* Add worktree labels for localhost ports
* Fix localhost label test fixtures
* Extend localhost worktree labels to agents
* Address localhost label review feedback
* Remove localhost label page injection; stream responses untouched
Drop the title/favicon HTML injection from the localhost label proxy.
The proxy now only relabels the hostname and pipes responses straight
through, so app CSP/cookies/bodies are preserved and large/streamed
responses are no longer buffered in memory.
- Normalize wildcard bind hosts (0.0.0.0 -> 127.0.0.1, :: -> ::1) before
using them as a proxy connect target.
- Delete the favicon SVG generator and dead repoIcon/badgeColor plumbing.
- Remove orphaned LocalhostLabelMock i18n keys.
Co-authored-by: Orca <help@stably.ai>
* Harden localhost label proxy from review
- IPC register: restrict proxy target to loopback or a matching scanned
workspace port (close open-proxy/SSRF surface from untrusted renderer).
- Proxy: guard against ERR_HTTP_HEADERS_SENT on mid-stream upstream error;
add error/cleanup listeners on client request/response and upgrade socket.
- labelLocalhostUrl: fall back to the raw URL when the proxy rejects a
target (e.g. https) instead of throwing.
- Port label route: include worktreePath so button-open and terminal/CLI
paths produce the same label.
- Terminal OSC link hover: discard stale async tooltip results via a hover
token, matching the WebLinks path.
Co-authored-by: Orca <help@stably.ai>
* Match default-port advertised hosts in localhost label target check
Co-authored-by: Orca <help@stably.ai>
* Consolidate duplicated localhost label helpers
- Move the loopback host set, loopback-URL parser, and wildcard
connect-host normalizer into shared/localhost-worktree-labels.ts; proxy,
runtime, terminal link routing, and the IPC guard now share one copy.
- Extract the port -> repo -> worktree -> project label-route lookup into
workspace-port-localhost-label-selector.ts (a hook plus an imperative
resolver), replacing the block triplicated across the ports surfaces.
Co-authored-by: Orca <help@stably.ai>
* Extract command-code prompt-status seed to its own module
Keeps launch-agent-in-new-tab.ts under the max-lines limit after the
localhost-hint additions, without a lint disable.
Co-authored-by: Orca <help@stably.ai>
* Remove agent-facing localhost mechanism
Orca does not mutate user prompts or inject prompt snippets, so drop the
localhost-open agent hint entirely:
- Remove appendLocalhostOpeningHint / includeLocalhostOpeningHint and the
hint constant from tui-agent-startup; agent prompts are no longer rewritten.
- Remove the ORCA_LOCALHOST_OPEN env var from local agent terminals (it was
only discoverable via the now-removed hint).
- Remove the orca localhost label|open CLI commands, their workspacePorts RPC
methods, and the runtime labelLocalhostUrl/openLocalhostUrl methods.
The feature is now purely structural: the loopback label proxy plus the
ports-panel and terminal-link 'Open in Browser' paths, which surface a
clickable labeled URL without touching agent prompts.
Co-authored-by: Orca <help@stably.ai>
* Make localhost worktree labels opt-in (default off)
Serving a dev app under a different host than localhost:<port> can break
apps that bind cookies/sessions to localhost, so the feature should not
change existing users' Open-in-Browser behavior on upgrade.
- Default localhostWorktreeLabelsEnabled to false.
- Flip the gates to enable only when explicitly true (=== true / !== true)
instead of treating undefined as enabled.
- Update the setting switch to checked only when explicitly enabled.
- Drop the now-unused runtime store settings field.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
* fix(terminal): converge post-spawn PTY size reconcile to fix split-mount column desync
Follow-up to #6644/#6649. Those added a post-spawn PTY reconcile but capped
it at a FIXED 12 requestAnimationFrames whose counter advanced even on frames
where the pane was unmeasurable or the split layout had not yet equalized. When
a tab MOUNTS with a split layout already present (a new worktree opened with the
side split panel on), the real narrow split width settles AFTER frame 12, so the
reconcile gave up while xterm had reflowed narrow and the PTY stayed pinned at
the wide spawn width. The corrective xterm onResize is dropped during the hidden
mount window (isRendererPtyResizeAuthoritative() is false), so process.stdout.columns
stayed wide and interactive TUIs (Claude Code) rendered garbled until a manual resize.
Extract the reconcile into pty-size-reconcile.ts with an authoritative-gated
convergence loop instead of a fixed frame budget:
- While the pane is hidden (onResize dropped), the reconcile is the SOLE corrector:
it keeps polling and forwarding every grid change (its transport.resize bypasses
the visibility gate). Hidden frames never advance the settle counter.
- Once visible AND stable for SETTLE_FRAMES, it hands off to the live
onResize/ResizeObserver path, which reliably catches any later reflow.
- Hard cap (MAX_FRAMES) guarantees termination; mobile-fit/locked frames are
skipped; the reconcile handle is cancelled on dispose.
Harness: pty-size-reconcile.test.ts (14 tests) drives the loop with a deterministic
frame scheduler; the desync-repro tests fail against the old 12-frame logic and
pass on the fix. Adds an e2e "MOUNTS with a split layout present" test.
Caveat: headless Electron does not reproduce this layout-settle-after-rAF race
(the existing golden e2e passes even against the old buggy logic), which is why
#6644/#6649 merged with green e2e yet the bug persisted. The unit test is the
real regression harness; the e2e tests are integration smoke.
Made with [Orca](https://github.com/stablyai/orca)
Co-authored-by: Orca <help@stably.ai>
* fix(terminal): re-assert PTY size on visibility resume to heal stubborn column desync
Follow-up within the same fix: the user reported "sometimes even resizing
doesn't fix it." Root cause beyond the mount-timing race — the renderer forwards
resizes fire-and-forget and dedupes on the size it THINKS it sent, but never
learns the PTY's actual size. A resize dropped main-side (the pane was hidden,
a mobile take-back resize-suppression window, or a provider no-op) leaves xterm
and the PTY silently diverged; a later same-cols layout fires no onResize, so it
never self-corrects.
Expose the PTY's last-APPLIED size to the renderer and re-assert on show:
- New read-only IPC pty:getSize -> ptySizes.get(id) (the size written only when
a resize actually lands or at spawn — the authoritative "what the PTY believes
it is"). Wired through preload (window.api.pty.getSize) + api-types.
- On visibility resume (noteVisibilityResume), the pane re-fits, reads the PTY's
real size, and re-asserts via forwardPtyResize ONLY on genuine drift — so no
spurious SIGWINCH on an already-synced resume (which would jar alt-screen TUIs).
Routed through forwardPtyResize so the authoritative/mobile gates are
re-checked at send time; remote-runtime PTYs (separate viewport channel) are
skipped; overlapping resumes coalesce to one query.
Also register pty:getSize in the registerPtyHandlers removeHandler cleanup block
so re-registration (macOS re-activate / new window) doesn't throw on a duplicate
ipcMain.handle, and make the pty IPC test mock throw on duplicate channels like
real Electron so this class of omission is caught going forward.
Tests: 7 resume-reassert cases (drift / match / null / remote-skip /
mobile-fit-skip / hide-during-hop / overlap-coalesce), all non-vacuous. Full
terminal-pane + pty IPC suites green (1494 tests); typecheck (web+node) + oxlint
clean; e2e desync specs pass against a fresh build.
Made with [Orca](https://github.com/stablyai/orca)
Co-authored-by: Orca <help@stably.ai>
* Stub PTY getSize API and skip redundant Wayland GPU sandbox tests
- Implement PTY `getSize` stub in `web-preload-api.ts` to satisfy API
requirements for the web-preload environment.
- Skip the unfixed Wayland GPU sandbox negative control test if the
target base branch already contains the sandbox workaround.
---------
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* Surface GitHub check suites awaiting approval to unblock merge
- Query the check-suites API endpoint to find suites with an
"action_required" conclusion, which are often workflows awaiting
"Approve and run" and do not have any associated check runs.
- Map the "action_required" status distinctly instead of treating it as
a standard failure or omitting it entirely.
- Update the UI to render these suites with a warning icon, a dedicated
"Action required" label, and a localized hint explaining that manual
approval is required on GitHub.
- Count "action_required" checks as failed/blocking when deriving overall
PR and task statuses so the UI does not report all checks passing.
* Enhance visibility and handling of action-required PR check suites
* Include check suite IDs in pending approval check names and URLs to
allow navigating directly to the specific workflow run.
* Add an "action required" count badge to PR dialog and page checks tabs.
* Prioritize action-required checks in the checks preview summary.
* Use correct check run state for the action-required fallback hint in
the right sidebar details panel.
* Add translations for the new status across all supported locales.
Machine translation rendered the abbreviation "PR" (pull request) as "relaciones públicas" (public relations) across 32 Spanish UI strings — e.g. "Reabrir relaciones públicas" (Reopen PR), "Crear relaciones públicas" (Create PR), "Abrir cheques de relaciones públicas" (Open PR checks).
Adds the missing `es` rule to LOCALE_PHRASE_FIXES. Because "relaciones públicas" is a real Spanish phrase (unlike the CJK-only ko/zh patterns 홍보/公关), the rule guards on the actual `PR`/`PRs` token via a new optional `whenEnMatches` RegExp guard in applyPhraseFixes, so it never fires on unrelated English that merely contains a "pr" substring (approve, preview, press). `whenEnMatches` is backward compatible — existing `whenEnIncludes` rules are unchanged.
Regenerates the 32 affected es.json leaves. Adds a vitest spec covering the rewrites and a negative case proving the token guard ignores genuine "public relations" strings.
* Reload working-tree combined diff views on external file changes
Combined diff views (e.g. "Changes" and "All Changes" tabs) display the
working-tree diffs for all modified files but do not match any single
file path. As a result, the file system watcher previously did not
notify them when individual files were updated.
Check for active working-tree combined diff tabs once per event payload,
and trigger a reload notification on file changes so the diff sections
refresh automatically when files are modified externally.
* Reload combined diff view when matching single-file tab is dirty
When an external file change occurs and the matching open file is dirty,
reloading the individual file tab is skipped. However, if a combined
diff view (like the uncommitted Changes tab) is open, it still needs
to be refreshed to reflect the external changes.
Ensure we schedule a debounced external reload for the combined diff
consumer even when there are dirty matching files.
* Clear stale agent identity when a pane is reused (codex vs claude)
When a terminal pane is reused for a different agent, its launchAgent
goes stale. resolveTabAgentFromSignals ignored the terminal title while
launchAgent was set and ranked the stale launch ahead of the live title,
so the tab icon and notifications kept showing the previous agent
(e.g. codex when claude is now running).
Extract the title->agent mapping into terminal-title-agent-type.ts and
let a live, explicit title override a stale launchAgent once the pane has
shown activity. Apply the same guard to notification dispatch so a stored
snapshot from a different agent is not reused for the rich notification.
Also add the missing MiMo Code title mapping.
Fixes#6355
* test(terminal-pane): align completion fixture with live agent identity
The working->idle completion test paired a stored codex snapshot with a
live '* Claude done' title. After the stale-identity guard, an explicit
Claude title correctly drops a mismatched codex snapshot, so the rich
notification no longer carried codex's prompt/tool fields.
Make the fixture self-consistent (snapshot agentType: 'claude') so the
test still verifies the rich completion snapshot flows through on
working->idle, matching the corrected dispatch behavior. The discard
path is covered separately in use-notification-dispatch.test.ts.
Refs #6355
* Harden agent notification snapshot identity guard
---------
Co-authored-by: brennanb2025 <brennanb2025@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* refactor(settings): unify network-address picker across mobile and server-share
The 'Share this Orca server' form (Settings → Runtime Environments) had the
same uneven dropdown + always-visible custom-text-field layout the mobile
pairing screen used to have.
Extract a generic AddressPicker + CustomAddressDialog (validator and copy
injected) and use it from both surfaces:
- Mobile keeps its IPv4 / Tailscale *.ts.net grammar.
- Server-share gets a plain dropdown (incl. 'This computer') plus an
'Add custom address…' row opening a dialog that accepts host, host:port,
or a ws(s):// URL (new parseServerShareAddress validator + tests).
Collapses the server form's separate selectedAddress/customAddress state
into one, dropping the side-by-side text field. Muted (non-red) validation
hint, all strings localized (en/es/ja/ko/zh).
Co-authored-by: Orca <help@stably.ai>
* fix(settings): bound the server-share connection-address dropdown width
Removing the side-by-side custom field left the picker as flex-1, which
stretched the trigger across the whole card for a short value like
'This computer (127.0.0.1)'. Give it min-w-[240px] max-w-full so it sizes to
content and only a long custom URL grows it (then truncates within the card).
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Fixes#2434. Orca unconditionally advertised xterm's Kitty enhanced
keyboard protocol (vtExtensions.kittyKeyboard) to every pane, including
local native Windows ConPTY terminals. Several local Windows CLIs (e.g.
the Antigravity agy CLI) read the advertisement but do not decode CSI-u,
so once enhanced reporting is on they ignore Enter/Up/Down and other
navigation keys.
Add a terminal-keyboard-protocol gate that withholds the advertisement
only for a genuine local Windows ConPTY pane (reusing the existing
isLocalNativeWindowsConpty predicate), while SSH and macOS/Linux panes
keep enhanced reporting.
Co-authored-by: brennanb2025 <brennanb2025@users.noreply.github.com>
* Keep disabled delete worktree option for primary checkouts
Primary checkout rows cannot be removed via git-worktree. To maintain
visual parity with non-primary cards, this keeps a disabled "Delete
Worktree" option in the context menu alongside the active "Remove
Project" action.
* Wrap disabled delete worktree menu item in a Tooltip
Replace the native title attribute with a Tooltip component. This ensures
that the explanation for why the primary worktree cannot be deleted is
reliably displayed when hovering over the disabled menu item.
* docs(spec): manual network address entry for mobile pairing
* docs(plan): manual network address entry for mobile pairing
* docs(plan): fix two test-spec issues in Task 1
* feat(mobile-pairing): add parseManualNetworkAddress validator
* docs(plan): fix buildComboboxEntries filter rule
* feat(mobile-pairing): buildComboboxEntries for network interface combobox
* feat(mobile-pairing): combobox with manual address entry
* docs(spec): align buildComboboxEntries behavior with corrected plan
* fix(mobile-pairing): use text-destructive token for inline error
* fix(mobile-pairing): route Use row through translate() with i18next interpolation
* refactor(mobile-pairing): extract NetworkInterfaceCombobox shared by MobileHero and Settings section
The Popover + Command + manual-entry UX lived only in the Settings →
Mobile → Network Interface section. The mobile pairing screen
("Step 2 of 2 — Pair this computer") had its own copy of the same
Select-based dropdown that did not support manual address entry. A
user trying to pair with a Tailscale MagicDNS hostname from the
pairing screen could not enter it.
Extract the typeable combobox into a shared
`NetworkInterfaceCombobox` component. Both surfaces now render the
same Popover + Command with manual address entry, the `Use "..."`
row, the inline validation error, and the `(custom)` trigger label.
Settings keeps its own Generate QR button, Refresh + Tooltip, and
Tailnet accordion around the combobox. The pairing screen keeps its
existing layout (label + combobox + refresh icon).
Net deletion: ~160 lines. Net behavior gain: manual address entry is
now reachable from both surfaces, not only Settings.
* style(ui): give CommandInput a visible background so the search box is not lost
The Popover content above the CommandList renders the cmdk CommandInput
with only a thin bottom border. Against a white popover background it
visually disappears, especially in the mobile pairing screen where the
popover sits inside a dark phone mockup. Add a subtle `bg-muted/30` +
`py-1` so the input row is unambiguous, without changing the input's
shape or behavior.
* fix(mobile-pairing): drop cmdk CommandItem, use plain buttons inside Popover
In `pnpm dev` HMR cycle the cmdk CommandItem `onSelect` dispatch was
unreliable — clicking the item fired the synthetic event but the parent
React state never received it, so the trigger label never updated after
the user picked a manual address or a refreshed interface.
Replace the `Command` + `CommandItem` primitives inside
NetworkInterfaceCombobox with a native `<input>` + `<button>` list
wrapped by Radix `Popover`. The list now responds to the user's first
click without any intermediate effect that could be skipped in dev mode.
The combobox keeps the same props contract, the same placeholder, the
same inline validation, and the same `Use "<address>"` row at the
bottom of the list.
Update MobileNetworkInterfaceSection.test.tsx selectors from
`role=option` (cmdk's) to `role=button` so the integration test still
asserts the right element. All 479 feature tests still pass.
* debug(mobile-pairing): log handleSelect* invocations to confirm click path
* fix(mobile-pairing): commit on pointerdown to beat Radix Popover close race
In dev mode Radix Popover's close-on-pointerdown handler occasionally
fires before React's synthetic click dispatch reaches the option button,
so the parent's selectedAddress never updates after the user picks a
manual address. Bind the commit handler to pointerdown (synchronous,
before any pointer-up / click synthesis) and call event.preventDefault()
to avoid text-selection side effects. Keep onClick as a fallback so
keyboard / touch / programmatic-dispatch paths still work.
* fix(mobile-pairing): keep manually-typed addresses across network refresh
`selectRefreshedNetworkAddress` used to fall back to the first OS
interface whenever `currentAddress` wasn't in the OS-enumerated
list — so a user who typed a Tailscale MagicDNS name saw their
selection snap back to LAN every time `loadNetworkInterfaces`
returned. Treat manual entries as sticky by passing an
`isManual` flag from the caller; `selectRefreshedNetworkAddress`
now keeps the address when the caller says the user typed it.
`MobilePage` tracks `addressIsManual` alongside
`selectedAddress`: `handleAddressChange` flips it on when the
picked address is not in the OS list, and `loadNetworkInterfaces`
passes it through so refresh keeps the choice.
* chore(mobile-pairing): remove debug logs and sync new-combobox-listbox i18n key
* fix(mobile-pairing): address CodeRabbit review on manual-address lifecycle
Three real bugs from review, plus a regression test:
1. NetworkInterfaceCombobox in MobileHero was disabled when
`networkInterfaces.length === 0`, which locked users out of the
only path to type a manual address during a transient empty
discovery. Pass `disabled={false}` and let the combobox's
own empty-state copy explain the situation.
2. `selectRefreshedNetworkAddress` returned `undefined` whenever
`interfaces.length === 0`, even if the user had a manual
address and `currentAddressIsManual` was true. Keep the manual
address so a recovering discovery doesn't clobber it.
3. `loadNetworkInterfaces` could rewrite `selectedAddress` (e.g.
when a refresh swaps to a freshly-discovered tailnet) but never
updated `addressIsManual`, so the next refresh could revert
the user back to LAN. Re-derive `addressIsManual` from the
new address after every refresh.
Adds a regression test in
`mobile-network-interface-selection.test.ts` exercising the
empty-refresh + manual path.
* style(mobile-pairing): trim disabled-false comment to two lines
* refactor(mobile-pairing): replace typeable combobox with select + custom-address dialog
The Settings/MobileHero network selector used a Popover+search-input hybrid
that looked uneven and hid its validation error behind the open popover.
Replace it with a plain Select of discovered interfaces plus an
'Add custom address…' footer row that opens a small dialog for entering a
Tailscale hostname or static IP. Drops the 'MagicDNS' jargon for plainer
copy, keeps the '(custom)' trigger label, and routes all strings through
translate() with real es/ja/ko/zh translations. Removes the now-dead
buildComboboxEntries helper. Also adds the missing scrollbar-sleek class
the old list omitted (was failing pnpm lint).
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: ppw-stack <ppw-stack@users.noreply.github.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
When Quick Open and File Explorer name search fall back to git ls-files, expand nested git repo placeholders with a bounded readdir walk so monorepo parent workspaces include files inside sub-projects. Keep local main-process and SSH relay behavior aligned, including non-git root fallback and non-zero git failure handling.
Co-authored-by: Orca <help@stably.ai>
* feat(source-control): show submodule diffs with lazy expansion
Dirty submodules now expand inline in Source Control to reveal their
inner changes, with file-level diffs that are read-only from the parent
worktree. Inner status is fetched lazily only when a submodule is
expanded, so status polling never recurses into (possibly nested)
submodules. Adds a submodule-status path across local and SSH runtimes
and git providers.
* feat(source-control): add compare-against-current-branch setting
Adds a global setting (default off) that defaults the Source Control
compare base to the current branch's upstream so the panel prioritizes
local changes instead of the full delta versus the repository default
branch. When the branch has no upstream, the compare view falls back to
working-tree-only. This affects only the compare/diff view; the Pull
Request and rebase merge target are unchanged.
* refactor(source-control): extract submodule status hook and entry-action gates
Moves the lazy submodule-expansion state into a useSourceControlSubmoduleStatus
hook and centralizes per-row stage/unstage/discard eligibility into
source-control-entry-actions, shrinking SourceControl.tsx and keeping the
read-only submodule rules consistent across the row UI, bulk actions, and tests.
The hook adds a generation guard so a slow submodule-status response from a
previous worktree (common over SSH) can't write stale status into the current
panel. On the relay side, configured submodule paths are read through a
short-TTL per-instance cache so a burst of diff clicks does not re-read
.gitmodules over the SSH link. Adds tests for the new modules.
* fix(source-control): address submodule/compare review feedback
- Degrade git.submoduleStatus to an actionable reconnect hint when an older
SSH relay lacks the RPC, mirroring clone()/worktreeIsClean fallbacks.
- Keep the branch-compare summary while upstream status is still loading so
it no longer flickers when switching worktrees with prefer-upstream on.
- Mark the compare-base switch as type="button" to avoid form submission.
- Add diff base / source control keywords to the Git settings search catalog.
- Assert the compare-base toggle's own switch state and updateSettings call.
* fix(source-control): address second-round submodule/compare review feedback
- Route submodule inner diffs through resolveSubmoduleWorktreePath so a
crafted .gitmodules path can't escape the selected worktree
- Clear statusReadsInFlight alongside the diff dedupe on git mutations so a
post-mutation getStatus() can't join a stale in-flight read
- Clear the SSH diff dedupe in getSubmoduleStatus to mirror getStatus
- Derive list-view selection from the submodule-injected rows so expanded
submodule children are selectable
- Refresh commit history when the upstream compare base changes
* Support staged submodule expansion and refine default compare base
- Support expanding and diffing staged submodule changes (HEAD vs index) independently of unstaged changes (index vs worktree).
- Track submodule expansion states using a compound key of area and path to prevent conflicts between staged and unstaged listings.
- Update the compare-against-upstream setting to a segmented control for the "Default Compare Base" policy.
- Fall back to the repository default branch when comparing a branch with no upstream, preventing comparison views from unexpectedly disappearing.
* Fix submodule staging behavior, WSL caching, and double-click toggles
- Namespace submodule path cache per WSL distro to prevent cross-distro
collisions.
- Preserve the staged area of child entries when expanding unstaged
submodules so staged inner changes do not open empty diffs.
- Prefix oldPath with the submodule path for renamed inner entries.
- Ignore click events where detail > 1 to prevent double-clicks from
instantly collapsing newly expanded submodules.
* Secure submodule path resolution and prevent stale status updates
* Extract and centralize submodule path validation into a new
`resolveSubmoduleWorktreePath` helper to prevent path traversal
exploits when resolving paths from untrusted `.gitmodules` files.
* Invalidate submodule expansion state and increment the query
generation whenever the active runtime environment or connection
route changes, preventing out-of-order responses from writing
stale data.
* Set git identity via CLI config options in test commits
- Extract test email and name into constants.
- Use `-c` config flags to pass user identity to `git commit` dynamically.
- This ensures commits succeed in submodule checkouts or CI environments
where a local or global identity is not configured.
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Resolve the File Explorer and Quick Open runtime file-list target through known worktrees so folder workspaces provide their root path, and make connectionId resolution reactive for SSH folder workspaces after store hydration.
Supersedes #6170.
Co-authored-by: bennewell35 <142949922+bennewell35@users.noreply.github.com>
* Keep mobile pairing data on stable userData path
Use the canonical userData path captured before app.setName() when starting the runtime WebSocket server so paired mobile device tokens and E2EE keys survive restarts/updates. Add regression coverage for app-name-driven userData path changes.
Co-Authored-By: Claude <noreply@anthropic.com>
* Migrate mobile pairing files from legacy path
Co-Authored-By: Claude <noreply@anthropic.com>
* Address mobile pairing migration review
Co-Authored-By: Claude <noreply@anthropic.com>
* Document mobile pairing path helpers
Co-Authored-By: Claude <noreply@anthropic.com>
* Explain paired mobile credential migration
Co-Authored-By: Claude <noreply@anthropic.com>
* Harden migrated mobile pairing credentials and tighten tests
Re-assert secure-file permissions after the migration copyFileSync, which
does not carry Windows ACLs, so the copied device tokens and E2EE keypair
keep the current-user-only restriction instead of relying on the runtime's
later lazy re-harden on read.
Import the pairing filename constants from the shared source of truth so a
rename can't silently pass the tests against stale names, and add no-op
regression coverage for the source==target (case-insensitive FS) and
fresh-install (no legacy files) paths.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
* Allow deleting files on WSL UNC paths from the file explorer
shell.trashItem cannot move a \wsl.localhost\<distro>\... UNC file to a
Recycle Bin (the WSL virtual volume has none), so fs:deletePath threw and the
file explorer showed an error. For WSL UNC targets, hard-delete via `rm`
inside the distro through wsl.exe (a true delete that honors Linux perms).
Normal local paths still go to the Recycle Bin via shell.trashItem.
Fixes#6415
* test: make WSL UNC delete tests platform-correct for Linux CI
The two WSL UNC deletePath tests passed on Windows but failed on the
Linux CI runner. They built the worktree root/target from literal
'\wsl.localhost\...' strings, which only resolve as a parent/child
pair under win32 path semantics. On POSIX, path.resolve() treats the
backslashes as ordinary filename characters, so the target was not a
descendant of the registered root and resolveAuthorizedPath denied it
before tryDeleteWslUncPath ran.
Build the UNC-style paths with path.join so they form a real
parent/child pair under both win32 and POSIX path rules. Production
behavior is unchanged; WSL UNC delete remains Windows-only.
---------
Co-authored-by: brennanb2025 <brennanb2025@users.noreply.github.com>
Resume-in-tab/drag-resume queued a cmd.exe-syntax command into a freshly
spawned tab whose live shell is the configured Windows shell (default
PowerShell). PowerShell mis-parsed the cmd ""-doubled wrapper and reported
"is not recognized as an internal or external command, operable program or
batch file", so the session never resumed.
Resolve terminalWindowsShell to a startup-shell family and quote the queued
command per shell (PowerShell Set-Location/$env, POSIX cd for git-bash),
only emitting the cmd /d /s /c wrapper when the live shell is cmd. The
copy-to-clipboard command is unchanged and stays cmd-wrapped.
Fixes#6152
Co-authored-by: Orca <help@stably.ai>
Folder-workspace selectors can now resolve through the existing folder launch-scope path before falling back to normal worktree resolution. This fixes file explorer read/preview/search/list operations for local and SSH-backed folder workspaces without changing git target resolution.
Refs #6357.
Supersedes #6363.
Co-authored-by: bennewell35 <newelljben@gmail.com>
Adds replace, replace all, match case, whole word, and the editor replace shortcut to the rich markdown editor. Includes review hardening for live replace matching and Unicode-safe whole-word boundaries.
Headless automation launches (launchAgentBackgroundSession) created an
inactive tab via createTab(..., { activate: false }) without first telling
the renderer to background-mount that worktree's terminal surface. As a
result the hidden surface either never mounted (no entry in
mountedWorktreeIdsRef) or mounted with display:none (zero-size, can't be
measured/fit), so the eager PTY buffer never flushed on the first mount —
the run tab showed only the shell prompt until an unmount/remount gave the
off-screen xterm a real layout box.
Dispatch BACKGROUND_MOUNT_TERMINAL_WORKTREE_EVENT immediately before
createTab, mirroring the established renderer-backed Codex startup path in
useIpcEvents. The Terminal.tsx listener adds the worktree to
mountedWorktreeIdsRef and marks it measurable for a 3000ms window, so the
hidden surface renders with opacity-0/pointer-events-none (a measurable box)
instead of display:none, letting the first xterm fit flush the buffer.
Extract the inline measurable-mount block into
background-terminal-worktree-visibility.ts (behavior-identical, now
unit-tested) and add unit + E2E coverage.
Fixes#6244
Co-authored-by: ChaDongWun <66347959+lovewave02@users.noreply.github.com>
The generic `.button` height override was collapsing the expand/collapse
chevron to 20px, pinning it to the top instead of centering it vertically.
Switch to targeting `.button.toggle` and restore `height: 100%` so Monaco's
own layout centers the chevron over the find row.
Fixes#6619: OMP-owned remote/mobile terminals no longer flicker their tab
label between "OMP" and "Pi".
OMP wraps Pi, so it emits Pi-identity OSC titles and status frames during
active work. On the host, in mirrored remote tabs, and in the title-derived
sidebar rows, those frames were stored verbatim — so an OMP-launched pane
alternated between "OMP" (launch identity) and "Pi" (live frame). The fix
introduces a shared owner-normalization helper (agent-title-owner.ts) that
rewrites Pi-compatible titles/status entries to the authoritative launch
owner, but only when the incoming and owner profiles share the same
titleIdentityGroup — so true Pi sessions, unrelated agents, and custom titles
are left untouched.
Maintainer hardening on top of the original change:
- Skip the new getForegroundProcess probe entirely when launchAgent is already
known (it is only ever the owner fallback when launchAgent is unknown), and
gate the onPtyData trigger on a real status transition rather than per-frame
braille-spinner title churn — avoiding a relay round-trip per output frame on
SSH/daemon-backed terminals.
- Make the foreground refresh fire-and-forget on the mobile listing hot path
(listTerminals/getWorktreePs) so latency does not grow per session and a
throwing snapshot listener cannot abort the liveness sweep.
- Added regression tests + a Why comment on the renderer owner precedence.
Verified: 829 tests pass; node/web/cli typechecks clean; oxlint clean;
reproduced the flicker against main as a negative control and confirmed the
live renderer build collapses interleaved OMP/Pi frames to a stable OMP label
with zero Pi leaks while leaving true-Pi/unrelated/custom titles unchanged.
Co-authored-by: Dvitash <dvitash3414@gmail.com>
Brennan BensonandOrca
github-actions[bot]
JinjingandOrca
Miguel Echávarri
Jinwoo HongandOrca
AmsZuidas
WolfieandWolfgang Schoenberger
lvfenandJinjing
Jingyue Wu
mehmet turac
Dvitash