* Keep model picks independent of answer metadata
* Remove unused answer model extraction
* Verify model selection stays separate from answer metadata
* Keep the agent-chosen model as a display default
* Keep agent-chosen model text out of input selections
gh 2.91.0 and 2.92.0 start `gh send-telemetry` with DETACHED_PROCESS. Its
`tzutil /g` child then gets a new console, which shows a terminal window for
about 0.2s. Orca's background PR polling runs gh about once a minute, so
Windows users on those gh versions see the window every few minutes while
Orca sits idle. Default GH_TELEMETRY to false in the gh child env, next to
GH_PROMPT_DISABLED, and keep any value the user already set.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Deliver client browser reconciliation completion to observed workspaces
* Supply the workspace snapshot in empty adoption coverage
* Skip recovery completion output after its recipient unsubscribes
* Check activity work in the departed recipient regression
* Select accepting session listeners before recovery delivery
* Preserve scoped removal and recovery clearing delivery
* Specify reconciliation listener selection type directly
* Use inherited reconciliation listener selection contract
* Type reconciliation observations by their actual owners
* Update recovery test row-order import after main integration
* fix(tests): import GitHub image capability from its owner (#41625)
---------
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* Antigravity settings: flatten into agy terminal and Chats cards
Replace the nested Antigravity card with two flat settings cards. Saved agy
accounts become Codex-style rows (click to select, Active badge, Remove), the
current login gets an inline Save, and usage refreshes from the active row.
Chats lists Sign in with (Enterprise fields inline), Account status with its
action, then Chat runtime.
* Use primitive variants for Antigravity row buttons and badge
* Antigravity settings: speak usage values and keep the /logout step
* feat(native-chat): answer card as separate option tiles (variant C)
- Card on the composer surface: 14px radius, its own edge, one 14px gutter
for the question, option tiles and footer.
- Each option is a bordered tile (new --question-option-border token); a
picked tile gets a primary border, 8% fill and a filled check badge.
- Keyboard focus is an inset --chat-focus-ring ring, never the selected fill,
so option 1's initial focus no longer reads as picked; descriptions stay
muted at 13px.
- Footer: the answer field is a bordered box; Skip is an outlined button that
turns into a filled Submit with an Enter hint.
- Fixtures for keyboard focus, multi-step and a 400px pane.
* fix(native-chat): answer card edges follow chat colors; bare multiline field
- Derive the card and option border tokens from --chat-source-foreground so
tiles keep their edges when chat follows the terminal's colors.
- Use the bare ImeTextarea for the multiline answer inside the shared box
instead of overriding the Textarea primitive.
- Show the Enter hint only where Enter confirms (single-select, single-line).
- Skip/Submit text follows the chat UI size; focus offset uses the card
surface; footer bottom-aligns beside a multiline field.
- Move Skip/Submit into NativeChatQuestionConfirmButton.
* fix(native-chat): preview inside the picked tile; steady footer; scheme-aware edges
- The tile wraps the row and its preview; the preview is indented to the
label column without its own border, and a 1px inset gap separates the
focus ring from a picked tile's border.
- Skip/Submit gets a min width that fits 'Submit ↵', so the answer field
keeps its width.
- The answer box shows keyboard focus as the same 2px inset ring as options;
the multiline field grows with its content up to 12 lines.
- Card and option border mixes follow the chat's own scheme when it takes
the terminal's colors.
- Focus the card's first target with focusVisible so the ring shows even when
a mouse click opened the card.
* fix(native-chat): force the focus ring only on a prompt card's focus target
The card-level fallback (approval cards, a question card with every target
disabled) keeps the browser's keyboard heuristic, so mouse-opened approval
cards do not draw a ring around the whole card.
* perf(worktrees): give each repository's worktree list one owner
The sidebar and the runtime catalog each kept their own copy of a
repository's `git worktree list` result and their own staleness rule, so
the same change was often listed twice. One owner per repository, host
and Git runtime now holds the observation, its flight and invalidation;
each reader keeps its accepted age (sidebar 5 s, runtime 30 s plus the
admin-file verifier up to the 5-minute ceiling) and shares the scan.
Settled rows now go stale on Git-level mutations too, overtaken readers
follow one trailing scan, store hygiene uses the facts captured before
the scan that produced the rows (once per observation), and a cooled-
down watcher failure defers its catalog refresh instead of dropping it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(worktrees): fence the catalog owner by runtime, single flight and hygiene claims
Sidebar reads age from scan start, so runtime verifications no longer
stretch them; probes only certify rows fingerprinted before their scan.
One flight per owner, with a single trailing scan after invalidation.
Switching a repo's Git runtime retires the old owner, and a reader whose
owner was retired mid-read returns non-authoritative rows. Only pruning
readers claim hygiene, failed scans keep the evidence gate's no-retry
claim, overflow invalidates at once, and the stopped-distro fallback
serves only current rows.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(worktrees): let only the live route own a repository's catalog
The catalog owner now asks the live registration which path and Git
runtime are current instead of trusting whichever request arrives last.
A request admitted for a replaced route runs no Git, retires nothing and
answers non-authoritatively; liveness is rechecked before a flight
starts and when it publishes. Route-changing writes retire obsolete
owners after they land. Adapters re-resolve the route after the WSL
admission check, a mismatching verification probe becomes the rescan's
fingerprint, and runtime scans share the strict true-empty-aware reader.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(worktrees): bound live-route checks and recheck authority before pruning
Live-route checks read the repo registry once per synchronous pass
instead of hydrating every repo per check. WSL discovery answers that
change a repo's Git route retire obsolete owners like other route
writes, and desktop and headless pruning recheck the owner's authority
for the observation after their own awaits.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(worktrees): revision the live-route snapshot and carry owner authority to publication
Route checks use one registry and project pass per route-input revision,
which repo, project-membership and runtime-setting writes advance
synchronously; WSL discovery answers retire obsolete owners at once.
Repair-state and SSH routes never acquire local Git authority. Metadata
pruning rechecks owner authority after its path probes, fleet lineage
claims require a current observation, and final desktop and runtime
listings stay non-authoritative once the owner has retired their route.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(worktrees): keep remote-owned repos out of local Git routes
Registrations owned by another host never get a local Git route, WSL
discovery notifies after the distro list is written and isolates its
listeners, and tests cover idle retirement on route-input and discovery
changes plus pruning that loses owner authority mid-helper.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(worktrees): cover catalog route authority at its production seams
Real repo-removal writer revokes the route at once, and desktop and
runtime listings never publish owner rows as authoritative after their
route was retired.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(worktrees): prove catalog authority at the pruning helper and Git conversion writer
The runtime listing loses route authority during its own metadata prune
and stays non-authoritative; a real held path probe deletes nothing once
the owner retires the route; a folder converted to Git is admitted as a
live route as soon as the write lands.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(worktrees): keep strict true-empty listing behind the mockable lister
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(worktrees): start each worktree.ps case from an unobserved catalog owner
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* build(typecheck): list the WSL discovery change module in the web project
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(worktrees): withdraw catalog authority from a replaced observation
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(github): cancel image uploads when the draft closes
* test(github): use the runtime response metadata field
* chore(github): explain upload boundary type assertions
* fix(agent-picker): stop listing Claude short-name rows beside the versioned model they run
* fix(agent-picker): hide a short name only on reported proof; keep hidden rows searchable
* fix(native-chat): keep a pending hidden model pick listed
* Hide projects from the sidebar without stopping them
Adds Repo.hiddenAt, a per-host, view-only flag. A hidden project's
workspaces, empty header and project-filter entry leave the desktop
sidebar, the paired phone's list, the new-workspace picker and the
palette's project filter. Its terminals, agents and automations keep
running, and repo.list / worktree.ps still list it.
- Hide Project in the project menu (toast with Undo), a collapsed
"N hidden projects" list under the workspace list with Show buttons,
and a Hide from sidebar switch in Settings > Projects.
- repo.setHidden RPC ({repo, repoHostId?, hidden} -> {repo, hostId,
hidden}) and `orca repo hide|unhide [--host]`; `repo list` marks
hidden rows.
- Opening a hidden project's workspace (notification, CLI, deep link)
focuses it without unhiding it, lifting sidebar filters, or leaving a
pending sidebar reveal.
- repo.update echo check: a host that drops hiddenAt reports failure
instead of reading as hidden.
* Address hidden-projects review: multi-host hide, picker scope, mute, stale filters, shared predicate, restore list styling
* Hidden projects re-review: keep saved filters, Agents filter, composer seed, per-toast Undo, shared default host
* Hidden projects: address review threads (pre-feed, palette search, notices, dialog default, seed remap, row keys, a11y)
* Hidden projects: no implicit dialog default when every project is hidden
OrcaWin
OrcaWinandOrcaWin
Neil
Kelvin Amoaba
Jinjing
Brennan Benson
mousepotato03andClaude Opus 5.5