* fix(relay): faster stall detection and a 60s retry cap when only the cell failed
Start the existing 3 x 8 s ping probe once a keepalive reply is 10 s overdue,
cutting silent-stall detection without shortening the keepalive interval or
tearing down on a single lost frame.
When the director answered and only the cell connect failed, cap the drain
retry at 60 s instead of 300 s. Director failures keep the full schedule.
* fix(relay): use the 60s cap only for a newly named failing cell
Every drain retry re-asks the director, so capping retries at 60 s for a cell
that keeps failing would raise director load for every host on that cell. The
short cap now applies only when the director names a cell that has not just
failed; the same cell failing again falls back to the full 300 s schedule.
* refactor(relay): keep retry-cap state next to assignment state
* fix(relay): give each failing cell the short retry cap once per episode
A director alternating between failing cells (A, B, A, B) kept the 60 s cap
forever because only the previous cell was compared. Track every cell that
failed since the last success; a repeat of any of them uses the full backoff.
* fix(relay): re-ask the director when data attaches fail and on broker self-close
Edge keepalives are answered without the host being seated, so a live control
does not prove phones can reach the desktop. Two consecutive data-attach
failures within 2 minutes now drain the origin through the existing
resolve-director path (at most once per 60 s per origin).
The coordinator now rebuilds a broker that closed itself after token refresh
gave up immediately instead of at the next 5-minute tick, and the tick no
longer tears down a pool that is already retrying against the director.
* fix(relay): count only failed host data dials, per-pool pacing, bounded recovery trust
Review follow-up for the data-path and coordinator fixes:
- Only a host data dial that fails before opening counts. After open, 4401
(phone left), 4408 (phone dropped) and the attach deadline (quiet phone)
are phone behaviour, not path evidence.
- Require failures on two distinct connections; a replayed pending attach
counts once.
- Pace data-path recovery once per minute per pool (not per origin) and
drain with a 60 s grace so live phones on the old cell are not cut off.
- isRecovering() trusts a failing pool retry for at most 5 minutes and never
after a non-retryable director refusal, so ensureLive rebuilds again.
* fix(relay): count a data dial that opens after half the attach window as failed
The relay's attach window starts when it sends conn-open and ours when we
receive it. On a lossy path a dial that opens at ~7 s leaves host-data-auth
missing the relay's window (phone gets 4404 attach-timeout, relay closes
4401), yet it counted as healthy and cleared the failure set. Opens slower
than RELAY_HOST_ATTACH_DEADLINE_MS / 2 now count as failures and never clear
it; fast opens still do.
* fix(relay): count a slow data dial only if its attach then fails
A slow open whose first relay frame still arrives (a slow-but-working path,
an event-loop stall, wake from sleep) no longer counts as a failure, and it
clears pending failures. The transport now reports each attach once, when it
ends: open latency plus whether the first frame arrived. A slow open counts
only if the socket closes or times out before that frame, the relay's 4401
first-frame timeout being the real failure.
Desktop: drop IPv4 169.254.0.0/16 (and, as before, IPv6 fe80::/10)
addresses from the pairing interface list, so an APIPA or idle adapter is
never the QR's direct endpoint. When nothing else is usable the offer
already omits the direct address (Relay carries the invite; LAN-only
refuses). Among non-Tailscale candidates, an adapter known to hold the
default route now wins ties.
Mobile: a relay-paired host whose stored endpoint is link-local seeds its
logical client with a never-dialing 'reconnecting' stand-in and disables
the direct return probe, so already-paired phones go straight to Relay
instead of redialing the dead address. Relay-less hosts still dial.
#41870 added hover/focus/press outlines to every Button, Toggle and
SelectTrigger, which read as noise on dense toolbar icon buttons.
Restore the previous focus-visible ring for those primitives and keep the
outline treatment only for buttons inside DialogFooter.
* fix(computer-use): refuse macOS background actions that open a menu or dialog over the user
* fix(computer-use): let web comboboxes click in the background and stop probing a hung app
* fix(computer-use): refuse background drags that start on a menu owner
* docs(computer-use): note background drags on menu owners are refused
* fix(computer-use): classify the element under a drag's start and check AXConfirm/AXOpen secondary actions
* fix(computer-use): refuse Windows pointer fallbacks without --restore-window
Coordinate, right, middle, modified and multi-clicks, clicks on elements with no
primary pattern, unscrollable wheel scrolls and drags raised the window and
moved the real cursor without being asked. They now refuse with
background_unavailable before anything is sent. Coordinate and fractional
scrolls go through ScrollPattern first. With --restore-window only the target
window is raised (never a cloaked one), with a UIA activation fallback and a
second attempt, points are validated first and the cursor is put back behind
the input. A failing UIA pattern or disabled element is an error instead of a
real click, and delivery is measured after the post-action observe.
* fix(computer-use): settle Windows clicks before restoring the cursor and keep scroll writes honest
* fix(computer-use): restore the Windows cursor with SetCursorPos and hit-test coordinate scrolls
* test(computer-use): assert Windows raise outcomes, not attempt order
* fix(computer-use): report a Windows page scroll the provider ignores as not scrolled
* feat(settings): add Workspace Cleanup settings page
Adds a Settings > Workspace Cleanup page for the host that owns the repos:
status with Clean up now, the rule switches, the ignored-files protection
and an Activity list of past runs. Turning on a delete rule that matches
workspaces right now asks first; Keep pins a workspace.
The page refreshes when the host's runner finishes a run: desktop main now
forwards workspaceCleanupRunFinished to its window, and remote hosts' event
is no longer dropped by the client event allowlist.
* feat(settings): confirm any cleanup rule change that would delete workspaces now
Lowering the inactive days or turning off the ignored-files protection makes
the runner delete within seconds too, so those changes get the same confirm
as turning a rule on.
* fix(settings): serialize cleanup rule changes and guard the confirm
One rule change at a time, built from the host's rules as they are when it
is saved; Esc or the close button can no longer abandon a confirm that is
already saving. Local save failures surface, a host whose rules cannot be
read says so with a retry, and the page follows project rules that keep
the runner on.
* fix(settings): keep cleanup changes bound to fresh rules and this page
A change re-reads the host's rules when it is confirmed, a change still
previewing when the page closes is dropped, Keep locks while saving, and
each preview is kept with the rules it evaluated. The page is hidden in a
paired browser, whose settings are not the host's.
* refactor(settings): reuse existing helpers in the Workspace Cleanup page
One row key helper, useMountedRef, SettingsSwitchRow and the shared
runtime target builder; only the preview of rules about to be saved is
kept as the page's matches, and the report waits for the rules.
* chore(i18n): protect the cleanup confirm's copy
* fix(settings): re-check the cleanup confirm when the rules moved meanwhile
If another client changed the rules while the confirm was open, preview
again and list any workspace the dialog had not shown before saving.
* fix(settings): preview again on every cleanup confirm
A workspace can age past a rule while the confirm is open, so the confirm
always checks again and lists anything new before saving.
* fix(settings): drop a confirmed cleanup change if the page closed while pinning
* feat(workspace-cleanup): keep PR number and ignored file names on cleanup rows
Run and preview rows now carry the merged PR number and up to 3 ignored
file names the evidence already read, so the page can say 'Merged · #4182'
and 'Ignored files · .env'. No new Git reads; older saved runs lack them.
* fix(settings): say when a run's saved receipt lists fewer kept workspaces
* fix(workspace-cleanup): import at-risk local files from its new home
* perf(workspace-cleanup): share in-flight previews and stop re-scanning confirmed rules
The host shares one evaluation between previews of the same rules, so
reopened pages and several clients no longer stack full scans. The page
keeps a would-be rules preview out of its matches until those rules are
saved, then adopts it, and reuses its own preview for the current rules.
* fix(hooks): approve setup from the ref a new workspace checks out
The setup trust check before a create read orca.yaml from the project's
own checkout, while the host (since #37977) checks the created worktree.
A checkout behind origin/main made every create skip setup and open the
"branch has different setup commands" dialog right after creation.
The check now reads orca.yaml at the ref the create checks out (the
resolved base, or the local branch for explicit reuse), refreshing it
only when create would, under one deadline. Any failure falls back to
the previous checkout read, and older hosts ignore the new parameter.
* fix(hooks): stop optional setup reads at the deadline and cover automation recovery, VM and web paths
* fix(hooks): refuse late WSL git retries and approve an automation's saved base on recovery
* docs(hooks): move the skipped-setup recovery comment back to its function
* fix(automations): re-approve setup when an automation's base branch changes
* fix(crash-reporting): read renderer allocation profiles only on heap growth
Each sampling-profile read makes V8 run a full renderer GC first, and the
old 30 s refresh paid that pause for as long as a window's heap stayed high.
Main's 30 s tick now asks only for heap usage (no GC); a profile is read once
after one interval and then only after 5% of the limit of further growth.
Stopping detaches instead of calling stopSampling, which also forced a GC.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(crash-reporting): take the baseline profile on main's first heap check
Tie the no-growth baseline read to main's first heap check instead of a
wall-clock deadline, so a clock correction can't postpone it, and ignore
non-finite heap readings.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The per-server check from #41834 used `state IN ('open', 'cancel_owed')`, which makes SQLite
build a small temporary set on every call, and asked about home conversations in a separate
statement. A server with one live link and no home conversation paid more per pull than the
old global scan did.
It is now one statement: a home-conversation seek, then one equality seek per live link state
on the same covering index, stopping at the first row. Closed-link history still never enters
the check. The answer, the read-error fallback and global discovery are unchanged.
* fix(orchestration): name the reused terminal's agent on unbound reuse starts
* fix(orchestration): record the reused agent where start options are built
The project catalog keys a repo by its first network remote (upstream,
origin, then the rest), but GitHub issue and PR lookups only read the
remotes named origin and upstream. A repo whose origin is a local bare
repo and whose GitHub remote has another name showed as GitHub-backed
yet Tasks said no GitHub source was detected. Origin's role now falls to
the same remote the project identity picks.
Fixes#42102
* fix(worktree-delete): cancel local at-risk ignored-file scans when the preview closes (STA-15114)
The delete preview aborts its controller on close/retarget, but the local
branch of getRuntimeWorktreeAtRiskLocalFiles dropped the signal and the
git:atRiskLocalFiles IPC had no cancel channel, so main kept running
queued/active git ls-files and file comparisons for obsolete previews.
Mirror git:status cancellation: a per-request token plus
git:cancelAtRiskLocalFiles aborts the sender-scoped controller whose signal
now reaches readWorktreeAtRiskLocalFiles (admission, git child, compares).
The web shim registers its controller before the worktree lookup and keeps
the typed RuntimeRpcCallError unwrap for old-host fallback.
* fix(worktree-delete): bound abortable web scan responses
* feat(native-chat): open each subagent in its own view inside the chat pane
Clicking a roster entry, an agent in the agents strip or a subagent row in
the sidebar now opens that subagent's own rows in the chat pane, with a bar
to switch between agents and a status bar with its state, Stop and the way
back in place of the composer. Subagent rows are no longer inlined in the
main transcript, which stays mounted underneath so going back keeps the
reader's place. The inline-section machinery is removed.
* fix(native-chat): close a subagent's hover preview when its view opens, and name the strip's open action
An open preview stayed over the subagent's view after its roster row was
hidden, and took the view's first Esc. The agents strip's label now says
it opens the agent rather than showing it in the conversation.
* feat(native-chat): show what the main agent asked a subagent and its reply in the subagent's view
A subagent's view now opens with the prompt the main agent gave it, folded
past a few lines, and ends with its final reply once it settles. Claude's
prompt and reply come from the Agent call its run names; Codex's prompt
comes from the spawn call naming the child, and its reply is already its
last own message.
* chore: drop the deleted delegation file from the node tsconfig and record the removed compiler bailout
* fix(native-chat): subagent view UX round: focus, endings, nested path, status glyphs
Going back hands focus to the entry or strip row that opened the view, else
the composer. Only a completed subagent ends with a reply; a failed one shows
its error and a stopped one says it stopped. Nested subagents get their spawn
path as a breadcrumb, and Back and Esc go to the parent. Every surface uses
the agents strip's status glyph, states lead capitalised and tokens carry
their unit, entries show that they open, the switcher marks the current
agent and numbers unnamed ones, and the status bar fits narrow panes.
* fix(native-chat): switch subagents from the switcher by pointer, and open no preview on handed-back focus
The switcher's modal-less menu closed on pointerdown before the item could
take the click; it is modal now. Focus handed back to a roster entry after a
pointer Back no longer pops its hover preview; keyboard focus and hover still do.
* fix(native-chat): fit the subagent view to main's tool-run provider, install slot and exhaustive state switch
* fix(native-chat): keep a subagent's full reply when its last message is only the start of it
* fix(native-chat): translate the subagent back label with useTranslate so it follows the language
* fix(shortcuts): forward Plugins shortcut from browser pages
* fix(shortcuts): preserve text-producing guest chords
* fix(shortcuts): preserve AltGr input in browser guests
* fix(browser): return keyboard to the page after Settings closes
Closing Settings remounts the active browser page. Its activation focus
retry waits a frame for the retained guest to reattach, and a StrictMode
effect re-run cancelled that wait while the activation latch stayed set,
so the page never got focus back (host activeElement stayed BODY). A
re-run that cancels the retry before any focus attempt now clears the
latch so the next run retries.
Also make the Plugins shortcut copy match browser-page behavior and add
guest-dispatch coverage for Linux Ctrl+Alt, macOS Option symbol vs dead
keys, and a German Y/Z layout.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(browser): keep the user's focus when a drag restarts page activation
The Settings-close fix re-arms a page activation whose focus retry was
cancelled before it acted. A drag starting or ending also re-runs that
effect, and the re-armed retry took the current focus as its starting
point. A user who picked the address bar while the guest was still
attaching therefore had it treated as the page's starting focus, and the
guest took the keyboard once it attached. The activation now keeps the
focus it began from across restarts until the page deactivates, so a
user focus change made before or during the drag still wins.
Move the focus-address-bar chord listener into its own hook, matching the
history shortcut, to keep the focus hook within the file-size limit.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(browser): take the activation's focus snapshot before the drag guard
A page that activated while a drag was already active skipped the focus
snapshot and took it when the drag ended. If the user picked the address bar
during the drag, that pick became the starting point and the guest took the
keyboard once it attached. Take the snapshot when the page activates, before
deferring for the drag.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(plugins): let the Plugins shortcut hint wrap in narrow windows
In a window about 700px wide the "Open with ..." hint stayed on one line and
cut off the key combo. The label now wraps like the rest of the description,
and only the key combo stays on one line, moving to the next line whole
when it does not fit.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat(native-chat): show each subagent's model, current tool and result in the roster
Subagent roster rows now carry the child's role, model, reasoning effort,
the tool it is running and the last thing it said, so a row says what the
subagent is doing and, once done, what it found. Codex children take model
and effort from the spawn call; Claude children take the model from their
own messages. A hover card shows the longer text.
* feat(native-chat): name subagent models and roles the way people say them
Show Opus 5.5 · High instead of claude-opus-5-5 · high, reusing the
model-id label and effort picker copy, and General purpose instead of
general-purpose.
* fix(native-chat): read Codex subagent model and effort from its started activity
Current Codex announces a spawn only through subAgentActivity, which carries
the model and reasoning effort the child resolved to.
* fix(native-chat): use the hover card's own spacing variant for the subagent preview
* fix(native-chat): show a subagent's reply as plain text in its roster row and preview
Its last message is markdown; the row now drops backticks, emphasis, list
and heading marks and joins lines into one readable line.
Kelvin Amoaba
Neil
OrcaWinandOrcaWin
Brennan Benson
Jinwoo Hong
Jinjing