41 Commits

Include renames

Author	SHA1	Message	Date
Brennan Benson	aee98ccaa0	fix(browser): make the browser identity one process-wide choice (#13822) (#20767) ... * feat(browser): process-wide browser identity, chosen before ready Electron resolves worker identity from a single process-global default, so two coherent identities cannot coexist in one process. This makes clean/native one app-wide decision read before `ready`, instead of a per-profile one that leaves documents on one identity and every worker request on the other. Both identities are load-bearing, measured across four origins at five reps: the cleaned identity clears an embedded Turnstile widget and WhatsApp's browser check where native is refused; native clears a full-page Cloudflare interstitial that the cleaned identity never clears. Base commit only: removing the per-profile field, its settings surface, and the migration notice follow. * test(browser): cover cross-context UA wire identity * refactor(browser): make user agent identity app-wide * test(browser): repair process identity wire fixture * Fix browser identity startup migration failures * WIP: rescue in-flight reduced-design work from a dead worker Worker ctx_cb5b1262d7fe stopped ~2h ago mid-implementation (last heartbeat 2026-09-14T22:48:06Z) leaving this uncommitted. Committed unverified to make it recoverable; not reviewed, not necessarily green. * fix(browser): repair the rescued identity work so it typechecks Finishes the interrupted edits in 7db9c54b54: - browser-user-agent-migration-notice.ts was truncated mid-write; close the then() callback so the file parses. - Register browser.identity.get/set in the generated RPC params catalog so the params type-parity gate is satisfied. - Retire the persistence assertions for the superseded design: a migratedNativeProfileIds event map, a notice-acknowledgement clear, and a global persistence-failure accessor. Legacy userAgentMode bytes are retained now, so these assert retention plus a failed notice write still hydrating. - The in-memory fs fixture threw a codeless ENOENT, which reads as "unreadable" rather than "missing" and made every identity write refuse. Carry the code. - Use the segmented control's per-option disabled rather than adding a control-level prop it does not have. * refactor(browser): make the identity store the only writer The rescued work already serialized identity writes, but the writer lived beside the pre-ready reader, so nothing stopped a second caller from writing the record directly -- which is the shape of the bug this change set removes. browser-identity-mode-record.ts is now read-only: record shape, path, parsing and the pre-ready synchronous read. browser-identity-mode-store.ts owns every mutation behind one queue, holds the snapshot and listeners, and derives restartRequired from appliedMode vs configuredMode rather than storing it. Consumers move to the store. The two identity RPC methods also move out of browser-core.ts into browser-identity-rpc.ts: they read and write this host's own process identity rather than driving a page, and browser-core.ts was over its line cap. The generated params catalog is byte-identical. * feat(browser): make resetting unhealthy identity data explicit and lossless A corrupt or newer-version record left the identity unchangeable with no way out. An explicit reset now copies the old bytes verbatim to a fresh unique path before publishing a replacement, and refuses the whole operation if that backup cannot be written -- so the reset can never be the thing that loses the data. Nothing resets automatically. Future-version data says update Orca rather than reporting corruption. Reset is opt-in via browser.identity.set and orca browser identity set --reset. ProfileCreate and BrowserIdentitySet move to browser-identity-params.ts: both carry the per-profile to app-wide identity move, and browser-params.ts was over its line cap. Also registers browser as a top-level CLI name so the Windows launch redirect covers it -- without it orca browser identity get boots the GUI and exits silently there -- and adds the canonical browser identity show alias the CLI vocabulary policy requires. * feat(browser): advertise the identity capability only where it exists browser.identity.v1 was static, so every host claimed it including one that never initialized the identity store, where both methods can only throw. It now follows the browser.headless.v1 precedent and is pushed at status time when the store is actually initialized. Also covers the retired profileCreate userAgentMode field at the dispatcher rather than only at the schema, so an older client provably gets the changed-semantics rejection over the wire instead of a success with the field quietly dropped. * refactor(browser): delete the identity write queue and guard backup uniqueness The queue could not be falsified by any test: writeRecord is synchronous end to end, so two calls cannot interleave and removing serialization entirely left every store test green. Carrying machinery whose guard is unconstructible is what the design review told us to cut, so it is gone. If durable writes ever become async, serialization comes back with the change that makes it testable. The test that claimed to prove serialization now states what it actually pins -- the later of two selections is the one that survives -- and the module doc no longer claims a queue that is not there. Adds the guard that was missing on reset: two resets across separate launches must produce two distinct backups, each holding its own original bytes. Verified discriminating -- a fixed backup filename fails it. * test(browser): guard the identity capability and harden two weak assertions Pins the mixed-version guarantee that had no test: browser.identity.v1 is advertised when the identity store is initialized and absent when it is not. Verified discriminating -- advertising it unconditionally fails the test. The profileCreate rejection test asserted ok:false against a runtime with no browserProfileCreate, so that assertion passed even when the retired field was accepted. It now stubs a working runtime method, making ok:false load-bearing, and asserts the runtime is never reached. Removes the persistence fixture's dead failIdentityWrite branch on writeFileAtomically: nothing on that path calls it, so it implied a second write mechanism that does not exist. Failure is injected through node:fs, which is what the identity write actually uses. * test(browser): classify the identity channels on the preview seam The channel split is asserted total, so adding browser:identity:get/set left it short by two. They manage the host's own process-wide user-agent choice rather than acting on a guest the reader is looking at, so they sit with the session and profile channels, not the preview tools. * test(browser): audit the identity rig's global-fetch call sites The wire probe server and CDP collector arrived with the cross-context coverage and were never added to the audit list. The collector's two real call sites are safe: the poll cancels its unread body and the version probe consumes it through response.json(). Every hit in the probe server is inside an injected page or worker script source string, not a call this process makes. * fix(browser): strip an app name that contains a space app.setName decides the app token in the user agent, and dev sets "Orca Dev". The cleaner matched a single whitespace-delimited token, which cannot span that space, so the replace failed outright and every dev build presented "Orca Dev/1.4.203" on the wire — the exact token class that gets transplanted sessions revoked. Anchoring on the engine comment and consuming lazily up to Chrome/ removes any number of app tokens. A user agent without that comment is returned unchanged rather than mangled, because over-stripping is worse than under-stripping. The function had no unit test at all; it was only exercised through the real-Electron wire tests, which run with a single-token fixture name. That is why this survived. * fix(browser): anchor the cleaner on the gap before Chrome/ My first attempt anchored on the engine comment, which broke a startup fixture whose platform comment is "(Test)" with no "(KHTML, like Gecko)" at all — the app token survived and the ordering test went red. Anchoring on the nearest ")" before Chrome/ and consuming only non-")" tokens keeps the match inside that gap, so it handles a multi-word app name, a synthetic platform comment, and an already-clean identity alike. A user agent with no such gap is still returned unchanged. The fixture shape is now a test case, since it is what caught the first attempt. * test(browser): repair the cleaner's case table A missing comma between two it.each elements was reformatted into an index expression, collapsing the table so every case ran with undefined input. * test(browser): make a CI-only capture failure diagnosable This probe passes locally and fails on CI with an empty receipt set, an empty CDP diagnostic list, and a fixture that still exits 0 — so the assertion message carried nothing usable. Thread the fixture's own result and stderr into the capture assertion so the next run says what the fixture actually did. * fix(browser): let an explicit choice retire the migration notice for good The retired per-profile userAgentMode bytes are retained on disk by design, so every launch rediscovers them and re-arms the notice — including the launch right after the user answers it, and every launch after that. Documented as one-time, it was permanent. The record already carries explicitSelection, which is exactly the fact that should end the notice. Gate the mark at the single writer rather than deleting the legacy key, so the retained bytes stay untouched and disk never claims a notice is pending beside a choice the user already made. The new test pushed the persistence suite past max-lines, so the in-memory fs and module mocks move to a named fixture module and the retired-identity tests move beside them in their own file. * fix(browser): stop reporting an unhydratable profile as a retired choice A profile that fails validation for a reason unrelated to identity — a non-UUID id, a mismatched partition — armed both the notice and its degraded flag. Since hydrateFromPersisted skips such entries silently and nothing ever repairs them, the user got "an old browser identity choice could not be inspected" forever, about a profile that never carried one. Key the notice on the presence of userAgentMode instead, and use validation only to decide whether the choice that was found is inspectable. Refusing to hydrate an entry and finding a retired choice are now separate facts. The old case table asserted the defect for null, 42 and 'broken', so it is replaced by two tables stating the new contract rather than adapted to pass. * fix(browser): stop rewriting worker requests for viewport emulation A worker request carries no webContentsId, so it always took the session-wide branch and picked up the mobile UA if any tab in the session had a mobile preset. That made a single context disagree with itself: a desktop tab's shared worker reported a desktop navigator.userAgent — the per-target CDP override cannot reach a worker — while its fetches left as CriOS. It also leaked across tabs, and closing the emulated tab silently reverted it. On main the divergence was between contexts, each internally coherent. Making one context internally inconsistent is worse by this PR's own standard, so accept that viewport emulation reaches documents only. Workers keep the session identity on the wire, which is the identity they report in JavaScript. That left hasSessionMobileViewportIntent with no reader, so the map it fed and its three accessors go too, rather than leaving a dead latch behind the guard. The electron fixture models this rule in its own header hook, so its hook and both mobile arms are rewritten around the invariant that each context's wire identity equals the identity its own JavaScript reports — not adapted to keep the old path list passing. * test(browser): point the identity tests at keys and writers that exist browserUserAgentMode appears in zero production files and zero commits on main; `git log -S` finds nothing. The retired key is profile.userAgentMode inside browser-session-meta.json. Two tests were built on the invented one. The global-settings test is deleted rather than repointed: no browser identity key has ever lived in global settings, and stripRetiredGlobalSettings strips only three unrelated keys, so the test asserted that an arbitrary unknown key survives an object spread — a fact about the normalizer, not about identity. The ready-phase test asserted on writeFileAtomically while the identity store writes through writeFileDurableSync, so it could not go red for the write it existed to forbid. It now watches the real writer, matched on the record path so an unrelated durable write cannot fail it for the wrong reason, and the invented settings key is gone from the Store mock. Proven by ablation: injecting a byte-identical rewrite of the record into ready composition leaves every snapshot and record assertion green and is caught only by the new assertion, while writeFileAtomically is never called. * fix(browser): let an unavailable process identity reject instead of throwing installBrowserSessionPartitionPolicies returned Promise<void> without being async, and configures the user agent policy before any suspension point. getBrowserProcessUserAgentIdentity throws when the process identity was never initialized, so that throw escaped synchronously past every caller's handler: `void install(...).catch(...)` in the registry, and a bare `void install(...)` in the route policies, which has no handler at all. Bookkeeping must never gate a user action. Session startup would have died on a failure its callers were already written to absorb and report. * docs(browser): scope the meta-store claim about dropped legacy keys The comment said persistMeta drops legacy keys on the next write because the loader no longer carries them. That holds for the top-level userAgent keys it describes, but not for the retired per-profile userAgentMode: it sits inside each BrowserSessionProfile in `profiles`, which is carried through untouched, so those bytes survive every write. Retaining them is deliberate — it is what makes rollback and data-loss machinery unnecessary, and the startup notice keys on their presence — so the comment read as broader cover than it provided, in the one place someone would look before deciding it was safe to strip them. * test(browser): pin the unmapped-webContents path beside an emulated tab A popup carries a webContentsId that maps to no registered tab, so it resolves through the same branch as a worker request that carries none at all. The branch already handled both, but only the absent-id case was covered. * test(browser): make the ordering fixture exhibit a multi-word app name This file sets the dev app name to "Orca Development" and then used a single-token user agent fixture, so it set up the multi-word scenario and used a fixture that could not exhibit it — which is how the multi-word app-name leak got through. The fixture now carries a two-word app token, matching what app.setName produces in dev, and the assertion names both words: a single \S+ match would leave "Orca" on the wire and still pass a one-token check. * test(settings): cover the local branch of the browser identity setting The only existing test covered the remote-host branch. The local branch — load, select, refused write, and reset-required — had none, and that is the path the retired-identity notice sends users down to make the choice that retires it. Covers the selected-mode render, the commit that reports restartRequired, a refused write surfacing its message without showing the mode as changed, and the reset-required state offering no control. * test(browser): run the real registry path in the ready identity pin The test stubbed browser-session-startup and browser-session-registry, which are the one ready-phase path that can write the identity record, so the record content assertion could not fail for the write it existed to forbid. Both are now real. Only the pieces hanging off the identity path are stubbed — partition policies, route sessions, cookie staging, webauthn — so the meta load, the retired-choice inspection, the identity store and the durable write all run for real against temp directories. The canonical path mock moves to persistence/loading-store/user-data-path, which is where the registry reads it; mocking persistence alone left the registry pointed elsewhere. The active profile directory is now a real temp dir, so the seeded browser-session-meta.json is actually found — against the old /test-profile literal the meta load found nothing and the whole exercise would have been vacuous. A third case proves the path is live: with no explicit choice, the same retired profile arms the notice through ready and lands migrationNoticePending on disk. The two authority cases assert the opposite, that an explicit choice leaves the record untouched. initializeBrowserSessionsForApp latches on module state, so each case resets modules and imports ready dynamically. Ablated: disabling the explicitSelection gate turns both authority cases red on the record content assertion while the arming case stays green. * fix(browser): reject an unrecognized identity mode at the IPC door normalizeBrowserUserAgentMode turned any unrecognized value into 'clean', so the IPC door reported success for a mode it had quietly replaced, while the RPC door validates against z.enum(['clean', 'native']) and rejects. One concept answered an unknown value two different ways, and a future mode name was silently downgraded rather than refused. The handler now rejects, which is what the RPC door does and what the renderer already handles — its catch puts the message in the error slot. Returning a result instead would have meant inventing a fourth error code for a case no legitimate caller can reach. normalizeBrowserUserAgentMode had no other consumer, so it goes with the change: leaving a coercion helper called "normalize" in shared/ invites the behaviour straight back in. * fix(settings): name the reset command where identity data is unusable When configuredMode is null the setting says identity data must be reset explicitly and then offers no control, because the reset overwrites data that may belong to a newer Orca. The only escape is the CLI, which the message never named — so it told the user to do something and gave them no way to do it. Copy only: one line naming the command, no control and no destructive action in the UI. The command goes in a new key beside the existing sentence rather than expanding its default, which keeps the already-translated string valid. No en.json entry: this component has no catalog entries for any of its keys, so English resolves from the call-site defaults and adding one only for the new key would be inconsistent with its siblings. * fix(i18n): add the browser identity keys to the localization catalog * fix(i18n): regenerate the runtime-required English catalog * fix(browser): attach nested CDP targets paused before enabling Network An OOPIF or dedicated worker was reached only through Target.targetCreated plus an explicit attachToTarget, which never pauses the target. The frame could issue its subresource fetch before Network.enable took effect, so the capture came back empty and the cross-context assertion failed under CI load. Re-arm auto-attach on each attached session, filtered to nested target types, so an OOPIF or worker arrives waiting for the debugger and its enables are ordered ahead of the resume. Drop the explicit attach, which is now both redundant and the racy path. * fix(settings): localize the browser identity search keywords * fix(browser): await route policy setup * fix(browser): satisfy strict static analysis * test(browser): update live identity fixture API * test(browser): preserve native UA in live probe * fix(browser): close the open review findings on the identity revert - drop a stray JSDoc left over from the removed per-profile setting - leave user agents without a Chromium engine comment byte-identical instead of anchoring the app-token strip on the OS comment and destroying a real engine token - localize the browser identity unavailable error - correct the worker comment: only shared and service worker requests carry no webContentsId, so emulation still reaches dedicated workers - retire the session user agent policy when a profile is deleted * test(browser): model a real Electron fallback in the startup UA fixture The ordering fixture carried no "(KHTML, like Gecko)" engine comment, a shape app.userAgentFallback cannot actually produce. That unfaithfulness was what made the old over-stripping look correct, and it broke once the cleaner started leaving non-Chromium identities alone. Add the engine comment, keeping the two-word "Orca Development" app token so the multi-word leak this test exists to catch is still caught. Both assertions are unchanged.	2026-09-16 10:31:01 -07:00
Jinwoo Hong	3e5eb0329a	feat(cli): orca search over the agent session index (#20514) ... * feat(cli): orca search over the agent session index `orca search <query>` calls PR 5's `aiVault.searchSessions` over the CLI's existing runtime RPC, against the host `--environment` / `--pairing-code` selects and no other. `orca search --index-status` calls `aiVault.searchStatus`. It is the proof the contract works with no panel. Every flag maps onto a contract field and nothing else: `--scope`, `--fresh`, `--limit`, `--cursor`, repeatable `--agent` and `--path`, `--since`, `--sort`, `--debug`, `--json`. No fan-out, no merged output, no `--host`. One command rather than a `search status` subcommand: the query is a bare positional, so `orca search status` could not be told apart from searching for the word "status". `--status` is unavailable because `orchestration task-list --status <state>` already owns the name as a valued flag. No new runtime capability. PR 5 decided an explicit `method_not_found` refusal maps to `unavailable/no-service`, so reusing `createSessionSearchClient` gives an old host a plain "this host runs no session search service" answer at exit 0 instead of a raw JSON-RPC error. `CommandSpec.repeatableFlags` scopes repeatability per command, because `--agent` must repeat for search and stay single-valued for `worktree create`. `help.ts` sat exactly at max-lines, so `skills-command-flag-help.ts` becomes `command-scoped-flag-help.ts` carrying both tables at the same call-site size. * refactor(cli): drop the search type assertions main's casting gate now rejects Main gained a `consistent-type-assertions: never` scan in the changed-code gate after this branch was cut, and it reported twelve assertions in the new files. The four in the argument parser were avoidable. `readEnum` now keeps the value `find` returns, which already carries the narrow type, and the agent filter goes through an `isAiVaultAgent` predicate over a `Set<string>` instead of widening the agent tuple. The test now narrows the printed envelope by shape and re-reads the printed result through `AiVaultSearchResponseSchema`, so the JSON assertions are checked rather than claimed, and the flag table is typed so its callback needs no cast. One assertion is left, for the structural fake client, with the SAFETY rationale AGENTS.md requires. * fix(cli): sanitize host strings and scope pre-command repeatable flags Route every host-supplied string the search formatter prints through the escape stripper, and resolve the repeatable-flag set from the command tokens ahead when a flag sits before the command. * refactor(cli): resolve repeatable flag rules once per command * fix(cli): clarify session search availability and SSH scope * feat(cli): hide orca search until the settings toggle ships `orca search` stays dispatchable but leaves every discovery surface: root help, group help, unknown-command suggestions, and `agent-context --json`. `buildAgentContext` did not filter hidden specs, so it also stops leaking the hidden `terminal stop`.	2026-09-16 12:03:38 -04:00
Neil	f37d2fec97	fix(linux): land the reviewed Linux packaging stack on main (#18100) ... * fix(linux): give the CLI one entrypoint by extracting the AppImage once * refactor(linux): trim AppImage CLI registration seams * test(cli): assert registration lock serialization * fix(linux): fence AppImage terminal shim mounts * fix(linux): accept extracted AppImage runtimes with APPDIR only * docs(linux): make headless AppImage extraction runnable * refactor(linux): import bundled launcher directly * fix(linux): reclaim superseded AppImage payloads and packaged symlinks Pruning removed 3215 of 3216 files from a superseded generation and always stranded resources/app.asar, leaking ~105 MB per version update. Electron's asar shim reports a *.asar file as a directory, so the recursive remove tried to rmdir a real file and failed with ENOTEMPTY; the .catch(() => {}) hid it. Reproduced end to end on Ubuntu 24.04: 519M -> 623M across one update, and 519M again once the payload is actually reclaimed. removeExtractedAppImagePayload holds process.noAsar for the removal, counted so overlapping removals cannot hand the shim back early, and the prune site now warns with the path instead of swallowing the rejection. All three removal sites use it -- staging cleanup and displaced roots leaked the same way. Also reclaim symlinks left by a packaged deb/rpm install, which the extracted-cache-only rule turned into a hard conflict on a deb -> AppImage migration, and name the remedy in the conflict error. * fix(linux): bound the CLI registration lock wait `retries: 1000` caps the attempt count, not elapsed time, so at up to 1s per attempt an IPC-driven registration could hang ~16 minutes against a wedged holder with no feedback. A legitimate holder is bounded by the extraction timeout, so wait that plus slack and then fail with a message naming the lock file, rather than hanging. `maxRetryTime` is forwarded verbatim to the `retry` package by proper-lockfile. * fix(linux): stop re-extracting the AppImage on inode metadata churn The extracted-payload cache key hashed ctime alongside dev/ino/size/mtime. ctime moves on any inode metadata write -- `chmod +x`, which every AppImage user is told to run, plus `chown`, an ACL or SELinux relabel, and a backup restore -- none of which alter a byte of the payload. Measured on Ubuntu 24.04: `chmod +x` leaves dev, ino, size and mtime identical and moves ctime alone, so the key changed and the next launch paid a full ~519 MB re-extraction and a multi-second stall to rebuild a payload it already had, then pruned the old generation. Key on content identity instead. An in-place content change moves mtime and almost always size; a replacement moves the inode. The existing replace-in-place test still passes. * fix(linux): stop CLI commands from falling through to Chromium startup * refactor(cli): remove redundant command membership check * test(cli): cover command-named project selectors * fix(cli): redirect the open-url command before startup * test(linux): cover AUR serve wrapper flags * fix(linux): tighten CLI launch detection * fix(linux): respect CLI flag value boundaries * fix(linux): strip injected Chromium switches from CLI args * fix(linux): report a missing display instead of dying in uv_close * refactor(linux): read display locks without a preflight race * fix(linux): preserve unverified external displays * chore: format reliability gate manifest * test(packaging): split runtime resource checks * fix(linux): fail serve when no display is available * fix(linux): do not treat a lockless X socket as a dead display An X server writes its lock beside its socket and both survive a crash (verified against Xvfb under SIGKILL), so a socket with no lock was never left by a crashed server. It is an endpoint published from elsewhere: a container bind-mounting only /tmp/.X11-unix, WSLg, or a foreign PID namespace. Declaring those dead made the desktop gate exit(1) on displays that work, with no workaround, and the serve gate refuse to start. Liveness now splits by ownership. A foreign DISPLAY trusts a lockless socket; Orca's own :99 does not, because removeStaleDisplayArtifacts unlinks the lock before the socket and so manufactures that state itself -- adopting it would resurrect the orphan-socket bug and stop the cleanup from self-healing. The stale-lock rejection is unchanged. Also correct four doc statements this behaviour falsified. * fix(linux): fail closed when a stale socket blocks the Xvfb rebind Readiness only checked that /tmp/.X11-unix/X99 exists. A stale socket we could not unlink still exists after our own Xvfb refused to bind, so Orca set DISPLAY to a dead server and Chromium died in Ozone init. Measured on Ubuntu 24.04 against the pre-fix build: with a leftover :99 socket and no lock, serve exits 139 (SIGSEGV), the socket inode is unchanged before and after, and no lock is recreated -- it neither cleaned up nor respawned. To a user that is a crash, not a misconfiguration. This is reachable in the documented topology, where orca-xvfb.service has no User= and runs as root while serve runs as User=orca: /tmp is sticky, so the orca uid cannot unlink a root-owned socket, rmSync fails, and Xvfb exits with the display already active. Readiness now requires the display to actually be live -- our socket plus a lock naming a running process -- so the same state reports an unusable display and exits 1 with the existing diagnosis. * fix(linux): recognise abstract X sockets and inherited Wayland fds Two display setups this gate could not prove were refused outright, and on the desktop path that is app.exit(1) with no workaround. An X server may bind only the abstract namespace (`@/tmp/.X11-unix/X0`), which leaves no filesystem socket to stat. Abstract addresses are kernel-owned and vanish the moment the owner exits, so an entry in /proc/net/unix is proof of a live server -- no lock file needed and no stale entry possible. Verified on Ubuntu 24.04, where 139 such addresses were present. WAYLAND_SOCKET is an already-connected fd handed over by the compositor, so there is no path to stat and WAYLAND_DISPLAY may be unset entirely. Its presence is the display. Both are consulted only after the filesystem-socket check fails, so no existing verdict changes. * fix(linux): never treat Orca's own display number as a foreign endpoint Recognising a lockless X socket as live is correct for an endpoint published from elsewhere -- a container bind mount, WSLg -- because an X server writes its lock beside its socket and both survive a crash. It is wrong for VIRTUAL_DISPLAY_NUMBER, because Orca's own teardown unlinks the lock before the socket and so manufactures that exact state. The managed branch was already strict, but a caller that sets DISPLAY=:99 explicitly takes the foreign path and skipped it, accepting a dead display left by Orca's own interrupted cleanup. Route the managed number through the strict probe on both paths. Found by an adversarial audit of the asymmetry introduced earlier in this branch; the documented systemd topology is unaffected because its Xvfb writes a real lock. * test(linux): add a packaged-artifact contract for the CLI launch paths * test(linux): avoid buffered serve readiness detection * test(linux): signal AppImage serve owner directly * test(linux): tolerate readiness timeout boundary * test(linux): add startup margin to shutdown oracle * ci(linux): give package contracts timeout headroom * fix(ci): route all Linux packaging contract changes * test(linux): poll shutdown readiness without tail leaks * test(linux): bound shutdown cleanup grace * test(linux): assert on CLI output, not the harness's own control lines run-cli-case.sh echoes `RESULT status=N case=<name>`, and the two cases named *-skills asserted `expectOutput: 'skills'`. That substring was satisfied by the case name in the harness's own line, so 2 of 8 cases asserted nothing about the command -- gutting `skills` entirely would still have gone green. Control lines are now excluded before matching, and both cases assert the rendered help header, which only real help output produces. Verified on an Ubuntu 24.04 host: 8/8 still pass against a stack-tip AppImage. Also register the gate in reliability-gates.jsonc, which #15085 added a CI Docker gate without. Red/green is recorded from a stock release AppImage failing 4 of 8, three of them at status 133 (SIGTRAP). * fix(linux): require static AppImage runtimes (#17319) * test(linux): reject a wrong-architecture native binary at packaging time Cross-building the arm64 slice on an x64 host silently packed an x86-64 `pty.node` -- the rebuild logged "Forcing native rebuild for linux-arm64" and shipped the host's binary anyway. Every gate here inspects symbol versions, which are perfectly valid on the wrong architecture, so nothing noticed. Observed on a Raspberry Pi 5: the packaged app loaded, then failed with "Failed to load native module: pty.node", and the launch contract reported 3 of 8 cases crashed rather than naming the cause. Swapping in the aarch64 `pty.node` took the same build to 8/8. Compare ELF `e_machine` against the slice being packaged and fail with the offending path. Checked before the glibc pass, because a wrong-architecture binary's symbol versions are valid but meaningless and would send the reader down the wrong path. Release CI builds arm64 on a native runner, so this guards local and future cross-builds rather than a shipped artifact. * test(linux): judge per-arch vendored binaries against their own path The first CI run of the architecture gate failed the x64 package job on `@parcel/watcher-linux-arm64-glibc/watcher.node`. That binary is arm64 on purpose: the package ships every architecture and its loader picks the match, so its presence in an x64 build is correct. Judge a binary against the architecture its own path names, falling back to the slice when the path names none. That keeps the case this gate exists for -- `bin/linux-arm64-*/node-pty.node` holding an x86-64 binary, which is what shipped to a Raspberry Pi 5 -- while letting multi-arch dependencies through. Dry-run over the real dependency tree flags nothing for either target arch. * fix(linux): move deb/rpm update installation outside Orca (#17318) * fix(linux): complete deb/rpm package metadata * fix(linux): preserve CLI link during package upgrades * docs(linux): document local RPM build prerequisites * fix(linux): move deb/rpm update installation outside Orca * fix(updater): preserve Linux recovery across stale events * fix(updater): fence stale downloaded events by active target * fix(updater): preserve active Linux package recovery * test(linux): keep workflow order assertion in scope * test(updater): assert stale recovery stays silent * fix(updater): preserve Linux package recovery after checks * refactor(updater): keep Linux marker message with status * fix(linux): describe the right manual update path for deb/rpm hosts A remote host installed from .deb or .rpm now reports manual-service-update-required, and the guidance told the operator to "update through the service manager that starts this server" -- which is correct for unsupported-headless-serve but wrong for a package install, where nothing about the remedy involves the service manager. Say both, keyed on how the host was installed. * docs(linux): document orcad update restart safety * docs(linux): scope restart census omissions * docs(linux): use absolute service CLI launcher * fix(serve): validate in-process serve options before startup (#17683) * fix(linux): stop offering updates a distro-managed install cannot apply (#17918) Closes #17702. The resources/package-type marker is authoritative but never checked against the host, so any repackager that unpacks Orca's .deb -- AUR, Nix, a container rebuild -- inherits `deb` verbatim. Install feasibility was then computed after a ~165 MB download, so those users got check -> download -> a card promising an install command -> a dead end. Validate the marker against the host: a deb/rpm marker with no matching package manager in the trusted directories means a package manager owns this install. This reuses the exact lists and resolver that buildLinuxPackageInstallCommand already loops over, so a false positive is impossible by construction -- any host flagged here would have failed with no-package-manager after the download anyway. The gate only moves that verdict earlier. Verified across Debian 12, Ubuntu 24.04, Arch, Fedora 40 and openSUSE Leap: no false positive on a real deb host, correct on every repackaging host. The release is still reported, because the user does want to know 1.4.194 exists and to update through their distro; only the download path is closed. `externallyManaged` is an additive optional field on the existing `available` status, so older paired clients decode it unchanged. downloadUpdate() refuses authoritatively, since main owns this verdict rather than the card, and unwinds any pinned-build state first -- a Linux pinned jump resolves to 'release', and stranding isPinnedBuildActive would silently kill every background check for the rest of the process. Note the fix the issue suggests cannot work: electron-updater builds a PacmanUpdater whose doDownloadUpdate looks for a .pacman asset Orca does not publish, then dereferences undefined. * style(cli): restore prettier wrapping on install error copy * test(linux): re-pin the child-process ratchets and the batch-shim allowlist after the merge	2026-09-02 03:08:01 -07:00
Neil	9d1dfc314f	fix(cli): resolve host names across both kinds, and stop ssh: answering empty (#15449) ... * fix(cli): resolve host names across both kinds, and stop ssh: answering empty `--host ssh:<id>` was never validated. An unknown target filtered to nothing and returned ok:true with an empty list — the same silent wrong-machine answer that unknown `runtime:` ids gave before they were rejected. And because SSH target ids are machine-generated (`ssh-<timestamp>-<random>`) while the name anyone actually knows is the label, this fired on the ordinary spelling rather than a rare typo: every human-typed SSH name missed. The two kinds of remote machine are also reached on different axes. A paired Orca server is a connection (`--environment <name>`); an SSH target is a machine the connected host reaches (`--host ssh:<id>`). A caller only knows "the machine called X", so naming X on the wrong axis was the common failure and produced either an empty answer or a dead-end "unknown environment". Now: `ssh:` resolves labels as well as ids and rejects an unknown target with the known ones listed; `runtime:` accepts the environment name as well as its id, matching --environment, and canonicalizes to the id so stored host ids still compare; and when a name misses on one axis but exists on the other, the error says which and gives the exact flag. Candidates ride along in error.data so an agent can recover without parsing prose. `orca host list` is the discovery surface that was missing entirely — nothing in the CLI listed SSH targets, so a caller told to use one had nowhere to look. It prints this machine, the SSH targets registered on the connected host, and the paired servers, each with the selector to use. * fix(cli): give --environment the same cross-kind hint, and validate the ssh host on setup-create Two gaps a follow-up survey found in the first pass. `--environment openclaw` still dead-ended with a bare "Unknown environment" while an SSH target by that name sat right there — the inverse of the case just fixed, and the direction the report actually hit. The store's own error cannot carry the hint: translateStoreError forwards code and message and drops data. So the selector is resolved before the client is built, where the payload survives. Only the explicit flag is asserted eagerly; an ambient ORCA_ENVIRONMENT stays lazy, because failing local-only commands over stale background config would be a regression. `project setup-create` records independent metadata and, unlike the other setup paths, is not covered by the runtime's ssh rejection — so an unknown target persisted a row pointing at a machine that does not exist. It now resolves the host. `local` and `runtime:` still pass through untouched: this is also the provisioning path, where a runtime host legitimately may not exist yet when its metadata is written. `setup-existing-folder` and `setup-clone` deliberately keep the unresolved id. The runtime rejects every ssh host for those operations regardless of whether it exists, so resolving first would answer "no such target" and imply the command would have worked with the right id. * fix(cli): refuse an ambiguous host name instead of resolving the first match Name lookup took the first match while the environment store itself refuses an ambiguous name rather than guessing. That put the guess back, in the selector whose entire purpose is to stop a command reaching a machine the caller did not choose — and it applied to both spellings: two SSH targets sharing a label, and two paired servers sharing a name. Both now resolve to nothing and report every candidate with its id, so the caller picks. An exact id still resolves past a colliding name, since an id is never ambiguous. Also pins the property that makes accepting a name safe at all: `runtime:<id>` is a persisted token that lands in ProjectHostSetup.hostId and is embedded in generated setup ids, so the name is canonicalized to the id before anything downstream sees it. A test now asserts a name never reaches the wire. * fix(cli): fall back to the older ssh listing so an old host is not read as having no targets Hosts predating ssh.listTargetSummaries still answer ssh.listTargets, and both are served by the same summariser. Swallowing the method_not_found made such a host indistinguishable from one with no SSH targets registered, which would reject a target id that is valid there — a new-client/old-host regression on a path that previously passed the id through unvalidated.	2026-08-19 17:20:21 -07:00
Neil	3ffab9a6b3	feat(terminal): read the rendered screen with terminal read --screen (STA-4792) (#15380) ... * feat(terminal): read the rendered screen with `terminal read --screen` (STA-4792) `terminal read` returns accumulated pty output with escape sequences stripped. That is the right answer for "what happened over time" and the wrong one for "what is on screen": any program that repaints a line comes back as stacked fragments, so one `clear` typed key by key reads as `cclclecleaclear`, and a prompt that draws a space by moving the cursor loses it. Nothing in the output said which question had been answered, so it was used as rendering evidence and produced false conclusions. The runtime already knew how to render — it replays the byte stream through a headless emulator — but only as a fallback for blank reads, alternate screen, and never-attached ptys. A normal attached terminal never reached it. `--screen` asks for it directly. Every read now reports its source, which also surfaces the pre-existing snapshot fallback that until now swapped rendered lines into an ordinary read with no indication. `screen-unavailable` distinguishes "asked for a screen, none could be rendered, here is the stream" from a stream the caller asked for, and an absent source means the host predates the field. Because an older host strips the unknown param and answers with its ordinary read, `--screen` against one fails with that explanation rather than passing the stream off as a screen. `--screen` and `--cursor` are mutually exclusive: a screen is the current frame and has nothing behind it to page. * refactor(terminal): stamp the screen source where rendered lines enter the read Inferring it from tail array identity worked but made a load-bearing contract out of reference equality; any later path spreading the read would silently mislabel. Rendered lines only enter through one builder, so it stamps there and anything still unlabelled is the stream.	2026-08-18 22:51:37 -07:00
Jinwoo Hong	c991bb27d3	Add account-backed artifact sharing (#13012)	2026-08-07 23:02:29 -07:00
Brennan Benson	39c3c58d55	perf(runtime): gate terminal.list visual layouts (#12450) ... * perf(runtime): gate terminal.list visual layouts and stop the false writable claim visualLayouts is ~31% of a large terminal.list payload (44,208 B of 137,412 B on a live 134-terminal remote runtime) and has exactly one consumer: the human-readable CLI formatter. Gate it behind an includeVisualLayouts request param that defaults to included, so pre-flag clients are unaffected, and have every --json/internal caller opt out. Also drop the record-backed builder's writable, which was a verbatim copy of connected. terminal.show now states writability explicitly as exactly what terminal.send's PTY gate enforces. * test(runtime): type the payload-size fixture arrays for tsc * fix(runtime): preserve terminal list compatibility * test(runtime): guard terminal list optimization * fix(cli): preserve agent access to terminal layouts	2026-08-04 17:50:52 -07:00
4 people	650dd48ec9	feat(cli): add orca account add / account list for headless hosts (Claude + Codex) (#9177) ... * feat(cli): add `orca account add` / `account list` for headless hosts The desktop "Add account" UI is disabled when the renderer drives a remote runtime (isRemoteAccountScope === kind:'environment'), so a headless server reached from a remote desktop/web client has no way to register managed Claude accounts. Add a host-local CLI path that reuses the existing capture logic: - ClaudeAccountService.addAccountFromConfigDir(): register a managed account by capturing credentials from an already-authenticated CLAUDE_CONFIG_DIR instead of spawning the interactive browser login (extracted persist/rollback helpers shared with the existing add flow) - RPC accounts.addClaudeFromConfigDir, bridged via OrcaRuntime; rejected for mobile device tokens (host-local only) - `orca account add` runs `claude login` in the user's own terminal into a temp CLAUDE_CONFIG_DIR, then registers it via the local runtime; `orca account list` lists managed accounts Switching (select) already works from a remote client; only adding was blocked. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cli): support Codex in `orca account add` / `account list` Mirror the Claude headless-account CLI for Codex: - CodexAccountService.addAccountFromHome(): register a managed Codex account by importing auth.json from an already-authenticated CODEX_HOME, reusing a shared persist helper extracted from doAddAccount (no interactive login spawned here) - RPC accounts.addCodexFromHome + OrcaRuntime.addCodexAccountFromHome bridge, rejected for mobile device tokens (host-local only) - `orca account add --agent claude|codex` (default claude); `orca account list` now renders both Claude and Codex managed-account blocks Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: cover headless account-add capture paths (Claude + Codex) - ClaudeAccountService.addAccountFromConfigDir: registers a managed account by capturing an authenticated CLAUDE_CONFIG_DIR; rejects and rolls back when the dir has no .credentials.json - CodexAccountService.addAccountFromHome: imports auth.json from an authenticated CODEX_HOME into a managed account; rejects when auth.json is missing Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: address CodeRabbit review on headless account-add flows - CLI login spawn uses a shell on Windows so `.cmd` agent shims resolve without ENOENT (args are fixed literals, no injection risk) - Claude capture skips the `.credentials.json` precheck on macOS, where creds live in the Keychain and captureAuthFromConfigDir reads them - Claude add rollback is best-effort: a failed rematerialization no longer skips managed-auth cleanup or masks the original add error - Codex persist restores the prior account/selection if a post-write sync or rate-limit refresh fails, so a failure can't leave a dangling managed account - Codex sync passes the account's selection target (correct runtime for WSL) - Add JSDoc to the new public service methods and CLI functions Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cli): harden headless account capture * fix(cli): correct account command flag surface and interrupt cleanup - `account` commands no longer accept or advertise the browser `--page` flag; `supportsBrowserPageFlag` allow-listed them by omission, so `orca account list --page x` was silently accepted and `--help` rendered a browser-only option - account specs declare GLOBAL_FLAGS, so `--help`/`--json` render in the Options block like every other command - `--agent` on `account add` documents the account provider instead of the terminal TUI-agent meaning inherited from the shared flag table - a SIGINT/SIGTERM during the interactive login now removes the temp login dir (and restores the macOS Keychain item) before exiting 130; Node terminates without unwinding `finally`, which stranded live OAuth credentials on disk * perf(cli): stop `account list` forcing a provider usage refresh `accounts.list` awaited refreshAccountsForMobile(), which runs fetchAll({ force: true }) — bypassing both the poll throttle and the per-provider Retry-After gate — then O(N) serial per-account round trips. `orca account list` renders only emails and the active ids, so all of that work was discarded. The RPC now takes `refreshUsage` (default true, so mobile and web keep the forced lane) and the CLI opts out. Older hosts declare `params: null` and ignore the field, so a newer CLI degrades to the previous behavior rather than failing. Also documents on `account list` that `--environment` does not retarget it, matching the host-local behavior of shouldIgnoreRemoteSelection. * fix(cli): survive repeated and hangup signals during account add withInterruptCleanup latched cleanup behind a boolean, so a second signal got an already-resolved promise and its process.exit fired while the first cleanup was still inside a Keychain call (3s each) — the temp dir's OAuth credentials and the swapped macOS Keychain item both survived. Memoize the cleanup promise so every signal awaits the same run, and register with `on` instead of `once` so a second Ctrl-C cannot fall through to Node's terminate-immediately default mid-cleanup. Handle SIGHUP too. This flow exists for headless/SSH hosts, where the most likely interrupt is the connection dropping, which hangs up the login's terminal and previously ran no cleanup at all. Warn when the interrupt lands after sign-in completed: the runtime finishes the add independently of this process, so exiting 130 silently would tell the user it was cancelled when the account may exist. Reject a valueless `--agent`; the parser turns it into boolean true, which silently ran a full OAuth login for Claude when the user asked for another provider. Also lock two behaviors the refactor changed but left uncovered: a WSL Codex add must sync the WSL runtime lane rather than the default host lane, and rename the account-spec help test to describe the Options block it actually asserts rather than the usage string it never reads. * fix(build): bundle the main modules the account CLI imports electron-vite cleans out/main and emits only its declared entries, and `build:desktop` runs it after `build:cli`, so the tsc-emitted copies of `claude-accounts/keychain`, `codex-cli/command` and `win32-utils` were deleted before packaging. Both `orca account add` and `orca account list` then died at require time with "Cannot find module '../../main/claude-accounts/keychain'" — reproduced against a real `--serve` host. `agent-hooks/managed-agent-hook-controls` already carried an entry for exactly this reason; these three were missing. Adds a parity test so any future CLI import of a `src/main` module fails in CI rather than at a user's shell after packaging. * test: cover the desktop add-path behavior this PR changes Both changes ride in the persist/rollback helpers the existing GUI add flow shares with the new headless path, and neither had coverage: - Claude: rollbackAddAccount now guards forceMaterializeCurrentSelection- ForRollback, so a rejecting rematerialization no longer replaces the real add error nor skips safeRemoveManagedAuth. Asserts the original error surfaces and the throwaway auth dir is gone. - Codex: the desktop add now passes the account's selection target to syncForCurrentSelection, matching reauthenticate and select. Asserts the host target alongside the existing WSL assertion. Both fail when the corresponding change is reverted. * fix(cli): close the remaining account-add interrupt and preflight gaps The round-1 interrupt fix detached the signal handlers before running the finally-path cleanup, so the very window it was meant to protect — the two serial 3s `security` calls plus rmSync on the success/error path — was still covered only by Node's terminate-immediately default. Both review lanes reproduced it independently. Await cleanup first, detach in a nested finally, and stop a cleanup failure from replacing the error that actually explains why the add failed. Do not burn the interactive login when the runtime is unreachable. The RuntimeClient is lazily constructed and the first call was the registration RPC itself, so "Requires the Orca runtime to be running" was discovered only after the user completed a full OAuth round trip. Preflight with the now-cheap `accounts.list { refreshUsage: false }`. Reject `--environment` / `--pairing-code` on `account add`. shouldIgnoreRemoteSelection pins account commands to the local runtime, so `orca account add --environment homelab` silently registered the account on the laptop instead of the headless host it names. Survive a daemon that cannot spawn `claude`. `allowFailure` is honored in onClose but not onError, and unlike the GUI flow nothing has run `claude` in the daemon before this point — so a launchd/systemd daemon with a minimal PATH hard-failed an add the user had already signed in for, even though identity resolves fine from the config dir's oauthAccount. Also align the `--agent` help description with the global flag column. * fix(cli): reject runtime selectors on `account list` too `orca account list --environment homelab` was accepted and silently listed the LOCAL machine's accounts, because shouldIgnoreRemoteSelection pins account commands to the local runtime. Documenting that in --help does not reach someone who already typed the flag, and answering with the wrong host's accounts is the specific wrong answer they would act on. `account add` already errors; this makes the new command group internally consistent. The other groups in shouldIgnoreRemoteSelection keep their existing silent-ignore behavior — changing those is not this PR's job. * test: harden account-add signal tests and cover cleanup failure - Identify the handler under test by set difference instead of `process.listeners(sig).at(-1)`. Vitest installs its own once-wrapped SIGINT teardown, so the positional lookup could grab the wrong listener; the helper also asserts exactly one new listener was added. - Mock rmSync while keeping the real implementation by default, so the temp-dir assertions elsewhere stay honest. - Cover that a cleanup failure in the `finally` does not replace the error explaining why the add failed. Fails when that guard is removed. Completes the review loop's final round; the loop died on an API error before it could commit this, and its `import()` type annotation would have failed oxlint. * fix(cli): harden interactive account add * test(cli): make account cancellation coverage portable * fix(cli): preserve merged skills runtime modules --------- Co-authored-by: Dominik <marketing@gavaplast.sk> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>	2026-07-30 12:50:07 -07:00
Sebastián Castañoandscastanoh21	676ef7fab8	feat(cli): add orca skills install and orca skills update for headless skill setup (#9201) ... Adds `orca skills install` and `orca skills update` so skills can be set up without the GUI — SSH hosts, containers, CI. Previously `orca skills` had only `list` and `get`, so there was no headless path. **Agent targeting is scoped explicitly rather than delegated to detection.** The `skills` CLI decides which agents to install into, and with `-y` and zero detected agents it takes `targetAgents = validAgents` — all ~75. That is not a corner case for a headless CLI: a fresh SSH box or container with no agent installed is the normal starting state. Measured on a bare host, the unscoped command created **52 top-level agent directories and 54 junctions** (one real payload in `~/.agents/skills`, the rest links) on Windows, and 52/53 on macOS. The CLI now passes `--agent` derived from Orca's own detection, mapped to the `skills` key namespace, plus `universal`. Supplying `--agent` makes `runAdd` use it directly and never call `detectInstalledAgents()`, so the fan-out branch is unreachable. On a bare host it now refuses with `No coding agent detected on this host` and exit 1, creating nothing. Same command with scoping: **1 directory, 0 junctions.** `universal` alone would under-install — Claude Code is not in that set, and 19 of 28 mapped keys write agent-private homes `universal` never touches. `--agent '*'` is the bug itself. The mapping is hedged three ways: `null` for any agent whose key could not be confirmed, `satisfies Record<TuiAgent, …>` so a new Orca agent is a compile error, and a test pinning every mapped key against the CLI's own valid list. Fixed during review — two holes that each restored the full fan-out through a different door: - `--agent ','` trimmed to nothing, which skipped the refusal *and* emitted no `--agent`. - `--agent -y` passed an emptiness check, and the vendor CLI silently drops `-`-leading values, re-emptying its list. The real invariant is argument *shape*, not emptiness, and it is now enforced at the choke point in `buildAgentFeatureSkillInstallArgs`, so no caller can emit `-y` without a usable target. `*` remains allowed — asking for every agent explicitly is a choice, not an accident. Verified with 51 hostile inputs through the built binary, each recorded argv replayed through the vendor's own parser. Also fixed: the `ORCA_CLI_CWD` refusal now runs before target resolution (it was quoting the wrong host's agent list), and `--dry-run` is refused in a forwarded shell rather than printing a command naming the wrong machine. Validated on a real Windows host across PowerShell 7, PowerShell 5.1, cmd.exe and Git Bash: `.cmd` shims route through `cmd.exe` and `.exe` shims spawn directly (proved with instrumented shims, not inferred), the ENOENT path produces an actionable error rather than a silent failure, and `skills update` genuinely restores a corrupted skill byte-for-byte. Known, not addressed here — both upstream behaviours this only forwards: a partial install failure exits 0, and "no installed skills found" exits 0. Both are invisible to the headless callers this feature exists for. Co-authored-by: scastanoh21 <scastanoh21@gmail.com>	2026-07-30 11:20:29 -07:00
Neil	badf91101b	fix(quality): enforce performance-safe lint baseline (#11074) ... * fix(quality): clear safe existing lint findings * fix(quality): keep lint cleanup allocation-free * fix(quality): enforce performance-safe baseline * test(terminal): drain deferred confirmation cleanup	2026-07-27 20:54:02 -07:00
NeilandOrca	6677b5f171	perf(cli): construct the runtime client only when a command needs it (#10919) ... src/cli/index.ts was the only eager value-import of RuntimeClient, and five other eager modules imported just RuntimeClientError / RuntimeRpcFailureError from the runtime-client barrel -- dragging in client -> pairing -> zod -> ws -> e2ee on every invocation. Those error classes live in runtime/types.ts, which has zero children, so the five imports now point there and the client loads through the existing (already lazy by design) ctx.client getter. Eager modules 199 -> 46, with node_modules dropping 94 -> 0. `orca --help` 2.04x (59.6 -> 29.2 ms); the same for help, no-args, and both error paths, which return before constructing a client. Commands that DO construct one still gain 1.10-1.12x from not eagerly parsing the transport the local path never uses. Correction to an earlier note: websocket-transport alone is ~24 modules / ~8 ms, not the 107 / 28 ms once recorded -- that figure wrongly charged it for zod, which enters through shared/pairing on a different edge. Marginal cost, never isolated cost. Co-authored-by: Orca <help@stably.ai>	2026-07-27 17:16:01 -07:00
Brennan Benson	42a4f017b4	feat(linear): add MCP-compatible issue listing (#9672)	2026-07-21 13:16:44 -07:00
Jinwoo HongandOrca	319ae4e9ea	fix(terminal): make whole-tab close durable (#8958) ... Co-authored-by: Orca <help@stably.ai>	2026-07-15 22:09:37 -07:00
Brennan Benson	31f643ca42	Add version-matched skill guides to the CLI (#8624) ... * Add version-matched bundled skill guides * Clarify skill freshness rollout PRs * Add canonical skills show alias * fix(skills): address guide review feedback * fix(skills): make guide commands cross-platform * fix(skills): apply the ORCA convention to the emulator guides Review follow-up: the emulator guides still instructed literal `orca emulator ...` in sh fences with no Linux disambiguation, so on unmanaged Linux they could launch the GNOME screen reader — the exact failure the executable-selection preamble prevents. Both emulator guides now carry the preamble and ORCA placeholder across fences, tables, and prose, and the cross-platform safety test covers all four converted guides. Also replaces computer-use's "unless a block names a shell" carve-out, which contradicted its own POSIX example, with the unconditional placeholder rule.	2026-07-14 02:17:55 -07:00
JinjingandOrca	9de1fb8d16	Cli destructive suggest (#8352) ... * fix(cli): don't recover benign typos into destructive commands CLI did-you-mean ranked purely by Levenshtein, so `orca worktree move` sole-suggested `orca worktree remove` (distance 2) — an alias of the destructive `worktree rm`. Suggestions also flow into --json error.data.nextSteps, the agent recovery channel, so a blind retry could delete a clean worktree. Make destructiveness a declared property of the command instead of a verb heuristic: add `destructive?: true` to CommandSpec and mark the irreversible commands (worktree rm, environment rm, automations remove, project setup-delete, tab profile delete, cookie delete, storage local/session clear). The suggestion ranker excludes destructive candidates unless the input token is itself a near-miss (distance <=1) of a destructive verb, so `worktree remov` still recovers `rm`/`remove` while `worktree move` no longer does. The guard tracks the registry, so it also covers destructive verbs outside the delete family (e.g. kill). Fixes #6303 Co-authored-by: Orca <help@stably.ai> * fix(cli): use Array.at(-1) to satisfy oxlint prefer-at Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>	2026-07-11 22:06:38 -07:00
3 people	e2b4bc2c2c	feat(cli): make the CLI self-correcting and self-describing for agents (#6303) ... * feat(cli): make the CLI self-correcting and self-describing for agents Agents build a generalized model of how CLIs work and apply it to every tool. When orca diverged — `rm` where git uses `remove` — a reasonable first guess (`orca worktree remove`) dead-ended on a bare "Unknown command" with no path forward. This makes the CLI degrade gracefully when the orca-cli skill isn't loaded in context. - First-class CommandSpec.aliases, resolved to the canonical path before dispatch (no new handler registrations). `worktree remove`/`delete` now resolve to `rm`; the ad-hoc `terminal focus` duplicate spec/handler is migrated onto the mechanism. - Did-you-mean suggestions on unknown commands and unknown flags, ranked by edit distance over the live registry, surfaced in both stderr and --json error.data (reusing the existing nextSteps channel). - `orca agent-context [--json]`: a versioned, machine-readable dump of the command schema. Pure local read (no RPC), so it works over SSH and when the app isn't running. - CI guards: specs<->handlers parity, and a vocabulary policy that fails on new off-policy deletion/read verbs (existing ones grandfathered). * Address PR review feedback (#6303) - agent-context now emits each command's effective flag set (globals + conditional --page), not just allowedFlags, so the schema no longer under-reports --json/--help. Shared as effectiveAllowedFlags() between validation and the schema. - Collision check now covers alias paths too, so a duplicate alias that would silently shadow a real command fails the build. * fix(cli): harden agent recovery and introspection Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>	2026-07-10 19:17:01 -07:00
Jinwoo HongandOrca	39964149c8	Per-Workspace Environments (on-demand disposable runtimes) + Add Project remote host setup (#6320) ... Co-authored-by: Orca <help@stably.ai>	2026-06-30 11:31:55 -07:00
4 people	42b2ecc5c6	feat(emulator): Android emulation via scrcpy (cross-platform, iOS parity) (#6434) ... * docs: add Android emulation design spec Adds the design for first-class Android emulator support as a cross-platform peer of the iOS simulator feature: an extracted EmulatorBackend interface (iOS + Android), full AVD lifecycle management via the Android SDK, a live scrcpy H.264 pane decoded in-renderer with WebCodecs, the full control surface (tap/gesture/type/buttons/rotate), accessibility tree, app install/launch, runtime permissions, logcat, and a dedicated orca-emulator-android skill. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(emulator): add EmulatorBackend interface + backend/codec session tags First step of multi-backend emulator support: introduce the EmulatorBackend type and tag each session with its backend kind + stream codec, defaulting to ios/mjpeg so existing serve-sim behavior is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(emulator): extract IosEmulatorBackend and make the bridge a router Move the serve-sim/simctl device + helper + input mechanics out of EmulatorBridge into IosEmulatorBackend (implementing EmulatorBackend). The bridge now owns the session registry and lifecycle orchestration and routes each command to the backend that owns the target device. iOS behavior is unchanged; the existing bridge tests pass untouched and the backend gains its own input-op coverage. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): add pure Android leaf modules (sdk/adb/avd/scrcpy/input/ax) Dependency-injected building blocks for the Android emulator backend, each unit- tested in isolation: SDK + tool discovery, adb device/output parsing, AVD list + boot arg building, scrcpy control-socket byte encoders, normalized<->pixel + keycode mapping, and a uiautomator XML accessibility-tree parser. Not yet wired; AndroidEmulatorBackend composes these in the next phase. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(emulator): gate availability on the iOS backend + lock it with tests inspectEmulatorAvailability now decides iOS host support via the registered iOS backend instead of a bare platform literal, routing the decision through the multi-backend seam. Output shape and all messages are unchanged (the settings pane still reads simctl/serveSim). Adds the previously-missing regression tests covering the unsupported, ready, no-devices, and tool-failure paths. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): add Android app/permissions/logcat arg builders Pure adb arg-builders + a logcat line parser for app install/launch, runtime permission grant/revoke/reset, and logcat capture. Unit-tested in isolation; wired into AndroidEmulatorBackend's capability verbs in a later phase. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): AndroidEmulatorBackend device management + unified device list Adds the Android backend (registered alongside iOS in the bridge): SDK-gated host support, device/AVD discovery and merge, AVD boot + boot-completion wait, shutdown, and tap/swipe/type/button/rotate/exec via `adb shell input` so control works without the scrcpy server (the live H.264 stream lands in the streaming phase). Surfaces everything through a new cross-platform `orca emulator devices` command (RPC emulator.listDevices -> bridge.listAllDevices) with a platform column. Device inventory is split into its own module to keep files focused. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): Android capability verbs (install/launch/permissions/ax/logcat) Wires the Android capability operations into AndroidEmulatorBackend and exposes them through a capability-gated bridge router (runCapability), RPC, and CLI: - orca emulator install/launch/permissions/ax/logcat Capabilities are advertised per backend; calling one on a backend that lacks it (e.g. iOS) fails with emulator_unsupported instead of a silent no-op. Input ops and capability ops are split into focused modules to keep files under the line cap; the runtime shares one target-param type. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(skill): add orca-emulator-android skill + cross-ref from iOS skill Documents the cross-platform Android emulator control surface (devices, input, hardware buttons, rotate, install/launch, permissions, ax, logcat) driveable via the orca CLI today, and notes the live visual pane is in development. Points the iOS skill's "when not to use" at the new Android skill. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): Android live-pane streaming scaffolding (scrcpy + WebCodecs) Builds the H.264 video path as scaffolding: scrcpy frame/codec-meta parsing, server-deploy arg builders, control-protocol encoders (committed earlier), the stream session (server + sockets), a video pub/sub registry, the emulator:videoStream* IPC channel, and a renderer WebCodecs->canvas hook. Pure framing/deploy/registry are unit-tested; the socket/WebCodecs/jar integration is clearly flagged UNVERIFIED and the remaining wiring (startSession, preload, pane codec branch, packaging the jar) is documented in docs/android-emulation-streaming.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: fix streaming notes doc path in video-stream hook comment Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(emulator): add diagnostic probes for Android testing Adds an emulator-probe logger (console + temp file at os.tmpdir()/orca-android-emu-probe.log) and wires probes at four layers so errors surface during manual testing: every emulator.* RPC call + error (RPC dispatcher), every adb/emulator command + non-zero exit (command runner), and the scrcpy session + video-stream IPC lifecycle. Temporary diagnostics; remove or gate behind a flag once the Android pane is validated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): show Mobile Emulator settings cross-platform + aggregate Android availability The Mobile Emulator settings section is no longer macOS-gated (Android works on Windows/Linux), and inspectEmulatorAvailability now aggregates the iOS and Android backends: Android devices/AVDs appear in the device list and a host without iOS gets the Android setup message instead of "requires macOS". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): show Mobile Emulator sidebar nav entry on non-mac desktops The settings sidebar nav registered the Mobile Emulator entry behind isMac, so it stayed hidden on Windows/Linux even after the section content was ungated. Widen it to showDesktopOnlySettings to match the section. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): wire Android startSession to scrcpy + client-downloaded jar AndroidEmulatorBackend.startSession now boots the device, ensures the scrcpy server jar (downloaded by the client into the per-user cache on first use, not bundled), starts a ScrcpyStreamSession, and feeds its H.264 frames to the video registry; stopHelperForDevice tears it down. Sessions carry their backend kind so worktree-active routing picks the right backend. Boot, host SDK discovery, and the stream starter are split into focused modules to stay under the line cap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): stop the iOS backend from claiming Android devices off-mac iOS ownsDevice now returns false unless the host supports it, so on Windows an Android serial routes to the Android backend instead of erroring with "requires macOS". Backend-for-device fallback prefers a host-supported backend. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): scrcpy scid 31-bit + retry video socket until server delivers Two fixes validated against a real emulator: scrcpy parses scid as a signed 32-bit hex int, so mask to 31 bits + pad to 8 digits (8-byte values overflowed and the server exited). And adb accepts the forwarded TCP connection before the server's abstract socket exists then resets it, so retry the video socket until it actually delivers the dummy byte before connecting control. H.264 meta now arrives (576x1280). Adds socket/server-exit diagnostics probes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): render the Android H.264 pane via WebCodecs Wires the live Android pane end-to-end: preload exposes emulator video stream APIs; the pane's device list uses the unified emulator.listDevices (Android + iOS); and emulator-screen-stream-content renders a WebCodecs <canvas> for scrcpy:// sessions (H.264, SPS/PPS prepended to the first keyframe) instead of the MJPEG <img>. The video hook reports the stream size for the device frame. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): buffer the current GOP for late video subscribers The renderer subscribes after attach already started the scrcpy stream, so the registry now caches the current GOP (keyframe + following deltas) alongside the codec meta and config, and replays it on subscribe. A pane opened mid-stream decodes from the keyframe immediately instead of showing black until scrcpy's next periodic keyframe (~10s). Refreshes the now-validated session doc comment. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): show New Mobile Emulator tab action off macOS The tab create menu and its dropdown item gated the New Mobile Emulator action on isMacOs, hiding it on Windows/Linux where Android emulation is now supported. Gate on mobileEmulatorEnabled + onNewSimulatorTab (already cross-platform) so the action appears wherever a mobile emulator backend is available. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): open the Mobile Emulator tab off macOS openMobileEmulatorTab and ensureSimulatorTab both returned null unless the host was macOS, so the New Mobile Emulator action no-opped on Windows/Linux even though the menu entry showed. Drop the isMacOsHost early-returns; the mobileEmulatorEnabled setting and backend availability already gate the feature. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): resolve a default attach device across backends emulatorAttach with no device fell back only to the iOS listSimulators picker (empty on Windows/Linux), so the pane's no-device launch flow errored. Extract resolveDefaultAttachDevice: iOS default first, else the first booted (else first) device across host backends, so Android attaches without an explicit device. Split into its own module to stay under the line cap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): render the pane off macOS instead of an unavailable wall EmulatorPane short-circuited to the "macOS only" EmulatorUnavailablePane on any non-Mac host, blocking the now-working Android pane. Always render the pane content; its device discovery and error surface handle a missing backend. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): let attach boot a shut-down AVD with a stale active session getReusableActiveForWorktree called resolveDeviceId on the requested device, which throws for a not-yet-booted Android AVD, aborting the attach. Guard it so a resolve failure means "not the active device" and the attach falls through to a fresh boot — so picking a shut-down AVD in the pane and hitting Connect boots it via ensureBooted instead of erroring. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): launch the AVD detached instead of via execFile bootAndroidDevice started the emulator through the command runner (execFile with a timeout + 1MB stdout maxBuffer), which kills the long-running, verbose emulator process — so booting an AVD from the pane never actually came up. Spawn it detached with no stdio and unref it so it outlives the call, mirroring how the scrcpy server is launched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): dedupe concurrent attaches into one scrcpy stream Extract AndroidStreamController to own the per-serial scrcpy lifecycle and dedupe starts: concurrent attaches (e.g. the pane's auto-attach racing the tab launch) now share one in-flight start and reuse the live stream instead of spawning a second scrcpy server that fights for the port and kills the first. Also initialize the registry GOP buffer in register() (latent type error). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): boot the AVD headless without a console window The detached spawn opened a Windows console (showing the emulator's verbose qemu/netsim logs) and a redundant native emulator window. Pass windowsHide and run the emulator with -no-window so it boots headless — the scrcpy pane is the view, matching how iOS hides Simulator.app. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): boot the AVD with a hidden console, not detached detached: true sets DETACHED_PROCESS, which gives the console-subsystem emulator no console — so it and its qemu/netsim children pop their own visible cmd window that windowsHide can't suppress. Drop detached and rely on windowsHide (CREATE_NO_WINDOW = hidden console) + unref; spawn already keeps it alive past the launch call, and managed emulators are shut down on app quit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): keep Android emulators alive when switching devices Attaching a different device shut down the active one (shutdownDevice: true), which for Android meant killing the running emulator and cold-booting the target (~60s) on every switch — and switching back. Add bridge.stopActiveForSwitch: Android emulators stay running for instant switch-back, while iOS simulators are still replaced. Switching to an already-running emulator is now immediate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(emulator): only resize the video canvas when dimensions change The decoder output handler set canvas.width/height on every frame, which reallocates the canvas backing store and forces an object-contain reflow each frame — a needless per-frame cost. Resize only when the frame dimensions actually change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): genericize copy + add Android Studio setup link Replace iOS-only wording (Xcode/Simulator/iPhone) in the pane and settings with backend-neutral copy so Android reads correctly on every platform. When no emulator is available, the Mobile Emulator settings now show a "Download Android Studio" link plus setup guidance (ANDROID_HOME / default install path). Removes the now-unused, macOS-only EmulatorUnavailablePane. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): show emulator SDK status in settings The backend availability now reports the resolved Android SDK path, aggregated into emulator.availability as an `android` block. The Mobile Emulator settings render an "Emulator SDKs" card showing Android SDK (detected at <path> / not found, with a Download Android Studio link) and, on macOS, iOS Simulator (Xcode) status — mirroring the agent-control card. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(emulator): locate a custom Android SDK folder from settings Add an androidSdkPath setting and a "Locate SDK folder…" / Clear action in the emulator SDK status card. The path is applied as the highest-priority discovery candidate (falls back if invalid), and the backend's SDK is re-resolved on use via a new AndroidSdkState — so locating or installing the SDK takes effect on Refresh without restarting Orca. Guards the status card against older runtimes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): settle the scrcpy video socket once to stop retry storms A failed TCP connect emits both 'error' and 'close', so retry ran twice and scheduled openVideoSocket(attempt+1) twice — fanning out into an exponential connection storm while waiting for the server to start listening. A runaway chain could then hit attempt 100 and fail/close a stream that had already connected. Replace the delivered flag with a single settled latch so each socket retries (or delivers) exactly once. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): address CodeRabbit review findings - avd-boot: handle spawn 'error' (an unhandled ChildProcess error crashed the main process); validate the target is a known AVD before launching. - capability-ops: propagate adb non-zero exits for launch/permission/logcat and check the uiautomator dump before reading (avoids stale XML). - scrcpy-video-registry: actually replay the buffered GOP on subscribe so late subscribers decode immediately. - android-sdk-state: re-resolve host discovery every call so a changed SDK path takes effect live (no restart). - android-sdk-discovery: require both adb and the emulator binary. - emulator-bridge: fall back to the platform-primary backend (Android off-mac) so setup errors aren't iOS/CoreSimulator on Windows/Linux. - scrcpy-server-download: dedupe concurrent first-use downloads + add a timeout. - scrcpy-stream-session: idle-socket connect timeout; surface control-socket errors instead of swallowing them. - android-exec: pass the whole command so the device shell parses quotes/pipes. - avd-manager: match emulator log prefixes exactly (keep AVD names like PixelWARNINGTest). - permissions: `pm reset-permissions` is global and takes no package argument. - stream controller/starter: drop stale handles for dead streams; idempotent teardown. use-emulator-video-stream: stopVideoStream returns Promise. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(emulator): populate the GOP buffer and reuse live scrcpy streams Self-audit follow-ups in the same class as the CodeRabbit GOP-replay finding: - scrcpy-video-registry: pushFrame never wrote to entry.gop, so the replay loop added for late subscribers iterated an empty array — a no-op. Build the GOP on ingest (start at each keyframe, append following deltas; don't buffer deltas before the first keyframe). Adds tests for population, reset, and the pre-keyframe guard. - android backend: isSessionReusable was stubbed to always return false with a "no persistent stream yet" note, but scrcpy streams are persistent now — so every renderer remount tore down and respawned the server. Reuse a live stream (scrcpyVideoRegistry.has) so remounts reconnect, matching iOS. The device-mismatch check still runs first, so device switching is unaffected. - Refresh stale comments that implied unfinished/unverified work. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Changes before auto-review fixes Co-authored-by: Orca <help@stably.ai> * Refine mobile emulator availability settings Co-authored-by: Orca <help@stably.ai> * Address emulator review follow-ups Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>	2026-06-28 21:01:09 -07:00
+313 people	36277801e4	Make remote hosts first class: concurrent multi-host workbench (#5071) ... * Restore the outlined server card for host headers Feedback: the bordered card with the server glyph made it clearer that a host section is a separate machine, not just another group. Bring that back while keeping the recent quieting: no status dot when healthy (marks only for connecting/blocked/error/disconnected), no 'This computer' detail on the local host, and collapse/menu/count behavior unchanged. Co-authored-by: Orca <help@stably.ai> * Anchor host badge to its label, indent rows under host cards Sidebar polish from review: - The count badge sat in dead space between the label and the hover-only chevron/menu; it now hugs the label like repo headers - Rows under a host card get a left inset so projects and workspaces visibly belong to the machine above them - A host whose only visible row is a collapsed repo group counted 0 while the group badge said 9; host counts now fall back to header counts for groups contributing no visible items Co-authored-by: Orca <help@stably.ai> * Two-tier sticky headers: pinned host card above pinned group header When scrolling inside a host section, the host card now stays pinned at the top (z-30) while project/status group headers hand off beneath it (z-20, offset by the pinned card height). The host is the outer hierarchy level, so it is the most persistent context — previously the first repo header replaced it, losing 'which machine am I on' exactly when it mattered. The pinned card keeps its collapse/menu/warning affordances. Handoff rules: the next host card pushes the previous one out at the viewport top; a group pins only once it reaches the slot beneath the host card, and a previous host's group can never pin under the next host. Without host sections the logic degrades to the original single-tier behavior. Co-authored-by: Orca <help@stably.ai> * Revert host-section row indent The two-tier sticky host card now provides continuous 'inside this machine' context at any scroll depth, making the static indent redundant — and it cost 12px of sidebar width on every row while making multi-host layouts misalign with single-host ones. Host cards bracketing their sections plus the pinned header carry the ownership signal on their own. Co-authored-by: Orca <help@stably.ai> * Checkpoint multi-host sidebar and project-first notes Co-authored-by: Orca <help@stably.ai> * Add project-first compatibility persistence Co-authored-by: Orca <help@stably.ai> * Expose project host setup APIs Co-authored-by: Orca <help@stably.ai> * Group sidebar rows by project setup Co-authored-by: Orca <help@stably.ai> * Document project-first host model discussion Co-authored-by: Orca <help@stably.ai> * Resolve workspace creation through project host setups Co-authored-by: Orca <help@stably.ai> * Stamp workspace ownership with project host setup Co-authored-by: Orca <help@stably.ai> * Add project host setup existing folder API Co-authored-by: Orca <help@stably.ai> * Summarize project-first host model discussion Co-authored-by: Orca <help@stably.ai> * Add project host setup CLI commands Co-authored-by: Orca <help@stably.ai> * Allow CLI worktree creation by project host setup Co-authored-by: Orca <help@stably.ai> * Add workspace host setup picker Co-authored-by: Orca <help@stably.ai> * Add project host setup settings summary Co-authored-by: Orca <help@stably.ai> * Make project host setup settings navigable Co-authored-by: Orca <help@stably.ai> * Stabilize project host setup settings selector Co-authored-by: Orca <help@stably.ai> * Add project host existing-folder setup form Co-authored-by: Orca <help@stably.ai> * Update project host model implementation status Co-authored-by: Orca <help@stably.ai> * Keep projects outermost in default sidebar view Co-authored-by: Orca <help@stably.ai> * Update project-first sidebar status Co-authored-by: Orca <help@stably.ai> * Show host context in project sidebar groups Co-authored-by: Orca <help@stably.ai> * Show unavailable hosts in workspace run target Co-authored-by: Orca <help@stably.ai> * Import missing project host from composer Co-authored-by: Orca <help@stably.ai> * Clone project host setup from composer Co-authored-by: Orca <help@stably.ai> * Persist project host setup method Co-authored-by: Orca <help@stably.ai> * Clone project hosts over SSH Co-authored-by: Orca <help@stably.ai> * Improve SSH clone cancellation cleanup Co-authored-by: Orca <help@stably.ai> * Backfill workspace project host ownership Co-authored-by: Orca <help@stably.ai> * Gate project host setup runtime capability Co-authored-by: Orca <help@stably.ai> * Preserve independent project host setups Co-authored-by: Orca <help@stably.ai> * Add project host setup update API Co-authored-by: Orca <help@stably.ai> * Add project host setup delete API Co-authored-by: Orca <help@stably.ai> * Add project host setup create API Co-authored-by: Orca <help@stably.ai> * Expose project host setup lifecycle in renderer store Co-authored-by: Orca <help@stably.ai> * Handle independent project host setups in settings Co-authored-by: Orca <help@stably.ai> * Add pending host setup action in project settings Co-authored-by: Orca <help@stably.ai> * Show pending project host setup status in composer Co-authored-by: Orca <help@stably.ai> * Report pending setup state in workspace target resolution Co-authored-by: Orca <help@stably.ai> * Use shared host registry for project setup choices Co-authored-by: Orca <help@stably.ai> * Add settings clone flow for project host setups Co-authored-by: Orca <help@stably.ai> * Gate unavailable project host setup options Co-authored-by: Orca <help@stably.ai> * Gate unavailable project setup hosts in settings Co-authored-by: Orca <help@stably.ai> * Stream SSH clone progress to renderer Co-authored-by: Orca <help@stably.ai> * Update project host model status notes Co-authored-by: Orca <help@stably.ai> * Add CLI project host setup clone command Co-authored-by: Orca <help@stably.ai> * Make add project host aware Co-authored-by: Orca <help@stably.ai> * Complete project host setup validation Co-authored-by: Orca <help@stably.ai> * Recover floating workspace terminal WebGL atlas on reopen (#5069) Co-authored-by: Orca <help@stably.ai> * Fix stale terminal daemon spawn health (#5064) Co-authored-by: Orca <help@stably.ai> * Suspend floating workspace terminal WebGL while the panel is closed (#5073) Co-authored-by: Orca <help@stably.ai> * Fix source control branch compare base (#5074) Co-authored-by: Orca <help@stably.ai> * Fix workspace-creation tour panel clipped by the Create Worktree dialog (#5078) * Fix workspace-creation tour panel clipped by the composer dialog The tour panel portals into dialog/sheet content that clips overflow, but its position was clamped against the window viewport. With the Project field spanning nearly the dialog's full width, the panel landed past the dialog's right edge and overflow-hidden cut it down to a sliver. Clamp hosted panels within the host's bounds instead, so the panel flips below the target and stays fully visible. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Add JSDoc docstrings to satisfy CodeRabbit docstring coverage check Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Test hosted contextual tour overlay positioning --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> * release: v1.4.56 * Handle buffer overflows gracefully and truncate diffs fairly (#5083) - Gracefully fall back to file-name summaries when staged diffs exceed node/ssh execution maxBuffer limits, preventing generation failures. - Split oversized diffs by file and allocate budget via water-filling, ensuring single huge files do not starve smaller human changes. - Clip truncated diff sections on line boundaries to avoid half-lines. * Wrap AI generation controls with tooltips and clean i18n dependencies (#5087) - Wrap the AI generation button in a tooltip so users can see the disabled reason or the action description on hover. - Add unit tests verifying tooltip triggers and aria-label safety. - Simplify memo dependencies in settings metadata and worktree palette by using 'useTranslation()' to handle language-change rerenders directly without needing 'i18n.language'. * fix: address review findings (#5088) * Fix localization in repository hooks and base ref suggestion toast (#5089) * Fix localization in base ref toast and custom hook description - Localize the "commit"/"commits" plural nouns in the base ref toast. - Translate missing suggestion toast strings for JA, KO, and ZH locales. - Pass `{{artifact_url}}` as a literal template variable to translate calls to prevent i18next from treating it as a dynamic placeholder. * Fix localization reactivity in RepositoryHooksSection Move static variables containing translation calls into helper functions and subscribe to translation updates using useTranslation. This ensures that localized options, descriptions, and error messages refresh dynamically when the user changes the UI language. * Fix task page labels after language changes (#5086) Co-authored-by: Orca <help@stably.ai> * release: v1.4.57 * Fix automation tabs showing a shell instead of the live agent (#5099) * Fix automation tabs showing a shell instead of the live agent Opening a background automation's terminal tab showed a bare shell while the agent (Claude) kept running headless — the sidebar updated but the pane was attached to the wrong PTY. On first mount the restored ptyId equals the tab ptyId, and isSessionOwnedByWorktree() returns true for it, so connectPanePty routed the still-live eagerly-spawned PTY into the daemon-reattach branch (transport.connect({ sessionId })), which spawns a fresh shell and orphans the live agent PTY instead of adopting it via attach()+replay. Part A: gate the deferred reattach on the absence of a live eager buffer. A live eager buffer means the PTY is a still-running local session to adopt (attach + replay), not a daemon session to re-connect. Daemon reattach and remote PTYs are unaffected (gated on the eager buffer). Part B: publish never-mounted background automation tabs into the runtime graph (gated on a live eager buffer) so the live agent PTY binds to its real tab instead of surfacing as an orphan `pty:<id>` terminal — fixing `orca terminal list`, the CLI, and automation session-reuse. Adds a characterization test (fails on the old code, passes now) and a runtime-graph publish test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Harden eager PTY tab adoption Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai> * Fix i18n label spacing in menus and settings (#5108) * fix i18n label spacing * Fix localized account runtime labels Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai> * Improve localization catalog sync workflow (#5110) Co-authored-by: Orca <help@stably.ai> * Add Warp terminal theme import (#4714) Co-authored-by: Orca <help@stably.ai> * release: v1.4.58 * Tidy README badge layout * Handle integration credential decrypt failures (#4683) Co-authored-by: Orca <help@stably.ai> * Fix git repo telemetry for repo adds (#5121) Co-authored-by: Orca <help@stably.ai> * Add feature interaction usage bucket telemetry (#5119) Co-authored-by: Orca <help@stably.ai> * Reset WebGL glyph atlases globally to stop cross-terminal glyph corruption (#5122) Co-authored-by: Orca <help@stably.ai> * perf(windows): fix 60s startup ACL walk and OpenCode streaming freeze, with benchmark harnesses (#5124) * release: v1.4.59-rc.0 * Fix packaged shell PATH order (#5125) Co-authored-by: Orca <help@stably.ai> * Add Floating Workspace contextual tour (#5062) * Add floating workspace contextual tour Co-authored-by: Orca <help@stably.ai> * Clarify floating workspace tour intro copy Co-authored-by: Orca <help@stably.ai> * Differentiate floating workspace tour steps instead of repeating examples Co-authored-by: Orca <help@stably.ai> * Lead floating workspace tour with the user benefit Co-authored-by: Orca <help@stably.ai> * Pitch floating workspace tour around cross-repo agents Co-authored-by: Orca <help@stably.ai> * Refine floating workspace tour step 1 copy Co-authored-by: Orca <help@stably.ai> * Anchor floating workspace tour step 2 on the minimize control Co-authored-by: Orca <help@stably.ai> * Restore floating workspace tour step 2 Co-authored-by: Orca <help@stably.ai> * Anchor floating workspace tour steps on New Terminal and New Markdown Note Co-authored-by: Orca <help@stably.ai> * Retitle floating workspace tour step 2 as scratchpad Co-authored-by: Orca <help@stably.ai> * Add why-comments for tour selector fallback and placement flipping Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai> * Fix source control compare base ambiguity (#5127) Co-authored-by: Orca <help@stably.ai> * release: v1.4.59-rc.1 [rc-slot:2026-06-10-15] * release: v1.4.59 * Default-driven create-project flow: name-first form with sensible defaults (#5115) Co-authored-by: Orca <help@stably.ai> * Redesign Connect integrations (#4531) Co-authored-by: Orca <help@stably.ai> * Expose E2E store via build mode * File search match counts (#5085) * Add matchCount to SearchFileResult for accurate per-file hit counts Co-authored-by: Orca <help@stably.ai> * Add file search match count design * rm design doc --------- Co-authored-by: Orca <help@stably.ai> * fix: address review findings (#5139) * perf(windows): avoid blocking daemon pid checks (#5137) * release: v1.4.60-rc.0 * release: v1.4.60 * Preserve core workflow terms in English and apply CJK spacing (#5141) * Preserve core workflow and product terms in English across locales Update translation policy to prevent localization of key terms such as "Agent", "Commit", "Markdown", and "Terminal". This ensures consistent jargon and product branding. Introduce CJK-Latin term spacing to keep these Latin terms legible when combined with CJK text, while adjusting Korean particle spacing. Also add overrides to prevent network proxy settings from being mistranslated as "Agent". * Preserve repo terminology in English and localize source control labels Treat "repo" and "repos" (and their capitalized forms) as brand terms that should remain in English/Latin across CJK and Spanish locales. Update translation files and policies to replace translated words like "repositorio" or "リポジトリ" with "repo"/"repos", and fix an issue where latin brand terms could be incorrectly matched as substrings in larger words during cleanup. Additionally, externalize and localize the "Staged Changes", "Changes", and "Untracked Files" section labels in the source control sidebar. * UX (#5143) * UX/copy tweaks (#5142) * UX/copy tweaks * UX/copy tweaks * Fix missed star UI translations (#5148) * fix: make windows ssh relay deploy survive session teardown (#5136) * Add option to remove child projects when deleting repo groups (#4702) Co-authored-by: Orca <help@stably.ai> * fix: remove checks panel response badge (#5147) * Add read-only `orca linear` CLI with trusted launch-prompt pointer (V1) (#5126) Co-authored-by: Orca <help@stably.ai> * Add AI Vault session history ## Summary - add AI Vault session scanning and resume command construction - add the Agents sidebar panel with filtering, grouping, copy/open actions, and local resume launch - support dragging saved sessions onto terminal split panes ## Validation - pnpm run lint - pnpm run typecheck - pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/register-core-handlers.test.ts src/main/ai-vault/session-scanner.test.ts src/renderer/src/components/right-sidebar/ai-vault-session-filters.test.ts src/renderer/src/lib/ai-vault-session-drag.test.ts src/renderer/src/lib/launch-ai-vault-session.test.ts * Default agent launches to yolo permissions mode (#5145) * Default agent launches to yolo mode * test: update launch default validations * Fix Claude usage refresh error copy (#5155) Co-authored-by: Orca <help@stably.ai> * Move workspace board to sidebar bottom toolbar (#5146) Co-authored-by: Orca <help@stably.ai> * Rebuild contextual tour positioning on floating-ui; fix hosted dialog placement and arrow seam (#5154) Co-authored-by: Orca <help@stably.ai> * Fix missing spaces in cross-repo switch dialog (#5158) * Fix Ctrl+Tab switcher selection on release (#5116) * Fix additional i18n spacing regressions from #4995 (#5159) * Refine add project selection styling (#5160) Co-authored-by: Orca <help@stably.ai> * improve chinese localization (#5162) * Fix floating workspace needing two clicks after app switch (macOS) (#5128) * Autofocus feedback textarea when Send Feedback dialog opens (#5164) * fix: address pr-bug-scan validated finding from #4683 (#5151) Isolated CredentialDecryptionError per-item in Linear getClients (client.ts:518) and Jira getClients (client.ts:373) on the 'all' selection so one bad credential no longer collapses healthy workspaces Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai> * fix: enable claude agent teams by default (#5168) * Refresh Jira and Linear status after credential errors (#5169) * fix: address pr-bug-scan validated finding from #4683 Isolated CredentialDecryptionError per-item in Linear getClients (client.ts:518) and Jira getClients (client.ts:373) on the 'all' selection so one bad credential no longer collapses healthy workspaces * Refresh Jira and Linear status to clear stale credential errors Ensure stale credential decryption errors are cleared from the store status once a successful API read completes. By updating the check in shouldRefreshStatusAfterRead to trigger when a credentialError is currently set, successful issue or list fetches will trigger a status check and remove stale error flags. --------- Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai> * Hide internal context from AI Vault titles (#5175) * Fix detached HEAD publish actions (#5173) * Keep freshly split terminal pane mounted if newborn PTY exits early (#5171) Prevent a newly split pane from collapsing immediately if its PTY exits during initial setup before any output is received or input is sent. This ensures a failed startup session remains visible to the user. * Route task PR queries by upstream source (#5176) * Route task PR queries by upstream source Implements the routing described in docs/tasks-pr-upstream-source.md so task PR and issue queries stay scoped to the selected source. * rm design doc * Prevent stale PR refreshes from restoring unlinked review state (#5180) - Pass `worktreeId` to `fetchPRForBranch` to track active worktree context - Ignore inflight or queued PR fetches if the worktree has been unlinked - Include linked PR/MR metadata in the checks panel snapshot key to trigger updates immediately on link/unlink events * Fix Claude agents management status detection (#5179) Co-authored-by: Orca <help@stably.ai> * fix: address review findings (#5177) * Allow resolving selected review comments with AI (#5184) * Allow resolving selected PR/MR review comments with AI Users can now select specific unresolved review comments or threads in the Checks panel sidebar, queue them, and trigger an AI agent to address them, marking resolved threads on the host upon agent launch. - Adds checkboxes and action/send buttons to select and queue comments. - Builds a structured, robust prompt with sanitized comment metadata. - Optimistically marks threads resolved on launch with rollback on error. - Supports both GitHub PRs and GitLab MRs. * Consolidate PR comment selection state and eliminate effects Combine independent selection states and context-tracking into a single state object. Derive active selection data and prune ineligible comments during render using useMemo instead of relying on asynchronous useEffect synchronization hooks. * Improve source control action dialog layout and recipe saving UX (#5153) * Improve source control agent action dialog layout and recipe UX - Constrain dialog and scroll area heights to prevent viewport overflow. - Add variable chips to easily insert the base prompt with tooltip previews. - Keep the recipe save controls visible when a recipe is already saved, showing informational status text instead of hiding them. - Update localized copy across multiple languages and reduce textarea rows. - Add unit tests for the variable chip preview and save target visibility. * Fix recipe-saved check in source control action dialog * Evaluate only the selected save target instead of checking all available targets, as the action only writes to the selected target. * Update daemon PTY adapter test fake PID to prevent collision with real host OS processes during runtime directory lookups. * fix: remove unsupported agent launch defaults (#5185) * Update Chinese and Japanese translations for worktrees and fixes (#5187) - Correct awkward Chinese translation of "fix" ("使固定") to "修复" and "基本的" to "主工作树" (main worktree). - Improve Japanese translation of "fix" from physical repair ("修理") to software correction ("修正"). * Embed hosted review creation composer directly in Checks panel (#5140) * Embed hosted review creation composer directly in the Checks panel - Replaces the modal pull request/merge request creation dialog with an inline composer embedded in the empty state of the Checks sidebar. - Extracts and moves pull request generation state to a dedicated store slice so AI-generated details are persisted across sidebar unmounts. * Fix hosted review composer feedback * Combine file search and file explorer right sidebar tabs (#5182) Unifies file discovery and tree navigation under a single Explorer domain, simplifying the right sidebar activity bar and reducing tab clutter. * Replaces the standalone 'search' activity bar tab with a nested 'search' subview inside the File Explorer tab * Introduces 'rightSidebarExplorerView' ('files' | 'search') state to manage the active subview inside the Explorer * Adds a search button to the File Explorer toolbar and a back button to the search subview for seamless transition * Exposes 'showRightSidebarFiles' and 'showRightSidebarSearch' store actions to route and seed search queries/include patterns * Adapts file explorer keybindings, git status polling, and external workspace watchers to respect the active subview * Maps legacy persisted search tab state to the new explorer search view for backward compatibility * release: v1.4.61-rc.1 * Add multi-repo folder workspaces (v1) (#5172) Co-authored-by: Orca <help@stably.ai> * release: v1.4.61-rc.2 * Hide unavailable project hosts in worktree composer Co-authored-by: Orca <help@stably.ai> * Remove inline project host setup from composer Co-authored-by: Orca <help@stably.ai> * Mark imported project host setup methods Co-authored-by: Orca <help@stably.ai> * Fix rebase merge fallout Co-authored-by: Orca <help@stably.ai> * Disable unavailable Add Project hosts Co-authored-by: Orca <help@stably.ai> * Compact Add Project host selector Co-authored-by: Orca <help@stably.ai> * Hide redundant SSH target chooser Co-authored-by: Orca <help@stably.ai> * Browse SSH clone destinations Co-authored-by: Orca <help@stably.ai> * Avoid local clone defaults for SSH hosts Co-authored-by: Orca <help@stably.ai> * Polish host-aware Add Project flows Co-authored-by: Orca <help@stably.ai> * Polish remote host add project flows Co-authored-by: Orca <help@stably.ai> * Remove redundant host kind chips Co-authored-by: Orca <help@stably.ai> * Fix remote project setup UX gaps Co-authored-by: Orca <help@stably.ai> * Fix multihost workspace composer project identity Co-authored-by: Orca <help@stably.ai> * Finish host context merge repair Co-authored-by: Orca <help@stably.ai> * Continue host context checklist implementation Co-authored-by: Orca <help@stably.ai> * Route Linear and Jira tasks by source context Co-authored-by: Orca <help@stably.ai> * Preserve Linear task source context in history Co-authored-by: Orca <help@stably.ai> * Scope task retry state by source context Co-authored-by: Orca <help@stably.ai> * Route GitHub drawer reads by source context Co-authored-by: Orca <help@stably.ai> * Guard GitLab selectors with repo context Co-authored-by: Orca <help@stably.ai> * Guard GitHub metadata selectors Co-authored-by: Orca <help@stably.ai> * Route GitHub task row actions by source context Co-authored-by: Orca <help@stably.ai> * Update GitHub source-context checklist status Co-authored-by: Orca <help@stably.ai> * Show host ownership for CLI provider accounts Co-authored-by: Orca <help@stably.ai> * Persist GitLab task detail source context Co-authored-by: Orca <help@stably.ai> * Show host scope for provider API budgets Co-authored-by: Orca <help@stably.ai> * Preserve Jira task source context Co-authored-by: Orca <help@stably.ai> * Scope Jira optimistic task patches Co-authored-by: Orca <help@stably.ai> * Resolve task PR bases on run host Co-authored-by: Orca <help@stably.ai> * Record Jira task workspace usage Co-authored-by: Orca <help@stably.ai> * Scope Linear optimistic task patches Co-authored-by: Orca <help@stably.ai> * Scope GitHub optimistic task patches Co-authored-by: Orca <help@stably.ai> * Clean host copy in onboarding flows Co-authored-by: Orca <help@stably.ai> * Preserve automation CLI run context Co-authored-by: Orca <help@stably.ai> * Add automation CLI source context selector Co-authored-by: Orca <help@stably.ai> * Clarify unavailable task source hosts Co-authored-by: Orca <help@stably.ai> * Surface host model runtime capability skew Co-authored-by: Orca <help@stably.ai> * Use SSH host copy in reconnect dialog Co-authored-by: Orca <help@stably.ai> * Show host context in task source picker Co-authored-by: Orca <help@stably.ai> * Mark task source display complete Co-authored-by: Orca <help@stably.ai> * Clarify provider account host selection Co-authored-by: Orca <help@stably.ai> * Guard task source switching boundary Co-authored-by: Orca <help@stably.ai> * Mark task source diagnostics persisted Co-authored-by: Orca <help@stably.ai> * Mark base resolution host boundary Co-authored-by: Orca <help@stably.ai> * Clarify external automation source states Co-authored-by: Orca <help@stably.ai> * Harden project host compatibility projection Co-authored-by: Orca <help@stably.ai> * Finish host copy audit Co-authored-by: Orca <help@stably.ai> * Add provider host scope controls Co-authored-by: Orca <help@stably.ai> * Show task source account labels Co-authored-by: Orca <help@stably.ai> * Show automation run context in CLI Co-authored-by: Orca <help@stably.ai> * Scope Jira task cache lookups by source Co-authored-by: Orca <help@stably.ai> * Seed workspace creation from task source context Co-authored-by: Orca <help@stably.ai> * Explain disabled external automation actions Co-authored-by: Orca <help@stably.ai> * Surface task source runtime capability gaps Co-authored-by: Orca <help@stably.ai> * Persist automation run context from UI saves Co-authored-by: Orca <help@stably.ai> * Require workspace run capability for setup hosts Co-authored-by: Orca <help@stably.ai> * Disable automation runs for stale host setup Co-authored-by: Orca <help@stably.ai> * Route GitHub drawer metadata by source host Co-authored-by: Orca <help@stably.ai> * Guard runtime project setup mutations by host model Co-authored-by: Orca <help@stably.ai> * Route PR page metadata by repo host Co-authored-by: Orca <help@stably.ai> * Route PR mention metadata by repo host Co-authored-by: Orca <help@stably.ai> * Route GitHub Project edits by view source Co-authored-by: Orca <help@stably.ai> * Clarify runtime automation disabled states Co-authored-by: Orca <help@stably.ai> * Guard runtime automation backend dispatch Co-authored-by: Orca <help@stably.ai> * Preserve GitLab task source identity Co-authored-by: Orca <help@stably.ai> * Remove redundant SSH target row in add project Co-authored-by: Orca <help@stably.ai> * Add task source provider availability reasons Co-authored-by: Orca <help@stably.ai> * Surface task provider preflight availability Co-authored-by: Orca <help@stably.ai> * Record local GitHub task source verification Co-authored-by: Orca <help@stably.ai> * Record Linear task source verification Co-authored-by: Orca <help@stably.ai> * Show automation source context in details Co-authored-by: Orca <help@stably.ai> * Record remote capability negotiation coverage Co-authored-by: Orca <help@stably.ai> * Record local add project create verification Co-authored-by: Orca <help@stably.ai> * Scope Linear cached task reads by source Co-authored-by: Orca <help@stably.ai> * Preserve PR generation host ownership Co-authored-by: Orca <help@stably.ai> * Route git operations by owner host Co-authored-by: Orca <help@stably.ai> * Route delete warnings by worktree owner Co-authored-by: Orca <help@stably.ai> * Route editor drops by worktree owner Co-authored-by: Orca <help@stably.ai> * Route agent draft paste by tab owner Co-authored-by: Orca <help@stably.ai> * Route file explorer requests by worktree owner Co-authored-by: Orca <help@stably.ai> * Document remaining host context gaps Co-authored-by: Orca <help@stably.ai> * Check runtime task source provider auth Co-authored-by: Orca <help@stably.ai> * Validate automation source availability Co-authored-by: Orca <help@stably.ai> * Route remaining UI requests by owner host Co-authored-by: Orca <help@stably.ai> * Route quick open file listing by worktree owner Co-authored-by: Orca <help@stably.ai> * Route typed GitHub lookups by source host Co-authored-by: Orca <help@stably.ai> * Centralize automation run identity fallback Co-authored-by: Orca <help@stably.ai> * Surface unsupported task source providers Co-authored-by: Orca <help@stably.ai> * Document automation legacy repo compatibility Co-authored-by: Orca <help@stably.ai> * Record live host model verification Co-authored-by: Orca <help@stably.ai> * Quiet disconnected SSH polling Co-authored-by: Orca <help@stably.ai> * Verify task drawer source boundaries Co-authored-by: Orca <help@stably.ai> * Verify GitLab repo source selectors Co-authored-by: Orca <help@stably.ai> * Route automations through owning host Co-authored-by: Orca <help@stably.ai> * Update host context verification checklist Co-authored-by: Orca <help@stably.ai> * Run remote automations headlessly in serve mode Co-authored-by: Orca <help@stably.ai> * Keep setup guide entry stable during refresh Co-authored-by: Orca <help@stably.ai> * Keep setup script prompt stable during host switches Co-authored-by: Orca <help@stably.ai> * Deduplicate Tasks project picker sources Co-authored-by: Orca <help@stably.ai> * Use project identity for Tasks picker dedupe Co-authored-by: Orca <help@stably.ai> * Add Tasks source host switcher Co-authored-by: Orca <help@stably.ai> * Refine Tasks source picker disclosure Co-authored-by: Orca <help@stably.ai> * Polish Tasks source picker hover Co-authored-by: Orca <help@stably.ai> * Open Tasks source menu on hover Co-authored-by: Orca <help@stably.ai> * Match Tasks source submenu hover behavior Co-authored-by: Orca <help@stably.ai> * Open Tasks source submenu from project row hover Co-authored-by: Orca <help@stably.ai> * Group automation project hosts Co-authored-by: Orca <help@stably.ai> * Tighten automation project picker density Co-authored-by: Orca <help@stably.ai> * Show selected host in Tasks project picker Co-authored-by: Orca <help@stably.ai> * Hide host labels for single-host project pickers Co-authored-by: Orca <help@stably.ai> * Use saved remote server names in host pickers Co-authored-by: Orca <help@stably.ai> * Use standard add project start for remote servers Co-authored-by: Orca <help@stably.ai> * Use saved host labels in workspace surfaces Co-authored-by: Orca <help@stably.ai> * Route remote browser tabs through runtime hosts Co-authored-by: Orca <help@stably.ai> * Keep sidebar project-first across grouping modes Co-authored-by: Orca <help@stably.ai> * Polish multi-host remote runtime UX Co-authored-by: Orca <help@stably.ai> * Fix CI lint and remove design notes Co-authored-by: Orca <help@stably.ai> * Fix CI test failures Co-authored-by: Orca <help@stably.ai> * Fix Windows CLI path expectation Co-authored-by: Orca <help@stably.ai> * Fix CI renderer test expectations Co-authored-by: Orca <help@stably.ai> * Fix remaining verify test failures Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai> Co-authored-by: Bryant Ung <bryant.ung@outlook.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Co-authored-by: Borja <3930245+BorjaLL@users.noreply.github.com> Co-authored-by: Parker Rex <me@parkerrex.com> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Co-authored-by: Trevin Chow <trevin@trevinchow.com> Co-authored-by: buf0-bot[bot] <252831055+buf0-bot[bot]@users.noreply.github.com> Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>	2026-06-13 18:53:01 -07:00
Brennan BensonandOrca	3a2d39cb37	Support full Linear task workflows from the CLI (#5323) ... Co-authored-by: Orca <help@stably.ai>	2026-06-13 15:07:44 -07:00
Brennan BensonandOrca	74c961b09f	Add Linear write commands for agents (#5165) ... Co-authored-by: Orca <help@stably.ai>	2026-06-12 13:29:13 -07:00
Brennan BensonandOrca	cdc0ca5e53	Add read-only orca linear CLI with trusted launch-prompt pointer (V1) (#5126) ... Co-authored-by: Orca <help@stably.ai>	2026-06-10 20:20:50 -07:00
Jinwoo HongandOrca	1b363b4d9c	Add mobile emulator (#4754) ... Co-authored-by: Orca <help@stably.ai>	2026-06-08 00:08:57 -07:00
Jinwoo Hong	62600ef808	Fix orchestration payloads on Windows (#4608)	2026-06-03 21:50:16 -04:00
Neil	f7fb6ef686	Expose memory diagnostics through CLI (#4408)	2026-06-01 15:14:15 -07:00
Jinjing	ffbc4c3cfb	fix: tighten CLI contract validation (#3874)	2026-05-30 12:55:47 -07:00
Trevin Chow	563d4ff64b	fix(cli): allow flag values that start with -- via --flag=value (#2892)	2026-05-27 00:19:43 -07:00
Jinwoo HongandOrca	523aa685bc	Add file-opening commands to Orca CLI (#2782) ... Co-authored-by: Orca <help@stably.ai>	2026-05-25 17:12:03 -07:00
Neil	d4703bd1ab	Restore agent hook opt-out controls (#2778)	2026-05-25 10:37:22 -07:00
Neil	28ba9151a5	Revert "Add agent hook opt-out controls" (#2739)	2026-05-23 23:04:57 -07:00
Neil	4f81953d10	feat: add agent hook opt-out controls (#2714)	2026-05-23 21:16:49 -07:00
Jinwoo HongandOrca	140ceb7fda	Add automation CLI commands (#2315) ... Co-authored-by: Orca <help@stably.ai>	2026-05-19 00:41:49 -07:00
Jinjing	82214e86ee	Revert "Add project notes (#1861)" (#1945) ... This reverts commit c73fd2c90b.	2026-05-15 11:46:06 -07:00
Jinwoo HongandOrca	a22717bb35	Refactor runtime app architecture (#1878) ... Co-authored-by: Orca <help@stably.ai>	2026-05-14 23:13:37 -07:00
Jinwoo HongandOrca	c73fd2c90b	Add project notes (#1861) ... Co-authored-by: Orca <help@stably.ai>	2026-05-14 13:33:24 -07:00
Jinwoo HongandOrca	0f54103dda	Add native computer-use automation (#1683) ... Co-authored-by: Orca <help@stably.ai>	2026-05-11 14:20:08 -07:00
NeilandHermes Agent	b933333500	fix(cli): exclude tab profile list/create/delete from --page flag (pr-bug-scan #1397) (#1512) ... Adds 'tab profile list', 'tab profile create', 'tab profile delete' to the supportsBrowserPageFlag exclusion list. These commands operate on profile identifiers, not browser pages, so accepting --page silently was misleading. Supersedes #1458 (which was branched off stale main pre-#1396 and would have reverted 'tab current' out of the exclusion list). Co-authored-by: Hermes Agent <hermes@orca>	2026-05-06 14:38:58 -07:00
Brennan BensonandOrca	6f2e31afad	feat(telemetry): PR 4 — wire 7 core events to call sites (#1433) ... Co-authored-by: Orca <help@stably.ai>	2026-05-05 11:57:51 -07:00
3 people	e623372cdb	feat(cli): add tab profile controls and automation primitives (#1396) ... * feat(cli): add browser tab profile controls * feat(cli): add tab profile automation primitives * refactor(cli): narrow tab profile automation scope * chore: retrigger PR checks * review: harden tab profile automation CLI - Wait for tab re-registration after browser.tabSetProfile so a follow-up tab list --show-profile reads the new sessionProfileId from BrowserManager instead of the stale one from the previous webview - Wait for tab registration after browser.tabProfileClone, matching browser.tabCreate, so the cloned browserPageId is operable when the CLI returns - Short-circuit browser.tabSetProfile when the tab is already on the requested profile so we do not tear down and remount the webview for a no-op switch - Switch TabShow.worktree from OptionalPlainString to OptionalString to match every other tab schema; empty --worktree should fall back to the active worktree, not pass through as the empty string - Add max-lines disable to browser.test.ts (file grew past 300 lines after adding the new tab-profile and tab-show tests) * review: fix useIpcEvents test setup for tab profile API CI failure: useIpcEvents.test.ts threw at module load with TypeError: window.addEventListener is not a function. The chain: the rebased useIpcEvents.ts imports destroyPersistentWebview from webview-registry, which calls window.addEventListener at module load. The test stubs window via vi.stubGlobal as a plain object without addEventListener, so the typeof window check passes but the call throws. - webview-registry.ts: tighten the module-load guard to also check that window.addEventListener is callable, so importing this module from a non-DOM-ish test env (vitest node env with stubbed window) does not throw at module load - useIpcEvents.test.ts: add the new onRequestTabSetProfile and replyTabSetProfile stubs to all 8 window.api.ui mocks so the new IPC subscription registered by useIpcEvents resolves * review: restore profile CRUD lost during rebase onto 1397-merged main The rebase brought commit 3242aa27 (refactor: narrow tab profile automation scope) onto a main that already had the lifecycle CRUD from 1397. The refactor commit removes BrowserProfileList/Create/Delete types, runtime methods, RPC registrations and schemas, plus the help/specs entries, because those were the precursor versions in commit 1 of this branch. Post-rebase those removals land on the hardened versions inherited from main, breaking 1397. Restore: - runtime-types.ts: BrowserSessionProfile import; ProfileList/Create/Delete result types - orca-runtime.ts: ProfileList/Create/Delete result type imports; browserProfileList/Create/Delete methods - browser-core.ts: ProfileCreate, ProfileDelete schema imports; browser.profileList/profileCreate/profileDelete RPC registrations - browser-schemas.ts: ProfileCreate, ProfileDelete zod schemas - help.ts: list/create/delete subcommand lines under Browser Automation - specs/browser-basic.ts: list/create/delete spec entries --------- Co-authored-by: Nikolatesla-lj <Nikolatesla-lj@users.noreply.github.com> Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>	2026-05-04 23:46:23 -07:00
Jinwoo HongandOrca	c9391e203f	feat(orchestration): add inter-agent orchestration system (#1188) ... Co-authored-by: Orca <help@stably.ai>	2026-04-28 12:21:31 -07:00
Neil	36c6a9241f	refactor(cli): split index.ts into per-verb handler modules (#1089)	2026-04-25 13:32:14 -07:00