mirror of
https://github.com/stablyai/orca.git
synced 2026-11-13 17:37:40 +00:00
cleanup-runner-lifecycle-rules
18
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Brennan Benson
|
fb5a8a0860 |
Run setup and archive scripts for folder projects (#40034)
* feat(workspaces): run setup and archive scripts for folder projects Folder projects get the setup and archive scripts git projects have: creating a workspace runs setup in a Setup tab, and removing one runs archive first. The script sees the workspace's name and id, so `orca worktree create` inside it attaches each new worktree to that workspace, however the workspace was created. - Folder creates (desktop IPC and runtime) prepare setup through the shared setup prep; runtime creates start it with the worktree terminal startup, so Setup-before-agent ordering matches. - Runner files live in <folder>/.orca, one fresh file per launch, removed with the workspace. - Only the host whose catalog holds the folder reads its orca.yaml or runs its scripts; a setup problem becomes a warning, never a failed create. - Shared orca.yaml setup with no approval from an older client is skipped; ask/inherit never refuses a folder create. - No orca.yaml default tabs for folders, since every workspace shares the directory. - New capability worktree.folder-setup.v1 gates the Settings section on runtime hosts; the composer, Settings and trust prompt reuse the existing setup surfaces. * i18n: add folder workspace hooks strings * chore: drop the runner's sync-fs baseline and an array cast * fix(workspaces): close review gaps in folder project setup - Whole-project trust sends an explicit run for folder creates the policy would run, since it carries no content hash. - Folder setup skips file access for a skipped setup and never starts a stopped WSL distro for a create nobody started; removal does the same. - Runtime folder creates return the trust mismatch, so the window re-asks. - The composer hides folder setup controls on hosts without worktree.folder-setup.v1 and keeps their old explicit skip. - Hook checks read a folder only on the host that owns it. - Git archive hooks get the removed workspace's id; WSL hooks blank inherited pane identity too. - Runner files are written through the drive path WSL needs for its drive mounts, and kept out of git status with .orca/.gitignore. - The CLI's older-host warning covers --agent creates and --json output. * fix(workspaces): wait for the folder setup capability and read orca.yaml once Create now waits for a runtime host's folder-setup answer instead of sending Skip while the probe is pending, and runtime setup reuses the parsed orca.yaml when merging effective hooks. * fix(workspaces): keep a failed folder setup probe unknown and retry it on create * fix(workspaces): share folder setup capability answers with the composer * fix(workspaces): re-ask the host for folder setup support on every create * fix(settings): read orca.yaml for folder projects and use workspace copy in hook rows QA found Settings reporting no orca.yaml for folder projects while the composer ran that script, and the inner hook rows still said worktree. * fix(folder-workspaces): open one Setup tab for an instant folder create * fix(workspaces): run setup when a created workspace has only editor tabs * perf(folder-workspaces): per-workspace runner dir, bounded setup answers, one archive config read * fix(folder-workspaces): retain setup capability for active consumers * fix(folder-workspaces): match hook search to workspace descriptions * fix(i18n): drop obsolete hook search descriptions * test(folder-workspaces): follow relocated setup trust modules |
||
|
Brennan Benson
|
3fe350eaed |
Create a worktree per repository from an empty folder workspace (#39575)
A folder workspace with no worktrees now offers Create worktree for each repository, named after the folder workspace. If that branch name is already taken, the host refuses instead of picking another name, and the composer opens so you can choose. |
||
 Kelvin Amoaba
|
81c97bb124 |
perf(runtime): push worktree row changes; host list poll becomes a 10 s backstop (#39688)
* perf(runtime): push worktree row changes; host list poll becomes a 10 s backstop * fix(runtime): announce title-only agent status changes and gate the rows capability with the switch * fix(mobile): keep event reads a floor apart while a read is out; announce a retired title clear * test(runtime): assert the rows notice without counting events |
||
 Jinwoo Hong
|
a55de38395 |
feat(cli): set and rm folder workspaces through the folder workspace RPCs (#39670)
* feat(cli): set and rm folder workspaces through the folder workspace RPCs worktree set and rm on folder:<id> (or a path:/name: selector that matches a folder) now call folderWorkspace.update and folderWorkspace.delete after the runtime confirms the folder id is unique. Flags with no folder meaning are refused before any change, a missing method reports incompatible_runtime, and worktree activate refuses folder workspaces as not supported yet. * test: read mocked method names without a cast * fix(runtime): refuse shared folder ids inside folder update and delete The CLI's show preflight could not make the id-only folder RPCs safe: an older show could select one of two same-id rows, and a twin added during teardown was deleted too. folderWorkspace.update/delete now take requireUniqueId, which refuses a shared id before any side effect, and delete removes only the row it checked. Hosts advertise folder-workspace.unique-id-mutation.v1; the CLI requires it and reports incompatible_runtime otherwise. * fix(runtime): refuse a folder delete when a twin appears during teardown Two rows that share a folder id share every record keyed by it, so delete can't keep one row's sessions while removing the other. After the awaited terminal teardown, delete checks the id again before any cleanup or removal and refuses with the duplicate-id error; only the stopped terminals remain as an effect. Removal by row identity is no longer needed and is dropped. * fix(cli): give only the repair step for a duplicated folder id The generic ambiguity recovery told agents to pass folder:<id>, which can't name one of two folders sharing that id. |
||
|
Jinwoo Hong
|
f341558b82 |
feat(cli): match folder workspaces by path: and name:, keep same-id ps rows apart (#39637)
* feat(cli): match folder workspaces by path: and name:, and keep same-id ps rows apart Adds one runtime matcher for worktrees and folder workspaces. With the new matchFolderWorkspaces opt-in (advertised as workspace-selector.folder-match.v1), path: and name: also match folder workspaces; branch:, issue: and identity: stay repo-backed. Several matches refuse with each choice's kind, host, path and selector; a folder id shared by two folder workspaces refuses with the repair step. The CLI resolves path:/name: through it, so terminal, file and ports commands reach a folder workspace, and create/set parents record a folder parent. Explicit ambiguous parents report LINEAGE_PARENT_AMBIGUOUS. worktree ps now keeps rows that share an id on different hosts apart, with their own host, identity, metadata and activity; activity whose host can't be proven attaches to neither. * test: let the cross-version ps harness pass the host-qualified summary lookup * fix(cli): read each ps row's own host session; qualify folder selector help * fix(runtime): refuse unscoped duplicate folder ids; hand lineage the matcher's typed result Unscoped folder:<id> refuses a duplicated id even when only one copy's host is derivable; a host-scoped lookup still picks that host's copy. A wsl: hook stamp counts as local host evidence. The lineage controller receives the worktree-or-folder candidate directly instead of re-deriving the kind. * docs(cli): guide the ambiguity fallback through truncated ps and id: selectors * fix(cli): report an ambiguous parent by its own choices; cover per-host sessions * fix(cli): send parents to the runtime parent resolver as typed; translate WSL paths for folders too Parent selectors skip the CLI's show-based folder lookup, so worktree.create and worktree.set classify them with parent rules: a folder spanning hosts is a valid parent, and ambiguity reports LINEAGE_PARENT_AMBIGUOUS. Caller-distro Linux path translation now also matches folder workspaces. * chore(rpc): import the computer-use recovery data directly instead of through an alias * fix(runtime): report a missing set parent as LINEAGE_PARENT_NOT_FOUND, as create does worktree set and worktree create now share one explicit-parent error conversion: several matches give LINEAGE_PARENT_AMBIGUOUS and none give LINEAGE_PARENT_NOT_FOUND, so a missing parent is no longer reported as a bare selector_not_found that could mean the child. |
||
|
Brennan Benson
|
d307cf015e |
fix(agents): workspaces created on a paired host use the host's launch settings (#38670)
* fix(agents): workspaces created on a paired host use the host's launch settings Creating a workspace with agent picks or a draft could launch the paired host's agent with desktop settings, or lose the picks during recovery. Let capable hosts compose those launches from their own settings and preserve the user's inputs through fallback creation. Older hosts retain their existing requests. * fix(agents): workspaces created on a paired host use the host's launch settings When a workspace is created on a paired computer, agent picks and Arguments can be replaced by this computer's defaults or dropped during recovery. Keep explicit choices with the submission and let the paired computer resolve its own launch settings. Preserve older-host request behavior, disabled-agent draft substitution and prompt submission, and restore the composer if compatibility preparation fails. * fix(agents): workspaces created on a paired host use the host's launch settings Keep the submitted choices available when a background launch has no prepared startup carrier. Tighten the regression checks for restored composer names, legacy commands and prompt submission so recovery preserves the user's work. * fix(agents): workspaces created on a paired host use the host's launch settings Creating a workspace on a paired machine could ignore its agent settings or lose a draft while the terminal connected. Keep the selected launch inputs and the pending text together through fallback and reconnect, and never replay partially written input. Preserve older hosts' launch commands and ordinary new-tab prompts' editable behavior. * fix(agents): workspaces created on a paired host use the host's launch settings Keep a workspace's pending prompt attached to its original terminal while the pane reconnects. Stop automatic delivery before reporting a final failure, retain the recoverable text, and recognize a launch handed off to the paired host even before its tab appears. Avoid delaying creation on a redundant host status request. * fix(agents): workspaces created on a paired host use the host's launch settings New workspaces on a paired computer could lose their first prompt when the terminal briefly disconnected. Delayed delivery could also continue after reporting failure, or leave terminal-only agents without an accessible copy of their prompt. Keep pending prompts through attachment loss, stop content writes when automatic delivery ends, and offer the existing composer to recover unsent text. Preserve launch identity without inventing empty Arguments or treating missing metadata as a replacement. * fix(agents): workspaces created on a paired host use the host's launch settings A replacement pane can learn its terminal before the layout catches up after reconnecting. Re-registering the effective launch settings then dropped the original first-prompt identity. Recover that identity from the existing verified terminal binding so later remounts keep the same pending prompt. * fix(agents): workspaces created on a paired host use the host's launch settings A terminal binding can identify the launch before its effective Arguments are known. Keep permission notifications working in that state without assuming a launch-settings recipe exists. * fix(agents): workspaces created on a paired host use the host's launch settings Keep an unsent prompt attached to its launch when a paired host briefly disappears, so reconnecting the same terminal can finish delivery. Clear the rest of the exited pane's status as before, and release the binding after delivery or a confirmed end. Offer Copy prompt when automatic delivery finally fails, so the prompt can be pasted into the terminal that already opened. Keep creation-failure Reopen separate. * fix(agents): preserve paired prompt recovery across transport updates Resolve the consumed startup token through the pane's verified binding instead of reading renderer ownership during every remote attach. Keep the transport's host-authoritative exit and reconnect behavior and its fixture guards. Settle pending prompt delivery when the host reconfirms a closed surface, including after it discards the terminal's exit record. Update the remount fixture for the Windows PTY model binding. * fix(agents): merge duplicate imports flagged by type-aware lint * test(agents): fix type assertions in paired launch fixtures Type the repository rows, mutable agent choice and terminal tab used by launch regressions. Reuse the session binding across its real installers and document the partial-fixture adapters required by the runtime APIs. Keep the RPC, remount and prompt-delivery assertions unchanged. * fix(agents): route workspace terminals through their owning host Creating a terminal for an existing workspace could send it to another focused server. Resolve its owning host when no explicit route was supplied, and keep the host-shaped draft regression within the shared startup contract so renderer checks do not pull in main-process code. * test(agents): align launch fixtures with runtime dependencies Retain real i18n exports while replacing translation output, hoist the terminal restore toast spy, and supply the explicit host environment used by paired terminal callers. Keep the existing behavior assertions unchanged. * fix(agents): isolate prompt failure notice dependencies Load the prompt failure notice only when a settled hosted launch needs it, so workspace recovery consumers do not initialize toast and localized agent catalogs just by importing delivery code. Keep prompt retirement and its recoverable draft synchronous, and preserve the existing Copy prompt action. Restore the ordinary new-tab failure toast's original invocation and verify that Fix Checks retains its edited request through the activation handoff. * test(agents): route legacy wire launches to their fixture host Pass the paired environment explicitly in legacy terminal-creation fixtures, matching real launch callers instead of relying on the focused host. Keep all compatibility and accepted-creation assertions unchanged. * fix(agents): preserve paired work-item completion without a startup plan Blank-terminal work-item launches on paired hosts now keep their successful activation result. If the agent command cannot be built, show that error once instead of reporting an activation failure. * refactor(agents): deliver paired creation prompts once like agent tabs Drop the retained hosted-prompt lifecycle (pending map, rebind, deadline, terminal retirement, token recovery). After the host creates the session the desktop attempts the prompt once; failure shows the prompt-not-sent toast with Copy prompt. * fix(agents): silence prompt failures after closing a workspace terminal Closing a paired workspace terminal before the agent was ready could report a prompt failure after that terminal was gone. Use shared launch completion and existing tab records to keep deliberate closes silent while preserving one Copy prompt notice after an interrupted delivery. Prepared launches now decide client delivery from the host request. * fix(agents): report every failed paired prompt delivery A paired host can retract its tab from inventory without the user cancelling the launch. Always report a failed prompt attempt with Copy prompt, using the same single-attempt completion as agent tabs. * test(agents): name host-session fixture mock types |
||
|
Jinwoo Hong
|
555bd481bc |
Let multi-repo folder workspaces parent and nest workspaces, including on other machines (#38904)
Multi-repo folder workspaces can parent workspaces on this machine and on paired servers, and their children nest under them in the sidebar and on the phone. Task parents are inferred at creation instead of on every lineage refresh. |
||
 Neil
|
490a5c05b8 |
fix(hooks): run a created worktree's setup once its own content is approved (#37978)
* fix(hooks): run a created worktree's setup once its own content is approved Adds worktrees:runApprovedSetup (IPC) and worktree.runApprovedSetup (RPC, capability worktree.run-approved-setup.v1). The host re-hashes the worktree's setup and default-tab commands, runs them only on a match, and otherwise reports the new content. After a create mismatch the host opens only the command-less default tabs; approving in the trust prompt starts setup and the command tabs. Clients whose host lacks the capability keep setup skipped. * fix(hooks): review a created branch's different setup from the workspace, not instead of it The trust prompt now says the workspace was created and its branch's setup differs; approving runs it for that workspace without replacing the primary checkout's approval (which made the next create prompt twice). Declining shows a toast whose Review setup action reopens the prompt. Repo-wide trust returns the content's hash so the host can run it. * fix(worktrees): import approved setup from its path after the RPC methods move |
||
|
Brennan Benson
|
e0005f5cbf |
Attach existing worktrees to folder workspaces from the CLI (#39018)
* feat(cli): attach existing worktrees to folder workspaces worktree set accepts --parent-worktree folder:<id> (hosts advertise worktree.set.folder-parent.v1), keeping each worktree to one parent in the store. --parent-worktree active/current resolves to a folder workspace from its terminal or enclosing directory, and worktree create without --repo under a folder workspace lists the folder's Git repositories with a ready command. * fix(cli): report folder parents and keep typed flags in folder repo choices worktree show/set report a folder parent; the missing-repo error lists --repo choices to add to the user's command and names the Attached worktrees panel. Load and import repairs skip malformed rows and only touch imported worktrees, an import keeps a worktree's existing parent, a twin-owned folder parent warns, and folder ambiguity keeps its choices. * fix(persistence): settle one parent per imported worktree before writing An Orca server migration import now decides each touched worktree's parent before any write: an explicit folder parent replaces an inferred worktree parent, any other disagreement refuses the import. --parent-worktree active in a folder terminal still lists the folder's repositories. * fix(persistence): let a folder parent beat hydrate's inferred worktree parent Load repair and import reconciliation share one rule: an inferred worktree parent loses to a folder parent when the folder was chosen explicitly or the worktree parent carries hydrate's orchestration stamp. Import tests now run payloads through the manifest parser and cover a conflict that appears after staging. * fix(cli): list folder repos when active resolves to the enclosing folder worktree create without --repo used only the terminal's env to find the folder, so --parent-worktree active run outside an Orca terminal fell back to the generic missing-repo error. Use the parent create already resolved. |
||
|
Jinwoo Hong
|
a9ba59c944 |
Nest workspaces under parents on other machines (#38740)
* feat(lineage): store cross-store parent links beside same-store lineage (inert)
A workspace's parent can live in another Orca store. Save that link in the
child's store under a new top-level key, crossStoreLineageByChildKey, so older
builds' same-store cleanup never reads it. Nothing writes records yet.
- Types, load normalization (malformed entries dropped one by one), section label.
- Store get/set/remove by child; a child keeps at most one parent record.
- Every maintenance path acts by the child only: deletion and missing-worktree
pruning, repo removal and deregistered-repo residue, identity migration,
profile project transfer, WSL move projection and UNC drive conversion, and
the orcad migration dormant payload (export, validation, import, subtraction).
* fix(lineage): gate cross-store links on host capability; one parent per child
- Migration stage/commit carrying crossStoreLineage requires the new
orcad.migration-cross-store-lineage.v1 capability; older hosts are refused
before staging instead of silently dropping the links. Empty arrays are omitted.
- Payload validation and destination prepare reject a child that has both a
cross-store and a same-store parent, through one shared conflict check.
- Saved entries stay on disk as written; the map is Record<string, unknown> and
readers go through validCrossStoreLineage. Re-keying moves unreadable entries unchanged.
- Tests: literal expectations; drop touched mock-call and work-count assertions.
* test(lineage): drop clone and save work-count assertions from project group removal test
* feat(lineage): resolve cross-store parents into the sidebar parent map (inert)
- One resolver: a saved record nests its child under the single visible
row whose store reports the parent's installationId and whose instance
matches; copied installs, unknown stores and stale instances stay standalone.
- getSidebarLineageParentsByIdentity merges resolved cross-store parents with
same-store edges before cycle breaking; a valid same-store edge wins.
- Workspace delete collects descendants only from the parent's own store.
- Store identity: paired stores from their verified status hostDescriptor;
this store from the published descriptor, else host-installation.json.
- Nothing passes a view or writes records yet, so the sidebar is unchanged.
* fix(lineage): import WorkspaceKey from workspace-scope after main move
* fix(lineage): resolve sidebar parents once over complete rows; keep unowned rows' delete rule
- resolveSidebarLineageParentIdentities resolves same-store edges and cross-store
records once over every visible store's unfiltered rows, then drops cycles.
Ancestor injection and nesting reuse that map, so a filtered-out twin still
makes a parent ambiguous.
- Removed, retired or refusing paired servers leave the view: their records stay
saved and their children standalone. Offline servers keep their last-known id.
- A row with no owner is unknown, not ours: it never resolves, and delete only
excludes descendants whose store is known and differs from the parent's.
* fix(lineage): refuse UNC rekey collisions and transfers giving a child two parents
The UNC drive conversion rekeys cross-store child keys through the shared
collision merge, so a UNC key and its drive key with different records throw
instead of one silently overwriting the other. Profile project transfer runs the
shared child-key conflict check before writing the target.
* feat(lineage): write, carry and nest cross-machine parents
- Capability worktree.lineage.crossMachine on the child's store; the CLI
refuses before any request when the server lacks it.
- worktree.set / worktree.create accept crossStoreParent
{ installationId, workspaceKey, instanceId } and write only
crossStoreLineageByChildKey (refused when it names this store, or the
child has no identity). Remove Parent clears both.
- worktree.crossStoreParentRef: the parent's own store names it with its
installationId; reparent refuses a parent whose chain already reaches
another store. Same-store Set Parent refuses the same.
- worktree.ps rows and lineage lists carry the records; same-store lineage
fields stay null so older readers show the child standalone.
- The desktop sidebar resolves parents over its own and paired stores'
records (PR 2's resolver) at the visible-worktree and row-plan call sites.
- CLI: active/current or an inferred terminal parent against a server is
sent as a cross-store parent.
* fix(lineage): read worktree rows through the record selector; mark the test runtime cast
* fix(lineage): hydrate every store, fence refreshes, honest CLI fallback
- Each host's catalog hydration fetches its lineage snapshot, so this
desktop's identity and records load whichever store is focused.
- Cross-store records join the per-child request-start fence: a stale
lineage list can't restore a removed record or override a newer one.
- A failed inferred cross-store parent sends noParent instead of
forwarding the selector a server could match to a same-store twin.
- Inferred cross-store creates record env-workspace/inferred capture.
- The writer states its trust contract; the chain rule runs at the mint.
* feat(lineage): cross-machine parents on the phone, pickers, chat resume and labels
- Phone: the list nests a child under a parent on another machine, from the
records rows already carry and the store identities its host verified
(status.get descriptor; relayed servers' installationId on the host list).
- Set Parent popover, context menu and the composer's parent picker offer
parents in other visible stores. The parent's own store names it
(worktree.crossStoreParentRef); the window checks it against that store's
verified installationId and the child store's capability before any write.
Remove Parent and Open parent cover cross-machine links.
- Native chat resume ancestors follow resolved cross-machine parents.
- Host sections keep a nested child under its parent and keep its own
machine label.
- Main sidebar feed resolves cross-store parents (rows carry records; desktop
facts and paired-host facts carry identities); paired web windows read
their host's installationId; reveal without an occurrence plan resolves
them; `worktree create --agent` names a parent on another machine.
* test(lineage): type the mint test's parent row through unknown
* test(lineage): give the cross-machine tests' partial-row casts their SAFETY reasons
* fix(cli): worktree set names a parent on another machine
* feat(lineage): name the machine of parent candidates on another machine
* fix(lineage): Set Parent and Remove Parent act on the clicked row's own host
* fix(lineage): phone resolves parents over every row before the repo filter
* fix(lineage): chat resume nests by host-qualified identity across machines
* fix(lineage): local create refuses a same-install parent before checkout and shares the RPC recorder
* fix(lineage): name parent machines without a focus read; keep create's probes synchronous
* fix(lineage): chat resume keys offers by their own machine; only cross-machine parents leave a section
* fix(lineage): name an older parent server before asking it for a cross-machine ref
* fix(lineage): an app-picked parent on another machine records as manual
* fix(lineage): chat resume keeps base grouping; only resolved cross-store parents move a chat
* revert(lineage): drop chat resume from cross-machine parents; it groups by machine as before
* refactor(lineage): CLI builds cross-machine parents; explicit only
- Drop worktree.crossStoreParentRef and its reparent chain walk: the CLI
builds the ref from this desktop's installationId (worktree.lineageList
now reports it) and the parent row it reads. Cross-machine chains are
allowed; same-store cycle validation and same-install refusal stay.
- No inferred cross-machine parent: remove crossStoreParentInferred and
the fallback states. Against a server, this machine's terminal, cwd and
env context is never sent; the CLI prints how to nest explicitly.
* refactor(lineage): build cross-machine parent refs from verified ids; pickers hide only loops; one desktop install id source
* refactor(lineage): refuse moving a linked workspace instead of carrying the link
Orcad migration and profile project transfer now refuse, before any staging or
write, when a workspace in the move has a cross-store parent record (raw entries,
readable or not). Remove the carry machinery: the dormant crossStoreLineage
field, its runtime capability and destination gate, import/subtract/claim code,
transfer carry and the two-parent conflict checker. Also drop the unused
removeCrossStoreWorkspaceLineage.
* docs(lineage): describe cross-store parent refs without the removed mint RPC
* test(lineage): drop the RPC call-list assertion from the cross-store ref test
* fix(lineage): refuse linked moves before any write and for shared-repo children
- Migration refusal passes the child's own host stamp to the scope matcher and
refuses an unstamped key whose shared repo id the move includes, so such a
child can't move while its link stays behind.
- Profile transfer checks the read-only source snapshot before pending-move
recovery or storage migration; the payload check stays as the final guard.
* fix(lineage): refuse a linked profile move before the profile lookup can restore the index
* fix(lineage): startup hydration of other stores loads only cross-machine links
* fix(lineage): list the child's own machine first in the parent picker
* fix(lineage): keep profile argument errors ahead of the linked-move preflight
* fix(worktrees): let the first listing replace a restored server workspace stub
A restored active server workspace starts as a session stub with no head.
If git status fills in its branch before the first listing lands, the
listing merge took that as a concurrent branch switch and kept the stub,
dropping the catalog row (instance id, lineage, provenance). The workspace
then showed standalone until the next listing.
* fix(worktrees): accept a headless row's listing only when it confirms git status
A stale listing could otherwise roll back a branch switch git status saw on
an empty-head row (e.g. an SSH fallback row) during the first connected listing.
* feat(lineage): CLI nests a create on another machine under the caller workspace
- No parent flag and no --no-parent against a server: the caller's workspace
on this machine (env, else cwd) is sent as an inferred cross-store parent,
the way --parent-worktree active builds it. The host records it as
inferred from environment or cwd.
- A server without worktree.lineage.crossMachine, or a caller workspace that
can't be linked, still creates unnested and prints one note.
- An inferred parent falls away for folder targets, as same-machine folder
creates record none.
* fix(lineage): CLI cross-machine inference reads the caller terminal and suppresses fallbacks
- The caller terminal's workspace joins env and cwd as an inferred parent,
with same-machine precedence: env and terminal must agree, cwd only alone.
- A fallback (old server, unlinkable or unresolved caller, ambiguous cwd)
prints one note and sends noParent, so the server's own create-time
inference can't nest what the CLI reported as not nested.
* feat(sidebar): drag a workspace onto one on another machine to nest it
Dropping a workspace on a workspace from another machine now sets the
parent through the same cross-machine path as Set Parent: same eligibility
(loops, older servers), same refusal messages. Drop targets carry host
identity so the child's own copy is the one written.
* refactor(lineage): this machine's Orca resolves the caller parent for a create on another machine
- New read-only worktree.resolveCallerParent runs the same-machine create
resolver over the caller's env, terminal and cwd context, so stale
contexts are skipped and only validated parents can conflict, and returns
the cross-store ref or a reason.
- The CLI's own precedence and terminal lookup are removed; it keeps the
capability gate, one note with noParent on any fallback, and silence with
no Orca context.
* feat(orchestration): remote worker-start --worktree new-child nests under the coordinator's workspace
worker-start --on <server> --worktree new-child creates the server's worktree
under the coordinator's workspace on this machine, using the same verified
cross-machine parent ref as the CLI's caller auto-nest. A server without
cross-machine parents still starts the worker, top-level, with a warning in
the receipt. Guide, CLI help and docs describe it.
* fix(lineage): resolveCallerParent reads this store's identity without creating it
- Uses the published host descriptor's installationId, else the existing
host-installation.json; never creates or repairs it. Missing identity
returns a reason, so the CLI creates unnested with its note.
- Drops the read-only wording: parent resolution does the same catalog
upkeep a same-machine create does.
* fix(sidebar): validate every cross-machine parent before a multi-select drop writes
A drop of several workspaces builds every cross-machine parent ref first, so an
older server's refusal leaves the whole selection unchanged. Drops the touched
preview-timing test cases.
* refactor(orchestration): build the remote new-child parent ref with the shared caller resolver
Orchestration still picks the caller workspace; resolveCallerParentForAnotherStore
verifies it and builds the ref, and both read the installationId the same way.
Drops the copy and mock-call tests.
* fix(lineage): narrow the inferred source with a guard instead of casts
* fix(lineage): a composer parent picked on another machine nests normally once the destination is that machine
The retained host-qualified pick is classified against the current destination:
same host gives the ordinary parent fields, another store the cross-machine ref.
Also corrects two stale comments.
* perf(lineage): read only the requested child's cross-store entry
* perf(lineage): request each store's lineage list once at startup
* perf(lineage): cap optional caller-parent inference at 3 s and skip a timed-out local Orca
* perf(lineage): return cached sidebar parents when selector inputs are unchanged
* fix(lineage): snapshot selector inputs without a type assertion
* Route startup lineage and the sidebar lineage memo through their owners
|
||
|
Neil
|
d09519f0f1 | refactor: group workspace and runtime contracts by defining owner (#38018) | ||
|
Brennan Benson
|
cf5f427d43 |
Keep worktree branches unless CLI deletion is requested (#35948)
* Keep CLI-removed worktree branches unless requested * Bind branch policy checks to removal connections * Remove redundant local default removal test row * Negotiate worktree branch policy on the mutation connection * Fix removal integration compiler boundaries and type imports * Use checked annotations in paired removal fixtures * Reset CLI integration exit status across test runtimes |
||
|
Neil
|
76cb99dc52 |
feat(automations): label workspaces a host creates with the desktop's own automation run (#35986)
* feat(automations): label workspaces a host creates with the desktop's own automation run A desktop's own automation could create its workspace on a managed or paired host, but the workspace lost its automation identity: no badge, and its run pane closed instead of sleeping. The desktop now sends a capable host its run as a label, naming itself (`local`) as the automation's owner. The host records it with origin 'client', only for automations it does not hold, caps its fields, and never lets a client-origin label grant run ownership, sleep authority or automation create policy. Older hosts get nothing new; older desktops still create plain workspaces. A client-origin label whose automation can't be found reads as unavailable, not removed. Refs #34433 * test(automations): keep the dropped-label warning test independent of test order Refs #34433 |
||
 Jinjing
|
bc55fe3cb0 |
Support explicit remote branch reuse across workspaces (#34295)
* Support explicit remote branch reuse across workspaces - Preserve selected branch identity, tracking, and busy-branch handling - Add explicit branch-off intent with v2 runtime capability gating * Style existing workspace action in branch reuse UI * Preserve explicit branch reuse with versioned host support - Gate strict reuse on a new request capability while retaining legacy behavior - Warn when a reused remote branch cannot be configured as the push upstream * Clarify selected branch checkout options * Offer existing or new branch choices for worktrees * Preserve new-branch intent when reusing a branch name * Adapt branch composer tests and catalog after rebase * Refresh mobile RPC recordings for branch intent capabilities * Remove retired Russian localization entries * Remove retired German and Turkish localization entries * Add branch selection translations for existing workspaces * Localize mobile worktree branch selection |
||
|
Neil
|
9dd6f26a6e |
fix: allow dismissing workspace auto-name failures (#35545)
* fix: allow dismissing workspace auto-name failures * fix: retain auto-name failures until dismissal is saved * refactor: use workspace selectors for metadata state updates |
||
 Pr1pandBrennan Benson
|
fdcf193cd4 |
fix(worktree): track explicit remote-only branch (#31645)
* fix(worktree): track explicit remote branch * test(worktree): cover remote branch path retry * fix(worktree): resolve cached remote branches canonically * fix(git): retain commit validation in bounded ref probes * fix(worktree): preserve selected remote identity during creation * test(worktree): count cached resolver Git work during path retries * Fix branch intent state in composer source fixture * Make Git and daemon regression fixtures portable * Use the selected base for existing branch creation --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> |
||
  OrcaWinandOrcaWin
|
7d6603aa17 |
[comment audit] Complete repository-wide comment cleanup (#33249)
* [comment audit] Align legacy failure-read counts with cached display * [comment audit] Condense shared provider lifecycle and browser recovery comments [skip ci] * [comment audit] Condense shared generation, path and preview comments [skip ci] * [comment audit] Condense host, file and Git contract rationale [skip ci] * [comment audit] Tighten Git lifecycle and provider contract comments [skip ci] * [comment audit] Clarify shared host authority and launch isolation [skip ci] * [comment audit] simplify local access mobile and native chat contracts [skip ci] * [comment audit] simplify native chat presentation and state contracts [skip ci] * [comment audit] simplify native runtime and provider contracts [skip ci] * [comment audit] simplify migration and orchestration contracts [skip ci] * [comment audit] simplify plugin trust and process capture rationale [skip ci] * [comment audit] simplify terminal delivery and remote compatibility rationale [skip ci] * [comment audit] clarify remote recovery and launch wire rationale [skip ci] * [comment audit] shorten shared RPC compatibility and runtime evidence comments [skip ci] * [comment audit] simplify secure storage shell startup and sidebar rationale [skip ci] * [comment audit] clarify sidebar, skill and SSH invariants [skip ci] * [comment audit] condense structured chat delivery and timing rationale [skip ci] * [comment audit] condense terminal replay and telemetry invariants [skip ci] * [comment audit] clarify launch permission and terminal delivery rationale [skip ci] * [comment audit] clarify workspace ownership and layout contracts [skip ci] * [comment audit] wait for fitted and painted SSH terminal links * [comment audit] clarify layout persistence and session ownership [skip ci] * [comment audit] clarify host routing and workspace lifecycle contracts [skip ci] * [comment audit] clarify startup persistence and app lifetime comments [skip ci] * [comment audit] clarify recovery and activity boundaries [skip ci] * [comment audit] condense activity and artifact invariants [skip ci] * [comment audit] condense automation authority contracts [skip ci] * [comment audit] simplify automation scheduling and history contracts [skip ci] * [comment audit] clarify browser chrome and annotation lifecycles [skip ci] * [comment audit] clarify browser routing and retained guest ownership [skip ci] * [comment audit] clarify browser recovery and document ownership comments [skip ci] * [comment audit] restore hosted runners required by native IME fixtures * [comment audit] shorten preview, palette and dashboard invariants [skip ci] * [comment audit] clarify terminal preview, dashboard and retention comments [skip ci] * [comment audit] clarify diff-note recovery and editor lifecycle comments [skip ci] * [comment audit] shorten rich-text and combined-diff ownership comments [skip ci] * [comment audit] shorten autosave, draft recovery and model ownership comments [skip ci] * [comment audit] shorten save-queue, notebook and Markdown constraints [skip ci] * [comment audit] shorten Monaco, PDF and rich Markdown safeguards [skip ci] * [comment audit] clarify rich Markdown source and selection safeguards [skip ci] * [comment audit] clarify editor loading and emulator stream lifetimes [skip ci] * [comment audit] trim emulator and feature tour narration [skip ci] * [comment audit] clarify floating workspace and GitHub cache ownership [skip ci] * [comment audit] trim provider controls and Linear filter explanations [skip ci] * [comment audit] clarify pairing and chat resume lifetimes [skip ci] * [comment audit] clarify chat delivery and transcript lifetimes [skip ci] * [comment audit] clarify session options and host-owned status [skip ci] * [comment audit] clarify draft durability and live-status precedence [skip ci] * [comment audit] Trim chat send and model ownership explanations [skip ci] * [comment audit] Shorten transcript ownership and send recovery comments [skip ci] * [comment audit] Simplify native chat composer and transcript hook comments [skip ci] * [comment audit] Shorten native chat scroll and structured session explanations [skip ci] * [comment audit] Trim workspace picker and onboarding commentary [skip ci] * [comment audit] Simplify pet rendering, review cache and quick open comments [skip ci] * [comment audit] Trim sidebar and session history explanations [skip ci] * [comment audit] Condense session resume and review checks comments [skip ci] * [comment audit] Shorten checks state and file explorer refresh comments [skip ci] * [comment audit] Trim plugin bridge and source-control action rationale [skip ci] * [comment audit] Trim source-control listing and review rationale [skip ci] * [comment audit] Shorten sidebar lifecycle and explorer safeguards [skip ci] * [comment audit] Condense Settings account and appearance rationale [skip ci] * [comment audit] Trim pairing and repository Settings explanations [skip ci] * [comment audit] Condense Settings search SSH and terminal safeguards [skip ci] * [comment audit] Shorten Settings voice and provider ownership comments [skip ci] * [comment audit] Condense Settings draft persistence and host-state rationale [skip ci] * [comment audit] Trim Settings hooks and sidebar setup rationale [skip ci] * [comment audit] Condense sidebar deletion and board-filter safeguards [skip ci] * [comment audit] Condense worktree cards, host ownership and Markdown contracts [skip ci] * [comment audit] Condense sidebar drag, folder and filtering contracts [skip ci] * [comment audit] Condense sidebar parity, sleep and host ownership contracts [skip ci] * [comment audit] Prune focus-read baseline after comment cleanup * [comment audit] Clarify sidebar visibility, board drops and agent evidence [skip ci] * [comment audit] Tighten sidebar listing, drag and reveal contracts [skip ci] * [comment audit] Clarify viewport geometry and skill update safeguards [skip ci] * [comment audit] Tighten skill inventory, usage and host status comments [skip ci] * [comment audit] Clarify usage ownership and resource kill safeguards [skip ci] * [comment audit] Tighten tab selection, rename and search contracts [skip ci] * [comment audit] Tighten tab-strip geometry and drag ownership comments [skip ci] * [comment audit] Tighten Tasks recovery, pagination and mutation comments [skip ci] * [comment audit] Tighten provider loading and terminal recovery comments [skip ci] * [comment audit] Tighten completion, cadence and PTY ownership comments [skip ci] * [comment audit] Clarify terminal restore and parked-pane boundaries [skip ci] * [comment audit] Tighten PTY startup and replay explanations [skip ci] * [comment audit] Clarify PTY identity and delivery ownership [skip ci] * [comment audit] Shorten remote reconnect and input replay rationale [skip ci] * [comment audit] Condense terminal parking clipboard and file link comments [skip ci] * [comment audit] Clarify IME ownership and trim trace history [skip ci] * [comment audit] Shorten pane recovery and parked watcher explanations [skip ci] * [comment audit] Condense snapshot replay and visibility recovery rationale [skip ci] * [comment audit] Shorten terminal parking and keyboard ownership rationale [skip ci] * [comment audit] Trim renderer lifecycle and menu rationale [skip ci] * [comment audit] Condense workspace cleanup ownership and settlement notes [skip ci] * [comment audit] Clarify renderer hook evidence and source ownership [skip ci] * [comment audit] Tighten IPC ownership and reconnect explanations [skip ci] * [comment audit] Trim renderer focus, paste and attention comments [skip ci] * [comment audit] Shorten scroll, locale and agent lifecycle comments [skip ci] * [comment audit] Trim agent launch, resume and ownership commentary [skip ci] * [comment audit] Shorten account, browser and editor comments [skip ci] * [comment audit] Clarify host-mirror waits, previews and input ownership [skip ci] * [comment audit] Condense launch recovery and editor tokenization comments [skip ci] * [comment audit] Condense workspace selection and terminal pane rationale [skip ci] * [comment audit] Condense terminal fitting and rendering recovery comments [skip ci] * [comment audit] Condense terminal input and host routing explanations [skip ci] * [comment audit] Condense ownership and sleeping-session recovery rationale [skip ci] * [comment audit] Condense structured launch and terminal link explanations [skip ci] * [comment audit] Condense terminal ownership and workspace file routing rationale [skip ci] * [comment audit] Condense session persistence and workspace activation rationale [skip ci] * [comment audit] Condense workspace routing and browser ownership rationale [skip ci] * [comment audit] Condense mirror recovery and layout authority rationale [skip ci] * [comment audit] Condense runtime transport and file safety rationale [skip ci] * [comment audit] Condense runtime graph and structured session rationale [skip ci] * [comment audit] Condense browser creation and remote tab recovery rationale [skip ci] * [comment audit] Condense snapshot authority and publisher recovery rationale [skip ci] * [comment audit] Condense frame, startup and provider cache rationale [skip ci] * [comment audit] Condense host twin and agent lifecycle rationale [skip ci] * [comment audit] Condense browser authority and editor cleanup rationale [skip ci] * [comment audit] Condense editor buffer identity and review cache rationale [skip ci] * [comment audit] Condense provider lifetime and repository ownership rationale [skip ci] * [comment audit] Condense reconnect, hydration and terminal retirement rationale [skip ci] * [comment audit] Condense recovery, reconciliation and persistence rationale [skip ci] * [comment audit] Condense cleanup ownership and listing admission rationale [skip ci] * [comment audit] Condense teardown ordering and terminal ownership rationale [skip ci] * [comment audit] Condense recovery ledger and web host-boundary rationale [skip ci] * [comment audit] Condense web reconnect and credential lifecycle rationale [skip ci] * [comment audit] Condense cloud rollout and assignment safety rationale [skip ci] * [comment audit] Condense relay session and database recovery rationale [skip ci] * [comment audit] Condense relay placement and protocol compatibility rationale [skip ci] * [comment audit] Condense build and packaging constraints [skip ci] * [comment audit] Condense CI gates and validation isolation rationale [skip ci] * [comment audit] Condense catalog identity and browser validation rationale [skip ci] * [comment audit] Condense mobile browser and frame-budget rationale [skip ci] * [comment audit] Shorten mobile route and browser test explanations [skip ci] * [comment audit] Condense editor and session seam test rationale [skip ci] * [comment audit] Trim session and terminal closure history [skip ci] * [comment audit] Shorten terminal browser and census explanations [skip ci] * [comment audit] Preserve root-only E2E diagnostic baseline * [comment audit] Condense mobile seam and HTML preview test rationale [skip ci] * [comment audit] Condense preview instrumentation and render harness rationale [skip ci] * [comment audit] Condense bundle contracts and native-build constraints [skip ci] * [comment audit] Shorten native packaging and CI routing rationale [skip ci] * [comment audit] Condense release tooling and benchmark constraints [skip ci] * [comment audit] Condense packaging and platform gate rationale [skip ci] * [comment audit] Shorten mobile route and history rationale [skip ci] * [comment audit] Condense mobile browser and component rationale [skip ci] * [comment audit] Shorten drawer and workspace-form rationale [skip ci] * [comment audit] Trim mobile review and editor-document explanations [skip ci] * [comment audit] Condense editor lifecycle and Markdown explanations [skip ci] * [comment audit] Trim mobile file, diagnostics and dictation commentary [skip ci] * [comment audit] Simplify mobile host-list and workspace-view explanations [skip ci] * [comment audit] Clarify mobile shell lifetime and bridge delivery constraints [skip ci] * [comment audit] Condense bridge stream, native request and audio rationale [skip ci] * [comment audit] Reduce bridge schema and page-client commentary [skip ci] * [comment audit] Tighten mobile page bridge contracts [skip ci] * [comment audit] Clarify mobile cache and session constraints [skip ci] * [comment audit] Condense mobile route and lifecycle rationale [skip ci] * [comment audit] Tighten mobile shell hook timing rationale [skip ci] * [comment audit] Clarify route handoff and notification compatibility [skip ci] * [comment audit] Clarify push registration and dictation cleanup constraints [skip ci] * [comment audit] Condense keyboard geometry and native media ownership rationale [skip ci] * [comment audit] Tighten mobile chat scroll and composer concurrency rationale [skip ci] * [comment audit] Condense mobile reply compatibility and upload ownership rationale [skip ci] * [comment audit] Condense optimistic echo and scroll ownership rationale [skip ci] * [comment audit] Tighten stream replay and queued session ownership rationale [skip ci] * [comment audit] Condense mobile composer and reply-schema constraints [skip ci] * [comment audit] Clarify mobile transcript recovery and session ownership [skip ci] * [comment audit] Clarify mobile queue and source-control compatibility [skip ci] * [comment audit] Condense storage and task launch constraints [skip ci] * [comment audit] Clarify task schemas and terminal document ownership [skip ci] * [comment audit] Tighten terminal input and viewport rationale [skip ci] * [comment audit] Shorten terminal and RPC recorder contracts [skip ci] * [comment audit] Condense recorder engine and connection contracts [skip ci] * [comment audit] Shorten host credential and relay recovery comments [skip ci] * [comment audit] Tighten pairing recovery and bundle transport rationale [skip ci] * [comment audit] Clarify RPC delivery and workspace catalog boundaries [skip ci] * [comment audit] Condense catalog and relay entry contracts [skip ci] * [comment audit] Shorten shutdown and SSH relay delivery contracts [skip ci] * [comment audit] Condense WSL relay and E2E regression rationale [skip ci] * [comment audit] Shorten cross-version harness and renderer fixture explanations [skip ci] * [comment audit] Condense paired-host and E2E lifecycle rationale [skip ci] * [comment audit] Shorten layout oracle and regression explanations [skip ci] * [comment audit] Condense paired recovery and ownership regression contracts [skip ci] * [comment audit] Shorten restart, sidebar and SSH lifecycle contracts [skip ci] * [comment audit] Condense terminal rendering and IME regression rationale [skip ci] * [comment audit] Shorten terminal recovery and benchmark contracts [skip ci] * [comment audit] Condense tooling and Windows lifecycle proof rationale [skip ci] * [comment audit] Condense workflow routing and release rationale [skip ci] * [comment audit] Condense mobile security and installer contracts [skip ci] * [comment audit] Shorten native rationale and stylesheet workarounds [skip ci] * [comment audit] Shorten Windows visibility probe rationale [skip ci] * [comment audit] Condense embedded release and signing rationale [skip ci] * [comment audit] Retain current main test behavior in final reconciliation [skip ci] * [comment audit] Complete final comment review across current source inventory * [comment audit] Handle consolidated audit reports before final CI * [comment audit] Preserve credential storage census detail [skip ci] * [comment audit] Scale broad changed E2E selections with verified timing shards * [comment audit] Align E2E assertions with browser close and settled session metadata * [comment audit] Match existing E2Es to current resource and windowing contracts * [comment audit] Observe the shared server outage notice in reconnect coverage * [comment audit] Make existing renderer probes measure settled tab and PTY work * [comment audit] Align palette E2E selector with task search * [comment audit] Refresh remaining palette search selectors * [comment audit] Keep selector correction within selected audit specs * [comment audit] Await emoji fixture settings inside renderer evaluation * [comment audit] Cancel fixture fit retries between terminal tests --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Brennan Benson
|
c93514db5b |
refactor(protocol): each area owns its published runtime capability list (#30641)
* refactor(protocol): each area owns its published runtime capability list RUNTIME_CAPABILITIES now spreads one array per area instead of a flat hand-appended list, and runtime-capability-constants.ts is split into the areas that own each constant. The published set is unchanged and pinned by an exact sorted test. * test: preserve capability baseline while allowing additions |