* fix(browser): let agents and users answer page alert, confirm and prompt dialogs on their page
* fix(browser): watch a replacement guest for dialogs and ignore the opening keypress
* fix(browser): ignore a repeated Enter in a guarded prompt field
* fix(browser): fill, select, upload and type act on the agent's element or fail
* refactor(browser): move agent key commands into their own bridge layer; fix test sender call
Orca's will-download handler picks every guest download's save path, so
agent-browser's own download (CDP download dir plus guid rename) never saw
the file: it landed in ~/Downloads and the command failed with a GUID error,
or after 30s when nothing downloaded. The bridge now claims the page's next
download for the requested path, clicks through agent-browser, and reports
the saved path, a 10s no-download error, or a failed download.
* fix(computer-use): replace the macOS permission status gate with one 5s launch floor (#34390)
Follows up #36028. The earlier gate grew background/explicit flags, epochs,
backoff and a setup pgrep path that reviewers could not make correct.
- Status: one probe at a time and one 5s launch floor shared by every reader, so
every path stays at <=12 helper launches/min. Readers inside the floor join the
running probe or ride one trailing probe that fires only if someone waits.
Only grants are cached (until the floor expires); denials and errors are never
served, so a grant shows within one floor locally and on web. No app epochs:
without a denial cache they bought nothing. Off macOS the gate is skipped.
- Setup: one launch per 5s across every permission, claimed synchronously; a
request inside the window is queued (latest wins) and reported as
launchQueued. Kill-and-relaunch stays so a click always re-shows the helper.
Setup reuses the gate's in-flight/cached/last result instead of probing.
- Reset checks helper availability from the bundle and invalidates after any
tccutil attempt, including partial failures.
- Remove the background flag from preload/IPC/renderer/web, the app-activity
binding, and the sidecar permission_denied invalidation.
* fix(computer-use): close the remaining gaps in the permission launch floor (#34390)
- Clear the trailing timer whenever any probe launches and re-check the floor
when it fires, so a late timer can never launch inside the floor.
- Setup reuses a denial only until the floor expires.
- A reader that joins a probe older than 300ms and gets a denial rides the next
probe, so a grant shows within about one floor even after a stale web/RPC probe.
- Setup requests are numbered on arrival, including ones that coalesce, so the
latest request wins (A, B, A launches A); a queued launch already covered by a
newer launch is dropped. Reset and will-quit cancel any queued launch.
- The settings pane says "Opening…" and the CLI says queued for queued launches.
* fix(computer-use): measure permission launch floors from real spawns and cancel setup on every host (#34390)
- Both 5s floors use performance.now, so a wall-clock step cannot stretch or skip them.
- The status floor counts from the later of claim and the actual `open` spawn, and
the setup window from after its spawn, so a slow mkdtemp or pkill can't allow a
13th spawn in a 60s window.
- Setup cancellation registers through AppEnvironment quit handlers (desktop,
headless Electron serve, orcad) and orcad's shutdown trigger; reset and
shutdown bump a generation so an Open still waiting on status never launches.
- Reset cancels queued setup before its first await.
- A setup request leaves the coalescing map when it launches, so a later request
for the same permission queues and wins (latest-wins across microtasks).
- A failed probe clears the remembered denial.
* fix(computer-use): drop setup coalescing and gate setup on a host-wide shutdown flag (#34390)
- Remove the per-permission setupInFlight map. Every Open goes through the 5s
window and seq-ordered queue; a queued request with the same args that arrived
before the last spawn was already shown by it, so concurrent same-permission
Opens still spawn once. This fixes stale entries after reset turning the next
Open into a no-op or a cancelled one.
- A cancelled Open (reset or shutdown) rejects with an error instead of returning
launchedHelper: false, which every client rendered as "setup complete".
- Replace the per-host cancel calls with src/main/host-shutdown-state.ts, set
synchronously by Electron will-quit and orcad's shutdown admission; setup
checks it before every spawn, including the queued timer.
- Track the status cache's expiry from the probe that produced it, so starting a
new probe cannot revive an expired grant.
- The queued setup timer re-checks its deadline and re-arms when early, and both
timers round delays up; a throwing spawn there is logged, not uncaught.
* fix(computer-use): keep setup latest-wins after slow probes and surface cancelled setups (#34390)
- Record the launching request's seq; an older request that resumes or is queued
after a newer one spawned is dropped, so latest-wins holds when requests
resume out of order behind a probe.
- orcad sets the host shutdown flag on every cleanup entry, including failed
startup.
- The web facade only falls back for hosts without computer.permissions; other
failures, such as a cancelled Open, reject so the pane and onboarding show them.
- The cancellation check runs before an untargeted Open can report everything granted.
- Opens that arrive mid-reset wait for it, so reset's helper cleanup cannot kill
what they open.
- Queued wording now says a newer request or a reset may replace it.
* fix(computer-use): wait out a reset before an Open reads permission status (#34390)
* feat(computer): send tree diffs after actions and add get-app-state --query
Action results now carry only the accessibility-tree lines that changed since
the caller's last view of the same window (~ changed, + added, - removed as
index ranges, or an explicit no-change line), plus the focused element. The
runtime sidecar keeps the last tree per session/worktree and app, so all three
providers get it. The CLI opts in with treeDiff; older runtimes strip the
param and keep returning the full tree, and --full-tree opts out.
The macOS helper now keeps an element's index across snapshots of a window:
AX identity first, then the next unclaimed index with the same signature for
views that rebuild their AX objects, and never reuses a removed index.
get-app-state --query prints matching elements with their ancestors and
--max-elements caps the output, both in the CLI over the rendered tree.
Custom action names with raw newlines no longer split an element over lines.
* fix(computer): preserve parent changes in snapshot diffs
* fix(computer): refuse stale index reuse for lookalike controls
* fix(computer): print full trees in action replies
* fix(computer): keep controls located in snapshot replies
* fix(computer): fail set-value when its read-back shows a different value
A value_mismatch came back as ok with exit 0, so callers that check only
the exit status took an ignored or misplaced write as success. The runtime
now turns it into a verification_failed error at the sidecar boundary,
which covers every provider and every caller of the RPC.
Part of #33511
* fix(computer): pair macOS AX windows with their CGWindowID
AppKit and WebKit windows don't answer AXWindowNumber, so matching a
capture to its accessibility window fell back to frames. Two windows with
the same frame then paired the screenshot of one with the tree and title
of whichever AX listed first, under the first one's id. Read the id with
_AXUIElementGetWindow, as yabai and Hammerspoon do, and keep AXWindowNumber
as the fallback.
Fixes#27252
* fix(computer): fail fast when a macOS app stops answering accessibility
Every request runs behind one helper lock, and a hung app cost a timeout
per AX read, so one get-app-state on it held every agent for up to the 60 s
RPC timeout. Pin the AX messaging timeout at 1.5 s, refuse an app that
doesn't answer a root probe, and stop a tree walk at the first read that
waits out the timeout, each with an action_timeout error.
A press or write that the app received but didn't answer now fails the
same way, saying it may have taken effect. Before, the click fell through
to AXConfirm and then a synthetic click, so a button whose handler blocked
ran twice, and type-text typed the text again as keys.
* fix(computer): report macOS accessibility actions that changed nothing
AXPress and other accessibility actions came back as plain unasserted
success even when the app ignored them, as Chromium does for a role=button
whose handler sits on a child. After such an action the helper now compares
the target's tree, frame and on-screen windows with the snapshot it took
just before. If they still match after re-reading for about a second, the
result says unverified/suspected_noop; if they change late, the result
carries the settled state instead.
The new reason is additive; older CLIs print it like any other reason.
Refs #31758
* fix(computer): propagate late macOS observation failures
* fix(computer): select existing text before replacement
* fix(computer): share native macOS window identity
* feat(computer): drive macOS apps in the background by default
Clicks no longer activate and raise the target first. Pointer and key
input go to the target window's pid through a new BackgroundInputTransport:
mouse and scroll events carry the window id in field 51 and a window-local
location, keys run inside a focus-without-raise key-window scope, and
chords carry no Unicode string so menu key equivalents fire. Scroll and
drag now land (#27306); typed text no longer doubles in Electron (#17942).
The HID tap and focus fence stay for --restore-window only. Results
report action.delivery, the handshake reports supports.input.background,
and a missing private symbol or a popup click fails with
background_unavailable instead of falling back to the foreground.
* test(computer): read typed key strings back instead of diffing live-state events
* fix(computer): keep Unicode characters in one key event
* fix(computer): preserve active macOS key windows
Refuse key-window changes in the active app and surface failed
focus records, including cleanup after partially delivered input.
* fix(computer): guard macOS click routes before delivery
* fix(computer): let paste events read the clipboard
* fix(computer): classify clicks in the requested macOS window
* fix(computer): fence macOS scroll and drag recipients
The agent-browser bridge cast agent-browser's {messages} and {requests} output to Orca's {entries, truncated} contract and dropped --limit, so text mode crashed and --json returned the raw shape. Map the output once at the bridge, keep the newest --limit entries, and make the contract fields agent-browser never reports optional.
The host answers a worktree delete as soon as it accepts it and lets Git
delete the checkout in the background. Clients that show a "removing"
marker ask it to wait for Git, but the CLI could not, so it printed
`removed: true` before anything was deleted, and a delete Git then refused
(for example a checkout with submodules) failed only in the host's log.
Scripts saw success, and every retry repeated the same silent failure.
`worktree.rm` takes an optional `waitForBackgroundRemoval` flag, and the CLI
sets it, so the command exits with Git's real result or error. It waits as
long as the desktop and web clients do and, if it stops waiting first, says
the delete may still be running and how to check. A reply sent on
acceptance now says `removed: false` alongside `removing: true`, so callers
that still get the early answer are not told the checkout is gone. Older
hosts ignore the flag, and the CLI then says the delete is still running.
Fixes#35135
* Nest chat-UI orchestration workers under the agent that started them
Main's lineage projection only walked terminal panes, so workers running
in the chat UI never got a parent link and listed flat in the sidebar.
It now also projects chat workers, keyed by their visible chat row, and
resolves a chat creator or coordinator to that chat's visible row
instead of its handle or private mailbox pane key.
* Fix public worker lineage across assignment and row identities
* Complete terminal lineage provenance and bound active session selection
* Repair lineage test runtime boundaries and SQLite counters
* Batch public lineage verification after exact recency selection
* Use checked runtime values in lineage integration tests
* Document the trusted Dispatch SQL row boundary
* Keep lineage integration imports within their test programs
* Load native lineage fixtures before test execution
* test: complete lineage inputs in runtime and sidebar fixtures
* test: seed benchmark facts from active dispatches
* test: replace partial orchestration DB casts with typed fixtures
* test: complete stale-leaf mailbox fixture session input
* fix(test): render worker lineage fixture with production list
Explain the worker-stop receipt's processAction values in the recovery
guide and command notes: closed_agent_terminal means Orca already issued
the close (no follow-up terminal close), and stop_unknown exits 1 while
possibly still reporting closed_agent_terminal.
Fixes#13197
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Clarify that `terminal create --title`/`terminal rename` set the tab
title (reported under visualLayouts), that `set-pane-title` sets
`terminals[].paneTitle`, and that `terminals[].title` is not a stable
key. Document that `agentIdentity` is only the agent type and that the
`worktree ps` `agents[].paneKey` join locates a specific agent's pane.
Fixes#12674
Co-authored-by: Neil <neil@stably.ai>
Expose the runtime's existing branchNameOverride on `orca worktree create`
so callers can name the Git branch (skipping the configured branch prefix)
while --name keeps setting the workspace name. A valueless or empty
--branch fails before any runtime request; omitting it leaves the request
unchanged. Document the flag in help, the spec notes, and the CLI
reference, including the numeric suffix applied when the name is taken.
Fixes#19541
Co-authored-by: Neil <neil@stably.ai>
Hosts filter with `updated_at >= ?`, comparing text against UTC
toISOString() values, so a `+08:00` cutoff was read as if UTC and a
whole-second `...00Z` cutoff dropped sessions in that same second
(`Z` sorts after `.`). The cursor key also hashed the raw spelling.
Normalize `since` to toISOString() in AiVaultSearchFiltersSchema. Every
client and host path parses this schema, so new clients send a cutoff
older hosts already compare correctly, and new hosts normalize whatever
older clients send before filtering or building the cursor key.
`Date` keeps milliseconds only, so a cutoff like `...00.0005Z` rounds up
to the next millisecond rather than letting in a session from before it.
Fixes#28253
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
--peek and --all return no deliveryId, so a coordinator that loops on them
never acknowledges anything. Document that, note the 100-row cap for --all
and Run --peek, and give the drain recipe: repeat plain check with
--ack <previous deliveryId> until deliveryId is null.
Co-authored-by: 서정화 <seojeonghwa@Mac.mshome.net>
Co-authored-by: Neil <neil@stably.ai>
`orca terminal read --help` listed flags but not the --json result shape,
so agents guessed field names and paged with latestCursor instead of
nextCursor. Add Notes listing result.terminal fields, the meaning of
truncated vs limited, when nextCursor is null, and how to page with
nextCursor/oldestCursor.
Fixes#7433
Co-authored-by: Neil <neil@stably.ai>
Running a command group with no subcommand (e.g. `orca skills`,
`orca browser identity`) printed "Unknown command" with unrelated
suggestions. Print the group's help instead, and when flags are passed
to a bare group, report a missing subcommand that points at its help.
Co-authored-by: Neil <neil@stably.ai>
`orca worktree ps --agent-wait --json` now reports, on each terminal-backed
agent row of the returned page, the same agentWait verdict
`orca terminal show --json` gives for that terminal. The lookup is opt-in
(RPC `includeAgentWait: true`) because it reads screens and may probe PTYs,
which is too costly for default pollers. Hook rows use their terminal handle
only when a connected PTY confirms it, and pane-only hook rows resolve the
live terminal by pane key. Structured-worker rows and older hosts omit the
field (absent = not evaluated; null = looked, no wait).
Fixes#23921
Co-authored-by: Neil <neil@stably.ai>
Linear-provided titles, states, assignees, projects, labels, workspace
names and error messages were printed verbatim, so remote text could
emit OSC/CSI/C1 sequences or forge extra output lines. Move terminalSafe
into src/shared/terminal-safe-text.ts, add terminalSafeLine (collapses
CR/LF), and apply it to every Linear text field in the human-readable
formatters. --json output is unchanged.
Fixes#20478
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* feat(wsl): internal distro allowlist for WSL execs on shared test boxes
ORCA_INTERNAL_WSL_DISTRO_ALLOWLIST (comma-separated distro names) keeps every
wsl.exe call out of distros not on the list: process-host's resolveSpawn,
the main and daemon node-pty spawns, and the two codex-accounts calls that
bypass process-host. Pure list/status/version calls stay allowed; any other
form must name an allowlisted distro, and --shutdown or a default-distro exec
is refused. A malformed value refuses every distro and logs once. Unset, the
check reads the variable and returns, so behavior is identical to today.
* fix(wsl): cover every direct wsl.exe exec with the internal distro allowlist
- Restore #34525's worktree-create payload and captured-host test, reverted by
accident in the first commit.
- Check the allowlist in execFileCapture, the choke point for WSL Git, gh and
worker-thread captures, and before the WSL git-read probe, the Codex hook
path canonicalization and the CLI login spawn. The WSL watcher now spawns
through process-host.
- Stop scanning wsl.exe argv at the first positional argument, which wsl.exe
runs in the default distro.
- check-process-host-imports fails on any direct wsl.exe exec outside
process-host that does not call assertWslDistroAllowed.
* fix(wsl): check the distro allowlist where resolveCommand produces the wsl.exe form
Every Git, gh and glab path into a distro resolves through resolveCommand, so
gitExecFileSync, gitSpawn, git stream reads and wslAwareSpawn are covered too;
the execFileCapture check is now redundant and removed. The import check also
treats buildWslExecArgs as a wsl.exe exec and accepts resolveCommand as covered.
* fix(cli): hide unsupported profile-state flags
* fix(cli): derive --page and remote-selector help from what each command takes
--page is now a property the browser spec modules set for commands that act on
one page, rather than offered to every command group not on a deny-list, so
serve, environment, agent, connector, host, vm and profile commands stop
advertising and accepting it. Local-only commands offer only --help and --json
plus a selector they take as their own argument, and a test ties their help to
the same local-only list dispatch uses.
Co-authored-by: William Poisel <53629276+epoisel@users.noreply.github.com>
---------
Co-authored-by: William Poisel <53629276+epoisel@users.noreply.github.com>
* fix(windows): probe fnm's real default alias dir for Node fallback
On Windows, fnm stores the default alias under FNM_DIR, else
%APPDATA%\fnm (legacy ~\.fnm), and node.exe sits directly in
aliases\default with no bin subdir. Probe those dirs and append them to
PATH so fnm's default only backfills a missing Node instead of shadowing
an inherited one.
Fixes#11356
Co-authored-by: niceSprite <16523864+iFwu@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
* test: keep onTestFinished callbacks returning void
---------
Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: Claude <noreply@anthropic.com>
Without --enter, --text reaches the PTY unmodified, so integrators can send
Escape or Ctrl+U directly. With --enter and without --interrupt, prompts to a
recognized running agent are bracketed-pasted and embedded Escape is made inert.
Fixes#14032
Co-authored-by: Neil <neil@stably.ai>
The orchestration skill description only advertised coordinator work, so a
dispatched worker never loaded it and built its heartbeat loop from the
preamble alone. Neither the preamble nor the guide said to stop a background
heartbeat loop before worker_done, so the loop outlived the task.
Add worker-role triggers (heartbeats, ask, worker_done) to the description and
stub, and tell workers in the preamble and guide to restart an expired
heartbeat loop mid-task and stop it before worker_done.
Fixes#26605
* fix(orcad): materialize the app's agent-browser driver into the local slot
Replaces #34111's ORCA_AGENT_BROWSER_DRIVER hand-off, Windows profile copy and
claimed snapshot store. Packaging now references the app's own
resources/agent-browser-<target> from the orcad template manifest
(packagedBrowser, like packagedRipgrep), so the materialized slot carries it and
every local orcad launch finds it beside orcad-server.js. macOS signs the driver
before hashing; Windows reseals it after SignPath. The resolver now also tries
the musl driver name on Linux.
Refs #33846
* build(orcad): let a checkout keep template drivers with ORCAD_OMIT_AGENT_BROWSER=0
Condition waits never forwarded --timeout, so agent-browser always stopped at its own 25s default and --timeout 60000 still failed at 25s. orcad's external Chromium run and Electron sidecar socket also capped waits at a fixed 90s. One builder now passes --timeout (explicit or the documented 25000 default) on the local and orcad paths, process kills sit 5s above it, and every forwarding hop waits max(60s, T+30s).
* fix(browser): make orca set media --reduced-motion actually apply
agent-browser's set media only looks for the bare tokens dark, light and
reduced-motion and ignores anything else, so the documented reduce value
was dropped and the command still reported success. Map Orca's values
onto those tokens in one builder used by the desktop bridge and the
orcad external Chromium path, and reject unknown values.
Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>
* fix(browser): reject bad set media values before queuing and list both flags in help
---------
Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>
* test: remove 37 low-value cases and 3 suites
* test: delete ten more renderer wiring and copy suites
* test: drop deleted suite from its contract entry point
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The desktop's connector accepts conversations from Slack, Discord and Linear and lists all three sources in its hello; per-source details (the Sent from line) come from one table. Nothing changes until those adapters are configured; behind the experimentalConnectors setting.
A connector-started agent is told it can answer in its thread with orca connector reply --text; the desktop posts the reply through its Orca Cloud connection, naming the conversation and turn, so the machine never holds a Slack token. Works for agents on this machine; elsewhere the command answers that replies aren't available from this host yet, and the turn's final message is still posted when the turn ends. Behind the experimentalConnectors setting.
* fix(orcad): find the app's bundled agent-browser driver for orca serve
Desktop orcad templates omit the driver for size, so orcad materialized from an
installed app reported driver_missing with ORCA_BROWSER_EXECUTABLE set. orca serve
now hands orcad the app's resources copy via ORCA_AGENT_BROWSER_DRIVER; the
slot's own driver still wins for standalone artifacts.
Fixes#33846
* test(serve): expect the app's agent-browser driver handed to orcad
* fix(serve): run a profile copy of the driver on Windows so app updates stay replaceable
* fix(serve): never lend the installed Windows driver when staging fails
* fix(serve): keep another launch's in-progress driver copy
* refactor(serve): share claimed snapshot publication for the Windows driver copy
* fix(orchestration): preserve task reset lineage per Run
STA-10382
* fix(orchestration): record removed Tasks, Dispatches and workers per entity
Replace the per-Run capped JSON snapshot with one row per removed entity in
removed_orchestration_work, written by AFTER DELETE triggers on tasks,
dispatch_contexts, worker_dispatches, worker_terminal_resources,
remote_dispatch_attachments and federated_dispatches. The triggers are
rebuilt on every open after migrate and dropped at migrate start; a
recorded_since coverage marker moves forward whenever any trigger was
missing, so a Run created before recording reads partial, never
complete-and-empty.
reset --tasks keeps its delete list and order; its reply gains optional
removed counts computed after commit (a failed summary only drops the
field). run-show gains an optional constant-size removedWork summary and
--removed/--cursor paging. reset --all clears the record; deleting a Run
deletes its rows.
Removes the snapshot modules, the run_reset_lineage table, the in-transaction
receipt completion and alwaysRequestId from the first version of this PR.
* chore: drop accidental pnpm-lock.yaml churn
* refactor(orchestration): decode removed work entries through unknown before the checked cast
* fix(orchestration): count settled workers with open terminals and name affected Runs
- A worker may still be running when its state was possibly live or its
Orca-owned terminal was never released; the reset reply, run-show line and
listing share one derivation from the removed records.
- The reset reply names the affected Runs (optional runIds); the CLI prints
the exact run-show command for one Run and the list for several.
- The watermark read is no longer swallowed inside the reset transaction.
- run-show's removed-work read is guarded; a failure omits the field.
- Coverage compares created_at strictly after recorded_since.
- --removed lists a federated worker once, shows a user-taken-over terminal
as such, and says when a cursor is past the end.
* fix(orchestration): count removed workers by held process minus durable exit proof
- A removed worker may still be running when Orca held its process (live
state, federated dispatch pending or dispatched, or an Orca-owned terminal)
and no durable exit proof exists (stopped, released, released terminal, or
a certified termination reason on its Dispatch).
- The exit proof is one DURABLE_EXIT_PROOF constant shared by the fleet
liveness projection (no behavior change) and the removed-work reader.
- Dispatch records keep terminationReason.
- Coverage is complete when a Run was created at or after recorded_since; a
moved marker is stamped one second past the newest existing non-legacy Run,
and the capture installs after the stub home Run backfill.
* docs(orchestration): correct the terminationReason and coverage marker comments
* fix(orchestration): decode removed work entries through a checked schema
The stored record is parsed once with a discriminated zod schema per kind,
so the listed entry keeps its precise type without an assertion. The same
lineage field table drives the capture triggers' key set and integer casts.
* fix(orchestration): exhaustive removed-work listing switch; keep valid ids in id lists
List worker and remote worker entries with explicit cases so the switch is
exhaustive over the entry kinds. An id list drops non-string elements and
keeps the rest, as before the schema decoder.
* test(orchestration): build removed-work CLI fixtures without type assertions
Use a real RuntimeClient with a spied call and decode listing fixtures through
the entry schema, so the tests carry checked types instead of casts.
* fix(orchestration): name only the removed kinds in run-show and word the no-record message truthfully
The run-show line lists the kinds a Run actually lost, terminals included,
and the --removed message for a missing record no longer claims the host
keeps none, since a new host omits it when its read fails.
* fix(wsl-move): classify the removed-work tables with the other orchestration tables
removed_orchestration_work and its coverage marker live in the orchestration
database and go with its Runs, so the WSL mover rewrites them in place like
every other orchestration table.
* fix(orchestration): keep the removed-work hint when a reset removes only terminal records
When an imported or cloned folder's derived project id does not match the
selected project, the error now names the id the folder resolves to (for
example github:owner/repo) instead of a generic mismatch message. Host-local
ids and identical ids keep the generic message. The setup-existing-folder
help notes which ids --project accepts.
Fixes#23528
Co-authored-by: Neil <neil@stably.ai>
The bundled orca-cli skill guide never mentioned `terminal read --screen`,
so agents onboarded from it used the stream read on repainting TUIs and got
stacked fragments. Add a --screen example plus the stream-vs-screen and
--screen/--cursor rules, and realign the root help usage lines for
terminal read and terminal split with their command specs.
Fixes#15856
The orca-cli skill guide said `--direction horizontal` splits left/right and
`vertical` splits top/bottom, but terminal panes map `vertical` to a
side-by-side split (flexDirection 'row'), matching the "Split terminal right"
menu. Swap the wording and regenerate the bundled guides.
Fixes#9023
Dispatched workers were told to run `orchestration check` but never to ack
the returned deliveryId, so the same batch replayed on every check and newer
coordinator mail stayed hidden. The dispatch preamble, orchestration skill
guide, and worker contract now tell workers to ack each processed batch with
`--ack <delivery_id>` (which also reads the next one) and repeat until count
is 0.
Co-authored-by: Neil <neil@stably.ai>
cmd /c strips the first and last quote of a line that starts with a quote
unless exactly one quoted, paren-free executable path is present. A spaced
.cmd launcher plus any quoted argument (or a Program Files (x86) launcher)
was cut at its first space and the spawn silently failed. Prefix the batch
invocation with `@` so the line never starts with a quote, in both the
waiting and detached start /B forms.
Add a real cmd.exe round trip in the Windows CI lane.
Co-authored-by: Neil <neil@stably.ai>
Neil
Kelvin Amoaba
Brennan Benson
OrcaWinandOrcaWin
Jinwoo Hong
BingZandNeil
Wooseong KimandNeil
Naveen ChatlapalliandNeil
Agustin VarelaandNeil
Ehsan-hashandNeil
小七andNeil
Samuel VilaandNeil
shahidbeig-a11yandNeil
Jason Brashear
Kaynan Sampaio de Camargo
Tae Hyeong, SonandNeil