From 2a1aa1d28552d212d4063b5a866d98fe5b3feed9 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 17 Jul 2026 00:54:44 +0000 Subject: [PATCH 01/17] Update README downloads badge --- docs/assets/readme-downloads.svg | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/assets/readme-downloads.svg b/docs/assets/readme-downloads.svg index 417924fc997..d96e1bddd40 100644 --- a/docs/assets/readme-downloads.svg +++ b/docs/assets/readme-downloads.svg @@ -1,5 +1,5 @@ - - downloads: 5.8m + + downloads: 5.9m @@ -15,7 +15,7 @@ downloads downloads - 5.8m - 5.8m + 5.9m + 5.9m From f8b9c2984d7de1c450855a6c305fdee9c2ce29df Mon Sep 17 00:00:00 2001 From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:02:51 -0700 Subject: [PATCH 02/17] fix(watcher): host macOS git-common narrow watch in the watcher child (#9091) * fix(watcher): host macOS git-common narrow watch in the watcher child The darwin-only .git/worktrees narrow stream was the last production path loading @parcel/watcher's native module inside the Electron main process. watcher.node 2.5.6 has unsynchronized cross-thread access to watcher state during unsubscribe/root-deletion (FSEventsBackend.cc:60/ 64 vs :336, :250 vs :262, and the deletedRoot double-stopStream) that corrupts the hosting process heap; `git worktree prune` deleting an empty worktrees dir makes that overlap routine, and the resulting PartitionAlloc trap killed the whole app (issue #8732, EXC_BREAKPOINT on the FSEvents thread in Watcher::isIgnored). Route the subscription through the existing crash-isolated watcher child supervisor instead, matching every other native watch (#7547). Error and root-deletion teardown/re-arm semantics are unchanged; a watcher-child interruption now reports a structural change so the worktree list re-syncs across the resubscribe gap. Fixes #8732 * fix(watcher): ignore callbacks from replaced git-common watches --- .../ipc/worktree-git-common-watch.test.ts | 189 ++++++++++++++++++ src/main/ipc/worktree-git-common-watch.ts | 53 +++-- 2 files changed, 225 insertions(+), 17 deletions(-) create mode 100644 src/main/ipc/worktree-git-common-watch.test.ts diff --git a/src/main/ipc/worktree-git-common-watch.test.ts b/src/main/ipc/worktree-git-common-watch.test.ts new file mode 100644 index 00000000000..9cc70f1d7e0 --- /dev/null +++ b/src/main/ipc/worktree-git-common-watch.test.ts @@ -0,0 +1,189 @@ +import { afterEach, describe, expect, it, vi } from 'vitest' +import { mkdtemp, mkdir, realpath, rm } from 'node:fs/promises' +import { tmpdir } from 'node:os' +import { join } from 'node:path' +import { subscribeViaWatcherProcess } from './parcel-watcher-process' +import type { + WatcherProcessCallback, + WatcherProcessHooks +} from './parcel-watcher-process-subscription' +import type { WorktreeBaseWatchTarget } from './worktree-base-directory-event-filter' +import type { WorktreeBasePollEvent } from './worktree-base-directory-poller' +import { startGitCommonWatch } from './worktree-git-common-watch' + +vi.mock('./parcel-watcher-process', () => ({ + subscribeViaWatcherProcess: vi.fn() +})) + +const POLL_MS = 25 + +type ChildSubscription = { + dir: string + callback: WatcherProcessCallback + hooks: WatcherProcessHooks + unsubscribe: ReturnType +} + +describe('worktree git-common narrow watch (darwin)', () => { + const cleanups: (() => Promise)[] = [] + const subscribeMock = vi.mocked(subscribeViaWatcherProcess) + let childSubscriptions: ChildSubscription[] = [] + + afterEach(async () => { + await Promise.all(cleanups.splice(0).map((cleanup) => cleanup())) + childSubscriptions = [] + subscribeMock.mockReset() + }) + + function installSubscribeMock(): void { + subscribeMock.mockImplementation(async (dir, callback, _opts, hooks = {}) => { + const unsubscribe = vi.fn(async () => {}) + childSubscriptions.push({ dir, callback, hooks, unsubscribe }) + return { unsubscribe } + }) + } + + async function makeCommonDir(withWorktrees: boolean): Promise { + const root = await mkdtemp(join(tmpdir(), 'orca-git-common-watch-')) + cleanups.push(() => rm(root, { recursive: true, force: true })) + const commonDir = await realpath(root) + if (withWorktrees) { + await mkdir(join(commonDir, 'worktrees')) + } + return commonDir + } + + function makeTarget(path: string): WorktreeBaseWatchTarget { + return { + key: `git-common:local:${path}`, + kind: 'git-common', + path, + repos: new Map([['repo-1', { repoId: 'repo-1', repoName: 'project', nestWorkspaces: false }]]) + } + } + + async function startWatch(commonDir: string, received: WorktreeBasePollEvent[][]): Promise { + const watch = await startGitCommonWatch( + makeTarget(commonDir), + (events) => received.push(events), + POLL_MS, + 'darwin' + ) + cleanups.push(() => watch.unsubscribe()) + } + + it('hosts the narrow stream in the watcher child, not in-process', async () => { + installSubscribeMock() + const commonDir = await makeCommonDir(true) + const received: WorktreeBasePollEvent[][] = [] + await startWatch(commonDir, received) + + expect(subscribeMock).toHaveBeenCalledTimes(1) + const [dir, , opts] = subscribeMock.mock.calls[0] + expect(dir).toBe(join(commonDir, 'worktrees')) + expect(opts).toEqual({}) + + const entryPath = join(commonDir, 'worktrees', 'wt-a') + childSubscriptions[0].callback(null, [{ type: 'create', path: entryPath }]) + expect(received.flat()).toContainEqual({ type: 'create', path: entryPath }) + }) + + it('tears down and re-arms when the watched root is deleted', async () => { + installSubscribeMock() + const commonDir = await makeCommonDir(true) + const worktreesDir = join(commonDir, 'worktrees') + const received: WorktreeBasePollEvent[][] = [] + await startWatch(commonDir, received) + + await rm(worktreesDir, { recursive: true, force: true }) + childSubscriptions[0].callback(null, [{ type: 'delete', path: worktreesDir }]) + await vi.waitFor(() => { + expect(childSubscriptions[0].unsubscribe).toHaveBeenCalledTimes(1) + }) + expect(received.flat()).toContainEqual({ type: 'delete', path: worktreesDir }) + + // The existence poll re-subscribes once a new first worktree recreates it. + await mkdir(worktreesDir) + await vi.waitFor(() => { + expect(subscribeMock).toHaveBeenCalledTimes(2) + }) + expect(received.flat()).toContainEqual({ type: 'create', path: worktreesDir }) + }) + + it('tears down and re-arms on watcher errors', async () => { + installSubscribeMock() + const commonDir = await makeCommonDir(true) + const worktreesDir = join(commonDir, 'worktrees') + const received: WorktreeBasePollEvent[][] = [] + await startWatch(commonDir, received) + + childSubscriptions[0].callback(new Error('watcher child reported failure'), []) + await vi.waitFor(() => { + expect(childSubscriptions[0].unsubscribe).toHaveBeenCalledTimes(1) + }) + // The error is surfaced as a structural change so worktrees re-sync. + expect(received.flat()).toContainEqual({ type: 'update', path: worktreesDir }) + + // The dir still exists, so the existence poll re-subscribes. + await vi.waitFor(() => { + expect(subscribeMock).toHaveBeenCalledTimes(2) + }) + + const receivedAfterRearm = received.length + childSubscriptions[0].callback(new Error('late error from replaced watcher'), []) + childSubscriptions[0].callback(null, [ + { type: 'create', path: join(worktreesDir, 'late-old-event') } + ]) + childSubscriptions[0].hooks.onInterruption?.() + + // A replaced watch cannot tear down its successor or report stale events. + expect(received).toHaveLength(receivedAfterRearm) + expect(childSubscriptions[1].unsubscribe).not.toHaveBeenCalled() + }) + + it('reports a structural change after a watcher-child interruption', async () => { + installSubscribeMock() + const commonDir = await makeCommonDir(true) + const worktreesDir = join(commonDir, 'worktrees') + const received: WorktreeBasePollEvent[][] = [] + await startWatch(commonDir, received) + + childSubscriptions[0].hooks.onInterruption?.() + expect(received.flat()).toContainEqual({ type: 'update', path: worktreesDir }) + // The supervisor resubscribed the same record; no teardown should happen. + expect(childSubscriptions[0].unsubscribe).not.toHaveBeenCalled() + }) + + it('arms via existence polling when the worktrees dir appears later', async () => { + installSubscribeMock() + const commonDir = await makeCommonDir(false) + const received: WorktreeBasePollEvent[][] = [] + await startWatch(commonDir, received) + expect(subscribeMock).not.toHaveBeenCalled() + + await mkdir(join(commonDir, 'worktrees')) + await vi.waitFor(() => { + expect(subscribeMock).toHaveBeenCalledTimes(1) + }) + }) + + it('stops forwarding events and unsubscribes the child on dispose', async () => { + installSubscribeMock() + const commonDir = await makeCommonDir(true) + const received: WorktreeBasePollEvent[][] = [] + const watch = await startGitCommonWatch( + makeTarget(commonDir), + (events) => received.push(events), + POLL_MS, + 'darwin' + ) + await watch.unsubscribe() + expect(childSubscriptions[0].unsubscribe).toHaveBeenCalledTimes(1) + + received.length = 0 + childSubscriptions[0].callback(null, [ + { type: 'create', path: join(commonDir, 'worktrees', 'late') } + ]) + expect(received).toHaveLength(0) + }) +}) diff --git a/src/main/ipc/worktree-git-common-watch.ts b/src/main/ipc/worktree-git-common-watch.ts index 39899b1e149..705963ed726 100644 --- a/src/main/ipc/worktree-git-common-watch.ts +++ b/src/main/ipc/worktree-git-common-watch.ts @@ -1,5 +1,6 @@ import { stat } from 'node:fs/promises' import { join } from 'node:path' +import { subscribeViaWatcherProcess } from './parcel-watcher-process' import type { WorktreeBaseWatchTarget } from './worktree-base-directory-event-filter' import type { WorktreeBasePollEvent, @@ -20,6 +21,10 @@ import { // included). Other platforms: dir-listing poll (no fseventsd to protect, and // on Windows an open directory handle on `worktrees/` could interfere with // `git worktree prune` removing it). +// The native stream is hosted in the crash-isolated watcher child, never the +// Electron main process: watcher.node teardown races heap-corrupt the hosting +// process when unsubscribe overlaps in-flight callbacks (issue #8732), and +// root deletion via `git worktree prune` makes that overlap routine here. // Why: branch switches and commits made in the primary checkout rewrite these // top-level files (linked-worktree equivalents live under `worktrees/`). @@ -157,12 +162,14 @@ async function startGitCommonNarrowWatch( return false } let errored = false + let active = true // Why: parcel tears its native stream down when the watched root is // deleted (e.g. `git worktree prune` removing an empty worktrees dir) — // sometimes surfaced as an error, sometimes as a delete event for the // root. Either way: notify, drop the dead stream, and let the existence // poll re-arm when a future worktree add recreates the dir. const teardownAndRearm = (): void => { + active = false errored = true const current = subscription subscription = null @@ -172,26 +179,38 @@ async function startGitCommonNarrowWatch( armExistencePoll() } try { - const watcher = await import('@parcel/watcher') - const sub = await watcher.subscribe(worktreesDir, (error, events) => { - if (disposed) { - return - } - if (error) { - onEvents([{ type: 'update', path: worktreesDir }]) - teardownAndRearm() - return - } - if (events.length > 0) { - const rootGone = events.some( - (event) => event.type === 'delete' && event.path === worktreesDir - ) - onEvents(events.map((event) => ({ type: event.type, path: event.path }))) - if (rootGone) { + const sub = await subscribeViaWatcherProcess( + worktreesDir, + (error, events) => { + if (disposed || !active) { + return + } + if (error) { + onEvents([{ type: 'update', path: worktreesDir }]) teardownAndRearm() + return + } + if (events.length > 0) { + const rootGone = events.some( + (event) => event.type === 'delete' && event.path === worktreesDir + ) + onEvents(events.map((event) => ({ type: event.type, path: event.path }))) + if (rootGone) { + teardownAndRearm() + } + } + }, + {}, + { + // Why: a watcher-child crash drops events during the automatic + // resubscribe gap; report a structural change so worktrees re-sync. + onInterruption: () => { + if (!disposed && active) { + onEvents([{ type: 'update', path: worktreesDir }]) + } } } - }) + ) if (disposed || errored) { void sub.unsubscribe().catch(() => {}) return !errored From f10c40591cb4f88c5a57163c9339dc39e182b324 Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Thu, 16 Jul 2026 18:05:38 -0700 Subject: [PATCH 03/17] fix(win): set UTF-8 console code page for Git Bash terminals (#9054) Launch Windows Git Bash as `bash -c 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'` so the ConPTY console is UTF-8 before a byte-writing UTF-8 TUI runs, matching what cmd.exe and PowerShell already do. Fixes CP437 mojibake for byte-writing agents in Git Bash tabs. Scoped to Git Bash; does not address PowerShell-reported mojibake. --- src/main/daemon/pty-subprocess.test.ts | 2 +- src/main/ipc/pty.test.ts | 2 +- src/main/providers/local-pty-provider.test.ts | 2 +- src/main/providers/windows-shell-args.test.ts | 17 +++++++++++++++-- src/main/providers/windows-shell-args.ts | 10 +++++++++- 5 files changed, 27 insertions(+), 6 deletions(-) diff --git a/src/main/daemon/pty-subprocess.test.ts b/src/main/daemon/pty-subprocess.test.ts index b4e5fc8e26c..ae8c834d894 100644 --- a/src/main/daemon/pty-subprocess.test.ts +++ b/src/main/daemon/pty-subprocess.test.ts @@ -2210,7 +2210,7 @@ describe('createPtySubprocess', () => { expect(spawnMock).toHaveBeenCalledWith( 'C:\\PortableGit\\bin\\bash.exe', - ['--login', '-i'], + ['-c', 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'], expect.objectContaining({ cwd: 'C:\\Users\\jin\\repo', env: expect.objectContaining({ CHERE_INVOKING: '1' }) diff --git a/src/main/ipc/pty.test.ts b/src/main/ipc/pty.test.ts index 4f08581282b..64047cb1c46 100644 --- a/src/main/ipc/pty.test.ts +++ b/src/main/ipc/pty.test.ts @@ -6497,7 +6497,7 @@ describe('registerPtyHandlers', () => { expect(spawnMock).toHaveBeenCalledWith( 'C:\\Program Files\\Git\\bin\\bash.exe', - ['--login', '-i'], + ['-c', 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'], expect.objectContaining({ env: expect.objectContaining({ CHERE_INVOKING: '1' }) }) diff --git a/src/main/providers/local-pty-provider.test.ts b/src/main/providers/local-pty-provider.test.ts index f69505161f2..54f8c2a110c 100644 --- a/src/main/providers/local-pty-provider.test.ts +++ b/src/main/providers/local-pty-provider.test.ts @@ -936,7 +936,7 @@ describe('LocalPtyProvider', () => { expect(spawnMock).toHaveBeenCalledWith( 'C:\\Program Files\\Git\\bin\\bash.exe', - ['--login', '-i'], + ['-c', 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'], expect.objectContaining({ cwd: 'C:\\Users\\jin\\repo', env: expect.objectContaining({ diff --git a/src/main/providers/windows-shell-args.test.ts b/src/main/providers/windows-shell-args.test.ts index 41e9b3b9488..273763f7017 100644 --- a/src/main/providers/windows-shell-args.test.ts +++ b/src/main/providers/windows-shell-args.test.ts @@ -196,14 +196,27 @@ describe('resolveWindowsShellLaunchArgs', () => { ]) }) - it('starts Git Bash as an interactive login shell without changing cwd', () => { + it('starts Git Bash as an interactive login shell with UTF-8 console setup', () => { const result = resolveWindowsShellLaunchArgs( 'C:\\Program Files\\Git\\bin\\bash.exe', 'C:\\Users\\alice\\code', 'C:\\Users\\alice' ) - expect(result.shellArgs).toEqual(['--login', '-i']) + // Why: Git Bash inherits the ConPTY OEM code page (CP437), so a byte-writing + // UTF-8 TUI mojibakes unless the console is switched to UTF-8 before it runs. + // Assert the contract behaviorally: chcp.com 65001 must precede the exec'd + // interactive login shell (which preserves `--login -i` and the shell's + // foreground identity), rather than pinning the exact command string. + expect(result.shellArgs[0]).toBe('-c') + const bashCommand = result.shellArgs[1] + expect(bashCommand).toContain('chcp.com 65001') + expect(bashCommand).toMatch(/exec "\$BASH" --login -i$/) + // The UTF-8 switch must run before the login shell is exec'd. + expect(bashCommand.indexOf('chcp.com')).toBeLessThan(bashCommand.indexOf('exec')) + // Must stay fail-open: `;` (not `&&`) so a missing chcp.com can't abort the + // exec and kill the terminal on startup. + expect(bashCommand).not.toContain('&&') expect(result.effectiveCwd).toBe('C:\\Users\\alice\\code') expect(result.validationCwd).toBe('C:\\Users\\alice\\code') }) diff --git a/src/main/providers/windows-shell-args.ts b/src/main/providers/windows-shell-args.ts index 4977cc11158..c860fa1a11d 100644 --- a/src/main/providers/windows-shell-args.ts +++ b/src/main/providers/windows-shell-args.ts @@ -16,6 +16,14 @@ const CMD_EXE_COMMAND_LINE_MAX_CHARS = 8191 const STARTUP_COMMAND_TEXT_MAX_CHARS = 6000 const POWERSHELL_ENCODED_COMMAND_ARG_MAX_CHARS = 28_000 const CMD_UTF8_SETUP_COMMAND = 'chcp 65001 > nul' +// Why: Git for Windows' bash inherits the ConPTY console's OEM code page +// (CP437), so a TUI that writes UTF-8 bytes straight to the console — agents +// like Claude Code use WriteFile, not WriteConsoleW — renders as mojibake +// (`❯` -> `Γ¥»`). Switch the console to UTF-8, then exec the normal interactive +// login shell; cmd.exe and PowerShell already do the equivalent. The `;` (not +// `&&`) keeps startup working even if chcp.com is missing. +const GIT_BASH_UTF8_LOGIN_COMMAND = + 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i' /** Result of resolving a Windows shell to its launch args + effective cwd. * @@ -176,7 +184,7 @@ export function resolveWindowsShellLaunchArgs( if (isWindowsGitBashShellPath(shellPath)) { return { - shellArgs: ['--login', '-i'], + shellArgs: ['-c', GIT_BASH_UTF8_LOGIN_COMMAND], effectiveCwd: nativeCwd, validationCwd: nativeCwd } From cdc7a5ca4695d2ae04572ffe7885ae99e63f4c6e Mon Sep 17 00:00:00 2001 From: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:08:47 -0700 Subject: [PATCH 04/17] Relay ssh image diff (#9112) Co-authored-by: Orca --- src/relay/git-working-file-read.test.ts | 27 +++++++++++++++++++++++++ src/relay/git-working-file-read.ts | 2 +- 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/src/relay/git-working-file-read.test.ts b/src/relay/git-working-file-read.test.ts index b4f8e3e6f7f..4f11437568b 100644 --- a/src/relay/git-working-file-read.test.ts +++ b/src/relay/git-working-file-read.test.ts @@ -35,4 +35,31 @@ describe('readWorkingDiffFile', () => { isBinary: true }) }) + + it('returns base64 content for previewable image working-tree files', async () => { + tmpDir = await mkdtemp(path.join(tmpdir(), 'relay-working-file-')) + const filePath = path.join(tmpDir, 'image.png') + // Why: PNG signature + trailing null byte forces the binary-detection heuristic to trip. + const pngBuffer = Buffer.concat([ + Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]), + Buffer.from([0x00]) + ]) + await writeFile(filePath, pngBuffer) + + await expect(readWorkingDiffFile(filePath)).resolves.toEqual({ + content: pngBuffer.toString('base64'), + isBinary: true + }) + }) + + it('returns empty content for non-previewable binary working-tree files', async () => { + tmpDir = await mkdtemp(path.join(tmpdir(), 'relay-working-file-')) + const filePath = path.join(tmpDir, 'archive.bin') + await writeFile(filePath, Buffer.from([0x00, 0x01, 0x02, 0x00, 0x03])) + + await expect(readWorkingDiffFile(filePath)).resolves.toEqual({ + content: '', + isBinary: true + }) + }) }) diff --git a/src/relay/git-working-file-read.ts b/src/relay/git-working-file-read.ts index 2c7db8e9778..30c762c3a24 100644 --- a/src/relay/git-working-file-read.ts +++ b/src/relay/git-working-file-read.ts @@ -16,7 +16,7 @@ export async function readWorkingDiffFile( return { content: '', isBinary: true } } const buffer = await readFile(absPath) - return bufferToBlob(buffer) + return bufferToBlob(buffer, absPath) } catch { return { content: '', isBinary: false } } From a03a3dd51b61ba94d8351c468529f8017795b0c1 Mon Sep 17 00:00:00 2001 From: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:21:08 -0700 Subject: [PATCH 05/17] Render png on mobile (#9087) * Add mobile image-diff previews via shared data-URI builder - Extracts a `buildImageDataUri` helper (src/shared/image-data-uri.ts) shared by the desktop ImageViewer and mobile, so both trim whitespace-wrapped base64 and skip non-previewable mimes (e.g. application/pdf) the same way. - Adds mobile-diff-image-preview.ts to render binary git.diff results (add/modify/ delete) as images instead of falling back to "Binary preview unavailable". - Extracts resolveMobileFileTabDoc to consolidate the session file-tab loading logic (diff/image/html/text) out of the route file for testability. * Fix stale binary image fallback for empty modified diffs and relay reads - mobileDiffImageDataUri now distinguishes a true deletion (modified side absent) from a modify whose binary bytes arrived empty (relay/size-cap cases), returning null instead of the stale pre-change image - readWorkingDiffFile passes the file path to bufferToBlob so relay working-tree reads can detect previewable image extensions instead of always reporting empty binary content - add mobile-file-tab-doc.test.ts covering diff/image/binary/text resolution paths * Regenerate skill bundle manifest for 1.4.144-rc.2 Co-authored-by: Orca * fix(review): trim comments to AGENTS.md's one/two-line why-only rule Comments in mobile-diff-image-preview.ts and mobile-file-tab-doc.ts ran 3-6 lines and narrated mechanism instead of stating only the non-obvious reason, per AGENTS.md's "Code Comments: Document the Why, Briefly" rule. Co-authored-by: Orca * Distinguish read failures from true deletions in binary diff results - Working-tree stat/readFile errors and relay reads previously collapsed onto the same empty-content signal as a genuine deletion, letting previewers fall back to stale original bytes on a failed read. - Add modifiedDeleted/missing flags through status.ts, git-handler-ops, and git-working-file-read so only proven deletions trigger the original-bytes fallback; failed reads now return null. - Tighten buildImageDataUri to accept only image/* mimes instead of special-casing application/pdf. * fix(relay): expect missing:false on index blob maxBuffer overflow readBlobAtIndex now returns a missing flag so staged deletions are distinct from size-capped binary reads; update the overflow test. * Allow opening deleted files to show pre-delete text or image diffs Deleted files can now be opened to view their pre-delete content via git.diff (including images via modifiedDeleted). Only unresolved conflicts remain unopenable. Centralizes the canOpen rule in canOpenMobileGitStatusEntry() to keep opener guards consistent across the mobile source control UI. --------- Co-authored-by: Orca --- .../app/h/[hostId]/session/[worktreeId].tsx | 94 +----------- .../files/mobile-diff-image-preview.test.ts | 123 ++++++++++++++++ mobile/src/files/mobile-diff-image-preview.ts | 32 +++++ mobile/src/files/mobile-file-tab-doc.test.ts | 136 ++++++++++++++++++ mobile/src/files/mobile-file-tab-doc.ts | 94 ++++++++++++ .../source-control/mobile-git-status.test.ts | 26 ++++ .../src/source-control/mobile-git-status.ts | 6 + .../mobile-source-control-screen-state.ts | 6 +- .../use-mobile-source-control-openers.ts | 10 +- src/main/git/status.test.ts | 31 ++++ src/main/git/status.ts | 42 ++++-- src/main/providers/windows-shell-args.ts | 3 +- src/relay/git-handler-blob-readers.test.ts | 3 +- src/relay/git-handler-ops.ts | 21 ++- src/relay/git-working-file-read.test.ts | 36 ++++- src/relay/git-working-file-read.ts | 34 +++-- .../src/components/editor/ImageViewer.tsx | 5 +- .../native-chat/native-chat-runtime-send.ts | 1 - src/shared/image-data-uri.test.ts | 30 ++++ src/shared/image-data-uri.ts | 20 +++ src/shared/types.ts | 7 + 21 files changed, 631 insertions(+), 129 deletions(-) create mode 100644 mobile/src/files/mobile-diff-image-preview.test.ts create mode 100644 mobile/src/files/mobile-diff-image-preview.ts create mode 100644 mobile/src/files/mobile-file-tab-doc.test.ts create mode 100644 mobile/src/files/mobile-file-tab-doc.ts create mode 100644 src/shared/image-data-uri.test.ts create mode 100644 src/shared/image-data-uri.ts diff --git a/mobile/app/h/[hostId]/session/[worktreeId].tsx b/mobile/app/h/[hostId]/session/[worktreeId].tsx index 0251da70490..d6bf1187811 100644 --- a/mobile/app/h/[hostId]/session/[worktreeId].tsx +++ b/mobile/app/h/[hostId]/session/[worktreeId].tsx @@ -141,7 +141,6 @@ import { saveCustomKeys, type CustomKey } from '../../../../src/components/CustomKeyModal' -import { buildMobileDiffLines } from '../../../../src/session/mobile-diff-lines' import { addMobileDiffComment, formatDiffComments, @@ -177,7 +176,7 @@ import { useMobileTerminalPaste } from '../../../../src/session/use-mobile-termi import { useTerminalLiveInputModePreference } from '../../../../src/session/use-terminal-live-input-mode-preference' import { MobileTerminalLiveInputStatus } from '../../../../src/session/MobileTerminalLiveInputStatus' import { MobileTerminalInputActions } from '../../../../src/session/MobileTerminalInputActions' -import { classifyMobileArtifact } from '../../../../src/session/mobile-artifact-kind' +import { resolveMobileFileTabDoc } from '../../../../src/files/mobile-file-tab-doc' import { openMobileTerminalFileTap } from '../../../../src/session/mobile-terminal-file-tap-open' import { useLiveWorktreeName } from '../../../../src/session/use-live-worktree-name' import { @@ -2043,93 +2042,12 @@ export default function SessionScreen() { } setFileDocs((prev) => new Map(prev).set(tab.id, { status: 'loading' })) try { - if (tab.diffSource === 'staged' || tab.diffSource === 'unstaged') { - const response = await client.sendRequest('git.diff', { - worktree: `id:${worktreeId}`, - filePath: tab.relativePath, - staged: tab.diffSource === 'staged' - }) - if (!response.ok) { - throw new Error((response as RpcFailure).error.message) - } - const result = (response as RpcSuccess).result as - | { - kind: 'text' - originalContent: string - modifiedContent: string - } - | { kind: 'binary' } - if (result.kind !== 'text') { - throw new Error('binary_file') - } - const diff = buildMobileDiffLines(result.originalContent, result.modifiedContent) - setFileDocs((prev) => - new Map(prev).set(tab.id, { - status: 'ready', - kind: 'diff', - lines: diff.lines, - truncated: diff.truncated - }) - ) - return - } - const artifactKind = classifyMobileArtifact(tab.relativePath) - if (artifactKind === 'image') { - const preview = await client.sendRequest('files.readPreview', { - worktree: `id:${worktreeId}`, - relativePath: tab.relativePath - }) - if (!preview.ok) { - throw new Error((preview as RpcFailure).error.message) - } - const result = (preview as RpcSuccess).result as { - content: string - isImage?: boolean - mimeType?: string - } - if (!result.isImage || !result.mimeType || result.content.length === 0) { - throw new Error('binary_file') - } - setFileDocs((prev) => - new Map(prev).set(tab.id, { - status: 'ready', - kind: 'image', - dataUri: `data:${result.mimeType};base64,${result.content}` - }) - ) - return - } - const response = await client.sendRequest('files.read', { - worktree: `id:${worktreeId}`, - relativePath: tab.relativePath + const doc = await resolveMobileFileTabDoc(client, { + worktreeId, + relativePath: tab.relativePath, + diffSource: tab.diffSource }) - if (!response.ok) { - throw new Error((response as RpcFailure).error.message) - } - const result = (response as RpcSuccess).result as { - content: string - truncated: boolean - byteLength: number - } - if (artifactKind === 'html') { - setFileDocs((prev) => - new Map(prev).set(tab.id, { - status: 'ready', - kind: 'html', - content: result.content - }) - ) - return - } - setFileDocs((prev) => - new Map(prev).set(tab.id, { - status: 'ready', - kind: 'file', - content: result.content, - truncated: result.truncated, - byteLength: result.byteLength - }) - ) + setFileDocs((prev) => new Map(prev).set(tab.id, doc)) } catch (err) { const message = err instanceof Error ? err.message : '' const previewMessage = diff --git a/mobile/src/files/mobile-diff-image-preview.test.ts b/mobile/src/files/mobile-diff-image-preview.test.ts new file mode 100644 index 00000000000..e63f532b28d --- /dev/null +++ b/mobile/src/files/mobile-diff-image-preview.test.ts @@ -0,0 +1,123 @@ +import { describe, expect, it } from 'vitest' +import { mobileDiffImageDataUri } from './mobile-diff-image-preview' + +describe('mobileDiffImageDataUri', () => { + it('renders a modified image diff from the post-change bytes', () => { + expect( + mobileDiffImageDataUri({ + kind: 'binary', + originalContent: 'b2xk', + modifiedContent: 'bmV3', + isImage: true, + mimeType: 'image/png' + }) + ).toBe('data:image/png;base64,bmV3') + }) + + it('renders an added image diff (no original) from the modified bytes', () => { + expect( + mobileDiffImageDataUri({ + kind: 'binary', + originalContent: '', + modifiedContent: 'bmV3', + isImage: true, + mimeType: 'image/png' + }) + ).toBe('data:image/png;base64,bmV3') + }) + + it('falls back to the original bytes for a proven deletion (modifiedDeleted)', () => { + expect( + mobileDiffImageDataUri({ + kind: 'binary', + originalContent: 'b2xk', + originalIsBinary: true, + modifiedContent: '', + modifiedIsBinary: false, + modifiedDeleted: true, + isImage: true, + mimeType: 'image/jpeg' + }) + ).toBe('data:image/jpeg;base64,b2xk') + }) + + // The reviewer's read-failure case: a relay/SSH read returns an empty modified + // side with modifiedIsBinary false and no modifiedDeleted flag. Without a proven + // deletion, falling back to the original would show a stale pre-change image, so + // "unavailable" (null) is the honest result. + it('returns null on a read failure (empty modified, no modifiedDeleted flag)', () => { + expect( + mobileDiffImageDataUri({ + kind: 'binary', + originalContent: 'b2xk', + originalIsBinary: true, + modifiedContent: '', + modifiedIsBinary: false, + isImage: true, + mimeType: 'image/png' + }) + ).toBeNull() + }) + + // Guards the >size-cap case: the modified side IS a binary image but its bytes + // arrive empty. Falling back to the original would render the stale pre-change + // image; "unavailable" is the honest result. + it('returns null for a modify whose binary modified side is empty (no stale fallback)', () => { + expect( + mobileDiffImageDataUri({ + kind: 'binary', + originalContent: 'b2xk', + originalIsBinary: true, + modifiedContent: '', + modifiedIsBinary: true, + isImage: true, + mimeType: 'image/png' + }) + ).toBeNull() + }) + + it('returns null for a non-previewable binary (no isImage/mimeType)', () => { + expect( + mobileDiffImageDataUri({ + kind: 'binary', + originalContent: '', + modifiedContent: 'AAAA' + }) + ).toBeNull() + }) + + it('returns null when flagged as image but carrying no bytes', () => { + expect( + mobileDiffImageDataUri({ + kind: 'binary', + originalContent: '', + modifiedContent: '', + isImage: true, + mimeType: 'image/png' + }) + ).toBeNull() + }) + + it('returns null for application/pdf even when flagged as previewable', () => { + expect( + mobileDiffImageDataUri({ + kind: 'binary', + originalContent: '', + modifiedContent: 'JVBER', + isImage: true, + mimeType: 'application/pdf' + }) + ).toBeNull() + }) + + it('returns null when flagged as image but mimeType is missing', () => { + expect( + mobileDiffImageDataUri({ + kind: 'binary', + originalContent: '', + modifiedContent: 'bmV3', + isImage: true + }) + ).toBeNull() + }) +}) diff --git a/mobile/src/files/mobile-diff-image-preview.ts b/mobile/src/files/mobile-diff-image-preview.ts new file mode 100644 index 00000000000..09d7cd2ef36 --- /dev/null +++ b/mobile/src/files/mobile-diff-image-preview.ts @@ -0,0 +1,32 @@ +import { buildImageDataUri } from '../../../src/shared/image-data-uri' + +// modifiedDeleted marks a proven deletion (modified side genuinely absent); an +// empty modifiedContent alone can't, since a relay/SSH read failure also arrives +// empty with modifiedIsBinary false. +export type MobileBinaryDiffResult = { + kind: 'binary' + originalContent?: string + modifiedContent?: string + originalIsBinary?: boolean + modifiedIsBinary?: boolean + modifiedDeleted?: boolean + isImage?: boolean + mimeType?: string +} + +// Falls back to the original bytes only for a proven deletion; a read failure or +// size-capped modify — also empty on the modified side — returns null instead of +// the stale pre-change image. +export function mobileDiffImageDataUri(result: MobileBinaryDiffResult): string | null { + if (result.isImage !== true) { + return null + } + const modified = result.modifiedContent || '' + if (modified) { + return buildImageDataUri(result.mimeType, modified) + } + if (result.modifiedDeleted === true) { + return buildImageDataUri(result.mimeType, result.originalContent || '') + } + return null +} diff --git a/mobile/src/files/mobile-file-tab-doc.test.ts b/mobile/src/files/mobile-file-tab-doc.test.ts new file mode 100644 index 00000000000..a9570e6cf44 --- /dev/null +++ b/mobile/src/files/mobile-file-tab-doc.test.ts @@ -0,0 +1,136 @@ +import { describe, expect, it } from 'vitest' +import type { RpcResponse } from '../transport/types' +import { resolveMobileFileTabDoc } from './mobile-file-tab-doc' + +function ok(result: unknown): RpcResponse { + return { id: 'x', ok: true, result, _meta: { runtimeId: 'r' } } +} + +function fail(code: string, message: string): RpcResponse { + return { id: 'x', ok: false, error: { code, message }, _meta: { runtimeId: 'r' } } +} + +// Fake client that returns a canned response per RPC method. +function clientOf(byMethod: Record): { + sendRequest: (method: string) => Promise + calls: string[] +} { + const calls: string[] = [] + return { + calls, + sendRequest: (method: string) => { + calls.push(method) + const response = byMethod[method] + if (!response) { + throw new Error(`unexpected method ${method}`) + } + return Promise.resolve(response) + } + } +} + +const WT = { worktreeId: 'wt1' } + +describe('resolveMobileFileTabDoc', () => { + it('renders a staged text diff', async () => { + const client = clientOf({ + 'git.diff': ok({ kind: 'text', originalContent: 'a\n', modifiedContent: 'a\nb\n' }) + }) + const doc = await resolveMobileFileTabDoc(client, { + ...WT, + relativePath: 'a.ts', + diffSource: 'staged' + }) + expect(doc.kind).toBe('diff') + expect(client.calls).toEqual(['git.diff']) + }) + + it('renders an unstaged image diff from the modified bytes', async () => { + const client = clientOf({ + 'git.diff': ok({ + kind: 'binary', + originalContent: 'b2xk', + modifiedContent: 'bmV3', + modifiedIsBinary: true, + isImage: true, + mimeType: 'image/png' + }) + }) + const doc = await resolveMobileFileTabDoc(client, { + ...WT, + relativePath: 'm1.png', + diffSource: 'unstaged' + }) + expect(doc).toEqual({ status: 'ready', kind: 'image', dataUri: 'data:image/png;base64,bmV3' }) + }) + + it('throws binary_file for an image modify whose bytes are empty (no stale fallback)', async () => { + const client = clientOf({ + 'git.diff': ok({ + kind: 'binary', + originalContent: 'b2xk', + modifiedContent: '', + modifiedIsBinary: true, + isImage: true, + mimeType: 'image/png' + }) + }) + await expect( + resolveMobileFileTabDoc(client, { ...WT, relativePath: 'm1.png', diffSource: 'unstaged' }) + ).rejects.toThrow('binary_file') + }) + + it('throws binary_file for a non-image binary diff', async () => { + const client = clientOf({ 'git.diff': ok({ kind: 'binary', modifiedContent: 'AAAA' }) }) + await expect( + resolveMobileFileTabDoc(client, { ...WT, relativePath: 'a.bin', diffSource: 'unstaged' }) + ).rejects.toThrow('binary_file') + }) + + it('renders a live image preview via files.readPreview', async () => { + const client = clientOf({ + 'files.readPreview': ok({ content: 'bmV3', isImage: true, mimeType: 'image/png' }) + }) + const doc = await resolveMobileFileTabDoc(client, { ...WT, relativePath: 'logo.png' }) + expect(doc).toEqual({ status: 'ready', kind: 'image', dataUri: 'data:image/png;base64,bmV3' }) + expect(client.calls).toEqual(['files.readPreview']) + }) + + it('throws binary_file when readPreview returns no image bytes', async () => { + const client = clientOf({ + 'files.readPreview': ok({ content: '', isImage: true, mimeType: 'image/png' }) + }) + await expect( + resolveMobileFileTabDoc(client, { ...WT, relativePath: 'logo.png' }) + ).rejects.toThrow('binary_file') + }) + + it('renders html source via files.read', async () => { + const client = clientOf({ + 'files.read': ok({ content: '

hi

', truncated: false, byteLength: 11 }) + }) + const doc = await resolveMobileFileTabDoc(client, { ...WT, relativePath: 'page.html' }) + expect(doc).toEqual({ status: 'ready', kind: 'html', content: '

hi

' }) + }) + + it('renders a plain text file via files.read', async () => { + const client = clientOf({ + 'files.read': ok({ content: 'hello', truncated: true, byteLength: 5 }) + }) + const doc = await resolveMobileFileTabDoc(client, { ...WT, relativePath: 'notes.txt' }) + expect(doc).toEqual({ + status: 'ready', + kind: 'file', + content: 'hello', + truncated: true, + byteLength: 5 + }) + }) + + it('propagates the RPC error message when a read fails', async () => { + const client = clientOf({ 'files.read': fail('EIO', 'file_too_large') }) + await expect( + resolveMobileFileTabDoc(client, { ...WT, relativePath: 'notes.txt' }) + ).rejects.toThrow('file_too_large') + }) +}) diff --git a/mobile/src/files/mobile-file-tab-doc.ts b/mobile/src/files/mobile-file-tab-doc.ts new file mode 100644 index 00000000000..78977b5fd30 --- /dev/null +++ b/mobile/src/files/mobile-file-tab-doc.ts @@ -0,0 +1,94 @@ +import { buildImageDataUri } from '../../../src/shared/image-data-uri' +import { classifyMobileArtifact } from '../session/mobile-artifact-kind' +import { buildMobileDiffLines, type MobileDiffLine } from '../session/mobile-diff-lines' +import type { RpcClient } from '../transport/rpc-client' +import type { RpcFailure, RpcSuccess } from '../transport/types' +import { mobileDiffImageDataUri, type MobileBinaryDiffResult } from './mobile-diff-image-preview' + +type FileTabDocClient = Pick + +// The ready doc a session file tab renders. Mirrors the ready arm of the route's +// FileDocState; kept in src so the loader stays testable without the route. +export type MobileFileTabDoc = + | { status: 'ready'; kind: 'file'; content: string; truncated: boolean; byteLength: number } + | { status: 'ready'; kind: 'diff'; lines: MobileDiffLine[]; truncated: boolean } + | { status: 'ready'; kind: 'image'; dataUri: string } + | { status: 'ready'; kind: 'html'; content: string } + +export type MobileFileTabDocRequest = { + worktreeId: string + relativePath: string + diffSource?: 'staged' | 'unstaged' | 'branch' | 'commit' +} + +// Throws 'binary_file'/'file_too_large'/the RPC error message; callers map those +// to error docs. +export async function resolveMobileFileTabDoc( + client: FileTabDocClient, + request: MobileFileTabDocRequest +): Promise { + const worktree = `id:${request.worktreeId}` + const { relativePath } = request + if (request.diffSource === 'staged' || request.diffSource === 'unstaged') { + const response = await client.sendRequest('git.diff', { + worktree, + filePath: relativePath, + staged: request.diffSource === 'staged' + }) + if (!response.ok) { + throw new Error((response as RpcFailure).error.message) + } + const result = (response as RpcSuccess).result as + | { kind: 'text'; originalContent: string; modifiedContent: string } + | MobileBinaryDiffResult + if (result.kind !== 'text') { + // Render image diffs (add/modify/delete) from the base64 the host already + // sends; only non-previewable binaries stay unavailable. + const dataUri = mobileDiffImageDataUri(result) + if (!dataUri) { + throw new Error('binary_file') + } + return { status: 'ready', kind: 'image', dataUri } + } + const diff = buildMobileDiffLines(result.originalContent, result.modifiedContent) + return { status: 'ready', kind: 'diff', lines: diff.lines, truncated: diff.truncated } + } + + const artifactKind = classifyMobileArtifact(relativePath) + if (artifactKind === 'image') { + const preview = await client.sendRequest('files.readPreview', { worktree, relativePath }) + if (!preview.ok) { + throw new Error((preview as RpcFailure).error.message) + } + const result = (preview as RpcSuccess).result as { + content: string + isImage?: boolean + mimeType?: string + } + const dataUri = result.isImage ? buildImageDataUri(result.mimeType, result.content) : null + if (!dataUri) { + throw new Error('binary_file') + } + return { status: 'ready', kind: 'image', dataUri } + } + + const response = await client.sendRequest('files.read', { worktree, relativePath }) + if (!response.ok) { + throw new Error((response as RpcFailure).error.message) + } + const result = (response as RpcSuccess).result as { + content: string + truncated: boolean + byteLength: number + } + if (artifactKind === 'html') { + return { status: 'ready', kind: 'html', content: result.content } + } + return { + status: 'ready', + kind: 'file', + content: result.content, + truncated: result.truncated, + byteLength: result.byteLength + } +} diff --git a/mobile/src/source-control/mobile-git-status.test.ts b/mobile/src/source-control/mobile-git-status.test.ts index 9c3575a75b2..a9e2b554f91 100644 --- a/mobile/src/source-control/mobile-git-status.test.ts +++ b/mobile/src/source-control/mobile-git-status.test.ts @@ -2,6 +2,7 @@ import { describe, expect, expectTypeOf, it } from 'vitest' import type { GitStatusResult } from '../../../src/shared/git-status-types' import { buildMobileSourceControlSections, + canOpenMobileGitStatusEntry, countStagedEntries, countUnstagedEntries, getStageablePaths, @@ -65,6 +66,31 @@ describe('mobile source control status helpers', () => { expect(isMobileGitDiscardableEntry(conflictedEntries[2])).toBe(false) }) + it('allows opening deleted files so pre-delete text/image diffs can load', () => { + expect( + canOpenMobileGitStatusEntry({ path: 'deleted.png', status: 'deleted', area: 'unstaged' }) + ).toBe(true) + expect( + canOpenMobileGitStatusEntry({ path: 'logo.png', status: 'modified', area: 'unstaged' }) + ).toBe(true) + expect( + canOpenMobileGitStatusEntry({ + path: 'conflict.ts', + status: 'modified', + area: 'unstaged', + conflictStatus: 'unresolved' + }) + ).toBe(false) + expect( + canOpenMobileGitStatusEntry({ + path: 'resolved.ts', + status: 'modified', + area: 'unstaged', + conflictStatus: 'resolved_locally' + }) + ).toBe(true) + }) + it('sorts entries by desktop-compatible conflict rank, then path', () => { const sections = buildMobileSourceControlSections([ { path: 'zeta.ts', status: 'modified', area: 'unstaged' }, diff --git a/mobile/src/source-control/mobile-git-status.ts b/mobile/src/source-control/mobile-git-status.ts index c6bfde9b8c2..65fcf61e211 100644 --- a/mobile/src/source-control/mobile-git-status.ts +++ b/mobile/src/source-control/mobile-git-status.ts @@ -90,6 +90,12 @@ export function isMobileGitDiscardableEntry(entry: MobileGitStatusEntry): boolea return entry.conflictStatus !== 'unresolved' && entry.conflictStatus !== 'resolved_locally' } +// Why: unresolved conflicts are not a stable file to open. Deletions are — +// git.diff still returns the pre-delete side (text or image via modifiedDeleted). +export function canOpenMobileGitStatusEntry(entry: MobileGitStatusEntry): boolean { + return entry.conflictStatus !== 'unresolved' +} + export function isMobileGitUnavailable(code: string | undefined, message: string | undefined) { return ( code === 'forbidden' || diff --git a/mobile/src/source-control/mobile-source-control-screen-state.ts b/mobile/src/source-control/mobile-source-control-screen-state.ts index eb20cdaa3ac..78a588d19ff 100644 --- a/mobile/src/source-control/mobile-source-control-screen-state.ts +++ b/mobile/src/source-control/mobile-source-control-screen-state.ts @@ -20,6 +20,7 @@ import type { MobileGitBranchCompareSummary } from './mobile-branch-compare' import { + canOpenMobileGitStatusEntry, isMobileGitDiscardableEntry, isMobileGitStageableEntry, type MobileGitFileStatus, @@ -58,15 +59,14 @@ export type MobileGitStatusEntryView = MobileGitStatusEntry & { } // Decorate raw status entries with the row-level capability/action-id fields the -// file list needs. Deleted/unresolved entries are not openable (matches the -// opener guards). +// file list needs. Opener guards must use the same canOpen rule. export function buildMobileGitStatusEntryViews( entries: readonly MobileGitStatusEntry[] ): MobileGitStatusEntryView[] { return entries.map((entry) => ({ ...entry, canDiscard: isMobileGitDiscardableEntry(entry), - canOpen: entry.status !== 'deleted' && entry.conflictStatus !== 'unresolved', + canOpen: canOpenMobileGitStatusEntry(entry), canStage: isMobileGitStageableEntry(entry), discardActionId: `discard:${entry.path}`, stageActionId: `stage:${entry.path}`, diff --git a/mobile/src/source-control/use-mobile-source-control-openers.ts b/mobile/src/source-control/use-mobile-source-control-openers.ts index be3febb4a80..bf0eff63cf6 100644 --- a/mobile/src/source-control/use-mobile-source-control-openers.ts +++ b/mobile/src/source-control/use-mobile-source-control-openers.ts @@ -12,7 +12,11 @@ import { canOpenMobileBranchCompareDiff, type MobileGitBranchChangeEntry } from './mobile-branch-compare' -import { isMobileGitUnavailable, type MobileGitStatusEntry } from './mobile-git-status' +import { + canOpenMobileGitStatusEntry, + isMobileGitUnavailable, + type MobileGitStatusEntry +} from './mobile-git-status' import { buildMobileReviewFileRoute } from './mobile-review-route' import type { GitDiffTextResult, @@ -70,7 +74,9 @@ export function useMobileSourceControlOpeners(params: Params) { const openFile = useCallback( async (entry: MobileGitStatusEntry) => { - if (entry.status === 'deleted' || entry.conflictStatus === 'unresolved') { + // Deletions are openable (pre-delete text/image via git.diff); only block + // unresolved conflicts, matching canOpenMobileGitStatusEntry / row UI. + if (!canOpenMobileGitStatusEntry(entry)) { return } if (openingPathRef.current || busyActionRef.current) { diff --git a/src/main/git/status.test.ts b/src/main/git/status.test.ts index 8af536a31a6..fd5e16f91c5 100644 --- a/src/main/git/status.test.ts +++ b/src/main/git/status.test.ts @@ -476,6 +476,37 @@ describe('getDiff', () => { }) }) + it('flags a deleted image so previewers can fall back to the original bytes', async () => { + const pngBuffer = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00]) + gitExecFileAsyncBufferMock.mockResolvedValueOnce({ stdout: pngBuffer }) + statMock.mockRejectedValueOnce(Object.assign(new Error('missing'), { code: 'ENOENT' })) + + const result = await getDiff('/repo', 'assets/deleted.png', false) + + expect(result.kind).toBe('binary') + if (result.kind !== 'binary') { + throw new Error('expected binary diff result') + } + expect(result.modifiedDeleted).toBe(true) + expect(result.originalContent).toBe(pngBuffer.toString('base64')) + expect(result.modifiedContent).toBe('') + }) + + it('does not treat an unreadable working-tree image as a deletion', async () => { + const pngBuffer = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00]) + gitExecFileAsyncBufferMock.mockResolvedValueOnce({ stdout: pngBuffer }) + statMock.mockResolvedValueOnce({ isFile: () => true, size: 5 }) + readFileMock.mockRejectedValueOnce(new Error('EIO')) + + const result = await getDiff('/repo', 'assets/unreadable.png', false) + + expect(result.kind).toBe('binary') + if (result.kind !== 'binary') { + throw new Error('expected binary diff result') + } + expect(result.modifiedDeleted).toBeUndefined() + }) + it('coalesces concurrent identical staged diff reads while in flight', async () => { const leftBlob = deferredBuffer('head-content\n') const rightBlob = deferredBuffer('index-content\n') diff --git a/src/main/git/status.ts b/src/main/git/status.ts index a0c103b744c..ae818b52567 100644 --- a/src/main/git/status.ts +++ b/src/main/git/status.ts @@ -1329,6 +1329,7 @@ async function loadDiff( let modifiedContent = '' let originalIsBinary = false let modifiedIsBinary = false + let modifiedDeleted = false try { const leftBlob = staged @@ -1343,22 +1344,30 @@ async function loadDiff( const rightBlob = await readGitBlobAtIndexPath(worktreePath, filePath, options) modifiedContent = rightBlob.content modifiedIsBinary = rightBlob.isBinary + modifiedDeleted = !rightBlob.exists } else { const workingTreeBlob = await readWorkingTreeFile(path.join(worktreePath, filePath)) modifiedContent = workingTreeBlob.content modifiedIsBinary = workingTreeBlob.isBinary + modifiedDeleted = !workingTreeBlob.exists } } catch { // Fallback } - return buildDiffResult( + const result = buildDiffResult( originalContent, modifiedContent, originalIsBinary, modifiedIsBinary, filePath ) + // Why: mark a proven deletion so previewers can fall back to the original bytes + // without mistaking a read failure's empty modified side for a deletion. + if (result.kind === 'binary' && modifiedDeleted) { + return { ...result, modifiedDeleted: true } + } + return result } export async function getBranchCompare( @@ -1859,20 +1868,33 @@ async function readGitBlobAtOidPath( } async function readWorkingTreeFile(filePath: string): Promise { + let fileStat try { - const fileStat = await stat(filePath) - if (!fileStat.isFile()) { - return { content: '', isBinary: false, exists: false } - } - if (fileStat.size > MAX_GIT_SHOW_BYTES) { - // Why: git blob reads are capped through maxBuffer; mirror that bound for - // unstaged working-tree content before readFile can pull in huge assets. - return { content: '', isBinary: true, exists: true } + fileStat = await stat(filePath) + } catch (error) { + // Why: ENOENT means the working-tree file is genuinely gone (a deletion); + // any other stat error is a read failure, which must not be reported as an + // absence since callers fall back to the original bytes only for deletions. + return { + content: '', + isBinary: false, + exists: (error as NodeJS.ErrnoException)?.code !== 'ENOENT' } + } + if (!fileStat.isFile()) { + return { content: '', isBinary: false, exists: false } + } + if (fileStat.size > MAX_GIT_SHOW_BYTES) { + // Why: git blob reads are capped through maxBuffer; mirror that bound for + // unstaged working-tree content before readFile can pull in huge assets. + return { content: '', isBinary: true, exists: true } + } + try { const buffer = await readFile(filePath) return bufferToBlob(buffer, filePath) } catch { - return { content: '', isBinary: false, exists: false } + // Why: the file exists but could not be read — a read failure, not a deletion. + return { content: '', isBinary: false, exists: true } } } diff --git a/src/main/providers/windows-shell-args.ts b/src/main/providers/windows-shell-args.ts index c860fa1a11d..523aee72a6a 100644 --- a/src/main/providers/windows-shell-args.ts +++ b/src/main/providers/windows-shell-args.ts @@ -22,8 +22,7 @@ const CMD_UTF8_SETUP_COMMAND = 'chcp 65001 > nul' // (`❯` -> `Γ¥»`). Switch the console to UTF-8, then exec the normal interactive // login shell; cmd.exe and PowerShell already do the equivalent. The `;` (not // `&&`) keeps startup working even if chcp.com is missing. -const GIT_BASH_UTF8_LOGIN_COMMAND = - 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i' +const GIT_BASH_UTF8_LOGIN_COMMAND = 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i' /** Result of resolving a Windows shell to its launch args + effective cwd. * diff --git a/src/relay/git-handler-blob-readers.test.ts b/src/relay/git-handler-blob-readers.test.ts index 3a32eccaed1..b2b9e87ecbb 100644 --- a/src/relay/git-handler-blob-readers.test.ts +++ b/src/relay/git-handler-blob-readers.test.ts @@ -44,6 +44,7 @@ describe('git blob readers', () => { const result = await readBlobAtIndex(gitBuffer, '/repo', 'large.log') - expect(result).toEqual({ content: '', isBinary: true }) + // Why: overflow is size-capped content, not a staged deletion (missing: false). + expect(result).toEqual({ content: '', isBinary: true, missing: false }) }) }) diff --git a/src/relay/git-handler-ops.ts b/src/relay/git-handler-ops.ts index 395e31badb3..afe75a2b582 100644 --- a/src/relay/git-handler-ops.ts +++ b/src/relay/git-handler-ops.ts @@ -52,17 +52,19 @@ export async function readBlobAtIndex( gitBuffer: GitBufferExec, cwd: string, filePath: string -): Promise<{ content: string; isBinary: boolean }> { +): Promise<{ content: string; isBinary: boolean; missing: boolean }> { // Why: Git's `:` syntax expects forward slashes even on Windows. const gitPath = filePath.replace(/\\/g, '/') try { const buf = await gitBuffer(['show', '--end-of-options', `:${gitPath}`], cwd) - return bufferToBlob(buf, filePath) + return { ...bufferToBlob(buf, filePath), missing: false } } catch (error) { if (isGitBufferOverflowError(error)) { - return { content: '', isBinary: true } + return { content: '', isBinary: true, missing: false } } - return { content: '', isBinary: false } + // Why: a non-overflow failure means the path is absent from the index (a + // staged deletion), distinct from the size-capped case handled above. + return { content: '', isBinary: false, missing: true } } } @@ -91,6 +93,7 @@ export async function computeDiff( let modifiedContent = '' let originalIsBinary = false let modifiedIsBinary = false + let modifiedDeleted = false try { if (staged) { @@ -101,6 +104,7 @@ export async function computeDiff( const right = await readBlobAtIndex(git, worktreePath, filePath) modifiedContent = right.content modifiedIsBinary = right.isBinary + modifiedDeleted = right.missing } else { const left = compareAgainstHead ? await readBlobAtOid(git, worktreePath, 'HEAD', filePath) @@ -111,18 +115,25 @@ export async function computeDiff( const right = await readWorkingDiffFile(path.join(worktreePath, filePath)) modifiedContent = right.content modifiedIsBinary = right.isBinary + modifiedDeleted = right.missing } } catch { // Fallback to empty } - return buildDiffResult( + const result = buildDiffResult( originalContent, modifiedContent, originalIsBinary, modifiedIsBinary, filePath ) + // Why: mark a proven deletion so previewers can fall back to the original bytes + // without mistaking a read failure's empty modified side for a deletion. + if (result.kind === 'binary' && modifiedDeleted) { + return { ...result, modifiedDeleted: true } + } + return result } // ─── Branch compare ────────────────────────────────────────────────── diff --git a/src/relay/git-working-file-read.test.ts b/src/relay/git-working-file-read.test.ts index 4f11437568b..7f9824ead94 100644 --- a/src/relay/git-working-file-read.test.ts +++ b/src/relay/git-working-file-read.test.ts @@ -21,7 +21,8 @@ describe('readWorkingDiffFile', () => { await expect(readWorkingDiffFile(filePath)).resolves.toEqual({ content: 'hello', - isBinary: false + isBinary: false, + missing: false }) }) @@ -32,7 +33,32 @@ describe('readWorkingDiffFile', () => { await expect(readWorkingDiffFile(filePath)).resolves.toEqual({ content: '', - isBinary: true + isBinary: true, + missing: false + }) + }) + + it('base64-encodes a previewable image by its extension', async () => { + tmpDir = await mkdtemp(path.join(tmpdir(), 'relay-working-file-')) + const filePath = path.join(tmpDir, 'icon.png') + const pngBytes = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x01]) + await writeFile(filePath, pngBytes) + + await expect(readWorkingDiffFile(filePath)).resolves.toEqual({ + content: pngBytes.toString('base64'), + isBinary: true, + missing: false + }) + }) + + it('reports an absent working-tree file as a deletion', async () => { + tmpDir = await mkdtemp(path.join(tmpdir(), 'relay-working-file-')) + const filePath = path.join(tmpDir, 'deleted.png') + + await expect(readWorkingDiffFile(filePath)).resolves.toEqual({ + content: '', + isBinary: false, + missing: true }) }) @@ -48,7 +74,8 @@ describe('readWorkingDiffFile', () => { await expect(readWorkingDiffFile(filePath)).resolves.toEqual({ content: pngBuffer.toString('base64'), - isBinary: true + isBinary: true, + missing: false }) }) @@ -59,7 +86,8 @@ describe('readWorkingDiffFile', () => { await expect(readWorkingDiffFile(filePath)).resolves.toEqual({ content: '', - isBinary: true + isBinary: true, + missing: false }) }) }) diff --git a/src/relay/git-working-file-read.ts b/src/relay/git-working-file-read.ts index 30c762c3a24..05cf1ebcdce 100644 --- a/src/relay/git-working-file-read.ts +++ b/src/relay/git-working-file-read.ts @@ -5,19 +5,31 @@ const MAX_RELAY_DIFF_WORKING_FILE_BYTES = 10 * 1024 * 1024 export async function readWorkingDiffFile( absPath: string -): Promise<{ content: string; isBinary: boolean }> { +): Promise<{ content: string; isBinary: boolean; missing: boolean }> { + let fileStat + try { + fileStat = await stat(absPath) + } catch (error) { + // Why: ENOENT means the working-tree file is genuinely gone (a deletion); + // any other stat error is a read failure we must not mistake for one, since + // callers fall back to the original bytes only for a proven deletion. + const missing = (error as NodeJS.ErrnoException)?.code === 'ENOENT' + return { content: '', isBinary: false, missing } + } + if (!fileStat.isFile()) { + return { content: '', isBinary: false, missing: true } + } + if (fileStat.size > MAX_RELAY_DIFF_WORKING_FILE_BYTES) { + // Why: mirror local git diff reads, which cap blob transfer at 10MB. + return { content: '', isBinary: true, missing: false } + } try { - const fileStat = await stat(absPath) - if (!fileStat.isFile()) { - return { content: '', isBinary: false } - } - if (fileStat.size > MAX_RELAY_DIFF_WORKING_FILE_BYTES) { - // Why: mirror local git diff reads, which cap blob transfer at 10MB. - return { content: '', isBinary: true } - } const buffer = await readFile(absPath) - return bufferToBlob(buffer, absPath) + // Why: bufferToBlob needs the path's extension to know an image is + // previewable; omitting it made every relay-side binary diff empty. + return { ...bufferToBlob(buffer, absPath), missing: false } } catch { - return { content: '', isBinary: false } + // Why: the file exists but could not be read — a read failure, not a deletion. + return { content: '', isBinary: false, missing: false } } } diff --git a/src/renderer/src/components/editor/ImageViewer.tsx b/src/renderer/src/components/editor/ImageViewer.tsx index 408afd795b3..88b57b092b6 100644 --- a/src/renderer/src/components/editor/ImageViewer.tsx +++ b/src/renderer/src/components/editor/ImageViewer.tsx @@ -20,6 +20,7 @@ import { getZoomedImageLayoutSize } from './image-viewer-zoom' import { translate } from '@/i18n/i18n' +import { buildImageDataUri } from '../../../../shared/image-data-uri' const FALLBACK_IMAGE_MIME_TYPE = 'image/png' @@ -59,8 +60,8 @@ export default function ImageViewer({ const isPdf = mimeType === 'application/pdf' const isIntrinsicLayout = layout === 'intrinsic' const previewSrc = useMemo( - () => (cleanedContent && !isPdf ? `data:${mimeType};base64,${cleanedContent}` : null), - [cleanedContent, isPdf, mimeType] + () => buildImageDataUri(mimeType, cleanedContent), + [cleanedContent, mimeType] ) const imageError = previewSrc !== null && failedPreviewSrc === previewSrc const estimatedSize = useMemo(() => { diff --git a/src/renderer/src/components/native-chat/native-chat-runtime-send.ts b/src/renderer/src/components/native-chat/native-chat-runtime-send.ts index f1f97d0b530..a1dca86b65f 100644 --- a/src/renderer/src/components/native-chat/native-chat-runtime-send.ts +++ b/src/renderer/src/components/native-chat/native-chat-runtime-send.ts @@ -23,7 +23,6 @@ export { NATIVE_CHAT_ADVANCE_BUFFER_MS, NATIVE_CHAT_QUESTION_STEP_MS, NATIVE_CHA export const NATIVE_CHAT_IMAGE_ATTACHMENT_SETTLE_MS = 300 - /** Cancels an in-flight send's pending pty writes (the delayed Enter, and any * later question bodies/Enters). Safe to call after the send completes. */ export type NativeChatSendHandle = { diff --git a/src/shared/image-data-uri.test.ts b/src/shared/image-data-uri.test.ts new file mode 100644 index 00000000000..8244d2d652b --- /dev/null +++ b/src/shared/image-data-uri.test.ts @@ -0,0 +1,30 @@ +import { describe, expect, it } from 'vitest' +import { buildImageDataUri } from './image-data-uri' + +describe('buildImageDataUri', () => { + it('builds a data URI from base64 image bytes', () => { + expect(buildImageDataUri('image/png', 'bmV3')).toBe('data:image/png;base64,bmV3') + }) + + it('strips whitespace from line-wrapped base64 payloads', () => { + expect(buildImageDataUri('image/png', 'bm\nV3\t bmV3\r\n')).toBe( + 'data:image/png;base64,bmV3bmV3' + ) + }) + + it('returns null for an empty payload', () => { + expect(buildImageDataUri('image/png', ' \n')).toBeNull() + }) + + it('returns null for a missing mime type', () => { + expect(buildImageDataUri(undefined, 'bmV3')).toBeNull() + }) + + it('returns null for application/pdf (not an source)', () => { + expect(buildImageDataUri('application/pdf', 'JVBER')).toBeNull() + }) + + it('returns null for a non-image mime such as application/octet-stream', () => { + expect(buildImageDataUri('application/octet-stream', 'AAAA')).toBeNull() + }) +}) diff --git a/src/shared/image-data-uri.ts b/src/shared/image-data-uri.ts new file mode 100644 index 00000000000..1501473560f --- /dev/null +++ b/src/shared/image-data-uri.ts @@ -0,0 +1,20 @@ +// Builds an inline `data:` URI for base64 image bytes, shared by the desktop +// editor ImageViewer and the mobile file preview so both decode images the same +// way. Strips whitespace from the payload (base64 from git diffs and SSH streams +// can arrive line-wrapped) and returns null when there is nothing an /RN +// can show — empty content or a non-image mime (PDF, octet-stream, …). +export function buildImageDataUri( + mimeType: string | undefined, + base64Content: string +): string | null { + // Only image/* renders in an /RN ; reject every other mime + // (application/pdf, application/octet-stream, …), not just PDF. + if (!mimeType?.startsWith('image/')) { + return null + } + const cleaned = base64Content.replace(/\s/g, '') + if (!cleaned) { + return null + } + return `data:${mimeType};base64,${cleaned}` +} diff --git a/src/shared/types.ts b/src/shared/types.ts index c805b9a0131..4d4301a0b6f 100644 --- a/src/shared/types.ts +++ b/src/shared/types.ts @@ -3742,6 +3742,13 @@ export type GitDiffBinaryResult = { isImage?: boolean /** MIME type for binary preview rendering, e.g. "image/png" or "application/pdf" */ mimeType?: string + /** + * True only when the modified side is a proven deletion (working-tree file gone + * or absent from the index) — distinct from an empty modified side caused by a + * read failure or size cap. Lets previewers fall back to the original bytes for + * a deletion without showing a stale image on a failed read. + */ + modifiedDeleted?: boolean } & ( | { originalIsBinary: true; modifiedIsBinary: boolean } | { originalIsBinary: boolean; modifiedIsBinary: true } From ce910e5d523438d1af6903933dc7f628e584328e Mon Sep 17 00:00:00 2001 From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:33:34 -0700 Subject: [PATCH 06/17] fix(naming): keep the built-in branch-name prompt general (#9088) * fix(naming): keep the built-in branch-name prompt general The shipped auto-rename prompt no longer hard-codes style rules (word count, kebab-case, no prefixes). Users can already override naming via Source Control AI instructions and the branch-name command template; a prescriptive default fought those overrides. Git-safe sanitization still runs after generation. * fix(naming): preserve branch prompt overrides * chore(skills): refresh rc.2 manifest version --- .../first-work-branch-rename.test.ts | 2 +- .../agent-hooks/first-work-branch-rename.ts | 5 +- src/main/persistence.test.ts | 2 +- .../commit-message-text-generation.test.ts | 10 ++- src/shared/branch-name-from-work.test.ts | 20 +++++- src/shared/branch-name-from-work.ts | 67 ++++++++++--------- src/shared/source-control-ai.test.ts | 16 ++++- src/shared/source-control-ai.ts | 67 ++++++++++++++++--- 8 files changed, 136 insertions(+), 53 deletions(-) diff --git a/src/main/agent-hooks/first-work-branch-rename.test.ts b/src/main/agent-hooks/first-work-branch-rename.test.ts index c1f46a602fb..1df5dbba930 100644 --- a/src/main/agent-hooks/first-work-branch-rename.test.ts +++ b/src/main/agent-hooks/first-work-branch-rename.test.ts @@ -140,7 +140,7 @@ describe('maybeAutoRenameBranchOnFirstWork', () => { }) it('strips a prefix the model leaked into the slug from both branch and display name', async () => { - // Model ignored "no prefixes" and echoed `you/worktree-spinner`, which the + // Model echoed `you/worktree-spinner`, which the // sanitizer folds to `you-worktree-spinner`; without stripping it would // double-prefix the branch (`you/you-...`) and show "You worktree spinner". generateBranchNameMock.mockResolvedValue({ success: true, slug: 'you-worktree-spinner' }) diff --git a/src/main/agent-hooks/first-work-branch-rename.ts b/src/main/agent-hooks/first-work-branch-rename.ts index c6e7fb8d10e..d669192907f 100644 --- a/src/main/agent-hooks/first-work-branch-rename.ts +++ b/src/main/agent-hooks/first-work-branch-rename.ts @@ -283,9 +283,8 @@ async function runAutoRename( const username = provider ? (await getSshGitUsername(provider, repo.path)) || null : (await resolveLocalGitUsername(repo.path)) || null - // The model is told not to add a prefix, but sometimes echoes the configured - // one (e.g. `tmchow/...`); strip it so it doesn't double-prefix the branch or - // leak into the display name. + // The model sometimes echoes the configured prefix (e.g. `tmchow/...`); strip + // it so it doesn't double-prefix the branch or leak into the display name. const slug = stripConfiguredBranchPrefix( generated.slug, getConfiguredBranchPrefix(settings, username) diff --git a/src/main/persistence.test.ts b/src/main/persistence.test.ts index 2cd0c36ef4c..39771208b1d 100644 --- a/src/main/persistence.test.ts +++ b/src/main/persistence.test.ts @@ -2508,7 +2508,7 @@ describe('Store', () => { }) expect(persisted.settings.sourceControlAi.actions.branchName).toEqual({ agentId: 'claude', - commandInputTemplate: '{basePrompt}\n\nRollback commit prompt' + commandInputTemplate: 'Rollback commit prompt\n\n{basePrompt}' }) }) diff --git a/src/main/text-generation/commit-message-text-generation.test.ts b/src/main/text-generation/commit-message-text-generation.test.ts index 4464bb8f4ed..3b921daf65b 100644 --- a/src/main/text-generation/commit-message-text-generation.test.ts +++ b/src/main/text-generation/commit-message-text-generation.test.ts @@ -1853,7 +1853,7 @@ describe('generateBranchNameFromContext', () => { }) }) - it('includes the branch-name custom prompt in the generated prompt', async () => { + it('keeps branch-name guidance first without dropping the output contract', async () => { let prompt = '' await generateBranchNameFromContext( { firstPrompt: 'Fix login flow' }, @@ -1861,7 +1861,8 @@ describe('generateBranchNameFromContext', () => { agentId: 'custom', model: '', customAgentCommand: 'agent', - customPrompt: 'Prefer auth terminology.' + customPrompt: 'Prefer auth terminology.', + commandInputTemplate: 'Prefer auth terminology.\n\n{basePrompt}' }, { kind: 'remote', @@ -1879,8 +1880,11 @@ describe('generateBranchNameFromContext', () => { } ) - expect(prompt).toContain('Additional user prompt:') + expect(prompt.startsWith('Prefer auth terminology.')).toBe(true) expect(prompt).toContain('Prefer auth terminology.') + expect(prompt).not.toContain('Additional user prompt:') + expect(prompt).toContain('Generate a short git branch name') + expect(prompt).toContain('Output ONLY the branch name on a single line') }) }) diff --git a/src/shared/branch-name-from-work.test.ts b/src/shared/branch-name-from-work.test.ts index a30c324cbfe..9b754cd92d1 100644 --- a/src/shared/branch-name-from-work.test.ts +++ b/src/shared/branch-name-from-work.test.ts @@ -100,6 +100,16 @@ describe('buildBranchNamePrompt', () => { expect(prompt).not.toContain("Agent's initial response") }) + it('keeps the default prompt general without style rules', () => { + const prompt = buildBranchNamePrompt({ firstPrompt: 'Add a logout button' }) + expect(prompt).toContain('Generate a short git branch name') + expect(prompt).toContain('Output ONLY the branch name on a single line') + expect(prompt).not.toContain('Rules:') + expect(prompt).not.toMatch(/kebab-case/i) + expect(prompt).not.toMatch(/between \d+ and \d+ words/i) + expect(prompt).not.toMatch(/no prefixes/i) + }) + it('includes the assistant response when present', () => { const prompt = buildBranchNamePrompt({ firstPrompt: 'Add a logout button', @@ -109,12 +119,16 @@ describe('buildBranchNamePrompt', () => { expect(prompt).toContain("I'll wire it into the header.") }) - it('appends a custom branch-name prompt when present', () => { + it('leads with a custom naming prompt so overrides can own style', () => { const prompt = buildBranchNamePrompt( { firstPrompt: 'Add a logout button' }, 'Prefer product nouns.' ) - expect(prompt).toContain('Additional user prompt:') - expect(prompt).toContain('Prefer product nouns.') + expect(prompt.startsWith('Prefer product nouns.')).toBe(true) + expect(prompt).not.toContain('Additional user prompt:') + expect(prompt).not.toContain('Rules:') + expect(prompt).toContain('Generate a git branch name') + expect(prompt).toContain('Output ONLY the branch name on a single line') + expect(prompt).toContain('Add a logout button') }) }) diff --git a/src/shared/branch-name-from-work.ts b/src/shared/branch-name-from-work.ts index abf30f38646..68880b38556 100644 --- a/src/shared/branch-name-from-work.ts +++ b/src/shared/branch-name-from-work.ts @@ -1,10 +1,9 @@ import { MARINE_CREATURES } from './marine-creatures' -// Why: the work-derived branch name stays short on purpose — long, sentence-like -// branches read worse than the creature name they replace. Two-to-four words is -// the sweet spot the feature targets. +// Why: post-generation sanitization still bounds the leaf so a long model dump +// cannot become an unreadable branch. The *prompt* stays general — users can +// override naming style via Source Control AI instructions / templates. export const MAX_BRANCH_NAME_WORDS = 4 -const MIN_BRANCH_NAME_WORDS = 2 const CREATURE_NAMES_LOWER = new Set(MARINE_CREATURES.map((name) => name.toLowerCase())) @@ -46,16 +45,15 @@ export function sanitizeBranchSlug(raw: string, maxWords = MAX_BRANCH_NAME_WORDS } /** - * Drop a leading prefix segment the generation model prepended despite the - * "no prefixes" instruction — e.g. with a `tmchow/` branch prefix the model - * emits `tmchow/worktree-spinner`, which `sanitizeBranchSlug` folds to - * `tmchow-worktree-spinner`. Left alone, that leaks the prefix into both the - * branch leaf (yielding a doubled `tmchow/tmchow-...`) and the humanized - * display name. Strips only when the leading segment matches the *configured* - * prefix, so a work-derived name that merely starts with a real word survives. - * Prefix-only output (the model echoed just `tmchow`) yields an empty slug so - * the caller skips the rename — otherwise it would double-prefix to - * `tmchow/tmchow`. + * Drop a leading prefix segment the generation model sometimes prepends (e.g. + * with a `tmchow/` branch prefix it emits `tmchow/worktree-spinner`, which + * `sanitizeBranchSlug` folds to `tmchow-worktree-spinner`). Left alone, that + * leaks the prefix into both the branch leaf (yielding a doubled + * `tmchow/tmchow-...`) and the humanized display name. Strips only when the + * leading segment matches the *configured* prefix, so a work-derived name that + * merely starts with a real word survives. Prefix-only output (the model + * echoed just `tmchow`) yields an empty slug so the caller skips the rename — + * otherwise it would double-prefix to `tmchow/tmchow`. */ export function stripConfiguredBranchPrefix( slug: string, @@ -100,30 +98,33 @@ export type BranchNameWorkContext = { } /** - * Build the text-generation prompt that asks the configured agent to summarize - * the work into a branch name. Kept in shared so the prompt is identical across - * local and SSH generation targets. + * Build the text-generation prompt that asks the configured agent to name the + * work. Kept in shared so the prompt is identical across local and SSH targets. + * + * Why: the shipped default stays general. Naming style is left open so users + * who override via Source Control AI instructions / the branch-name command + * template are not fighting a rigid built-in rule list. Git-safety (kebab, + * length) is enforced after generation by sanitizeBranchSlug. */ export function buildBranchNamePrompt(context: BranchNameWorkContext, customPrompt = ''): string { - const sections = [ - 'Generate a git branch name that summarizes the coding task described below.', - 'Rules:', - `- Use between ${MIN_BRANCH_NAME_WORDS} and ${MAX_BRANCH_NAME_WORDS} words.`, - '- Lowercase kebab-case only (words joined by single hyphens).', - '- No slashes, no prefixes, no quotes, no trailing punctuation.', - '- Describe the work itself, not the agent or the repository.', - '- Output ONLY the branch name on a single line, nothing else.', - '', - 'User request:', - context.firstPrompt.trim() - ] + const sections: string[] = [] + const prompt = customPrompt.trim() + // Why: when the user supplies naming guidance, lead with it so their + // override owns style rather than sitting under a prescriptive default. + if (prompt) { + sections.push(prompt, '') + } + sections.push( + prompt + ? 'Generate a git branch name that summarizes the coding task described below.' + : 'Generate a short git branch name that summarizes the coding task described below.', + 'Output ONLY the branch name on a single line, nothing else.', + '' + ) + sections.push('User request:', context.firstPrompt.trim()) const assistant = context.assistantMessage?.trim() if (assistant) { sections.push('', "Agent's initial response:", assistant) } - const prompt = customPrompt.trim() - if (prompt) { - sections.push('', 'Additional user prompt:', prompt) - } return sections.join('\n') } diff --git a/src/shared/source-control-ai.test.ts b/src/shared/source-control-ai.test.ts index 2b560889b62..54a35115b87 100644 --- a/src/shared/source-control-ai.test.ts +++ b/src/shared/source-control-ai.test.ts @@ -313,11 +313,19 @@ describe('source-control AI resolution', () => { }).params.customPrompt ).toBe('Repo commit style') expect(resolve('branchName').params.customPrompt).toBe('Global branch style') + expect(resolve('branchName').params.commandInputTemplate).toBe( + 'Global branch style\n\n{basePrompt}' + ) expect( resolve('branchName', { instructionsByOperation: { branchName: 'Repo branch style' } }).params.customPrompt ).toBe('Repo branch style') + expect( + resolve('branchName', { + instructionsByOperation: { branchName: 'Repo branch style' } + }).params.commandInputTemplate + ).toBe('Repo branch style\n\n{basePrompt}') }) it('does not treat null repo instructions as configured overrides', () => { @@ -368,6 +376,12 @@ describe('source-control AI resolution', () => { expect(migrated.instructionsByOperation.commitMessage).toBe('Legacy commit prompt') expect(migrated.instructionsByOperation.pullRequest).toBe('') expect(migrated.instructionsByOperation.branchName).toBe('Legacy commit prompt') + expect(migrated.actions?.commitMessage?.commandInputTemplate).toBe( + '{basePrompt}\n\nLegacy commit prompt' + ) + expect(migrated.actions?.branchName?.commandInputTemplate).toBe( + 'Legacy commit prompt\n\n{basePrompt}' + ) }) it('merges legacy commit-message updates without wiping PR-only settings', () => { @@ -702,7 +716,7 @@ describe('source-control AI resolution', () => { commandInputTemplate: '{basePrompt}' }, branchName: { - commandInputTemplate: '{basePrompt}\n\nbranch style' + commandInputTemplate: 'branch style\n\n{basePrompt}' } }, prCreationDefaults: { diff --git a/src/shared/source-control-ai.ts b/src/shared/source-control-ai.ts index 31adf5ac70d..2ca3541916a 100644 --- a/src/shared/source-control-ai.ts +++ b/src/shared/source-control-ai.ts @@ -296,13 +296,15 @@ export function normalizeRepoSourceControlAiOverrides( const migratedActionOverrides = { ...actionOverrides } for (const operation of SOURCE_CONTROL_TEXT_ACTION_IDS) { const instruction = instructionsByOperation?.[operation] + const existingTemplate = migratedActionOverrides[operation]?.commandInputTemplate if ( typeof instruction === 'string' && - migratedActionOverrides[operation]?.commandInputTemplate === undefined + (existingTemplate === undefined || + isLegacyBranchInstructionTemplate(operation, instruction, existingTemplate)) ) { migratedActionOverrides[operation] = { ...migratedActionOverrides[operation], - commandInputTemplate: commandTemplateFromInstruction(instruction) + commandInputTemplate: commandTemplateFromOperationInstruction(operation, instruction) } } } @@ -324,6 +326,35 @@ function commandTemplateFromInstruction(instruction: string | null | undefined): return ['{basePrompt}', '', trimmed].join('\n') } +function commandTemplateFromOperationInstruction( + operation: SourceControlAiOperation, + instruction: string | null | undefined +): string { + const trimmed = instruction?.trim() + if (!trimmed) { + return '{basePrompt}' + } + // Why: branch naming instructions define naming style, so they must precede + // the general built-in prompt. Other operations retain their released order. + return operation === 'branchName' + ? [trimmed, '', '{basePrompt}'].join('\n') + : commandTemplateFromInstruction(trimmed) +} + +function isLegacyBranchInstructionTemplate( + operation: SourceControlAiOperation, + instruction: string | null | undefined, + template: string | null | undefined +): boolean { + // Why: reorder only the exact template older settings derived automatically; + // a user-authored command template remains authoritative. + return ( + operation === 'branchName' && + Boolean(instruction?.trim()) && + template === commandTemplateFromInstruction(instruction) + ) +} + function actionRecipeFromLegacyCommitMessageAi(legacy: CommitMessageAiSettings): { agentId?: TuiAgent | CustomAgentId | null commandInputTemplate: string @@ -400,7 +431,10 @@ function shouldImportLegacyBranchPrompt( projectedLegacy: CommitMessageAiSettings ): boolean { const branchRecipe = readSourceControlActionDefault(base.actions, 'branchName') - const projectedTemplate = commandTemplateFromInstruction(projectedLegacy.customPrompt) + const projectedTemplate = commandTemplateFromOperationInstruction( + 'branchName', + projectedLegacy.customPrompt + ) return ( branchRecipe.commandInputTemplate === undefined || branchRecipe.commandInputTemplate === @@ -473,7 +507,13 @@ export function sourceControlAiSettingsFromLegacy( actions: { ...defaults.actions, commitMessage: legacyActionRecipe, - branchName: legacyActionRecipe + branchName: { + ...legacyActionRecipe, + commandInputTemplate: commandTemplateFromOperationInstruction( + 'branchName', + legacy.customPrompt + ) + } } } } @@ -640,7 +680,12 @@ export function mergeLegacyCommitMessageAiIntoSourceControlAi( ? applyLegacyAgentToActionRecipe(base.actions?.branchName, legacy.agentId) : base.actions?.branchName), ...(shouldMergeBranchPrompt - ? { commandInputTemplate: legacyActionRecipe.commandInputTemplate } + ? { + commandInputTemplate: commandTemplateFromOperationInstruction( + 'branchName', + legacy.customPrompt + ) + } : {}) } } @@ -693,15 +738,21 @@ export function normalizeSourceControlAiSettings( const existing = readSourceControlActionDefault(normalizedActions, actionId) const instruction = base.instructionsByOperation?.[actionId] const legacyInstruction = actionId === 'commitMessage' ? legacy?.customPrompt : undefined + const resolvedInstruction = instruction ?? legacyInstruction const instructionTemplate = instruction || legacyInstruction - ? commandTemplateFromInstruction(instruction ?? legacyInstruction) + ? commandTemplateFromOperationInstruction(actionId, resolvedInstruction) : undefined const shouldApplyInstructionTemplate = instructionTemplate !== undefined && (existing.commandInputTemplate === undefined || existing.commandInputTemplate === - DEFAULT_SOURCE_CONTROL_ACTION_COMMAND_TEMPLATES[actionId]) + DEFAULT_SOURCE_CONTROL_ACTION_COMMAND_TEMPLATES[actionId] || + isLegacyBranchInstructionTemplate( + actionId, + resolvedInstruction, + existing.commandInputTemplate + )) return [ actionId, { @@ -1048,7 +1099,7 @@ function resolveActionRecipeForTextOperation( ) const fallbackTemplate = repoInstruction !== undefined - ? commandTemplateFromInstruction(repoInstruction) + ? commandTemplateFromOperationInstruction(operation, repoInstruction) : resolveSourceControlActionCommandTemplate(source.actions, operation) const repoTemplate = typeof repoRecipe?.commandInputTemplate === 'string' From 900397369c23f9bde0b5c14c45ebd315c4ffaea9 Mon Sep 17 00:00:00 2001 From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:33:48 -0700 Subject: [PATCH 07/17] fix(settings): show "Up to date" for current skills in settings sidebar (#9086) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(settings): show "Up to date" for current skills in sidebar Orchestration and Computer Use showed a green "Installed" badge in the settings sidebar even when freshness tracking knows the copy is current. Add an "up-to-date" nav status so a present, no-update skill reads "Up to date" (pairing with the existing "Update available" state), while Voice — which tracks model readiness, not skill freshness — keeps "Installed". * fix(settings): require freshness proof for current badge Only label a skill Up to date when every discovered placement is current. Keep Installed for unloaded, blocked, inaccessible, or unrecognized inventories, and share the classifier with the existing freshness pill. Regenerate the current skill manifest so its app version matches the package release and the required verification gate passes. --- .../src/components/settings/Settings.tsx | 18 +++-- .../settings/SettingsSidebar.test.tsx | 7 ++ .../components/settings/SettingsSidebar.tsx | 4 +- .../skills/SkillFreshnessStatusPill.tsx | 13 ++-- .../src/lib/settings-navigation-types.ts | 7 +- .../skill-freshness-display-status.test.ts | 69 +++++++++++++++++++ .../src/lib/skill-freshness-display-status.ts | 25 +++++++ 7 files changed, 125 insertions(+), 18 deletions(-) create mode 100644 src/renderer/src/lib/skill-freshness-display-status.test.ts create mode 100644 src/renderer/src/lib/skill-freshness-display-status.ts diff --git a/src/renderer/src/components/settings/Settings.tsx b/src/renderer/src/components/settings/Settings.tsx index 0d4c2d5d537..ef50a504a3a 100644 --- a/src/renderer/src/components/settings/Settings.tsx +++ b/src/renderer/src/components/settings/Settings.tsx @@ -12,6 +12,7 @@ import { import { toast } from 'sonner' import type { GlobalSettings, OrcaHooks, ProjectHostSetup, Repo } from '../../../../shared/types' import type { SpeechModelState } from '../../../../shared/speech-types' +import type { SkillFreshnessInventory } from '../../../../shared/skill-freshness' import type { SourceControlAiSettings, SourceControlAiSettingsPatch @@ -101,6 +102,7 @@ import { } from '@/hooks/useInstalledAgentSkills' import { useActiveProjectSkillRuntime } from '@/hooks/useActiveProjectSkillRuntime' import { useSkillFreshness } from '@/hooks/useSkillFreshness' +import { getSkillFreshnessDisplayStatus } from '@/lib/skill-freshness-display-status' import { deriveNeededSectionIds, getInitialMountedSectionIds } from './settings-load-performance' import { translate } from '@/i18n/i18n' import { getProjectHostSetupProjectionFromState } from '../../store/selectors' @@ -206,9 +208,10 @@ function getSettingsNavGroupDefinitionsForSearch( } function getSkillNavInstallStatus(skill: { + name: string installed: boolean loading: boolean - updateAvailable?: boolean + inventory: SkillFreshnessInventory | null }): SettingsNavInstallStatus { if (skill.loading) { return 'checking' @@ -216,7 +219,7 @@ function getSkillNavInstallStatus(skill: { if (!skill.installed) { return 'install' } - return skill.updateAvailable ? 'update-available' : 'installed' + return getSkillFreshnessDisplayStatus(skill.inventory, skill.name) } function hasReadyVoiceModel( @@ -733,16 +736,16 @@ function Settings(): React.JSX.Element { orchestrationSkill const { installed: computerUseSkillInstalled, loading: computerUseSkillLoading } = computerUseSkill - const eligibleUpdateSkillNames = skillFreshnessInventory?.eligibleUpdateNames const capabilityInstallStatusBySectionId = useMemo(() => { - const eligibleUpdates = new Set(skillFreshnessApplies ? (eligibleUpdateSkillNames ?? []) : []) + const applicableFreshnessInventory = skillFreshnessApplies ? skillFreshnessInventory : null const next = new Map([ [ 'orchestration', getSkillNavInstallStatus({ + name: ORCHESTRATION_SKILL_NAME, installed: orchestrationSkillInstalled, loading: orchestrationSkillLoading, - updateAvailable: eligibleUpdates.has(ORCHESTRATION_SKILL_NAME) + inventory: applicableFreshnessInventory }) ] ]) @@ -750,9 +753,10 @@ function Settings(): React.JSX.Element { next.set( 'computer-use', getSkillNavInstallStatus({ + name: COMPUTER_USE_SKILL_NAME, installed: computerUseSkillInstalled, loading: computerUseSkillLoading, - updateAvailable: eligibleUpdates.has(COMPUTER_USE_SKILL_NAME) + inventory: applicableFreshnessInventory }) ) if (settings) { @@ -770,13 +774,13 @@ function Settings(): React.JSX.Element { }, [ computerUseSkillInstalled, computerUseSkillLoading, - eligibleUpdateSkillNames, modelStates, orchestrationSkillInstalled, orchestrationSkillLoading, settings, showDesktopOnlySettings, skillFreshnessApplies, + skillFreshnessInventory, voiceModelStatesLoading ]) const navSections = useMemo( diff --git a/src/renderer/src/components/settings/SettingsSidebar.test.tsx b/src/renderer/src/components/settings/SettingsSidebar.test.tsx index 11eb49163a0..6fec899efea 100644 --- a/src/renderer/src/components/settings/SettingsSidebar.test.tsx +++ b/src/renderer/src/components/settings/SettingsSidebar.test.tsx @@ -62,6 +62,12 @@ function renderSidebar( title: 'Voice', icon: Mic, installStatus: 'installed' + }, + { + id: 'computer-use', + title: 'Computer Use', + icon: Bot, + installStatus: 'up-to-date' } ] }, @@ -114,6 +120,7 @@ describe('SettingsSidebar', () => { expect(markup).toContain('Not installed') expect(markup).toContain('Installed') + expect(markup).toContain('Up to date') expect(markup).toContain('Optional') }) diff --git a/src/renderer/src/components/settings/SettingsSidebar.tsx b/src/renderer/src/components/settings/SettingsSidebar.tsx index 8029eabda1a..54908713bc6 100644 --- a/src/renderer/src/components/settings/SettingsSidebar.tsx +++ b/src/renderer/src/components/settings/SettingsSidebar.tsx @@ -155,6 +155,8 @@ export function SettingsSidebar({ ) case 'installed': return translate('auto.components.settings.AgentSkillSetupPanel.9fcebceb2a', 'Installed') + case 'up-to-date': + return translate('auto.components.skills.SkillFreshnessStatusPill.upToDate', 'Up to date') case 'update-available': return translate( 'auto.components.skills.SkillFreshnessStatusPill.updateAvailable', @@ -167,7 +169,7 @@ export function SettingsSidebar({ const installStatusClassName = (status: SettingsNavInstallStatus): string => cn( 'ml-auto shrink-0 rounded-full border px-1.5 py-0.5 text-[10px] font-medium leading-none', - status === 'installed' + status === 'installed' || status === 'up-to-date' ? 'border-status-success-border bg-status-success-background text-status-success' : status === 'update-available' ? 'border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-300' diff --git a/src/renderer/src/components/skills/SkillFreshnessStatusPill.tsx b/src/renderer/src/components/skills/SkillFreshnessStatusPill.tsx index 3c858686591..d71bf0d8ba7 100644 --- a/src/renderer/src/components/skills/SkillFreshnessStatusPill.tsx +++ b/src/renderer/src/components/skills/SkillFreshnessStatusPill.tsx @@ -1,6 +1,7 @@ import { useSkillFreshness } from '@/hooks/useSkillFreshness' import { translate } from '@/i18n/i18n' import { IntegrationStatusPill } from '@/components/integration-status-pill' +import { getSkillFreshnessDisplayStatus } from '@/lib/skill-freshness-display-status' // Why: the setup rails' Installed pill is presence-only; when freshness knows a // safe update exists (or that every copy is current) the pill should say so. @@ -8,7 +9,8 @@ import { IntegrationStatusPill } from '@/components/integration-status-pill' // placement is never advertised as updatable here. export function SkillFreshnessStatusPill({ skillName }: { skillName: string }): React.JSX.Element { const { inventory } = useSkillFreshness() - if (inventory?.eligibleUpdateNames.includes(skillName)) { + const status = getSkillFreshnessDisplayStatus(inventory, skillName) + if (status === 'update-available') { return ( {translate( @@ -18,14 +20,7 @@ export function SkillFreshnessStatusPill({ skillName }: { skillName: string }): ) } - const placements = inventory?.installations.filter( - (installation) => installation.name === skillName - ) - if ( - placements && - placements.length > 0 && - placements.every((installation) => installation.status === 'current') - ) { + if (status === 'up-to-date') { return ( {translate('auto.components.skills.SkillFreshnessStatusPill.upToDate', 'Up to date')} diff --git a/src/renderer/src/lib/settings-navigation-types.ts b/src/renderer/src/lib/settings-navigation-types.ts index 3541c0e3f2a..b59ed0f6768 100644 --- a/src/renderer/src/lib/settings-navigation-types.ts +++ b/src/renderer/src/lib/settings-navigation-types.ts @@ -3,7 +3,12 @@ import type { LucideProps } from 'lucide-react' import type { SettingsSearchEntry } from '@/components/settings/settings-search' export type SettingsNavIcon = ComponentType -export type SettingsNavInstallStatus = 'install' | 'installed' | 'update-available' | 'checking' +export type SettingsNavInstallStatus = + | 'install' + | 'installed' + | 'up-to-date' + | 'update-available' + | 'checking' export type SettingsNavTarget = | 'general' diff --git a/src/renderer/src/lib/skill-freshness-display-status.test.ts b/src/renderer/src/lib/skill-freshness-display-status.test.ts new file mode 100644 index 00000000000..9d244007d0e --- /dev/null +++ b/src/renderer/src/lib/skill-freshness-display-status.test.ts @@ -0,0 +1,69 @@ +import { describe, expect, it } from 'vitest' +import type { + SkillFreshnessInstallation, + SkillFreshnessInventory, + SkillFreshnessStatus +} from '../../../shared/skill-freshness' +import { getSkillFreshnessDisplayStatus } from './skill-freshness-display-status' + +const SKILL_NAME = 'orca-cli' + +function placement(status: SkillFreshnessStatus, index = 0): SkillFreshnessInstallation { + return { + id: `${SKILL_NAME}-${index}`, + name: SKILL_NAME, + rootId: 'home-agents', + providers: ['agent-skills'], + sourceKind: 'home', + sourceLabel: 'Agent skills home', + unresolvedPath: `/home/.agents/skills/${SKILL_NAME}-${index}`, + resolvedPath: `/home/.agents/skills/${SKILL_NAME}-${index}`, + physicalIdentity: `physical-${index}`, + topology: 'canonical-copy', + status, + installedReleaseRevision: 1, + installedAppVersion: '1.0.0', + currentReleaseRevision: 2, + currentPackageDigest: 'current', + currentAppVersion: '2.0.0', + observedPackageDigest: status === 'current' ? 'current' : 'other', + errorCategory: null + } +} + +function inventory( + installations: SkillFreshnessInstallation[], + eligibleUpdateNames: string[] = [] +): SkillFreshnessInventory { + return { schemaVersion: 1, installations, eligibleUpdateNames, scannedAt: 1 } +} + +describe('getSkillFreshnessDisplayStatus', () => { + it('shows update available when the inventory authorizes an update', () => { + expect( + getSkillFreshnessDisplayStatus(inventory([placement('outdated')], [SKILL_NAME]), SKILL_NAME) + ).toBe('update-available') + }) + + it('shows up to date only when every discovered placement is current', () => { + expect( + getSkillFreshnessDisplayStatus( + inventory([placement('current'), placement('current', 1)]), + SKILL_NAME + ) + ).toBe('up-to-date') + }) + + it.each([ + ['before the inventory loads', null], + ['when the inventory has no matching placement', inventory([])], + [ + 'when any placement is unrecognized', + inventory([placement('current'), placement('unrecognized', 1)]) + ], + ['when a placement is inaccessible', inventory([placement('inaccessible')])], + ['when an outdated placement is not eligible', inventory([placement('outdated')])] + ])('falls back to installed %s', (_scenario, value) => { + expect(getSkillFreshnessDisplayStatus(value, SKILL_NAME)).toBe('installed') + }) +}) diff --git a/src/renderer/src/lib/skill-freshness-display-status.ts b/src/renderer/src/lib/skill-freshness-display-status.ts new file mode 100644 index 00000000000..25264022659 --- /dev/null +++ b/src/renderer/src/lib/skill-freshness-display-status.ts @@ -0,0 +1,25 @@ +import type { SkillFreshnessInventory } from '../../../shared/skill-freshness' + +export type SkillFreshnessDisplayStatus = 'installed' | 'up-to-date' | 'update-available' + +export function getSkillFreshnessDisplayStatus( + inventory: SkillFreshnessInventory | null, + skillName: string +): SkillFreshnessDisplayStatus { + if (inventory?.eligibleUpdateNames.includes(skillName)) { + return 'update-available' + } + + let hasPlacement = false + for (const installation of inventory?.installations ?? []) { + if (installation.name !== skillName) { + continue + } + hasPlacement = true + // No eligible update is not proof that a blocked or unrecognized copy is current. + if (installation.status !== 'current') { + return 'installed' + } + } + return hasPlacement ? 'up-to-date' : 'installed' +} From f6f25616234da3bd33c3d1ea720b8b33a3c8f6da Mon Sep 17 00:00:00 2001 From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:39:11 -0700 Subject: [PATCH 08/17] ci(release): regenerate skill manifest on version bump (#9117) * ci(release): regenerate skill manifest on version bump The release-cut "Bump package.json and tag" step bumped package.json but never regenerated resources/skills/current-manifest.json, so its appVersion stayed at the prior release. That drift shipped in v1.4.144-rc.1, rc.2, and rc.3 (all carried an rc.1 manifest) and turns verify:skill-bundle-manifest red on every branch after a cut, since that check runs in `pnpm lint` and the PR `verify` job. Regenerate the manifest right after `npm version` and stage resources/skills into the release commit so the bundled manifest always matches the shipped version. The generator is dependency-free (node builtins + git), so it runs without a pnpm install, and the step's fetch-depth:0 checkout supplies the tag history it reads. * test(release): guard skill manifest regeneration * test(release): require full history for skill manifest --- .github/workflows/release-cut.yml | 5 ++++- .../package-electron-runtime-contract.test.mjs | 14 +++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml index 605645186fb..1409ed1c371 100644 --- a/.github/workflows/release-cut.yml +++ b/.github/workflows/release-cut.yml @@ -472,7 +472,10 @@ jobs: # message and tag name explicitly (avoids npm's `v1.2.3` prefix # assumptions and any lifecycle scripts that would run on bump). npm version "$VERSION" --no-git-tag-version --allow-same-version - git add package.json + # Why: package version is embedded in generated skill provenance; full tag + # history preserves released snapshots while the current version is updated. + node config/scripts/generate-skill-bundle-manifest.mjs --write + git add package.json resources/skills commit_message="release: v$VERSION" if [[ "$EVENT_NAME" == "schedule" ]]; then commit_message="$commit_message [rc-slot:$SLOT]" diff --git a/config/scripts/package-electron-runtime-contract.test.mjs b/config/scripts/package-electron-runtime-contract.test.mjs index 0514453128b..e6f6018e6b0 100644 --- a/config/scripts/package-electron-runtime-contract.test.mjs +++ b/config/scripts/package-electron-runtime-contract.test.mjs @@ -374,16 +374,28 @@ describe('Electron runtime package contract', () => { expect(afterInstallScript).not.toContain('chmod 0755 "$sandbox"') }) - it('lets release-cut tag a version that is already present on main', () => { + it('keeps release-cut version commits self-healing and taggable on retries', () => { const releaseWorkflow = readFileSync( join(projectDir, '.github/workflows/release-cut.yml'), 'utf8' ) const parsedWorkflow = parse(releaseWorkflow) + const checkoutStep = parsedWorkflow.jobs.cut.steps.find((step) => step.name === 'Checkout ref') const bumpStep = parsedWorkflow.jobs.cut.steps.find( (step) => step.name === 'Bump package.json and tag' ) + const bumpIndex = bumpStep.run.indexOf( + 'npm version "$VERSION" --no-git-tag-version --allow-same-version' + ) + const generateIndex = bumpStep.run.indexOf( + 'node config/scripts/generate-skill-bundle-manifest.mjs --write' + ) + const stageIndex = bumpStep.run.indexOf('git add package.json resources/skills') + expect(checkoutStep.with['fetch-depth']).toBe(0) + expect(bumpIndex).toBeGreaterThanOrEqual(0) + expect(generateIndex).toBeGreaterThan(bumpIndex) + expect(stageIndex).toBeGreaterThan(generateIndex) expect(bumpStep.run).toContain('git diff --cached --quiet') expect(bumpStep.run).toContain('git commit --allow-empty -m "$commit_message"') }) From 91ece6ca7edf10472ee47464aaace8d7046d230d Mon Sep 17 00:00:00 2001 From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:41:49 -0700 Subject: [PATCH 09/17] fix(terminal): tear down runtime-owned headless PTYs on whole-tab close (#9114) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(terminal): tear down runtime-owned headless PTYs on whole-tab close #8958 placed the closeTerminalTab renderer relay ahead of the authoritative headless teardown in closeMobileSessionTab. Production always wires closeTerminalTab, so the teardown became dead code for whole-parent closes whenever a window is attached. The relay resolves close targets only from renderer state (resolveTerminalCloseTarget), which never contains a runtime-owned headless tab, so it acks success without killing the PTY — leaking SSH-durable/serve PTYs and letting syncMobileSessionTabs republish the "closed" tab (the exact case the removed comment warned about). Run the isRuntimeOwnedHeadlessMobileTab teardown before the relay so headless tabs are killed and pruned authoritatively even with a renderer attached; normal adopted tabs still take the durable closeTerminalTab path. Add a regression test that wires both notifiers (prior tests covered only the no-notifier and in-graph cases). * fix(terminal): preserve adopted tab close guards * fix(runtime): preserve headless close durability on notifier failure --- src/main/runtime/orca-runtime.test.ts | 128 ++++++++++++++++++++++++++ src/main/runtime/orca-runtime.ts | 38 ++++++-- 2 files changed, 157 insertions(+), 9 deletions(-) diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts index 15a59321409..ba20f682015 100644 --- a/src/main/runtime/orca-runtime.test.ts +++ b/src/main/runtime/orca-runtime.test.ts @@ -19722,6 +19722,134 @@ describe('OrcaRuntimeService', () => { expect(getSession().terminalLayoutsByTabId['host-tab']).toBeUndefined() }) + it('durably tears down a runtime-owned SSH headless tab when renderer cleanup fails', async () => { + // #8958 regression: the acknowledged renderer relay cannot see headless tabs; + // its advisory fallback must not prevent authoritative teardown or flushing. + const persistedPtyId = 'ssh:ssh-1@@relay-pty' + const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession( + makeWorkspaceSessionWithHeadlessTerminal({ + tabsByWorktree: { + [TEST_WORKTREE_ID]: [ + { + id: 'host-tab', + ptyId: persistedPtyId, + worktreeId: TEST_WORKTREE_ID, + title: 'Remote Terminal', + customTitle: null, + color: null, + sortOrder: 0, + createdAt: 1 + } + ] + }, + terminalLayoutsByTabId: { + 'host-tab': makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: persistedPtyId }) + } + }) + ) + const kill = vi.fn(() => true) + const flushOrThrow = vi.fn() + const rendererError = new Error('renderer unavailable') + const closeTerminal = vi.fn(() => { + throw rendererError + }) + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + const closeTerminalTab = vi.fn(async () => {}) + const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never) + runtime.setPtyController({ + write: () => true, + kill, + getForegroundProcess: async () => null, + listProcesses: async () => [{ id: persistedPtyId, cwd: TEST_WORKTREE_PATH, title: 'Remote' }] + }) + runtime.setNotifier({ closeTerminal, closeTerminalTab } as never) + runtime.syncWindowGraph(0, { tabs: [], leaves: [] }) + + await runtime.closeMobileSessionTab(`id:${TEST_WORKTREE_ID}`, 'host-tab') + + expect(closeTerminalTab).not.toHaveBeenCalled() + expect(kill).toHaveBeenCalledWith(persistedPtyId) + expect(closeTerminal).toHaveBeenCalledWith('host-tab') + expect(flushOrThrow).toHaveBeenCalledTimes(1) + expect(warn).toHaveBeenCalledWith( + '[runtime] failed to notify renderer after headless terminal close', + { parentTabId: 'host-tab', error: rendererError } + ) + expect(getSession().tabsByWorktree[TEST_WORKTREE_ID]).toEqual([]) + expect(getSession().terminalLayoutsByTabId['host-tab']).toBeUndefined() + }) + + it('keeps the renderer close transaction for an adopted runtime-owned tab', async () => { + // The renderer pin state can be newer than the debounced workspace session. + // Once adopted, its live close guard must win over stale persisted metadata. + const servePtyId = 'serve-adopted-1' + const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession( + makeWorkspaceSessionWithHeadlessTerminal({ + tabsByWorktree: { + [TEST_WORKTREE_ID]: [ + { + id: 'host-tab', + ptyId: servePtyId, + worktreeId: TEST_WORKTREE_ID, + title: 'Adopted Terminal', + customTitle: null, + color: null, + sortOrder: 0, + createdAt: 1, + isPinned: false + } + ] + }, + terminalLayoutsByTabId: { + 'host-tab': makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: servePtyId }) + } + }) + ) + const kill = vi.fn(() => true) + const closeTerminal = vi.fn() + const closeTerminalTab = vi.fn(async () => { + throw new Error('terminal_tab_pinned') + }) + const runtime = new OrcaRuntimeService(runtimeStore as never) + runtime.setPtyController({ + write: () => true, + kill, + getForegroundProcess: async () => null, + listProcesses: async () => [{ id: servePtyId, cwd: TEST_WORKTREE_PATH, title: 'Adopted' }] + }) + runtime.setNotifier({ closeTerminal, closeTerminalTab } as never) + runtime.syncWindowGraph(1, { + tabs: [ + { + tabId: 'host-tab', + worktreeId: TEST_WORKTREE_ID, + title: 'Adopted Terminal', + activeLeafId: HEADLESS_LEAF_ID, + layout: null + } + ], + leaves: [ + { + tabId: 'host-tab', + worktreeId: TEST_WORKTREE_ID, + leafId: HEADLESS_LEAF_ID, + paneRuntimeId: 1, + ptyId: servePtyId + } + ] + }) + + await expect( + runtime.closeMobileSessionTab(`id:${TEST_WORKTREE_ID}`, 'host-tab') + ).rejects.toThrow('terminal_tab_pinned') + + expect(closeTerminalTab).toHaveBeenCalledWith('host-tab') + expect(closeTerminal).not.toHaveBeenCalled() + expect(kill).not.toHaveBeenCalled() + expect(getSession().tabsByWorktree[TEST_WORKTREE_ID]).toHaveLength(1) + expect(getSession().terminalLayoutsByTabId['host-tab']).toBeDefined() + }) + it('materializes hydrated pending headless terminals with the persisted session identity', async () => { const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession( makeWorkspaceSessionWithHeadlessTerminal() diff --git a/src/main/runtime/orca-runtime.ts b/src/main/runtime/orca-runtime.ts index 40bfc0e5691..fdf3657e08e 100644 --- a/src/main/runtime/orca-runtime.ts +++ b/src/main/runtime/orca-runtime.ts @@ -4685,26 +4685,33 @@ export class OrcaRuntimeService { (candidate) => candidate.type === 'terminal' && candidate.parentTabId === tab.parentTabId ).length const closingWholeParent = tab.id !== tabId || parentLeafCount <= 1 + // Why: a runtime-owned headless tab is absent from renderer state, so the + // closeTerminalTab relay below would ack success without killing its PTY, + // and syncMobileSessionTabs would republish the "closed" tab. Only bypass + // the relay when no renderer owns the parent: an adopted tab needs the + // renderer's live pin guard and durable close transaction. + if (closingWholeParent && !this.tabs.has(tab.parentTabId)) { + this.closeHeadlessMobileTerminalTab(worktreeId, snapshot!, tab) + this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId) + this.store?.flushOrThrow?.() + return { closed: true } + } if (closingWholeParent && this.notifier?.closeTerminalTab) { // Why: whole-tab close is a lifecycle transaction. The renderer reply // arrives only after canonical retirement and a forced session flush. await this.notifier.closeTerminalTab(tab.parentTabId) return { closed: true } } - if (!this.notifier?.closeTerminal) { + // Why: notifier implementations without the acknowledged relay may expose + // only raw pane close. Runtime-owned parents still need de-persist + kill. + if (closingWholeParent && this.isRuntimeOwnedHeadlessMobileTab(worktreeId, tab)) { this.closeHeadlessMobileTerminalTab(worktreeId, snapshot!, tab) + this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId) this.store?.flushOrThrow?.() return { closed: true } } - // Why: a runtime-owned headless tab whose whole parent is being closed must - // be torn down authoritatively even with a renderer attached — kill the - // PTY, drop the persisted binding, and prune+emit — or syncMobileSessionTabs - // keeps republishing the "closed" tab with a live PTY. Best-effort notify the - // renderer too so any adopted pane closes (no dead pane). A single split leaf - // (exact id, multi-leaf parent) keeps the per-leaf path so siblings survive. - if (closingWholeParent && this.isRuntimeOwnedHeadlessMobileTab(worktreeId, tab)) { + if (!this.notifier?.closeTerminal) { this.closeHeadlessMobileTerminalTab(worktreeId, snapshot!, tab) - this.notifier?.closeTerminal(tab.parentTabId) this.store?.flushOrThrow?.() return { closed: true } } @@ -4732,6 +4739,19 @@ export class OrcaRuntimeService { return { closed: true } } + private notifyRendererOfHeadlessTerminalClose(parentTabId: string): void { + // Why: this relay is advisory after main owns teardown; renderer failure must + // not prevent the authoritative session flush or turn the close into failure. + try { + this.notifier?.closeTerminal(parentTabId) + } catch (error) { + console.warn('[runtime] failed to notify renderer after headless terminal close', { + parentTabId, + error + }) + } + } + private async closeHeadlessMobileBrowserTab( worktreeId: string, snapshot: RuntimeMobileSessionTabsSnapshot, From 3b227d06e890f98486027bdc09edf1f723440601 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 17 Jul 2026 01:52:57 +0000 Subject: [PATCH 10/17] release: v1.4.144-rc.4 --- package.json | 2 +- resources/skills/current-manifest.json | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index 292873687f1..147a7c89226 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "orca", - "version": "1.4.144-rc.2", + "version": "1.4.144-rc.4", "description": "Next-gen IDE for parallel agentic development", "homepage": "https://github.com/stablyai/orca", "author": "stablyai", diff --git a/resources/skills/current-manifest.json b/resources/skills/current-manifest.json index 51cbb6af5cc..cea063aa334 100644 --- a/resources/skills/current-manifest.json +++ b/resources/skills/current-manifest.json @@ -1,11 +1,11 @@ { "schemaVersion": 1, - "appVersion": "1.4.144-rc.2", + "appVersion": "1.4.144-rc.4", "skills": [ { "name": "computer-use", "sourcePath": "skills/computer-use", - "appVersion": "1.4.144-rc.2", + "appVersion": "1.4.144-rc.4", "releaseRevision": 5, "packageDigest": "cd2809474d57fd7277adb277448e6fa446810d3cbad71ac0b473b9e8ff1bad68", "gitTreeSha": "306c0f8cb63bcac265a5b7975dc2f855be4f1344", @@ -24,7 +24,7 @@ { "name": "linear-tickets", "sourcePath": "skills/linear-tickets", - "appVersion": "1.4.144-rc.2", + "appVersion": "1.4.144-rc.4", "releaseRevision": 4, "packageDigest": "f198d7b22e5ee1673dac403f9cca0553b124e0a90e4fdd05d2c23b7344e32d2b", "gitTreeSha": "de9fc106bbb4e313a90ff9a9513a720909bbd176", @@ -43,7 +43,7 @@ { "name": "orca-cli", "sourcePath": "skills/orca-cli", - "appVersion": "1.4.144-rc.2", + "appVersion": "1.4.144-rc.4", "releaseRevision": 32, "packageDigest": "51740ff13f379ac5743d3fd28a14b17168dcef40f7048c20182dce166098c45f", "gitTreeSha": "ded93000a5f654e2b4f324501282459bd56afe19", @@ -62,7 +62,7 @@ { "name": "orca-emulator", "sourcePath": "skills/orca-emulator", - "appVersion": "1.4.144-rc.2", + "appVersion": "1.4.144-rc.4", "releaseRevision": 4, "packageDigest": "453b1d9aa20b51b8a4d32c7b6def6a93f7ef9c730de32abbcbc1788ad1b1820b", "gitTreeSha": "66be6abe99f1807da85934aee0e22daefc8f7656", @@ -81,7 +81,7 @@ { "name": "orca-emulator-android", "sourcePath": "skills/orca-emulator-android", - "appVersion": "1.4.144-rc.2", + "appVersion": "1.4.144-rc.4", "releaseRevision": 2, "packageDigest": "12272cf82e0731f11e424822b961882457034e730358cc65ea28e4eb9c8ff7f5", "gitTreeSha": "f7b0fc8cbf5cd78ca5156f6bbe3a20f1462d8f83", @@ -100,7 +100,7 @@ { "name": "orca-linear", "sourcePath": "skills/orca-linear", - "appVersion": "1.4.144-rc.2", + "appVersion": "1.4.144-rc.4", "releaseRevision": 2, "packageDigest": "d44d09e6ecb6a64da177083aad26a95f031cd1cf26ba059fdc888c2628aef64f", "gitTreeSha": "c34f42030f43e5a85737996fa375bbd79cb5bea8", @@ -119,7 +119,7 @@ { "name": "orca-per-workspace-env", "sourcePath": "skills/orca-per-workspace-env", - "appVersion": "1.4.144-rc.2", + "appVersion": "1.4.144-rc.4", "releaseRevision": 2, "packageDigest": "fa3b65a1a107fca3f0375c696852477b62f58c154b9eb5c0663c41edc4bcd30d", "gitTreeSha": "354e775b79ea6952ec63acac4d3ee8a9ae07a650", @@ -138,7 +138,7 @@ { "name": "orchestration", "sourcePath": "skills/orchestration", - "appVersion": "1.4.144-rc.2", + "appVersion": "1.4.144-rc.4", "releaseRevision": 24, "packageDigest": "9fbfa2ae3f3f99441563a4b8b1c6302107944480db8718ddb326a862a51f7ab9", "gitTreeSha": "086c41e0b353b4908d2963694b4a7c791d4b3982", From 6e91ca6c0e751b14a27af1b3a8d9d56faaa953ce Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Thu, 16 Jul 2026 19:11:34 -0700 Subject: [PATCH 11/17] fix(browser): local HTTPS Try HTTPS + cert proceed (#8454) (#9104) Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> --- .../browser-local-https-certificate-trust.md | 926 ++++++++++++++++++ src/main/browser/agent-browser-bridge.test.ts | 39 + src/main/browser/agent-browser-bridge.ts | 10 +- .../browser/browser-certificate-challenge.ts | 77 ++ .../browser/browser-certificate-identity.ts | 32 + .../browser-certificate-request-guard.ts | 203 ++++ ...owser-certificate-trust-controller.test.ts | 336 +++++++ .../browser-certificate-trust-controller.ts | 300 ++++++ src/main/browser/browser-manager-grab.test.ts | 4 +- src/main/browser/browser-manager.test.ts | 197 ++++ src/main/browser/browser-manager.ts | 235 ++++- ...owser-session-registry.persistence.test.ts | 4 +- .../browser/browser-session-registry.test.ts | 4 +- src/main/browser/browser-session-registry.ts | 2 + src/main/index.ts | 22 +- src/main/ipc/browser.test.ts | 97 ++ src/main/ipc/browser.ts | 26 +- src/main/runtime/orca-runtime-browser.ts | 13 +- src/main/runtime/orca-runtime.test.ts | 127 +++ src/main/runtime/orca-runtime.ts | 114 ++- src/main/runtime/rpc/methods/browser-core.ts | 11 +- .../runtime/rpc/methods/browser-schemas.ts | 6 +- src/main/runtime/runtime-rpc.test.ts | 21 + src/preload/api-types.ts | 11 +- src/preload/index.ts | 13 +- .../components/browser-pane/BrowserPane.tsx | 305 +++--- .../browser-load-failure-overlay.test.tsx | 319 ++++++ .../browser-load-failure-overlay.tsx | 340 +++++++ .../browser-pane/browser-notices.test.ts | 28 +- .../browser-pane/browser-notices.ts | 44 +- .../tab-create-entry-classifier.test.ts | 9 + .../tab-create-entry-url-classification.ts | 17 +- src/renderer/src/hooks/useIpcEvents.ts | 12 + src/renderer/src/i18n/locales/en.json | 23 + src/renderer/src/i18n/locales/es.json | 23 + src/renderer/src/i18n/locales/ja.json | 23 + src/renderer/src/i18n/locales/ko.json | 23 + src/renderer/src/i18n/locales/zh.json | 23 + .../src/runtime/remote-server-parity.test.ts | 1 + .../sync-runtime-graph-browser.test.ts | 44 +- .../src/runtime/sync-runtime-graph.ts | 6 + .../src/runtime/web-session-tabs-sync.test.ts | 48 +- .../src/runtime/web-session-tabs-sync.ts | 58 +- src/renderer/src/store/slices/browser.test.ts | 33 + src/renderer/src/store/slices/browser.ts | 45 + src/renderer/src/web/web-preload-api.ts | 4 +- src/shared/browser-certificate-errors.ts | 9 + src/shared/browser-url.test.ts | 99 +- src/shared/browser-url.ts | 114 ++- src/shared/protocol-version.ts | 1 + src/shared/runtime-types.ts | 9 + src/shared/types.ts | 22 + ...wser-local-https-certificate-trust.spec.ts | 199 ++++ .../helpers/local-https-test-certificate.ts | 50 + tests/e2e/helpers/local-https-test-server.ts | 162 +++ 55 files changed, 4697 insertions(+), 226 deletions(-) create mode 100644 docs/reference/browser-local-https-certificate-trust.md create mode 100644 src/main/browser/browser-certificate-challenge.ts create mode 100644 src/main/browser/browser-certificate-identity.ts create mode 100644 src/main/browser/browser-certificate-request-guard.ts create mode 100644 src/main/browser/browser-certificate-trust-controller.test.ts create mode 100644 src/main/browser/browser-certificate-trust-controller.ts create mode 100644 src/renderer/src/components/browser-pane/browser-load-failure-overlay.test.tsx create mode 100644 src/renderer/src/components/browser-pane/browser-load-failure-overlay.tsx create mode 100644 src/shared/browser-certificate-errors.ts create mode 100644 tests/e2e/browser-local-https-certificate-trust.spec.ts create mode 100644 tests/e2e/helpers/local-https-test-certificate.ts create mode 100644 tests/e2e/helpers/local-https-test-server.ts diff --git a/docs/reference/browser-local-https-certificate-trust.md b/docs/reference/browser-local-https-certificate-trust.md new file mode 100644 index 00000000000..d858e030cb9 --- /dev/null +++ b/docs/reference/browser-local-https-certificate-trust.md @@ -0,0 +1,926 @@ +# Built-in Browser Local HTTPS and Certificate Trust + +## Status + +Implemented reference design for +[issue #8454](https://github.com/stablyai/orca/issues/8454). + +The branch includes scheme-less local-dev URL classification, certificate-specific +failure copy, `Try HTTPS`, exact per-WebContents certificate grants, +`Proceed Anyway (Unsafe)`, local IPC, remote/headless runtime propagation, and +focused unit and real-Electron coverage. A session-level request gate contains +Chromium's cached certificate continuation so approval cannot leak to sibling +tabs, assets, fetches, iframes, or WebSockets. The release gates below remain +the acceptance contract for Electron upgrades and cross-platform validation. + +## Summary + +Orca's built-in browser cannot open a local HTTPS development server when the +server presents an untrusted certificate. A scheme-less local address also +defaults to HTTP, so entering `localhost:3000` does not discover an HTTPS-only +server. + +This design keeps HTTP as the default for the scheme-less local forms that +already use it, adds a visible `Try HTTPS` recovery action after a failed local +HTTP navigation, and adds an explicit `Proceed Anyway (Unsafe)` path for an +untrusted local HTTPS certificate. Certificate approval is narrow and +temporary: it is bound to one browser WebContents, one secure endpoint, the +SHA-256 digest of the exact leaf certificate, and the specific certificate +error. A secure endpoint treats `https` and its companion `wss` scheme as one +TLS endpoint but still includes the canonical hostname and effective port. No +approval state is persisted. + +The certificate decision runs in the process that owns the browser page. Local +desktop webviews use the desktop main process; SSH/headless pages use the remote +runtime process and expose the decision through runtime RPC. + +## Problem + +There are three independent behaviors behind the current failure. + +1. `normalizeBrowserNavigationUrl` and the tab-create entry classifier prepend + `http://` to scheme-less loopback input. Explicit `https://` input is already + preserved. +2. Electron rejects an untrusted server certificate by default. Orca has no + `certificate-error` decision flow, so a self-signed development certificate + fails with a Chromium certificate error such as + `ERR_CERT_AUTHORITY_INVALID (-202)`. +3. Browser load errors are presented as generic connectivity failures. For a + loopback URL, Orca advises the user to check that the server is running even + when the server responded and only certificate verification failed. + +The same trust limitation exists in the offscreen browser backend used by +headless and SSH-owned browser pages. A desktop-only handler would fix the +visible local webview while leaving remote browser ownership inconsistent. + +## Goals + +- Show certificate-specific failure copy for main-frame certificate errors. +- Let a user explicitly approve an untrusted local development certificate. +- Bind approval to the exact browser surface, secure endpoint, leaf certificate + digest, and certificate error. +- Keep approval in memory only and clear it with the owning browser surface. +- Support both desktop webviews and SSH/headless offscreen browser pages. +- Give scheme-less local input a discoverable path to HTTPS without silently + changing the existing HTTP default. +- Preserve the current browser sandbox, navigation allowlist, session profiles, + and mixed-content policy. +- Keep browser failure state accurate across event-order races, early webview + attachment, reload, stale user actions, and remote latency. + +## Non-goals + +- Do not automatically trust a self-signed certificate. +- Do not disable `webSecurity`, enable insecure mixed content, or add + `--ignore-certificate-errors`. +- Do not install a certificate into the operating-system trust store. +- Do not persist certificate exceptions across app restarts, browser surface + recreation, or session-profile changes. +- Do not default every scheme-less localhost URL to HTTPS. +- Do not automatically probe HTTPS and then downgrade to HTTP. +- Do not add a general-purpose exception flow for public websites in v1. +- Do not make every Chromium certificate error overridable in v1. +- Do not extend localhost worktree-label proxying to HTTPS targets. + +## Product Decisions + +### Scheme-less local input continues to use HTTP + +`localhost:3000` remains `http://localhost:3000/`. HTTP is still the common +development-server default, and changing the inference globally would turn +working HTTP servers into certificate or TLS failures. + +When an HTTP navigation to a loopback URL fails, the browser failure overlay +offers `Try HTTPS`. The action replaces only the URL scheme and preserves the +host, explicit non-default port, path, query, and fragment. An absent port, or +an explicit `:80` normalized away by the URL parser, becomes HTTPS's default +port 443. Orca does not automatically retry because an invisible +cross-protocol retry would add latency, send an unexpected second request, and +make downgrade behavior opaque. + +Explicit input remains authoritative: + +- `http://localhost:3000` stays HTTP. +- `https://localhost:3000` stays HTTPS. +- URLs advertised by a workspace process keep their advertised scheme. + +The shared browser URL domain becomes the source of truth for the existing +scheme-less local-dev classification. The tab-create entry classifier calls +that shared logic instead of keeping a second regular expression and scheme +rule. This consolidation must not reuse the stricter certificate-eligibility +predicate: doing so would change current behavior for inputs such as +`0.0.0.0`, bracketed non-loopback IPv6 addresses, and `.localhost` subdomains. + +### V1 approval covers untrusted local authorities only + +The first version offers `Proceed Anyway (Unsafe)` only when all of these are +true: + +- the failure is for the main frame; +- the attempted URL is HTTPS; +- Electron reports `net::ERR_CERT_AUTHORITY_INVALID`, corresponding to + Chromium load error `-202`; +- the host is an eligible loopback host; +- the WebContents is a browser surface managed by Orca; and +- Orca retained a live pending challenge for that browser surface. + +Other certificate errors receive accurate copy but no bypass action. In +particular, v1 does not bypass revoked certificates, malformed certificates, +weak keys, date errors, or hostname/SAN mismatches. Expanding the allowlist +requires a separate security decision and dedicated tests. + +### Eligible loopback hosts + +The shared predicate accepts: + +- `localhost`, case-insensitively, with an optional trailing dot; +- valid subdomains of `.localhost`, also with an optional trailing dot; +- valid IPv4 addresses in `127.0.0.0/8`; and +- IPv6 loopback `::1`. + +The predicate does not treat `0.0.0.0`, `::`, arbitrary bracketed IPv6 +addresses, private LAN addresses, or a DNS name that merely resolves to +loopback as certificate-bypass eligible. Wildcard bind addresses should already +be normalized to a connectable loopback address before navigation. + +SSH local forwards are eligible when their browser-facing URL uses one of these +loopback hosts. Forwarding does not fix certificate names: a URL using +`127.0.0.1` still needs an IP SAN for `127.0.0.1`; a certificate containing only +`localhost` will fail with `ERR_CERT_COMMON_NAME_INVALID`, which v1 does not +bypass. Custom advertised DNS names remain subject to normal system trust in +v1, even if the name maps to loopback. + +### Approval lifetime + +An accepted grant is scoped to: + +```text +browser WebContents ID + secure endpoint + leaf SHA-256 digest + error name +``` + +The secure endpoint canonicalizes `wss:` to its companion `https:` endpoint and +includes the normalized hostname and effective port. This lets an approved +local page load same-endpoint HTTPS assets and its WSS development socket. A +grant for `https://localhost:3000` does not apply to port 3001, to +`https://127.0.0.1:3000`, to another browser tab, or to a replacement +certificate. + +Construct the secure endpoint from the parsed request URL: map `https:` and +`wss:` to `https:`, lowercase the hostname, remove one optional trailing dot, +use the URL parser's canonical IP representation, and use port 443 when the +parsed port is empty. Exclude credentials, path, query, and fragment. Reject +every other scheme. + +Accepted grants survive reloads and same-surface navigation back to the exact +endpoint. They are cleared when the WebContents commits a main-frame navigation +whose canonical secure endpoint differs from the grant's endpoint (reusing the +per-WebContents navigation-sequence tracking), when the WebContents is destroyed +or replaced, the session profile changes, the browser-owning process exits, or +the app restarts. Binding grant lifetime to the granting main-frame document +prevents a later top-level document in the same tab — for example a navigation +to a public site — from silently reusing the loopback grant for a same-endpoint +iframe, fetch, or WSS subrequest. +Clearing a grant affects future requests; it cannot retroactively terminate a +document that already loaded. Grants are not written to settings, browser +history, workspace session state, or logs. + +Chromium caches an accepted `certificate-error` continuation across the +Electron session partition. Orca therefore retains every endpoint/certificate +identity accepted in that partition until the browser-owning process exits and +gates all later HTTPS/WSS requests with `webRequest.onBeforeRequest`. Only the +WebContents holding the matching grant may reach a cached endpoint. A sibling +main-frame navigation receives a synthetic challenge for the known identity; +sibling subresources, fetches, iframes, workers, and WSS requests fail silently. + +Because a preflight request gate cannot inspect the certificate that will be +presented after Chromium's cache is consulted, one endpoint is locked to the +first accepted untrusted leaf identity for that process lifetime. If that +endpoint later presents a different untrusted leaf, strict verification rejects +it and Orca does not offer another bypass until the browser-owning process +restarts. A replacement system-trusted certificate may load normally; the +conservative request gate still keeps sibling WebContents blocked until restart. + +## User Experience + +### Local HTTP failure + +For a failed `http://` loopback navigation, keep the current connectivity +title and recovery hint. Add `Try HTTPS` when an HTTPS form can be constructed. + +Example: + +```text +Can't reach localhost:3000 +We couldn't connect to your local server. + +[Try HTTPS] [Retry] [Copy Address] [Open Externally] +``` + +`Try HTTPS` is the default button because it is the targeted recovery action +for a local HTTP failure. Keep the existing `Copy Address` recovery action; +`Retry` uses `outline`, while `Copy Address` and `Open Externally` stay quiet +secondary actions. `Try HTTPS` does not appear for an already-HTTPS URL or a +non-eligible host. + +### Certificate failure + +For `ERR_CERT_AUTHORITY_INVALID (-202)` on an eligible local endpoint, replace +the generic connectivity content with: + +```text +Connection isn't secure +Orca doesn't trust the authority that issued the certificate for localhost:3000. + +For local development, use a trusted local certificate when possible. + +[Open Externally] [Retry] [Copy Address] [Proceed Anyway (Unsafe)] +``` + +- `Open Externally` is the default safe recovery action when the URL is + reachable from the desktop. +- When `Open Externally` is unavailable, `Retry` becomes the default action. +- `Proceed Anyway (Unsafe)` uses `outline`; `Copy Address` stays quiet. +- `Proceed Anyway (Unsafe)` is always visibly labeled; it is not hidden behind + a tooltip. +- The unsafe action does not use the destructive color. It does not delete or + irreversibly mutate user data, and the explicit label carries the warning. +- Use a muted `ShieldAlert` icon from `lucide-react`; do not add a warning color + or new token. + +For a remote-owned page whose URL is remote localhost, `Open Externally` is +hidden because the desktop system browser cannot reach the remote loopback +address. It remains available for a desktop-owned page or a locally forwarded +URL. + +For certificate errors that v1 does not permit bypassing, show the same +certificate-specific title with error-specific body text, `Retry`, +`Copy Address`, and an eligible `Open Externally` action. `Copy Address` remains +present as a quiet secondary action in every certificate-failure branch, +eligible or not, so only `Try HTTPS` and `Proceed Anyway (Unsafe)` toggle in and +out across cases. The same default-action rule applies as for `-202`: +`Open Externally` is the default when the URL is reachable from the desktop, +otherwise `Retry` becomes the default. Do not show the local-server-running +hint. + +Use this presentation mapping, inserting the display host into the copy: + +| Chromium code | Body copy | Proceed in v1 | +| ----------------------- | -------------------------------------------------------------------------- | ----------------------------- | +| `-200` | `The certificate doesn't match {host}.` | No | +| `-201` | `The certificate for {host} isn't valid at the current date and time.` | No | +| `-202` | `Orca doesn't trust the authority that issued the certificate for {host}.` | Eligible local endpoints only | +| Other certificate error | `Orca couldn't verify the certificate for {host}.` | No | + +Keep the raw error name/code available to diagnostics and optional details, but +do not make users interpret it to understand the primary failure. + +### Interaction behavior + +- The overlay is persistent inline UI because the user must read and act on the + failure; do not use a toast. +- The overlay does not steal focus when it appears. +- Actions are reachable by Tab and have visible focus rings. +- Use `aria-live="polite"`; repeated background failures must not repeatedly + announce the same message. +- Clicking `Proceed Anyway (Unsafe)` disables the action immediately, and also + disables the other overlay actions (`Retry`, `Try HTTPS`, `Copy Address`, + `Open Externally`) for the duration of the approval round-trip so a stale + click cannot race the controller's own `loadURL`. Re-enable them once a + success or typed-failure response returns. +- Map every `proceedCertificate` failure reason to an overlay outcome: + `expired`, `changed`, `ineligible`, and `missing` keep the overlay open and + show the inline recovery message below; `navigated` shows no message because + the overlay for that navigation is already cleared. In every non-success case + `Proceed Anyway (Unsafe)` stays disabled until a fresh pending challenge is + announced rather than re-enabling on its own. +- Delay the spinner by 200 ms, matching the style guide's remote-latency rule. + After that delay, show the canonical `Loader2` with `Connecting…` and use a + fixed button width so the label swap cannot move adjacent actions. +- If approval expired or the certificate changed, keep the overlay open and + show `The certificate changed or the approval expired. Retry the page.` +- A successful main-frame navigation clears the visible certificate failure. + +The UI must use existing `background`, `foreground`, `muted-foreground`, +`border`, and `ring` tokens plus the existing shadcn `Button` primitive. No new +color, radius, or shadow tier is required. Do not apply a blanket opacity to +the overlay's interactive content; use semantic muted text classes so button +and focus-ring contrast remains intact. Put every new user-visible string +through the existing localization catalog. + +## Architecture + +### Ownership + +The browser-owning main process is the only authority that can accept a +certificate challenge. + +- Desktop-owned `` pages are controlled by the desktop main process. +- Headless/SSH-owned pages are controlled by the remote `orca serve` main + process through `OffscreenBrowserBackend`. +- The renderer only presents a pending challenge and requests approval. It + never decides whether a certificate is trusted. + +### New main-process controller + +Add `src/main/browser/browser-certificate-trust-controller.ts` to manage pending +certificate challenges, and +`src/main/browser/browser-certificate-request-guard.ts` to manage grants plus +the session-level cached-certificate request boundary. + +The controller owns: + +```ts +type BrowserCertificateFailure = { + challengeId: string + browserPageId: string + errorCode: number | null + error: string + origin: string + displayHost: string + canProceed: boolean + observedAt: number +} + +type PendingBrowserCertificateChallenge = { + challengeId: string + guestWebContentsId: number + browserPageId: string | null + navigationSequence: number + navigationUrl: string + origin: string + secureEndpoint: string + leafCertificateSha256: string + errorCode: number | null + error: string + expiresAt: number +} + +type BrowserCertificateGrant = { + guestWebContentsId: number + secureEndpoint: string + leafCertificateSha256: string + error: string +} +``` + +Generate challenge IDs with `randomUUID()`. Compute the certificate identity in +the browser-owning main process as SHA-256 over the DER bytes of Electron's leaf +`certificate.data`; do not depend on the undocumented formatting or algorithm +of `certificate.fingerprint`. Renderer and runtime payloads expose no +certificate bytes or digest—only the challenge ID, display host, origin, error +code, error name, `canProceed`, and observation time. + +Pending challenges expire after five minutes and are bounded to 32 entries. +Accepted grants are bounded to 32 entries per browser-owning process and are +also removed with their WebContents. Bounds evict the oldest entry and notify +the affected UI when a live challenge is evicted. Ordinary cleanup should keep +both collections much smaller. Accepted endpoint identities are not evicted: +Chromium's corresponding cache cannot be cleared narrowly, so forgetting one +would reopen cross-WebContents access until process exit. + +### Certificate event handling + +Register exactly one app-level `certificate-error` listener after Electron is +ready but before either a desktop window or the offscreen backend can create a +browser page. Every branch must call Electron's callback exactly once; an +unexpected exception fails closed with `callback(false)`. + +Electron supplies the certificate error as a string on this event, while +`did-fail-load` supplies the Chromium number later. Normalize the string to one +canonical error name and map only known names to numbers for presentation. An +unknown name keeps `errorCode: null` and is never bypass-eligible. + +For every event: + +1. Resolve the WebContents through `BrowserManager` and reject unmanaged, + retired, or popup WebContents. +2. Parse the request URL, normalize its secure endpoint, and compute the leaf + certificate SHA-256 digest. Invalid data fails closed. +3. Compare the normalized error name, endpoint, and digest against an accepted + grant for this exact WebContents. On an exact match, first retain the accepted + identity in the owning Electron session, then call `event.preventDefault()` + and `callback(true)`. +4. If no grant matches, reject non-main-frame failures without creating a + challenge. Subresources and iframes can consume an existing grant but cannot + mint one. +5. For a main-frame failure, record a pending challenge only when the URL and + error are eligible. Notify the owning page when its page ID is known, then + call `callback(false)`. + +Track a monotonically increasing main-frame navigation sequence per +WebContents. A new main-frame navigation invalidates its pending challenge in +both main and renderer state before the next certificate decision. Repeated +identical events within one sequence reuse the challenge ID; a retry or a +different navigation gets a new ID. This prevents an old button or compromised +renderer from approving a page the user has already left. + +The first failure is always rejected. User approval records a grant and reloads +the page; the next certificate event is the one that succeeds. + +Do not leave Electron's callback pending while waiting for user input. Rejecting +first gives Orca a normal load-failure lifecycle, avoids an unbounded blocked +navigation, and makes stale approval cleanup deterministic. + +Do not use `session.setCertificateVerifyProc`. It applies to an entire session +partition, cannot bind a decision to one browser page, and verification results +can be cached by Chromium's network service. + +### Session request gate and Electron upgrade guard + +The pinned Electron 43 binary caches `callback(true)` broadly enough that a +second WebContents in the same partition can load the endpoint without another +`certificate-error` event. The certificate callback alone is therefore not an +isolation boundary. + +Install exactly one `webRequest.onBeforeRequest` listener on every Orca browser +session before its first page loads. Electron permits only one listener for this +event, so the browser session registry owns installation and removal. Once an +endpoint identity has been accepted, the listener blocks every HTTPS/WSS +request to that endpoint unless `details.webContentsId` has the matching grant. +Requests without a WebContents ID, including background/worker traffic, fail +closed. A blocked main-frame request recreates the challenge and certificate +load error; other resource types are canceled without replacing the current +page's overlay. + +The real-Electron integration suite must prove same-tab reload, same-endpoint +HTTPS assets and WSS, different-tab documents and subresources, and +different-port isolation against the exact Electron version in +`pnpm-lock.yaml`. Any Electron upgrade that breaks those tests blocks release +until the design is revised; unit mocks are insufficient. + +### BrowserManager integration + +Add a narrow BrowserManager query API instead of exposing its internal maps: + +```ts +getManagedBrowserGuestContext(webContentsId: number): { + browserPageId: string | null + worktreeId: string | null + sessionProfileId: string | null + owner: 'desktop-webview' | 'offscreen' +} | null +``` + +For guest lifecycle, follow the existing extracted-controller precedent +(`browser-grab-session-controller.ts`, `browser-guest-ui.ts`, +`browser-download-destination.ts`), all of which BrowserManager drives by +calling a plain method on the controller directly from `registerGuest` / +`unregisterGuest`. Have BrowserManager call +`certificateTrustController.onGuestRegistered({ browserPageId, webContentsId })` +and `.onGuestRetired(webContentsId)` from those same bodies, rather than adding a +new listener/emitter registration API to BrowserManager — there is no such +pub-sub surface in `src/main/browser` today and this single consumer does not +warrant introducing one. + +`getManagedBrowserGuestContext` must recognize an attached primary desktop +guest before renderer registration, returning a null page ID, while rejecting +popup descendants that merely inherited browser policies. It must also +recognize offscreen pages after `registerOffscreenGuest` and stop recognizing a +guest immediately when BrowserManager retires or unregisters it. The controller +re-checks this ownership on every certificate event even if it still has an +in-memory grant. + +An attached desktop webview can encounter a certificate error before its +document reaches `dom-ready`, which is when BrowserPane currently registers the +guest. Keep pending challenges keyed by WebContents ID until registration +supplies the page ID, then flush the failure to the renderer. + +BrowserPane should also register idempotently on the webview's `did-attach` +event, with `dom-ready` retained as a fallback. `registerGuest` should report +whether the main process accepted the registration so a rare attach-policy race +can retry at `dom-ready`; the renderer must not cache the WebContents ID as +registered until it receives `true`. + +Offscreen pages already register before `loadURL`, so their page ID is normally +available when the certificate event fires. Bring their main-frame navigation +and `did-fail-load` observation under the same BrowserManager lifecycle used by +desktop guests; the current offscreen loader only logs a rejected `loadURL`, so +it cannot by itself populate runtime failure snapshots. + +### Renderer state + +Certificate challenges are transient runtime state and must not be added to +the persisted `BrowserPage` schema. + +Add a transient map to the browser store: + +```ts +browserCertificateFailuresByPageId: Record +``` + +The workspace session serializer must omit this map. Clear an entry when: + +- the page completes a successful main-frame navigation; +- the user starts a different navigation; +- the page or workspace closes; +- the owning browser WebContents is replaced; or +- the main process reports that the challenge expired. + +The existing `BrowserLoadError` remains the persisted diagnostic source. Add a +pure Chromium-error classifier for Electron 43's certificate range (`-200` +through `-219`, excluding the unused values) so certificate failures still +render accurate copy after restore even when no live challenge exists. A live +certificate failure's error code takes presentation precedence over a +synthesized `-1` Chromium-error-page fallback. Independently, only a live, +matching challenge controls whether `Proceed Anyway (Unsafe)` is enabled. + +Use both the page ID and attempted origin when combining the live challenge +with `BrowserLoadError`. A stale challenge from a prior navigation must never +add a proceed action to a different failure. Main-process navigation-sequence +invalidation is the security boundary; renderer cleanup is defense in depth and +keeps the UI honest. + +### Local IPC + +Extend the browser preload API with: + +```ts +onCertificateFailureChanged( + callback: (event: { + browserPageId: string + failure: BrowserCertificateFailure | null + }) => void +): () => void + +proceedCertificate(args: { + browserPageId: string + challengeId: string +}): Promise< + | { ok: true } + | { + ok: false + reason: 'expired' | 'changed' | 'ineligible' | 'missing' | 'navigated' + } +> +``` + +Register the handler with the existing browser IPC group and reuse +`isTrustedBrowserRenderer`. The main process resolves the page to its current +WebContents and then consumes the exact pending challenge. Renderer-provided +origin, error code, or certificate identity are never trusted. + +On success, main consumes the challenge, records the grant, and calls +`loadURL` with the challenge's main-owned `navigationUrl`. It must not use +`webContents.getURL()`, which may be `chrome-error://chromewebdata/` or a +previously committed page. It also must not reload if the page's current +navigation sequence no longer matches the challenge. The renderer does not +assign `webview.src` as a second side effect. + +### Remote runtime RPC + +The remote browser owner exposes equivalent behavior through: + +```text +browser.certificate.proceed +``` + +with the runtime worktree selector, remote browser page ID, and challenge ID. +Advertise support through a new `browser.certificate-trust.v1` capability only +when the runtime has both a browser backend and the certificate controller. +Keep the method out of the mobile-scope RPC allowlist; it is for an +authenticated runtime-scope Orca client presenting browser chrome, not a guest +page or unauthenticated caller. + +Extend `RuntimeMobileSessionBrowserTab` compatibly with optional `loadError` +and `certificateFailure` fields. Both are emitted from live runtime state. +`loadError` keeps the existing `BrowserPage` last-known diagnostic semantics, +including workspace persistence; `certificateFailure` is transient and is +never written to workspace persistence. Controller changes, challenge expiry, +navigation, and offscreen `did-fail-load` must mark the runtime session snapshot +dirty so clients do not wait for unrelated state to change. Web clients and +desktop clients reconcile these fields through the existing remote page-handle +mapping. Each full snapshot replaces the prior transient certificate failure +for that page, including clearing it when the field is absent. An older runtime +without the capability always clears any previously mirrored proceed action. + +When the active page has a remote owner, BrowserPane routes approval to that +environment. It must not call local desktop IPC. If the runtime lacks the new +capability, the UI still classifies the certificate failure accurately but does +not render `Proceed Anyway (Unsafe)`. `Try HTTPS`, retry, and other navigation +actions continue through the existing owner-aware navigation path rather than +touching a local webview for a remote-owned page. + +### Scheme recovery + +Add pure functions in the shared browser URL domain: + +```ts +classifySchemeLessLocalDevAddress(rawInput: string): URL | null +isEligibleLocalCertificateHost(hostname: string): boolean +toHttpsRecoveryUrl(rawUrl: string): string | null +``` + +`classifySchemeLessLocalDevAddress` preserves the exact current HTTP-default +input set and is shared by address-bar normalization and tab-create entry. It +is deliberately broader than certificate eligibility. + +`isEligibleLocalCertificateHost` accepts a parsed/canonical hostname; normalize +case and an optional trailing dot and handle the brackets returned by +`URL.hostname` for IPv6. Validate IPv4 octets and DNS label boundaries instead +of using a substring or loose suffix check. + +`toHttpsRecoveryUrl` returns a value only for an HTTP URL with an eligible +loopback host. It changes `protocol` to `https:` on a parsed `URL` object and +preserves credentials, hostname, an explicit non-default port, path, query, and +fragment. When no port is present, including when the parsed HTTP URL normalized +`:80` away, the result uses HTTPS's default port 443. It never probes either +protocol. + +Both address-bar submission and tab-create entry use the shared local-address +classifier. Existing advertised workspace-port URLs remain authoritative and +require no new probing. + +## Security Model + +### Invariants + +- Default certificate verification remains strict. +- Only a trusted Orca renderer or authenticated runtime-scope Orca client can + request approval. +- The renderer cannot choose the origin, certificate digest, error, + WebContents, or eligibility result. +- A grant is exact-match only and never applies across tabs, ports, + certificates, or browser-owning processes. +- Session-cached accepted endpoints remain request-gated until process exit, + even after their original WebContents or bounded grant is removed. +- Certificate PEM/DER data and certificate digests do not enter workspace + state, history, telemetry, or ordinary logs. +- Subresource and iframe certificate failures cannot mint an approval action; + they can consume an already-approved exact-endpoint grant on the same + WebContents. +- The proceed affordance exists only in Orca chrome; guest content has no + direct approval channel. Main-process challenge validation remains the + security boundary and does not assume proof of a physical click. +- A remote client cannot approve a certificate in a different runtime + environment. +- Starting another main-frame navigation invalidates the pending approval in + the browser-owning process, not only in renderer state. + +### Threat cases + +| Threat | Required behavior | +| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | +| Compromised web page sends forged IPC | Guest WebContents has no preload API; trusted-renderer check rejects it. | +| Compromised renderer invents a challenge | Main consumes only a server-created pending challenge tied to the current page and WebContents. | +| Certificate changes after approval | Leaf-digest mismatch rejects; a second untrusted leaf for that endpoint cannot be bypassed until restart. | +| Same host uses a different port | Secure-endpoint mismatch rejects. | +| Another tab visits the approved endpoint | WebContents mismatch rejects. | +| Approved tab later loads a foreign top document | Grant is invalidated when the main frame navigates to a different endpoint; the new document cannot reuse it. | +| Challenge is replayed | Challenge ID is single-use and expires. | +| User leaves the failed page before clicking | Navigation-sequence mismatch rejects without reloading the stale URL. | +| Approved page opens same-endpoint WSS/HMR | Existing endpoint grant permits it; WSS cannot create a grant by itself. | +| Public site presents an untrusted certificate | Host eligibility fails; no proceed action is available. | +| Remote page approval is sent locally | Ownership routing and remote page handles select the browser-owning runtime. | +| App restarts after approval | No persisted grant exists. | + +## Failure Handling + +- If a certificate event arrives before guest registration, retain it by + WebContents ID and flush after registration. +- If guest registration never completes, expire the pending challenge without + notifying unrelated pages. +- If `Proceed` arrives after expiry, navigation, or WebContents replacement, + return a typed failure and leave strict verification in place. +- If reload fails for a different reason, clear the certificate challenge and + present the new load error. +- If the same rejected challenge fires repeatedly in one navigation, coalesce + it without rotating the challenge ID or stacking announcements. +- If the certificate-error listener cannot parse the URL or leaf certificate, + reject normally and do not offer approval. +- If the remote connection drops during approval, keep the local UI stable and + surface the runtime error inline after the latency threshold. +- If an unexpected controller error occurs, call Electron's callback once with + `false`; never leave the request suspended. +- If an accepted main-frame page later opens a new same-endpoint TLS connection, + apply the exact grant to that HTTPS/WSS subrequest. Reject unmatched + subrequests silently without replacing the main-frame overlay. +- If an accepted endpoint presents a different untrusted leaf, reject it without + replacing the process-lifetime accepted identity or offering a second bypass. + +## Data and Privacy + +No migration is required. + +Add no new product analytics in v1. Do not record URLs, certificate digests, +challenge IDs, certificate subjects, or approval results. If product analytics +becomes a requirement later, define coarse actions in the existing typed +feature-interaction catalog as a separate reviewed change. + +Existing diagnostics may retain the Chromium numerical error code, as they do +for other browser load failures. Debug logging must contain at most the error +name, page ID, owner kind, and normalized loopback host class; omit query +strings, full URLs, and certificate digests. + +## Test Plan + +### Shared URL tests + +- Explicit HTTP and HTTPS local URLs remain unchanged. +- Scheme-less `localhost`, IPv4 loopback, and IPv6 loopback still normalize to + HTTP. +- Tab-create and address-bar local-address classification stay in parity for + the full legacy set, including wildcard and bracketed IPv6 inputs. +- The broader scheme-less classifier is not accidentally substituted for the + stricter certificate-eligibility predicate. +- `toHttpsRecoveryUrl` preserves host, an explicit non-default port, path, + query, and fragment; a URL with no parsed port changes from HTTP's default 80 + to HTTPS's default 443. +- `Try HTTPS` is unavailable for HTTPS, file URLs, public hosts, wildcard bind + hosts, private LAN hosts, and invalid URLs. +- Loopback eligibility covers `localhost`, trailing-dot localhost, + `.localhost` subdomains with and without a trailing dot, the full valid IPv4 + 127/8 range, and bracketed or unbracketed `::1` after URL parsing. +- Reject malformed IPv4, arbitrary bracketed IPv6, `0.0.0.0`, `::`, and names + that only contain the word `localhost`. + +### Main-process trust-controller tests + +- Unmanaged, retired, and popup WebContents are rejected without pending + challenges. +- A managed `-202` loopback failure creates one pending challenge and calls + `callback(false)`. +- Every event path calls its callback exactly once; only an accepted grant calls + `preventDefault()` and `callback(true)`. +- The digest is SHA-256 over DER leaf bytes and is stable across PEM formatting. +- An exact accepted grant covers same-endpoint HTTPS assets, WSS, and iframes on + the same WebContents without allowing those requests to mint a challenge. +- Wrong page, WebContents, origin, port, certificate digest, error type, and + challenge ID fail closed. +- A token is single-use and expires after five minutes. +- Repeated identical failures in one navigation coalesce; a new navigation + invalidates the token and rotates the challenge ID. +- Approving after navigation returns `navigated` and never reloads the old URL. +- Approval loads the main-owned challenged URL, not the current Chromium error + URL or a renderer-supplied URL. +- Certificate rotation fails closed and cannot replace the process-lifetime + accepted endpoint identity. +- WebContents destruction removes pending challenges and grants. +- Bounds evict the oldest pending challenge/grant. +- Registering a page after an early certificate event flushes the event to the + correct renderer. +- Concurrent tabs and session profiles remain isolated. + +### IPC and runtime tests + +- Browser certificate IPC rejects untrusted senders and malformed arguments. +- Renderer-supplied origin or certificate-identity fields are neither accepted + nor used. +- Local approval reloads only the currently mapped guest. +- Remote approval calls the owning environment's RPC with the remote page ID. +- Local IPC is not called for a remote-owned page. +- Mobile-scope runtime clients cannot call the approval method. +- Older runtimes without `browser.certificate-trust.v1` never show an enabled + proceed action. +- Runtime snapshots carry live load errors and certificate failure state, + publish immediately on changes, and do not add certificate challenges to + persisted session schemas. +- A snapshot that omits or clears a challenge removes the mirrored proceed + action rather than leaving a stale one behind. +- Two runtime environments with identical page IDs cannot approve each other's + challenge. + +### Renderer tests + +- `-202` renders certificate-specific copy and no server-running hint. +- A live certificate challenge still wins when Chromium's error-page fallback + produced diagnostic code `-1`. +- A live eligible challenge renders `Proceed Anyway (Unsafe)`. +- A restored `-202` load error without a live challenge remains accurate but + cannot proceed. +- Other certificate errors render accurate copy without v1 bypass. +- Local HTTP failures render `Try HTTPS`; HTTPS and non-loopback failures do not. +- Starting a new navigation clears stale certificate state. +- Success clears the overlay. +- Proceed disables immediately, delays the spinner, and preserves its width. +- Expired/changed responses show the inline recovery message. +- Keyboard focus and `aria-live` behavior do not regress the address bar. +- `Copy Address` remains available, interactive content is not blanket-dimmed, + and all new strings are present in the localization catalog. + +### Electron integration + +Run a local HTTPS server with a generated certificate whose SAN includes +`localhost` but whose authority is not trusted. + +1. `https://localhost:` fails with `-202` and shows certificate copy. +2. `Proceed Anyway (Unsafe)` reloads and renders the page. +3. HTTPS assets and a WSS echo/HMR endpoint on the same host and port load after + approval; a different-port asset remains blocked. +4. Reload in the same tab remains allowed without broadening the grant. +5. A second tab using the same session profile, origin, and certificate remains + blocked. This is a release-blocking assertion against the pinned Electron + binary, not a mocked controller test. +6. Navigating away before clicking makes the old challenge unusable and does + not pull the tab back to the failed URL. +7. Replacing the certificate keeps the original tab blocked and offers no + second bypass until the browser-owning process restarts. +8. Closing and recreating the browser surface removes the grant. +9. Restarting Orca removes the grant. +10. A system-trusted local certificate loads without an interstitial. +11. A public/non-loopback untrusted origin has no proceed action. +12. A hostname/SAN mismatch shows certificate copy but no proceed action. +13. `localhost:` first attempts HTTP and its failure offers `Try HTTPS`. + +Repeat the ownership-sensitive cases for: + +- a local desktop webview; +- an SSH local port forward opened in the desktop browser, using a certificate + whose SAN matches the browser-facing forwarded hostname; and +- a headless/offscreen browser page owned by `orca serve` under Linux/Xvfb. + +## Implementation Plan + +1. Add the shared scheme-less local classifier, strict certificate-host + predicate, secure-endpoint canonicalizer, and HTTPS-recovery function with + focused tests. +2. Consolidate address-bar and tab-create local classification without changing + current scheme defaults. +3. Add BrowserManager ownership/registration/retirement hooks, early + `did-attach` registration with a `dom-ready` fallback, and offscreen load + failure observation. +4. Add shared certificate failure/result types and the main-process trust + controller, including navigation-sequence invalidation and the app-level + listener. Its certificate-event handling resolves ownership through the + BrowserManager hooks from step 3, so those must land first. +5. Add local IPC, preload APIs, and transient renderer state. +6. Add the certificate-specific classification and copy as new exported + functions/branches in the existing `browser-notices.ts` (which already owns + load-failure copy via `formatLoadFailureDescription` / + `formatLoadFailureRecoveryHint`), and extract only the overlay JSX into a + focused `browser-load-failure-overlay.tsx` module instead of growing the + already grandfathered `BrowserPane.tsx`; do not add or extend a max-lines + disable. +7. Add certificate-specific and `Try HTTPS` UI, preserve existing recovery + actions, and update the localization catalog. +8. Add the offscreen/runtime capability, live snapshot fields and publication, + and approval RPC. +9. Add unit, IPC, renderer, runtime, and real-Electron integration coverage. +10. Run formatting, typecheck, lint, localization verification, targeted tests, + and cross-platform manual validation. + +## Rollout + +No feature flag is required for accurate error copy or `Try HTTPS` because both +paths preserve strict certificate verification. + +The proceed path should ship only after desktop and offscreen ownership tests +pass. If remote runtime support cannot land in the same release, gate the +button on `browser.certificate-trust.v1`; local desktop support may ship while +older/remote owners retain accurate error copy and trusted-CA guidance. + +Do not close issue #8454 until a packaged build has been validated against a +real self-signed local HTTPS server. Unit mocks alone do not establish Electron +certificate-event ordering. + +## UI Quality Bar + +- Follow `docs/STYLEGUIDE.md` and the adjacent browser failure overlay. +- Use only existing semantic tokens, shadcn buttons, and lucide icons. +- Keep the overlay quiet and monochrome; certificate failure must not introduce + an amber warning treatment. +- Copy must distinguish connection, DNS, and certificate failures without + claiming more than the Chromium error proves. +- Buttons must remain on one line at supported pane widths or wrap as one + deliberate group without overlap. +- Validate light/dark mode, macOS/Windows/Linux font metrics, and 200 ms remote + latency. +- Capture review evidence for local HTTP failure, eligible certificate failure, + ineligible certificate failure, accepted certificate, and the same browser + chrome after recovery. + +## Release Gates and Open Risks + +- The pinned Electron binary must prove that the session request gate blocks a + second tab, sibling HTTPS subresources/WSS, and a second port even when + Chromium does not re-emit `certificate-error`. If any isolation assertion + fails, omit the proceed path or redesign it around a dedicated ephemeral + partition; do not silently widen the grant. +- Same-endpoint WSS and fresh HTTPS subresource connections must work after + approval. A main document that renders while HMR/API traffic remains blocked + does not fix the local-development use case. +- A remote/headless certificate failure must reach the client as both accurate + load-error copy and a live challenge. Logging a rejected offscreen `loadURL` + is not sufficient. +- Stale approval must be rejected in the browser-owning process after any new + main-frame navigation, including when renderer cleanup or a remote snapshot + is delayed. +- SSH-forward validation must use a certificate whose SAN matches the + browser-facing hostname. Authority bypass must not mask a hostname mismatch. +- The app-level listener and real-certificate tests must pass on macOS, Windows, + and Linux/Xvfb. Platform trust-store differences do not justify enabling a + broader error allowlist. + +## Review Decisions and Follow-ups + +### From 2026-07-12 review + +- The integrated browser is part of the development workflow (including + automation, annotations, and remote ownership), so `Open Externally` and trusted + local-certificate guidance remain safer alternatives but do not replace an + explicit in-browser decision. +- V1 intentionally limits approval to `ERR_CERT_AUTHORITY_INVALID (-202)`. + Hostname/SAN, date, revoked, and malformed-certificate failures remain blocked; + broadening that set requires a separate security review and real-certificate + tests. +- Raw error details remain available to existing diagnostics rather than adding a + new disclosure affordance to the quiet recovery overlay. diff --git a/src/main/browser/agent-browser-bridge.test.ts b/src/main/browser/agent-browser-bridge.test.ts index f55f726f356..4629c844f08 100644 --- a/src/main/browser/agent-browser-bridge.test.ts +++ b/src/main/browser/agent-browser-bridge.test.ts @@ -79,6 +79,8 @@ function mockBrowserManager( getWebContentsIdByTabId: () => tabs, getWorktreeIdForTab: (tabId: string) => worktrees.get(tabId), getGuestWebContentsId: vi.fn(() => null), + getBrowserPageLoadError: vi.fn(() => null), + getBrowserPageCertificateFailure: vi.fn(() => null), unregisterGuest: vi.fn(), ensureWebviewVisible: vi.fn(async () => () => {}), acquireAutomationVisibility: vi.fn(async () => () => {}), @@ -531,6 +533,43 @@ describe('AgentBrowserBridge', () => { expect(result.tabs[0].url).toBe('https://a.com') }) + it('surfaces the browser-manager load error on each listed tab', () => { + const tabs = new Map([['tab-a', 1]]) + const wc1 = mockWebContents(1, 'chrome-error://chromewebdata/', '') + webContentsFromIdMock.mockImplementation((id: number) => (id === 1 ? wc1 : null)) + const loadError = { + code: -202, + description: 'ERR_CERT_AUTHORITY_INVALID', + validatedUrl: 'https://localhost:3443/' + } + const certificateFailure = { + challengeId: 'challenge-1', + browserPageId: 'tab-a', + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 123 + } + const b = new AgentBrowserBridge( + mockBrowserManager(tabs, new Map(), { + getBrowserPageLoadError: vi.fn((tabId: string) => (tabId === 'tab-a' ? loadError : null)), + getBrowserPageCertificateFailure: vi.fn((tabId: string) => + tabId === 'tab-a' ? certificateFailure : null + ) + }) + ) + + // Why: an agent driving the browser must see the structured cert failure, + // not just chrome-error:// from getURL(). + expect(b.tabList().tabs[0]).toMatchObject({ + url: 'https://localhost:3443/', + loadError, + certificateFailure + }) + }) + it('does not mutate active-tab routing when tab-list infers the first live tab', () => { const tabs = new Map([ ['tab-a', 1], diff --git a/src/main/browser/agent-browser-bridge.ts b/src/main/browser/agent-browser-bridge.ts index 80817c81d58..0bec7bf68fa 100644 --- a/src/main/browser/agent-browser-bridge.ts +++ b/src/main/browser/agent-browser-bridge.ts @@ -698,12 +698,18 @@ export class AgentBrowserBridge { if (firstLiveWcId === null) { firstLiveWcId = wcId } + const loadError = this.browserManager.getBrowserPageLoadError(tabId) + const certificateFailure = this.browserManager.getBrowserPageCertificateFailure(tabId) result.push({ browserPageId: tabId, index: index++, - url: wc.getURL() ?? '', + // Why: failed WebContents report chrome-error://, which is neither + // actionable nor the address the user asked to load. + url: loadError?.validatedUrl ?? wc.getURL() ?? '', title: wc.getTitle() ?? '', - active: wcId === activeWcId + active: wcId === activeWcId, + loadError, + certificateFailure }) } // Why: if no tab has been explicitly activated yet, surface the first live diff --git a/src/main/browser/browser-certificate-challenge.ts b/src/main/browser/browser-certificate-challenge.ts new file mode 100644 index 00000000000..2e49685b5d3 --- /dev/null +++ b/src/main/browser/browser-certificate-challenge.ts @@ -0,0 +1,77 @@ +import type { BrowserCertificateFailure } from '../../shared/types' +import { SUPPORTED_CERTIFICATE_ERROR_CODE } from './browser-certificate-identity' + +export const CERTIFICATE_CHALLENGE_TTL_MS = 5 * 60_000 +export const MAX_PENDING_CERTIFICATE_CHALLENGES = 32 +export const MAX_CERTIFICATE_GRANTS = 32 + +export type ManagedBrowserGuestContext = { + browserPageId: string | null + worktreeId: string | null + sessionProfileId: string | null + owner: 'desktop-webview' | 'offscreen' +} + +export type BrowserCertificateTrustControllerDependencies = { + resolveManagedGuestContext: (webContentsId: number) => ManagedBrowserGuestContext | null + resolveWebContentsIdForPage: (browserPageId: string) => number | null + resolveWebContents: (webContentsId: number) => Electron.WebContents | null + onFailureChanged: ( + webContentsId: number, + failure: BrowserCertificateFailure | null, + navigationUrl?: string + ) => void + now?: () => number + createChallengeId?: () => string +} + +export type PendingCertificateChallenge = { + challengeId: string + guestWebContentsId: number + browserPageId: string | null + navigationSequence: number + navigationUrl: string + origin: string + displayHost: string + secureEndpoint: string + leafCertificateSha256: string + errorCode: number | null + error: string + observedAt: number + expiresAt: number +} + +export type CertificateTrustGrant = Pick< + PendingCertificateChallenge, + 'guestWebContentsId' | 'secureEndpoint' | 'leafCertificateSha256' | 'error' +> + +export function certificateChallengeIdentityMatches( + challenge: PendingCertificateChallenge, + candidate: Pick< + PendingCertificateChallenge, + 'navigationSequence' | 'secureEndpoint' | 'leafCertificateSha256' | 'error' + > +): boolean { + return ( + challenge.navigationSequence === candidate.navigationSequence && + challenge.secureEndpoint === candidate.secureEndpoint && + challenge.leafCertificateSha256 === candidate.leafCertificateSha256 && + challenge.error === candidate.error + ) +} + +export function toBrowserCertificateFailure( + challenge: PendingCertificateChallenge +): BrowserCertificateFailure { + return { + challengeId: challenge.challengeId, + browserPageId: challenge.browserPageId ?? '', + errorCode: challenge.errorCode, + error: challenge.error, + origin: challenge.origin, + displayHost: challenge.displayHost, + canProceed: challenge.errorCode === SUPPORTED_CERTIFICATE_ERROR_CODE, + observedAt: challenge.observedAt + } +} diff --git a/src/main/browser/browser-certificate-identity.ts b/src/main/browser/browser-certificate-identity.ts new file mode 100644 index 00000000000..9170f8edde4 --- /dev/null +++ b/src/main/browser/browser-certificate-identity.ts @@ -0,0 +1,32 @@ +import { createHash } from 'node:crypto' + +export const SUPPORTED_CERTIFICATE_ERROR = 'ERR_CERT_AUTHORITY_INVALID' +export const SUPPORTED_CERTIFICATE_ERROR_CODE = -202 + +export function normalizeCertificateError(error: string): string { + return error + .trim() + .replace(/^net::/i, '') + .toUpperCase() +} + +export function getSupportedCertificateErrorCode(error: string): number | null { + return normalizeCertificateError(error) === SUPPORTED_CERTIFICATE_ERROR + ? SUPPORTED_CERTIFICATE_ERROR_CODE + : null +} + +export function getLeafCertificateSha256(certificate: Electron.Certificate): string | null { + const match = certificate.data.match( + /-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/ + ) + if (!match) { + return null + } + try { + const der = Buffer.from(match[1].replace(/\s+/g, ''), 'base64') + return der.length > 0 ? createHash('sha256').update(der).digest('hex') : null + } catch { + return null + } +} diff --git a/src/main/browser/browser-certificate-request-guard.ts b/src/main/browser/browser-certificate-request-guard.ts new file mode 100644 index 00000000000..0a4602804a9 --- /dev/null +++ b/src/main/browser/browser-certificate-request-guard.ts @@ -0,0 +1,203 @@ +import type { Session } from 'electron' + +import { toSecureCertificateEndpoint } from '../../shared/browser-url' +import { MAX_CERTIFICATE_GRANTS, type CertificateTrustGrant } from './browser-certificate-challenge' + +type CertificateIdentity = Pick< + CertificateTrustGrant, + 'secureEndpoint' | 'leafCertificateSha256' | 'error' +> + +type BlockedMainFrame = CertificateIdentity & { + webContentsId: number + navigationUrl: string + origin: string + displayHost: string +} + +type RequestGuardDependencies = { + onBlockedMainFrame: (blocked: BlockedMainFrame) => void +} + +function certificateIdentitiesMatch( + left: CertificateIdentity | undefined, + right: CertificateIdentity +): boolean { + return Boolean( + left && + left.secureEndpoint === right.secureEndpoint && + left.leafCertificateSha256 === right.leafCertificateSha256 && + left.error === right.error + ) +} + +export class BrowserCertificateRequestGuard { + private readonly grantsByGuestId = new Map() + private readonly grantSessionByGuestId = new Map() + private readonly guardedSessions = new Set() + private readonly acceptedIdentityBySession = new Map>() + + constructor(private readonly dependencies: RequestGuardDependencies) {} + + installSession(session: Session): void { + if (this.guardedSessions.has(session)) { + return + } + // Why: Chromium caches certificate continuations at session scope. This + // request gate restores the narrower per-WebContents approval boundary. + session.webRequest.onBeforeRequest((details, callback) => { + callback(this.shouldBlockRequest(session, details) ? { cancel: true } : {}) + }) + this.guardedSessions.add(session) + } + + removeSession(session: Session): void { + if (!this.guardedSessions.delete(session)) { + return + } + session.webRequest.onBeforeRequest(null) + this.acceptedIdentityBySession.delete(session) + for (const [webContentsId, grantSession] of this.grantSessionByGuestId) { + if (grantSession === session) { + this.revokeGuest(webContentsId) + } + } + } + + canOfferCertificate(session: Session, identity: CertificateIdentity): boolean { + if (!this.guardedSessions.has(session)) { + return false + } + const accepted = this.acceptedIdentityBySession.get(session)?.get(identity.secureEndpoint) + // Why: the request gate cannot inspect TLS after Chromium caches a decision. + // Never accept a second bad leaf for one endpoint in the same app process. + return !accepted || certificateIdentitiesMatch(accepted, identity) + } + + grant(session: Session, grant: CertificateTrustGrant): boolean { + if (!this.guardedSessions.has(session)) { + return false + } + let acceptedByEndpoint = this.acceptedIdentityBySession.get(session) + const accepted = acceptedByEndpoint?.get(grant.secureEndpoint) + // Why: once one leaf is accepted for an endpoint in this session, Chromium + // caches the TLS decision. Refuse a conflicting pending leaf so proceed() + // cannot report success when the next certificate-error will still fail. + if (accepted && !certificateIdentitiesMatch(accepted, grant)) { + return false + } + // Why: pin the identity at grant time, not only on the later certificate + // callback, so a concurrent sibling proceed cannot race in a second leaf. + if (!acceptedByEndpoint) { + acceptedByEndpoint = new Map() + this.acceptedIdentityBySession.set(session, acceptedByEndpoint) + } + acceptedByEndpoint.set(grant.secureEndpoint, { + secureEndpoint: grant.secureEndpoint, + leafCertificateSha256: grant.leafCertificateSha256, + error: grant.error + }) + this.grantsByGuestId.delete(grant.guestWebContentsId) + this.grantsByGuestId.set(grant.guestWebContentsId, grant) + this.grantSessionByGuestId.set(grant.guestWebContentsId, session) + this.enforceGrantBound() + return true + } + + shouldTrustCertificate( + session: Session, + webContentsId: number, + identity: CertificateIdentity + ): boolean { + if ( + !this.guardedSessions.has(session) || + this.grantSessionByGuestId.get(webContentsId) !== session || + !certificateIdentitiesMatch(this.grantsByGuestId.get(webContentsId), identity) + ) { + return false + } + let acceptedByEndpoint = this.acceptedIdentityBySession.get(session) + if (!acceptedByEndpoint) { + acceptedByEndpoint = new Map() + this.acceptedIdentityBySession.set(session, acceptedByEndpoint) + } + const accepted = acceptedByEndpoint.get(identity.secureEndpoint) + if (accepted && !certificateIdentitiesMatch(accepted, identity)) { + return false + } + acceptedByEndpoint.set(identity.secureEndpoint, identity) + return true + } + + revokeGuest(webContentsId: number): void { + this.grantsByGuestId.delete(webContentsId) + this.grantSessionByGuestId.delete(webContentsId) + } + + revokeForCommittedNavigation(webContentsId: number, url: string): void { + const grant = this.grantsByGuestId.get(webContentsId) + if (grant && toSecureCertificateEndpoint(url) !== grant.secureEndpoint) { + this.revokeGuest(webContentsId) + } + } + + private shouldBlockRequest( + session: Session, + details: Electron.OnBeforeRequestListenerDetails + ): boolean { + const secureEndpoint = toSecureCertificateEndpoint(details.url) + if (!secureEndpoint) { + return false + } + const accepted = this.acceptedIdentityBySession.get(session)?.get(secureEndpoint) + if (!accepted) { + return false + } + const webContentsId = details.webContentsId ?? details.webContents?.id + const grant = webContentsId === undefined ? undefined : this.grantsByGuestId.get(webContentsId) + if ( + webContentsId !== undefined && + grant && + this.grantSessionByGuestId.get(webContentsId) === session && + certificateIdentitiesMatch(grant, accepted) + ) { + return false + } + if (details.resourceType === 'mainFrame' && webContentsId !== undefined) { + this.reportBlockedMainFrame(webContentsId, details.url, accepted) + } + return true + } + + private reportBlockedMainFrame( + webContentsId: number, + navigationUrl: string, + identity: CertificateIdentity + ): void { + try { + const parsed = new URL(navigationUrl) + if (parsed.protocol !== 'https:') { + return + } + this.dependencies.onBlockedMainFrame({ + webContentsId, + navigationUrl, + origin: parsed.origin, + displayHost: parsed.host, + ...identity + }) + } catch { + // The request remains blocked even if Chromium supplies a malformed URL. + } + } + + private enforceGrantBound(): void { + while (this.grantsByGuestId.size > MAX_CERTIFICATE_GRANTS) { + const oldest = this.grantsByGuestId.keys().next().value as number | undefined + if (oldest === undefined) { + return + } + this.revokeGuest(oldest) + } + } +} diff --git a/src/main/browser/browser-certificate-trust-controller.test.ts b/src/main/browser/browser-certificate-trust-controller.test.ts new file mode 100644 index 00000000000..85153aef5a7 --- /dev/null +++ b/src/main/browser/browser-certificate-trust-controller.test.ts @@ -0,0 +1,336 @@ +import { beforeEach, describe, expect, it, vi } from 'vitest' + +import { BrowserCertificateTrustController } from './browser-certificate-trust-controller' + +const FIRST_CERTIFICATE = certificate('first certificate') +const SECOND_CERTIFICATE = certificate('replacement certificate') +let beforeRequestListener: + | (( + details: Electron.OnBeforeRequestListenerDetails, + callback: (response: Electron.CallbackResponse) => void + ) => void) + | null = null +const browserSession = { + webRequest: { + onBeforeRequest: vi.fn( + ( + listener: + | (( + details: Electron.OnBeforeRequestListenerDetails, + callback: (response: Electron.CallbackResponse) => void + ) => void) + | null + ) => { + beforeRequestListener = listener + } + ) + } +} as unknown as Electron.Session + +function certificate(contents: string): Electron.Certificate { + return { + data: `-----BEGIN CERTIFICATE-----\n${Buffer.from(contents).toString('base64')}\n-----END CERTIFICATE-----` + } as Electron.Certificate +} + +function createGuest(id: number): Electron.WebContents { + return { + id, + session: browserSession, + isDestroyed: vi.fn(() => false), + loadURL: vi.fn(() => Promise.resolve()) + } as unknown as Electron.WebContents +} + +function beforeRequest(args: { + url?: string + webContentsId?: number + resourceType?: Electron.OnBeforeRequestListenerDetails['resourceType'] +}) { + const callback = vi.fn() + beforeRequestListener?.( + { + id: 1, + url: args.url ?? 'https://localhost:3443/app', + method: 'GET', + webContentsId: args.webContentsId, + resourceType: args.resourceType ?? 'mainFrame', + referrer: '', + timestamp: 1, + uploadData: [] + }, + callback + ) + return callback +} + +function certificateEvent(args: { + controller: BrowserCertificateTrustController + guest: Electron.WebContents + url?: string + error?: string + certificate?: Electron.Certificate + isMainFrame?: boolean +}) { + const preventDefault = vi.fn() + const callback = vi.fn() + args.controller.handleCertificateError({ + event: { preventDefault }, + webContents: args.guest, + url: args.url ?? 'https://localhost:3443/app', + error: args.error ?? 'net::ERR_CERT_AUTHORITY_INVALID', + certificate: args.certificate ?? FIRST_CERTIFICATE, + callback, + isMainFrame: args.isMainFrame ?? true + }) + return { preventDefault, callback } +} + +describe('BrowserCertificateTrustController', () => { + const guest = createGuest(7) + const otherGuest = createGuest(8) + const onFailureChanged = vi.fn() + let now = 1_000 + let challengeNumber = 0 + let pageByGuestId: Map + let guestByPageId: Map + let guestById: Map + let controller: BrowserCertificateTrustController + + beforeEach(() => { + vi.clearAllMocks() + vi.mocked(guest.isDestroyed).mockReturnValue(false) + vi.mocked(otherGuest.isDestroyed).mockReturnValue(false) + vi.mocked(guest.loadURL).mockResolvedValue(undefined) + vi.mocked(otherGuest.loadURL).mockResolvedValue(undefined) + now = 1_000 + challengeNumber = 0 + pageByGuestId = new Map([ + [guest.id, 'page-1'], + [otherGuest.id, 'page-2'] + ]) + guestByPageId = new Map([ + ['page-1', guest.id], + ['page-2', otherGuest.id] + ]) + guestById = new Map([ + [guest.id, guest], + [otherGuest.id, otherGuest] + ]) + controller = new BrowserCertificateTrustController({ + resolveManagedGuestContext: (webContentsId) => { + if (!pageByGuestId.has(webContentsId)) { + return null + } + return { + browserPageId: pageByGuestId.get(webContentsId) ?? null, + worktreeId: 'worktree-1', + sessionProfileId: 'profile-1', + owner: 'desktop-webview' + } + }, + resolveWebContentsIdForPage: (browserPageId) => guestByPageId.get(browserPageId) ?? null, + resolveWebContents: (webContentsId) => guestById.get(webContentsId) ?? null, + onFailureChanged, + now: () => now, + createChallengeId: () => `challenge-${++challengeNumber}` + }) + controller.installSessionRequestGuard(browserSession) + }) + + it('rejects first, then trusts only the approved guest, endpoint, certificate, and error', () => { + controller.onMainFrameNavigationStarted(guest.id) + const first = certificateEvent({ controller, guest }) + + expect(first.callback).toHaveBeenCalledOnce() + expect(first.callback).toHaveBeenCalledWith(false) + expect(first.preventDefault).not.toHaveBeenCalled() + expect(controller.getFailure('page-1')).toMatchObject({ + challengeId: 'challenge-1', + browserPageId: 'page-1', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + errorCode: -202, + canProceed: true + }) + + expect(controller.proceed('page-1', 'challenge-1')).toEqual({ ok: true }) + expect(guest.loadURL).toHaveBeenCalledWith('https://localhost:3443/app') + expect(onFailureChanged).toHaveBeenLastCalledWith(guest.id, null) + + const sameEndpoint = certificateEvent({ + controller, + guest, + url: 'wss://localhost:3443/socket' + }) + expect(sameEndpoint.preventDefault).toHaveBeenCalledOnce() + expect(sameEndpoint.callback).toHaveBeenCalledOnce() + expect(sameEndpoint.callback).toHaveBeenCalledWith(true) + + const otherTab = certificateEvent({ controller, guest: otherGuest }) + expect(otherTab.callback).toHaveBeenCalledWith(false) + expect(otherTab.preventDefault).not.toHaveBeenCalled() + + const otherPort = certificateEvent({ + controller, + guest, + url: 'https://localhost:3444/' + }) + expect(otherPort.callback).toHaveBeenCalledWith(false) + expect(otherPort.preventDefault).not.toHaveBeenCalled() + + const otherCertificate = certificateEvent({ + controller, + guest, + certificate: SECOND_CERTIFICATE + }) + expect(otherCertificate.callback).toHaveBeenCalledWith(false) + expect(otherCertificate.preventDefault).not.toHaveBeenCalled() + }) + + it('blocks a session-cached certificate for sibling requests until that guest approves it', () => { + certificateEvent({ controller, guest }) + expect(controller.proceed('page-1', 'challenge-1')).toEqual({ ok: true }) + expect(certificateEvent({ controller, guest }).callback).toHaveBeenCalledWith(true) + + const siblingMainFrame = beforeRequest({ webContentsId: otherGuest.id }) + expect(siblingMainFrame).toHaveBeenCalledWith({ cancel: true }) + expect(controller.getFailure('page-2')).toMatchObject({ + challengeId: 'challenge-2', + browserPageId: 'page-2', + origin: 'https://localhost:3443', + canProceed: true + }) + + expect( + beforeRequest({ webContentsId: otherGuest.id, resourceType: 'webSocket' }) + ).toHaveBeenCalledWith({ cancel: true }) + expect(beforeRequest({ resourceType: 'webSocket' })).toHaveBeenCalledWith({ cancel: true }) + expect( + beforeRequest({ url: 'https://localhost:3444/app', webContentsId: otherGuest.id }) + ).toHaveBeenCalledWith({}) + expect(beforeRequest({ webContentsId: guest.id })).toHaveBeenCalledWith({}) + + expect(controller.proceed('page-2', 'challenge-2')).toEqual({ ok: true }) + expect(beforeRequest({ webContentsId: otherGuest.id })).toHaveBeenCalledWith({}) + }) + + it('fails closed when an accepted endpoint presents a replacement bad certificate', () => { + certificateEvent({ controller, guest }) + expect(controller.proceed('page-1', 'challenge-1')).toEqual({ ok: true }) + expect(certificateEvent({ controller, guest }).callback).toHaveBeenCalledWith(true) + + controller.onMainFrameNavigationStarted(guest.id) + const replacement = certificateEvent({ controller, guest, certificate: SECOND_CERTIFICATE }) + + expect(replacement.callback).toHaveBeenCalledWith(false) + expect(replacement.preventDefault).not.toHaveBeenCalled() + expect(controller.getFailure('page-1')).toBeNull() + }) + + it('rejects proceed for a second tab whose pending leaf conflicts with an accepted identity', () => { + // Both tabs observe different leaves before either is approved. + certificateEvent({ controller, guest }) + certificateEvent({ controller, guest: otherGuest, certificate: SECOND_CERTIFICATE }) + expect(controller.getFailure('page-1')?.challengeId).toBe('challenge-1') + expect(controller.getFailure('page-2')?.challengeId).toBe('challenge-2') + + expect(controller.proceed('page-1', 'challenge-1')).toEqual({ ok: true }) + // First proceed pins the session identity; the sibling's conflicting leaf + // must not report success (Chromium cannot honor a second bad leaf). + expect(controller.proceed('page-2', 'challenge-2')).toEqual({ + ok: false, + reason: 'ineligible' + }) + expect(otherGuest.loadURL).not.toHaveBeenCalled() + }) + + it('never offers approval for public hosts, non-authority failures, or subframes', () => { + for (const event of [ + certificateEvent({ controller, guest, url: 'https://example.com/' }), + certificateEvent({ controller, guest, error: 'ERR_CERT_DATE_INVALID' }), + certificateEvent({ controller, guest, isMainFrame: false }) + ]) { + expect(event.callback).toHaveBeenCalledOnce() + expect(event.callback).toHaveBeenCalledWith(false) + expect(event.preventDefault).not.toHaveBeenCalled() + } + expect(controller.getFailure('page-1')).toBeNull() + expect(onFailureChanged).not.toHaveBeenCalled() + }) + + it('queues an early challenge until the guest receives its browser page identity', () => { + pageByGuestId.set(guest.id, null) + certificateEvent({ controller, guest }) + + expect(onFailureChanged).not.toHaveBeenCalled() + expect(controller.getFailure('page-1')).toBeNull() + + pageByGuestId.set(guest.id, 'page-1') + controller.onGuestRegistered(guest.id, 'page-1') + + expect(onFailureChanged).toHaveBeenCalledWith( + guest.id, + expect.objectContaining({ challengeId: 'challenge-1', browserPageId: 'page-1' }), + 'https://localhost:3443/app' + ) + }) + + it('rejects stale, expired, destroyed, and mismatched approval attempts', () => { + certificateEvent({ controller, guest }) + + expect(controller.proceed('page-1', 'wrong-challenge')).toEqual({ + ok: false, + reason: 'changed' + }) + now += 5 * 60_000 + expect(controller.proceed('page-1', 'challenge-1')).toEqual({ + ok: false, + reason: 'expired' + }) + + certificateEvent({ controller, guest }) + vi.mocked(guest.isDestroyed).mockReturnValue(true) + expect(controller.proceed('page-1', 'challenge-2')).toEqual({ + ok: false, + reason: 'missing' + }) + expect(guest.loadURL).not.toHaveBeenCalled() + }) + + it('clears pending approval and grants when navigation or guest ownership changes', () => { + certificateEvent({ controller, guest }) + controller.onMainFrameNavigationStarted(guest.id) + expect(controller.getFailure('page-1')).toBeNull() + expect(controller.proceed('page-1', 'challenge-1')).toEqual({ + ok: false, + reason: 'missing' + }) + + certificateEvent({ controller, guest }) + expect(controller.proceed('page-1', 'challenge-2')).toEqual({ ok: true }) + controller.onMainFrameNavigationCommitted(guest.id, 'https://example.com/') + const afterCommit = certificateEvent({ controller, guest }) + expect(afterCommit.callback).toHaveBeenCalledWith(false) + + controller.onGuestRetired(guest.id) + expect(controller.getFailure('page-1')).toBeNull() + }) + + it('answers malformed and unmanaged events exactly once without overriding Electron', () => { + pageByGuestId.delete(guest.id) + const unmanaged = certificateEvent({ controller, guest }) + const malformedUrl = certificateEvent({ controller, guest: otherGuest, url: 'not a URL' }) + const malformedCertificate = certificateEvent({ + controller, + guest: otherGuest, + certificate: { data: 'not a PEM certificate' } as Electron.Certificate + }) + + for (const event of [unmanaged, malformedUrl, malformedCertificate]) { + expect(event.callback).toHaveBeenCalledOnce() + expect(event.callback).toHaveBeenCalledWith(false) + expect(event.preventDefault).not.toHaveBeenCalled() + } + }) +}) diff --git a/src/main/browser/browser-certificate-trust-controller.ts b/src/main/browser/browser-certificate-trust-controller.ts new file mode 100644 index 00000000000..e69d7ad2ca3 --- /dev/null +++ b/src/main/browser/browser-certificate-trust-controller.ts @@ -0,0 +1,300 @@ +import { randomUUID } from 'node:crypto' +import type { BrowserCertificateFailure, BrowserCertificateProceedResult } from '../../shared/types' +import { + isEligibleLocalCertificateHost, + toSecureCertificateEndpoint +} from '../../shared/browser-url' +import { + certificateChallengeIdentityMatches, + CERTIFICATE_CHALLENGE_TTL_MS, + MAX_PENDING_CERTIFICATE_CHALLENGES, + toBrowserCertificateFailure, + type BrowserCertificateTrustControllerDependencies, + type PendingCertificateChallenge +} from './browser-certificate-challenge' +import { + getLeafCertificateSha256, + getSupportedCertificateErrorCode, + normalizeCertificateError, + SUPPORTED_CERTIFICATE_ERROR, + SUPPORTED_CERTIFICATE_ERROR_CODE +} from './browser-certificate-identity' +import { BrowserCertificateRequestGuard } from './browser-certificate-request-guard' + +export type { ManagedBrowserGuestContext } from './browser-certificate-challenge' + +export class BrowserCertificateTrustController { + private readonly pendingByGuestId = new Map() + private readonly navigationSequenceByGuestId = new Map() + private readonly expiryTimerByGuestId = new Map>() + private readonly requestGuard: BrowserCertificateRequestGuard + + constructor(private readonly dependencies: BrowserCertificateTrustControllerDependencies) { + this.requestGuard = new BrowserCertificateRequestGuard({ + onBlockedMainFrame: (blocked) => { + const context = this.dependencies.resolveManagedGuestContext(blocked.webContentsId) + if (context) { + this.recordPendingChallenge({ + ...blocked, + browserPageId: context.browserPageId + }) + } + } + }) + } + + installSessionRequestGuard(session: Electron.Session): void { + this.requestGuard.installSession(session) + } + removeSessionRequestGuard(session: Electron.Session): void { + this.requestGuard.removeSession(session) + } + + handleCertificateError(args: { + event: Pick + webContents: Electron.WebContents + url: string + error: string + certificate: Electron.Certificate + callback: (isTrusted: boolean) => void + isMainFrame: boolean + }): void { + let answered = false + const answer = (trusted: boolean): void => { + if (!answered) { + answered = true + args.callback(trusted) + } + } + try { + const context = this.dependencies.resolveManagedGuestContext(args.webContents.id) + const parsed = new URL(args.url) + const endpoint = toSecureCertificateEndpoint(args.url) + const digest = getLeafCertificateSha256(args.certificate) + const error = normalizeCertificateError(args.error) + if (!context || !endpoint || !digest) { + answer(false) + return + } + const identity = { secureEndpoint: endpoint, leafCertificateSha256: digest, error } + if ( + this.requestGuard.shouldTrustCertificate( + args.webContents.session, + args.webContents.id, + identity + ) + ) { + args.event.preventDefault() + answer(true) + return + } + if ( + args.isMainFrame && + parsed.protocol === 'https:' && + error === SUPPORTED_CERTIFICATE_ERROR && + isEligibleLocalCertificateHost(parsed.hostname) && + this.requestGuard.canOfferCertificate(args.webContents.session, identity) + ) { + this.recordPendingChallenge({ + webContentsId: args.webContents.id, + browserPageId: context.browserPageId, + navigationUrl: args.url, + origin: parsed.origin, + displayHost: parsed.host, + secureEndpoint: endpoint, + leafCertificateSha256: digest, + error + }) + } + answer(false) + } catch { + answer(false) + } + } + + onGuestRegistered(webContentsId: number, browserPageId: string): void { + const pending = this.pendingByGuestId.get(webContentsId) + if (!pending) { + return + } + pending.browserPageId = browserPageId + this.emitFailure(pending) + } + + onGuestRetired(webContentsId: number): void { + this.clearPending(webContentsId, true) + this.requestGuard.revokeGuest(webContentsId) + this.navigationSequenceByGuestId.delete(webContentsId) + } + + onMainFrameNavigationStarted(webContentsId: number): void { + this.navigationSequenceByGuestId.set( + webContentsId, + (this.navigationSequenceByGuestId.get(webContentsId) ?? 0) + 1 + ) + this.clearPending(webContentsId, true) + } + + onMainFrameNavigationCommitted(webContentsId: number, url: string): void { + this.requestGuard.revokeForCommittedNavigation(webContentsId, url) + } + + getFailure(browserPageId: string): BrowserCertificateFailure | null { + this.pruneExpired() + for (const pending of this.pendingByGuestId.values()) { + if (pending.browserPageId === browserPageId) { + return toBrowserCertificateFailure(pending) + } + } + return null + } + + proceed(browserPageId: string, challengeId: string): BrowserCertificateProceedResult { + const webContentsId = this.dependencies.resolveWebContentsIdForPage(browserPageId) + if (webContentsId === null) { + return { ok: false, reason: 'missing' } + } + const pending = this.pendingByGuestId.get(webContentsId) + if (!pending) { + return { ok: false, reason: 'missing' } + } + if (pending.challengeId !== challengeId || pending.browserPageId !== browserPageId) { + return { ok: false, reason: 'changed' } + } + if (pending.expiresAt <= this.now()) { + this.clearPending(webContentsId, true) + return { ok: false, reason: 'expired' } + } + if (pending.errorCode !== SUPPORTED_CERTIFICATE_ERROR_CODE) { + return { ok: false, reason: 'ineligible' } + } + if (pending.navigationSequence !== (this.navigationSequenceByGuestId.get(webContentsId) ?? 0)) { + return { ok: false, reason: 'navigated' } + } + const context = this.dependencies.resolveManagedGuestContext(webContentsId) + const guest = this.dependencies.resolveWebContents(webContentsId) + if (!context || context.browserPageId !== browserPageId || !guest || guest.isDestroyed()) { + return { ok: false, reason: 'missing' } + } + const granted = this.requestGuard.grant(guest.session, { + guestWebContentsId: webContentsId, + secureEndpoint: pending.secureEndpoint, + leafCertificateSha256: pending.leafCertificateSha256, + error: pending.error + }) + if (!granted) { + return { ok: false, reason: 'ineligible' } + } + const navigationUrl = pending.navigationUrl + this.clearPending(webContentsId, true) + void guest.loadURL(navigationUrl).catch(() => {}) + return { ok: true } + } + + private recordPendingChallenge(args: { + webContentsId: number + browserPageId: string | null + navigationUrl: string + origin: string + displayHost: string + secureEndpoint: string + leafCertificateSha256: string + error: string + }): void { + const navigationSequence = this.navigationSequenceByGuestId.get(args.webContentsId) ?? 0 + const existing = this.pendingByGuestId.get(args.webContentsId) + if ( + existing && + certificateChallengeIdentityMatches(existing, { + navigationSequence, + secureEndpoint: args.secureEndpoint, + leafCertificateSha256: args.leafCertificateSha256, + error: args.error + }) + ) { + return + } + this.clearPending(args.webContentsId, true) + const observedAt = this.now() + const pending: PendingCertificateChallenge = { + challengeId: this.dependencies.createChallengeId?.() ?? randomUUID(), + guestWebContentsId: args.webContentsId, + browserPageId: args.browserPageId, + navigationSequence, + navigationUrl: args.navigationUrl, + origin: args.origin, + displayHost: args.displayHost, + secureEndpoint: args.secureEndpoint, + leafCertificateSha256: args.leafCertificateSha256, + errorCode: getSupportedCertificateErrorCode(args.error), + error: args.error, + observedAt, + expiresAt: observedAt + CERTIFICATE_CHALLENGE_TTL_MS + } + this.pendingByGuestId.set(args.webContentsId, pending) + this.scheduleExpiry(pending) + this.enforcePendingBound() + this.emitFailure(pending) + } + + private emitFailure(pending: PendingCertificateChallenge): void { + if (pending.browserPageId) { + this.dependencies.onFailureChanged( + pending.guestWebContentsId, + toBrowserCertificateFailure(pending), + pending.navigationUrl + ) + } + } + + private clearPending(webContentsId: number, notify: boolean): void { + const pending = this.pendingByGuestId.get(webContentsId) + this.pendingByGuestId.delete(webContentsId) + const timer = this.expiryTimerByGuestId.get(webContentsId) + if (timer) { + clearTimeout(timer) + this.expiryTimerByGuestId.delete(webContentsId) + } + if (notify && pending?.browserPageId) { + this.dependencies.onFailureChanged(webContentsId, null) + } + } + + private scheduleExpiry(pending: PendingCertificateChallenge): void { + const timer = setTimeout( + () => { + if ( + this.pendingByGuestId.get(pending.guestWebContentsId)?.challengeId === pending.challengeId + ) { + this.clearPending(pending.guestWebContentsId, true) + } + }, + Math.max(0, pending.expiresAt - this.now()) + ) + timer.unref?.() + this.expiryTimerByGuestId.set(pending.guestWebContentsId, timer) + } + + private pruneExpired(): void { + const now = this.now() + for (const pending of this.pendingByGuestId.values()) { + if (pending.expiresAt <= now) { + this.clearPending(pending.guestWebContentsId, true) + } + } + } + + private enforcePendingBound(): void { + while (this.pendingByGuestId.size > MAX_PENDING_CERTIFICATE_CHALLENGES) { + const oldest = this.pendingByGuestId.keys().next().value as number | undefined + if (oldest === undefined) { + return + } + this.clearPending(oldest, true) + } + } + + private now(): number { + return this.dependencies.now?.() ?? Date.now() + } +} diff --git a/src/main/browser/browser-manager-grab.test.ts b/src/main/browser/browser-manager-grab.test.ts index 0d10e915fa8..43652e6b9db 100644 --- a/src/main/browser/browser-manager-grab.test.ts +++ b/src/main/browser/browser-manager-grab.test.ts @@ -781,7 +781,7 @@ describe('browserManager grab operations', () => { const promise = browserManager.awaitGrabSelection('tab-1', 'op-1', guest) // Find the did-start-navigation handler and trigger it with isMainFrame=true - const navHandler = guestOnMock.mock.calls.find( + const navHandler = guestOnMock.mock.calls.findLast( ([event]) => event === 'did-start-navigation' )?.[1] as ((...args: unknown[]) => void) | undefined @@ -798,7 +798,7 @@ describe('browserManager grab operations', () => { void browserManager.awaitGrabSelection('tab-1', 'op-1', guest) // Trigger did-start-navigation with isMainFrame=false (subframe) - const navHandler = guestOnMock.mock.calls.find( + const navHandler = guestOnMock.mock.calls.findLast( ([event]) => event === 'did-start-navigation' )?.[1] as ((...args: unknown[]) => void) | undefined diff --git a/src/main/browser/browser-manager.test.ts b/src/main/browser/browser-manager.test.ts index 912923fc8f5..6a4d6400e44 100644 --- a/src/main/browser/browser-manager.test.ts +++ b/src/main/browser/browser-manager.test.ts @@ -104,6 +104,7 @@ describe('browserManager', () => { webContentsFromIdMock.mockReset() openPopupWithOriginBarMock.mockReset() browserManager.unregisterAll() + browserManager.setBrowserGuestStateChangedListener(null) browserManager.setDictationShortcutForwardingPredicate(null) browserManager.setSettingsResolver(() => ({})) }) @@ -583,6 +584,45 @@ describe('browserManager', () => { expect(browserManager.getSessionProfileIdForTab('browser-1')).toBe('work') }) + it('tracks offscreen load failures for the owning worktree snapshot', () => { + const stateChanged = vi.fn() + const offscreenGuest = { + id: 605, + isDestroyed: vi.fn(() => false), + getType: vi.fn(() => 'window'), + setBackgroundThrottling: vi.fn(), + setWindowOpenHandler: vi.fn(), + on: vi.fn(), + off: vi.fn(), + getURL: vi.fn(() => 'https://localhost:3443/') + } + webContentsFromIdMock.mockReturnValue(offscreenGuest) + browserManager.setBrowserGuestStateChangedListener(stateChanged) + + browserManager.registerOffscreenGuest({ + browserPageId: 'offscreen-page', + worktreeId: 'remote-worktree', + webContentsId: offscreenGuest.id + }) + const didFailLoad = offscreenGuest.on.mock.calls.find( + ([event]) => event === 'did-fail-load' + )?.[1] as ( + event: unknown, + errorCode: number, + errorDescription: string, + validatedUrl: string, + isMainFrame: boolean + ) => void + didFailLoad(null, -202, 'Certificate authority invalid', 'https://localhost:3443/', true) + + expect(browserManager.getBrowserPageLoadError('offscreen-page')).toEqual({ + code: -202, + description: 'Certificate authority invalid', + validatedUrl: 'https://localhost:3443/' + }) + expect(stateChanged).toHaveBeenCalledWith('remote-worktree') + }) + it('falls back to opening popup URLs externally before a guest is registered', () => { const guest = { id: 105, @@ -1588,6 +1628,163 @@ describe('browserManager', () => { validatedUrl: 'http://localhost:3000/' } }) + expect(browserManager.getBrowserPageLoadError('browser-1')).toEqual({ + code: -105, + description: 'Name not resolved', + validatedUrl: 'http://localhost:3000/' + }) + + const didStartNavigationHandler = guestOnMock.mock.calls.find( + ([event]) => event === 'did-start-navigation' + )?.[1] as + | ((event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void) + | undefined + didStartNavigationHandler?.(null, 'http://localhost:3000/retry', false, true) + expect(browserManager.getBrowserPageLoadError('browser-1')).toBeNull() + }) + + it('drops a queued failure when a replacement navigation starts before registration', () => { + const rendererSendMock = vi.fn() + const guest = { + id: 407, + isDestroyed: vi.fn(() => false), + getType: vi.fn(() => 'webview'), + setBackgroundThrottling: guestSetBackgroundThrottlingMock, + setWindowOpenHandler: guestSetWindowOpenHandlerMock, + on: guestOnMock, + off: guestOffMock, + openDevTools: guestOpenDevToolsMock, + getURL: vi.fn(() => 'https://example.com/') + } + webContentsFromIdMock.mockImplementation((id: number) => + id === guest.id + ? guest + : id === rendererWebContentsId + ? { isDestroyed: vi.fn(() => false), send: rendererSendMock } + : null + ) + + browserManager.attachGuestPolicies(guest as never) + const didFailLoad = guestOnMock.mock.calls.find( + ([event]) => event === 'did-fail-load' + )?.[1] as ( + event: unknown, + errorCode: number, + errorDescription: string, + validatedUrl: string, + isMainFrame: boolean + ) => void + const didStartNavigation = guestOnMock.mock.calls.find( + ([event]) => event === 'did-start-navigation' + )?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void + + didFailLoad(null, -202, 'Certificate authority invalid', 'https://localhost:3443/', true) + didStartNavigation(null, 'https://example.com/', false, true) + expect( + browserManager.registerGuest({ + browserPageId: 'browser-late-registration', + webContentsId: guest.id, + rendererWebContentsId + }) + ).toBe(true) + + expect(rendererSendMock).not.toHaveBeenCalledWith( + 'browser:guest-load-failed', + expect.anything() + ) + expect(browserManager.getBrowserPageLoadError('browser-late-registration')).toBeNull() + }) + + it('keeps a certificate failure until a real main-frame navigation starts', () => { + const guest = { + id: 405, + isDestroyed: vi.fn(() => false), + getType: vi.fn(() => 'webview'), + setBackgroundThrottling: guestSetBackgroundThrottlingMock, + setWindowOpenHandler: guestSetWindowOpenHandlerMock, + on: guestOnMock, + off: guestOffMock, + openDevTools: guestOpenDevToolsMock, + send: vi.fn(), + getURL: vi.fn(() => 'chrome-error://chromewebdata/') + } + webContentsFromIdMock.mockReturnValue(guest) + + browserManager.attachGuestPolicies(guest as never) + const didStartNavigation = guestOnMock.mock.calls.find( + ([event]) => event === 'did-start-navigation' + )?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void + const didFailLoad = guestOnMock.mock.calls.find( + ([event]) => event === 'did-fail-load' + )?.[1] as ( + event: unknown, + errorCode: number, + errorDescription: string, + validatedUrl: string, + isMainFrame: boolean + ) => void + + browserManager.registerGuest({ + browserPageId: 'browser-certificate-page', + webContentsId: guest.id, + rendererWebContentsId + }) + didFailLoad(null, -202, 'Certificate authority invalid', 'https://localhost:3443/', true) + didStartNavigation(null, 'chrome-error://chromewebdata/', false, true) + expect(browserManager.getBrowserPageLoadError('browser-certificate-page')?.code).toBe(-202) + + didStartNavigation(null, 'https://localhost:3443/', false, true) + expect(browserManager.getBrowserPageLoadError('browser-certificate-page')).toBeNull() + }) + + it('restores a certificate failure when a retry navigation aborts before committing', () => { + const guest = { + id: 406, + isDestroyed: vi.fn(() => false), + getType: vi.fn(() => 'webview'), + setBackgroundThrottling: guestSetBackgroundThrottlingMock, + setWindowOpenHandler: guestSetWindowOpenHandlerMock, + on: guestOnMock, + off: guestOffMock, + openDevTools: guestOpenDevToolsMock, + send: vi.fn(), + getURL: vi.fn(() => 'chrome-error://chromewebdata/') + } + webContentsFromIdMock.mockReturnValue(guest) + + browserManager.attachGuestPolicies(guest as never) + const didStartNavigation = guestOnMock.mock.calls.find( + ([event]) => event === 'did-start-navigation' + )?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void + const didFailLoad = guestOnMock.mock.calls.find( + ([event]) => event === 'did-fail-load' + )?.[1] as ( + event: unknown, + errorCode: number, + errorDescription: string, + validatedUrl: string, + isMainFrame: boolean + ) => void + + browserManager.registerGuest({ + browserPageId: 'browser-retry-abort-page', + webContentsId: guest.id, + rendererWebContentsId + }) + didFailLoad(null, -202, 'Certificate authority invalid', 'https://localhost:3443/', true) + // Retry: the new navigation starts (overlay optimistically cleared)... + didStartNavigation(null, 'https://localhost:3443/', false, true) + expect(browserManager.getBrowserPageLoadError('browser-retry-abort-page')).toBeNull() + // ...then aborts (ERR_ABORTED) before committing, so the error is restored. + didFailLoad(null, -3, 'Aborted', 'https://localhost:3443/', true) + expect(browserManager.getBrowserPageLoadError('browser-retry-abort-page')?.code).toBe(-202) + + // A fresh navigation from a non-errored state drops the stash, so a later + // abort cannot resurrect the old error. + didStartNavigation(null, 'https://localhost:3443/', false, true) // stashes -202, clears active + didStartNavigation(null, 'https://example.com/', false, true) // active empty -> drops stash + didFailLoad(null, -3, 'Aborted', 'https://example.com/', true) + expect(browserManager.getBrowserPageLoadError('browser-retry-abort-page')).toBeNull() }) it('queues permission denials and download requests until the guest registers', () => { diff --git a/src/main/browser/browser-manager.ts b/src/main/browser/browser-manager.ts index b9232bcd8d6..60352732efa 100644 --- a/src/main/browser/browser-manager.ts +++ b/src/main/browser/browser-manager.ts @@ -9,7 +9,8 @@ import { ORCA_BROWSER_BLANK_URL } from '../../shared/constants' import { normalizeBrowserNavigationUrl, normalizeExternalBrowserUrl, - redactKagiSessionToken + redactKagiSessionToken, + toSecureCertificateEndpoint } from '../../shared/browser-url' import type { BrowserDownloadFinishedEvent, @@ -52,9 +53,18 @@ import { buildBrowserAnnotationViewportBridgeScript } from '../../shared/browser-annotation-viewport-bridge' import type { KeybindingOverrides } from '../../shared/keybindings' +import type { BrowserCertificateFailure, BrowserLoadError } from '../../shared/types' +import { + BrowserCertificateTrustController, + type ManagedBrowserGuestContext +} from './browser-certificate-trust-controller' const AUTOMATION_VISIBILITY_ACQUIRE_TIMEOUT_MS = 2_000 +function isChromiumInternalErrorUrl(url: string): boolean { + return url.startsWith('chrome-error://') +} + function resolveWithTimeout( promise: Promise, timeoutMs: number, @@ -238,23 +248,47 @@ export class BrowserManager { private readonly annotationViewportBridgeOpsByTabId = new Map>() private readonly worktreeIdByTabId = new Map() private readonly policyAttachedGuestIds = new Set() + private readonly offscreenGuestIds = new Set() private readonly policyCleanupByGuestId = new Map void>() private readonly clickedLinkFrameNameByGuestId = new Map() + private readonly loadErrorsByGuestId = new Map() + // Why: did-start-navigation optimistically hides the overlay, but an aborted + // nav never commits — stash the cleared error so did-fail-load(-3) can restore + // it instead of stranding the user on a blank surface. + private readonly clearedLoadErrorsByGuestId = new Map() + private browserGuestStateChangedListener: ((worktreeId: string) => void) | null = null + private certificateTrustController: BrowserCertificateTrustController | null = null private shouldForwardDictationShortcut: (() => boolean) | null = null private readonly pendingLoadFailuresByGuestId = new Map< number, { code: number; description: string; validatedUrl: string } >() - - setDictationShortcutForwardingPredicate(predicate: (() => boolean) | null): void { - this.shouldForwardDictationShortcut = predicate - } private readonly pendingPermissionEventsByGuestId = new Map() private readonly pendingPopupEventsByGuestId = new Map() private readonly pendingDownloadIdsByGuestId = new Map() private readonly downloadsById = new Map() private readonly grabSessionController = new BrowserGrabSessionController() + setDictationShortcutForwardingPredicate(predicate: (() => boolean) | null): void { + this.shouldForwardDictationShortcut = predicate + } + + setBrowserGuestStateChangedListener(listener: ((worktreeId: string) => void) | null): void { + this.browserGuestStateChangedListener = listener + } + + setCertificateTrustController(controller: BrowserCertificateTrustController): void { + this.certificateTrustController = controller + } + + installCertificateRequestGuard(session: Electron.Session): void { + this.certificateTrustController?.installSessionRequestGuard(session) + } + + removeCertificateRequestGuard(session: Electron.Session): void { + this.certificateTrustController?.removeSessionRequestGuard(session) + } + setSettingsResolver( resolver: () => { keybindings?: KeybindingOverrides @@ -827,18 +861,84 @@ export class BrowserManager { validatedURL: string, isMainFrame: boolean ): void => { - if (!isMainFrame || errorCode === -3) { + if (!isMainFrame) { return } - this.forwardOrQueueGuestLoadFailure(guest.id, { + const browserPageId = this.tabIdByWebContentsId.get(guest.id) + const certificateFailure = browserPageId + ? this.certificateTrustController?.getFailure(browserPageId) + : null + if ( + certificateFailure && + toSecureCertificateEndpoint(validatedURL || guest.getURL()) === + toSecureCertificateEndpoint(certificateFailure.origin) + ) { + // Why: a request-guard cancellation is the transport for the existing + // certificate warning; do not replace it with ERR_ABORTED/blocked copy. + return + } + if (errorCode === -3) { + // Why: an aborted main-frame nav never committed, so restore the error + // did-start-navigation optimistically cleared — otherwise a retry that + // aborts leaves the failed page with no overlay. + const clearedError = this.clearedLoadErrorsByGuestId.get(guest.id) + if (clearedError !== undefined) { + this.clearedLoadErrorsByGuestId.delete(guest.id) + this.loadErrorsByGuestId.set(guest.id, clearedError) + this.forwardOrQueueGuestLoadFailure(guest.id, clearedError) + this.notifyBrowserGuestStateChanged(guest.id) + } + return + } + this.clearedLoadErrorsByGuestId.delete(guest.id) + const loadError = { code: errorCode, description: errorDescription || 'This site could not be reached.', - validatedUrl: validatedURL || guest.getURL() || 'about:blank' - }) + validatedUrl: redactKagiSessionToken(validatedURL || guest.getURL() || 'about:blank') + } + this.loadErrorsByGuestId.set(guest.id, loadError) + this.forwardOrQueueGuestLoadFailure(guest.id, loadError) + this.notifyBrowserGuestStateChanged(guest.id) + } + + const didStartNavigationHandler = ( + _event: Electron.Event, + url: string, + _isInPlace: boolean, + isMainFrame: boolean + ): void => { + if (!isMainFrame || isChromiumInternalErrorUrl(url)) { + return + } + this.certificateTrustController?.onMainFrameNavigationStarted(guest.id) + // Why: a failure queued before renderer registration belongs only to the + // navigation that produced it. A replacement navigation must not replay + // that stale failure when its later dom-ready registers the guest. + this.pendingLoadFailuresByGuestId.delete(guest.id) + const activeError = this.loadErrorsByGuestId.get(guest.id) + if (activeError === undefined) { + // Why: no error to hide; drop any stale stash so a later abort cannot + // resurrect an error from a navigation that already succeeded. + this.clearedLoadErrorsByGuestId.delete(guest.id) + return + } + this.clearedLoadErrorsByGuestId.set(guest.id, activeError) + this.loadErrorsByGuestId.delete(guest.id) + this.notifyBrowserGuestStateChanged(guest.id) + } + + const didNavigateHandler = (_event: Electron.Event, url: string): void => { + // Why: a committed navigation means the optimistic stash from + // did-start-navigation is obsolete — drop it so a later ERR_ABORTED + // cannot restore a failure over the already-committed page. + this.clearedLoadErrorsByGuestId.delete(guest.id) + this.certificateTrustController?.onMainFrameNavigationCommitted(guest.id, url) } guest.on('will-navigate', navigationGuard) guest.on('will-redirect', navigationGuard) + guest.on('did-start-navigation', didStartNavigationHandler) + guest.on('did-navigate', didNavigateHandler) guest.on('did-fail-load', didFailLoadHandler) const handleDestroyed = (): void => { // Why: guests can be destroyed before renderer registration. Without @@ -874,6 +974,8 @@ export class BrowserManager { if (!guest.isDestroyed()) { guest.off('will-navigate', navigationGuard) guest.off('will-redirect', navigationGuard) + guest.off('did-start-navigation', didStartNavigationHandler) + guest.off('did-navigate', didNavigateHandler) guest.off('did-fail-load', didFailLoadHandler) } }) @@ -918,6 +1020,7 @@ export class BrowserManager { private cleanupGuestPolicyAttachment(guestWebContentsId: number): void { const isPrimaryGuest = this.tabIdByWebContentsId.has(guestWebContentsId) + this.certificateTrustController?.onGuestRetired(guestWebContentsId) const policyCleanup = this.policyCleanupByGuestId.get(guestWebContentsId) if (policyCleanup) { policyCleanup() @@ -925,6 +1028,7 @@ export class BrowserManager { } this.policyAttachedGuestIds.delete(guestWebContentsId) this.clickedLinkFrameNameByGuestId.delete(guestWebContentsId) + this.offscreenGuestIds.delete(guestWebContentsId) this.popupOwnerContextByGuestId.delete(guestWebContentsId) // Why: a popup must stop inheriting authorization as soon as its primary // owner is retired, even if Chromium has not destroyed the child yet. @@ -936,6 +1040,8 @@ export class BrowserManager { } } this.pendingLoadFailuresByGuestId.delete(guestWebContentsId) + this.loadErrorsByGuestId.delete(guestWebContentsId) + this.clearedLoadErrorsByGuestId.delete(guestWebContentsId) this.pendingPermissionEventsByGuestId.delete(guestWebContentsId) this.pendingPopupEventsByGuestId.delete(guestWebContentsId) this.cancelPendingDownloadsForGuest(guestWebContentsId) @@ -949,10 +1055,10 @@ export class BrowserManager { sessionProfileId, webContentsId, rendererWebContentsId - }: BrowserGuestRegistration): void { + }: BrowserGuestRegistration): boolean { const browserTabId = browserPageId ?? legacyBrowserTabId if (!browserTabId) { - return + return false } // Why: re-registering the same browser tab can happen when Chromium swaps // or recreates the underlying guest surface. Any active grab is bound to @@ -968,7 +1074,7 @@ export class BrowserManager { const guest = webContents.fromId(webContentsId) if (!guest || guest.isDestroyed()) { - return + return false } // Why: the renderer sends webContentsId, which we must not blindly trust. @@ -976,21 +1082,20 @@ export class BrowserManager { // causing us to overwrite its setWindowOpenHandler or attach unintended // context menus. Only accept genuine webview guest surfaces. if (guest.getType() !== 'webview') { - return + return false } if (!this.policyAttachedGuestIds.has(webContentsId)) { // Why: renderer registration is only the second half of the guest setup. // Main must only trust guests that already passed attach-time policy // installation; otherwise a trusted renderer could point us at some other // arbitrary webview and bypass the intended host-window attach boundary. - return + return false } const previousWebContentsId = this.webContentsIdByTabId.get(browserTabId) if (previousWebContentsId !== undefined && previousWebContentsId !== webContentsId) { this.retireStaleGuestWebContents(previousWebContentsId) } - this.webContentsIdByTabId.set(browserTabId, webContentsId) this.tabIdByWebContentsId.set(webContentsId, browserTabId) if (workspaceId) { @@ -1001,6 +1106,7 @@ export class BrowserManager { if (worktreeId) { this.worktreeIdByTabId.set(browserTabId, worktreeId) } + this.certificateTrustController?.onGuestRegistered(webContentsId, browserTabId) this.setupContextMenu(browserTabId, guest) this.setupGrabShortcut(browserTabId, guest) @@ -1010,6 +1116,7 @@ export class BrowserManager { this.flushPendingPermissionEvents(browserTabId, webContentsId) this.flushPendingPopupEvents(browserTabId, webContentsId) this.flushPendingDownloadRequests(browserTabId, webContentsId) + return true } unregisterGuest(browserTabId: string): void { @@ -1088,6 +1195,10 @@ export class BrowserManager { if (!guest || guest.isDestroyed()) { return } + // Why: offscreen pages have no renderer webview listeners, so main owns + // their load-failure lifecycle for remote browser chrome. + this.offscreenGuestIds.add(webContentsId) + this.attachGuestPolicies(guest) const previousWebContentsId = this.webContentsIdByTabId.get(browserPageId) if (previousWebContentsId !== undefined && previousWebContentsId !== webContentsId) { this.retireStaleGuestWebContents(previousWebContentsId) @@ -1098,6 +1209,7 @@ export class BrowserManager { if (worktreeId) { this.worktreeIdByTabId.set(browserPageId, worktreeId) } + this.certificateTrustController?.onGuestRegistered(webContentsId, browserPageId) } unregisterAll(): void { @@ -1111,6 +1223,7 @@ export class BrowserManager { this.unregisterGuest(browserTabId) } this.policyAttachedGuestIds.clear() + this.offscreenGuestIds.clear() // Why: unregisterGuest only cleans up guests that were registered (have an // entry in webContentsIdByTabId). Guests that went through // attachGuestPolicies but were never registered still have cleanup closures @@ -1125,6 +1238,8 @@ export class BrowserManager { this.worktreeIdByTabId.clear() this.sessionProfileIdByPageId.clear() this.pendingLoadFailuresByGuestId.clear() + this.loadErrorsByGuestId.clear() + this.clearedLoadErrorsByGuestId.clear() this.pendingPermissionEventsByGuestId.clear() this.pendingPopupEventsByGuestId.clear() this.pendingDownloadIdsByGuestId.clear() @@ -1148,6 +1263,86 @@ export class BrowserManager { return this.sessionProfileIdByPageId.get(browserTabId) ?? null } + getBrowserPageLoadError(browserPageId: string): BrowserLoadError | null { + const webContentsId = this.webContentsIdByTabId.get(browserPageId) + return webContentsId === undefined + ? null + : (this.loadErrorsByGuestId.get(webContentsId) ?? null) + } + + getBrowserPageCertificateFailure(browserPageId: string): BrowserCertificateFailure | null { + return this.certificateTrustController?.getFailure(browserPageId) ?? null + } + + getManagedBrowserGuestContext(webContentsId: number): ManagedBrowserGuestContext | null { + if (this.popupOwnerContextByGuestId.has(webContentsId)) { + return null + } + const browserPageId = this.tabIdByWebContentsId.get(webContentsId) ?? null + const offscreen = this.offscreenGuestIds.has(webContentsId) + if (!offscreen && !this.policyAttachedGuestIds.has(webContentsId)) { + return null + } + if (!offscreen) { + const guest = webContents.fromId(webContentsId) + if (!guest || guest.isDestroyed() || guest.getType() !== 'webview') { + return null + } + } + return { + browserPageId, + worktreeId: browserPageId ? (this.worktreeIdByTabId.get(browserPageId) ?? null) : null, + sessionProfileId: browserPageId + ? (this.sessionProfileIdByPageId.get(browserPageId) ?? null) + : null, + owner: offscreen ? 'offscreen' : 'desktop-webview' + } + } + + notifyCertificateFailureChanged( + webContentsId: number, + failure: BrowserCertificateFailure | null, + navigationUrl?: string + ): void { + if (failure && navigationUrl) { + const loadError = { + code: failure.errorCode ?? -1, + description: failure.error, + validatedUrl: redactKagiSessionToken(navigationUrl) + } + this.loadErrorsByGuestId.set(webContentsId, loadError) + this.forwardOrQueueGuestLoadFailure(webContentsId, loadError) + } + const browserPageId = this.tabIdByWebContentsId.get(webContentsId) + if (!browserPageId) { + return + } + if (this.offscreenGuestIds.has(webContentsId)) { + this.notifyBrowserGuestStateChanged(webContentsId) + return + } + const renderer = this.resolveRendererForBrowserTab(browserPageId) + renderer?.send('browser:certificate-failure-changed', { browserPageId, failure }) + } + + private notifyBrowserGuestStateChanged(webContentsId: number): void { + if (!this.offscreenGuestIds.has(webContentsId)) { + return + } + const browserPageId = this.tabIdByWebContentsId.get(webContentsId) + const worktreeId = browserPageId ? this.worktreeIdByTabId.get(browserPageId) : null + if (worktreeId) { + // Why: this runs inside an Electron guest event dispatch; the listener + // synchronously reconciles mobile-session tabs, and an escaping throw would + // become a fatal uncaught exception (no catch-all main-process guard). + try { + this.browserGuestStateChangedListener?.(worktreeId) + } catch (error) { + console.error('[browser-manager] browserGuestStateChanged listener failed', error) + } + } + } + notifyPermissionDenied(args: { guestWebContentsId: number permission: string @@ -2033,3 +2228,13 @@ export class BrowserManager { } export const browserManager = new BrowserManager() +export const browserCertificateTrustController = new BrowserCertificateTrustController({ + resolveManagedGuestContext: (webContentsId) => + browserManager.getManagedBrowserGuestContext(webContentsId), + resolveWebContentsIdForPage: (browserPageId) => + browserManager.getGuestWebContentsId(browserPageId), + resolveWebContents: (webContentsId) => webContents.fromId(webContentsId) ?? null, + onFailureChanged: (webContentsId, failure, navigationUrl) => + browserManager.notifyCertificateFailureChanged(webContentsId, failure, navigationUrl) +}) +browserManager.setCertificateTrustController(browserCertificateTrustController) diff --git a/src/main/browser/browser-session-registry.persistence.test.ts b/src/main/browser/browser-session-registry.persistence.test.ts index 583afff0815..174b5aa7715 100644 --- a/src/main/browser/browser-session-registry.persistence.test.ts +++ b/src/main/browser/browser-session-registry.persistence.test.ts @@ -109,7 +109,9 @@ function installModuleMocks( vi.doMock('./browser-manager', () => ({ browserManager: { notifyPermissionDenied: browserManagerNotifyPermissionDeniedMock, - handleGuestWillDownload: browserManagerHandleGuestWillDownloadMock + handleGuestWillDownload: browserManagerHandleGuestWillDownloadMock, + installCertificateRequestGuard: vi.fn(), + removeCertificateRequestGuard: vi.fn() } })) vi.doMock('./browser-media-access', () => ({ diff --git a/src/main/browser/browser-session-registry.test.ts b/src/main/browser/browser-session-registry.test.ts index 8d81590ae5c..f116e08c0da 100644 --- a/src/main/browser/browser-session-registry.test.ts +++ b/src/main/browser/browser-session-registry.test.ts @@ -21,7 +21,9 @@ vi.mock('electron', () => ({ vi.mock('./browser-manager', () => ({ browserManager: { notifyPermissionDenied: vi.fn(), - handleGuestWillDownload: vi.fn() + handleGuestWillDownload: vi.fn(), + installCertificateRequestGuard: vi.fn(), + removeCertificateRequestGuard: vi.fn() } })) diff --git a/src/main/browser/browser-session-registry.ts b/src/main/browser/browser-session-registry.ts index 3603de11568..a70aff4e6b2 100644 --- a/src/main/browser/browser-session-registry.ts +++ b/src/main/browser/browser-session-registry.ts @@ -551,6 +551,7 @@ class BrowserSessionRegistry { } const sess = session.fromPartition(partition) + browserManager.installCertificateRequestGuard(sess) if (typeof sess.getUserAgent === 'function') { const cleanUA = cleanElectronUserAgent(sess.getUserAgent()) sess.setUserAgent(cleanUA) @@ -622,6 +623,7 @@ class BrowserSessionRegistry { // Electron Session object survives; clear policy callbacks and listener // bookkeeping so removed profiles do not leave retained closures behind. this.configuredPartitions.delete(partition) + browserManager.removeCertificateRequestGuard(sess) sess.removeListener('will-download', this.handleWillDownload) clearBrowserWebAuthnAccessHandlers(sess) sess.setPermissionRequestHandler(null) diff --git a/src/main/index.ts b/src/main/index.ts index b120f62c8a5..cebff02a96f 100644 --- a/src/main/index.ts +++ b/src/main/index.ts @@ -163,7 +163,7 @@ import { } from './ipc/pty' import { AgentBrowserBridge } from './browser/agent-browser-bridge' import { EmulatorBridge } from './emulator/emulator-bridge' -import { browserManager } from './browser/browser-manager' +import { browserCertificateTrustController, browserManager } from './browser/browser-manager' import { OffscreenBrowserBackend } from './browser/offscreen-browser-backend' import { initializeBrowserSessionsForApp } from './browser/browser-session-startup' import { setUnreadDockBadgeCount } from './dock/unread-badge' @@ -1710,6 +1710,22 @@ function shouldSuppressCodexAutoApprovalSyntheticTitleFromHook(args: { app.whenReady().then(async () => { logStartupMilestone('app-ready') + // Why: certificate decisions must be installed before either desktop + // webviews or headless browser windows can issue their first TLS request. + app.on( + 'certificate-error', + (event, webContents, url, error, certificate, callback, isMainFrame) => { + browserCertificateTrustController.handleCertificateError({ + event, + webContents, + url, + error, + certificate, + callback, + isMainFrame + }) + } + ) electronApp.setAppUserModelId(devInstanceIdentity.appUserModelId) app.setName(devInstanceIdentity.name) @@ -1919,6 +1935,9 @@ app.whenReady().then(async () => { isAgentStatusHooksEnabled(store?.getSettings()) ? agentHookServer.buildPtyEnv() : {} }) runtime = runtimeService + browserManager.setBrowserGuestStateChangedListener((worktreeId) => { + runtimeService.notifyMobileSessionTabsChanged(worktreeId) + }) automations = new AutomationService(store, { claudeUsage, codexUsage, @@ -2401,6 +2420,7 @@ app.on('will-quit', (e) => { // Why: headless offscreen browser windows are main-process owned; tear them // down explicitly on quit alongside the other browser/session shutdowns. runtime?.getOffscreenBrowserBackend()?.destroyAll?.() + browserManager.setBrowserGuestStateChangedListener(null) const emulatorShutdown = runtime?.getEmulatorBridge()?.destroyAllSessions() ?? Promise.resolve() killAllPty() const watcherShutdown = shutdownWatchersOnce() diff --git a/src/main/ipc/browser.test.ts b/src/main/ipc/browser.test.ts index 042140cd38b..7651d130651 100644 --- a/src/main/ipc/browser.test.ts +++ b/src/main/ipc/browser.test.ts @@ -11,6 +11,7 @@ const { openDevToolsMock, setAnnotationViewportBridgeMock, cancelDownloadMock, + proceedCertificateMock, browserWindowFromWebContentsMock, webContentsFromIdMock } = vi.hoisted(() => ({ @@ -24,6 +25,7 @@ const { openDevToolsMock: vi.fn().mockResolvedValue(true), setAnnotationViewportBridgeMock: vi.fn().mockResolvedValue(true), cancelDownloadMock: vi.fn(), + proceedCertificateMock: vi.fn(), browserWindowFromWebContentsMock: vi.fn(), webContentsFromIdMock: vi.fn() })) @@ -42,6 +44,9 @@ vi.mock('electron', () => ({ })) vi.mock('../browser/browser-manager', () => ({ + browserCertificateTrustController: { + proceed: proceedCertificateMock + }, browserManager: { registerGuest: registerGuestMock, unregisterGuest: unregisterGuestMock, @@ -68,6 +73,7 @@ describe('registerBrowserHandlers', () => { removeHandlerMock.mockReset() handleMock.mockReset() registerGuestMock.mockReset() + registerGuestMock.mockReturnValue(true) unregisterGuestMock.mockReset() getGuestWebContentsIdMock.mockReset() getWebContentsIdByTabIdMock.mockReset() @@ -76,6 +82,8 @@ describe('registerBrowserHandlers', () => { openDevToolsMock.mockReset() setAnnotationViewportBridgeMock.mockReset() cancelDownloadMock.mockReset() + proceedCertificateMock.mockReset() + proceedCertificateMock.mockReturnValue({ ok: true }) browserWindowFromWebContentsMock.mockReset() webContentsFromIdMock.mockReset() webContentsFromIdMock.mockReturnValue({ isDestroyed: () => false }) @@ -110,6 +118,41 @@ describe('registerBrowserHandlers', () => { expect(registerGuestMock).not.toHaveBeenCalled() }) + it('does not resolve registration waiters when BrowserManager rejects the guest', async () => { + vi.useFakeTimers() + try { + registerGuestMock.mockReturnValue(false) + const settled = Promise.allSettled([waitForTabRegistration('page-1', 1000)]) + registerBrowserHandlers() + const registerHandler = handleMock.mock.calls.find( + ([channel]) => channel === 'browser:registerGuest' + )?.[1] as (event: { sender: Electron.WebContents }, args: object) => boolean + + const result = registerHandler( + { + sender: { + id: 91, + isDestroyed: () => false, + getType: () => 'window', + getURL: () => 'file:///renderer/index.html' + } as Electron.WebContents + }, + { + browserPageId: 'page-1', + workspaceId: 'workspace-1', + worktreeId: 'worktree-1', + webContentsId: 123 + } + ) + + expect(result).toBe(false) + await vi.advanceTimersByTimeAsync(1001) + expect(await settled).toEqual([{ status: 'rejected', reason: expect.any(Error) }]) + } finally { + vi.useRealTimers() + } + }) + it('authorizes browser download cancellation through the owning renderer', () => { cancelDownloadMock.mockReturnValue(true) registerBrowserHandlers() @@ -157,6 +200,60 @@ describe('registerBrowserHandlers', () => { expect(cancelDownloadMock).not.toHaveBeenCalled() }) + it('allows only the trusted renderer to approve an exact certificate challenge', () => { + registerBrowserHandlers() + const proceedHandler = handleMock.mock.calls.find( + ([channel]) => channel === 'browser:proceedCertificate' + )?.[1] as (event: { sender: Electron.WebContents }, args: unknown) => unknown + const trustedSender = { + id: 91, + isDestroyed: () => false, + getType: () => 'window', + getURL: () => 'file:///renderer/index.html' + } as Electron.WebContents + + expect( + proceedHandler( + { sender: trustedSender }, + { browserPageId: 'page-1', challengeId: 'challenge-1' } + ) + ).toEqual({ ok: true }) + expect(proceedCertificateMock).toHaveBeenCalledWith('page-1', 'challenge-1') + + proceedCertificateMock.mockClear() + const untrustedSender = { + id: 92, + isDestroyed: () => false, + getType: () => 'webview', + getURL: () => 'https://localhost:3443/' + } as Electron.WebContents + expect( + proceedHandler( + { sender: untrustedSender }, + { browserPageId: 'page-1', challengeId: 'challenge-1' } + ) + ).toEqual({ ok: false, reason: 'missing' }) + expect(proceedCertificateMock).not.toHaveBeenCalled() + }) + + it('rejects malformed certificate approval IPC arguments', () => { + registerBrowserHandlers() + const proceedHandler = handleMock.mock.calls.find( + ([channel]) => channel === 'browser:proceedCertificate' + )?.[1] as (event: { sender: Electron.WebContents }, args: unknown) => unknown + const sender = { + id: 91, + isDestroyed: () => false, + getType: () => 'window', + getURL: () => 'file:///renderer/index.html' + } as Electron.WebContents + + for (const args of [null, {}, { browserPageId: 1, challengeId: 'challenge-1' }]) { + expect(proceedHandler({ sender }, args)).toEqual({ ok: false, reason: 'missing' }) + } + expect(proceedCertificateMock).not.toHaveBeenCalled() + }) + it('updates the bridge active tab for the owning worktree', async () => { const onTabChangedMock = vi.fn() getGuestWebContentsIdMock.mockReturnValue(4242) diff --git a/src/main/ipc/browser.ts b/src/main/ipc/browser.ts index 1bc405c9d0a..f5c1c8fb268 100644 --- a/src/main/ipc/browser.ts +++ b/src/main/ipc/browser.ts @@ -1,7 +1,7 @@ /* eslint-disable max-lines -- Why: browser IPC handlers must be registered together so the trust boundary (isTrustedBrowserRenderer) and handler teardown stay consistent. */ import { BrowserWindow, ipcMain, webContents } from 'electron' -import { browserManager } from '../browser/browser-manager' +import { browserCertificateTrustController, browserManager } from '../browser/browser-manager' import type { AgentBrowserBridge } from '../browser/agent-browser-bridge' import { browserSessionRegistry } from '../browser/browser-session-registry' import { @@ -24,6 +24,7 @@ import type { } from '../../shared/browser-grab-types' import type { BrowserCookieImportResult, + BrowserCertificateProceedResult, BrowserSessionProfile, BrowserSessionProfileScope, BrowserViewportOverride @@ -180,6 +181,7 @@ export function registerBrowserHandlers(): void { ipcMain.removeHandler('browser:captureSelectionScreenshot') ipcMain.removeHandler('browser:extractHoverPayload') ipcMain.removeHandler('browser:activeTabChanged') + ipcMain.removeHandler('browser:proceedCertificate') ipcMain.handle( 'browser:registerGuest', @@ -201,10 +203,13 @@ export function registerBrowserHandlers(): void { // with a new webContentsId. The bridge must destroy the old session's // proxy (its webContents is gone) and let the next command recreate it. const previousWcId = browserManager.getGuestWebContentsId(args.browserPageId) - browserManager.registerGuest({ + const registered = browserManager.registerGuest({ ...args, rendererWebContentsId: event.sender.id }) + if (!registered) { + return false + } if (agentBrowserBridgeRef && previousWcId !== null && previousWcId !== args.webContentsId) { agentBrowserBridgeRef.onProcessSwap(args.browserPageId, args.webContentsId, previousWcId) } @@ -235,6 +240,23 @@ export function registerBrowserHandlers(): void { return true }) + ipcMain.handle( + 'browser:proceedCertificate', + ( + event, + args: { browserPageId?: unknown; challengeId?: unknown } + ): BrowserCertificateProceedResult => { + if ( + !isTrustedBrowserRenderer(event.sender) || + typeof args?.browserPageId !== 'string' || + typeof args.challengeId !== 'string' + ) { + return { ok: false, reason: 'missing' } + } + return browserCertificateTrustController.proceed(args.browserPageId, args.challengeId) + } + ) + // Why: keeps the bridge's active tab in sync with the renderer's UI state. // Without this, a user switching tabs in the UI would leave the agent operating // on the previous tab, which is confusing. diff --git a/src/main/runtime/orca-runtime-browser.ts b/src/main/runtime/orca-runtime-browser.ts index 053f614663c..c7da17da95d 100644 --- a/src/main/runtime/orca-runtime-browser.ts +++ b/src/main/runtime/orca-runtime-browser.ts @@ -49,9 +49,10 @@ import type { BrowserViewportResult, BrowserWaitResult } from '../../shared/runtime-types' +import type { BrowserCertificateProceedResult } from '../../shared/types' import type { AgentBrowserBridge } from '../browser/agent-browser-bridge' import type { BrowserBackend } from '../browser/browser-backend' -import { browserManager } from '../browser/browser-manager' +import { browserCertificateTrustController, browserManager } from '../browser/browser-manager' import { BrowserError } from '../browser/cdp-bridge' import { startBrowserScreencast, @@ -633,6 +634,16 @@ export class RuntimeBrowserCommands { } } + async browserProceedCertificate( + params: { challengeId: string } & BrowserCommandTargetParams + ): Promise { + const target = await this.resolveBrowserCommandTarget(params) + if (!target.browserPageId) { + return { ok: false, reason: 'missing' } + } + return browserCertificateTrustController.proceed(target.browserPageId, params.challengeId) + } + async browserTabShow(params: { page: string; worktree?: string }): Promise { const target = await this.resolveBrowserCommandTarget(params) return { tab: this.describeBrowserTab(params.page, target.worktreeId) } diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts index ba20f682015..055d1c2ac48 100644 --- a/src/main/runtime/orca-runtime.test.ts +++ b/src/main/runtime/orca-runtime.test.ts @@ -1538,6 +1538,123 @@ describe('OrcaRuntimeService', () => { expect(capabilities).toContain('browser.screencast.v1') // ...and the headless marker tells clients not to fall back to a local tab. expect(capabilities).toContain('browser.headless.v1') + expect(capabilities).toContain('browser.certificate-trust.v1') + }) + + it('surfaces live offscreen load failures in headless browser snapshots', () => { + const runtime = createRuntime() + runtime.setOffscreenBrowserBackend({ createTab: vi.fn(), closeTab: vi.fn() }) + runtime.setAgentBrowserBridge({ + tabList: vi.fn(() => ({ + tabs: [ + { + browserPageId: 'page-certificate-error', + index: 0, + url: 'https://localhost:3443/', + title: 'Local HTTPS', + active: true, + loadError: { + code: -202, + description: 'ERR_CERT_AUTHORITY_INVALID', + validatedUrl: 'https://localhost:3443/' + }, + certificateFailure: { + challengeId: 'challenge-1', + browserPageId: 'page-certificate-error', + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 123 + } + } + ] + })) + } as never) + const browserTabs = runtime['buildHeadlessMobileSessionBrowserTabs'](TEST_WORKTREE_ID) + expect(browserTabs).toContainEqual( + expect.objectContaining({ + type: 'browser', + browserPageId: 'page-certificate-error', + loadError: { + code: -202, + description: 'ERR_CERT_AUTHORITY_INVALID', + validatedUrl: 'https://localhost:3443/' + }, + certificateFailure: { + challengeId: 'challenge-1', + browserPageId: 'page-certificate-error', + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 123 + } + }) + ) + }) + + it('detects headless browser-tab changes by field, treating absent and null loadError alike', () => { + const runtime = createRuntime() + const base = { + type: 'browser' as const, + id: 'page-1', + title: 'Local', + browserWorkspaceId: 'page-1', + browserPageId: 'page-1', + url: 'https://localhost:3443/', + loading: false, + canGoBack: false, + canGoForward: false, + isActive: true + } + const err = { + code: -202, + description: 'ERR_CERT_AUTHORITY_INVALID', + validatedUrl: 'https://localhost:3443/' + } + const certificateFailure = { + challengeId: 'challenge-1', + browserPageId: 'page-1', + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 123 + } + const unchanged = (a: unknown[], b: unknown[]): boolean => + runtime['headlessBrowserTabsUnchanged'](a as never, b as never) + + // Absent vs explicit null loadError are equivalent (the JSON.stringify trap). + expect(unchanged([{ ...base }], [{ ...base, loadError: null }])).toBe(true) + expect(unchanged([{ ...base, loadError: err }], [{ ...base, loadError: { ...err } }])).toBe( + true + ) + // A load-error-only change (identical ids/order) must not be missed. + expect(unchanged([{ ...base }], [{ ...base, loadError: err }])).toBe(false) + expect( + unchanged([{ ...base, loadError: err }], [{ ...base, loadError: { ...err, code: -200 } }]) + ).toBe(false) + expect( + unchanged( + [{ ...base, certificateFailure }], + [{ ...base, certificateFailure: { ...certificateFailure } }] + ) + ).toBe(true) + expect(unchanged([{ ...base }], [{ ...base, certificateFailure }])).toBe(false) + expect( + unchanged( + [{ ...base, certificateFailure }], + [{ ...base, certificateFailure: { ...certificateFailure, challengeId: 'challenge-2' } }] + ) + ).toBe(false) + // Scalar and length changes are detected. + expect(unchanged([{ ...base }], [{ ...base, title: 'Changed' }])).toBe(false) + expect(unchanged([{ ...base }], [{ ...base, isActive: false }])).toBe(false) + expect(unchanged([{ ...base }], [{ ...base }, { ...base, id: 'page-2' }])).toBe(false) }) it('does not advertise headless browser capability when a renderer window exists', () => { @@ -1547,6 +1664,16 @@ describe('OrcaRuntimeService', () => { runtime.setOffscreenBrowserBackend({ createTab: vi.fn(), closeTab: vi.fn() }) expect(runtime.getStatus().capabilities).not.toContain('browser.headless.v1') + // Desktop webviews still host certificate trust, so the proceed capability + // remains advertised for remote clients controlling those pages. + expect(runtime.getStatus().capabilities).toContain('browser.certificate-trust.v1') + }) + + it('does not advertise certificate trust when no browser backend is available', () => { + const runtime = createRuntime() + + expect(runtime.getStatus().capabilities).not.toContain('browser.certificate-trust.v1') + expect(runtime.getStatus().capabilities).not.toContain('browser.screencast.v1') }) it('closes a worktree’s offscreen browser pages when its metadata is removed (leak fix)', () => { diff --git a/src/main/runtime/orca-runtime.ts b/src/main/runtime/orca-runtime.ts index fdf3657e08e..6e1bce48a5a 100644 --- a/src/main/runtime/orca-runtime.ts +++ b/src/main/runtime/orca-runtime.ts @@ -264,6 +264,7 @@ import { } from '../../shared/worktree-ownership' import { BROWSER_HEADLESS_RUNTIME_CAPABILITY, + BROWSER_CERTIFICATE_TRUST_RUNTIME_CAPABILITY, MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION, RUNTIME_CAPABILITIES, RUNTIME_PROTOCOL_VERSION, @@ -3061,6 +3062,12 @@ export class OrcaRuntimeService { if (hasOffscreen) { capabilities.push(BROWSER_HEADLESS_RUNTIME_CAPABILITY) } + // Why: certificate proceed is owned by the browser-hosting process for both + // desktop webviews and offscreen pages. Advertise whenever either backend + // can host a page so remote clients can surface Proceed Anyway (Unsafe). + if (canBrowse) { + capabilities.push(BROWSER_CERTIFICATE_TRUST_RUNTIME_CAPABILITY) + } return { runtimeId: this.runtimeId, rendererGraphEpoch: this.rendererGraphEpoch, @@ -3430,13 +3437,16 @@ export class OrcaRuntimeService { allowAttachedWindow?: boolean onlyServeOwnedTerminals?: boolean } = {} - ): void { + ): Set { + // Why: report which worktrees were reconciled in place so callers don't + // reconcile them a second time (see notifyMobileSessionTabsChanged). + const reconciledWorktreeIds = new Set() if (this.getAvailableAuthoritativeWindow() && options.allowAttachedWindow !== true) { - return + return reconciledWorktreeIds } const session = this.store?.getWorkspaceSession?.() if (!session) { - return + return reconciledWorktreeIds } const entries = worktreeId !== undefined @@ -3455,6 +3465,7 @@ export class OrcaRuntimeService { // Reconcile just the browser tabs against the live bridge instead of // leaving a stale snapshot that omits a freshly-opened browser tab. this.reconcileHeadlessMobileSessionBrowserTabs(entryWorktreeId, existing) + reconciledWorktreeIds.add(entryWorktreeId) continue } const terminalTabs = this.buildHeadlessMobileSessionTerminalTabs( @@ -3554,6 +3565,7 @@ export class OrcaRuntimeService { tabs: mergedTabs }) } + return reconciledWorktreeIds } // Why: keep an existing snapshot's browser tabs in sync with the live bridge @@ -3568,13 +3580,11 @@ export class OrcaRuntimeService { } const liveBrowserTabs = this.buildHeadlessMobileSessionBrowserTabs(worktreeId) const liveIds = liveBrowserTabs.map((tab) => tab.id) - const existingBrowserIds = existing.tabs - .filter((tab): tab is RuntimeMobileSessionBrowserTab => tab.type === 'browser') - .map((tab) => tab.id) - const unchanged = - liveIds.length === existingBrowserIds.length && - liveIds.every((id, index) => existingBrowserIds[index] === id) - if (unchanged) { + const existingBrowserTabs = existing.tabs.filter( + (tab): tab is RuntimeMobileSessionBrowserTab => tab.type === 'browser' + ) + const existingBrowserIds = existingBrowserTabs.map((tab) => tab.id) + if (this.headlessBrowserTabsUnchanged(liveBrowserTabs, existingBrowserTabs)) { return } const nonBrowserTabs = existing.tabs.filter((tab) => tab.type !== 'browser') @@ -4051,6 +4061,8 @@ export class OrcaRuntimeService { loading: false, canGoBack: false, canGoForward: false, + loadError: tab.loadError ?? undefined, + certificateFailure: tab.certificateFailure ?? undefined, ...(persistedProps ? { color: persistedProps.color } : {}), ...(persistedProps ? { isPinned: persistedProps.isPinned === true } : {}), isActive: tab.active === true @@ -4058,6 +4070,75 @@ export class OrcaRuntimeService { }) } + // Why: change detection for headless browser tabs. Compares the fields that + // actually vary (a JSON.stringify equality was order-sensitive and silently + // dropped `undefined` keys, so it only worked while both sides shared one + // construction path). + private headlessBrowserTabsUnchanged( + live: RuntimeMobileSessionBrowserTab[], + existing: RuntimeMobileSessionBrowserTab[] + ): boolean { + if (live.length !== existing.length) { + return false + } + return live.every((tab, index) => { + const prev = existing[index] + return ( + tab.id === prev.id && + tab.title === prev.title && + tab.url === prev.url && + tab.isActive === prev.isActive && + (tab.isPinned ?? false) === (prev.isPinned ?? false) && + (tab.color ?? null) === (prev.color ?? null) && + this.browserLoadErrorsEqual(tab.loadError, prev.loadError) && + this.browserCertificateFailuresEqual(tab.certificateFailure, prev.certificateFailure) + ) + }) + } + + private browserLoadErrorsEqual( + a: RuntimeMobileSessionBrowserTab['loadError'], + b: RuntimeMobileSessionBrowserTab['loadError'] + ): boolean { + const left = a ?? null + const right = b ?? null + if (left === right) { + return true + } + if (!left || !right) { + return false + } + return ( + left.code === right.code && + left.description === right.description && + left.validatedUrl === right.validatedUrl + ) + } + + private browserCertificateFailuresEqual( + a: RuntimeMobileSessionBrowserTab['certificateFailure'], + b: RuntimeMobileSessionBrowserTab['certificateFailure'] + ): boolean { + const left = a ?? null + const right = b ?? null + if (left === right) { + return true + } + if (!left || !right) { + return false + } + return ( + left.challengeId === right.challengeId && + left.browserPageId === right.browserPageId && + left.errorCode === right.errorCode && + left.error === right.error && + left.origin === right.origin && + left.displayHost === right.displayHost && + left.canProceed === right.canProceed && + left.observedAt === right.observedAt + ) + } + private getPersistedUnifiedSessionTabProps( worktreeId: string, tabId: string @@ -21565,6 +21646,17 @@ export class OrcaRuntimeService { this.notifyMobileSessionTabSnapshots() return } + if (this.offscreenBrowserBackend) { + const reconciled = this.hydrateHeadlessMobileSessionTabsFromWorkspaceSession(worktreeId) + // Why: hydrate already reconciles an existing snapshot in place; only + // reconcile here when it didn't (fresh build or an early-returned hydrate). + if (!reconciled.has(worktreeId)) { + const existing = this.mobileSessionTabsByWorktree.get(worktreeId) + if (existing) { + this.reconcileHeadlessMobileSessionBrowserTabs(worktreeId, existing) + } + } + } // Why: structural changes (tab add/remove/activate) must propagate promptly, // so cancel any pending coalesced title/status notify — this immediate emit // already reflects the latest snapshot and supersedes it. @@ -25478,6 +25570,8 @@ export class OrcaRuntimeService { browserTabList: RuntimeBrowserCommands['browserTabList'] = this.browserCommands.browserTabList.bind(this.browserCommands) + browserProceedCertificate: RuntimeBrowserCommands['browserProceedCertificate'] = + this.browserCommands.browserProceedCertificate.bind(this.browserCommands) browserTabShow: RuntimeBrowserCommands['browserTabShow'] = this.browserCommands.browserTabShow.bind(this.browserCommands) diff --git a/src/main/runtime/rpc/methods/browser-core.ts b/src/main/runtime/rpc/methods/browser-core.ts index fc1b1277fce..41484d20768 100644 --- a/src/main/runtime/rpc/methods/browser-core.ts +++ b/src/main/runtime/rpc/methods/browser-core.ts @@ -1,5 +1,5 @@ import { defineMethod, type RpcMethod } from '../core' -import { BrowserTarget } from '../schemas' +import { BrowserTarget, requiredString } from '../schemas' import { Check, Drag, @@ -34,6 +34,10 @@ import { } from './browser-schemas' import { BROWSER_TEXT_METHODS } from './browser-text-rpc-methods' +const CertificateProceed = BrowserTarget.extend({ + challengeId: requiredString('Missing required challengeId') +}) + export const BROWSER_CORE_METHODS: RpcMethod[] = [ defineMethod({ name: 'browser.snapshot', @@ -50,6 +54,11 @@ export const BROWSER_CORE_METHODS: RpcMethod[] = [ params: Goto, handler: async (params, { runtime }) => runtime.browserGoto(params) }), + defineMethod({ + name: 'browser.certificate.proceed', + params: CertificateProceed, + handler: async (params, { runtime }) => runtime.browserProceedCertificate(params) + }), ...BROWSER_TEXT_METHODS, defineMethod({ name: 'browser.select', diff --git a/src/main/runtime/rpc/methods/browser-schemas.ts b/src/main/runtime/rpc/methods/browser-schemas.ts index 72a2893444e..9eff1456662 100644 --- a/src/main/runtime/rpc/methods/browser-schemas.ts +++ b/src/main/runtime/rpc/methods/browser-schemas.ts @@ -1,7 +1,5 @@ -// Why: the browser method surface area is large enough that keeping every -// schema in the same file as its handler registration pushes the file past -// the 300-line lint cap. Grouping all browser schemas here keeps each -// handler file focused on dispatch wiring. +// Why: browser schemas stay separate from handler registration so both sides +// remain under the line cap and dispatch wiring stays scannable. import { z } from 'zod' import { BrowserTarget, diff --git a/src/main/runtime/runtime-rpc.test.ts b/src/main/runtime/runtime-rpc.test.ts index 03c8225b44d..1b0a31dd2b0 100644 --- a/src/main/runtime/runtime-rpc.test.ts +++ b/src/main/runtime/runtime-rpc.test.ts @@ -1983,6 +1983,20 @@ describe('OrcaRuntimeRpcServer', () => { (response) => replies.push(JSON.parse(response) as Record), () => {} ) + await server['handleWebSocketMessage']( + JSON.stringify({ + id: 'req_browser_certificate_proceed', + method: 'browser.certificate.proceed', + deviceToken: mobile.token, + params: { + worktree: 'id:wt-1', + page: 'page-1', + challengeId: 'challenge-1' + } + }), + (response) => replies.push(JSON.parse(response) as Record), + () => {} + ) await server['handleWebSocketMessage']( JSON.stringify({ id: 'req_browser_dialog_accept', @@ -2123,6 +2137,13 @@ describe('OrcaRuntimeRpcServer', () => { expect(replies).toContainEqual( expect.objectContaining({ id: 'req_browser_viewport', ok: true }) ) + expect(replies).toContainEqual( + expect.objectContaining({ + id: 'req_browser_certificate_proceed', + ok: false, + error: expect.objectContaining({ code: 'forbidden' }) + }) + ) expect(replies).toContainEqual( expect.objectContaining({ id: 'req_browser_dialog_accept', ok: true }) ) diff --git a/src/preload/api-types.ts b/src/preload/api-types.ts index a3db4bbbc55..7c03b6f8879 100644 --- a/src/preload/api-types.ts +++ b/src/preload/api-types.ts @@ -67,6 +67,8 @@ import type { BaseRefDefaultResult, BaseRefSearchResult, BrowserCookieImportResult, + BrowserCertificateFailure, + BrowserCertificateProceedResult, BrowserLoadError, BrowserSessionProfile, BrowserSessionProfileScope, @@ -479,7 +481,7 @@ export type BrowserApi = { worktreeId: string sessionProfileId?: string | null webContentsId: number - }) => Promise + }) => Promise unregisterGuest: (args: { browserPageId: string }) => Promise openDevTools: (args: { browserPageId: string }) => Promise setViewportOverride: (args: { @@ -490,6 +492,13 @@ export type BrowserApi = { onGuestLoadFailed: ( callback: (args: { browserPageId: string; loadError: BrowserLoadError }) => void ) => () => void + onCertificateFailureChanged: ( + callback: (event: { browserPageId: string; failure: BrowserCertificateFailure | null }) => void + ) => () => void + proceedCertificate: (args: { + browserPageId: string + challengeId: string + }) => Promise onPermissionDenied: (callback: (event: BrowserPermissionDeniedEvent) => void) => () => void onPopup: (callback: (event: BrowserPopupEvent) => void) => () => void onDownloadRequested: (callback: (event: BrowserDownloadRequestedEvent) => void) => () => void diff --git a/src/preload/index.ts b/src/preload/index.ts index 4aa685d7b56..9f0a30529bd 100644 --- a/src/preload/index.ts +++ b/src/preload/index.ts @@ -2238,7 +2238,7 @@ const api = { worktreeId: string sessionProfileId?: string | null webContentsId: number - }): Promise => ipcRenderer.invoke('browser:registerGuest', args), + }): Promise => ipcRenderer.invoke('browser:registerGuest', args), unregisterGuest: (args: { browserPageId: string }): Promise => ipcRenderer.invoke('browser:unregisterGuest', args), @@ -2271,6 +2271,17 @@ const api = { return () => ipcRenderer.removeListener('browser:guest-load-failed', listener) }, + onCertificateFailureChanged: (callback): (() => void) => { + const listener = ( + _event: Electron.IpcRendererEvent, + data: Parameters[0] + ): void => callback(data) + ipcRenderer.on('browser:certificate-failure-changed', listener) + return () => ipcRenderer.removeListener('browser:certificate-failure-changed', listener) + }, + + proceedCertificate: (args) => ipcRenderer.invoke('browser:proceedCertificate', args), + onPermissionDenied: ( callback: (event: { browserPageId: string; permission: string; origin: string }) => void ): (() => void) => { diff --git a/src/renderer/src/components/browser-pane/BrowserPane.tsx b/src/renderer/src/components/browser-pane/BrowserPane.tsx index 20cde69e56f..50b4dc45852 100644 --- a/src/renderer/src/components/browser-pane/BrowserPane.tsx +++ b/src/renderer/src/components/browser-pane/BrowserPane.tsx @@ -63,6 +63,7 @@ import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner import { ORCA_BROWSER_BLANK_URL, ORCA_BROWSER_PARTITION } from '../../../../shared/constants' import { getOrcaProfileBrowserDefaultPartition } from '../../../../shared/orca-profiles' import type { + BrowserCertificateProceedResult, BrowserLoadError, BrowserPage as BrowserPageState, BrowserWorkspace as BrowserWorkspaceState @@ -70,7 +71,9 @@ import type { import { normalizeBrowserNavigationUrl, normalizeExternalBrowserUrl, - redactKagiSessionToken + redactKagiSessionToken, + resolveRemoteFailureExternalUrl, + toHttpsRecoveryUrl } from '../../../../shared/browser-url' import { keybindingMatchesAction } from '../../../../shared/keybindings' import { getScreenSubmitModifierLabel, isScreenSubmitShortcut } from '@/lib/screen-submit-shortcut' @@ -165,13 +168,7 @@ import { type BrowserScreencastFrameMetadata } from '../../../../shared/browser-screencast-protocol' import { withBrowserPaneUiRuntimeRpcSource } from '../../../../shared/runtime-rpc-feature-interaction-source' -import { - formatByteCount, - formatLoadFailureDescription, - formatLoadFailureRecoveryHint, - formatPermissionNotice, - formatPopupNotice -} from './browser-notices' +import { formatByteCount, formatPermissionNotice, formatPopupNotice } from './browser-notices' import { getDriverForBrowserPage, onBrowserDriverChange, @@ -186,6 +183,7 @@ import { useMarkupMode, type MarkupCaptureContext } from './markup/useMarkupMode import { MarkupOverlay } from './markup/MarkupOverlay' import { MarkupDrawButton } from './markup/MarkupDrawButton' import { deliverMarkupToClipboard } from './markup/markup-clipboard-delivery' +import { BrowserLoadFailureOverlay } from './browser-load-failure-overlay' type BrowserTabPageState = Partial< Pick< @@ -700,28 +698,6 @@ function getRemoteBrowserDeviceScaleFactor(): number { return Math.min(2, Math.max(1, Number(scale.toFixed(2)))) } -function getLoadErrorMetadata(loadError: BrowserLoadError | null): { - displayUrl: string - host: string | null - isLocalhostLike: boolean -} { - const rawUrl = loadError?.validatedUrl ?? 'about:blank' - const displayUrl = toDisplayUrl(rawUrl) - try { - const parsed = new URL(rawUrl) - const host = parsed.host || null - const hostname = parsed.hostname - const isLocalhostLike = - hostname === 'localhost' || - hostname === '127.0.0.1' || - hostname === '0.0.0.0' || - hostname === '::1' - return { displayUrl, host, isLocalhostLike } - } catch { - return { displayUrl, host: null, isLocalhostLike: false } - } -} - function getOpenableExternalUrl( webview: Electron.WebviewTag | null, fallbackUrl: string @@ -960,6 +936,12 @@ function RemoteBrowserPagePane({ (token: RemoteBrowserOperationToken) => Promise >(async () => null) const setRemoteBrowserPageHandle = useAppStore((s) => s.setRemoteBrowserPageHandle) + const certificateFailure = useAppStore( + (s) => s.browserCertificateFailuresByPageId[browserTab.id] ?? null + ) + const remotePageHandle = useAppStore( + (s) => s.remoteBrowserPageHandlesByPageId[browserTab.id] ?? null + ) const createBrowserTab = useAppStore((s) => s.createBrowserTab) const closeBrowserPage = useAppStore((s) => s.closeBrowserPage) const closeBrowserTab = useAppStore((s) => s.closeBrowserTab) @@ -1985,7 +1967,13 @@ function RemoteBrowserPagePane({ setRemoteError(message) onUpdatePageState(browserTab.id, { loading: false, - loadError: { code: 0, description: message, validatedUrl: url ?? browserTab.url } + // Why: validatedUrl crosses process/persistence boundaries, so redact a + // Kagi session token the same way the main-process failure path does. + loadError: { + code: 0, + description: message, + validatedUrl: redactKagiSessionToken(url ?? browserTab.url) + } }) } finally { if (isCurrentRemoteOperationToken(pageToken)) { @@ -2398,6 +2386,12 @@ function RemoteBrowserPagePane({ }, [frameUrl, handleRemoteScreenshotWheel]) const remoteFrameStyle = useMemo(() => getRemoteBrowserFrameStyle(frameMetadata), [frameMetadata]) + const remoteFailureUrl = browserTab.loadError?.validatedUrl ?? browserTab.url + const remoteFailureExternalUrl = resolveRemoteFailureExternalUrl(remoteFailureUrl) + const showRemoteFailureOverlay = + Boolean(browserTab.loadError) && + remoteFailureUrl !== 'about:blank' && + remoteFailureUrl !== ORCA_BROWSER_BLANK_URL // Why: markup works on remote panes by snapshotting the already-displayed // screencast — no in-page injection needed, so it is enabled here even @@ -2692,6 +2686,44 @@ function RemoteBrowserPagePane({ )} + {showRemoteFailureOverlay && browserTab.loadError ? ( + void runRemoteNavigation('browser.reload')} + onTryHttps={(url) => void runRemoteNavigation('browser.goto', url)} + onCopy={(url) => void window.api.ui.writeClipboardText(url)} + onOpenExternal={(url) => void window.api.shell.openUrl(url)} + certificateFailure={certificateFailure} + expectedBrowserPageId={ + remotePageHandle?.environmentId === activeRuntimeEnvironmentId + ? remotePageHandle.remotePageId + : null + } + onProceedCertificate={async (challengeId) => { + const target = runtimeTarget() + if ( + !target || + remotePageHandle?.environmentId !== target.environmentId || + remotePageHandle.remotePageId !== certificateFailure?.browserPageId + ) { + return { ok: false, reason: 'missing' } + } + return callRuntimeRpc( + target, + 'browser.certificate.proceed', + { + worktree: runtimeWorktree, + page: remotePageHandle.remotePageId, + challengeId + }, + { timeoutMs: 15_000, suppressFeatureInteraction: true } + ) + }} + /> + ) : null} {remoteError ? (
{remoteError} @@ -2879,6 +2911,9 @@ function BrowserPagePane({ const browserAnnotations = useAppStore( (s) => s.browserAnnotationsByPageId[browserTab.id] ?? EMPTY_BROWSER_ANNOTATIONS ) + const certificateFailure = useAppStore( + (s) => s.browserCertificateFailuresByPageId[browserTab.id] ?? null + ) const activeGroupId = useAppStore((s) => s.activeGroupIdByWorktree[worktreeId]) const browserAnnotationsRef = useRef(browserAnnotations) browserAnnotationsRef.current = browserAnnotations @@ -3731,21 +3766,53 @@ function BrowserPagePane({ dismissAddressBarSuggestionsRef.current?.() } - const handleDomReady = (): void => { + let registrationInFlight: { webContentsId: number; promise: Promise } | null = null + const registerGuest = (): Promise => { const webContentsId = webview.getWebContentsId() - let queuedAnnotationViewportBridgeSync = false - if (registeredWebContentsIds.get(browserTab.id) !== webContentsId) { - registeredWebContentsIds.set(browserTab.id, webContentsId) - queuedAnnotationViewportBridgeSync = true - void window.api.browser - .registerGuest({ - browserPageId: browserTab.id, - workspaceId, - worktreeId, - sessionProfileId, - webContentsId - }) - .finally(() => syncBrowserAnnotationViewportBridge()) + if (registeredWebContentsIds.get(browserTab.id) === webContentsId) { + return Promise.resolve(true) + } + if (registrationInFlight?.webContentsId === webContentsId) { + return registrationInFlight.promise + } + const promise = window.api.browser + .registerGuest({ + browserPageId: browserTab.id, + workspaceId, + worktreeId, + sessionProfileId, + webContentsId + }) + .then((registered) => { + if (registered) { + registeredWebContentsIds.set(browserTab.id, webContentsId) + } + return registered + }) + // Why: normalize IPC rejection to false so the dom-ready fallback can + // retry attach-policy races without an unhandled promise rejection. + .catch(() => false) + .finally(() => { + if (registrationInFlight?.promise === promise) { + registrationInFlight = null + } + }) + registrationInFlight = { webContentsId, promise } + return promise + } + + const handleDidAttach = (): void => { + // Why: certificate failures can happen before dom-ready. Register at + // attach so main can map the initial failure to this page; dom-ready below + // remains an idempotent fallback for attach-policy races. + void registerGuest().finally(() => syncBrowserAnnotationViewportBridge()) + } + + const handleDomReady = (): void => { + const queuedAnnotationViewportBridgeSync = + registeredWebContentsIds.get(browserTab.id) !== webview.getWebContentsId() + if (queuedAnnotationViewportBridgeSync) { + void registerGuest().finally(() => syncBrowserAnnotationViewportBridge()) } syncNavigationState(webview) if (keepAddressBarFocusRef.current) { @@ -3964,6 +4031,7 @@ function BrowserPagePane({ } } + webview.addEventListener('did-attach', handleDidAttach) webview.addEventListener('dom-ready', handleDomReady) webview.addEventListener('focus', dismissAddressBarSuggestions) webview.addEventListener('did-start-loading', handleDidStartLoading) @@ -3997,6 +4065,7 @@ function BrowserPagePane({ } return () => { + webview.removeEventListener('did-attach', handleDidAttach) webview.removeEventListener('dom-ready', handleDomReady) webview.removeEventListener('focus', dismissAddressBarSuggestions) webview.removeEventListener('did-start-loading', handleDidStartLoading) @@ -4672,8 +4741,8 @@ function BrowserPagePane({ const isBlankTab = browserTab.url === 'about:blank' || browserTab.url === ORCA_BROWSER_BLANK_URL const externalUrl = getOpenableExternalUrl(webviewRef.current, browserTab.url) const currentBrowserUrl = getCurrentBrowserUrl(webviewRef.current, browserTab.url) - const loadErrorMeta = getLoadErrorMetadata(browserTab.loadError) - const loadErrorHint = formatLoadFailureRecoveryHint(loadErrorMeta) + const failedNavigationUrl = browserTab.loadError?.validatedUrl ?? currentBrowserUrl + const failureExternalUrl = normalizeExternalBrowserUrl(failedNavigationUrl) const showFailureOverlay = Boolean(browserTab.loadError) && !isBlankTab const visibleDownloads = (() => { const active = downloadStates.filter((download) => download.status === 'downloading') @@ -5476,114 +5545,40 @@ function BrowserPagePane({ onClose={() => setFindOpen(false)} webviewRef={webviewRef} /> - {showFailureOverlay ? ( -
-
-
- -
-

- {loadErrorMeta.host - ? translate( - 'auto.components.browser.pane.BrowserPane.db325a7eeb', - "Can't reach {{value0}}", - { value0: loadErrorMeta.host } - ) - : translate( - 'auto.components.browser.pane.BrowserPane.b2856516e2', - "Can't load this page" - )} -

-

- {formatLoadFailureDescription(browserTab.loadError, loadErrorMeta)} -

- {loadErrorHint ? ( -

{loadErrorHint}

- ) : null} -
- - - {externalUrl ? ( - - ) : null} -
-
-
+ {showFailureOverlay && browserTab.loadError ? ( + { + const webview = webviewRef.current + if (!webview) { + return + } + onUpdatePageStateRef.current(browserTab.id, { loading: true }) + retryBrowserTabLoad(webview, browserTab, onUpdatePageStateRef.current) + }} + onTryHttps={navigateToUrl} + onCopy={(url) => { + void window.api.ui.writeClipboardText(url) + setResourceNotice( + translate( + 'browser.loadFailure.addressCopied', + 'Copied the current page address.' + ) + ) + }} + onOpenExternal={(url) => void window.api.shell.openUrl(url)} + certificateFailure={certificateFailure} + expectedBrowserPageId={browserTab.id} + onProceedCertificate={(challengeId) => + window.api.browser.proceedCertificate({ + browserPageId: browserTab.id, + challengeId + }) + } + /> ) : null} {isBlankTab ? (
diff --git a/src/renderer/src/components/browser-pane/browser-load-failure-overlay.test.tsx b/src/renderer/src/components/browser-pane/browser-load-failure-overlay.test.tsx new file mode 100644 index 00000000000..d49e8ccdc9f --- /dev/null +++ b/src/renderer/src/components/browser-pane/browser-load-failure-overlay.test.tsx @@ -0,0 +1,319 @@ +// @vitest-environment happy-dom +import '@testing-library/jest-dom/vitest' +import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react' +import { afterEach, describe, expect, it, vi } from 'vitest' + +import { BrowserLoadFailureOverlay } from './browser-load-failure-overlay' + +const callbacks = { + onRetry: vi.fn(), + onTryHttps: vi.fn(), + onCopy: vi.fn(), + onOpenExternal: vi.fn(), + onProceedCertificate: vi.fn() +} + +const certificateFailure = { + challengeId: 'challenge-1', + browserPageId: 'page-1', + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 123 +} + +afterEach(() => { + cleanup() + vi.useRealTimers() + vi.clearAllMocks() +}) + +describe('BrowserLoadFailureOverlay', () => { + it('uses certificate-specific copy while keeping strict verification', () => { + render( + + ) + + expect(screen.getByText("Connection isn't secure")).toBeInTheDocument() + expect( + screen.getByText( + "Orca doesn't trust the authority that issued the certificate for localhost:3443." + ) + ).toBeInTheDocument() + expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull() + expect(screen.queryByText(/make sure the server is running/i)).not.toBeInTheDocument() + }) + + it('keeps restored certificate errors accurate without allowing approval', () => { + render( + + ) + + expect(screen.getByText("The certificate doesn't match localhost:3443.")).toBeInTheDocument() + expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull() + expect(screen.getByRole('button', { name: 'Retry' })).toBeEnabled() + expect(screen.getByRole('button', { name: 'Copy Address' })).toBeEnabled() + }) + + it('offers HTTPS recovery only for an eligible failed HTTP address', () => { + const { rerender } = render( + + ) + + fireEvent.click(screen.getByRole('button', { name: 'Try HTTPS' })) + expect(callbacks.onTryHttps).toHaveBeenCalledWith('https://localhost:3000/app') + + rerender( + + ) + expect(screen.queryByRole('button', { name: 'Try HTTPS' })).toBeNull() + }) + + it('hides Open Externally and works without an external handler', () => { + render( + + ) + + // externalUrl / onOpenExternal omitted (e.g. a remote loopback failure): + // the action is absent and the overlay still renders its other recovery UI. + expect(screen.queryByRole('button', { name: 'Open Externally' })).toBeNull() + expect(screen.getByRole('button', { name: 'Retry' })).toBeEnabled() + expect(screen.getByRole('button', { name: 'Copy Address' })).toBeEnabled() + }) + + it('does not show local-certificate guidance for a public-host failure', () => { + render( + + ) + + expect(screen.queryByText(/use a trusted local certificate/i)).not.toBeInTheDocument() + }) + + it('offers approval only for a matching live challenge', () => { + const { rerender } = render( + + ) + + expect(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeEnabled() + + rerender( + + ) + expect(screen.getByText("Connection isn't secure")).toBeInTheDocument() + expect(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeEnabled() + + rerender( + + ) + expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull() + + rerender( + + ) + expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull() + }) + + it('disables every action immediately and delays connecting feedback', async () => { + vi.useFakeTimers() + let resolveProceed: ((result: { ok: true }) => void) | null = null + callbacks.onProceedCertificate.mockReturnValue( + new Promise((resolve) => { + resolveProceed = resolve + }) + ) + const { rerender } = render( + + ) + + fireEvent.click(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })) + expect(callbacks.onProceedCertificate).toHaveBeenCalledWith('challenge-1') + for (const name of ['Proceed Anyway (Unsafe)', 'Open Externally', 'Retry', 'Copy Address']) { + expect(screen.getByRole('button', { name })).toBeDisabled() + } + expect(screen.queryByText('Connecting…')).toBeNull() + + act(() => vi.advanceTimersByTime(199)) + expect(screen.queryByText('Connecting…')).toBeNull() + act(() => vi.advanceTimersByTime(1)) + expect(screen.getByRole('button', { name: 'Connecting…' })).toBeDisabled() + + await act(async () => resolveProceed?.({ ok: true })) + rerender( + + ) + expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull() + expect(screen.getByRole('button', { name: 'Retry' })).toBeEnabled() + }) + + it('recovers from typed approval failures and resets for a new challenge', async () => { + callbacks.onProceedCertificate.mockResolvedValue({ ok: false, reason: 'expired' }) + const props = { + loadError: { + code: -202, + description: 'ERR_CERT_AUTHORITY_INVALID', + validatedUrl: 'https://localhost:3443/app' + }, + externalUrl: null, + currentUrl: 'https://localhost:3443/app', + httpsRecoveryUrl: null, + expectedBrowserPageId: 'page-1', + ...callbacks + } + const { rerender } = render( + + ) + + fireEvent.click(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })) + await waitFor(() => + expect(screen.getByRole('alert')).toHaveTextContent(/certificate approval expired/i) + ) + expect(screen.getByRole('button', { name: 'Retry' })).toBeEnabled() + + callbacks.onProceedCertificate.mockReturnValue(new Promise(() => {})) + fireEvent.click(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })) + expect(screen.getByRole('button', { name: 'Retry' })).toBeDisabled() + rerender( + + ) + expect(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeEnabled() + expect(screen.queryByRole('alert')).toBeNull() + }) +}) diff --git a/src/renderer/src/components/browser-pane/browser-load-failure-overlay.tsx b/src/renderer/src/components/browser-pane/browser-load-failure-overlay.tsx new file mode 100644 index 00000000000..06fa7249108 --- /dev/null +++ b/src/renderer/src/components/browser-pane/browser-load-failure-overlay.tsx @@ -0,0 +1,340 @@ +import { useEffect, useRef, useState } from 'react' +import { Copy, ExternalLink, Globe, Loader2, RefreshCw, ShieldAlert } from 'lucide-react' + +import { Button } from '@/components/ui/button' +import { translate } from '@/i18n/i18n' +import type { + BrowserCertificateFailure, + BrowserCertificateProceedFailureReason, + BrowserCertificateProceedResult, + BrowserLoadError +} from '../../../../shared/types' +import { isEligibleLocalCertificateHost } from '../../../../shared/browser-url' +import { + formatLoadFailureDescription, + formatLoadFailureRecoveryHint, + isCertificateLoadError, + type LoadFailureMeta +} from './browser-notices' + +type BrowserLoadFailureOverlayProps = { + loadError: BrowserLoadError + externalUrl?: string | null + currentUrl: string + httpsRecoveryUrl: string | null + onRetry: () => void + onTryHttps: (url: string) => void + onCopy: (url: string) => void + onOpenExternal?: (url: string) => void + certificateFailure?: BrowserCertificateFailure | null + expectedBrowserPageId?: string | null + onProceedCertificate?: (challengeId: string) => Promise +} + +type CertificateProceedAttempt = { + challengeId: string + state: 'submitting' | 'failed' + showConnecting: boolean + reason?: BrowserCertificateProceedFailureReason | 'request-failed' +} + +function getLoadErrorMetadata(loadError: BrowserLoadError): LoadFailureMeta { + try { + const parsed = new URL(loadError.validatedUrl) + return { + host: parsed.host || null, + isLocalhostLike: + parsed.hostname === '0.0.0.0' || isEligibleLocalCertificateHost(parsed.hostname) + } + } catch { + return { host: null, isLocalhostLike: false } + } +} + +function normalizeCertificateError(error: string): string { + return error + .trim() + .replace(/^net::/i, '') + .toUpperCase() +} + +function getMatchingCertificateFailure(args: { + loadError: BrowserLoadError + certificateFailure?: BrowserCertificateFailure | null + expectedBrowserPageId?: string | null + canProceed: boolean +}): BrowserCertificateFailure | null { + const { loadError, certificateFailure, expectedBrowserPageId, canProceed } = args + const errorMatchesChallenge = Boolean( + certificateFailure && + (loadError.code === -1 || + (loadError.code === certificateFailure.errorCode && + normalizeCertificateError(certificateFailure.error) === + normalizeCertificateError(loadError.description))) + ) + if ( + !canProceed || + !certificateFailure?.canProceed || + !expectedBrowserPageId || + certificateFailure.browserPageId !== expectedBrowserPageId || + certificateFailure.errorCode !== -202 || + !errorMatchesChallenge + ) { + return null + } + try { + return new URL(loadError.validatedUrl).origin === certificateFailure.origin + ? certificateFailure + : null + } catch { + return null + } +} + +function formatCertificateProceedFailure( + reason: BrowserCertificateProceedFailureReason | 'request-failed' +): string { + if (reason === 'expired') { + return translate( + 'browser.loadFailure.certificateChallengeExpired', + 'This certificate approval expired. Retry the page to request a new one.' + ) + } + if (reason === 'changed' || reason === 'navigated') { + return translate( + 'browser.loadFailure.certificateChallengeChanged', + 'The certificate request changed. Retry the page and review the new warning.' + ) + } + if (reason === 'request-failed') { + return translate( + 'browser.loadFailure.certificateProceedFailed', + 'Orca could not approve this certificate request. Retry the page and try again.' + ) + } + return translate( + 'browser.loadFailure.certificateChallengeUnavailable', + 'This certificate request is no longer available. Retry the page to request a new one.' + ) +} + +export function BrowserLoadFailureOverlay({ + loadError, + externalUrl, + currentUrl, + httpsRecoveryUrl, + onRetry, + onTryHttps, + onCopy, + onOpenExternal, + certificateFailure, + expectedBrowserPageId, + onProceedCertificate +}: BrowserLoadFailureOverlayProps): React.JSX.Element { + const connectingTimerRef = useRef<{ + challengeId: string + timer: ReturnType + } | null>(null) + const [proceedAttempt, setProceedAttempt] = useState(null) + const matchingCertificateFailure = getMatchingCertificateFailure({ + loadError, + certificateFailure, + expectedBrowserPageId, + canProceed: Boolean(onProceedCertificate) + }) + // Why: Chromium's error-page fallback can replace the diagnostic code with + // -1 after main has already captured an exact live certificate challenge. + const presentationLoadError = + matchingCertificateFailure && loadError.code === -1 + ? { + ...loadError, + code: matchingCertificateFailure.errorCode ?? loadError.code, + description: matchingCertificateFailure.error + } + : loadError + const meta = getLoadErrorMetadata(presentationLoadError) + const certificateError = isCertificateLoadError(presentationLoadError) + const recoveryHint = formatLoadFailureRecoveryHint(meta, presentationLoadError) + const activeProceedAttempt = + proceedAttempt?.challengeId === matchingCertificateFailure?.challengeId ? proceedAttempt : null + const actionsDisabled = activeProceedAttempt?.state === 'submitting' + + useEffect(() => { + return () => { + if (connectingTimerRef.current) { + clearTimeout(connectingTimerRef.current.timer) + connectingTimerRef.current = null + } + } + }, [matchingCertificateFailure?.challengeId]) + + const proceedCertificate = (): void => { + if (!matchingCertificateFailure || !onProceedCertificate || actionsDisabled) { + return + } + const challengeId = matchingCertificateFailure.challengeId + setProceedAttempt({ challengeId, state: 'submitting', showConnecting: false }) + connectingTimerRef.current = { + challengeId, + timer: setTimeout(() => { + setProceedAttempt((current) => + current?.challengeId === challengeId && current.state === 'submitting' + ? { ...current, showConnecting: true } + : current + ) + }, 200) + } + void onProceedCertificate(challengeId) + .then((result) => { + if (connectingTimerRef.current?.challengeId === challengeId) { + clearTimeout(connectingTimerRef.current.timer) + connectingTimerRef.current = null + } + if (!result.ok) { + setProceedAttempt((current) => + current?.challengeId === challengeId + ? { + challengeId, + state: 'failed', + showConnecting: false, + reason: result.reason + } + : current + ) + } + }) + .catch(() => { + if (connectingTimerRef.current?.challengeId === challengeId) { + clearTimeout(connectingTimerRef.current.timer) + connectingTimerRef.current = null + } + setProceedAttempt((current) => + current?.challengeId === challengeId + ? { + challengeId, + state: 'failed', + showConnecting: false, + reason: 'request-failed' + } + : current + ) + }) + } + const retryButton = ( + + ) + const copyButton = ( + + ) + const externalButton = + externalUrl && onOpenExternal ? ( + + ) : null + + return ( +
+
+
+ {certificateError ? : } +
+

+ {certificateError + ? translate('browser.loadFailure.connectionNotSecure', "Connection isn't secure") + : meta.host + ? translate('browser.loadFailure.cantReachHost', "Can't reach {{value0}}", { + value0: meta.host + }) + : translate('browser.loadFailure.cantLoadPage', "Can't load this page")} +

+

+ {formatLoadFailureDescription(presentationLoadError, meta)} +

+ {certificateError && meta.isLocalhostLike ? ( +

+ {translate( + 'browser.loadFailure.trustedCertificateGuidance', + 'For local development, use a trusted local certificate when possible.' + )} +

+ ) : null} + {recoveryHint ?

{recoveryHint}

: null} + {activeProceedAttempt?.state === 'failed' && activeProceedAttempt.reason ? ( +

+ {formatCertificateProceedFailure(activeProceedAttempt.reason)} +

+ ) : null} +
+ {certificateError ? ( + <> + {externalButton} + {retryButton} + {copyButton} + {matchingCertificateFailure ? ( + + ) : null} + + ) : ( + <> + {httpsRecoveryUrl ? ( + + ) : null} + {retryButton} + {copyButton} + {externalButton} + + )} +
+
+
+ ) +} diff --git a/src/renderer/src/components/browser-pane/browser-notices.test.ts b/src/renderer/src/components/browser-pane/browser-notices.test.ts index b08bca7ba3c..24f31d3866a 100644 --- a/src/renderer/src/components/browser-pane/browser-notices.test.ts +++ b/src/renderer/src/components/browser-pane/browser-notices.test.ts @@ -5,7 +5,8 @@ import { formatLoadFailureDescription, formatLoadFailureRecoveryHint, formatPermissionNotice, - formatPopupNotice + formatPopupNotice, + isCertificateLoadError } from './browser-notices' describe('browser notice formatting', () => { @@ -114,4 +115,29 @@ describe('browser notice formatting', () => { }) ).toBeNull() }) + + it('formats certificate failures without local-server recovery advice', () => { + const meta = { host: 'localhost:3443', isLocalhostLike: true } + const loadError = (code: number) => ({ + code, + description: 'certificate error', + validatedUrl: 'https://localhost:3443/' + }) + + expect(formatLoadFailureDescription(loadError(-200), meta)).toBe( + "The certificate doesn't match localhost:3443." + ) + expect(formatLoadFailureDescription(loadError(-201), meta)).toBe( + "The certificate for localhost:3443 isn't valid at the current date and time." + ) + expect(formatLoadFailureDescription(loadError(-202), meta)).toBe( + "Orca doesn't trust the authority that issued the certificate for localhost:3443." + ) + expect(formatLoadFailureDescription(loadError(-208), meta)).toBe( + "Orca couldn't verify the certificate for localhost:3443." + ) + expect(isCertificateLoadError(loadError(-219))).toBe(true) + expect(isCertificateLoadError(loadError(-215))).toBe(false) + expect(formatLoadFailureRecoveryHint(meta, loadError(-202))).toBeNull() + }) }) diff --git a/src/renderer/src/components/browser-pane/browser-notices.ts b/src/renderer/src/components/browser-pane/browser-notices.ts index 81e31c8d81b..8c7b22800e0 100644 --- a/src/renderer/src/components/browser-pane/browser-notices.ts +++ b/src/renderer/src/components/browser-pane/browser-notices.ts @@ -4,8 +4,10 @@ import type { BrowserPopupEvent } from '../../../../shared/browser-guest-events' import type { BrowserLoadError } from '../../../../shared/types' +import { isChromiumCertificateErrorCode } from '../../../../shared/browser-certificate-errors' +import { translate } from '@/i18n/i18n' -type LoadFailureMeta = { +export type LoadFailureMeta = { host: string | null isLocalhostLike: boolean } @@ -73,6 +75,35 @@ export function formatLoadFailureDescription( if (!loadError) { return 'The page did not respond.' } + if (isChromiumCertificateErrorCode(loadError.code)) { + const host = meta.host ?? 'this address' + if (loadError.code === -200) { + return translate( + 'browser.loadFailure.certificateNameMismatch', + "The certificate doesn't match {{value0}}.", + { value0: host } + ) + } + if (loadError.code === -201) { + return translate( + 'browser.loadFailure.certificateDateInvalid', + "The certificate for {{value0}} isn't valid at the current date and time.", + { value0: host } + ) + } + if (loadError.code === -202) { + return translate( + 'browser.loadFailure.certificateAuthorityInvalid', + "Orca doesn't trust the authority that issued the certificate for {{value0}}.", + { value0: host } + ) + } + return translate( + 'browser.loadFailure.certificateVerificationFailed', + "Orca couldn't verify the certificate for {{value0}}.", + { value0: host } + ) + } if (meta.isLocalhostLike) { return "We couldn't connect to your local server." } @@ -82,9 +113,16 @@ export function formatLoadFailureDescription( return "We couldn't connect to this page." } -export function formatLoadFailureRecoveryHint(meta: LoadFailureMeta): string | null { - if (!meta.isLocalhostLike) { +export function formatLoadFailureRecoveryHint( + meta: LoadFailureMeta, + loadError?: BrowserLoadErrorLike +): string | null { + if (!meta.isLocalhostLike || (loadError && isChromiumCertificateErrorCode(loadError.code))) { return null } return 'If this should be a local app, make sure the server is running and listening on the expected port.' } + +export function isCertificateLoadError(loadError: BrowserLoadErrorLike): boolean { + return Boolean(loadError && isChromiumCertificateErrorCode(loadError.code)) +} diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts index 3dae3be6826..f46d958aee0 100644 --- a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts +++ b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts @@ -50,6 +50,15 @@ describe('tab create entry classification', () => { }) }) + it('keeps the shared legacy local-dev forms in parity with address-bar normalization', () => { + for (const input of ['0.0.0.0:3000', '[::1]:3000', '[2001:db8::1]:3000/path']) { + expect(classifyTabEntryQuery(input, readyFiles([]))).toMatchObject({ + kind: 'host-url', + url: expect.stringMatching(/^http:/) + }) + } + }) + it('does not classify invalid numeric hosts as URLs', () => { expect(classifyTabEntryQuery('999.999.999.999', readyFiles([]))).toEqual({ kind: 'new-file', diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts b/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts index 2f1ddfeccb4..375e5d71764 100644 --- a/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts +++ b/src/renderer/src/components/tab-bar/tab-create-entry-url-classification.ts @@ -1,4 +1,5 @@ import { translate } from '@/i18n/i18n' +import { classifySchemeLessLocalDevAddress } from '../../../../shared/browser-url' const HOST_FILE_EXTENSIONS = new Set([ 'css', @@ -15,9 +16,6 @@ const HOST_FILE_EXTENSIONS = new Set([ 'yml' ]) -const LOCAL_ADDRESS_PATTERN = - /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[[0-9a-f:]+\])(?::\d+)?(?:[/?#].*)?$/i - const LOCALHOST_WITH_PORT_PATTERN = /^localhost(?::\d{1,5})?$/i const IPV4_WITH_PORT_PATTERN = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?::\d{1,5})?$/ @@ -33,7 +31,7 @@ export type HostUrlClassification = { kind: 'host-url'; url: string } export function classifyExplicitUrl(query: string): ExplicitUrlClassification | null { // Local dev inputs are handled by host-url classification so users can // enter localhost/IP addresses without an explicit scheme. - if (LOCAL_ADDRESS_PATTERN.test(query)) { + if (classifySchemeLessLocalDevAddress(query)) { return null } let url: URL @@ -55,15 +53,8 @@ export function classifyExplicitUrl(query: string): ExplicitUrlClassification | } function classifyLocalDevUrl(query: string): HostUrlClassification | null { - if (!LOCAL_ADDRESS_PATTERN.test(query)) { - return null - } - try { - const url = new URL(`http://${query}`) - return url.hostname ? { kind: 'host-url', url: url.href } : null - } catch { - return null - } + const url = classifySchemeLessLocalDevAddress(query) + return url?.hostname ? { kind: 'host-url', url: url.href } : null } function classifyHostLikeUrl(query: string): HostUrlClassification | null { diff --git a/src/renderer/src/hooks/useIpcEvents.ts b/src/renderer/src/hooks/useIpcEvents.ts index 838cf50720e..2a0fe660165 100644 --- a/src/renderer/src/hooks/useIpcEvents.ts +++ b/src/renderer/src/hooks/useIpcEvents.ts @@ -2108,6 +2108,18 @@ export function useIpcEvents(): void { }) ) + const unsubscribeCertificateFailure = window.api.browser.onCertificateFailureChanged?.( + ({ browserPageId, failure }) => { + if (isRuntimeEnvironmentActive()) { + return + } + useAppStore.getState().setBrowserPageCertificateFailure(browserPageId, failure) + } + ) + if (unsubscribeCertificateFailure) { + unsubs.push(unsubscribeCertificateFailure) + } + // Why: agent-browser drives navigation via CDP, bypassing Electron's webview // event system. The renderer's did-navigate listener never fires for those // navigations, so the Zustand store (address bar, tab title) stays stale. diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json index 45f8b3fb8bc..38d542e76be 100644 --- a/src/renderer/src/i18n/locales/en.json +++ b/src/renderer/src/i18n/locales/en.json @@ -7,6 +7,29 @@ "webDescription": "Retry the web client or reconnect to the paired runtime." } }, + "browser": { + "loadFailure": { + "connectionNotSecure": "Connection isn't secure", + "cantReachHost": "Can't reach {{value0}}", + "cantLoadPage": "Can't load this page", + "certificateNameMismatch": "The certificate doesn't match {{value0}}.", + "certificateDateInvalid": "The certificate for {{value0}} isn't valid at the current date and time.", + "certificateAuthorityInvalid": "Orca doesn't trust the authority that issued the certificate for {{value0}}.", + "certificateVerificationFailed": "Orca couldn't verify the certificate for {{value0}}.", + "trustedCertificateGuidance": "For local development, use a trusted local certificate when possible.", + "retry": "Retry", + "copyAddress": "Copy Address", + "addressCopied": "Copied the current page address.", + "openExternally": "Open Externally", + "tryHttps": "Try HTTPS", + "proceedUnsafe": "Proceed Anyway (Unsafe)", + "connecting": "Connecting…", + "certificateChallengeExpired": "This certificate approval expired. Retry the page to request a new one.", + "certificateChallengeChanged": "The certificate request changed. Retry the page and review the new warning.", + "certificateChallengeUnavailable": "This certificate request is no longer available. Retry the page to request a new one.", + "certificateProceedFailed": "Orca could not approve this certificate request. Retry the page and try again." + } + }, "settings": { "appearance": { "language": { diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json index 48b2a4b5284..d8d0681e113 100644 --- a/src/renderer/src/i18n/locales/es.json +++ b/src/renderer/src/i18n/locales/es.json @@ -13284,5 +13284,28 @@ } } } + }, + "browser": { + "loadFailure": { + "connectionNotSecure": "Connection isn't secure", + "cantReachHost": "Can't reach {{value0}}", + "cantLoadPage": "Can't load this page", + "certificateNameMismatch": "The certificate doesn't match {{value0}}.", + "certificateDateInvalid": "The certificate for {{value0}} isn't valid at the current date and time.", + "certificateAuthorityInvalid": "Orca doesn't trust the authority that issued the certificate for {{value0}}.", + "certificateVerificationFailed": "Orca couldn't verify the certificate for {{value0}}.", + "trustedCertificateGuidance": "For local development, use a trusted local certificate when possible.", + "retry": "Retry", + "copyAddress": "Copy Address", + "addressCopied": "Copied the current page address.", + "openExternally": "Open Externally", + "tryHttps": "Try HTTPS", + "proceedUnsafe": "Proceed Anyway (Unsafe)", + "connecting": "Connecting…", + "certificateChallengeExpired": "This certificate approval expired. Retry the page to request a new one.", + "certificateChallengeChanged": "The certificate request changed. Retry the page and review the new warning.", + "certificateChallengeUnavailable": "This certificate request is no longer available. Retry the page to request a new one.", + "certificateProceedFailed": "Orca could not approve this certificate request. Retry the page and try again." + } } } diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json index 538b1ef1b61..8b38bf6102e 100644 --- a/src/renderer/src/i18n/locales/ja.json +++ b/src/renderer/src/i18n/locales/ja.json @@ -13284,5 +13284,28 @@ } } } + }, + "browser": { + "loadFailure": { + "connectionNotSecure": "Connection isn't secure", + "cantReachHost": "Can't reach {{value0}}", + "cantLoadPage": "Can't load this page", + "certificateNameMismatch": "The certificate doesn't match {{value0}}.", + "certificateDateInvalid": "The certificate for {{value0}} isn't valid at the current date and time.", + "certificateAuthorityInvalid": "Orca doesn't trust the authority that issued the certificate for {{value0}}.", + "certificateVerificationFailed": "Orca couldn't verify the certificate for {{value0}}.", + "trustedCertificateGuidance": "For local development, use a trusted local certificate when possible.", + "retry": "Retry", + "copyAddress": "Copy Address", + "addressCopied": "Copied the current page address.", + "openExternally": "Open Externally", + "tryHttps": "Try HTTPS", + "proceedUnsafe": "Proceed Anyway (Unsafe)", + "connecting": "Connecting…", + "certificateChallengeExpired": "This certificate approval expired. Retry the page to request a new one.", + "certificateChallengeChanged": "The certificate request changed. Retry the page and review the new warning.", + "certificateChallengeUnavailable": "This certificate request is no longer available. Retry the page to request a new one.", + "certificateProceedFailed": "Orca could not approve this certificate request. Retry the page and try again." + } } } diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json index ccb2d833551..90745d32358 100644 --- a/src/renderer/src/i18n/locales/ko.json +++ b/src/renderer/src/i18n/locales/ko.json @@ -13284,5 +13284,28 @@ } } } + }, + "browser": { + "loadFailure": { + "connectionNotSecure": "Connection isn't secure", + "cantReachHost": "Can't reach {{value0}}", + "cantLoadPage": "Can't load this page", + "certificateNameMismatch": "The certificate doesn't match {{value0}}.", + "certificateDateInvalid": "The certificate for {{value0}} isn't valid at the current date and time.", + "certificateAuthorityInvalid": "Orca doesn't trust the authority that issued the certificate for {{value0}}.", + "certificateVerificationFailed": "Orca couldn't verify the certificate for {{value0}}.", + "trustedCertificateGuidance": "For local development, use a trusted local certificate when possible.", + "retry": "Retry", + "copyAddress": "Copy Address", + "addressCopied": "Copied the current page address.", + "openExternally": "Open Externally", + "tryHttps": "Try HTTPS", + "proceedUnsafe": "Proceed Anyway (Unsafe)", + "connecting": "Connecting…", + "certificateChallengeExpired": "This certificate approval expired. Retry the page to request a new one.", + "certificateChallengeChanged": "The certificate request changed. Retry the page and review the new warning.", + "certificateChallengeUnavailable": "This certificate request is no longer available. Retry the page to request a new one.", + "certificateProceedFailed": "Orca could not approve this certificate request. Retry the page and try again." + } } } diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json index 86769650574..d6cd49a0234 100644 --- a/src/renderer/src/i18n/locales/zh.json +++ b/src/renderer/src/i18n/locales/zh.json @@ -13284,5 +13284,28 @@ } } } + }, + "browser": { + "loadFailure": { + "connectionNotSecure": "Connection isn't secure", + "cantReachHost": "Can't reach {{value0}}", + "cantLoadPage": "Can't load this page", + "certificateNameMismatch": "The certificate doesn't match {{value0}}.", + "certificateDateInvalid": "The certificate for {{value0}} isn't valid at the current date and time.", + "certificateAuthorityInvalid": "Orca doesn't trust the authority that issued the certificate for {{value0}}.", + "certificateVerificationFailed": "Orca couldn't verify the certificate for {{value0}}.", + "trustedCertificateGuidance": "For local development, use a trusted local certificate when possible.", + "retry": "Retry", + "copyAddress": "Copy Address", + "addressCopied": "Copied the current page address.", + "openExternally": "Open Externally", + "tryHttps": "Try HTTPS", + "proceedUnsafe": "Proceed Anyway (Unsafe)", + "connecting": "Connecting…", + "certificateChallengeExpired": "This certificate approval expired. Retry the page to request a new one.", + "certificateChallengeChanged": "The certificate request changed. Retry the page and review the new warning.", + "certificateChallengeUnavailable": "This certificate request is no longer available. Retry the page to request a new one.", + "certificateProceedFailed": "Orca could not approve this certificate request. Retry the page and try again." + } } } diff --git a/src/renderer/src/runtime/remote-server-parity.test.ts b/src/renderer/src/runtime/remote-server-parity.test.ts index 6122838dc81..dceb8ad7ab5 100644 --- a/src/renderer/src/runtime/remote-server-parity.test.ts +++ b/src/renderer/src/runtime/remote-server-parity.test.ts @@ -48,6 +48,7 @@ function makeState(overrides: Partial = {}): WebSession activeWorktreeId: WT, agentStatusByPaneKey: {}, agentStatusEpoch: 0, + browserCertificateFailuresByPageId: {}, browserPagesByWorkspace: {}, browserTabsByWorktree: {}, groupsByWorktree: {}, diff --git a/src/renderer/src/runtime/sync-runtime-graph-browser.test.ts b/src/renderer/src/runtime/sync-runtime-graph-browser.test.ts index c57ceee92ce..4042e70c525 100644 --- a/src/renderer/src/runtime/sync-runtime-graph-browser.test.ts +++ b/src/renderer/src/runtime/sync-runtime-graph-browser.test.ts @@ -20,6 +20,7 @@ function makeState(overrides: Partial = {}): AppState { activeBrowserTabIdByWorktree: {}, browserTabsByWorktree: {}, browserPagesByWorkspace: {}, + browserCertificateFailuresByPageId: {}, openFiles: [], editorDrafts: {}, activeTabId: null, @@ -103,7 +104,19 @@ describe('browser mobile session sync', () => { createdAt: 1 } ] - } as unknown as AppState['browserPagesByWorkspace'] + } as unknown as AppState['browserPagesByWorkspace'], + browserCertificateFailuresByPageId: { + 'page-1': { + challengeId: 'challenge-1', + browserPageId: 'page-1', + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 123 + } + } }) expect(buildMobileSessionTabSnapshots(state)[0]?.tabs).toMatchObject([ @@ -115,11 +128,40 @@ describe('browser mobile session sync', () => { title: 'Example Page', url: 'https://example.com/path', canGoBack: true, + certificateFailure: { + challengeId: 'challenge-1', + browserPageId: 'page-1' + }, isActive: true } ]) }) + it('does not resurrect a stale workspace failure after the active page clears it', () => { + const staleError = { + code: -202, + description: 'ERR_CERT_AUTHORITY_INVALID', + validatedUrl: 'https://localhost:3443/' + } + const workspace = { ...makeBrowserWorkspace(), loadError: staleError } + const activePage = { + ...workspace, + id: 'page-1', + workspaceId: workspace.id, + loadError: null + } + const state = makeState({ + activeBrowserTabIdByWorktree: { 'wt-1': workspace.id }, + browserTabsByWorktree: { 'wt-1': [workspace] }, + browserPagesByWorkspace: { [workspace.id]: [activePage] } + }) + + expect(buildMobileSessionTabSnapshots(state)[0]?.tabs[0]).toMatchObject({ + type: 'browser', + loadError: null + }) + }) + it('publishes fallback browser tabs by workspace id when no unified tab exists', () => { const state = makeState({ activeBrowserTabIdByWorktree: { 'wt-1': 'browser-1' }, diff --git a/src/renderer/src/runtime/sync-runtime-graph.ts b/src/renderer/src/runtime/sync-runtime-graph.ts index b684e3fba9a..e735e130004 100644 --- a/src/renderer/src/runtime/sync-runtime-graph.ts +++ b/src/renderer/src/runtime/sync-runtime-graph.ts @@ -1492,6 +1492,12 @@ function buildMobileBrowserTab( loading: activePage?.loading ?? workspace.loading, canGoBack: activePage?.canGoBack ?? workspace.canGoBack, canGoForward: activePage?.canGoForward ?? workspace.canGoForward, + // Why: null means the active page successfully cleared its failure. Falling + // back through ?? would resurrect a stale workspace-level error. + loadError: activePage ? activePage.loadError : workspace.loadError, + certificateFailure: activePage + ? (state.browserCertificateFailuresByPageId[activePage.id] ?? null) + : null, color: unifiedTab?.color ?? null, isPinned: unifiedTab?.isPinned === true, isActive: unifiedTabId diff --git a/src/renderer/src/runtime/web-session-tabs-sync.test.ts b/src/renderer/src/runtime/web-session-tabs-sync.test.ts index d5eef6225ae..9d5f20f926f 100644 --- a/src/renderer/src/runtime/web-session-tabs-sync.test.ts +++ b/src/renderer/src/runtime/web-session-tabs-sync.test.ts @@ -64,6 +64,7 @@ function makeState(overrides: Partial = {}): WebSession activeWorktreeId: WT, agentStatusByPaneKey: {}, agentStatusEpoch: 0, + browserCertificateFailuresByPageId: {}, browserPagesByWorkspace: {}, browserTabsByWorktree: {}, groupsByWorktree: {}, @@ -2359,6 +2360,21 @@ describe('applyWebSessionTabsSnapshot', () => { loading: false, canGoBack: true, canGoForward: false, + loadError: { + code: -202, + description: 'ERR_CERT_AUTHORITY_INVALID', + validatedUrl: 'https://localhost:3443/' + }, + certificateFailure: { + challengeId: 'challenge-1', + browserPageId: 'host-browser-page', + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 123 + }, color: '#3b82f6', isPinned: true, isActive: true @@ -2390,13 +2406,28 @@ describe('applyWebSessionTabsSnapshot', () => { worktreeId: WT, url: 'https://example.com/', title: 'Example Domain', - loading: false + loading: false, + loadError: { + code: -202, + description: 'ERR_CERT_AUTHORITY_INVALID', + validatedUrl: 'https://localhost:3443/' + } } ]) expect(patch.remoteBrowserPageHandlesByPageId?.['host-browser-page']).toEqual({ environmentId: ENV, remotePageId: 'host-browser-page' }) + expect(patch.browserCertificateFailuresByPageId?.['host-browser-page']).toEqual({ + challengeId: 'challenge-1', + browserPageId: 'host-browser-page', + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 123 + }) expect(patch.unifiedTabsByWorktree?.[WT]).toEqual( expect.arrayContaining([ expect.objectContaining({ @@ -2888,6 +2919,18 @@ describe('applyWebSessionTabsSnapshot', () => { remoteBrowserPageHandlesByPageId: { [page.id]: { environmentId: ENV, remotePageId: 'host-browser-page' } }, + browserCertificateFailuresByPageId: { + [page.id]: { + challengeId: 'stale-challenge', + browserPageId: 'host-browser-page', + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 100 + } + }, openFiles: [file], unifiedTabsByWorktree: { [WT]: existingTabs } }), @@ -2945,6 +2988,9 @@ describe('applyWebSessionTabsSnapshot', () => { }) ]) ) + // Why: older runtimes omit this transient field. Omission must clear an + // earlier challenge instead of leaving an unsafe action wired to stale RPC input. + expect(patch.browserCertificateFailuresByPageId).toEqual({}) }) it('uses local markdown preview file ids while preserving the host unified tab id', () => { diff --git a/src/renderer/src/runtime/web-session-tabs-sync.ts b/src/renderer/src/runtime/web-session-tabs-sync.ts index 54a94965767..41fbb2c8fe1 100644 --- a/src/renderer/src/runtime/web-session-tabs-sync.ts +++ b/src/renderer/src/runtime/web-session-tabs-sync.ts @@ -19,6 +19,7 @@ import type { RuntimeMobileSessionTerminalClientTab } from '../../../shared/runtime-types' import type { + BrowserCertificateFailure, BrowserPage, BrowserWorkspace, Tab, @@ -104,6 +105,7 @@ type MirroredTerminalTab = { type MirroredBrowserTab = { workspace: BrowserWorkspace page: BrowserPage + certificateFailure: BrowserCertificateFailure | null remotePageId: string unifiedTab: Tab hostTabId: string @@ -130,6 +132,7 @@ export type WebSessionTabsSyncState = Pick< | 'agentStatusByPaneKey' | 'agentStatusEpoch' | 'browserPagesByWorkspace' + | 'browserCertificateFailuresByPageId' | 'browserTabsByWorktree' | 'groupsByWorktree' | 'layoutByWorktree' @@ -951,7 +954,7 @@ function buildMirroredBrowserTabs( faviconUrl: existing?.page.faviconUrl ?? null, canGoBack: tab.canGoBack, canGoForward: tab.canGoForward, - loadError: null, + loadError: tab.loadError ?? null, createdAt, browserRuntimeEnvironmentId: environmentId, viewportPresetId: existing?.page.viewportPresetId ?? null @@ -975,6 +978,7 @@ function buildMirroredBrowserTabs( return { workspace, page, + certificateFailure: tab.certificateFailure ?? null, remotePageId: tab.browserPageId, unifiedTab: buildBrowserUnifiedTab(workspace, tab, existing?.unifiedTab ?? null, groupId), hostTabId: tab.id @@ -1478,6 +1482,29 @@ function browserPageEqual(a: BrowserPage, b: BrowserPage): boolean { ) } +function browserCertificateFailureEqual( + a: BrowserCertificateFailure | null | undefined, + b: BrowserCertificateFailure | null | undefined +): boolean { + const left = a ?? null + const right = b ?? null + if (left === right) { + return true + } + return Boolean( + left && + right && + left.challengeId === right.challengeId && + left.browserPageId === right.browserPageId && + left.errorCode === right.errorCode && + left.error === right.error && + left.origin === right.origin && + left.displayHost === right.displayHost && + left.canProceed === right.canProceed && + left.observedAt === right.observedAt + ) +} + function sameBrowserPages( a: readonly BrowserPage[] | undefined, b: readonly BrowserPage[] | null @@ -2135,6 +2162,7 @@ export function applyWebSessionTabsSnapshot( let nextBrowserPagesByWorkspace = state.browserPagesByWorkspace let nextRemoteBrowserPageHandlesByPageId = state.remoteBrowserPageHandlesByPageId + let nextBrowserCertificateFailuresByPageId = state.browserCertificateFailuresByPageId for (const removedWorkspaceId of removedBrowserWorkspaceIds) { const pages = nextBrowserPagesByWorkspace[removedWorkspaceId] ?? [] if (nextBrowserPagesByWorkspace[removedWorkspaceId]) { @@ -2145,6 +2173,13 @@ export function applyWebSessionTabsSnapshot( delete nextBrowserPagesByWorkspace[removedWorkspaceId] } for (const page of pages) { + if (nextBrowserCertificateFailuresByPageId[page.id]) { + nextBrowserCertificateFailuresByPageId = + nextBrowserCertificateFailuresByPageId === state.browserCertificateFailuresByPageId + ? { ...state.browserCertificateFailuresByPageId } + : nextBrowserCertificateFailuresByPageId + delete nextBrowserCertificateFailuresByPageId[page.id] + } if (nextRemoteBrowserPageHandlesByPageId[page.id]) { nextRemoteBrowserPageHandlesByPageId = nextRemoteBrowserPageHandlesByPageId === state.remoteBrowserPageHandlesByPageId @@ -2154,7 +2189,7 @@ export function applyWebSessionTabsSnapshot( } } } - for (const { page, remotePageId } of mirroredBrowserTabs) { + for (const { page, certificateFailure, remotePageId } of mirroredBrowserTabs) { const current = nextBrowserPagesByWorkspace[page.workspaceId] ?? [] if (!sameBrowserPages(current, [page])) { nextBrowserPagesByWorkspace = @@ -2177,6 +2212,22 @@ export function applyWebSessionTabsSnapshot( remotePageId } } + if ( + !browserCertificateFailureEqual( + nextBrowserCertificateFailuresByPageId[page.id], + certificateFailure + ) + ) { + nextBrowserCertificateFailuresByPageId = + nextBrowserCertificateFailuresByPageId === state.browserCertificateFailuresByPageId + ? { ...state.browserCertificateFailuresByPageId } + : nextBrowserCertificateFailuresByPageId + if (certificateFailure) { + nextBrowserCertificateFailuresByPageId[page.id] = certificateFailure + } else { + delete nextBrowserCertificateFailuresByPageId[page.id] + } + } } const nextTabsByWorktree = withWorktreeEntry( @@ -2383,6 +2434,9 @@ export function applyWebSessionTabsSnapshot( ...(nextRemoteBrowserPageHandlesByPageId !== state.remoteBrowserPageHandlesByPageId ? { remoteBrowserPageHandlesByPageId: nextRemoteBrowserPageHandlesByPageId } : {}), + ...(nextBrowserCertificateFailuresByPageId !== state.browserCertificateFailuresByPageId + ? { browserCertificateFailuresByPageId: nextBrowserCertificateFailuresByPageId } + : {}), ...(nextActiveTabIdByWorktree !== state.activeTabIdByWorktree ? { activeTabIdByWorktree: nextActiveTabIdByWorktree } : {}), diff --git a/src/renderer/src/store/slices/browser.test.ts b/src/renderer/src/store/slices/browser.test.ts index 61a534c6194..c6b441fbb4c 100644 --- a/src/renderer/src/store/slices/browser.test.ts +++ b/src/renderer/src/store/slices/browser.test.ts @@ -180,6 +180,39 @@ describe('createBrowserSlice annotations', () => { expect(store.getState().browserAnnotationsByPageId[pageId]).toBeUndefined() }) + it('keeps certificate challenges transient across navigation, success, and close', () => { + const store = createTestStore() + const tab = store.getState().createBrowserTab('wt-1', 'https://localhost:3443/') + const pageId = tab.activePageId + if (!pageId) { + throw new Error('Expected a new browser page') + } + const failure = { + challengeId: 'challenge-1', + browserPageId: pageId, + errorCode: -202, + error: 'ERR_CERT_AUTHORITY_INVALID', + origin: 'https://localhost:3443', + displayHost: 'localhost:3443', + canProceed: true, + observedAt: 123 + } + + store.getState().setBrowserPageCertificateFailure(pageId, failure) + expect(store.getState().browserCertificateFailuresByPageId[pageId]).toEqual(failure) + + store.getState().setBrowserPageUrl(pageId, 'https://localhost:3443/next') + expect(store.getState().browserCertificateFailuresByPageId[pageId]).toBeUndefined() + + store.getState().setBrowserPageCertificateFailure(pageId, failure) + store.getState().updateBrowserPageState(pageId, { loadError: null }) + expect(store.getState().browserCertificateFailuresByPageId[pageId]).toBeUndefined() + + store.getState().setBrowserPageCertificateFailure(pageId, failure) + store.getState().closeBrowserTab(tab.id) + expect(store.getState().browserCertificateFailuresByPageId[pageId]).toBeUndefined() + }) + it('creates inactive browser unified tabs without stealing the visible tab', () => { const store = createTestStore() diff --git a/src/renderer/src/store/slices/browser.ts b/src/renderer/src/store/slices/browser.ts index 10f955275bc..ea4d2e0ebb3 100644 --- a/src/renderer/src/store/slices/browser.ts +++ b/src/renderer/src/store/slices/browser.ts @@ -4,6 +4,7 @@ import type { AppState } from '../types' import type { BrowserCookieImportResult, BrowserCookieImportSummary, + BrowserCertificateFailure, BrowserHistoryEntry, BrowserLoadError, BrowserPage, @@ -117,6 +118,7 @@ export type RemoteBrowserPageHandle = { export type BrowserSlice = { browserTabsByWorktree: Record browserPagesByWorkspace: Record + browserCertificateFailuresByPageId: Record browserAnnotationsByPageId: Record remoteBrowserPageHandlesByPageId: Record activeBrowserTabId: string | null @@ -159,6 +161,10 @@ export type BrowserSlice = { consumeAddressBarFocusRequest: (pageId: string) => boolean updateBrowserTabPageState: (pageId: string, updates: BrowserTabPageState) => void updateBrowserPageState: (pageId: string, updates: BrowserTabPageState) => void + setBrowserPageCertificateFailure: ( + pageId: string, + failure: BrowserCertificateFailure | null + ) => void setBrowserTabUrl: (pageId: string, url: string) => void setBrowserPageUrl: (pageId: string, url: string) => void setRemoteBrowserPageHandle: (pageId: string, handle: RemoteBrowserPageHandle) => void @@ -473,6 +479,7 @@ function findPage( export const createBrowserSlice: StateCreator = (set, get) => ({ browserTabsByWorktree: {}, browserPagesByWorkspace: {}, + browserCertificateFailuresByPageId: {}, browserAnnotationsByPageId: {}, remoteBrowserPageHandlesByPageId: {}, activeBrowserTabId: null, @@ -675,8 +682,12 @@ export const createBrowserSlice: StateCreator = const nextBrowserPagesByWorkspace = { ...s.browserPagesByWorkspace } delete nextBrowserPagesByWorkspace[tabId] const nextBrowserAnnotationsByPageId = { ...s.browserAnnotationsByPageId } + const nextBrowserCertificateFailuresByPageId = { + ...s.browserCertificateFailuresByPageId + } for (const page of closedPages) { delete nextBrowserAnnotationsByPageId[page.id] + delete nextBrowserCertificateFailuresByPageId[page.id] } remotePagesToClose = closedPages.flatMap((page) => { const handle = s.remoteBrowserPageHandlesByPageId[page.id] @@ -766,6 +777,7 @@ export const createBrowserSlice: StateCreator = recentlyClosedTabKindsByWorktree: nextRecentlyClosedTabKindsByWorktree, recentlyClosedBrowserPagesByWorkspace: nextRecentlyClosedBrowserPagesByWorkspace, remoteBrowserPageHandlesByPageId: nextRemoteBrowserPageHandlesByPageId, + browserCertificateFailuresByPageId: nextBrowserCertificateFailuresByPageId, browserAnnotationsByPageId: nextBrowserAnnotationsByPageId } }) @@ -1040,6 +1052,10 @@ export const createBrowserSlice: StateCreator = delete nextRemoteBrowserPageHandlesByPageId[pageId] const nextBrowserAnnotationsByPageId = { ...s.browserAnnotationsByPageId } delete nextBrowserAnnotationsByPageId[pageId] + const nextBrowserCertificateFailuresByPageId = { + ...s.browserCertificateFailuresByPageId + } + delete nextBrowserCertificateFailuresByPageId[pageId] return { browserPagesByWorkspace: { @@ -1072,6 +1088,7 @@ export const createBrowserSlice: StateCreator = ) ), remoteBrowserPageHandlesByPageId: nextRemoteBrowserPageHandlesByPageId, + browserCertificateFailuresByPageId: nextBrowserCertificateFailuresByPageId, browserAnnotationsByPageId: nextBrowserAnnotationsByPageId } }) @@ -1367,6 +1384,32 @@ export const createBrowserSlice: StateCreator = } return nextState }) + if (updates.loadError === null) { + get().setBrowserPageCertificateFailure(pageId, null) + } + }, + + setBrowserPageCertificateFailure: (pageId, failure) => { + set((s) => { + const current = s.browserCertificateFailuresByPageId[pageId] + if (failure === null) { + if (!current) { + return s + } + const nextFailures = { ...s.browserCertificateFailuresByPageId } + delete nextFailures[pageId] + return { browserCertificateFailuresByPageId: nextFailures } + } + if (!findPage(s.browserPagesByWorkspace, pageId) || current === failure) { + return s + } + return { + browserCertificateFailuresByPageId: { + ...s.browserCertificateFailuresByPageId, + [pageId]: failure + } + } + }) }, setBrowserTabUrl: (pageId, url) => get().setBrowserPageUrl(pageId, url), @@ -1425,6 +1468,7 @@ export const createBrowserSlice: StateCreator = : {}) } }) + get().setBrowserPageCertificateFailure(pageId, null) }, setRemoteBrowserPageHandle: (pageId, handle) => { @@ -1688,6 +1732,7 @@ export const createBrowserSlice: StateCreator = activeTabTypeByWorktree: nextActiveTabTypeByWorktree, activeTabType, remoteBrowserPageHandlesByPageId: {}, + browserCertificateFailuresByPageId: {}, browserAnnotationsByPageId: {}, browserUrlHistory: normalizeBrowserHistoryEntries(session.browserUrlHistory ?? []) } diff --git a/src/renderer/src/web/web-preload-api.ts b/src/renderer/src/web/web-preload-api.ts index d6f6d6e5830..29268cee148 100644 --- a/src/renderer/src/web/web-preload-api.ts +++ b/src/renderer/src/web/web-preload-api.ts @@ -1993,12 +1993,14 @@ function createGitApi(): NonNullable['git']> { function createBrowserApi(): NonNullable['browser']> { return { - registerGuest: () => Promise.resolve(), + registerGuest: () => Promise.resolve(false), unregisterGuest: () => Promise.resolve(), openDevTools: () => Promise.resolve(false), setViewportOverride: () => Promise.resolve(false), setAnnotationViewportBridge: () => Promise.resolve(false), onGuestLoadFailed: () => noopUnsubscribe, + onCertificateFailureChanged: () => noopUnsubscribe, + proceedCertificate: () => Promise.resolve({ ok: false, reason: 'missing' }), onPermissionDenied: () => noopUnsubscribe, onPopup: () => noopUnsubscribe, onDownloadRequested: () => noopUnsubscribe, diff --git a/src/shared/browser-certificate-errors.ts b/src/shared/browser-certificate-errors.ts new file mode 100644 index 00000000000..9f1eba87dee --- /dev/null +++ b/src/shared/browser-certificate-errors.ts @@ -0,0 +1,9 @@ +// Why: use Chromium's exact certificate codes so unrelated network failures +// never receive certificate-specific recovery copy. +const CHROMIUM_CERTIFICATE_ERROR_CODES = new Set([ + -200, -201, -202, -203, -204, -205, -206, -207, -208, -210, -211, -212, -213, -214, -217, -219 +]) + +export function isChromiumCertificateErrorCode(code: number): boolean { + return CHROMIUM_CERTIFICATE_ERROR_CODES.has(code) +} diff --git a/src/shared/browser-url.test.ts b/src/shared/browser-url.test.ts index ce5487be0c0..4a246355fea 100644 --- a/src/shared/browser-url.test.ts +++ b/src/shared/browser-url.test.ts @@ -2,10 +2,15 @@ import { describe, expect, it } from 'vitest' import { ORCA_BROWSER_BLANK_URL } from './constants' import { buildSearchUrl, + classifySchemeLessLocalDevAddress, + isEligibleLocalCertificateHost, normalizeKagiSessionLink, normalizeBrowserNavigationUrl, normalizeExternalBrowserUrl, - redactKagiSessionToken + redactKagiSessionToken, + resolveRemoteFailureExternalUrl, + toSecureCertificateEndpoint, + toHttpsRecoveryUrl } from './browser-url' describe('browser-url helpers', () => { @@ -20,6 +25,98 @@ describe('browser-url helpers', () => { ) }) + it('keeps the legacy scheme-less local-dev classifier broader than certificate eligibility', () => { + for (const input of [ + 'localhost:3000/path', + '127.0.0.1:5173', + '0.0.0.0:8080', + '[::1]:3000', + '[2001:db8::1]:3000' + ]) { + expect(classifySchemeLessLocalDevAddress(input), input).not.toBeNull() + } + expect(classifySchemeLessLocalDevAddress('app.localhost:3000')).toBeNull() + expect(isEligibleLocalCertificateHost('0.0.0.0')).toBe(false) + expect(isEligibleLocalCertificateHost('[2001:db8::1]')).toBe(false) + }) + + it('recognizes only canonical loopback certificate hosts', () => { + for (const hostname of [ + 'localhost', + 'LOCALHOST.', + 'app.localhost', + 'deep.app.localhost.', + '127.0.0.1', + '127.255.255.255', + '::1', + '[::1]' + ]) { + expect(isEligibleLocalCertificateHost(hostname), hostname).toBe(true) + } + for (const hostname of [ + '0.0.0.0', + '::', + '[2001:db8::1]', + '192.168.1.1', + 'localhost.example.com', + 'notlocalhost', + '.localhost', + '-bad.localhost', + 'bad-.localhost', + '127.0.0.999', + '127.00.0.1' + ]) { + expect(isEligibleLocalCertificateHost(hostname), hostname).toBe(false) + } + }) + + it('constructs HTTPS recovery URLs without changing the rest of the address', () => { + expect(toHttpsRecoveryUrl('http://localhost:3000/path?q=1#preview')).toBe( + 'https://localhost:3000/path?q=1#preview' + ) + expect(toHttpsRecoveryUrl('http://user:pass@127.0.0.2:8080/')).toBe( + 'https://user:pass@127.0.0.2:8080/' + ) + expect(toHttpsRecoveryUrl('http://localhost:80/path')).toBe('https://localhost/path') + expect(toHttpsRecoveryUrl('https://localhost:3000/')).toBeNull() + expect(toHttpsRecoveryUrl('http://0.0.0.0:3000/')).toBeNull() + expect(toHttpsRecoveryUrl('http://example.com/')).toBeNull() + expect(toHttpsRecoveryUrl('not a url')).toBeNull() + }) + + it('canonicalizes secure certificate endpoints without path or credential data', () => { + expect(toSecureCertificateEndpoint('https://User:secret@LOCALHOST.:443/path?q=1')).toBe( + 'https://localhost:443' + ) + expect(toSecureCertificateEndpoint('wss://localhost:3000/socket')).toBe( + 'https://localhost:3000' + ) + expect(toSecureCertificateEndpoint('https://[::1]/')).toBe('https://[::1]:443') + expect(toSecureCertificateEndpoint('http://localhost:3000/')).toBeNull() + expect(toSecureCertificateEndpoint('not a url')).toBeNull() + }) + + it('offers Open Externally for a remote failure only when the URL is desktop-reachable', () => { + // Loopback / wildcard hosts are unreachable from the desktop system browser. + expect(resolveRemoteFailureExternalUrl('https://localhost:3000/')).toBeNull() + expect(resolveRemoteFailureExternalUrl('https://127.0.0.1:3000/')).toBeNull() + expect(resolveRemoteFailureExternalUrl('https://127.0.0.9:3000/')).toBeNull() + expect(resolveRemoteFailureExternalUrl('https://[::1]:3000/')).toBeNull() + expect(resolveRemoteFailureExternalUrl('https://app.localhost:3000/')).toBeNull() + expect(resolveRemoteFailureExternalUrl('http://0.0.0.0:3000/')).toBeNull() + expect(resolveRemoteFailureExternalUrl('http://[::]:3000/')).toBeNull() + // Public hosts are reachable, so the action is offered. + expect(resolveRemoteFailureExternalUrl('https://example.com/app')).toBe( + 'https://example.com/app' + ) + expect(resolveRemoteFailureExternalUrl('http://example.com:8080/x')).toBe( + 'http://example.com:8080/x' + ) + // Non-web schemes and garbage never become an external target. + expect(resolveRemoteFailureExternalUrl('file:///etc/passwd')).toBeNull() + expect(resolveRemoteFailureExternalUrl('not a url')).toBeNull() + }) + it('keeps normal web URLs and blank tabs in the allowed set', () => { expect(normalizeBrowserNavigationUrl('https://example.com')).toBe('https://example.com/') expect(normalizeBrowserNavigationUrl('')).toBe(ORCA_BROWSER_BLANK_URL) diff --git a/src/shared/browser-url.ts b/src/shared/browser-url.ts index 71e980db2f6..7eb2ca6ebe1 100644 --- a/src/shared/browser-url.ts +++ b/src/shared/browser-url.ts @@ -34,6 +34,111 @@ const SEARCH_ENGINE_URLS: Record = { export const DEFAULT_SEARCH_ENGINE: SearchEngine = 'google' +export function classifySchemeLessLocalDevAddress(rawInput: string): URL | null { + const trimmed = rawInput.trim() + if (!LOCAL_ADDRESS_PATTERN.test(trimmed)) { + return null + } + try { + return new URL(`http://${trimmed}`) + } catch { + return null + } +} + +function normalizeCertificateHostname(hostname: string): string { + const lower = hostname.trim().toLowerCase() + const unbracketed = lower.startsWith('[') && lower.endsWith(']') ? lower.slice(1, -1) : lower + return unbracketed.endsWith('.') ? unbracketed.slice(0, -1) : unbracketed +} + +function isValidDnsName(name: string): boolean { + if (name.length === 0 || name.length > 253) { + return false + } + return name + .split('.') + .every( + (label) => + label.length > 0 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label) + ) +} + +function isIpv4Loopback(hostname: string): boolean { + const octets = hostname.split('.') + if (octets.length !== 4 || octets.some((octet) => !/^\d{1,3}$/.test(octet))) { + return false + } + const values = octets.map(Number) + return ( + values[0] === 127 && + values.every((value, index) => value >= 0 && value <= 255 && octets[index] === String(value)) + ) +} + +export function isEligibleLocalCertificateHost(hostname: string): boolean { + const normalized = normalizeCertificateHostname(hostname) + if (normalized === '::1' || isIpv4Loopback(normalized)) { + return true + } + if (!isValidDnsName(normalized)) { + return false + } + return normalized === 'localhost' || normalized.endsWith('.localhost') +} + +function isWildcardBindHost(hostname: string): boolean { + const normalized = normalizeCertificateHostname(hostname) + return normalized === '0.0.0.0' || normalized === '::' +} + +export function toHttpsRecoveryUrl(rawUrl: string): string | null { + try { + const parsed = new URL(rawUrl) + if (parsed.protocol !== 'http:' || !isEligibleLocalCertificateHost(parsed.hostname)) { + return null + } + parsed.protocol = 'https:' + return parsed.toString() + } catch { + return null + } +} + +export function toSecureCertificateEndpoint(rawUrl: string): string | null { + try { + const parsed = new URL(rawUrl) + if (parsed.protocol !== 'https:' && parsed.protocol !== 'wss:') { + return null + } + const normalizedHostname = normalizeCertificateHostname(parsed.hostname) + if (!normalizedHostname) { + return null + } + const endpointHost = normalizedHostname.includes(':') + ? `[${normalizedHostname}]` + : normalizedHostname + return `https://${endpointHost}:${parsed.port || '443'}` + } catch { + return null + } +} + +// Why: a remote-owned browser page's loopback URL is unreachable from the +// desktop system browser, so Open Externally is offered only for publicly +// reachable (non-loopback) failure URLs. +export function resolveRemoteFailureExternalUrl(rawUrl: string): string | null { + try { + const parsed = new URL(rawUrl) + if (isWildcardBindHost(parsed.hostname) || isEligibleLocalCertificateHost(parsed.hostname)) { + return null + } + } catch { + return null + } + return normalizeExternalBrowserUrl(rawUrl) +} + export function normalizeKagiSessionLink(rawLink: string): string | null { const trimmed = rawLink.trim() if (!trimmed) { @@ -163,12 +268,9 @@ export function normalizeBrowserNavigationUrl( return ORCA_BROWSER_BLANK_URL } - if (LOCAL_ADDRESS_PATTERN.test(trimmed)) { - try { - return new URL(`http://${trimmed}`).toString() - } catch { - return null - } + const localDevAddress = classifySchemeLessLocalDevAddress(trimmed) + if (localDevAddress) { + return localDevAddress.toString() } if (WINDOWS_UNC_PATH_PATTERN.test(trimmed)) { diff --git a/src/shared/protocol-version.ts b/src/shared/protocol-version.ts index 89e4303014c..f6242c93e99 100644 --- a/src/shared/protocol-version.ts +++ b/src/shared/protocol-version.ts @@ -38,6 +38,7 @@ export const AI_VAULT_RUNTIME_CAPABILITY = 'aiVault.v1' as const // offscreen backend). Advertised only when that backend is actually available, so // clients never fall back to a local desktop browser tab for a remote-owned page. export const BROWSER_HEADLESS_RUNTIME_CAPABILITY = 'browser.headless.v1' as const +export const BROWSER_CERTIFICATE_TRUST_RUNTIME_CAPABILITY = 'browser.certificate-trust.v1' as const // Why: hosts without this strip terminal.send's inputKind (zod object drops // unknown keys), so a mobile xterm query reply would land as ordinary // floor-taking input. Mobile must not forward replies unless advertised. diff --git a/src/shared/runtime-types.ts b/src/shared/runtime-types.ts index 774114b6d75..953dae57909 100644 --- a/src/shared/runtime-types.ts +++ b/src/shared/runtime-types.ts @@ -8,6 +8,8 @@ import type { import type { BaseRefSearchResult, BrowserCookieImportResult, + BrowserCertificateFailure, + BrowserLoadError, BrowserSessionProfile, BrowserSessionProfileSource, CreateWorktreeResult, @@ -206,6 +208,8 @@ export type RuntimeMobileSessionBrowserTab = { loading: boolean canGoBack: boolean canGoForward: boolean + loadError?: BrowserLoadError | null + certificateFailure?: BrowserCertificateFailure | null color?: string | null isPinned?: boolean isActive: boolean @@ -818,6 +822,11 @@ export type BrowserTabInfo = { url: string title: string active: boolean + // Why: a failed load leaves getURL() at chrome-error://; surface the structured + // error so an agent driving the browser can tell a bypassable certificate + // failure from an ordinary network error the way the UI can. + loadError?: BrowserLoadError | null + certificateFailure?: BrowserCertificateFailure | null worktreeId?: string | null profileId?: string | null profileLabel?: string | null diff --git a/src/shared/types.ts b/src/shared/types.ts index 4d4301a0b6f..ff46520c44d 100644 --- a/src/shared/types.ts +++ b/src/shared/types.ts @@ -889,6 +889,28 @@ export type BrowserLoadError = { validatedUrl: string } +export type BrowserCertificateFailure = { + challengeId: string + browserPageId: string + errorCode: number | null + error: string + origin: string + displayHost: string + canProceed: boolean + observedAt: number +} + +export type BrowserCertificateProceedFailureReason = + | 'expired' + | 'changed' + | 'ineligible' + | 'missing' + | 'navigated' + +export type BrowserCertificateProceedResult = + | { ok: true } + | { ok: false; reason: BrowserCertificateProceedFailureReason } + // Why: BrowserPage persists the active viewport preset so CDP emulation can be // reapplied on reload/navigation without the user re-picking from the toolbar. export type BrowserViewportPresetId = diff --git a/tests/e2e/browser-local-https-certificate-trust.spec.ts b/tests/e2e/browser-local-https-certificate-trust.spec.ts new file mode 100644 index 00000000000..c82ec75f959 --- /dev/null +++ b/tests/e2e/browser-local-https-certificate-trust.spec.ts @@ -0,0 +1,199 @@ +import type { Page } from '@stablyai/playwright-test' + +import { expect, test } from './helpers/orca-app' +import { + ensureTerminalVisible, + getActiveWorktreeId, + waitForActiveWorktree, + waitForSessionReady +} from './helpers/store' +import { startLocalHttpProbeServer, startLocalHttpsServer } from './helpers/local-https-test-server' + +type CreatedBrowserTab = { + id: string + pageId: string +} + +async function createBrowserTab( + page: Page, + worktreeId: string, + url: string +): Promise { + const tab = await page.evaluate( + ({ targetWorktreeId, targetUrl }) => { + const state = window.__store?.getState() + if (!state) { + return null + } + const browserTab = state.createBrowserTab(targetWorktreeId, targetUrl, { + title: 'Local TLS', + activate: true + }) + return { id: browserTab.id, pageId: browserTab.activePageId ?? null } + }, + { targetWorktreeId: worktreeId, targetUrl: url } + ) + if (!tab?.pageId) { + throw new Error('Failed to create local TLS browser page') + } + return { id: tab.id, pageId: tab.pageId } +} + +async function switchToBrowserTab(page: Page, worktreeId: string, browserTabId: string) { + await page.evaluate( + ({ targetWorktreeId, targetBrowserTabId }) => { + const state = window.__store?.getState() + if (!state) { + return + } + if ( + !(state.browserTabsByWorktree[targetWorktreeId] ?? []).some( + (tab) => tab.id === targetBrowserTabId + ) + ) { + return + } + state.setActiveBrowserTab(targetBrowserTabId) + state.setActiveTabType('browser') + }, + { targetWorktreeId: worktreeId, targetBrowserTabId: browserTabId } + ) +} + +function browserSlot(page: Page, pageId: string) { + return page.locator(`[data-browser-overlay-tab-id="${pageId}"]`) +} + +async function readBrowserHeading(page: Page, browserTabId: string): Promise { + return page.evaluate(async (targetBrowserTabId) => { + const slot = [...document.querySelectorAll('[data-browser-overlay-tab-id]')].find( + (candidate) => candidate.getAttribute('data-browser-overlay-tab-id') === targetBrowserTabId + ) + const webview = slot?.querySelector('webview') as Electron.WebviewTag | null + if (!webview) { + return null + } + try { + return await webview.executeJavaScript('document.querySelector("h1")?.textContent ?? null') + } catch { + return null + } + }, browserTabId) +} + +async function readBrowserState( + page: Page, + browserTabId: string, + stateName: '__localTlsState' | '__siblingTlsProbe' +): Promise | null> { + return page.evaluate( + async ({ targetBrowserTabId, targetStateName }) => { + const slot = [...document.querySelectorAll('[data-browser-overlay-tab-id]')].find( + (candidate) => candidate.getAttribute('data-browser-overlay-tab-id') === targetBrowserTabId + ) + const webview = slot?.querySelector('webview') as Electron.WebviewTag | null + if (!webview) { + return null + } + try { + return await webview.executeJavaScript(`window.${targetStateName} ?? null`) + } catch { + return null + } + }, + { targetBrowserTabId: browserTabId, targetStateName: stateName } + ) +} + +async function reloadBrowserGuest(page: Page, browserTabId: string): Promise { + await page.evaluate((targetBrowserTabId) => { + const slot = [...document.querySelectorAll('[data-browser-overlay-tab-id]')].find( + (candidate) => candidate.getAttribute('data-browser-overlay-tab-id') === targetBrowserTabId + ) + const webview = slot?.querySelector('webview') as Electron.WebviewTag | null + if (!webview) { + throw new Error(`Missing webview for browser tab ${targetBrowserTabId}`) + } + webview.reload() + }, browserTabId) +} + +test.describe('local HTTPS certificate trust', () => { + test.beforeEach(async ({ orcaPage }) => { + await waitForSessionReady(orcaPage) + await waitForActiveWorktree(orcaPage) + await ensureTerminalVisible(orcaPage) + }) + + test('approves one exact local certificate endpoint without trusting sibling tabs or ports', async ({ + orcaPage + }) => { + const firstServer = await startLocalHttpsServer() + const secondPortServer = await startLocalHttpsServer() + const siblingProbeServer = await startLocalHttpProbeServer(firstServer) + try { + const worktreeId = (await getActiveWorktreeId(orcaPage))! + const firstTab = await createBrowserTab(orcaPage, worktreeId, firstServer.schemeLessUrl) + const firstSlot = browserSlot(orcaPage, firstTab.id) + + await expect(firstSlot.getByRole('button', { name: 'Try HTTPS' })).toBeVisible() + await firstSlot.getByRole('button', { name: 'Try HTTPS' }).click() + await expect( + firstSlot.getByRole('heading', { name: "Connection isn't secure" }) + ).toBeVisible() + // The certificate-failure branch keeps its safe recovery actions and the + // certificate-specific hint, but never the local-server connectivity hint. + await expect(firstSlot.getByRole('button', { name: 'Copy Address' })).toBeVisible() + await expect(firstSlot.getByRole('button', { name: 'Retry' })).toBeVisible() + await expect(firstSlot.getByText(/use a trusted local certificate/i)).toBeVisible() + await expect(firstSlot.getByText(/make sure the server is running/i)).toHaveCount(0) + await firstSlot.getByRole('button', { name: 'Proceed Anyway (Unsafe)' }).click() + await expect + .poll(() => readBrowserHeading(orcaPage, firstTab.id), { timeout: 10_000 }) + .toBe('Local HTTPS request 1') + await expect + .poll(() => readBrowserState(orcaPage, firstTab.id, '__localTlsState')) + .toEqual({ asset: true, webSocket: true }) + expect(firstServer.assetRequestCount()).toBe(1) + expect(firstServer.webSocketConnectionCount()).toBe(1) + + const secondTab = await createBrowserTab(orcaPage, worktreeId, firstServer.secureUrl) + const secondSlot = browserSlot(orcaPage, secondTab.id) + await expect( + secondSlot.getByRole('heading', { name: "Connection isn't secure" }) + ).toBeVisible() + // Why: approval is scoped to the first guest WebContents, not its shared + // profile partition, so this sibling still requires an explicit decision. + await expect( + secondSlot.getByRole('button', { name: 'Proceed Anyway (Unsafe)' }) + ).toBeVisible() + + const probeTab = await createBrowserTab(orcaPage, worktreeId, siblingProbeServer.url) + await expect + .poll(() => readBrowserState(orcaPage, probeTab.id, '__siblingTlsProbe')) + .toEqual({ asset: 'blocked', webSocket: 'blocked' }) + expect(firstServer.assetRequestCount()).toBe(1) + expect(firstServer.webSocketConnectionCount()).toBe(1) + + await switchToBrowserTab(orcaPage, worktreeId, firstTab.id) + await reloadBrowserGuest(orcaPage, firstTab.id) + await expect.poll(firstServer.documentRequestCount, { timeout: 10_000 }).toBe(2) + await expect + .poll(() => readBrowserHeading(orcaPage, firstTab.id), { timeout: 10_000 }) + .toBe('Local HTTPS request 2') + await expect.poll(firstServer.assetRequestCount).toBe(2) + await expect.poll(firstServer.webSocketConnectionCount).toBe(2) + + const firstAddressBar = firstSlot.locator('[data-orca-browser-address-bar="true"]') + await firstAddressBar.fill(secondPortServer.secureUrl) + await firstAddressBar.press('Enter') + await expect( + firstSlot.getByRole('heading', { name: "Connection isn't secure" }) + ).toBeVisible() + await expect(firstSlot.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeVisible() + await expect.poll(secondPortServer.documentRequestCount).toBe(0) + } finally { + await Promise.all([firstServer.close(), secondPortServer.close(), siblingProbeServer.close()]) + } + }) +}) diff --git a/tests/e2e/helpers/local-https-test-certificate.ts b/tests/e2e/helpers/local-https-test-certificate.ts new file mode 100644 index 00000000000..3fafc61bcfe --- /dev/null +++ b/tests/e2e/helpers/local-https-test-certificate.ts @@ -0,0 +1,50 @@ +// Static test-only identity with SANs for localhost and 127.0.0.1. Keeping the +// fixture in-repo avoids an OpenSSL dependency on Windows E2E runners. +export const LOCAL_HTTPS_TEST_PRIVATE_KEY = `-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCjkYboq/BDMxGh +0jYeeAEnhH466vJO2NTIsDAaqhVDxXSWqgcqPHhAXS3I4CCzBuTBKMCfZnFLjOf6 +/+8mGhMsWUmgkchZ23fo5kszbgslx+bu0NAT14OAuD0E5rNEJwGA2W7i3a3k1ULX +TSUpE9W1dxQLQzLSmXIKYST1Sadi3/qtuikcQW1E9Lyb1guf3gvm+jHSzUiM33ge +JX6zNkd3fX+uc2oNkm+tFo7Ol52A++cSIqxB8MCqrfUNhISyzu4Ozne9bsCoWdoW +4aLX+XVVRw9Y8nU9cIvt88H1a9oChrG+5oXU166pAdKZvAUV65fi/y3w3ldgKu5I +Xk+RJ+1xAgMBAAECggEAExg15DNPOd8MNcR7FCE8/EKhtEnRZd427+MuiGxWzWmv +d7erXLVAsf3WrpKoipG5UmnKG8mbG/9b5O+r+LoWRyj4uQWPupqt47q/qGY2J6/P +kA1BHzHbXINVfz0ZzBDUInkvkk0f49z3/7eWKRaTTgrzxHFQrWhjmV3YEUjrARYW +DtlAJiCuBW2Mrnl866kLwzH3KHGFs4bPYIyMr3LYDYVDlHEdGuseI1OclGXbDcyF +z0Es9Z1u+W6ttnamvanhS7MskWCMOddtXKpaiuDQqo1r3xbhSHCA+7cs7J0cQ1FX +cq5VZ2/EMyI++U0/0sW0aWnUNKmZcGNwaDschejI6QKBgQDPfsyZ4o8urLEwPciB +PnfHxWtB/9IhqKwUHoUg5rPtYsyQBoWqAFBfS68FP91yv5KH0Y1sQ3SbN11+1d2U +uk0gQaV9TqLa51/8Za6C8Sig7UdwArEmuEmIJhj0Jux6QxF6th9Dpnrd4Bxtm42T +lnEMSvSB3vbyDk1Q+WJKblpJWQKBgQDJzgBJDGuj7LJrMaGqLjRshOoCyYbBjVsO +3GX24Vm1eO9SSOEpucoqf7hswnKx+/h1GPCxTife9/qobgGV64L7CMSrQviIC39l +GlUGyh1onGEZB/0xLjswuocRBU9qX88zRwpanqctxMtxD/36k2IP6ru4acvrryKD +lWla01Sp2QKBgGkuKH7VFqmdRpBisTG6vbMZgt5I1HbVbq0gL3HXIFv0Gifj9nuP +fy5fShAKKLITJC8O7XZ01zYbIZy6woCy04fHXyEe7HS0lrZ1wLmFj4fL38uKwcwT +3MpULZAN7w+m0cR3b2+2g0/XW/G/yUuIFjQaBsmSgXGACHdEgyuhtsi5AoGASLKu +RaJ00Gu/ZoBNpdnZRtKm3nQs2GMMz5C0JrjNsWMsi673dimY27CBBqUR3m5P9hcS +9jyafmdE5BIk/hYGbFqfRrbsg03pCcnvoW+EIqBbFkJbgrEN36MCby5DiqWTJfzM +jRKkVQeU5lkFfJRFekhscaWjMXc47sAPYQnKcRkCgYEAsHhU/aUtLUnSDgqrmRoC +VBxeCBa3/pMlBuiiRRMKvjMp+h0eGmgP0sP549d+PGBjkAu7Bp1szWUuB19OcULy +c33XAFdeZScLL1E3eMRVX4LwfJ5ZlUBrd3fv5R2X9D0TrAcHaGEVVHhkwRlhi69W +AcJ+zYua3ZDxmpZtCgGomOA= +-----END PRIVATE KEY-----` + +export const LOCAL_HTTPS_TEST_CERTIFICATE = `-----BEGIN CERTIFICATE----- +MIIDJTCCAg2gAwIBAgIUIw41Eu7j9W1oTBKtoStG2UbRdUIwDQYJKoZIhvcNAQEL +BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDcxMzA2MzAxN1oXDTM2MDcx +MDA2MzAxN1owFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF +AAOCAQ8AMIIBCgKCAQEAo5GG6KvwQzMRodI2HngBJ4R+OuryTtjUyLAwGqoVQ8V0 +lqoHKjx4QF0tyOAgswbkwSjAn2ZxS4zn+v/vJhoTLFlJoJHIWdt36OZLM24LJcfm +7tDQE9eDgLg9BOazRCcBgNlu4t2t5NVC100lKRPVtXcUC0My0plyCmEk9UmnYt/6 +rbopHEFtRPS8m9YLn94L5vox0s1IjN94HiV+szZHd31/rnNqDZJvrRaOzpedgPvn +EiKsQfDAqq31DYSEss7uDs53vW7AqFnaFuGi1/l1VUcPWPJ1PXCL7fPB9WvaAoax +vuaF1NeuqQHSmbwFFeuX4v8t8N5XYCruSF5PkSftcQIDAQABo28wbTAdBgNVHQ4E +FgQUCmY8mF92kNqEbWlJ15z7Y1qq8wcwHwYDVR0jBBgwFoAUCmY8mF92kNqEbWlJ +15z7Y1qq8wcwDwYDVR0TAQH/BAUwAwEB/zAaBgNVHREEEzARgglsb2NhbGhvc3SH +BH8AAAEwDQYJKoZIhvcNAQELBQADggEBACidMu/gBoJozW/HwWzU924fHndhnZRV +nhzR1JWB1/7DaeC1ePJYs6eRKe+A7mV1qxPXDMpMqzv3KAo4WirDW8y4rsM/sp5w +C2qTGbo+nF6u4tX6p9RQnN4HPeJfGXOtOfkyXK7M7C7O+Rzo3RdJmZZk8GBWe0+q +vYIIvbLmC4zRFLL2Mp8fPlW7VeQWl8u+2nXQrC/0oOGN7cXjtsj8Dcu6939srMW/ +6KiypTji5Idkn7HK2qq4Obbzbet8euWabhMZ3N5+tAcWHvJoNy6wGQlBZmZaPbQD +6LnMrP0J7dmEcShy5MXhNp6BFQ9jkhGVkIxk3fRtHFO9vDPYbdo0Pho= +-----END CERTIFICATE-----` diff --git a/tests/e2e/helpers/local-https-test-server.ts b/tests/e2e/helpers/local-https-test-server.ts new file mode 100644 index 00000000000..b2c99fa4ea1 --- /dev/null +++ b/tests/e2e/helpers/local-https-test-server.ts @@ -0,0 +1,162 @@ +import { createServer as createHttpServer, type Server } from 'node:http' +import { createServer as createHttpsServer } from 'node:https' +import type { AddressInfo } from 'node:net' +import { WebSocketServer } from 'ws' + +import { + LOCAL_HTTPS_TEST_CERTIFICATE, + LOCAL_HTTPS_TEST_PRIVATE_KEY +} from './local-https-test-certificate' + +export type LocalHttpsServer = { + secureUrl: string + schemeLessUrl: string + documentRequestCount: () => number + assetRequestCount: () => number + webSocketConnectionCount: () => number + close: () => Promise +} + +export type LocalHttpProbeServer = { + url: string + close: () => Promise +} + +function closeServer(server: Server): Promise { + return new Promise((resolve, reject) => + server.close((error) => { + if (error) { + reject(error) + return + } + resolve() + }) + ) +} + +export async function startLocalHttpsServer(): Promise { + let documentRequestCount = 0 + let assetRequestCount = 0 + let webSocketConnectionCount = 0 + let secureOrigin = '' + const server = createHttpsServer( + { key: LOCAL_HTTPS_TEST_PRIVATE_KEY, cert: LOCAL_HTTPS_TEST_CERTIFICATE }, + (request, response) => { + const requestUrl = new URL(request.url ?? '/', secureOrigin) + if (requestUrl.pathname === '/asset.svg') { + assetRequestCount += 1 + response.writeHead(200, { + 'Cache-Control': 'no-store', + 'Content-Type': 'image/svg+xml; charset=utf-8' + }) + response.end('') + return + } + // Why: count only the root document. Favicon/probes would inflate the + // document counter and flake exact E2E request-count assertions. + if (requestUrl.pathname !== '/') { + response.writeHead(404) + response.end() + return + } + documentRequestCount += 1 + const socketUrl = `${secureOrigin.replace('https:', 'wss:')}/socket` + response.writeHead(200, { + 'Cache-Control': 'no-store', + 'Content-Type': 'text/html; charset=utf-8' + }) + response.end(` + + + Untrusted TLS page + +

Local HTTPS request ${documentRequestCount}

+ TLS asset + + + + `) + } + ) + const webSocketServer = new WebSocketServer({ noServer: true }) + server.on('upgrade', (request, socket, head) => { + if (request.url !== '/socket') { + socket.destroy() + return + } + webSocketServer.handleUpgrade(request, socket, head, (client) => { + webSocketServer.emit('connection', client, request) + }) + }) + webSocketServer.on('connection', (client) => { + webSocketConnectionCount += 1 + client.send('ready') + }) + + await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve)) + const port = (server.address() as AddressInfo).port + secureOrigin = `https://127.0.0.1:${port}` + + return { + secureUrl: `${secureOrigin}/`, + schemeLessUrl: `127.0.0.1:${port}/`, + documentRequestCount: () => documentRequestCount, + assetRequestCount: () => assetRequestCount, + webSocketConnectionCount: () => webSocketConnectionCount, + close: async () => { + for (const client of webSocketServer.clients) { + client.terminate() + } + await new Promise((resolve) => webSocketServer.close(() => resolve())) + await closeServer(server) + } + } +} + +export async function startLocalHttpProbeServer( + target: LocalHttpsServer +): Promise { + const assetUrl = new URL('/asset.svg', target.secureUrl).toString() + const socketUrl = new URL('/socket', target.secureUrl).toString().replace('https:', 'wss:') + const server = createHttpServer((_request, response) => { + response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }) + response.end(` + + + Sibling TLS probe + +

Sibling TLS probe

+ Sibling TLS asset + + + + `) + }) + await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve)) + const port = (server.address() as AddressInfo).port + return { url: `http://127.0.0.1:${port}/`, close: () => closeServer(server) } +} From d363c83ae33f3617797eb6065433107a482dc67c Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Thu, 16 Jul 2026 19:15:40 -0700 Subject: [PATCH 12/17] fix(worktrees): force-remove clean worktree with initialised submodule (#9096) Co-authored-by: Claude Fable 5 Co-authored-by: MarkXian --- src/main/git/remove-worktree.test.ts | 115 ++++++++++++++++++ src/main/git/worktree.ts | 17 ++- src/relay/git-handler-worktree-ops.test.ts | 111 +++++++++++++++++ src/relay/git-handler-worktree-remove.ts | 19 ++- src/shared/worktree-submodule-removal.test.ts | 39 ++++++ src/shared/worktree-submodule-removal.ts | 22 ++++ 6 files changed, 321 insertions(+), 2 deletions(-) create mode 100644 src/shared/worktree-submodule-removal.test.ts create mode 100644 src/shared/worktree-submodule-removal.ts diff --git a/src/main/git/remove-worktree.test.ts b/src/main/git/remove-worktree.test.ts index 121a8208754..c0789d1529c 100644 --- a/src/main/git/remove-worktree.test.ts +++ b/src/main/git/remove-worktree.test.ts @@ -280,6 +280,121 @@ branch refs/heads/main expect(getGitCalls()).toContain('git worktree remove --force /repo-feature') }) + it('force-retries removal when git refuses a clean worktree containing an initialised submodule', async () => { + mockGitCommands({ + 'git worktree list --porcelain': { + stdout: `worktree /repo +HEAD abc123 +branch refs/heads/main + +worktree /repo-feature +HEAD def456 +branch refs/heads/feature/test +` + }, + 'git worktree list --porcelain#2': { + stdout: `worktree /repo +HEAD abc123 +branch refs/heads/main +` + }, + 'git worktree remove /repo-feature': { + error: new Error('git worktree remove failed'), + stderr: 'fatal: working trees containing submodules cannot be moved or removed' + }, + 'git status --porcelain --untracked-files=all': { stdout: '' } + }) + + await removeWorktree('/repo', '/repo-feature') + + const calls = getGitCalls() + expectGitCallOrder( + calls, + 'git worktree remove /repo-feature', + 'git status --porcelain --untracked-files=all' + ) + expectGitCallOrder( + calls, + 'git status --porcelain --untracked-files=all', + 'git worktree remove --force /repo-feature' + ) + expect(calls).toContain('git branch -d -- feature/test') + }) + + it('surfaces uncommitted changes instead of force-removing a dirty submodule worktree', async () => { + mockGitCommands({ + 'git worktree list --porcelain': { + stdout: `worktree /repo +HEAD abc123 +branch refs/heads/main + +worktree /repo-feature +HEAD def456 +branch refs/heads/feature/test +` + }, + 'git worktree remove /repo-feature': { + error: new Error('git worktree remove failed'), + stderr: 'fatal: working trees containing submodules cannot be moved or removed' + }, + 'git status --porcelain --untracked-files=all': { stdout: ' M sub\n' } + }) + + await expect(removeWorktree('/repo', '/repo-feature')).rejects.toThrow( + 'Worktree has uncommitted or untracked changes.' + ) + expect(getGitCalls()).not.toContain('git worktree remove --force /repo-feature') + }) + + it('does not force-retry when the caller already forced removal', async () => { + mockGitCommands({ + 'git worktree list --porcelain': { + stdout: `worktree /repo +HEAD abc123 +branch refs/heads/main + +worktree /repo-feature +HEAD def456 +branch refs/heads/feature/test +` + }, + 'git worktree remove --force /repo-feature': { + error: new Error('git worktree remove failed'), + stderr: 'fatal: working trees containing submodules cannot be moved or removed' + } + }) + + await expect(removeWorktree('/repo', '/repo-feature', true)).rejects.toThrow() + expect( + getGitCalls().filter((call) => call === 'git worktree remove --force /repo-feature') + ).toHaveLength(1) + }) + + it('does not force-retry unrelated non-force remove failures', async () => { + mockGitCommands({ + 'git worktree list --porcelain': { + stdout: `worktree /repo +HEAD abc123 +branch refs/heads/main + +worktree /repo-feature +HEAD def456 +branch refs/heads/feature/test +` + }, + 'git worktree remove /repo-feature': { + error: new Error('git worktree remove failed'), + stderr: 'fatal: contains modified or untracked files, use --force to delete it' + } + }) + + await expect(removeWorktree('/repo', '/repo-feature')).rejects.toThrow( + 'git worktree remove failed' + ) + expect(getGitCalls()).not.toContain('git worktree remove --force /repo-feature') + expect(getGitCalls()).not.toContain('git status --porcelain --untracked-files=all') + }) + it('rejects a locked worktree with stable app-owned copy before invoking remove', async () => { mockGitCommands({ 'git worktree list --porcelain': { diff --git a/src/main/git/worktree.ts b/src/main/git/worktree.ts index 8823c683b60..84ce3963192 100644 --- a/src/main/git/worktree.ts +++ b/src/main/git/worktree.ts @@ -14,6 +14,7 @@ import type { RemoveWorktreeResult } from '../../shared/types' import { assertWorktreeUnlockedForRemoval } from '../../shared/worktree-removal' +import { isSubmoduleWorktreeRemovalRefusal } from '../../shared/worktree-submodule-removal' import { decodeGitCQuotedPath } from '../../shared/git-cquoted-path' import { parseGitRevListAheadBehindCounts } from '../../shared/git-rev-list-output' import { parseWslUncPath } from '../../shared/wsl-paths' @@ -1221,7 +1222,21 @@ async function performRemoveWorktree( args.push('--force') } args.push(worktreePath) - await gitExecFileAsync(args, gitExecOptions(repoPath, options)) + try { + await gitExecFileAsync(args, gitExecOptions(repoPath, options)) + } catch (error) { + if (force || !isSubmoduleWorktreeRemovalRefusal(error)) { + throw error + } + // Why: Git refuses non-force removal of any worktree with an initialised + // submodule even when everything is clean. Re-prove cleanliness (parent + // status reports dirty submodule content as ` M `), then --force. + await assertWorktreeCleanForRemoval(worktreePath, false, options) + await gitExecFileAsync( + ['worktree', 'remove', '--force', worktreePath], + gitExecOptions(repoPath, options) + ) + } if (!branchName) { return {} diff --git a/src/relay/git-handler-worktree-ops.test.ts b/src/relay/git-handler-worktree-ops.test.ts index ed252df6a46..cedcf8b797c 100644 --- a/src/relay/git-handler-worktree-ops.test.ts +++ b/src/relay/git-handler-worktree-ops.test.ts @@ -196,6 +196,117 @@ describe('removeWorktreeOp', () => { ]) }) + it('force-retries removal when git refuses a clean worktree containing an initialised submodule', async () => { + const calls: string[] = [] + let listCount = 0 + const git = vi.fn(async (args, cwd) => { + calls.push(`${cwd}$ ${args.join(' ')}`) + if (args[0] === 'rev-parse') { + return { stdout: '/repo/.git\n', stderr: '' } + } + if (args[0] === 'worktree' && args[1] === 'list') { + listCount += 1 + return { + stdout: + listCount === 1 + ? worktreeList( + { path: '/repo', branch: 'main' }, + { path: '/repo-feature', branch: 'feature/test' } + ) + : worktreeList({ path: '/repo', branch: 'main' }), + stderr: '' + } + } + if (args[0] === 'worktree' && args[1] === 'remove' && !args.includes('--force')) { + throw Object.assign(new Error('git worktree remove failed'), { + stderr: 'fatal: working trees containing submodules cannot be moved or removed' + }) + } + return { stdout: '', stderr: '' } + }) + + await removeWorktreeWithCapabilityCache(git, { worktreePath: '/repo-feature' }) + + expect(calls).toEqual([ + '/repo-feature$ rev-parse --git-common-dir', + `${resolvedRepoPath()}$ worktree list --porcelain -z`, + `${resolvedRepoPath()}$ worktree remove /repo-feature`, + '/repo-feature$ status --porcelain --untracked-files=all', + `${resolvedRepoPath()}$ worktree remove --force /repo-feature`, + `${resolvedRepoPath()}$ branch -d -- feature/test` + ]) + }) + + it('surfaces uncommitted changes instead of force-removing a dirty submodule worktree', async () => { + const git = vi.fn(async (args) => { + if (args[0] === 'rev-parse') { + return { stdout: '/repo/.git\n', stderr: '' } + } + if (args[0] === 'worktree' && args[1] === 'list') { + return { + stdout: worktreeList( + { path: '/repo', branch: 'main' }, + { path: '/repo-feature', branch: 'feature/test' } + ), + stderr: '' + } + } + if (args[0] === 'worktree' && args[1] === 'remove') { + throw Object.assign(new Error('git worktree remove failed'), { + stderr: 'fatal: working trees containing submodules cannot be moved or removed' + }) + } + if (args[0] === 'status') { + return { stdout: ' M sub\n', stderr: '' } + } + return { stdout: '', stderr: '' } + }) + + await expect( + removeWorktreeWithCapabilityCache(git, { worktreePath: '/repo-feature' }) + ).rejects.toThrow('Worktree has uncommitted or untracked changes.') + expect(git).not.toHaveBeenCalledWith( + ['worktree', 'remove', '--force', '/repo-feature'], + expect.any(String) + ) + }) + + it('does not force-retry when the caller already forced SSH removal', async () => { + const git = vi.fn(async (args) => { + if (args[0] === 'rev-parse') { + return { stdout: '/repo/.git\n', stderr: '' } + } + if (args[0] === 'worktree' && args[1] === 'list') { + return { + stdout: worktreeList( + { path: '/repo', branch: 'main' }, + { path: '/repo-feature', branch: 'feature/test' } + ), + stderr: '' + } + } + if (args[0] === 'worktree' && args[1] === 'remove') { + throw Object.assign(new Error('git worktree remove failed'), { + stderr: 'fatal: working trees containing submodules cannot be moved or removed' + }) + } + return { stdout: '', stderr: '' } + }) + + await expect( + removeWorktreeWithCapabilityCache(git, { worktreePath: '/repo-feature', force: true }) + ).rejects.toThrow('git worktree remove failed') + expect( + git.mock.calls.filter( + ([args]) => args[0] === 'worktree' && args[1] === 'remove' && args.includes('--force') + ) + ).toHaveLength(1) + expect(git).not.toHaveBeenCalledWith( + ['status', '--porcelain', '--untracked-files=all'], + expect.any(String) + ) + }) + it('preserves the branch (does not throw) when `branch -d` refuses an unmerged branch', async () => { let listCount = 0 const git = vi.fn(async (args) => { diff --git a/src/relay/git-handler-worktree-remove.ts b/src/relay/git-handler-worktree-remove.ts index 2c2ce54a8cc..46ebaf8a355 100644 --- a/src/relay/git-handler-worktree-remove.ts +++ b/src/relay/git-handler-worktree-remove.ts @@ -1,6 +1,7 @@ import * as path from 'node:path' import type { RemoveWorktreeResult } from '../shared/types' import { assertWorktreeUnlockedForRemoval } from '../shared/worktree-removal' +import { isSubmoduleWorktreeRemovalRefusal } from '../shared/worktree-submodule-removal' import { deleteAlreadyMergedRelayBranchAfterSafeDeleteFailure } from './git-handler-branch-cleanup' import type { GitExec } from './git-handler-ops' import type { GitCapabilityCache } from '../shared/git-capability-cache' @@ -156,7 +157,23 @@ export async function removeWorktreeOp( args.push('--force') } args.push(worktreePath) - await git(args, repoPath) + try { + await git(args, repoPath) + } catch (error) { + if (force || !isSubmoduleWorktreeRemovalRefusal(error)) { + throw error + } + // Why: Git refuses non-force removal of any worktree with an initialised + // submodule even when everything is clean. Re-prove cleanliness (parent + // status reports dirty submodule content as ` M `), then --force. + const { stdout } = await git(['status', '--porcelain', '--untracked-files=all'], worktreePath) + if (stdout.trim()) { + const dirtyError = new Error('Worktree has uncommitted or untracked changes.') + ;(dirtyError as Error & { stdout?: string }).stdout = stdout + throw dirtyError + } + await git(['worktree', 'remove', '--force', worktreePath], repoPath) + } if (!branchName) { return {} diff --git a/src/shared/worktree-submodule-removal.test.ts b/src/shared/worktree-submodule-removal.test.ts new file mode 100644 index 00000000000..0c8564b79d3 --- /dev/null +++ b/src/shared/worktree-submodule-removal.test.ts @@ -0,0 +1,39 @@ +import { describe, expect, it } from 'vitest' +import { isSubmoduleWorktreeRemovalRefusal } from './worktree-submodule-removal' + +describe('isSubmoduleWorktreeRemovalRefusal', () => { + it('matches the English git fatal on stderr', () => { + expect( + isSubmoduleWorktreeRemovalRefusal( + Object.assign(new Error('git worktree remove failed'), { + stderr: 'fatal: working trees containing submodules cannot be moved or removed\n' + }) + ) + ).toBe(true) + }) + + it('matches when the refusal is only in the error message', () => { + expect( + isSubmoduleWorktreeRemovalRefusal( + new Error('fatal: working trees containing submodules cannot be moved or removed') + ) + ).toBe(true) + }) + + it('does not match dirty-worktree or lock refusals', () => { + expect( + isSubmoduleWorktreeRemovalRefusal( + Object.assign(new Error('git worktree remove failed'), { + stderr: 'fatal: contains modified or untracked files, use --force to delete it' + }) + ) + ).toBe(false) + expect( + isSubmoduleWorktreeRemovalRefusal( + Object.assign(new Error('git worktree remove failed'), { + stderr: 'fatal: cannot remove a locked working tree' + }) + ) + ).toBe(false) + }) +}) diff --git a/src/shared/worktree-submodule-removal.ts b/src/shared/worktree-submodule-removal.ts new file mode 100644 index 00000000000..8a6f91a2cf8 --- /dev/null +++ b/src/shared/worktree-submodule-removal.ts @@ -0,0 +1,22 @@ +function getErrorText(error: unknown): string { + if (typeof error === 'object' && error !== null) { + const parts: string[] = [] + for (const field of ['message', 'stderr', 'stdout'] as const) { + const value = (error as Record)[field] + if (typeof value === 'string' && value) { + parts.push(value) + } + } + return parts.join('\n') + } + return String(error) +} + +// Why: `git worktree remove` (non-force) categorically refuses any worktree +// containing an initialised submodule, even when parent and submodule are +// fully clean (validate_no_submodules, Git >= 2.17). Callers re-prove +// cleanliness and retry with --force. Both the local runner and the relay pin +// English git output (UNTRANSLATED_GIT_OUTPUT_ENV), so text matching is stable. +export function isSubmoduleWorktreeRemovalRefusal(error: unknown): boolean { + return /working trees containing submodules cannot be moved or removed/i.test(getErrorText(error)) +} From 53af61160a8f2074cde9851c470b1c991f4479e4 Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Thu, 16 Jul 2026 19:20:05 -0700 Subject: [PATCH 13/17] fix(settings): keep Shortcuts rows visible on pane-title-only search (#9097) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: 조재중 <126754298+m-a-king@users.noreply.github.com> --- .../settings/ShortcutCommandBlock.tsx | 3 ++ .../settings/ShortcutFilterRail.test.ts | 35 +++++++++++++++ .../settings/ShortcutFilterRail.tsx | 13 +++++- .../src/components/settings/ShortcutsPane.tsx | 5 ++- .../settings-search-shortcuts-pane.spec.ts | 43 +++++++++++++++++++ 5 files changed, 96 insertions(+), 3 deletions(-) create mode 100644 tests/e2e/settings-search-shortcuts-pane.spec.ts diff --git a/src/renderer/src/components/settings/ShortcutCommandBlock.tsx b/src/renderer/src/components/settings/ShortcutCommandBlock.tsx index 853e6ae3c62..c4eaa9cbe84 100644 --- a/src/renderer/src/components/settings/ShortcutCommandBlock.tsx +++ b/src/renderer/src/components/settings/ShortcutCommandBlock.tsx @@ -106,6 +106,8 @@ export function ShortcutCommandBlock({ /> ) + // Why: ShortcutsPane already filters rows against the global query; + // forceVisible skips the re-match here that would hide rows it kept. return (
diff --git a/src/renderer/src/components/settings/ShortcutFilterRail.test.ts b/src/renderer/src/components/settings/ShortcutFilterRail.test.ts index d979415798a..8dd6a039010 100644 --- a/src/renderer/src/components/settings/ShortcutFilterRail.test.ts +++ b/src/renderer/src/components/settings/ShortcutFilterRail.test.ts @@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest' import type { KeybindingActionId } from '../../../../shared/keybindings' import { SHORTCUT_LOCAL_SEARCH_QUERY_MAX_BYTES, + buildShortcutGlobalSearchMatcher, isShortcutLocalSearchQueryTooLarge, matchesShortcutLocalSearch, normalizeShortcutLocalSearchQuery, @@ -52,6 +53,40 @@ describe('ShortcutFilterRail search helpers', () => { expect(normalizeShortcutLocalSearchQuery(query)).toBeNull() }) + it('narrows rows when the global settings query matches specific rows', () => { + const settingsRow = createShortcutRow() + const worktreeRow: ShortcutRowModel = { + ...createShortcutRow(), + item: { + ...createShortcutRow().item, + id: 'worktree.create' as KeybindingActionId, + title: 'Create worktree', + searchKeywords: ['worktree', 'create'] + } + } + + const matcher = buildShortcutGlobalSearchMatcher([settingsRow, worktreeRow], 'worktree') + + expect(matcher(settingsRow)).toBe(false) + expect(matcher(worktreeRow)).toBe(true) + }) + + it('keeps every row visible on a pane-title-only global query', () => { + const rows = [createShortcutRow()] + + // Mirrors sidebar search selecting the pane with a query that matches only + // pane-level metadata (e.g. a localized pane title) and no row metadata. + const matcher = buildShortcutGlobalSearchMatcher(rows, '단축키') + + expect(matcher(rows[0])).toBe(true) + }) + + it('keeps every row visible when the global query is empty', () => { + const rows = [createShortcutRow()] + + expect(buildShortcutGlobalSearchMatcher(rows, '')(rows[0])).toBe(true) + }) + it('rejects oversized pasted shortcut searches before reading row metadata', () => { const oversizedQuery = 'secret-shortcut-search'.repeat(SHORTCUT_LOCAL_SEARCH_QUERY_MAX_BYTES) const row = { diff --git a/src/renderer/src/components/settings/ShortcutFilterRail.tsx b/src/renderer/src/components/settings/ShortcutFilterRail.tsx index 76445a67e9a..222127f88ed 100644 --- a/src/renderer/src/components/settings/ShortcutFilterRail.tsx +++ b/src/renderer/src/components/settings/ShortcutFilterRail.tsx @@ -6,7 +6,7 @@ import { cn } from '../../lib/utils' import { Button } from '../ui/button' import { Input } from '../ui/input' import type { ShortcutTerminalStatus } from './shortcut-terminal-status' -import type { SettingsSearchEntry } from './settings-search' +import { matchesSettingsSearch, type SettingsSearchEntry } from './settings-search' import { translate } from '@/i18n/i18n' export type ShortcutFilter = 'all' | 'modified' | 'unassigned' | 'conflicts' @@ -60,6 +60,17 @@ export function getShortcutSearchEntry(row: ShortcutRowModel): SettingsSearchEnt } } +// Why: a sidebar query can select this pane by title alone while matching zero +// rows; that would blank the list, so zero-row queries keep every row visible. +export function buildShortcutGlobalSearchMatcher( + rows: readonly ShortcutRowModel[], + searchQuery: string +): (row: ShortcutRowModel) => boolean { + const rowMatches = (row: ShortcutRowModel): boolean => + matchesSettingsSearch(searchQuery, getShortcutSearchEntry(row)) + return rows.some(rowMatches) ? rowMatches : () => true +} + export function matchesShortcutFilter(row: ShortcutRowModel, filter: ShortcutFilter): boolean { switch (filter) { case 'modified': diff --git a/src/renderer/src/components/settings/ShortcutsPane.tsx b/src/renderer/src/components/settings/ShortcutsPane.tsx index b6fe5b3556c..29f9661d196 100644 --- a/src/renderer/src/components/settings/ShortcutsPane.tsx +++ b/src/renderer/src/components/settings/ShortcutsPane.tsx @@ -25,7 +25,7 @@ import { sameBindings } from './keybinding-override-edits' import { - getShortcutSearchEntry, + buildShortcutGlobalSearchMatcher, matchesShortcutFilter, matchesShortcutLocalSearch, normalizeShortcutLocalSearchQuery, @@ -138,9 +138,10 @@ export function ShortcutsPane(): React.JSX.Element { ) const shortcutSearchQuery = normalizeShortcutLocalSearchQuery(shortcutQuery) const shortcutRows = shortcutGroups.flatMap((group) => group.rows) + const matchesShortcutGlobalSearch = buildShortcutGlobalSearchMatcher(shortcutRows, searchQuery) const matchesShortcutSearch = (row: ShortcutRowsByGroup['rows'][number]): boolean => shortcutSearchQuery !== null && - matchesSettingsSearch(searchQuery, getShortcutSearchEntry(row)) && + matchesShortcutGlobalSearch(row) && matchesShortcutLocalSearch(row, shortcutSearchQuery, platform) const baseVisibleRows = shortcutRows.filter((row) => matchesShortcutSearch(row)) const filterCounts: Record = { diff --git a/tests/e2e/settings-search-shortcuts-pane.spec.ts b/tests/e2e/settings-search-shortcuts-pane.spec.ts new file mode 100644 index 00000000000..17e8097083b --- /dev/null +++ b/tests/e2e/settings-search-shortcuts-pane.spec.ts @@ -0,0 +1,43 @@ +import { test, expect } from './helpers/orca-app' +import { waitForSessionReady } from './helpers/store' + +test.describe('Settings sidebar search on the Shortcuts pane', () => { + test('pane-title-only query keeps rows visible and local search usable', async ({ orcaPage }) => { + await waitForSessionReady(orcaPage) + + await orcaPage.evaluate(async () => { + const store = window.__store + if (!store) { + throw new Error('window.__store is not available') + } + // Why: the spec asserts on English strings; the host machine may run a + // non-English system locale, which 'system' would follow. + await store.getState().updateSettings({ uiLanguage: 'en' }) + store.getState().openSettingsPage() + }) + + const searchInput = orcaPage.getByPlaceholder('Search settings') + await expect(searchInput).toBeVisible() + await searchInput.fill('shortcuts') + + // The query matches the pane title, so the Shortcuts pane auto-activates. + await expect(orcaPage.getByRole('heading', { name: 'Shortcuts', exact: true })).toBeVisible() + + // Regression: a pane-title-only query used to blank the whole list (0/112). + await expect(orcaPage.getByText('Go to File', { exact: true })).toBeVisible() + await expect(orcaPage.getByText('No shortcuts match those filters.')).not.toBeVisible() + + // Regression: the pane's own search was dead while the global query was + // active, because it intersected with an already-empty base list. + const localSearch = orcaPage.getByPlaceholder('Search command or keys') + await localSearch.fill('go to') + await expect(orcaPage.getByText('Go to File', { exact: true })).toBeVisible() + await expect(orcaPage.getByText('Force Reload', { exact: true })).not.toBeVisible() + + // A row-matching global query still narrows the list as before. + await localSearch.clear() + await searchInput.fill('worktree') + await expect(orcaPage.getByText('Create worktree', { exact: true })).toBeVisible() + await expect(orcaPage.getByText('Go to File', { exact: true })).not.toBeVisible() + }) +}) From a7c40cd89b2fde220c04abbc24289bb38456da3b Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Thu, 16 Jul 2026 19:21:09 -0700 Subject: [PATCH 14/17] fix(terminal): stop gluing the next line onto a modifier-clicked URL (#9100) Fixes #8832. HTTP hit-testing no longer consumes path hard-wrap candidates that poisoned mid-row URLs with next-line labels. Uses soft-wrap, framed hard-wrap HTTP, and dedicated edge-wrap reconstruction instead. Supersedes #8852 (edge-wrap approach credit: @xianjianlf2). --- .../edge-wrapped-terminal-http-links.test.ts | 425 ++++++++++++++++++ .../edge-wrapped-terminal-http-links.ts | 183 ++++++++ .../repro-8832-url-next-line.test.ts | 203 +++++++++ .../terminal-url-link-click.test.ts | 38 ++ .../terminal-url-link-hit-testing.ts | 33 +- 5 files changed, 866 insertions(+), 16 deletions(-) create mode 100644 src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.test.ts create mode 100644 src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.ts create mode 100644 src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts diff --git a/src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.test.ts b/src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.test.ts new file mode 100644 index 00000000000..9289f67b7b2 --- /dev/null +++ b/src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.test.ts @@ -0,0 +1,425 @@ +import type { IBufferLine } from '@xterm/xterm' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing' +import { openHttpLinkAtBufferPosition } from './terminal-url-link-hit-testing' + +const COLS = 40 +const WIDE_GLYPH = '界' +const openUrlMock = vi.fn() + +function makeBufferLine(content: string, cols = COLS): IBufferLine { + return makeBufferLineFromCells( + Array.from(content, (text) => ({ text, width: text === WIDE_GLYPH ? 2 : 1 })), + cols + ) +} + +function makeBufferLineFromCells( + cells: { text: string; width: number }[], + cols = COLS +): IBufferLine { + const columns: number[] = [] + let column = 0 + let text = '' + for (const cell of cells) { + text += cell.text + for (let index = 0; index < cell.text.length; index++) { + columns.push(column) + } + column += cell.width + } + while (column < cols) { + text += ' ' + columns.push(column) + column++ + } + columns.push(column) + + return { + isWrapped: false, + length: cols, + translateToString: ( + _trimRight?: boolean, + startColumn = 0, + endColumn = text.length, + outColumns?: number[] + ) => { + outColumns?.splice(0, outColumns.length, ...columns.slice(startColumn, endColumn + 1)) + return text.slice(startColumn, endColumn) + } + } as IBufferLine +} + +describe('edge-wrapped terminal HTTP links', () => { + beforeEach(() => { + vi.stubGlobal('window', { api: { shell: { openUrl: openUrlMock } } }) + registerHttpLinkStoreAccessor(() => ({ + settings: { openLinksInApp: false }, + setActiveWorktree: vi.fn(), + createBrowserTab: vi.fn() + })) + openUrlMock.mockReset() + }) + + afterEach(() => { + vi.unstubAllGlobals() + }) + + it('opens a URL when a wide glyph starts the continuation row', () => { + const prefix = 'https://example.com/wide/' + const firstRow = `${prefix}${'c'.repeat(COLS - 1 - prefix.length)}` + const continuationRow = `${WIDE_GLYPH}tail` + const expectedUrl = new URL(`${firstRow}${continuationRow}`).toString() + const rows = [makeBufferLine(firstRow), makeBufferLine(continuationRow)] + const buffer = { getLine: (y: number) => rows[y] } + + expect( + openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(expectedUrl) + + openUrlMock.mockReset() + expect( + openHttpLinkAtBufferPosition(buffer, { x: 3, y: 2 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(expectedUrl) + }) + + it('opens a URL when a multi-code-point wide cell starts the continuation row', () => { + const wideCell = '👩‍💻' + const prefix = 'https://example.com/wide/' + const firstRow = `${prefix}${'c'.repeat(COLS - 1 - prefix.length)}` + const continuationRow = `${wideCell}tail` + const expectedUrl = new URL(`${firstRow}${continuationRow}`).toString() + const rows = [ + makeBufferLine(firstRow), + makeBufferLineFromCells([ + { text: wideCell, width: 2 }, + ...Array.from('tail', (text) => ({ text, width: 1 })) + ]) + ] + const buffer = { getLine: (y: number) => rows[y] } + + expect( + openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(expectedUrl) + + openUrlMock.mockReset() + expect( + openHttpLinkAtBufferPosition(buffer, { x: 1, y: 2 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(expectedUrl) + }) + + it('does not use the wide-glyph tolerance for an ASCII continuation row', () => { + const firstRow = `https://example.com/${'a'.repeat(COLS - 1 - 'https://example.com/'.length)}` + const rows = [makeBufferLine(firstRow), makeBufferLine('next')] + const buffer = { getLine: (y: number) => rows[y] } + + expect( + openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(firstRow) + + openUrlMock.mockReset() + expect( + openHttpLinkAtBufferPosition(buffer, { x: 2, y: 2 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(false) + expect(openUrlMock).not.toHaveBeenCalled() + }) + + it.each(['Description: 123', 'Description:', '404: Not Found', 'HTTP/2: 200', 'HTTP/2:200'])( + 'does not append a %s label when a complete URL ends at the terminal edge', + (labelRow) => { + const firstRow = `https://example.com/${'a'.repeat(COLS - 1 - 'https://example.com/'.length)}/` + const rows = [makeBufferLine(firstRow), makeBufferLine(labelRow)] + const buffer = { getLine: (y: number) => rows[y] } + + expect(firstRow).toHaveLength(COLS) + expect( + openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(firstRow) + + openUrlMock.mockReset() + expect( + openHttpLinkAtBufferPosition(buffer, { x: 2, y: 2 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(false) + expect(openUrlMock).not.toHaveBeenCalled() + } + ) + + it('does not append an adjacent URL that starts on the next row', () => { + const firstRow = `https://example.com/${'a'.repeat(COLS - 'https://example.com/'.length)}` + const secondRow = 'https://two.test/path' + const rows = [makeBufferLine(firstRow), makeBufferLine(secondRow)] + const buffer = { getLine: (y: number) => rows[y] } + + expect( + openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(firstRow) + + openUrlMock.mockReset() + expect( + openHttpLinkAtBufferPosition(buffer, { x: 11, y: 2 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(secondRow) + }) + + it('keeps a full-width continuation row that ends in a colon', () => { + const prefix = 'https://example.com/' + const firstRow = `${prefix}${'a'.repeat(COLS - prefix.length)}` + const secondRow = `${'b'.repeat(COLS - 1)}:` + const thirdRow = 'tail' + const expectedUrl = new URL(`${firstRow}${secondRow}${thirdRow}`).toString() + const rows = [makeBufferLine(firstRow), makeBufferLine(secondRow), makeBufferLine(thirdRow)] + const buffer = { getLine: (y: number) => rows[y] } + + expect( + openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(expectedUrl) + + openUrlMock.mockReset() + expect( + openHttpLinkAtBufferPosition(buffer, { x: 20, y: 2 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(expectedUrl) + }) + + it('keeps a short colon-bearing URL continuation', () => { + const firstRow = `https://example.com/${'a'.repeat(COLS - 'https://example.com/'.length)}` + const secondRow = 'urn:abc' + const expectedUrl = `${firstRow}${secondRow}` + const rows = [makeBufferLine(firstRow), makeBufferLine(secondRow)] + const buffer = { getLine: (y: number) => rows[y] } + + expect( + openHttpLinkAtBufferPosition(buffer, { x: 4, y: 2 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(expectedUrl) + }) + + it('does not count text before the URL against the URL length limit', () => { + const cols = 200 + const prefix = `${'P'.repeat(179)} ` + const url = `https://example.com/${'a'.repeat(1_880)}` + const displayed = `${prefix}${url}` + const rowTexts = Array.from({ length: Math.ceil(displayed.length / cols) }, (_value, index) => + displayed.slice(index * cols, (index + 1) * cols) + ) + const rows = rowTexts.map((row) => makeBufferLine(row, cols)) + const buffer = { getLine: (y: number) => rows[y] } + + expect(url).toHaveLength(1_900) + expect(displayed.length).toBeGreaterThan(2_048) + expect( + openHttpLinkAtBufferPosition(buffer, { x: 191, y: 1 }, cols, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(url) + + openUrlMock.mockReset() + expect( + openHttpLinkAtBufferPosition(buffer, { x: 10, y: rows.length }, cols, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(url) + }) + + it('reconstructs a narrow-terminal URL spanning more than 20 rows from either end', () => { + const url = `https://example.com/${'a'.repeat(1_000)}` + const rowTexts = Array.from({ length: Math.ceil(url.length / COLS) }, (_value, index) => + url.slice(index * COLS, (index + 1) * COLS) + ) + const rows = rowTexts.map((row) => makeBufferLine(row)) + const buffer = { getLine: (y: number) => rows[y] } + + expect(url.length).toBeLessThanOrEqual(2_048) + expect(rowTexts.length).toBeGreaterThan(20) + expect( + openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(url) + + openUrlMock.mockReset() + expect( + openHttpLinkAtBufferPosition(buffer, { x: 5, y: rowTexts.length }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(url) + }) + + it('reconstructs a wide-glyph URL whose row span exceeds the single-width column bound', () => { + const wideCount = 1_100 + const url = `https://example.com/${WIDE_GLYPH.repeat(wideCount)}` + const rowTexts: string[] = [] + let row = '' + let width = 0 + for (const char of url) { + const charWidth = char === WIDE_GLYPH ? 2 : 1 + if (width + charWidth > COLS) { + rowTexts.push(row) + row = '' + width = 0 + } + row += char + width += charWidth + } + if (row.length > 0) { + rowTexts.push(row) + } + const rows = rowTexts.map((rowText) => makeBufferLine(rowText)) + const buffer = { getLine: (y: number) => rows[y] } + + expect(url.length).toBeLessThanOrEqual(2_048) + expect(rowTexts.length).toBeGreaterThan(Math.ceil(2_048 / COLS) + 1) + expect( + openHttpLinkAtBufferPosition(buffer, { x: 5, y: rowTexts.length }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(new URL(url).toString()) + }) + + it('joins a real multi-line URL whose continuation is a Chinese path segment', () => { + const prefix = 'https://example.com/' + const firstRow = `${prefix}${'a'.repeat(COLS - prefix.length)}` + const continuation = `${WIDE_GLYPH}文档/路径` + const expectedUrl = new URL(`${firstRow}${continuation}`).toString() + const rows = [makeBufferLine(firstRow), makeBufferLine(continuation)] + const buffer = { getLine: (y: number) => rows[y] } + + expect(firstRow).toHaveLength(COLS) + expect( + openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(expectedUrl) + }) + + it('does not glue a mid-row URL to a next-line Windows path', () => { + const firstRow = 'Repo: https://example.com/repo/' + const secondRow = 'C:\\Users\\demo\\project\\file.ts' + const rows = [makeBufferLine(firstRow), makeBufferLine(secondRow)] + const buffer = { getLine: (y: number) => rows[y] } + + expect( + openHttpLinkAtBufferPosition(buffer, { x: firstRow.indexOf('https') + 8, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith('https://example.com/repo/') + }) + + it('does not create an edge candidate for a scheme embedded in a word', () => { + const embeddedUrl = `abchttps://example.com/${'a'.repeat( + COLS - 'abchttps://example.com/'.length + )}` + const rows = [makeBufferLine(embeddedUrl), makeBufferLine('tail')] + const buffer = { getLine: (y: number) => rows[y] } + + expect( + openHttpLinkAtBufferPosition(buffer, { x: 10, y: 1 }, COLS, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(false) + expect(openUrlMock).not.toHaveBeenCalled() + }) + + it('keeps a URL under the length limit when its final row also contains a label', () => { + const cols = 200 + const url = `https://example.com/${'a'.repeat(2_020)}` + const displayed = `${url} ${'L'.repeat(159)}` + const rowTexts = Array.from({ length: Math.ceil(displayed.length / cols) }, (_value, index) => + displayed.slice(index * cols, (index + 1) * cols) + ) + const rows = rowTexts.map((row) => makeBufferLine(row, cols)) + const buffer = { getLine: (y: number) => rows[y] } + + expect(url).toHaveLength(2_040) + expect(rowTexts).toHaveLength(11) + expect(rowTexts.at(-1)).toHaveLength(cols) + expect( + openHttpLinkAtBufferPosition(buffer, { x: 10, y: 1 }, cols, { + worktreeId: 'wt-1', + forceSystemBrowser: true + }) + ).toBe(true) + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(url) + }) +}) diff --git a/src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.ts b/src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.ts new file mode 100644 index 00000000000..48e10fabedd --- /dev/null +++ b/src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.ts @@ -0,0 +1,183 @@ +import type { IBufferLine } from '@xterm/xterm' +import { TERMINAL_HTTP_URL_MAX_LENGTH } from './terminal-http-link-limits' +import { translateLineWithColumns, type WrappedLogicalLine } from './wrapped-terminal-link-ranges' + +const HTTP_SCHEME_PATTERN = /https?:\/\//i +const HTTP_SCHEME_START_PATTERN = /^https?:\/\//i +const HTTP_STATUS_ROW_PATTERN = /^HTTP\/\d(?:\.\d)?:\d{3}(?:\s|$)/i +const VERTICAL_LAYOUT_FRAME_PATTERN = /[│┃║╎╏┆┇┊┋|]/ +const EMPTY_LABEL_ROW_PATTERN = /^[^\s:][^:]*:$/ +const LABEL_WITH_SPACING_ROW_PATTERN = /^[^\s:][^:]*:\s/ + +function maxEdgeWrappedHttpRows(lineLength: number): number { + // Why: every continued row reaches the terminal edge, so even all-width-2 + // cells carry at least floor(columns / 2) characters per row; the URL length + // limit then bounds the scan without truncating URLs on narrow terminals. + // The +2 covers the start and tail rows, which may hold only a fragment. + const minCharsPerFullRow = Math.max(1, Math.floor(lineLength / 2)) + return Math.ceil(TERMINAL_HTTP_URL_MAX_LENGTH / minCharsPerFullRow) + 2 +} + +type TrimmedTranslatedLine = { + text: string + sourceText: string + columns: number[] + lineLength: number +} + +function trimRightTranslatedLine(line: IBufferLine): TrimmedTranslatedLine | null { + const translated = translateLineWithColumns(line) + let endIndex = translated.text.length + while (endIndex > 0 && /\s/.test(translated.text[endIndex - 1])) { + endIndex-- + } + if (endIndex === 0) { + return null + } + return { + text: translated.text.slice(0, endIndex), + sourceText: translated.text, + columns: translated.columns.slice(0, endIndex + 1), + lineLength: line.length + } +} + +function firstCellWidth(row: TrimmedTranslatedLine): number { + const firstColumn = row.columns[0] + if (firstColumn === undefined) { + return 0 + } + const nextColumn = row.columns.find((column) => column > firstColumn) + return nextColumn === undefined ? 0 : nextColumn - firstColumn +} + +function isAsciiWordCode(code: number): boolean { + return ( + (code >= 48 && code <= 57) || + (code >= 65 && code <= 90) || + code === 95 || + (code >= 97 && code <= 122) + ) +} + +function findHttpSchemeIndex(text: string): number { + let searchStart = 0 + while (searchStart < text.length) { + const relativeIndex = text.slice(searchStart).search(HTTP_SCHEME_PATTERN) + if (relativeIndex === -1) { + return -1 + } + const schemeIndex = searchStart + relativeIndex + if (schemeIndex === 0 || !isAsciiWordCode(text.charCodeAt(schemeIndex - 1))) { + return schemeIndex + } + searchStart = schemeIndex + 1 + } + return -1 +} + +function rowsCanContinueAtTerminalEdge( + row: WrappedLogicalLine['rows'][number], + nextRow: TrimmedTranslatedLine +): boolean { + // Why: a cursor-positioned label is not URL continuation evidence even when + // the preceding URL happens to end at the terminal edge (#8832). + const nextColumnAfterText = nextRow.columns.at(-1) + const nextRowReachesEdge = + nextColumnAfterText !== undefined && nextColumnAfterText >= nextRow.lineLength + const isLabelRow = + LABEL_WITH_SPACING_ROW_PATTERN.test(nextRow.text) || + ((EMPTY_LABEL_ROW_PATTERN.test(nextRow.text) || HTTP_STATUS_ROW_PATTERN.test(nextRow.text)) && + !nextRowReachesEdge) + if (isLabelRow || HTTP_SCHEME_START_PATTERN.test(nextRow.text)) { + return false + } + const columnAfterText = row.columns.at(-1) + if (columnAfterText === undefined || columnAfterText < row.lineLength - 1) { + return false + } + return columnAfterText >= row.lineLength || firstCellWidth(nextRow) > 1 +} + +export function buildEdgeWrappedHttpLogicalLineCandidates( + buffer: { getLine(y: number): IBufferLine | undefined }, + bufferLineNumber: number +): WrappedLogicalLine[] { + // Why: cursor-positioned output lacks xterm wrap metadata, but an HTTP URL + // may still continue when each earlier row reaches the terminal edge. + const currentY = bufferLineNumber - 1 + const currentLine = buffer.getLine(currentY) + if (!currentLine) { + return [] + } + const maxRows = maxEdgeWrappedHttpRows(currentLine.length) + + const candidates: WrappedLogicalLine[] = [] + const translatedLines = new Map() + const getTranslatedLine = (rowY: number): TrimmedTranslatedLine | null => { + if (translatedLines.has(rowY)) { + return translatedLines.get(rowY) ?? null + } + const line = buffer.getLine(rowY) + const translated = line ? trimRightTranslatedLine(line) : null + translatedLines.set(rowY, translated) + return translated + } + const minY = Math.max(0, currentY - maxRows + 1) + for (let startY = currentY; startY >= minY; startY--) { + const start = getTranslatedLine(startY) + const schemeIndex = start ? findHttpSchemeIndex(start.text) : -1 + if (!start || schemeIndex === -1 || VERTICAL_LAYOUT_FRAME_PATTERN.test(start.text)) { + continue + } + + let text = '' + const rows: WrappedLogicalLine['rows'] = [] + for (let rowY = startY; rowY < startY + maxRows; rowY++) { + const line = buffer.getLine(rowY) + const translated = getTranslatedLine(rowY) + if (!line || !translated) { + break + } + if (VERTICAL_LAYOUT_FRAME_PATTERN.test(translated.text)) { + break + } + if ( + rows.length > 0 && + !line.isWrapped && + !rowsCanContinueAtTerminalEdge(rows.at(-1)!, translated) + ) { + break + } + const fragmentStartIndex = rowY === startY ? schemeIndex : 0 + const fragment = translated.text.slice(fragmentStartIndex) + const whitespaceIndex = fragment.search(/\s/) + const possibleUrlFragmentLength = whitespaceIndex === -1 ? fragment.length : whitespaceIndex + if (text.length + possibleUrlFragmentLength > TERMINAL_HTTP_URL_MAX_LENGTH) { + break + } + + rows.push({ + y: rowY, + text: fragment, + sourceText: translated.sourceText, + columns: translated.columns.slice(fragmentStartIndex), + startIndex: text.length, + isWrapped: line.isWrapped, + lineLength: line.length + }) + text += fragment + if (rows.length > 1 && rowY >= currentY) { + candidates.push({ + text, + rows: [...rows], + fingerprint: `edge-http:${rows.map((row) => `${row.y}:${row.sourceText}`).join('\0')}` + }) + } + } + } + + return candidates.sort( + (left, right) => right.rows.length - left.rows.length || right.text.length - left.text.length + ) +} diff --git a/src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts b/src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts new file mode 100644 index 00000000000..14fbe14aa81 --- /dev/null +++ b/src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts @@ -0,0 +1,203 @@ +/** + * Issue #8832 — Cmd-click URL must not glue the next logical line. + * + * Root cause: path hard-wrap reconstruction (from #8339) still joins a URL + * suffix ending in `/` with the next row's path-like prefix. HTTP hit-testing + * must not consume those candidates; it uses soft-wrap, framed hard-wrap HTTP, + * and edge-wrap reconstruction only. + * + * Re-run: + * pnpm exec vitest run --config config/vitest.config.ts \ + * src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts + */ +import type { IBufferLine } from '@xterm/xterm' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing' +import { buildCandidateLogicalLinesForBufferPosition } from './terminal-file-link-hit-testing' +import { + extractTerminalHttpLinks, + openHttpLinkAtBufferPosition +} from './terminal-url-link-hit-testing' +import { buildHardWrappedPathLogicalLineCandidates } from './wrapped-terminal-link-ranges' + +const LINE_1 = 'Repo: https://github.com/stablyai/orca/' +const LINE_2 = 'Description: 123' +const EXPECTED_URL = 'https://github.com/stablyai/orca/' +const BUGGY_URL = 'https://github.com/stablyai/orca/Description' + +const openUrlMock = vi.fn() + +function makeBufferLine( + text: string, + options: { cols?: number; isWrapped?: boolean } = {} +): IBufferLine { + const cols = options.cols ?? Math.max(text.length, 80) + const padded = text.padEnd(cols) + return { + isWrapped: options.isWrapped ?? false, + length: cols, + getCell: () => undefined, + translateToString: ( + _trimRight?: boolean, + startColumn = 0, + endColumn = padded.length, + outColumns?: number[] + ) => { + if (outColumns) { + outColumns.length = 0 + for (let index = startColumn; index <= endColumn; index++) { + outColumns.push(index) + } + } + return padded.slice(startColumn, endColumn) + } + } as IBufferLine +} + +function twoRowBuffer( + row0: string, + row1: string, + options: { cols?: number; softWrapped?: boolean } = {} +): { getLine(y: number): IBufferLine | undefined } { + const cols = options.cols ?? 120 + const rows = [ + makeBufferLine(row0, { cols, isWrapped: false }), + makeBufferLine(row1, { cols, isWrapped: options.softWrapped === true }) + ] + return { getLine: (y: number) => rows[y] } +} + +function issueBuffer(): { getLine(y: number): IBufferLine | undefined } { + return twoRowBuffer(LINE_1, LINE_2, { cols: 120 }) +} + +function openUrlAt( + buffer: { getLine(y: number): IBufferLine | undefined }, + x: number, + y: number, + cols = 120 +) { + openUrlMock.mockReset() + const opened = openHttpLinkAtBufferPosition(buffer, { x, y }, cols, { + worktreeId: 'wt-repro-8832', + forceSystemBrowser: true + }) + return { opened, url: openUrlMock.mock.calls[0]?.[0] as string | undefined } +} + +describe('#8832 hard-wrapped path candidates glue next-line text into URLs', () => { + beforeEach(() => { + vi.stubGlobal('navigator', { userAgent: 'Macintosh' }) + vi.stubGlobal('window', { api: { shell: { openUrl: openUrlMock } } }) + registerHttpLinkStoreAccessor(() => ({ + settings: { openLinksInApp: false }, + setActiveWorktree: vi.fn(), + createBrowserTab: vi.fn() + })) + openUrlMock.mockReset() + }) + + afterEach(() => { + vi.unstubAllGlobals() + }) + + it('still builds a multi-row path candidate that concatenates Description onto the URL', () => { + // Why: documents the path-reconstruction poison that HTTP hit-testing must + // not consume. File links remain protected by existence checks. + const buffer = issueBuffer() + const candidates = buildHardWrappedPathLogicalLineCandidates(buffer, 1) + const multiRow = candidates.filter((candidate) => candidate.rows.length > 1) + + expect(multiRow.some((candidate) => candidate.text.includes('Description'))).toBe(true) + + const glued = multiRow.find((candidate) => candidate.text.includes('https://')) + expect(glued).toBeDefined() + expect(glued!.text).toContain('https://github.com/stablyai/orca/Description') + }) + + it('HTTP extraction on a path logical line still yields the glued URL', () => { + const buffer = issueBuffer() + const candidates = buildCandidateLogicalLinesForBufferPosition(buffer, 1) + const extracted = candidates.flatMap((line) => extractTerminalHttpLinks(line.text)) + + expect(extracted.map((link) => link.url)).toContain(BUGGY_URL) + const singleLineUrls = extractTerminalHttpLinks(LINE_1).map((link) => link.url) + expect(singleLineUrls).toEqual([EXPECTED_URL]) + }) + + it('openHttpLinkAtBufferPosition opens the unglued URL when Cmd-clicking the URL row', () => { + const buffer = issueBuffer() + const urlStart = LINE_1.indexOf('https://') + const { opened, url } = openUrlAt(buffer, urlStart + 10, 1) + + expect(opened).toBe(true) + expect(url).toBe(EXPECTED_URL) + expect(url).not.toBe(BUGGY_URL) + }) + + it.each([ + ['Chinese label', '说明: 中文路径/文件.ts'], + ['Windows path', 'C:\\Users\\demo\\project\\README.md'], + ['POSIX path', '/usr/local/bin/orca'], + ['relative path', './src/main/index.ts'], + ['UNC-ish path', '\\\\server\\share\\file.txt'] + ])('does not glue a mid-row URL to a next-line %s', (_label, nextLine) => { + const row0 = 'See https://example.com/docs/' + const buffer = twoRowBuffer(row0, nextLine, { cols: 100 }) + const urlStart = row0.indexOf('https://') + const { opened, url } = openUrlAt(buffer, urlStart + 8, 1) + + expect(opened).toBe(true) + expect(url).toBe('https://example.com/docs/') + expect(url).not.toMatch(/说明|Users|usr|src|server/) + }) + + it('still joins a soft-wrapped multi-line URL via native wrap metadata', () => { + const cols = 40 + const url = 'https://example.com/very/long/path/segments/that/continue/more' + const row0 = url.slice(0, cols) + const row1 = url.slice(cols) + const buffer = twoRowBuffer(row0, row1, { cols, softWrapped: true }) + const first = openUrlAt(buffer, 11, 1, cols) + const second = openUrlAt(buffer, 5, 2, cols) + + expect(first.opened).toBe(true) + expect(first.url).toBe(url) + expect(second.opened).toBe(true) + expect(second.url).toBe(url) + }) + + it('still joins an edge-wrapped multi-line URL without wrap metadata', () => { + const cols = 40 + const url = 'https://example.com/very/long/path/segments/that/continue/more' + const row0 = url.slice(0, cols) + const row1 = url.slice(cols) + expect(row0).toHaveLength(cols) + const buffer = twoRowBuffer(row0, row1, { cols, softWrapped: false }) + const first = openUrlAt(buffer, 11, 1, cols) + const second = openUrlAt(buffer, 5, 2, cols) + + expect(first.opened).toBe(true) + expect(first.url).toBe(url) + expect(second.opened).toBe(true) + expect(second.url).toBe(url) + }) + + it('does not treat file:// as an HTTP link (file routing stays separate)', () => { + const row0 = 'open file:///Users/demo/project/README.md' + const buffer = twoRowBuffer(row0, 'next: line', { cols: 100 }) + const { opened, url } = openUrlAt(buffer, row0.indexOf('file://') + 4, 1) + + expect(opened).toBe(false) + expect(url).toBeUndefined() + }) + + it('opens only the HTTP URL when a Windows path shares the same row', () => { + const row0 = 'https://example.com/a C:\\Users\\demo\\file.txt' + const buffer = twoRowBuffer(row0, 'Description: more', { cols: 100 }) + const { opened, url } = openUrlAt(buffer, 8, 1) + + expect(opened).toBe(true) + expect(url).toBe('https://example.com/a') + }) +}) diff --git a/src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts b/src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts index c8e85950da3..36b38c09a5e 100644 --- a/src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts +++ b/src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts @@ -379,6 +379,44 @@ describe('hard-wrapped terminal HTTP clicks', () => { expect(openUrlMock).toHaveBeenCalledWith('http://example.com/') }) + it('does not glue the next logical line onto a URL that ends mid-row (#8832)', () => { + const { terminal, registrations } = makeTerminal({ + cols: 80, + urlRows: ['Repo: https://github.com/stablyai/orca/', 'Description: 123'], + softWrapped: false + }) + const disposable = installHttpLinkClickFallback(terminal, { worktreeId: 'wt-1' }) + + const fallback = registrations.find( + ([name, _listener, options]) => name === 'mouseup' && options === undefined + )?.[1] + fallback!(mouseEventForRow(0)) + + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith('https://github.com/stablyai/orca/') + disposable.dispose() + }) + + it('still joins a URL hard-wrapped at the row edge without native wrap metadata', () => { + const cols = 40 + const url = 'https://example.com/very/long/path/segments/that/continue/more' + const { terminal, registrations } = makeTerminal({ + cols, + urlRows: [url.slice(0, cols), url.slice(cols)], + softWrapped: false + }) + const disposable = installHttpLinkClickFallback(terminal, { worktreeId: 'wt-1' }) + + const fallback = registrations.find( + ([name, _listener, options]) => name === 'mouseup' && options === undefined + )?.[1] + fallback!(mouseEventForRow(0)) + + expect(openUrlMock).toHaveBeenCalledOnce() + expect(openUrlMock).toHaveBeenCalledWith(url) + disposable.dispose() + }) + it('does not suppress a modifier-click when the buffer position is not an HTTP link', () => { const { terminal, registrations } = makeTerminal({ urlRows: ['not-a-link'] }) const disposable = installHttpLinkClickFallback(terminal, { worktreeId: 'wt-1' }) diff --git a/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts b/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts index bfbbe29f723..3a6e2c1f274 100644 --- a/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts +++ b/src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.ts @@ -1,10 +1,8 @@ import type { IBufferLine, IBufferRange, IDisposable, Terminal } from '@xterm/xterm' import { openHttpLink } from '@/lib/http-link-routing' -import { - buildCandidateLogicalLinesForBufferPosition, - dedupeLogicalLines -} from './terminal-file-link-hit-testing' +import { buildEdgeWrappedHttpLogicalLineCandidates } from './edge-wrapped-terminal-http-links' import { buildHardWrappedHttpLogicalLineCandidates } from './hard-wrapped-terminal-http-links' +import { dedupeLogicalLines } from './terminal-file-link-hit-testing' import { isTerminalHttpLinkActivation } from './terminal-http-link-activation' import { installTerminalLinkPtyMouseSuppression } from './terminal-link-pty-mouse-suppression' import { getTerminalBufferPositionForMouseEvent } from './terminal-mouse-buffer-position' @@ -271,7 +269,10 @@ function findHttpLinkAtBufferPosition( ? [nativeWrappedLogicalLine] : []), ...buildHardWrappedHttpLogicalLineCandidates(buffer, position.y), - ...buildCandidateLogicalLinesForBufferPosition(buffer, position.y) + ...buildEdgeWrappedHttpLogicalLineCandidates(buffer, position.y), + ...(nativeWrappedLogicalLine && nativeWrappedLogicalLine.rows.length === 1 + ? [nativeWrappedLogicalLine] + : []) ]) if (logicalLines.length === 0) { return null @@ -290,6 +291,17 @@ function findHttpLinkAtBufferPosition( return null } +function rangeContainsBufferPosition( + range: IBufferRange, + position: { x: number; y: number }, + terminalColumns: number +): boolean { + const lower = range.start.y * terminalColumns + range.start.x + const upper = range.end.y * terminalColumns + range.end.x + const current = position.y * terminalColumns + position.x + return lower <= current && current <= upper +} + export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): void { if (deps.forceSystemBrowser) { openHttpLink(url, { worktreeId: deps.worktreeId, forceSystemBrowser: true }) @@ -316,14 +328,3 @@ export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): voi openHttpLink(url, { worktreeId: deps.worktreeId, forceSystemBrowser: true }) }) } - -function rangeContainsBufferPosition( - range: IBufferRange, - position: { x: number; y: number }, - terminalColumns: number -): boolean { - const lower = range.start.y * terminalColumns + range.start.x - const upper = range.end.y * terminalColumns + range.end.x - const current = position.y * terminalColumns + position.x - return lower <= current && current <= upper -} From 539e0601d5f14b350a8ca20c408326058efa05b3 Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Thu, 16 Jul 2026 19:24:10 -0700 Subject: [PATCH 15/17] fix(github): render GitHub Enterprise PR avatars via API avatar_url (#9107) Co-authored-by: Claude Opus 4.8 (1M context) Co-authored-by: davkim1030 --- src/main/github/client.ts | 35 +++-- src/main/github/work-item-details.test.ts | 112 ++++++++++++++ src/main/github/work-item-details.ts | 138 ++++++++++++++++-- .../src/components/GitHubItemDialog.tsx | 13 +- .../src/components/PullRequestPage.tsx | 23 +-- src/renderer/src/components/TaskPage.tsx | 18 +-- .../github/github-user-avatar.test.tsx | 107 ++++++++++++++ .../components/github/github-user-avatar.tsx | 104 +++++++++++++ .../repro-8784-ghe-avatar-fallback.test.ts | 55 +++++++ src/shared/types.ts | 5 + 10 files changed, 547 insertions(+), 63 deletions(-) create mode 100644 src/renderer/src/components/github/github-user-avatar.test.tsx create mode 100644 src/renderer/src/components/github/github-user-avatar.tsx create mode 100644 src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts diff --git a/src/main/github/client.ts b/src/main/github/client.ts index 54572bd406f..ac85669836a 100644 --- a/src/main/github/client.ts +++ b/src/main/github/client.ts @@ -485,16 +485,32 @@ function mapIssueWorkItem(item: Record): MainWorkItem { .filter(Boolean) : [], updatedAt: String(item.updated_at ?? item.updatedAt ?? ''), - author: - typeof item.user === 'object' && item.user !== null && 'login' in item.user - ? String((item.user as { login?: unknown }).login ?? '') - : typeof item.author === 'object' && item.author !== null && 'login' in item.author - ? String((item.author as { login?: unknown }).login ?? '') - : null, + ...authorFieldsFromUnknown(item), ...(item.assignees !== undefined ? { assignees: usersFromUnknown(item.assignees) } : {}) } } +/** + * Derive both the author login and its API avatar_url in one place so GHE + * avatars render (the login-only `github.com/{login}.png` URL 404s on GHE). + * + * REST exposes `user.avatar_url`; gh/GraphQL expose `author.avatarUrl`. `gh pr + * view` omits the avatar entirely, so authorAvatarUrl is left undefined and the + * UI falls back to the login URL then a placeholder. See #8784. + */ +function authorFieldsFromUnknown( + item: Record +): Pick { + const user = userFromUnknown(item.user ?? item.author) + if (!user) { + return { author: null } + } + return { + author: user.login, + ...(user.avatarUrl ? { authorAvatarUrl: user.avatarUrl } : {}) + } +} + function extractHeadOwnerLogin(item: Record): string | null { // gh CLI `pr list --json headRepositoryOwner` shape: { login } if (typeof item.headRepositoryOwner === 'object' && item.headRepositoryOwner !== null) { @@ -746,12 +762,7 @@ function mapPullRequestWorkItem( .filter(Boolean) : [], updatedAt: String(item.updated_at ?? item.updatedAt ?? ''), - author: - typeof item.user === 'object' && item.user !== null && 'login' in item.user - ? String((item.user as { login?: unknown }).login ?? '') - : typeof item.author === 'object' && item.author !== null && 'login' in item.author - ? String((item.author as { login?: unknown }).login ?? '') - : null, + ...authorFieldsFromUnknown(item), branchName: typeof item.head === 'object' && item.head !== null && 'ref' in item.head ? String((item.head as { ref?: unknown }).ref ?? '') diff --git a/src/main/github/work-item-details.test.ts b/src/main/github/work-item-details.test.ts index 6d3d14c99b7..4fd21131c23 100644 --- a/src/main/github/work-item-details.test.ts +++ b/src/main/github/work-item-details.test.ts @@ -216,6 +216,56 @@ describe('getWorkItemDetails', () => { expect(details?.participants?.[0]?.login).toBe('issue-author') }) + it('enriches a non-participating assignee avatar from the GraphQL assignees connection', async () => { + // Why: a GHE assignee who never commented is absent from `participants`, so + // the enrichment must also draw avatars from the `assignees` connection or + // item.assignees keeps the blank avatar `gh` returns. + getWorkItemMock.mockResolvedValueOnce({ + id: 'issue:924', + type: 'issue', + number: 924, + title: 'Assignee avatar', + state: 'open', + url: 'https://github.com/acme/widgets/issues/924', + labels: [], + updatedAt: '2026-04-01T00:00:00Z', + author: 'issue-author', + assignees: [{ login: 'ghe-assignee', name: 'GHE Assignee', avatarUrl: '' }] + }) + getIssueOwnerRepoMock.mockResolvedValue({ owner: 'acme', repo: 'widgets' }) + ghExecFileAsyncMock + .mockResolvedValueOnce({ + stdout: JSON.stringify({ + data: { + repository: { + issue: { + body: 'Issue body', + assignees: { + nodes: [ + { + login: 'ghe-assignee', + name: 'GHE Assignee', + avatarUrl: 'https://ghe.example.com/avatars/ghe-assignee' + } + ] + }, + participants: { nodes: [{ login: 'issue-author', avatarUrl: 'https://x/y' }] }, + comments: { nodes: [] } + } + } + } + }) + }) + .mockResolvedValueOnce({ stdout: '' }) + + const details = await getWorkItemDetails('/repo-root', 924, 'issue') + + expect(details?.item.assignees?.[0]).toMatchObject({ + login: 'ghe-assignee', + avatarUrl: 'https://ghe.example.com/avatars/ghe-assignee' + }) + }) + it('caps issue timeline pagination by supported activity items', async () => { getWorkItemMock.mockResolvedValueOnce({ id: 'issue:923', @@ -568,4 +618,66 @@ describe('getWorkItemDetails', () => { expect(details?.filesUnavailable).toBe(false) expect(details?.files).toEqual([]) }) + + // Why: `gh pr view` omits avatar_url, so the login-based github.com URL 404s on + // GHE. getWorkItemDetails must resolve author/reviewer/assignee avatars via the + // GraphQL user(login:) batch and stamp them onto the returned item. See #8784. + it('enriches PR author, reviewer, and assignee avatars from the GraphQL user lookup', async () => { + getWorkItemMock.mockResolvedValueOnce({ + id: 'pr:1102', + type: 'pr', + number: 1102, + title: 'Enterprise PR', + state: 'open', + url: 'https://ghe.example.com/acme/widgets/pull/1102', + labels: [], + updatedAt: '2026-07-11T00:00:00Z', + author: 'seah', + reviewRequests: [{ login: 'ludi', name: null, avatarUrl: '' }], + latestReviews: [{ login: 'inho', state: 'APPROVED', avatarUrl: '' }], + // A default `u/0` placeholder must be replaced by the resolved avatar. + assignees: [{ login: 'seah', name: 'Seah', avatarUrl: 'https://avatars.example.com/u/0?v=4' }] + }) + getOwnerRepoMock.mockResolvedValue({ owner: 'acme', repo: 'widgets' }) + getPRCommentsMock.mockResolvedValue([]) + getPRChecksMock.mockResolvedValue([]) + const avatars: Record = { + seah: 'https://avatars.example.com/u/1?v=4', + ludi: 'https://avatars.example.com/u/2?v=4', + inho: 'https://avatars.example.com/u/3?v=4' + } + ghExecFileAsyncMock.mockImplementation(async (args: string[]) => { + const target = args.at(-1) + if (target === 'repos/acme/widgets/pulls/1102') { + return { + stdout: JSON.stringify({ body: 'PR body', head: { sha: 'h' }, base: { sha: 'b' } }) + } + } + if (target === 'repos/acme/widgets/pulls/1102/files?per_page=100') { + return { stdout: '[]' } + } + const query = args.find((arg) => arg.startsWith('query=')) ?? '' + if (query.includes('user(login:')) { + // Return the aliased users the batch asked for, keyed by their login. + const data: Record = {} + let index = 0 + for (const login of Object.keys(avatars)) { + if (query.includes(`user(login: "${login}")`)) { + data[`u${index}`] = { login, name: null, avatarUrl: avatars[login] } + index += 1 + } + } + return { stdout: JSON.stringify({ data }) } + } + return { stdout: JSON.stringify({ data: {} }) } + }) + + const details = await getWorkItemDetails('/repo-root', 1102, 'pr') + + expect(details?.item.authorAvatarUrl).toBe(avatars.seah) + expect(details?.item.reviewRequests?.[0]?.avatarUrl).toBe(avatars.ludi) + expect(details?.item.latestReviews?.[0]?.avatarUrl).toBe(avatars.inho) + // The default u/0 placeholder is overridden by the resolved avatar. + expect(details?.item.assignees?.[0]?.avatarUrl).toBe(avatars.seah) + }) }) diff --git a/src/main/github/work-item-details.ts b/src/main/github/work-item-details.ts index 9aa2de2b26b..bd126641fcb 100644 --- a/src/main/github/work-item-details.ts +++ b/src/main/github/work-item-details.ts @@ -85,7 +85,7 @@ const ISSUE_DETAILS_QUERY = `query($owner: String!, $repo: String!, $number: Int repository(owner: $owner, name: $repo) { issue(number: $number) { body - assignees(first: 50) { nodes { login } } + assignees(first: 50) { nodes { login avatarUrl(size: 48) ... on User { name } } } participants(first: 100) { nodes { login avatarUrl(size: 48) ... on User { name } } } @@ -111,7 +111,7 @@ type GraphQLIssueDetailsResponse = { repository?: { issue?: { body?: string | null - assignees?: { nodes?: { login?: string }[] } + assignees?: { nodes?: { login?: string; avatarUrl?: string; name?: string | null }[] } participants?: { nodes?: GitHubAssignableUser[] } comments?: { nodes?: { @@ -323,6 +323,12 @@ async function getIssueTimelineItems( } } +/** + * Fetch an issue's body, comments, assignees, participants, and timeline in a + * single GraphQL round-trip. Returns null on any partial error so the caller + * falls back to the strict REST path. Assignee/participant avatars are resolved + * here so GitHub Enterprise users don't render blank. + */ async function getIssueDetailsViaGraphQL( repoPath: string, issueNumber: number, @@ -332,6 +338,10 @@ async function getIssueDetailsViaGraphQL( body: string comments: PRComment[] assignees: string[] + // Avatar-bearing assignees, kept separate from the `assignees` login list so + // callers that only need logins are unaffected; used to enrich assignee + // avatars that `gh` leaves blank (notably GitHub Enterprise users). + assigneeUsers: GitHubAssignableUser[] participants: GitHubAssignableUser[] timelineItems: GitHubIssueTimelineItem[] } | null> { @@ -386,9 +396,16 @@ async function getIssueDetailsViaGraphQL( url: c.url ?? '', isBot: c.author?.__typename === 'Bot' })) - const assignees = (issue.assignees?.nodes ?? []) - .map((a) => a.login) - .filter((login): login is string => Boolean(login)) + const assigneeUsers: GitHubAssignableUser[] = (issue.assignees?.nodes ?? []) + .filter((a): a is { login: string; avatarUrl?: string; name?: string | null } => + Boolean(a.login) + ) + .map((a) => ({ + login: a.login, + name: a.name ?? null, + avatarUrl: a.avatarUrl ?? '' + })) + const assignees = assigneeUsers.map((a) => a.login) const participants: GitHubAssignableUser[] = (issue.participants?.nodes ?? []) .filter((u) => Boolean(u.login)) .map((u) => ({ @@ -401,6 +418,7 @@ async function getIssueDetailsViaGraphQL( body: issue.body ?? '', comments, assignees, + assigneeUsers, participants, timelineItems } @@ -877,6 +895,11 @@ async function getGitHubUsersByLogin( return [] } if (rateLimitGuard('graphql').blocked) { + // Why: surface the skip. Callers degrade silently to login-based avatar URLs + // (blank on GHE), so without this log "why are avatars missing" is untraceable. + console.warn( + `getGitHubUsersByLogin skipped: GraphQL rate-limit budget exhausted (${uniqueLogins.length} logins unresolved)` + ) return [] } const fields = uniqueLogins @@ -921,19 +944,100 @@ async function getGitHubUsersByLogin( } } +/** + * Stamp GraphQL-resolved avatars onto a work item's author, reviewers, review + * requests, latest reviews, and assignees. + * + * The work item's users come from `gh pr view`, which omits avatar_url. On + * GitHub Enterprise the login-based `github.com/{login}.png` URL 404s, so those + * avatars render blank while comment avatars (fetched via GraphQL) work. + * `knownUsers` (participants + the mention-author batch, which already includes + * the item's reviewers/assignees) carries the resolved avatars, so we apply + * them without any extra round-trip. See #8784. + */ +function enrichItemDisplayAvatars( + item: Omit, + knownUsers: GitHubAssignableUser[] +): Omit { + const avatarByLogin = new Map() + for (const user of knownUsers) { + if (user.login && user.avatarUrl) { + avatarByLogin.set(user.login.toLowerCase(), user.avatarUrl) + } + } + if (avatarByLogin.size === 0) { + return item + } + // Why: prefer the GraphQL-resolved avatar over whatever `gh` returned. `gh pr + // view` often yields an empty avatar or the default `u/0` placeholder for + // enterprise users; the resolved avatar is the authoritative one for that + // login. Fall back to the original only when the lookup found nothing. + const avatarFor = (login: string): string | undefined => avatarByLogin.get(login.toLowerCase()) + const resolvedAvatar = (login: string, existing?: string | null): string | undefined => + avatarFor(login) || existing || undefined + // Callers coalesce a missing result to the field's "no avatar" sentinel ('' + // for GitHubAssignableUser, null for GitHubPRReviewSummary); GitHubUserAvatar + // treats both as falsy and falls back to the login URL then initials. + const authorAvatarUrl = (item.author ? avatarFor(item.author) : undefined) || item.authorAvatarUrl + return { + ...item, + ...(authorAvatarUrl ? { authorAvatarUrl } : {}), + ...(item.reviewRequests + ? { + reviewRequests: item.reviewRequests.map((user) => ({ + ...user, + avatarUrl: resolvedAvatar(user.login, user.avatarUrl) ?? '' + })) + } + : {}), + ...(item.latestReviews + ? { + latestReviews: item.latestReviews.map((review) => ({ + ...review, + avatarUrl: resolvedAvatar(review.login, review.avatarUrl) ?? null + })) + } + : {}), + ...(item.assignees + ? { + assignees: item.assignees.map((user) => ({ + ...user, + avatarUrl: resolvedAvatar(user.login, user.avatarUrl) ?? '' + })) + } + : {}) + } +} + async function getMentionParticipants( repoPath: string, - item: Pick, + item: Pick< + GitHubWorkItem, + 'author' | 'number' | 'type' | 'reviewRequests' | 'latestReviews' | 'assignees' + >, comments: PRComment[], participants: GitHubAssignableUser[], connectionId?: string | null, localGitOptions: LocalGitExecOptions = {} ): Promise { - const visibleLogins = [item.author ?? '', ...comments.map((comment) => comment.author)] - // Why: one aliased GraphQL query returns login/name/avatarUrl for every - // mentioned author in a single round-trip. The previous REST fan-out - // (/users/) returned the same fields but cost one rate-limit point - // per user. + // Why: resolve mention authors AND the item's reviewers/assignees in ONE + // aliased GraphQL round-trip. Folding the display users in here means the + // caller can reuse this result to stamp avatars (see enrichItemDisplayAvatars) + // without a second, separately rate-limited lookup — which is what made GHE + // reviewer/assignee avatars resolve intermittently. See #8784. + // Why: order the always-visible display users (author, reviewers, assignees) + // before comment authors so the 40-login cap in getGitHubUsersByLogin never + // drops a reviewer/assignee avatar on a PR with many commenters. On a PR with + // 40+ distinct participants the trailing comment authors are dropped from this + // batch and lose only their @mention-suggestion avatar; rendered comment + // avatars are unaffected (they carry their own avatarUrl from the comment). + const visibleLogins = [ + item.author ?? '', + ...(item.reviewRequests ?? []).map((user) => user.login), + ...(item.latestReviews ?? []).map((review) => review.login), + ...(item.assignees ?? []).map((user) => user.login), + ...comments.map((comment) => comment.author) + ] const graphQlUsers = await getGitHubUsersByLogin( repoPath, visibleLogins, @@ -1007,7 +1111,13 @@ export async function getWorkItemDetails( ) if (collapsed) { return { - item, + // Include assigneeUsers: a non-participating assignee is absent from + // the participants connection, so without them item.assignees keeps a + // blank/placeholder avatar (common for GitHub Enterprise users). + item: enrichItemDisplayAvatars(item, [ + ...collapsed.participants, + ...collapsed.assigneeUsers + ]), body: collapsed.body, comments: collapsed.comments, assignees: collapsed.assignees, @@ -1030,7 +1140,7 @@ export async function getWorkItemDetails( localGitOptions ) return { - item, + item: enrichItemDisplayAvatars(item, mentionParticipants), body, comments, assignees, @@ -1064,7 +1174,7 @@ export async function getWorkItemDetails( ]) return { - item, + item: enrichItemDisplayAvatars(item, mentionParticipants), body, comments, headSha: shas?.headSha, diff --git a/src/renderer/src/components/GitHubItemDialog.tsx b/src/renderer/src/components/GitHubItemDialog.tsx index d076f0b325d..6f6b7fb2424 100644 --- a/src/renderer/src/components/GitHubItemDialog.tsx +++ b/src/renderer/src/components/GitHubItemDialog.tsx @@ -181,7 +181,7 @@ import { filterGitHubPRReviewerCandidates, getGitHubPRReviewerQueryState } from '@/components/github/github-pr-reviewer-candidate-filter' -import { githubAvatarUrl } from '@/components/github/github-issue-comment-helpers' +import { GitHubUserAvatar } from '@/components/github/github-user-avatar' import { presentGitHubPRMergeState } from '@/components/github-pr-merge-state' import { GITHUB_PR_MERGE_METHOD_LABELS, @@ -421,16 +421,7 @@ function ReviewerAvatar({ login: string avatarUrl: string }): React.JSX.Element { - return ( - - ) + return } function mergeReviewerSuggestions( diff --git a/src/renderer/src/components/PullRequestPage.tsx b/src/renderer/src/components/PullRequestPage.tsx index d807dacf89f..b53ba354618 100644 --- a/src/renderer/src/components/PullRequestPage.tsx +++ b/src/renderer/src/components/PullRequestPage.tsx @@ -157,7 +157,7 @@ import { filterGitHubPRReviewerCandidates, getGitHubPRReviewerQueryState } from '@/components/github/github-pr-reviewer-candidate-filter' -import { githubAvatarUrl } from '@/components/github/github-issue-comment-helpers' +import { GitHubUserAvatar } from '@/components/github/github-user-avatar' import { filterGitHubMentionOptions } from '@/components/github/github-mention-option-filter' import { getCommentBodySubmitState, @@ -468,16 +468,7 @@ function ReviewerAvatar({ login: string avatarUrl: string }): React.JSX.Element { - return ( - - ) + return } function mergeReviewerSuggestions( @@ -7148,12 +7139,10 @@ export default function PullRequestPage({ {workItem.author ? ( - ) : null} diff --git a/src/renderer/src/components/TaskPage.tsx b/src/renderer/src/components/TaskPage.tsx index af47d26736d..e43cc6a8089 100644 --- a/src/renderer/src/components/TaskPage.tsx +++ b/src/renderer/src/components/TaskPage.tsx @@ -133,6 +133,7 @@ import { } from '../../../shared/linear-links' import PRFilterDropdowns, { type PRFilterChange } from '@/components/github/PRFilterDropdowns' import { GitHubMarkdownComposer } from '@/components/github/GitHubMarkdownComposer' +import { GitHubUserAvatar } from '@/components/github/github-user-avatar' import { buildGitHubRepoUrl, parseGitHubIssueOrPRLink } from '@/lib/github-links' import { findGithubWorkItemWorkspaceAttachment, @@ -1520,17 +1521,16 @@ function ReviewChipAvatar({ reviewer: GitHubPRPrimaryReviewer | null }): React.JSX.Element { if (reviewer?.login) { - // Why: `gh pr list --json reviewRequests` can return only logins; GitHub's - // public avatar endpoint keeps the list visual aligned with assignee cells. - const avatarUrl = reviewer.avatarUrl || `https://github.com/${reviewer.login}.png?size=40` + // Why: `gh pr list --json reviewRequests` can return only logins. Prefer the + // API avatar_url so GHE renders; GitHubUserAvatar falls back to the login URL + // and then an initials placeholder when no avatar loads. See #8784. return ( - ) } diff --git a/src/renderer/src/components/github/github-user-avatar.test.tsx b/src/renderer/src/components/github/github-user-avatar.test.tsx new file mode 100644 index 00000000000..5eeed156426 --- /dev/null +++ b/src/renderer/src/components/github/github-user-avatar.test.tsx @@ -0,0 +1,107 @@ +// @vitest-environment happy-dom + +import { act } from 'react' +import { createRoot, type Root } from 'react-dom/client' +import { afterEach, describe, expect, it } from 'vitest' +import { GitHubUserAvatar, resolveGitHubUserAvatarSrc } from './github-user-avatar' + +function render(node: React.JSX.Element): { root: Root; container: HTMLDivElement } { + const container = document.createElement('div') + document.body.appendChild(container) + const root = createRoot(container) + act(() => { + root.render(node) + }) + return { root, container } +} + +describe('GitHubUserAvatar', () => { + let root: Root | null = null + let container: HTMLDivElement | null = null + + afterEach(() => { + act(() => root?.unmount()) + container?.remove() + root = null + container = null + }) + + it('renders the API avatar_url when provided (works for github.com and GHE)', () => { + const url = 'https://avatars.example.com/u/42?u=hash&v=4' + ;({ root, container } = render()) + const img = container.querySelector('img') + expect(img?.getAttribute('src')).toBe(url) + }) + + it('falls back to the login URL when no avatar_url is available', () => { + ;({ root, container } = render()) + const img = container.querySelector('img') + expect(img?.getAttribute('src')).toBe('https://github.com/octocat.png?size=64') + }) + + it('degrades to an initials placeholder when the image fails to load (GHE 404)', () => { + ;({ root, container } = render( + + )) + const img = container.querySelector('img') + expect(img).not.toBeNull() + act(() => { + img?.dispatchEvent(new Event('error')) + }) + expect(container.querySelector('img')).toBeNull() + expect(container.textContent).toBe('AL') + }) + + it('skips leading non-BMP chars so initials never render a broken surrogate', () => { + ;({ root, container } = render()) + act(() => { + container?.querySelector('img')?.dispatchEvent(new Event('error')) + }) + // Emoji word is skipped entirely rather than split into a broken half. + expect(container.textContent).toBe('D') + }) + + it('derives initials from the login when no name is given', () => { + ;({ root, container } = render()) + act(() => { + container?.querySelector('img')?.dispatchEvent(new Event('error')) + }) + expect(container.textContent).toBe('OC') + }) + + it('retries when avatarUrl changes after an earlier src failed (late-arriving avatar)', () => { + // Why: PR detail enrichment supplies avatar_url after first paint. A row that + // 404s on the early login-based URL must recover once the real URL lands. + ;({ root, container } = render()) + // First src is the login fallback; simulate the GHE 404. + act(() => { + container?.querySelector('img')?.dispatchEvent(new Event('error')) + }) + expect(container.querySelector('img')).toBeNull() + // Enriched avatar_url arrives → component must render the new image, not the + // latched placeholder. + const url = 'https://avatars.example.com/u/7?v=4' + act(() => { + root?.render() + }) + expect(container.querySelector('img')?.getAttribute('src')).toBe(url) + }) + + it('shows initials immediately when login and avatarUrl are both empty', () => { + ;({ root, container } = render()) + expect(container.querySelector('img')).toBeNull() + expect(container.textContent).toBe('AD') + }) +}) + +describe('resolveGitHubUserAvatarSrc', () => { + it('prefers trimmed API avatar over login.png', () => { + expect(resolveGitHubUserAvatarSrc('u', ' https://avatars.example.com/u/1?v=4 ')).toBe( + 'https://avatars.example.com/u/1?v=4' + ) + }) + + it('skips empty login so no github.com/.png request is built', () => { + expect(resolveGitHubUserAvatarSrc('', null)).toBeNull() + }) +}) diff --git a/src/renderer/src/components/github/github-user-avatar.tsx b/src/renderer/src/components/github/github-user-avatar.tsx new file mode 100644 index 00000000000..385c7feda93 --- /dev/null +++ b/src/renderer/src/components/github/github-user-avatar.tsx @@ -0,0 +1,104 @@ +import { useState } from 'react' +import { cn } from '@/lib/utils' +import { githubAvatarUrl } from '@/components/github/github-issue-comment-helpers' + +/** + * Build a 1-2 character initials placeholder from a display name or login, + * used when no avatar image is available or the image fails to load. + */ +function initialsFor(login: string, name?: string | null): string { + const source = (name?.trim() || login).trim() + if (!source) { + return '?' + } + // Iterate by code point (not UTF-16 unit) and keep only letters/digits, so a + // display name that leads with an emoji or other non-BMP char yields clean + // initials instead of a broken surrogate half. Words that are all symbols are + // skipped; an all-symbol name falls back to '?'. + const alnum = (word: string): string[] => [...word].filter((ch) => /[\p{L}\p{N}]/u.test(ch)) + const parts = source.split(/\s+/).filter(Boolean) + const letters = + parts.length >= 2 + ? parts + .map((word) => alnum(word)[0]) + .filter(Boolean) + .slice(0, 2) + .join('') + : alnum(source).slice(0, 2).join('') + return letters.toUpperCase() || '?' +} + +/** + * Prefer the API `avatar_url`, then the public login.png URL. Empty/whitespace + * API values and empty logins never produce a bogus request. See #8784. + */ +export function resolveGitHubUserAvatarSrc( + login: string, + avatarUrl?: string | null +): string | null { + const fromApi = avatarUrl?.trim() + if (fromApi) { + return fromApi + } + const trimmedLogin = login.trim() + if (!trimmedLogin) { + return null + } + return githubAvatarUrl(trimmedLogin) +} + +/** + * Avatar for a GitHub user that renders correctly on github.com and GitHub + * Enterprise. GHE logins don't exist on github.com, so the login-based + * `github.com/{login}.png` URL 404s. We prefer the API-provided `avatarUrl` + * and, when it (or the login fallback) fails to load, degrade to an initials + * placeholder instead of a broken image. See #8784. + */ +export function GitHubUserAvatar({ + login, + name, + avatarUrl, + title, + className +}: { + login: string + name?: string | null + avatarUrl?: string | null + title?: string + className?: string +}): React.JSX.Element { + // Why: track the specific src that failed rather than a boolean. Avatar data + // arrives after the first paint (PR detail enrichment), so a row that 404s on + // the early login-based URL must retry once the real avatar_url lands — a + // latched boolean would keep showing the placeholder forever. See #8784. + const [failedSrc, setFailedSrc] = useState(null) + const src = resolveGitHubUserAvatarSrc(login, avatarUrl) + if (src && failedSrc !== src) { + return ( + setFailedSrc(src)} + className={cn( + 'shrink-0 rounded-full border border-border/50 bg-muted object-cover', + className + )} + /> + ) + } + return ( + + {initialsFor(login, name)} + + ) +} diff --git a/src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts b/src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts new file mode 100644 index 00000000000..7b831270910 --- /dev/null +++ b/src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts @@ -0,0 +1,55 @@ +/** + * Issue #8784 — GHE PR avatars must prefer API avatar_url over github.com/{login}.png. + * + * Regression guard (was a repro that documented the broken path). After the fix: + * - resolveGitHubUserAvatarSrc prefers API URLs + * - PullRequestPage author uses authorAvatarUrl via GitHubUserAvatar + * - TaskPage ReviewChipAvatar no longer hardcodes github.com login.png + * + * Re-run: + * pnpm exec vitest run --config config/vitest.config.ts \ + * src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts + */ +import { describe, expect, it } from 'vitest' +import { readFileSync } from 'node:fs' +import { join } from 'node:path' +import { githubAvatarUrl } from './github-issue-comment-helpers' +import { resolveGitHubUserAvatarSrc } from './github-user-avatar' + +describe('issue #8784 GHE avatar fallback (regression)', () => { + it('prefers API avatar_url over login.png (GHE healthy path)', () => { + const api = 'https://ghe.example.com/avatars/u/42?v=4' + expect(resolveGitHubUserAvatarSrc('enterprise-only-user', api)).toBe(api) + }) + + it('trims whitespace-only avatarUrl and falls back to login.png for github.com', () => { + expect(resolveGitHubUserAvatarSrc('octocat', ' ')).toBe( + 'https://github.com/octocat.png?size=64' + ) + expect(resolveGitHubUserAvatarSrc('octocat', null)).toBe(githubAvatarUrl('octocat')) + }) + + it('returns null when neither avatarUrl nor login is usable (no bogus request)', () => { + expect(resolveGitHubUserAvatarSrc('', '')).toBeNull() + expect(resolveGitHubUserAvatarSrc(' ', null)).toBeNull() + }) + + it('login-only fallback still hardcodes public github.com png (github.com path)', () => { + // Why: github.com users without avatar_url still use this; GHE relies on + // enrichment + image onError → initials when this 404s. + expect(githubAvatarUrl('corp-user')).toBe('https://github.com/corp-user.png?size=64') + }) + + it('source routes PR author/reviewer avatars through GitHubUserAvatar + authorAvatarUrl', () => { + const prPage = readFileSync(join(__dirname, '../PullRequestPage.tsx'), 'utf8') + expect(prPage).toMatch(/GitHubUserAvatar/) + expect(prPage).toMatch(/authorAvatarUrl/) + // Why: author chip must not ignore API avatar_url and only pass login. + expect(prPage).not.toMatch(/githubAvatarUrl\(workItem\.author\)/) + + const taskPage = readFileSync(join(__dirname, '../TaskPage.tsx'), 'utf8') + expect(taskPage).toMatch(/GitHubUserAvatar/) + // Why: list chip must not hardcode github.com/{login}.png. + expect(taskPage).not.toMatch(/github\.com\/\$\{reviewer\.login\}\.png/) + }) +}) diff --git a/src/shared/types.ts b/src/shared/types.ts index ff46520c44d..36297481741 100644 --- a/src/shared/types.ts +++ b/src/shared/types.ts @@ -1491,6 +1491,11 @@ export type GitHubWorkItem = { labels: string[] updatedAt: string author: string | null + // Why: GHE user logins don't exist on github.com, so the github.com/{login}.png + // fallback 404s. Carry the API-provided avatar_url so github.com + Enterprise + // both render; absent on the gh-pr-view path (gh omits avatar), then the UI + // falls back to the login URL and finally an initials placeholder. See #8784. + authorAvatarUrl?: string branchName?: string baseRefName?: string // Why: PR checks are keyed by head commit; carrying this lets task rows use From e01f3f474c39ce1a35c83d07c2adf36a380c48d3 Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Thu, 16 Jul 2026 19:38:13 -0700 Subject: [PATCH 16/17] fix(sidebar): preserve Project Group members under Hide sleeping (#9101) * fix(sidebar): preserve grouped projects under sleep filter * test(sidebar): harden #8865 project-group sleep-filter coverage Add adversarial cases for explicit project filters, multi-member groups, ungrouped neighbors, and buildRows membership/count preservation. Co-authored-by: bbingz --------- Co-authored-by: bbingz --- .../src/components/sidebar/WorktreeList.tsx | 3 +- .../empty-project-placeholder-repos.test.ts | 105 ++++++++++++++++++ .../empty-project-placeholder-repos.ts | 8 +- .../sidebar/worktree-list-groups.test.ts | 67 +++++++++++ 4 files changed, 181 insertions(+), 2 deletions(-) diff --git a/src/renderer/src/components/sidebar/WorktreeList.tsx b/src/renderer/src/components/sidebar/WorktreeList.tsx index 81671c20616..948228984d8 100644 --- a/src/renderer/src/components/sidebar/WorktreeList.tsx +++ b/src/renderer/src/components/sidebar/WorktreeList.tsx @@ -5711,9 +5711,10 @@ const WorktreeList = React.memo(function WorktreeList({ groupBy, repos: visibleReposForRows, worktreesByRepo, + visibleWorktrees, filterRepoIds }) - }, [filterRepoIds, groupBy, visibleReposForRows, worktreesByRepo]) + }, [filterRepoIds, groupBy, visibleReposForRows, visibleWorktrees, worktreesByRepo]) const allRepoIds = useMemo(() => repos.map((r) => r.id), [repos]) // Why: buildRows only needs which creates exist and their repo. Subscribe on a diff --git a/src/renderer/src/components/sidebar/empty-project-placeholder-repos.test.ts b/src/renderer/src/components/sidebar/empty-project-placeholder-repos.test.ts index aaa3be238e9..8a33151f73a 100644 --- a/src/renderer/src/components/sidebar/empty-project-placeholder-repos.test.ts +++ b/src/renderer/src/components/sidebar/empty-project-placeholder-repos.test.ts @@ -38,6 +38,7 @@ describe('getEmptyProjectPlaceholderRepoIds', () => { groupBy: 'repo', repos: [repo], worktreesByRepo: { [repo.id]: [] }, + visibleWorktrees: [], filterRepoIds: [] }) ) @@ -51,6 +52,7 @@ describe('getEmptyProjectPlaceholderRepoIds', () => { groupBy: 'repo', repos: [repo], worktreesByRepo: {}, + visibleWorktrees: [], filterRepoIds: [] }) ) @@ -67,6 +69,7 @@ describe('getEmptyProjectPlaceholderRepoIds', () => { groupBy: 'repo', repos: [selectedRepo, hiddenRepo], worktreesByRepo: { [selectedRepo.id]: [], [hiddenRepo.id]: [] }, + visibleWorktrees: [], filterRepoIds: [selectedRepo.id] }) ) @@ -79,6 +82,7 @@ describe('getEmptyProjectPlaceholderRepoIds', () => { groupBy: 'none', repos: [repo], worktreesByRepo: { [repo.id]: [] }, + visibleWorktrees: [], filterRepoIds: [] }).size ).toBe(0) @@ -90,8 +94,109 @@ describe('getEmptyProjectPlaceholderRepoIds', () => { groupBy: 'repo', repos: [repo], worktreesByRepo: { [repo.id]: [worktree] }, + visibleWorktrees: [], filterRepoIds: [] }).size ).toBe(0) }) + + it('keeps grouped repos visible when workspace filters hide all of their rows', () => { + const groupedRepo: Repo = { ...repo, projectGroupId: 'group-1' } + const groupedWorktree: Worktree = { ...worktree, repoId: groupedRepo.id } + + expect( + Array.from( + getEmptyProjectPlaceholderRepoIds({ + groupBy: 'repo', + repos: [groupedRepo], + worktreesByRepo: { [groupedRepo.id]: [groupedWorktree] }, + visibleWorktrees: [], + filterRepoIds: [] + }) + ) + ).toEqual([groupedRepo.id]) + }) + + it('does not create a grouped repo placeholder when one of its workspaces is visible', () => { + const groupedRepo: Repo = { ...repo, projectGroupId: 'group-1' } + const groupedWorktree: Worktree = { ...worktree, repoId: groupedRepo.id } + + expect( + getEmptyProjectPlaceholderRepoIds({ + groupBy: 'repo', + repos: [groupedRepo], + worktreesByRepo: { [groupedRepo.id]: [groupedWorktree] }, + visibleWorktrees: [groupedWorktree], + filterRepoIds: [] + }).size + ).toBe(0) + }) + + it('still respects explicit project filters for sleep-filtered grouped members', () => { + const selected: Repo = { ...repo, id: 'repo-selected', projectGroupId: 'group-1' } + const filteredOut: Repo = { ...repo, id: 'repo-hidden', projectGroupId: 'group-1' } + const selectedWt: Worktree = { ...worktree, id: 'wt-selected', repoId: selected.id } + const hiddenWt: Worktree = { ...worktree, id: 'wt-hidden', repoId: filteredOut.id } + + expect( + Array.from( + getEmptyProjectPlaceholderRepoIds({ + groupBy: 'repo', + repos: [selected, filteredOut], + worktreesByRepo: { + [selected.id]: [selectedWt], + [filteredOut.id]: [hiddenWt] + }, + // Why: simulate Hide sleeping removing every card while the project + // filter still intentionally excludes `filteredOut`. + visibleWorktrees: [], + filterRepoIds: [selected.id] + }) + ) + ).toEqual([selected.id]) + }) + + it('placeholders only the fully-filtered members of a multi-project group', () => { + const sleeping: Repo = { ...repo, id: 'repo-sleeping', projectGroupId: 'group-1' } + const awake: Repo = { ...repo, id: 'repo-awake', projectGroupId: 'group-1' } + const sleepingWt: Worktree = { ...worktree, id: 'wt-sleeping', repoId: sleeping.id } + const awakeWt: Worktree = { ...worktree, id: 'wt-awake', repoId: awake.id } + + expect( + Array.from( + getEmptyProjectPlaceholderRepoIds({ + groupBy: 'repo', + repos: [sleeping, awake], + worktreesByRepo: { + [sleeping.id]: [sleepingWt], + [awake.id]: [awakeWt] + }, + visibleWorktrees: [awakeWt], + filterRepoIds: [] + }) + ) + ).toEqual([sleeping.id]) + }) + + it('does not placeholder ungrouped neighbors of a filtered grouped member', () => { + const grouped: Repo = { ...repo, id: 'repo-grouped', projectGroupId: 'group-1' } + const ungrouped: Repo = { ...repo, id: 'repo-ungrouped' } + const groupedWt: Worktree = { ...worktree, id: 'wt-grouped', repoId: grouped.id } + const ungroupedWt: Worktree = { ...worktree, id: 'wt-ungrouped', repoId: ungrouped.id } + + expect( + Array.from( + getEmptyProjectPlaceholderRepoIds({ + groupBy: 'repo', + repos: [grouped, ungrouped], + worktreesByRepo: { + [grouped.id]: [groupedWt], + [ungrouped.id]: [ungroupedWt] + }, + visibleWorktrees: [], + filterRepoIds: [] + }) + ) + ).toEqual([grouped.id]) + }) }) diff --git a/src/renderer/src/components/sidebar/empty-project-placeholder-repos.ts b/src/renderer/src/components/sidebar/empty-project-placeholder-repos.ts index 26c248a2a65..57aee59c1bd 100644 --- a/src/renderer/src/components/sidebar/empty-project-placeholder-repos.ts +++ b/src/renderer/src/components/sidebar/empty-project-placeholder-repos.ts @@ -5,6 +5,7 @@ export function getEmptyProjectPlaceholderRepoIds(args: { groupBy: WorktreeGroupBy repos: readonly Repo[] worktreesByRepo: Readonly> + visibleWorktrees: readonly Worktree[] filterRepoIds: readonly string[] }): Set { if (args.groupBy !== 'repo') { @@ -12,12 +13,17 @@ export function getEmptyProjectPlaceholderRepoIds(args: { } const filterSet = args.filterRepoIds.length > 0 ? new Set(args.filterRepoIds) : null + const visibleRepoIds = new Set(args.visibleWorktrees.map((worktree) => worktree.repoId)) const placeholderRepoIds = new Set() for (const repo of args.repos) { if (filterSet && !filterSet.has(repo.id)) { continue } - if ((args.worktreesByRepo[repo.id]?.length ?? 0) === 0) { + const hasNoWorktrees = (args.worktreesByRepo[repo.id]?.length ?? 0) === 0 + // Why: workspace filters hide cards, but must not rewrite the visible + // membership of a persisted Project Group. #8865 + const isFilteredProjectGroupMember = repo.projectGroupId != null && !visibleRepoIds.has(repo.id) + if (hasNoWorktrees || isFilteredProjectGroupMember) { placeholderRepoIds.add(repo.id) } } diff --git a/src/renderer/src/components/sidebar/worktree-list-groups.test.ts b/src/renderer/src/components/sidebar/worktree-list-groups.test.ts index b967c4cd356..4b4012f8c7c 100644 --- a/src/renderer/src/components/sidebar/worktree-list-groups.test.ts +++ b/src/renderer/src/components/sidebar/worktree-list-groups.test.ts @@ -1933,6 +1933,73 @@ describe('project groups', () => { expect(rows[0]).toMatchObject({ label: 'Platform' }) }) + it('keeps sleep-filtered Project Group members as empty project headers', () => { + // Why: #8865 — Hide sleeping removes workspace cards; membership placeholders + // must still project the grouped project header so the group count stays honest. + const group: ProjectGroup = { + id: 'group-1', + name: 'Platform', + parentPath: '/platform', + parentGroupId: null, + createdFrom: 'folder-scan', + tabOrder: 0, + isCollapsed: false, + color: null, + createdAt: 1, + updatedAt: 1 + } + const sleepingRepo: Repo = { + ...repo, + id: 'repo-sleeping', + displayName: 'sleeping-project', + projectGroupId: group.id + } + const awakeRepo: Repo = { + ...repo, + id: 'repo-awake', + displayName: 'awake-project', + projectGroupId: group.id + } + const awakeWorktree: Worktree = { + ...worktree, + id: 'wt-awake', + repoId: awakeRepo.id, + path: '/tmp/awake' + } + + const rows = buildRows( + 'repo', + [awakeWorktree], + new Map([ + [sleepingRepo.id, sleepingRepo], + [awakeRepo.id, awakeRepo] + ]), + null, + new Set(), + undefined, + undefined, + undefined, + {}, + new Map([[awakeWorktree.id, awakeWorktree]]), + false, + undefined, + [group], + new Set([sleepingRepo.id]) + ) + + expect(rows[0]).toMatchObject({ + type: 'header', + key: 'project-group:group-1', + count: 2 + }) + // Why: empty/placeholder projects sort after projects with visible activity. + expect(rows.filter((row) => row.type === 'header').map((row) => row.key)).toEqual([ + 'project-group:group-1', + `repo:${awakeRepo.id}`, + `repo:${sleepingRepo.id}` + ]) + }) + it('renders ungrouped repos as top-level repo rows when Project Groups exist', () => { const group: ProjectGroup = { id: 'group-1', From 5ee90c8d59f5839b5a05fe5e42db32c40b936273 Mon Sep 17 00:00:00 2001 From: Neil <4138956+nwparker@users.noreply.github.com> Date: Thu, 16 Jul 2026 19:53:18 -0700 Subject: [PATCH 17/17] fix(agents): recognize OpenCode native OC | tab titles (#9102) * fix(agents): recognize OpenCode native OC | tab titles OpenCode's native OSC titles use `OC | ` without an `opencode` token, so title classifiers left tabs as Claude/unknown. Map the native marker (optional mux prefix) to OpenCode identity in both title classifiers, exclude it from isClaudeAgent, and cover lookalikes plus stale Claude launch reclaim. Builds on and supersedes #8590 (credit @gatsby74). Fixes #8478. * fix(agents): drop renderer import from #8478 shared repro tsconfig.node includes src/shared tests; importing agent-status pulled renderer modules outside the node project and failed typecheck. Assert opencode identity via shared title classifiers only (OpenCode TUI sets "OpenCode" and `OC | ${title}`). * fix(runtime): fill browser cert failure map in mobile snapshot fixtures Main's #9104 reads browserCertificateFailuresByPageId in buildMobileBrowserTab but left partial AppState test helpers without the field, breaking PR Checks merge commits. Default the map in fixtures and use optional chaining so partial state cannot throw. --- src/renderer/src/lib/use-tab-agent.test.ts | 14 ++++++ ...sync-runtime-graph-terminal-layout.test.ts | 1 + .../src/runtime/sync-runtime-graph.test.ts | 2 + .../src/runtime/sync-runtime-graph.ts | 2 +- src/shared/agent-detection.ts | 1 + src/shared/agent-title-identity.ts | 8 ++- src/shared/opencode-terminal-title.test.ts | 11 ++++- src/shared/opencode-terminal-title.ts | 14 +++++- ...ro-8478-opencode-native-title-icon.test.ts | 49 +++++++++++++++++++ src/shared/terminal-title-agent-type.test.ts | 35 +++++++++++++ src/shared/terminal-title-agent-type.ts | 8 ++- 11 files changed, 138 insertions(+), 7 deletions(-) create mode 100644 src/shared/repro-8478-opencode-native-title-icon.test.ts diff --git a/src/renderer/src/lib/use-tab-agent.test.ts b/src/renderer/src/lib/use-tab-agent.test.ts index 9152159f14b..d2283db7dea 100644 --- a/src/renderer/src/lib/use-tab-agent.test.ts +++ b/src/renderer/src/lib/use-tab-agent.test.ts @@ -258,6 +258,20 @@ describe('resolveTabAgentFromSignals', () => { ).toBe('claude') }) + // Why: #8478 — OpenCode native `OC | …` titles must reclaim a stale Claude + // launch identity so the tab icon is OpenCode, not Claude. + it('uses OpenCode native session titles to replace stale Claude launch identity', () => { + expect( + resolveTabAgentFromSignals({ + hasObservedAgentSignal: true, + isRemote: false, + title: 'OC | Understand about the plugin', + hookAgent: null, + launchAgent: 'claude' + }) + ).toBe('opencode') + }) + it('does not let an explicit title override launch identity before any activity is observed', () => { expect( resolveTabAgentFromSignals({ diff --git a/src/renderer/src/runtime/sync-runtime-graph-terminal-layout.test.ts b/src/renderer/src/runtime/sync-runtime-graph-terminal-layout.test.ts index 6095f4e1840..385a7764fd1 100644 --- a/src/renderer/src/runtime/sync-runtime-graph-terminal-layout.test.ts +++ b/src/renderer/src/runtime/sync-runtime-graph-terminal-layout.test.ts @@ -16,6 +16,7 @@ function makeState(overrides: Partial = {}): AppState { activeBrowserTabIdByWorktree: {}, browserTabsByWorktree: {}, browserPagesByWorkspace: {}, + browserCertificateFailuresByPageId: {}, openFiles: [], editorDrafts: {}, activeTabId: null, diff --git a/src/renderer/src/runtime/sync-runtime-graph.test.ts b/src/renderer/src/runtime/sync-runtime-graph.test.ts index 2de176df7b9..d1082d89cab 100644 --- a/src/renderer/src/runtime/sync-runtime-graph.test.ts +++ b/src/renderer/src/runtime/sync-runtime-graph.test.ts @@ -26,6 +26,7 @@ function makeState(overrides: Partial = {}): AppState { activeBrowserTabIdByWorktree: {}, browserTabsByWorktree: {}, browserPagesByWorkspace: {}, + browserCertificateFailuresByPageId: {}, openFiles: [], editorDrafts: {}, activeTabId: null, @@ -60,6 +61,7 @@ function makeSharedOverrides(): Partial { activeBrowserTabIdByWorktree: {}, browserTabsByWorktree: {}, browserPagesByWorkspace: {}, + browserCertificateFailuresByPageId: {}, openFiles: [], editorDrafts: {}, agentStatusByPaneKey: {}, diff --git a/src/renderer/src/runtime/sync-runtime-graph.ts b/src/renderer/src/runtime/sync-runtime-graph.ts index e735e130004..fb32a847941 100644 --- a/src/renderer/src/runtime/sync-runtime-graph.ts +++ b/src/renderer/src/runtime/sync-runtime-graph.ts @@ -1496,7 +1496,7 @@ function buildMobileBrowserTab( // back through ?? would resurrect a stale workspace-level error. loadError: activePage ? activePage.loadError : workspace.loadError, certificateFailure: activePage - ? (state.browserCertificateFailuresByPageId[activePage.id] ?? null) + ? (state.browserCertificateFailuresByPageId?.[activePage.id] ?? null) : null, color: unifiedTab?.color ?? null, isPinned: unifiedTab?.isPinned === true, diff --git a/src/shared/agent-detection.ts b/src/shared/agent-detection.ts index 891f37093db..4fbfff86f24 100644 --- a/src/shared/agent-detection.ts +++ b/src/shared/agent-detection.ts @@ -18,6 +18,7 @@ export { STRONG_IDLE_KEYWORDS_RE, STRONG_WORKING_KEYWORDS_RE } from './agent-title-core' +export { isOpenCodeNativeTitle, isMeaningfulOpenCodeTerminalTitle } from './opencode-terminal-title' export { getAgentLabel, isClaudeAgent } from './agent-title-identity' export { clearWorkingIndicators, diff --git a/src/shared/agent-title-identity.ts b/src/shared/agent-title-identity.ts index 9f7746b01bc..af86de1667d 100644 --- a/src/shared/agent-title-identity.ts +++ b/src/shared/agent-title-identity.ts @@ -10,6 +10,7 @@ import { isPiAgentTitle, titleHasAgentName } from './agent-title-core' +import { isOpenCodeNativeTitle } from './opencode-terminal-title' import { getPiCompatibleSyntheticAgentLabel } from './pi-compatible-synthetic-title' /** @@ -17,7 +18,7 @@ import { getPiCompatibleSyntheticAgentLabel } from './pi-compatible-synthetic-ti * Used to scope prompt-cache-timer behavior to Claude sessions only. */ export function isClaudeAgent(title: string): boolean { - if (!title || isClaudeManagementTitle(title)) { + if (!title || isClaudeManagementTitle(title) || isOpenCodeNativeTitle(title)) { return false } const lower = title.toLowerCase() @@ -46,6 +47,11 @@ export function getAgentLabel(title: string): string | null { if (isClaudeManagementTitle(title)) { return null } + // Why: the native marker owns the whole title; its session text may name or + // include status glyphs from other agents without changing OpenCode identity. + if (isOpenCodeNativeTitle(title)) { + return 'OpenCode' + } // Why: Claude task titles can mention another CLI; the prefix is the identity // signal, not arbitrary task text. if ( diff --git a/src/shared/opencode-terminal-title.test.ts b/src/shared/opencode-terminal-title.test.ts index fc1b7806e35..f1cb825e8cd 100644 --- a/src/shared/opencode-terminal-title.test.ts +++ b/src/shared/opencode-terminal-title.test.ts @@ -1,16 +1,23 @@ import { describe, expect, it } from 'vitest' -import { isMeaningfulOpenCodeTerminalTitle } from './opencode-terminal-title' +import { isMeaningfulOpenCodeTerminalTitle, isOpenCodeNativeTitle } from './opencode-terminal-title' describe('OpenCode terminal titles', () => { it('recognizes native session titles', () => { expect(isMeaningfulOpenCodeTerminalTitle('OC | Native Stable Session')).toBe(true) expect(isMeaningfulOpenCodeTerminalTitle(' OC|Session ')).toBe(true) + expect(isOpenCodeNativeTitle('OC | Understand about the plugin')).toBe(true) + expect(isOpenCodeNativeTitle('tmux | OC | ses_123')).toBe(true) }) - it('rejects generic or incomplete OpenCode titles', () => { + it('rejects generic, incomplete, embedded, and lookalike titles', () => { expect(isMeaningfulOpenCodeTerminalTitle('OpenCode')).toBe(false) expect(isMeaningfulOpenCodeTerminalTitle('OpenCode ready')).toBe(false) expect(isMeaningfulOpenCodeTerminalTitle('OC |')).toBe(false) expect(isMeaningfulOpenCodeTerminalTitle(undefined)).toBe(false) + // Why: lowercase is not OpenCode's native marker; avoid "oc |" cwd/task noise. + expect(isOpenCodeNativeTitle('oc | Understand about the plugin')).toBe(false) + // Why: mid-title OC must not steal another agent's braille/task frame. + expect(isOpenCodeNativeTitle('⠋ Fix foo | OC | bar')).toBe(false) + expect(isOpenCodeNativeTitle('my session | OC | task')).toBe(false) }) }) diff --git a/src/shared/opencode-terminal-title.ts b/src/shared/opencode-terminal-title.ts index 64312b94be2..01d3d3819ae 100644 --- a/src/shared/opencode-terminal-title.ts +++ b/src/shared/opencode-terminal-title.ts @@ -1,4 +1,14 @@ +// Why: OpenCode abbreviates native OSC session titles as `OC | ` (no +// agent-name token). Optional single-token multiplexer prefix covers SSH/tmux +// frames like `tmux | OC | …`. Case-sensitive `OC` avoids ordinary lowercase +// "oc" lookalikes; require non-whitespace after the marker so bare `OC |` is not +// identity. Used for both display-title preservation and tab-agent identity. +const OPENCODE_NATIVE_TITLE_RE = /^(?:[^|\s]+ \| )?OC\s*\|\s*\S/u + +export function isOpenCodeNativeTitle(title: string | null | undefined): boolean { + return OPENCODE_NATIVE_TITLE_RE.test(title?.trim() ?? '') +} + export function isMeaningfulOpenCodeTerminalTitle(title: string | null | undefined): boolean { - // Why: bare OpenCode labels are status/identity; `OC | …` carries native session identity. - return /^OC\s*\|\s*\S/u.test(title?.trim() ?? '') + return isOpenCodeNativeTitle(title) } diff --git a/src/shared/repro-8478-opencode-native-title-icon.test.ts b/src/shared/repro-8478-opencode-native-title-icon.test.ts new file mode 100644 index 00000000000..554ac0c5ddb --- /dev/null +++ b/src/shared/repro-8478-opencode-native-title-icon.test.ts @@ -0,0 +1,49 @@ +/** + * Issue #8478 — OpenCode logo / icon not coming up well (Claude glyph on + * OpenCode tabs). + * + * Root cause (pre-fix): OpenCode's native OSC tab title format is `OC | `. + * Title classifiers only recognized OpenCode when the token "opencode" appeared. + * Native `OC | …` titles fell through, so AgentIcon rendered Claude/"?". + * + * OpenCode source (packages/tui/src/app.tsx) sets titles as: + * - "OpenCode" on home / default session titles + * - `OC | ${title}` for named sessions (title truncated at 40 chars) + * - `OC | ${pluginId}` on plugin routes + * + * Related: #8940 (OpenCode activity frames mislabeled Claude Code — separate + * braille-without-token path; not fully solved here). + * + * Re-run: + * pnpm exec vitest run --config config/vitest.config.ts \ + * src/shared/repro-8478-opencode-native-title-icon.test.ts + */ +import { describe, expect, it } from 'vitest' +import { getAgentLabel, isClaudeAgent } from './agent-detection' +import { + resolveExplicitTerminalTitleAgentType, + resolveTerminalTitleAgentType +} from './terminal-title-agent-type' + +describe('#8478 OpenCode native OC | titles map to OpenCode icon', () => { + it('recognizes OpenCode native "OC | …" title format as opencode identity', () => { + const native = 'OC | Understand about the plugin' + expect(getAgentLabel(native)).toBe('OpenCode') + expect(resolveTerminalTitleAgentType(native)).toBe('opencode') + expect(resolveExplicitTerminalTitleAgentType(native)).toBe('opencode') + expect(isClaudeAgent(native)).toBe(false) + }) + + // Why: bare "OpenCode" is what the TUI sets on home/default sessions; keep it + // classified so the icon path stays OpenCode without the OC | abbreviation. + it('keeps bare OpenCode home titles and Claude-style frames classified correctly', () => { + expect(getAgentLabel('OpenCode')).toBe('OpenCode') + expect(resolveTerminalTitleAgentType('OpenCode')).toBe('opencode') + expect(getAgentLabel('OpenCode ready')).toBe('OpenCode') + expect(resolveTerminalTitleAgentType('OpenCode ready')).toBe('opencode') + // Same family as #8940: braille/task frames without "opencode" still become Claude + // when they lack the native OC marker — documented, out of scope for this fix. + expect(isClaudeAgent('⠋ implementing the feature')).toBe(true) + expect(getAgentLabel('⠋ implementing the feature')).toBe('Claude Code') + }) +}) diff --git a/src/shared/terminal-title-agent-type.test.ts b/src/shared/terminal-title-agent-type.test.ts index d28dd43f503..d0fda7dcc45 100644 --- a/src/shared/terminal-title-agent-type.test.ts +++ b/src/shared/terminal-title-agent-type.test.ts @@ -1,4 +1,6 @@ import { describe, expect, it } from 'vitest' +import { getAgentLabel as getSharedAgentLabel } from './agent-title-identity' +import { isOpenCodeNativeTitle } from './opencode-terminal-title' import { isClaudeAgent, isGrokRotatingWorkingTitle, @@ -51,6 +53,39 @@ describe('resolveExplicitTerminalTitleAgentType', () => { expect(resolveExplicitTerminalTitleAgentType('* Review Codex behavior')).toBeNull() }) + it('resolves OpenCode native abbreviated session titles before task-text identities', () => { + expect(resolveExplicitTerminalTitleAgentType('OC | Understand about the plugin')).toBe( + 'opencode' + ) + expect(resolveExplicitTerminalTitleAgentType('OC | Compare Codex and Claude')).toBe('opencode') + // Why: Gemini glyphs inside OpenCode session text must not rebrand the tab. + expect(resolveExplicitTerminalTitleAgentType('OC | ✦ Gemini CLI')).toBe('opencode') + expect(getSharedAgentLabel('OC | Compare Codex and Claude')).toBe('OpenCode') + expect(getSharedAgentLabel('OC | ✦ Gemini CLI')).toBe('OpenCode') + expect(resolveExplicitTerminalTitleAgentType('tmux | OC | ses_123')).toBe('opencode') + expect(resolveExplicitTerminalTitleAgentType('OC|compact-session')).toBe('opencode') + expect(resolveExplicitTerminalTitleAgentType('oc | Understand about the plugin')).toBeNull() + }) + + it('does not find an OpenCode marker inside another agent task title', () => { + expect(isOpenCodeNativeTitle('⠋ Fix foo | OC | bar')).toBe(false) + expect(resolveExplicitTerminalTitleAgentType('⠋ Fix foo | OC | bar')).toBeNull() + }) + + // Why: adversarial coverage — native OC must not steal Claude/Codex/Cursor/ + // Gemini/Pi identity, and those agents must keep resolving when titled normally. + it('keeps other agents classified correctly alongside OpenCode native titles', () => { + expect(resolveExplicitTerminalTitleAgentType('✳ Claude Code')).toBe('claude') + expect(resolveExplicitTerminalTitleAgentType('⠋ Codex')).toBe('codex') + expect(resolveExplicitTerminalTitleAgentType('✦ Gemini CLI')).toBe('gemini') + expect(resolveExplicitTerminalTitleAgentType('Cursor Agent')).toBe('cursor') + expect(resolveExplicitTerminalTitleAgentType('Pi ready')).toBe('pi') + expect(resolveExplicitTerminalTitleAgentType('OpenCode ready')).toBe('opencode') + expect(resolveTerminalTitleAgentType('OC | ⠋ implementing the feature')).toBe('opencode') + expect(isClaudeAgent('OC | ⠋ implementing the feature')).toBe(false) + expect(isClaudeAgent('OC | Understand about the plugin')).toBe(false) + }) + it('still resolves Claude when the title explicitly names Claude', () => { expect(resolveExplicitTerminalTitleAgentType('. Claude Code compare Opencode')).toBe('claude') }) diff --git a/src/shared/terminal-title-agent-type.ts b/src/shared/terminal-title-agent-type.ts index ae7c97c09e7..fa92bb198c0 100644 --- a/src/shared/terminal-title-agent-type.ts +++ b/src/shared/terminal-title-agent-type.ts @@ -5,6 +5,7 @@ import { titleHasAgentName } from './agent-name-token-match' import { isCursorAgentTitle } from './agent-title-core' +import { isOpenCodeNativeTitle } from './opencode-terminal-title' import { getPiCompatibleSyntheticAgentLabel, isLegacyPiCompatibleTitle @@ -80,7 +81,7 @@ export function isPiAgentTitle(title: string): boolean { * agents have different (or no) caching semantics. */ export function isClaudeAgent(title: string): boolean { - if (!title || isClaudeManagementTitle(title)) { + if (!title || isClaudeManagementTitle(title) || isOpenCodeNativeTitle(title)) { return false } const lower = title.toLowerCase() @@ -124,6 +125,11 @@ export function getAgentLabel(title: string): string | null { if (isClaudeManagementTitle(title)) { return null } + // Why: the native marker owns the whole title; its session text may name or + // include status glyphs from other agents without changing OpenCode identity. + if (isOpenCodeNativeTitle(title)) { + return 'OpenCode' + } // Why: Claude Code title text is often the task title. If that task mentions // another CLI, the Claude-specific prefix is the identity signal, not the words. if (