G6 lists "no superseded quarantine remains reachable" and this module was
assumed to be one. Disabling its single call site reproduces the hazard
it exists for — `cho hi; rm -rf x` reaching the shell — so deleting it
without a replacement re-opens command execution.
The replacement was costed by building it rather than estimated: +26
production LOC to thread the incarnation, ~+33 complete, and the
cross-remount state it needs outlives the destroyed pane so it becomes a
module about the size of the one deleted. Floor is roughly +140 to delete
88, and it would add a second identity comparison to a gate already
failing for having more than one.
The decisive part is that the route is not uniformly available: remote
runtime results carry no incarnation, old hosts cannot be made to publish
one, and mixed versions are the normal state. A paired client reads
unknown, which this program's own rule says is not proof — so either
every remote reattach surfaces unresolved, or a fallback is needed and
the only correct fallback is this module.
Whether to amend the clause or accept something weaker on remote hosts is
a user decision, so the clause verdict is left as failing rather than
quietly reclassified.
Co-authored-by: Orca <help@stably.ai>
G6's body still demanded strictly-negative production LOC after the user
relaxed it to minimise-and-justify, so the gate had two conflicting pass
conditions and no single truth value. Its body now points at that
decision.
Assessed the remaining clauses against the branch rather than assuming.
Two fail structurally: more than one identity comparison and mutation
admission path still exist, and `terminal-input-quarantine.ts` is still
reachable from two production files.
Records why the quarantine is not subsumed by the superseded-PTY fence,
which I had assumed and checked. The fence refuses writes aimed at a
stale ptyId; the quarantine guards the user's next keystrokes landing on
the successor under its current, correct id — a case the fence never
sees. Removing it needs the recovery path to surface a different shell as
unresolved, not a deletion.
Co-authored-by: Orca <help@stably.ai>
I recommended adding a typed end-reason so a user quit stops looking like
a resume candidate, then went to implement it and stopped.
`SleepingAgentSessionRecord` already carries three fields that each exist
to stop something resuming that should not have — `origin`,
`restoreOnTabOpenOnly`, and `automaticResumeBlockedBy` — each traceable
to its own incident, consulted at 22 non-test sites. A fourth predicate,
however well typed, is the fifth containment cycle.
The designs without this bug do not have a better flag; they resume only
on an explicit action, into a new terminal id, and make two agents in one
terminal unrepresentable in the schema. The first of those is a product
decision about whether automatic resume stays a feature, so it is the
user's call rather than mine.
Co-authored-by: Orca <help@stably.ai>
Three journeys attempted; none promoted, and the reasons are recorded in
the ledger rather than rounded up.
MaxSessions=1 against real OpenSSH, with the cap read back from `sshd -T`
rather than assumed, and remote pids read on the container two
independent ways that must agree, each carrying its kernel start time.
Two disjoint mutations discriminate — one reddens only the reconnect
clause, the other only the two restart clauses. But the disconnect clause
is a forward guard: four separate guard removals left it green, so
nothing shipped is load-bearing for it.
Lazy discovery samples sshd's own accept log and live session census
across a 22s window with the in-use host as a positive control. No
mutation reddens its third clause alone — the real cross-host lease
scoping is load-bearing, but removing it breaks the sibling host during
setup, so the failure carries no clause information.
The paired-runtime skew spec pairs two real processes at different
versions and refuses to run rather than degrade into a same-version
pairing that would look green and prove nothing.
No production code changes.
Co-authored-by: Orca <help@stably.ai>
These five reproduced a defect that was live on main: folder-workspace
ids were compared with the instance suffix stripped, so two workspaces
sharing a directory read as the same namespace. They were committed
skipped, pointing at the PR that fixes it.
That PR is merged, and they pass. Verified they still bite: restoring the
suffix-stripping comparison reddens exactly these five and leaves the
other four green.
An oracle written before its fix, held skipped, and confirmed against the
fix after the merge — rather than deleted and rewritten from the answer.
Co-authored-by: Orca <help@stably.ai>
The WSL run blamed bash 5.3.9 for the unrelated
`local-pty-shell-ready` failure. macOS runs the same bash version and
passes 67/67, so the version is not the cause — the trigger is
environmental to that distro, and the underlying defect is that the spec
asserts an absolute count of OSC markers it does not own.
Co-authored-by: Orca <help@stably.ai>
The oracle runs on every environment the journey names, and is
clause-selective on all three: reverting three-valued `hasPty` reddens
only the unknown-not-dead clause, and widening the sole-provider fallback
reddens only the stale-generation clause.
Selectivity in WSL was established rather than assumed. The spec runs
serially, so a red first test reports the others as "did not run" — they
were re-run alone under the same mutation and stayed green.
Also records that an Orca WSL-mode terminal now starts on that host at
all, which it could not before: the distro had no provisioned default
Unix user, so every interactive launch blocked on first-run setup.
One diagnosis from the WSL run is corrected here rather than repeated:
the unrelated `local-pty-shell-ready` failure was attributed to bash
5.3.9, but macOS runs the same bash version and passes 67/67. The trigger
is environmental to that distro, and the underlying defect is that the
spec pins an absolute count of OSC markers it does not own.
Co-authored-by: Orca <help@stably.ai>
Four journeys now have discriminating oracles but none meets its full
stated scope, and each shortfall is named rather than rounded up.
Journey 2 is one WSL run from promotion. Journey 12's tests are
in-process, so they do not close the live-skew gap the original ledger
named. Journey 4's cross-host clause cannot be proven by mutation at all
— a mux is per target, so its dispose cannot cross hosts, and the
cross-host test stayed green under the mutation that reddens siblings.
Journey 13 measured one dimension of ten, on lifted predicates rather
than through real IPC.
Co-authored-by: Orca <help@stably.ai>
Daemon: replaces a spec that modelled only a client restart and never
crossed the daemon boundary, whose successor generation owned nothing so
"the live successor is neither killed nor replaced" was vacuous. The PTY
leader is now a real login shell reporting `$$` back through the
production write path, resolved to a kernel start time. Two mutations
each redden exactly one of the three clauses, on macOS and Linux:
reverting three-valued `hasPty` reddens only the unknown-not-dead
clause; widening the sole-provider fallback reddens only the stale
generation clause.
Skew: reverting the restore-required publication to expiry reddens 4 of
5 new tests while the legacy control stays green — the regression this
branch fixed is now caught if reintroduced.
Multi-host: restoring `mux.dispose('connection_lost')` reddens sibling
isolation on one host. It does NOT redden across hosts, and that is
recorded rather than glossed: a mux belongs to one relay session per
target, so its dispose cannot cross a host boundary. Journey 4's
cross-host clause rests on isolation-by-construction, not on a mutation.
No production code changes.
Co-authored-by: Orca <help@stably.ai>
The oracle now runs natively on macOS, Linux and Windows, and its
discrimination was watched on each: a mutation reddens it, a restore
greens it. On Linux and Windows both mutations were run, and the second
reddens only the stale-operation test — so the journey's two clauses are
proved independently rather than jointly.
Windows is the new evidence. The PowerShell branches added blind at
ebffb85a848 executed correctly on their first run: `$PID` expanded to
real integers, which also proves the pane shell there is PowerShell-family
rather than Git Bash, and `Get-Process StartTime` returned kernel start
times 5.4s apart — so a recycled pid could not have passed as a survivor.
First journey promoted in this program. The other twelve are unchanged,
and the residual limit on "every stale exact operation" is recorded
rather than glossed.
Co-authored-by: Orca <help@stably.ai>
Marks the client-constructed binding proposal as rejected with the three
false claims that sank it, and records what shipped instead.
States the shipped fence's actual limitation rather than leaving it
implied: it compares a binding, not an incarnation, so a respawn under a
reused ptyId passes. The obvious remedy is wrong here — the agent-create
id is deterministic by design so a replayed create stays idempotent, and
randomising it would trade this narrow gap for a duplicate-spawn bug.
Also records the ranked lessons from four comparable agent IDEs, chiefly
that a typed end-reason at end time is what stops a user quit from
looking like a resume candidate.
Co-authored-by: Orca <help@stably.ai>
Both probes were POSIX-only and unconditional: `echo ...=\$\$` for the
shell's own pid, and `ps -o lstart=` for its start time. Running the spec
on a real Windows host proved it dies before reaching either guard, so
Journey 1's Windows half was unprovable rather than merely unproven.
PowerShell exposes the same two facts as `$PID` and `Get-Process`
StartTime. The start time still matters on both platforms for the same
reason: a PID alone cannot separate a survivor from a reused number.
Still green on macOS. The Windows path is written from the host probe and
has not itself been executed end to end — that is the next thing to run
there, not a claim being made here.
Co-authored-by: Orca <help@stably.ai>
`readPaneBinding` took a single unpolled read of a DOM dataset attribute
immediately after a renderer reload, while its sibling helper polls the
same data for 15s. On a native Linux host both tests failed every run
with 'No bound terminal pane is mounted' while the app was demonstrably
healthy — the screenshot showed the terminal restored with a live prompt
and the boot PID echoed.
The assertion is unchanged; it is only awaited. Nothing is weakened.
Found by running this spec on native Linux rather than assuming macOS
behaviour generalises.
Co-authored-by: Orca <help@stably.ai>
A signal means "interrupt my pane", so delivering one to a PTY the pane
has already replaced is a misdirected interrupt. Fence it with the same
lock-step proof used for write and resize.
`pty:kill` stays deliberately unfenced and a test now pins that: a
superseded PTY is orphaned, and reclaiming it is exactly what the
orphan-cleanup callers ask for. Refusing there would break the operation
that reclaims leaked shells — the opposite of the intent.
The fence sits at the IPC boundary, above `tryGetProviderForPty`, so it
covers local, daemon and SSH rather than the local path alone.
Co-authored-by: Orca <help@stably.ai>
`pty:write`, `pty:writeAccepted` and `pty:resize` accepted any id. The
renderer queues input, so a keystroke buffered before a reattach landed
on whatever PTY had since taken the pane — and a resize reshaped the
successor's shell.
Main already tracks `ptyPaneKey` and `paneKeyPtyId` in lock-step, so
their disagreement is proof the caller's id was superseded. No wire
change, no renderer change, nothing added to the input payload.
An id with no recorded pane stays permitted: unowned and orphaned PTYs
are unknown, not stale, and unknown never authorizes refusing an explicit
operation. That is also what keeps orphan cleanup working — those ids
have no pane by construction.
The tests pin the CALL SITES, not the predicate. A capability that exists
and is never called is indistinguishable from no capability, which is
exactly how `mayCreate` sat inert here for several commits with every
test green.
Co-authored-by: Orca <help@stably.ai>
Every defect this program has touched is the same defect: identity
compared with the wrong key, or not compared at all. Lease keyed without
the pane, reattach using a creating write, folder-workspace ids compared
with the instance suffix stripped, local mutating IPC carrying only an
id, a live shell classified as expired, liveness unable to say unknown.
Proposal: one branded binding type built from fields that already exist
and are already persisted, constructible only from an authoritative
source, carried by mutating operations, compared by one shared function.
Makes a wrong-key comparison a type error rather than the next incident.
Under adversarial review, including against the open issue corpus.
Not accepted.
Co-authored-by: Orca <help@stably.ai>
The previous induction closed a pane while the transport was severed and
relied on `pty:kill` FAILING so the lease outlived the pane record. It
does not fail: with the provider already torn down, `pty:kill` takes its
tombstone branch and marks the lease terminated, and `reattachKnownPtys`
filters terminated leases out of the fan-out — so the reconnect never
visited the PTY the test was about. It passed on both trees.
Seed the precondition instead. Spawn a real remote PTY on a leaf that
never becomes a pane, then roll the host partition back to its pre-spawn
snapshot, leaving a live lease and a live remote shell that no durable
pane owns. No failure races a success.
Adds a vacuity guard that is independent of the tree under test: the
lease's own `lastAttachedAt` must advance, proving the fan-out actually
visited this lease before the pane census is trusted.
Verified on this machine under an isolated TMPDIR, since the e2e
harness keys its seeded-repo pointer on a machine-global tmpdir path:
guard present passes, guard removed fails with the phantom leaf grafted
into the local partition, guard restored passes.
Co-authored-by: Orca <help@stably.ai>
Six parallel streams, each required to fail with its guard removed rather
than merely pass.
Local restart proves the OS process itself survives, by reading
`ps -o lstart=` for the shell's own pid. That matters: with the quit path
made destructive, the tab, leaf and pty ids all came back byte-identical
while the shell underneath was a new process — every existing restart
spec would have stayed green. Two separate guards were removed to redden
it, and the second reddens only the stale-operation case.
Daemon restart discriminates by reverting three-valued `hasPty`; version
skew now covers publication semantics and confirms the new
`SSH_SOURCE_RESTORE_REQUIRED` token mutates nothing on an old client;
two-host isolation censuses both containers.
Deletes `src/relay/pty-source-replay-index.ts` — 201 production lines
with no importer outside its own test, verified against an
entrypoint-rooted import graph rather than a name grep.
Five namespace tests are skipped, not passing: they reproduce a defect
still live on main where folder-workspace ids compare equal with the
instance suffix stripped. PR #12474 fixes it; they are its oracle.
Co-authored-by: Orca <help@stably.ai>
G6 becomes minimise-and-justify rather than strictly net-negative. The
deletion budget the plan assumed does not exist: an entrypoint-rooted
import graph found 51 of 53 candidate files reachable and instantiated
on live paths, leaving 263 deletable LOC against roughly +1,021 to
offset. Correctness may still not be traded for line count.
Co-authored-by: Orca <help@stably.ai>
Adds a second reconnect scenario and a helper that reads pane records
from the local partition as well as the ssh host partition. That split
matters: the reattach binding call passes no hostId, so a grafted pane
lands in the LOCAL partition and an oracle reading only the host
partition passes whether or not the guard is present.
Both tests remain forward guards. The second one was reported as
discriminating and did not reproduce: with `mayCreate: false` removed
from the call site and the app rebuilt, both still passed. Its induction
races `pty:kill` against a severed transport, so when the kill lands the
lease is cleaned up and there is nothing left to graft. The handoff
README is corrected to say so rather than claim a journey.
Co-authored-by: Orca <help@stably.ai>
The settle poll reused a matcher the assertion 15 lines above had already
satisfied, and Playwright's poll engine probes immediately and returns as
soon as the matcher passes — so it observed the same state twice and
elapsed 0ms. A shell grafted a second or two after reattach reported
ready slipped through into the next cycle.
Reviewer was right on #13111. Test-only; no production change.
Co-authored-by: Orca <help@stably.ai>
The package was untracked under a gitignored `docs/**`, with the
un-ignore rules living only in an uncommitted .gitignore edit — a single
`git clean -xdf` would have destroyed the authoritative plan.
The 814-path construction snapshot is now pushed as
`nwparker/react185-authority-snapshot` too; it had no remote ref.
Co-authored-by: Orca <help@stably.ai>
`IPtyProvider.hasPty` returned a boolean, so a provider whose inventory
was empty for reasons that have nothing to do with the session — socket
down, cache never hydrated, provider generation just constructed — had no
way to say so and answered "absent". Its own siblings already knew
better: `probePtyLiveness` and the runtime's `PtyController.hasPty` were
both already `boolean | null`, with consumers branching on null
correctly. The lie was injected at exactly one interface.
Now three-valued, and each provider answers unknown where it cannot
prove absence: the daemon adapter off-socket, the SSH provider before a
completed listing, the router when any adapter cannot answer, and the
degraded provider rather than fabricating a verdict. `terminal_gone`
requires unanimous proven absence.
Also fixes a real cold-start bug this surfaced: `pty:hasPty` never
awaited the daemon-swap startup promise, though the sibling
`probePtyLiveness` bridge already did, so before the swap the local
provider answered an authoritative false for every daemon-owned id.
Net +27 production lines. The plan behind this predicted -92 on the
strength of deleting the renderer's dead-session reconcile path; that
code is live (`pty-connection.ts` imports it), so nothing was deleted.
Expressing a third value where there were two costs lines, and a
deletion that is not real is not worth manufacturing.
Co-authored-by: Orca <help@stably.ai>
A per-PTY recovery budget running out disposed the whole relay channel,
so one PTY that could not re-prove its delivery aborted every in-flight
filesystem and git request on that host and stalled every sibling pane.
A retry count is not proof of anything, and it certainly is not proof
about the other sessions sharing the channel.
Exhaustion now parks that PTY's delivery. The remote shell keeps
running, its lease stands, and the next relay open reattaches it with a
fresh delivery generation — the parked state is cleared on teardown and
the generation changes on reconnect, so a reconnect recovers it.
The consecutive-attempt ceiling goes away entirely; the per-generation
one is what bounds the retry cost, and the second ceiling only existed
to reach the channel drop sooner.
Tradeoff worth stating: the failing pane used to self-heal within
seconds because the forced reconnect wiped all rejection state, and it
now stays frozen until the next relay open. That is a worse outcome for
that one pane and a much better one for every other session on the host,
and reconnecting is user-reachable.
Co-authored-by: Orca <help@stably.ai>
A refusal that exists and is never passed is indistinguishable from no
refusal, and store-level tests cannot tell the difference — they call the
store directly. Learned from `mayCreate`, which was correct and had no
production caller for several commits.
Co-authored-by: Orca <help@stably.ai>
It was run against an unfixed tree and passed, so it does not prove the
STA-3077 fixes and should not be read as if it does. A clean severed
transport does not reproduce the field conditions — accumulated duplicate
leases, or a source returning needing re-establishment.
It keeps its place as a forward guard: it counts the shells the relay
actually hosts and pins their PIDs, so a later change that grafts a pane
or respawns a shell fails here.
Co-authored-by: Orca <help@stably.ai>
connectPanePty has two near-verbatim reattach blocks — one keyed on the
deferred SSH session, one on the restored session — and only the second
was fixed. The first still checked for expiry and then respawned
unconditionally anyway, so a transport fault there resumed the same agent
session a second time.
Also keep the wire token out of the pane. The main-process bridge only
special-cases expiry, so a source-restore failure crossed IPC as raw
`SSH_SOURCE_RESTORE_REQUIRED: <id>` text and surfaced to the user. It
correctly does not respawn; it just should not read like that.
Co-authored-by: Orca <help@stably.ai>
The `mayCreate` guard was correct and had no production caller, so the
reattach path still went through the creating branches and grafted panes
back. `restoreReattachedPtyRuntime` is that call site — RC3 in the
original diagnosis — and it now refuses to create.
Binding moves ahead of runtime registration, because registering first
would surface a pane the user never opened before the refusal landed. A
refusal leaves the remote shell running and reattachable; a *thrown*
write stays unknown and still registers, so a failed disk write cannot
detach a live pane.
Adds an oracle over the call site itself. The store-level tests all
passed while the fix was inert, because they called the store directly —
only pinning the wiring catches that.
Co-authored-by: Orca <help@stably.ai>
Counts the shells the relay actually hosts, on the container, rather
than inferring them from app state — that is the census the report was
based on. Asserts the PIDs are unchanged, not merely the count, so a
kill-and-respawn cannot pass.
Every pane streams before the transport is severed: an idle pane sends
no recovery checkpoint, so only a live source comes back needing
re-establishment, which is the outcome that used to read as expiry.
Co-authored-by: Orca <help@stably.ai>
`flush()` logs and swallows write errors, so a failed write left these
leases retired in memory while disk still called them attached — and the
pane bindings scrubbed alongside them stayed scrubbed. Use `flushOrThrow`
and restore both the lease states and the affected session partitions
when it throws, reporting nothing retired.
Co-authored-by: Orca <help@stably.ai>
Choosing the newest lease for a pane is wrong whenever a newer lease
exists that no pane is bound to: it retires the lease the pane is
actually attached to, detaching a live terminal instead of healing it.
Two changes. Arbitration now prefers the lease matching the pane's
durable binding, across both the SSH-target and local partitions,
falling back to recency only when no binding names either candidate.
And supersession at upsert time now defers rather than expiring a bound
predecessor. When a lease arrives for a pane that is still bound to a
different PTY, the binding has not caught up yet, so both stay live and
reattach arbitrates once the binding is available.
Co-authored-by: Orca <help@stably.ai>
A thrown empty value exercises the same property — a failure carrying no
usable message is not proof the session is gone — and does not trip the
empty-error-message lint.
Co-authored-by: Orca <help@stably.ai>
Shortening a grace period is the wrong lever. Measuring process time and
gating reclamation on an independent observation are what make one safe,
and they are what deployed systems actually do.
Also records that lifecycle belongs in the attach reply rather than a
delivered event — that is what removes the need for a durable per-consumer
cursor to guarantee an exit is never lost.
Co-authored-by: Orca <help@stably.ai>
A pane that failed to reattach spawned a fresh shell. Because the
restored session id came along, the replacement resumed the same agent
session, and two processes appended to one transcript — reported
repeatedly, up to five concurrent resumes of a single session.
Two defects fed it.
The relay reported a source that merely needed re-establishing as
`SSH_SESSION_EXPIRED`. The shell was still running; only its output
source was gone. Give that outcome its own error so it stops reading as
"the session no longer exists".
The reattach failure handler then treated every error as proof of death.
It checked for expiry and, in the else branch, took the identical
action — so the check bought nothing and a transport fault, a timed-out
call, or a wedged relay all respawned. Respawn now requires proof: an
explicit host expiry or a not-found PTY. Anything else, including an
error we have never seen before, is unresolved, leaves the shell
running, and keeps the binding for a later reattach.
Two existing tests asserted the old behavior. One threw a bare error as
scaffolding to reach the spawn-adoption door; it now throws proof, which
is what it meant. The other pinned the expiry mapping itself, and now
asserts the outcome fails closed *without* being reported as expiry.
Co-authored-by: Orca <help@stably.ai>
Pane-keyed supersession stops new duplicates, but it does nothing for
installs that already carry the ones STA-3077 accumulated — the report
behind this reached 20 live leases across a handful of panes, and every
reconnect fanned out over all of them.
Retire the stale duplicates once per reattach pass, keeping the newest
lease for each pane under a total order so two hosts resolve a tie the
same way. As with supersession, retired leases are marked `expired`
rather than terminated: their remote shells are deliberately left
running, because a lease we chose not to revive is not evidence the
shell died.
The relay-session store stubs gain the new method. Note the gap this
leaves open: those shells keep running and are no longer reachable from
the app, so the "accumulates unused shells" half of the report needs a
visible recovery surface rather than a silent kill.
Co-authored-by: Orca <help@stably.ai>
Properties stated as observable behavior rather than mechanism, so an
oracle written against them survives a change of implementation.
Records the weaker, correct form of the timer rule — a timer may never
be the sole cause of a destructive action — because recovery budgets and
scratch-file age gates are correct code that an absolute ban would
condemn. Also notes which mechanisms are deliberately not required, so
each has to earn its place rather than arrive with an architecture.
Co-authored-by: Orca <help@stably.ai>
Reconnecting an SSH-backed workspace added terminal panes the user never
opened, and the remote host accumulated shells nobody was using — one
report went from 2 to 19 to 20 relay PTYs across three reconnects
(STA-3077).
Two root causes, both in the store.
Reattach could create UI. `persistPtyBinding` has four creating branches
— mint a tab, mint a root leaf, split the root and graft a leaf, mint a
layout. All four are load-bearing for `pty:spawn`, which can beat the
renderer's debounced layout writer, but none of them is appropriate on
reattach, where the pane either already exists or is gone for good. Add
`mayCreate`, defaulting true so the spawn path is untouched; every
creating branch already sets `terminalMembershipChanged`, so refusing is
a check rather than a new code path.
Lease identity had no pane key. `upsertSshRemotePtyLease` matched on
`(targetId, ptyId)` alone, so a pane that re-leased under a new relay id
left its predecessor live with nothing to retire it, and the next
reattach fanned out over both. One pane now keeps at most one live
lease. Superseded leases are marked `expired` rather than terminated:
losing a lease is not proof the shell died, so the remote process is
deliberately left running.
Tests assert observable behavior rather than mechanism, so they stay
valid under any implementation that fixes this.
Co-authored-by: Orca <help@stably.ai>
* Revert "test(ime): restore coverage the composition-ownership change removed (#13168)"
This reverts commit 25a8c517e1.
* Revert "refactor(terminal): return IME composition ownership to xterm (#13128)"
This reverts commit 17b3dff3c4.
* test(ime): keep the architecture-neutral Korean trace coverage
The recorded IBus/fcitx5 and Windows MS-Korean traces from #13168 assert PTY
byte order, not composition ownership, so they still hold once the terminal
composition layer is restored. The mobile accessory-order test pinned the new
handleLiveInputChange signature and does not.
Co-authored-by: Orca <help@stably.ai>
* fix(terminal): keep the macOS Backslash bypass through the revert
The restored native-text forwarder only claims keys for input sources in its
hardcoded CJK allowlist, so third-party IMEs off that list (Qingg, #10896) still
get a raw backslash. #13128 added this bypass as a partial replacement; keep it
rather than trade the open issue back.
Scoped to the bare backslash key. The rest of shouldBypassXtermForMacNativeText
bypassed all unmodified non-ASCII text, which would race the restored forwarder.
Co-authored-by: Orca <help@stably.ai>
* fix(mobile): move the mirror-step ref write out of render
The restored hook assigned runMirrorStepRef during render, which is not
replay-safe — React can discard render work, so the mutation can leak from UI
that never commits. Its only read is inside the held-commit timer, which fires
long after commit, and the ref has a safe default, so an effect is soon enough.
Surfaced by the changed-lines React Doctor gate: the rule postdates this code,
so restoring the file re-introduced it as a new violation.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix tab search host routing and churn
* Fix open-tab search to resolve hosts from worktree when active host unkn
- Use worktree.hostId to resolve execution host instead of defaulting to LOCAL_EXECUTION_HOST_ID
- Correctly populate search results for remote-only worktrees when activeWorkspaceExecutionHostId is null
- Remove automatic focus of terminal tabs after search activation
* Prevent stale tab results when user keeps typing ahead of deferred searc
- useOpenTabSearch now returns {query, results} to track which query the results describe
- Gate tab results on query match so stale results don't appear on user's screen
- Add live region (role=status) for accessibility of tab switch error messages
- Distinguish missing-worktree from missing-page errors in browser page activation
- Improve host resolution to prefer active host when worktree and repo don't specify one
* Re-pin entry to deferred tab results that rank higher
Track whether selection auto-follows the top-ranked result or was
manually positioned. Re-pin entry to tabs when they rank higher,
but preserve manual selection.
* Consolidate browser focus requests and simplify selection state
- Extract requestBrowserFocus to handle queueing + event dispatch atomically
- Simplify omnibox selection tracking with single pinnedOptionId state
- Optimize host resolution in tab search to compute once per query
* Report dead browser workspaces correctly and fold dedupe case by host
Two readiness-checklist fixes for open-tab search:
- Browser page activation checked page/workspace before the worktree, but
deleting a worktree purges its browser workspaces and pages too, so a dead
workspace surfaced as "Browser page no longer exists". Check the worktree
first; routing already maps missing-worktree to the workspace wording.
- Editor-tab/file dedupe compared paths with separator normalization only, so
a Windows worktree offered both "Switch to tab" and "Open file" for the same
path in different case. Fold by the worktree path's syntax via the new
isCaseInsensitiveRuntimeRoot, keeping WSL, POSIX and SSH roots case-sensitive,
and add NFC so a macOS NFD listing matches an editor's composed path.
* Fix tab deduplication and resolve worktree host collisions
- Only editor tabs should suppress file entries; check contentType instead
of relying on path being empty for non-editor tabs.
- Add executionHostId to simulator search results to disambiguate when
the same worktree id exists on multiple execution hosts.
* Focus search inputs for immediate typing
- Autofocus inputs in AutomationListSearchField, SettingsSidebar, and WorktreeParentPickerPopover
- Only autofocus Settings search when opening directly, not via deep-link
- Use modal mode and explicit focus management in popover for proper restoration
- Forward CommandInput ref and add autofocus test coverage
* Restore focus when closing worktree parent picker popover
- Find the nearest focusable ancestor of the anchor row to restore focus
to instead of letting it drop on the detached input element
- Simplify focus assertion in AutomationListSearchField test to verify
actual focus behavior rather than autofocus attribute presence
* fix(ci): stop hourly prune from deleting the just-published release
Hourly prune sorted non-draft releases by createdAt, but nearly every
orca-hourly release shares one createdAt from bulk import. At the retain
cap, stable sort + reverse put the newest release past the window and
immediately deleted it with --cleanup-tag.
Sort by publishedAt (tagName as tie-break) and hard-skip the tag this run
just published so prune cannot self-delete.
* fix(ci): harden hourly prune protect without retain+1 drift
Review found that skipping only in the delete loop under-prunes when sort
is wrong, and excluding TAG before the retain slice would permanently keep
retain+1 releases. Force this run's tag to the front of the sorted list
before slicing so it always has a retain seat and oldest builds still prune.
Also gate prune on publish_live success and warn if TAG still appears stale.
* test(wsl): drive hook-relay reattach bench through real PTY spawn
Follow-up to #13139: stop calling ensureWslHookRelayForReattach from the
benchmark and instead reattach a surviving WSL PTY via main's
registerPtyHandlers path, so a missing or misplaced integration in pty.ts
fails the bench.
* refactor(bench): isolate reattach relay refresh measurement and verify s
- Wrap benchmark in try-finally for reliable cleanup
- Add jiti module graph duplication detection to catch missing pty.ts integration
- Track relay refreshes only during reattach phase to avoid false positives from earlier phases
- Disable agent-status hooks during PTY spawn (reattach path doesn't gate on them)
- Improve error messages and make cleanup safe with optional chaining
* fix(cmd-j): fit large palette on short screens and sync overflow copy
Cap dialog/list height against the viewport so the input, filter chips, and
footer stay visible after the larger Cmd+J shell, and align the English catalog
overflow hint with the multi-primary “scroll or keep typing” wording.
* fix(cmd-j): re-emit section headers for interleaved palette remainder ro
When both open tabs and worktrees overflow their first-screen slice, the
layout interleaves remainder rows. The trailing-section header renders
before the leading remainder, so unlabeled rows read as the wrong section.
Re-emit headers before each remainder with a distinct suffix for React keys.
Refactor type-alias matching into a reusable utility that prefers earliest
match position over declaration order.
* fix(cmd-j): stabilize palette memos and gate heavy builders when closed
P1-a: Move quickActionContext filtering into a useMemo with stable
primitive deps (activeView, activeWorktreeId, sshConnectionStates, etc.)
instead of calling buildQuickActionContext() inline every render — the
fresh object identity defeated the middleItems memo on every keystroke.
P1-b: Guard browserSortedWorktrees, browserPageEntries,
simulatorTabEntries, and workspaceTabEntries on paletteStatusInputsActive
so the always-mounted palette stops rebuilding full open-tab indexes
after every store write while closed.
P2-a: Derive sortedWorktrees from browserSortedWorktrees by filtering
out archived worktrees — both called sortWorktreesSmart with identical
deps, so one sort + filter replaces two.
P2-b: Pre-index agent metadata by tabId once per build via
buildAgentMetadataTabIndex, replacing the O(tabs × map entries) scan in
collectAgentMetadataForTerminal with O(1) lookups per tab.
P2-e: Assert in the interleaved test that rendered selectable row order
matches orderMultiPrimaryPaletteItems, keeping listEntries and the
layout function as a single source of truth.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* Allow automation deletion without SSH connection
Remove external source entries from the list and only show jobs.
This allows users to delete and manage automations even when the
remote host is not connected.
* Update test: list jobs from unavailable automation manager
Remove availability constraints (status, error, canManage) from test to
verify jobs can be listed regardless of manager connection state.
* fix(terminal): repair stale-dpr WebGL canvas backing on reveal and fit
When devicePixelRatio changes while a pane is hidden (window moved between
retina and non-retina displays, worktree then revealed), xterm's WebGL
renderer re-measures cell dimensions but its canvas keeps the old backing
store — the addon's device-pixel observer misses changes that land while the
element has no box. The browser composites the stale-scale bitmap into the
css box: half/double-size or smeared text until a manual resize. Reproduced
deterministically (2160px backing behind a 1080px css box at dpr 1) — this is
the mechanism behind the field reports of a normal pane going blurry after
switching back to a worktree.
A repair check now runs on every successful fit (via the fit-success hook)
and on the light tab-resume path (which never fits): when the canvas backing
diverges from cssWidth x devicePixelRatio beyond rounding tolerance, it
replays xterm's own dpr + resize path to rebuild the backing at the current
scale, then refreshes. Verified live: the same break sequence now self-heals
on reveal with no user action. A webgl-canvas-dpr-repair diagnostic records
each repair with the stale and expected backing widths.
* fix(terminal): keep dpr repair off the layout path
* fix(native-chat): resolve WSL Codex transcripts so Chat UI renders responses
Codex reports a guest Linux transcript path. On a Windows host `existsSync` resolved it against the current drive (`C:\home\...`) and discarded it, and the id-based fallback only searched host roots. `resolveSessionFilePath` returned null forever while the watcher reported `watching: true`, leaving Chat UI permanently empty.
Translate the guest path to its host-readable UNC twin, classifying **before** any `existsSync` probe on win32 so the `C:\home` false positive cannot fire. Adapted from #10639 with one required correction: it uses the **async cached** WSL seams (`listWslDistrosAsync` / `getWslHomeAsync`) rather than the `execFileSync` ones, which would stall the Electron main thread for up to 5s per tick of the resolve-poll loop on a cold distro.
Fixes#10326
Co-authored-by: Orca <help@stably.ai>
* fix(native-chat): stop the WSL transcript probe firing every poll tick
Three follow-ups from review of the WSL Codex transcript fix:
- The UNC translation was retried on every fast resolve-poll tick (measured 10
sync UNC stats per 100ms) because only a successful result was memoized. Gate
the retry to the slow fallback cadence.
- A non-empty WSL home list was cached for the process lifetime, so a distro
that was still booting during the first probe stayed excluded forever. Expire
both branches; getWslHomeAsync caches successes, so a refresh only re-spawns
wsl.exe for the distros that actually failed.
- codexSessionsDirs enumerated every distro's home eagerly, waking distros the
user left stopped even for native-Windows panes. Make the WSL roots a lazy
tier consulted only after the host's own Codex roots miss.
The resolve-poll suite became platform-dependent and only passed off Windows;
pin the platform and add explicit win32 coverage.
---------
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: OrcaWin <alpha-eng@stably.ai>
`mapTerminalFilePath` derived the WSL distro only from the *shape* of `worktreePath`. A worktree on a native Windows drive whose project runs under the WSL runtime gets a shell whose paths are POSIX, so no distro was found, the path went verbatim to a Win32 stat probe, and the candidate was dropped — no underline, no tooltip, inert Ctrl+click.
Resolve the pane's distro from the execution runtime, falling back to the old worktree-shape derivation so existing behaviour is unchanged. Note the half of #8156 covered by merged #8215 (worktree on the WSL filesystem) was already fixed; this closes the remaining gap.
Fixes#8156
Co-authored-by: Orca <help@stably.ai>
NeilandOrca
Jinjing
Brennan Benson
Jinwoo HongandJinwoo-H
github-actions[bot]
