* refactor: group agent launch, status, and messaging owners
* refactor: consolidate direct owner imports
* refactor: import pane ownership directly in status listeners
* refactor: group renderer workspace ownership and navigation
* refactor: use the defining WSL rewrite store identifier
* refactor: route new upstream consumers to workspace owners
* refactor: consolidate connection owner test imports
* refactor: preserve upstream review-owner test retirement
* feat(release): publish a server-only Linux tarball for orca serve
Each release now also uploads orca-server-linux-x64.tar.gz and
orca-server-linux-arm64.tar.gz (orcad slot from the qualified template, the
pinned Node, and an orca-ide launcher) plus orca-server-sha256sums.txt, so a
Linux host can run orca serve without the desktop package.
The tarballs are packed and smoke-tested (serve --recipe-json, then pair a
second profile) on both architectures, including bare ubuntu:24.04 and
debian:12-slim containers. Upload runs only after the release is published
and nothing depends on it, so it cannot hold the desktop release.
* fix(release): keep the server tarball's launcher env out of its terminals; skip refs that predate it
- The launcher runs the CLI with ELECTRON_RUN_AS_NODE=1, as the packaged app does, and the CLI strips it
before starting orcad; ORCA_APP_EXECUTABLE and ORCA_SERVE_RUNTIME are cleared.
- Ship Node's LICENSE beside the runtime.
- Skip packing on release refs that predate the scripts, and upload only when both tarballs passed.
- Run the PR smoke when the CLI's serve-runtime selection changes; document service install.
onorca.dev offers an opt-in 'mirror link' (https://downloads.onorca.dev)
next to the GitHub download for when GitHub release downloads 5xx.
Upload the onorca.dev download assets there right after each stable
desktop release and each Android release, instead of polling.
- config/scripts/release/publication/mirror-release-to-r2.sh: retrying,
resumable download from GitHub, size + sha256 check, S3 multipart
upload to R2 (no 300 MiB wrangler cap)
- release-mirror-r2.yml: reusable + manual backfill
- release-cut: run after publish-release for stable vX.Y.Z tags only
- mobile-android-release: run before bump-apk-download so the site's
mirror link never points at a missing APK (success not required)
* refactor: move atomic publication to its filesystem owner
* refactor: group shared browser definitions by feature
* refactor: bind proxy process and session contracts to defining owners
* refactor: consolidate direct session contract type imports
* refactor: retain atomic publication test timing under moved owner
* fix(benchmark): resolve historical tunnel framing source before loading
* refactor: separate execution route and child exit owners
* refactor: move browser data into defining feature owners
* refactor: give runtime RPC entry its shutdown implementation
* refactor: use defining process types and colocate host telemetry test
* docs(process-host): point piped child contract to Node owner
* docs(process-host): clarify both piped contract owners
* refactor: use concrete browser and input owners
* refactor: bind remote runtime callers to concrete transport owners
* Use checked subscription mock argument types
* Type browser lease mock with its subscription contract
* refactor: bind sleeping VM status probe test to socket owner
ORCAD_CHILD_ENTRY_POINTS builds session-search-worker-entry.js, but
ORCAD_ARTIFACTS never listed it, so templates, the materializer, and the
remote installer dropped it and SSH-hosted session search failed with
'Session search worker entry not found'. Add the artifact and a test that
every built child entry is listed.
* Remove low-value ACP, hook and renderer test suites
* Remove low-value shared automation and agent test cases
* Remove low-value packaging and mobile probe test cases
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* Move session search SQLite into dedicated workers
* test: spawn the session search test worker with the shared worker helper
* fix: pass only drain promises to the channel's drain wait
* Repair session search failure and lifecycle boundaries
* Stop indexing tool output and reclaim existing rows
* test: say why the session search worker tests need a longer timeout
* Bound search cleanup and preserve failure and digest semantics
* Use the database row type for tool purge batches
* test: drop the same-connection mid-page write case now that each page reads one snapshot
* test: prove a mid-page delete from the writer can't change that page's hits
* Repair transcript cancellation cleanup and search test runtime admission
* fix: cancel active transcript finalization and enrichment waits
* fix: close transcript handles when cancellation wins delivery
* fix: preserve scan cancellation errors across parser waits
* test: prove cold session search bypasses an active writer batch
* fix: preserve search continuation through background tool cleanup
* fix: preserve search pages during orphan reclamation
* fix: bound typo repair posting visibility probes
* fix: preserve exact search terms when visibility is inconclusive
* test: drop orphan-reclaim cursor staleness case superseded by frozen continuation
* Bound session search work before ranking candidates
* Preserve the limit notice for empty search windows
* Bound session eligibility lookups and reuse FTS scoring statistics
* Index session scopes for population and candidate searches
* Derive search status from the live index after clear
* Preserve disabled search status during settings transitions
* Share planned expressions between spelling probes and search
* Keep identifier fragments out of spelling presence checks
* Report search initialization through its pending transition
* Bound spelling vocabulary work with the search posting budget
* Preserve search fallback while bounding distinct vocabulary seeks
* fix(session-search): drain removals before the worker queue fills; keep aborted close waits from failing teardown
* fix(session-search): hold writer commands when the worker queue is full instead of stopping the writer
* chore(ratchets): baseline the session search worker's one-shot entry check
* refactor: organize browser guest lifecycle owners
* test: resolve cross-version client owners and pre-ticket baseline
* test: record the released terminal registry path
* test(perf): render and identity contracts for agent status, sidebar, tab strip and chat
Twelve operation, render and identity contracts at the production seams of
the hottest UI paths, each driven at N and 10N with one hardcoded bound and
shown to fail with its regression restored. Registers them in the contract
list and fixes the perf workflow's path filter, which had drifted to 12 of
19 contracts. Removes test-only production exports nothing reads.
* test(perf): prove composer typing lands; drop dead rebuild counter
Review: the composer contract never checked the draft reached the composer,
and its transcript control could not fail; the live-index rebuild counter
and a bucket constant had no readers after the test exports went.
* chore(ratchets): count sync fs calls on Electron main and setInterval calls
Sync fs on main and fixed-cadence intervals that never settle were two of the
most common perf fix classes since September, and no gate counted them. Both
ratchets grandfather today's uses per file and fail when a file's count grows.
* chore(ratchets): count every sync fs export, src/shared and node:timers intervals
Review: the allow-list missed descriptor/copy APIs, src/shared helpers run on
main too, and setInterval imported from node:timers escaped the timer count.
* chore(ratchets): keep hosted setInterval calls beside a named timer import
Review: a named node:timers import zeroed window/globalThis calls too, a
destructured require was counted twice, and collector edits didn't select
the timer ratchet in check:changed.
* chore(ratchets): charge calls through an alias, not the alias binding
Decider ruling B on review finding C6: binding a plain alias of a gated call
counted as a use, so an alias refactor failed every collector-based ratchet.
Conditional/fallback aliases and exported bindings stay charged.
* chore(ratchets): count bare setInterval only when nothing local shadows it
Review: the timer ratchet kept its own narrower binding resolver, so alias
and namespace-destructure forms of an imported setInterval counted twice.
Module bindings are the shared collector's; a bare call is the global only
when the file declares no setInterval binding.
* chore(ratchets): resolve bare setInterval calls per scope
Decider ruling A: the file-wide shadow rule let an unrelated parameter or type
declaration named setInterval hide every global poll in the file. Each bare
call now resolves through a single-file TypeScript checker (noLib, noResolve)
and counts when it binds to nothing declared in the file.
* chore(ratchets): write the timer baseline exactly as --prune does
* chore(ratchets): charge global timer aliases and bracket access
CodeRabbit: `const schedule = setInterval; schedule(poll)` and
`window['setInterval'](poll)` counted zero. Count value references to the
global timer (per scope) instead of only direct calls.
* chore(ratchets): charge shorthand timer escapes; skip writes, typeof and JSX tags
Review: `{ setInterval }` of the global counted 0, while assignments to it,
parenthesized typeof probes and a <setInterval/> tag counted 1.
* chore(ratchets): charge compound assignments to the global timer
Review: `||=` and `??=` read setInterval before writing it, so only a
plain `=` target is write-only.
* chore(ratchets): regenerate baselines for files main moved
main's SSH reorganisation moved counted files under src/main/ssh and
src/main/managed-server; counts are unchanged except one sync fs call main
removed.
OrcaWinandOrcaWin
Neil
Jinjing
Brennan Benson