* fix: handle headless file download version skew
- Issue: remote downloads could open the local save dialog before discovering an older headless server lacks files.readChunk.
- Fix: preflight the first remote chunk before starting the local download transaction.
- Coverage: add regression coverage for method_not_found and preserve cleanup for mid-transfer failures.
* fix: fall back for headless downloads without chunks
- Issue: older headless servers can lack files.readChunk but still expose preview-sized file reads.
- Fix: fall back to files.readPreview and save the file when the preview payload is usable.
- Coverage: verify preview fallback success, unsupported preview update messaging, and modern chunk cleanup.
* fix: reduce remote download support probe
- Issue: the chunk-support probe downloaded a full chunk before the real save flow started.
- Fix: probe chunk support with a one-byte read and keep the actual download starting from offset zero.
- Coverage: add a transport-failure probe test and name the remote download args type.
* fix: preserve empty binary preview downloads
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
PR #7423 resized the working spinner ring from the dot size to the
icon size (sm: 6px -> 10px, md: 8px -> 12px) as a side effect of the
AI Vault subagent display work. The size change was unintentional in
the sidebar agent rows, so restore the original dot sizing.
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
launch-agent-in-new-tab.ts crossed the 300-line oxlint max-lines limit
(303 counted lines) after #5510 and #7944 both grew it; verify only runs
on PRs, so the over-limit state landed on main via a merge race and now
fails lint for every open PR.
Move the web-runtime host launch branch (stale-local-tab pruning plus
createWebRuntimeSessionTerminal call) into launch-agent-web-host-tab.ts.
No behavior change; the i18n key is kept so locale catalogs are
untouched.
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
Aligns status bar, tooltip, popover mocks, and mobile usage bars with the
Claude/Codex harness convention (consumption meters) so a fresh account
reads empty/green and a depleted one reads full/red, instead of the
inverted "left" framing that misread as "full = exhausted".
* fix(ports): stop live-port indicator flickering on transient scan failures
A worktree's plug icon renders only when it has ports. The scanner polls
each execution host every 30s and, on a transient failure (SSH/IPC latency),
substituted an empty "unavailable" scan — dropping that host's ports for the
cycle and blinking the affected row's live-port indicator off, then on again
next poll.
Debounce per-host failures: reuse the host's last good scan until failures
reach a tolerance, so a single dropped poll no longer zeroes the row. A
reachable host reporting no ports has no unavailableReason, so a genuine port
close still clears immediately. Logic extracted to a pure helper with tests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ports): stop port scan re-init loop that flickered live-port icons
The scan poll effect depended on the `refresh` callback identity, which gets a
fresh reference whenever repos/settings are replaced (frequent in a busy
workspace). Each change re-ran the effect, which reset the scan to null and
kicked an immediate re-scan — a tight ~600ms loop that blinked the plug icon
off/on even though the scanned ports never changed.
Drive the poll and advertised-url effects off the latest refresh via a ref and
key them on stable value-signatures (enable state, active scan key, host-set
signature, runtime kind) instead of the callback identity. Incidental store
churn no longer re-inits the scanner; it still polls every 30s, reacts to
advertised-url events, and rescans on a real host-set or runtime change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Address PR review feedback (#5510)
- Prune the per-host failure counter for failed-only hosts that disappear,
not just hosts present in lastGood — avoids an unbounded failures map and a
stale failure streak if the host reappears
- Canonicalize scanTargetsSignature by sorting so a reordered-but-unchanged
host set does not re-init the scan and reintroduce flicker
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ports): keep host scans targeted and stable
* test(ports): cover scan debounce state
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* Show agent session history on mobile
Bring the desktop "Agent Session History" panel to Orca Mobile as a
per-worktree screen: browse past agent transcript sessions across the
host with scope tabs (Workspace/Project/All), search, grouping, session
cards, and tap-to-read message previews.
The transcript scan previously ran only over Electron IPC, so mobile
could not reach it. Expose it over the runtime RPC protocol mobile
already speaks (aiVault.listSessions) so the scan runs on whichever host
owns the transcripts — correct for local and SSH/remote hosts. Both the
desktop IPC handler and the new RPC method share one cache, so opening
the desktop panel and the mobile screen never double-scan.
The pure filter/group/display logic is lifted into /shared (the renderer
re-exports it) so the standalone mobile package can reuse it. Mobile
narrows scoped tabs client-side by cwd path-prefix because the host scan
treats scope paths as a widening union.
Resume-from-mobile is intentionally a follow-up.
* Fix mobile agent history list rendering and RPC authorization
- Authorize aiVault.listSessions in the mobile RPC allowlist so the
mobile client's call is not rejected before dispatch (without this the
screen could never load sessions at runtime).
- Name each SectionList section's rows `data` (the field React Native
reads) instead of `cards`, fixing a type error and silent empty-section
rendering.
* Address review feedback on agent session history
- Match quoted repo:/path: search operator values so labels and paths
with spaces match (e.g. path:"/Users/ada/My Project").
- Hold a scoped tab in loading until the worktree list resolves instead
of firing an unscoped fetch that briefly shows unrelated host history;
proceed once loaded even if the worktree is absent (no stuck spinner).
- Clear cached host capabilities on disconnect/host-switch and failed
status.get so a capability-gated action can't linger for a host that
doesn't support it.
- Cover the real OrcaRuntimeService codex-home forwarding path and the
quoted-operator parser with tests.
* Hide redundant mobile current worktree badges
Co-authored-by: Orca <help@stably.ai>
* Resume agent sessions from mobile history (#6969)
Co-authored-by: Orca <help@stably.ai>
* Adapt merged seams to main's lint and reply-sender hardening
Co-authored-by: Orca <help@stably.ai>
* Cap mobile project-scope paths to the aiVault RPC bound
Co-authored-by: Orca <help@stably.ai>
* Share the aiVault scopePaths bound between the RPC schema and mobile
Co-authored-by: Orca <help@stably.ai>
* Guard shared AI Vault inflight cleanup against concurrent key replacement
The extracted cache module's .finally() cleared inflight tracking
unconditionally, dropping the if (inflightKey === key) guard its sibling
outer cache kept: an older scan resolving after a different-key scan
replaced the tracking would null the newer scan's dedup slot, so a
re-request started a duplicate transcript rescan. Mirrors the sibling
guard; the regression test flushes a macrotask so a reverted guard fails
fast on the call count instead of hanging.
Co-authored-by: Orca <help@stably.ai>
* Harden aiVault.listSessions contract and gate mobile header entry on capability
- Clamp scopePaths (64) instead of rejecting, cap limit at 2000, and make
executionHostId optional so mobile can omit it; restamp per caller.
- Retain successful mobile terminal-create mutation ids for 60s so resume
retries dedupe after transient socket drops.
- Gate the session-header Agent History action on the aiVault.v1 capability
(mirrors the host-list action) so old hosts never show a dead-end entry.
- Fix stale contract comments (scopePaths clamp semantics; filters move
includes quoted repo:/path: operator parsing).
* Add subagent field to session test fixtures after #7423 merge
AiVaultSession.subagent became required on main; the five fixtures added on
this branch predate it. Top-level scanned sessions carry null.
---------
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
* fix(terminal): forward Option hotkeys to kitty-keyboard TUIs on compose layouts
On macOS layouts where Option composes characters (ABC and all non-US, the
effective default), pressing Option+P in a TUI that negotiated the kitty
keyboard protocol made xterm's kitty encoder report the composed codepoint
(alt+pi, CSI 960;3u) instead of the physical key (alt+p, CSI 112;3u). No TUI
binds the composed form, so agent hotkeys like OMP's Alt+P / Alt+M neither
fired nor typed anything.
Fix: mirror each pane's application-negotiated kitty flags with a scan-based
tracker fed only from PTY output (immune to Orca's defensive renderer-side
kitty resets on Ctrl+C interrupts and reattach), and have the terminal
shortcut policy encode Option chords as kitty CSI-u from the physical key
when the pane's app opted in. Dead keys stay exempt so Option composition
still works, and panes without kitty negotiation (shells) are unchanged.
Alt+Arrow / Alt+Backspace now defer to xterm's native kitty encoding in
kitty panes instead of the legacy readline translations.
The daemon's headless emulator tracks the same flags and re-arms them via
the snapshot rehydrate preamble (CSI = flags ; 1 u), so the behavior
survives window reloads and reattaches; PTY exit and cold restore reset the
mirror.
Validated byte-for-byte against a real omp 16.3.15 in a pty: the policy's
emitted CSI-u opens the temporary-model selector (Alt+P) and agent hub
(Alt+A), identical to the legacy ESC-prefixed forms it parses.
* fix(terminal): harden kitty Option-chord mirror for soft resets, replay redelivery, and non-QWERTY layouts
Three review findings on the kitty keyboard mirror, each verified against a
live omp 16.3.15 pty session using the real production modules:
- DECSTR: xterm's soft reset (CSI ! p) clears its kitty flags and stacks for
both screens without switching buffers; the tracker now mirrors that, so a
soft-resetting TUI stops receiving kitty-encoded Option chords.
- Replay redelivery: relay reconnects can redeliver the retained replay
window, and each scan of the app's one-time CSI > u push grew the mirrored
stack while the renderer's post-replay reset drained xterm's copy. The
TUI's single exit pop (omp emits a bare CSI < u on quit) then landed on a
stale frame, leaving Option+B/F/D kitty-encoded in a plain shell. Replay
paths now scan with scanReplay(), which applies pushes as idempotent sets
so redelivery cannot grow the stack; the live-output funnel and the
daemon's once-per-byte emulator keep full stack semantics.
- Layout-correct base keys: kitty CSI-u reports must carry the key's
unshifted codepoint in the active layout, but the encoder resolved it from
a US-QWERTY physical-code table — on Dvorak/Colemak/AZERTY-class layouts
(exactly the population whose effective Option-as-Alt default activates
this path) the wrong key's chord fired, e.g. Colemak Option+P sent alt+r.
A new keyboard-layout module caches Chromium's KeyboardLayoutMap (fetched
at terminal setup and on focus-in, like the option-as-alt probe) and the
policy resolves through it before the US fallback. Verified live: the
layout-resolved bytes open omp's model selector; the US-table bytes do not.
* fix(terminal): reset kitty mirror on fresh spawn to cover replaced-PTY late exits
The exit handler resets the per-pane kitty keyboard mirror, but a late exit
from a replaced PTY takes the stale-transport early return and skips it —
so a restart-in-place could leak the old TUI's kitty flags into the fresh
shell, kitty-encoding Option chords the shell cannot parse. A fresh spawn
is by definition a new process with kitty state at zero, so startFreshSpawn
now resets the reused tracker itself, alongside the other per-pane mode
state it already clears. Reattach paths are untouched, so a live TUI's
mirrored flags still survive reconnects.
---------
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
* fix(grok): restore clipboard and native-chat parity
Grok CLI already supports argv prompts, OSC 52 copy, and image paste chips.
Orca was blocking those paths: stdin-after-start keystroke injection, OSC 52
writes default-off, image-attachment denylist, and native-chat allowlist.
- Launch Grok with positional argv prompts
- Default OSC 52 TUI clipboard writes on (still user-toggleable)
- Treat Grok as image-attachment capable
- Parse ~/.grok/.../chat_history.jsonl for native chat
OSC 52 clipboard *query* remains ignored by design (host clipboard exfil risk);
xAI docs only require OSC 52 write for remote copy.
* fix(grok): sync OSC 52 docs and locale catalog with default-on
Update terminalAllowOsc52Clipboard type docs for the true default, and
refresh locale strings so settings UI mentions Grok alongside other TUIs.
* fix(grok): tool hook matcher, StopFailure, previews, AskUser waiting
Grok tool-event matchers are real regexes; bare `*` failed as match-all.
Install `.*` for Pre/Post tool hooks, add StopFailure for API-error ends,
recognize Grok-native tool input keys, and map ask_user_question PreToolUse
to waiting with interactivePrompt (Kimi-style live card path).
* fix(grok): resolve chat_history under GROK_HOME and long-cwd layouts
Centralize Grok session path helpers so hooks and native-chat honor
GROK_HOME and find chat_history.jsonl by session id when the cwd group
is slug-encoded (encoded name > 255 bytes) instead of only
encodeURIComponent(cwd).
* fix(terminal): keep Kitty keyboard for Grok on Windows ConPTY
Local Windows ConPTY withholds KKP so CSI-u-blind CLIs (e.g. Antigravity)
keep Enter/nav working (#2434). Grok needs KKP for Ctrl+Enter interject and
modified-Enter newline chords; blanking the advertisement for Orca-launched
Grok left those actions broken.
- Prefer KKP when tuiAgent is grok despite ConPTY withhold
- Wire launchAgent from tab/startup into keyboard protocol options
* fix(grok): restore OSC52 default-off, split decoders, honor GROK_HOME hooks
- Keep terminalAllowOsc52Clipboard default false (clipboard exfil risk)
- Split transcript-line-decoders under max-lines without suppressions
- Install local Grok hooks under resolveGrokHomeDir() / GROK_HOME
* refactor(grok): share CLI home resolution
* fix(grok): harden terminal and native chat integration
* test(grok): align CI coverage with native chat support
---------
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
* fix(status-bar): keep antigravity usage visible
* feat(rate-limits): add Grok usage status
* feat(grok): add managed usage accounts
* test(rate-limits): isolate Codex PTY fallback fetches
* fix(grok): address CodeRabbit review on usage status PR
- Guard auth.json read/parse so missing files return null
- Thread AbortSignal through Grok rate-limit fetch and ACP auth
- Pass isRemote:false for floating-terminal agent launch env
* fix(grok): wire ACP abort after child listeners to avoid TDZ
* fix(status-bar): address CodeRabbit on combined Grok/Antigravity usage
- Pin WSL shell distro when resolving managed GROK_HOME (parity with Codex)
- Refresh only Grok on account change via fetchGrokOnly
- Consolidate usage status-bar toggle catalogs; add Grok locale keys
- Fix Grok aria-label, feature-interaction tracking, and test fixture
* fix(settings): drop duplicate usage status-bar toggle catalog
Remove the leftover re-export path so Appearance search has a single
source of truth for usage provider toggles (including Antigravity + Grok).
* fix(settings): restore AccountsPane and locale UTF-8 after merge
Re-do AccountsPane three-way merge with binary-safe git objects and keep
both Grok accounts + remote provider client imports. Rebuild locale JSON
merges so em dash/ellipsis/middle-dot strings are no longer mojibake.
* fix(i18n): add missing comma after merged status-bar locale keys
* test: add antigravity to GrokUsagePane rate-limit fixture
RateLimitState gained a required antigravity field; the pane fixture must
carry it to typecheck.
* fix(status-bar): gate Antigravity durable visibility on Gemini OAuth opt-in
The Antigravity snapshot mirrors the Gemini fetch, which is permanently
'unavailable' until the user opts into Gemini CLI OAuth. Without this gate
the default-on checked item plus a detected agy CLI pinned a dead 'A --'
bar (Gemini itself hides in that state) and suppressed the usage setup CTA
for users who configured nothing.
---------
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
* fix(jira): group Jira issues by status in task page
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(jira): order grouped statuses by agile board columns configuration
* test(jira): add comprehensive tests for Jira issue grouping functionality
Add test coverage for the new Jira issue grouping features including:
- Grouping issues by status name
- Sorting sections by agile board column configuration
- Falling back to alphabetical sorting when no board config exists
- Collapsed groups state management
- Filtering issues based on collapsed state
- Backend tests for getProjectStatuses API with various scenarios
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* test(jira): add backend tests for getProjectStatuses and RPC routing
Add test coverage for the new getProjectStatuses backend functionality:
- Returns empty array when no clients are available
- Returns statuses from project statuses API when no board configuration exists
- Orders statuses by agile board column configuration when available
- Handles missing status IDs gracefully by falling back to unordered list
- Clears token on auth errors
- Returns empty array on operational errors
- RPC routing for jira.getProjectStatuses method
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(jira): harden status grouping
---------
Co-authored-by: Andres Van Reepingen <andres.vanreepingen@datacamp.com>
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* fix(terminal): reset PTY delivery accounting across renderer lifecycle resets (frozen panes)
Panes froze permanently because main's PTY->renderer flow control leaked
its unacked in-flight byte counters and pending backlog across renderer
reloads/crashes: the lifecycle reset cleared only visibility hints, daemon
PTYs outlive the page, and the new page never acks the dead page's bytes,
so any pty with >=512KB unacked at reload time was delivery-gated forever
(proven by dev repro: counter pinned at exactly 524288; one manual ackData
of the leaked bytes instantly unfroze the pane).
Fix: (1) zero in-flight counters + pending backlog on every main-frame
renderer lifecycle reset (panes rebuild losslessly from main's
authoritative snapshot on reattach); (2) hold PTY sends until the new
page's pty:data listener signals ready (pty:rendererDispatcherReady), so
boot-window output accrues in the capped backlog instead of being
counted-but-dropped; (3) 10s self-heal watchdog + reconcile-on-handshake
backstop so a missed reset (subframe-overlapped reload emits no
did-start-loading) or lost handshake can never itself freeze delivery;
(4) derive the active-renderer-pty report reactively so in-place rebinds
keep the interactive reserve; (5) expose reset/gate state in the delivery
debug snapshot for future diagnosis.
Adds an experimental reliability gate
(pty-delivery.renderer-lifecycle-accounting-reset) with red/green-proven
regression tests for each branch of the fix.
* chore(reliability-gates): link PR #8034 as the gate's motivating fix
* fix(terminal): sender-guard the dispatcher-ready handshake; fix WSL gate wording
CodeRabbit: the reconcile backstop destructively clears delivery
accounting, so a straggler pty:rendererDispatcherReady from a dying
window's webContents must not reset the new window — reuse the pty:write
main-window sender check (+ regression test). Also resolve the
contradictory WSL coverage claim in the reliability gate notes (WSL rides
the same local/daemon pipeline; mobile/relay and SSH are separate paths).
* docs: full design + context for agent status over WSL (STA-1515)
Why hooks don't work on Windows+WSL (loopback transport gap + WSL-side
installation gap), per-client transport map, the OMP-only fixes that
shipped (7642/7641) and why they don't generalize, the recommended
guest-resident relay over wsl.exe stdio mirroring the SSH relay plus
WSL-side hook installers, alternatives considered, validation facts and
gotchas from the 2026-07-08 Windows rig run, and acceptance criteria.
Co-authored-by: Orca <help@stably.ai>
* feat(agent-hooks): agent status over WSL — guest relay + WSL-side hook installers (STA-1515)
Agent hooks have never worked from inside WSL: under default NAT
networking, WSL's 127.0.0.1 is its own loopback, so every hook POST to
the Windows listener dies silently, and hook configs were only ever
written to the Windows home where WSL agents never see them.
Transport: a hooks-only guest relay (src/relay/wsl-agent-hook-relay.ts)
runs inside the distro, binds WSL loopback on the very port the clients
were already given (host-issued token; EADDRINUSE falls back to :0 with
endpoint-file re-coordination, which also covers mirrored networking),
and forwards parsed envelopes over its own wsl.exe stdio into
agentHookServer.ingestRemote — the same shape as the SSH relay. It exits
when stdin closes so a freed Windows port can never be forwarded into a
dead guest listener.
Installation: the unchanged SSH remote hook installers run against an
SFTP-shaped adapter whose primitives are home-scoped fs RPCs served by
the relay, so all 14 managed agents' hooks land in the WSL home over the
already-open channel with zero per-file wsl.exe spawns.
Lifecycle: per-distro manager ensured from buildPtyHostEnv on every WSL
PTY spawn (covers post-restart daemon reattach re-spawns), stale-bundle
reinstall via exit 42, no-node-43 cooldown, bounded retry for wsl.exe
'Catastrophic failure (E_UNEXPECTED)', breadcrumbed failures.
Zero per-client transport changes; listener stays Windows-loopback-only.
Co-authored-by: Orca <help@stably.ai>
* fix(agent-hooks): WSL relay link-death recovery + Codex runtime-home hook install (STA-1515)
Follow-ups from the first Windows-rig validation of PR #7903:
Link death: a mux protocol error or keepalive timeout could kill the
host<->guest link while the guest relay stayed alive returning 204s —
the manager stayed 'running' and every later envelope blackholed
silently (the exact observed signature: Claude hooks POST 204, store
never populates). wsl-hook-relay-link.ts now guarantees exactly-once
death handling from either signal (mux dispose OR child exit); the
manager breadcrumbs it, kills the child, and self-restarts after a
short cooldown since a live agent session produces no new PTY spawns
to re-trigger ensure. ORCA_WSL_HOOK_RELAY_DEBUG=1 traces each received
envelope pre-ingest. A live integration test pins the full host chain:
the real esbuild bundle over real child stdio through the real manager
into a real AgentHookServer.ingestRemote, exact Claude POST shape.
Codex: Orca launches WSL Codex with CODEX_HOME redirected to the
managed runtime home (~/.local/share/orca/codex-runtime-home/home), so
hooks installed to ~/.codex were never read. installRemote now accepts
an explicit codex home (flat layout), threaded from the relay manager;
the config.toml trust write is deferred while the file doesn't exist
(the launch path seeds it only-if-absent — creating it first would
cancel the seed), and the manager re-runs the byte-equality-idempotent
installers on later ensures (30s throttle) to upsert trust once the
seed lands.
Also: WSL test suites now run on Windows dev hosts (fs-backed suites
skip with rig coverage noted; manager suite uses a fixed POSIX home).
Co-authored-by: Orca <help@stably.ai>
* fix(agent-hooks): renderer ownership gate treats wsl:* connection ids as local (STA-1515)
Round-2 rig finding: with the link fixed, WSL hook envelopes reached
ingestRemote and the durable cache, but useIpcEvents.applyAgentStatus
drops any status whose stamped connectionId differs from the owning
repo's — 'wsl:<distro>' !== null for a local repo, so every WSL-relayed
status died before setAgentStatus and notifications.
wsl:* ids are transport provenance, not ownership: the gate now
normalizes them to local via isWslHookRelayConnectionId (shared
contract, also used by the relay link when stamping), while still
rejecting WSL-stamped events against SSH-owned repos. Provenance stays
stamped — it is what made this drop diagnosable.
Co-authored-by: Orca <help@stably.ai>
* fix(agent-hooks): adversarial-review hardening for the WSL hook relay (STA-1515)
Four independent review lenses over the branch; all confirmed findings
fixed before the next rig round:
Endpoint identity (4/4 reviewers): the guest endpoint dir was keyed by
the EPHEMERAL Windows hook port, so a daemon-surviving agent kept
sourcing the dead port-P1 file after an Orca restart — breaking the
restart-resume acceptance criterion and regressing shipped OMP
recovery. Now keyed by a restart-stable instance key (hash of the
Windows endpoint file path, crossed via ORCA_WSL_HOOK_INSTANCE): the
restarted instance's relay rewrites the SAME file, which is exactly
what re-coordinates survivors.
Restart policy: every failure arms the restart timer (one failed
relaunch no longer ends self-recovery), and the timer probes
wsl --list --running first — wsl -d BOOTS a stopped distro, so
recovery must never resurrect a VM the user shut down; stopped-distro
state is dropped instead. Failure counters reset only after 2min of
stable uptime, so connect-then-die loops escalate to the 10-min cap
instead of cycling every 10s. Timer policy extracted to
wsl-hook-relay-recovery.ts with direct tests.
Also: version-namespaced guest install dir (dev+prod instances no
longer reinstall over each other; PID-suffixed tmp files), 30s install
timeout (a wedged wsl.exe could pin the state machine at 'starting'
forever), per-candidate node version probing (apt node 12 on PATH no
longer masks nvm node 20 into a false no-node cooldown), WSL_UTF8=1 +
NUL-stripped stderr (catastrophic-failure matcher survives UTF-16LE),
ordered post-sentinel chunk handoff, port-fallback breadcrumb via the
home handshake, bad home reply now fails the connect, missing-bundle
warn-once, case-normalized distro keys, disposeAll wired to will-quit,
one-shot 60s reinstall timer for single-spawn Codex trust catch-up,
escaped + contract-derived spawn command.
Co-authored-by: Orca <help@stably.ai>
* docs: record round-3 rig validation status for agent status over WSL (STA-1515)
Co-authored-by: Orca <help@stably.ai>
* fix(agent-hooks): round-4 adversarial-review fixes for the WSL hook relay (STA-1515)
- dropState identity race: recovery re-checks state identity after the
distro-running probe await, and the manager's dropState only deletes the
exact state it was armed for — an ensure() landing mid-probe can no longer
have its fresh relay orphaned outside the map.
- Distro-running probe fails CLOSED: a probe error no longer reports
'running', so recovery can never wsl-d-boot a distro the user shut down.
- Relay spawns use --exec: bypasses the distro's default login shell
(fish/nushell chsh) and passes argv verbatim, dropping the $-escape shim;
same form as the Codex WSL login spawn.
- Post-sentinel chunk handoff rides a microtask so an envelope in the
trailing bytes can no longer dispatch before the link's notification
handler is registered.
- Guest relay mirrors the SSH relay's uncaughtException/unhandledRejection
posture.
- Replay cache capped at 256 panes with recency eviction (the WSL relay has
no per-pane teardown signal); meta map kept in lockstep.
- Launch script derives the stale-exit code from the shared contract
constant; one-shot reinstall timer refuses to arm after dispose.
- New oracles: sentinel unit suite, fs-bridge scoping suite, fixed-token
403/204, EADDRINUSE endpoint-file rewrite, cache-cap eviction, and the
recovery/manager race regressions (verified to fail with fixes reverted).
- Doc: round-4 review section + revised curl.exe stance (kept as the
no-node fallback — Codex is a native binary; fresh distros ship no node).
* docs: record round-4 pinned rig validation for agent status over WSL (STA-1515)
---------
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
Extracts row rendering into a WorkspaceCleanupCandidateList that windows
rows via @tanstack/react-virtual once the list crosses 40 items, keeping
plain natural-flow rendering below that threshold. Memoizes CandidateRow
and stabilizes its callback props so scan stream-in and selection updates
don't re-render unrelated rows, avoiding O(N) DOM churn for users with
large numbers of worktrees.
Splitting on newline alone left trailing text attached to the task
ID once normalizeSingleLinePreview folded newlines to spaces, so
getOrcaDispatchTaskId never matched in production status prompts.
Delimit on the first whitespace instead, and add regression tests
covering both the normalized and raw multi-line prompt shapes.
* feat(rate-limits): Grok CLI OAuth weekly credit usage in status bar
Read ~/.grok/auth.json (read-only), fetch billing credits via cli-chat-proxy, and surface Grok in Settings, status bar toggles, and rate-limit polling alongside other usage providers.
* fix(grok): clarify comments and address CodeRabbit review
- Shorten Why comments per AGENTS.md; fix billing period end fallback.
- Share GrokAccountStatus type; hash-based locale keys; reload why in Settings.
* docs(grok): plain-language comments and Settings copy
* feat(stats): subscription usage section with Grok in Stats & Usage
Surface rate-limit weekly credits in Settings > Stats & Usage and link to Accounts for setup.
* feat(stats): Grok tab in Usage Analytics dropdown
* refactor(stats): drop Subscription usage block; align Grok pane with Codex
* fix(grok): align settings copy and visibility tests
* fix(grok): add localization catalog entries
* fix(grok): avoid eager usage refresh fanout
* fix(grok): harden usage refresh visibility
* test(grok): cover account status privacy boundary
* fix(grok): target refreshes and redact auth errors
* fix(grok): hide usage UI for signed-out users and align empty states
- Treat a token-less auth.json (e.g. after grok logout) as signed out
instead of surfacing a permanent status-bar error.
- Map billing responses without credit usage to 'unavailable' so plans
with no weekly credits hide the bar like Claude API-key billing.
- Gate the grok status-bar item and toggle on CLI PATH detection,
matching claude/codex/gemini/kimi.
- Guard an empty GROK_CLI_CHAT_PROXY_BASE_URL from producing a
relative billing URL.
- Drop dead minimax/kimi Stats & Usage search keywords left from the
removed subscription section.
- Add missing grok search keyword catalog entries and translate the
English-stubbed stats keywords in es/ja/ko/zh.
* test(ipc): mock grok account registrar in register-core-handlers test
---------
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
Retranslates remaining English placeholder strings and tightens
existing translations for terminology consistency (e.g. "workspace"
→ "workspace/worktree" per locale, "check" → "verification/検査")
across Spanish, Japanese, Korean, and Chinese locale files.
Boundary reveals (first/last row) previously widened the virtual list
with paddingStart/paddingEnd to force centering, but nothing cleared
that padding once the reveal finished, leaving a phantom gap in the
sidebar (#8019 follow-up). Clamp boundary targets to the list edge via
revealElementInScrollContainer instead, and drop the now-unused
centering-padding helpers and state.
* Show dispatch task preview and refresh generated titles when orchestrati
- Worker panes now display the task block from the dispatch preamble
instead of the raw prompt until orchestration metadata resolves
- Once orchestration displayName/taskTitle arrives, replace the
previously generated tab title instead of leaving the stale one
* fix: harden dispatch title preview and replace paths
Bound preamble scans, match orchestration labels to live task IDs, and
skip expensive title derivation when auto-title will not write.
* fix: accept orchestration labels when live task id is unparseable
Agent-status prompts are often truncated and omit the task-id line.
Only reject sticky labels when both ids are present and disagree.
* Fix diff viewer scroll flicker by marking programmatic scrolls explicitl
- Wall-clock "recent direct input" heuristics misclassified scroll events
during main-thread jank, causing stale anchor restores to fight active
wheel scrolling and produce visible flicker.
- Replace timing-based classification with explicit programmatic scroll
marks: every self-initiated scroll write (virtualizer corrections,
anchor restores, scrollToIndex) is marked so listeners can distinguish
it from genuine user input, including clamped landings from shrunken
scroll ranges.
- Gate anchor restore on a structural restoreSignal (row add/remove/
collapse, remount, layout flips) instead of every measurement tick, so
restores only run when something actually changed.
- Extract restore/listener logic into dedicated modules
(virtualized-scroll-anchor-listener.ts, virtualized-scroll-anchor-restore.ts,
programmatic-scroll-marks.ts) for testability.
- Leave WorktreeList on the legacy wall-clock suppression for now, with a
TODO to migrate once the new approach is validated for the sidebar.
* Fix diff viewer scroll flicker from stale marks and dropped restores
- Skip marking no-op writes since they emit no scroll event and could
claim a later user scroll within the mark-matching epsilon
- Distinguish browser clamp (viewport can't reach target) from real
user takeover using in-range origin and direct-input checks
- Sync scrollOffsetRef/anchor bookkeeping on our own programmatic
writes so divergence checks don't misread them as user scrolling
- Arm pending restore before skip guards so a restore owed during
active input retries once input settles instead of being dropped
- Guard the rAF-deferred restore against a user scroll that
disarmed it between scheduling and execution
* Fix leaked pending-restore flag when scroll anchor is unresolvable
Clearing pendingRestoreRef on both early-return paths prevents a stale
armed restore from firing on a later measurement tick with an unchanged
restoreSignal, which could re-trigger scroll writes and flicker.
* Add screenshot of current diff view scroll flicker state
- Captures the visual bug before the fix, for reference in the PR
* rm tem file
Add attribute filters (status, priority, assignee, labels) to the Linear
issues list, applied in GraphQL before pagination so hasMore matches the
filtered set. Thread filters through IPC/RPC/store cache with invalidation
on issue mutations, and mirror GitHub-style filter chrome on TaskPage.
The Source Control panel mounted every non-collapsed file row, so large
changesets (big refactors, lockfiles, branch compare with hundreds of
entries) created hundreds to thousands of DOM rows and re-rendered them
all on every 3s git-status refresh (`STA-351`, `STA-1280`).
Window each per-section list (uncommitted tree/list, committed-on-branch
tree/list) with @tanstack/react-virtual against the panel's shared
scroller, extracted into source-control-virtual-file-list.tsx. Sections
under 50 rows keep the exact pre-virtualization DOM so small changesets
see zero change; larger sections mount only viewport + overscan rows.
Fixed-height estimates with element measurement keep identical refreshes
from moving the scroll position, and stable row keys carry item identity
across status polls.
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
- Move the preview button before the single-diff tooltip in the header
- Extend canOpenPreviewToSide to allow single diffs (not commit diffs)
when the modified file still exists on disk, since the preview
renders the working-tree file rather than diff content
- Add tests covering HTML edit tabs, unstaged diffs, deleted files,
commit diffs, and non-HTML diffs
* Support WSL Codex settings promotion and harden config write-back
- Enable settings promotion for WSL runtimes using per-distro baselines.
- Create parent directories if missing to prevent promotion ENOENTs.
- Keep restrictive permissions (0600) and follow symlinks on promote.
- Respect CRLF line endings when inserting keys into CRLF config files.
- Skip redundant baseline file writes when settings are unchanged.
- Include the release scan report for the 1.4.131-rc2 prep.
* Refactor sleeping agent wake flow and fetch rate limits via backend
- Background-mount only targeted terminal tabs during passive wake to
prevent spawning unnecessary PTYs for unvisited tabs.
- Latch edge-triggered wake requests that arrive mid-hibernation and
track active claims to prevent double-resuming a provider session.
- Query the ChatGPT wham usage backend API directly with fetch for
rate limits, avoiding launching Codex or WSL login shells.
- Asynchronously probe and serialize WSL auth files with timeouts to
prevent synchronous I/O from stalling Electron's main process.
- Fix config promotion edge cases such as missing parent directories,
dangling symlinks, and atomic write permission widening.
* Support WSL dotfile-symlink write-back and lengthen redeem timeout
- Preserve symlinked Codex config on WSL by writing through the
existing file instead of atomic-rename, since \\wsl$ symlink
metadata isn't reliably detected and rename would clobber the link.
- Tighten new ~/.codex directory creation to 0700 (holds auth.json).
- Give explicit reset-credit redemption a 30s backend timeout instead
of the 10s background-poll default, since it's user-triggered.
- Read sleeping-agent session state from the worktree's actual
execution-host partition instead of always the local one, so the
headless-wake check works correctly for SSH-hosted worktrees.
- Isolate serve-sim watcher tests from the real $TMPDIR/serve-sim
state file to avoid leaking unrelated events.
- Removes the `behavior`/`sidebarRevealBehavior` plumbing throughout
activation and reveal call sites now that every reveal jumps
immediately, eliminating the need to special-case newly created
worktrees.
- Reworks worktree-sidebar-reveal.ts to center the target row within
the viewport and temporarily pad list boundaries so first/last rows
can still center instead of clamping to the edge.
- Drops the reduced-motion e2e workaround since reveals no longer
animate.
- Fail queued removals that reveal concrete git risk (dirty files or
unpushed commits) discovered after an unverifiable force approval.
- Clear a failed row's queued-for-deletion sidebar overlay as soon as the
row fails instead of when the whole batch settles (new onRowFailed).
- Skip the auto-scan on dialog reopen while a removal batch is running;
the removal's scan invalidation would discard it immediately.
Co-authored-by: Orca <help@stably.ai>
* Prevent continuous git status scanning in large repositories
On repos where `git status --untracked-files=all` takes tens of seconds,
the background status poll restarted a fresh scan 3s after the previous
one finished, keeping a git process at high CPU almost continuously
while the workspace sat idle (#7983).
The coalesced poll runner now paces reruns by the previous run's
duration, split by trigger class:
- Evidence-free timer ticks wait 5x the last refresh duration (capped
at 5 minutes), bounding idle polling to ~1/6 duty cycle.
- Change signals (file-watch events, repo metadata pushes, finished
terminal commands, window reveal after hidden) wait only 1x, so real
changes in a slow repo still surface promptly; a change signal can
pull an already-scheduled tick run earlier, and the strongest pending
trigger wins for trailing reruns.
- Backoff-deferred scans are skipped while the window is hidden; the
becoming-visible run catches up on the short lane.
Fast repos keep the exact 3s cadence (the multiplier never drops the
gap below the existing floor), and user-triggered refreshes are
unaffected (they bypass the poll runner). The stale-conflict poll gets
the same pacing, which also spaces slow remote SSH probe chains.
Fixes#7983
* Skip hidden-window stale-conflict probes like the status poll
---------
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
PR #5071 (36277801e) accidentally dropped the LinearAgentSkillSetupPrompt
modal from WorktreeCard, orphaning the component. Restore the exact
wiring: render on the active worktree when it has a linked Linear issue.
Also surface the decoupled orca-linear agent skill on the Linear task
provider settings card: install state via useInstalledAgentSkillNames,
copyable install/update command resolved for the agent runtime, and a
remote-setup note when a runtime environment is active. The legacy-aware
update-command selection moves into a shared lib module so the sidebar
prompt and the new CTA stay in sync.
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
* fix: propagate hook-only agent status to Remote Orca Server clients
On a headless Remote Orca Server, agent-status hooks (OSC 9999) updated the
retained row map but never republished PTY-backed session snapshots — only
terminal *title* changes did. Paired desktop/web/mobile clients therefore
kept a stale agent state (e.g. opencode working/idle) until relaunch, and
even title-driven updates carried an empty prompt and no agent identity
because the snapshot builder only used the title heuristic (#7970).
- retainAgentRowSnapshot reports client-visible changes (state, prompt,
agent type, tool, interactive prompt, interrupted) so handlePtyData can
republish snapshots on hook-only transitions without fanning out a
rebuild per repeated same-state hook ping.
- buildPtyMobileAgentStatus prefers the fresh retained hook payload over
the title-only fallback, so clients see the real state/prompt/agentType
and interactive prompts. The non-agent-title suppression (#1437 stuck
spinners) still wins unless the hook shows a live tool/question signal,
and it now also covers leaf-backed panes with no PTY record.
Co-authored-by: Orca <help@stably.ai>
* fix: refetch remote projects when the client-events stream replays
worktreesChanged/reposChanged emitted during a transport gap are lost, not
queued. A quick drop can replay without flipping the environment
unreachable, so the reachability-transition refetch never runs and a
server-created worktree stays invisible until relaunch (#7970). Request a
debounced project refresh on the replay tag, mirroring the SSH-state
refetch that already rides it.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* Improve workspace cleanup list
Co-authored-by: Orca <help@stably.ai>
* Address workspace cleanup review feedback
Co-authored-by: Orca <help@stably.ai>
* Fix workspace cleanup perf findings
Co-authored-by: Orca <help@stably.ai>
* Avoid stale cleanup progress cache
Co-authored-by: Orca <help@stably.ai>
* Complete workspace cleanup perf fixes
Co-authored-by: Orca <help@stably.ai>
* Fix worktree list option forwarding
Co-authored-by: Orca <help@stably.ai>
* Address workspace cleanup review nits
Co-authored-by: Orca <help@stably.ai>
* Fix workspace cleanup removal review findings
- Fail a queued removal that now needs a force the user never approved
(confirm-time approvedCandidates snapshot compared in preflight)
- Reword the 120s removal timeout to say removal continues in background
- Wire suppressPreservedBranchToast into cleanup removals
- Stop statting a repo after the first activity metadata timeout
- Document the WSL 9P best-effort stat gap; drop unused locale key
Co-authored-by: Orca <help@stably.ai>
* Split workspace-cleanup slice test to satisfy max-lines
Rebasing onto latest main pushed the combined store-slice test over the
800-line cap. Extract shared fixtures into a test harness and split the
suite into scan-progress and removal-preflight files instead of adding a
forbidden max-lines suppression.
---------
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Brennan Benson <brennanbenson@Brennans-MacBook-Pro.local>
* Harden layout validation, watcher lifecycle, and connection robustness
- Throw instead of silently skipping when the packaged daemon-entry is
missing, preventing layout regressions from passing build checks.
- Terminate idle parcel-watcher processes to reclaim native handles and
avoid crash-prone native node module teardowns on shutdown.
- Bind the persisted WS fallback port first to prevent orphaning active
mobile pairings when the preferred port becomes free again.
- Cap concurrent disk reads for restored dirty tab verification at three
to prevent startup connection bottlenecks on remote SSH workspaces.
* Queue file IDs instead of snapshots in restored conflict scans
This avoids using stale file snapshots (e.g., outdated disk signatures)
if a tab is saved, closed, or re-baselined while waiting in the queue
behind the concurrency limit. The live state is now fetched from the
store and validated immediately before initiating the disk read.
Neil
Brennan BensonandBrennan Benson
Jinjing
BingZandJinwoo Hong
mehmet turacandOrca
Doan Bac TamandBrennan Benson
BingZ
OrcaWin