* fix(agent-hooks): keep the Claude session model on later hook status
SessionStart reports the model, but the Claude handler dropped it, so the
mobile composer chip stayed on "Model". Publish that model and retain it
when later lead and child events omit it.
* fix(agent-hooks): keep the Claude model across an Orca restart
Claude reports its model only on SessionStart. After a restart the listener's
lead state is empty, so the next hook dropped the saved model from the row.
* test: run the Claude model restart test in the node pool
* fix(agent-hooks): keep the Claude model when a terminal status row lands first
* refactor(agent-hooks): read the Claude lead model once to keep claude-events under the line limit
---------
Co-authored-by: Kelvin Amoaba <97001695+AmoabaKelvin@users.noreply.github.com>
* perf(orchestration): read released worker output from its original instead of a saved copy
* fix(orchestration): keep refusal codes on released chat reads and locate legacy remote transcripts
* test(orchestration): prune flaky-pattern baseline for removed archive tests; guard a cursor read
* fix(orchestration): keep locator fields when stripping copies; never let the optional receipt page block remote release
* test(orchestration): drop removed archive tests from the node-runtime test list
* refactor(orchestration): drop the background strip; old rows keep their saved copy and its reader
* fix(orchestration): give reference rows the empty copy fields older Orca reads, with a note
* test(orchestration): give the slow-exit release mock a stored archive body
* fix(orchestration): record a transcript reference only for agents the reader can open
* chore(endpoints): call orca.dev for feedback, plugin lists and update notes
The site moved to orca.dev. Feedback, connection diagnostics, plugin install
stats, the plugin kill list, update nudges and the changelog feed now use
orca.dev, as do the diagnostics token URL baked into builds and the release
download mirror (downloads.orca.dev). The old hosts serve the same paths,
so released builds keep working.
Skill share links on share.orca.dev are accepted, and the mobile scanner
recognizes the orca.dev Android download code. The old hosts stay accepted.
* chore(ci): leave the release JavaScript benchmark workflow unchanged
Editing it triggers the benchmark, whose parity check currently fails on
arm64 because max-quality brotli output for the mobile page differs by
architecture. The benchmark only needs some diagnostics URL, and the old
host still serves it.
* fix(runtime): hold tui-idle until a cold-starting Claude has painted (STA-2380)
A shell auto-title (oh-my-zsh preexec) names the pane `claude` the moment
the command execs. Claude's `idle_title` rule counts that bare name as weak
idle once output has been quiet for 3s, so a Claude that took >3s to draw
its first frame settled `terminal wait --for tui-idle` on a blank screen.
`dispatch --inject` then pasted into a TUI that had not mounted yet and the
prompt was lost.
Name-only idle lanes (agent rule verdicts that require quiet, and the
sustained-title lane) now also require that the running command has painted
something since the shell's OSC 133;C command-start marker. Shells without
the marker keep today's behavior.
* fix(runtime): corroborate Claude's name-only idle with its own composer marker (STA-2380, C1 F1)
Orca's zsh OSC 133;C hook is first in preexec_functions, so a later user or
framework preexec hook (zsh-you-should-use, a custom echo) prints after the
command-start marker and before Claude runs. The any-visible-byte paint latch
counted that text as Claude's paint, so a silent cold start under such a hook
still settled tui-idle ready-weak on the shell's bare `claude` title.
For agents whose worker start already trusts their composer marker (Claude),
"painted" now means that marker (`❯`+NBSP after DECSET 2031, which no shell
sends) arrived since the command started. Other agents keep any-byte paint;
markerless shells and output gaps keep the permissive default.
Evidence: a real-zsh live-shell test under the production wrapper with
oh-my-zsh title-only, p10k/starship-style silent, and you-should-use-style
printing hooks, replayed through the real wait; runtime tests for the hook
text, a boot banner, the positive bare-title + composer path, and worker-start
readiness plus brief delivery timing.
* fix(ci): route command-paint attribution sources to shell_contracts; attribute live-shell bytes by stream offset (STA-2380, C2 F1/F2)
- pr-shell-contract-prefixes: the live-shell test, terminal-command-paint.ts,
tui-idle-evidence-source.ts and draft-paste-ready-scanner.ts route to the
shell_contracts job; a routing test reads the job's step from pr.yml and
asserts every listed test routes there.
- tui-idle-zsh-preexec-hook-order.live-shell.test: locate the DECSET 2031
anchor by offset in the accumulated stream, split a straddling read, carry
pending escapes across the shell/agent halves, and assert attribution is
invariant under coalescing and 3-byte re-chunking.
- terminal-command-paint: disclose the accepted trade-off (a known Claude with
marker history but no supported composer signal times out; markerless shells
and output gaps still fail open; no version cutoff claimed).
* test(ci): stream-offset launch-order proof, route tui-idle-evidence.ts, parse the whole shell-contracts step (STA-2380, C3-1/2/3)
- live-shell test: assert the launch order on the joined bytes by stream
offset (133;C, then the user hook's output, then the agent's anchor and
composer); no read-boundary or timestamp assertions remain. Re-chunk
cases add a split anchor and a shell-tail/agent-start coalesced read.
- pr-shell-contract-prefixes: route tui-idle-evidence.ts, the readiness
evaluator the live-shell replay exercises.
- routing ratchet: read the step's run script through the YAML parser so
a blank line or later command cannot truncate it; cross-check against
the real-shell tests UNIT_EXCLUDE drops so a dropped entry fails rather
than a smaller count; fixture tests for blank line, exact list, missing
step.
* test(ci): answer compinit's insecure-directory prompt in the zsh preexec live-shell test (STA-2380)
Ubuntu's global zshrc runs a plain compinit, which on CI runners stops at
"Ignore insecure directories and continue [y] or abort compinit [n]?"
before zle exists, so the stand-in never launched and the shell-contracts
job failed with "no composer frame from the stand-in". Answer the prompt
with y as zsh-startup-hook-pty-harness.ts does. The prompt bytes precede
Orca's OSC 133;C marker, so stream-offset attribution is unchanged.
* Preserve bounded diagnostics for main-thread stalls and observer gaps
* Use a typed file-read fault injection in watchdog coverage
* Record reviewed incident-only watchdog file operations
* Clarify watchdog snapshot types and validated parser conversions
* Place validated object assertion rationale at its conversion
* Capture executing stacks after main and renderer hangs
* Preserve hang capture progress through late cleanup and reporting
* Publish renderer hang baseline before collecting stacks
* Service capture cleanup in packaged watchdog smoke
* Release native capture after dependency load failure
* test: remove internal query-plan assertions
* test: remove startup sweep plan-only suite and mailbox plan observer
* test: remove terminal link grant metadata suite
* test: trim hosted review eligibility projections and probe inventories
* test: keep peer reply selection without query plan assertions
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* Move local usage services into a supervised backend process
* Own usage recovery and worker retirement lifetimes
* Preserve answered usage data during background refresh
* Run independent usage scans concurrently in the backend
* Limit backend startup paths to the delegated usage service
* Show usage failures through backend recovery
* Include usage failure strings in the English catalog
* Keep usage update details beside refresh failures
* Resolve usage freshness failure from the final producer snapshot
* Retain the forced refresh completion requirement
* Keep managed backend failures out of application crash reports
* Preserve usage recovery boundaries across backend reconnects
* Match the backend RPC cancellation signal in the usage seam proof
* Avoid serializing backend requests before port delivery
* Keep receiving request validation in the boundary schemas
* test: align usage transport coverage with renderer project
* fix: preserve unknown usage state and renderer retirement
* fix(usage): revalidate tracking before scan admission
* fix(usage): retry failed backend startup on demand
* test(usage): isolate stale backend ownership checks
* fix(emulator): let iPhone Duo fold in release builds
Release signing gave serve-sim's in-simulator helpers the hardened runtime,
which drops the DYLD_ROOT_PATH that simctl spawn hands them, so the Duo HID
and accessibility helpers aborted at launch. Sign just those two with only
allow-dyld-environment-variables.
serve-sim's uncaught errors print its minified source, which contains the
"No serve-sim server running" text, so every crash was reported as no active
emulator. Report the thrown error line instead.
Fixes#40509
* fix(emulator): keep multi-line serve-sim error messages
* refactor(emulator): simplify serve-sim failure message parsing
* build(mobile): upgrade to Expo SDK 58 and React Native 0.88
Expo 58 drops Zod from @expo/cli, which clears the last Zod 3 advisory
(GHSA-mrhx-c7xc-m3w5) in mobile along with its local patch and override.
- Expo 55 -> 58, React Native 0.83 -> 0.88, React 19.3, gesture-handler 3,
webview 14, reanimated 4.7, worklets 0.13 (SDK 58 bundled versions,
pinned below today's batch to respect minimumReleaseAge).
- Port the react-native and react-native-webview patches unchanged; drop
expo-constants, expo-notifications, @expo/cli, expo-router, zod and
query-string patches plus the zod/query-string/xcode>uuid overrides,
which upstream fixed or no longer need.
- iOS minimum rises to 16.4 (Expo 58 / RN 0.88 requirement).
- Migrate to RN 0.88 strict types: instance ref types, NamedStyles,
AppState.currentState, list header/footer nulls.
- Replace removed runtime APIs: InteractionManager -> idle callback with a
macrotask fallback; StyleSheet.absoluteFillObject -> absoluteFill;
FileHandle.readBytes -> readBytesSync (it became async).
- Resolve react-native/asset-registry for shared assets in Metro and alias
the old registry path for react-native-svg in the desktop mobile-web bundle.
- Reduce the iOS scene plugin to the reconnect override; Expo 58's template
now ships the scene delegate itself.
* fix(mobile): bridge react-native-svg web imports and libsodium runtime for RN 0.88
- Share react-native-svg web shims between the mobile-web build and its render
checks: map the old asset-registry path to react-native-web's registry and stub
the Android-only touch-sound TurboModule.
- Patch react-native-libsodium 1.7.0 to read the JSI runtime from the bridge proxy;
RN 0.88 removed RCTCxxBridge.runtime.
* fix(mobile): use Expo 58's legacy promise resolver for audio permissions
* fix(mobile): skip null handles in the RPC recording timer shims for RN 0.88 types
* style(mobile): format MobilePRSidebar after rebase
* fix(mobile): name RN 0.88 text input refs for declarations; allow queued back in stack render check
- Type text input refs with an exported interface so declaration emit can name hook results
(RN 0.88 aliases TextInputInstance to an unexported class).
- Expo Router 58 drains back() after a commit; check the interrupted push's exit from the
frame it starts, bounded to three frames of lag.
* chore(mobile): justify the text input handle interface for React Doctor
* chore(mobile): use a nameable intersection alias for text input refs
* fix(mobile): use sync expo-file-system writes, copies and moves on Expo 58
Expo 58 made File.write/copy/move and FileHandle.writeBytes return promises.
Our callers never awaited them, so failures escaped their try/catch and the
store's tmp-then-move and PDF writes could race their close or rename.
* build(mobile): raise the page bundle budget to 10 MiB for Expo 58
Expo 58 adds about 310 KB to the page: expo-router (+258 KB, now carrying
React Navigation, net about +110 KB) and Reanimated 4.7 (+152 KB). Main had
85 KB of headroom left. 10 MiB still stays within the 10 MiB per-asset contract.
* fix(mobile): drop the window-metrics seed RN 0.88 removed from Android
RN 0.88 no longer holds window metrics: DeviceInfoModule reads the activity's
WindowMetrics on demand and setWindowDisplayMetrics is gone, so MainActivity
no longer compiled. Layout scale still comes from the screen metrics we reseed.
---------
Co-authored-by: Kelvin Amoaba <97001695+AmoabaKelvin@users.noreply.github.com>
Disable commit/tag GPG signing via a cached wrapper GIT_CONFIG_GLOBAL when
the developer's global gitconfig enables signing, clear inherited GIT_CONFIG_GLOBAL
in GitBinaryTestFixture, strip inherited TERM_PROGRAM* in Vitest setup, and
run ssh-posix-command-wrapper shell checks against an empty HOME/ZDOTDIR/XDG_CONFIG_HOME.
Fixes#27210
Co-authored-by: outof-place <contact@outofplace.space>
Kelvin Amoaba
OrcaWinandOrcaWin
Neil
Wooseong KimandKelvin Amoaba
Jinwoo Hong
HrithikandHrithik Saini
Jinjing
Brennan Benson
