3 Commits

Include renames

Author	SHA1	Message	Date
Brennan Benson	26a265d704	Host plans agent launches with the window's runtime rule and one runtime fact (C1) (#27692) ... * feat(agent-launch): host plans agent launches with the window's runtime rule and one runtime fact Host-started agent launches now pick their platform with the same rule the window uses (project runtime, else a \\wsl$ path, else the host), and resolve one runtime fact that supplies both the command quoting and the PTY shell. Adds the agent.launch.terminal-inputs.v1 capability and its optional title/extraAgentArgs/requestKind/terminalOnly fields; no sender yet. OpenCode's createAgentSession stays on today's rules until C2 (temporary). * fix(agent-launch): one shared runtime rule, a derived fact, and only quoted commands carry it Round-1 review fixes for C1: - Window and host read a workspace's runtime through one shared resolver (local-workspace-execution-runtime.ts); a repo-less \\wsl$ folder gets no runtime, as in the window. - The fact is { platform, remote, pty } with the spawn's own PTY type; the quoting shell is derived from it, never stored. - createAgentSession uses the same fact (its pre-C1 exception is deleted). - Worktree startups quote from a fact for the repo and pass it on; a runtime that needs repair fails the startup, not the create. `shell` is required when building a launch command. - The host planner stamps a fact only on commands quoted with it; a caller-quoted command keeps the spawn's own rule. - Qoder probes where the process runs (\\wsl$ cwd, then a WSL shell). - wslShellRule 'host-legacy' keeps today's WSL-shell outcome where no project chose a runtime (temporary, removed by C8). - terminalOnly reaches the early-tab decision with an accurate receipt sentence; the unused client gate is removed. - Adds one host C0 row for a \\wsl$ repo with no saved runtime. * fix(agent-launch): round 2: keep request fields for C2, extend main's resolver, one answer per workspace Problem: the first round still carried request fields and window-parity switches that only the next step sends, added a new shared resolver that also changed window code, and left some background launches using a different runtime answer than the one they spawn with. - Move the agent.launch request fields, their capability and fingerprint handling, and the prompt/Codex parity switches out to the next step; today's host behaviour is kept. - Drop the shared resolver: main's resolveLocalWorkspaceRuntime now finds the project by repo id or source repos, folders borrow their single local repo, and a \\wsl$ path is not refused on a stale distro list. Window code is back to main. - Agents started in an existing worktree use that worktree's answer; the phone's fallback paths spawn with the answer they quoted for, and a runtime that needs repair shows its message instead of a plain shell. - The OpenCode model check looks where the agent will run. - A Windows --shell in a \\wsl$ workspace names the path, not a runtime setting that cannot change it. - The temporary folder rule names its follow-up, STA-10231. * fix(agent-launch): OpenCode model picks in WSL folders keep today's Windows runtime Problem: once a folder follows its repo's WSL runtime, an OpenCode launch that picks a model would be checked and started inside WSL, where Orca cannot yet verify OpenCode models, so picks that work today could be refused. Where main had no runtime for the scope (only folders), a model-picked OpenCode launch keeps main's answer. Start, resume and the worker's model check read the same answer. Temporary until OpenCode models are verified inside WSL. * fix(agent-launch): round 3: OpenCode keyed on the agent, new worktrees quoted for where they land Problem: round 2's OpenCode exception keyed on a model pick, so a resumed chat could run somewhere other than where it started, and the worker's model check read WSL from the Terminal shell and refused folders that work today. A new worktree's startup used the repo's answer even when the worktree lands in a WSL share. - In a folder whose repo runs in WSL, every OpenCode launch keeps main's Windows answer: create, resume and the worker's model check agree. The model check reads WSL from the path alone, as main did. STA-10251. - A new worktree's startup is planned for its WSL-share base folder when one is set (newWorktreeLaunchScope). - A \\wsl$ working directory runs in WSL whatever the project says, so non-OpenCode agents there are written for Linux. - The planner test derives the answer instead of passing it in. - Smaller shapes for the PTY settings type, the cache-less resolve, executionRuntimePlatform, spawnShellInputs and two comments. * fix(agent-launch): round 3c: one labelled rule for where the path decides; OpenCode follows the WSL-share fix Problem: OpenCode in a repo on a WSL share whose project is saved as Windows host still got PowerShell quoting typed into WSL, because the WSL-share fix skipped OpenCode. The fix and the two temporary parity rules were also split across two returns, so deleting the temporary ones could take the permanent fix with them. - One expression decides when the path places the agent, each term labelled: WSL share + Windows host (permanent fix), folder + Windows host (STA-10231), OpenCode in a folder (STA-10251). - OpenCode now gets the WSL-share fix too; a model pick there is refused, as main's model check already did. - The OpenCode entry-point tests set a WSL Terminal shell, so the model check test fails if it reads WSL from that shell again. - Tests trimmed with no coverage loss; the spawn-precedence unit test is dropped (the C0 WSL-share row covers the reachable case). * fix(agent-launch): keep the window's WSL answer for panes the window spawns Live Windows QA (Terminal shell wsl.exe, global default Windows host, repo with no project setting) saw an agent command written with PowerShell quoting typed into a WSL pane, so codex lost the apostrophes in its prompt. The host wrote the command for its own answer (Windows, PowerShell), but on routes where the window spawns the pane (the phone while a window is open, a focused desktop chat create, `orca terminal create --command` in a repo) the window spawned it by the Terminal shell, which is WSL. Quoting and the pane came from two different answers. Those routes ran in WSL with Linux-style quoting on main and worked, so the temporary host-legacy term (STA-10231) now also covers them: when the window spawns the pane, the path and Terminal shell decide, as on main. Background routes keep the approved change (PowerShell instead of cmd.exe with Linux-style quoting, which was broken on main). createTerminal and the pre-launch planning share one `windowSpawnsTerminal` rule so they can't disagree about who spawns the pane. * Revert "fix(agent-launch): keep the window's WSL answer for panes the window spawns" This reverts commit 3e4311db19. * fix(agent-launch): report a runtime that needs repair as a refusal, not an unknown outcome `orca agent launch` into a folder whose one repo is set to a WSL distro that is no longer installed printed "Orca could not confirm the launch outcome; the agent may already be running", although nothing had started. The host knew the launch was refused before any spawn, but the refusal went out as the generic `runtime_error`, which the CLI must treat as possibly started. The launch planner now raises that refusal under its own code, `project_runtime_repair_required`, with the same message, and the RPC layer passes the code through. The CLI then prints the repair message as a plain failure. Older CLIs read the unrecognised code as a failure too; a newer CLI against an older host still gets `runtime_error`, as before. * fix(agent-launch): say a repair refusal in plain words, and repeat them on a retry The repair refusal from the last commit read "Project runtime requires repair before terminal spawn: wsl-distro-missing", an internal reason code rather than what happened and what to do. It now says, for example, "No agent was started. Ubuntu is not installed in WSL. Choose an installed distro or switch this project to Windows.", adding "This project follows the default in Settings > Project Runtime." when the runtime came from the default. Those sentences are the project settings page's own. They now live in one shared module that maps each repair reason to the page's existing translation key; the settings page passes its translator, and the host writes English, since it also runs headless where the desktop's translations can't load. The planner checks for a repair before the shell lookup, so the shared spawn message, which window spawns still use, is untouched. A retried launch (`--retry-launch`, or a phone resend) used to answer with the bare error code. The failed launch record now keeps the refusal's words and the retry repeats them. * fix(agent-launch): test that a retry repeats a refusal's words, and keep the host's English equal to the window's A retried launch now repeats a coded refusal's own words, but nothing tested it. A new case refuses a launch with a coded error and checks the retry answers with the same words. The repair sentences live in one shared module whose English the host writes and whose keys the settings page translates. The localization checks can't see call sites outside the window and main, so the module's test now checks each sentence against the window's English catalog for its key. Smaller, behaviour-identical tidy-ups: the reason-to-words mapping is a table, the refusal type fits on one line, and the length cap the retry words share with folder refusals has a neutral name. * refactor(agent-launch): keep main's behaviour where the stacked fixes change it The repair refusal's own code and words, the \\wsl$ path's distro in the agent list, --shell refusals for agents (decision and words), OpenCode's model check in a \\wsl$ repo, and finding a repo's project by its id move to their own stacked PRs. Until they land, each keeps main's behaviour with temporary code and a test that pins it. A disabled agent is refused as disabled before its runtime is looked at again, as on main. * fix(agent-launch): keep main's folder agent list when only the group names another host The agent list for a folder reads the folder's own host pin, as on main; only launches also read the containing group's host tag. * ci: re-run checks now that main's capacity-capture replay fix (#28286) has landed * test(agent-launch): give main's account-env startup test the launch runtime its build now returns	2026-10-13 15:00:32 -07:00
+313 people	46c3c3b44d	Keep OpenCode worker model selection separate from the default (#24768) ... * feat(orchestration): support OpenCode worker model selection Allow supervised OpenCode workers to use per-launch model overrides through the existing launch-preference and receipt path. Preserve existing OpenCode agent arguments while replacing only model flags, and reject unsupported effort values explicitly. Keep Native Chat option exposure unchanged and update the worker CLI and orchestration guidance. * fix: wait for OpenCode worker composer before first dispatch Reuse captured composer readiness on local and paired execution hosts and revoke launching-shell paste anchors. Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * feat(opencode): probe execution-host CLI capabilities * fix(opencode): select plugin default for execution host loader * fix(opencode): limit prompt prefill capability to verified release * feat(orchestration): gate OpenCode worker model preferences by host capability Co-authored-by: user141514 <user141514@users.noreply.github.com> * feat(opencode): probe launch capabilities on the execution host * feat(opencode): probe execution-host CLI capabilities * feat(opencode): probe launch capabilities on the execution host * feat(orchestration): resolve explicitly configured command aliases * fix(opencode): select plugin loader for the launched host binary * fix(opencode): match WSL probe cwd and declared guest environment * fix(orchestration): verify available OpenCode model on execution host * Add host-owned OpenCode and Devin account profiles * fix(orchestration): inspect OpenCode models with selected account environment * fix(orchestration): bind model validation to direct existing-workspace launch * fix(opencode): preserve launch environment deletion boundaries * fix(orchestration): limit effective model contract to verified OpenCode release * wip(opencode): authorize native startup prompt intent at execution owner * fix(opencode): atomically replace status plugin entrypoints * fix(opencode): retain plugin permissions across restrictive umasks * test(opencode): resolve permission fixture from primary cwd * feat(opencode): install startup prompt plugin independently of status hooks * Restore inherited account environment and preserve cleanup retries * fix(opencode): select plugin loader for the launched host binary * fix(opencode): match WSL probe cwd and declared guest environment * fix(opencode): preserve launch environment deletion boundaries * wip(opencode): authorize native startup prompt intent at execution owner * fix(opencode): atomically replace status plugin entrypoints * fix(opencode): retain plugin permissions across restrictive umasks * test(opencode): resolve permission fixture from primary cwd * feat(opencode): install startup prompt plugin independently of status hooks * Check relay environment values before merging * fix(opencode): wait for admitted startup intent and preserve failed-launch briefs * fix(opencode): confine overlay manifest cleanup to owned directories Co-authored-by: Adnan Khan <adnank11427@gmail.com> * fix: wait for OpenCode worker composer before first dispatch Reuse captured composer readiness on local and paired execution hosts and revoke launching-shell paste anchors. Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * fix(orchestration): validate configured aliases with target shell grammar * fix(orchestration): use actual shell and refuse assignment-only aliases * fix(opencode): wait for admitted startup intent and preserve failed-launch briefs * Support verified OpenCode v2 model selection in fresh native workers * fix(opencode): refuse unsupported startup preferences before model probing * feat(opencode): probe execution-host CLI capabilities * fix(opencode): select plugin default for execution host loader * fix(opencode): limit prompt prefill capability to verified release * feat(opencode): probe launch capabilities on the execution host * fix(opencode): select plugin loader for the launched host binary * fix(opencode): match WSL probe cwd and declared guest environment * fix(opencode): preserve launch environment deletion boundaries * wip(opencode): authorize native startup prompt intent at execution owner * fix(opencode): atomically replace status plugin entrypoints * fix(opencode): retain plugin permissions across restrictive umasks * test(opencode): resolve permission fixture from primary cwd * feat(opencode): install startup prompt plugin independently of status hooks * fix(opencode): wait for admitted startup intent and preserve failed-launch briefs * fix(opencode): unsubscribe hook settings during async host shutdown * fix(opencode): confine overlay manifest cleanup to owned directories Co-authored-by: Adnan Khan <adnank11427@gmail.com> * test: preserve typed calls in configured worker target checks Replace Reflect.apply with the existing typed prototype call pattern so the unchanged regression cases pass the anti-slop lint gate. * test: check typed model host calls and terminal delay state Replace Reflect dispatch and property reads with checked access and typed calls. Complete the existing resume request fixture with its required identity fields without changing the rejection boundary or assertions. * test(readiness): census recorded OpenCode composer boots * fix(opencode): reject redirected overlay parents before cleanup * fix(orcad): retain runtime cleanup when subscribing to hook settings * refactor(launch): extract OpenCode config and attachment authority * fix(opencode): retain host version selection across relay restarts * fix(opencode): pass run prompts as positional messages Preserve run flags and use the existing shell quoting and run-command detector to append the initial message after --, reusing an existing separator. TUI launches retain their version-selected prompt transport and draft behavior. Original run-order work: @coelho-doti (#13065, tracked in #17551). * fix(opencode): keep wrapped run tasks positional Recognize supported environment prefixes and PowerShell call operators without mistaking prompt arguments for executables. Keep environment and run separators separate, preserve the task text and exclude run commands from native submission. Source-parent: 23fc08b4e9 Related-to: stablya/orca#17551 Credits: @coelho-doti (stablya/orca#13065) * Prepare complete private OpenCode launch validation source Integrate the complete reviewed readiness, capability, native prompt, overlay and positional-run source onto frozen main. Preserve canonical atomic ACL retry, status generator/disposal, restrictive-umask fixtures and unowned source. Keep supported wrapped run commands positional. Private-validation-source: a44345ce49 Original-full-source: 23fc08b4e9 Original-core-base: 8186ded0bd Frozen-main: 08ee7ba9ef Owned-source-paths: 111 Publication-policy: private validation only; preserve the six separate PR boundaries and held model/provider drafts Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Co-authored-by: Adnan Khan <adnank11427@gmail.com> Credits: juli-gonzalez readiness contribution; Ahmed Nagy atomic plugin writer; coelho-doti positional run contribution * Prepare private complete 111-path launch validation on current main Private validation only. Preserve main credential additions and original launch ownership. Held model and provider topics remain excluded. * Recognize env options before positional OpenCode run messages * STRICT launch CI contract correction * CAPS launch CI contract correction * INTENT launch CI contract correction * test(opencode): wait for malformed claim retries before expiring intent Observe real endpoint I/O completion under fake timers before forcing expiry. * test: initialize Claude prompt state in output retention fixture * Verify OpenCode catalog model launches and preserve current launch behavior * Verify OpenCode catalog model launches and preserve current launch behavior * Refuse unverified new-worktree OpenCode models and complete host audits * Wait for OpenCode location hydration in intent startup * Refuse unverified new-worktree OpenCode model launches and record startup attribution * fix(opencode): bind startup readiness to the composer location * Bind OpenCode startup readiness to the current location in intent startup * Restore the owning Orca CLI path after shell profiles * Use a literal marker for the Bash lookup regression * Preserve plain panes and initialize zsh after prompt hook replacement * Preserve user line-editor dispatchers during deferred startup * fix: retain CLI startup when global Zsh replaces prompt hooks * test: replay global Zsh hook replacement after host startup * test: isolate controlled Zsh widgets from distro keyboard setup * fix(shell): preserve user hooks during deferred zsh initialization * Retry interrupted OpenCode startup prompt claims * Keep completed Zsh startup hooks retired when the wrapper is sourced again * Reject truncated OpenCode catalogs and explain worktree model limits * Use a template literal in truncated-catalog coverage * Refuse unfinished OpenCode model catalogs --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Co-authored-by: user141514 <user141514@users.noreply.github.com> Co-authored-by: Ahmed Nagy <ahmednagy25t@gmail.com> Co-authored-by: Adnan Khan <adnank11427@gmail.com> Co-authored-by: Orca startup hydration review <agents@stably.ai> Co-authored-by: Codex <codex@openai.com> Co-authored-by: Orca maintenance <orca-maintenance@users.noreply.github.com> Co-authored-by: Orca <dev@stably.ai> Co-authored-by: Orca campaign <orca-campaign@local.invalid> Co-authored-by: Orca OpenCode issue campaign <opencode-campaign@stably.ai> Co-authored-by: OpenCode issue campaign <codex@localhost> Co-authored-by: Nathan Parker <nwparker@users.noreply.github.com>	2026-10-04 19:27:20 -07:00
+212 people	8e5080c132	Validate OpenCode worker model preferences on the execution host (#24624) ... * feat(orchestration): support OpenCode worker model selection Allow supervised OpenCode workers to use per-launch model overrides through the existing launch-preference and receipt path. Preserve existing OpenCode agent arguments while replacing only model flags, and reject unsupported effort values explicitly. Keep Native Chat option exposure unchanged and update the worker CLI and orchestration guidance. * fix: wait for OpenCode worker composer before first dispatch Reuse captured composer readiness on local and paired execution hosts and revoke launching-shell paste anchors. Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * feat(opencode): probe execution-host CLI capabilities * fix(opencode): select plugin default for execution host loader * fix(opencode): limit prompt prefill capability to verified release * feat(orchestration): gate OpenCode worker model preferences by host capability Co-authored-by: user141514 <user141514@users.noreply.github.com> * feat(opencode): probe launch capabilities on the execution host * feat(opencode): probe execution-host CLI capabilities * feat(opencode): probe launch capabilities on the execution host * feat(orchestration): resolve explicitly configured command aliases * fix(opencode): select plugin loader for the launched host binary * fix(opencode): match WSL probe cwd and declared guest environment * fix(orchestration): verify available OpenCode model on execution host * fix(opencode): preserve launch environment deletion boundaries * wip(opencode): authorize native startup prompt intent at execution owner * fix(opencode): atomically replace status plugin entrypoints * fix(opencode): retain plugin permissions across restrictive umasks * test(opencode): resolve permission fixture from primary cwd * feat(opencode): install startup prompt plugin independently of status hooks * fix(opencode): wait for admitted startup intent and preserve failed-launch briefs * fix(opencode): confine overlay manifest cleanup to owned directories Co-authored-by: Adnan Khan <adnank11427@gmail.com> * fix: wait for OpenCode worker composer before first dispatch Reuse captured composer readiness on local and paired execution hosts and revoke launching-shell paste anchors. Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> * feat(opencode): probe execution-host CLI capabilities * fix(opencode): select plugin default for execution host loader * fix(opencode): limit prompt prefill capability to verified release * feat(opencode): probe launch capabilities on the execution host * fix(opencode): select plugin loader for the launched host binary * fix(opencode): match WSL probe cwd and declared guest environment * fix(opencode): preserve launch environment deletion boundaries * wip(opencode): authorize native startup prompt intent at execution owner * fix(opencode): atomically replace status plugin entrypoints * fix(opencode): retain plugin permissions across restrictive umasks * test(opencode): resolve permission fixture from primary cwd * feat(opencode): install startup prompt plugin independently of status hooks * fix(opencode): wait for admitted startup intent and preserve failed-launch briefs * fix(opencode): unsubscribe hook settings during async host shutdown * fix(opencode): confine overlay manifest cleanup to owned directories Co-authored-by: Adnan Khan <adnank11427@gmail.com> * test(readiness): census recorded OpenCode composer boots * fix(opencode): reject redirected overlay parents before cleanup * fix(orcad): retain runtime cleanup when subscribing to hook settings * refactor(launch): extract OpenCode config and attachment authority * fix(opencode): retain host version selection across relay restarts * fix(opencode): pass run prompts as positional messages Preserve run flags and use the existing shell quoting and run-command detector to append the initial message after --, reusing an existing separator. TUI launches retain their version-selected prompt transport and draft behavior. Original run-order work: @coelho-doti (#13065, tracked in #17551). * fix(opencode): keep wrapped run tasks positional Recognize supported environment prefixes and PowerShell call operators without mistaking prompt arguments for executables. Keep environment and run separators separate, preserve the task text and exclude run commands from native submission. Source-parent: 23fc08b4e9 Related-to: stablya/orca#17551 Credits: @coelho-doti (stablya/orca#13065) * Prepare complete private OpenCode launch validation source Integrate the complete reviewed readiness, capability, native prompt, overlay and positional-run source onto frozen main. Preserve canonical atomic ACL retry, status generator/disposal, restrictive-umask fixtures and unowned source. Keep supported wrapped run commands positional. Private-validation-source: a44345ce49 Original-full-source: 23fc08b4e9 Original-core-base: 8186ded0bd Frozen-main: 08ee7ba9ef Owned-source-paths: 111 Publication-policy: private validation only; preserve the six separate PR boundaries and held model/provider drafts Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Co-authored-by: Adnan Khan <adnank11427@gmail.com> Credits: juli-gonzalez readiness contribution; Ahmed Nagy atomic plugin writer; coelho-doti positional run contribution * Prepare private complete 111-path launch validation on current main Private validation only. Preserve main credential additions and original launch ownership. Held model and provider topics remain excluded. * Recognize env options before positional OpenCode run messages * STRICT launch CI contract correction * CAPS launch CI contract correction * INTENT launch CI contract correction * test(opencode): wait for malformed claim retries before expiring intent Observe real endpoint I/O completion under fake timers before forcing expiry. * test: initialize Claude prompt state in output retention fixture * Verify OpenCode catalog model launches and preserve current launch behavior * Verify OpenCode catalog model launches and preserve current launch behavior * Wait for OpenCode location hydration in intent startup * Refuse unverified new-worktree OpenCode model launches and record startup attribution * fix(opencode): bind startup readiness to the composer location * Bind OpenCode startup readiness to the current location in intent startup * Restore the owning Orca CLI path after shell profiles * Use a literal marker for the Bash lookup regression * Preserve plain panes and initialize zsh after prompt hook replacement * Preserve user line-editor dispatchers during deferred startup * fix: retain CLI startup when global Zsh replaces prompt hooks * test: replay global Zsh hook replacement after host startup * test: isolate controlled Zsh widgets from distro keyboard setup * fix(shell): preserve user hooks during deferred zsh initialization * Retry interrupted OpenCode startup prompt claims * Keep completed Zsh startup hooks retired when the wrapper is sourced again * Reject truncated OpenCode catalogs and explain worktree model limits * Use a template literal in truncated-catalog coverage * Refuse unfinished OpenCode model catalogs --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> Co-authored-by: user141514 <user141514@users.noreply.github.com> Co-authored-by: Ahmed Nagy <ahmednagy25t@gmail.com> Co-authored-by: Adnan Khan <adnank11427@gmail.com> Co-authored-by: Orca startup hydration review <agents@stably.ai> Co-authored-by: Codex <codex@openai.com> Co-authored-by: Orca maintenance <orca-maintenance@users.noreply.github.com> Co-authored-by: Orca <dev@stably.ai> Co-authored-by: Orca campaign <orca-campaign@local.invalid> Co-authored-by: Orca OpenCode issue campaign <opencode-campaign@stably.ai> Co-authored-by: OpenCode issue campaign <codex@localhost>	2026-10-04 16:44:38 -07:00