* refactor(ai-vault): group scanner modules by defining owner
* refactor(ai-vault): consolidate owner imports and isolate path absence
* Preserve mobile CI triggers for extracted absence predicate
The site now lives at orca.dev; the old onorca.dev and www.onorca.dev hosts
redirect there. Linking to orca.dev directly skips that redirect.
Only page links change. Service hosts, sign-in and relay endpoints stay as they are.
* chore(endpoints): call orca.dev for feedback, plugin lists and update notes
The site moved to orca.dev. Feedback, connection diagnostics, plugin install
stats, the plugin kill list, update nudges and the changelog feed now use
orca.dev, as do the diagnostics token URL baked into builds and the release
download mirror (downloads.orca.dev). The old hosts serve the same paths,
so released builds keep working.
Skill share links on share.orca.dev are accepted, and the mobile scanner
recognizes the orca.dev Android download code. The old hosts stay accepted.
* chore(ci): leave the release JavaScript benchmark workflow unchanged
Editing it triggers the benchmark, whose parity check currently fails on
arm64 because max-quality brotli output for the mobile page differs by
architecture. The benchmark only needs some diagnostics URL, and the old
host still serves it.
* fix(runtime): hold tui-idle until a cold-starting Claude has painted (STA-2380)
A shell auto-title (oh-my-zsh preexec) names the pane `claude` the moment
the command execs. Claude's `idle_title` rule counts that bare name as weak
idle once output has been quiet for 3s, so a Claude that took >3s to draw
its first frame settled `terminal wait --for tui-idle` on a blank screen.
`dispatch --inject` then pasted into a TUI that had not mounted yet and the
prompt was lost.
Name-only idle lanes (agent rule verdicts that require quiet, and the
sustained-title lane) now also require that the running command has painted
something since the shell's OSC 133;C command-start marker. Shells without
the marker keep today's behavior.
* fix(runtime): corroborate Claude's name-only idle with its own composer marker (STA-2380, C1 F1)
Orca's zsh OSC 133;C hook is first in preexec_functions, so a later user or
framework preexec hook (zsh-you-should-use, a custom echo) prints after the
command-start marker and before Claude runs. The any-visible-byte paint latch
counted that text as Claude's paint, so a silent cold start under such a hook
still settled tui-idle ready-weak on the shell's bare `claude` title.
For agents whose worker start already trusts their composer marker (Claude),
"painted" now means that marker (`❯`+NBSP after DECSET 2031, which no shell
sends) arrived since the command started. Other agents keep any-byte paint;
markerless shells and output gaps keep the permissive default.
Evidence: a real-zsh live-shell test under the production wrapper with
oh-my-zsh title-only, p10k/starship-style silent, and you-should-use-style
printing hooks, replayed through the real wait; runtime tests for the hook
text, a boot banner, the positive bare-title + composer path, and worker-start
readiness plus brief delivery timing.
* fix(ci): route command-paint attribution sources to shell_contracts; attribute live-shell bytes by stream offset (STA-2380, C2 F1/F2)
- pr-shell-contract-prefixes: the live-shell test, terminal-command-paint.ts,
tui-idle-evidence-source.ts and draft-paste-ready-scanner.ts route to the
shell_contracts job; a routing test reads the job's step from pr.yml and
asserts every listed test routes there.
- tui-idle-zsh-preexec-hook-order.live-shell.test: locate the DECSET 2031
anchor by offset in the accumulated stream, split a straddling read, carry
pending escapes across the shell/agent halves, and assert attribution is
invariant under coalescing and 3-byte re-chunking.
- terminal-command-paint: disclose the accepted trade-off (a known Claude with
marker history but no supported composer signal times out; markerless shells
and output gaps still fail open; no version cutoff claimed).
* test(ci): stream-offset launch-order proof, route tui-idle-evidence.ts, parse the whole shell-contracts step (STA-2380, C3-1/2/3)
- live-shell test: assert the launch order on the joined bytes by stream
offset (133;C, then the user hook's output, then the agent's anchor and
composer); no read-boundary or timestamp assertions remain. Re-chunk
cases add a split anchor and a shell-tail/agent-start coalesced read.
- pr-shell-contract-prefixes: route tui-idle-evidence.ts, the readiness
evaluator the live-shell replay exercises.
- routing ratchet: read the step's run script through the YAML parser so
a blank line or later command cannot truncate it; cross-check against
the real-shell tests UNIT_EXCLUDE drops so a dropped entry fails rather
than a smaller count; fixture tests for blank line, exact list, missing
step.
* test(ci): answer compinit's insecure-directory prompt in the zsh preexec live-shell test (STA-2380)
Ubuntu's global zshrc runs a plain compinit, which on CI runners stops at
"Ignore insecure directories and continue [y] or abort compinit [n]?"
before zle exists, so the stand-in never launched and the shell-contracts
job failed with "no composer frame from the stand-in". Answer the prompt
with y as zsh-startup-hook-pty-harness.ts does. The prompt bytes precede
Orca's OSC 133;C marker, so stream-offset attribution is unchanged.
* test: remove 60 low-value cases and orphaned conversion fixtures
* docs(ci): list supported Windows SSH host cells
* test: recognize direct Windows orcad server entry
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* feat(release): publish a server-only Linux tarball for orca serve
Each release now also uploads orca-server-linux-x64.tar.gz and
orca-server-linux-arm64.tar.gz (orcad slot from the qualified template, the
pinned Node, and an orca-ide launcher) plus orca-server-sha256sums.txt, so a
Linux host can run orca serve without the desktop package.
The tarballs are packed and smoke-tested (serve --recipe-json, then pair a
second profile) on both architectures, including bare ubuntu:24.04 and
debian:12-slim containers. Upload runs only after the release is published
and nothing depends on it, so it cannot hold the desktop release.
* fix(release): keep the server tarball's launcher env out of its terminals; skip refs that predate it
- The launcher runs the CLI with ELECTRON_RUN_AS_NODE=1, as the packaged app does, and the CLI strips it
before starting orcad; ORCA_APP_EXECUTABLE and ORCA_SERVE_RUNTIME are cleared.
- Ship Node's LICENSE beside the runtime.
- Skip packing on release refs that predate the scripts, and upload only when both tarballs passed.
- Run the PR smoke when the CLI's serve-runtime selection changes; document service install.
onorca.dev offers an opt-in 'mirror link' (https://downloads.onorca.dev)
next to the GitHub download for when GitHub release downloads 5xx.
Upload the onorca.dev download assets there right after each stable
desktop release and each Android release, instead of polling.
- config/scripts/release/publication/mirror-release-to-r2.sh: retrying,
resumable download from GitHub, size + sha256 check, S3 multipart
upload to R2 (no 300 MiB wrangler cap)
- release-mirror-r2.yml: reusable + manual backfill
- release-cut: run after publish-release for stable vX.Y.Z tags only
- mobile-android-release: run before bump-apk-download so the site's
mirror link never points at a missing APK (success not required)
* refactor: organize browser guest lifecycle owners
* test: resolve cross-version client owners and pre-ticket baseline
* test: record the released terminal registry path
* test(perf): render and identity contracts for agent status, sidebar, tab strip and chat
Twelve operation, render and identity contracts at the production seams of
the hottest UI paths, each driven at N and 10N with one hardcoded bound and
shown to fail with its regression restored. Registers them in the contract
list and fixes the perf workflow's path filter, which had drifted to 12 of
19 contracts. Removes test-only production exports nothing reads.
* test(perf): prove composer typing lands; drop dead rebuild counter
Review: the composer contract never checked the draft reached the composer,
and its transcript control could not fail; the live-index rebuild counter
and a bucket constant had no readers after the test exports went.
Neil
Jinjing
OrcaWinandOrcaWin
Brennan Benson