* feat(settings): group settings into titled cards so section boundaries are clear
Each settings group now shows its title above its own card, with hairlines
between rows, replacing one shared card where group headers looked like rows.
Adds SettingsGroup; SettingsSection drops its outer card when a pane is built
from groups, and SettingsRow/SearchableSetting mark rows for the dividers.
* fix(settings): use status-warning tokens for the task sources banner
* fix(settings): avoid subtree-restyling :has() spacing and keep orchestration search copy
* fix(settings): keep agent catalog rows mounted when an agent moves from available to installed
* fix(settings): hide groups that search empties and divide rows inside multi-row wrappers
* fix(settings): drop pane-wide :has scans, keep group headers when search empties a card
Ruling D2/E2/S3 on #39253 review: outermost rows own dividers, only an empty
card hides (direct-child selector) so header actions like Remove Project stay,
and panes declare grouped statically. Also restores the whole-header Alt-click
for the release channel, gives App Icon and the Windows admin row stable cards,
and removes wrapper divs that kept emptied cards visible.
* test(settings): Option-clicking the Updates version line reveals the release channel switcher
* test(settings): stub the updater API without a type assertion
* feat(native-chat): add /fork to fork a chat from its latest response
Typing /fork in a native chat now runs the same fork as "Fork from this
response", through the newest response still in context, instead of
passing the text to the agent. It is offered only where the host and
agent can fork, and answers with a composer notice while a response is
still running, before any response exists, while a fork is opening, or
when text follows the command.
* fix(native-chat): keep /fork off the transcript rows' fork surface
* fix(native-chat): read /fork's response from the hook's latest input
* Prepare queue rows to preserve accepted delivery intent
* Keep waiting native chat input in one ordered queue
* Keep a typed view of admitted queue records
* Keep the removed queue caption in the runtime catalog
* Remove the unused queue barrier caption
* Keep queue writes local and preserve accepted send provenance
* Read the sender from the queued admission request
* Keep continuation fixture clock within its operation window
* Remove deleted queue-barrier test from ratchet baseline
* Keep ratchet baseline change scoped to the deleted test
* Filter historical acceptance reads before loading payloads
* Instrument cached acceptance cursor once per fixture
* Restore original personal provenance after legacy card cleanup
* Complete legacy sender fixture metadata
* Narrow admitted history record types
* Reconstruct accepted personal proof after restoring original admissions
* Use the fixed clock for historical queue fixtures
* Consolidate queue source and type imports
* Preserve admission refusals and failed startup ownership
* Keep manual queue holds independent of later turn endings
* Remove obsolete mobile queue barrier expectations
* Keep journal format initialization independent of its decoder
* Assert returned-row recovery for released send clients
* Preserve Stop assertion across handoff-only publication
* Redesign Antigravity chat sign-in settings
Settings rows for method, project and location; one full-size Sign in
button named for the method; a status badge; the chat runtime install
row inside the card; and no save error while Enterprise fields are
still empty.
* Use primitive variants for Antigravity sign-in styling
* Drop Antigravity sign-in strings translated on main after removal
* Announce settled sign-in, keep Change account after a cancelled switch, reset paste form per flow
* fix(agents): workspaces created on a paired host use the host's launch settings
Creating a workspace with agent picks or a draft could launch the paired host's agent with desktop settings, or lose the picks during recovery. Let capable hosts compose those launches from their own settings and preserve the user's inputs through fallback creation. Older hosts retain their existing requests.
* fix(agents): workspaces created on a paired host use the host's launch settings
When a workspace is created on a paired computer, agent picks and Arguments can be replaced by this computer's defaults or dropped during recovery. Keep explicit choices with the submission and let the paired computer resolve its own launch settings.
Preserve older-host request behavior, disabled-agent draft substitution and prompt submission, and restore the composer if compatibility preparation fails.
* fix(agents): workspaces created on a paired host use the host's launch settings
Keep the submitted choices available when a background launch has no prepared startup carrier. Tighten the regression checks for restored composer names, legacy commands and prompt submission so recovery preserves the user's work.
* fix(agents): workspaces created on a paired host use the host's launch settings
Creating a workspace on a paired machine could ignore its agent settings or lose a draft while the terminal connected. Keep the selected launch inputs and the pending text together through fallback and reconnect, and never replay partially written input. Preserve older hosts' launch commands and ordinary new-tab prompts' editable behavior.
* fix(agents): workspaces created on a paired host use the host's launch settings
Keep a workspace's pending prompt attached to its original terminal while the pane reconnects. Stop automatic delivery before reporting a final failure, retain the recoverable text, and recognize a launch handed off to the paired host even before its tab appears. Avoid delaying creation on a redundant host status request.
* fix(agents): workspaces created on a paired host use the host's launch settings
New workspaces on a paired computer could lose their first prompt when the terminal briefly disconnected. Delayed delivery could also continue after reporting failure, or leave terminal-only agents without an accessible copy of their prompt.
Keep pending prompts through attachment loss, stop content writes when automatic delivery ends, and offer the existing composer to recover unsent text. Preserve launch identity without inventing empty Arguments or treating missing metadata as a replacement.
* fix(agents): workspaces created on a paired host use the host's launch settings
A replacement pane can learn its terminal before the layout catches up after reconnecting. Re-registering the effective launch settings then dropped the original first-prompt identity.
Recover that identity from the existing verified terminal binding so later remounts keep the same pending prompt.
* fix(agents): workspaces created on a paired host use the host's launch settings
A terminal binding can identify the launch before its effective Arguments are known. Keep permission notifications working in that state without assuming a launch-settings recipe exists.
* fix(agents): workspaces created on a paired host use the host's launch settings
Keep an unsent prompt attached to its launch when a paired host briefly disappears, so reconnecting the same terminal can finish delivery. Clear the rest of the exited pane's status as before, and release the binding after delivery or a confirmed end.
Offer Copy prompt when automatic delivery finally fails, so the prompt can be pasted into the terminal that already opened. Keep creation-failure Reopen separate.
* fix(agents): preserve paired prompt recovery across transport updates
Resolve the consumed startup token through the pane's verified binding instead of reading renderer ownership during every remote attach. Keep the transport's host-authoritative exit and reconnect behavior and its fixture guards.
Settle pending prompt delivery when the host reconfirms a closed surface, including after it discards the terminal's exit record. Update the remount fixture for the Windows PTY model binding.
* fix(agents): merge duplicate imports flagged by type-aware lint
* test(agents): fix type assertions in paired launch fixtures
Type the repository rows, mutable agent choice and terminal tab used by
launch regressions. Reuse the session binding across its real installers
and document the partial-fixture adapters required by the runtime APIs.
Keep the RPC, remount and prompt-delivery assertions unchanged.
* fix(agents): route workspace terminals through their owning host
Creating a terminal for an existing workspace could send it to another focused server. Resolve its owning host when no explicit route was supplied, and keep the host-shaped draft regression within the shared startup contract so renderer checks do not pull in main-process code.
* test(agents): align launch fixtures with runtime dependencies
Retain real i18n exports while replacing translation output, hoist the terminal restore toast spy, and supply the explicit host environment used by paired terminal callers. Keep the existing behavior assertions unchanged.
* fix(agents): isolate prompt failure notice dependencies
Load the prompt failure notice only when a settled hosted launch needs it,
so workspace recovery consumers do not initialize toast and localized agent
catalogs just by importing delivery code. Keep prompt retirement and its
recoverable draft synchronous, and preserve the existing Copy prompt action.
Restore the ordinary new-tab failure toast's original invocation and verify
that Fix Checks retains its edited request through the activation handoff.
* test(agents): route legacy wire launches to their fixture host
Pass the paired environment explicitly in legacy terminal-creation fixtures,
matching real launch callers instead of relying on the focused host. Keep
all compatibility and accepted-creation assertions unchanged.
* fix(agents): preserve paired work-item completion without a startup plan
Blank-terminal work-item launches on paired hosts now keep their successful activation result. If the agent command cannot be built, show that error once instead of reporting an activation failure.
* refactor(agents): deliver paired creation prompts once like agent tabs
Drop the retained hosted-prompt lifecycle (pending map, rebind, deadline,
terminal retirement, token recovery). After the host creates the session the
desktop attempts the prompt once; failure shows the prompt-not-sent toast with
Copy prompt.
* fix(agents): silence prompt failures after closing a workspace terminal
Closing a paired workspace terminal before the agent was ready could report a prompt failure after that terminal was gone. Use shared launch completion and existing tab records to keep deliberate closes silent while preserving one Copy prompt notice after an interrupted delivery. Prepared launches now decide client delivery from the host request.
* fix(agents): report every failed paired prompt delivery
A paired host can retract its tab from inventory without the user cancelling the launch. Always report a failed prompt attempt with Copy prompt, using the same single-attempt completion as agent tabs.
* test(agents): name host-session fixture mock types
* refactor: place native chat media and link code with defining owners
* refactor: preserve code control copy protection after relocation
* style: format rebased native chat owner imports
* fix(cursor): write workspace trust where cursor-agent reads it
cursor-agent names ~/.cursor/projects/<dir> by replacing every
non-alphanumeric character with '-', collapsing repeats, and trimming
dashes. Orca only replaced Windows-illegal characters, so paths with
'_', '.', spaces or non-ASCII got a marker cursor-agent never reads and
the trust menu appeared on every fresh worktree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(cursor): cover space, non-ASCII and Windows paths in the trust slug test
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
* fix(mobile): finish Android dictation on a call, alarm or leaving the app
A transient audio-focus loss (call, alarm, assistant) left the mic recording
silence, and pausing the activity closed the mic only to reopen it on resume,
splicing a silent gap into the dictation. Both now end the recording and emit
an interruption, so dictation finishes and inserts what was heard. The
dictation hook also finishes when the app goes to the background, which
covers iOS and shells without this native change.
* fix(mobile): keep a dictation that is waiting on the Android mic prompt
* fix(mobile): keep Android recording state consistent across the focus and JS threads
* refactor(mobile): name the Android pause path for what it does and stop retaking focus on resume
* fix(mobile): keep what the open mic heard when leaving during a pending host start
* fix(mobile): close the open mic at once when leaving during a pending host start
* fix(mobile): a second page capture end waits for the stop already in flight
* refactor(backend): use defining owners for orchestration and ACP startup
* test(orchestration): trim redundant observations and retain safety cases
* test(orchestration): seed restored sessions with one fixed operation clock
* fix(mobile): show the phone speech download size and drop a cancelled session's late text
* fix(mobile): show the Android language download size too
* fix(mobile): keep a recognizer error raised while its start resolves, and read the download size aloud
agy has no Full access session mode, so Full access chats always fell back to
Orca's managed runtime, which kept most people off the host's agy (and off
Intel Macs, where only the host can run it). agy 1.5.2+ `agy acp` accepts
--dangerously-skip-permissions, which approves tool requests but not plans.
Host chats now launch with that flag only in Full access, in agy's default
mode. Switching permission mid-chat already restarts the ACP process and
resumes the session, so the flag follows the chat's mode. The flag never
approves plans, and Orca still leaves agy's requests to the person, so plan
approvals keep surfacing.
The cached readiness check launches with the flag, so a build that rejects it
keeps chats on Orca's runtime without an extra spawn; such a binary is not
checked again until it changes. Because ask and Full access both run agy's
default mode, the reported mode is read per launch, so a Full access chat
does not show as Ask.
Refs #39006, #33188
App themes may set background.videoPath: a muted, looping MP4 or WebM (H.264
recommended, VP9 or AV1; one video track, no audio; <= 60 s, 8 MB, 2.3 MP)
played over the required static background.path. Main checks it from container
headers without decoding and serves it on the orca-plugin-image slot
theme-<i>-video; images stay static-only. The renderer reveals it on its first
frame, keeps the still on any failure or a decoded size past the limits, plays
it only while main reports the window focused, shown and not minimized and no
dialog is open, and omits it under prefers-reduced-motion.
Animated WebP was measured and declined: software-decoded every frame, it cost
11-23 points of CPU vs 3-10 for the same loop as video.
Implements #38363 proposed by @dohaidang.
Neil
Brennan Benson
OrcaWinandOrcaWin
buf0-bot[bot]
Kelvin Amoaba