* fix(terminal): a new SSH terminal opened before sign-in waits and starts after sign-in
A terminal created while its managed SSH host is still waiting for a typed
password or passphrase got main's sign-in refusal from terminal.create and
showed it as a fatal error. Signing in later never started it.
Route that refusal into the same parked retry #32275 gave restored panes, so
the post-sign-in control-ready revival replays the create. The pane shows a
'Waiting for SSH sign-in' banner with a Sign in action instead of an error.
* fix(terminal): clear the sign-in wait as soon as sign-in finishes
Publish the sign-in reason through one setter so clearing it always reaches
the banner, and clear it when the control socket proves sign-in finished.
The Sign in button retries only after a successful connect, so a rejected
password cannot re-dial into a second prompt. Share one banner layout.
* fix(terminal): keep a sign-in-waiting spawn pending until the replayed create lands
The pane's spawn finalization (launch config registration, startup delivery)
ran against an undefined result while the create waited for SSH sign-in,
then never saw the terminal the post-sign-in replay made. Keep the original
connect pending and settle it with the replay's result, or with nothing when
the pane is closed, re-attached or a fresh connect supersedes it.
* fix(terminal): a stale replay settles only its own sign-in wait
* fix(terminal): settle a sign-in-waiting spawn at the recovery state, not per replay
Codex and Opus found recoveries that finish outside a create replay (the
stream resubscribe after the create landed, an ownership refresh) and left
the original connect pending. Settle it at the two points every recovery
passes: healthy (with the bound terminal) and idle or disposed (with nothing).
* fix(i18n): clearer Spanish sign-in wait copy
* fix(checks): stop stale-while-revalidate from flashing a stale merged PR
The synchronous fresh-return path guards on `staleMergedHeadRefetch` so a
worktree that advanced off a merged PR's head does not reuse the now-stale
merged review (added in #7277). The stale-while-revalidate fast path was
missing that same guard, so it served the stale merged card synchronously
(and kicked only a background refetch) whenever the parent-PR-checks overview
polled with `{ staleWhileRevalidate: true, currentHeadOid }`.
Result: a worktree that commits new work on top of a merged branch keeps
showing the old "Merged" card instead of going branch-only — persistently
while the background revalidation keeps failing (rate limit / gh error).
Add `!staleMergedHeadRefetch` to the SWR condition so the read revalidates
synchronously, matching the fresh-return path. Adds a regression test that
fails without the guard.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(review): clarify stale review revalidation comments
* fix: avoid reusing hosted review requests from a different head
* fix(checks): track concurrent review lookups by Git head
* fix(hosted-review): narrow per-HEAD request fencing to a join guard
Replace the HEAD-keyed in-flight map with the original single slot per
request key, and skip joining an in-flight lookup only when it was started
for a different known HEAD. Keep the stale-merged guard on the
stale-while-revalidate path and the merged-HEAD guards on the readers.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* fix: back off failed GitLab authentication probes
* fix(gitlab): use short exponential backoff for failed host-discovery probes
Start at 15s and double up to the existing 5-minute negative TTL, and
clear the backoff on auth refresh (rememberGlabKnownHosts), successful
probes and forced preflight resets so recovered auth is seen promptly.
Keeps the positive host cache shape unchanged.
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(keybindings): report conflicts between terminal shortcuts and chords that fire in terminals
Actions that reach a focused terminal now share a conflict bucket, and the
Shortcuts pane judges the bindings as written in the file instead of the
map the loader already stripped.
* fix(keybindings): flag only the ignored binding and say it was ignored
The other claimant keeps its own default and never stopped working, so a
warning on its row blamed an untouched action. Adds the e2e regression that
seeds a conflicting file inside the isolated E2E home.
* test(keybindings): capture the shortcuts pane at each stage of the conflict report
* test(keybindings): assert the untouched action carries no warning
Visibility alone would still pass if a regression warned on both rows.
* fix(keybindings): narrow the ignored-binding guard and tighten its negative test
Review follow-ups:
- Only warn when the file asked for a binding and the loader took it away.
The guard now also requires the action to be absent from the active map,
so an override that survived is never labelled "was ignored".
- The negative case used view.tasks, which has no default binding, so the
conflict assertion passed without exercising the terminal bucket at all.
It now uses worktree.quickOpen and asserts the definition exists, is not
terminal-reachable, and has a non-empty default list.
* fix(keybindings): compare main-process shortcuts against every scope
- List the actions resolveWindowShortcutAction consumes in main and put them in every scope's conflict bucket, so a binding elsewhere on the same chord is reported instead of silently losing it.
- Browser bindings are compared only against the actions a focused guest forwards ahead of browser chords.
- Dictation stays out, since main lets its chord through while voice is off (the default).
- The two digit ranges may still share a modifier.
- Drop the allowInTerminal terminal-bucket rule.
- Explain overrides the loader drops on a later pass.
- Pin the list to the resolver and the guest order with tests.
* fix: report main-intercepted shortcuts in Settings without dropping saved overrides
Main-process interception now only feeds the Settings conflict report.
The loader, write path and web normalization keep main's scope-only check,
so existing keybindings.json overrides load exactly as before.
---------
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(native-chat): show unknown HTML tags as text instead of dropping them
Chat UI renders messages through CommentMarkdown, which parses raw HTML
and then sanitizes it. Sanitize unwraps any tag outside its allowlist,
so prose that mentions a tag lost it: "use a <se-tabs>" rendered as
"use a ".
Add a remark plugin that turns raw HTML containing a non-allowlisted
tag into literal text before sanitize runs. It reads the sanitize
schema's own tag list, so the two cannot drift, and runs before
remark-breaks so newlines inside it still break. Allowed tags
(<sub>, <kbd>, <details>, ...) and inline code are unchanged.
The behaviour is opt-in via a new `unknownHtmlAsText` prop and enabled
only for native chat; GitHub, GitLab, Jira and Linear surfaces keep
matching their host's rendering, which also strips unknown tags.
Fixes#30604
* fix(native-chat): preserve markdown parsing around literal HTML
* fix(native-chat): escape only unknown tags in mixed raw HTML blocks
A raw HTML block that mixes allowed and unknown tags keeps rendering its
allowed tags and comments; only the unknown tags are shown literally.
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(ui): prevent sidebar agent send labels from wrapping
- Keep localized send-target labels on one line inside the fixed-height sidebar control. Add a regression assertion for the nowrap utility.
* fix(ui): reserve space for localized sidebar Send controls
Keep Send labels on one line and size their flex slot to the button. Share remaining task/model space while selecting a send target so longer translations cannot obscure the primary label.
Co-authored-by: hwantage <hwantagexsw2@gmail.com>
* fix(sidebar): keep model badge sizing while Send is in flow
The badge keeps its natural width and only shrinks when the in-flow Send
button would otherwise overflow the row, instead of splitting the row with
the task label.
* fix(sidebar): keep model badge class order unchanged outside send mode
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(linear): tolerate documented Markdown normalization
* fix(linear): preserve fenced Markdown literals
* docs(linear): describe Markdown fence matching
* fix(linear): close nested Markdown fences
* fix(linear): tolerate documented Markdown normalization
* fix(linear): preserve fenced Markdown literals
* docs(linear): describe Markdown fence matching
* fix(linear): close nested Markdown fences
* fix(linear): compare only parsed list marker rewrites
* style(linear): satisfy save confirmation quality gates
* fix(linear): preserve list structure and load parser on demand
* fix(linear): bundle save Markdown comparator for every runtime
The comparator resolved unified/remark at runtime via createRequire, which
orcad's esbuild bundle does not ship. Import them statically from a lazily
imported module so Electron and orcad both inline the parser.
---------
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(agent-status): keep a hook question from a stale program working report
Pi reports no blocked status for ctx.ui.custom() dialogs such as ask_user, so
its OSC 7501 status stays working through the question. The 10-minute lease
renewal re-sent that working, and once the hooks had been silent for two
minutes it replaced the hook row's waiting.
A waiting or blocked hook row now yields to a program working report until
the program enters working after the hook event, mirroring the done/waiting
case.
* fix(agent-status): limit hook-question precedence to working that predates it
Only a program working that began before the hook question is stale; a later working
transition, or one without facet ordering evidence, keeps the existing silence fallback.
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(agent-status): drop Claude teammates stopped with TaskStop from the sidebar
Named background agents run as in-process teammates. TaskStop fires no
lifecycle hook, and their background_tasks entries use ids unrelated to the
lifecycle agent_id, so an idle teammate row was kept as long as any teammate
task remained listed, even after that teammate was stopped.
Remember the description of the lead's Agent call that spawned each teammate
(Claude lists the teammate's background_tasks entry under it), and at a lead
Stop with a complete inventory drop a teammate row whose description is no
longer listed. Rows without that evidence keep the previous behavior.
Fixes#31818
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(agent-status): keep a teammate's spawn description when its spawn result lands first
Hook requests are handled unordered, so the lead's Agent PostToolUse can
arrive before the teammate's SubagentStart. Create the row as idle in that
case so the description is kept; SubagentStart then revives it to working,
and an idle row never gates the pane if the teammate's stop came first.
Moves the spawn recorder into claude-teammate-spawn.ts to keep
claude-events.ts within the file length limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(agent-status): retain teammates with clipped task descriptions
Claude caps background task descriptions and appends a clipping marker. Match that visible prefix conservatively when reconciling a teammate's full spawn description, so an inventory update cannot hide a live teammate. Keep ambiguous descriptions and unknown inventories safe, with coverage through the production hook normalizer.
* fix(agent-status): escape clipping marker in daemon bundle
* fix(agent-status): retire stopped teammates only when the inventory is fully attributable
Claude registers a teammate task under the whitespace-collapsed spawn description, so
compare normalized descriptions. Infer a stop from absence only when every listed
teammate matches a recorded spawn; unknown or differently formatted entries keep rows.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(runtime): keep lastAssistantMessage when demoting idle agent status
Paired clients mirror the mobile/session terminal projection. Demoting a
stale working status under a neutral title dropped lastAssistantMessage, so
remote workspace cards lost the completion subtitle that local cards still
show from the in-process hook row.
Fixes#9914
* Format completion field projection consistently
* Preserve completion classification and bound interrupted verdicts
* Keep completed replies out of new live title intervals
* Restrict retained completion previews to completed title status
* Keep mobile session projection within lint file budget
* fix(runtime): keep only completed-turn replies in demoted mobile status
Mid-turn hook snapshots carry tool stdout as lastAssistantMessage; a shell or idle
title must not surface that as the final reply.
---------
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(settings): show tooltip for truncated shortcut titles in shortcuts pane
- Wrap shortcut title with Radix Tooltip primitives in ShortcutCommandBlock.
- Enable full title visibility on hover when long command names are truncated.
- Add unit test in ShortcutCommandBlock.test.tsx verifying tooltip trigger attachment.
* fix(settings): show shortcut title tooltip only when the title is truncated
Reuse TruncatedSidebarLabel so untruncated titles keep no tooltip (STYLEGUIDE Tooltips).
---------
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(ai-vault): preserve transient panel state
Refs #9418
* fix(ai-vault): synchronize transient panel state
* fix(ai-vault): keep session expansion local to the virtual list
Restore expandedSessionIds inside AiVaultSessionVirtualList so the
history/search resetKey still gives each list fresh expansions; only
scope and collapsed groups are retained across sidebar remounts.
---------
Co-authored-by: just-zzp <264744947+just-zzp@users.noreply.github.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(source-control): preserve section collapse state
* test(source-control): strengthen remount regression
* fix(source-control): preserve section disclosure across panel remounts
Adapt just-zzp's #9405 fix to the current panel modules and existing bounded map, with runtime/host/occupant isolation. Part of #9403; Session History remains separate.
Co-authored-by: just-zzp <264744947+just-zzp@users.noreply.github.com>
* fix(source-control): key retained disclosure by active worktree id
Narrow the remount fix to the existing per-worktree reset: a bounded
renderer-session map keyed by activeWorktreeId restores section disclosure
after the panel unmounts, while a worktree switch still never inherits
another worktree's view.
---------
Co-authored-by: just-zzp <264744947+just-zzp@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* Native chat: never mark a message not delivered after a crash; reopening a chat stops reading the transcript
After a crash or restart, attach read a window of the agent's saved log and marked any
unconfirmed message missing from it as rejected "not delivered". Absence from a log Orca
does not own is not proof: the window's anchor moves every turn (STA-7416) and its text
filters drop tagged prompts (STA-7453), so messages the agent received were marked
undelivered and retyping them duplicated the question. The read also ran on every attach
(STA-7434).
Delete the inference: the provider history window and its adapter hooks (Claude window and
branch proof, OpenCode stored-messages reader), the submission matcher, and the attach step.
A send the crash boundary leaves unconfirmed stays an ordinary sent message; the interrupted
turn still ends through the existing settlement. Explicit live refusals are unchanged.
A queued card whose hand-off a restart left unconfirmed no longer counts as able to return
to the queue, so it stops keeping an idle chat loaded.
* test(native-chat): update restart fixture calls after history removal
* Hide rewind targets without a saved native boundary
* Run rewind boundary regression across host and renderer
* Keep incoming main package-manager lock unchanged
* Test recovered chat consumer outcomes without delivery inference
* Assign the complete cursor in recovered phone regression fixture
* Supply presentation capture in rewind boundary fixture
Main's static lint failed max-lines (303 of 300) on structured-agent-session-adapter.ts after #28051 merged. The adapter's error classes move to structured-agent-session-adapter-errors.ts and are re-exported, so every importer is unchanged.
* fix(ui): allow toast dismissal over modal panels
* test(ui): retain toast stacking and credential boundaries
* Preserve modal state when dismissing stacked toasts
* fix(ui): limit modal toast gate to dialog and sheet overlays
Radix menus and selects also set body pointer-events:none; gating on that
blocked toast clicks from closing an open dropdown.
---------
Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* fix(terminal): hand a host-exit-settled remote pane back when the host binds a new process
After #31968 settles a host-session pane on the host's exit record, a host
restart can bind the new process just after the probe read the old one's exit.
The pane then stayed ended until the tab was reopened. Keep watching the host's
accepted snapshots after that settle; once one publishes a provably different
live process for the pane, remount the tab so it attaches to it.
* fix(terminal): let a new host process reopen recovery after a failed rebind
* fix(terminal): watch for a host rebind only on a leaf-addressed pane
* fix(terminal): catch a host rebind published while the exit probe confirms
* fix(terminal): keep the host-rebind remount under the recovery window cap
The host-scoped port scan reported 'Remote connection dropped' for every
direct-SSH workspace even with a healthy connection: the relay has no port
scan, so the connection was never the problem. Name the real limitation
and point at an Orca server on the host, which scans its own ports.
* fix(native-chat): publish retained history corrections to capable clients
* test(native-chat): expose canonical reads in phone history fixture
* test(native-chat): migrate remaining history reader fixtures
* fix(native-chat): preserve expanded history on late acceptance
* fix(native-chat): share lazy correction metadata by journal source
* fix(native-chat): reuse raw legacy display selections
Move the "Seen in" chip onto the review's meta line as a terminal icon with
a tooltip. Native chat tabs now record PR links their tools print, so the
icon appears for PRs created from chat too.
* Transfer keyboard focus when a sibling chat pane opens
* fix(native-chat): hand focus to newly opened chat composer
* fix(native-chat): keep tab bar controller within line limit
* fix(chat): split into a fresh conversation beside the current chat
* test(chat): declare the split fixture store without an assertion
* fix(chat): route the split to the source conversation host
* test(chat): keep the split regression focused on the launch contract
* test(chat): give the command palette split fixture its conversation agent
* test(chat): seed the legacy command fixture without expanding its asserted shape
* test(chat): isolate pane identity commands from the split launch boundary
* Prevent chat splits from starting a terminal on host refusal
* Cancel structured launches when their destination pane closes
* Model live destination groups in agent launch test fixture
* Capture split chat focus intent at the user action
* feat(chat): add the terminal pane hover action cluster
* fix(chat): keep pane controls above the conversation surface
* refactor(chat): share the tab resume launch hook and format pane controls
* style(chat): document reuse of the terminal header button styles
* refactor(ui): share the pane title button variants between terminals and chats
* fix(chat): keep header actions scoped to the displayed chat
* fix(chat): abandon Resume when its destination pane closes
* test(chat): declare destination fixtures without type assertions
* fix(chat): keep Resume visible when its source pane closes
* fix(chat): reuse tab menu Resume placement unchanged
* test: fix Resume regression harness setup
* feat(chat): match terminal pane split and close context actions
* style(chat): format the pane context menu
* style(chat): format the structured pane command fixture
* test(chat): remove the obsolete tab-movement menu stubs
* Match terminal close-pane menu styling
* fix(chat): share the pane action close label in the body menu
* test(chat): match structured pane action fixture returns
* fix(chat): hand input to the split pane during admission
* fix(chat): Split opens a fresh chat beside the current one
Split Right/Down on a native chat used to move the chat into a new pane.
It now opens an empty pane beside the chat and launches a new chat of the
same agent on the same host into it through the New Chat launch, so the
new composer takes focus at once. A launch that never opens a tab closes
the empty pane. Drops the earlier admission and focus-transfer changes
that main now covers.
* fix(chat): Split palette search words describe a new chat, not a move
* fix: remove misleading chat move shortcut hints
* fix(chat): a new chat stays in its pane until its host lists it
A host tab list built before a chat's create landed can arrive after the
create reply. Once the reply settled the launch, nothing protected the new
tab, so that older list dropped it: Split's new pane collapsed and focus
moved to another chat, and the next list re-added the chat elsewhere.
Keep a small in-memory record for a chat this client created that no host
list has shown yet. While it exists, a list that omits the chat keeps its
tab. The record ends when an accepted list from that host includes the
chat, when the tab closes, on workspace teardown, or 30 seconds after the
reply, when the worktree is re-read from its host (including an unchanged
version) so a chat the host really closed is dropped then. The launch
lifecycle, status, persistence and settlement are unchanged.
* test(chat): type the faked create replies without an assertion
* Keep new chat protection tied to accepted host lists
* Update paired chat close regression to current suppression API
* fix(chat): Portuguese Split palette words describe a new chat
* test(chat): use the destination group option in split fixture
* Avoid History projection in native chat header and currentness checks
* fix(native-chat): keep Find below pane controls
* fix(ui): keep noninteractive tooltip layers pointer-transparent
* fix: derive chat pane menu state inside mounted content
* test: use complete settings fixture for chat menu contract
* ci: refresh chat menu checks after base correction
* ci: refresh chat menu checks after base type fixes
* test(chat): focus retained menu lifetime contract
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
* Observe Claude readiness through the host status
* Keep optional readback behind host readiness
* Recheck launch permission after host readiness
* Preserve the awaited child during permission revalidation
* Await Codex protocol open under host ownership
* Await ACP protocol open in the host
* Derive ACP opening from its protocol session facts
* Exercise unanswered ACP options with an explicit silent route
* Await Pi open and fail signed-out construction
* Read Pi catalog facts from awaited opening
* Keep the Pi fixture exit observer
* Record failed owned opening before the first message
* Abort a matching provider open when its child exits
* Cover provider exit during an unanswered host open
* Cover explicit failure facts on a host-stopped child
* Capture message choices per accepted send and preserve picker state
* Apply accepted Claude message choices at prompt handover
* Apply captured message choices at provider dispatch
* Bind native chat choices to accepted message dispatch
* Reset Codex turn choices for each captured message
* Resolve Codex message defaults from native facts
* Align message choice and Pi default fixtures with provider dispatch
* Align option fixtures with saved message choices
* Match Codex message choices to the active turn origin
* fix: let pending commands reach handover refusal
* Abort pre-prompt message choice writes with host-owned wait
* Verify message choices through provider input boundaries
* Keep legacy mobile test hosts explicit about message choices
* Align Stop close causes and request-note fixtures
* test: align ACP Stop note fixtures with settled behavior
* Verify close intent reaches the native adapter
* Record the Stop request before waiting for interruption
* Keep Stop cleanup independent of request-note persistence
* Keep startup waits cancellable and preserve operation order
* Derive Codex startup exits from host phase
* Open Codex protocol in background-task test fixtures
* Keep ACP startup ownership until handshake completes
* Run ACP opening catalog fixtures with Node SQLite
* Verify saved ACP picks without live option writes
* Keep ACP catalog bookkeeping from failing an options read
* Restore signed-out restart and fail Pi startup faults
* Run Pi opening catalog fixtures with Node SQLite
* Preserve message choices across cold clients and kept cards
* Remove the unused provider option restore ledger
* Clarify launch choices and legacy option hydration
* Remove remaining restore-ledger forwarding and assertions
* Remove unused ACP and Pi restore bookkeeping
* Report late Codex exits and keep card Cancel notes scoped
* Remove the Pi close wrapper left by unused cause plumbing
* Update Stop tests for the simplified close contract and Node journals
* Update remaining close and interrupt assertions after cause removal
* Keep live choices and delivery order while agents start
* Drop retired startup revision from Codex opening
* Keep live-option cancellation until message choices and clarify catalog reads
* Hold ACP option replies in live-write cancellation regressions
* Remove retired Pi startup revision and match saved-pick behavior
* Check running choices and retained rewind messages after delivery integration
* Use observed root exit in Codex close reports
* Apply startup picks and let parked messages release operations [skip ci]
* Remove unused Codex opening report field [skip ci]
* Keep ACP restoration facts local to the provider [skip ci]
* Apply Pi startup picks after readiness and remove unused open facts [skip ci]
* Cover goal changes during the held Codex message wait [skip ci]
* Save a waiting startup pick after Stop ends its opening [skip ci]
* Save choices when startup ends or a replacement is still opening
* Check saved choices separately from Claude startup reports
* Release scripted Codex startup before awaiting queued picks
* Check the saved picker selection in per-message choice fixtures
* Exercise current choices and eager client capabilities in runtime fixtures
* Keep accepted Stop requests in runtime settlement assertions
* Reuse runtime fixture reads and type the fake connection directly
* Type the Codex child-proof fixture connection directly
* Align startup fixtures and preserve observed Claude exits
* Honor queued send authorization in Claude runtime fixtures
* Open Codex protocol sessions before Stop fixture dispatch
* Wait for the opened Codex child before runtime notifications
* Keep repeated permission picks usable and align Codex fixtures
* Validate pending picks against the live option state
* Order startup picks before later messages and retain flow regressions
* Keep reviewed lifecycle contracts while pruning duplicate tests
* Save picks after a proven exit without requiring a child
* Type the startup reply fixture against the Claude control contract
* Keep Codex startup flow contracts and remove overlapping adapter tests
* Restore the committed dependency lockfile after test tooling
* Keep startup recovery flows and remove duplicate Pi handshake cases
* Cover both Pi startup choices in the delivery flow
* Match the Pi prompt entry recorded by the scripted wire
* Honor the before-input callback in the startup reply fixture
* Keep message choice flows and remove overlapping selector tests
* Retain Stop flows and remove repeated reducer and adapter cases
* Keep Stop note writes independent of full session context
* Keep startup option menus independent and show the saved choice
* Exercise startup picks across real menus and the runtime
* Match startup picker fixture to saved message choices
* Keep saved effort visible when picking a model during startup
* Include the running-turn scope in repeated Stop fixture
* Use the current attach contract in import fixtures
* Keep the Codex journal translator within its line limit
* Match ACP startup fixtures to saved picks and late Stop behavior
* Check startup effort after saved picker choices are acknowledged
* Complete Stop target types and keep the effort regression concise
* Use requested picker values in the effort regression acknowledgement
* Exercise Stop receipt replay across a resumed provider child
* Require owned provider spawn and one host-awaited open (from #28055)
* Restore the live checks the startup cleanup's deleted tests pinned
One assertion each, in the surviving suites: a stale-generation exit is
ignored, a failed create lets its sink go, a readback before open is saved,
an idle stop that fails is retried, a no-pick Pi start teaches its default,
an older client's pre-spawn failure and packed answer, an undrivable chat
stays readable, the resting slash menu stays on its own host, the main agent
reads apart from subagents, restore publishes status, naming runs off the
host's status feed, and a throwing logger never reaches the operation.
Also corrects the reliability gate note that claimed the send-idempotency
suite replaced the refusal-retry tests.
* Read a rewind in doubt outside the chat's serialize and apply it in the commit
The started settle and the attach's ready-child path read the provider's
history first, then apply what it proves in a short commit that re-checks
the rewind it read.
* Accept messages while the agent starts: run the start outside the chat's serialize
The chat's serialize was both where a send was admitted and where its agent
started, so every slow step of a start (closing-child join, lease
reconcile, recovery probes, resolvers, history read, spawn, sink drain,
provider dispatch) held every later send.
A start now registers in one short step before its first wait: its abort
controller (which Stop, close and quit already reach outside the lock),
its startup clock (the 10-minute ceiling now counts from here) and quit's
drain. Every wait after runs outside the lock, raced with that signal, and
every write is a commit that first re-checks the start is still the
session's. A start that loses the check is late: its spawn is closed
through the post-acquisition failure path and nothing is handed to it.
- The delivery loop's prepare returns a start handle; the loop awaits the
start outside, then re-prepares. Handover writes the pending row and
begins the dispatch abort handle in one commit, calls the provider
outside after re-checking the child, and resolves in a second commit.
- Ready operations claim a start instead of running one in their step.
- A client attach runs the same steps under one serialize, as before.
- An exit reported between spawn and publish is held for the publish
commit, which ends the child it indexes.
- An unproven close still fails only what was queued when its start was
asked for.
* Test that a send is accepted at every wait an agent start makes
One whole-flow test holds the start at each wait in turn (closing-child
join, reconcile probe, recovery re-probe, resolver, spawn, sink drain,
open, started recovery, pending row, provider call): a second send is
accepted at once, a Stop is recorded without waiting and nothing reaches
the provider, and what was sent goes to the published child once, in
order. Also quit before spawn, concurrent sends, a lease left recovering,
and an idle sweep racing a send.
* Bound each startup step on its own and drop the startup silence rule
A start no longer ends after 60 s without output: output is not protocol
progress. Each protocol step now has its own bound where its handshake
lives, and one 10-minute ceiling from registration stays as the outer bound.
- Codex: initialize 15 s and thread start/resume on the connection's 30 s
default again, instead of the startup ceiling.
- ACP: initialize 60 s, authenticate 120 s, session new/load/resume/fork
300 s; turns stay unbounded and option writes keep their caller's bound.
- Claude: the initialize answer has a 60 s bound; past it the open fails
with the ordinary startup-failure words and the host ends the child.
- The onOutput plumbing that only fed the silence rule is removed.
* Count Pi ready once it reports its state
Pi's start no longer waits for its model listing and slash commands.
The open returns after get_state and the unknown-provider check; the
listing then arrives as an options report (with the catalog listing the
start resolved) and the commands as a later publish. An empty model list
no longer fails the start as signed out: a signed-out Pi runs the unknown
provider, which still fails it, and a prompt it cannot run is refused
with the sign-in words by the existing prompt path.
get_state keeps the connection's 30 s request bound instead of the
startup ceiling.
* Test that model and effort picked while a chat is created ride its first message
A slow host's create reply arrives after the user picked a model and effort. The picker's view
layers the launch's held picks over its seed and the host's saved selection, and every send
carries what the picker shows, so the first message carries the picks whether the host's status
names its selection or not, and while the last pick is still on its way to the host.
* Start a phone's new empty chat on its first message
The phone's new chat is an agent.launch with no prompt, which always created the chat with its
agent started, while desktop chats start on the first message. The phone now advertises the
create-without-start capability, and a launch with no prompt from a caller advertising it creates
the chat at rest, keyed in the ledger by its create intent as a client's create is. Launches with
a prompt, the CLI (which advertises nothing), orchestration workers and ensure still start at once;
an older host ignores the capability and stays eager.
* Take main's lockfile; the branch changes no dependencies
* Restore main's exact text in files the merge only reformatted
The pre-commit formatter rewrote 37 of main's files staged by the merge, though this branch never changed them, pushing two past the line limit. Committed without the hook because the hook would reformat main's text again; CI lints the result.
* Fit the startup tests to the owned-spawn, host-awaited-open contract
Test doubles gain the mandatory open and an acquisition generation, the
removed started event gives way to the rig's proveStart, and two literal
types are tightened for CI's typecheck. A Stop during a held start writes
no host note on this branch: the taken-back send draws its own
stopped-before-start row, which the startup-attempt test now asserts.
* Fit the remaining CI checks to the startup limits and current releases
- Run agent-launch-at-rest.test.ts in the SQLite Node runtime project.
- Pin the send-options cross-version case to v1.4.228, the first published release with agent-session.send-options.v1; v1.4.226 was never pushed.
- Load the baseline's isStructuredTab from src/shared (moved in v1.4.228), falling back to the renderer path for older baselines.
- End the never-proven start with a short startup ceiling: the silence limit it relied on is gone, and the ceiling counts from registration.
* Read the option stamp from the chat's one host-execution selection
* fix: preserve startup authority and accepted agent choices
* Retain dispatch authority and reconcile accepted options
* fix(native-chat): preserve accepted choices and cancellation authority
* Restore established client selection flow
* Preserve provider output observation and typed startup fixtures
* fix: preserve initial Claude launch choices and effort readback
* test: complete Claude catalog session fixture
* Preserve incoming main files after merge formatting
* Preserve compact handover through startup merge
* Type instant startup fixtures before their open is supplied
* Keep browser sign-in under its existing expiry owner
* Finish the main merge: retired-model display, start rewind cut, new tests
A model the Claude CLI retired is reported again, so the picker shows what the child runs and the
next send moves the chat off it. The start reads a rewind in doubt against the handle it answered
with, the record its commit then applies to. Main's tests follow the start's open: the admission
fixture holds a real turn, and a sign-in close during setup fails the open.
* Type the start's rewind record as the store returns it
* Type the Sleep test's held open as the provider open it replaces
* Sleep counts a chat stopped once the start it aborted leaves it at rest
A start runs outside the chat's lane, so Sleep's step can run before the start it aborted has
settled; it then re-reads the chat once that start is done, instead of reporting it unverified.
* Keep Sleep's start-abort bookkeeping beside the rest of Sleep's stop
* Keep the listed background Stop lifetime cases
The two #29905 cases lived in the turns test this branch removed. They pin that a listed Stop never ends a helper lifetime it did not capture: a same-id restart during acceptance, or a refused helper that appears mid Stop-all, which must not close the agent.
* Reconcile test registries and queued provider work accessor
* Update CI scope fixtures after removed connection test
* Bound native chat Stop protocol steps and omit empty startup feedback
* Supply current session fence in empty-start Stop test
* Align goal cancellation test with accepted-message feedback
* test(native-chat): cover distinct repeated Stop through Codex adapter
* fix(native-chat): save dispatch proof before Stop closes the child
* ci: retrigger checks for Stop dispatch repair
* Keep accepted Stop effects through dispatch settlement
* Capture earlier Stop evidence before writing request feedback
* Preserve named Stop runtime effects across turn advancement
* Combine projection imports in named Stop regression
* feat(orchestration): a chat worker's turn-ending error alerts its coordinator
A native-chat agent working a Dispatch whose turn ends in an error (usage limit, signed out,
provider refused, agent died mid-turn, failed start) now sends one high-priority escalation to
the Run that dispatched it, carrying the error sentence the chat recorded plus the agent's own
detail. The task stays assigned to the chat. Terminal workers already escalated on exit; both
now share one escalation helper.
On by default; a new switch on the Agent Orchestration settings page turns it off. It only
works for agents in Chat UI, so it is disabled while Chat UI is off.
* fix(native-chat): observe committed worker request failures
* Fix chat error alert fixture types and catalogs
* Keep chat failure alerts scoped to their request and journal lifetime
* fix: capture pending chat failure diagnostics before escalation
* fix: type chat failure observation fixtures and journal reads
* fix(orchestration): use checked database during worker exit
* test: bound chat failure observation and diagnostic work
* test: check ACP acquisition generation before capture
* test: bound native worker end history traversal
* test: type native exit fixture record lookup
* test: follow the journal context clear signature
* test: bound legacy display work for worker failure alerts
* test: type shared request failure rig mocks explicitly
* test: cover paired web chat error preference hiding
* perf(ssh): reuse one proxy connection for system SSH on Windows
Windows OpenSSH cannot multiplex (ControlMaster fails with "getsockname
failed: Not a socket"), so every system-SSH exec for a ProxyCommand or
ProxyJump target re-ran the proxy handshake. Hold one `ssh -N -L` through
the real proxy per session and dial later execs over 127.0.0.1 with
HostName/Port/ProxyCommand=none/ProxyJump=none/HostKeyAlias overrides.
The route starts after connect, is proven with a login before use, falls
back to per-command proxying on any failure, honors
systemSshConnectionReuse: false, and is torn down with its proxy child.
Rebased from #31731 (commits b1cdd46, 3835c2d, 6268f2f) onto current main,
including the pending-route cancellation fix from b301b6a.
Co-authored-by: Neil <neil@stably.ai>
* refactor(ssh): stop the loopback forward through process-host's tree kill
Reuse signalProcessTree instead of a hand-rolled taskkill-then-kill
fallback: it already joins an in-flight tree kill, refuses a reaped PID,
and falls back to killing the root, so the route keeps no parallel copy
of that logic.
* fix(ssh): harden the Windows loopback route against review findings
- Manual targets: take the forward's sshd port and the HostKeyAlias from
the stored endpoint; `ssh -G` ran on the label and named another host.
- Hold the forward with ServerAlive probes so a silently dead proxy ends
it and commands fall back instead of stalling on 127.0.0.1.
- Never route forwards: their argv must stay stable for orphan recovery,
and the route's own forward must take the real proxy.
- Upload sessions read the route per file, so an exited route's port is
not dialled after it closes.
- Skip the route for security-key identities, whose forward and probe
logins would each ask for an unprompted touch.
* fix(ssh): keep the loopback route for manual targets no Host block claims
The unclaimed-alias endpoint rewrite only applies to config-backed targets,
so manual targets with a configHost no block names stay eligible.
* fix(ssh): keep the held loopback forward non-interactive
The forward is an optional background login; with BatchMode=no a password or
passphrase login raised an extra prompt right after connect, which the
non-interactive probe then discarded anyway.
* fix(ssh): admit the loopback route only when it changes nothing but the route
Overriding HostName to 127.0.0.1 changes which ssh_config blocks match, so a
`Match host <real host>` block could silently switch the remote User (or
identities, certificates, known-hosts files) for every routed command. Run
`ssh -G` with and without the route options and refuse the route on any
difference outside HostName/Port/HostKeyAlias/ProxyCommand/ProxyJump.
Also ask the agent with `ssh-add -L` and refuse the route when it may hold a
security key, so the background forward and probe never request a touch.
Both checks run through process-host and fail closed.
* feat(ssh): make Windows proxy connection reuse an opt-in per-target setting
The loopback route rewrites HostName, which ssh_config can key settings on,
so it no longer turns on by itself: a new optional systemSshProxyConnectionReuse
field (default off, Windows only) enables it from the SSH host's Advanced
settings. Old clients and servers ignore or omit the field.
Admission stays as the safety net and now:
- takes the forward's sshd port and HostKeyAlias from the direct `ssh -G`,
so a manual host's own Host block cannot send the route to another sshd;
- refuses any non-routing value with a `%` token, which `ssh -G` can leave
unexpanded while a routed login expands `%h` to 127.0.0.1;
- checks the security-key and agent identities of every ProxyJump hop;
- asserts the routed config really dials 127.0.0.1 with no proxy left.
* fix(ssh): offer proxy reuse only for hosts this desktop dials, refuse ${VAR} paths
- The switch now appears only for this desktop's own SSH hosts. A paired
server's add-host dialog never shows or sends it, so an older server's
strict schema is never handed the new field, and a client's platform no
longer decides a server's setting.
- Admission also refuses `${VAR}` references, which `ssh -G` prints
unexpanded while a login expands them.
- Advanced no longer auto-opens just for the opt-in.
---------
Co-authored-by: Bingxin Xu <xubingxin.xbx@gmail.com>
* fix(bitbucket): recognize the SSH host alias
* fix(bitbucket): recognize the SSH host alias on current main
Apply Chen's original SSH alias fix to current main, preserving canonical
Bitbucket browser links and adding case/port and lookalike-host coverage.
Co-authored-by: Chen <zwq19980411@gmail.com>
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(ai-vault): show Copilot sessions under their workspace with the original prompt as title
Copilot sessions in Agent Session History showed "Unknown location" and
titles prefixed with an injected <current_datetime> tag.
The Copilot parser only learned a session's folder from the
"Folder X has been added to trusted folders" notice, which Copilot does
not write for every session. It now reads the launch directory, git
root and branch from session.start's context, and the trust notice only
fills a folder the start did not name, so resume runs in the start
directory as it does for other agents.
User messages now take the original `content` before
`transformedContent`, which carries context Copilot injects.
`current_datetime` joins the hidden blocks so a transformed-only
message still gets a clean title.
Bump the session parse cache schema so histories cached with the old
parser are re-read once instead of keeping the wrong folder and title.
Fixes#30985
* fix(ai-vault): refresh cached Copilot metadata and search text
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(terminal): re-probe stale "missing" path results so links go live
The terminal link provider caches filesystem existence per pane, but the
cache had no expiry on negatives. A path printed a moment before its file
exists (e.g. an agent announcing a file it is about to write) got cached
as "missing" and stayed un-clickable forever, even after the file landed —
while a later mention of the same path resolved fine.
Give negative results a short TTL: a cached "missing" older than ~10s is
treated as a cache miss so the next hover re-probes the filesystem.
Positives stay cached (files rarely vanish mid-session, and a stale
positive fails gracefully on open). Cache entries become
{ exists, checkedAt }; both readers (the link provider and the click
fallback) go through the shared read helper so the TTL applies uniformly.
Refs #5024
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(terminal): preserve negative path cache expiry
* fix(terminal): ignore stale negative link probes
Overlapping hover scans can re-probe the same expired missing path. Stamp each probe with its start time and drop a result older than the cached one, so a late "missing" no longer hides a link a newer probe found.
* fix(terminal): order same-millisecond link probes with a sequence
* fix(terminal): retain expired link probe ordering
---------
Co-authored-by: gatsby74 <166927047+gatsby74@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(automations): list a web client's paired server once, not again as Desktop
A paired web client's local runtime calls go to its server, so the desktop
authority and the saved runtime are one runtime. The Automations catalog
projected both and every automation appeared twice (Local <OS> + Orca Server).
The catalog now folds the desktop authority into the saved runtime that
getPairedWebClientEnvironmentId names, and a saved Desktop host filter falls
back to All hosts instead of waiting forever for an entry that never comes.
Co-authored-by: Chen <zwq19980411@gmail.com>
* fix(automations): move a saved Desktop host filter onto the paired server
On a paired web client the Desktop host is the server, so a saved Desktop
selection now names the server's matching host instead of being dropped with
a fallback notice on every visit.
Co-authored-by: Chen <zwq19980411@gmail.com>
* fix(automations): route web run links and sole-host choice through the folded server
Codex review: with Desktop folded into the paired server, a workspace run link
carrying hostId 'local' never matched a row and the run page stayed loading,
and the sole create host could be picked before the server's SSH targets
loaded. Pending navigation on a paired web client now names the server's
runtime, and desktop SSH hydration follows the runtime Desktop folded into.
Co-authored-by: Chen <zwq19980411@gmail.com>
* fix(automations): match web run links against the folded server at use time
Resolving the pending navigation's host when it is matched, not when it is
stored, also covers a link opened before the server environment list loads.
Replaces the store-setter rewrite from the previous commit.
Co-authored-by: Chen <zwq19980411@gmail.com>
---------
Co-authored-by: Chen <zwq19980411@gmail.com>
* feat(cli): add orca ports to list a workspace's detected ports
Scripts and agents had no way to read the ports Orca already detects for
a workspace, so finding a dev server on a random port meant redoing the
lsof scan by hand. `orca ports` reuses the host-scoped
workspacePorts.scanHost RPC, keeps the rows owned by the current (or
--worktree) workspace, and prints port, pid, process, connect host,
protocol, how the owner was matched, and the advertised URL. --all shows
every listener on that host. An older runtime without scanHost gets an
"update Orca" error instead of a raw method_not_found.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): resolve folder workspaces in orca ports and match rows by path
Run inside a native folder, `orca ports` failed with selector_not_found
(or picked an enclosing git worktree) because it only searched the
worktree list. It now resolves the cwd like `agent launch`, native
folders first, and shows that host's listeners. Rows are matched on the
owner's path instead of its id, so every instance of a repo-backed
folder workspace keeps its ports even though attribution names only the
first instance as owner. `--all` adds the worktree id when two owners
share a display name, and the skill guide notes that only workspace
rows carry `owner` and `advertisedUrl`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): refuse orca ports for folder workspaces without --all; document the command
Co-authored-by: Manuel Meurer <manuel@meurer.io>
* fix(cli): recognise native folder path selectors in orca ports; note SSH scan limits
Co-authored-by: Manuel Meurer <manuel@meurer.io>
* fix(cli): refuse a folder path shared by several folder workspaces in orca ports
Co-authored-by: Manuel Meurer <manuel@meurer.io>
* fix(cli): refuse a path a worktree and a folder workspace share in orca ports
Co-authored-by: Manuel Meurer <manuel@meurer.io>
---------
Co-authored-by: Manuel Meurer <manuel@meurer.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Neil
Naveen ChatlapalliandNeil
AnmolandNeil
hwantageandNeil
Max HsuandNeil
OrcaWinandOrcaWin
Kelvin Amoaba
