* fix(terminal): render the covered row tail inside the IME preedit overlay
Closes#12545.
Composing mid-line hid the character at the cursor for the whole composition.
The preedit overlay is an opaque box anchored to the cursor cell, and nothing
reaches the pty while composing, so those cells still held their characters —
the box simply covered them.
`CompositionHelper` now draws the rest of the row after the preedit inside the
view, so the composition reads as inserted text pushing the tail right. Four
details come with it:
- The view is start-anchored while it carries a tail, so the preedit stays put
and the pushed tail clips at the right edge; alone, `rtl` still keeps a long
preedit's end in view.
- It is themed from `options.theme` instead of the stock `#000`/`#FFF`, with any
alpha dropped — the view masks the cells it draws over, so a see-through
background would re-expose the very characters the tail stands in for.
- The helper textarea syncs to the preedit's own bounds, so IME candidate
dialogs anchor to the composing text rather than past the rendered tail.
- A TUI can repaint the row under an open composition, so
`updateCompositionElements` — which already runs on every render — re-reads
the remainder and re-renders on change. A string compare adds no layout read.
The tail is read with an explicit end column: the cacheable form of
`translateToString` arms the line string cache's self-renewing idle-clear timer,
and the composition path must own no timers.
Geometry is not the cause. Two mature reference terminal implementations compose
marked text into the grid rather than into a floating box, and both still blank
the cells under it — one of them literally substitutes the marked characters
into the row's character array before rasterizing. Moving off the overlay would
not have fixed this report; rendering the covered tail is what does.
The e2e arm asserts the invariant an opaque overlay owes the grid: it must
render every committed cell its bounding rect covers. That is measured from the
real rect against the real cell grid, so it fails on the unfixed build with
`covers "하" / renders "가"`.
Known limitation: the rendered tail is plain-styled while composing (theme
foreground on theme background, no per-cell colors); colors return on commit.
This is inherent to the overlay, and drawing the preedit into the cell renderer
instead would be a far larger change.
Co-authored-by: rayim <rayim@fxy.global>
* test(e2e): assert the occlusion invariant, not the runner's cell width
CI covered four columns where this machine covers two — 34.4px over an 8.43px
grid against 12.3px over an 8px grid — so pinning the covered text verbatim
pinned the font metrics rather than the behaviour. Assert instead that every
committed cell the overlay covers appears in what it draws, which is the actual
invariant and holds at any cell width.
Still fails against main: covers "하" / renders "가".
* fix(terminal): keep the rendered tail's spacing on the grid
The composition view is white-space: nowrap, which collapses runs of spaces
exactly like normal — it only suppresses wrapping. So a committed tail carrying
padding drew its trailing glyph cells left of where the grid has them: measured
in Chromium with xterm's own rule, twenty spaces plus a border rendered two
cells wide instead of twenty-one.
The visible case is Orca's most common IME context — composing inside an agent
TUI input box, where the row is a prompt, padding, then a real border glyph the
trim cannot drop. A stray border appeared a cell after the preedit while the
real one stayed put.
xterm sets white-space: pre on its grid rows for this reason; the view was only
nowrap-safe while it held preedit text alone.
The existing fixtures are all space-free, and the e2e invariant is that the
overlay renders everything it covers — collapsing makes it cover less, so both
stayed green. Pinned with a padded-row fixture.
---------
Co-authored-by: rayim <rayim@fxy.global>
* fix(github): fail closed when the SSH git provider is gone
getCurrentHeadOid and probeTrackedUpstreamBranches only routed through the
SSH provider when one was registered. With connectionId set but the provider
unregistered (dropped connection, not yet reattached) they fell through to
client-side git with cwd pointing at the remote repoPath — on a machine with
a same-named local path that silently answers for the wrong repository.
getCurrentHeadOid feeds shouldHideMergedImplicitPR, so a wrong OID changes
which PR the UI attributes to a worktree.
Both now take their existing unknown path (null / probeFailed) instead,
matching repo-default-branch.ts. Local and WSL routing is unchanged.
* fix(github): preserve PR state when SSH probes fail
* fix(github): keep failed SSH discovery unverifiable
* fix(github): propagate SSH identity failures
* fix(github): scope verified SSH identity probes
* test(github): preserve tolerant resolver calls
* fix(github): preserve indeterminate auth discovery
* fix(github): isolate SSH repository probe generations
* test(github): expose SSH probe generation in mocks
* fix(ssh): stop reporting a confirmed kill when the SSH provider is gone
A detached relay PTY is designed to outlive the provider that addressed it
(it ignores SIGHUP and ships with an unlimited grace), so "the SSH provider
is no longer registered" is lost contact, never evidence the remote process
stopped. Both stop primitives in the PTY controller returned `true` from
that branch, and every caller downstream reported the fabricated success:
the CLI printed "PTY killed.", worker-stop settled the dispatch as stopped,
and — because the stop "succeeded" — the unstopped-PTY gate never ran, so
worktree removal walked straight past a live remote agent.
`kill`/`stopAndWait` now still tombstone the local lease but report an
unconfirmed stop and record why, using the three-verdict vocabulary the
worktree teardown gate already spoke (`live` / `unverifiable` / `exited`),
promoted out of that module into `src/shared/pty-liveness-verdict.ts`.
The close receipt, the CLI wording, worker-stop and the removal gate all
read that verdict instead of inferring an exit from silence.
The same rule fixes the mirror-image defect: the aggregate inventory only
enumerates registered providers, so a dropped relay clears `connected` for
every remote PTY at once. The sweep now separates the provider answering
"absent" (an exit) from no provider being able to answer (lost contact), so
worker-stop stops claiming `exited` from a disconnect.
The `connected` wire field is unchanged in meaning and shape.
* fix(orchestration): apply the same honesty to the federation stop path
The federation host runs its own copy of the worker observation and stop
logic, with the same two defects: `inspectRemoteAttachment` read a dropped
relay's `connected: false` as `exited`, and `federationStop` settled the
dispatch as stopped from a close it never confirmed — relaying a fabricated
success all the way home to the coordinator.
Two guards also had to move so the honest verdict does not become a new
refusal. `federationRead` gated on `status !== 'running'`, which would have
rejected a connected terminal the moment a stop lost contact with it; it now
gates on `status === 'exited'`, which is equivalent for every pre-existing
status given the two guards beside it. Local `workerStop` likewise still
attempts the close when the verdict is `unverifiable` — losing contact is a
reason to report the outcome honestly, never a reason to stop trying.
The show observations now carry the reason alongside the status, so a bare
`unverifiable` is actionable. Both are new optional fields.
* fix(ssh): preserve unconfirmed stop verdicts across consumers
* fix(ssh): use canonical live verdict wording
* fix(ssh): refuse wrong-host teardown verification
* test(orchestration): confirm worker release teardown
* fix(orchestration): negotiate honest worker stop receipts
* fix(agent-teams): fence uncertain teammate respawns
* fix(ssh): avoid duplicate missing-provider teardown
* fix(orchestration): preserve archives across release retries
* fix(ssh): preserve verdicts across synthetic kill exits
* fix(ssh): preserve liveness evidence across teardown
* fix(agent-teams): replace panes only after confirmed stop
* fix(ssh): distinguish host exits from relay loss
* fix(ssh): narrow concurrent inventory verdicts
* fix(orchestration): serve archives after uncertain release
* fix(orchestration): expose unverifiable read liveness
* test(ssh): align liveness assertions with verdicts
* fix(ssh): preserve host scope across inventory failures
Descendants of pinned parents now appear in the Pinned section without individual pins. When an ancestor's pin state changes, reveal the active descendant to maintain focus and visibility.
* reland: portable startup-shell dialect, with the two revert causes fixed
Relands #14863 (reverted by #14975) with fixes for both regressions the
revert cited.
1. History GC deleted folder-workspace shell history. The live set was built
from `getAllWorktreeMeta()` alone, but a folder workspace's PTY carries
`folder:<id>` as its worktree id, so every live folder workspace looked
orphaned. `getKnownWorktreeIdsForHistoryGc` now unions in
`getFolderWorkspaces()`. Both consumers — the history-directory prune and
the fish-history sweep — read that one set, so the fix covers bash, zsh and
fish history alike. The directory prune had this gap since #1524; #14863
only widened its blast radius to fish files.
2. A copied Codex resume command aborted under `set -u`. Its leading clear
statement has to test `$fish_pid`, and that unbound expansion takes the
whole line — including the agent launch — down with it. Copied text runs in
a shell Orca never spawned, so nothing can seed that variable first. The
removal now rides on the agent itself as `env -u`, which needs no shell
syntax and no expansion. Verified byte-identical under `set -u` in sh,
bash, zsh, dash, ksh and fish.
`env` cannot run the `cd` builtin, and a child `cd` would not move the
agent, so the prefix is placed on the agent rather than on the whole
`cd … && agent` chain. cmd and PowerShell have no nounset hazard and keep
their clear ahead of the `cd`, which preserves `cd … && agent` — a failed
`cd` still cannot launch the agent in the wrong directory.
* fix(history-gc): stop three more paths from deleting live shell history
Found by adversarial review of the reland. All three are the same class as
the bug that caused the revert: a live set that is missing a category of
real workspace, so the GC reads it as orphaned.
1. Profiles. The history root is `userData/terminal-history`, which has no
profile segment, but the Store the GC consults is per-profile. So after a
profile switch the live set condemned every other profile's history — and
fish history, which lands in the user's own fish data dir, is shared by
every profile on the machine. The live set now unions in the inactive
profiles' worktrees and folder workspaces, read from their data files. A
profile whose ids cannot be read reports the empty set rather than one
that condemns real history.
2. No empty-set guard on the tree scan. `sweepOrphanedFishHistoryFiles`
refuses an empty live set because it cannot be told apart from a store
that failed to hydrate; the directory scan, which deletes more, had no
such guard. A store that fell back to default state would have taken
every worktree's bash and zsh history with it, across all roots including
WSL. Four existing tests passed `new Set()` and relied on "empty means
everything is orphaned" — exactly the behavior being removed — so they
now pass a real live set.
3. Relay fish history. The relay isolates its history tree under its own
root but wrote fish history into the shared fish data dir under the
desktop naming, keyed by the CLIENT's worktree ids. On a machine running
both Orca and a relay host, the desktop sweep deleted remote sessions'
history once it went stale. Relay files are now `orca_relay_<hash>`,
which the sweep's pattern deliberately does not match; the relay still
deletes them by exact name when the worktree goes away.
* fix(resume): enforce the env-removal invariants instead of documenting them
Both found by adversarial review; both were unreachable from today's callers
and silent if reached, which is exactly how they would survive to a caller
that does reach them.
- A pinned CODEX_HOME and the removal named the same variable, and `env -u`
strips what the assignment just set — so the agent would have resumed
against the real home and not found the session. The removal list now
excludes any name the prefix pins, keeping the assignment authoritative as
the old `clear…; CODEX_HOME=x agent` ordering did. Same fix in the git-bash
twin. The PowerShell branch already clears before it assigns, so it was
never affected.
- Placement was keyed on the platform while the grammar it selects is keyed
on the shell, so `platform: 'linux'` with `shell: 'powershell'` emitted
POSIX `env -u` into a PowerShell line. PowerShell now routes to the
PowerShell builder whatever the host, and the POSIX/cmd split below asks
the shell rather than the platform.
* fix(skills): keep an unanswered skill root's last known skills instead of reporting none
An aborted or shed root scan degraded to `{skills: [], unavailable: true}`. Every
consumer derives "installed" from the skill list, so an unreadable root read as
proof the skill was gone and an already-installed skill offered Install again.
- discovery: retain the last answered scan per root (5 min, LRU-bounded, dropped
on install/update invalidation and when a root answers as absent) and serve it
when a later scan goes unavailable.
- source inventory: an unanswered root reports `exists: true`, so check
`skippedReason` first rather than presenting it as a successful scan.
- useInstalledAgentSkills: when an in-scope root did not answer and the skill was
not found, say the status may be incomplete instead of a bare "Not installed".
* fix(skills): do not let install verification accept an unanswered root's retained scan
Retention makes discovery serve a stalled root's last completed scan, which is the
state before an install wrote. Verification read that as proof, so reinstalling a
skill into a root that stalled could report success without reading what it wrote —
turning a retryable false negative into a false positive.
A match now counts only when a root that actually answered reached the skill, so a
symlinked placement co-owned by a healthy root still verifies.
The chord held for a live composition waits with `fallbackMs: null`, so nothing
but compositionend can end it. `sendTerminalInputAfterComposition` returned
void, so nobody could stop it either: the two listeners it puts on the terminal
element outlived the pane, and a later composition on that element flushed the
stale chord.
Return a disposer from the helper and put a sender in front of it that owns
every pending chord, so blur and pane teardown drop them the way the Enter path
already clears its state. The sender also bounds the wait — generous enough for
a conversion candidate window, and it discards rather than sends, because a
chord arriving mid-preedit is the corruption the wait exists to prevent.
The Enter path needs none of this: its 200 ms fallback always runs, so its
listeners cannot outlive it. Pinned so that stays true.
Fixes STA-4476
* refactor: split db.ts under 400 lines
* rm plan
* fix(orchestration-db): add safety guards to database operations
Add status guards to UPDATE statements to prevent late operations from
overwriting changes made by concurrent requests. Validate mutation results
to surface silent no-ops. Extract circuit-break threshold, add transaction
wrapping, and sanitize untrusted input. Bump schema version to v28.
* Add transactional safety to dispatch and message operations
Wrap dispatch failures and batched message updates with SAVEPOINTs to
ensure atomicity and idempotency:
- Dispatch failures now check status guards and roll back if the
related task update fails, preventing partial state corruption
- Message batches (across multiple 500-id chunks) roll back entirely
if any batch fails, avoiding partial mutations
- Add tests verifying idempotency and atomicity under failure conditions
* Handle concurrent writes and improve transactional safety
- Remote question answering: add classification check before and after UPDATE to safely detect concurrent modifications. Prevents false success when the UPDATE loses a race.
- Transaction rollback: wrap in try-catch to prevent errors from masking the original failure.
- Question thread reset: use status update instead of deletion to preserve message references.
* test: add answer replay and race condition edge case coverage
Add test cases for answer replay idempotency, conflict detection, and a race condition between concurrent answer updates in federation relay. Also verify local question state transitions during orchestration reset.
The reviewing agent died with this uncommitted while implementing the P1 fix
for probePtyLiveness returning false for PTYs absent from both liveness sets.
Introduces ssh-pty-liveness-state.ts. Not reviewed, not verified, not complete.
Track a PTY whose verification lost transport without classifying it live or exited. Keep provider routing ownership, but return null through the existing tri-state liveness probe until a later inventory or exit supplies evidence.
Distinguish host-confirmed live delivery failure from a transport loss during verification. Preserve the detached lease and pane binding for both, but reserve provider live state and live-session copy for an observed host response.
A first restore-required response proves the remote PTY is live. If the bounded fresh-delivery attach then loses transport, retain the PTY and renderer binding; only authoritative absence or an observed exit may allow replacement.
Surface repeated output-delivery recovery failure without retiring the remote lease or cold-starting a duplicate agent. Keep renderer retry authority bounded and explain that the remote session remains live.
Treat restoreRequired as a delivery condition, retry one fresh attach, and keep the remote lease detached after repeated delivery failure. Preserve exited classification only for authoritative PTY absence, humanize the live-session recovery path, and pin the invariant in the reliability gate.
* fix(browser): keep cookie-import warnings readable from newer hosts
The import summary is cast, not decoded, coming off the runtime RPC wire, so a
newer host can publish a warning code or undecryptable reason this build has
never seen. Both switches then matched nothing and returned undefined, which
rendered as a blank toast.warning(undefined).
#14683 replaced the absorbing default: arm with case 'unknown' to satisfy
switch-exhaustiveness-check, which forbids default: on an exhaustive switch.
Guard before each switch instead: narrow the wire value against the handled set
and route anything else to a generic message. The handled sets are keyed by the
unions themselves, so a fourth member still fails typecheck here.
* fix(browser): reject non-string cookie-import warning discriminants
Object.hasOwn coerces its key, so the membership guards admitted any value whose
toString() matched a handled variant. A host that widened reason to an array
sends ['unknown'], which passed the guard and then fell straight back out of the
switch -- the same undefined-to-toast.warning blank the guards exist to prevent.
Take unknown and check typeof first, matching isTopLevelView and isTuiAgent. The
Record membership sets still fail typecheck on a new union member.
* Remap SSH leases per execution host, not globally
SSH lease leaf IDs are now remapped within their execution host partition, preventing silently empty tabs when the same tab name exists on multiple machines after restart. Also preserve folder workspace paths exactly as provided without trimming whitespace.
* rm review file
---------
Co-authored-by: m4air <m4air@m4airs-Air.localdomain>
* feat(terminal): report execution host and listing scope in terminal list
`orca terminal list` returned rows with no host identity and no statement
of what the listing covered, so a scoped listing that saw nothing read as
"nothing exists anywhere" — an agent reported a live remote worker dead.
Each row now carries an optional `executionHostId` derived from the PTY id
(SSH and paired-runtime ids embed their owner), and the result carries an
optional `hostScope` naming the hosts covered and the known hosts skipped.
Both are surfaced in `--json` and in the human-readable CLI output, where
an absent field renders as `unknown` rather than `local`.
Both row builders route through one resolver, so the rule lives in one place.
* fix(terminal): preserve unverifiable host scope
* fix(terminal): fail closed on unverifiable hosts
* test(terminal): name unverifiable scope explicitly
* perf(terminal): keep graph hydration host scans narrow
* fix(terminal): reject blank foreign host owners
* fix(terminal): validate inferred inventory hosts
* fix(terminal): preserve paired folder host scope
* fix(terminal): keep inventory host inference typed
* fix(terminal): disclose paired folder hosts
detectRepoFileIcon fell back to a LOCAL read whenever the SSH filesystem
provider was absent, so a disconnected/not-yet-reattached remote repo whose
path also exists on the client picked up the wrong repository's icon. Thread
the connection identity through and fail closed, matching the rule already
stated in connection-context.ts and repo-default-branch.ts.
The managed hook command embedded a bare $SYSTEMROOT. Grok loads Claude's
settings.json hooks and statically prechecks env vars across the whole command
string, so the reference inside the never-taken Windows branch made it refuse
the hook on macOS on every event:
hook not executed: required env var(s) not set: ${SYSTEMROOT}
Grok fails these open, and Orca installs Grok's native hook separately, so no
status was lost -- the symptom is a swallowed failure line per tool call.
$VAR and ${VAR-} expand identically in POSIX shells absent set -u, so this has
no execution-time effect; only the static precheck observes it. Verified in Git
Bash on Windows that both guard forms resolve identically ($SYSTEMROOT is set
there and uppercase is the correct spelling -- $SystemRoot is undefined).
Also converts the three bare $HOME references so the regression test can assert
zero bare variable references with no exemption. A $SYSTEMROOT-specific check
would not have caught this class of bug being introduced elsewhere.
* refactor: split PullRequestPage.tsx under 400 lines
Move the 5888-line PR page into nested domain modules under
src/renderer/src/components/pull-request-page/ and leave a thin public
barrel. No intentional behavior change.
* rm plan
* Improve React stability and remove manual ref caching
- Stabilize React keys in CheckDetailsPanel using content fields instead of array indices to prevent unnecessary remounting
- Remove manual ref-based entries cache in PRFilesCombinedDiffViewer, rely on useMemo dependency (diffEntrySignature) instead
- Move sectionsRef assignment to useLayoutEffect to avoid render-phase ref writes
- Refactor usePRFileSectionLoader to destructure args for readability
* Improve PR page stability: add error handling and fix race conditions
- Add error handling with user feedback (toast notifications) for comment submission, review comments, diff loading, and file view syncing
- Internationalize hardcoded strings for PR state labels and error messages
- Fix race condition in reviewer submission by using a ref-based guard instead of render-time state
- Fix scroll restoration to avoid overwriting target positions with intermediate clamp values
- Add effectiveRepoId parameter for proper repo context in review operations
- Disable reviewer picker during submission to prevent concurrent requests
* Improve PR page stability: add timeout and stable list keys
- Add 45s timeout for diff loading to prevent indefinite hangs
- Fix React list key generation for annotations/jobs using content-based keys with occurrence tracking
- Refactor scroll position caching to properly handle mid-restore teardown
- Replace interpolated error messages with full locale-specific strings for close/reopen actions
* Fix PR diff viewer cache isolation and list key collisions
- Changed list key generation from string concatenation to JSON serialization to avoid collisions with actual content keys
- Added host-aware scoping to diff view caches so local and remote execution don't share entries
- Optimized virtualizer keys to use lightweight revision counter instead of full serialized signature
* Extract PR file state into entry-scoped hooks
Replace manual state resets with custom hooks that automatically clear section heights and active section when switching PR entries. This prevents state leakage between files and simplifies the diff viewer component. Also validates the active section key exists before passing it to child components.
* Improve PR page error messages, accessibility, and stability
- Show actual error messages from failed operations instead of generic fallbacks
- Add aria attributes for combobox/listbox patterns and proper option identifiers
- Consolidate duplicate label/assignee update logic and fix event listener passive mode
- Memoize GitHub source runtime to prevent stale closure in checks callbacks
- Extract filled state badge tone for reuse and fix workspace attachment type
- Guard textarea shortcuts against concurrent saves and add mention query test
* Add explicit PR file content cache eviction
Extract PRFileContentRequestArgs type and create evictPRFileContentRequest
function to handle cache eviction explicitly. Call eviction on load timeout
so retries fetch fresh content. Adds tests for cache behavior.
* fix(commit-message): keep Windows paths intact in agent command overrides
`tokenizeCustomCommandTemplate` applies POSIX backslash-escape rules on every
platform. On Windows `\` is the path separator, so a native absolute path in an
agent command override is silently destroyed:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
-> C:WindowsSystem32WindowsPowerShellv1.0powershell.exe
which is then reported as not found on PATH. The agent *startup* path already
routes Windows shells to the Windows tokenizer, but the commit-message AI path
still calls the generic tokenizer directly, so overrides, extra CLI args and
custom commands there are all affected.
The tokenizer gains an explicit `'escape' | 'literal'` mode rather than reading
`process.platform`, because the same template can be parsed on one host and
executed on another. `'escape'` stays the default, so POSIX behaviour — where
`foo\ bar` is deliberately one token — is unchanged.
`'literal'` is selected only where the command provably runs on native Windows:
a LOCAL target, on win32, with no WSL distro. A WSL target runs a Linux binary
inside the distro, and a remote target runs on a host whose platform this
process cannot see; both keep POSIX escaping.
Fixes#11375
* test: pin the platform decision for literal-backslash parsing
commandBackslashMode is the only place that reads the platform, so it is where
this can be wrong in the direction that matters — applying Windows rules to a
command that will actually run under a POSIX shell. WSL and remote targets are
pinned explicitly; both were previously untested.
* fix(terminal): inset the grid inside the xterm surface (#13252)
Padding X/Y was applied as start-edge container margin, so the cell grid
stayed flush on the trailing edges and a fractional background opacity
stacked a darker gutter around the viewport. Put the setting on .xterm
so FitAddon insets both axes and the themed background fills the pad.
* fix(terminal): normalize padding before fit
* fix(terminal): align stored and fitted padding
* test(terminal): lock padding before fit
* fix terminal padding opacity compositing
* fix live terminal padding backgrounds
* fix(terminal): preserve source-over alpha blending
* fix(terminal): restore WebGL alpha blending
* test(terminal): complete hidden retention pane fixture
* fix(agent-hooks): make the Windows managed hook survive Claude-hooks-compat consumers
`~/.claude/settings.json` is not read only by Claude Code. Third-party
Claude-hooks-compat layers (cursor-agent, Devin) import the same file and
reimplement hook execution, so Orca's entry has to survive consumers that
support strictly less than the documented schema. Three separate defects
came from assuming otherwise.
1. The entry depended on `args`, which a compat consumer ignores.
`args` is valid Claude Code syntax, but cursor-agent spawns `command`
alone -- so `conhost.exe` ran bare, which opens an interactive console
that never closes. Hook payloads were typed into those stranded shells
(#14815). The entry is now one self-contained `command` string that
depends on nothing optional.
2. `conhost.exe --headless` never relayed anything. It implements the
ConPTY server protocol, not a generic no-window wrapper: it does not
wait for the hosted process and relays neither exit code nor stdout.
Measured directly -- `conhost --headless cmd /c "echo X& exit /b 42"`
yields empty stdout and no exit code, while the replacement returns
both and waits. So every hook was fire-and-forget, and whatever it
printed was discarded. Replaced with `-WindowStyle Hidden`, which
suppresses the window and keeps wait/exit-code/stdout intact.
3. The hook never wrote anything to stdout. Guards exited silently and
curl's output went to nul. Claude Code documents empty stdout as "no
decision", but cursor-agent treats PreToolUse as a permission gate,
fails to parse empty stdout as JSON, and blocks the tool call -- so
every shell command in every cursor-agent session on Windows failed
(#14818). The script now writes `{}` first, on both the Windows and
POSIX branches, which is documented to be identical to writing nothing
for real Claude Code. Gemini and Antigravity already did this.
Defects 2 and 3 are causally linked: `{}` cannot reach any consumer while
conhost is swallowing stdout, so neither fix works without the other.
Also fixed while establishing the contract:
- The launcher's own missing-script fallback returned empty stdout,
reproducing #14818 whenever `~/.orca` was cleaned or an install was
half-finished. It now emits `{}` too.
- PowerShell serializes progress records to stderr as CLIXML when stderr
is redirected; a consumer merging stderr into stdout would see those
bytes before the JSON. Every encoded payload now silences progress.
- `runtime-home-hook-command.ts` built its own launcher without window
suppression -- exactly the drift #14815 asks to prevent. All launcher
construction now goes through `windows-powershell-hook-launcher.ts`, so
the switch list cannot be present in one installer and missing in
another.
- Renamed `usesWindowsHeadlessHook` to `usesWindowsPowerShellLauncher`;
nothing is headless anymore, and the flag selects a launcher.
Testing: the new regression test asserts the effect a consumer observes
-- it runs the exact `command` string from settings.json through both
cmd.exe and Git Bash, across the guard-exit, reached-curl, and
missing-script paths, and parses stdout. Verified it fails when
`conhost --headless` is reintroduced. The previous tests all asserted
installer intent, which is why they passed through all three defects.
* fix(agent-hooks): close hook launcher review gaps
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(agent-status): announce Claude turn complete while background work runs
Lead Stop/StopFailure already ends the turn, but resolveClaudePaneState keeps
the pane working for subagents, background shells, and session crons. That
erases the working→done edge that mints the completion banner: subagent turns
notify late with a stale body, and shells/crons never notify at all.
Stamp turnCompletedAt on the gated lead Stop, announce immediately from that
row, and pair the later all-clear done to the same end time so it cannot
double-fire or collapse consecutive turns onto the pinned stateStartedAt.
Fixes#13245
* fix(agent-status): suppress stamped turn replays
* fix(agent-status): notify paired clients at turn end
* Fix late-paired completion notification arming
* test(agent-status): make the notification-id test fail on the pre-fix ordering
The stored row inherited the helper's default codex agentType while the event
named claude, so agentSnapshotMatchesExplicitTitle dropped it and
freshStoredAgentStatus was undefined — the assertion held under either side of
the `??`. Name the stored row's agent so the pinned working row survives and
the snapshot-first precedence is what the test actually pins.
* Suppress stamped completion tail replays
* Prevent cross-coordinator title replays
* Preserve stamped tails across fallback signals
* Keep remount replay state while sibling lives
* Scope OSC turn stamp preservation
* Forward paired host completion stamps
* Deduplicate paired completion tails
* Bind paired completion tails to their turn
* Preserve paired completion tail ownership
* Keep paired tail replay state across remounts
* Seed paired recovery without replaying completions
* Seed startup replay and release stale fallback dedupe
* fix(notifications): preserve stamped OSC repaints
* fix(notifications): retain paired client turn boundary
* fix notifications module import safety
* chore: keep main integration focused
* fix: preserve completion re-enable boundary
* fix(browser): shadow PermissionStatus state instead of proxying it
Rebased onto main after #14685 landed in the same file. Both changes coexist:
#14685's Firefox gating and narrowed promptPerms are preserved untouched, and
this change replaces only the query-override implementation.
The previous Proxy bound every callable property, which broke three observable
things:
- onchange assignment threw "Illegal invocation" — the native setter received
the proxy rather than the branded target.
- Listeners were delivered with the real target and the NATIVE state, so on a
real permission change event.target.state read 'granted' while the returned
status still read 'prompt'.
- Method reads returned a new bound function each time, so name became
'bound addEventListener', toString lost its name, and identity was unstable.
Separately, the notifications state was captured once as a string, so an
already-returned status went stale after requestPermission updated it.
Shadow only 'state' on the genuine PermissionStatus with a lazy provider. The
object the site holds IS the real one, so identity, brand checks, method
fingerprints and native event delivery survive with nothing to keep in sync.
Verified against real Chromium (Chrome 151) rather than only the vm stand-in,
because the stand-in cannot show whether defineProperty succeeds on a branded
instance: the instance is extensible, the prototype 'state' accessor is
configurable, defineProperty succeeds, instanceof survives, addEventListener
keeps its native name and referential stability, and onchange assignment works.
New tests live in their own file rather than merged into anti-detection.test.ts,
whose harness diverged on main. The fallback test targets 'camera' because
#14685 narrowed the intercepted set, so a name outside it never reaches the
fallback.
* test(browser): cover intercepted PermissionStatus identity
`setx GROK_HOME "C:\path\"` stores `C:\path"` — the CRT turns the `\"` into a
literal quote. That quote unbalanced the trailing-backslash `if` operand, so
cmd aborted grok-hook.cmd with exit 255 before curl and every Grok hook event
failed. A quote elsewhere in the value closed curl's `grokHome=` argument
early, swallowing the `^` continuation and dropping the `payload@-` line.
`"` is illegal in a Windows path, so strip it during the copy.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Brennan Benson
Neilandrayim
Jinjing
Jinwoo Hong
OrcaWinandm4air
hwantage
