- Worker: run orca-agent-signout (each agent's logout, then credential files) on a running sandbox
before the provider delete; bounded (20 s) and best effort, never blocks the delete.
- Environment builds: scrub agent auth (--scrub-only) before the snapshot; fail closed.
- New VM script registered in VM_SCRIPTS + provision loop; vm-scripts regenerated.
- Main IPC ephemeralVm:forwardedEnvSummary returns names only, grouped by credential-looking.
- P-4 warning component (+ fixture) shown under Settings > recipes; delete dialog line for awake
Orca Cloud sandboxes.
- Orca account pane: signed-out and reconnect-required lines name Orca Cloud.
- Every unauthorized failure (lifecycle toast, cloud workspace errors, share links,
cloud secrets) now says "Sign in to Orca again to continue." with a "Sign in" action.
- Team page busy row keeps full contrast: spinner + aria-busy, no opacity dimming.
- destructive-chip text uses a new --destructive-text token (light: 85% mix with
foreground) so it clears AA on its tint.
- TeamDialogHost quietRefresh depends on the stable refresh callbacks.
#216 let a launcher-set ORCA_PORT (the VM launcher sets 3000) override the per-workspace block, so
two worktrees on one cloud VM would both get 3000. Each workspace always gets its own registry
block again; a regression test covers a host env with ORCA_PORT=3000.
Live on dev the first capture sealed zero sessions: agentSession.subscribeStatus needs a streaming
transport and the unix socket refuses it, and worktree.ps lists only agents live right now. The
collector now reads orcad's own session records (agent-session-journal.db, read-only): provider,
name and last turn, open tabs first; live worktree.ps rows override status; history still comes
from agentSession.history, with the stored last turn as fallback.
* fix(w3): port row keeps only Open in browser, Share… and More inline; Copy details gets its own icon (DS-29 follow-up)
* chore(w3): drop the unreferenced inline copy-button label from every locale
Found live on an Orca Cloud rollover (m4air): the persisted-run reader referenced a const declared
below the module-level read, so every restart started with no runs and nothing relaunched. The
relaunch also read orca.yaml before the replacement host served RPCs; it now retries with a bound.
Design-squad sign-off tweaks for DS-15: the action reopens the composer rather
than creating, so it says so; member billing bodies put 'Nothing was created,
and you weren't charged.' before who to ask.
- Rewind confirm lists the changed files under the choice (three, then Show N more);
the host preview returns up to 200 sorted paths.
- 'Restore files to here' in a user message's menu restores files without
rewinding the chat (Claude Code's code-only rewind), with Undo.
- Rewind hover action uses the --focus-ring outline token.
- Disabled unchecked checkboxes keep a full-strength --input border on a muted fill.
- Fixture: NativeChatRewindConfirm:restoreFilesOnly; restoreFiles shows six paths.
DS-15: no-plan access carries canManageBilling. Members see 'Ask an owner or
admin' instead of Upgrade, and the hint says 'Ask an owner or admin to choose
one.'; at the cap they're told to raise the spend cap. Every billing failure
on the build card offers 'Create on this computer instead' (same prompt,
Local), and Dismiss hands the typed prompt back to the composer.
DS-16: choosing a plan from an Orca Cloud wall leaves an intent. Once paid,
the plans dialog returns to the open composer with Orca Cloud picked, or
retries the refused create. The no-plan card adds Try again, and the Team
page's create action opens on Orca Cloud.
- Port rows get hover/focus buttons: Open in browser, Share… (Orca Cloud), and
More actions for port N, which opens the existing row menu.
- Drop focus:outline-none on the port row group so the focus-ring shows.
- Retry -> Try again; listen failure copy; sentence case for SSH/ports labels.
- Remote desktop notCloud/notInstalled/signedOut render neutral, not red.
- busy/taken -> in use on this computer.
- Expired / Turned off share status keeps full text-muted-foreground.
- New i18n keys for changed defaults; stale keys pruned from all locales.
- Fixtures: share-links portRowFocused / portRowShareFocused / portRowMoreActions.
- 'Save as personal Cloud secret' is offered, and accepted by main, only for names the egress proxy
swaps (a shared list the control-plane test holds equal to the proxy's); anything else would sit
on the VM in full, so main answers not_swappable.
- SSH launches into an Orca Cloud workspace (orca-* aliases or an 'orca ssh-proxy' ProxyCommand
surfaced through ~/.ssh/config Includes) get no desktop keys.
- Defense in depth on the VM: orcad with ORCA_IS_CLOUD=1 drops a carried keyEnv.
Settings and Home kept showing the previous team's plan, secrets, keys and
workspaces after a team switch while saves went to the new team, and a
billing read from before the switch could land in local state.
- useOrcaAccountKey() gives `${userId}:${activeOrgId}`; Plan & billing,
Cloud secrets, Cloud environment and Orca API keys remount on it.
- useOrcaBillingStatus re-reads on a switch, clears the old plan, and
drops (and re-reads) an answer whose billing generation moved.
- useCloudWorkspaces keys its read by account, hides another team's list
instead of dimming it; Home resets its filters on a switch.
- Hook tests cover the stale response being dropped and the new team read.
Desktop-sealed keys (Settings → Agent API Keys) ride every agent launch as plain env on other
hosts. An Orca Cloud VM would hold them in plaintext, so they are no longer sent there: runtime
calls to Orca Cloud environments skip them (provider record; otherwise any VM-provisioned host or a
Vercel Sandbox route counts, failing closed). The Add-an-agent view and the build sheet's key step
list each every-host key no Cloud secret covers yet, with its own 'Save as personal Cloud secret'
button: main unseals that one key and writes it to the user's personal Cloud secrets; the renderer
never sees the value, and nothing is uploaded without the click. The VM then gets a placeholder
the egress proxy swaps. Readiness no longer counts desktop keys as cloud access.
Line items: '{{seats}} x {{price}} per seat, billed yearly' / 'per seat per month'
(plural keys); totals '{{total}} per year' / 'per month'; Worker plan labels
'$50 per seat per month' and '$480 per seat, billed yearly'. Drops /mo, /yr,
/year and /seat/month strings.
Found on a real Orca Cloud VM (m4air): a remote host adopts the run's tab under web-terminal-<id>,
so the run was pruned at once and Stop/status/relaunch lost it; a window reload's empty tab list
pruned local runs too. Pruning now waits for the list to settle (3 s; 15 s after startup).
A one-workspace host (the VM launcher sets ORCA_PORT=3000) keeps its pinned block.
Neil
Neil