- When the Orca account goes from active/expiring to expired/revoked, every running Orca Cloud
Claude/Codex pane shows the strip (same component, place, height as #315): 'Your Claude sign-in
expired' / 'Renew to keep working. Your conversation is kept.' / Renew (compact: 'Claude sign-in
expired' + Renew). The process keeps running; nothing is parsed from terminal output.
- One Renew clears state 1 everywhere; the panes that showed it move to state 2: 'Claude sign-in
renewed' / 'Restart Claude to pick up where you left off.' (or 'Starts a new conversation.') /
Restart Claude / Dismiss. Restart reuses the account-restart path (queuePaneAccountRestarts), which
resumes the pane's own session. Never automatic; a turn that ends cleanly after the renewal clears it.
- Kill switch / never offered: nothing new on a running pane. A held launch keeps #315's strip.
- Account reads while a running cloud agent pane is mounted: on window focus and at most once a
minute (one timer per window).
- #315 P2: the strip is a pane-top banner (useReservePaneTopSpace), so the terminal refits below it
and no row is covered; a spacer keeps it under a chromeless pane's title-row buttons.
- Spec: terminal starts below the strip and its last row stays visible (held and running); state 2's
Dismiss sits a full title row below the pane's ×. Removes the debug screenshot left in #315's spec
and polls the resize assertion (it raced the layout).
From the m4air real-app shots:
- The width class was frozen at mount, so a pane narrowed after mount collapsed the text to 'Y.'/'S.'.
The strip now lays itself out from its own width (ResizeObserver): wide / narrow / tiny, plus a
compact class below 360 px with one line ('Claude sign-in expired') and Renew; the detail stays the
region's aria-describedby and tooltip. Height stays 56 px.
- The strip sat under the pane's split and close buttons. CloudStripLayer (shared by the pane and the
fixture) starts it below the pane title row (--orca-pane-title-height), and the renew strip drops
its own × (Renew is the action; Escape still cancels).
Specs: resize after mount keeps the title readable at 520 and 320 px; the pane's split and close
buttons are hit-testable above the strip in three states.
- interrupted-turn-continue reads its delivery helpers at call time: the cloud workspace store
imports it, so launch-agent-picker-prompt.test's partial paste mock failed at module load
- plugin-shot-editor test marks its temp cwd as a repo root so the default shots dir (which walks up
to the nearest plugin folder / repo root) can't be redirected by anything above the shared temp dir
A single 401 on an Orca-account request no longer revokes the person's Claude account everywhere. The hook only fires after the real credential was swapped in and sent. The control plane then makes one free auth check with the real token (Anthropic count_tokens, oauth beta) and revokes only on a definite authentication_error; anything else (passes, 429, 5xx, other 401 types, network) keeps the account. Checks are rate-limited to one per person and agent per minute (agent_credentials.checked_at), and every keep/revoke is audited (agent_credential_audit, migration 0047). Codex keeps its lease-refresh path.
renderAccountsSettingsSection now takes additionalParts ({ id, title, description, content }) and
titles each with AgentAccountsSubsection. When the page has more than one part, a jump row under the
description links to each one ('This computer · …'); a link scrolls the settings pane to the part and
moves focus to its heading.
Drops the separate cloud 'agent-accounts' settings entry. The upstream 'accounts' page (now
Agent accounts) gets Hosts (S3) and Orca Cloud (S0) through renderAccountsSettingsSection's
additionalSections; deep links move to pane 'accounts' with sectionId orca-cloud / accounts-hosts.
In Orca Cloud builds the entry loses its Optional badge and gains the cloud search entries.
AI provider accounts becomes Agent accounts: a page whose first part is This computer (or the
selected host), holding the existing provider accounts, switching and usage. renderAccountsSettingsSection
takes additionalSections so other parts can be added below it with AgentAccountsSubsection. The
section id stays 'accounts', so every deep link keeps working.
The Settings nav, its group labels and the matching section titles move to sentence case
(Orca account, Computer use, SSH hosts, ...). In-app, CLI and docs references to
'AI Provider Accounts' now say 'Agent accounts'.
- S3 host column: the name keeps a 6rem minimum so 'Orca Cloud' never truncates; the muted detail
gives way first.
- 'Needs attention · 0' shows 'Nothing needs attention.' instead of a header-only table.
- An expired Orca Cloud row offers Renew plus a ⋯ with Remove…, which confirms like the active row
(shared RemoveConfirmRow).
- 'Renew' everywhere for an expired account: the build-sheet row no longer says 'Sign in again'.
- The not-set-up Claude row offers 'Paste a token instead' (S0's existing paste path) under its detail.
Fixtures: OrcaCloudAccounts:expiredRemoveConfirm, AgentAccountsPane:nothingNeedsAttention.
A sandbox destroyed out of band (the team list's Delete for a workspace
this desktop doesn't run, or the control plane) left its runtime record,
server and project here. After a restart its clone came back as a stray
folder project with a "Couldn't start" row.
The team filing's list now runs at startup and every 10 minutes too, and
hands each successful list to a prune. A record filed under that team
that the list omits is retired only on proof: a second consecutive list
without it, or GET /v1/sandboxes/:id answering not found or destroyed.
Errors, offline, a team switch while confirming, a create in flight, or
another or unknown team's record never retire anything, and asleep
(suspended/archived) sandboxes stay listed so they are never touched.
Retiring follows the app's own delete: the record is cleaned and its
server released and retired, and the window's catalog refresh purges the
host's project and setup.
The team and per-member concurrency counts (billing's checkStart input and the guardrail backstop)
counted 'suspending' rows, which drain for up to 5 min after someone chose Sleep and read as
asleep everywhere, and 'creating' rows whose Worker was cut off (until the cron released them).
Both could refuse a start that the user's view says fits. The global capacity cap still counts them.
A team switch hid the old team's sandboxes from every list, but the main
pane kept showing the one that was open. When the active workspace's host
goes from in-team to out of scope (team or account switch), clear the
active workspace as a host removal does; its terminals stay, since the
sandbox is still the old team's. Only that edge counts, so a launch whose
team or runtimes are still loading keeps a restored cloud workspace.
orcad's process env and its cached login-shell capture are frozen at sandbox start, while the control plane updates the session env live (tmpfs file). A Claude account signed in after the workspace started reached shells (profile hook) but not chat agents or PTYs orcad spawns itself: no CLAUDE_CODE_OAUTH_TOKEN placeholder, ORCA_SESSION_ENV_NAMES empty, Not logged in. Structured agent launches and the PTY daemon now lay the current file over their env (same name rules as the hook) and drop names the live env removed; a launch's explicit deletions still win.
Neil
Neil