* Move local usage services into a supervised backend process
* Own usage recovery and worker retirement lifetimes
* Preserve answered usage data during background refresh
* Run independent usage scans concurrently in the backend
* Limit backend startup paths to the delegated usage service
* Show usage failures through backend recovery
* Include usage failure strings in the English catalog
* Keep usage update details beside refresh failures
* Resolve usage freshness failure from the final producer snapshot
* Retain the forced refresh completion requirement
* Keep managed backend failures out of application crash reports
* Preserve usage recovery boundaries across backend reconnects
* Match the backend RPC cancellation signal in the usage seam proof
* Avoid serializing backend requests before port delivery
* Keep receiving request validation in the boundary schemas
* test: align usage transport coverage with renderer project
* fix: preserve unknown usage state and renderer retirement
* fix(usage): revalidate tracking before scan admission
* fix(usage): retry failed backend startup on demand
* test(usage): isolate stale backend ownership checks
* fix(native-chat): hold an automatic continue until the chat's account has usage again
The automatic continue after a usage limit sent at the cut's reported reset
without looking at the account, so it could send into a still-spent weekly
window. Each sweep pass now attributes the chat's launch account (the host's
launchAccountHome) to Orca's polled reading taken in that same home, and holds
the send until the latest spent window's reset (+15 s). The hold is derived
each pass, never saved, only grows for one cut and account, and waits up to two
minutes for a reading taken since that reset before falling back to the reset
it has. A spent window with no known reset stops the automatic continue for that
cut; on System Default, where Orca can't tell which login a reading saw, a fresh
reading with room releases both. Rows on desktop and phone show the held time
through an optional continueAt; older clients keep the cut's time.
* fix(native-chat): attribute usage holds once per account and retire them with their scope
- C1/X7: launch home resolved once per provider and reading once per (provider, home) per pass; narrow usageReading accessor replaces getState().
- X8: forget() drops the hold; hidden-chat caches are pruned while the setting is off; readState stores nothing for an unattributed chat.
- X3/C3: launch and reading homes compared in canonical form (~, dot segments, async realpath, bounded cache).
- X4/C2: a hold belongs to its scope (canonical home + billing kind) and retires when it changes.
- X2: a launch whose provider has no reading yet asks once and waits within the two-minute window.
- X5: attribution runs before the overdue check, so a restart keeps the account's later reset.
- X6: the launch account is re-attributed right before each send; beforeRun refuses a changed attribution.
- C5: cold chats publish when their continue time moves.
- X1/C4: WSL launches keep the cut's own reset (no hold).
* fix(native-chat): gate held continues on an account scope token and stop reviving stale cuts
- C6: a hold extends only with a spent window that had begun by the cut's reset.
- X6-R2, X10, P1-1: a synchronous account scope token (selection, launch env, reading home and
provenance) is captured at attribution; send() re-resolves only when it moved, memoized per
token, and beforeRun compares live and captured tokens. Opening a chat drops only cold-cut caches.
- X11: production tick() test at N=300 and 10N=3000 counts resolver and reader calls.
- X2-R2: the bootstrap wait starts when a pass first sees the due send without a reading.
- X9: canonical homes are resolved once per account per pass; the unbounded-lifetime cache is gone.
- C5-R2: unloaded chats have no status push path, so the cold continueAt publication is removed.
* fix(native-chat): separate continue eligibility from current spending and bind sends to their attribution's sources
- X12: a cut's eligible anchor (its reset, an established hold, or a covering window) takes the
24 h overdue test; once eligible, every currently spent window holds the send.
- X13/P1-2, X6-R3: the account owner returns attributions with a synchronous source witness
(settings snapshot identity, cached login-shell capture revision, reading-source identity);
Claude billing comes from the launch's own env composition. A result whose sources moved while
it resolved is discarded; send() and beforeRun bind to the attribution's own witness and
supersede without spending an attempt.
- CI-1: the scope-token type assertion is gone with the token.
* fix(native-chat): keep a covering hold beside spent windows of unknown reset
- X12-R4 / C7: rebuilding the covering anchor skips spent windows whose reset, and so start, is
unknown; the eligible branch still refuses on them.
- E1-R4: the preparation-change and suspended-attribution race tests run on a Claude chat
through the real host send, mutation and accepted settlement.
* refactor(native-chat): move the usage-limit continue status into its own wire module
The merge with main put agent-session-wire.ts one line over the 300-line limit.
* fix(native-chat): read the shell capture revision lazily so module mocks without it still load
Tests that main added mock login-shell-environment without the revision accessor, so binding it at module load failed.
* fix(native-chat): release a usage hold on fresh room for any account without stranding the cut
- QA-1: room in a fresh attributed reading newer than the last spent evidence (spentSeenAt)
releases the hold and clears an unknown reset for every account; the System Default-only
branch and identityKnown are gone.
- QA-1b: the release pulls heldUntil down to that reading instead of clearing it, and an
unknown-reset hold anchors on its last evidence, so a release over a day after the cut sends.
* fix(native-chat): release an expired usage hold from its room reading and ask for readings while a reset is unknown
- R6-1 / QA-1b-R6: a release sets heldUntil to the room reading itself, so an expired finite
hold followed by an unknown reset no longer strands the cut.
- R6-2: the usage poller idles while Orca is unfocused with no viewer, so an unknown reset asks
for a non-forced reading at most every 10 minutes through the existing refresh.
* fix(native-chat): bound unknown-reset readings per account and honor the failure backoff
- R7-1 / X-R7-1: the rate-limit service owns the automatic-read cadence: a read waits while the
provider's last reading or admitted automatic read is within the asked interval, so held chats
on one account cause at most one unknown-reset read per 10 minutes.
- R7-2: automatic reads wait out the poller's failure backoff (shared failureRetryDue) and start
its clock; forced refreshes are unchanged.
* fix(rate-limits): scope automatic usage-read admission to the selected account
- R8-1 / X-R8-1: an admitted automatic read counts toward the cadence only for the account whose
reading source the service held then, so a switch never lets one account's read delay another's.
- Prunes the flaky-test-pattern baseline: service-refresh-orchestration no longer reads the wall clock.
* fix(native-chat): keep a usage-reading request retryable until the service starts it, and show the last known reset while one is unknown
* fix(native-chat): show no automatic continue while a chat waits on an unknown reset, since fresh room still releases it
* fix(native-chat): publish no continue time for a cancelled or stopped cut while its account's reset is unknown
* fix(browser): stop agent clicks from opening the system file picker
An agent click on a file input opened the macOS Open panel, which brought
Orca's window forward over the app the user was in. Page actions now catch
the picker the way upload does and tell the agent to use upload.
* fix(browser): enable Page, cancel the picker, and clean up outside host scope
* fix(browser): limit picker blocking to input delivery and bound its setup
* perf(browser): skip picker blocking for actions without user activation
* fix(browser): bound picker interception cleanup on a hung page
* fix(browser): bound the picker interception setup as a whole
* fix(emulator): let iPhone Duo fold in release builds
Release signing gave serve-sim's in-simulator helpers the hardened runtime,
which drops the DYLD_ROOT_PATH that simctl spawn hands them, so the Duo HID
and accessibility helpers aborted at launch. Sign just those two with only
allow-dyld-environment-variables.
serve-sim's uncaught errors print its minified source, which contains the
"No serve-sim server running" text, so every crash was reported as no active
emulator. Report the thrown error line instead.
Fixes#40509
* fix(emulator): keep multi-line serve-sim error messages
* refactor(emulator): simplify serve-sim failure message parsing
* fix(native-chat): refuse a stale startup-dialog card choice and add a card for the multi-server MCP dialog
* fix(native-chat): drop casts from the startup-dialog guard
* fix(native-chat): refuse a startup card choice until the screen model has applied all received output
* fix(native-chat): refuse a clipped MCP server list and guard restored startup cards
* fix(native-chat): allow one startup card choice per screen so a second client's keys can't hit the next dialog
* Avoid sorting the folder catalog for a single host lookup
* Model the folder point read in remaining runtime fixtures
* Explain the partial emulator routing fixture boundary
Structured image sends replace inline composer chips with `[Image #N]` tokens
for the provider prompt, which left sent `[Image #N]` markers visible in user
message bubbles, copied text, rail/outline previews, and row height estimates.
Strip in-range `[Image #1..imageCount]` markers across user message display,
copy text, row height estimation, and rail/outline previews while preserving
literal markers past `imageCount`, in quoted file references, or inside inline
backticks and fenced code blocks.
Fixes#32727
Co-authored-by: lurunzi <lurunzi@gmail.com>
Creating a child worktree while a runtime or fleet listing was in flight could delete its fresh lineage edge if the mutation landed after the scan's overtaken check (for example during metadata pruning or removal-checkout probes). Gate pruneLineageForMissingRepoWorktrees on the scan-start generation and pass { scanGeneration } from both runtime callers.
Fixes#16654
Co-authored-by: Skyler Shaw <skyler@jump.run>
Claude and Codex chat children kept the launching pane's ORCA_* identity
(pane key, tab, worktree, workspace, terminal handle), so hooks and the
CLI attributed the chat to the host pane. Launch composition now applies
the shared STRUCTURED_CHILD_ENV_TO_DELETE list once for every agent, which
also adds ORCA_WORKSPACE_ID and ORCA_TERMINAL_HANDLE to it; the seal still
keeps a worker's own handle.
Refs #26417
Co-authored-by: petersindex <287557875+petersindex@users.noreply.github.com>
Disable commit/tag GPG signing via a cached wrapper GIT_CONFIG_GLOBAL when
the developer's global gitconfig enables signing, clear inherited GIT_CONFIG_GLOBAL
in GitBinaryTestFixture, strip inherited TERM_PROGRAM* in Vitest setup, and
run ssh-posix-command-wrapper shell checks against an empty HOME/ZDOTDIR/XDG_CONFIG_HOME.
Fixes#27210
Co-authored-by: outof-place <contact@outofplace.space>
Callers such as getRepoUpstream and the tracked-upstream branch fallback called getGitHubApiRepositoryForRemote without checking the cached remote listing, causing repos without an upstream remote to run failing git remote get-url upstream execs on cold lookups. Gate non-origin remotes on shouldProbeGitRemote at the shared entry point while keeping origin unconditional.
Refs #22684
Co-authored-by: h5k <31630310+h5kk@users.noreply.github.com>
* feat(native-chat): run GitHub Copilot in Chat over its ACP server
Copilot chats launch `copilot --acp` with Copilot's own sign-in (or gh's),
so enterprise hosts and managed policy carry over. A Copilot dialect turns
its tool results into plain output and exit codes, and withholds the
commands that would switch Copilot to approving everything behind the
chat's permission mode.
The CLI version reader now accepts a version that ends a sentence, as
Copilot prints it.
Co-authored-by: Morten Trydal <trydis@hotmail.com>
* fix(native-chat): show Auto when a session lists no models instead of hiding the model pill
* fix(native-chat): don't name Copilot chats with a Copilot run that stays in its history
---------
Co-authored-by: Morten Trydal <trydis@hotmail.com>
* perf(orchestration): an unreadable item holds back only its own conversation, and remote-owned queries use their indexes
* fix(orchestration): a held conversation stays skipped for its batch, and pulls past the hold-back cap wait locally
* Fix Codex account status for Bedrock and other built-in providers
Derive system-default authentication from the configured provider and honor the declared credential mode before reading ChatGPT identity.
Co-authored-by: Christopher Ryu <cryu17@gmail.com>
* Reuse provider classification until canonical config changes
* Bound provider config work and refresh after file removal
* Use portable module counters for provider config regression checks
* Complete the host target in the account warning fixture
* Include the account warning module in Node test typechecking
---------
Co-authored-by: Christopher Ryu <cryu17@gmail.com>
* Keep browser chrome metadata current without synchronous guest reads
* Provide the guest Escape subscription in browser pane fixtures
* Provide native navigation state in browser guest fixtures
* Preserve browser navigation and loading across asynchronous metadata reads
* Retire browser metadata when its actual guest is removed
* Explain native identity casts in browser disposal fixtures
* Preserve URL titles for untitled client browser pages
* Preserve current browser navigation and untitled page labels
* Keep merged browser failure type within lint limit
* Keep merged browser failure type within lint limit
* Bound published browser titles to the existing wire limit
* Use template literals in browser title regression
OpenCode, OpenCode 2 and Z Code keep every conversation in one shared
database, so Session History could only hand off the row's preview
messages. The session's own host now copies that one conversation into
the per-chat hand-off snapshot the chat Hand Off already uses, and the
dialog points the new agent at it. Older hosts, SSH rows and failed
reads keep the preview.
* fix(orchestration): tell the coordinator when a worker is lost
A worker that could no longer run its task sent no mail: a failed start,
a person closing its pane, tab or chat, or a terminal gone after a restart.
Each now sends one "Worker lost without reporting" alert through the
turn-stop report, with its cause, last output and any leftover workspace.
An unexpected exit and a lost Codex app-server use the same path. An exit
or loss says the Dispatch is closed as failed and gives the retry command.
Failure text in the alert is redacted like terminal output.
The coordinator's own worker-stop stays silent, locally and on a paired
server. A finished turn is not reported when that turn's worker_done was
rejected; later turns still are. worker-read and worker-show say
"never started" for a start that never got a terminal.
* fix(orchestration): a lost worker's restart command names its Task id and suits its Task's state
- The command named the Task's label, not its id.
- Restart recovery puts the Task back to ready, which --retry-of refuses:
the command is a plain worker-start then.
- worker-show does not call a paired server's failed worker "never
started": its record carries no terminal details.
* test(orchestration): import the turn-stop report after main's test cleanup
* fix(jcode): keep the agent row for Jcode panes and read its working title
On Linux the Jcode release runs jcode-linux-<arch>.bin behind a jcode wrapper, so
the foreground read never identified the pane, and Jcode's own title
(<emoji> jcode/<server> <Codename> · work ~2s) was not classified. Once Jcode
replaced its startup title, the title-derived row lost its only identity and
disappeared. Map the platform binary to jcode, accept the server-qualified
identity title, and read the work/last tail as working/idle.
* fix(jcode): read the bare title tail only in a Jcode pane
The activity tail on conversation and SSH titles is too generic to prove an
agent, so title-only readers must not treat it as one. Gate it on the pane's
agent, as Hermes markers are, keep identity titles self-describing, narrow the
server segment, and keep the title strip linear.
* fix(jcode): keep the turn tail out of title-only readers
Title-only readers (completion tracking) saw a turn from Jcode's identity title
and then idle when Jcode switched to a conversation title naming another agent.
Read the tail only through the pane-scoped reader, check it before generic
title status in the sidebar row, and stop treating a bare jcode/<dir> as Jcode.
* fix(jcode): escape the title separator so the orcad bundle stays ASCII
Usage attribution only knew live worktrees, so deleting one moved its
sessions out of the Orca scope on the next scan and Stats & Usage totals
went down. Remember every worktree Orca has had in a small usage-owned
history and attribute against live plus remembered worktrees, with live
rows claiming reused paths first. The history loads off the main thread,
scans wait for it, and an unreadable or newer file is never overwritten.
* fix(cli): chat wait checks the chat's work state instead of reading its history every second
`orca chat wait` and `orca chat send --wait` polled `agentSession.history` once a second only to
learn whether the chat was still working. Each poll made the host build a transcript page, scan
every retained item twice for the running turn, and send the newest reply's full text, all
ignored by the waiter.
The host now answers `agentSession.workState` with just the facts a wait decides from (working,
a waiting question or approval, queued ids, the next queued send, the fence), and the journal's
running turn comes from its existing per-row turn index instead of a scan. The CLI polls that
read and falls back to history pages on hosts without it. The final transcript read is unchanged.
* test(cli): type the chat wait host test without assertions
* docs(cli): say what a work-state check skips, not that it does no history work
* test(cli): pin the chat wait's exact final reply and its single history read
* docs(cli): name the scan a work-state check skips
* ci: typecheck the chat wait host test with the cross-process test project
Brennan Benson
Kelvin Amoaba
OrcaWinandOrcaWin
Jinwoo Hong
Neilandlurunzi
Noah
itigoppoanditigoppo
Dat
Aashish Mahato
