.createElement('div') + document.body.append(target) + const observer = new MutationObserver(() => {}) + observer.observe(target, { childList: true, subtree: true }) + + const callbacks = readListenerCallbacks(target) + expect(callbacks.length).toBe(1) + expect(callbacks[0]).toBeTypeOf('function') + expect(retainedMutationCallbackCount(observer)).toBe(1) + + observer.disconnect() + expect(retainedMutationCallbackCount(observer)).toBe(0) + target.remove() + }) + + it('keeps delivering records after the weak callback would have been collected', async () => { + installHappyDomMutationObserverRetention() + const target = document.createElement('div') + document.body.append(target) + let deliveries = 0 + const observer = new MutationObserver(() => { + deliveries += 1 + }) + observer.observe(target, { childList: true, subtree: true }) + + target.replaceChildren(document.createElement('div')) + await Promise.resolve() + expect(deliveries).toBe(1) + + const collectGarbage = (globalThis as { gc?: () => void }).gc + if (collectGarbage) { + for (let round = 0; round < 5; round += 1) { + await new Promise((resolve) => setTimeout(resolve, 1)) + collectGarbage() + } + await new Promise((resolve) => setTimeout(resolve, 1)) + } + + target.replaceChildren(document.createElement('span')) + await Promise.resolve() + expect(deliveries).toBe(2) + + observer.disconnect() + target.remove() + }) +}) diff --git a/config/scripts/happy-dom-mutation-observer-retention.ts b/config/scripts/happy-dom-mutation-observer-retention.ts new file mode 100644 index 00000000000..a315b3d520c --- /dev/null +++ b/config/scripts/happy-dom-mutation-observer-retention.ts @@ -0,0 +1,81 @@ +// Why: happy-dom stores each MutationObserver's internal callback in a WeakRef, so any GC pause +// under parallel test load silently and permanently stops a still-connected observer. Browsers +// keep that callback reachable for as long as the observer observes; mirror that lifetime here so +// DOM-driven tests never lose mutation records mid-run. + +type HappyDomMutationListener = { + callback?: { deref: () => unknown } +} + +type PatchableMutationObserver = { + observe: (target: Node, options?: MutationObserverInit) => void + disconnect: () => void +} + +const MUTATION_LISTENERS_SYMBOL_DESCRIPTION = 'mutationListeners' +const RETENTION_INSTALLED = Symbol.for('orca.happyDomMutationObserverRetention') + +const retainedCallbacks = new WeakMap>() + +function readMutationListeners(target: Node): HappyDomMutationListener[] { + const listenersSymbol = Object.getOwnPropertySymbols(target).find( + (candidate) => candidate.description === MUTATION_LISTENERS_SYMBOL_DESCRIPTION + ) + if (!listenersSymbol) { + return [] + } + const listeners = (target as unknown as Record)[listenersSymbol] + return Array.isArray(listeners) ? (listeners as HappyDomMutationListener[]) : [] +} + +/** Number of internal callbacks pinned for `observer`; drops to 0 once it disconnects. */ +export function retainedMutationCallbackCount(observer: MutationObserver): number { + return retainedCallbacks.get(observer)?.size ?? 0 +} + +export function installHappyDomMutationObserverRetention(): boolean { + const observerClass = (globalThis as { MutationObserver?: typeof MutationObserver }) + .MutationObserver + if (!observerClass) { + return false + } + const prototype = observerClass.prototype as unknown as PatchableMutationObserver & + Record + if (prototype[RETENTION_INSTALLED] === true) { + return true + } + const observe = prototype.observe + const disconnect = prototype.disconnect + + prototype.observe = function patchedObserve( + this: object, + target: Node, + options?: MutationObserverInit + ): void { + const existing = new Set(readMutationListeners(target)) + observe.call(this as unknown as PatchableMutationObserver, target, options) + const pinned = retainedCallbacks.get(this) ?? new Set() + for (const listener of readMutationListeners(target)) { + if (existing.has(listener)) { + continue + } + const callback = listener.callback?.deref() + if (callback) { + pinned.add(callback) + } + } + if (pinned.size > 0) { + retainedCallbacks.set(this, pinned) + } + } + + prototype.disconnect = function patchedDisconnect(this: object): void { + disconnect.call(this as unknown as PatchableMutationObserver) + retainedCallbacks.delete(this) + } + + prototype[RETENTION_INSTALLED] = true + return true +} + +installHappyDomMutationObserverRetention() diff --git a/config/vitest.config.ts b/config/vitest.config.ts index 1146cd4a5ca..735e1b2a0af 100644 --- a/config/vitest.config.ts +++ b/config/vitest.config.ts @@ -17,6 +17,8 @@ export default defineConfig({ environment: 'node', // Why: Node 26's undefined Web Storage globals prevent Vitest from installing happy-dom's. execArgv: ['--no-experimental-webstorage'], + // Why: happy-dom drops MutationObserver callbacks on GC; keep them alive like a browser does. + setupFiles: [resolve('config/scripts/happy-dom-mutation-observer-retention.ts')], include: [ 'src/**/*.test.ts', 'src/**/*.test.tsx', From e8d30431074f8723254aafcad32d6e2bf91a6f3e Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:23:33 -0700 Subject: [PATCH 13/72] fix(mobile): stop unrenewed-grace rotation churn and gate cadence gaps (#12426) - skip proactive rotation when the resume confirmation reports renewed=false (a re-resume provably returns the same unchanged deadline; rotating churned one session replacement per clamp floor, ~60/hour, until a fresh credential) - armCredentialReprobe under a held gate mints the tick's pass token so the effective reprobe cadence stays 60s..15min instead of doubling to ~30min - registerFailure honors scheduleRetry=false in gate branches: no reprobe timer is armed while backgrounded/stopped; foreground resume re-arms - extract RelayRetryDelays and supervisor test fakes into their own modules (max-lines) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- .../mobile-endpoint-supervisor-test-fakes.ts | 169 +++++++++++++++ .../mobile-endpoint-supervisor.test.ts | 199 +++--------------- .../transport/mobile-endpoint-supervisor.ts | 5 +- .../mobile-relay-reconnect-controller.test.ts | 42 ++++ .../mobile-relay-reconnect-controller.ts | 76 +++---- .../transport/mobile-relay-retry-delays.ts | 45 ++++ 6 files changed, 319 insertions(+), 217 deletions(-) create mode 100644 mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts create mode 100644 mobile/src/transport/mobile-relay-retry-delays.ts diff --git a/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts new file mode 100644 index 00000000000..d483c6536e8 --- /dev/null +++ b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts @@ -0,0 +1,169 @@ +import { vi } from 'vitest' +import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bundle' +import type { MobileRelayRpcSession } from './mobile-relay-rpc-session' +import type { MobileEndpointSupervisorDependencies } from './mobile-endpoint-supervisor' +import type { RpcClient } from './rpc-client' +import type { MobileConnectionPath, StableLogicalRpcClient } from './stable-logical-rpc-client' +import type { ConnectionState, HostProfile, RpcResponse } from './types' + +export class FakeSession implements RpcClient { + readonly sendRequest = vi.fn( + async (_method: string, _params?: unknown): Promise => ({ + id: 'rpc-1', + ok: true, + result: {}, + _meta: { runtimeId: 'runtime-1' } + }) + ) + readonly subscribe = vi.fn(() => () => {}) + readonly updateTerminalSubscriptionViewport = vi.fn() + readonly notifyForeground = vi.fn() + readonly close = vi.fn() + private readonly listeners = new Set<(state: ConnectionState) => void>() + + constructor(private state: ConnectionState) {} + + getState = () => this.state + getReconnectAttempt = () => 0 + getLastConnectedAt = () => null + onStateChange = (listener: (state: ConnectionState) => void) => { + this.listeners.add(listener) + return () => this.listeners.delete(listener) + } + + publishState(state: ConnectionState): void { + this.state = state + for (const listener of this.listeners) { + listener(state) + } + } +} + +export class FakeRelaySession extends FakeSession implements MobileRelayRpcSession { + constructor( + state: ConnectionState, + private readonly failure: Error | null = null, + private readonly resumeExpiry = Date.now() + 30 * 24 * 3_600_000, + private readonly renewed = true + ) { + super(state) + } + // Why: production-realistic defaults — fictional fake values hid three + // live defects in this subsystem (latch, churn, int32 timer overflow). + getAttachDeadlineAt = () => Date.now() + 10_000 + getResumeExpiresAt = () => this.resumeExpiry + getResumeConfirmation = () => ({ + v: 1 as const, + reqId: 'confirm-1', + currentVersion: 2, + acceptedAs: this.renewed ? ('current' as const) : ('grace' as const), + renewed: this.renewed, + resumeExpiresAt: this.resumeExpiry + }) + getFailure = () => this.failure +} + +export class FakeLogicalClient extends FakeSession implements StableLogicalRpcClient { + private path: MobileConnectionPath + private generation = 1 + + constructor(state: ConnectionState, path: MobileConnectionPath) { + super(state) + this.path = path + } + + migrateTo = vi.fn(async (session: RpcClient, path: MobileConnectionPath) => { + if (session.getState() !== 'connected') { + session.close() + throw new Error(`replacement session ${session.getState()}`) + } + this.path = path + this.generation += 1 + this.publishState('connected') + }) + suspendActiveSession = vi.fn(() => this.publishState('disconnected')) + getActivePath = () => this.path + getGeneration = () => this.generation +} + +export const relay = { + v: 1 as const, + directorUrl: 'https://relay.onorca.dev', + cellUrl: 'https://relay-c1.onorca.dev', + assignmentEpoch: 7, + relayHostId: 'AbCdEf0123_-xyZ9', + e2eeFraming: 2 as const +} +export const host: HostProfile = { + id: 'host-1', + name: 'Blue Whale', + endpoint: 'ws://192.168.1.10:6768', + deviceToken: 'device-token', + publicKeyB64: 'A'.repeat(44), + lastConnected: 1, + endpoints: [ + { id: 'direct-primary', kind: 'lan', url: 'ws://192.168.1.10:6768' }, + { id: 'relay-primary', kind: 'relay', url: 'wss://relay-c1.onorca.dev/v1/connect/id' } + ], + relayHostId: relay.relayHostId, + relay +} +export const bundle: MobileRelayCredentialBundle = { + v: 1, + hostId: host.id, + deviceToken: host.deviceToken, + current: { + token: 'A'.repeat(43), + hash: 'B'.repeat(43), + version: 2, + expiresAt: Number.MAX_SAFE_INTEGER + } +} + +export function dependencies( + overrides: Partial = {} +): MobileEndpointSupervisorDependencies { + return { + openDirect: vi.fn(() => new FakeSession('connected')), + openRelay: vi.fn(() => new FakeRelaySession('connected')), + resolveRelay: vi.fn(async ({ relay }) => relay), + readBundle: vi.fn(async () => bundle), + writeBundle: vi.fn(async () => {}), + saveHost: vi.fn(async () => {}), + now: Date.now, + randomBytes: (length) => new Uint8Array(length).fill(1), + setTimer: setTimeout, + clearTimer: clearTimeout, + ...overrides + } +} + +export function mockCredentialRotation(logical: FakeLogicalClient): void { + let installResult: Record | null = null + logical.sendRequest.mockImplementation(async (method, params) => { + const request = params as { installReqId?: string; reqId?: string } + if (method === 'pairing.provisionRelay') { + installResult = { + v: 1, + reqId: request.reqId, + authorizationMode: 'authenticated-direct', + currentVersion: 3, + resumeExpiresAt: Date.now() + 300_000, + graceExpiresAt: Date.now() + 60_000 + } + return { id: 'rpc-2', ok: true, result: installResult, _meta: { runtimeId: 'runtime-1' } } + } + return { + id: 'rpc-1', + ok: true, + result: { + v: 1, + relay, + installStatus: installResult + ? { v: 1, reqId: request.installReqId, state: 'committed', result: installResult } + : { v: 1, reqId: request.installReqId, state: 'not-found' } + }, + _meta: { runtimeId: 'runtime-1' } + } + }) +} diff --git a/mobile/src/transport/mobile-endpoint-supervisor.test.ts b/mobile/src/transport/mobile-endpoint-supervisor.test.ts index e6d0ff8bb32..d1b8b6918cd 100644 --- a/mobile/src/transport/mobile-endpoint-supervisor.test.ts +++ b/mobile/src/transport/mobile-endpoint-supervisor.test.ts @@ -2,180 +2,22 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bundle' import { hashMobileRelayCredential } from './mobile-relay-credential-hash' import { RelayOuterError } from './mobile-relay-e2ee-link' -import type { MobileRelayRpcSession } from './mobile-relay-rpc-session' import { - MobileEndpointSupervisor, - type MobileEndpointSupervisorDependencies -} from './mobile-endpoint-supervisor' -import type { RpcClient } from './rpc-client' -import type { MobileConnectionPath, StableLogicalRpcClient } from './stable-logical-rpc-client' -import type { ConnectionState, HostProfile, RpcResponse } from './types' + bundle, + dependencies, + FakeLogicalClient, + FakeRelaySession, + FakeSession, + host, + mockCredentialRotation, + relay +} from './mobile-endpoint-supervisor-test-fakes' +import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor' vi.mock('react-native', () => ({ Platform: { OS: 'ios' } })) vi.mock('expo-secure-store', () => ({ WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'when-unlocked' })) vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) })) -class FakeSession implements RpcClient { - readonly sendRequest = vi.fn( - async (_method: string, _params?: unknown): Promise => ({ - id: 'rpc-1', - ok: true, - result: {}, - _meta: { runtimeId: 'runtime-1' } - }) - ) - readonly subscribe = vi.fn(() => () => {}) - readonly updateTerminalSubscriptionViewport = vi.fn() - readonly notifyForeground = vi.fn() - readonly close = vi.fn() - private readonly listeners = new Set<(state: ConnectionState) => void>() - - constructor(private state: ConnectionState) {} - - getState = () => this.state - getReconnectAttempt = () => 0 - getLastConnectedAt = () => null - onStateChange = (listener: (state: ConnectionState) => void) => { - this.listeners.add(listener) - return () => this.listeners.delete(listener) - } - - publishState(state: ConnectionState): void { - this.state = state - for (const listener of this.listeners) { - listener(state) - } - } -} - -class FakeRelaySession extends FakeSession implements MobileRelayRpcSession { - constructor( - state: ConnectionState, - private readonly failure: Error | null = null, - private readonly resumeExpiry = Date.now() + 30 * 24 * 3_600_000 - ) { - super(state) - } - // Why: production-realistic defaults — fictional fake values hid three - // live defects in this subsystem (latch, churn, int32 timer overflow). - getAttachDeadlineAt = () => Date.now() + 10_000 - getResumeExpiresAt = () => this.resumeExpiry - getResumeConfirmation = () => ({ - v: 1 as const, - reqId: 'confirm-1', - currentVersion: 2, - acceptedAs: 'current' as const, - renewed: true, - resumeExpiresAt: this.resumeExpiry - }) - getFailure = () => this.failure -} - -class FakeLogicalClient extends FakeSession implements StableLogicalRpcClient { - private path: MobileConnectionPath - private generation = 1 - - constructor(state: ConnectionState, path: MobileConnectionPath) { - super(state) - this.path = path - } - - migrateTo = vi.fn(async (session: RpcClient, path: MobileConnectionPath) => { - if (session.getState() !== 'connected') { - session.close() - throw new Error(`replacement session ${session.getState()}`) - } - this.path = path - this.generation += 1 - this.publishState('connected') - }) - suspendActiveSession = vi.fn(() => this.publishState('disconnected')) - getActivePath = () => this.path - getGeneration = () => this.generation -} - -const relay = { - v: 1 as const, - directorUrl: 'https://relay.onorca.dev', - cellUrl: 'https://relay-c1.onorca.dev', - assignmentEpoch: 7, - relayHostId: 'AbCdEf0123_-xyZ9', - e2eeFraming: 2 as const -} -const host: HostProfile = { - id: 'host-1', - name: 'Blue Whale', - endpoint: 'ws://192.168.1.10:6768', - deviceToken: 'device-token', - publicKeyB64: 'A'.repeat(44), - lastConnected: 1, - endpoints: [ - { id: 'direct-primary', kind: 'lan', url: 'ws://192.168.1.10:6768' }, - { id: 'relay-primary', kind: 'relay', url: 'wss://relay-c1.onorca.dev/v1/connect/id' } - ], - relayHostId: relay.relayHostId, - relay -} -const bundle: MobileRelayCredentialBundle = { - v: 1, - hostId: host.id, - deviceToken: host.deviceToken, - current: { - token: 'A'.repeat(43), - hash: 'B'.repeat(43), - version: 2, - expiresAt: Number.MAX_SAFE_INTEGER - } -} - -function dependencies( - overrides: Partial = {} -): MobileEndpointSupervisorDependencies { - return { - openDirect: vi.fn(() => new FakeSession('connected')), - openRelay: vi.fn(() => new FakeRelaySession('connected')), - resolveRelay: vi.fn(async ({ relay }) => relay), - readBundle: vi.fn(async () => bundle), - writeBundle: vi.fn(async () => {}), - saveHost: vi.fn(async () => {}), - now: Date.now, - randomBytes: (length) => new Uint8Array(length).fill(1), - setTimer: setTimeout, - clearTimer: clearTimeout, - ...overrides - } -} - -function mockCredentialRotation(logical: FakeLogicalClient): void { - let installResult: Record | null = null - logical.sendRequest.mockImplementation(async (method, params) => { - const request = params as { installReqId?: string; reqId?: string } - if (method === 'pairing.provisionRelay') { - installResult = { - v: 1, - reqId: request.reqId, - authorizationMode: 'authenticated-direct', - currentVersion: 3, - resumeExpiresAt: Date.now() + 300_000, - graceExpiresAt: Date.now() + 60_000 - } - return { id: 'rpc-2', ok: true, result: installResult, _meta: { runtimeId: 'runtime-1' } } - } - return { - id: 'rpc-1', - ok: true, - result: { - v: 1, - relay, - installStatus: installResult - ? { v: 1, reqId: request.installReqId, state: 'committed', result: installResult } - : { v: 1, reqId: request.installReqId, state: 'not-found' } - }, - _meta: { runtimeId: 'runtime-1' } - } - }) -} - describe('mobile endpoint supervisor', () => { beforeEach(() => { vi.useFakeTimers() @@ -805,6 +647,27 @@ describe('mobile endpoint supervisor', () => { supervisor.stop() }) + it('skips forced rotation for a session resumed without renewal', async () => { + // Why: renewed=false means a re-resume provably returns the same unchanged + // deadline; rotating anyway churned one session replacement per clamp floor. + const logical = new FakeLogicalClient('disconnected', 'lan') + const openRelay = vi.fn( + () => new FakeRelaySession('connected', null, Date.now() + 31_000, false) + ) + const deps = dependencies({ + openRelay, + openDirect: vi.fn(() => new FakeSession('disconnected')) + }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + + await supervisor.start() + expect(openRelay).toHaveBeenCalledTimes(1) + + await vi.advanceTimersByTimeAsync(5 * 60_000) + expect(openRelay).toHaveBeenCalledTimes(1) + supervisor.stop() + }) + it('keeps a fatal lease-replacement gate after the active relay later drops', async () => { const logical = new FakeLogicalClient('disconnected', 'lan') const openRelay = vi diff --git a/mobile/src/transport/mobile-endpoint-supervisor.ts b/mobile/src/transport/mobile-endpoint-supervisor.ts index 77ffbbde3db..be295fdcdda 100644 --- a/mobile/src/transport/mobile-endpoint-supervisor.ts +++ b/mobile/src/transport/mobile-endpoint-supervisor.ts @@ -265,8 +265,11 @@ export class MobileEndpointSupervisor { // Why: rotate against the resume credential's expiry, never the hello's // leaseExpiresAt — that field is the cell's ~10s attach-reservation // deadline, and using it forced a session replacement every second. + // Why: renewed=false means a re-resume provably returns the same + // unchanged deadline — rotating then just churns one replacement per + // clamp floor until a fresh credential arrives over direct or disk. this.leaseRotation.scheduleFromLease( - this.stopped || !this.foreground + this.stopped || !this.foreground || confirmation?.renewed === false ? null : (confirmation?.resumeExpiresAt ?? session.getResumeExpiresAt()) ) diff --git a/mobile/src/transport/mobile-relay-reconnect-controller.test.ts b/mobile/src/transport/mobile-relay-reconnect-controller.test.ts index cc640d4d7e7..4f50878c6d5 100644 --- a/mobile/src/transport/mobile-relay-reconnect-controller.test.ts +++ b/mobile/src/transport/mobile-relay-reconnect-controller.test.ts @@ -111,6 +111,48 @@ describe('relay reconnect controller', () => { expect(onRetry).toHaveBeenCalledTimes(3) }) + it('mints the gate pass when arming a no-bundle reprobe under a held gate', () => { + // Why: an external-signal gate never records rejected versions, so the + // no-dialable-bundle path must still mint the tick's pass token — a plain + // cooldown tick bounces off shouldDefer and doubles the effective cadence. + const onRetry = vi.fn() + const reconnect = createController(onRetry) + + reconnect.registerFailure(new MobileE2EEAuthenticationError()) + expect(reconnect.shouldDefer()).toBe(true) + vi.advanceTimersByTime(60_000) + expect(onRetry).toHaveBeenCalledTimes(1) + expect(reconnect.shouldDefer()).toBe(false) + // The gated attempt finds no dialable credential at all and re-arms. + reconnect.armCredentialReprobe() + + vi.advanceTimersByTime(120_000) + expect(onRetry).toHaveBeenCalledTimes(2) + expect(reconnect.shouldDefer()).toBe(false) + }) + + it('does not arm a gate reprobe timer when the supervisor declined retries', () => { + // Why: scheduleRetry=false means background or stopped — a tick firing + // there wakes nothing useful, and the next foreground resume re-arms. + const onRetry = vi.fn() + const reconnect = createController(onRetry) + const logical = { getState: () => 'disconnected' } as never + + reconnect.registerFailure(new MobileE2EEAuthenticationError(), false) + expect(vi.getTimerCount()).toBe(0) + reconnect.registerFailure(new RelayOuterError(4401), false) + expect(vi.getTimerCount()).toBe(0) + reconnect.registerFailure(new RelayOuterError(4429), false) + expect(vi.getTimerCount()).toBe(0) + vi.runAllTimers() + expect(onRetry).not.toHaveBeenCalled() + + // Resume restores the gated cadence instead of stalling forever. + reconnect.handleForeground(logical, false) + expect(reconnect.shouldDefer()).toBe(true) + expect(vi.getTimerCount()).toBe(1) + }) + it('does not let an orphaned reprobe timer swallow the next fast backoff', () => { const onRetry = vi.fn() const reconnect = createController(onRetry) diff --git a/mobile/src/transport/mobile-relay-reconnect-controller.ts b/mobile/src/transport/mobile-relay-reconnect-controller.ts index f2a7cad6b05..9ec5c1398bc 100644 --- a/mobile/src/transport/mobile-relay-reconnect-controller.ts +++ b/mobile/src/transport/mobile-relay-reconnect-controller.ts @@ -6,24 +6,10 @@ import { import type { MobileRelayRpcSession } from './mobile-relay-rpc-session' import { MobileE2EEAuthenticationError } from './mobile-e2ee-v2-physical-channel' import { RelayOuterError } from './mobile-relay-e2ee-link' +import { RELAY_STABLE_CONNECTION_MS, RelayRetryDelays } from './mobile-relay-retry-delays' import type { StableLogicalRpcClient } from './stable-logical-rpc-client' import type { ConnectionState } from './types' -// Why: relay resume closes and silent cellular NAT rebinds otherwise cause -// immediate re-dials that ping-pong the phone between connected and disconnected. -const RELAY_BACKOFF_MIN_MS = 250 -const RELAY_BACKOFF_BASE_MS = 500 -const RELAY_BACKOFF_CEILING_MS = 30_000 -const RELAY_STABLE_CONNECTION_MS = RELAY_BACKOFF_CEILING_MS -const RELAY_HOST_OFFLINE_RETRY_MIN_MS = 5_000 -const RELAY_HOST_OFFLINE_RETRY_MAX_MS = 15_000 -// Why: gates must slow recovery down, never end it — a relay-only phone has no -// direct path to refresh credentials, so a timerless gate is a permanent outage. -// The cadence escalates and jitters so a permanently revoked device is not a -// forever one-minute beacon and a fleet-wide gating event cannot phase-align. -const RELAY_GATE_REPROBE_BASE_MS = 60_000 -const RELAY_GATE_REPROBE_CEILING_MS = 15 * 60_000 - export type RelayReconnectDependencies = { now: () => number randomBytes: (length: number) => Uint8Array @@ -43,11 +29,14 @@ export class RelayReconnectController { private gateReprobePending = false private gateReprobeStreak = 0 private readonly rejectedCredentialVersions = new Set() + private readonly delays: RelayRetryDelays constructor( private readonly dependencies: RelayReconnectDependencies, private readonly onRetry: (forceReplacement?: boolean) => void - ) {} + ) { + this.delays = new RelayRetryDelays(dependencies.randomBytes) + } handleForeground(logical: StableLogicalRpcClient, wasForeground: boolean): void { if (!wasForeground) { @@ -156,10 +145,17 @@ export class RelayReconnectController { this.scheduleGateReprobe() return } + if (this.recoveryGate) { + // Why: under a held gate the tick must mint its pass token — a plain + // cooldown tick bounces off shouldDefer and doubles the effective cadence. + this.clearTimer() + this.scheduleGateReprobe() + return + } // Why: a merely missing or expired bundle must not enter the credential // gate — that gate forces a rotation on the next direct connect. A plain // cooldown retries the read on the same escalating cadence. - const delay = this.gateReprobeDelayMs() + const delay = this.delays.gateReprobeDelayMs(this.gateReprobeStreak) this.nextAttemptAt = this.dependencies.now() + delay this.clearTimer() this.scheduleReprobeTick(delay, false) @@ -219,9 +215,12 @@ export class RelayReconnectController { this.recoveryGate === 'fresh-credential' || (this.recoveryGate === 'external-signal' && recovery?.kind !== 'disable-relay-credential') ) { - // Why: a failed reprobe stays gated, but the slow cadence must keep going. + // Why: a failed reprobe stays gated, but the slow cadence must keep going + // — unless the supervisor is backgrounded/stopped; resume re-arms it. this.clearTimer() - this.scheduleGateReprobe() + if (scheduleRetry) { + this.scheduleGateReprobe() + } return } const now = this.dependencies.now() @@ -236,7 +235,9 @@ export class RelayReconnectController { this.activeRelayConnectedAt = null this.consecutiveFailures += 1 const delay = - recovery?.kind === 'retry-after-host-offline' ? this.hostOfflineDelayMs() : this.delayMs() + recovery?.kind === 'retry-after-host-offline' + ? this.delays.hostOfflineDelayMs() + : this.delays.transportDelayMs(this.consecutiveFailures) this.nextAttemptAt = now + delay if (error instanceof MobileE2EEAuthenticationError) { // Why: an E2EE rejection is usually pairing revocation, but it also fires @@ -244,7 +245,9 @@ export class RelayReconnectController { // reprobe slowly instead of waiting forever for a UI nudge. this.recoveryGate = 'external-signal' this.clearTimer() - this.scheduleGateReprobe() + if (scheduleRetry) { + this.scheduleGateReprobe() + } return } if (recovery?.kind === 'disable-relay-credential') { @@ -252,7 +255,9 @@ export class RelayReconnectController { // alive — the caller re-reads durable state before each gated attempt. this.recoveryGate = 'fresh-credential' this.clearTimer() - this.scheduleGateReprobe() + if (scheduleRetry) { + this.scheduleGateReprobe() + } return } if (recovery?.kind === 'retry-after-host-offline') { @@ -316,7 +321,7 @@ export class RelayReconnectController { } private scheduleGateReprobe(): void { - this.scheduleReprobeTick(this.gateReprobeDelayMs(), true) + this.scheduleReprobeTick(this.delays.gateReprobeDelayMs(this.gateReprobeStreak), true) } private scheduleReprobeTick(delay: number, mintToken: boolean): void { @@ -337,14 +342,6 @@ export class RelayReconnectController { }, delay) } - private gateReprobeDelayMs(): number { - const base = Math.min( - RELAY_GATE_REPROBE_CEILING_MS, - RELAY_GATE_REPROBE_BASE_MS * 2 ** Math.min(this.gateReprobeStreak, 8) - ) - return Math.floor(base * (0.75 + 0.5 * this.jitterFraction())) - } - // Why: clearing a gate must also drop its timer, pending tick, and cadence — // an orphaned reprobe timer would otherwise swallow the next fast backoff. private liftGate(): void { @@ -353,21 +350,4 @@ export class RelayReconnectController { this.gateReprobeStreak = 0 this.clearTimer() } - - private delayMs(): number { - const exponent = Math.max(0, this.consecutiveFailures - 1) - const cap = Math.min(RELAY_BACKOFF_CEILING_MS, RELAY_BACKOFF_BASE_MS * 2 ** exponent) - // Full jitter (uniform in [0, cap)), floored so retries never busy-loop. - return Math.max(RELAY_BACKOFF_MIN_MS, Math.floor(cap * this.jitterFraction())) - } - - private hostOfflineDelayMs(): number { - const range = RELAY_HOST_OFFLINE_RETRY_MAX_MS - RELAY_HOST_OFFLINE_RETRY_MIN_MS - return RELAY_HOST_OFFLINE_RETRY_MIN_MS + Math.floor(range * this.jitterFraction()) - } - - private jitterFraction(): number { - const [high, low] = this.dependencies.randomBytes(2) - return (((high ?? 0) << 8) | (low ?? 0)) / 0x1_00_00 - } } diff --git a/mobile/src/transport/mobile-relay-retry-delays.ts b/mobile/src/transport/mobile-relay-retry-delays.ts new file mode 100644 index 00000000000..6ff145acdb4 --- /dev/null +++ b/mobile/src/transport/mobile-relay-retry-delays.ts @@ -0,0 +1,45 @@ +// Why: relay resume closes and silent cellular NAT rebinds otherwise cause +// immediate re-dials that ping-pong the phone between connected and disconnected. +const RELAY_BACKOFF_MIN_MS = 250 +const RELAY_BACKOFF_BASE_MS = 500 +const RELAY_BACKOFF_CEILING_MS = 30_000 +export const RELAY_STABLE_CONNECTION_MS = RELAY_BACKOFF_CEILING_MS +const RELAY_HOST_OFFLINE_RETRY_MIN_MS = 5_000 +const RELAY_HOST_OFFLINE_RETRY_MAX_MS = 15_000 +// Why: gates must slow recovery down, never end it — a relay-only phone has no +// direct path to refresh credentials, so a timerless gate is a permanent outage. +// The cadence escalates and jitters so a permanently revoked device is not a +// forever one-minute beacon and a fleet-wide gating event cannot phase-align. +const RELAY_GATE_REPROBE_BASE_MS = 60_000 +const RELAY_GATE_REPROBE_CEILING_MS = 15 * 60_000 + +// Every relay retry delay in one place: transport backoff, known-offline +// polling, and the escalating gated reprobe cadence, all jittered. +export class RelayRetryDelays { + constructor(private readonly randomBytes: (length: number) => Uint8Array) {} + + transportDelayMs(consecutiveFailures: number): number { + const exponent = Math.max(0, consecutiveFailures - 1) + const cap = Math.min(RELAY_BACKOFF_CEILING_MS, RELAY_BACKOFF_BASE_MS * 2 ** exponent) + // Full jitter (uniform in [0, cap)), floored so retries never busy-loop. + return Math.max(RELAY_BACKOFF_MIN_MS, Math.floor(cap * this.jitterFraction())) + } + + hostOfflineDelayMs(): number { + const range = RELAY_HOST_OFFLINE_RETRY_MAX_MS - RELAY_HOST_OFFLINE_RETRY_MIN_MS + return RELAY_HOST_OFFLINE_RETRY_MIN_MS + Math.floor(range * this.jitterFraction()) + } + + gateReprobeDelayMs(streak: number): number { + const base = Math.min( + RELAY_GATE_REPROBE_CEILING_MS, + RELAY_GATE_REPROBE_BASE_MS * 2 ** Math.min(streak, 8) + ) + return Math.floor(base * (0.75 + 0.5 * this.jitterFraction())) + } + + private jitterFraction(): number { + const [high, low] = this.randomBytes(2) + return (((high ?? 0) << 8) | (low ?? 0)) / 0x1_00_00 + } +} From 665b85047b2863e64ec3697f99c046966887dd5d Mon Sep 17 00:00:00 2001 From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:23:43 -0700 Subject: [PATCH 14/72] fix(relay): revive a dead relay broker without user interaction (#12432) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Broker deaths that end with closeNow() — an auth refresh failing past token expiry (laptop sleep) or a transient context read at open — left no retry timer, so Relay stayed offline until the user clicked Retry or auth state changed. Adds a dead-man's switch: - RelayAuthCoordinator.ensureLive(): reconciles only when there is no live broker, no scheduled retry, and no open in flight - DesktopRelayService arms a 5-minute liveness interval and exposes ensureLive() for wake signals - powerMonitor 'resume' triggers ensureLive (sleep is the common cause) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- src/main/index.ts | 5 +- .../runtime/relay/desktop-relay-service.ts | 20 +++++ .../relay-auth-coordinator-recovery.test.ts | 74 +++++++++++++++++++ .../runtime/relay/relay-auth-coordinator.ts | 16 ++++ 4 files changed, 114 insertions(+), 1 deletion(-) diff --git a/src/main/index.ts b/src/main/index.ts index 3521070b55c..39fc076be0a 100644 --- a/src/main/index.ts +++ b/src/main/index.ts @@ -2,7 +2,7 @@ import { existsSync, statSync } from 'node:fs' import { isAbsolute, join } from 'node:path' import os from 'node:os' -import { app, BrowserWindow, dialog, ipcMain, nativeTheme, type Tray } from 'electron' +import { app, BrowserWindow, dialog, ipcMain, nativeTheme, powerMonitor, type Tray } from 'electron' import { initTccPromptNotice, stopTccPromptNotice } from './macos-tcc-prompt-notice' import { electronApp, is } from '@electron-toolkit/utils' import { @@ -2897,6 +2897,9 @@ void app.whenReady().then(async () => { provisionRelay: (context, params) => relayService.provisionRelay(context, params) }) relayService.start() + // Why: sleeping past relay-token expiry kills the broker with no retry + // timer; resume is the moment that state becomes recoverable. + powerMonitor.on('resume', () => desktopRelayService?.ensureLive()) } catch (error) { console.warn( '[relay] Desktop relay startup unavailable:', diff --git a/src/main/runtime/relay/desktop-relay-service.ts b/src/main/runtime/relay/desktop-relay-service.ts index c52d80a8fe4..04236fea2b7 100644 --- a/src/main/runtime/relay/desktop-relay-service.ts +++ b/src/main/runtime/relay/desktop-relay-service.ts @@ -42,12 +42,18 @@ export function pairingAuthorizationForContext( : null } +// Why: a broker that died without arming a retry (sleep past token expiry, +// transient auth read) must not stay dead until the user clicks Retry. The +// cadence is slow because it is a safety net, not the primary retry path. +const RELAY_LIVENESS_INTERVAL_MS = 5 * 60_000 + export class DesktopRelayService { private readonly coordinator: RelayAuthCoordinator private readonly revokeOutbox: RelayRevokeOutbox private readonly runtimeRpc: OrcaRuntimeRpcServer private readonly demandLedger: RelayDemandLedger private demandExpiryTimer: ReturnType | null = null + private livenessTimer: ReturnType | null = null private stopped = false constructor(options: DesktopRelayServiceOptions) { @@ -90,6 +96,16 @@ export class DesktopRelayService { start(): void { this.refreshDemand() + if (!this.livenessTimer) { + this.livenessTimer = setInterval(() => this.ensureLive(), RELAY_LIVENESS_INTERVAL_MS) + } + } + + // Safe to call from any wake signal (power resume, network change). + ensureLive(): void { + if (!this.stopped) { + this.coordinator.ensureLive() + } } authMutated(): void { @@ -217,6 +233,10 @@ export class DesktopRelayService { clearTimeout(this.demandExpiryTimer) this.demandExpiryTimer = null } + if (this.livenessTimer) { + clearInterval(this.livenessTimer) + this.livenessTimer = null + } this.coordinator.stop() } diff --git a/src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts b/src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts index 29b1d3596da..8bfc71688e0 100644 --- a/src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts +++ b/src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts @@ -257,3 +257,77 @@ describe('RelayAuthCoordinator transient recovery', () => { expect(openBroker).toHaveBeenCalledTimes(2) }) }) + +describe('RelayAuthCoordinator liveness safety net', () => { + it('reopens a broker that died leaving no retry timer behind', async () => { + // Why: an auth refresh failing past token expiry closes the broker with + // no timer; only ensureLive (periodic/power-resume) can revive it. + vi.useFakeTimers() + const dead = { closeNow: vi.fn(), isLive: () => false } + const live = { closeNow: vi.fn(), isLive: () => true } + const openBroker = vi.fn().mockResolvedValueOnce(dead).mockResolvedValueOnce(live) + const coordinator = new RelayAuthCoordinator({ + readContext: async () => context, + openBroker, + onStatus: vi.fn(), + random: () => 0.5 + }) + + coordinator.reconcile() + await vi.advanceTimersByTimeAsync(0) + expect(coordinator.getActiveBroker()).toBe(dead) + await vi.advanceTimersByTimeAsync(600_000) + expect(openBroker).toHaveBeenCalledOnce() + + coordinator.ensureLive() + await vi.advanceTimersByTimeAsync(0) + expect(openBroker).toHaveBeenCalledTimes(2) + expect(dead.closeNow).toHaveBeenCalled() + expect(coordinator.getActiveBroker()).toBe(live) + }) + + it('does not disturb a live broker, a scheduled retry, or an open in flight', async () => { + vi.useFakeTimers() + const broker = { closeNow: vi.fn(), isLive: () => true } + let releaseOpen: ((value: typeof broker) => void) | undefined + const openBroker = vi + .fn() + .mockRejectedValueOnce(new RelayHttpError('assignment', 503, 30_000)) + .mockImplementationOnce( + () => + new Promise((resolve) => { + releaseOpen = resolve + }) + ) + const coordinator = new RelayAuthCoordinator({ + readContext: async () => context, + openBroker, + onStatus: vi.fn(), + random: () => 0.5 + }) + + coordinator.reconcile() + await vi.advanceTimersByTimeAsync(0) + expect(openBroker).toHaveBeenCalledOnce() + + // A scheduled Retry-After timer owns recovery; ensureLive must not race it. + coordinator.ensureLive() + await vi.advanceTimersByTimeAsync(0) + expect(openBroker).toHaveBeenCalledOnce() + + // The retry fires into a slow open; ensureLive must not preempt it. + await vi.advanceTimersByTimeAsync(30_000) + expect(openBroker).toHaveBeenCalledTimes(2) + coordinator.ensureLive() + await vi.advanceTimersByTimeAsync(0) + expect(openBroker).toHaveBeenCalledTimes(2) + releaseOpen?.(broker) + await vi.advanceTimersByTimeAsync(0) + expect(coordinator.getActiveBroker()).toBe(broker) + + // A live broker needs nothing. + coordinator.ensureLive() + await vi.advanceTimersByTimeAsync(0) + expect(openBroker).toHaveBeenCalledTimes(2) + }) +}) diff --git a/src/main/runtime/relay/relay-auth-coordinator.ts b/src/main/runtime/relay/relay-auth-coordinator.ts index a09c8f6374a..f6539842f8a 100644 --- a/src/main/runtime/relay/relay-auth-coordinator.ts +++ b/src/main/runtime/relay/relay-auth-coordinator.ts @@ -92,6 +92,22 @@ export class RelayAuthCoordinator { return this.ownership?.valid ? this.ownership.broker : null } + // Why: some broker deaths end with no retry timer — an auth refresh that + // fails past token expiry (laptop sleep), or a transient context read that + // returned null at open. Periodic/power-resume callers use this as a + // dead-man's switch; it never disturbs a live broker, a scheduled retry, + // or an open already in flight. + ensureLive(): void { + if (this.stopped || this.retryTimer || this.pendingOwnerships.size > 0) { + return + } + const ownership = this.ownership + if (ownership?.valid && (ownership.broker?.isLive?.() ?? true)) { + return + } + this.beginReconcile(false) + } + async waitForActiveBroker(): Promise { while (!this.stopped) { const broker = this.getActiveBroker() From 5a2b329d8d7e96c974aecf4d3e12b707abd7d732 Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:24:25 -0700 Subject: [PATCH 15/72] chore(mobile): bump to 0.0.37 (versionCode 10) (#12365) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Completes the 0.0.37 release attempted on 2026-08-03 (run 30791649691 failed on the version assertion). Ships the post-0.0.36 transport fixes: relay session recovery when the LAN endpoint is unreachable (#12344, #11368, #11465, #11690) and honest worktree-catalog failure states (#12235) — the released-app defect class verified live tonight. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- mobile/app.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mobile/app.json b/mobile/app.json index 413cebc8d28..53654335486 100644 --- a/mobile/app.json +++ b/mobile/app.json @@ -2,7 +2,7 @@ "expo": { "name": "Orca", "slug": "orca-mobile", - "version": "0.0.36", + "version": "0.0.37", "orientation": "default", "icon": "./assets/icon.png", "userInterfaceStyle": "automatic", @@ -75,7 +75,7 @@ "allowBackup": false, "permissions": ["RECORD_AUDIO", "MODIFY_AUDIO_SETTINGS"], "package": "com.stably.orca.mobile", - "versionCode": 9 + "versionCode": 10 }, "plugins": [ "expo-router", From 0f052a50100cb31751f65bff4e98ae795525c04d Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:25:02 -0700 Subject: [PATCH 16/72] fix(editor): stop Cmd/Ctrl+Shift+T reopening a phantom editor tab (#12399) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `openFile` honored a recently-closed snapshot's `reopenId` whenever no open file currently held that id, without checking whether the same (path, mode, owner) was already open under a different id. Editor ids are not symmetrical across worktrees: the first worktree to open an absolute path gets the bare path as its id, and any other owner of the same path gets a namespaced `editor:::` id. So a snapshot captured under one shape could be restored while the live tab carried the other. When that happened `openFile` took the `existing` branch and mapped over `openFiles` looking for the stale id, matching nothing — no OpenFile was created or updated — yet it still set `activeFileId`, the per-worktree active id, the tab bar order and a unified tab entity to that stale id. The user got a tab rendering nothing and a dangling active editor. Resolve the id from the already-open file whenever one exists, so capture and restore agree on canonicalization. This is a no-op for the non-reopen path, where `resolveEditorFileIdForOwner` already returns `existing.id` via the identical predicate. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- src/renderer/src/store/slices/editor.test.ts | 43 ++++++++++++++++++++ src/renderer/src/store/slices/editor.ts | 6 ++- 2 files changed, 47 insertions(+), 2 deletions(-) diff --git a/src/renderer/src/store/slices/editor.test.ts b/src/renderer/src/store/slices/editor.test.ts index 1f2c8474641..a3c572612a4 100644 --- a/src/renderer/src/store/slices/editor.test.ts +++ b/src/renderer/src/store/slices/editor.test.ts @@ -1716,6 +1716,49 @@ describe('createEditorSlice recently closed editor tabs', () => { expect(store.getState().openFiles[0]?.id).toBe(firstId) expect(store.getState().tabBarOrderByWorktree['wt-1']).toEqual([firstId]) }) + + it('reactivates the live tab when a stale reopen id targets an already-open file', () => { + const store = createEditorTabsStore() + store.setState({ + worktreesByRepo: { + 'repo-1': [ + { id: 'wt-1', repoId: 'repo-1', path: '/repo' }, + { id: 'wt-2', repoId: 'repo-1', path: '/repo-2' } + ] + } + } as unknown as Partial) + const sharedPath = '/home/me/.zshrc' + const openShared = (worktreeId: string): string => + store.getState().openFile({ + filePath: sharedPath, + relativePath: '.zshrc', + worktreeId, + language: 'shell', + mode: 'edit' + }) + + // Bare path id: nothing else owns this path yet. + const staleWt1Id = openShared('wt-1') + expect(staleWt1Id).toBe(sharedPath) + store.getState().closeFile(staleWt1Id) + + // wt-2 claims the bare id, so wt-1's reopen gets a namespaced id instead. + const wt2Id = openShared('wt-2') + expect(wt2Id).toBe(sharedPath) + const liveWt1Id = openShared('wt-1') + expect(liveWt1Id).toBe(ownedEditorFileId(sharedPath, 'wt-1', null)) + store.getState().closeFile(wt2Id) + + expect(store.getState().reopenClosedEditorTab('wt-1')).toBe(true) + + expect(store.getState().openFiles.map((file) => file.id)).toEqual([liveWt1Id]) + expect(store.getState().activeFileId).toBe(liveWt1Id) + expect(store.getState().activeFileIdByWorktree['wt-1']).toBe(liveWt1Id) + expect( + (store.getState().unifiedTabsByWorktree['wt-1'] ?? []).map((tab) => tab.entityId) + ).toEqual([liveWt1Id]) + expect(store.getState().tabBarOrderByWorktree['wt-1']).toEqual([liveWt1Id]) + }) }) describe('createEditorSlice markdown view state', () => { diff --git a/src/renderer/src/store/slices/editor.ts b/src/renderer/src/store/slices/editor.ts index b8d5faa39dd..be768183cac 100644 --- a/src/renderer/src/store/slices/editor.ts +++ b/src/renderer/src/store/slices/editor.ts @@ -1743,8 +1743,10 @@ export const createEditorSlice: StateCreator = (s matchesEditorMode(f, reusableOpenFileModes) && isSameEditorOwner(f, worktreeId, runtimeEnvironmentId) ) - const id = - options?.reopenId && !s.openFiles.some((candidate) => candidate.id === options.reopenId) + // Why: a snapshot's reopenId can be a stale shape — the same path is bare in whichever worktree opened it first and namespaced elsewhere — so honoring it while this owner's tab is already open would strand activeFileId and the unified tab on an id no OpenFile has. + const id = existing + ? existing.id + : options?.reopenId && !s.openFiles.some((candidate) => candidate.id === options.reopenId) ? options.reopenId : resolveEditorFileIdForOwner( s, From bdafe840f7493321284425a5d613332524954f03 Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:25:08 -0700 Subject: [PATCH 17/72] fix(browser): keep the chrome inset when a page viewport shell is rebuilt (#12401) The chrome inset that pushes a browser guest below the toolbar was applied only from BrowserPane's layout effect, whose deps cover the first mount (page id, active, paintable, slot readiness). Every path that rebuilds the viewport shell without re-running that effect therefore produced a shell with a zero-height inset: guest recovery replacing a lost guest (replacePersistentWebview -> removeBrowserPageViewport -> render-time ensureBrowserPageViewport), a session-profile switch that recreates the guest for a new partition, and an overlay slot-root remount (STA-3228). The recovered page then painted underneath the browser chrome until an unrelated resize or tab switch forced a recompute. Make the geometry a property of the viewport instead of the mount: remember the last synced inset height per page and apply it whenever a shell is built. This also fixes the ordering case where the chrome is measured before the shell exists (the height used to be dropped on the floor). Test: browser-page-viewport.test.ts covers the rebuild-after-replacement and measured-before-shell cases; both fail without the change. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- .../browser-page-viewport.test.ts | 21 +++++++++++++++++++ .../browser-pane/browser-page-viewport.ts | 13 +++++++++++- 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/src/renderer/src/components/browser-pane/browser-page-viewport.test.ts b/src/renderer/src/components/browser-pane/browser-page-viewport.test.ts index 8ea69a07c8c..d6def5c80e5 100644 --- a/src/renderer/src/components/browser-pane/browser-page-viewport.test.ts +++ b/src/renderer/src/components/browser-pane/browser-page-viewport.test.ts @@ -121,6 +121,27 @@ describe('syncBrowserPageChromeInset', () => { const viewport = ensureBrowserPageViewport('page-1', 'workspace-1')! expect(viewport.chromeInset.style.height).toBe('48px') }) + + it('restores the inset when guest recovery rebuilds the shell', () => { + mountSlotViewport('workspace-1') + ensureBrowserPageViewport('page-1', 'workspace-1') + syncBrowserPageChromeInset('page-1', 48) + // Guest replacement tears the shell down; the recovery re-render rebuilds it without re-measuring the chrome. + removeBrowserPageViewport('page-1') + + const rebuilt = ensureBrowserPageViewport('page-1', 'workspace-1')! + + expect(rebuilt.chromeInset.style.height).toBe('48px') + }) + + it('applies an inset measured before the shell existed', () => { + syncBrowserPageChromeInset('page-2', 40) + mountSlotViewport('workspace-1') + + const viewport = ensureBrowserPageViewport('page-2', 'workspace-1')! + + expect(viewport.chromeInset.style.height).toBe('40px') + }) }) describe('applyBrowserPageViewportLayout', () => { diff --git a/src/renderer/src/components/browser-pane/browser-page-viewport.ts b/src/renderer/src/components/browser-pane/browser-page-viewport.ts index d34fbf744f4..e4a2441c755 100644 --- a/src/renderer/src/components/browser-pane/browser-page-viewport.ts +++ b/src/renderer/src/components/browser-pane/browser-page-viewport.ts @@ -14,6 +14,11 @@ type BrowserPageViewport = { const browserPageViewports = new Map() +// Why: React measures the chrome only on mount, but shells are rebuilt without a +// re-measure (guest recovery/replacement, profile switch, slot remount). Remembering +// the inset keeps geometry a property of attaching a guest, not of the first mount. +const browserPageChromeInsetHeights = new Map() + const slotRootListeners = new Map void>>() function notifySlotRootListeners(workspaceTabId: string): void { @@ -88,6 +93,10 @@ export function ensureBrowserPageViewport( const chromeInset = document.createElement('div') chromeInset.dataset.browserPageChromeInset = '' chromeInset.className = 'shrink-0' + const rememberedInsetHeight = browserPageChromeInsetHeights.get(browserPageId) + if (rememberedInsetHeight !== undefined) { + chromeInset.style.height = `${rememberedInsetHeight}px` + } const container = document.createElement('div') container.dataset.browserPageContainer = '' @@ -141,11 +150,13 @@ export function applyBrowserPageViewportLayout( } export function syncBrowserPageChromeInset(browserPageId: string, heightPx: number): void { + const insetHeight = Math.max(0, heightPx) + browserPageChromeInsetHeights.set(browserPageId, insetHeight) const viewport = browserPageViewports.get(browserPageId) if (!viewport) { return } - viewport.chromeInset.style.height = `${Math.max(0, heightPx)}px` + viewport.chromeInset.style.height = `${insetHeight}px` } export function parkBrowserPageViewport(browserPageId: string): void { From 1ef83986a131e544294b14a6c47a969594a5b17d Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:25:14 -0700 Subject: [PATCH 18/72] fix(codex): stop a surviving descendant wedging the Codex home process lock forever (#12410) * fix(codex): stop a surviving descendant wedging the Codex home process lock The per-Codex-home process lock was released only by the child's 'close' event. 'close' fires when the child AND every process that inherited its stdio have exited, so a grandchild that outlives codex (an MCP server, a helper, an `sh -c` wrapper) keeps the pipe open and 'close' never arrives. killProcessTree only SIGKILLs the direct child on POSIX, so Stop and the 60s generation timeout both leave the lock held. Every later AI commit message, PR field, branch name, and quota probe for that home then queued forever with no error and no recovery until the app restarted. Release the hold on 'exit' as well as 'close': once the codex process itself is gone it can no longer rotate that home's auth.json, which is the race the lock exists to prevent, so waiting on descendants bought nothing. As a backstop for a child that never reports exit at all (a kill that does not land), bound the hold: while another run is queued behind it, a hold that outlives CODEX_HOME_PROCESS_LOCK_MAX_HOLD_MS releases the queue. The cap is armed only when someone is waiting and only counts time the entry actually holds the lock, so uncontended runs arm no timer and queueing behind a slow predecessor never shortens a run's own budget. * fix(codex): preserve home lock exclusivity --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> --- .../codex-cli/codex-home-process-lock.test.ts | 26 +++++++- .../commit-message-text-generation.test.ts | 65 +++++++++++++++++++ .../commit-message-text-generation.ts | 18 +++-- 3 files changed, 103 insertions(+), 6 deletions(-) diff --git a/src/main/codex-cli/codex-home-process-lock.test.ts b/src/main/codex-cli/codex-home-process-lock.test.ts index 7287d011b42..e5a7eee7976 100644 --- a/src/main/codex-cli/codex-home-process-lock.test.ts +++ b/src/main/codex-cli/codex-home-process-lock.test.ts @@ -1,6 +1,6 @@ import { join } from 'node:path' import { homedir } from 'node:os' -import { describe, expect, it } from 'vitest' +import { describe, expect, it, vi } from 'vitest' import { resolveCodexHomeProcessLockKey, resolveCodexHomeProcessLockKeyForSpawnEnv, @@ -70,6 +70,30 @@ describe('withCodexHomeProcessLock', () => { await expect(withCodexHomeProcessLock('home-a', async () => 'after')).resolves.toBe('after') }) + it('does not release a running lock based on elapsed time', async () => { + vi.useFakeTimers() + try { + const events: string[] = [] + const gate = deferred() + const first = withCodexHomeProcessLock('home-long-running', async () => { + events.push('first:start') + await gate.promise + }) + const second = withCodexHomeProcessLock('home-long-running', async () => { + events.push('second:start') + }) + + await vi.advanceTimersByTimeAsync(60 * 60_000) + expect(events).toEqual(['first:start']) + + gate.resolve() + await Promise.all([first, second]) + expect(events).toEqual(['first:start', 'second:start']) + } finally { + vi.useRealTimers() + } + }) + it('keys explicit and default host homes consistently', () => { const previousCodexHome = process.env.CODEX_HOME delete process.env.CODEX_HOME diff --git a/src/main/text-generation/commit-message-text-generation.test.ts b/src/main/text-generation/commit-message-text-generation.test.ts index 5c21ffa231e..3d435ee9477 100644 --- a/src/main/text-generation/commit-message-text-generation.test.ts +++ b/src/main/text-generation/commit-message-text-generation.test.ts @@ -540,6 +540,38 @@ describe('discoverCommitMessageModelsLocal', () => { } }) + it('releases the Codex home after a discovery timeout once the child exits', async () => { + vi.useFakeTimers() + const firstChild = createMockDiscoveryChild() + const secondChild = createMockDiscoveryChild() + spawnMock.mockReturnValueOnce(firstChild as never).mockReturnValueOnce(secondChild as never) + const env = { CODEX_HOME: '/managed/codex-discovery-descendant-home' } + + try { + const first = discoverCommitMessageModelsLocal('codex', env) + await vi.advanceTimersByTimeAsync(0) + const second = discoverCommitMessageModelsLocal('codex', env) + await vi.advanceTimersByTimeAsync(60_000) + await expect(first).resolves.toMatchObject({ success: false }) + expect(spawnMock).toHaveBeenCalledTimes(1) + + // A grandchild kept the inherited stdout open, so the killed child reports + // 'exit' and 'close' never arrives. + firstChild.emit('exit', null, 'SIGKILL') + await vi.advanceTimersByTimeAsync(0) + expect(spawnMock).toHaveBeenCalledTimes(2) + + secondChild.stdout.emit( + 'data', + Buffer.from(JSON.stringify({ models: [{ slug: 'gpt-5.5', display_name: 'GPT-5.5' }] })) + ) + secondChild.emit('close', 0) + await expect(second).resolves.toMatchObject({ success: true, defaultModelId: 'gpt-5.5' }) + } finally { + vi.useRealTimers() + } + }) + it('settles and detaches model discovery when output exceeds the limit', async () => { const child = createMockDiscoveryChild() spawnMock.mockReturnValue(child as never) @@ -1692,6 +1724,39 @@ describe('generateCommitMessageFromContext', () => { await expect(second).resolves.toMatchObject({ success: true, message: 'Update README' }) }) + it('releases the Codex home lock when the child exits with a descendant holding its stdio', async () => { + const firstChild = createMockDiscoveryChild() + const secondChild = createMockDiscoveryChild() + spawnMock.mockReturnValueOnce(firstChild as never).mockReturnValueOnce(secondChild as never) + const env = { CODEX_HOME: '/managed/codex-descendant-home' } + const context = { branch: 'main', stagedSummary: 'M\tREADME.md', stagedPatch: '+hello' } + const params = { agentId: 'codex' as const, model: 'gpt-5.5' } + + const first = generateCommitMessageFromContext(context, params, { + kind: 'local', + cwd: '/descendant-repo', + env + }) + await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledTimes(1)) + cancelGenerateCommitMessageLocal('/descendant-repo') + await expect(first).resolves.toMatchObject({ canceled: true }) + expectChildTerminated(firstChild) + + // SIGKILL reaches the codex process but not a grandchild that inherited its + // stdout, so 'exit' arrives and 'close' never does. + firstChild.emit('exit', null, 'SIGKILL') + + const second = generateCommitMessageFromContext(context, params, { + kind: 'local', + cwd: '/descendant-repo-2', + env + }) + await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledTimes(2)) + secondChild.stdout.emit('data', Buffer.from('Update README\n')) + secondChild.emit('close', 0) + await expect(second).resolves.toMatchObject({ success: true, message: 'Update README' }) + }) + it('holds the Codex home lock until Windows tree termination and wrapper close', async () => { const originalPlatform = process.platform Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) diff --git a/src/main/text-generation/commit-message-text-generation.ts b/src/main/text-generation/commit-message-text-generation.ts index 8410231dc40..98314f6975b 100644 --- a/src/main/text-generation/commit-message-text-generation.ts +++ b/src/main/text-generation/commit-message-text-generation.ts @@ -452,6 +452,10 @@ export async function discoverCommitMessageModelsLocal( if (agentId === 'codex') { // Result publication stays prompt while the home lock follows the // process lifetime after asynchronous timeout/output-limit kills. + // Why: 'close' also waits on descendants that inherited this child's + // stdio, so a surviving MCP helper would hold the home forever; at + // 'exit' the codex process is gone and can no longer rotate auth.json. + child.once('exit', markClosedAfterTermination) child.once('close', markClosedAfterTermination) } child.on('error', onError) @@ -604,7 +608,7 @@ function runLocalPlan( emptyResultName = 'message', operation: TextGenerationOperation = 'commit-message', wslDistro?: string, - holdHomeLockUntilClose = false + holdHomeLockUntilExit = false ): LocalProcessExecution { const { binary, args, stdinPayload, label } = plan let markProcessClosed!: () => void @@ -685,7 +689,7 @@ function runLocalPlan( if (cancelToken && cancelTokensByLane.get(laneKey) === cancelToken) { cancelTokensByLane.delete(laneKey) } - if (!holdHomeLockUntilClose) { + if (!holdHomeLockUntilExit) { markProcessClosed() } resolve(result) @@ -769,7 +773,11 @@ function runLocalPlan( } child.stdout?.on('data', onStdoutData) child.stderr?.on('data', onStderrData) - if (holdHomeLockUntilClose) { + if (holdHomeLockUntilExit) { + // Why: 'close' also waits on descendants that inherited this child's + // stdio, so a surviving MCP helper would hold the home forever; at 'exit' + // the codex process is gone and can no longer rotate auth.json. + child.once('exit', markClosedAfterTermination) child.once('close', markClosedAfterTermination) } child.on('error', onError) @@ -801,7 +809,7 @@ function runLocalPlanForAgent( operation: TextGenerationOperation ): Promise { const start = ( - holdHomeLockUntilClose = false + holdHomeLockUntilExit = false ): LocalProcessExecution => runLocalPlan( plan, @@ -810,7 +818,7 @@ function runLocalPlanForAgent( emptyResultName, operation, target.wslDistro, - holdHomeLockUntilClose + holdHomeLockUntilExit ) if (agentId !== 'codex') { // Why: no extra promise hops here — cancellation timing for non-codex From 20a2901677a9aec7f069b93f94ac6420e058ab74 Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:25:21 -0700 Subject: [PATCH 19/72] fix(worktree): tell the truth about live PTYs, and offer force for a wedged sweep (#12394) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(worktree): tell the truth about live PTYs, and offer force for a wedged sweep Two gaps in the #11960 force path: The delete toast described every unstopped-PTY failure as "could not confirm every terminal has exited", including the case where verification positively watched them running. Force Delete proceeds either way, so the user was being asked to waive a doubt that did not exist while a running agent's uncommitted work died with it. The live verdict now gets copy that says so. A sweep that rejects before any per-PTY verdict exists (wedged daemon, dropped SSH channel) fails with a teardown-timeout message that the force classifier did not recognise, so no Force Delete button appeared — the exact dead end #11960 set out to remove. That error now carries the shared prefix and classifies. * fix(worktree): close the sweep-rejection wedge and stop racing the delete Review of #12394 found the fix covered only half the wedge it named, and routed users into a force path whose own safety comment was untrue. 1. Only the outer deadline was classifiable. When a provider *rejects* the sweep — dropped SSH channel, erroring daemon — settleBeforeDeadline rejects with the provider's original error, which carries no marker, so classifyWorktreeForceDeleteReason still returned null and no Force Delete button rendered. That is the exact case #11960 named. A rejected sweep on the destructive path is now reworded through the existing unstopped-PTY prefix (provider text preserved, original kept as `cause`), so old and new clients alike classify it as 'unstopped-pty'. 2. Force could delete files while a sweep was still running. The deadline rejects without cancelling run(), so allSettled resolved with shutdown() still in flight — by construction the deadline error can only fire while something is in flight. Force then deleted the directory a live PTY still held open (EBUSY / half-delete on Windows and WSL). Sweeps are now tracked so the forced path waits for the abandoned work, bounded by a 2s grace; force never wedges, and when the grace expires the warning says handles may outlive the delete instead of implying the sweep finished. 3. The toast test named for the classifier passed the reason in as a literal, so it never exercised it. It now derives the reason exactly as the store does, and fails against main. 4. Added the missing unstoppedPtyLive key to the English catalog. 5. isProvenLivePtyRemovalError anchored the 'still live:' marker to the detail separator, so a worktree path can no longer spell out a live verdict and flip the toast to the destructive copy. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- src/main/runtime/forced-sweep-settlement.ts | 122 ++++++++++++++++++ .../runtime/unstopped-pty-verification.ts | 22 +++- .../worktree-teardown-unstopped-pty.test.ts | 85 ++++++++++++ src/main/runtime/worktree-teardown.ts | 97 +++++++------- .../sidebar/delete-worktree-toast.test.ts | 59 ++++++++- .../sidebar/delete-worktree-toast.ts | 17 ++- src/renderer/src/i18n/locales/en.json | 3 +- ...ktree-removal-force-classification.test.ts | 42 +++++- src/shared/worktree-removal.ts | 28 +++- 9 files changed, 410 insertions(+), 65 deletions(-) create mode 100644 src/main/runtime/forced-sweep-settlement.ts diff --git a/src/main/runtime/forced-sweep-settlement.ts b/src/main/runtime/forced-sweep-settlement.ts new file mode 100644 index 00000000000..e53a0e66ce0 --- /dev/null +++ b/src/main/runtime/forced-sweep-settlement.ts @@ -0,0 +1,122 @@ +import { describeError } from './unstopped-pty-verification' + +// Why: an abandoned sweep is one whose provider ignored the deadline it was already given, +// so this is a second chance, not a second budget — long enough for a shutdown() that is +// mid-kill to finish releasing handles, short enough that Force Delete still feels forced. +export const ABANDONED_SWEEP_GRACE_MS = 2_000 + +export type WorktreeSweepTracker = { + /** Wraps a sweep body so the promise stays observable after its deadline abandons it. */ + track: (run: () => Promise) => () => Promise + /** Resolves when every tracked sweep settled, or the grace expired; true if one is still running. */ + awaitAbandonedSweeps: (graceMs?: number) => Promise +} + +/** + * Keeps the real sweep promises reachable after `settleBeforeDeadline` stops waiting on them. + * + * Why: that helper rejects on its timer without cancelling `run()`, so by construction the + * deadline error can only fire while work is still in flight — and forced removal deletes + * the worktree directory the moment teardown returns. + */ +export function createWorktreeSweepTracker(): WorktreeSweepTracker { + const running = new Set>() + return { + track: + (run: () => Promise) => + () => { + const sweep = run() + running.add(sweep) + // Why: the tracked copy is observed here too, so a rejection this call abandons + // never surfaces as an unhandled rejection in whatever ran next. + void sweep.catch(() => undefined).finally(() => running.delete(sweep)) + return sweep + }, + awaitAbandonedSweeps: async (graceMs = ABANDONED_SWEEP_GRACE_MS) => { + const pending = [...running] + if (pending.length === 0) { + return false + } + let expiry: ReturnType | undefined + const expired = new Promise((resolve) => { + expiry = setTimeout(() => resolve(true), graceMs) + expiry.unref?.() + }) + const stillRunning = await Promise.race([ + Promise.allSettled(pending).then(() => false), + expired + ]) + clearTimeout(expiry) + return stillRunning + } + } +} + +export type WorktreeSweepPromises = { + runtime: Promise<{ stopped: number }> + provider: Promise + registry: Promise +} + +export type ForcedSweepSettlement = { + stopped: { runtimeStopped: number; providerStopped: number; registryStopped: number } + /** A sweep failed outright, so no per-PTY verdict below it can be trusted. */ + incomplete: boolean +} + +/** + * Reconciles the three sweeps for a removal carrying the Force Delete waiver (#11960). + * + * Force goes on to delete files, so every sweep must finish releasing handles first — + * `Promise.all` would abandon the siblings of the first rejection while they were still + * inside shutdown(). Waiting on the tracked promises rather than only on their deadline + * wrappers is what makes that true for the timeout case as well. + */ +export async function settleSweepsForForcedRemoval( + worktreeId: string, + sweeps: WorktreeSweepPromises, + tracker: WorktreeSweepTracker, + deadlineError: Error +): Promise { + const settled = await Promise.allSettled([sweeps.runtime, sweeps.provider, sweeps.registry]) + const [runtimeSettled, providerSettled, registrySettled] = settled + // Report what the surviving sweeps actually stopped rather than a flat zero. + const stopped = { + runtimeStopped: runtimeSettled.status === 'fulfilled' ? runtimeSettled.value.stopped : 0, + providerStopped: providerSettled.status === 'fulfilled' ? providerSettled.value : 0, + registryStopped: registrySettled.status === 'fulfilled' ? registrySettled.value : 0 + } + const reasons = settled.flatMap((result) => + result.status === 'rejected' ? [result.reason as unknown] : [] + ) + const stillRunning = await tracker.awaitAbandonedSweeps() + if (reasons.length === 0 && !stillRunning) { + return { stopped, incomplete: false } + } + // Why (#11960): a sweep that cannot even complete — unresponsive daemon, dropped SSH + // channel — fails before the unproven-stop gate could offer its escape hatch, so an + // explicit Force Delete has to survive it. Report every reason, specific ones first: the + // shared deadline sentinel only says that *something* timed out, so leading with it would + // bury the provider error that actually explains the failure. This warning is the only + // trace of a removal that deleted files without proving a single stop. + const detail = [ + ...reasons.filter((candidate) => candidate !== deadlineError), + ...reasons.filter((candidate) => candidate === deadlineError) + ].map(describeError) + if (stillRunning) { + // Force must never wedge, so the wait is bounded — but "we stopped waiting" is not + // "handles released", and on Windows/WSL that is the difference between a clean + // removal and a half-deleted directory. Say so instead of implying the sweep finished. + detail.push( + `a sweep was still running after the ${ABANDONED_SWEEP_GRACE_MS}ms grace, so its PTY handles may outlive the delete` + ) + } + console.warn( + `[worktree-teardown] forcing removal after an incomplete PTY sweep for ${worktreeId} — ${detail.join('; ')}` + ) + // Reporting `incomplete` does skip the per-PTY verdict, which could still have named live + // PTYs when only one sweep failed — accepted for now because this path is behind an + // explicit Force Delete, deletes either way, and clears no registry rows, so the cost is + // diagnosability rather than safety. + return { stopped, incomplete: reasons.length > 0 } +} diff --git a/src/main/runtime/unstopped-pty-verification.ts b/src/main/runtime/unstopped-pty-verification.ts index b0df601f133..068334eb98d 100644 --- a/src/main/runtime/unstopped-pty-verification.ts +++ b/src/main/runtime/unstopped-pty-verification.ts @@ -1,5 +1,9 @@ import type { IPtyProvider } from '../providers/types' -import { UNSTOPPED_PTY_REMOVAL_PREFIX } from '../../shared/worktree-removal' +import { + UNSTOPPED_PTY_DETAIL_SEPARATOR, + UNSTOPPED_PTY_LIVE_DETAIL_PREFIX, + UNSTOPPED_PTY_REMOVAL_PREFIX +} from '../../shared/worktree-removal' import { settleBeforeDeadline } from './settle-before-deadline' // Floor for the verification window when the sweep ran on a very short budget. @@ -60,9 +64,21 @@ export function describeUnstoppedPtys( ): string { const detail = verdict.status === 'live' - ? `still live: ${verdict.ptyIds.join(', ')}` + ? `${UNSTOPPED_PTY_LIVE_DETAIL_PREFIX} ${verdict.ptyIds.join(', ')}` : `could not verify these exited: ${failedPtyIds.join(', ')} (${verdict.reason})` - return `${UNSTOPPED_PTY_REMOVAL_PREFIX} ${worktreeId} — ${detail}` + return `${UNSTOPPED_PTY_REMOVAL_PREFIX} ${worktreeId}${UNSTOPPED_PTY_DETAIL_SEPARATOR}${detail}` +} + +/** + * Words a sweep that never produced a per-PTY verdict — a wedged daemon, a dropped SSH + * channel — as the unstopped-PTY failure it is. + * + * Why (#11960): this rejection carried only the provider's own wording, which the force + * classifier cannot recognise, so the wedge the escape hatch exists for was the one case + * that never got offered it. The provider's message stays in the text; only the shape changes. + */ +export function describeFailedPtySweep(worktreeId: string, error: unknown): string { + return `${UNSTOPPED_PTY_REMOVAL_PREFIX} ${worktreeId}${UNSTOPPED_PTY_DETAIL_SEPARATOR}the terminal sweep failed: ${describeError(error)}` } export function describeError(error: unknown): string { diff --git a/src/main/runtime/worktree-teardown-unstopped-pty.test.ts b/src/main/runtime/worktree-teardown-unstopped-pty.test.ts index 47852b45985..ca09e01b2d8 100644 --- a/src/main/runtime/worktree-teardown-unstopped-pty.test.ts +++ b/src/main/runtime/worktree-teardown-unstopped-pty.test.ts @@ -9,6 +9,11 @@ vi.mock('../memory/pty-registry', () => ({ })) import { killAllProcessesForWorktree, WORKTREE_PROCESS_SWEEP_TIMEOUT_MS } from './worktree-teardown' +import { ABANDONED_SWEEP_GRACE_MS } from './forced-sweep-settlement' +import { + classifyWorktreeForceDeleteReason, + isProvenLivePtyRemovalError +} from '../../shared/worktree-removal' import type { IPtyProvider, PtyProcessInfo } from '../providers/types' // Why: these tests advance fake timers *before* awaiting the teardown, so a @@ -243,6 +248,13 @@ describe('destructive teardown when a PTY stop cannot be proven', () => { providerStopped: 0, registryStopped: 0 }) + // Why: the deadline gave up on this sweep without cancelling it, so the grace + // expired with the provider still inside listProcesses. Force deletes the + // directory anyway, and this warning is the only record that a PTY handle may + // have outlived it — a silent "incomplete sweep" reads as if it had finished. + expect(warn).toHaveBeenCalledWith( + expect.stringContaining(`still running after the ${ABANDONED_SWEEP_GRACE_MS}ms grace`) + ) } finally { releaseList([]) await vi.advanceTimersByTimeAsync(0) @@ -337,6 +349,79 @@ describe('destructive teardown when a PTY stop cannot be proven', () => { ).rejects.toThrow('ssh channel closed') }) + // Why (#11960): the wedge the escape hatch exists for — an unresponsive daemon, a dropped + // SSH channel — rejects the sweep in the provider's own words, which the force classifier + // cannot recognise. Failing closed with no Force Delete button is the dead end itself. + it('offers force delete for a sweep-level failure without losing the provider wording', async () => { + listRegisteredPtysMock.mockReturnValue([]) + const localProvider = createProviderStub(async () => { + throw new Error('SSH channel closed while listing processes') + }) + + const error = await killAllProcessesForWorktree('repo-1::/w', { + localProvider, + requirePhysicalStop: true + }).then( + () => new Error('expected a rejection'), + (rejection: Error) => rejection + ) + expect(error.message).toContain('SSH channel closed while listing processes') + expect(classifyWorktreeForceDeleteReason(error.message)).toBe('unstopped-pty') + // Nothing was verified here, so it must not read as the proven-live verdict. + expect(isProvenLivePtyRemovalError(error.message)).toBe(false) + }) + + // Why: the outer deadline rejects without cancelling the sweep it gave up on, so force + // could return — and the caller start deleting the directory — while shutdown() was still + // killing the PTY holding it open. On Windows that rmdir fails and half-deletes the + // workspace, which is exactly what the ordering at the removal call site exists to avoid. + it('waits for a shutdown the deadline abandoned before force returns', async () => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + let releaseShutdown: () => void = () => {} + try { + listRegisteredPtysMock.mockReturnValue([]) + const localProvider = createProviderStub(async () => [ + { id: 'w1@@live-1', cwd: '/tmp/w1', title: 'shell' } + ]) + let shutdownFinished = false + ;(localProvider.shutdown as unknown as ReturnType).mockImplementation( + async () => + await new Promise((resolve) => { + releaseShutdown = () => { + shutdownFinished = true + resolve() + } + }) + ) + + const teardown = settleTeardown( + killAllProcessesForWorktree('w1', { + localProvider, + timeoutMs: 30, + requirePhysicalStop: true, + allowUnverifiedStop: true + }) + ) + let returned = false + void teardown.then(() => { + returned = true + }) + await new Promise((resolve) => setTimeout(resolve, 150)) + + expect(shutdownFinished).toBe(false) + expect(returned).toBe(false) + releaseShutdown() + await expect(teardown).resolves.toEqual({ + runtimeStopped: 0, + providerStopped: 0, + registryStopped: 0 + }) + } finally { + releaseShutdown() + warn.mockRestore() + } + }) + it('lets an explicit force removal proceed past PTYs it could not stop', async () => { const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) try { diff --git a/src/main/runtime/worktree-teardown.ts b/src/main/runtime/worktree-teardown.ts index 45929e21f98..993a263d348 100644 --- a/src/main/runtime/worktree-teardown.ts +++ b/src/main/runtime/worktree-teardown.ts @@ -4,10 +4,16 @@ import { listRegisteredPtys } from '../memory/pty-registry' import { isPathInsideOrEqual } from '../../shared/cross-platform-path' import { splitWorktreeId, splitWorktreeIdForFilesystem } from '../../shared/worktree-id' import { mapWithConcurrency } from '../../shared/map-with-concurrency' -import { WORKTREE_TEARDOWN_FORCE_HINT } from '../../shared/worktree-removal' +import { + isUnstoppedPtyRemovalError, + WORKTREE_TEARDOWN_FORCE_HINT, + WORKTREE_TEARDOWN_TIMEOUT_PREFIX +} from '../../shared/worktree-removal' import { settleBeforeDeadline } from './settle-before-deadline' +import { createWorktreeSweepTracker, settleSweepsForForcedRemoval } from './forced-sweep-settlement' import { describeError, + describeFailedPtySweep, describeUnstoppedPtys, verifyUnstoppedPtys, type UnstoppedPtyVerdict @@ -87,7 +93,10 @@ export async function killAllProcessesForWorktree( ): Promise { const sweepBudgetMs = Math.max(1, deps.timeoutMs ?? WORKTREE_PROCESS_SWEEP_TIMEOUT_MS) const deadline = Date.now() + sweepBudgetMs - const deadlineError = new Error(`Timed out waiting for physical PTY teardown: ${worktreeId}`) + const deadlineError = new Error( + `${WORKTREE_TEARDOWN_TIMEOUT_PREFIX} ${worktreeId}. ${WORKTREE_TEARDOWN_FORCE_HINT}` + ) + const sweeps = createWorktreeSweepTracker() const stopAttempts = new Map>() const stopPty = ( ptyId: string, @@ -116,7 +125,7 @@ export async function killAllProcessesForWorktree( // destructive removal closed. const runtimeSweep = deps.runtime ? settleBeforeDeadline( - () => + sweeps.track(() => deps.runtime!.stopTerminalsForWorktree(worktreeId, { deadline, stopPty, @@ -127,7 +136,8 @@ export async function killAllProcessesForWorktree( ...(deps.resolvedRuntimeEnvironmentId ? { resolvedRuntimeEnvironmentId: deps.resolvedRuntimeEnvironmentId } : {}) - }), + }) + ), { stopped: 0 }, deadline, deps.requirePhysicalStop ? deadlineError : undefined, @@ -142,7 +152,7 @@ export async function killAllProcessesForWorktree( deps.includeProviderInventory === false ? Promise.resolve(0) : settleBeforeDeadline( - () => + sweeps.track(() => sweepProviderByPrefix( worktreeId, deps.localProvider, @@ -150,7 +160,8 @@ export async function killAllProcessesForWorktree( stopPty, deps.onPtyStopped, deps.requirePhysicalStop - ), + ) + ), 0, deadline, deps.requirePhysicalStop ? deadlineError : undefined @@ -159,14 +170,15 @@ export async function killAllProcessesForWorktree( deps.includeLocalRegistry === false ? Promise.resolve(0) : settleBeforeDeadline( - () => + sweeps.track(() => sweepRegistryForWorktree( worktreeId, deps.localProvider, deadline, stopPty, deps.onPtyStopped - ), + ) + ), 0, deadline, deps.requirePhysicalStop ? deadlineError : undefined @@ -180,54 +192,39 @@ export async function killAllProcessesForWorktree( let providerStopped: number let registryStopped: number if (deps.allowUnverifiedStop) { - // Why: force goes on to delete files, so every sweep must finish releasing - // handles first — Promise.all would abandon the siblings of the first - // rejection while they were still inside shutdown(), racing the delete. - const settled = await Promise.allSettled([runtimeSweep, providerSweep, registrySweep]) - const [runtimeSettled, providerSettled, registrySettled] = settled - const reasons = settled.flatMap((result) => - result.status === 'rejected' ? [result.reason as unknown] : [] + const forced = await settleSweepsForForcedRemoval( + worktreeId, + { runtime: runtimeSweep, provider: providerSweep, registry: registrySweep }, + sweeps, + deadlineError ) - if (reasons.length > 0) { - // Why (#11960): a sweep that cannot even complete — unresponsive daemon, - // dropped SSH channel — fails before the unproven-stop gate below could - // offer its escape hatch, so an explicit Force Delete has to survive it. - // Report every reason, specific ones first: the shared deadline sentinel - // only says that *something* timed out, so leading with it would bury the - // provider error that actually explains the failure. This warning is the - // only trace of a removal that deleted files without proving a single stop. - const detail = [ - ...reasons.filter((candidate) => candidate !== deadlineError), - ...reasons.filter((candidate) => candidate === deadlineError) - ] - .map(describeError) - .join('; ') - console.warn( - `[worktree-teardown] forcing removal after an incomplete PTY sweep for ${worktreeId} — ${detail}` - ) - // Returning here does skip the verdict below, which could still have named - // live PTYs when only one sweep failed — accepted for now because this path - // is behind an explicit Force Delete, deletes either way, and clears no - // registry rows, so the cost is diagnosability rather than safety. - // Report what the surviving sweeps actually stopped rather than a flat zero. - return { - runtimeStopped: runtimeSettled.status === 'fulfilled' ? runtimeSettled.value.stopped : 0, - providerStopped: providerSettled.status === 'fulfilled' ? providerSettled.value : 0, - registryStopped: registrySettled.status === 'fulfilled' ? registrySettled.value : 0 - } + if (forced.incomplete) { + return forced.stopped } - runtimeResult = (runtimeSettled as PromiseFulfilledResult<{ stopped: number }>).value - providerStopped = (providerSettled as PromiseFulfilledResult).value - registryStopped = (registrySettled as PromiseFulfilledResult).value + runtimeResult = { stopped: forced.stopped.runtimeStopped } + providerStopped = forced.stopped.providerStopped + registryStopped = forced.stopped.registryStopped } else { // Why: without the waiver a rejection aborts the removal and nothing is // deleted, so failing fast is safe — and keeps a dead host reporting // immediately instead of after the full sweep budget. - ;[runtimeResult, providerStopped, registryStopped] = await Promise.all([ - runtimeSweep, - providerSweep, - registrySweep - ]) + try { + ;[runtimeResult, providerStopped, registryStopped] = await Promise.all([ + runtimeSweep, + providerSweep, + registrySweep + ]) + } catch (error) { + // Why (#11960): this rejection is the provider's own wording, which the force + // classifier cannot recognise — so the wedge Force Delete exists for was the one + // failure that never offered it. Re-word it, keeping the original as the cause. + throw deps.requirePhysicalStop && !isUnstoppedPtyRemovalError(describeError(error)) + ? new Error( + `${describeFailedPtySweep(worktreeId, error)}. ${WORKTREE_TEARDOWN_FORCE_HINT}`, + { cause: error } + ) + : error + } } if (deps.requirePhysicalStop) { const stopResults = await Promise.all( diff --git a/src/renderer/src/components/sidebar/delete-worktree-toast.test.ts b/src/renderer/src/components/sidebar/delete-worktree-toast.test.ts index 16bf7c4b954..acaa7d8f16f 100644 --- a/src/renderer/src/components/sidebar/delete-worktree-toast.test.ts +++ b/src/renderer/src/components/sidebar/delete-worktree-toast.test.ts @@ -1,5 +1,13 @@ import { describe, expect, it } from 'vitest' import { getDeleteWorktreeToastCopy } from './delete-worktree-toast' +import { classifyWorktreeForceDeleteReason } from '../../../../shared/worktree-removal' + +// Why: production never hands this function a literal reason — the store derives it from +// classifyWorktreeForceDeleteReason (store/slices/worktrees.ts). Passing one in would let a +// message the classifier rejects still render the force copy, testing a UI that never runs. +function toastCopyForRemovalError(worktreeName: string, error: string): unknown { + return getDeleteWorktreeToastCopy(worktreeName, classifyWorktreeForceDeleteReason(error), error) +} describe('getDeleteWorktreeToastCopy', () => { it('uses direct guidance when force delete is available', () => { @@ -14,11 +22,58 @@ describe('getDeleteWorktreeToastCopy', () => { // toast has to actually offer it — a reason of null hides the button entirely. it('uses terminal-teardown guidance when a PTY stop could not be proven', () => { expect( - getDeleteWorktreeToastCopy( + toastCopyForRemovalError( + 'feature/foo', + 'Failed to physically stop every PTY for worktree: repo-1::/w — could not verify these exited: term_a (the process list timed out)' + ) + ).toEqual({ + title: 'Failed to delete workspace feature/foo', + description: + 'Orca could not confirm every terminal in this workspace has exited, so it stopped before deleting any files. Use Force Delete to remove it anyway.', + isDestructive: false + }) + }) + + // Why: Force Delete proceeds on a proven-live PTY too, so the copy must not describe + // that as an unconfirmed exit — the user is killing a terminal Orca watched running. + it('names the running terminals when verification proved they are still live', () => { + expect( + toastCopyForRemovalError( 'feature/foo', - 'unstopped-pty', 'Failed to physically stop every PTY for worktree: repo-1::/w — still live: term_a' ) + ).toEqual({ + title: 'Failed to delete workspace feature/foo', + description: + 'This workspace still has running terminals, so Orca stopped before deleting any files. Force Delete will kill them and discard any uncommitted work they hold.', + isDestructive: false + }) + }) + + // Why: a sweep that never answered wedges removal the same way, and the waiver clears + // both — so it must reach the same force affordance instead of a dead end. + it('offers force delete when the teardown sweep itself timed out', () => { + expect( + toastCopyForRemovalError( + 'feature/foo', + 'Timed out waiting for physical PTY teardown: repo-1::/w. Retry with force delete (--force) to remove it anyway.' + ) + ).toEqual({ + title: 'Failed to delete workspace feature/foo', + description: + 'Orca could not confirm every terminal in this workspace has exited, so it stopped before deleting any files. Use Force Delete to remove it anyway.', + isDestructive: false + }) + }) + + // Why: the same wedge worded by the provider instead of the deadline — a dropped SSH + // channel — must reach the same offer, or the escape hatch misses the case it was for. + it('offers force delete when the sweep failed rather than timed out', () => { + expect( + toastCopyForRemovalError( + 'feature/foo', + 'Failed to physically stop every PTY for worktree: repo-1::/w — the terminal sweep failed: SSH channel closed while listing processes. Retry with force delete (--force) to remove it anyway.' + ) ).toEqual({ title: 'Failed to delete workspace feature/foo', description: diff --git a/src/renderer/src/components/sidebar/delete-worktree-toast.ts b/src/renderer/src/components/sidebar/delete-worktree-toast.ts index 22f7eb7f5ad..fac1c6ee06a 100644 --- a/src/renderer/src/components/sidebar/delete-worktree-toast.ts +++ b/src/renderer/src/components/sidebar/delete-worktree-toast.ts @@ -1,6 +1,7 @@ import { translate } from '@/i18n/i18n' import { isLockedWorktreeRemovalError, + isProvenLivePtyRemovalError, type WorktreeForceDeleteReason } from '../../../../shared/worktree-removal' export type DeleteWorktreeToastCopy = { @@ -58,10 +59,18 @@ export function getDeleteWorktreeToastCopy( 'Failed to delete workspace {{value0}}', { value0: worktreeName } ), - description: translate( - 'auto.components.sidebar.delete.worktree.toast.unstoppedPty', - 'Orca could not confirm every terminal in this workspace has exited, so it stopped before deleting any files. Use Force Delete to remove it anyway.' - ), + // Why: Force Delete proceeds either way, so the copy must say which case this is. + // Telling a user "could not confirm" about terminals Orca watched stay alive asks + // them to waive a doubt that does not exist, and any running agent's work dies with it. + description: isProvenLivePtyRemovalError(error) + ? translate( + 'auto.components.sidebar.delete.worktree.toast.unstoppedPtyLive', + 'This workspace still has running terminals, so Orca stopped before deleting any files. Force Delete will kill them and discard any uncommitted work they hold.' + ) + : translate( + 'auto.components.sidebar.delete.worktree.toast.unstoppedPty', + 'Orca could not confirm every terminal in this workspace has exited, so it stopped before deleting any files. Use Force Delete to remove it anyway.' + ), isDestructive: false } } diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json index 05082ae9ba8..643a4f326c9 100644 --- a/src/renderer/src/i18n/locales/en.json +++ b/src/renderer/src/i18n/locales/en.json @@ -4773,7 +4773,8 @@ "0899ebdb28": "Git already forgot this workspace, but its directory is still on disk. Use Force Delete to remove the orphaned directory.", "locked": "This workspace is locked by Git. Run git worktree unlock from its repository, then retry deletion.", "lockedReason": "This workspace is locked by Git. Git reported: {{value0}}. Run git worktree unlock from its repository, then retry deletion.", - "unstoppedPty": "Orca could not confirm every terminal in this workspace has exited, so it stopped before deleting any files. Use Force Delete to remove it anyway." + "unstoppedPty": "Orca could not confirm every terminal in this workspace has exited, so it stopped before deleting any files. Use Force Delete to remove it anyway.", + "unstoppedPtyLive": "This workspace still has running terminals, so Orca stopped before deleting any files. Force Delete will kill them and discard any uncommitted work they hold." } } }, diff --git a/src/shared/worktree-removal-force-classification.test.ts b/src/shared/worktree-removal-force-classification.test.ts index 1d995d412f4..b4d95a5727d 100644 --- a/src/shared/worktree-removal-force-classification.test.ts +++ b/src/shared/worktree-removal-force-classification.test.ts @@ -1,13 +1,19 @@ import { describe, expect, it } from 'vitest' -import { classifyWorktreeForceDeleteReason, WORKTREE_TEARDOWN_FORCE_HINT } from './worktree-removal' +import { + classifyWorktreeForceDeleteReason, + isProvenLivePtyRemovalError, + UNSTOPPED_PTY_REMOVAL_PREFIX, + WORKTREE_TEARDOWN_FORCE_HINT, + WORKTREE_TEARDOWN_TIMEOUT_PREFIX +} from './worktree-removal' + +const liveError = `${UNSTOPPED_PTY_REMOVAL_PREFIX} repo-1::/w — still live: term_a. ${WORKTREE_TEARDOWN_FORCE_HINT}` +const unverifiableError = `${UNSTOPPED_PTY_REMOVAL_PREFIX} repo-1::/w — could not verify these exited: term_a (daemon socket closed). ${WORKTREE_TEARDOWN_FORCE_HINT}` // Why (#11960): the desktop Force Delete button renders only when this classifier // returns a reason. The PTY-teardown error tells the user to force-delete, so an // unclassified message leaves them reading advice they cannot act on. describe('classifyWorktreeForceDeleteReason for unstopped PTYs', () => { - const liveError = `Failed to physically stop every PTY for worktree: repo-1::/w — still live: term_a. ${WORKTREE_TEARDOWN_FORCE_HINT}` - const unverifiableError = `Failed to physically stop every PTY for worktree: repo-1::/w — could not verify these exited: term_a (daemon socket closed). ${WORKTREE_TEARDOWN_FORCE_HINT}` - it('offers force for a PTY that is still live', () => { expect(classifyWorktreeForceDeleteReason(liveError)).toBe('unstopped-pty') }) @@ -29,7 +35,35 @@ describe('classifyWorktreeForceDeleteReason for unstopped PTYs', () => { expect(classifyWorktreeForceDeleteReason(liveError, false, true)).toBeNull() }) + // Why: a wedged provider rejects the sweep before any per-PTY verdict exists, so the + // failure arrives worded as a teardown timeout. The waiver clears it exactly like an + // unproven stop, so leaving it unclassified hid the button for the wedge #11960 targeted. + it('offers force when the teardown sweep itself timed out', () => { + expect( + classifyWorktreeForceDeleteReason( + `${WORKTREE_TEARDOWN_TIMEOUT_PREFIX} repo-1::/w. ${WORKTREE_TEARDOWN_FORCE_HINT}` + ) + ).toBe('unstopped-pty') + }) + it('leaves unrelated failures unclassified', () => { expect(classifyWorktreeForceDeleteReason('some other failure')).toBeNull() }) }) + +// The live verdict escalates the delete toast to "Force Delete will kill them", so it must +// come from Orca's own detail — not from the worktree id, which is a user-chosen path. +describe('isProvenLivePtyRemovalError', () => { + it('reads the verdict Orca actually recorded', () => { + expect(isProvenLivePtyRemovalError(liveError)).toBe(true) + expect(isProvenLivePtyRemovalError(unverifiableError)).toBe(false) + }) + + it('does not let a worktree path spell out a live verdict', () => { + expect( + isProvenLivePtyRemovalError( + `${UNSTOPPED_PTY_REMOVAL_PREFIX} repo-1::/Users/dev/still live: notes — could not verify these exited: term_a (daemon socket closed)` + ) + ).toBe(false) + }) +}) diff --git a/src/shared/worktree-removal.ts b/src/shared/worktree-removal.ts index 17e1b719cae..8788171ebe0 100644 --- a/src/shared/worktree-removal.ts +++ b/src/shared/worktree-removal.ts @@ -15,8 +15,34 @@ export type WorktreeForceDeleteReason = | 'missing-registration' | 'unstopped-pty' +// Why: everything before this separator is the worktree id — a user-chosen filesystem path. +// Only the detail after it is Orca's own wording, so verdict matchers anchor on the boundary +// rather than scanning the whole message and letting a path spell out a verdict. +export const UNSTOPPED_PTY_DETAIL_SEPARATOR = ' — ' + +// Why: verification distinguishes a PTY it watched stay alive from one it could not reach, +// and the delete toast must not flatten the two — a user waiving "we could not confirm" is +// making a different decision than one killing a terminal Orca just saw running. The marker +// and its matcher stay together for the same reason the force hint does. +export const UNSTOPPED_PTY_LIVE_DETAIL_PREFIX = 'still live:' + +// Why (#11960): a sweep that never answers wedges removal exactly like a stop that could not +// be proven, and the waiver clears both — but this error carries different words, so without +// its own matcher the force affordance stayed hidden for the very case it was added for. +export const WORKTREE_TEARDOWN_TIMEOUT_PREFIX = 'Timed out waiting for physical PTY teardown:' + export function isUnstoppedPtyRemovalError(error: string): boolean { - return error.includes(UNSTOPPED_PTY_REMOVAL_PREFIX) + return ( + error.includes(UNSTOPPED_PTY_REMOVAL_PREFIX) || error.includes(WORKTREE_TEARDOWN_TIMEOUT_PREFIX) + ) +} + +/** True only when verification positively observed the PTYs still running. */ +export function isProvenLivePtyRemovalError(error: string): boolean { + return ( + isUnstoppedPtyRemovalError(error) && + error.includes(`${UNSTOPPED_PTY_DETAIL_SEPARATOR}${UNSTOPPED_PTY_LIVE_DETAIL_PREFIX}`) + ) } export function createLockedWorktreeRemovalError(lockReason?: string): Error { From dbb7804421f43b9058ce54bd0556e35a8026106c Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:25:26 -0700 Subject: [PATCH 20/72] fix(updater): re-prove the retained Linux package before a privileged retry (#12395) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(updater): re-prove the retained Linux package before a privileged retry The recovery card's "Try Automatic Install Again" handed electron-updater the cached .deb/.rpm path with no re-verification. That path is user-writable, so the digest proven when the card rendered says nothing about the bytes dpkg or rpm would read as root minutes later — and the card's other actions (copy command, reveal) validated while the one that actually installs did not. Re-hash the artifact immediately before the install, ahead of any destructive quit prep, and abort with copy that tells the user to download again. This narrows the window rather than closing it; only an immutable handoff would close it, which is a larger change. Also fix a macOS-only failure this suite gained with the platform-conditional pre-commit copy: the expectation hardcoded the non-Darwin string, so the suite was red on any Mac. * fix(updater): re-prove the retained Linux package on every install path Review findings on the original fix: 1. The abort force-sent its error status with no staleness guard, so a verdict from a hash that outlived its cycle overwrote whatever card had replaced it (a fresh 'available' from Check for Updates became a stale "package no longer matches" error). Now keyed on an install-cycle signature, the same protection failLinuxPackageRecovery already had. 2. 'read-failed' (EMFILE/EIO/EACCES mid-stream) was described as a digest mismatch and tore down the recovery card. It now reuses the accurate per-reason copy and keeps the card, exactly as the Copy/Show paths do for the same reason. It still fails closed: chmod 000 on a swapped file would otherwise be a one-line bypass, since root can read what we cannot. 3. The check was keyed on the recovery status, so it only covered the retry. The primary 'downloaded -> Restart to Update' install, whose window is hours rather than seconds, handed the same user-writable path to dpkg/rpm unverified. Moved into performQuitAndInstall keyed on the tracked artifact, so both paths are covered; non-Linux keeps its exact timing through a synchronous artifact guard. 4. The async prologue had moved the "quit timer is always cleared" invariant out of a try/finally. The re-proof now owns a flag cleared in finally, and a rejection fails closed instead of wedging the updater. 5. The install re-proof no longer joins an in-flight validation, so its proof cannot predate the click that asked for it. 6. The retry button gained the pending affordance the other actions have, since the click now streams the whole package before anything happens. Tests: real packages are staged in a real updater cache for the whole Linux block (a path that never existed would now abort every install); new cases cover the swapped primary install, the stale-verdict drop, the preserved card on read-failed, the rejecting re-proof, the concurrent second click, and the fresh-hash guarantee. Each was verified to fail with only its source change reverted. * fix(updater): tell the renderer when a stale verdict abandons the install The cycle guard that stops a stale digest verdict from clobbering a newer card also withheld the only signal the renderer has that the restart was called off. The preload abort relay keys on an 'error' status, so with the status suppressed the window stays restart-prepared for the rest of the session: Terminal/Settings skip their unsaved-work prompts and the shutdown checkpoint stays deduped, so a later real quit stages no fresh snapshot. Push the abandon from performQuitAndInstall's single return-false site, so it cannot depend on what the reporter decides about the status text, and relay it to the existing relay.abort() (a no-op unless the renderer armed a restart). The status stays cycle-guarded exactly as before. Tests: the stale-verdict and swapped-primary-install cases now assert the push, a committed install asserts its absence, and the preload relay test covers the new channel. Each fails with only its source change reverted. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- .../linux-package-update-recovery.test.ts | 58 +++ src/main/linux-package-update-recovery.ts | 52 ++- ...ter-linux-package-recovery-actions.test.ts | 4 + src/main/updater.test.ts | 366 ++++++++++++++++-- src/main/updater.ts | 125 +++++- src/preload/renderer-restart-wiring.test.ts | 10 +- src/preload/renderer-restart-wiring.ts | 6 +- .../LinuxPackageInstallRecoveryCard.test.tsx | 3 + .../LinuxPackageInstallRecoveryCard.tsx | 4 + 9 files changed, 577 insertions(+), 51 deletions(-) diff --git a/src/main/linux-package-update-recovery.test.ts b/src/main/linux-package-update-recovery.test.ts index e3c4a27533f..1d9bf8d8650 100644 --- a/src/main/linux-package-update-recovery.test.ts +++ b/src/main/linux-package-update-recovery.test.ts @@ -611,6 +611,31 @@ describePosix('validation coalescing', () => { expect(hashPasses.count).toBe(2) }) + // Why: a verdict handed to a root package manager must cover the bytes as of the click, not the + // bytes a Copy click started streaming seconds earlier. + it('never reuses an in-flight pass for a pre-install re-proof', async () => { + await writePackage('orca.deb') + capture() + const artifact = recovery.getTrackedLinuxPackageArtifact() + const copyPass = recovery.resolveLinuxPackageInstallInstructions(recoveryFor()) + const installPass = recovery.revalidateLinuxPackageForInstall(artifact!) + + await expect(installPass).resolves.toEqual({ ok: true }) + await expect(copyPass).resolves.toMatchObject({ ok: true }) + expect(hashPasses.count).toBe(2) + }) + + it('lets a later Copy click join the pre-install pass', async () => { + await writePackage('orca.deb') + capture() + const artifact = recovery.getTrackedLinuxPackageArtifact() + const installPass = recovery.revalidateLinuxPackageForInstall(artifact!) + const copyPass = recovery.resolveLinuxPackageInstallInstructions(recoveryFor()) + + await Promise.all([installPass, copyPass]) + expect(hashPasses.count).toBe(1) + }) + it('does not reuse an in-flight pass for a different artifact', async () => { await writePackage('orca.deb') await writePackage('orca-next.deb') @@ -629,6 +654,39 @@ describePosix('validation coalescing', () => { }) }) +describePosix('revalidateLinuxPackageForInstall', () => { + it('proves the retained package still matches its release digest', async () => { + await writePackage('orca.deb') + capture() + const artifact = recovery.getTrackedLinuxPackageArtifact() + await expect(recovery.revalidateLinuxPackageForInstall(artifact!)).resolves.toEqual({ + ok: true + }) + }) + + it('rejects a package swapped after the download was verified', async () => { + await writePackage('orca.deb') + capture() + const artifact = recovery.getTrackedLinuxPackageArtifact() + await writePackage('orca.deb', 'attacker supplied package') + await expect(recovery.revalidateLinuxPackageForInstall(artifact!)).resolves.toEqual({ + ok: false, + reason: 'hash-mismatch' + }) + }) + + it('reports a package deleted from the cache as missing', async () => { + const filePath = await writePackage('orca.deb') + capture() + const artifact = recovery.getTrackedLinuxPackageArtifact() + await fsp.rm(filePath) + await expect(recovery.revalidateLinuxPackageForInstall(artifact!)).resolves.toEqual({ + ok: false, + reason: 'missing' + }) + }) +}) + describePosix('revealLinuxPackage', () => { it('reveals a verified package on the machine that owns it', async () => { const filePath = await writePackage('orca.deb') diff --git a/src/main/linux-package-update-recovery.ts b/src/main/linux-package-update-recovery.ts index 83aca03cb3f..f854b63c5b8 100644 --- a/src/main/linux-package-update-recovery.ts +++ b/src/main/linux-package-update-recovery.ts @@ -241,6 +241,29 @@ async function validateArtifact(artifact: LinuxPackageArtifact): Promise { + const key = `${artifact.packageType}:${artifact.version}:${artifact.path}:${artifact.sha512}` + if (!options?.fresh && inFlightValidation?.key === key) { + return inFlightValidation.promise + } + const promise: Promise = validateArtifact(artifact).finally(() => { + // Why: identity, not key — a fresh install pass may already have replaced this entry. + if (inFlightValidation?.promise === promise) { + inFlightValidation = null + } + }) + inFlightValidation = { key, promise } + return promise +} + /** * Revalidates the retained package against the digest captured from the release metadata. This is * an integrity check against that HTTPS metadata, not a package signature and not a privilege @@ -257,17 +280,7 @@ async function validateTrackedArtifact( ) { return { ok: false, reason: 'missing' } } - const key = `${artifact.packageType}:${artifact.version}:${artifact.path}:${artifact.sha512}` - if (inFlightValidation?.key === key) { - return inFlightValidation.promise - } - const promise = validateArtifact(artifact).finally(() => { - if (inFlightValidation?.key === key) { - inFlightValidation = null - } - }) - inFlightValidation = { key, promise } - return promise + return runValidation(artifact) } export async function resolveLinuxPackageInstallInstructions( @@ -289,6 +302,23 @@ export async function resolveLinuxPackageInstallInstructions( } } +/** + * Re-proves the retained package immediately before the privileged installer consumes it. + * + * The cache path is user-writable, so a digest checked when the download finished says nothing + * about the bytes `dpkg -i` will read minutes later. Re-hashing here does not close the race — + * only an immutable handoff would — but it shrinks the window from "since the download" to + * "since this call", and it catches the artifact being swapped or deleted outright. Takes the + * artifact rather than a recovery so both the retry and the plain "Restart to Update" install + * are covered. + */ +export async function revalidateLinuxPackageForInstall( + artifact: LinuxPackageArtifact +): Promise<{ ok: true } | { ok: false; reason: LinuxPackageRecoveryUnavailableReason }> { + const validation = await runValidation(artifact, { fresh: true }) + return validation.ok ? { ok: true } : { ok: false, reason: validation.reason } +} + export async function revealLinuxPackage( recovery: LinuxPackageInstallRecovery ): Promise { diff --git a/src/main/updater-linux-package-recovery-actions.test.ts b/src/main/updater-linux-package-recovery-actions.test.ts index 91b2423c817..75f593b7f57 100644 --- a/src/main/updater-linux-package-recovery-actions.test.ts +++ b/src/main/updater-linux-package-recovery-actions.test.ts @@ -9,6 +9,7 @@ const { getTrackedLinuxPackageArtifactMock, recordUpdaterLifecycleMock, resolveLinuxPackageInstallInstructionsMock, + revalidateLinuxPackageForInstallMock, revealLinuxPackageMock, resetHandlers } = vi.hoisted(() => { @@ -42,6 +43,7 @@ const { getTrackedLinuxPackageArtifactMock: vi.fn(), recordUpdaterLifecycleMock: vi.fn(), resolveLinuxPackageInstallInstructionsMock: vi.fn(), + revalidateLinuxPackageForInstallMock: vi.fn(), revealLinuxPackageMock: vi.fn(), resetHandlers: () => updaterHandlers.clear() } @@ -82,6 +84,7 @@ vi.mock('./linux-package-update-recovery', () => ({ clearTrackedLinuxPackageArtifactForOtherVersion: vi.fn(), getTrackedLinuxPackageArtifact: getTrackedLinuxPackageArtifactMock, resolveLinuxPackageInstallInstructions: resolveLinuxPackageInstallInstructionsMock, + revalidateLinuxPackageForInstall: revalidateLinuxPackageForInstallMock, revealLinuxPackage: revealLinuxPackageMock })) @@ -113,6 +116,7 @@ describe('linux package recovery actions', () => { resolveLinuxPackageInstallInstructionsMock .mockReset() .mockResolvedValue({ ok: true, command: "sudo apt install -- ''", packageFileName: 'p' }) + revalidateLinuxPackageForInstallMock.mockReset().mockResolvedValue({ ok: true }) revealLinuxPackageMock.mockReset().mockResolvedValue({ ok: true }) }) diff --git a/src/main/updater.test.ts b/src/main/updater.test.ts index 35a8c4c45bc..a0ab479343d 100644 --- a/src/main/updater.test.ts +++ b/src/main/updater.test.ts @@ -1,6 +1,53 @@ /* eslint-disable max-lines */ -import { beforeEach, describe, expect, it, vi } from 'vitest' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { createHash } from 'node:crypto' +import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs' +import { tmpdir } from 'node:os' +import { join } from 'node:path' import type * as UpdaterModule from './updater' +import type * as RecoveryModule from './linux-package-update-recovery' +import type { UpdateStatus } from '../shared/types' + +type RevalidationVerdict = Awaited< + ReturnType +> + +// Captured before any vi.useFakeTimers() call: the only handle left that still yields to libuv. +const realSetTimeout = globalThis.setTimeout + +type StagedLinuxPackages = { + cacheRoot: string + debPath: string + debSha512: string + rpmPath: string + rpmSha512: string +} + +/** + * Stages real packages inside a real updater cache: every install re-proves the retained digest by + * streaming the file off disk, so a path that never existed would abort before reaching the native + * updater. Returns the actual digests for the download events. + */ +function stageLinuxUpdateCache(): StagedLinuxPackages { + const cacheRoot = mkdtempSync(join(tmpdir(), 'orca-updater-cache-')) + const pendingDir = join(cacheRoot, 'orca-updater', 'pending') + mkdirSync(pendingDir, { recursive: true }) + const stagePackage = (fileName: string): { path: string; sha512: string } => { + const packagePath = join(pendingDir, fileName) + const bytes = Buffer.from(`orca test package ${fileName}`) + writeFileSync(packagePath, bytes) + return { path: packagePath, sha512: createHash('sha512').update(bytes).digest('base64') } + } + const deb = stagePackage('orca-ide_1.0.61_amd64.deb') + const rpm = stagePackage('orca-ide-1.0.61.x86_64.rpm') + return { + cacheRoot, + debPath: deb.path, + debSha512: deb.sha512, + rpmPath: rpm.path, + rpmSha512: rpm.sha512 + } +} const { appMock, @@ -1780,8 +1827,12 @@ describe('updater', () => { 'updater:status', expect.objectContaining({ state: 'error', - // Why: a pre-commit install failure is not fixed by restarting, so the copy must not suggest it. - message: 'Could not start the update installer. Orca remains open.' + // Why: a pre-commit install failure is not fixed by restarting, so the copy must not + // suggest it — except on macOS, where quitting does re-stage a Squirrel update. + message: + process.platform === 'darwin' + ? 'Could not restart to install the update. Quit and reopen Orca, then try again.' + : 'Could not start the update installer. Orca remains open.' }) ) }) @@ -3794,29 +3845,93 @@ describe('updater', () => { }) describe('linux root package install recovery', () => { - // Real 64-byte SHA-512 values; capture rejects a digest that cannot decode to one. - const DEB_SHA512 = - 'LHlL7dKoqg98gS2nfQv878dK+UoktbAkm4M20/hoJ2Qr0Kqsa3MSL4VmWy/Lll/MYjQFkpvOxduQ/vswentozA==' - const RPM_SHA512 = - 'W2U3AUPfVpc0Ia1qX/VJ5+8aW+yOFhysT6ryodo7A6DTZKqL6RYLK53U6ShGx+9f4lb35qtd4tOp5jzJZZdAfQ==' + let staged: StagedLinuxPackages + let EXIT_127: string + + // Why: the pre-install digest re-proof streams the package off real disk. Fake timers never + // advance libuv, so the quit timer needs fake time while the read needs real event-loop turns. + const settleQuitAndInstall = async (): Promise => { + await vi.advanceTimersByTimeAsync(100) + for (let turn = 0; turn < 40; turn += 1) { + await new Promise((resolve) => realSetTimeout(resolve, 0)) + } + await vi.advanceTimersByTimeAsync(0) + } + + beforeEach(() => { + staged = stageLinuxUpdateCache() + vi.stubEnv('XDG_CACHE_HOME', staged.cacheRoot) + EXIT_127 = `Command failed: /usr/bin/pkexec /usr/bin/dpkg -i ${staged.debPath}, exited with code 127` + }) + + afterEach(() => { + vi.doUnmock('./linux-package-update-recovery') + vi.unstubAllEnvs() + rmSync(staged.cacheRoot, { recursive: true, force: true }) + }) + + /** + * Holds the pre-install re-proof open so a verdict can be delivered at an exact point in the + * cycle. Only that call is replaced — the artifact state stays real. Must precede startUpdater. + */ + const holdRevalidation = (): { + settle: (verdict: RevalidationVerdict) => void + fail: (error: Error) => void + } => { + let pending: { + resolve: (verdict: RevalidationVerdict) => void + reject: (error: Error) => void + } | null = null + vi.doMock('./linux-package-update-recovery', async () => { + const actual = await vi.importActual( + './linux-package-update-recovery' + ) + return { + ...actual, + revalidateLinuxPackageForInstall: vi.fn( + () => + new Promise((resolve, reject) => { + pending = { resolve, reject } + }) + ) + } + }) + return { + settle: (verdict) => { + pending?.resolve(verdict) + pending = null + }, + fail: (error) => { + pending?.reject(error) + pending = null + } + } + } + + const lastStatus = (send: ReturnType): UpdateStatus | undefined => + send.mock.calls.findLast(([channel]) => channel === 'updater:status')?.[1] + // Why: macOS keeps the restart advice because quitting does re-stage a Squirrel update. const PRE_COMMIT_FAILURE_MESSAGE = process.platform === 'darwin' ? 'Could not restart to install the update. Quit and reopen Orca, then try again.' : 'Could not start the update installer. Orca remains open.' - const DEB_PATH = '/home/tester/.cache/orca-updater/pending/orca-ide_1.0.61_amd64.deb' - const RPM_PATH = '/home/tester/.cache/orca-updater/pending/orca-ide-1.0.61.x86_64.rpm' const AGENT_STDERR = 'pkexec: Error executing command as another user: No authentication agent found.' - const EXIT_127 = `Command failed: /usr/bin/pkexec /usr/bin/dpkg -i ${DEB_PATH}, exited with code 127` const downloadedEvent = (overrides?: Record): Record => ({ version: '1.0.61', - downloadedFile: DEB_PATH, - files: [{ url: 'orca-ide_1.0.61_amd64.deb', sha512: DEB_SHA512 }], + downloadedFile: staged.debPath, + files: [{ url: 'orca-ide_1.0.61_amd64.deb', sha512: staged.debSha512 }], ...overrides }) + const rpmDownloadedEvent = (): Record => + downloadedEvent({ + downloadedFile: staged.rpmPath, + files: [{ url: 'orca-ide-1.0.61.x86_64.rpm', sha512: staged.rpmSha512 }] + }) + const startUpdater = async ( packageType: 'deb' | 'rpm' | null ): Promise<{ send: ReturnType; updater: typeof UpdaterModule }> => { @@ -3902,12 +4017,12 @@ describe('updater', () => { const { send, updater } = await startUpdater('deb') await reachDownloaded(updater, downloadedEvent()) autoUpdaterMock.quitAndInstall.mockImplementation(() => { - autoUpdaterMock.logger?.error(`${AGENT_STDERR} target ${DEB_PATH}`) + autoUpdaterMock.logger?.error(`${AGENT_STDERR} target ${staged.debPath}`) throw new Error(EXIT_127) }) updater.quitAndInstall() - await vi.advanceTimersByTimeAsync(100) + await settleQuitAndInstall() // Why: the sync throw ends capture before the catch, so the stashed text must survive. expect(send).toHaveBeenCalledWith('updater:status', { @@ -3926,19 +4041,13 @@ describe('updater', () => { const openWindow = { removeAllListeners: vi.fn() } browserWindowMock.getAllWindows.mockReturnValue([openWindow] as never) const { send, updater } = await startUpdater('rpm') - await reachDownloaded( - updater, - downloadedEvent({ - downloadedFile: RPM_PATH, - files: [{ url: 'orca-ide-1.0.61.x86_64.rpm', sha512: RPM_SHA512 }] - }) - ) + await reachDownloaded(updater, rpmDownloadedEvent()) autoUpdaterMock.quitAndInstall.mockImplementation(() => { autoUpdaterMock.emit('error', new Error('Command failed, exited with code 1')) }) updater.quitAndInstall() - await vi.advanceTimersByTimeAsync(100) + await settleQuitAndInstall() expect(send).toHaveBeenCalledWith('updater:status', { state: 'error', @@ -3968,7 +4077,7 @@ describe('updater', () => { }) updater.quitAndInstall() - await vi.advanceTimersByTimeAsync(100) + await settleQuitAndInstall() expect(send).toHaveBeenCalledWith('updater:status', { state: 'error', @@ -3992,7 +4101,7 @@ describe('updater', () => { }) updater.quitAndInstall() - await vi.advanceTimersByTimeAsync(100) + await settleQuitAndInstall() expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled() expect(send).toHaveBeenCalledWith('updater:status', { @@ -4012,7 +4121,7 @@ describe('updater', () => { send.mockClear() updater.quitAndInstall() - await vi.advanceTimersByTimeAsync(100) + await settleQuitAndInstall() expect(recordUpdaterLifecycleMock).toHaveBeenCalledWith( 'post_commit_cleanup_failed', @@ -4030,7 +4139,7 @@ describe('updater', () => { await reachDownloaded(updater, downloadedEvent()) updater.quitAndInstall() - await vi.advanceTimersByTimeAsync(100) + await settleQuitAndInstall() expect(killAllPtyMock).toHaveBeenCalledTimes(1) send.mockClear() @@ -4048,9 +4157,9 @@ describe('updater', () => { }) updater.quitAndInstall() - await vi.advanceTimersByTimeAsync(100) + await settleQuitAndInstall() updater.quitAndInstall() - await vi.advanceTimersByTimeAsync(100) + await settleQuitAndInstall() // Why: a retry usually fails identically; a deduped status would strand the preload restart relay. expect( @@ -4069,16 +4178,205 @@ describe('updater', () => { }) }) - it('records classification-only lifecycle data for a package install failure', async () => { - const { updater } = await startUpdater('deb') + // Why: the cache path is user-writable, so the bytes verified when the recovery card + // rendered are not necessarily the bytes a root package manager would read on retry. + it('aborts the retry when the retained package no longer matches its digest', async () => { + const { send, updater } = await startUpdater('deb') + await reachDownloaded(updater, downloadedEvent()) + + // The escalation fails, which is what puts the recovery card (and its retry) on screen. + autoUpdaterMock.quitAndInstall.mockImplementation(() => { + autoUpdaterMock.emit('error', new Error(EXIT_127)) + }) + updater.quitAndInstall() + await settleQuitAndInstall() + expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1) + + // A local process swaps the verified package for its own between failure and retry. + writeFileSync(staged.debPath, Buffer.from('attacker supplied package')) + send.mockClear() + killAllPtyMock.mockClear() + + updater.quitAndInstall() + await settleQuitAndInstall() + + expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1) + expect(killAllPtyMock).not.toHaveBeenCalled() + expect(updater.isQuittingForUpdate()).toBe(false) + expect(send).toHaveBeenCalledWith('updater:status', { + state: 'error', + message: + 'The downloaded package no longer matches the verified release, so Orca will not hand it to a package manager. Download the update again, or get it from the official release page.' + }) + expect(recordUpdaterLifecycleMock).toHaveBeenCalledWith( + 'linux_package_revalidation_failed', + expect.objectContaining({ action: 'retry-automatic', reason: 'hash-mismatch' }), + expect.anything() + ) + }) + + // Why: "Restart to Update" is the common path and can sit unclicked for hours, so the same + // user-writable package reaches a root installer with a far longer window than any retry. + it('aborts the first install when the downloaded package was swapped', async () => { + const { send, updater } = await startUpdater('deb') + await reachDownloaded(updater, downloadedEvent()) + writeFileSync(staged.debPath, Buffer.from('attacker supplied package')) + send.mockClear() + + updater.quitAndInstall() + await settleQuitAndInstall() + + expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled() + expect(killAllPtyMock).not.toHaveBeenCalled() + expect(updater.isQuittingForUpdate()).toBe(false) + expect(send).toHaveBeenCalledWith('updater:status', { + state: 'error', + message: + 'The downloaded package no longer matches the verified release, so Orca will not hand it to a package manager. Download the update again, or get it from the official release page.' + }) + expect(send).toHaveBeenCalledWith('updater:quitAndInstallAborted') + expect(recordUpdaterLifecycleMock).toHaveBeenCalledWith( + 'linux_package_revalidation_failed', + expect.objectContaining({ action: 'restart-to-install', reason: 'hash-mismatch' }), + expect.anything() + ) + }) + + it('installs normally when the retained package still matches its digest', async () => { + const { send, updater } = await startUpdater('deb') + await reachDownloaded(updater, downloadedEvent()) + + updater.quitAndInstall() + await settleQuitAndInstall() + + expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1) + expect(killAllPtyMock).toHaveBeenCalledTimes(1) + // Why: an abort push here would clear the restart flag mid-quit and re-arm the dirty-buffer + // prompt against the install that is already committed. + expect(send).not.toHaveBeenCalledWith('updater:quitAndInstallAborted') + expect(recordUpdaterLifecycleMock).not.toHaveBeenCalledWith( + 'linux_package_revalidation_failed', + expect.anything(), + expect.anything() + ) + }) + + // Why: hashing 160 MB outlives the cycle it started in, and Check for Updates stays enabled + // while it runs — a verdict from the old cycle must not replace the card that took over. + it('drops an abort verdict once a newer check replaced the card', async () => { + const revalidation = holdRevalidation() + const { send, updater } = await startUpdater('deb') + await reachDownloaded(updater, downloadedEvent()) + + updater.quitAndInstall() + await vi.advanceTimersByTimeAsync(100) + // The user gives up waiting and checks again; that check owns the card from here. + updater.checkForUpdatesFromMenu() + await vi.advanceTimersByTimeAsync(0) + expect(lastStatus(send)).toMatchObject({ state: 'available', version: '1.0.61' }) + + revalidation.settle({ ok: false, reason: 'hash-mismatch' }) + await settleQuitAndInstall() + + // The install is still abandoned — only the stale status is withheld. + expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled() + expect(lastStatus(send)).toMatchObject({ state: 'available', version: '1.0.61' }) + // Withholding the status must not also withhold the abort: the renderer armed its restart and + // would otherwise skip its unsaved-work prompt for the rest of the session. + expect(send).toHaveBeenCalledWith('updater:quitAndInstallAborted') + expect(recordUpdaterLifecycleMock).toHaveBeenCalledWith( + 'linux_package_revalidation_failed', + expect.objectContaining({ reason: 'hash-mismatch' }), + expect.anything() + ) + }) + + // Why: EMFILE/EIO during the stream says nothing about the bytes, so the copy must not claim + // the package changed and the card must keep the actions that still work. + it('keeps the recovery card usable when the re-proof cannot read the package', async () => { + const revalidation = holdRevalidation() + const { send, updater } = await startUpdater('deb') await reachDownloaded(updater, downloadedEvent()) autoUpdaterMock.quitAndInstall.mockImplementation(() => { - autoUpdaterMock.logger?.error(`${AGENT_STDERR} target ${DEB_PATH}`) autoUpdaterMock.emit('error', new Error(EXIT_127)) }) + updater.quitAndInstall() + await vi.advanceTimersByTimeAsync(100) + revalidation.settle({ ok: true }) + await settleQuitAndInstall() + send.mockClear() + + updater.quitAndInstall() + await vi.advanceTimersByTimeAsync(100) + revalidation.settle({ ok: false, reason: 'read-failed' }) + await settleQuitAndInstall() + + expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1) + expect(lastStatus(send)).toEqual({ + state: 'error', + message: + 'Orca could not read the downloaded package. Download the update again, or get it from the official release page.', + recovery: { + kind: 'linux-package-install', + packageType: 'deb', + reason: 'package-install-failed', + version: '1.0.61' + } + }) + }) + + // Why: the re-proof runs before performQuitAndInstall's own error handling, so a rejection + // there would strand the quit timer and make every later install a silent no-op. + it('stays installable after a re-proof that rejects outright', async () => { + const revalidation = holdRevalidation() + const { send, updater } = await startUpdater('deb') + await reachDownloaded(updater, downloadedEvent()) + + updater.quitAndInstall() + await vi.advanceTimersByTimeAsync(100) + revalidation.fail(new Error('hash worker crashed')) + await settleQuitAndInstall() + + // Fails closed: an unprovable package is not handed to a root package manager. + expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled() + expect(lastStatus(send)).toMatchObject({ + state: 'error', + message: + 'Orca could not read the downloaded package. Download the update again, or get it from the official release page.' + }) updater.quitAndInstall() await vi.advanceTimersByTimeAsync(100) + revalidation.settle({ ok: true }) + await settleQuitAndInstall() + + expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1) + }) + + // Why: a second click during the multi-second hash must not schedule a parallel install. + it('ignores a second install request while the digest re-proof runs', async () => { + const { updater } = await startUpdater('deb') + await reachDownloaded(updater, downloadedEvent()) + + updater.quitAndInstall() + // Fires the quit timer, which starts the hash; the read itself is still outstanding. + await vi.advanceTimersByTimeAsync(100) + updater.quitAndInstall() + await settleQuitAndInstall() + + expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1) + }) + + it('records classification-only lifecycle data for a package install failure', async () => { + const { updater } = await startUpdater('deb') + await reachDownloaded(updater, downloadedEvent()) + autoUpdaterMock.quitAndInstall.mockImplementation(() => { + autoUpdaterMock.logger?.error(`${AGENT_STDERR} target ${staged.debPath}`) + autoUpdaterMock.emit('error', new Error(EXIT_127)) + }) + + updater.quitAndInstall() + await settleQuitAndInstall() const failure = recordUpdaterLifecycleMock.mock.calls.find( ([event]) => event === 'linux_package_install_failed' @@ -4091,7 +4389,7 @@ describe('updater', () => { errorType: 'Error' }) const durable = JSON.stringify(recordUpdaterLifecycleMock.mock.calls) - expect(durable).not.toContain(DEB_PATH) + expect(durable).not.toContain(staged.debPath) expect(durable).not.toContain('authentication agent') }) @@ -4103,7 +4401,7 @@ describe('updater', () => { }) updater.quitAndInstall() - await vi.advanceTimersByTimeAsync(100) + await settleQuitAndInstall() const failure = recordUpdaterLifecycleMock.mock.calls.find( ([event]) => event === 'linux_package_install_failed' diff --git a/src/main/updater.ts b/src/main/updater.ts index 6bb26d84dd5..302591286f3 100644 --- a/src/main/updater.ts +++ b/src/main/updater.ts @@ -45,7 +45,9 @@ import { clearTrackedLinuxPackageArtifact, getTrackedLinuxPackageArtifact, resolveLinuxPackageInstallInstructions, + revalidateLinuxPackageForInstall, revealLinuxPackage, + type LinuxPackageArtifact, type LinuxPackageRecoveryUnavailableReason } from './linux-package-update-recovery' import { @@ -124,6 +126,9 @@ let autoUpdateCheckTimer: ReturnType | null = null let nudgeCheckTimer: ReturnType | null = null let pendingQuitAndInstallTimer: ReturnType | null = null let quitAndInstallInProgress = false +// Why: the pre-install digest re-proof streams the whole package, so a second install request can +// arrive while it runs — after the quit timer was cleared but before the handoff owns the process. +let linuxPackageRevalidationInFlight = false let updateInstallMode: UpdateInstallMode = 'interactive' let lastInstallDeferralVersion = { download: null as string | null, install: null as string | null } // Why: once install has committed, late 'error' events must not clear quittingForUpdate — that would re-enable dock activate mid-installer. @@ -693,7 +698,7 @@ function clearPrereleaseFallbackContextIfSettled(): void { } async function performQuitAndInstall(): Promise { - if (quitAndInstallInProgress) { + if (quitAndInstallInProgress || linuxPackageRevalidationInFlight) { recordUpdaterLifecycle('quit_and_install_ignored', { reason: 'already-in-progress' }) return } @@ -707,6 +712,17 @@ async function performQuitAndInstall(): Promise { if (deferHeadlessServeInstall('install', pendingVersion)) { return } + // Why: the retained .deb/.rpm sits on a user-writable path that a root package manager is about + // to read, and nothing re-checks it after download. Re-prove it here — before any teardown — so a + // swapped or vanished package aborts instead of being installed as root. The synchronous guard + // keeps every non-Linux install on its existing timing. + if (getTrackedLinuxPackageArtifact() && !(await proveRetainedLinuxPackage(pendingVersion))) { + // Why: the renderer armed its restart before invoking, and it infers the abort from the error + // status — which a stale-cycle verdict deliberately withholds. Signal the abandon here, where + // it cannot depend on that decision, or the window keeps skipping its unsaved-work prompt. + mainWindowRef?.webContents.send('updater:quitAndInstallAborted') + return + } quitAndInstallInProgress = true markMacQuitAndInstallInFlight() @@ -1801,6 +1817,108 @@ function failLinuxPackageRecovery( throw new Error(message) } +/** + * Identifies the update cycle an install belongs to, so a verdict produced by a multi-second hash + * can be dropped when a newer cycle already replaced the card it would otherwise overwrite. + */ +function getInstallCycleSignature(): string { + const recovery = getActiveLinuxPackageRecovery() + if (recovery) { + return `recovery:${recovery.packageType}:${recovery.version}` + } + return currentStatus.state === 'downloaded' + ? `downloaded:${currentStatus.version}` + : `state:${currentStatus.state}` +} + +/** + * Re-proves the retained package before the install starts. Returns false when the install must be + * abandoned; the artifact is only re-read here, so callers still own every teardown decision. + */ +async function proveRetainedLinuxPackage(pendingVersion: string): Promise { + const artifact = getTrackedLinuxPackageArtifact() + if (!artifact) { + return true + } + // Why: an artifact retained from another cycle says nothing about the file electron-updater is + // about to install, so proving it would block a legitimate install on an unrelated digest. + if (pendingVersion && pendingVersion !== artifact.version) { + return true + } + const recovery = getActiveLinuxPackageRecovery() + const cycle = getInstallCycleSignature() + const reason = await revalidateRetainedLinuxPackage(artifact) + if (!reason) { + return true + } + reportLinuxPackageRevalidationFailure({ artifact, recovery, reason, cycle }) + return false +} + +/** The failing reason, or null when the retained package still matches its release digest. */ +async function revalidateRetainedLinuxPackage( + artifact: LinuxPackageArtifact +): Promise { + linuxPackageRevalidationInFlight = true + try { + const verdict = await revalidateLinuxPackageForInstall(artifact) + return verdict.ok ? null : verdict.reason + } catch (error) { + recordUpdaterLifecycle( + 'linux_package_revalidation_errored', + { errorType: error instanceof Error ? error.name : typeof error }, + { level: 'warn', message: 'Could not re-verify the retained update package' } + ) + // Why: fail closed — bytes we could not read are bytes we cannot hand to a root installer. + return 'read-failed' + } finally { + // Why: the invariant every install path depends on — a wedged flag would make quitAndInstall + // early-return for the rest of the session. + linuxPackageRevalidationInFlight = false + } +} + +function reportLinuxPackageRevalidationFailure({ + artifact, + recovery, + reason, + cycle +}: { + artifact: LinuxPackageArtifact + recovery: LinuxPackageInstallRecovery | null + reason: LinuxPackageRecoveryUnavailableReason + cycle: string +}): void { + recordUpdaterLifecycle( + 'linux_package_revalidation_failed', + { + action: recovery ? 'retry-automatic' : 'restart-to-install', + packageType: artifact.packageType, + version: artifact.version, + reason + }, + { level: 'warn', message: 'Retained update package failed its pre-install digest check' } + ) + // Why: a package proven bad must not stay tracked, but a download that landed during the hash + // owns the slot now and destroying it would force a needless 160 MB redownload. + const clearsArtifact = RECOVERY_CLEARING_REASONS.includes(reason) + if (clearsArtifact && getTrackedLinuxPackageArtifact() === artifact) { + clearTrackedLinuxPackageArtifact() + } + // Why: same reasoning as failLinuxPackageRecovery — a verdict from a cycle that has since been + // replaced must not clobber whatever card the user is looking at now. + if (getInstallCycleSignature() !== cycle) { + return + } + sendInstallFailureStatus({ + state: 'error', + message: LINUX_PACKAGE_RECOVERY_MESSAGES[reason], + // Why: an unreadable file is not evidence the bytes changed, so the recovery card and its + // Copy/Show actions survive a transient I/O failure exactly as they do elsewhere. + ...(recovery && !clearsArtifact ? { recovery } : {}) + }) +} + export async function getLinuxPackageInstallInstructions(): Promise { const recovery = getActiveLinuxPackageRecovery() if (!recovery) { @@ -1849,7 +1967,10 @@ export function quitAndInstall(): void { localBuildSelectionInProgress || pinnedBuildSelectionInProgress || pendingQuitAndInstallTimer || - quitAndInstallInProgress + quitAndInstallInProgress || + // Why: the quit timer is already cleared while the pre-install digest re-proof streams, so + // without this a second click would schedule a parallel install of the same package. + linuxPackageRevalidationInFlight ) { return } diff --git a/src/preload/renderer-restart-wiring.test.ts b/src/preload/renderer-restart-wiring.test.ts index 06be6537fcb..bd896109b57 100644 --- a/src/preload/renderer-restart-wiring.test.ts +++ b/src/preload/renderer-restart-wiring.test.ts @@ -10,11 +10,12 @@ import { } from './renderer-restart-wiring' describe('renderer restart wiring', () => { - it('relays updater status and prevented unload events', () => { + it('relays updater status, aborted installs, and prevented unload events', () => { const eventTarget = new EventTarget() const unloadPrevented = vi.fn() const restartAborted = vi.fn() const handleStatus = vi.fn() + const abort = vi.fn() const listeners = new Map void>() const ipcRenderer = { on: vi.fn((channel: string, listener: (...args: unknown[]) => void) => { @@ -25,12 +26,15 @@ describe('renderer restart wiring', () => { eventTarget.addEventListener(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT, unloadPrevented) eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, restartAborted) - registerRendererRestartIpcRelays(ipcRenderer, eventTarget, { handleStatus }) + registerRendererRestartIpcRelays(ipcRenderer, eventTarget, { handleStatus, abort }) listeners.get('updater:status')?.({}, { state: 'error', message: 'install failed' }) + // Why: main abandons an install without any status when its verdict outlived the cycle. + listeners.get('updater:quitAndInstallAborted')?.({}) listeners.get('window:unload-prevented')?.({}) - expect(ipcRenderer.on).toHaveBeenCalledTimes(2) + expect(ipcRenderer.on).toHaveBeenCalledTimes(3) expect(handleStatus).toHaveBeenCalledWith({ state: 'error', message: 'install failed' }) + expect(abort).toHaveBeenCalledTimes(1) expect(unloadPrevented).toHaveBeenCalledTimes(1) expect(restartAborted).toHaveBeenCalledTimes(1) }) diff --git a/src/preload/renderer-restart-wiring.ts b/src/preload/renderer-restart-wiring.ts index 9b140e7116b..0a177dd55b0 100644 --- a/src/preload/renderer-restart-wiring.ts +++ b/src/preload/renderer-restart-wiring.ts @@ -15,11 +15,15 @@ import { export function registerRendererRestartIpcRelays( ipcRenderer: Pick, eventTarget: EventTarget, - relay: Pick + relay: Pick ): void { ipcRenderer.on('updater:status', (_event, status: UpdateStatus) => { relay.handleStatus(status) }) + // Why: main abandons some installs without an error status, and only this tells the renderer. + ipcRenderer.on('updater:quitAndInstallAborted', () => { + relay.abort() + }) ipcRenderer.on('window:unload-prevented', () => { eventTarget.dispatchEvent(new Event(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT)) eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT)) diff --git a/src/renderer/src/components/LinuxPackageInstallRecoveryCard.test.tsx b/src/renderer/src/components/LinuxPackageInstallRecoveryCard.test.tsx index b42844611b4..e0685b55fbe 100644 --- a/src/renderer/src/components/LinuxPackageInstallRecoveryCard.test.tsx +++ b/src/renderer/src/components/LinuxPackageInstallRecoveryCard.test.tsx @@ -484,6 +484,9 @@ describe('LinuxPackageInstallRecoveryCard retry', () => { fireEvent.click(button('Try Automatic Install Again')) await flushActions() + // Why: the retry now re-proves the package digest before quitting, so the click must report + // progress instead of leaving three inert buttons for the length of the hash. + expect(isAriaDisabled(button('Checking package...'))).toBe(true) // Why: quitAndInstall resolves as soon as main schedules the install, so a resolved promise is // not an outcome — the slot stays held until a real status arrives. expect(isAriaDisabled(button('Copy Install Command'))).toBe(true) diff --git a/src/renderer/src/components/LinuxPackageInstallRecoveryCard.tsx b/src/renderer/src/components/LinuxPackageInstallRecoveryCard.tsx index 96d6b3cd5ee..3d89b7ee6b7 100644 --- a/src/renderer/src/components/LinuxPackageInstallRecoveryCard.tsx +++ b/src/renderer/src/components/LinuxPackageInstallRecoveryCard.tsx @@ -198,6 +198,10 @@ export function LinuxPackageInstallRecoveryCard({ 'auto.components.LinuxPackageInstallRecoveryCard.3da99454c6', 'Try Automatic Install Again' ), + // Why: the retry re-proves the package digest before it quits, so the click is no longer + // instant — without this the card would just go inert for the length of the hash. + pendingLabel: CHECKING_LABEL, + isPending: pendingAction === 'retry', disabled: pendingAction !== null, onClick: handleRetryAutomatic } From 141b1f43f632c3ec78e92113dda54ab4c8428db5 Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:25:44 -0700 Subject: [PATCH 21/72] fix(runtime): keep the listener on loopback for a "This computer only" pairing link (#12405) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(runtime): keep the listener on loopback for a "This computer only" pairing link The runtime pairing URL handler called ensureNetworkExposure() for every offer, including one whose advertised address is loopback. Settings -> "Share this Orca server" offers a "This computer only" radio that pairs against 127.0.0.1 precisely so nothing is reachable off-host, yet choosing it rebound the WebSocket listener from 127.0.0.1 to 0.0.0.0 — and the widen never narrows back, so the runtime stayed exposed to the whole LAN for the rest of the process after the user picked the option that exists to avoid exactly that. Gate the widen on the advertised address: only a non-loopback endpoint (LAN, Tailscale, custom host) needs a listener reachable off this machine, so those paths keep widening exactly as STA-2370 intended. A loopback link is already served by the loopback listener, so it now mints without touching the bind. Classification reuses the shared pairing-address classifier, which also covers localhost, ::1 and 127.0.0.0/8 typed into the custom-address field. Tests: a real OrcaRuntimeRpcServer driven through the IPC handler asserts the bind host stays 127.0.0.1 after a local link and flips to 0.0.0.0 after a LAN one, plus handler-level cases for 127.0.0.1 / localhost / ::1. * fix(runtime): gate the pairing widen on the user's declared reach, not the address shape Review of #12405 found two ways the loopback fix misbehaved. 1. The guarantee died at the next launch. resolveInitialWebSocketBindHost() binds 0.0.0.0 whenever any device has lastSeenAt > 0, and MobileSocketWiring stamps that for EVERY authenticated socket — including the local browser opening a "This computer only" link. So the runtime was still published on every interface, one restart later. Grants now carry the reach they were minted for (DeviceEntry.pairingReach, persisted); a this-computer grant no longer counts as proof that an off-host client may reconnect. Registries written before the field default to network reach, so an already-paired phone still finds a wide listener after upgrading. A pending grant that is re-advertised for the network widens (never narrows) so its link survives. 2. The widen was gated on the shape of the typed address, which the renderer never sent the intent for. A Custom `127.0.0.1:8443` — the documented SSH tunnel / reverse proxy field — skipped the widen and produced a dead link, while `localhost:8443`, `[::1]:6768` and `ws://127.0.0.1:6768` widened, so the same loopback intent was handled three different ways. The renderer now sends the declared reach ('this-computer' | 'network') and main gates on it; the address is only used as a mismatch guard (a this-computer reach carrying an off-host address still widens rather than minting an unreachable link), resolved through resolveAdvertisedPairingHostname so every accepted address form classifies identically. Also corrected the ensureNetworkExposure invariant comment: the widen is no longer confined to the first pairing action, so it can now tear down live loopback sockets — they reconnect on the reused pinned port. Tests: reach-form matrix + tunnel/undeclared/mismatch cases in mobile.test.ts, real-server relaunch bind for both reaches, legacy registry compatibility, the pending-grant reach upgrade, a live-client port-stability guard, hostname resolver coverage, and the renderer reach plumbing. Reverting only the source fails 18 of them. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- src/main/ipc/mobile.test.ts | 246 +++++++++++++++++- src/main/ipc/mobile.ts | 53 ++-- src/main/runtime/device-registry.ts | 57 +++- src/main/runtime/pairing-endpoint.test.ts | 33 ++- src/main/runtime/pairing-endpoint.ts | 17 ++ src/main/runtime/runtime-rpc.test.ts | 143 ++++++++++ src/main/runtime/runtime-rpc.ts | 26 +- src/preload/api-types.ts | 7 +- src/preload/index.ts | 4 + .../RuntimePairingUrlGenerator.test.tsx | 46 +++- .../settings/RuntimePairingUrlGenerator.tsx | 6 +- .../settings/runtime-pairing-link-state.ts | 8 + src/shared/runtime-pairing-reach.ts | 5 + 13 files changed, 608 insertions(+), 43 deletions(-) create mode 100644 src/shared/runtime-pairing-reach.ts diff --git a/src/main/ipc/mobile.test.ts b/src/main/ipc/mobile.test.ts index 54458541f92..9f81c3a6516 100644 --- a/src/main/ipc/mobile.test.ts +++ b/src/main/ipc/mobile.test.ts @@ -1,4 +1,5 @@ -import { beforeEach, describe, expect, it, vi } from 'vitest' +import { beforeEach, describe, expect, it, vi, type Mock } from 'vitest' +import type * as NodeOs from 'node:os' const { handleMock, networkInterfacesMock } = vi.hoisted(() => ({ handleMock: vi.fn(), @@ -17,12 +18,21 @@ vi.mock('qrcode', () => ({ } })) -vi.mock('os', () => ({ +// Why: only the interface enumeration is faked; the real `os` stays available for the integration +// test below, which needs tmpdir() for a real runtime's user data directory. +vi.mock('os', async (importOriginal) => ({ + ...(await importOriginal()), networkInterfaces: networkInterfacesMock })) +import { mkdtempSync } from 'node:fs' +import { tmpdir } from 'node:os' +import { join } from 'node:path' import { registerMobileHandlers } from './mobile' import { NETWORK_EXPOSURE_FAILED_GUIDANCE } from '../runtime/network-exposure-guidance' +import { OrcaRuntimeService } from '../runtime/orca-runtime' +import { OrcaRuntimeRpcServer } from '../runtime/runtime-rpc' +import { WebSocketTransport } from '../runtime/rpc/ws-transport' describe('registerMobileHandlers', () => { const handlers = new Map unknown>() @@ -308,7 +318,8 @@ describe('registerMobileHandlers', () => { address: '100.64.1.20', rotate: true, name: expect.stringMatching(/^Runtime /), - scope: 'runtime' + scope: 'runtime', + reach: 'network' }) // Why: STA-2370 — generating a runtime offer must widen the listener BEFORE advertising its endpoint, // or a client could read the URL and connect before the LAN bind exists. Assert call ORDER, not just @@ -319,6 +330,111 @@ describe('registerMobileHandlers', () => { ) }) + const stubRuntimePairingServer = ( + address: string + ): { createPairingOffer: Mock; ensureNetworkExposure: Mock } => ({ + createPairingOffer: vi.fn().mockReturnValue({ + available: true, + pairingUrl: 'orca://pair#runtime', + webClientUrl: `http://${address}/web-index.html?pairing=runtime`, + endpoint: `ws://${address}`, + deviceId: 'runtime-local' + }), + ensureNetworkExposure: vi.fn().mockResolvedValue(undefined) + }) + + // Why: every loopback form the address field accepts must behave identically once the user declared + // "This computer only" — `splitHostPort`/`ws://` overrides all reach the handler verbatim, so gating on + // the raw string alone treated `localhost:8443` and `ws://127.0.0.1:6768` as off-host. + it.each([ + '127.0.0.1', + 'localhost', + '::1', + '127.0.0.1:8443', + 'localhost:8443', + '[::1]:6768', + 'ws://127.0.0.1:6768' + ])('mints a %s runtime link without widening the listener off-host', async (address) => { + const rpcServer = stubRuntimePairingServer(address) + + registerMobileHandlers(rpcServer as never) + + await expect( + handlers.get('mobile:getRuntimePairingUrl')?.(null, { + address, + rotate: true, + reach: 'this-computer' + }) + ).resolves.toMatchObject({ available: true, deviceId: 'runtime-local' }) + + // Why: "This computer only" exists so nothing is exposed off-host — a loopback link is already + // served by the loopback listener, and the widen is one-way for the life of the process. + expect(rpcServer.ensureNetworkExposure).not.toHaveBeenCalled() + expect(rpcServer.createPairingOffer).toHaveBeenCalledWith( + expect.objectContaining({ reach: 'this-computer' }) + ) + }) + + // Why: the Custom field is documented as "SSH tunnel, reverse proxy, or custom hostname", so a loopback + // front-end there still needs the listener open behind it — gating the widen on the address SHAPE broke + // `ssh -L 8443::6768` (sshd dials the LAN address on this host and gets refused). + it.each(['127.0.0.1:8443', 'localhost', 'ws://127.0.0.1:6768'])( + 'widens the listener for a custom %s address that fronts a tunnel', + async (address) => { + const rpcServer = stubRuntimePairingServer(address) + + registerMobileHandlers(rpcServer as never) + + await expect( + handlers.get('mobile:getRuntimePairingUrl')?.(null, { + address, + rotate: true, + reach: 'network' + }) + ).resolves.toMatchObject({ available: true }) + + expect(rpcServer.ensureNetworkExposure).toHaveBeenCalled() + expect(rpcServer.createPairingOffer).toHaveBeenCalledWith( + expect.objectContaining({ reach: 'network' }) + ) + } + ) + + it('widens for a loopback address when the caller declares no reach', async () => { + const rpcServer = stubRuntimePairingServer('127.0.0.1:6768') + + registerMobileHandlers(rpcServer as never) + + await expect( + handlers.get('mobile:getRuntimePairingUrl')?.(null, { address: '127.0.0.1', rotate: true }) + ).resolves.toMatchObject({ available: true }) + + // Why: only an explicit "This computer only" declines remote reach; an undeclared caller keeps the + // pre-STA-2370 opt-in behavior rather than silently minting a link the widen never backed. + expect(rpcServer.ensureNetworkExposure).toHaveBeenCalled() + }) + + it('widens when a this-computer reach carries an off-host address', async () => { + const rpcServer = stubRuntimePairingServer('192.168.1.5:6768') + + registerMobileHandlers(rpcServer as never) + + await expect( + handlers.get('mobile:getRuntimePairingUrl')?.(null, { + address: '192.168.1.5', + rotate: true, + reach: 'this-computer' + }) + ).resolves.toMatchObject({ available: true }) + + // Why: the declared reach and the advertised address disagree; honoring the declaration would mint a + // LAN link with no LAN listener behind it, so the address it actually publishes wins. + expect(rpcServer.ensureNetworkExposure).toHaveBeenCalled() + expect(rpcServer.createPairingOffer).toHaveBeenCalledWith( + expect.objectContaining({ reach: 'network' }) + ) + }) + it('reports the runtime pairing url unavailable and mints no offer when the widen fails', async () => { const createPairingOffer = vi.fn() // Why: STA-2370 — a failed widen leaves the listener on loopback, so the handler must NOT advertise a @@ -496,3 +612,127 @@ describe('registerMobileHandlers', () => { expect(runPowerShell).not.toHaveBeenCalled() }) }) + +describe('runtime pairing bind host', () => { + const handlers = new Map unknown>() + + const wsTransportOf = (server: OrcaRuntimeRpcServer): WebSocketTransport | undefined => + (server['activeTransports'] as unknown[]).find( + (transport): transport is WebSocketTransport => transport instanceof WebSocketTransport + ) + + beforeEach(() => { + handlers.clear() + handleMock.mockReset() + networkInterfacesMock.mockReset() + networkInterfacesMock.mockReturnValue({}) + handleMock.mockImplementation((channel: string, handler: (...args: unknown[]) => unknown) => { + handlers.set(channel, handler) + }) + }) + + const startServer = async (userDataPath: string): Promise => { + const server = new OrcaRuntimeRpcServer({ + runtime: new OrcaRuntimeService(), + userDataPath, + enableWebSocket: true, + wsPort: 0 + }) + await server.start() + return server + } + + it('keeps a real listener on loopback for a local link and widens it only for an off-host one', async () => { + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-mobile-ipc-')) + const server = await startServer(userDataPath) + + try { + registerMobileHandlers(server) + expect(wsTransportOf(server)?.resolvedHost).toBe('127.0.0.1') + + await expect( + handlers.get('mobile:getRuntimePairingUrl')?.(null, { + address: '127.0.0.1', + rotate: true, + reach: 'this-computer' + }) + ).resolves.toMatchObject({ available: true }) + // Why: the exposure regression — picking "This computer only" used to rebind the listener to + // 0.0.0.0 and leave it there, publishing the runtime to the whole LAN for the rest of the process. + expect(wsTransportOf(server)?.resolvedHost).toBe('127.0.0.1') + + await expect( + handlers.get('mobile:getRuntimePairingUrl')?.(null, { + address: '100.64.1.20', + rotate: true, + reach: 'network' + }) + ).resolves.toMatchObject({ available: true }) + // Why: the LAN/Tailscale choice still opts in — a client off this host cannot reach a loopback bind. + expect(wsTransportOf(server)?.resolvedHost).toBe('0.0.0.0') + } finally { + await server.stop() + } + }) + + // Why: the whole guarantee is worthless if it lasts one process — the local web client authenticating + // marks its grant lastSeenAt > 0, which used to make the NEXT launch bind every interface. + it('still binds loopback on the next launch after the local link has been used', async () => { + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-mobile-ipc-')) + const server = await startServer(userDataPath) + let deviceId: string + try { + registerMobileHandlers(server) + const offer = (await handlers.get('mobile:getRuntimePairingUrl')?.(null, { + address: '127.0.0.1', + rotate: true, + reach: 'this-computer' + })) as { available: true; deviceId: string } + expect(offer.available).toBe(true) + deviceId = offer.deviceId + // Exactly what MobileSocketWiring does for every authenticated socket, local browser included. + server.getDeviceRegistry()?.updateLastSeen(deviceId) + } finally { + await server.stop() + } + + const relaunched = await startServer(userDataPath) + try { + expect( + relaunched + .getDeviceRegistry() + ?.listDevices() + .some((device) => device.deviceId === deviceId && device.lastSeenAt > 0) + ).toBe(true) + expect(wsTransportOf(relaunched)?.resolvedHost).toBe('127.0.0.1') + } finally { + await relaunched.stop() + } + }) + + it('binds all interfaces on the next launch after a network link has been used', async () => { + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-mobile-ipc-')) + const server = await startServer(userDataPath) + try { + registerMobileHandlers(server) + const offer = (await handlers.get('mobile:getRuntimePairingUrl')?.(null, { + address: '100.64.1.20', + rotate: true, + reach: 'network' + })) as { available: true; deviceId: string } + expect(offer.available).toBe(true) + server.getDeviceRegistry()?.updateLastSeen(offer.deviceId) + } finally { + await server.stop() + } + + const relaunched = await startServer(userDataPath) + try { + // Why: the reconnect widen must survive — a client that really did connect from off-host has to + // find the listener at launch without the user re-pairing. + expect(wsTransportOf(relaunched)?.resolvedHost).toBe('0.0.0.0') + } finally { + await relaunched.stop() + } + }) +}) diff --git a/src/main/ipc/mobile.ts b/src/main/ipc/mobile.ts index ff4c5c6d3ec..35584f951a4 100644 --- a/src/main/ipc/mobile.ts +++ b/src/main/ipc/mobile.ts @@ -2,9 +2,12 @@ import { app, ipcMain, shell, type IpcMainInvokeEvent } from 'electron' import { networkInterfaces } from 'node:os' import type { RuntimeAccessGrant } from '../../shared/runtime-access-grants' import type { MobilePairingConnectionMode } from '../../shared/mobile-pairing-connection-mode' +import { classifyRemotePairingHostname } from '../../shared/remote-pairing-address' +import type { RuntimePairingReach } from '../../shared/runtime-pairing-reach' import { isTailnetIPv4Address } from '../../shared/tailnet-address' import type { DeviceEntry } from '../runtime/device-registry' import { NETWORK_EXPOSURE_FAILED_GUIDANCE } from '../runtime/network-exposure-guidance' +import { resolveAdvertisedPairingHostname } from '../runtime/pairing-endpoint' import type { OrcaRuntimeRpcServer } from '../runtime/runtime-rpc' import type { RelayBrokerStatus } from '../runtime/relay/relay-session-broker' import { encodeMobilePairingQr, type MobilePairingQrResult } from '../runtime/mobile-pairing-qr' @@ -77,6 +80,18 @@ function getDefaultPairingAddress(): string | null { return ifaces.length > 0 ? ifaces[0]!.address : null } +// Why: only an explicit "This computer only" pick skips the one-way widen, and only when the address it +// advertises really is loopback — a mismatch (a LAN address under a this-computer reach) would otherwise +// mint a link with no listener behind it. Every other reach, including a loopback-looking Custom address +// that fronts an SSH tunnel or reverse proxy, still opts in. +function servesThisComputerOnly(reach: RuntimePairingReach | undefined, address: string): boolean { + if (reach !== 'this-computer') { + return false + } + const hostname = resolveAdvertisedPairingHostname(address) + return hostname !== null && classifyRemotePairingHostname(hostname) === 'loopback' +} + function toRuntimeAccessGrant(device: DeviceEntry): RuntimeAccessGrant { return { deviceId: device.deviceId, @@ -175,7 +190,7 @@ export function registerMobileHandlers( ipcMain.handle( 'mobile:getRuntimePairingUrl', - async (_event, args?: { address?: string; rotate?: boolean }) => { + async (_event, args?: { address?: string; rotate?: boolean; reach?: RuntimePairingReach }) => { const ip = args?.address ?? getDefaultPairingAddress() if (!ip) { return { available: false as const } @@ -184,19 +199,24 @@ export function registerMobileHandlers( // Why: STA-2370 — generating a runtime pairing offer is the user's explicit opt-in to remote // reach, so widen the loopback listener before advertising its LAN endpoint. If the widen fails the // listener stays on loopback, so report unavailable rather than advertise a dead LAN endpoint. - try { - await rpcServer.ensureNetworkExposure() - } catch (error) { - console.error( - '[mobile] Network exposure failed while creating a runtime pairing offer:', - error - ) - // Why: STA-2370 — carry the specific reason/guidance to the renderer (mirrors the mobile-QR path) so - // a widen failure is distinguishable from a missing address, not collapsed into a bare unavailable. - return { - available: false as const, - reason: 'network_exposure_failed' as const, - guidance: NETWORK_EXPOSURE_FAILED_GUIDANCE + // "This computer only" is the opposite opt-in: the loopback listener already serves it, and the widen + // never narrows back, so that pick alone must not expose the runtime off-host. + const thisComputerOnly = servesThisComputerOnly(args?.reach, ip) + if (!thisComputerOnly) { + try { + await rpcServer.ensureNetworkExposure() + } catch (error) { + console.error( + '[mobile] Network exposure failed while creating a runtime pairing offer:', + error + ) + // Why: STA-2370 — carry the specific reason/guidance to the renderer (mirrors the mobile-QR path) so + // a widen failure is distinguishable from a missing address, not collapsed into a bare unavailable. + return { + available: false as const, + reason: 'network_exposure_failed' as const, + guidance: NETWORK_EXPOSURE_FAILED_GUIDANCE + } } } @@ -206,7 +226,10 @@ export function registerMobileHandlers( address: ip, rotate: args?.rotate, name: `Runtime ${new Date().toLocaleDateString()}`, - scope: 'runtime' + scope: 'runtime', + // Why: a grant that only ever pointed at loopback must not make the next launch bind every + // interface when its local client reconnects (that would restore the exposure one restart later). + reach: thisComputerOnly ? 'this-computer' : 'network' }) if (!offer.available) { return { available: false as const } diff --git a/src/main/runtime/device-registry.ts b/src/main/runtime/device-registry.ts index 959b52c9474..7de8af08fde 100644 --- a/src/main/runtime/device-registry.ts +++ b/src/main/runtime/device-registry.ts @@ -10,6 +10,7 @@ import type { DeviceScope } from '../../shared/runtime-types' import { DEVICE_REGISTRY_FILENAME } from './mobile-pairing-files' import type { RelayDeviceBinding } from './relay/relay-revoke-outbox' import type { MobilePairingConnectionMode } from '../../shared/mobile-pairing-connection-mode' +import type { RuntimePairingReach } from '../../shared/runtime-pairing-reach' export type { DeviceScope } @@ -22,6 +23,9 @@ export type DeviceEntry = { lastSeenAt: number relayBinding?: RelayDeviceBinding mobilePairingConnectionMode?: MobilePairingConnectionMode + // Why: STA-2370 — a grant minted for "This computer only" proves nothing about off-host reach when its + // client connects, so the bind decision must be able to tell it apart from a LAN/phone grant. + pairingReach?: RuntimePairingReach } function validRelayBinding(value: unknown, deviceId: string): RelayDeviceBinding | undefined { @@ -52,14 +56,19 @@ export class DeviceRegistry { this.load() } - addDevice(name: string, scope: DeviceScope = 'mobile'): DeviceEntry { - return this.createAndPersistDevice(this.devices, name, scope) + addDevice( + name: string, + scope: DeviceScope = 'mobile', + pairingReach: RuntimePairingReach = 'network' + ): DeviceEntry { + return this.createAndPersistDevice(this.devices, name, scope, pairingReach) } private createAndPersistDevice( existingDevices: DeviceEntry[], name: string, - scope: DeviceScope + scope: DeviceScope, + pairingReach: RuntimePairingReach ): DeviceEntry { const entry: DeviceEntry = { deviceId: randomUUID(), @@ -67,7 +76,8 @@ export class DeviceRegistry { token: randomBytes(24).toString('hex'), scope, pairedAt: Date.now(), - lastSeenAt: 0 + lastSeenAt: 0, + pairingReach } const nextDevices = [...existingDevices, entry] // Why: a credential is not valid until its durable registry write succeeds. @@ -82,12 +92,32 @@ export class DeviceRegistry { // copy-button flow that encourages regeneration) leaves an orphaned token // forever. Returns an existing never-scanned entry if present; otherwise // mints a new one and drops any stale pending entries. - getOrCreatePendingDevice(name: string, scope: DeviceScope = 'mobile'): DeviceEntry { + getOrCreatePendingDevice( + name: string, + scope: DeviceScope = 'mobile', + pairingReach: RuntimePairingReach = 'network' + ): DeviceEntry { const existing = this.devices.find((d) => d.lastSeenAt === 0 && d.scope === scope) if (existing) { - return existing + // Why: the same pending token can be re-advertised at a broader reach; widen it but never narrow it, + // or a link already handed out for off-host use would stop being served after the next launch. + return pairingReach === 'network' && existing.pairingReach === 'this-computer' + ? this.setPairingReach(existing, 'network') + : existing } - return this.addDevice(name, scope) + return this.addDevice(name, scope, pairingReach) + } + + private setPairingReach(existing: DeviceEntry, pairingReach: RuntimePairingReach): DeviceEntry { + const updated: DeviceEntry = { ...existing, pairingReach } + const nextDevices = this.devices.map((device) => + device.deviceId === existing.deviceId ? updated : device + ) + // Why: persist before the memory swap so a failed write cannot leave the bind decision reading a + // reach that never reached disk. + this.save(nextDevices) + this.devices = nextDevices + return updated } // Why: explicit rotation path for "Regenerate QR" — invalidates any @@ -96,9 +126,13 @@ export class DeviceRegistry { // this, getOrCreatePendingDevice keeps returning the same token forever // until a phone actually pairs, so users have no way to revoke a leaked // pre-pairing token. - rotatePendingDevice(name: string, scope: DeviceScope = 'mobile'): DeviceEntry { + rotatePendingDevice( + name: string, + scope: DeviceScope = 'mobile', + pairingReach: RuntimePairingReach = 'network' + ): DeviceEntry { const retainedDevices = this.devices.filter((d) => d.lastSeenAt !== 0 || d.scope !== scope) - return this.createAndPersistDevice(retainedDevices, name, scope) + return this.createAndPersistDevice(retainedDevices, name, scope, pairingReach) } removeDevice(deviceId: string): boolean { @@ -197,7 +231,10 @@ export class DeviceRegistry { scope: device.scope === 'runtime' ? 'runtime' : 'mobile', relayBinding: validRelayBinding(device.relayBinding, device.deviceId), mobilePairingConnectionMode: - device.mobilePairingConnectionMode === 'local-only' ? 'local-only' : 'automatic' + device.mobilePairingConnectionMode === 'local-only' ? 'local-only' : 'automatic', + // Why: registries written before this field existed only ever held network-reach grants (phones and + // LAN links), so a missing value must keep binding every interface on reconnect. + pairingReach: device.pairingReach === 'this-computer' ? 'this-computer' : 'network' })) } catch { this.devices = [] diff --git a/src/main/runtime/pairing-endpoint.test.ts b/src/main/runtime/pairing-endpoint.test.ts index d43c95d7873..5fcebe0afd8 100644 --- a/src/main/runtime/pairing-endpoint.test.ts +++ b/src/main/runtime/pairing-endpoint.test.ts @@ -1,5 +1,8 @@ import { describe, expect, it } from 'vitest' -import { resolveAdvertisedPairingEndpoint } from './pairing-endpoint' +import { + resolveAdvertisedPairingEndpoint, + resolveAdvertisedPairingHostname +} from './pairing-endpoint' import { PAIRING_OFFER_VERSION, PairingOfferSchema } from '../../shared/mobile-relay-pairing-offer' import { PAIRING_ENDPOINT_MAX_CHARACTERS } from '../../shared/mobile-pairing-protocol-limits' import { parseManualNetworkAddress } from '../../shared/network/manual-address' @@ -100,3 +103,31 @@ describe('resolveAdvertisedPairingEndpoint', () => { expect(PairingOfferSchema.safeParse(offer(aboveLimit)).success).toBe(false) }) }) + +describe('resolveAdvertisedPairingHostname', () => { + // Why: the loopback/off-host decision must read the host a link will advertise, not the raw string the + // user typed — `127.0.0.1:8443` and `ws://127.0.0.1:6768` both publish a loopback host. + it.each([ + ['127.0.0.1', '127.0.0.1'], + ['127.0.0.1:8443', '127.0.0.1'], + ['localhost', 'localhost'], + ['localhost:8443', 'localhost'], + ['::1', '::1'], + ['[::1]:6768', '::1'], + ['ws://127.0.0.1:6768', '127.0.0.1'], + ['http://localhost:6768/web-index.html', 'localhost'], + ['100.64.1.20', '100.64.1.20'], + ['192.168.1.5:6768', '192.168.1.5'], + ['desktop', 'desktop'], + ['wss://proxy.example.test:8443/orca', 'proxy.example.test'] + ])('reads the advertised host of %s', (input, hostname) => { + expect(resolveAdvertisedPairingHostname(input)).toBe(hostname) + }) + + it.each([null, undefined, '', ' ', 'host.example.test:', 'ftp://proxy.example.test'])( + 'returns null for the unusable address %j', + (input) => { + expect(resolveAdvertisedPairingHostname(input)).toBeNull() + } + ) +}) diff --git a/src/main/runtime/pairing-endpoint.ts b/src/main/runtime/pairing-endpoint.ts index c7af166f191..75ef7ae68c6 100644 --- a/src/main/runtime/pairing-endpoint.ts +++ b/src/main/runtime/pairing-endpoint.ts @@ -40,6 +40,23 @@ export function resolveAdvertisedPairingEndpoint( return valid(formatWebSocketUrl(endpoint)) } +// Why: callers that must reason about WHERE a link points (loopback vs off-host) need the hostname the +// offer will advertise, not the raw string the user typed — `127.0.0.1:8443`, `[::1]:6768` and +// `ws://127.0.0.1:6768` all advertise a loopback host but none of them parse as one on their own. +export function resolveAdvertisedPairingHostname( + advertisedAddress: string | null | undefined +): string | null { + const override = advertisedAddress?.trim() + if (!override) { + return null + } + if (override.includes('://')) { + const normalized = normalizePairingUrl(override) + return normalized ? unbracketIpv6(new URL(normalized).hostname) : null + } + return parseHostOverride(override)?.hostname ?? null +} + function resolveFullUrl(value: string): PairingEndpointResolution { const endpoint = normalizePairingUrl(value) return endpoint ? valid(endpoint) : invalid() diff --git a/src/main/runtime/runtime-rpc.test.ts b/src/main/runtime/runtime-rpc.test.ts index 609079305c5..55d03efbd50 100644 --- a/src/main/runtime/runtime-rpc.test.ts +++ b/src/main/runtime/runtime-rpc.test.ts @@ -5616,6 +5616,149 @@ describe('OrcaRuntimeRpcServer WebSocket bind host (STA-2370)', () => { } }) + it('stays on loopback at startup after a "This computer only" grant has connected', async () => { + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-runtime-rpc-')) + // Why: the local web client authenticating marks its grant lastSeenAt > 0 like any other socket, so a + // blanket "any connected device" widen republished the runtime on every interface one launch later — + // exactly what the user declined by picking "This computer only". + const registry = new DeviceRegistry(userDataPath) + const device = registry.getOrCreatePendingDevice('Runtime local', 'runtime', 'this-computer') + registry.updateLastSeen(device.deviceId) + + const server = new OrcaRuntimeRpcServer({ + runtime: new OrcaRuntimeService(), + userDataPath, + enableWebSocket: true, + wsPort: 0 + }) + + await server.start() + try { + expect(wsTransportOf(server)?.resolvedHost).toBe('127.0.0.1') + } finally { + await server.stop() + } + }) + + it('binds all interfaces at startup for a connected device paired before pairingReach existed', async () => { + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-runtime-rpc-')) + // Why: registries written by older desktops only ever held network-reach grants; a missing field must + // keep the reconnect widen or an already-paired phone would be stranded by the upgrade. + const legacyDevice = { + deviceId: 'legacy-device', + name: 'Legacy phone', + token: 'legacy-token', + scope: 'mobile', + pairedAt: Date.now(), + lastSeenAt: Date.now() + } + await writeFile( + join(userDataPath, DEVICE_REGISTRY_FILENAME), + JSON.stringify([legacyDevice]), + 'utf-8' + ) + + const server = new OrcaRuntimeRpcServer({ + runtime: new OrcaRuntimeService(), + userDataPath, + enableWebSocket: true, + wsPort: 0 + }) + + await server.start() + try { + expect(wsTransportOf(server)?.resolvedHost).toBe('0.0.0.0') + } finally { + await server.stop() + } + }) + + it('upgrades a reused pending grant to network reach so its link survives a relaunch', async () => { + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-runtime-rpc-')) + const server = new OrcaRuntimeRpcServer({ + runtime: new OrcaRuntimeService(), + userDataPath, + enableWebSocket: true, + wsPort: 0 + }) + + await server.start() + let deviceId: string + try { + const local = server.createPairingOffer({ + address: '127.0.0.1', + scope: 'runtime', + reach: 'this-computer' + }) + expect(local.available).toBe(true) + // Why: without `rotate` the same pending token is re-advertised, now for off-host reach. The mark must + // widen with it — keeping it this-computer would leave the LAN link unserved after the next launch. + const network = server.createPairingOffer({ + address: '100.64.1.20', + scope: 'runtime', + reach: 'network' + }) + expect(network.available).toBe(true) + deviceId = network.available ? network.deviceId : '' + expect(deviceId).toBe(local.available ? local.deviceId : '') + server.getDeviceRegistry()?.updateLastSeen(deviceId) + } finally { + await server.stop() + } + + const relaunched = new OrcaRuntimeRpcServer({ + runtime: new OrcaRuntimeService(), + userDataPath, + enableWebSocket: true, + wsPort: 0 + }) + await relaunched.start() + try { + expect(wsTransportOf(relaunched)?.resolvedHost).toBe('0.0.0.0') + } finally { + await relaunched.stop() + } + }) + + it('keeps the pinned port when a later widen tears down a live loopback client', async () => { + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-runtime-rpc-')) + const server = new OrcaRuntimeRpcServer({ + runtime: new OrcaRuntimeService(), + userDataPath, + enableWebSocket: true, + wsPort: 0 + }) + + await server.start() + try { + const loopbackPort = wsTransportOf(server)!.resolvedPort + // Why: a "This computer only" link never widens, so unlike before, a local client can already be + // connected when a later LAN offer opts in. The rebind terminates it (ws cannot move a listener), so + // the port must be reused or the already-issued local link could never reconnect. + const client = new WebSocket(`ws://127.0.0.1:${loopbackPort}`) + await new Promise((resolve, reject) => { + client.once('open', () => resolve()) + client.once('error', reject) + }) + const closed = new Promise((resolve) => client.once('close', () => resolve())) + + await server.ensureNetworkExposure() + await closed + + expect(wsTransportOf(server)?.resolvedHost).toBe('0.0.0.0') + expect(wsTransportOf(server)?.resolvedPort).toBe(loopbackPort) + + const reconnected = new WebSocket(`ws://127.0.0.1:${loopbackPort}`) + await new Promise((resolve, reject) => { + reconnected.once('open', () => resolve()) + reconnected.once('error', reject) + }) + reconnected.close() + } finally { + await server.stop() + } + }) + it('keeps the same MobileSocketWiring instance across a pairing widen (relay capture stays valid)', async () => { const userDataPath = mkdtempSync(join(tmpdir(), 'orca-runtime-rpc-')) const server = new OrcaRuntimeRpcServer({ diff --git a/src/main/runtime/runtime-rpc.ts b/src/main/runtime/runtime-rpc.ts index f6274c3a996..7056f4bfe8f 100644 --- a/src/main/runtime/runtime-rpc.ts +++ b/src/main/runtime/runtime-rpc.ts @@ -30,6 +30,7 @@ import { } from './rpc/mobile-socket-wiring' import type { PairingRelay } from '../../shared/mobile-relay-pairing-offer' import type { MobilePairingConnectionMode } from '../../shared/mobile-pairing-connection-mode' +import type { RuntimePairingReach } from '../../shared/runtime-pairing-reach' import { mobileRelayMintFailureFromUnknown, type MobileRelayMintFailure @@ -661,6 +662,9 @@ export class OrcaRuntimeRpcServer { name?: string rotate?: boolean scope?: DeviceScope + // Why: STA-2370 — recorded on the grant so a "This computer only" client reconnecting cannot make the + // next launch bind every interface. Defaults to network reach, which is what every other caller means. + reach?: RuntimePairingReach }): | PairingOfferUnavailable | { @@ -697,9 +701,10 @@ export class OrcaRuntimeRpcServer { const scope = args.scope ?? 'runtime' let device: DeviceEntry try { + const reach = args.reach ?? 'network' device = args.rotate - ? this.deviceRegistry.rotatePendingDevice(deviceName, scope) - : this.deviceRegistry.getOrCreatePendingDevice(deviceName, scope) + ? this.deviceRegistry.rotatePendingDevice(deviceName, scope, reach) + : this.deviceRegistry.getOrCreatePendingDevice(deviceName, scope, reach) } catch (error) { console.error('[runtime] Failed to persist pairing credential:', error) return pairingUnavailable('device_registry_unavailable', DEVICE_REGISTRY_UNAVAILABLE_GUIDANCE) @@ -1228,13 +1233,17 @@ export class OrcaRuntimeRpcServer { // Why: STA-2370 — a desktop with no previously-connected device stays on loopback until the user // explicitly pairs; `orca serve`/E2E (exposeNetworkByDefault) and a reconnecting paired device bind wide. + // A grant minted for "This computer only" is excluded: its client is a browser on this machine, so + // counting it would republish the runtime on every interface one restart after the user declined that. private resolveInitialWebSocketBindHost(): string { if (this.exposeNetworkByDefault) { return WS_BIND_HOST_ALL_INTERFACES } - const hasConnectedDevice = - this.deviceRegistry?.listDevices().some((device) => device.lastSeenAt > 0) ?? false - return hasConnectedDevice ? WS_BIND_HOST_ALL_INTERFACES : WS_BIND_HOST_LOOPBACK + const hasConnectedNetworkDevice = + this.deviceRegistry + ?.listDevices() + .some((device) => device.lastSeenAt > 0 && device.pairingReach !== 'this-computer') ?? false + return hasConnectedNetworkDevice ? WS_BIND_HOST_ALL_INTERFACES : WS_BIND_HOST_LOOPBACK } // Why: builds and starts a WS transport bound to `host`, wiring the session-scoped mobile socket @@ -1340,9 +1349,10 @@ export class OrcaRuntimeRpcServer { } // Why: STA-2370 — widen the loopback listener to all interfaces so a freshly generated pairing - // offer's advertised LAN endpoint is reachable. Idempotent and only ever runs on the first opt-in - // (before any device has connected), so no live socket is disrupted; the resolved port is reused so - // an already-issued endpoint stays valid. + // offer's advertised LAN endpoint is reachable. Idempotent, but it is no longer confined to the first + // pairing action: a "This computer only" link never widens, so live loopback clients can already be + // connected when a later LAN/QR offer opts in. Rebinding terminates them (ws cannot move a listener), + // so the resolved port is reused — already-issued endpoints stay valid and clients reconnect in place. async ensureNetworkExposure(): Promise { if ( !this.enableWebSocket || diff --git a/src/preload/api-types.ts b/src/preload/api-types.ts index 859be396e2e..c0c57731e1e 100644 --- a/src/preload/api-types.ts +++ b/src/preload/api-types.ts @@ -49,6 +49,7 @@ import type { } from '../shared/terminal-render-desync-evidence' import type { MobileRelayStatus } from '../shared/mobile-relay-status' import type { MobilePairingConnectionMode } from '../shared/mobile-pairing-connection-mode' +import type { RuntimePairingReach } from '../shared/runtime-pairing-reach' import type { MobileRelayMintFailure } from '../shared/mobile-relay-mint-failure' import type { VerifyAndAddRuntimeEnvironmentResult } from '../shared/remote-pairing-verification' import type { @@ -3650,7 +3651,11 @@ export type PreloadApi = { { ok: true } | { ok: false; reason: 'cancelled' | 'failed' | 'unsupported' } > openWindowsNetworkSettings: () => Promise - getRuntimePairingUrl: (args?: { address?: string; rotate?: boolean }) => Promise< + getRuntimePairingUrl: (args?: { + address?: string + rotate?: boolean + reach?: RuntimePairingReach + }) => Promise< | { available: false; reason?: 'network_exposure_failed'; guidance?: string } | { available: true diff --git a/src/preload/index.ts b/src/preload/index.ts index 13a450bce83..d54af396aca 100644 --- a/src/preload/index.ts +++ b/src/preload/index.ts @@ -22,6 +22,7 @@ import type { } from '../shared/agent-session-resume' import type { MobileRelayStatus } from '../shared/mobile-relay-status' import type { MobilePairingConnectionMode } from '../shared/mobile-pairing-connection-mode' +import type { RuntimePairingReach } from '../shared/runtime-pairing-reach' import type { MobileRelayMintFailure } from '../shared/mobile-relay-mint-failure' import type { VerifyAndAddRuntimeEnvironmentResult } from '../shared/remote-pairing-verification' import type { @@ -4651,6 +4652,9 @@ const api = { getRuntimePairingUrl: (args?: { address?: string rotate?: boolean + // Why: the widen is one-way and host-wide, so main must gate it on the reach the user picked, not + // on how the typed address happens to look (a Custom loopback may front an SSH tunnel). + reach?: RuntimePairingReach }): Promise< | { available: false; reason?: 'network_exposure_failed'; guidance?: string } | { diff --git a/src/renderer/src/components/settings/RuntimePairingUrlGenerator.test.tsx b/src/renderer/src/components/settings/RuntimePairingUrlGenerator.test.tsx index f0bb4ba08df..0b32a439dbd 100644 --- a/src/renderer/src/components/settings/RuntimePairingUrlGenerator.test.tsx +++ b/src/renderer/src/components/settings/RuntimePairingUrlGenerator.test.tsx @@ -7,15 +7,21 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' const mocks = vi.hoisted(() => ({ listNetworkInterfaces: vi.fn(), - listRuntimeAccessGrants: vi.fn() + listRuntimeAccessGrants: vi.fn(), + getRuntimePairingUrl: vi.fn() })) vi.mock('@/i18n/i18n', () => ({ translate: (_key: string, fallback: string) => fallback })) vi.mock('sonner', () => ({ toast: { error: vi.fn(), success: vi.fn() } })) vi.mock('./RuntimeAccessGrantList', () => ({ RuntimeAccessGrantList: () => null })) vi.mock('./RuntimePairingGeneratorForm', () => ({ - RuntimePairingGeneratorForm: (props: { selectedAddress: string }) => ( -
{props.selectedAddress}
+ RuntimePairingGeneratorForm: (props: { selectedAddress: string; onGenerate: () => void }) => ( +
+
{props.selectedAddress}
+ +
) })) @@ -33,12 +39,20 @@ describe('RuntimePairingUrlGenerator', () => { runtimePairingLinkCache.runtimePairingDeviceId = null mocks.listNetworkInterfaces.mockReset() mocks.listRuntimeAccessGrants.mockReset().mockResolvedValue({ grants: [] }) + mocks.getRuntimePairingUrl.mockReset().mockResolvedValue({ + available: true, + pairingUrl: 'orca://pair#runtime', + webClientUrl: 'http://127.0.0.1:6768/web-index.html?pairing=runtime', + endpoint: 'ws://127.0.0.1:6768', + deviceId: 'runtime-1' + }) Object.defineProperty(window, 'api', { configurable: true, value: { mobile: { listNetworkInterfaces: mocks.listNetworkInterfaces, - listRuntimeAccessGrants: mocks.listRuntimeAccessGrants + listRuntimeAccessGrants: mocks.listRuntimeAccessGrants, + getRuntimePairingUrl: mocks.getRuntimePairingUrl } } }) @@ -67,4 +81,28 @@ describe('RuntimePairingUrlGenerator', () => { expect(screen.getByTestId('selected-address')).toHaveTextContent('100.76.32.125') ) }) + + // Why: the main process gates the one-way network widen on the declared reach, so dropping it (as the + // component used to) leaves main guessing from the address string — "This computer only" then widened, + // and a Custom loopback tunnel front-end would not. + it.each([ + ['local' as const, '127.0.0.1', 'this-computer'], + ['another' as const, '100.76.32.125', 'network'], + ['custom' as const, '127.0.0.1:8443', 'network'] + ])('sends the %s reach with the address', async (intent, address, reach) => { + runtimePairingLinkCache.intent = intent + runtimePairingLinkCache.selectedAddress = address + mocks.listNetworkInterfaces.mockResolvedValue({ + interfaces: [{ name: 'tailscale0', address: '100.76.32.125' }] + }) + + render() + await waitFor(() => expect(mocks.listNetworkInterfaces).toHaveBeenCalledOnce()) + + screen.getByRole('button', { name: 'Generate' }).click() + + await waitFor(() => + expect(mocks.getRuntimePairingUrl).toHaveBeenCalledWith({ address, rotate: true, reach }) + ) + }) }) diff --git a/src/renderer/src/components/settings/RuntimePairingUrlGenerator.tsx b/src/renderer/src/components/settings/RuntimePairingUrlGenerator.tsx index 54c75c7ac92..c6d927de593 100644 --- a/src/renderer/src/components/settings/RuntimePairingUrlGenerator.tsx +++ b/src/renderer/src/components/settings/RuntimePairingUrlGenerator.tsx @@ -11,6 +11,7 @@ import { cacheGeneratedRuntimePairingLink, clearGeneratedRuntimePairingLink, runtimePairingLinkCache, + runtimePairingReachForIntent, selectRuntimePairingIntent, type RuntimePairingIntent, type RuntimePairingUrlGeneratorProps @@ -187,7 +188,10 @@ export function RuntimePairingUrlGenerator({ try { const result = await window.api.mobile.getRuntimePairingUrl({ address, - rotate: true + rotate: true, + // Why: main gates the one-way network widen on this, so the declared choice must travel with the + // address — the address alone cannot tell "This computer only" from a loopback tunnel front-end. + reach: runtimePairingReachForIntent(intent) }) if (!result.available) { clearGeneratedUrls() diff --git a/src/renderer/src/components/settings/runtime-pairing-link-state.ts b/src/renderer/src/components/settings/runtime-pairing-link-state.ts index 0b3a1230fb9..ff777fc72fe 100644 --- a/src/renderer/src/components/settings/runtime-pairing-link-state.ts +++ b/src/renderer/src/components/settings/runtime-pairing-link-state.ts @@ -1,7 +1,15 @@ +import type { RuntimePairingReach } from '../../../../shared/runtime-pairing-reach' + export const RUNTIME_PAIRING_LOOPBACK_ADDRESS = '127.0.0.1' export type RuntimePairingIntent = 'another' | 'local' | 'custom' +// Why: only "This computer only" declines off-host reach. Custom is the SSH-tunnel/reverse-proxy field, so +// even a loopback-looking custom address (`127.0.0.1:8443`) needs the listener open behind the tunnel. +export function runtimePairingReachForIntent(intent: RuntimePairingIntent): RuntimePairingReach { + return intent === 'local' ? 'this-computer' : 'network' +} + export type RuntimePairingUrlGeneratorProps = { framed?: boolean showHeader?: boolean diff --git a/src/shared/runtime-pairing-reach.ts b/src/shared/runtime-pairing-reach.ts new file mode 100644 index 00000000000..0f7f0315416 --- /dev/null +++ b/src/shared/runtime-pairing-reach.ts @@ -0,0 +1,5 @@ +// Why: STA-2370 — widening the runtime listener to every interface is one-way for the life of the process +// and persists across launches, so it must follow the reach the user picked, not the shape of the address +// they typed: a Custom `127.0.0.1:8443` is usually an SSH tunnel or reverse proxy that still needs off-host +// reach, while "This computer only" must never publish the runtime beyond loopback. +export type RuntimePairingReach = 'this-computer' | 'network' From ed7849eb7b9432089e910873582bb96bfc7fa48f Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:25:50 -0700 Subject: [PATCH 22/72] fix(worktrees): stop silently switching existing Windows setup scripts to Git Bash (#12406) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(worktrees): stop silently switching existing Windows setup scripts to Git Bash #6967 derived the Windows setup-runner shell from `terminalWindowsShell`. On upgrade, any Windows user whose terminal preference resolved to Git Bash had their existing `orca.yaml` setup script (and issue command) handed to bash instead of cmd.exe. Scripts authored against the cmd runner — `copy`, `xcopy`, `set VAR=value`, `if errorlevel 1`, `%VAR%`, backslash paths — broke with no migration and no warning, and the failure looked like Orca broke the project. The conflation is also wrong in the steady state: a terminal preference is per-user, so two people on the same repo got different interpreters for the same orca.yaml and no project could write a setup script that worked for all of its Windows contributors. The interpreter is now a property of the script, declared the standard way: a leading `#!` line. Native Windows keeps the historical `.cmd` runner unless the script declares a POSIX shell, so no existing script changes behavior. `resolveSetupRunnerShell` keeps its role as the feasibility gate — a bash runner still requires the terminal to resolve to Git Bash, since the launch command is typed into that shell and uses MSYS `/c/...` paths. `buildWindowsRunnerScript` now drops a leading `#!` line rather than `call`ing it, so a declared-bash script that falls back to cmd (Git Bash missing) fails on a real setup line instead of aborting on errorlevel at line one. WSL worktrees, POSIX platforms, and SSH hosts are untouched. * fix(worktrees): keep the cmd setup runner launchable from a Git Bash pane Adversarial review of this PR found that pinning the runner format per script reopened issue #6896 one layer down. - `WorktreeSetupLaunch.shell` had been redefined to mean "the format the runner file was written in". `resolveSetupRunnerCommand` consumes it as "the shell that types the launch command", so a Git Bash terminal with a batch setup script produced `cmd.exe /c "C:\...\setup-runner.cmd"` typed into a bash pane, where MSYS rewrites the `/c` switch into a drive path: cmd opens interactively and setup never runs. `shell` is the terminal's family again; the runner file's .cmd/.sh extension carries the format, and a batch runner launched from a POSIX pane reuses the existing PowerShell ProcessStartInfo launcher. - The cmd runner dropped a leading `#!` line and ran the rest as batch, so a bash script reaching cmd (PowerShell/cmd terminal, or any SSH-to-Windows host) got its interpreter-agnostic prefix executed before failing mid-way. It now prints why and exits 1 without running anything. - A `#!` line's option flags were discarded: `#!/usr/bin/env -S bash -euo pipefail` lost pipefail because the runner is launched as `bash `. The generated posix runner now replays declared flags via `set` and drops the duplicate interpreter line. - Docs cover the per-user setup command in repository hook settings, which goes through the same `#!` rule, and describe what the `#!` line does and does not select. Tests: composed launch command for a POSIX pane + cmd runner (hooks, shared runner command, setup sequencing gate, observed-setup signal), the cmd runner's shebang refusal, and shebang flag replay. Each fails with the source reverted. * fix(worktrees): replay only real `set` flags and keep the gate in the pane's shell Two round-2 review findings: - `#!/bin/bash -l` replayed `set -l`, which exits 2 and aborted the runner under its own `set -e` before a single setup line ran (all platforms). Only the flags `set` documents are replayed now; a bare `-o` with no option name is dropped instead of dumping the shell-option table. - The wait-for-setup gate picked its language from the runner file, so a batch runner launched from a Git Bash pane got the PowerShell gate while the agent startup command was already POSIX-quoted — `Invoke-Expression` cannot parse `'\''`. The gate now follows the pane; the runner still launches through the ProcessStartInfo launcher, never through bash. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- .gitignore | 1 + AGENTS.md | 1 + docs/reference/windows-setup-shell.md | 86 ++++++++++ src/main/hooks-runner.test.ts | 56 ++++++- src/main/hooks.test.ts | 147 ++++++++++++++++-- src/main/hooks.ts | 64 ++++++-- .../setup-completion-signal.test.ts | 13 ++ src/shared/setup-agent-sequencing.test.ts | 34 ++++ src/shared/setup-agent-sequencing.ts | 13 +- src/shared/setup-runner-command.test.ts | 45 ++++++ src/shared/setup-runner-command.ts | 24 ++- src/shared/setup-script-shebang.test.ts | 99 ++++++++++++ src/shared/setup-script-shebang.ts | 100 ++++++++++++ 13 files changed, 654 insertions(+), 29 deletions(-) create mode 100644 docs/reference/windows-setup-shell.md create mode 100644 src/shared/setup-script-shebang.test.ts create mode 100644 src/shared/setup-script-shebang.ts diff --git a/.gitignore b/.gitignore index 2918ae32a69..b1de9292f1a 100644 --- a/.gitignore +++ b/.gitignore @@ -100,6 +100,7 @@ docs/** !docs/reference/headless-linux-server.md !docs/reference/linux-glibc-compatibility.md !docs/reference/relay-grace-time-reconfiguration.md +!docs/reference/windows-setup-shell.md # Stably CLI (only docs/ are tracked) .stably/* diff --git a/AGENTS.md b/AGENTS.md index bfb1617f8ea..6bc54a6f5c0 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -29,6 +29,7 @@ Orca targets macOS, Linux, and Windows. Keep all platform-dependent behavior beh - **Keyboard shortcuts**: Never hardcode `e.metaKey`. Use a platform check (`navigator.userAgent.includes('Mac')`) to pick `metaKey` on Mac and `ctrlKey` on Linux/Windows. Electron menu accelerators should use `CmdOrCtrl`. - **Shortcut labels in UI**: Display `⌘` / `⇧` on Mac and `Ctrl+` / `Shift+` on other platforms. - **File paths**: Use `path.join` or Electron/Node path utilities — never assume `/` or `\`. +- **Windows setup scripts**: the setup/issue-command runner is a `.cmd` batch file unless the script starts with a `#!` line — never derive that from the user's terminal-shell preference, and never launch a `.cmd` runner with a bare `cmd.exe /c` from a Git Bash pane (MSYS rewrites the `/c`). See [`docs/reference/windows-setup-shell.md`](./docs/reference/windows-setup-shell.md). - **Linux native modules**: keep the glibc floor at Ubuntu 20.04 / glibc 2.31. A module compiled from source on a newer runner can reference symbol versions absent on the floor and crash the app on startup. See [`docs/reference/linux-glibc-compatibility.md`](./docs/reference/linux-glibc-compatibility.md); packaging fails if a bundled native binary needs newer glibc. ## SSH Use Case diff --git a/docs/reference/windows-setup-shell.md b/docs/reference/windows-setup-shell.md new file mode 100644 index 00000000000..6c93185b602 --- /dev/null +++ b/docs/reference/windows-setup-shell.md @@ -0,0 +1,86 @@ +# Windows setup-runner shell + +On native Windows, Orca writes the `orca.yaml` setup script (and the issue command) to a generated +runner file and types a launch command into a terminal. The runner is a **`.cmd` batch file by +default**, exactly as it has been since setup hooks shipped. + +A script opts into bash by starting with a `#!` interpreter line: + +```yaml +scripts: + setup: | + #!/usr/bin/env bash + [ -f .env ] || cp .env.example .env + pnpm install +``` + +Without that line the script keeps running under `cmd.exe`: + +```yaml +scripts: + setup: | + copy .env.example .env + xcopy /E assets dist +``` + +## Why the script declares it, not the terminal preference + +`terminalWindowsShell` says which shell *interactive terminals* open in. It says nothing about the +language a project's setup script is written in. Deriving the runner from it had two consequences: + +- Windows users with batch-syntax setup scripts silently switched to bash on upgrade, so `copy`, + `xcopy`, `set VAR=value`, and `if errorlevel 1` stopped working. +- Two people on the same repo got different interpreters for the same `orca.yaml`, so no project + could write a setup script that worked for all of its Windows contributors. + +A `#!` line is per-project, explicit, and identical for everyone who checks the repo out. + +The same rule applies to the per-user setup command in **Settings → repository hooks** +(`repo.hookSettings.scripts.setup`): it is merged into the same script that reaches the runner, so a +POSIX one-liner stored there needs its own `#!` line to run under bash on Windows. + +## What the `#!` line does and does not select + +The generated runner is always executed by bash (`bash `; Git Bash on native Windows), on +every platform. The `#!` line therefore does two things: + +- It declares the script is written for a POSIX shell, which is what selects the bash runner. +- Its option flags are replayed with `set`, so `#!/usr/bin/env -S bash -euo pipefail` really does + get `pipefail`. Without that replay the flags would be silently dropped, because `bash ` + never parses the interpreter line. Only the flags `set` itself accepts + (`[--abefhkmnptuvxBCHP] [-o option]`) are replayed; invocation-only ones such as `-l` are + dropped, because `set -l` exits 2 and would abort the runner before its first line. + +The interpreter name itself is not honored beyond "is this a POSIX shell": `#!/bin/sh` and +`#!/bin/zsh` scripts run under bash, exactly as they already did on macOS and Linux. + +## Requirements for the bash runner + +A `#!` line only takes effect when Orca can actually launch bash from the configured terminal — the +terminal shell must resolve to Git Bash (`resolveWindowsGitBashShellPath`). The generated runner +uses MSYS `/c/...` paths, which Cygwin and the WSL shim do not accept, and the launch command is +typed into whatever shell the terminal opened with. + +When bash is not available (a PowerShell/cmd terminal, or an SSH-to-Windows host, which always uses +the remote's `.cmd` runner) the `#!` script is **not** executed under cmd. The generated `.cmd` +runner prints why and exits 1, because running the interpreter-agnostic prefix of a bash script +(`pnpm install`, `git submodule update`) and only failing at the first bash-only line leaves a +half-set-up worktree that looks finished. + +## Launching a `.cmd` runner from a Git Bash terminal + +The runner format and the shell that types the launch command are independent: a Git Bash terminal +with a batch-syntax setup script gets a `.cmd` runner launched from a bash pane. `cmd.exe /c +"C:\..."` cannot be used there — MSYS rewrites the bare `/c` switch into a drive path, so cmd opens +interactively and the runner never executes (issue #6896). Those launches reuse the PowerShell +`ProcessStartInfo` launcher (`buildWindowsCmdRunnerDelayedLaunchCommand`), which carries the switch +and the runner path outside the command line. `WorktreeSetupLaunch.shell` therefore describes the +launching pane; the runner file's `.cmd`/`.sh` extension describes the format. + +The `wait-for-setup` gate follows the same split. The pane types the gate and already quoted the +agent startup command for itself, so a `.cmd` runner launched from a Git Bash pane still gets the +bash gate — PowerShell's `Invoke-Expression` cannot parse POSIX `'\''` escaping. The gate wraps the +same `ProcessStartInfo` launcher, so the batch runner is never handed to bash. + +WSL worktrees and non-Windows platforms are unaffected: they always use the bash runner. SSH hosts +choose their runner from the remote path format, never from local Windows preferences. diff --git a/src/main/hooks-runner.test.ts b/src/main/hooks-runner.test.ts index 79827207aba..5ca5903d66f 100644 --- a/src/main/hooks-runner.test.ts +++ b/src/main/hooks-runner.test.ts @@ -1,3 +1,8 @@ +import type * as NodeChildProcess from 'node:child_process' +import type * as NodeFs from 'node:fs' +import { tmpdir } from 'node:os' +import { join } from 'node:path' + import type { Repo } from '../shared/types' import { describe, expect, it, vi } from 'vitest' @@ -94,7 +99,7 @@ describe('createSetupRunnerScript', () => { const result = createSetupRunnerScript( { ...makeRepo(), path: 'C:\\Users\\jinwo\\git\\orca' }, 'C:\\repo\\feature', - 'pnpm install', + '#!/usr/bin/env bash\npnpm install', undefined, { family: 'posix' } ) @@ -186,6 +191,55 @@ describe('createSetupRunnerScript', () => { expect(runner).toContain('call echo hello!world!') }) + it('refuses to run a shebang script as a batch command', async () => { + const { buildWindowsRunnerScript } = await import('./hooks') + + // Regression: a POSIX script reaching the cmd runner (no Git Bash terminal, or an SSH + // Windows host) must not have its interpreter-agnostic prefix executed under cmd — + // `pnpm install` would run and only a later bash-only line would fail, leaving the + // worktree half set up. + const runner = buildWindowsRunnerScript('#!/usr/bin/env bash\npnpm install\nsource .env') + + expect(runner).not.toContain('call pnpm install') + expect(runner).not.toContain('call source .env') + expect(runner).toContain('needs a POSIX shell') + expect(runner).toContain('exit /b 1') + }) + + it('keeps a `#` comment that is not an interpreter line', async () => { + const { buildWindowsRunnerScript } = await import('./hooks') + + const runner = buildWindowsRunnerScript('# not a shebang\nrem still batch') + + expect(runner).toContain('call # not a shebang') + expect(runner).toContain('call rem still batch') + }) + + it.skipIf(process.platform === 'win32')( + 'runs a script whose shebang carries invocation-only bash flags', + async () => { + // Regression: `set` rejects `-l`/`-s`/`-i` with exit 2, and the runner's own `set -e` turns + // that into an aborted setup before the first user line. + const { buildPosixRunnerScript } = await import('./hooks') + const { mkdtempSync, rmSync, writeFileSync } = await vi.importActual('node:fs') + const { execFileSync } = await vi.importActual('node:child_process') + + const dir = mkdtempSync(join(tmpdir(), 'orca-posix-runner-')) + try { + const runnerPath = join(dir, 'setup-runner.sh') + writeFileSync( + runnerPath, + buildPosixRunnerScript('#!/bin/bash -l\necho SETUP_RAN\n'), + 'utf-8' + ) + + expect(execFileSync('bash', [runnerPath], { encoding: 'utf-8' })).toContain('SETUP_RAN') + } finally { + rmSync(dir, { recursive: true, force: true }) + } + } + ) + it('derives ORCA_WORKSPACE_NAME from a POSIX worktree path', async () => { const originalPlatform = process.platform diff --git a/src/main/hooks.test.ts b/src/main/hooks.test.ts index b51a38e3321..c39ea86cf2f 100644 --- a/src/main/hooks.test.ts +++ b/src/main/hooks.test.ts @@ -1255,7 +1255,7 @@ describe('createSetupRunnerScript', () => { } }) as unknown as Repo - it('writes POSIX setup runners for Git Bash on native Windows paths', async () => { + it('writes POSIX setup runners for shebang-declared scripts on native Windows paths', async () => { gitExecFileSyncMock.mockReset() gitExecFileSyncMock.mockReturnValue('C:\\repo\\.git\\orca\\setup-runner.sh\n') const fs = await import('node:fs') @@ -1271,7 +1271,7 @@ describe('createSetupRunnerScript', () => { const result = createSetupRunnerScript( makeRepo(), 'C:\\repo-worktree', - 'pnpm install\r\nnpm run build', + '#!/usr/bin/env bash\r\npnpm install\r\nnpm run build', undefined, { family: 'posix' } ) @@ -1295,6 +1295,108 @@ describe('createSetupRunnerScript', () => { } }) + it('keeps batch setup scripts on cmd.exe when the terminal is Git Bash', async () => { + // Regression (#6967): a Git Bash terminal preference used to hand pre-existing + // batch setup scripts to bash, where `copy`/`xcopy`/`if errorlevel` do not exist. + gitExecFileSyncMock.mockReset() + gitExecFileSyncMock.mockReturnValue('C:\\repo\\.git\\orca\\setup-runner.cmd\n') + const fs = await import('node:fs') + const writeFileSyncMock = vi.mocked(fs.writeFileSync) + writeFileSyncMock.mockClear() + const originalPlatform = process.platform + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + + try { + const { createSetupRunnerScript } = await import('./hooks') + const result = createSetupRunnerScript( + makeRepo(), + 'C:\\repo-worktree', + 'copy .env.example .env\r\nxcopy /E assets dist', + undefined, + { family: 'posix' } + ) + + expect(gitExecFileSyncMock).toHaveBeenCalledWith( + ['rev-parse', '--git-path', 'orca/setup-runner.cmd'], + { cwd: 'C:\\repo-worktree' } + ) + expect(writeFileSyncMock).toHaveBeenCalledWith( + 'C:\\repo\\.git\\orca\\setup-runner.cmd', + expect.stringContaining('call copy .env.example .env\r\n'), + 'utf-8' + ) + expect(result).toMatchObject({ + runnerScriptPath: 'C:\\repo\\.git\\orca\\setup-runner.cmd', + // Why: `shell` is the pane that types the launch command — still Git Bash here. The + // runner's own .cmd extension is what says the file is batch. + shell: { family: 'posix' } + }) + } finally { + Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform }) + } + }) + + it('hands a Git Bash pane a launch command MSYS cannot rewrite for a cmd runner', async () => { + // Regression (#6896): `cmd.exe /c "C:\...\setup-runner.cmd"` typed into Git Bash has its + // `/c` switch rewritten into a drive path, so cmd opens interactively and setup never runs. + gitExecFileSyncMock.mockReset() + gitExecFileSyncMock.mockReturnValue('C:\\repo\\.git\\orca\\setup-runner.cmd\n') + const originalPlatform = process.platform + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + + try { + const { createSetupRunnerScript } = await import('./hooks') + const { buildSetupRunnerCommand } = await import('../shared/setup-runner-command') + const result = createSetupRunnerScript( + makeRepo(), + 'C:\\repo-worktree', + 'copy .env.example .env', + undefined, + { family: 'posix' } + ) + + const command = buildSetupRunnerCommand(result.runnerScriptPath, 'windows', result.shell) + + expect(command).not.toContain('cmd.exe /c') + // Why: the batch runner must never be handed to bash either. + expect(command).not.toContain('bash ') + expect(command).toContain('powershell.exe') + } finally { + Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform }) + } + }) + + it('replays interpreter flags declared on the shebang line', async () => { + // Regression: the runner is launched as `bash `, so `-euo pipefail` on the script's + // own `#!` line never reaches the interpreter unless the runner re-applies it. + gitExecFileSyncMock.mockReset() + gitExecFileSyncMock.mockReturnValue('C:\\repo\\.git\\orca\\setup-runner.sh\n') + const fs = await import('node:fs') + const writeFileSyncMock = vi.mocked(fs.writeFileSync) + writeFileSyncMock.mockClear() + const originalPlatform = process.platform + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + + try { + const { createSetupRunnerScript } = await import('./hooks') + createSetupRunnerScript( + makeRepo(), + 'C:\\repo-worktree', + '#!/usr/bin/env -S bash -euo pipefail\nmake build | tee build.log', + undefined, + { family: 'posix' } + ) + + expect(writeFileSyncMock).toHaveBeenCalledWith( + 'C:\\repo\\.git\\orca\\setup-runner.sh', + '#!/usr/bin/env bash\nset -e\nset -euo pipefail\nmake build | tee build.log\n', + 'utf-8' + ) + } finally { + Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform }) + } + }) + it('preserves cmd.exe setup runner semantics for configured cmd users', async () => { gitExecFileSyncMock.mockReset() gitExecFileSyncMock.mockReturnValue('C:\\repo\\.git\\orca\\setup-runner.cmd\n') @@ -1409,7 +1511,7 @@ describe('createIssueCommandRunnerScript', () => { hookSettings: { mode: 'auto', scripts: { setup: '', archive: '' } } }) as unknown as Repo - it('writes a POSIX issue-command runner when setup resolves to Git Bash', async () => { + it('writes a POSIX issue-command runner when a shebang declares bash and setup resolves to Git Bash', async () => { gitExecFileSyncMock.mockReset() gitExecFileSyncMock.mockReturnValue('C:\\repo\\.git\\orca\\issue-command-runner.sh\n') const fs = await import('node:fs') @@ -1418,6 +1520,37 @@ describe('createIssueCommandRunnerScript', () => { const originalPlatform = process.platform Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + try { + const { createIssueCommandRunnerScript } = await import('./hooks') + const result = createIssueCommandRunnerScript( + makeRepo(), + 'C:\\repo-worktree', + '#!/usr/bin/env bash\ngh issue view 42', + undefined, + { family: 'posix' } + ) + + expect(gitExecFileSyncMock).toHaveBeenCalledWith( + ['rev-parse', '--git-path', 'orca/issue-command-runner.sh'], + { cwd: 'C:\\repo-worktree' } + ) + expect(writeFileSyncMock).toHaveBeenCalledWith( + 'C:\\repo\\.git\\orca\\issue-command-runner.sh', + '#!/usr/bin/env bash\nset -e\ngh issue view 42\n', + 'utf-8' + ) + expect(result.shell).toEqual({ family: 'posix' }) + } finally { + Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform }) + } + }) + + it('keeps a plain issue command on the cmd runner under a Git Bash terminal', async () => { + gitExecFileSyncMock.mockReset() + gitExecFileSyncMock.mockReturnValue('C:\\repo\\.git\\orca\\issue-command-runner.cmd\n') + const originalPlatform = process.platform + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + try { const { createIssueCommandRunnerScript } = await import('./hooks') const result = createIssueCommandRunnerScript( @@ -1429,14 +1562,10 @@ describe('createIssueCommandRunnerScript', () => { ) expect(gitExecFileSyncMock).toHaveBeenCalledWith( - ['rev-parse', '--git-path', 'orca/issue-command-runner.sh'], + ['rev-parse', '--git-path', 'orca/issue-command-runner.cmd'], { cwd: 'C:\\repo-worktree' } ) - expect(writeFileSyncMock).toHaveBeenCalledWith( - 'C:\\repo\\.git\\orca\\issue-command-runner.sh', - '#!/usr/bin/env bash\nset -e\ngh issue view 42\n', - 'utf-8' - ) + // Why: the runner file is batch (.cmd) while the pane that launches it is still Git Bash. expect(result.shell).toEqual({ family: 'posix' }) } finally { Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform }) diff --git a/src/main/hooks.ts b/src/main/hooks.ts index ad73003778f..21b56b8a597 100644 --- a/src/main/hooks.ts +++ b/src/main/hooks.ts @@ -9,6 +9,12 @@ import { shouldWaitForSetupBeforeAgentStartup } from '../shared/setup-agent-star import { TERMINAL_GIT_CREDENTIAL_GUARD_POLICY_ENV } from '../shared/terminal-git-credential-guard' import { parseOrcaYaml } from '../shared/orca-yaml' import { nativeWindowsPathToPosixShellPath } from '../shared/setup-runner-command' +import { + isShebangLine, + parseSetupScriptShebang, + scriptDeclaresPosixShell, + stripLeadingShebangLine +} from '../shared/setup-script-shebang' import { resolveWindowsShellStartupFamily } from '../shared/windows-terminal-shell' import { resolveWindowsGitBashShellPath } from './git-bash' import { gitExecFileSync, promptGuardShellEnv } from './git/runner' @@ -397,13 +403,32 @@ function getHookWslContext( } } +// Why: cmd cannot run a POSIX script, and executing its interpreter-agnostic prefix (`pnpm +// install`, `git submodule update`) before dying on the first bash-only line is worse than not +// starting: half-applied setup looks like a working worktree. +const WINDOWS_RUNNER_SHEBANG_REFUSAL = [ + 'echo Orca setup: this script starts with a "#!" interpreter line, so it needs a POSIX shell. 1>&2', + 'echo Orca setup: this worktree runs setup through cmd.exe, which cannot execute it. 1>&2', + 'echo Orca setup: set the Windows terminal shell to Git Bash, or rewrite the script in cmd syntax. 1>&2', + 'exit /b 1', + '' +].join('\r\n') + export function buildWindowsRunnerScript(script: string): string { // Why: launchers invoke this runner under `cmd /v:on`, and EnableExtensions does not reset an // inherited delayed-expansion state — without this, every `!` in a user setup line is eaten. - let runnerScript = '@echo off\r\nsetlocal EnableExtensions DisableDelayedExpansion\r\n' + const header = '@echo off\r\nsetlocal EnableExtensions DisableDelayedExpansion\r\n' + let runnerScript = header + let isFirstLine = true for (const rawLine of iterateLfScriptLines(script)) { const command = rawLine.trim() + if (isFirstLine) { + isFirstLine = false + if (isShebangLine(command)) { + return `${header}${WINDOWS_RUNNER_SHEBANG_REFUSAL}` + } + } if (!command) { runnerScript += '\r\n' continue @@ -462,7 +487,15 @@ export function getSetupRunnerEnvVars(repo: Repo, worktreePath: string): Record< } export function buildPosixRunnerScript(script: string): string { - return `#!/usr/bin/env bash\nset -e\n${normalizeCrlfScriptLineEndings(script)}\n` + // Why: the runner is always launched as `bash `, so flags on the script's own `#!` line + // are never seen by the interpreter — replay them through `set` or a script that asked for + // `-euo pipefail` silently loses pipefail, and drop the now-duplicate interpreter line. + const shebang = parseSetupScriptShebang(script) + const declaredOptions = shebang?.shellOptions.length + ? `set ${shebang.shellOptions.join(' ')}\n` + : '' + const body = shebang ? stripLeadingShebangLine(script) : script + return `#!/usr/bin/env bash\nset -e\n${declaredOptions}${normalizeCrlfScriptLineEndings(body)}\n` } function normalizeCrlfScriptLineEndings(script: string): string { @@ -500,8 +533,8 @@ export function createIssueCommandRunnerScript( script: command, runnerBaseName: 'issue-command-runner', runtimeTarget: getHookRuntimeTarget(projectRuntime), - // Why: issue commands run in the same terminal as setup, so a Git Bash setup - // runner must not be paired with a cmd issue runner in one session. + // Why: issue commands share the setup session's shell resolution; the runner still + // needs its own `#!` line to be treated as bash. setupShell }) } @@ -528,11 +561,21 @@ function createWorktreeRunnerScript(args: { // Why: WSL worktrees are Linux fs even though process.platform is 'win32'; use bash for WSL, .cmd for native Windows. const wslWorktree = isWslPath(worktreePath) || Boolean(runtimeTarget?.wslDistro) const nativeWindowsWorktree = process.platform === 'win32' && !wslWorktree + // Why: the terminal-shell preference says nothing about the language a project's script is + // written in, and every pre-existing Windows script was authored against the cmd runner. Only a + // `#!` line opts a script into bash, so the same orca.yaml runs identically for every Windows + // user of the repo instead of following whichever terminal each of them happens to prefer. const runnerShell: SetupRunnerShell = nativeWindowsWorktree - ? (setupShell ?? { family: 'cmd' }) + ? setupShell?.family === 'posix' && scriptDeclaresPosixShell(script) + ? setupShell + : { family: 'cmd' } : { family: 'posix' } + // Why: `shell` tells the launcher which shell types the command, not which format the runner + // file is in — the .cmd/.sh extension already carries that. Reporting the runner family here + // would make a Git Bash pane receive `cmd.exe /c ...`, whose `/c` MSYS rewrites into a drive + // path (issue #6896), so setup would open an interactive cmd and never run. const launchShell: SetupRunnerShell | undefined = nativeWindowsWorktree - ? runnerShell + ? (setupShell ?? { family: 'cmd' }) : process.platform === 'win32' && runtimeTarget?.wslDistro ? { family: 'posix', executable: 'wsl.exe' } : undefined @@ -583,8 +626,7 @@ function createWorktreeRunnerScript(args: { envVars, // Why: WSL git returns /mnt paths that Node converts back to C:\ for file // writes; retain the runtime signal so launch converts them to /mnt again. - // Issue-command runners take the same resolved shell, so one session never - // mixes a bash setup runner with a cmd issue runner. + // On native Windows it is the terminal's family, i.e. the shell that types the command. ...(launchShell ? { shell: launchShell } : {}), ...(waitForAgentStartup === true ? { waitForAgentStartup: true } : {}) } @@ -615,9 +657,9 @@ export function resolveSetupRunnerShell( options.resolveGitBashShellPath ?? ((shell: string) => resolveWindowsGitBashShellPath(shell, { platform })) if (resolveGitBashShellPath(configuredShell)) { - // Note: Git Bash users with batch-syntax orca.yaml setup content get a bash - // interpreter from here on. The flip is intentional and documented in - // docs/reference/windows-setup-shell.md. + // Note: this reports the terminal's family — the shell that types the launch command, and + // therefore also that a bash runner *could* launch here. Whether one is written is decided + // per script by its `#!` line — see docs/reference/windows-setup-shell.md. return { family: 'posix' } } } diff --git a/src/main/runtime/orchestration/setup-completion-signal.test.ts b/src/main/runtime/orchestration/setup-completion-signal.test.ts index baa5af51cf3..73f29371b50 100644 --- a/src/main/runtime/orchestration/setup-completion-signal.test.ts +++ b/src/main/runtime/orchestration/setup-completion-signal.test.ts @@ -64,6 +64,19 @@ describe('orchestration setup completion signal', () => { expect(command).toContain('bash /c/repo/.git/orca/setup-runner.sh') }) + it('keeps a batch runner on the Windows completion path from a Git Bash pane', () => { + // Regression (#6896): a Git Bash terminal with a batch setup script still gets a .cmd + // runner; observing it must not shell out to bash or type a bare `cmd.exe /c` switch. + const runnerPath = 'C:\\repo\\.git\\orca\\setup-runner.cmd' + const observed = buildObservedSetupCommand(runnerPath, 'windows', 'token-git-bash-cmd', { + family: 'posix' + }) + + expect(observed.command).toContain('powershell.exe -NoLogo -NoProfile -NonInteractive') + expect(observed.command).not.toContain('bash ') + expect(observed.env).toEqual({ ORCA_SETUP_RUNNER_PATH: runnerPath }) + }) + it('recognizes one completion signal across output chunk boundaries', () => { const onComplete = vi.fn() const scanner = createSetupCompletionScanner('token-chunks', onComplete) diff --git a/src/shared/setup-agent-sequencing.test.ts b/src/shared/setup-agent-sequencing.test.ts index bffeb0de351..61dc001e627 100644 --- a/src/shared/setup-agent-sequencing.test.ts +++ b/src/shared/setup-agent-sequencing.test.ts @@ -218,6 +218,40 @@ describe('createSequencedSetupAgentCommands', () => { }) }) + it('launches a batch runner through the cmd launcher inside a Git Bash gate', () => { + // Regression (#6896): a Git Bash terminal with a batch setup script still gets a .cmd + // runner, and the gate must not hand that runner to bash. The gate itself stays POSIX + // because the Git Bash pane types it and quoted the startup command for bash. + const result = createSequencedSetupAgentCommands({ + runnerScriptPath: 'C:\\repo\\.git\\orca\\setup-runner.cmd', + startupCommand: "claude 'fix the user'\\''s login'", + platform: 'windows', + shell: { family: 'posix' }, + nonce: 'nonce-gitbash-cmd' + }) + + expect(result.setupCommand).toContain( + 'powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand' + ) + expect(result.setupCommand).not.toMatch(/bash\s+\S*setup-runner/) + expect(decodePowerShellScript(result.setupCommand)).toContain( + "$runner = 'C:\\repo\\.git\\orca\\setup-runner.cmd'" + ) + // Why: PowerShell's `Invoke-Expression` cannot parse the POSIX `'\''` escaping a Git Bash + // pane produces, so the gate that evaluates the startup command must be bash. + expect(result.setupCommand).toMatch(/^bash -lc /) + expect(result.startupCommand).toMatch(/^bash -lc /) + expect(result.startupCommand).not.toContain('Invoke-Expression') + expect(result.startupCommand).toContain('eval "$ORCA_SEQUENCED_STARTUP_COMMAND"') + // Why: bash writes and reads the marker here, so it needs the /c/... form of the path. + expect(result.setupCommand).toContain( + '/c/repo/.git/orca/setup-runner.cmd.nonce-gitbash-cmd.done' + ) + expect(result.startupCommand).toContain( + '/c/repo/.git/orca/setup-runner.cmd.nonce-gitbash-cmd.done' + ) + }) + it.skipIf(process.platform !== 'win32')( 'executes the native Windows setup-to-agent sequence through cmd.exe', async () => { diff --git a/src/shared/setup-agent-sequencing.ts b/src/shared/setup-agent-sequencing.ts index 92376f10886..1ec888e3aa6 100644 --- a/src/shared/setup-agent-sequencing.ts +++ b/src/shared/setup-agent-sequencing.ts @@ -1,5 +1,6 @@ import { encodePowerShellCommand } from './powershell-command-encoding' import { + nativeWindowsPathToPosixShellPath, resolveSetupRunnerCommand, type SetupRunnerCommandPlatform, type SetupRunnerCommandShell, @@ -41,12 +42,20 @@ export function createSequencedSetupAgentCommands(args: { }): SequencedSetupAgentCommands { const nonce = args.nonce ?? createSetupAgentSequenceNonce() const resolution = resolveSetupRunnerCommand(args.runnerScriptPath, args.platform, args.shell) + // Why: the gate is typed into the terminal pane and `startupCommand` is already quoted for that + // pane, so a batch runner launched from a Git Bash pane still needs the bash gate — PowerShell's + // `Invoke-Expression` cannot parse the POSIX `'\''` escaping the pane's quoting produces. The + // runner itself still launches through `resolution.command`, never through bash. + const posixGateForWindowsRunner = resolution.shell === 'windows' && args.shell?.family === 'posix' + const markerBasePath = posixGateForWindowsRunner + ? nativeWindowsPathToPosixShellPath(resolution.runnerScriptPathForShell) + : resolution.runnerScriptPathForShell // Why: overlapping gated launches of the same setup runner must not race on // a shared completion marker. - const markerPath = `${resolution.runnerScriptPathForShell}.${nonce}.done` + const markerPath = `${markerBasePath}.${nonce}.done` const waitTimeoutSeconds = args.waitTimeoutSeconds ?? DEFAULT_WAIT_TIMEOUT_SECONDS - if (resolution.shell === 'windows') { + if (resolution.shell === 'windows' && !posixGateForWindowsRunner) { return { setupCommand: buildWindowsSetupCommand( resolution.runnerScriptPathForShell, diff --git a/src/shared/setup-runner-command.test.ts b/src/shared/setup-runner-command.test.ts index 99ba2e029c4..069130b1313 100644 --- a/src/shared/setup-runner-command.test.ts +++ b/src/shared/setup-runner-command.test.ts @@ -61,6 +61,51 @@ describe('buildSetupRunnerCommand', () => { 'bash /c/repo/.git/orca/setup-runner.sh' ) }) + + it('never hands a batch runner to bash, even from a Git Bash pane', () => { + // Regression: a Git Bash terminal with a batch-syntax setup script gets a .cmd runner, + // so the launch shell being POSIX must not be read as "the runner is a shell script". + const command = buildSetupRunnerCommand('C:\\repo\\.git\\orca\\setup-runner.cmd', 'windows', { + family: 'posix' + }) + + expect(command).not.toContain('bash ') + expect(command).not.toContain('/c/repo') + }) + + it('avoids the bare /c switch when a POSIX pane launches a batch runner', () => { + // Regression (#6896): MSYS rewrites `cmd.exe /c` into a drive path inside Git Bash, so cmd + // opens interactively and the runner payload never executes. + const command = buildSetupRunnerCommand('C:\\repo\\.git\\orca\\setup-runner.cmd', 'windows', { + family: 'posix' + }) + + expect(command).not.toContain('cmd.exe /c') + expect(command).toMatch( + /^powershell\.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand [A-Za-z0-9+/=]+$/ + ) + }) + + it('keeps the batch runner path in native form for a POSIX pane launch', () => { + // Why: the PowerShell launcher hands the path to cmd, which cannot read /c/... MSYS paths; + // marker and completion paths derive from this value too. + expect( + resolveSetupRunnerCommand('C:\\repo\\.git\\orca\\setup-runner.cmd', 'windows', { + family: 'posix' + }) + ).toMatchObject({ + runnerScriptPathForShell: 'C:\\repo\\.git\\orca\\setup-runner.cmd', + shell: 'windows' + }) + }) + + it('still uses bash for a POSIX runner launched from a POSIX pane', () => { + expect( + buildSetupRunnerCommand('C:\\repo\\.git\\orca\\setup-runner.sh', 'windows', { + family: 'posix' + }) + ).toBe('bash /c/repo/.git/orca/setup-runner.sh') + }) }) describe('buildSetupRunnerCommand cmd metacharacter guard', () => { diff --git a/src/shared/setup-runner-command.ts b/src/shared/setup-runner-command.ts index fe9cebed50b..7b1dee560fd 100644 --- a/src/shared/setup-runner-command.ts +++ b/src/shared/setup-runner-command.ts @@ -60,7 +60,10 @@ export function resolveSetupRunnerCommand( shell: 'posix' } } - if (shell?.family === 'posix' || /\.sh$/i.test(runnerScriptPath)) { + // Why: `shell` is the shell that types the command; the runner file's own extension decides + // what can execute it. A batch runner never goes to bash even from a Git Bash pane. + const cmdRunnerFile = isWindowsCmdRunnerPath(runnerScriptPath) + if (!cmdRunnerFile && (shell?.family === 'posix' || /\.sh$/i.test(runnerScriptPath))) { // Why: WSL shells need /mnt/... paths, while Git Bash expects /c/... when replaying deferred setup scripts. if (isWslExecutable(shell?.executable)) { const wslPath = nativeWindowsPathToWslShellPath(runnerScriptPath) @@ -79,11 +82,15 @@ export function resolveSetupRunnerCommand( } } return { - // Why: some path characters survive no amount of quoting on a cmd command line, so those - // paths take a delayed-expansion launcher instead. Every other path keeps the plain form. - command: windowsRunnerPathNeedsCmdGuard(runnerScriptPath) - ? buildWindowsCmdRunnerDelayedLaunchCommand(runnerScriptPath) - : `cmd.exe /c ${quoteWindowsArg(runnerScriptPath)}`, + // Why: some path characters survive no amount of quoting on a cmd command line, and a Git + // Bash pane rewrites the bare `/c` switch itself into a drive path (issue #6896) so cmd + // opens interactively and the runner never starts. Both take the delayed-expansion + // launcher, which passes the switch through a PowerShell ProcessStartInfo instead. Every + // other case keeps the plain form. + command: + shell?.family === 'posix' || windowsRunnerPathNeedsCmdGuard(runnerScriptPath) + ? buildWindowsCmdRunnerDelayedLaunchCommand(runnerScriptPath) + : `cmd.exe /c ${quoteWindowsArg(runnerScriptPath)}`, runnerScriptPathForShell: runnerScriptPath, shell: 'windows' } @@ -96,6 +103,11 @@ export function resolveSetupRunnerCommand( } } +/** True when the runner file is a batch script, which only cmd can execute. */ +export function isWindowsCmdRunnerPath(runnerScriptPath: string): boolean { + return /\.(cmd|bat)$/i.test(runnerScriptPath) +} + export function isWslUncPath(path: string): boolean { const normalized = path.replace(/\\/g, '/') return /^\/\/(wsl\.localhost|wsl\$)\//i.test(normalized) diff --git a/src/shared/setup-script-shebang.test.ts b/src/shared/setup-script-shebang.test.ts new file mode 100644 index 00000000000..05dca1204da --- /dev/null +++ b/src/shared/setup-script-shebang.test.ts @@ -0,0 +1,99 @@ +import { describe, it, expect } from 'vitest' +import { + isShebangLine, + parseSetupScriptShebang, + scriptDeclaresPosixShell, + stripLeadingShebangLine +} from './setup-script-shebang' + +describe('scriptDeclaresPosixShell', () => { + it('accepts the common env and absolute-path forms', () => { + expect(scriptDeclaresPosixShell('#!/usr/bin/env bash\npnpm install')).toBe(true) + expect(scriptDeclaresPosixShell('#!/bin/sh -e\npnpm install')).toBe(true) + expect(scriptDeclaresPosixShell('#!/usr/bin/env -S bash -euo pipefail\npnpm install')).toBe( + true + ) + expect(scriptDeclaresPosixShell('#!/bin/zsh')).toBe(true) + }) + + it('rejects scripts with no interpreter line', () => { + // Regression: batch-syntax setup scripts must stay on the cmd runner. + expect(scriptDeclaresPosixShell('copy .env.example .env\nxcopy /E assets dist')).toBe(false) + expect(scriptDeclaresPosixShell('')).toBe(false) + expect(scriptDeclaresPosixShell('pnpm install\n#!/usr/bin/env bash')).toBe(false) + expect(scriptDeclaresPosixShell('# !/usr/bin/env bash\npnpm install')).toBe(false) + }) + + it('rejects interpreters that are not POSIX shells', () => { + expect(scriptDeclaresPosixShell('#!/usr/bin/env node\nconsole.log(1)')).toBe(false) + expect(scriptDeclaresPosixShell('#!/usr/bin/env python3\nprint(1)')).toBe(false) + }) + + it('tolerates CRLF and Windows-style interpreter paths', () => { + expect(scriptDeclaresPosixShell('#!/usr/bin/env bash\r\npnpm install')).toBe(true) + expect(scriptDeclaresPosixShell('#!C:\\tools\\git\\bin\\bash.exe\r\npnpm install')).toBe(true) + }) +}) + +describe('parseSetupScriptShebang', () => { + it('keeps the interpreter flags a script declares', () => { + // Regression: the runner is launched as `bash `, so flags survive only if they are + // parsed out here and replayed with `set` — otherwise `pipefail` is silently lost. + expect(parseSetupScriptShebang('#!/usr/bin/env -S bash -euo pipefail\nmake')).toEqual({ + interpreter: 'bash', + shellOptions: ['-euo', 'pipefail'] + }) + expect(parseSetupScriptShebang('#!/bin/bash -e -x\nmake')).toEqual({ + interpreter: 'bash', + shellOptions: ['-e', '-x'] + }) + expect(parseSetupScriptShebang('#!/bin/sh\nmake')).toEqual({ + interpreter: 'sh', + shellOptions: [] + }) + }) + + it('ignores interpreter arguments that `set` cannot apply', () => { + // Regression: `set` rejects invocation-only flags with exit 2, and the runner's `set -e` + // turns that into an aborted setup before its first line runs. + expect(parseSetupScriptShebang('#!/bin/bash --norc\nmake')?.shellOptions).toEqual([]) + expect(parseSetupScriptShebang('#!/bin/bash -l\nmake')?.shellOptions).toEqual([]) + expect(parseSetupScriptShebang('#!/bin/bash -s\nmake')?.shellOptions).toEqual([]) + expect(parseSetupScriptShebang('#!/bin/bash -i\nmake')?.shellOptions).toEqual([]) + // Why: `-r` is accepted by `set` on some shells but silently restricts the rest of setup. + expect(parseSetupScriptShebang('#!/bin/bash -r\nmake')?.shellOptions).toEqual([]) + expect(parseSetupScriptShebang('#!/bin/bash -ex -l\nmake')?.shellOptions).toEqual(['-ex']) + // Why: a bare `-o` would print the whole shell-option table into the setup terminal. + expect(parseSetupScriptShebang('#!/bin/bash -o\nmake')?.shellOptions).toEqual([]) + expect(parseSetupScriptShebang('#!/bin/bash -euo\nmake')?.shellOptions).toEqual([]) + expect(parseSetupScriptShebang('#!/bin/bash +o posix\nmake')?.shellOptions).toEqual([ + '+o', + 'posix' + ]) + }) + + it('returns null without an interpreter line', () => { + expect(parseSetupScriptShebang('pnpm install')).toBeNull() + expect(parseSetupScriptShebang('#!/usr/bin/env')).toBeNull() + }) +}) + +describe('stripLeadingShebangLine', () => { + it('removes only a leading interpreter line', () => { + expect(stripLeadingShebangLine('#!/usr/bin/env bash\npnpm install\n')).toBe('pnpm install\n') + expect(stripLeadingShebangLine('#!/usr/bin/env bash\r\npnpm install')).toBe('pnpm install') + expect(stripLeadingShebangLine('pnpm install\n#!/usr/bin/env bash')).toBe( + 'pnpm install\n#!/usr/bin/env bash' + ) + expect(stripLeadingShebangLine('#!/usr/bin/env bash')).toBe('') + }) +}) + +describe('isShebangLine', () => { + it('detects interpreter lines regardless of leading whitespace', () => { + expect(isShebangLine('#!/usr/bin/env bash')).toBe(true) + expect(isShebangLine(' #!/bin/sh')).toBe(true) + expect(isShebangLine('#comment')).toBe(false) + expect(isShebangLine('pnpm install')).toBe(false) + }) +}) diff --git a/src/shared/setup-script-shebang.ts b/src/shared/setup-script-shebang.ts new file mode 100644 index 00000000000..f30bbab0959 --- /dev/null +++ b/src/shared/setup-script-shebang.ts @@ -0,0 +1,100 @@ +// Why: the interpreter a setup/issue-command script is written for is a property of the script, +// not of the user's terminal preference, so a `#!` line is how a project declares it. + +const POSIX_SHELL_BASENAMES = new Set(['sh', 'bash', 'zsh', 'dash', 'ksh', 'ash']) +// Why: only the letters `set` itself accepts (`set [--abefhkmnptuvxBCHP] [-o option]`). An +// invocation-only flag such as `-l` or `-r` makes `set` exit 2, which under the runner's `set -e` +// aborts setup before its first line runs. +const SET_OPTION_FLAG_PATTERN = /^[-+][abefhkmnptuvxBCHP]+$/ +// Why: `-o`/`-euo` name their option in the next token; a trailing `-o` with no name would make +// `set` dump the whole shell-option table into the setup terminal instead. +const SET_LONG_OPTION_FLAG_PATTERN = /^[-+][abefhkmnptuvxBCHP]*o$/ +const SHELL_OPTION_NAME_PATTERN = /^[a-z_]+$/ + +export type SetupScriptShebang = { + /** Lowercased interpreter basename, e.g. `bash` for `#!/usr/bin/env -S bash -e`. */ + interpreter: string + /** Interpreter flags the generated runner replays through `set`, e.g. `['-euo', 'pipefail']`. */ + shellOptions: string[] +} + +/** True when `line` is a `#!` interpreter line (leading whitespace tolerated). */ +export function isShebangLine(line: string): boolean { + return line.trimStart().startsWith('#!') +} + +/** Parses the script's leading `#!` line, or null when it has none. */ +export function parseSetupScriptShebang(script: string): SetupScriptShebang | null { + const firstLine = script.split('\n', 1)[0] ?? '' + if (!isShebangLine(firstLine)) { + return null + } + + const tokens = firstLine.trim().slice(2).trim().split(/\s+/).filter(Boolean) + const interpreterIndex = findInterpreterIndex(tokens) + if (interpreterIndex === -1) { + return null + } + + return { + interpreter: executableBasename(tokens[interpreterIndex]), + shellOptions: parseShellOptions(tokens.slice(interpreterIndex + 1)) + } +} + +/** True when the script's first line is a `#!` line naming a POSIX shell. */ +export function scriptDeclaresPosixShell(script: string): boolean { + const shebang = parseSetupScriptShebang(script) + return shebang !== null && POSIX_SHELL_BASENAMES.has(shebang.interpreter) +} + +/** Drops a leading `#!` line; the generated runner carries its own interpreter line. */ +export function stripLeadingShebangLine(script: string): string { + if (!isShebangLine(script.split('\n', 1)[0] ?? '')) { + return script + } + const lineEnd = script.indexOf('\n') + return lineEnd === -1 ? '' : script.slice(lineEnd + 1) +} + +function findInterpreterIndex(tokens: string[]): number { + for (let index = 0; index < tokens.length; index++) { + const basename = executableBasename(tokens[index]) + // Why: `env` (and its `-S` split-string form) only forwards to the real interpreter. + if (basename === '' || basename === 'env' || basename.startsWith('-')) { + continue + } + return index + } + return -1 +} + +function parseShellOptions(tokens: string[]): string[] { + const options: string[] = [] + for (let index = 0; index < tokens.length; index++) { + const token = tokens[index] + if (SET_LONG_OPTION_FLAG_PATTERN.test(token)) { + const optionName = tokens[index + 1] + if (optionName && SHELL_OPTION_NAME_PATTERN.test(optionName)) { + options.push(token, optionName) + index++ + } + continue + } + if (SET_OPTION_FLAG_PATTERN.test(token)) { + options.push(token) + } + } + return options +} + +function executableBasename(token: string): string { + return ( + token + .replaceAll('\\', '/') + .split('/') + .pop() + ?.toLowerCase() + .replace(/\.exe$/, '') ?? '' + ) +} From 401f66939d234200f3b770d3881115793b9c95f7 Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:25:56 -0700 Subject: [PATCH 23/72] fix(codex): do not silently run the previous account when managed auth is unreadable (#12407) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(codex): never launch the previously synced account during the credential grace window The credential-absence grace window exists so a mid-rotation read of a managed auth.json does not deselect the account over a race. In the shared runtime-home lane it did that by returning early from syncForCurrentSelection, which leaves the runtime home holding whatever it held before — the previously synced account's credentials. So when the selected account's auth.json was missing or unreadable (home on a disconnected network drive, never provisioned, removed, or held under an EPERM/EACCES lock by Windows AV), the next launch ran Codex as the *previous* account while Settings showed the selected one: wrong quota, wrong identity, work attributed to the wrong account, and no signal to the user. Not being able to read the selected account's credentials proves nothing about the identity already mirrored in the runtime home. The grace window now only short-circuits when Orca can prove the runtime home already holds that same account (shared-runtime-auth provenance, falling back to the in-memory sync state on pre-provenance installs). Otherwise the runtime auth is cleared and the provenance fenced: the selection survives in case the absence heals, but the launch is logged out rather than logged in as someone else. Tests cover ENOENT, EACCES/EPERM, and a genuinely still-settling rotation of the selected account, which keeps its grace and its credentials. * fix(codex): keep a mirrored token refresh when refusing an unproven selection Clearing the shared runtime auth to avoid launching the wrong account can drop bytes Codex refreshed in place — on a cold start whose mirror still holds the previous account, no outgoing read-back has run yet, so those tokens exist nowhere else and OAuth refresh-token rotation would force a re-login. Read the mirror back to whichever managed account owns it (identity + freshness proven, as on an account switch) before removing it. * fix(codex): keep an unreadable managed home from dropping another account's mirrored refresh An account whose auth.json cannot be read aborted the whole read-back scan, so removing the runtime mirror for an unproven selection destroyed a token refresh it held for a different account. Skip the unreadable home instead. * fix(codex): prove mirror ownership from the credential, not just provenance Review found the unproven-selection clear was both too eager and too destructive: - A `fenced` provenance record (torn provenance file, or a crashed pending write) turned the grace window into a logout of the account the mirror actually and correctly held. - The pre-provenance fallback was tautological: initializeLastSyncedState seeds lastSyncedAccountId with the SELECTED account, so `missing && lastSyncedAccountId === id` is true on every cold start — the wrong-account launch still reproduced on installs with no provenance file. - The pre-delete read-back only rescued managed-owned bytes, so a system-default refresh living only in the mirror was destroyed with no path back to ~/.codex. - rmSync was unguarded on a branch whose entry condition is "the filesystem refused a read", so an EPERM/EBUSY lock could throw out of prepareForCodexLaunch, and the fence was written after the delete. - Swallowing managed-home read errors let an ambiguous candidate set collapse to a single match and be written to the wrong home. Ownership is now decided from the credential's own identity claims (codexAuthMatchesManagedAccount against the account record, no read of the unreadable home), then from the exact bytes Orca mirrored this run, and only then from provenance. The clear rescues a mirror-only system-default refresh to ~/.codex first (reusing the ownership rules syncRuntimeAuthWithSystemDefault already applies, now shared via resolveSystemDefaultMirrorClaim), fences before deleting, and never throws. An unreadable managed home whose record cannot rule it out now makes the read-back scan ambiguous instead of misattributing the bytes. Five tests added; each fails on the previous commit and passes here. * fix(codex): never let the fence cancel the delete, or unattributable bytes cause a logout Round-2 review found the previous response commit walked the guard backwards in three places: - `fence before deleting` put persistSharedRuntimeAuthProvenance and rmSync in one try, so a fence write the OS refuses (Windows AV lock on the provenance file) cancelled the delete and the launch ran with the other account's credentials — the original defect, reproduced. The delete now runs from a finally: the fence is still attempted first, but neither it nor the read-back rescue can skip it. - Credentials with no OAuth identity claims (apikey/agentIdentity/PAT/bedrock, all first-class in managed-codex-auth-readiness) can never satisfy a positive ownership proof, so a pre-provenance install deleted the mirror it correctly held during a transient absence. With no committed provenance record left, ownership is now refuted rather than proven: only claims that contradict the account rule the mirror out, and claims a credential does not carry contradict nothing. - A stale record email hard-failed the proof even when the account id matched exactly. Orca only refreshes account.email on add/re-auth, so a renamed ChatGPT account kept a stale email indefinitely and both lost its mirror and had its refreshes dropped instead of read back. A positive account-id match now outranks the email, in one shared rule both identity predicates use. Four tests added; each fails without its fix. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> --- .../codex-accounts/codex-auth-identity.ts | 63 +- .../codex-credential-absence-grace.test.ts | 17 +- .../managed-codex-auth-readiness.test.ts | 14 +- .../runtime-home-service.test.ts | 572 +++++++++++++++++- .../codex-accounts/runtime-home-service.ts | 167 ++++- 5 files changed, 809 insertions(+), 24 deletions(-) diff --git a/src/main/codex-accounts/codex-auth-identity.ts b/src/main/codex-accounts/codex-auth-identity.ts index e8d094f03b6..5c62dbfe272 100644 --- a/src/main/codex-accounts/codex-auth-identity.ts +++ b/src/main/codex-accounts/codex-auth-identity.ts @@ -29,8 +29,17 @@ export function codexAuthMatchesManagedAccount( normalizeField(account.workspaceAccountId), managedIdentity?.workspaceAccountId ) - const emailMatches = Boolean(selectedEmail && identity.email && selectedEmail === identity.email) - if (selectedEmail && identity.email && selectedEmail !== identity.email) { + const emailMatches = identityFieldsAgree(selectedEmail, identity.email) + if ( + identityContradictsSelection( + { + email: selectedEmail, + providerAccountId: selectedProviderId, + workspaceAccountId: selectedWorkspaceId + }, + identity + ) + ) { return false } if (!identityFieldMatches(selectedProviderId, identity.providerAccountId)) { @@ -50,6 +59,26 @@ export function codexAuthMatchesManagedAccount( ) } +// Why: an unreadable managed home cannot be compared byte-for-byte, so only the +// account record itself can rule that home out as the credential's owner. +export function codexAuthCouldBelongToManagedAccount( + runtimeAuthContents: string, + account: CodexManagedAccount +): boolean { + const identity = readIdentityFromAuthContents(runtimeAuthContents) + return ( + !identity || + !identityContradictsSelection( + { + email: normalizeField(account.email), + providerAccountId: normalizeField(account.providerAccountId), + workspaceAccountId: normalizeField(account.workspaceAccountId) + }, + identity + ) + ) +} + // Why: the shared mirror may still hold managed credentials; only the same // positively identified system account may ever be read back to ~/.codex. export function codexAuthMatchesSystemDefaultIdentity( @@ -240,3 +269,33 @@ function firstNonNull(...values: (string | null | undefined)[]): string | null { function identityFieldMatches(selectedField: string | null, runtimeField: string | null): boolean { return !selectedField || Boolean(runtimeField && selectedField === runtimeField) } + +// Why: only a claim both sides carry can rule an account out — a credential with +// no identity claims (api key, PAT, bedrock) contradicts nothing. A ChatGPT +// rename leaves the record email stale, so a matching account id outranks it. +function identityContradictsSelection( + selected: CodexAuthIdentity, + identity: CodexAuthIdentity +): boolean { + if ( + identityFieldsConflict(selected.providerAccountId, identity.providerAccountId) || + identityFieldsConflict(selected.workspaceAccountId, identity.workspaceAccountId) + ) { + return true + } + return ( + identityFieldsConflict(selected.email, identity.email) && + !identityFieldsAgree(selected.providerAccountId, identity.providerAccountId) + ) +} + +function identityFieldsAgree(selectedField: string | null, runtimeField: string | null): boolean { + return Boolean(selectedField && runtimeField && selectedField === runtimeField) +} + +function identityFieldsConflict( + selectedField: string | null, + runtimeField: string | null +): boolean { + return Boolean(selectedField && runtimeField && selectedField !== runtimeField) +} diff --git a/src/main/codex-accounts/codex-credential-absence-grace.test.ts b/src/main/codex-accounts/codex-credential-absence-grace.test.ts index 6672bb7676a..37e360a3a6e 100644 --- a/src/main/codex-accounts/codex-credential-absence-grace.test.ts +++ b/src/main/codex-accounts/codex-credential-absence-grace.test.ts @@ -1,4 +1,4 @@ -import { mkdtempSync, rmSync, writeFileSync } from 'node:fs' +import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' import { afterEach, beforeEach, describe, expect, it } from 'vitest' @@ -57,6 +57,21 @@ describe('CodexCredentialAbsenceGrace', () => { }) }) + it('keeps a permission-denied read inside the grace window before it turns durable', () => { + if (process.platform === 'win32' || process.getuid?.() === 0) { + return + } + const grace = new CodexCredentialAbsenceGrace() + writeFileSync(authPath, VALID_AUTH, 'utf-8') + chmodSync(authPath, 0o000) + + expect(grace.assess(authPath, 1_000)).toEqual({ state: 'unreadable', durable: false }) + expect(grace.assess(authPath, 1_000 + CODEX_CREDENTIAL_ABSENCE_GRACE_MS)).toEqual({ + state: 'unreadable', + durable: true + }) + }) + it('reports settled credential-free JSON as durable immediately', () => { const grace = new CodexCredentialAbsenceGrace() writeFileSync(authPath, '{}', 'utf-8') diff --git a/src/main/codex-accounts/managed-codex-auth-readiness.test.ts b/src/main/codex-accounts/managed-codex-auth-readiness.test.ts index 4de1da70396..abd6a4881ee 100644 --- a/src/main/codex-accounts/managed-codex-auth-readiness.test.ts +++ b/src/main/codex-accounts/managed-codex-auth-readiness.test.ts @@ -1,4 +1,4 @@ -import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs' +import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' import { afterEach, describe, expect, it, vi } from 'vitest' @@ -208,6 +208,18 @@ describe('waitForManagedCodexAuthReady', () => { ) }) + it('separates an absent credential from one that cannot be read', () => { + const fixture = createFixture() + expect(readStoredCodexCredentialState(join(fixture.home, 'auth.json'))).toBe('missing') + + if (process.platform === 'win32' || process.getuid?.() === 0) { + return + } + writeAuth(fixture.home, testChatGptAuth) + chmodSync(join(fixture.home, 'auth.json'), 0o000) + expect(readStoredCodexCredentialState(join(fixture.home, 'auth.json'))).toBe('unreadable') + }) + it('does not gate system, WSL, or unmanaged custom homes', async () => { const fixture = createFixture() await waitForManagedCodexAuthReady({ diff --git a/src/main/codex-accounts/runtime-home-service.test.ts b/src/main/codex-accounts/runtime-home-service.test.ts index d4ab194705d..3449dbd28f4 100644 --- a/src/main/codex-accounts/runtime-home-service.test.ts +++ b/src/main/codex-accounts/runtime-home-service.test.ts @@ -16,7 +16,7 @@ import { } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' -import type { GlobalSettings } from '../../shared/types' +import type { CodexManagedAccount, GlobalSettings } from '../../shared/types' import type * as ShellStartupEnv from '../pty/shell-startup-env' const testState = { @@ -259,6 +259,25 @@ function createManagedAuth(rootDir: string, accountId: string, auth: string): st return managedHomePath } +function createCodexAccountRecord( + id: string, + email: string, + providerAccountId: string, + managedHomePath: string +): CodexManagedAccount { + return { + id, + email, + managedHomePath, + providerAccountId, + workspaceLabel: null, + workspaceAccountId: providerAccountId, + createdAt: 1, + updatedAt: 1, + lastAuthenticatedAt: 1 + } +} + function encodeJwtPart(value: Record): string { return Buffer.from(JSON.stringify(value)).toString('base64url') } @@ -467,6 +486,557 @@ describe('CodexRuntimeHomeService', () => { expect(store.getSettings().activeCodexManagedAccountIdsByRuntime?.host).toBeNull() }) + it.each([ + ['missing', (authPath: string) => rmSync(authPath, { force: true })], + [ + 'unreadable', + (authPath: string) => { + chmodSync(authPath, 0o000) + } + ] + ])( + 'never launches the previously synced account when the selected account auth is %s', + async (label, breakAuth) => { + if (label === 'unreadable' && (process.platform === 'win32' || process.getuid?.() === 0)) { + return + } + const runtimeAuthPath = getRuntimeCodexAuthPath() + const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system') + const authA = createCodexAuthJson('a@example.com', 'acct-a', 'a') + const authB = createCodexAuthJson('b@example.com', 'acct-b', 'b') + writeFileSync(getSystemCodexAuthPath(), systemAuth, 'utf-8') + const homeA = createManagedAuth(testState.userDataDir, 'account-a', authA) + const homeB = createManagedAuth(testState.userDataDir, 'account-b', authB) + const store = createStore( + createSettings({ + codexManagedAccounts: [ + { + id: 'account-a', + email: 'a@example.com', + managedHomePath: homeA, + providerAccountId: 'acct-a', + workspaceLabel: null, + workspaceAccountId: 'acct-a', + createdAt: 1, + updatedAt: 1, + lastAuthenticatedAt: 1 + }, + { + id: 'account-b', + email: 'b@example.com', + managedHomePath: homeB, + providerAccountId: 'acct-b', + workspaceLabel: null, + workspaceAccountId: 'acct-b', + createdAt: 2, + updatedAt: 2, + lastAuthenticatedAt: 2 + } + ], + activeCodexManagedAccountId: 'account-a', + activeCodexManagedAccountIdsByRuntime: { host: 'account-a', wsl: {} } + }) + ) + const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + const service = new CodexRuntimeHomeService(store as never) + expect(readFileSync(runtimeAuthPath, 'utf-8')).toBe(authA) + + store.updateSettings({ + activeCodexManagedAccountId: 'account-b', + activeCodexManagedAccountIdsByRuntime: { host: 'account-b', wsl: {} } + }) + breakAuth(join(homeB, 'auth.json')) + + expect(service.prepareForCodexLaunch()).toBe(getRuntimeCodexHomePath()) + + // The selection survives the grace window, but the launch must never run + // as account A while the UI says account B. + expect(store.getSettings().activeCodexManagedAccountIdsByRuntime?.host).toBe('account-b') + expect(existsSync(runtimeAuthPath) ? readFileSync(runtimeAuthPath, 'utf-8') : null).not.toBe( + authA + ) + expect(warnSpy).toHaveBeenCalledWith( + '[codex-runtime-home] Active managed account auth.json unavailable while the runtime home holds another account, clearing runtime auth' + ) + } + ) + + it.each([ + ['missing', (authPath: string) => rmSync(authPath, { force: true })], + [ + 'unreadable', + (authPath: string) => { + chmodSync(authPath, 0o000) + } + ] + ])( + 'preserves the mirrored refresh of the account the runtime home actually holds when the selected account auth is %s', + async (label, breakAuth) => { + if (label === 'unreadable' && (process.platform === 'win32' || process.getuid?.() === 0)) { + return + } + const runtimeAuthPath = getRuntimeCodexAuthPath() + writeFileSync( + getSystemCodexAuthPath(), + createCodexAuthJson('system@example.com', 'acct-system', 'system'), + 'utf-8' + ) + const authA = createCodexAuthJson('a@example.com', 'acct-a', 'a', 1) + const authARefreshed = createCodexAuthJson('a@example.com', 'acct-a', 'a-refreshed', 2) + const homeA = createManagedAuth(testState.userDataDir, 'account-a', authA) + const homeB = createManagedAuth( + testState.userDataDir, + 'account-b', + createCodexAuthJson('b@example.com', 'acct-b', 'b') + ) + // A crash left account A's refreshed tokens in the mirror while settings + // already select account B, whose own auth.json cannot be read. + writeFileSync(runtimeAuthPath, authARefreshed, 'utf-8') + writeFileSync( + getSharedRuntimeAuthProvenancePath(), + `${JSON.stringify({ owner: 'managed', accountId: 'account-a' })}\n`, + 'utf-8' + ) + breakAuth(join(homeB, 'auth.json')) + const store = createStore( + createSettings({ + codexManagedAccounts: [ + { + id: 'account-a', + email: 'a@example.com', + managedHomePath: homeA, + providerAccountId: 'acct-a', + workspaceLabel: null, + workspaceAccountId: 'acct-a', + createdAt: 1, + updatedAt: 1, + lastAuthenticatedAt: 1 + }, + { + id: 'account-b', + email: 'b@example.com', + managedHomePath: homeB, + providerAccountId: 'acct-b', + workspaceLabel: null, + workspaceAccountId: 'acct-b', + createdAt: 2, + updatedAt: 2, + lastAuthenticatedAt: 2 + } + ], + activeCodexManagedAccountId: 'account-b', + activeCodexManagedAccountIdsByRuntime: { host: 'account-b', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + new CodexRuntimeHomeService(store as never) + + expect(existsSync(runtimeAuthPath)).toBe(false) + expect(readFileSync(join(homeA, 'auth.json'), 'utf-8')).toBe(authARefreshed) + expect(store.getSettings().activeCodexManagedAccountIdsByRuntime?.host).toBe('account-b') + } + ) + + it('keeps the runtime auth through the grace window while the selected account rotates', async () => { + const runtimeAuthPath = getRuntimeCodexAuthPath() + const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system') + const managedAuth = createCodexAuthJson('user@example.com', 'acct-user', 'managed') + writeFileSync(getSystemCodexAuthPath(), systemAuth, 'utf-8') + const managedHomePath = createManagedAuth(testState.userDataDir, 'account-1', managedAuth) + const store = createStore( + createSettings({ + codexManagedAccounts: [ + { + id: 'account-1', + email: 'user@example.com', + managedHomePath, + providerAccountId: 'acct-user', + workspaceLabel: null, + workspaceAccountId: 'acct-user', + createdAt: 1, + updatedAt: 1, + lastAuthenticatedAt: 1 + } + ], + activeCodexManagedAccountId: 'account-1', + activeCodexManagedAccountIdsByRuntime: { host: 'account-1', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + const service = new CodexRuntimeHomeService(store as never) + expect(readFileSync(runtimeAuthPath, 'utf-8')).toBe(managedAuth) + + // Codex rewrites the selected account's auth.json in place: the runtime home + // already holds that same account, so its credentials must survive the race. + writeFileSync(join(managedHomePath, 'auth.json'), '{"tokens":{"acc', 'utf-8') + expect(service.prepareForCodexLaunch()).toBe(getRuntimeCodexHomePath()) + + expect(readFileSync(runtimeAuthPath, 'utf-8')).toBe(managedAuth) + expect(store.getSettings().activeCodexManagedAccountIdsByRuntime?.host).toBe('account-1') + }) + + it('keeps runtime auth the selected account still owns when provenance is unreadable', async () => { + const runtimeAuthPath = getRuntimeCodexAuthPath() + const managedAuth = createCodexAuthJson('user@example.com', 'acct-user', 'managed') + writeFileSync( + getSystemCodexAuthPath(), + createCodexAuthJson('system@example.com', 'acct-system', 'system'), + 'utf-8' + ) + const managedHomePath = createManagedAuth(testState.userDataDir, 'account-1', managedAuth) + // Cold start: the mirror holds the selected account's own credential, but a + // torn provenance file can no longer say so and its auth.json reads torn. + mkdirSync(getRuntimeCodexHomePath(), { recursive: true }) + writeFileSync(runtimeAuthPath, managedAuth, 'utf-8') + writeFileSync(getSharedRuntimeAuthProvenancePath(), 'not-json', 'utf-8') + writeFileSync(join(managedHomePath, 'auth.json'), '{"tokens":{"acc', 'utf-8') + const store = createStore( + createSettings({ + codexManagedAccounts: [ + createCodexAccountRecord('account-1', 'user@example.com', 'acct-user', managedHomePath) + ], + activeCodexManagedAccountId: 'account-1', + activeCodexManagedAccountIdsByRuntime: { host: 'account-1', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + new CodexRuntimeHomeService(store as never) + + expect(readFileSync(runtimeAuthPath, 'utf-8')).toBe(managedAuth) + expect(store.getSettings().activeCodexManagedAccountIdsByRuntime?.host).toBe('account-1') + }) + + it('never launches another account on a cold start with no provenance record', async () => { + const runtimeAuthPath = getRuntimeCodexAuthPath() + writeFileSync( + getSystemCodexAuthPath(), + createCodexAuthJson('system@example.com', 'acct-system', 'system'), + 'utf-8' + ) + const authA = createCodexAuthJson('a@example.com', 'acct-a', 'a') + const homeA = createManagedAuth(testState.userDataDir, 'account-a', authA) + const homeB = createManagedAuth( + testState.userDataDir, + 'account-b', + createCodexAuthJson('b@example.com', 'acct-b', 'b') + ) + // Pre-provenance install: the mirror still holds account A, settings already + // select account B, and nothing on disk records who wrote those bytes. + mkdirSync(getRuntimeCodexHomePath(), { recursive: true }) + writeFileSync(runtimeAuthPath, authA, 'utf-8') + rmSync(getSharedRuntimeAuthProvenancePath(), { force: true }) + rmSync(join(homeB, 'auth.json'), { force: true }) + const store = createStore( + createSettings({ + codexManagedAccounts: [ + createCodexAccountRecord('account-a', 'a@example.com', 'acct-a', homeA), + createCodexAccountRecord('account-b', 'b@example.com', 'acct-b', homeB) + ], + activeCodexManagedAccountId: 'account-b', + activeCodexManagedAccountIdsByRuntime: { host: 'account-b', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + const service = new CodexRuntimeHomeService(store as never) + + expect(service.prepareForCodexLaunch()).toBe(getRuntimeCodexHomePath()) + expect(existsSync(runtimeAuthPath) ? readFileSync(runtimeAuthPath, 'utf-8') : null).not.toBe( + authA + ) + expect(readFileSync(join(homeA, 'auth.json'), 'utf-8')).toBe(authA) + expect(store.getSettings().activeCodexManagedAccountIdsByRuntime?.host).toBe('account-b') + }) + + it('persists a mirror-only system-default refresh before dropping unproven runtime auth', async () => { + const runtimeAuthPath = getRuntimeCodexAuthPath() + const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system', 1) + const systemAuthRefreshed = createCodexAuthJson( + 'system@example.com', + 'acct-system', + 'system-refreshed', + 2 + ) + writeFileSync(getSystemCodexAuthPath(), systemAuth, 'utf-8') + const homeB = createManagedAuth( + testState.userDataDir, + 'account-b', + createCodexAuthJson('b@example.com', 'acct-b', 'b') + ) + // Codex rotated the system-default credential inside the mirror; ~/.codex is + // still the older copy Orca mirrored, so the refresh lives only here. + mkdirSync(getRuntimeCodexHomePath(), { recursive: true }) + writeFileSync(runtimeAuthPath, systemAuthRefreshed, 'utf-8') + writeFileSync( + getSharedRuntimeAuthProvenancePath(), + `${JSON.stringify({ owner: 'system-default', authJson: systemAuth })}\n`, + 'utf-8' + ) + rmSync(join(homeB, 'auth.json'), { force: true }) + const store = createStore( + createSettings({ + codexManagedAccounts: [ + createCodexAccountRecord('account-b', 'b@example.com', 'acct-b', homeB) + ], + activeCodexManagedAccountId: 'account-b', + activeCodexManagedAccountIdsByRuntime: { host: 'account-b', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + new CodexRuntimeHomeService(store as never) + + expect(readFileSync(getSystemCodexAuthPath(), 'utf-8')).toBe(systemAuthRefreshed) + expect(existsSync(runtimeAuthPath)).toBe(false) + }) + + it('survives a runtime auth delete the filesystem refuses', async () => { + const runtimeAuthPath = getRuntimeCodexAuthPath() + writeFileSync( + getSystemCodexAuthPath(), + createCodexAuthJson('system@example.com', 'acct-system', 'system'), + 'utf-8' + ) + const homeA = createManagedAuth( + testState.userDataDir, + 'account-a', + createCodexAuthJson('a@example.com', 'acct-a', 'a') + ) + const homeB = createManagedAuth( + testState.userDataDir, + 'account-b', + createCodexAuthJson('b@example.com', 'acct-b', 'b') + ) + // Stands in for a Windows AV/EBUSY lock: the mirror auth.json cannot be + // removed, and the branch is only reached because reads are already failing. + mkdirSync(runtimeAuthPath, { recursive: true }) + writeFileSync( + getSharedRuntimeAuthProvenancePath(), + `${JSON.stringify({ owner: 'managed', accountId: 'account-a' })}\n`, + 'utf-8' + ) + rmSync(join(homeB, 'auth.json'), { force: true }) + const store = createStore( + createSettings({ + codexManagedAccounts: [ + createCodexAccountRecord('account-a', 'a@example.com', 'acct-a', homeA), + createCodexAccountRecord('account-b', 'b@example.com', 'acct-b', homeB) + ], + activeCodexManagedAccountId: 'account-b', + activeCodexManagedAccountIdsByRuntime: { host: 'account-b', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + const service = new CodexRuntimeHomeService(store as never) + + expect(() => service.prepareForCodexLaunch()).not.toThrow() + // The bytes survived the failed delete, so they must at least be fenced off. + expect(JSON.parse(readFileSync(getSharedRuntimeAuthProvenancePath(), 'utf-8'))).toEqual({ + owner: 'fenced' + }) + rmSync(runtimeAuthPath, { recursive: true, force: true }) + }) + + it('refuses to read runtime auth back into a duplicate account while a home is unreadable', async () => { + if (process.platform === 'win32' || process.getuid?.() === 0) { + return + } + const runtimeAuthPath = getRuntimeCodexAuthPath() + writeFileSync( + getSystemCodexAuthPath(), + createCodexAuthJson('system@example.com', 'acct-system', 'system'), + 'utf-8' + ) + const authX = createCodexAuthJson('x@example.com', 'acct-x', 'x', 1) + const authXRefreshed = createCodexAuthJson('x@example.com', 'acct-x', 'x-refreshed', 2) + // Two records for the same identity: one home unreadable, one readable. + const homeX1 = createManagedAuth(testState.userDataDir, 'account-x1', authX) + const homeX2 = createManagedAuth(testState.userDataDir, 'account-x2', authX) + const homeB = createManagedAuth( + testState.userDataDir, + 'account-b', + createCodexAuthJson('b@example.com', 'acct-b', 'b') + ) + mkdirSync(getRuntimeCodexHomePath(), { recursive: true }) + writeFileSync(runtimeAuthPath, authXRefreshed, 'utf-8') + writeFileSync( + getSharedRuntimeAuthProvenancePath(), + `${JSON.stringify({ owner: 'managed', accountId: 'account-x1' })}\n`, + 'utf-8' + ) + chmodSync(join(homeX1, 'auth.json'), 0o000) + rmSync(join(homeB, 'auth.json'), { force: true }) + const store = createStore( + createSettings({ + codexManagedAccounts: [ + createCodexAccountRecord('account-x1', 'x@example.com', 'acct-x', homeX1), + createCodexAccountRecord('account-x2', 'x@example.com', 'acct-x', homeX2), + createCodexAccountRecord('account-b', 'b@example.com', 'acct-b', homeB) + ], + activeCodexManagedAccountId: 'account-b', + activeCodexManagedAccountIdsByRuntime: { host: 'account-b', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + new CodexRuntimeHomeService(store as never) + + expect(readFileSync(join(homeX2, 'auth.json'), 'utf-8')).toBe(authX) + }) + + it('drops another account from the mirror even when the fence write fails', async () => { + const runtimeAuthPath = getRuntimeCodexAuthPath() + writeFileSync( + getSystemCodexAuthPath(), + createCodexAuthJson('system@example.com', 'acct-system', 'system'), + 'utf-8' + ) + const authA = createCodexAuthJson('a@example.com', 'acct-a', 'a') + const homeA = createManagedAuth(testState.userDataDir, 'account-a', authA) + const homeB = createManagedAuth( + testState.userDataDir, + 'account-b', + createCodexAuthJson('b@example.com', 'acct-b', 'b') + ) + // Stands in for a Windows AV lock on the provenance file: the fence cannot + // be written, while auth.json itself is perfectly deletable. + mkdirSync(getRuntimeCodexHomePath(), { recursive: true }) + writeFileSync(runtimeAuthPath, authA, 'utf-8') + rmSync(getSharedRuntimeAuthProvenancePath(), { force: true }) + mkdirSync(getSharedRuntimeAuthProvenancePath(), { recursive: true }) + rmSync(join(homeB, 'auth.json'), { force: true }) + const store = createStore( + createSettings({ + codexManagedAccounts: [ + createCodexAccountRecord('account-a', 'a@example.com', 'acct-a', homeA), + createCodexAccountRecord('account-b', 'b@example.com', 'acct-b', homeB) + ], + activeCodexManagedAccountId: 'account-b', + activeCodexManagedAccountIdsByRuntime: { host: 'account-b', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + const service = new CodexRuntimeHomeService(store as never) + + expect(service.prepareForCodexLaunch()).toBe(getRuntimeCodexHomePath()) + expect(existsSync(runtimeAuthPath) ? readFileSync(runtimeAuthPath, 'utf-8') : null).not.toBe( + authA + ) + }) + + it('keeps a mirrored api-key credential no identity claim can attribute', async () => { + const runtimeAuthPath = getRuntimeCodexAuthPath() + writeFileSync( + getSystemCodexAuthPath(), + createCodexAuthJson('system@example.com', 'acct-system', 'system'), + 'utf-8' + ) + const apiKeyAuth = `${JSON.stringify({ auth_mode: 'apikey', OPENAI_API_KEY: 'sk-managed' })}\n` + const managedHomePath = createManagedAuth(testState.userDataDir, 'account-1', apiKeyAuth) + // Pre-provenance install, cold start: the mirror holds the selected account's + // own api-key credential — bytes carrying no id_token to identify — while its + // auth.json reads torn mid-rotation. + mkdirSync(getRuntimeCodexHomePath(), { recursive: true }) + writeFileSync(runtimeAuthPath, apiKeyAuth, 'utf-8') + rmSync(getSharedRuntimeAuthProvenancePath(), { force: true }) + writeFileSync(join(managedHomePath, 'auth.json'), '{"OPENAI_API_K', 'utf-8') + const store = createStore( + createSettings({ + codexManagedAccounts: [ + createCodexAccountRecord('account-1', 'user@example.com', 'acct-user', managedHomePath) + ], + activeCodexManagedAccountId: 'account-1', + activeCodexManagedAccountIdsByRuntime: { host: 'account-1', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + new CodexRuntimeHomeService(store as never) + + expect(readFileSync(runtimeAuthPath, 'utf-8')).toBe(apiKeyAuth) + expect(store.getSettings().activeCodexManagedAccountIdsByRuntime?.host).toBe('account-1') + }) + + it('reads a renamed account refresh back into its own home despite a stale record email', async () => { + const runtimeAuthPath = getRuntimeCodexAuthPath() + writeFileSync( + getSystemCodexAuthPath(), + createCodexAuthJson('system@example.com', 'acct-system', 'system'), + 'utf-8' + ) + const authA = createCodexAuthJson('new@example.com', 'acct-a', 'a', 1) + const authARefreshed = createCodexAuthJson('new@example.com', 'acct-a', 'a-refreshed', 2) + const homeA = createManagedAuth(testState.userDataDir, 'account-a', authA) + const homeB = createManagedAuth( + testState.userDataDir, + 'account-b', + createCodexAuthJson('b@example.com', 'acct-b', 'b') + ) + // Account A was renamed on the ChatGPT side after it was added, so its record + // email is stale while the mirrored refresh carries the new one. + writeFileSync(runtimeAuthPath, authARefreshed, 'utf-8') + writeFileSync( + getSharedRuntimeAuthProvenancePath(), + `${JSON.stringify({ owner: 'managed', accountId: 'account-a' })}\n`, + 'utf-8' + ) + rmSync(join(homeB, 'auth.json'), { force: true }) + const store = createStore( + createSettings({ + codexManagedAccounts: [ + createCodexAccountRecord('account-a', 'old@example.com', 'acct-a', homeA), + createCodexAccountRecord('account-b', 'b@example.com', 'acct-b', homeB) + ], + activeCodexManagedAccountId: 'account-b', + activeCodexManagedAccountIdsByRuntime: { host: 'account-b', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + new CodexRuntimeHomeService(store as never) + + expect(readFileSync(join(homeA, 'auth.json'), 'utf-8')).toBe(authARefreshed) + expect(existsSync(runtimeAuthPath)).toBe(false) + }) + + it('keeps the mirror of a renamed account whose record email is stale', async () => { + const runtimeAuthPath = getRuntimeCodexAuthPath() + writeFileSync( + getSystemCodexAuthPath(), + createCodexAuthJson('system@example.com', 'acct-system', 'system'), + 'utf-8' + ) + const renamedAuth = createCodexAuthJson('new@example.com', 'acct-user', 'managed') + const managedHomePath = createManagedAuth(testState.userDataDir, 'account-1', renamedAuth) + // Torn provenance can no longer vouch for the mirror, and the only remaining + // evidence is a credential whose email no longer matches the record. + mkdirSync(getRuntimeCodexHomePath(), { recursive: true }) + writeFileSync(runtimeAuthPath, renamedAuth, 'utf-8') + writeFileSync(getSharedRuntimeAuthProvenancePath(), 'not-json', 'utf-8') + writeFileSync(join(managedHomePath, 'auth.json'), '{"tokens":{"acc', 'utf-8') + const store = createStore( + createSettings({ + codexManagedAccounts: [ + createCodexAccountRecord('account-1', 'old@example.com', 'acct-user', managedHomePath) + ], + activeCodexManagedAccountId: 'account-1', + activeCodexManagedAccountIdsByRuntime: { host: 'account-1', wsl: {} } + }) + ) + vi.spyOn(console, 'warn').mockImplementation(() => {}) + const { CodexRuntimeHomeService } = await import('./runtime-home-service') + new CodexRuntimeHomeService(store as never) + + expect(readFileSync(runtimeAuthPath, 'utf-8')).toBe(renamedAuth) + expect(store.getSettings().activeCodexManagedAccountIdsByRuntime?.host).toBe('account-1') + }) + it('repoints legacy active host CODEX_HOME to the shared runtime home on startup', async () => { const legacyLaunchHomePath = join( testState.userDataDir, diff --git a/src/main/codex-accounts/runtime-home-service.ts b/src/main/codex-accounts/runtime-home-service.ts index fac946c51b2..7ab8f8a9766 100644 --- a/src/main/codex-accounts/runtime-home-service.ts +++ b/src/main/codex-accounts/runtime-home-service.ts @@ -72,6 +72,7 @@ import { hasCustomCodexHomeOverrideForLaunch } from '../codex/codex-real-home-pa import { invalidateCodexSessionBackfillMarker } from '../codex/codex-session-backfill-marker' import { assertOwnedHostCodexManagedHomePath } from './host-codex-managed-home-ownership' import { + codexAuthCouldBelongToManagedAccount, codexAuthIsFresher, codexAuthMatchesManagedAccount, codexAuthMatchesSystemDefaultIdentity @@ -741,11 +742,21 @@ export class CodexRuntimeHomeService { const authAbsence = this.credentialAbsenceGrace.assess(activeAuthPath) if (authAbsence.state !== 'present' && authAbsence.state !== 'incomplete') { if (!authAbsence.durable) { - // Why: mid-rotation reads look missing/unreadable for a moment; skip - // this sync without deselecting and let a settled read decide later. + if (this.sharedRuntimeAuthBelongsToAccount(activeAccount)) { + // Why: mid-rotation reads look missing/unreadable for a moment; skip + // this sync without deselecting and let a settled read decide later. + console.warn( + '[codex-runtime-home] Active managed account auth.json unavailable, keeping selection through grace window' + ) + return + } + // Why: the runtime home still holds another account, so riding out the + // grace would launch that account under this selection. Not being able + // to read the selected account is no license to run a different one. console.warn( - '[codex-runtime-home] Active managed account auth.json unavailable, keeping selection through grace window' + '[codex-runtime-home] Active managed account auth.json unavailable while the runtime home holds another account, clearing runtime auth' ) + this.clearRuntimeAuthForUnprovenSelection() return } console.warn( @@ -920,6 +931,116 @@ export class CodexRuntimeHomeService { } } + // Why: an unreadable managed auth.json says nothing about who the shared + // runtime home currently holds. The credential's own identity claims answer + // that without touching the unreadable home; Orca's write records and its + // provenance file are corroboration, not the only evidence — a torn or fenced + // provenance file is no proof the bytes belong to somebody else. + private sharedRuntimeAuthBelongsToAccount(account: CodexManagedAccount): boolean { + if (!existsSync(this.getRuntimeAuthPath())) { + return true + } + const runtimeAuth = this.readRuntimeAuthForProvenance() + if (runtimeAuth !== null) { + if (codexAuthMatchesManagedAccount(runtimeAuth, account, null)) { + return true + } + // Why: Orca itself mirrored these exact bytes for this account this run. + if (this.lastSyncedAccountId === account.id && this.lastWrittenAuthJson === runtimeAuth) { + return true + } + } + const status = this.resolveSharedRuntimeAuthProvenanceStatus() + if (status.kind === 'committed') { + return status.provenance.owner === 'managed' && status.provenance.accountId === account.id + } + // Why: with no committed record left, only claims that contradict this + // account prove the mirror is somebody else's. Deleting bytes nothing can + // attribute logs the user out over the very absence the grace window covers. + return runtimeAuth !== null && codexAuthCouldBelongToManagedAccount(runtimeAuth, account) + } + + // Why: the absence may still heal, so keep the selection — but leave no other + // identity's credentials behind for the launch. Logged out beats logged in as + // someone else, and fencing stops later syncs adopting the removed bytes. + private clearRuntimeAuthForUnprovenSelection(): void { + const runtimeAuthPath = this.getRuntimeAuthPath() + try { + try { + // Why: a refresh Codex wrote into the mirror belongs to whoever owns + // those bytes; persist it to that owner's home — managed or ~/.codex — + // first, then fence so a delete the OS refuses (Windows AV lock, EBUSY) + // still leaves the surviving bytes marked untrusted. + const readBackResult = this.readBackRefreshedTokensFromPath(runtimeAuthPath, { + updateLastWrittenAuthJson: false + }) + if (readBackResult === 'rejected') { + this.readBackRefreshedSystemDefaultAuth() + } + this.persistSharedRuntimeAuthProvenance({ owner: 'fenced' }) + } finally { + // Why: neither the rescue nor the fence may cancel the delete — leaving + // another identity's credentials for the launch is the defect itself. + this.lastWrittenAuthJson = null + rmSync(runtimeAuthPath, { force: true }) + } + } catch (error) { + // Why: this branch only runs because the filesystem already refused a + // read; a second failure must not throw out of launch preparation. + console.warn('[codex-runtime-home] Failed to clear unproven runtime auth:', error) + } + } + + // Why: a token Codex refreshed inside the mirror has no managed home to fall + // back to when the mirror holds the user's own ~/.codex credential, so persist + // it there before the unproven mirror is dropped. + private readBackRefreshedSystemDefaultAuth(): void { + const runtimeAuth = this.readRuntimeAuthForProvenance() + const systemDefaultAuth = this.readSystemDefaultAuth() + if (runtimeAuth === null || systemDefaultAuth === null || runtimeAuth === systemDefaultAuth) { + return + } + const claim = this.resolveSystemDefaultMirrorClaim( + runtimeAuth, + this.resolveSharedRuntimeAuthProvenanceStatus() + ) + if ( + !claim.ownershipProven || + claim.mirroredAuthJson === null || + systemDefaultAuth !== claim.mirroredAuthJson || + !this.runtimeAuthMatchesSystemDefaultIdentity(runtimeAuth, systemDefaultAuth) + ) { + return + } + this.writeSystemDefaultAuth(runtimeAuth) + this.captureSystemDefaultSnapshot({ force: true }) + } + + // Why: which ~/.codex bytes the mirror was seeded from, and whether the system + // default can be proven to own the mirror at all. + private resolveSystemDefaultMirrorClaim( + runtimeAuth: string, + provenanceStatus: CodexSharedRuntimeAuthProvenanceStatus + ): { ownershipProven: boolean; mirroredAuthJson: string | null } { + const provenance = provenanceStatus.kind === 'committed' ? provenanceStatus.provenance : null + const snapshotAuth = + this.readSystemDefaultSnapshot(this.getSystemDefaultSnapshotPath())?.authJson ?? null + const preProvenanceRuntimeRefreshProven = + provenanceStatus.kind === 'missing' && + snapshotAuth !== null && + this.runtimeAuthMatchesSystemDefaultIdentity(runtimeAuth, snapshotAuth) && + codexAuthIsMonotonicallyFresher(runtimeAuth, snapshotAuth) + return { + ownershipProven: provenance?.owner === 'system-default' || preProvenanceRuntimeRefreshProven, + mirroredAuthJson: + provenance?.owner === 'system-default' + ? provenance.authJson + : provenanceStatus.kind === 'missing' + ? (this.lastWrittenAuthJson ?? snapshotAuth) + : null + } + } + private safeSyncForCurrentSelection(): void { try { this.syncForCurrentSelection() @@ -1234,6 +1355,7 @@ export class CodexRuntimeHomeService { managedAuthPath: string managedAuthContents: string }[] = [] + let unreadableHomeCouldOwnRuntimeAuth = false for (const account of this.store.getSettings().codexManagedAccounts) { if (expectedAccountId && account.id !== expectedAccountId) { continue @@ -1242,12 +1364,30 @@ export class CodexRuntimeHomeService { if (!existsSync(managedAuthPath)) { continue } - const managedAuthContents = readFileSync(managedAuthPath, 'utf-8') + let managedAuthContents: string + try { + managedAuthContents = readFileSync(managedAuthPath, 'utf-8') + } catch { + // Why: an unreadable home can never be compared, but letting the read + // throw abandons the scan for every other account — dropping a refresh + // the runtime home holds for one of them. Only its record can rule it + // out as the owner; when it cannot, the scan is no longer unambiguous. + if ( + !expectedAccountId && + codexAuthCouldBelongToManagedAccount(runtimeAuthContents, account) + ) { + unreadableHomeCouldOwnRuntimeAuth = true + } + continue + } if (codexAuthMatchesManagedAccount(runtimeAuthContents, account, managedAuthContents)) { matches.push({ account, managedAuthPath, managedAuthContents }) } } + if (unreadableHomeCouldOwnRuntimeAuth) { + return { kind: 'ambiguous' } + } if (matches.length === 1) { return { kind: 'matched', ...matches[0] } } @@ -1652,21 +1792,10 @@ export class CodexRuntimeHomeService { }) return } - const snapshot = this.readSystemDefaultSnapshot(this.getSystemDefaultSnapshotPath()) - const snapshotAuth = snapshot?.authJson ?? null - const preProvenanceRuntimeRefreshProven = - provenanceStatus.kind === 'missing' && - snapshotAuth !== null && - this.runtimeAuthMatchesSystemDefaultIdentity(runtimeAuth, snapshotAuth) && - codexAuthIsMonotonicallyFresher(runtimeAuth, snapshotAuth) - const systemDefaultOwnershipProven = - provenance?.owner === 'system-default' || preProvenanceRuntimeRefreshProven - const mirroredSystemDefaultAuth = - provenance?.owner === 'system-default' - ? provenance.authJson - : provenanceStatus.kind === 'missing' - ? (this.lastWrittenAuthJson ?? snapshotAuth) - : null + const { + ownershipProven: systemDefaultOwnershipProven, + mirroredAuthJson: mirroredSystemDefaultAuth + } = this.resolveSystemDefaultMirrorClaim(runtimeAuth, provenanceStatus) if (!existsSync(systemDefaultAuthPath)) { if (mirroredSystemDefaultAuth !== null && runtimeAuth === mirroredSystemDefaultAuth) { this.clearRuntimeAuthAfterSystemDefaultLogout(runtimeAuthPath) From fb1259a09d3e352899f8287ca73865b8d0b3d361 Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:26:02 -0700 Subject: [PATCH 24/72] fix(mobile): keep cached workspace counts across a transient RPC failure (#12408) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(mobile): keep cached workspace counts across a transient RPC failure The Home host card showed "12 worktrees · 2 active" until any worktree.ps failed — a backgrounded app, a Wi-Fi→cellular handoff, or a sleep/resume that kills the socket mid-request. Two things then went wrong: - render dropped the counts: `markHomeWorktreeCatalogUnavailable` kept the proven numbers in state, but the card only rendered them when `catalogUnavailable` was unset, so the line collapsed to "Worktree list unavailable" even though the last successful counts were right there. - nothing re-drove the fetch: the per-host wiring latched a `statsFetched` boolean on the first connect, and the logical client survives socket drops, so its reconnect never re-read the catalog. The card stayed wrong until the user navigated away and back. Keep the proven counts and flag them stale (`staleCounts`), rendered as "Last known: 12 worktrees · 2 active"; a host whose catalog never loaded still reads "Worktree list unavailable" (STA-3123). Replace the one-shot latch with createHostConnectRefetchGate, which fires on each transition INTO 'connected' — one refetch per reconnect, no polling timer — mirroring useWorktreeResync on the host screen. fetchHomeHostWorktreeInfo moves out of app/index.tsx so its rejection path is covered by tests. * fix(mobile): bound "Last known" counts and survive a path cutover Review found two ways the home host card's stale-count fix misbehaves. 1. A migrateTo cutover (relay->direct probe, forced replacement) rejects in-flight requests with LogicalClientCutoverError and republishes 'connected' from 'connected', so the connect gate never re-arms and the card latched on "Last known: ..." with nothing left to clear it. worktree.ps now re-issues on the authenticated replacement, bounded, like runtime-capability-probe and worktree-create-retry already do. 2. "Last known: N worktrees" had no age bound. The home snapshot is persisted, so a cold start whose first worktree.ps failed rendered counts proven days ago exactly like counts proven seconds ago - the case STA-3123 deliberately rendered as "Worktree list unavailable". Counts now carry countsProvenAt and expire out of the "last known" wording after 10 minutes; counts persisted by an older build count as expired. Also, per review: the card derives its own worktree line from HostWorktreeInfo, so a caller can no longer re-gate the counts away (that was the original defect), and the derivation is covered by a render test - mobile/vitest.config.ts never collected *.test.tsx, so component tests were silently dead. Home stats are keyed by host and summed instead of letting whichever desktop replied last overwrite the shared header row, which the per-reconnect refetch made churn on flaky links. * fix(mobile): age bounds liveness, not the counts; scope the header total to paired hosts Round-2 review follow-up. Age bound was anchored on proof time inside the failure branch only, so a session connected past the window that then hit one failed refresh rendered the pre-fix "Worktree list unavailable" — the exact case this PR exists for — while identically aged counts still rendered unlabeled as live whenever the refresh was merely pending. Age now decides live vs "Last known" and the failure branch keeps whatever the host last proved; "Worktree list unavailable" is reserved for a catalog that never loaded. Header stats summed every entry ever cached, so removing a desktop left its lifetime numbers in the total for the rest of the session. totalHomeStats now sums the hosts still paired, which also covers removal from the host screen. wireHostSubscriptions is the effect body moved verbatim out of useEffect; react-doctor's effect-needs-cleanup false-positives on `subscribe` inside one and the changed-code gate has no working suppression path (an inline directive reads as unused to the plugin-less scan). --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- mobile/app/index.tsx | 200 ++++++--------- mobile/src/cache/home-snapshot-cache.ts | 19 +- mobile/src/components/MobileHostCard.test.tsx | 93 +++++++ mobile/src/components/MobileHostCard.tsx | 14 +- mobile/src/stats/home-stats-total.test.ts | 81 ++++++ mobile/src/stats/home-stats-total.ts | 51 ++++ .../host-connect-refetch-gate.test.ts | 28 +++ .../transport/host-connect-refetch-gate.ts | 18 ++ .../worktree/home-host-worktree-fetch.test.ts | 236 ++++++++++++++++++ .../src/worktree/home-host-worktree-fetch.ts | 79 ++++++ .../src/worktree/home-worktree-info.test.ts | 80 +++++- mobile/src/worktree/home-worktree-info.ts | 42 +++- mobile/vitest.config.ts | 4 +- 13 files changed, 791 insertions(+), 154 deletions(-) create mode 100644 mobile/src/components/MobileHostCard.test.tsx create mode 100644 mobile/src/stats/home-stats-total.test.ts create mode 100644 mobile/src/stats/home-stats-total.ts create mode 100644 mobile/src/transport/host-connect-refetch-gate.test.ts create mode 100644 mobile/src/transport/host-connect-refetch-gate.ts create mode 100644 mobile/src/worktree/home-host-worktree-fetch.test.ts create mode 100644 mobile/src/worktree/home-host-worktree-fetch.ts diff --git a/mobile/app/index.tsx b/mobile/app/index.tsx index 907f50ed974..57532a4a8ae 100644 --- a/mobile/app/index.tsx +++ b/mobile/app/index.tsx @@ -18,14 +18,11 @@ import AsyncStorage from '@react-native-async-storage/async-storage' import { loadHosts } from '../src/transport/host-store' import { navigateToMobileHostEdit } from '../src/transport/host-edit-navigation' import { removeHostAndCloseClient } from '../src/transport/host-removal-lifecycle' -import { pickResumeWorktree } from '../src/worktree/resume-worktree' -import { WORKTREE_PS_FULL_LIMIT } from '../src/worktree/worktree-catalog-snapshot-client' -import { - markHomeWorktreeCatalogUnavailable, - type HomeWorktreeSummary, - type HostWorktreeInfo -} from '../src/worktree/home-worktree-info' +import { fetchHomeHostWorktreeInfo } from '../src/worktree/home-host-worktree-fetch' +import { totalHomeStats, type HomeStatsSummary } from '../src/stats/home-stats-total' +import type { HomeWorktreeSummary, HostWorktreeInfo } from '../src/worktree/home-worktree-info' import type { RpcClient } from '../src/transport/rpc-client' +import { createHostConnectRefetchGate } from '../src/transport/host-connect-refetch-gate' import { sendSingleFlightRequest } from '../src/transport/request-single-flight' import { useAllHostClients, @@ -68,13 +65,6 @@ function endpointLabel(endpoint: string): string { } } -type StatsSummary = { - totalAgentsSpawned: number - totalPRsCreated: number - totalAgentTimeMs: number - firstEventAt: number | null -} - type HomeTaskSettings = { visibleTaskProviders?: unknown } @@ -123,7 +113,9 @@ function clientKey(client: RpcClient): number { function fetchStats( client: RpcClient, hostId: string, - setStats: (s: StatsSummary) => void, + setStats: ( + updater: (prev: Record) => Record + ) => void, disposed: () => boolean ) { sendSingleFlightRequest(client, hostId, 'stats.summary') @@ -132,61 +124,13 @@ function fetchStats( return } if (response.ok) { - setStats(response.result as StatsSummary) + // Keyed by host: the header totals every desktop instead of showing whoever replied last. + setStats((prev) => ({ ...prev, [hostId]: response.result as HomeStatsSummary })) } }) .catch(() => {}) } -function fetchWorktreeInfo( - client: RpcClient, - hostId: string, - setInfo: ( - updater: (prev: Record) => Record - ) => void, - disposed: () => boolean -) { - const markUnavailable = () => { - setInfo((prev) => { - const current = prev[hostId] - const next = markHomeWorktreeCatalogUnavailable(current, hostId) - return next === current ? prev : { ...prev, [hostId]: next } - }) - } - - sendSingleFlightRequest(client, hostId, 'worktree.ps', { limit: WORKTREE_PS_FULL_LIMIT }) - .then((response) => { - if (disposed()) { - return - } - if (response.ok) { - const result = response.result as { worktrees: HomeWorktreeSummary[] } - const worktrees = result.worktrees ?? [] - setCachedWorktrees(hostId, worktrees) - const activeStatuses = new Set(['working', 'active', 'permission']) - const active = worktrees.filter((w) => w.status && activeStatuses.has(w.status)) - // Mirror the desktop's focused workspace (see pickResumeWorktree). - const lastActive = pickResumeWorktree(worktrees) - setInfo((prev) => ({ - ...prev, - [hostId]: { - hostId, - totalWorktrees: worktrees.length, - activeCount: active.length, - lastActiveWorktree: lastActive - } - })) - } else { - markUnavailable() - } - }) - .catch(() => { - if (!disposed()) { - markUnavailable() - } - }) -} - function fetchAccountsSnapshot( client: RpcClient, hostId: string, @@ -272,7 +216,7 @@ export default function HomeScreen() { const [hostStates, setHostStates] = useState>({}) const [hostAttempts, setHostAttempts] = useState>({}) const [hostLastConnected, setHostLastConnected] = useState>({}) - const [stats, setStats] = useState(null) + const [statsByHost, setStatsByHost] = useState>({}) const [worktreeInfo, setWorktreeInfo] = useState>({}) const [accountsByHost, setAccountsByHost] = useState>({}) const [taskProvidersByHost, setTaskProvidersByHost] = useState>({}) @@ -285,6 +229,8 @@ export default function HomeScreen() { // Why: shared clients from the per-host store, not N independent WebSockets. See docs/mobile-shared-client-per-host.md. const hostIds = useMemo(() => hosts.map((h) => h.id), [hosts]) + // Why: scoped to the paired hosts so an unpaired desktop's cached reply leaves the header total. + const stats = useMemo(() => totalHomeStats(statsByHost, hostIds), [statsByHost, hostIds]) const allClients = useAllHostClients(hostIds) const hostPaths = useMemo( () => Object.fromEntries(allClients.map(({ hostId, path }) => [hostId, path])), @@ -375,8 +321,8 @@ export default function HomeScreen() { }) for (const entry of allClientsRef.current) { if (entry.client.getState() === 'connected') { - fetchStats(entry.client, entry.hostId, setStats, () => stale) - fetchWorktreeInfo(entry.client, entry.hostId, setWorktreeInfo, () => stale) + fetchStats(entry.client, entry.hostId, setStatsByHost, () => stale) + void fetchHomeHostWorktreeInfo(entry.client, entry.hostId, setWorktreeInfo, () => stale) fetchAccountsSnapshot(entry.client, entry.hostId, setAccountsByHost, () => stale) fetchTaskProviders(entry.client, entry.hostId, setTaskProvidersByHost, () => stale) } @@ -457,60 +403,70 @@ export default function HomeScreen() { }) }, [allClients, hosts]) - // Per-host notif/accounts subs + one-shot stats on 'connected'; re-runs per (hostId, client) pair, socket stays open so it's cheap. - useEffect(() => { - const cleanups: Array<() => void> = [] - for (const entry of allClients) { - let unsubNotif: (() => void) | null = null - let unsubAccounts: (() => void) | null = null - let statsFetched = false - const wireUp = (state: ConnectionState) => { - if (state === 'connected') { - if (!unsubNotif) { - unsubNotif = subscribeToDesktopNotifications(entry.client, entry.hostId) - } - if (!unsubAccounts) { - unsubAccounts = entry.client.subscribe('accounts.subscribe', null, (payload) => { - if (!payload || typeof payload !== 'object') { - return + // Notif/accounts subs + a snapshot read per connect for one host. Lives outside the effect body + // because react-doctor's effect-needs-cleanup false-positives on `subscribe` inside one; the + // returned disposer owns every handle allocated here. + const wireHostSubscriptions = (entry: { + hostId: string + client: RpcClient + state: ConnectionState + }) => { + let unsubNotif: (() => void) | null = null + let unsubAccounts: (() => void) | null = null + const refetchGate = createHostConnectRefetchGate() + const wireUp = (state: ConnectionState) => { + const reconnected = refetchGate.observe(state) + if (state === 'connected') { + if (!unsubNotif) { + unsubNotif = subscribeToDesktopNotifications(entry.client, entry.hostId) + } + if (!unsubAccounts) { + unsubAccounts = entry.client.subscribe('accounts.subscribe', null, (payload) => { + if (!payload || typeof payload !== 'object') { + return + } + const evt = payload as { type?: string; snapshot?: unknown } + if (evt.type === 'ready' || evt.type === 'snapshot') { + try { + const snapshot = decodeAccountsSnapshot(evt.snapshot) + setAccountsByHost((prev) => ({ ...prev, [entry.hostId]: snapshot })) + } catch { + // Keep the last proven snapshot; malformed remote data must + // not enter render state or crash the home host cards. } - const evt = payload as { type?: string; snapshot?: unknown } - if (evt.type === 'ready' || evt.type === 'snapshot') { - try { - const snapshot = decodeAccountsSnapshot(evt.snapshot) - setAccountsByHost((prev) => ({ ...prev, [entry.hostId]: snapshot })) - } catch { - // Keep the last proven snapshot; malformed remote data must - // not enter render state or crash the home host cards. - } - } - }) - } - if (!statsFetched) { - statsFetched = true - fetchStats(entry.client, entry.hostId, setStats, () => false) - fetchWorktreeInfo(entry.client, entry.hostId, setWorktreeInfo, () => false) - fetchTaskProviders(entry.client, entry.hostId, setTaskProvidersByHost, () => false) - } - } else { - if (unsubNotif) { - unsubNotif() - unsubNotif = null - } - if (unsubAccounts) { - unsubAccounts() - unsubAccounts = null - } + } + }) + } + // Why: the socket survives backgrounding/handoffs by reconnecting, so re-read the host + // snapshot on every reconnect — a one-shot latch left the card on stale data forever. + if (reconnected) { + fetchStats(entry.client, entry.hostId, setStatsByHost, () => false) + void fetchHomeHostWorktreeInfo(entry.client, entry.hostId, setWorktreeInfo, () => false) + fetchTaskProviders(entry.client, entry.hostId, setTaskProvidersByHost, () => false) + } + } else { + if (unsubNotif) { + unsubNotif() + unsubNotif = null + } + if (unsubAccounts) { + unsubAccounts() + unsubAccounts = null } } - wireUp(entry.state) - const unsubState = entry.client.onStateChange(wireUp) - cleanups.push(() => { - unsubState() - unsubNotif?.() - unsubAccounts?.() - }) } + wireUp(entry.state) + const unsubState = entry.client.onStateChange(wireUp) + return () => { + unsubState() + unsubNotif?.() + unsubAccounts?.() + } + } + + // Re-runs per (hostId, client) pair; the socket stays open so it's cheap. + useEffect(() => { + const cleanups = allClients.map((entry) => wireHostSubscriptions(entry)) return () => { for (const c of cleanups) { c() @@ -750,7 +706,6 @@ export default function HomeScreen() { const state = hostStates[item.id] ?? 'connecting' const attempts = hostAttempts[item.id] ?? 0 const lastConnectedAt = hostLastConnected[item.id] ?? null - const info = worktreeInfo[item.id] const verdict = classifyConnection({ state, reconnectAttempts: attempts, @@ -763,12 +718,7 @@ export default function HomeScreen() { state={state} verdict={verdict} path={hostPaths[item.id] ?? 'lan'} - worktreeCounts={ - info && !info.catalogUnavailable - ? { total: info.totalWorktrees, active: info.activeCount } - : undefined - } - worktreeCountsUnavailable={info?.catalogUnavailable === true} + worktreeInfo={worktreeInfo[item.id]} onPress={() => router.push(`/h/${item.id}`)} onLongPress={() => { triggerMediumImpact() diff --git a/mobile/src/cache/home-snapshot-cache.ts b/mobile/src/cache/home-snapshot-cache.ts index a591bb01d70..bbda033735e 100644 --- a/mobile/src/cache/home-snapshot-cache.ts +++ b/mobile/src/cache/home-snapshot-cache.ts @@ -5,25 +5,12 @@ // WebSocket reconnects and the first responses come back. import AsyncStorage from '@react-native-async-storage/async-storage' import type { AccountsSnapshot } from '../components/AccountUsage' +// Why: the canonical shape, so persisted counts keep carrying countsProvenAt — the home card +// needs it to know whether a rehydrated count is minutes or days old. +import type { HostWorktreeInfo } from '../worktree/home-worktree-info' const STORAGE_KEY = 'orca:home-snapshot:v1' -type WorktreeSummary = { - worktreeId: string - repo: string - branch: string - displayName: string - liveTerminalCount: number - status?: 'working' | 'active' | 'permission' | 'done' | 'inactive' -} - -type HostWorktreeInfo = { - hostId: string - totalWorktrees: number - activeCount: number - lastActiveWorktree: WorktreeSummary | null -} - export type HomeSnapshot = { worktreeInfo: Record accountsByHost: Record diff --git a/mobile/src/components/MobileHostCard.test.tsx b/mobile/src/components/MobileHostCard.test.tsx new file mode 100644 index 00000000000..a1889793982 --- /dev/null +++ b/mobile/src/components/MobileHostCard.test.tsx @@ -0,0 +1,93 @@ +import { createElement } from 'react' +import { act, create, type ReactTestRenderer } from 'react-test-renderer' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import type { ConnectionVerdict } from '../transport/connection-health' +import type { HostProfile } from '../transport/types' +import { + markHomeWorktreeCatalogUnavailable, + type HostWorktreeInfo +} from '../worktree/home-worktree-info' +import { MobileHostCard } from './MobileHostCard' + +vi.mock('react-native', () => ({ + Pressable: 'Pressable', + StyleSheet: { create: (styles: T) => styles }, + Text: 'Text', + View: 'View' +})) +vi.mock('lucide-react-native', () => ({ ChevronRight: 'ChevronRight', Monitor: 'Monitor' })) +vi.mock('./StatusDot', () => ({ StatusDot: 'StatusDot' })) + +const host: HostProfile = { + id: 'host-1', + name: 'Studio', + endpoint: 'ws://studio.local:8765', + deviceToken: 'token', + publicKeyB64: 'key', + lastConnected: 0 +} +const verdict: ConnectionVerdict = { kind: 'normal', label: 'Connected' } +const loaded: HostWorktreeInfo = { + hostId: 'host-1', + totalWorktrees: 12, + activeCount: 2, + lastActiveWorktree: null, + countsProvenAt: Date.now() +} + +describe('MobileHostCard', () => { + let renderer: ReactTestRenderer | null = null + + beforeEach(() => { + globalThis.IS_REACT_ACT_ENVIRONMENT = true + }) + + afterEach(() => { + act(() => renderer?.unmount()) + renderer = null + }) + + async function renderCard(worktreeInfo: HostWorktreeInfo | undefined): Promise { + await act(async () => { + renderer = create( + createElement(MobileHostCard, { + host, + state: 'connected', + verdict, + path: 'lan', + worktreeInfo, + onPress: () => {}, + onLongPress: () => {} + }) + ) + }) + return renderer!.root + .findAllByType('Text') + .flatMap((node) => node.children.filter((child) => typeof child === 'string')) + } + + it('renders the counts the host proved', async () => { + expect(await renderCard(loaded)).toContain('12 worktrees · 2 active') + }) + + it('keeps rendering the last proven counts after a failed refresh', async () => { + // The regression this card shipped once: the caller dropped the counts the + // failure path deliberately preserved. + expect(await renderCard(markHomeWorktreeCatalogUnavailable(loaded, 'host-1'))).toContain( + 'Last known: 12 worktrees · 2 active' + ) + }) + + it('never asserts a count for a catalog that failed with nothing proven', async () => { + expect(await renderCard(markHomeWorktreeCatalogUnavailable(undefined, 'host-1'))).toContain( + 'Worktree list unavailable' + ) + }) + + it('shows no worktree line before the first read lands', async () => { + const lines = await renderCard(undefined) + + expect(lines).not.toContain('0 worktrees') + expect(lines).not.toContain('Worktree list unavailable') + }) +}) diff --git a/mobile/src/components/MobileHostCard.tsx b/mobile/src/components/MobileHostCard.tsx index 4e466922f4a..79a58bf760e 100644 --- a/mobile/src/components/MobileHostCard.tsx +++ b/mobile/src/components/MobileHostCard.tsx @@ -6,6 +6,7 @@ import { mobileConnectionPathLabel } from '../transport/mobile-connection-path-l import type { MobileConnectionPath } from '../transport/stable-logical-rpc-client' import type { ConnectionState, HostProfile } from '../transport/types' import { colors, radii, spacing } from '../theme/mobile-theme' +import { homeHostWorktreeSummary, type HostWorktreeInfo } from '../worktree/home-worktree-info' import { StatusDot } from './StatusDot' export function MobileHostCard(props: { @@ -13,20 +14,15 @@ export function MobileHostCard(props: { state: ConnectionState verdict: ConnectionVerdict path: MobileConnectionPath - worktreeCounts?: { total: number; active: number } - // Why (STA-3123): the host is connected but its worktree catalog request failed, - // so the card must say "unavailable" instead of asserting a count of zero. - worktreeCountsUnavailable?: boolean + // Why: the card owns the fresh/stale/unavailable wording so no caller can re-gate the counts + // away (STA-3123 shipped that bug once already). + worktreeInfo?: HostWorktreeInfo onPress: () => void onLongPress: () => void }) { const connected = props.state === 'connected' const isError = ['warning', 'unreachable', 'auth-failed'].includes(props.verdict.kind) - const worktreeSummary = props.worktreeCounts - ? `${props.worktreeCounts.total} worktree${props.worktreeCounts.total === 1 ? '' : 's'}${props.worktreeCounts.active > 0 ? ` · ${props.worktreeCounts.active} active` : ''}` - : props.worktreeCountsUnavailable - ? 'Worktree list unavailable' - : null + const worktreeSummary = homeHostWorktreeSummary(props.worktreeInfo) return ( [styles.card, pressed && styles.cardPressed]} diff --git a/mobile/src/stats/home-stats-total.test.ts b/mobile/src/stats/home-stats-total.test.ts new file mode 100644 index 00000000000..035f6c7476f --- /dev/null +++ b/mobile/src/stats/home-stats-total.test.ts @@ -0,0 +1,81 @@ +import { describe, expect, it } from 'vitest' +import { totalHomeStats, type HomeStatsSummary } from './home-stats-total' + +function stats(overrides: Partial = {}): HomeStatsSummary { + return { + totalAgentsSpawned: 10, + totalPRsCreated: 2, + totalAgentTimeMs: 60_000, + firstEventAt: 1_700_000_000_000, + ...overrides + } +} + +describe('totalHomeStats', () => { + it('has nothing to show before any host answers', () => { + expect(totalHomeStats({}, ['host-1'])).toBeNull() + }) + + it('passes a single host through unchanged', () => { + expect(totalHomeStats({ 'host-1': stats() }, ['host-1'])).toEqual(stats()) + }) + + it('sums every desktop instead of letting the last reply win', () => { + const total = totalHomeStats( + { + 'host-1': stats(), + 'host-2': stats({ totalAgentsSpawned: 5, totalPRsCreated: 1, totalAgentTimeMs: 30_000 }) + }, + ['host-1', 'host-2'] + ) + + expect(total).toMatchObject({ + totalAgentsSpawned: 15, + totalPRsCreated: 3, + totalAgentTimeMs: 90_000 + }) + }) + + it('drops a removed desktop from the total', () => { + // Replies are cached for the life of the process, so the entry outlives the pairing. + const byHost = { + 'host-1': stats(), + 'host-2': stats({ totalAgentsSpawned: 5, totalPRsCreated: 1, totalAgentTimeMs: 30_000 }) + } + + expect(totalHomeStats(byHost, ['host-1'])).toEqual(stats()) + expect(totalHomeStats(byHost, [])).toBeNull() + }) + + it('keeps the earliest known first event', () => { + const total = totalHomeStats( + { + 'host-1': stats({ firstEventAt: 2_000 }), + 'host-2': stats({ firstEventAt: null }), + 'host-3': stats({ firstEventAt: 1_000 }) + }, + ['host-1', 'host-2', 'host-3'] + ) + + expect(total?.firstEventAt).toBe(1_000) + }) + + it('reports no first event when no host has one', () => { + expect( + totalHomeStats({ 'host-1': stats({ firstEventAt: null }) }, ['host-1'])?.firstEventAt + ).toBeNull() + }) + + it('ignores a malformed reply instead of poisoning the header', () => { + const total = totalHomeStats( + { + 'host-1': stats(), + 'host-2': null as unknown as HomeStatsSummary, + 'host-3': { totalAgentsSpawned: 'lots' } as unknown as HomeStatsSummary + }, + ['host-1', 'host-2', 'host-3'] + ) + + expect(total).toEqual(stats()) + }) +}) diff --git a/mobile/src/stats/home-stats-total.ts b/mobile/src/stats/home-stats-total.ts new file mode 100644 index 00000000000..72264872561 --- /dev/null +++ b/mobile/src/stats/home-stats-total.ts @@ -0,0 +1,51 @@ +export type HomeStatsSummary = { + totalAgentsSpawned: number + totalPRsCreated: number + totalAgentTimeMs: number + firstEventAt: number | null +} + +/** + * Why: the home header shows one lifetime-usage row for every paired desktop. Each host answers + * stats.summary for itself, so a single shared slot made the row flip to whichever host replied + * last — visible churn now that every reconnect re-reads. Sum instead; one host still totals itself. + * + * Summing only `hostIds` keeps an unpaired desktop out of the total: replies are cached per host + * for the life of the process, so an entry outlives the host it describes. + */ +export function totalHomeStats( + byHost: Record, + hostIds: readonly string[] +): HomeStatsSummary | null { + const hosts = hostIds.filter((id) => id in byHost).map((id) => byHost[id]) + if (hosts.length === 0) { + return null + } + const total: HomeStatsSummary = { + totalAgentsSpawned: 0, + totalPRsCreated: 0, + totalAgentTimeMs: 0, + firstEventAt: null + } + for (const host of hosts) { + // The rows come straight off the wire unvalidated; a malformed desktop reply must not + // NaN out or crash the header for every other host. + if (!host || typeof host !== 'object') { + continue + } + total.totalAgentsSpawned += finiteOrZero(host.totalAgentsSpawned) + total.totalPRsCreated += finiteOrZero(host.totalPRsCreated) + total.totalAgentTimeMs += finiteOrZero(host.totalAgentTimeMs) + if (typeof host.firstEventAt === 'number' && Number.isFinite(host.firstEventAt)) { + total.firstEventAt = + total.firstEventAt === null + ? host.firstEventAt + : Math.min(total.firstEventAt, host.firstEventAt) + } + } + return total +} + +function finiteOrZero(value: number): number { + return typeof value === 'number' && Number.isFinite(value) ? value : 0 +} diff --git a/mobile/src/transport/host-connect-refetch-gate.test.ts b/mobile/src/transport/host-connect-refetch-gate.test.ts new file mode 100644 index 00000000000..17b3d68ae24 --- /dev/null +++ b/mobile/src/transport/host-connect-refetch-gate.test.ts @@ -0,0 +1,28 @@ +import { describe, expect, it } from 'vitest' +import { createHostConnectRefetchGate } from './host-connect-refetch-gate' +import type { ConnectionState } from './types' + +function refetchesFor(states: ConnectionState[]): number { + const gate = createHostConnectRefetchGate() + return states.filter((state) => gate.observe(state)).length +} + +describe('createHostConnectRefetchGate', () => { + it('fetches once on the first connect', () => { + expect(refetchesFor(['connecting', 'handshaking', 'connected'])).toBe(1) + }) + + it('fetches again after a dropped socket comes back', () => { + expect( + refetchesFor(['connected', 'reconnecting', 'connecting', 'handshaking', 'connected']) + ).toBe(2) + }) + + it('does not storm while the connection holds', () => { + expect(refetchesFor(['connected', 'connected', 'connected'])).toBe(1) + }) + + it('never fetches while the host stays down', () => { + expect(refetchesFor(['connecting', 'disconnected', 'reconnecting', 'auth-failed'])).toBe(0) + }) +}) diff --git a/mobile/src/transport/host-connect-refetch-gate.ts b/mobile/src/transport/host-connect-refetch-gate.ts new file mode 100644 index 00000000000..4ce2ba885fc --- /dev/null +++ b/mobile/src/transport/host-connect-refetch-gate.ts @@ -0,0 +1,18 @@ +import type { ConnectionState } from './types' + +// Why: a logical client survives socket drops, so screens that fetch once per client latched +// after the first connect and never refreshed after a background/handoff reconnect. Gate the +// refetch on the transition INTO 'connected' — one read per reconnect, no polling timer. +export function createHostConnectRefetchGate(): { + observe: (state: ConnectionState) => boolean +} { + let connected = false + return { + observe(state) { + const nowConnected = state === 'connected' + const crossedIntoConnected = nowConnected && !connected + connected = nowConnected + return crossedIntoConnected + } + } +} diff --git a/mobile/src/worktree/home-host-worktree-fetch.test.ts b/mobile/src/worktree/home-host-worktree-fetch.test.ts new file mode 100644 index 00000000000..5799de96366 --- /dev/null +++ b/mobile/src/worktree/home-host-worktree-fetch.test.ts @@ -0,0 +1,236 @@ +import { describe, expect, it } from 'vitest' +import { createHostConnectRefetchGate } from '../transport/host-connect-refetch-gate' +import type { RpcClient } from '../transport/rpc-client' +import { + createStableLogicalRpcClient, + LogicalClientCutoverError +} from '../transport/stable-logical-rpc-client' +import type { ConnectionState, RpcResponse } from '../transport/types' +import { fetchHomeHostWorktreeInfo } from './home-host-worktree-fetch' +import type { HostWorktreeInfo } from './home-worktree-info' + +type FakeSession = { + client: RpcClient + calls: number + settle: (response: RpcResponse | Error) => void +} + +function fakeSession(): FakeSession { + const pending: Array<(response: RpcResponse | Error) => void> = [] + const fake: FakeSession = { + calls: 0, + settle(response: RpcResponse | Error) { + const next = pending.shift() + next?.(response) + }, + client: { + sendRequest: () => { + fake.calls += 1 + return new Promise((resolve, reject) => { + pending.push((response) => + response instanceof Error ? reject(response) : resolve(response) + ) + }) + }, + subscribe: () => () => {}, + updateTerminalSubscriptionViewport: () => {}, + getState: (): ConnectionState => 'connected', + getReconnectAttempt: () => 0, + getLastConnectedAt: () => null, + onStateChange: () => () => {}, + notifyForeground: () => {}, + close: () => {} + } + } + return fake +} + +// Drains the promise chain so a retry queued in a .catch has reached the transport. +const flush = () => new Promise((resolve) => setTimeout(resolve, 0)) + +function catalogResponse(count: number, active: number): RpcResponse { + const worktrees = Array.from({ length: count }, (_, index) => ({ + worktreeId: `wt-${index}`, + repo: 'orca', + branch: `branch-${index}`, + displayName: `Workspace ${index}`, + liveTerminalCount: 0, + status: index < active ? ('working' as const) : ('done' as const) + })) + return { ok: true, result: { worktrees } } as RpcResponse +} + +function infoStore() { + let state: Record = {} + return { + get current() { + return state + }, + setInfo(updater: (prev: Record) => Record) { + state = updater(state) + } + } +} + +const notDisposed = () => false + +describe('fetchHomeHostWorktreeInfo', () => { + it('keeps the last proven counts when the in-flight read rejects', async () => { + const store = infoStore() + const host = fakeSession() + + const loaded = fetchHomeHostWorktreeInfo(host.client, 'host-1', store.setInfo, notDisposed) + host.settle(catalogResponse(12, 2)) + await loaded + + const failed = fetchHomeHostWorktreeInfo(host.client, 'host-1', store.setInfo, notDisposed) + host.settle(new Error('socket closed mid-request')) + await failed + + expect(store.current['host-1']).toEqual({ + hostId: 'host-1', + totalWorktrees: 12, + activeCount: 2, + lastActiveWorktree: expect.objectContaining({ worktreeId: 'wt-0' }), + catalogUnavailable: true, + staleCounts: true, + // Age-stamped so the card can stop calling day-old counts "last known". + countsProvenAt: expect.any(Number) + }) + }) + + it('stamps when the host proved the counts', async () => { + const store = infoStore() + const host = fakeSession() + const before = Date.now() + + const loaded = fetchHomeHostWorktreeInfo(host.client, 'host-1', store.setInfo, notDisposed) + host.settle(catalogResponse(3, 1)) + await loaded + + const provenAt = store.current['host-1'].countsProvenAt + expect(provenAt).toBeGreaterThanOrEqual(before) + expect(provenAt).toBeLessThanOrEqual(Date.now()) + }) + + it('marks a host whose catalog never loaded as unavailable, not empty', async () => { + const store = infoStore() + const host = fakeSession() + + const failed = fetchHomeHostWorktreeInfo(host.client, 'host-1', store.setInfo, notDisposed) + host.settle({ ok: false, error: { code: 'internal' } } as RpcResponse) + await failed + + expect(store.current['host-1']).toMatchObject({ + totalWorktrees: 0, + catalogUnavailable: true + }) + expect(store.current['host-1'].staleCounts).toBeUndefined() + }) + + it('re-reads the catalog on reconnect and clears the stale flag', async () => { + const store = infoStore() + const host = fakeSession() + const gate = createHostConnectRefetchGate() + + const connect = async (response: RpcResponse | Error) => { + if (!gate.observe('connected')) { + return + } + const done = fetchHomeHostWorktreeInfo(host.client, 'host-1', store.setInfo, notDisposed) + host.settle(response) + await done + } + + await connect(catalogResponse(12, 2)) + // Socket dies mid-poll: counts survive, flagged stale. + const dropped = fetchHomeHostWorktreeInfo(host.client, 'host-1', store.setInfo, notDisposed) + host.settle(new Error('socket closed mid-request')) + await dropped + gate.observe('reconnecting') + expect(store.current['host-1'].staleCounts).toBe(true) + + await connect(catalogResponse(13, 3)) + + expect(store.current['host-1']).toMatchObject({ + totalWorktrees: 13, + activeCount: 3 + }) + expect(store.current['host-1'].staleCounts).toBeUndefined() + expect(store.current['host-1'].catalogUnavailable).toBeUndefined() + // Two connects + the dropped poll: the gate must not re-read while the link holds. + expect(host.calls).toBe(3) + await connect(catalogResponse(13, 3)) + expect(host.calls).toBe(3) + }) + + it('re-reads through a relay→direct cutover, which never leaves connected', async () => { + const store = infoStore() + const relay = fakeSession() + const direct = fakeSession() + const logical = createStableLogicalRpcClient(relay.client, 'relay') + const gate = createHostConnectRefetchGate() + const gateFires: ConnectionState[] = [] + logical.onStateChange((state) => { + if (gate.observe(state)) { + gateFires.push(state) + } + }) + gate.observe(logical.getState()) + + const loaded = fetchHomeHostWorktreeInfo(logical, 'host-1', store.setInfo, notDisposed) + relay.settle(catalogResponse(12, 2)) + await loaded + + // The supervisor's direct probe migrates while a refresh is on the wire. + const interrupted = fetchHomeHostWorktreeInfo(logical, 'host-1', store.setInfo, notDisposed) + await logical.migrateTo(direct.client, 'lan') + await flush() + + expect(direct.calls).toBe(1) + direct.settle(catalogResponse(13, 3)) + await interrupted + + // The gate can't cover this: migrateTo republishes 'connected' from 'connected'. + expect(gateFires).toEqual([]) + expect(store.current['host-1']).toMatchObject({ totalWorktrees: 13, activeCount: 3 }) + expect(store.current['host-1'].staleCounts).toBeUndefined() + expect(store.current['host-1'].catalogUnavailable).toBeUndefined() + }) + + it('gives up on a host that keeps cutting over so the card still reports the failure', async () => { + const store = infoStore() + const host = fakeSession() + + const loaded = fetchHomeHostWorktreeInfo(host.client, 'host-1', store.setInfo, notDisposed) + host.settle(catalogResponse(12, 2)) + await loaded + + const cutoverStorm = fetchHomeHostWorktreeInfo( + host.client, + 'host-1', + store.setInfo, + notDisposed + ) + for (let attempt = 0; attempt < 6; attempt += 1) { + host.settle(new LogicalClientCutoverError()) + await flush() + } + await cutoverStorm + + // 1 original + CUTOVER_RETRY_LIMIT retries, then the failure is surfaced. + expect(host.calls).toBe(4) + expect(store.current['host-1'].staleCounts).toBe(true) + }) + + it('ignores a response that lands after the screen is disposed', async () => { + const store = infoStore() + const host = fakeSession() + + const done = fetchHomeHostWorktreeInfo(host.client, 'host-1', store.setInfo, () => true) + host.settle(new Error('socket closed mid-request')) + await done + + expect(store.current['host-1']).toBeUndefined() + }) +}) diff --git a/mobile/src/worktree/home-host-worktree-fetch.ts b/mobile/src/worktree/home-host-worktree-fetch.ts new file mode 100644 index 00000000000..7c6dafe6b14 --- /dev/null +++ b/mobile/src/worktree/home-host-worktree-fetch.ts @@ -0,0 +1,79 @@ +import { setCachedWorktrees } from '../cache/worktree-cache' +import { sendSingleFlightRequest } from '../transport/request-single-flight' +import type { RpcClient } from '../transport/rpc-client' +import { isLogicalClientCutoverError } from '../transport/stable-logical-rpc-client' +import { + markHomeWorktreeCatalogUnavailable, + type HomeWorktreeSummary, + type HostWorktreeInfo +} from './home-worktree-info' +import { pickResumeWorktree } from './resume-worktree' +import { WORKTREE_PS_FULL_LIMIT } from './worktree-catalog-snapshot-client' + +const ACTIVE_STATUSES = new Set(['working', 'active', 'permission']) +// Why: a relay↔direct cutover rejects in-flight reads without ever leaving 'connected', so the +// connect gate never re-arms. Re-issue on the replacement session; cap it so a migration loop +// can't spin. See runtime-capability-probe.ts for the same hazard on status.get. +const CUTOVER_RETRY_LIMIT = 2 + +export type HostWorktreeInfoSetter = ( + updater: (prev: Record) => Record +) => void + +/** Reads one host's worktree catalog for the Home card, preserving proven counts on failure. */ +export function fetchHomeHostWorktreeInfo( + client: RpcClient, + hostId: string, + setInfo: HostWorktreeInfoSetter, + disposed: () => boolean +): Promise { + const markUnavailable = (): void => { + setInfo((prev) => { + const current = prev[hostId] + const next = markHomeWorktreeCatalogUnavailable(current, hostId) + return next === current ? prev : { ...prev, [hostId]: next } + }) + } + + const attempt = (cutoverRetriesLeft: number): Promise => + sendSingleFlightRequest(client, hostId, 'worktree.ps', { limit: WORKTREE_PS_FULL_LIMIT }) + .then((response) => { + if (disposed()) { + return + } + if (!response.ok) { + markUnavailable() + return + } + const result = response.result as { worktrees?: HomeWorktreeSummary[] } + const worktrees = result.worktrees ?? [] + setCachedWorktrees(hostId, worktrees) + const active = worktrees.filter((w) => w.status && ACTIVE_STATUSES.has(w.status)) + // Mirror the desktop's focused workspace (see pickResumeWorktree). + const lastActive = pickResumeWorktree(worktrees) + setInfo((prev) => ({ + ...prev, + [hostId]: { + hostId, + totalWorktrees: worktrees.length, + activeCount: active.length, + lastActiveWorktree: lastActive, + countsProvenAt: Date.now() + } + })) + }) + .catch((error: unknown) => { + if (disposed()) { + return + } + // A cutover raises only after migrateTo installed an authenticated replacement, so the + // read was interrupted, not answered — ask again instead of latching "Last known". + if (cutoverRetriesLeft > 0 && isLogicalClientCutoverError(error)) { + return attempt(cutoverRetriesLeft - 1) + } + // Any other rejection (socket died mid-request) is a failed refresh, not an empty host. + markUnavailable() + }) + + return attempt(CUTOVER_RETRY_LIMIT) +} diff --git a/mobile/src/worktree/home-worktree-info.test.ts b/mobile/src/worktree/home-worktree-info.test.ts index ebbfe379e99..5cb80d007dd 100644 --- a/mobile/src/worktree/home-worktree-info.test.ts +++ b/mobile/src/worktree/home-worktree-info.test.ts @@ -1,5 +1,10 @@ import { describe, expect, it } from 'vitest' -import { markHomeWorktreeCatalogUnavailable, type HostWorktreeInfo } from './home-worktree-info' +import { + HOME_WORKTREE_COUNTS_LIVE_MAX_AGE_MS, + homeHostWorktreeSummary, + markHomeWorktreeCatalogUnavailable, + type HostWorktreeInfo +} from './home-worktree-info' describe('markHomeWorktreeCatalogUnavailable', () => { it('marks a host unavailable when no catalog has loaded', () => { @@ -28,7 +33,8 @@ describe('markHomeWorktreeCatalogUnavailable', () => { expect(markHomeWorktreeCatalogUnavailable(current, 'host-1')).toEqual({ ...current, - catalogUnavailable: true + catalogUnavailable: true, + staleCounts: true }) }) @@ -44,3 +50,73 @@ describe('markHomeWorktreeCatalogUnavailable', () => { expect(markHomeWorktreeCatalogUnavailable(current, 'host-1')).toBe(current) }) }) + +describe('homeHostWorktreeSummary', () => { + const provenAt = 1_700_000_000_000 + const loaded: HostWorktreeInfo = { + hostId: 'host-1', + totalWorktrees: 12, + activeCount: 2, + lastActiveWorktree: null, + countsProvenAt: provenAt + } + + it('summarizes a freshly loaded catalog', () => { + expect(homeHostWorktreeSummary(loaded, provenAt)).toBe('12 worktrees · 2 active') + expect( + homeHostWorktreeSummary({ ...loaded, totalWorktrees: 1, activeCount: 0 }, provenAt) + ).toBe('1 worktree') + }) + + it('keeps showing the last proven counts after a failed refresh', () => { + const afterFailure = markHomeWorktreeCatalogUnavailable(loaded, 'host-1') + + expect(homeHostWorktreeSummary(afterFailure, provenAt + 30_000)).toBe( + 'Last known: 12 worktrees · 2 active' + ) + }) + + it('keeps the last proven counts however long ago the refresh failed', () => { + const afterFailure = markHomeWorktreeCatalogUnavailable(loaded, 'host-1') + + // A session that stays connected past the live window then hits one failed refresh is the + // headline case: the counts are history, not nothing. + expect( + homeHostWorktreeSummary(afterFailure, provenAt + HOME_WORKTREE_COUNTS_LIVE_MAX_AGE_MS + 1) + ).toBe('Last known: 12 worktrees · 2 active') + expect(homeHostWorktreeSummary(afterFailure, provenAt + 3 * 86_400_000)).toBe( + 'Last known: 12 worktrees · 2 active' + ) + }) + + it('stops calling aged-out counts live even while a refresh is only pending', () => { + // A snapshot rehydrated from a previous app session describes a host we have not reached yet. + expect(homeHostWorktreeSummary(loaded, provenAt + HOME_WORKTREE_COUNTS_LIVE_MAX_AGE_MS)).toBe( + '12 worktrees · 2 active' + ) + expect( + homeHostWorktreeSummary(loaded, provenAt + HOME_WORKTREE_COUNTS_LIVE_MAX_AGE_MS + 1) + ).toBe('Last known: 12 worktrees · 2 active') + expect(homeHostWorktreeSummary(loaded, provenAt + 3 * 86_400_000)).toBe( + 'Last known: 12 worktrees · 2 active' + ) + }) + + it('treats counts persisted before age stamping as no longer live', () => { + const preUpgrade: HostWorktreeInfo = { ...loaded, countsProvenAt: undefined } + + expect(homeHostWorktreeSummary(preUpgrade, provenAt)).toBe( + 'Last known: 12 worktrees · 2 active' + ) + expect( + homeHostWorktreeSummary(markHomeWorktreeCatalogUnavailable(preUpgrade, 'host-1'), provenAt) + ).toBe('Last known: 12 worktrees · 2 active') + }) + + it('reports unavailable only when no catalog ever loaded', () => { + expect(homeHostWorktreeSummary(markHomeWorktreeCatalogUnavailable(undefined, 'host-1'))).toBe( + 'Worktree list unavailable' + ) + expect(homeHostWorktreeSummary(undefined)).toBeNull() + }) +}) diff --git a/mobile/src/worktree/home-worktree-info.ts b/mobile/src/worktree/home-worktree-info.ts index 867e266e89e..a417636dcaf 100644 --- a/mobile/src/worktree/home-worktree-info.ts +++ b/mobile/src/worktree/home-worktree-info.ts @@ -15,8 +15,17 @@ export type HostWorktreeInfo = { activeCount: number lastActiveWorktree: HomeWorktreeSummary | null catalogUnavailable?: boolean + // The counts are the last proven ones, kept across a failed refresh. + staleCounts?: boolean + // When the host last answered with these counts (ms epoch); absent in snapshots an older + // build persisted, which is why an unstamped count counts as expired rather than fresh. + countsProvenAt?: number } +// Why: the home snapshot is persisted across launches, so counts could otherwise be rendered as +// live while describing a workspace set proven days ago. Past this window they are only history. +export const HOME_WORKTREE_COUNTS_LIVE_MAX_AGE_MS = 10 * 60_000 + export function markHomeWorktreeCatalogUnavailable( current: HostWorktreeInfo | undefined, hostId: string @@ -25,7 +34,9 @@ export function markHomeWorktreeCatalogUnavailable( return current } if (current) { - return { ...current, catalogUnavailable: true } + // Why: `current` predates this failure, so its counts are proven host truth — a dropped + // socket must not erase them, only flag them as no longer live. + return { ...current, catalogUnavailable: true, staleCounts: true } } return { hostId, @@ -35,3 +46,32 @@ export function markHomeWorktreeCatalogUnavailable( catalogUnavailable: true } } + +/** The host card's worktree line, or null when nothing is known yet. */ +export function homeHostWorktreeSummary( + info: HostWorktreeInfo | undefined, + now: number = Date.now() +): string | null { + if (!info) { + return null + } + // Why (STA-3123): a catalog that never loaded must not assert a count the host has not proven. + if (info.catalogUnavailable && !info.staleCounts) { + return 'Worktree list unavailable' + } + const counts = `${info.totalWorktrees} worktree${info.totalWorktrees === 1 ? '' : 's'}${ + info.activeCount > 0 ? ` · ${info.activeCount} active` : '' + }` + // Age bounds liveness, not the counts themselves: a failed refresh — or a rehydrated snapshot the + // host has not re-confirmed — is still the last thing it told us, so keep it and drop the claim + // that it is current. + return info.staleCounts || !provenRecently(info, now) ? `Last known: ${counts}` : counts +} + +function provenRecently(info: HostWorktreeInfo, now: number): boolean { + // A snapshot written before countsProvenAt existed has an unknowable age; treat it as expired. + return ( + typeof info.countsProvenAt === 'number' && + now - info.countsProvenAt <= HOME_WORKTREE_COUNTS_LIVE_MAX_AGE_MS + ) +} diff --git a/mobile/vitest.config.ts b/mobile/vitest.config.ts index 9e7e3ecc59d..e39f90eedf1 100644 --- a/mobile/vitest.config.ts +++ b/mobile/vitest.config.ts @@ -9,6 +9,8 @@ export default defineConfig({ oxc: vitestOxcConfig, test: { environment: 'node', - include: ['src/**/*.test.ts'] + // .tsx too: component tests exist (react-test-renderer + mocked react-native) and were + // silently never collected, so render-level regressions shipped untested. + include: ['src/**/*.test.ts', 'src/**/*.test.tsx'] } }) From e599d924bdb828d060ea23aec1e4185435768f70 Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:27:28 -0700 Subject: [PATCH 25/72] fix(editor): stop Close All / Close Others freezing the renderer on large tab sets (#12404) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(editor): stop Cmd/Ctrl+Shift+T reopening a phantom editor tab `openFile` honored a recently-closed snapshot's `reopenId` whenever no open file currently held that id, without checking whether the same (path, mode, owner) was already open under a different id. Editor ids are not symmetrical across worktrees: the first worktree to open an absolute path gets the bare path as its id, and any other owner of the same path gets a namespaced `editor:::` id. So a snapshot captured under one shape could be restored while the live tab carried the other. When that happened `openFile` took the `existing` branch and mapped over `openFiles` looking for the stale id, matching nothing — no OpenFile was created or updated — yet it still set `activeFileId`, the per-worktree active id, the tab bar order and a unified tab entity to that stale id. The user got a tab rendering nothing and a dangling active editor. Resolve the id from the already-open file whenever one exists, so capture and restore agree on canonicalization. This is a no-op for the non-reopen path, where `resolveEditorFileIdForOwner` already returns `existing.id` via the identical predicate. * fix(editor): make Close All linear instead of cubic in tab count closeAllFiles resolved a reopen position for every closing tab by calling getRecentlyClosedTabPosition, which itself rescanned the worktree's tab-bar order and group membership with a nested find per entry. That made the whole bulk close O(N^3) in open editor tabs, and because it runs inside a synchronous zustand set() the renderer is blocked for the entire duration: measured against the real store, 500 tabs took 1.2s and 1000 tabs took 13.0s of frozen UI. Sessions that accumulate tabs — long SSH/relay work, a mirrored host republishing open files, a folder workspace opened wide — hit this on a single menu click. Hoist the per-tab rescans into one precomputed index. The new createRecentlyClosedTabPositionIndex builds tab-bar, unified-tab, and group lookups in a single linear pass over the worktree's state, then answers each position query in O(1); getRecentlyClosedTabPosition now delegates to it so single-tab callers keep identical behavior. Positions, reopen order, and the tab-bar/group indices recorded by #12236 are unchanged — first-occurrence wins everywhere, matching the indexOf/find scans this replaces. Position derivation moves to its own module so recently-closed-tabs.ts stays under the max-lines limit without a suppression; existing importers are unaffected via re-export. Same measurement after the change: 500 tabs 44ms, 1000 tabs 142ms, and the instrumented scan count drops from 503,000,500 to 4,000 at N=1000. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- ...runtime-pty-latched-pane-retention.test.ts | 5 +- src/renderer/src/store/slices/editor.test.ts | 60 +++++++ src/renderer/src/store/slices/editor.ts | 5 +- .../slices/recently-closed-tab-position.ts | 167 ++++++++++++++++++ .../src/store/slices/recently-closed-tabs.ts | 121 ++----------- 5 files changed, 247 insertions(+), 111 deletions(-) create mode 100644 src/renderer/src/store/slices/recently-closed-tab-position.ts diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts index e9c83bf6718..5892ee2c19d 100644 --- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts +++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts @@ -274,9 +274,8 @@ describe('remote runtime pty latched-pane retention', () => { it('does not stack listeners, registry entries or timers across repeated revive cycles', async () => { vi.useFakeTimers() try { - const { retryAllRemoteRuntimePtyRecoveriesNow } = await import( - './remote-runtime-pty-recovery-state' - ) + const { retryAllRemoteRuntimePtyRecoveriesNow } = + await import('./remote-runtime-pty-recovery-state') const transport = await attachStalePane(0) await vi.advanceTimersByTimeAsync(66_000) expect(transport.getRecoveryState?.().phase).toBe('disconnected') diff --git a/src/renderer/src/store/slices/editor.test.ts b/src/renderer/src/store/slices/editor.test.ts index a3c572612a4..8b87ee976c7 100644 --- a/src/renderer/src/store/slices/editor.test.ts +++ b/src/renderer/src/store/slices/editor.test.ts @@ -101,6 +101,22 @@ function ownedEditorFileId( return `editor:${encodeURIComponent(worktreeId)}:${encodeURIComponent(runtimeKey)}:${encodeURIComponent(filePath)}` } +/** Counts how often store code reads `entityId` off a worktree's unified tabs — + * a scan-count proxy that pins complexity without timing the wall clock. */ +function withCountedEntityIdReads(tabs: readonly Tab[], onRead: () => void): Tab[] { + return tabs.map((tab) => { + const { entityId, ...rest } = tab + return Object.defineProperty(rest, 'entityId', { + get: () => { + onRead() + return entityId + }, + enumerable: true, + configurable: true + }) as Tab + }) +} + function mirroredEditorUnifiedTab(id: string, entityId: string, worktreeId: string): Tab { return { id, @@ -1717,6 +1733,50 @@ describe('createEditorSlice recently closed editor tabs', () => { expect(store.getState().tabBarOrderByWorktree['wt-1']).toEqual([firstId]) }) + it('captures close-all snapshot positions without rescanning tab state per closed tab', () => { + const countEntityIdReads = (fileCount: number): number => { + const store = createEditorTabsStore() + for (let index = 0; index < fileCount; index += 1) { + store.getState().openFile( + { + filePath: `/repo/file-${index}.ts`, + relativePath: `file-${index}.ts`, + worktreeId: 'wt-1', + language: 'typescript', + mode: 'edit' + }, + { preview: false } + ) + } + let reads = 0 + store.setState({ + unifiedTabsByWorktree: { + 'wt-1': withCountedEntityIdReads( + store.getState().unifiedTabsByWorktree['wt-1'] ?? [], + () => { + reads += 1 + } + ) + } + } as Partial) + reads = 0 + + store.getState().closeAllFiles() + + expect(store.getState().openFiles).toHaveLength(0) + expect(store.getState().recentlyClosedEditorTabsByWorktree['wt-1']?.[0]?.position).toEqual({ + tabBarIndex: 0, + groupId: expect.any(String), + groupIndex: 0 + }) + return reads + } + + // Why: resolving each closed tab's position by rescanning tab order and group membership + // made close-all cubic — 4x the tabs cost ~64x the scans and froze the renderer for seconds. + expect(countEntityIdReads(80)).toBeLessThanOrEqual(countEntityIdReads(20) * 8) + }) + it('reactivates the live tab when a stale reopen id targets an already-open file', () => { const store = createEditorTabsStore() store.setState({ diff --git a/src/renderer/src/store/slices/editor.ts b/src/renderer/src/store/slices/editor.ts index be768183cac..bf17d61a3ea 100644 --- a/src/renderer/src/store/slices/editor.ts +++ b/src/renderer/src/store/slices/editor.ts @@ -2,6 +2,7 @@ import type { StateCreator } from 'zustand' import type { AppState } from '../types' import { + createRecentlyClosedTabPositionIndex, getRecentlyClosedTabPosition, restoreRecentlyClosedTabPosition, pushRecentlyClosedTabKind @@ -2462,6 +2463,8 @@ export const createEditorSlice: StateCreator = (s const closingFiles = s.openFiles.filter((f) => f.worktreeId === activeWorktreeId) let nextRecentClosed = s.recentlyClosedEditorTabsByWorktree[activeWorktreeId] ?? [] let capturedCloseCount = 0 + // Why: one shared index — a per-file position lookup rescans tab order and group membership, making close-all cubic. + const positionIndex = createRecentlyClosedTabPositionIndex(s, activeWorktreeId) for (const f of [...closingFiles].toReversed()) { // Why: skip untitled non-dirty files (deleted from disk after close) and ephemeral preview tabs so the reopen stack has no vanished/junk paths. if ( @@ -2471,7 +2474,7 @@ export const createEditorSlice: StateCreator = (s continue } const { id: _id, isDirty: _dirty, mirroredFromRuntimeSession: _mirrored, ...snap } = f - const position = getRecentlyClosedTabPosition(s, activeWorktreeId, f.id) + const position = positionIndex.positionFor(f.id) nextRecentClosed = [ { ...(snap as ClosedEditorTabSnapshot), diff --git a/src/renderer/src/store/slices/recently-closed-tab-position.ts b/src/renderer/src/store/slices/recently-closed-tab-position.ts new file mode 100644 index 00000000000..69a144534c5 --- /dev/null +++ b/src/renderer/src/store/slices/recently-closed-tab-position.ts @@ -0,0 +1,167 @@ +import type { AppState } from '../types' + +export type RecentlyClosedTabPosition = { + tabBarIndex?: number + groupId?: string + groupIndex?: number +} + +/** Reusable position lookup for one worktree. Bulk closes resolve a position per + * closed tab; without a shared index every lookup rescans tab order and group + * membership, which makes close-all cubic in the tab count. */ +export type RecentlyClosedTabPositionIndex = { + positionFor: (entityId: string) => RecentlyClosedTabPosition | undefined +} + +export function createRecentlyClosedTabPositionIndex( + state: Pick, + worktreeId: string +): RecentlyClosedTabPositionIndex { + const tabBarOrder = state.tabBarOrderByWorktree?.[worktreeId] + const unifiedTabs = state.unifiedTabsByWorktree?.[worktreeId] ?? [] + const groups = state.groupsByWorktree?.[worktreeId] ?? [] + + // First occurrence wins everywhere, matching the `indexOf`/`find` scans this replaces. + const tabBarIndexByEntityId = new Map() + const tabByEntityId = new Map() + const tabById = new Map() + for (const tab of unifiedTabs) { + if (!tabByEntityId.has(tab.entityId)) { + tabByEntityId.set(tab.entityId, tab) + } + if (!tabById.has(tab.id)) { + tabById.set(tab.id, tab) + } + } + const tabBarEntityIdsByGroupId = new Map() + tabBarOrder?.forEach((entityId, index) => { + if (!tabBarIndexByEntityId.has(entityId)) { + tabBarIndexByEntityId.set(entityId, index) + } + const tab = tabByEntityId.get(entityId) + if (!tab?.groupId) { + return + } + const bucket = tabBarEntityIdsByGroupId.get(tab.groupId) + if (bucket) { + bucket.push(tab.entityId) + } else { + tabBarEntityIdsByGroupId.set(tab.groupId, [tab.entityId]) + } + }) + + const groupById = new Map() + const tabOrderIndexByGroupId = new Map>() + const groupOrderMatchesTabBarByGroupId = new Map() + for (const group of groups) { + if (groupById.has(group.id)) { + continue + } + groupById.set(group.id, group) + const indexByTabId = new Map() + const groupTabEntityIds = group.tabOrder.map((tabId, index) => { + if (!indexByTabId.has(tabId)) { + indexByTabId.set(tabId, index) + } + return tabById.get(tabId)?.entityId + }) + tabOrderIndexByGroupId.set(group.id, indexByTabId) + const tabBarGroupEntityIds = tabBarEntityIdsByGroupId.get(group.id) ?? [] + groupOrderMatchesTabBarByGroupId.set( + group.id, + groupTabEntityIds.length === tabBarGroupEntityIds.length && + groupTabEntityIds.every((entityId, index) => entityId === tabBarGroupEntityIds[index]) + ) + } + + return { + positionFor: (entityId) => { + const tabBarIndex = tabBarOrder ? (tabBarIndexByEntityId.get(entityId) ?? -1) : -1 + const unifiedTab = tabByEntityId.get(entityId) + const group = unifiedTab ? groupById.get(unifiedTab.groupId) : undefined + const groupIndex = + group && unifiedTab ? (tabOrderIndexByGroupId.get(group.id)?.get(unifiedTab.id) ?? -1) : -1 + if (tabBarIndex < 0 && (!group || groupIndex < 0)) { + return undefined + } + const groupOrderMatchesTabBar = + !group || (groupOrderMatchesTabBarByGroupId.get(group.id) ?? true) + return { + ...(tabBarIndex >= 0 && groupOrderMatchesTabBar ? { tabBarIndex } : {}), + ...(group && groupIndex >= 0 ? { groupId: group.id, groupIndex } : {}) + } + } + } +} + +export function getRecentlyClosedTabPosition( + state: Pick, + worktreeId: string, + entityId: string +): RecentlyClosedTabPosition | undefined { + return createRecentlyClosedTabPositionIndex(state, worktreeId).positionFor(entityId) +} + +export function insertTabAtRecentlyClosedPosition( + order: readonly string[], + tabId: string, + position?: RecentlyClosedTabPosition +): string[] { + const nextOrder = order.filter((id) => id !== tabId) + const index = position?.tabBarIndex + if (index === undefined) { + return [...nextOrder, tabId] + } + nextOrder.splice(Math.min(Math.max(index, 0), nextOrder.length), 0, tabId) + return nextOrder +} + +export function restoreRecentlyClosedTabPosition( + getState: () => Pick< + AppState, + | 'tabBarOrderByWorktree' + | 'groupsByWorktree' + | 'unifiedTabsByWorktree' + | 'setTabBarOrder' + | 'reorderUnifiedTabs' + >, + worktreeId: string, + entityId: string, + position?: RecentlyClosedTabPosition +): void { + if (!position) { + return + } + const state = getState() + const order = state.tabBarOrderByWorktree?.[worktreeId] + if (order && typeof state.setTabBarOrder === 'function') { + state.setTabBarOrder(worktreeId, insertTabAtRecentlyClosedPosition(order, entityId, position)) + } + + if (position?.groupIndex === undefined) { + return + } + const unifiedTab = (getState().unifiedTabsByWorktree?.[worktreeId] ?? []).find( + (candidate) => + candidate.entityId === entityId && + (position.groupId === undefined || candidate.groupId === position.groupId) + ) + if (!unifiedTab) { + return + } + const group = (getState().groupsByWorktree?.[worktreeId] ?? []).find( + (candidate) => candidate.id === unifiedTab.groupId + ) + if (!group) { + return + } + if (typeof getState().reorderUnifiedTabs === 'function') { + getState().reorderUnifiedTabs( + group.id, + insertTabAtRecentlyClosedPosition(group.tabOrder, unifiedTab.id, { + tabBarIndex: position.groupIndex + }), + { recordInteraction: false } + ) + } +} diff --git a/src/renderer/src/store/slices/recently-closed-tabs.ts b/src/renderer/src/store/slices/recently-closed-tabs.ts index 7faebebfa4f..d7904eb6c8f 100644 --- a/src/renderer/src/store/slices/recently-closed-tabs.ts +++ b/src/renderer/src/store/slices/recently-closed-tabs.ts @@ -5,114 +5,21 @@ import { isWindowsAbsolutePathLike, relativePathInsideRoot } from '../../../../shared/cross-platform-path' +import { + restoreRecentlyClosedTabPosition, + type RecentlyClosedTabPosition +} from './recently-closed-tab-position' -export type RecentlyClosedTabPosition = { - tabBarIndex?: number - groupId?: string - groupIndex?: number -} - -export function getRecentlyClosedTabPosition( - state: Pick, - worktreeId: string, - entityId: string -): RecentlyClosedTabPosition | undefined { - const tabBarOrder = state.tabBarOrderByWorktree?.[worktreeId] - const unifiedTabs = state.unifiedTabsByWorktree?.[worktreeId] ?? [] - const tabBarIndex = tabBarOrder?.indexOf(entityId) ?? -1 - const unifiedTab = unifiedTabs.find((tab) => tab.entityId === entityId) - const group = unifiedTab - ? (state.groupsByWorktree?.[worktreeId] ?? []).find( - (candidate) => candidate.id === unifiedTab.groupId - ) - : undefined - const groupIndex = group?.tabOrder.indexOf(unifiedTab?.id ?? '') ?? -1 - const groupTabEntityIds = group - ? group.tabOrder.map((tabId) => unifiedTabs.find((tab) => tab.id === tabId)?.entityId) - : [] - const tabBarGroupEntityIds = group - ? (tabBarOrder ?? []) - .map((tabId) => unifiedTabs.find((tab) => tab.entityId === tabId)) - .filter((tab) => tab?.groupId === group.id) - .map((tab) => tab?.entityId) - : [] - const groupOrderMatchesTabBar = - !group || - (groupTabEntityIds.length === tabBarGroupEntityIds.length && - groupTabEntityIds.every((entityId, index) => entityId === tabBarGroupEntityIds[index])) - if (tabBarIndex < 0 && (!group || groupIndex < 0)) { - return undefined - } - - return { - ...(tabBarIndex >= 0 && groupOrderMatchesTabBar ? { tabBarIndex } : {}), - ...(group && groupIndex >= 0 ? { groupId: group.id, groupIndex } : {}) - } -} - -export function insertTabAtRecentlyClosedPosition( - order: readonly string[], - tabId: string, - position?: RecentlyClosedTabPosition -): string[] { - const nextOrder = order.filter((id) => id !== tabId) - const index = position?.tabBarIndex - if (index === undefined) { - return [...nextOrder, tabId] - } - nextOrder.splice(Math.min(Math.max(index, 0), nextOrder.length), 0, tabId) - return nextOrder -} - -export function restoreRecentlyClosedTabPosition( - getState: () => Pick< - AppState, - | 'tabBarOrderByWorktree' - | 'groupsByWorktree' - | 'unifiedTabsByWorktree' - | 'setTabBarOrder' - | 'reorderUnifiedTabs' - >, - worktreeId: string, - entityId: string, - position?: RecentlyClosedTabPosition -): void { - if (!position) { - return - } - const state = getState() - const order = state.tabBarOrderByWorktree?.[worktreeId] - if (order && typeof state.setTabBarOrder === 'function') { - state.setTabBarOrder(worktreeId, insertTabAtRecentlyClosedPosition(order, entityId, position)) - } - - if (position?.groupIndex === undefined) { - return - } - const unifiedTab = (getState().unifiedTabsByWorktree?.[worktreeId] ?? []).find( - (candidate) => - candidate.entityId === entityId && - (position.groupId === undefined || candidate.groupId === position.groupId) - ) - if (!unifiedTab) { - return - } - const group = (getState().groupsByWorktree?.[worktreeId] ?? []).find( - (candidate) => candidate.id === unifiedTab.groupId - ) - if (!group) { - return - } - if (typeof getState().reorderUnifiedTabs === 'function') { - getState().reorderUnifiedTabs( - group.id, - insertTabAtRecentlyClosedPosition(group.tabOrder, unifiedTab.id, { - tabBarIndex: position.groupIndex - }), - { recordInteraction: false } - ) - } -} +export { + createRecentlyClosedTabPositionIndex, + getRecentlyClosedTabPosition, + insertTabAtRecentlyClosedPosition, + restoreRecentlyClosedTabPosition +} from './recently-closed-tab-position' +export type { + RecentlyClosedTabPosition, + RecentlyClosedTabPositionIndex +} from './recently-closed-tab-position' /** Snapshot of a terminal tab captured at user-initiated close time. Reopen * recreates a fresh shell in the same startup directory (Ghostty semantics) — From d8e5944b60e63a56346e27156bce4edff52bb966 Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:34:22 -0700 Subject: [PATCH 26/72] Stop a duplicate headless orca serve from crash-looping and exhausting AppImage FUSE mounts (#12212) * fix(startup): stop a duplicate headless serve from crash-looping and leaking AppImage mounts A second Orca launch that loses the single-instance lock called app.quit() before `ready`. That quit is deferred, so the doomed process kept booting into Chromium's Linux display initialization, failed with "Missing X server or $DISPLAY", and died with SIGSEGV. systemd read that as a crash and restarted it forever; each restart re-mounted the AppImage and left the squashfuse mount behind, until the host hit the 1000-mount FUSE ceiling and every later launch failed. The lock-losing launch now calls app.exit(3), which terminates synchronously before any display init. Exit code 3 is a stable "another process already owns this userData profile" contract, and the documented systemd unit uses RestartPreventExitStatus=3 plus a real StartLimitIntervalSec/StartLimitBurst window so a permanently failing launch can no longer retry unbounded. Second-instance argv is now forwarded to the owner, and a duplicate `orca serve` no longer asks the live headless server to open a desktop window. Desktop activation for ordinary launches and macOS dock re-activation is unchanged. Closes #11935 * docs(headless): clear the start limit before the scripted service starts StartLimitIntervalSec=300/StartLimitBurst=5 rate-limits operator starts too, so after a crash-loop trips the burst systemd refuses a plain `systemctl start` for the rest of the window. The Upgrade and Roll back scripts run under `set -euo pipefail`, so that refusal aborted the rollback mid-flight and left the server down on the exact recovery path the doc prescribes. Both scripts (and their EXIT-trap recoveries) now run `systemctl reset-failed` first, the unit reference explains the interaction, and the crash-loop bullet points at it for manual starts. Co-authored-by: Orca * test(startup): reproduce the #11935 duplicate-serve crash loop under real Electron The committed coverage for #11935 was source-text greps, so nothing gated the mechanism the fix rests on: pre-`ready` `app.quit()` is deferred, which is why the lock-losing headless `orca serve` kept booting into Linux display init. This runs two real Electron processes against one disposable profile. The duplicate executes the lock-loss gate's own `app.*` statement, lifted out of `src/main/index.ts`, so reverting to `app.quit()` fails the test. It also feeds the owner's real forwarded argv through `shouldActivateDesktopForSecondInstance`. Also record why the activation predicate matches `--serve` and not the `serve` subcommand: an AppImage launched as `orca serve` exits at the CLI redirect before requesting the lock. * test(startup): wait for the owner process to exit before removing its profile Windows holds the profile's handles for a beat after SIGKILL, so an immediate rmSync can fail with EBUSY/EPERM. Co-authored-by: Orca * test(startup): pass the fixture marker path by env, not argv Chromium reorders argv and the duplicate's argv is itself under test, so a trailing positional was the wrong channel for it. Co-authored-by: Orca * test(startup): only the activation case waits on the owner notification The exit-contract cases assert on the duplicate's own already-terminated process, so they should not block on cross-process delivery. Co-authored-by: Orca * test(startup): drop the staged lock race, keep the real-Electron gate contract CI proved the two-process form cannot work on a display-less Linux runner: Chromium's ProcessSingleton needs the browser IO thread, which needs `ready`, which needs a display. The pre-`ready` owner looked stale and the duplicate took the lock (`expected [ 'DUPLICATE_WON_LOCK' ] to include 'DUPLICATE_LOST_LOCK'`). Lock acquisition and argv forwarding are already covered in single-instance-lock.test.ts. What only a real process can settle is what the loser does next, so that is all this file now runs -- display-independent. Co-authored-by: Orca --------- Co-authored-by: Orca --- docs/reference/headless-linux-server.md | 44 ++++++- src/main/index.ts | 15 ++- ...single-instance-lock-exit.electron.test.ts | 115 ++++++++++++++++++ ...single-instance-lock-headless-exit.test.ts | 84 +++++++++++++ src/main/startup/single-instance-lock.test.ts | 29 ++++- src/main/startup/single-instance-lock.ts | 18 ++- 6 files changed, 295 insertions(+), 10 deletions(-) create mode 100644 src/main/startup/single-instance-lock-exit.electron.test.ts create mode 100644 src/main/startup/single-instance-lock-headless-exit.test.ts diff --git a/docs/reference/headless-linux-server.md b/docs/reference/headless-linux-server.md index cdee2a4ca41..2284bcdaa23 100644 --- a/docs/reference/headless-linux-server.md +++ b/docs/reference/headless-linux-server.md @@ -155,6 +155,8 @@ display `:99` when no display exists: Description=Orca runtime server After=network-online.target Wants=network-online.target +StartLimitIntervalSec=300 +StartLimitBurst=5 [Service] Type=simple @@ -165,6 +167,7 @@ ExecStart=/opt/orca/orca-linux.AppImage serve --port 6768 --pairing-address 100. StandardOutput=journal StandardError=journal Restart=on-failure +RestartPreventExitStatus=3 RestartSec=5 [Install] @@ -174,6 +177,19 @@ WantedBy=multi-user.target Replace `100.64.1.20` with the LAN, Tailscale, tunnel, or public hostname that clients should use. +Exit status `3` means another process already owns this userData profile, so +`RestartPreventExitStatus=3` stops the unit instead of retrying a launch that +cannot succeed. Any other permanent startup fault is capped at 5 starts per +5 minutes; systemd's defaults (10s window, 5 starts) can never trip at +`RestartSec=5`, which is how one bad launch could restart thousands of times. +The start limit counts operator-initiated starts too, so once it trips systemd +refuses a plain `systemctl start` until the 5-minute window rolls over. Run +`sudo systemctl reset-failed orca-serve.service` first to clear it — the +[Upgrade](#upgrade-steps) and [Roll back](#roll-back) scripts already do. +On systemd older than 230 those two directives are spelled +`StartLimitInterval=`/`StartLimitBurst=` and belong in `[Service]`; Ubuntu +20.04, Orca's oldest supported base, ships systemd 245. + Enable the service: ```bash @@ -228,6 +244,8 @@ Then add the display dependency to the Orca service: Description=Orca runtime server After=network-online.target orca-xvfb.service Wants=network-online.target orca-xvfb.service +StartLimitIntervalSec=300 +StartLimitBurst=5 [Service] Type=simple @@ -237,6 +255,7 @@ Environment=DISPLAY=:99 Environment=LIBGL_ALWAYS_SOFTWARE=1 ExecStart=/opt/orca/orca-linux.AppImage serve --port 6768 --pairing-address 100.64.1.20 Restart=on-failure +RestartPreventExitStatus=3 RestartSec=5 [Install] @@ -415,6 +434,8 @@ recover_failed_upgrade() { sudo rm -f /opt/orca/orca-linux.AppImage.recovering \ /opt/orca/VERSION.recovering if ((recovery_ok)); then + # A tripped StartLimitBurst refuses a plain start + sudo systemctl reset-failed orca-serve.service || true sudo systemctl start orca-serve.service || true else echo 'Upgrade recovery failed; service remains stopped' >&2 @@ -482,6 +503,8 @@ sudo mv "$ORCA_ROLLBACK_NEW" "$ORCA_ROLLBACK" ORCA_BINARY_PROMOTED=1 sudo mv -f /opt/orca/orca-linux.AppImage.new /opt/orca/orca-linux.AppImage sudo mv -f /opt/orca/VERSION.new /opt/orca/VERSION +# Clears a start-limit hit left by the version being replaced +sudo systemctl reset-failed orca-serve.service sudo systemctl start orca-serve.service ORCA_SERVICE_STOPPED=0 trap - EXIT @@ -614,6 +637,8 @@ restart_after_rollback_error() { fi fi if ((recovery_ok)); then + # A tripped StartLimitBurst refuses a plain start + sudo systemctl reset-failed orca-serve.service || true sudo systemctl start orca-serve.service || true else echo 'Rollback recovery failed; service remains stopped' >&2 @@ -714,6 +739,8 @@ if ((ORCA_ROLLBACK_HAS_VERSION)); then else sudo rm -f /opt/orca/VERSION fi +# The crash-looping build you are rolling back from tripped StartLimitBurst +sudo systemctl reset-failed orca-serve.service sudo systemctl start orca-serve.service ORCA_SERVICE_STOPPED=0 sudo rm -rf -- "$ORCA_RESTORE" @@ -805,9 +832,24 @@ refuse to run there and print the command to run on the machine you want. `orca` user and that `/opt/orca` is readable by that user. - Clients cannot connect: make sure `--pairing-address` is an address reachable from the client, and make sure firewalls allow the selected `--port`. +- Journal shows `Another Orca instance is already running for this userData + profile` and the unit exits `3`: another process already owns the profile, so + `RestartPreventExitStatus=3` leaves the unit `failed` on purpose. Find the + owner with `systemctl status orca-serve` and `pgrep -af orca`. Stop it (or + keep it and leave the unit down), then run + `sudo systemctl reset-failed orca-serve && sudo systemctl start orca-serve` — + `reset-failed` clears the failed state and any start-limit counter. If no owner + exists, the lock is stale (Chromium recorded a pid that + has since been reused): remove `SingletonLock` and `SingletonSocket` from the + userData directory and start again. If an earlier crash-loop already leaked + AppImage mounts, list them with `findmnt -rn -t fuse.orca-linux.AppImage` and + release only the ones with no live owner using `fusermount -uz ` (or + `umount -l `), leaving the running instance's mount alone. - Service crash-loops right after an upgrade: use [Roll back](#roll-back) with the pre-upgrade `.ready` bundle. Do not rerun the upgrade first; doing so would - make the crashing version the next rollback binary. + make the crashing version the next rollback binary. The loop trips + `StartLimitBurst`, so any manual `systemctl start` outside that script needs + `sudo systemctl reset-failed orca-serve.service` first. - Diagnosing other missing libraries: extract the AppImage without launching it with `./orca-linux.AppImage --appimage-extract`, then run `ldd squashfs-root/orca` to list any shared libraries the host is missing. diff --git a/src/main/index.ts b/src/main/index.ts index 39fc076be0a..7ed25c33dc9 100644 --- a/src/main/index.ts +++ b/src/main/index.ts @@ -160,8 +160,10 @@ import { acquireSingleInstanceLock, logSingleInstanceLockBypass, logSingleInstanceLockFailure, + shouldActivateDesktopForSecondInstance, shouldBypassSingleInstanceLock, - shouldSkipSingleInstanceLock + shouldSkipSingleInstanceLock, + SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE } from './startup/single-instance-lock' import { startEventLoopStallProbe } from './startup/event-loop-stall-probe' import { startMainThreadChurnProbe } from './diagnostics/main-thread-churn-probe' @@ -606,7 +608,11 @@ function focusExistingWindow(): void { }) } -function requestDesktopActivation(): void { +function requestDesktopActivation(argv: readonly string[] = []): void { + // Why: a duplicate `orca serve` must not drag a headless server into opening a desktop window (#11935). + if (!shouldActivateDesktopForSecondInstance(argv)) { + return + } desktopActivationGate.requestActivation() } @@ -726,10 +732,11 @@ if (startupDiagnosticsEnabled) { if (!hasSingleInstanceLock) { // Why: a false-negative lock loss otherwise looks like a silent crash on packaged macOS; `open --stderr` can capture this line. logSingleInstanceLockFailure() - app.quit() + // Why: a graceful quit is deferred pre-ready, so this launch would still walk into Linux display init and SIGSEGV (#11935). + app.exit(SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE) } -// Why: when another process holds the lock we've already quit; skip file-writing side effects so this transient process never touches userData. +// Why: when another process holds the lock we've already exited; skip file-writing side effects so this transient process never touches userData. if (hasSingleInstanceLock) { // Why: couple to dev-parent only for electron-vite desktop runs; `orca serve`'s parent (CLI shim/background shell) isn't the intended server lifetime. const shouldCoupleToDevParent = is.dev && !isServeMode diff --git a/src/main/startup/single-instance-lock-exit.electron.test.ts b/src/main/startup/single-instance-lock-exit.electron.test.ts new file mode 100644 index 00000000000..7cf61a4af0f --- /dev/null +++ b/src/main/startup/single-instance-lock-exit.electron.test.ts @@ -0,0 +1,115 @@ +import { spawnSync } from 'node:child_process' +import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs' +import { createRequire } from 'node:module' +import { tmpdir } from 'node:os' +import { join } from 'node:path' +import { afterAll, describe, expect, it } from 'vitest' +import { SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE } from './single-instance-lock' + +// Why #11935: the lock-loss gate runs before Electron `ready`, where `app.quit()` is deferred, so a +// duplicate headless `orca serve` kept executing the rest of startup, reached Linux Ozone/X11 init +// with no display, died with SIGSEGV, and systemd restarted it until the leaked AppImage FUSE mounts +// hit the kernel's 1000-mount ceiling. This runs the gate's own termination statement, lifted out of +// `src/main/index.ts`, under the real Electron binary. +// +// Why not a live lock race: Chromium's Linux ProcessSingleton only answers a second process once the +// browser IO thread is up, which needs `ready` and therefore a display. On a display-less CI runner +// the "owner" is treated as stale and the duplicate takes the lock, so the race cannot be staged +// there. Lock acquisition and argv forwarding are covered in `single-instance-lock.test.ts`; what +// only a real process can settle is what the loser does next, which is what this file pins. + +const electronBinary = createRequire(import.meta.url)('electron') as string +const LOCK_LOST = 'LOCK_LOST' +const CONTINUED_INTO_STARTUP = 'CONTINUED_INTO_STARTUP' +const REACHED_TAIL = 'REACHED_TAIL' +const MARKER_ENV = 'ORCA_LOCK_FIXTURE_MARKER' + +const fixtureRoots: string[] = [] + +afterAll(() => { + for (const root of fixtureRoots) { + rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 }) + } +}) + +/** The `app.*` call the shipped lock-loss gate executes, so a revert to `app.quit()` fails here. */ +function readLockLossTermination(): string { + const source = readFileSync(join(process.cwd(), 'src/main/index.ts'), 'utf8') + const start = source.indexOf('if (!hasSingleInstanceLock) {') + expect(start).toBeGreaterThanOrEqual(0) + const end = source.indexOf('\n}', start) + expect(end).toBeGreaterThan(start) + + return source + .slice(start, end) + .split('\n') + .map((line) => line.trim()) + .filter((line) => line.startsWith('app.')) + .join('\n') +} + +function buildFixtureMain(termination: string): string { + return [ + `const { app } = require('electron')`, + `const { appendFileSync } = require('node:fs')`, + // Why: the marker path travels by env — Chromium rewrites argv before the main script sees it. + `const marker = process.env.${MARKER_ENV}`, + `const mark = (name) => appendFileSync(marker, name + '\\n')`, + `const SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE = ${SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE}`, + `mark('${LOCK_LOST}')`, + termination, + `mark('${CONTINUED_INTO_STARTUP}')`, + // Why: stand in for the rest of `src/main/index.ts`, which on the reported host was display init. + `mark('${REACHED_TAIL}')`, + `process.exit(0)` + ].join('\n') +} + +type FixtureRun = { status: number | null; markers: string[] } + +function runLockLossGate(termination: string): FixtureRun { + const root = mkdtempSync(join(tmpdir(), 'orca-lock-loss-')) + fixtureRoots.push(root) + const dir = join(root, 'fixture') + const marker = join(root, 'markers.log') + mkdirSync(dir, { recursive: true }) + writeFileSync( + join(dir, 'package.json'), + '{ "name": "orca-lock-loss-fixture", "main": "main.js" }' + ) + writeFileSync(join(dir, 'main.js'), buildFixtureMain(termination)) + writeFileSync(marker, '') + + const result = spawnSync(electronBinary, [dir, '--no-sandbox'], { + stdio: 'ignore', + timeout: 60_000, + env: { ...process.env, [MARKER_ENV]: marker } + }) + expect(result.error).toBeUndefined() + + return { + status: result.status, + markers: readFileSync(marker, 'utf8').split('\n').filter(Boolean) + } +} + +describe('#11935 pre-ready lock-loss termination under real Electron', () => { + it('stops the duplicate launch before any further startup runs, with the already-running code', () => { + const termination = readLockLossTermination() + // Why: an empty slice would let the fixture fall through to its own exit and pass vacuously. + expect(termination).not.toBe('') + + const run = runLockLossGate(termination) + + expect(run.markers).toEqual([LOCK_LOST]) + expect(run.status).toBe(SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE) + }, 90_000) + + it('reproduces the deferred graceful quit that let the doomed launch keep booting', () => { + const run = runLockLossGate('app.quit()') + + // Why: pins the Electron semantic the fix rests on — pre-`ready` `quit()` schedules, it does not stop. + expect(run.markers).toEqual([LOCK_LOST, CONTINUED_INTO_STARTUP, REACHED_TAIL]) + expect(run.status).not.toBe(SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE) + }, 90_000) +}) diff --git a/src/main/startup/single-instance-lock-headless-exit.test.ts b/src/main/startup/single-instance-lock-headless-exit.test.ts new file mode 100644 index 00000000000..3c9468f595e --- /dev/null +++ b/src/main/startup/single-instance-lock-headless-exit.test.ts @@ -0,0 +1,84 @@ +import { readFileSync } from 'node:fs' +import { join } from 'node:path' +import { describe, expect, it } from 'vitest' +import { SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE } from './single-instance-lock' + +// Why #11935: a pre-`ready` graceful quit is deferred, so a lock-losing headless `orca serve` +// kept booting into Linux Ozone/X11 init, died with SIGSEGV, and systemd restarted it forever +// until the leaked AppImage FUSE mounts hit the kernel's 1000-mount ceiling. + +function readSystemdUnitBlocks(doc: string): Map { + const blocks = new Map() + // Why: key on the unit's path comment — splitting on directives mixes `[Unit]` and `[Service]` across blocks. + for (const match of doc.matchAll(/^# \/etc\/systemd\/system\/(\S+\.service)$/gm)) { + const start = match.index + match[0].length + const name = match[1] + blocks.set(name, [...(blocks.get(name) ?? []), doc.slice(start, doc.indexOf('```', start))]) + } + return blocks +} + +describe('headless lock-loss exit contract', () => { + const source = readFileSync(join(process.cwd(), 'src/main/index.ts'), 'utf8') + const doc = readFileSync(join(process.cwd(), 'docs/reference/headless-linux-server.md'), 'utf8') + + it('exits the lock-losing launch immediately instead of scheduling a graceful quit', () => { + const gateStart = source.indexOf('if (!hasSingleInstanceLock) {') + // Why: bound the anchor — an unresolved indexOf slices to EOF and passes vacuously. + expect(gateStart).toBeGreaterThanOrEqual(0) + const gateEnd = source.indexOf('\n}', gateStart) + expect(gateEnd).toBeGreaterThan(gateStart) + + const gate = source.slice(gateStart, gateEnd) + expect(gate).toContain('app.exit(SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE)') + expect(gate).not.toContain('app.quit()') + }) + + it('keeps a duplicate serve launch from promoting the live server to a desktop window', () => { + const activationStart = source.indexOf('function requestDesktopActivation(') + expect(activationStart).toBeGreaterThanOrEqual(0) + const activationEnd = source.indexOf('\n}', activationStart) + expect(activationEnd).toBeGreaterThan(activationStart) + + expect(source.slice(activationStart, activationEnd)).toContain( + 'shouldActivateDesktopForSecondInstance(argv)' + ) + }) + + it('makes every documented serve unit treat a duplicate owner as terminal', () => { + const serveUnits = readSystemdUnitBlocks(doc).get('orca-serve.service') ?? [] + + expect(serveUnits.length).toBeGreaterThan(0) + for (const unit of serveUnits) { + expect(unit).toContain( + `RestartPreventExitStatus=${SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE}` + ) + expect(unit).toContain('StartLimitIntervalSec=') + expect(unit).toContain('StartLimitBurst=') + } + }) + + it('clears the start limit before every scripted start, which a tripped burst would refuse', () => { + const lines = doc.split('\n') + const startLines = lines.flatMap((line, index) => + /^\s*sudo systemctl start orca-serve/.test(line) ? [index] : [] + ) + + expect(startLines.length).toBeGreaterThan(0) + for (const index of startLines) { + expect(lines.slice(Math.max(0, index - 3), index).join('\n')).toContain( + 'systemctl reset-failed orca-serve' + ) + } + }) + + it('leaves the Xvfb unit free to self-heal from a transient display flap', () => { + const xvfbUnits = readSystemdUnitBlocks(doc).get('orca-xvfb.service') ?? [] + + expect(xvfbUnits.length).toBeGreaterThan(0) + // Why: a start limit here would down the display unit permanently and take orca-serve with it. + for (const unit of xvfbUnits) { + expect(unit).not.toContain('StartLimitBurst=') + } + }) +}) diff --git a/src/main/startup/single-instance-lock.test.ts b/src/main/startup/single-instance-lock.test.ts index 5ccd70e6a4a..b3058c91a66 100644 --- a/src/main/startup/single-instance-lock.test.ts +++ b/src/main/startup/single-instance-lock.test.ts @@ -4,8 +4,10 @@ import { acquireSingleInstanceLock, logSingleInstanceLockBypass, logSingleInstanceLockFailure, + shouldActivateDesktopForSecondInstance, shouldBypassSingleInstanceLock, shouldSkipSingleInstanceLock, + SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE, SINGLE_INSTANCE_LOCK_BYPASS_MESSAGE, SINGLE_INSTANCE_LOCK_FAILURE_MESSAGE } from './single-instance-lock' @@ -56,11 +58,11 @@ describe('acquireSingleInstanceLock', () => { expect(acquired).toBe(true) expect(fake.requestSingleInstanceLock).toHaveBeenCalledTimes(1) expect(fake.on).toHaveBeenCalledTimes(1) - expect(fake.on).toHaveBeenCalledWith('second-instance', onSecondInstance) + expect(fake.on).toHaveBeenCalledWith('second-instance', expect.any(Function)) expect(fake.listeners['second-instance']).toHaveLength(1) }) - it('fires the registered callback when second-instance dispatches', () => { + it('forwards the second launch argv so the owner can decide whether to activate', () => { const onSecondInstance = vi.fn() const fake = makeFakeApp(true) @@ -68,9 +70,30 @@ describe('acquireSingleInstanceLock', () => { const [registered] = fake.listeners['second-instance'] ?? [] expect(registered).toBeDefined() - registered?.() + registered?.({}, ['/opt/orca/orca-linux.AppImage', '--serve'], '/home/orca') expect(onSecondInstance).toHaveBeenCalledTimes(1) + expect(onSecondInstance).toHaveBeenCalledWith(['/opt/orca/orca-linux.AppImage', '--serve']) + }) +}) + +describe('shouldActivateDesktopForSecondInstance', () => { + it('ignores a duplicate serve launch but still activates for a desktop launch', () => { + // Why: a supervisor respawning `orca serve` must not open a window on a display-less host (#11935). + const serveArgv = ['/opt/orca/orca-linux.AppImage', '--serve'] + expect(shouldActivateDesktopForSecondInstance(serveArgv)).toBe(false) + expect(shouldActivateDesktopForSecondInstance(['/Applications/Orca.app/orca'])).toBe(true) + }) + + it('fails open when no argv is available', () => { + expect(shouldActivateDesktopForSecondInstance([])).toBe(true) + expect(shouldActivateDesktopForSecondInstance()).toBe(true) + }) +}) + +describe('SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE', () => { + it('stays 3 because the documented systemd unit keys RestartPreventExitStatus off it', () => { + expect(SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE).toBe(3) }) }) diff --git a/src/main/startup/single-instance-lock.ts b/src/main/startup/single-instance-lock.ts index 078500284a2..4a08fa61e73 100644 --- a/src/main/startup/single-instance-lock.ts +++ b/src/main/startup/single-instance-lock.ts @@ -7,6 +7,17 @@ export const SINGLE_INSTANCE_LOCK_BYPASS_ENV = 'ORCA_BYPASS_SINGLE_INSTANCE_LOCK export const SINGLE_INSTANCE_LOCK_E2E_ENFORCE_ENV = 'ORCA_E2E_ENFORCE_SINGLE_INSTANCE_LOCK' export const SINGLE_INSTANCE_LOCK_BYPASS_MESSAGE = '[single-instance] ORCA_BYPASS_SINGLE_INSTANCE_LOCK=1 is set; bypassing the packaged macOS single-instance lock for diagnostics. Do not use this with another Orca instance running for the same profile.' +// Why: stable "another process owns this profile" contract that systemd RestartPreventExitStatus= keys off; changing it silently un-fixes #11935. +export const SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE = 3 + +// Why: `serve` is a CLI subcommand, never Electron argv — an AppImage launched as `orca serve` exits +// at the CLI redirect before requesting the lock, and the CLI re-spawns the Electron child with `--serve`. +const SERVE_MODE_ARG = '--serve' + +// Why: a duplicate `orca serve` is a supervisor artifact, not a user asking for a window; fail open when argv is unavailable. +export function shouldActivateDesktopForSecondInstance(argv: readonly string[] = []): boolean { + return !argv.includes(SERVE_MODE_ARG) +} /** * Why: Orca writes two canonical discovery files into `/`: @@ -26,11 +37,14 @@ export const SINGLE_INSTANCE_LOCK_BYPASS_MESSAGE = * way dev (`orca-dev` userData) and packaged (`orca` userData) runs lock in * separate namespaces instead of serialising against each other. */ -export function acquireSingleInstanceLock(app: App, onSecondInstance: () => void): boolean { +export function acquireSingleInstanceLock( + app: App, + onSecondInstance: (argv: readonly string[]) => void +): boolean { if (!app.requestSingleInstanceLock()) { return false } - app.on('second-instance', onSecondInstance) + app.on('second-instance', (_event, argv) => onSecondInstance(argv)) return true } From ac7f9a4fe1dfe40b4e8dafad175df7e9e869a17d Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Mon, 3 Aug 2026 23:48:18 -0700 Subject: [PATCH 27/72] fix(pty): require proven absence before retiring a stable pane owner (#12393) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(pty): require proven absence before retiring a stable pane owner "Session not found" only proves the provider we asked has no such PTY. A degraded router answers unmapped session ids from the local fallback, which never owned a daemon session, so a live agent's PTY produced the same error a dead one does — and the pane was then given a synthetic exit, its durable pane->PTY binding deleted, and a duplicate spawned. For a single-pane tab the retirement also drops the tab from persisted state, which the renderer cannot add back. Gate the retirement on probePtyLiveness, which polls every possible owner and answers false only when all of them agree the session is absent. `null` (nobody could answer) is not absence. Providers without a probe are their own sole owner, so their refusal stays authoritative and their behavior is unchanged. Also move the retirement's durability barrier off writeToDiskSync: it fsyncs the whole multi-MB state from the main thread, and a restore that retired N dead panes paid that stall N times. * fix(pty): make the unproven-absence veto transient and route attaches to the real owner Review found the proven-absence gate correct in direction but terminal in effect: "probe says alive" and "probe says unknown" both became a hard spawn failure with no consumer, no retry, and a raw internal token in a toast. - Graceful teardown (should-fix): a session being killed reports alive (getAppliedSize answers while isAlive, and isTerminating does not flip _state) while createOrAttach already throws SessionNotFoundError, so for up to KILL_TIMEOUT_MS the pane failed instead of retiring the doomed binding. The veto now re-proves on a bounded 6s budget: the moment any owner answers "absent" the pane retires and spawns fresh exactly as before. - Unprovable owners (should-fix): DaemonPtyAdapter.probePtyLiveness never called ensureConnected, so a merely disconnected adapter answered null forever and one null poisons probePtyOwners; it also took no deadline, so a wedged daemon burned the client's 30s request timeout per attach. It now connects first (like listProcesses) and threads an absolute deadline through the fan-out. The thrown error is user-legible English instead of terminal_pane_owner_unverified. - Durability barrier (should-fix): flushPendingOrThrowAsync is not a twin of flushOrThrow — it defaults to the drain-to-stable-generation loop the sibling best-effort caller deliberately avoids, adds active-view and GitHub sidecar writes, re-serializes state per iteration, and rejects when writes are frozen where the sync path no-ops. Reverted to flushOrThrow, matching the sibling retire paths in orca-runtime. - Misrouting root cause (nit): DegradedDaemonFreshSpawnRouter.spawn sent an unmapped sessionId to the local fallback and DaemonPtyRouter.spawn sent it to the current daemon, both faking "Session not found" for a live session. Both now resolve an existing owner first (the same resolution every non-spawn path already uses); minted ids still route to the fallback/current daemon. The pane reattaches instead of only surviving. Tests: retry-until-proven, teardown-window retire, misroute-then-reattach, probe deadline threading, unconnected-adapter probe, and both routers' owner resolution. Each fails with only the source reverted. * fix(pty): drop the follow-up, keep the minimal proven-absence guard Reverts aa27eb5274 and leaves only the original guard: retire a stable pane's owner solely when a provider authoritatively answers absent (probePtyLiveness === false). `true` and `null` still refuse to authorize destruction, and providers without a probe keep their refusal authoritative, so their behavior is unchanged. The follow-up bought too much surface for a P0, and two of its pieces did not hold up: - The `hasPty` owner scan added to DaemonPtyRouter.spawn and the degraded fresh-spawn router is inert for the case it targeted. `hasPty` reads `activeSessionIds`, which only spawn/attach populate — `listProcesses` (daemon-pty-adapter.ts) never does. After a failed discovery the scan therefore cannot find the owner it was written to find. - Its two routing tests could not fail: the mocks backed `hasPty` and `listProcesses` with one shared array, giving the fake adapter knowledge the real DaemonPtyAdapter provably lacks. Also dropped: the bounded 6s retry loop and its constants, the sentinel symbol, the exported user-facing message, the `opts.deadlineMs` widening of probePtyLiveness and its threading through the probe/routers, and the ensureConnected change in DaemonPtyAdapter. Kept from the follow-up: the flushOrThrow revert. flushPendingOrThrowAsync is not a like-for-like twin (drain-to-stable-generation loop, sidecar writes, per-iteration serialize, rejects when writes are frozen), so retirePersistedStablePaneOwner stays synchronous. One gap the strict one-shot gate does open is closed here. `getSize` landed in daemon protocol v18, and legacy adapters are created for every version in PREVIOUS_DAEMON_PROTOCOL_VERSIONS (1..30). A pre-v18 daemon error-replies "Unknown request type", probePtyLiveness catches it as `null`, and one `null` makes probePtyOwners unprovable forever — so a genuinely dead pane could never retire. probePtyLiveness now version-gates getSize and asks such a daemon for `listSessions` instead, the same inventory legacy discovery already routes by, requested directly rather than through listProcesses (which swallows errors into an empty list) so an unreachable socket still answers `null`. Unreachable never means absent; only an owner that answered does. * fix(daemon): detect getSize support instead of inferring it from the protocol number The version gate was not a sound boundary. `getSize` landed in 22b00a7cd2 while PROTOCOL_VERSION was already 18 and that commit did not bump it, so version 18 means two different things: daemons built before it lack the request, daemons built after it have it. Both report 18. A daemon from that window therefore passed the `>= 18` gate, was sent `getSize`, error-replied "Unknown request type", and answered `null` — and one `null` makes the owner fan-out permanently unprovable, so a genuinely dead pane could never retire. That is the same wedge the gate was added to close, just narrowed to one build window. Ask the daemon what it supports rather than trusting its number: attempt `getSize`, and fall back to `listSessions` only when the daemon itself replies that the request type is unknown. The predicate is deliberately narrow so a transient failure stays unproven instead of being mistaken for a missing capability, and the rejection is remembered so later probes skip a round trip that cannot work. This mirrors the capability-probe rule AGENTS.md already requires for Git, for the same reason: version numbers overstate capabilities. Unreachable still never means absent. * test(pty): pin that proven absence still retires, and correct a wrong rationale Review found the guard had no positive-direction coverage: every existing retire test uses a provider with no probePtyLiveness, so the guard is skipped there. Mutating `!== false` into `!== undefined` — which turns the guard into a permanent veto, so no daemon-backed pane could ever recover from a genuinely dead owner — left the whole suite green. Pinned with a case that fails under exactly that mutation. Also corrects the fallback's Why-comment. It claimed listProcesses "swallows errors into an empty list"; it does not — DaemonPtyAdapter.listProcesses rethrows and the router fails closed. The error-swallowing lives in discoverLegacySessions / discoverDegradedDaemonSessions. Requesting listSessions directly is still right, but because a liveness probe should not publish inventory audit observations as a side effect — not for the stated reason. * fix(daemon): bound the liveness probe so a wedged daemon cannot stall a pane mount probePtyLiveness passed no timeout, so each request fell back to the client's 30s REQUEST_TIMEOUT_MS. A wedged daemon holds its socket open rather than refusing, so it answers neither quickly nor at all — and probePtyOwners awaits every adapter before it can conclude anything. One hung daemon therefore stalled each restoring pane for up to 30s before the pane reported that it could not reopen. Nearly all local terminals are daemon-backed, so this is the common configuration, not an edge case. Bound both probe requests to 2s. Answering "unknown" quickly is strictly better here than answering slowly: unknown never authorizes retirement, it only defers it, so the only thing a shorter budget can cost is an earlier retry. The tests now pin the bound at the call rather than leaving it implicit. * test(daemon): pin the getSize probe timeout, and reattach an orphaned comment Review proved a coverage gap by mutation: removing LIVENESS_PROBE_TIMEOUT_MS from the getSize request left the whole suite green, so nothing stopped that leg regressing to the client's 30s default. Only the listSessions leg was pinned. The assertion now fails under exactly that mutation. Also moves isUnknownRequestTypeError below isDaemonGoneError. It had been inserted between isDaemonGoneError and the comment describing it, so that comment read as documenting the wrong function. --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- src/main/daemon/daemon-protocol-version.ts | 2 + src/main/daemon/daemon-pty-adapter.test.ts | 100 +++++++- src/main/daemon/daemon-pty-adapter.ts | 53 ++++- src/main/ipc/pty.test.ts | 253 +++++++++++++++++++++ src/main/ipc/pty.ts | 9 + 5 files changed, 412 insertions(+), 5 deletions(-) diff --git a/src/main/daemon/daemon-protocol-version.ts b/src/main/daemon/daemon-protocol-version.ts index 61cabf2fc15..fee06b235f2 100644 --- a/src/main/daemon/daemon-protocol-version.ts +++ b/src/main/daemon/daemon-protocol-version.ts @@ -6,6 +6,8 @@ export const STABLE_PANE_ATTACH_ONLY_DAEMON_PROTOCOL_VERSION = 31 export const HISTORY_SEED_TRANSFER_PROTOCOL_VERSION = 30 export const COMPLETION_PROCESS_INSPECTION_PROTOCOL_VERSION = 27 export const GET_FOREGROUND_PROCESS_PROTOCOL_VERSION = 11 +// Why: `getSize` landed in v18; older daemons reject it as an unknown request type. +export const GET_SIZE_PROTOCOL_VERSION = 18 export const PTY_STARTUP_INGRESS_PROTOCOL_VERSION = 25 export const AGENT_SESSION_CLAIM_DAEMON_PROTOCOL_VERSION = 26 export const AGENT_SESSION_CREATE_OPERATION_DAEMON_PROTOCOL_VERSION = 26 diff --git a/src/main/daemon/daemon-pty-adapter.test.ts b/src/main/daemon/daemon-pty-adapter.test.ts index 5dc807459be..84147ddb890 100644 --- a/src/main/daemon/daemon-pty-adapter.test.ts +++ b/src/main/daemon/daemon-pty-adapter.test.ts @@ -5,10 +5,11 @@ import { join } from 'node:path' import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs' import { DaemonClient } from './client' import { DaemonProtocolError } from './daemon-errors' -import { DaemonPtyAdapter } from './daemon-pty-adapter' +import { DaemonPtyAdapter, LIVENESS_PROBE_TIMEOUT_MS } from './daemon-pty-adapter' import { COMPLETION_PROCESS_INSPECTION_PROTOCOL_VERSION, GET_FOREGROUND_PROCESS_PROTOCOL_VERSION, + GET_SIZE_PROTOCOL_VERSION, PROTOCOL_VERSION } from './daemon-protocol-version' import { DaemonServer } from './daemon-server' @@ -1204,6 +1205,103 @@ describe('DaemonPtyAdapter (IPtyProvider)', () => { await expect(adapter.probePtyLiveness('session')).resolves.toBeNull() }) + + function createProbeAdapter( + protocolVersion: number, + request: ReturnType + ): DaemonPtyAdapter { + const probeAdapter = new DaemonPtyAdapter({ socketPath, tokenPath, protocolVersion }) + ;( + probeAdapter as unknown as { + client: { request: ReturnType; disconnect: ReturnType } + } + ).client = { request, disconnect: vi.fn() } + return probeAdapter + } + + // Why: a pre-v18 daemon rejects `getSize` as an unknown request type, so it would answer + // `null` forever — and one `null` makes the owner fan-out permanently unprovable, which + // would leave a genuinely dead pane unable to ever retire and respawn. + it('answers a pre-getSize daemon from its session inventory', async () => { + // Faithful pre-v18 daemon: routeRequest falls through its switch and error-replies. + const request = vi.fn(async (type: string) => { + if (type !== 'listSessions') { + throw new Error(`Unknown request type: ${type}`) + } + return { + sessions: [ + { sessionId: 'legacy-live', isAlive: true }, + { sessionId: 'legacy-exited', isAlive: false } + ] + } + }) + const legacy = createProbeAdapter(GET_SIZE_PROTOCOL_VERSION - 1, request) + + await expect(legacy.probePtyLiveness('legacy-live')).resolves.toBe(true) + await expect(legacy.probePtyLiveness('legacy-exited')).resolves.toBe(false) + await expect(legacy.probePtyLiveness('never-existed')).resolves.toBe(false) + expect(request).toHaveBeenCalledWith('listSessions', undefined, LIVENESS_PROBE_TIMEOUT_MS) + expect(request).not.toHaveBeenCalledWith('getSize', expect.anything()) + + legacy.dispose() + }) + + // The P0 boundary: an owner that cannot be reached must never read as one that answered "absent". + it('still answers unknown when a pre-getSize daemon cannot be reached', async () => { + const request = vi.fn(async () => { + throw new Error('Not connected') + }) + const legacy = createProbeAdapter(GET_SIZE_PROTOCOL_VERSION - 1, request) + + await expect(legacy.probePtyLiveness('legacy-live')).resolves.toBeNull() + + legacy.dispose() + }) + + // Why: `getSize` shipped into an already-released protocol without a version bump, so a + // daemon can report a version that implies support and still reject the request. Gating on + // the number alone left those daemons permanently unprovable — the same wedge, narrowed. + it('falls back when a daemon rejects getSize despite reporting a version that has it', async () => { + const request = vi.fn(async (type: string) => { + if (type === 'getSize') { + throw new Error(`Unknown request type: ${type}`) + } + return { sessions: [{ sessionId: 'ambiguous-live', isAlive: true }] } + }) + const ambiguous = createProbeAdapter(GET_SIZE_PROTOCOL_VERSION, request) + + await expect(ambiguous.probePtyLiveness('ambiguous-live')).resolves.toBe(true) + await expect(ambiguous.probePtyLiveness('never-existed')).resolves.toBe(false) + + // The rejection is remembered, so later probes skip the round trip that cannot work. + expect(request.mock.calls.filter(([type]) => type === 'getSize')).toHaveLength(1) + // Why pinned here: a wedged daemon holds its socket open, so an unbounded getSize would + // stall a pane mount for the client's 30s default instead of answering "unknown" in 2s. + expect(request).toHaveBeenCalledWith( + 'getSize', + { sessionId: 'ambiguous-live' }, + LIVENESS_PROBE_TIMEOUT_MS + ) + + ambiguous.dispose() + }) + + // The safety direction: only the daemon's own "I do not implement that" may switch strategy. + // A transient failure must stay unproven rather than be retried as a capability question. + it('keeps a transient getSize failure unproven instead of treating it as unsupported', async () => { + const request = vi.fn(async (type: string) => { + if (type === 'getSize') { + throw new Error('Connection lost') + } + return { sessions: [] } + }) + const flaky = createProbeAdapter(GET_SIZE_PROTOCOL_VERSION, request) + + await expect(flaky.probePtyLiveness('live-elsewhere')).resolves.toBeNull() + expect(request).not.toHaveBeenCalledWith('listSessions', undefined, LIVENESS_PROBE_TIMEOUT_MS) + + flaky.dispose() + }) }) describe('getBufferSnapshot', () => { diff --git a/src/main/daemon/daemon-pty-adapter.ts b/src/main/daemon/daemon-pty-adapter.ts index 2bba3c467dc..b9473c3de32 100644 --- a/src/main/daemon/daemon-pty-adapter.ts +++ b/src/main/daemon/daemon-pty-adapter.ts @@ -37,6 +37,7 @@ import { type TakePendingOutputResult } from './types' import { + GET_SIZE_PROTOCOL_VERSION, HISTORY_SEED_TRANSFER_PROTOCOL_VERSION, SNAPSHOT_SERIALIZER_FIDELITY_DAEMON_PROTOCOL_VERSION, STABLE_PANE_ATTACH_ONLY_DAEMON_PROTOCOL_VERSION @@ -139,6 +140,12 @@ export type DaemonIdentityChangeEvent = { const MAX_TOMBSTONES = 1000 const MAX_CONCURRENT_CHECKPOINTS = 4 +// Why far below the client's 30s default: a wedged daemon holds its socket open, so an unbounded +// probe stalls a pane mount for the full request timeout — and the owner fan-out waits on every +// adapter, so one hung daemon stalls each restoring pane. Answering "unknown" quickly is strictly +// better here: unknown never authorizes retirement, it only defers it. +export const LIVENESS_PROBE_TIMEOUT_MS = 2_000 + // Why: providers take an absolute teardown deadline, but the client RPC takes a // relative timeout — convert only here, at the request itself, so sequential RPCs // naturally share the remaining budget (undefined keeps the client's 30s default). @@ -203,6 +210,8 @@ export class DaemonPtyAdapter implements IPtyProvider { this.sleepRestoreSessionIds.delete(sessionId) }) private activeSessionIds = new Set() + // Set only once this daemon has rejected `getSize` as unknown; its protocol number cannot prove it. + private getSizeUnsupported = false // A replacement daemon has none of the old PTYs; only createOrAttach can make their bindings writable again. private sessionsAwaitingDaemonRecovery = new Set() private sessionIncarnations = new Map() @@ -900,11 +909,37 @@ export class DaemonPtyAdapter implements IPtyProvider { async probePtyLiveness(id: string): Promise { try { - const result = await this.client.request<{ size: { cols: number; rows: number } | null }>( - 'getSize', - { sessionId: id } + if (!this.getSizeUnsupported && this.protocolVersion >= GET_SIZE_PROTOCOL_VERSION) { + try { + const result = await this.client.request<{ size: { cols: number; rows: number } | null }>( + 'getSize', + { sessionId: id }, + LIVENESS_PROBE_TIMEOUT_MS + ) + return result.size !== null + } catch (error) { + // Why the capability probe rather than the version alone: `getSize` shipped into an + // already-released protocol without a bump, so a daemon can report a version that + // implies support and still reject the request. Ask what it can do, not what its + // number implies — and remember the answer so later probes skip the dead round trip. + if (!isUnknownRequestTypeError(error)) { + throw error + } + this.getSizeUnsupported = true + } + } + // Why: a daemon without `getSize` would otherwise answer `null` forever, and one `null` + // makes the whole owner fan-out unprovable — a dead pane could then never be retired. + // `listSessions` is the same inventory legacy discovery routes by, and has existed since + // the first daemon protocol. Requested directly rather than through `listProcesses` so a + // liveness probe does not publish inventory audit observations as a side effect; both + // rethrow on failure, so either way a dead socket stays `null` instead of reading absent. + const { sessions } = await this.client.request( + 'listSessions', + undefined, + LIVENESS_PROBE_TIMEOUT_MS ) - return result.size !== null + return sessions.some((session) => session.sessionId === id && session.isAlive) } catch { return null } @@ -2409,6 +2444,16 @@ function notifyAuditListeners(listeners: readonly ((value: T) => void)[], val } } +/** + * Narrow on purpose: only the daemon's own reply for a request type it does not implement. + * A transient failure must stay unproven rather than be mistaken for a missing capability. + * The server throws `Unknown request type: `; the client rejects with that text, which + * `addNodePtyRecoveryHint` only ever prepends to. + */ +function isUnknownRequestTypeError(err: unknown): boolean { + return err instanceof Error && err.message.includes('Unknown request type') +} + // Why: syscall='connect' distinguishes a dead-socket ENOENT/ECONNREFUSED from token-file ENOENT (no syscall); // message strings incl. wedged-daemon "Hello response timed out" (#8689) also warrant a respawn. function isDaemonGoneError(err: unknown): boolean { diff --git a/src/main/ipc/pty.test.ts b/src/main/ipc/pty.test.ts index 257250a9858..797cfa4411f 100644 --- a/src/main/ipc/pty.test.ts +++ b/src/main/ipc/pty.test.ts @@ -9108,6 +9108,259 @@ describe('registerPtyHandlers', () => { } ) + it.each([ + { label: 'another owner reports it alive', liveness: true }, + { label: 'no owner could answer', liveness: null } + ])('keeps a persisted owner whose absence is unproven ($label)', async ({ liveness }) => { + const worktreeId = 'repo-1::/tmp/unproven-owner' + const cwd = '/tmp/unproven-owner' + const tabId = 'tab-unproven-owner' + const leafId = '56565656-5656-4656-8656-565656565656' + const paneKey = makePaneKey(tabId, leafId) + // Why: a degraded router answers unmapped ids from the local fallback, which never + // owned this daemon session — the same "Session not found" a truly dead PTY yields. + const providerSpawn = vi.fn( + async (options: { attachOnly?: boolean; command?: string; sessionId?: string }) => { + if (options.attachOnly) { + throw new Error('Session not found: pty-unproven-owner') + } + return { id: 'pty-fresh-unproven', incarnationId: 'inc-fresh-unproven' } + } + ) + const probePtyLiveness = vi.fn(async () => liveness) + setLocalPtyProvider({ + spawn: providerSpawn, + probePtyLiveness, + write: vi.fn(), + resize: vi.fn(), + kill: vi.fn(), + shutdown: vi.fn(), + sendSignal: vi.fn(), + getCwd: vi.fn(), + getInitialCwd: vi.fn(), + clearBuffer: vi.fn(), + acknowledgeDataEvent: vi.fn(), + hasChildProcesses: vi.fn(), + getForegroundProcess: vi.fn(), + serialize: vi.fn(), + revive: vi.fn(), + onData: vi.fn(() => () => {}), + onReplay: vi.fn(() => () => {}), + onExit: vi.fn(() => () => {}), + listProcesses: vi.fn(async () => []), + attach: vi.fn(), + getDefaultShell: vi.fn(), + getProfiles: vi.fn() + } as never) + let session = { + tabsByWorktree: { + [worktreeId]: [{ id: tabId, worktreeId, ptyId: 'pty-unproven-owner' }] + }, + terminalLayoutsByTabId: { + [tabId]: { + root: { type: 'leaf' as const, leafId }, + activeLeafId: leafId, + expandedLeafId: null, + ptyIdsByLeafId: { [leafId]: 'pty-unproven-owner' } + } + }, + terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-unproven-owner' } + } + const store = { + getWorkspaceSession: vi.fn(() => session), + setWorkspaceSession: vi.fn((next) => { + session = next + }), + flushOrThrow: vi.fn(), + persistPtyBinding: vi.fn(), + getFolderWorkspace: vi.fn(() => undefined), + getFolderWorkspaces: vi.fn(() => []), + getProjectGroups: vi.fn(() => []), + getRepos: vi.fn(() => []) + } + const runtime = { + setPtyController: vi.fn(), + resolveTerminalPane: vi.fn(() => { + throw new Error('terminal_not_found') + }), + createPreAllocatedTerminalHandle: vi.fn(() => 'term-unproven'), + preAllocateHandleForPty: vi.fn(() => 'term-unproven'), + registerPreAllocatedHandleForPty: vi.fn(), + beginPtyRegistration: vi.fn(), + cancelPendingPtyRegistration: vi.fn(), + assertPtyRegistrationAllowed: vi.fn(), + registerPty: vi.fn(), + noteTerminalSpawnCommand: vi.fn(), + seedHeadlessTerminal: vi.fn(), + onPtySpawned: vi.fn(), + onPtyExit: vi.fn(), + onPtyData: vi.fn() + } + + registerPtyHandlers( + mainWindow as never, + runtime as never, + undefined, + undefined, + undefined, + store as never + ) + + await expect( + handlers.get('pty:spawn')!(null, { + cols: 80, + rows: 24, + cwd, + command: 'codex resume unproven-owner-session', + worktreeId, + tabId, + leafId, + env: { + ORCA_PANE_KEY: paneKey, + ORCA_TAB_ID: tabId, + ORCA_WORKTREE_ID: worktreeId + } + }) + ).rejects.toThrow('terminal_pane_owner_unverified') + + expect(probePtyLiveness).toHaveBeenCalledWith('pty-unproven-owner') + // The live PTY keeps its pane binding, gets no synthetic exit, and is not duplicated. + expect(providerSpawn).toHaveBeenCalledOnce() + expect(providerSpawn.mock.calls[0]?.[0]).toMatchObject({ attachOnly: true }) + expect(runtime.onPtyExit).not.toHaveBeenCalled() + expect(store.setWorkspaceSession).not.toHaveBeenCalled() + expect(store.flushOrThrow).not.toHaveBeenCalled() + expect(session.tabsByWorktree[worktreeId]).toHaveLength(1) + }) + + // Why the positive direction needs its own case: the sibling retire tests use providers with + // no `probePtyLiveness`, so they skip this guard entirely. Without this, the guard could be + // strengthened into a permanent veto — no daemon-backed pane could ever recover from a dead + // owner — and every suite would stay green. + it('still retires and respawns when a provider proves the owner is absent', async () => { + const worktreeId = 'repo-1::/tmp/proven-absent-owner' + const cwd = '/tmp/proven-absent-owner' + const tabId = 'tab-proven-absent-owner' + const leafId = '78787878-7878-4878-8878-787878787878' + const paneKey = makePaneKey(tabId, leafId) + const providerSpawn = vi.fn( + async (options: { attachOnly?: boolean; command?: string; sessionId?: string }) => { + if (options.attachOnly) { + throw new Error('Session not found: pty-proven-absent-owner') + } + return { id: 'pty-fresh-proven', incarnationId: 'inc-fresh-proven' } + } + ) + const probePtyLiveness = vi.fn(async () => false) + setLocalPtyProvider({ + spawn: providerSpawn, + probePtyLiveness, + write: vi.fn(), + resize: vi.fn(), + kill: vi.fn(), + shutdown: vi.fn(), + sendSignal: vi.fn(), + getCwd: vi.fn(), + getInitialCwd: vi.fn(), + clearBuffer: vi.fn(), + acknowledgeDataEvent: vi.fn(), + hasChildProcesses: vi.fn(), + getForegroundProcess: vi.fn(), + serialize: vi.fn(), + revive: vi.fn(), + onData: vi.fn(() => () => {}), + onReplay: vi.fn(() => () => {}), + onExit: vi.fn(() => () => {}), + listProcesses: vi.fn(async () => []), + attach: vi.fn(), + getDefaultShell: vi.fn(), + getProfiles: vi.fn() + } as never) + let session = { + tabsByWorktree: { + [worktreeId]: [{ id: tabId, worktreeId, ptyId: 'pty-proven-absent-owner' }] + }, + terminalLayoutsByTabId: { + [tabId]: { + root: { type: 'leaf' as const, leafId }, + activeLeafId: leafId, + expandedLeafId: null, + ptyIdsByLeafId: { [leafId]: 'pty-proven-absent-owner' } + } + }, + terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-proven-absent-owner' } + } + const store = { + getWorkspaceSession: vi.fn(() => session), + setWorkspaceSession: vi.fn((next) => { + session = next + }), + flushOrThrow: vi.fn(), + persistPtyBinding: vi.fn(), + getFolderWorkspace: vi.fn(() => undefined), + getFolderWorkspaces: vi.fn(() => []), + getProjectGroups: vi.fn(() => []), + getRepos: vi.fn(() => []) + } + const runtime = { + setPtyController: vi.fn(), + resolveTerminalPane: vi.fn(() => { + throw new Error('terminal_not_found') + }), + createPreAllocatedTerminalHandle: vi.fn(() => 'term-proven-absent'), + preAllocateHandleForPty: vi.fn(() => 'term-proven-absent'), + registerPreAllocatedHandleForPty: vi.fn(), + beginPtyRegistration: vi.fn(), + cancelPendingPtyRegistration: vi.fn(), + assertPtyRegistrationAllowed: vi.fn(), + registerPty: vi.fn(), + noteTerminalSpawnCommand: vi.fn(), + seedHeadlessTerminal: vi.fn(), + onPtySpawned: vi.fn(), + onPtyExit: vi.fn(), + onPtyData: vi.fn() + } + + registerPtyHandlers( + mainWindow as never, + runtime as never, + undefined, + undefined, + undefined, + store as never + ) + + const mounted = await handlers.get('pty:spawn')!(null, { + cols: 80, + rows: 24, + cwd, + command: 'codex resume proven-absent-session', + worktreeId, + tabId, + leafId, + env: { + ORCA_PANE_KEY: paneKey, + ORCA_TAB_ID: tabId, + ORCA_WORKTREE_ID: worktreeId + } + }) + + expect(probePtyLiveness).toHaveBeenCalledWith('pty-proven-absent-owner') + // Proven absence is the one answer that authorizes retirement, so recovery must proceed. + expect(mounted).toMatchObject({ id: 'pty-fresh-proven' }) + expect(providerSpawn).toHaveBeenCalledTimes(2) + expect(providerSpawn.mock.calls[1]?.[0]).toMatchObject({ + command: 'codex resume proven-absent-session' + }) + expect(runtime.onPtyExit).toHaveBeenCalledWith( + 'pty-proven-absent-owner', + 0, + 'inc-proven-absent-owner' + ) + expect(store.setWorkspaceSession).toHaveBeenCalledOnce() + expect(store.flushOrThrow).toHaveBeenCalledOnce() + }) + it('retires a dead owner from the exact SSH host session before fresh recovery', async () => { const connectionId = 'ssh-dead-stable-pane' const hostId = `ssh:${connectionId}` diff --git a/src/main/ipc/pty.ts b/src/main/ipc/pty.ts index cd01a985243..a59f70e8ac2 100644 --- a/src/main/ipc/pty.ts +++ b/src/main/ipc/pty.ts @@ -734,6 +734,15 @@ async function attachStablePaneOwner( if (!isPtyAlreadyGoneError(error)) { throw error } + // Why: "Session not found" only proves the provider we asked has no such PTY — and a + // degraded router answers unmapped ids from the local fallback, which never owned a + // daemon session. Retiring on that would signal exit and delete a live agent's pane + // binding. Absence must be proven across every possible owner first; `null` (nobody + // could answer) is not absence. Providers without a probe are their own sole owner, + // so their refusal stays authoritative. + if (provider.probePtyLiveness && (await provider.probePtyLiveness(owner.ptyId)) !== false) { + throw new Error('terminal_pane_owner_unverified') + } const ownerBeforeRetire = args.resolveOwner?.() if ( ownerBeforeRetire && From 29bfc1e22c33a971210089d020d87cbe410bda64 Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Mon, 3 Aug 2026 23:49:19 -0700 Subject: [PATCH 28/72] Fix Windows git/gh attribution wrappers rejecting a piped stdin argument (#12440) Co-authored-by: Orca --- ...al-attribution-win32-dash-argument.test.ts | 100 ++++++++++++++++++ src/main/attribution/terminal-attribution.ts | 23 +++- 2 files changed, 122 insertions(+), 1 deletion(-) create mode 100644 src/main/attribution/terminal-attribution-win32-dash-argument.test.ts diff --git a/src/main/attribution/terminal-attribution-win32-dash-argument.test.ts b/src/main/attribution/terminal-attribution-win32-dash-argument.test.ts new file mode 100644 index 00000000000..810322a53c9 --- /dev/null +++ b/src/main/attribution/terminal-attribution-win32-dash-argument.test.ts @@ -0,0 +1,100 @@ +import { spawnSync } from 'node:child_process' +import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs' +import { tmpdir } from 'node:os' +import { join } from 'node:path' +import { afterEach, describe, expect, it } from 'vitest' +import { applyTerminalAttributionEnv } from './terminal-attribution' + +// Why (#12046 follow-up): `powershell.exe -File