* docs(spec): manual network address entry for mobile pairing
* docs(plan): manual network address entry for mobile pairing
* docs(plan): fix two test-spec issues in Task 1
* feat(mobile-pairing): add parseManualNetworkAddress validator
* docs(plan): fix buildComboboxEntries filter rule
* feat(mobile-pairing): buildComboboxEntries for network interface combobox
* feat(mobile-pairing): combobox with manual address entry
* docs(spec): align buildComboboxEntries behavior with corrected plan
* fix(mobile-pairing): use text-destructive token for inline error
* fix(mobile-pairing): route Use row through translate() with i18next interpolation
* refactor(mobile-pairing): extract NetworkInterfaceCombobox shared by MobileHero and Settings section
The Popover + Command + manual-entry UX lived only in the Settings →
Mobile → Network Interface section. The mobile pairing screen
("Step 2 of 2 — Pair this computer") had its own copy of the same
Select-based dropdown that did not support manual address entry. A
user trying to pair with a Tailscale MagicDNS hostname from the
pairing screen could not enter it.
Extract the typeable combobox into a shared
`NetworkInterfaceCombobox` component. Both surfaces now render the
same Popover + Command with manual address entry, the `Use "..."`
row, the inline validation error, and the `(custom)` trigger label.
Settings keeps its own Generate QR button, Refresh + Tooltip, and
Tailnet accordion around the combobox. The pairing screen keeps its
existing layout (label + combobox + refresh icon).
Net deletion: ~160 lines. Net behavior gain: manual address entry is
now reachable from both surfaces, not only Settings.
* style(ui): give CommandInput a visible background so the search box is not lost
The Popover content above the CommandList renders the cmdk CommandInput
with only a thin bottom border. Against a white popover background it
visually disappears, especially in the mobile pairing screen where the
popover sits inside a dark phone mockup. Add a subtle `bg-muted/30` +
`py-1` so the input row is unambiguous, without changing the input's
shape or behavior.
* fix(mobile-pairing): drop cmdk CommandItem, use plain buttons inside Popover
In `pnpm dev` HMR cycle the cmdk CommandItem `onSelect` dispatch was
unreliable — clicking the item fired the synthetic event but the parent
React state never received it, so the trigger label never updated after
the user picked a manual address or a refreshed interface.
Replace the `Command` + `CommandItem` primitives inside
NetworkInterfaceCombobox with a native `<input>` + `<button>` list
wrapped by Radix `Popover`. The list now responds to the user's first
click without any intermediate effect that could be skipped in dev mode.
The combobox keeps the same props contract, the same placeholder, the
same inline validation, and the same `Use "<address>"` row at the
bottom of the list.
Update MobileNetworkInterfaceSection.test.tsx selectors from
`role=option` (cmdk's) to `role=button` so the integration test still
asserts the right element. All 479 feature tests still pass.
* debug(mobile-pairing): log handleSelect* invocations to confirm click path
* fix(mobile-pairing): commit on pointerdown to beat Radix Popover close race
In dev mode Radix Popover's close-on-pointerdown handler occasionally
fires before React's synthetic click dispatch reaches the option button,
so the parent's selectedAddress never updates after the user picks a
manual address. Bind the commit handler to pointerdown (synchronous,
before any pointer-up / click synthesis) and call event.preventDefault()
to avoid text-selection side effects. Keep onClick as a fallback so
keyboard / touch / programmatic-dispatch paths still work.
* fix(mobile-pairing): keep manually-typed addresses across network refresh
`selectRefreshedNetworkAddress` used to fall back to the first OS
interface whenever `currentAddress` wasn't in the OS-enumerated
list — so a user who typed a Tailscale MagicDNS name saw their
selection snap back to LAN every time `loadNetworkInterfaces`
returned. Treat manual entries as sticky by passing an
`isManual` flag from the caller; `selectRefreshedNetworkAddress`
now keeps the address when the caller says the user typed it.
`MobilePage` tracks `addressIsManual` alongside
`selectedAddress`: `handleAddressChange` flips it on when the
picked address is not in the OS list, and `loadNetworkInterfaces`
passes it through so refresh keeps the choice.
* chore(mobile-pairing): remove debug logs and sync new-combobox-listbox i18n key
* fix(mobile-pairing): address CodeRabbit review on manual-address lifecycle
Three real bugs from review, plus a regression test:
1. NetworkInterfaceCombobox in MobileHero was disabled when
`networkInterfaces.length === 0`, which locked users out of the
only path to type a manual address during a transient empty
discovery. Pass `disabled={false}` and let the combobox's
own empty-state copy explain the situation.
2. `selectRefreshedNetworkAddress` returned `undefined` whenever
`interfaces.length === 0`, even if the user had a manual
address and `currentAddressIsManual` was true. Keep the manual
address so a recovering discovery doesn't clobber it.
3. `loadNetworkInterfaces` could rewrite `selectedAddress` (e.g.
when a refresh swaps to a freshly-discovered tailnet) but never
updated `addressIsManual`, so the next refresh could revert
the user back to LAN. Re-derive `addressIsManual` from the
new address after every refresh.
Adds a regression test in
`mobile-network-interface-selection.test.ts` exercising the
empty-refresh + manual path.
* style(mobile-pairing): trim disabled-false comment to two lines
* refactor(mobile-pairing): replace typeable combobox with select + custom-address dialog
The Settings/MobileHero network selector used a Popover+search-input hybrid
that looked uneven and hid its validation error behind the open popover.
Replace it with a plain Select of discovered interfaces plus an
'Add custom address…' footer row that opens a small dialog for entering a
Tailscale hostname or static IP. Drops the 'MagicDNS' jargon for plainer
copy, keeps the '(custom)' trigger label, and routes all strings through
translate() with real es/ja/ko/zh translations. Removes the now-dead
buildComboboxEntries helper. Also adds the missing scrollbar-sleek class
the old list omitted (was failing pnpm lint).
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: ppw-stack <ppw-stack@users.noreply.github.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
When Quick Open and File Explorer name search fall back to git ls-files, expand nested git repo placeholders with a bounded readdir walk so monorepo parent workspaces include files inside sub-projects. Keep local main-process and SSH relay behavior aligned, including non-git root fallback and non-zero git failure handling.
Co-authored-by: Orca <help@stably.ai>
* feat(source-control): show submodule diffs with lazy expansion
Dirty submodules now expand inline in Source Control to reveal their
inner changes, with file-level diffs that are read-only from the parent
worktree. Inner status is fetched lazily only when a submodule is
expanded, so status polling never recurses into (possibly nested)
submodules. Adds a submodule-status path across local and SSH runtimes
and git providers.
* feat(source-control): add compare-against-current-branch setting
Adds a global setting (default off) that defaults the Source Control
compare base to the current branch's upstream so the panel prioritizes
local changes instead of the full delta versus the repository default
branch. When the branch has no upstream, the compare view falls back to
working-tree-only. This affects only the compare/diff view; the Pull
Request and rebase merge target are unchanged.
* refactor(source-control): extract submodule status hook and entry-action gates
Moves the lazy submodule-expansion state into a useSourceControlSubmoduleStatus
hook and centralizes per-row stage/unstage/discard eligibility into
source-control-entry-actions, shrinking SourceControl.tsx and keeping the
read-only submodule rules consistent across the row UI, bulk actions, and tests.
The hook adds a generation guard so a slow submodule-status response from a
previous worktree (common over SSH) can't write stale status into the current
panel. On the relay side, configured submodule paths are read through a
short-TTL per-instance cache so a burst of diff clicks does not re-read
.gitmodules over the SSH link. Adds tests for the new modules.
* fix(source-control): address submodule/compare review feedback
- Degrade git.submoduleStatus to an actionable reconnect hint when an older
SSH relay lacks the RPC, mirroring clone()/worktreeIsClean fallbacks.
- Keep the branch-compare summary while upstream status is still loading so
it no longer flickers when switching worktrees with prefer-upstream on.
- Mark the compare-base switch as type="button" to avoid form submission.
- Add diff base / source control keywords to the Git settings search catalog.
- Assert the compare-base toggle's own switch state and updateSettings call.
* fix(source-control): address second-round submodule/compare review feedback
- Route submodule inner diffs through resolveSubmoduleWorktreePath so a
crafted .gitmodules path can't escape the selected worktree
- Clear statusReadsInFlight alongside the diff dedupe on git mutations so a
post-mutation getStatus() can't join a stale in-flight read
- Clear the SSH diff dedupe in getSubmoduleStatus to mirror getStatus
- Derive list-view selection from the submodule-injected rows so expanded
submodule children are selectable
- Refresh commit history when the upstream compare base changes
* Support staged submodule expansion and refine default compare base
- Support expanding and diffing staged submodule changes (HEAD vs index) independently of unstaged changes (index vs worktree).
- Track submodule expansion states using a compound key of area and path to prevent conflicts between staged and unstaged listings.
- Update the compare-against-upstream setting to a segmented control for the "Default Compare Base" policy.
- Fall back to the repository default branch when comparing a branch with no upstream, preventing comparison views from unexpectedly disappearing.
* Fix submodule staging behavior, WSL caching, and double-click toggles
- Namespace submodule path cache per WSL distro to prevent cross-distro
collisions.
- Preserve the staged area of child entries when expanding unstaged
submodules so staged inner changes do not open empty diffs.
- Prefix oldPath with the submodule path for renamed inner entries.
- Ignore click events where detail > 1 to prevent double-clicks from
instantly collapsing newly expanded submodules.
* Secure submodule path resolution and prevent stale status updates
* Extract and centralize submodule path validation into a new
`resolveSubmoduleWorktreePath` helper to prevent path traversal
exploits when resolving paths from untrusted `.gitmodules` files.
* Invalidate submodule expansion state and increment the query
generation whenever the active runtime environment or connection
route changes, preventing out-of-order responses from writing
stale data.
* Set git identity via CLI config options in test commits
- Extract test email and name into constants.
- Use `-c` config flags to pass user identity to `git commit` dynamically.
- This ensures commits succeed in submodule checkouts or CI environments
where a local or global identity is not configured.
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* Keep mobile pairing data on stable userData path
Use the canonical userData path captured before app.setName() when starting the runtime WebSocket server so paired mobile device tokens and E2EE keys survive restarts/updates. Add regression coverage for app-name-driven userData path changes.
Co-Authored-By: Claude <noreply@anthropic.com>
* Migrate mobile pairing files from legacy path
Co-Authored-By: Claude <noreply@anthropic.com>
* Address mobile pairing migration review
Co-Authored-By: Claude <noreply@anthropic.com>
* Document mobile pairing path helpers
Co-Authored-By: Claude <noreply@anthropic.com>
* Explain paired mobile credential migration
Co-Authored-By: Claude <noreply@anthropic.com>
* Harden migrated mobile pairing credentials and tighten tests
Re-assert secure-file permissions after the migration copyFileSync, which
does not carry Windows ACLs, so the copied device tokens and E2EE keypair
keep the current-user-only restriction instead of relying on the runtime's
later lazy re-harden on read.
Import the pairing filename constants from the shared source of truth so a
rename can't silently pass the tests against stale names, and add no-op
regression coverage for the source==target (case-insensitive FS) and
fresh-install (no legacy files) paths.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
* Allow deleting files on WSL UNC paths from the file explorer
shell.trashItem cannot move a \wsl.localhost\<distro>\... UNC file to a
Recycle Bin (the WSL virtual volume has none), so fs:deletePath threw and the
file explorer showed an error. For WSL UNC targets, hard-delete via `rm`
inside the distro through wsl.exe (a true delete that honors Linux perms).
Normal local paths still go to the Recycle Bin via shell.trashItem.
Fixes#6415
* test: make WSL UNC delete tests platform-correct for Linux CI
The two WSL UNC deletePath tests passed on Windows but failed on the
Linux CI runner. They built the worktree root/target from literal
'\wsl.localhost\...' strings, which only resolve as a parent/child
pair under win32 path semantics. On POSIX, path.resolve() treats the
backslashes as ordinary filename characters, so the target was not a
descendant of the registered root and resolveAuthorizedPath denied it
before tryDeleteWslUncPath ran.
Build the UNC-style paths with path.join so they form a real
parent/child pair under both win32 and POSIX path rules. Production
behavior is unchanged; WSL UNC delete remains Windows-only.
---------
Co-authored-by: brennanb2025 <brennanb2025@users.noreply.github.com>
Folder-workspace selectors can now resolve through the existing folder launch-scope path before falling back to normal worktree resolution. This fixes file explorer read/preview/search/list operations for local and SSH-backed folder workspaces without changing git target resolution.
Refs #6357.
Supersedes #6363.
Co-authored-by: bennewell35 <newelljben@gmail.com>
Fixes#6619: OMP-owned remote/mobile terminals no longer flicker their tab
label between "OMP" and "Pi".
OMP wraps Pi, so it emits Pi-identity OSC titles and status frames during
active work. On the host, in mirrored remote tabs, and in the title-derived
sidebar rows, those frames were stored verbatim — so an OMP-launched pane
alternated between "OMP" (launch identity) and "Pi" (live frame). The fix
introduces a shared owner-normalization helper (agent-title-owner.ts) that
rewrites Pi-compatible titles/status entries to the authoritative launch
owner, but only when the incoming and owner profiles share the same
titleIdentityGroup — so true Pi sessions, unrelated agents, and custom titles
are left untouched.
Maintainer hardening on top of the original change:
- Skip the new getForegroundProcess probe entirely when launchAgent is already
known (it is only ever the owner fallback when launchAgent is unknown), and
gate the onPtyData trigger on a real status transition rather than per-frame
braille-spinner title churn — avoiding a relay round-trip per output frame on
SSH/daemon-backed terminals.
- Make the foreground refresh fire-and-forget on the mobile listing hot path
(listTerminals/getWorktreePs) so latency does not grow per session and a
throwing snapshot listener cannot abort the liveness sweep.
- Added regression tests + a Why comment on the renderer owner precedence.
Verified: 829 tests pass; node/web/cli typechecks clean; oxlint clean;
reproduced the flicker against main as a negative control and confirmed the
live renderer build collapses interleaved OMP/Pi frames to a stable OMP label
with zero Pi leaks while leaving true-Pi/unrelated/custom titles unchanged.
Co-authored-by: Dvitash <dvitash3414@gmail.com>
* Gate punctuation forwarding on input source feature
Ensure ASCII and CJK direct punctuation keys are only treated as keydown
candidates if `forwardAsciiPunctuation` is enabled in the current input
source features. This avoids forwarding punctuation when the feature is
disabled, satisfying requirements where certain input methods (such as
Vietnamese) should not have punctuation forwarding enabled.
* Fix macOS IME input mode detection
* docs: add Android emulation design spec
Adds the design for first-class Android emulator support as a cross-platform
peer of the iOS simulator feature: an extracted EmulatorBackend interface
(iOS + Android), full AVD lifecycle management via the Android SDK, a live
scrcpy H.264 pane decoded in-renderer with WebCodecs, the full control surface
(tap/gesture/type/buttons/rotate), accessibility tree, app install/launch,
runtime permissions, logcat, and a dedicated orca-emulator-android skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(emulator): add EmulatorBackend interface + backend/codec session tags
First step of multi-backend emulator support: introduce the EmulatorBackend
type and tag each session with its backend kind + stream codec, defaulting to
ios/mjpeg so existing serve-sim behavior is unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(emulator): extract IosEmulatorBackend and make the bridge a router
Move the serve-sim/simctl device + helper + input mechanics out of
EmulatorBridge into IosEmulatorBackend (implementing EmulatorBackend). The
bridge now owns the session registry and lifecycle orchestration and routes
each command to the backend that owns the target device. iOS behavior is
unchanged; the existing bridge tests pass untouched and the backend gains its
own input-op coverage.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): add pure Android leaf modules (sdk/adb/avd/scrcpy/input/ax)
Dependency-injected building blocks for the Android emulator backend, each unit-
tested in isolation: SDK + tool discovery, adb device/output parsing, AVD list +
boot arg building, scrcpy control-socket byte encoders, normalized<->pixel +
keycode mapping, and a uiautomator XML accessibility-tree parser. Not yet wired;
AndroidEmulatorBackend composes these in the next phase.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(emulator): gate availability on the iOS backend + lock it with tests
inspectEmulatorAvailability now decides iOS host support via the registered iOS
backend instead of a bare platform literal, routing the decision through the
multi-backend seam. Output shape and all messages are unchanged (the settings
pane still reads simctl/serveSim). Adds the previously-missing regression tests
covering the unsupported, ready, no-devices, and tool-failure paths.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): add Android app/permissions/logcat arg builders
Pure adb arg-builders + a logcat line parser for app install/launch, runtime
permission grant/revoke/reset, and logcat capture. Unit-tested in isolation;
wired into AndroidEmulatorBackend's capability verbs in a later phase.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): AndroidEmulatorBackend device management + unified device list
Adds the Android backend (registered alongside iOS in the bridge): SDK-gated
host support, device/AVD discovery and merge, AVD boot + boot-completion wait,
shutdown, and tap/swipe/type/button/rotate/exec via `adb shell input` so control
works without the scrcpy server (the live H.264 stream lands in the streaming
phase). Surfaces everything through a new cross-platform `orca emulator devices`
command (RPC emulator.listDevices -> bridge.listAllDevices) with a platform
column. Device inventory is split into its own module to keep files focused.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): Android capability verbs (install/launch/permissions/ax/logcat)
Wires the Android capability operations into AndroidEmulatorBackend and exposes
them through a capability-gated bridge router (runCapability), RPC, and CLI:
- orca emulator install/launch/permissions/ax/logcat
Capabilities are advertised per backend; calling one on a backend that lacks it
(e.g. iOS) fails with emulator_unsupported instead of a silent no-op. Input ops
and capability ops are split into focused modules to keep files under the
line cap; the runtime shares one target-param type.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(skill): add orca-emulator-android skill + cross-ref from iOS skill
Documents the cross-platform Android emulator control surface (devices, input,
hardware buttons, rotate, install/launch, permissions, ax, logcat) driveable via
the orca CLI today, and notes the live visual pane is in development. Points the
iOS skill's "when not to use" at the new Android skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): Android live-pane streaming scaffolding (scrcpy + WebCodecs)
Builds the H.264 video path as scaffolding: scrcpy frame/codec-meta parsing,
server-deploy arg builders, control-protocol encoders (committed earlier), the
stream session (server + sockets), a video pub/sub registry, the
emulator:videoStream* IPC channel, and a renderer WebCodecs->canvas hook. Pure
framing/deploy/registry are unit-tested; the socket/WebCodecs/jar integration is
clearly flagged UNVERIFIED and the remaining wiring (startSession, preload,
pane codec branch, packaging the jar) is documented in
docs/android-emulation-streaming.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: fix streaming notes doc path in video-stream hook comment
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(emulator): add diagnostic probes for Android testing
Adds an emulator-probe logger (console + temp file at
os.tmpdir()/orca-android-emu-probe.log) and wires probes at four layers so
errors surface during manual testing: every emulator.* RPC call + error (RPC
dispatcher), every adb/emulator command + non-zero exit (command runner), and
the scrcpy session + video-stream IPC lifecycle. Temporary diagnostics; remove
or gate behind a flag once the Android pane is validated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): show Mobile Emulator settings cross-platform + aggregate Android availability
The Mobile Emulator settings section is no longer macOS-gated (Android works on
Windows/Linux), and inspectEmulatorAvailability now aggregates the iOS and
Android backends: Android devices/AVDs appear in the device list and a host
without iOS gets the Android setup message instead of "requires macOS".
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): show Mobile Emulator sidebar nav entry on non-mac desktops
The settings sidebar nav registered the Mobile Emulator entry behind isMac, so
it stayed hidden on Windows/Linux even after the section content was ungated.
Widen it to showDesktopOnlySettings to match the section.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): wire Android startSession to scrcpy + client-downloaded jar
AndroidEmulatorBackend.startSession now boots the device, ensures the scrcpy
server jar (downloaded by the client into the per-user cache on first use, not
bundled), starts a ScrcpyStreamSession, and feeds its H.264 frames to the video
registry; stopHelperForDevice tears it down. Sessions carry their backend kind
so worktree-active routing picks the right backend. Boot, host SDK discovery,
and the stream starter are split into focused modules to stay under the line cap.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): stop the iOS backend from claiming Android devices off-mac
iOS ownsDevice now returns false unless the host supports it, so on Windows an
Android serial routes to the Android backend instead of erroring with
"requires macOS". Backend-for-device fallback prefers a host-supported backend.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): scrcpy scid 31-bit + retry video socket until server delivers
Two fixes validated against a real emulator: scrcpy parses scid as a signed
32-bit hex int, so mask to 31 bits + pad to 8 digits (8-byte values overflowed
and the server exited). And adb accepts the forwarded TCP connection before the
server's abstract socket exists then resets it, so retry the video socket until
it actually delivers the dummy byte before connecting control. H.264 meta now
arrives (576x1280). Adds socket/server-exit diagnostics probes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): render the Android H.264 pane via WebCodecs
Wires the live Android pane end-to-end: preload exposes emulator video stream
APIs; the pane's device list uses the unified emulator.listDevices (Android +
iOS); and emulator-screen-stream-content renders a WebCodecs <canvas> for
scrcpy:// sessions (H.264, SPS/PPS prepended to the first keyframe) instead of
the MJPEG <img>. The video hook reports the stream size for the device frame.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): buffer the current GOP for late video subscribers
The renderer subscribes after attach already started the scrcpy stream, so the
registry now caches the current GOP (keyframe + following deltas) alongside the
codec meta and config, and replays it on subscribe. A pane opened mid-stream
decodes from the keyframe immediately instead of showing black until scrcpy's
next periodic keyframe (~10s). Refreshes the now-validated session doc comment.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): show New Mobile Emulator tab action off macOS
The tab create menu and its dropdown item gated the New Mobile Emulator action
on isMacOs, hiding it on Windows/Linux where Android emulation is now supported.
Gate on mobileEmulatorEnabled + onNewSimulatorTab (already cross-platform) so
the action appears wherever a mobile emulator backend is available.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): open the Mobile Emulator tab off macOS
openMobileEmulatorTab and ensureSimulatorTab both returned null unless the host
was macOS, so the New Mobile Emulator action no-opped on Windows/Linux even
though the menu entry showed. Drop the isMacOsHost early-returns; the
mobileEmulatorEnabled setting and backend availability already gate the feature.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): resolve a default attach device across backends
emulatorAttach with no device fell back only to the iOS listSimulators picker
(empty on Windows/Linux), so the pane's no-device launch flow errored. Extract
resolveDefaultAttachDevice: iOS default first, else the first booted (else
first) device across host backends, so Android attaches without an explicit
device. Split into its own module to stay under the line cap.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): render the pane off macOS instead of an unavailable wall
EmulatorPane short-circuited to the "macOS only" EmulatorUnavailablePane on any
non-Mac host, blocking the now-working Android pane. Always render the pane
content; its device discovery and error surface handle a missing backend.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): let attach boot a shut-down AVD with a stale active session
getReusableActiveForWorktree called resolveDeviceId on the requested device,
which throws for a not-yet-booted Android AVD, aborting the attach. Guard it so
a resolve failure means "not the active device" and the attach falls through to
a fresh boot — so picking a shut-down AVD in the pane and hitting Connect boots
it via ensureBooted instead of erroring.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): launch the AVD detached instead of via execFile
bootAndroidDevice started the emulator through the command runner (execFile with
a timeout + 1MB stdout maxBuffer), which kills the long-running, verbose emulator
process — so booting an AVD from the pane never actually came up. Spawn it
detached with no stdio and unref it so it outlives the call, mirroring how the
scrcpy server is launched.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): dedupe concurrent attaches into one scrcpy stream
Extract AndroidStreamController to own the per-serial scrcpy lifecycle and
dedupe starts: concurrent attaches (e.g. the pane's auto-attach racing the tab
launch) now share one in-flight start and reuse the live stream instead of
spawning a second scrcpy server that fights for the port and kills the first.
Also initialize the registry GOP buffer in register() (latent type error).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): boot the AVD headless without a console window
The detached spawn opened a Windows console (showing the emulator's verbose
qemu/netsim logs) and a redundant native emulator window. Pass windowsHide and
run the emulator with -no-window so it boots headless — the scrcpy pane is the
view, matching how iOS hides Simulator.app.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): boot the AVD with a hidden console, not detached
detached: true sets DETACHED_PROCESS, which gives the console-subsystem emulator
no console — so it and its qemu/netsim children pop their own visible cmd window
that windowsHide can't suppress. Drop detached and rely on windowsHide
(CREATE_NO_WINDOW = hidden console) + unref; spawn already keeps it alive past
the launch call, and managed emulators are shut down on app quit.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): keep Android emulators alive when switching devices
Attaching a different device shut down the active one (shutdownDevice: true),
which for Android meant killing the running emulator and cold-booting the target
(~60s) on every switch — and switching back. Add bridge.stopActiveForSwitch:
Android emulators stay running for instant switch-back, while iOS simulators are
still replaced. Switching to an already-running emulator is now immediate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* perf(emulator): only resize the video canvas when dimensions change
The decoder output handler set canvas.width/height on every frame, which
reallocates the canvas backing store and forces an object-contain reflow each
frame — a needless per-frame cost. Resize only when the frame dimensions
actually change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): genericize copy + add Android Studio setup link
Replace iOS-only wording (Xcode/Simulator/iPhone) in the pane and settings with
backend-neutral copy so Android reads correctly on every platform. When no
emulator is available, the Mobile Emulator settings now show a "Download Android
Studio" link plus setup guidance (ANDROID_HOME / default install path). Removes
the now-unused, macOS-only EmulatorUnavailablePane.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): show emulator SDK status in settings
The backend availability now reports the resolved Android SDK path, aggregated
into emulator.availability as an `android` block. The Mobile Emulator settings
render an "Emulator SDKs" card showing Android SDK (detected at <path> / not
found, with a Download Android Studio link) and, on macOS, iOS Simulator (Xcode)
status — mirroring the agent-control card.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(emulator): locate a custom Android SDK folder from settings
Add an androidSdkPath setting and a "Locate SDK folder…" / Clear action in the
emulator SDK status card. The path is applied as the highest-priority discovery
candidate (falls back if invalid), and the backend's SDK is re-resolved on use
via a new AndroidSdkState — so locating or installing the SDK takes effect on
Refresh without restarting Orca. Guards the status card against older runtimes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): settle the scrcpy video socket once to stop retry storms
A failed TCP connect emits both 'error' and 'close', so retry ran twice and
scheduled openVideoSocket(attempt+1) twice — fanning out into an exponential
connection storm while waiting for the server to start listening. A runaway
chain could then hit attempt 100 and fail/close a stream that had already
connected. Replace the delivered flag with a single settled latch so each
socket retries (or delivers) exactly once.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): address CodeRabbit review findings
- avd-boot: handle spawn 'error' (an unhandled ChildProcess error crashed the
main process); validate the target is a known AVD before launching.
- capability-ops: propagate adb non-zero exits for launch/permission/logcat and
check the uiautomator dump before reading (avoids stale XML).
- scrcpy-video-registry: actually replay the buffered GOP on subscribe so late
subscribers decode immediately.
- android-sdk-state: re-resolve host discovery every call so a changed SDK path
takes effect live (no restart).
- android-sdk-discovery: require both adb and the emulator binary.
- emulator-bridge: fall back to the platform-primary backend (Android off-mac)
so setup errors aren't iOS/CoreSimulator on Windows/Linux.
- scrcpy-server-download: dedupe concurrent first-use downloads + add a timeout.
- scrcpy-stream-session: idle-socket connect timeout; surface control-socket
errors instead of swallowing them.
- android-exec: pass the whole command so the device shell parses quotes/pipes.
- avd-manager: match emulator log prefixes exactly (keep AVD names like
PixelWARNINGTest).
- permissions: `pm reset-permissions` is global and takes no package argument.
- stream controller/starter: drop stale handles for dead streams; idempotent
teardown. use-emulator-video-stream: stopVideoStream returns Promise.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(emulator): populate the GOP buffer and reuse live scrcpy streams
Self-audit follow-ups in the same class as the CodeRabbit GOP-replay finding:
- scrcpy-video-registry: pushFrame never wrote to entry.gop, so the replay
loop added for late subscribers iterated an empty array — a no-op. Build the
GOP on ingest (start at each keyframe, append following deltas; don't buffer
deltas before the first keyframe). Adds tests for population, reset, and the
pre-keyframe guard.
- android backend: isSessionReusable was stubbed to always return false with a
"no persistent stream yet" note, but scrcpy streams are persistent now — so
every renderer remount tore down and respawned the server. Reuse a live
stream (scrcpyVideoRegistry.has) so remounts reconnect, matching iOS. The
device-mismatch check still runs first, so device switching is unaffected.
- Refresh stale comments that implied unfinished/unverified work.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* Refine mobile emulator availability settings
Co-authored-by: Orca <help@stably.ai>
* Address emulator review follow-ups
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
* Support background and focused terminal presentation modes
* Add `presentation` field ('background' | 'focused') to terminal
creation to control focus behavior.
* Prevent terminal creation from stealing UI focus by default.
* Return discoverability warnings when default terminal presentation
fails, unless explicit background mode is selected.
* Update orchestration SKILL.md to clarify review-only worker
completion rules and named owner handoffs.
* Prevent background terminal sessions from auto-activating
Ensure that terminal tabs created with 'background' presentation (such
as background agent sessions or locally backed renderer transports) do
not automatically activate or get selected as the active tab on remote
or mobile sessions.
- Add a selectIfNoActiveTab option to control auto-activation on mobile
- Set presentation to 'background' for remote runtime transports and
agent background sessions
- Skip tab auto-selection when the presentation is background
* Keep background terminal create payloads focused
* Wire terminal-initiated worktree navigation to back-and-forth stack
* Unify terminal-driven worktree activation and Cmd+J recency marking.
* Record worktree visits in the back/forward history stack unless navigating history.
* Resolve stale terminal focus and ignore late exits from old PTYs
- Repair the active terminal pane leaf selection when a pane's PTY exits, preventing focus from being stranded on a dead pane.
- Ensure stale, pruned, or unbound terminal leaves are not persisted as active in visual layouts or shutdown snapshots.
- Ignore late exit notifications and subscription end events from old PTY transports or remote stream handles after a reconnect or rebind.
* Prevent active terminal focus on dead panes and ignore stale PTY events
- Redirect active keyboard focus to a live, PTY-backed sibling pane
if the focused pane dies, fails to spawn, or is hydrated without a
live connection.
- Ignore stale data, replay messages, and subscription rejection errors
from older PTY sessions after a transport has reconnected.
- Avoid persisting stale PTY bindings and dead pane focus inside
terminal shutdown layout snapshots.
* Clear pending input when attaching a different remote terminal handle
When switching between different remote terminal handles, debounced input
meant for the previous terminal could get incorrectly flushed and sent
to the newly attached terminal.
Fix this by clearing the batcher's pending state (text and byte counts)
and invoking `inputBatcher.clear()` if the attached terminal handle
changes.
* Add window wake recovery hook for visible terminal panes
- Extract and enhance window focus and visibility change recovery logic
into a dedicated `useTerminalWindowWakeRecovery` hook.
- Recover the xterm renderer, input surface, and WebGL texture atlases
when macOS/display wakes or the window/tab regains focus.
- Schedule recovery steps with requestAnimationFrame to ensure the
terminal layout settles correctly.
* Fix mutable variable capturing in remote transport test
Avoid mutating a local `let` variable from inside a Promise executor
closure by wrapping the rejection callback in a `const` object.
* Prevent duplicate terminal wake recovery on overlapping window events
When window focus and visibility events fire concurrently, they can trigger multiple redundant wake recovery passes.
- Return early if a wake recovery frame is already scheduled.
- Keep the scheduled animation frame instead of canceling it to ensure we get a settled recovery pass.
Defect 1: the typed GitLab MR search query was dropped before reaching
the API. Thread query?: string end-to-end through the renderer effect,
the source-lookup, the preload/RPC args, and the desktop IPC handlers
(which previously passed a hardcoded undefined), and honor it on both the
glab REST path (&search=) and the cwd-inferred 'glab mr list' fallback.
Defect 2: when MR base resolution failed the renderer silently returned,
leaving baseBranch undefined so the worktree was created off the repo
default branch (origin/master) with no feedback. Surface the failure via
toast and clear stale base state, mirroring the GitHub PR path. Also make
resolveManagedMrBase resilient to an optional compare-base (target branch)
fetch failure: degrade gracefully by dropping compareBaseRef instead of
aborting, so a merged MR with a deleted target ref still resolves to its
valid source-branch base.
Fixes#6263
Co-authored-by: Orca <help@stably.ai>
* perf: dedupe relay process-table scans behind a short-TTL cache (#6288)
Agent foreground-process inspection runs `ps -axo pid=,ppid=,stat=,command=`
(a full system process-table scan) on a 750ms/2000ms per-pane cadence. On a
shared SSH relay every tracked agent terminal drives it, so concurrent panes
each forked their own `ps` — sustaining up to the per-second inspection cap of
full-table scans for as long as agents are open, pinning idle relay CPU and
amplified by AV process scanning. This is the CPU half of #6288 (PR #6564
covers the memory-leak half).
Memoize the scan behind a single in-flight promise + 500ms TTL shared by the
relay and local main-process call sites. 500ms sits below the active poll's
minimum inter-poll gap (~675ms after jitter), so a single pane never reuses a
snapshot older than it would have scanned itself — same data and freshness,
just deduplicated within the cadence window (worst case ~8 scans/sec -> ~2).
Failures are never cached (in-flight cleared on settle) so a transient `ps`
error retries and the existing best-effort fall-through is preserved. Windows
branches are untouched; no git-provider implications.
Co-authored-by: Orca <help@stably.ai>
* test: regression guard for #6288 ps-scan volume (repro + measurement)
Drives the real local foreground-inspection call site under the documented
750ms agent-completion cadence across 6 concurrently-inspecting agent panes
over a 30s window, counting actual `ps -axo pid=,ppid=,stat=,command=`
full-table scans.
Reproduces the waste on `main` (240 inspections -> 240 scans, 1.0/inspection;
the test fails there) and proves the fix (240 inspections -> 40 scans,
0.167/inspection — bounded by poll ticks, not pane count) while every pane
still resolves its foreground agent. Guards against regressing the cache back
to a per-call scan.
Co-authored-by: Orca <help@stably.ai>
* docs: clarify 500ms TTL covers cadence floor + tolerated event-driven staleness (#6288)
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Add Project → Browse folder on a monorepo subfolder (e.g. /tmp/monorepo/packages/web)
stored the subfolder as Repo.path because isGitRepo() uses
`git rev-parse --is-inside-work-tree`, which is true for any subdirectory.
Authoritative worktree resolution then snapped activation back to the repo root,
so the import identity mismatched and the first terminal landed at the repo root
rather than the selected subfolder.
Canonicalize local git imports to the actual repo root via getGitRepoRoot()
(mirroring the SSH import path that snaps to check.rootPath, including its
post-resolution dedup), and preserve the user-selected subfolder as a one-shot
initial terminal cwd consumed only by the first activation-created pane.
Selecting the repo root applies no override, and re-importing a subfolder of an
existing project dedupes.
Supersedes community PR #6362.
Fixes#6336
Co-authored-by: Rod Boev <rodboev@users.noreply.github.com>
Previously, transient errors during candidate branch discovery (such as
rate limits or network issues) were silently ignored, leading to a
false "no-pr" result and causing the sidebar PR state to flicker.
Now, track and return any pending error encountered during branch
lookups, propagating it as an upstream error if no PR is successfully
recovered.
* Migrate terminal scrollback setting from bytes to rows
Transition terminal scrollback configuration from a byte-based (MB)
limit to a row-based count to align with standard terminal emulator
behavior.
- Introduce a shared scrollback policy to handle normalization and
safe migration of legacy byte presets to row equivalents.
- Update persistence logic to automatically convert and clean up legacy
settings on startup and write-back.
- Refactor the advanced settings interface and localization strings
to let users configure scrollback in terms of rows (up to 50k).
- Live-apply row limit changes directly to mounted xterm instances
without recreating panes or restarting PTY sessions.
* Migrate terminal scrollback setting from bytes to rows
Transition terminal scrollback configuration from a byte-based (MB)
limit to a row-based count to align with standard terminal emulator
behavior.
- Introduce a shared scrollback policy to handle normalization and
safe migration of legacy byte presets to row equivalents.
- Update persistence logic to automatically convert and clean up legacy
settings on startup and write-back.
- Refactor the advanced settings interface and localization strings
to let users configure scrollback in terms of rows (up to 50k).
- Live-apply row limit changes directly to mounted xterm instances
without recreating panes or restarting PTY sessions.
* defer updating terminal scrollback rows until blur or Enter
Avoid committing terminal scrollback row setting changes on every
keystroke, which can trigger rapid updates with incomplete or
invalid numbers. Instead, manage a local draft state and commit to
settings only when the input is blurred or the user presses Enter.
* fix(terminal): support Windows shell selection for SSH hosts
* fix(runtime): register SSH Windows capability preflight RPC
* fix(terminal): honor remote Git Bash and split preflight IPC seams
* fix(terminal): keep SSH Windows shell state tied to the selected host
* fix(terminal): preserve Windows SSH shell selection
---------
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Opening a workspace whose worktree lives on a \wsl.localhost\<distro>
UNC path failed with 'Working directory ... does not exist' even though it
exists. validateWorkingDirectory relied on Win32 fs.statSync, which is
unreliable against the WSL 9P share and can report ENOENT for directories
that exist on the Linux side.
Make working-directory validation WSL-aware: when the cwd is a WSL UNC path,
ask the distro itself via 'wsl.exe -d <distro> -- test -d <linuxPath>' and only
fall back to the fs check when wsl.exe is inconclusive. Native Windows path
validation is unchanged.
Fixes#6331
Co-authored-by: brennanb2025 <brennanb2025@users.noreply.github.com>
On Windows the bundled orca.cmd runs Orca.exe with the unpacked CLI
entrypoint and ELECTRON_RUN_AS_NODE=1. When that env var is dropped, Orca
boots as a GUI, loses the single-instance lock to an already-running
window, and exits silently with no stdout.
Add a packaged-CLI-entry redirect that detects a Windows launch whose argv
carries the known in-package CLI entrypoint and re-runs it in Electron node
mode before the single-instance lock gate can bounce it, then exits with the
CLI's status. Mirrors the existing maybeRedirectAppImageCliLaunch pattern.
Fixes#5774
Co-authored-by: brennanb2025 <brennanb2025@users.noreply.github.com>
* Preserve terminal scrollback when restoring a hidden alternate-screen pane
On Windows, an alternate-screen TUI pane (Claude Code) could lose scroll-up
after being hidden (tab/worktree switch or app backgrounded) and shown again.
Root cause: on hidden->visible restore, applyMainBufferSnapshot
unconditionally wrote a destructive clear (\x1b[2J\x1b[3J\x1b[H) before
replaying the snapshot, wiping xterm's scrollback. The attach/reattach path
already guards this same clear behind !isAlternateScreen (pty-transport.ts);
the snapshot path did not.
Thread an alternateScreen flag from the backend headless serialization
through the pty:getMainBufferSnapshot IPC + preload types into
applyMainBufferSnapshot, and skip the destructive clear when restoring an
alternate-screen buffer. Add a regression test asserting the clear is NOT
emitted for an alt-screen restore (and the existing normal-buffer test still
asserts it IS).
Fixes#5723
* test: account for alternateScreen flag in empty headless snapshot assertions
The alt-screen scrollback fix threads an alternateScreen flag through the
headless snapshot return type. Two sibling empty-buffer tests used exact
toEqual() assertions that did not include the new (legitimately false) key.
Update them to reflect the correct snapshot shape.
---------
Co-authored-by: brennanb2025 <brennanb2025@users.noreply.github.com>
* Resolve PowerShell to a real executable so terminals spawn (Windows error code 5)
On Windows, launching a PowerShell terminal could fail with:
Failed to spawn shell "pwsh.exe": Cannot create process, error code: 5
error code 5 = ERROR_ACCESS_DENIED from CreateProcessW inside node-pty's
ConPTY. Orca handed ConPTY a bare family name ("pwsh.exe" /
"powershell.exe"). When pwsh resolved to the Microsoft Store App Execution
Alias stub under WindowsApps (or was blocked by AV/AppLocker/SAC),
CreateProcessW rejected it with access-denied. isPwshAvailable probes via
execFileSync (which DOES follow the alias), so detection and launch disagreed.
Fix: resolve the PowerShell executable to a real absolute path before
spawning, skipping the WindowsApps alias stub, and add a Windows fallback
chain: pwsh (resolved abs) -> Windows PowerShell (System32 abs) -> cmd.exe.
SSH/remote and WSL/Git Bash/cmd paths are unaffected.
Fixes#5161
* test(pty): assert resolved absolute PowerShell path in win32 spawn tests
The PowerShell-resolution fix (#5161) now hands ConPTY a real absolute
executable instead of a bare 'powershell.exe'/'pwsh.exe' family name. The
pre-existing win32 spawn assertions in pty.test.ts (not in the worker's
per-file affected set) still expected the bare names and went red on the
full CI verify suite. Mock the fs seam and pin the install roots the
resolver probes so the resolved path is deterministic on Linux CI and
Windows alike, and assert the resolved System32 / Program Files paths.
* fix(pty): derive Windows shell name with win32 basename for determinism
getForegroundProcess() falls back to the spawned shell's basename when
Windows node-pty reports only the terminal name. The basename was taken
with the host-native path.basename, so on a non-Windows host (Linux CI)
the Windows absolute path 'C:\...\powershell.exe' was not split and the
whole path was stored as the shell name — making getForegroundProcess
return the absolute path instead of 'powershell.exe'. This produced a
host-dependent result for the same forced win32 platform.
Parse the spawned shell basename for the target platform (win32 basename
on Windows, POSIX otherwise), matching the daemon path
(pty-subprocess.ts already uses pathWin32.basename). The win32 spawn
foreground test is now deterministic on Linux CI and Windows alike.
---------
Co-authored-by: brennanb2025 <brennanb2025@users.noreply.github.com>
Catch errors during hosted review lookup if local blockers are present.
This ensures that network or API failures do not completely hide the
Create PR preparation UI if we can still guide the user to resolve local
issues first.
* fix Orca CLI path resolution and improve registration UI
- Hydrate the shell PATH before running installer actions on macOS to
match the user's terminal instead of launchd.
- Resolve the active macOS command path dynamically against shell PATH
candidates, ignoring broken symlinks and non-executable files.
- Detect and report conflicts with unmanaged executables shadowing the
configured command path.
- Add "Preparing..." and "Registering..." loading states to the settings
and setup panels during preflight checks.
* Fix Orca CLI detection and installation path conflict checks
- Allow detecting a managed Orca command located later in PATH when the
default path entry is missing or non-executable.
- Avoid raising installation conflicts for unmanaged commands located
after the default install path, as they will be safely shadowed.
- Translate terminal setup and Orca CLI registration strings for
Spanish, Japanese, Korean, and Chinese locales.
* Only open terminal when pre-install checks succeed
Prevent the terminal from opening and setting the terminal command if
onBeforeOpenTerminal or refreshPreInstallNotice throws an error.
* Fix browser pane stuck in HTML fullscreen (#6442)
Guest content in a browser pane could enter HTML fullscreen but not
exit it: requestFullscreen() resized the host BrowserWindow into native
fullscreen, and exitFullscreen() had nothing to restore, leaving the
pane stuck.
Set the webview's disableHtmlFullscreenWindowResize preference so HTML
fullscreen is contained to the <webview> element. Exit then works and
fullscreenchange fires as guests expect.
* Apply browser guest fullscreen policy consistently
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Wolfgang Schoenberger <221313372+wolfiesch@users.noreply.github.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
Brennan BensonandOrca
lvfenandJinjing
NeilandOrca
Jinwoo Hong
WolfieandWolfgang Schoenberger
Dvitash
Rod BoevandJinwoo Hong
