* refactor(main): organize SSH transport and managed server owners
* Remove orphan deploy readiness fixture and shrink test baselines
* refactor(wsl): import lock records from their defining owner
* refactor(wsl): use the canonical deferred update contract
* fix(github): stop PR pages from hanging when the rate-limit cache expires
Slot holders await assertRateLimitBudget -> getRateLimit while holding a
gh semaphore slot, and the /rate_limit probe queued for a slot behind
them. With all four slots held by budget waiters nothing ever released.
The probe is quota-exempt and deduped, so it no longer takes a slot.
* fix(github): bound rate-limit probe concurrency without the gh semaphore
Forced getRateLimit calls now join an in-flight probe, and all /rate_limit
probes share a small probe-only limiter that acquires nothing else.
Fold the deadlock regression test into rate-limit.test.ts as a direct await.
* fix(github): make forced rate-limit probes read quota after the call
Forced callers (403 reset refinement) share one follow-up probe queued
behind the running one instead of joining a probe that may predate the
403, so a stale positive budget cannot clear a fresh breaker block.
* fix(github): hand forced rate-limit follow-ups off synchronously
A pending forced follow-up could outlive its probe's settlement, so a
later forced caller joined a probe that predated it. Settlement now
detaches the shared deferred follow-up and starts its probe in one
synchronous step. Run rate-limit.test.ts on the Node runtime, where the
V8 scheduling that opens the race is reproducible.
* refactor(mobile): give relay and encryption concrete owners
* refactor(mobile): organize session and review feature owners
* refactor(mobile): organize RPC and host ownership
* test(mobile): point render fixtures at concrete owners
* refactor(mobile): use explicit type-only owner imports
* refactor: import journal queue state from defining owners
* refactor(shared): organize execution and automation owners
* fix: retain type imports used by surviving test cases
* refactor: finish work item owners and refresh validation metadata
* test: infer reconnect status fixture type
* test(claude): resolve source files beside same-named directories
* test(runtime): group repository creation mock registrations
* chore(lint): bump oxlint to 1.91, add perf lint rules and perf audits
* fix(lint): await promises returned inside try/catch/finally for return-await
Prepare typescript/return-await with error-handling-correctness-only: await
returns whose catch or finally was meant to cover them, and suppress the eight
sites where the catch must not re-handle the returned promise.
* chore(lint): enable return-await (error-handling-correctness-only); exempt secondary-scan directives in the changed gate
* refactor(mobile): move file preview discard modal into its own module
Keeps MobileFilePreviewScreen under the 400-line limit after merging main.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
The packaged daemon PTY check types a POSIX arithmetic command and waits
for "OK 42". The daemon picked the PTY shell from the builder's $SHELL, so
a fish builder never printed it and Linux afterPack timed out. Pin the
probe daemon's SHELL to /bin/sh so the check exercises the packaged PTY,
not the builder's login shell.
Fixes#39591
Co-authored-by: Neil <neil@stably.ai>
* fix(settings): unify terminal theme pickers
Reuse the Appearance searchable selector and palette swatches while preserving imported-theme actions and independent terminal theme slots.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(settings): don't replay a handled theme import after remount
Settings search unmounts the theme row, so the picker remounted with
handledImportSignal=0 and reopened at Imported without a new import.
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(terminal): send one ACK overflow recovery image per drained window
Recovery snapshots bypass ACK windows, so on a link slower than a flooding
TUI each ACK while overflowed published another full-screen image behind
the queued window. Measured through real orcad over a 1 Mbit/s shaped link
this queued images without bound: keystroke echo grew from 22s to 50s over
a 45s flood and the pane took 51s to settle. Holding the next image until
the output sent ahead of the previous one is acknowledged bounds that
queue to the window plus one image (echo <= 18s, settle 7s, 10x fewer
snapshot bytes). Server-only; no protocol change.
* fix(terminal): let adaptive ACK pacing engage under overflowing TUI floods
Through real orcad on a shaped 1 Mbit/s link, ORCA_TERMINAL_ADAPTIVE_ACK_WINDOW=1
never paced a 60fps full-screen TUI: once its queue overflowed, recovery
images cleared the queue, so later sends counted as idle trickle and the
estimate never collected window-limited samples. When it did, the images
(never acked) inflated paced RTT and tripped the divergence fallback.
- A stream whose output outran the window stays backlogged until an ACK
finds its queue empty, so sends after a recovery still measure the link.
- The estimate records recovery images: they count as queue ahead of later
sends (no drained/paced samples behind them) and as delivered bytes once
an ACK of a later send confirms them.
Shaped-link soak (1 Mbit/s, 50ms): echo p50 13s -> 2.2s, settle 7s -> 1.1s.
Bench gains a 6.4 MB/s TUI scenario: paced 7.7s -> 1.2s.
* refactor(main): organize runtime implementation owners
* test: retire wall-clock CLI title recovery case
* refactor: route new folder mutation to runtime store owner
* test: import folder mutation store contract from its owner
* refactor(terminal): own multiplex ACK window accounting in one module
* perf(terminal): pace alternate-screen multiplex output to the measured link BDP
Slow SSH links queued up to 2MB of superseded TUI frames ahead of keystroke
echo. orcad now estimates delivery rate and base RTT from existing output ACK
timing, caps in-flight output for alternate-screen streams near 2x BDP on links
under 4 MB/s, and replaces a backlog larger than that budget with the existing
recovery snapshot. Normal-screen streams and fast links keep the legacy
windows. ORCA_TERMINAL_ADAPTIVE_ACK_WINDOW=0 restores legacy behavior.
* perf(terminal): back off unavailable superseding snapshots and bound legacy echo checks
* perf(terminal): gate ACK pacing to measured remote links and keep supersedes history-neutral
Pacing now needs a base RTT of at least 40ms, 16 fresh window-limited samples,
and a sample within 15s, so LAN/local links and stale estimates keep the legacy
windows. Superseding snapshots are screen-only, only replace frames that never
switch screen mode (rechecked after serializing), and leave client history
untouched. Paced streams keep today's total buffering before overflow, so
overflow recovery fires no earlier than with legacy windows.
* fix(terminal): close supersede gaps found in review
Scan for screen switches and OSC side effects across frame and send
boundaries (raw and JSON-escaped), back off after an aborted supersede so it
cannot re-serialize in a loop, and keep paced pending headroom until the queue
drains so leaving the alternate screen cannot force an overflow recovery.
* fix(terminal): judge supersedable backlogs on decoded text across every seam
Scan the joined text of the whole queue (plus the sent tail) so screen
switches split across any frame, send, or covered/retained boundary are
seen; never supersede span frames; reject bells (via the shared bell
detector), OSC clipboard/notification writes and 8-bit OSC; back off for 1s
after a rejected scan instead of rescanning on every ACK.
* perf(terminal): make backlog superseding opt-in and forget the sent tail after snapshots
Every recovery snapshot makes current clients replay their reattach reset
(cursor shape/visibility, focus reporting), which is visible when it fires
routinely, so superseding is opt-in via ORCA_TERMINAL_SUPERSEDE_ALT_BACKLOG=1
until clients can skip it. Pacing stays on by default: on a slow link the
existing overflow recovery then reaches the client promptly instead of queuing
behind a 2MB window. After any snapshot the sent tail is unknown (it can end
inside an escape), so superseding waits for the next text frame.
* test(terminal): cover default pacing and opt-in superseding separately
* perf(terminal): read the supersede switch once per connection and skip its bookkeeping when off
* perf(terminal): make adaptive ACK pacing opt-in and fix review findings
- Default off: ORCA_TERMINAL_ADAPTIVE_ACK_WINDOW=1 enables it; when off every
new path is a single flag check, so behavior matches legacy windows.
- Base RTT is a windowed minimum kept honest by periodic probes that drain our
own queue; a paced RTT beyond what our window can add means the path changed,
so legacy windows hold while the base re-learns (no more self-tightening to
64KiB after an RTT increase).
- Paced pending headroom is capped by the connection window legacy would have
used and released on drain, pause and detach.
- Superseding refuses snapshots that end inside an escape.
- Replace the latency-threshold unit test with hardcoded estimator tests and
move the link simulation to bench:terminal-multiplex-ack-pacing.
* perf(terminal): drop backlog superseding and harden opt-in ACK pacing
- Remove the opt-in backlog-superseding snapshot path (code, env switch,
frame classifier and tests); it needs a client capability to skip the
reattach reset before it can ship.
- Paced-ness is decided once at admission (alt screen checked before the
estimate) and reused by the send, so a probe starting in between cannot
mislabel a sample.
- Base RTT is fed only by sends with a near-empty connection queue; probes end
only on such samples from paced streams, and a probe that cannot drain backs
off. A path change forgets the base and holds legacy windows until a drained
sample re-learns it.
- Paced pending headroom is sized from the steady window (never a probe's
zero) and released whenever the queue drains back within the legacy cap.
- Flow-level tests: disabled pacing keeps legacy frames on a measured slow
link; drained headroom returns so later output overflows at the legacy cap.
* fix(terminal): release paced headroom whenever the queue drains, including after recovery
* feat(claude): sync the terminal theme into Claude Code
* fix(claude): retry missed theme reloads, keep settings key order, search entry
* fix(claude): persist theme ownership before settings writes, skip deliberate themes, restore only on toggle
* fix(claude): gate theme sync on Claude Code 2.1.119, follow Orca's Claude config dirs, keep restores owed
* refactor(theme): point markdown Monaco rules at the shared contrast helpers
* fix(claude): lock theme ownership edits across Orca processes, retry missed theme reloads with backoff
* test(e2e): opt-in real Claude Code theme sync journey; retry theme reloads for up to five minutes
* fix(claude): keep theme takeover recoverable when settings writes or the lock fail; steadier e2e journey
* fix(claude): serialize theme publication with takeover and restore, per-file reload retries; record the real-Claude e2e in the isolated home
* fix(claude): retry an owed restore publish, stop off-state retries, reread settings right before writing
* fix(claude): republish theme files under the cross-process lock
* refactor(theme): point chat selection contrast at the shared helpers
* feat(claude): default theme sync on for new profiles; offer it once to existing users at their next Claude launch
* fix(claude): offer theme sync to every existing profile, confirm only after the save, honest offer copy
* fix(claude): right-align the theme sync offer's two actions, primary last
* spike(relay-edge): local Durable Object relay prototype and de-risk harness
Stateless Worker routes control/phone/data sockets to one object per host.
Harness drives the shipped desktop control client and data transport against
wrangler dev. Not wired into builds or deploys.
* spike(relay-edge): one Durable Object per splice isolates slow phones
The host object keeps control, session and connection bookkeeping. Each
phone connection and its host data socket live in their own object and talk
to the host over DO RPC. Harness adds flood isolation, splice reset, budget
reclaim and RPC latency checks; the silent-bytes guard is measured and left
disabled.
* spike(relay-edge): Cloudflare de-risk kit (spike env, load, deploy, canary, rtt tools, runbook)
* spike(relay-edge): rebind after an object reset keeps the generation
* spike(relay-edge): pool splice objects per host to avoid object creation per phone connect
* spike(relay-edge): slow-phone flood test for Cloudflare
* relay-edge: MVP backend (credential store over Hyperdrive, JWKS, epoch check, host commands)
* relay-edge: MVP checks on local Postgres (credentials, commands, epoch, DB-down)
* relay-edge: refusal and database-latency metrics; Analytics Engine on the spike
* relay-edge: alerts cron Worker over Analytics Engine; edge.relay.orca.dev on the spike
* relay-edge: slow assignment check closes 4429, never 4401; staging env over Hyperdrive; db latency debug route
* relay-edge alerts: silence only after traffic
* relay-edge: Durable Object SQLite adapter; relay credential-store tests pass on it (P1)
* relay-edge phase 2: credential store on HostRelay SQLite, signed director push/export/erase; 17/17 in workerd
* relay-edge phase 2: Cloudflare env, push-assignments load prep, remote mode for phase-2 checks
* relay-edge: export freezes the host and is refused while connected; move-on replaces host data; stale/conflict carry the edge epoch; push location hint; admin content-length check
* relay-edge: daily store sweep on the object alarm (armed on every wake and admin call), wipe of objects whose host never arrived or left 30 days ago, erase guard ignores expired bases, admin and sweep metrics
* relay-edge: admin key renamed ADMIN_SIGNING_KEY; optional erase-only signer for the erasure job; a move onto the edge also voids audit rows from an earlier stay
* relay-edge: phase2 test env names the erasure issuer
* relay-edge: director ⇄ cell ⇄ edge round trip with the shipped desktop and phone clients
* relay-edge: round trip resolves the live phone first (a failed resolve rate-limits the host)
* relay-edge: per-source pre-auth limits; phones for unpushed hosts answered without storage
Phone and host data upgrades are counted per source (CF-Connecting-IP, IPv6 by /64)
through a Rate Limiting binding, failing open. A phone for a host the director never
pushed (or one since wiped) gets relay-hello 4409 from the Worker, so neither the host
nor a splice object writes storage. Local 25/25, phase2 21/21.
* relay-edge: production env on edge.relay.orca.dev; object schema version; frame caps; place on metrics
- production env (orca-relay-edge): custom domain edge.relay.orca.dev moved off the
spike env; object backend, production auth JWKS, no debug/reset routes.
- Object storage carries a schema version; code older than an object's schema refuses
it; a test pins the version to a hash of the tables so changes need a migration.
- Frames over the cells' limits close 1009 (control 1 MiB, splices 8 MiB).
- Metrics carry the client's ingress '<continent>/<colo>'.
Local 26/26, phase2 22/22, unit 24/24.
* relay-edge: production alerts env (reads the production dataset)
* relay-edge: keep only local dev config in this repo
Deployed environments (Worker names, hostname, account id, dataset names,
rate limits, Hyperdrive id) move to the private deploy config. The local
config and tests are unchanged.
* cloud: keep relay-edge out of the pnpm workspace (own npm lockfile)
* Revert "cloud: keep relay-edge out of the pnpm workspace (own npm lockfile)"
This reverts commit a55955d3c023964ccd2dfb644e2d09ca67322722.
* cloud: relay-edge as a pnpm workspace member (lockfile; workerd binary-only)
* relay-edge: follow main's relay module moves; alias workspace packages by directory so subpath imports resolve
* relay-edge: splice byte counters on the socket attachment (survive hibernation)
* relay-edge: keep deployed-target load tools out of the public tree; abort routes only on the spike backend
The local harness (spike/run-all.ts, lib.ts, keys.ts) stays. The tools that drive a deployed
Worker and the Cloudflare runbook live with the private deploy config.
* relay-edge: satisfy the changed-lines lint gate
Braces on every if, type aliases over interfaces, template strings, no explicit any,
!== -1 index checks, and a justified max-lines header on the per-host object, the splice
object and the end-to-end harnesses. No behaviour change: unit 19/19, object MVP 26/26.
* relay-edge: split the host object and harnesses under the 300-line limit
HostRelay is layered base → handshake → control → phones → HostRelay (one object, one state;
method bodies moved verbatim, private → protected). SpliceRelay's state types move to
splice-state.ts. The harnesses' helpers move to sibling modules. No max-lines disables.
Unit 19/19, object MVP 26/26, local spike harness 19/19.
* relay-edge: run its vitest suite from cloud's pnpm -r test and register the runner
Two new React Compiler compat hazards:
- discarded-subscription: a useSyncExternalStore call whose result is thrown
away, so the reads after it get cached on unrelated inputs.
- store-read-in-memo-block: a render-level getState() that the compiler places
in a cache-guarded block. Reads inside the source's own useMemo or callbacks
keep their written deps and are skipped.
The compiled output is parsed once for hook and store reads. Current sites are
grandfathered in the hazard baseline.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* perf(mobile): open Jump back in and notifications inside the host document
* fix(mobile): gate open targets on page 3, keep notification suppression, fold double taps
* fix(mobile): report the shown session from host documents and only open this host's sessions
* test(mobile): ignore the page's location report in the agent-history notify check
* fix(mobile): let a Back before the paint gate settle the host stack
* refactor(mobile): build the route-param clear frame beside its name
* fix(mobile): stop a session opened on a pane from faulting the page
* test(mobile): check the opened pane leaves the session URL
* fix(mobile): type the session's own navigation for the pane erase
* perf(mobile): merge small route-shared page chunks into one
* refactor(mobile): share the merged page build with the route closure check
* build(mobile): check in the chunk sweep and drop the unused route closure helper
* refactor(mobile): count page chunks in one place
Neil
OrcaWinandOrcaWin
Brennan Benson
Vitalii KulishandNeil
Kelvin Amoaba