* feat(workspace-cleanup): keep workspaces a paired client has unsaved edits in
* fix(workspace-cleanup): keep each window's unsaved-editor report and send them in order
* fix(github): keep the selected workspace's PR on its one-minute refresh
Follow-up reads inherited the priority of whatever entry ran last. A workspace
selected while its cached PR was still fresh never got a foreground entry, so
its follow-ups competed with every visible card for the shared list budget and
were read about every five minutes with 25 visible open PRs. Previously
selected workspaces kept priority 80 forever. Follow-ups now take foreground
priority only while their workspace is selected.
* feat(source-control): say when a merged workspace is safe to delete
Source Control's committed list is a merge-base diff against the base ref. A
squash or rebase merge copies the commits onto the base with new IDs, so the
list looks the same after the merge as before it. A notice now states whether
the merged review contains everything: HEAD is the review's head (or the
provider confirmed it is contained) and nothing is uncommitted.
* fix(sidebar): keep PR status visible on sleeping workspaces
The sleeping moon replaced the review glyph, hiding whether a sleeping
workspace's PR was open, failing or merged. Review status now keeps the lane;
the dimmed row already shows sleep and the accessible label names both.
Co-authored-by: Tobias Diez <code@tobiasdiez.com>
Co-authored-by: alpenshtokk <wawesandways@gmail.com>
* fix(source-control): wait for a git status read before judging a merged workspace
Before the first status read the change count is zero and HEAD may be stale,
so the notice could call a dirty workspace safe to delete. Use the HEAD from
the latest successful status read and say nothing until one completes.
* chore(i18n): ship the merged-review plural copy in the runtime English catalog
* fix: satisfy design-system, cast and flaky-test gates for the merged notice
Use the callout-important token instead of raw purple, let Button own its
type size, build the fixture worktree with the shared factory, pin the test
clock and give the long simulated-time tests a reason for their timeout.
* fix(github): align selected-refresh regression with feature ownership
* refactor(github): give refresh queue aliases their concrete owner
* fix(source-control): preserve cleanup warnings and reserve refresh fairness
* fix(source-control): describe missing merged-head proof as unverified
---------
Co-authored-by: Tobias Diez <code@tobiasdiez.com>
Co-authored-by: alpenshtokk <wawesandways@gmail.com>
* Show matching settings as a results list in the Settings sidebar
Typing in the Settings search now replaces the nav with a ranked list of
individual settings (pane title on the second line, matched text marked).
The first result is selected and previewed: its pane opens unfiltered,
scrolled to the setting with the target highlight. Arrow keys move and
preview, Enter or a click picks and keeps the query, Esc or the clear
button returns to the nav while leaving the shown pane open.
The sidebar query no longer filters page content. The Back to app row is
now 48px so its border lines up with the Settings header.
* Highlight settings search targets with a full-bleed bar and find unanchored rows
Matches in the results list are marked with semibold text (the jump palette's
HighlightedText) instead of a grey box. The landed-on row gets a tint from card
edge to card edge with a left bar that fades after ~3s, replacing the inset
grey block that sat off-center in the card padding. Integration provider rows
get anchors, and rows not wrapped in SearchableSetting are found by their
visible label.
* Fit the search highlight to each row's enclosing card
Settings cards pad differently (groups, plain sections, shadcn cards, the
Appearance accordion), so the highlight now measures the gap from the row to
its nearest card's inner edges instead of assuming one gutter. A group title
match highlights that group's card rather than the heading text.
* Give the settings target highlight a single owner
Components applied the highlight through SettingsTargetHighlightContext while the
page effect applied it to whatever element the jump scrolled to; when those
differed (Jira's provider row vs. its card shell) two highlights showed. The
effect now owns it alone, and the context, its provider and the macOS
Permissions prop are removed. Jira and Linear reuse their existing anchor ids.
* Use a plain fading tint for the settings target highlight
Drops the left bar; the tint still spans the enclosing card and fades after ~3s.
* Mark settings result titles with the ranking fold
The title highlight lowercased by hand and skipped titles whose length changed,
so İstanbul matching "stan" (or a query of İ) ranked but was never marked. Fold
per code point with the ranking's own fold and map offsets back to the title.
* Make settings search list-only until a pick and reveal collapsed targets
Typing now only changes the result rows: nothing is selected and the page does
not move until Enter or a click (arrows move the selection only). This removes
previews that discarded the Open in draft, re-ran repo hook checks, mounted a
pane per keystroke and drifted after deep links.
- Rank once on a deferred query, cap the list at 50 with a 'keep typing' hint,
and skip rendering the normal nav while searching.
- A settings jump dispatches a reveal event from its target; Appearance sections,
Advanced disclosures and the network/mobile collapsibles (now kept mounted)
open themselves instead of reading the search query.
- Nested scrollers (Shortcuts) scroll the target into view; General sub-page
results open their page; mirror recovery deep-links to the mirror field; a
target that never mounts drops its pending jump; group-title matches use
data-settings-group.
* Fix follow-ups from the settings search repair review
- Two more e2e specs pick a result with ArrowDown + Enter instead of relying on
typing to navigate.
- After a jump reveals a growing section, re-scroll once if the row is still cut off.
- Hide 'No settings match' while the deferred ranking catches up.
- The reveal hook is a ref callback so disclosures that mount later still open.
- The Advanced disclosure fixture shows the real forced-open case (unsaved edits).
* Give every settings search result a reachable row
* Type the General sub-page anchors as a list instead of casting map entries
* Keep the reveal callback ref out of render
* Match the e2e shortcut labels to main's sentence-case names
* Highlight the result's card, not its section title or a bare label
* feat(markdown): open clicked URLs in Orca, middle-click in system browser, and show link menu on hover
* fix(markdown): share click handling and dismiss stale link edits
* fix(markdown): respect disabled editors and browser availability
Scan merge proofs run with lazy fetches and transports off, so partial
clones never download blobs; direct WSL reads forward those variables.
Base and coordinator refs resolve once per repo per scan, and the squash
search lists target commits once and only patch-ids commits that touch
the branch's exact file set.
The split-focus guard treated the replayed snapshot making the new leaf
active (its own focus intent) as the viewer moving away, so it dropped
the focus call whenever the host's layout push beat the split reply.
* feat(workspace-cleanup): run cleanup rules in the background on the owning host
* fix(workspace-cleanup): keep workspaces whose own orca.yaml has an archive script
* feat(native-chat): draw the New line only when it helps, then fade it once seen
* fix(native-chat): adapt the New line port to public main (test helper, class-names, no notice field)
* fix(native-chat): a queued send that ran behind a turn with no reply drawn yet still draws the New line
* fix(native-chat): judge a running turn from the host's turn record, not row liveness, for the New line
A workspace a worker start created gets the 'orchestration-worker' reason once every dispatch on it released its terminal and its work landed in the default branch, a merged review or the coordinator's branch. Commits the coordinator's branch already holds no longer count as unpushed.
The fetch queue checked each queued-refresh flag once per loop, in a fixed
order. A forced refresh queued after its flag was checked stayed set when the
loop ended, so nothing ran it: after two quick account switches during a
refresh the meter stayed on fetching with no numbers, and the switch never
read the new account. One drain loop now re-reads every flag after each cycle.
* fix(terminal): draw the hardware cursor in remounted panes before first focus
xterm withholds the cursor until its textarea gets a focus event or a
keystroke. A remounted pane (reload, reattach) keeps DOM focus, so no
event fires and TUIs that use the hardware cursor, like agy, show no
cursor until the next keypress. Set showCursorImmediately so DECTCEM
alone decides visibility, matching the mobile fix in #11387.
* test(terminal): drop xterm-behavior cases and casts from cursor init test
* feat(workspace-cleanup): classify finished automation run workspaces
A new-per-run automation leaves one workspace behind per run. Cleanup
scans now tag such a workspace 'automation-run' once its run is final
and the automation has released the run's terminal, so the
automationRuns rule can remove it behind the usual safety blockers.
* refactor(workspace-cleanup): keep the scan file under its line cap
* Give every Settings pane the same card structure
Settings cards that hold rows were built several ways (the non-grouped
SettingsSection px-7 card, shadcn Card, the Appearance accordion, one-off
bordered boxes), each with its own side padding and row inset. Every one
now goes through SettingsGroup: one 20px inset, rules between rows, title
outside the card. SettingsGroup gains an id, a collapse prop for the
Appearance groups, SettingsGroupSubsection, SettingsGroupNestedRows and
SettingsGroupDisclosure (the old Appearance advanced disclosure), plus
shared bleed classes for rows that span the card. The non-grouped
SettingsSection body is removed.
* Fix settings card typecheck errors
* Keep collapsible group headings valid and restore notification row padding
* Keep Chat names anchor on its group, toggle Appearance groups from the whole header, and steady the Machines row padding
* Show Appearance groups as plain cards and even the Computer Use card's top inset
* Restore the SettingsGroup subsection exports dropped with the collapse mode
* Scope workspace deletion shortcuts to selected sidebar rows
* Complete shortcut event typing and web bridge cleanup
* Use stable fixture rows and typed input elements
* Align sidebar deletion and navigation with eligible focused rows
* Pass explicit absent repo for selected row host lookup
* Describe selected options in keyboard test fixture
* Bound sidebar selection and deletion work and preserve host ownership
* Keep navigation imports within the file size limit
* Separate navigation type imports consistently
* Match selected workspace repositories by explicit host
* feat(computer): type into a named text field without focusing it on Linux and macOS
* fix(computer): report unconfirmed Linux text readback and cover element typing
* test(computer): send an element with benchmark text only for targeted typing
* test(computer): pick gedit's editor, not its hidden overview map, in Linux e2e
* docs(computer): confirm focus before the unindexed type-text fallback
* fix(computer): report unreadable element text readback as readback_unsupported
* fix(native-chat): preview GitHub PR links in chats without a GitHub repo
A chat whose workspace has no GitHub repo (a plain folder) sent every
GitHub link to the anonymous web page fetch. Private repos answer that
with a 404, so the card said "No preview for this page." Route the
lookup through another registered repo on the chat's host whose remote
is on the link's GitHub host; main already lets a preview read any repo
on such a host with that sign-in.
* fix(native-chat): prefer exact clones and repair attachment test import
* fix(native-chat): retain direct SSH ownership for GitHub previews
* fix(native-chat): invalidate routed previews when repo accounts change
* fix(native-chat): resolve current preview routes before cache reuse
* fix(native-chat): preserve preview authority across async lookups
* fix(native-chat): retain valid preview lookups across catalog updates
* Avoid coalescing retired preview requests
* Give terminal agents a lasting Orca Agent ID
Terminal agents now get an Orca ID (orca_session_id:<agent>_<uuid>) derived
from their own conversation id on the host that runs them, so it stays the
same across worktree sleep/wake, app restart and a hand-run resume in any
pane. The terminal pane menu gets Copy Agent ID beside Copy Session ID, and
worktree ps --json agent rows carry orcaSessionId. Messaging a terminal
agent by that ID is refused with a message naming its pane until terminal
delivery lands.
* Name terminal agents at row admission and fix review round 1
- Perf: a row's Agent ID is resolved once, when its provider key changes at
admission (legacy rows via the status adapter's prepareRow hook, tmux rows at
canonical commit) and carried on the row as runtime-only agentIdentity.
Snapshots, publications and internal notifications only copy it; no key
serialization, cache lookup or database access per walk. Drops the pane FIFO
cache.
- Refusal: the identity service keeps a reverse index id -> rows, kept exact by
the adapter's rowChanged hook; a terminal refusal reads only matching panes
and names only confirmed running ones (no resume seeds, exited or
unconfirmed restored rows).
- Retry: a read-only identity file is lookup-only and never mints; any store
failure backs off all SQLite work for 30 s; a Copy click retries once.
- Menu: Copy Agent ID shows for a live pane only when its host stamped an ID,
and for a sleeping pane only when this app owns it on macOS/Linux.
- SSH: a sleeping record keeps its connection; a foreign (non-WSL) one resolves
no ID.
- Renderer keeps an existing ID only for the same agent, owner and provider key
including the Pi transcript locator.
- tmux-selected terminal rows carry their ID at every snapshot seam and in Copy
resolution; structured chat rows stay excluded.
* Keep Agent ID work out of notifications and reach Copy wherever a host can answer
- Internal status/provider notifications walk rows without Agent ID work:
canonical (tmux-selected) rows are decorated only for outputs that carry
the id (snapshots, live emit, ps, Copy). The tmux publish body is now
publishTmuxSelectedStatus so tests drive the production path.
- A row this host can name but has not yet (failed or pending link) is
published with orcaSessionId: null; older hosts omit the field. The
renderer offers Copy Agent ID on a live row whenever the field is present,
and the click retries through terminal.agentId.
- Hosts advertise terminal.agent-id.v1. A sleeping pane offers Copy Agent ID
when its owner is this app on macOS/Linux, or a remote owner that advertises
the capability on a known non-Windows platform, and its record names no
foreign connection.
- "Running in pane" places require that this runtime observed the row; a
saved status, Done included, is history.
* Guard the pane menu subscription and stop offering Copy where it can never succeed
- A settled read-only miss (no link in a newer build's identity file) no
longer publishes orcaSessionId; only a resolved id or a pending failed link
does, so Copy Agent ID is offered only where a click can succeed.
- Render contract for the per-pane menu selection: another pane's or host's
status change re-renders no unaffected pane; a pane's own stamp flips its
availability.
* Move terminal agent identity SQL into a worker thread
Main's blocking-SQLite ratchet forbids the synchronous identity store, so
(per the decider ruling) agent-identities.db is now owned by one lazy
worker-thread entry per hook-server owner, desktop and orcad alike.
- The schema, open/version handling, mint/link transaction and read-only
behaviour move unchanged into agent-identity-worker-entry.ts; main keeps
only the key type, path and an async client over WorkerThreadRequestQueue.
- Admission stays synchronous: a new key is published pending (null), one
request per exact key is shared by every row and click, and the committed
answer re-stamps the current rows still pending on that key (legacy and
tmux-selected) as identity-only replays. Replies are fenced by store
generation, key and current subscription; failures back off 30 s and a
Copy click retries once.
- terminal.agentId and the terminal-ID refusal are async: Copy waits for the
pending lookup and revalidates the pane; send/task routing resolves the
terminal recipient (awaiting the store's has() on an index miss) before
any synchronous routing or effects.
- The renderer treats the host's row naming a conversation as authoritative
for its id, so a settled miss clears a pending null, while ID-less local
updates keep it.
- Packaged for desktop and orcad; registered as a worker entry, no baseline
growth.
* Own identity demand per key, publish settled ids as projections, recheck authority
Implements the second decider ruling for the identity worker:
- One owner-level demand table replaces the per-key promise backlog and the
settled-row scan: each exact key a current row or caller needs has one
record (identity, places, waiters); the pump sends the worker one operation
at a time, only for keys still needed, so a healthy burst completes and
detached keys are never sent. Operation deadlines start at dispatch; a
caller's wait expiring never drops a row's demand.
- One failure gate for lookups and membership: after a failure nothing is
sent for 30 s except one coalesced Copy attempt; a single owner wake
retries while rows still wait, and cancels with the last demand or close.
- The retirement barrier outlives a client: a replaced worker must exit
before another starts; a different store path is a different authority.
- Settlement re-stamps the stored row and publishes a projection only: window
readers get the row without its hook event (no agent-state record) and
session.tabs is woken by a row touch; no enriched subscriber, plugin event
or freshness heartbeat runs again.
- Copy and terminal membership check the owner generation after their waits.
A known chat is decided by the chat store alone; send, peer mail, reply and
assignee admission resolve the terminal recipient before reading the facts
they act on, recheck the sender after the wait, and group send reselects
its audience and mailboxes after each wait before writing.
* Scope identity answers to their store authority, expire Copy grants with callers, index provider aliases
- One synchronized authority token before Copy/reverse fast paths, compared after their awaits;
answers carry their authority and an ended store turns rows, tmux subjects and the reverse
index pending together. Status path changes sync the authority outside admission.
- A failed operation reschedules the pump so a queued click gets its attempt; grants belong to
live waiters and a click joining a running attempt earns none.
- Provider-native ids resolve through a commit-maintained alias index at the record store.
- Group fan-out no longer classifies authoritative candidates; @idle rereads statuses with
current candidates before the final synchronous selection.
- Hook-server unit fixtures use an in-memory identity client; a real worker load/stop failure
check covers the worker boundary.
* Pick a shared provider alias's owner among its owners only
The alias index keeps the store's listing order (readable, then unreadable) as derived ranks, updated from the draft's appended keys on commit, so a duplicate alias no longer walks the history per lookup.
* Ask a remote pane's host for its Agent ID by the host's own pane key
Copy Agent ID on a web-terminal surface sent the client's mirrored pane key, which the execution host does not know, so it answered null.
* Keep focus where the user moved, recover a missed identity re-stamp, ack peer-mail replays first
Copy Agent ID refocuses its pane only when focus is unclaimed or still in the pane; a carried pending row takes its key's settled answer; an already-delivered peer-mail retry is acknowledged before recipient preparation.
* fix(tab-group): track divider drags by pointer and keep guests click-through
When a divider drag's first move lands on a browser page, the guest's
process takes that event and every later one, so pointer capture never
activates and the divider stays stuck in is-dragging. Hold webview drag
passthrough for the whole gesture, as the pane-divider, tab and DevTools
dock drags already do.
Linux Chromium can report hasPointerCapture() false while moves still
arrive (#34287), so own the gesture by pointerId with window-level
listeners, and end it on a buttonless move when the release was missed.
Drawn from #35919 by alpenshtokk.
Co-authored-by: alpenshtokk <wawesandways@gmail.com>
* fix(tab-group): keep split dividers grabbable beside a narrow browser group
A squeezed browser toolbar overflowed its overlay slot and sat on top of the
divider to its right, so presses in the toolbar row never reached the handle.
Clip the overlay slot to its group like other retained pane hosts.
Adds a real-mouse e2e for a narrow terminal | browser | terminal row: the
divider must be uncovered along its whole height, follow a drag whose first
move lands on the page, and accept the next drag afterwards.
* fix(tab-group): end a lost divider drag on blur, hide or re-press
A release outside the window could be missed with no buttonless move to end
the gesture, leaving guest passthrough held and letting a later pressed move
resume the old drag. End the gesture when the window blurs or is hidden, and
let a new press of the same pointer replace a gesture whose release was missed.
Covers release outside the window, Linux false capture, multiple guest
surfaces and unmount mid-drag.
Co-authored-by: alpenshtokk <wawesandways@gmail.com>
* fix(tab-group): end a lost divider drag on the next press anywhere
Divider moves are tracked on window, but the same-pointer recovery only ran
when the next press landed on the stale handle itself. A press on another
divider or on pane content let later pressed moves resume the old drag, and
with two dividers both followed the new gesture. Listen for the active
pointer's next pointerdown on window in the capture phase and end the stale
gesture before anything handles the press.
* fix(browser): clip the narrow browser toolbar without making it scrollable
overflow-hidden still made the browser overlay slot a scroll container, so
tabbing to a toolbar control clipped in a narrow group scrolled the toolbar
and page sideways with no way back. overflow-clip clips the same way without
a scroll position.
---------
Co-authored-by: alpenshtokk <wawesandways@gmail.com>
* Chat UI settings: install an agent's chat runtime from its row
* Keep the install line while Orca installs over an external copy or can't read status
* Keep Removing… visible in the Chat UI install line
* Chat UI and new chats: show Antigravity sign-in as the next step after install
* Record NativeChatStructuredSession's cleared React Compiler bailout
* Keep the Chat UI row install-only; open sign-in on the chat's host and skip chats on the host's agy
* fix(settings): drop nested cards from Worktree hooks
The orca.yaml status, its parse-error callout and the local-scripts notice drew bordered panels inside the Worktree hooks card. Render them as flat rows; code blocks and inputs keep their borders.
* fix(settings): show healthy orca.yaml status as a collapsed row
Loaded and missing orca.yaml now render as a disclosure row under Command source instead of a tinted card inside the Worktree hooks card; the script preview or template is collapsed by default. Parse-error and update-available keep their warning card. Advanced content is indented to line up with its label. Restores the local-scripts notice card from main.
* chore(i18n): drop orca.yaml status strings the new row no longer uses
* fix(settings): keep orca.yaml row inside design-system lint rules
Kelvin Amoaba
OrcaWinandOrcaWin
Neil
Brennan Benson