mirror of
https://github.com/stablyai/orca.git
synced 2026-10-30 16:47:34 +00:00
19f6c10c3ff8a21b10d19559ff59efcfcc1df6cf
938
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  NeilandNaufaldi
|
19f6c10c3f |
perf(renderer): drop group-has-[:focus-visible] rules that restyle whole subtrees (#36098)
Fixes #34312. Takes over naufaldi/orca#1 by @naufaldi, with the main.css part dropped because #34932 already covers it. - SshTargetCard and the reasoning chevron now use the scoped `[[class~='group/x']:has(:focus-visible)_&]` shape. Tailwind's `group-has-*` compiles to a non-subject `:has()` whose subject is `*`, and that rule made Blink restyle whole subtrees on every mutation. This change is the entire measured win: 19.4 → 1.6 ms, 12.5 → 3.6 ms and 8.0 → 2.4 ms per mutation. - rich-markdown-editor.css drops a redundant `:has()` on the TOC header, as defence in depth. - Adds a guard, check-has-restyle-scope.mjs. It compiles the renderer's Tailwind CSS, adds plain stylesheets and the listed vendor stylesheets, and fails on any non-subject `:has()` whose subject has no class, id or attribute. Three pdf.js rules are baselined after being measured as harmless. It runs in lint, check:changed and PR CI in about 1.5 s. Co-authored-by: Naufaldi <naufaldi.rafif@gmail.com> |
||
|
Neil
|
3f8b15d5a7 |
test(wsl): stop a distro mid-reply on the real-WSL lane, then Start and Continue (#35826)
* test(wsl): stop a distro mid-reply on the real-WSL lane, then Start and Continue * test(wsl): read the held partial reply from the chat stream, not history * test(wsl): close the mid-turn chat streams when a wait fails * test(wsl): reinstall the guest claude the decoy probe removed before the mid-turn stop * test(wsl): read the continued turn from the scripted Claude's report log After Start the restarted server's model discovery relaunches the same scripted CLI, which overwrites report.json with a discovery-only report after the continued turn finished. The CLI now also appends every report to an opt-in log, and the mid-turn step finds the resumed launch there. * test(wsl): match the continued launch by its session id, after Continue only |
||
|
Neil
|
2a5f6c79c1 |
test(e2e): on the real WSL lane, background work never starts the stopped distro (E9 guard) (#35590)
* test(e2e): on the real WSL lane, background work never starts the stopped distro (E9 guard) The Windows real-WSL lane opens a project inside its own imported distro, terminates that distro, and runs a window of background work elsewhere (focus/blur/reveal, workspace switches, a linked issue/PR card, Settings panes, Tasks, account switches). Every child the main process starts is logged; no wsl.exe may run anything in the distro (listings are fine), and `wsl --list --running`, watched each second, must never show it, which also catches UNC touches. Opening a terminal in the WSL workspace then starts it. A participation check fails the lane if the guard skipped. * test(e2e): actually render each Settings pane in the WSL lane's E9 background window openSettingsTarget alone only set the navigation target, so no pane mounted and none of its reads (servers, accounts, agents, integrations, CLI status, the repo pane's orca.yaml check) ran. Open Settings, wait for each pane's section to mount, then close it. * test(e2e): harden the WSL lane's E9 guard per review - process-host logs every spawn to ORCA_E2E_SPAWN_LOG when set, so the guard sees worker-thread and inheriting-child spawns (e.g. the Codex rate-limit fetch), sync ones included. - The spawn baseline is taken before `wsl --terminate`, and the running-list watcher starts right after it, so work in the stopping window counts. - A wsl.exe launch counts as starting the distro unless it names another or only lists/terminates. - The watcher is async with a 5 s timeout and non-overlapping ticks; a failed read is retried and fails the guard after three, never reads as "stopped". The recorder throws if it cannot hook, and the spawn log must be non-empty. The doc names the watcher as the authoritative assertion. * test(e2e): bound the terminate grace, keep the spawn log out of shipped runs, tolerate torn lines - The watcher forgives running reads only within 3 s of `--terminate` and before its first not-running read, which the rounds now await; any running read after it fails the guard. - Main drops ORCA_E2E_SPAWN_LOG outside e2e mode (no ORCA_E2E_USER_DATA_DIR) before anything spawns, so no daemon, PTY or agent inherits it; the log holds full argv, tests only. - readSpawnLog skips a line torn by a concurrent append. * test(e2e): no blocking wsl.exe in the WSL lane's E9 guard, and a timeline for failures The first lane run was cancelled at the 30-minute job limit while the guard step had run 25 minutes: past three 5-minute test timeouts, which only a blocked worker survives. Every wsl.exe call (setup, terminate, cleanup) is now async with a timeout, so a hung one fails the test. The guard logs a timestamped timeline (each running-list read, terminate, rounds) for diagnosis, and the job limit goes to 50 minutes for the three added runs. * test(e2e): let the setup's own WSL terminal launch settle before the terminate; 10 s grace The lane run failed with "Ubuntu was still listed 3000 ms after --terminate" in all three runs. The timeline showed why: focusing the WSL workspace in setup is a user act that opens a WSL terminal, and its launch (codex trust probe, PTY, hook relay) landed about a second after the terminate and restarted the distro. Setup now waits for that terminal's PTY and for wsl.exe launches to go quiet for 3 s before terminating. The grace is two running-list reads (10 s). * test(e2e): interleave wsl.exe launches into the E9 guard's timeline The lane saw the distro boot about two seconds after the terminate with nothing naming the launcher; each running-list tick now also prints the wsl.exe launches logged since the last one. * test(e2e): time and stack every logged spawn and main's WSL UNC touches The E9 guard printed spawns at its poll time, up to a second late, and with no caller. Each record now carries when it happened and the caller's stack, and main's fs touches of \\wsl.localhost paths are logged too, so a boot with no wsl.exe launch before it can still be attributed. * test(e2e): keep spawn-log stacks and main's fs hooks strictly to e2e mode process-host now writes the spawn log, and captures caller stacks, only when ORCA_E2E_USER_DATA_DIR is set as well, so a stray log variable in a CLI or daemon environment does nothing. The main-process fs/spawn hook refuses to install outside an e2e-mode app, and a source scan pins that no shipped code imports or installs it. * test(e2e): guard a focused WSL workspace left idle through the stop Device runs saw a stopped distro restart with its bridge workspace focused and nothing touched: the stop's own fallout re-ran renderer reads as user acts. The new case keeps that workspace focused with a folder expanded in the Explorer and Source Control shown, terminates, and idles. Shared guard helpers move to tests/e2e/helpers/wsl-boot-guard.ts. * test(e2e): capture caller stacks deep enough to reach the IPC handler * test(e2e): give the focused-idle guard's timeout bump its reason |
||
|
Neil
|
9f62a4fa2d |
fix(windows): start the WSL holder with only a NUL handle to inherit (#35799)
* fix(windows): start the WSL holder with only a NUL handle to inherit libuv starts every Windows child with bInheritHandles=TRUE and no handle list, so a detached holder that outlives Orca kept any inheritable handle Orca had open, such as a launcher's pipe or a DevTools socket. Start it through CreateProcessW with PROC_THREAD_ATTRIBUTE_HANDLE_LIST naming one NUL handle for its stdio. The build probes now check the newest export without calling it, and the lane receipt labels ConPTY's own startup output. * fix(windows): report isolated holder exits and kills the way libuv does |
||
  OrcaWinandOrcaWin
|
4cee4b1ba6 |
ci: run the layout oracle gate on free hosted runners (#35809)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Neil
|
a50a44bb8d |
feat(wsl): bridge sh/dash/ash panes report their folder (OSC 7) at every prompt (#35597)
* feat(wsl): bridge sh/dash/ash panes report their folder (OSC 7) at every prompt bash, zsh, fish and nushell panes already tell the terminal daemon their folder; a bridge pane whose login shell is sh, dash or busybox ash did not, so restores fell back to the starting folder. dash has no rcfile flag or prompt hook, but an interactive sh reads $ENV after ~/.profile, and dash 0.5.8+ (plus ash and bash-as-sh) expand $(...) in PS1. The bridge now points ENV at a new sh/env file in the published wrapper tree, saving the user's own ENV. That file hands ENV back to the user's value (so children see theirs), sources it, and inside WSL only prefixes PS1 with the report. A root containing $, ` or \ is skipped, since the shell expands ENV's value. A non-interactive sh -c never reads ENV, and a missing file (Orca updated away or uninstalled) is silently ignored by dash, ash and bash. * fix(wsl): sh ENV hook survives quotes in the user's ENV and keeps prompt width - The user's ENV is expanded through a here-document, so a value with a quote, $ or space no longer breaks startup with a syntax error. - bash-as-sh and busybox ash (fancy prompt) get the report inside \[ \] so its invisible bytes don't count toward the prompt width; dash has no line editor to miscount and would print \[ literally, so it stays bare. - Tests: a user ENV of `$HOME/u "q" sp/env`, a user PS1 with $, a quote and a backslash, and reports read through the daemon's WSL parser. - CI: edits to the sh hook and the bridge launch trigger the shell contracts job (its prefix list moves to its own module, keeping the scope script under its line limit), and the sh and fish WSL pty tests leave the unit shards. * ci: check out the shell-contract prefix module in the change detector The detector job sparse-checks-out a fixed file list; the new pr-shell-contract-prefixes.mjs that pr-code-change-scope.mjs imports was missing from it, so the job failed with ERR_MODULE_NOT_FOUND. A contract test now walks the scope script's local imports and requires each in that list. * ci: list the shell-contract prefix module wherever the scope script's modules are listed Two config-script suites copy pr-code-change-scope.mjs and its sibling modules into a fixture repo; without the new pr-shell-contract-prefixes.mjs the copied script failed to load, and the detector fell back to running everything. Also lists it with the scope script's other modules in the mobile workflow trigger and the mobile non-test file set. |
||
|
OrcaWinandOrcaWin
|
3ce252c79a |
ci: run preflight on free hosted ARM off the PR critical path (#35652)
Unit shards now wait for a standalone plan job instead of preflight, and packaging and the layout oracle start immediately, so preflight's slower free runner no longer delays the PR gate. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
006bbb28e7 |
ci: run PR unit shards on free hosted ARM as 12 shards (#34906)
* ci: run PR unit shards on free hosted ARM as 12 shards Enterprise's 1,000-job limit makes more, smaller shards free. A 12-shard cold run on ubuntu-24.04-arm measured 361s median / 412s max per shard, against ~390s / ~441s for five warm Blacksmith 8-vCPU shards. The Blacksmith-store module cache producer becomes dispatch-only since hosted shards cannot read it. * TEMP: force 12 shards on this PR (repo var is still 5); drop before merge * test: size the full-inventory routing check from FULL_SHARD_COUNT * Revert TEMP 12-shard override; the repository variable is now 12 --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Neil
|
5616230ecd |
feat(wsl): bridge fish panes report their folder (OSC 7) at every prompt (#35517)
The bridge fish launch's -C now also defines a fish_prompt hook that sends the same percent-encoded OSC 7 as bash and zsh, only inside WSL, after the user's config.fish. |
||
|
OrcaWinandOrcaWin
|
12a7d4c13a |
feat(mobile): localization infrastructure and language setting (#35399)
* feat(mobile): add UI localization infrastructure Mobile follows the phone's language (or an in-app choice under Settings > Appearance) across the same 11 languages as desktop, switching live like the theme does. - i18next with desktop's translate(key, fallback, options) call shape; catalogs in mobile/src/i18n/locales load lazily, English fallbacks stay inline - Hermes lacks Intl.PluralRules: load the FormatJS polyfill with the 11 languages' rules - OTA pages get the shell's language through an optional bridge init field - iOS permission prompts localized; iOS and Android 13+ per-app language pickers - verify:mobile-localization and a coverage ratchet run in lint, check:changed and CI * fix(mobile): mount pages after the newest language request; tighten localization gates - Wait for the latest page language activation, not a superseded one - Keep literal fallbacks when a key also has a dynamic one - Count headerTitle as visible copy; select the mobile check when the runtime catalog generator changes * feat(mobile): repaint themed components on language changes Components that read the theme already subscribe for repaint; a language switch repaints them too, so labels built by helpers during render follow it. RPC recordings load the real i18next and JSON catalogs. * fix(mobile): scope the translate() gate to render bodies and memos; prune stale keys on sync Handlers and effects may call translate() when they run. sync:mobile-localization now removes keys no code references from every catalog. * fix(mobile): use node: imports in the locale config plugin; pass uiLocale in bridge hook test * chore(mobile): refresh the localization coverage baseline * fix(mobile): follow render callbacks in the translate() gate; keep used plural siblings on prune Also let anonymous default-exported screens count as components, flag any plural family a locale started, and mark JSON modules as ES modules in the recording loader. * fix(mobile): treat async and named local callbacks as handlers in the translate() gate * chore(mobile): refresh the localization coverage baseline * chore(mobile): refresh the localization coverage baseline --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
 Brennan Benson
|
bb1b05e3bd |
Clear Google cookies from a browser profile, as often as you need (#34158)
* Add repeatable Google cookie clearing for browser profiles * Bind Google cookie clearing to its successful import target * Repair cookie-clear contract test boundaries and positive flows * Correct cookie-clear test fixture typing * test: use checked runtime bindings in browser profile RPC fixture * test: provide page registry to sidecar forwarding fixture * fix: use selected browser profile owner for cookie clear menus * test: provide confirmation context to link materialization fixture * test: classify cookie clear session channels * refactor: consolidate browser command property guards * test: update cookie clear fixture for merged registry API * feat: move Google sign-in recovery to browser settings * Freeze Settings Google cookie clearing intent and refresh availability * Restore baseline browser import disclosure coverage * Pass the selected browser profile into cookie settings * Localize Google cookie settings search keywords * Update cookie restart fixture policy exports * Keep localized browser search results visible * fix: make Google cookie clear a red right-aligned setting that explains when to use it * Explain why Google cookies are handled separately in the clear row caption |
||
|
Neil
|
045f8c8266 |
feat(files): show images and PDFs from the byte-range preview path, local and remote (#35165)
* feat(files): show images and PDFs from the byte-range preview path, local and remote ImageViewer and PdfViewer read an orca-media:// URL instead of base64 when the editor opens a file: images load by URL, and pdf.js reads PDFs by range, so a large PDF no longer arrives whole through files.readPreview or pages into memory first. The grant mints only for the editor's viewers; diffs, git blobs, markdown images and the paired web client keep base64. - Minting an image checks its header with the base64 path's rule, so an image proven too large to decode safely never reaches the decoder. - orca-media gains fetch and CORS privileges, and range responses expose Accept-Ranges and Content-Range, so pdf.js can read by range. - Grants report the file size the viewer used to estimate from base64. * fix(files): read PDFs by real range, check served images, keep old hosts' previews - pdf.js fetches ranges only over http(s), so an orca-media URL was read whole; a small range transport now hands it bytes=a-b reads from the grant, and a failed range fails the preview instead of hanging it. - A file can change after mint, so the raster header is checked again on the bytes each image request serves (the same handle locally). - A paired host without files.readChunk falls back to files.readPreview for images and PDFs, as before; only audio and video need the update. * fix(files): mint no local document grant for a renderer gone mid-mint The local image/PDF mint is async now (authorize, open, header check), so a renderer that closed meanwhile could leave a grant no teardown drops. It binds the renderer lifetime first and refuses to mint once it's gone, as the remote mint does. * fix(files): keep the 50 MB cap for URL images, and probe remote headers incrementally An <img> decodes the whole file, so image grants keep the base64 path's 50 MB cap; PDFs, now read by range, don't need one. A remote header probe reads only each wider step's new bytes instead of re-reading from the start. A replaced image of a different size resets its zoom. * fix(files): tear down a PDF load whose range failed, and read 256 KiB ranges A failed range only showed the error and left the pdf.js task, its worker and pages alive; it now destroys that load first. pdf.js asks for one readChunk-sized range at a time instead of 64 KiB, and a Range preflight gets its CORS answer instead of 405. * fix(files): read PDF ranges over IPC so orca-media needs no fetch or CORS orca-media had gained supportFetchAPI and corsEnabled, and its responses sent Access-Control-Allow-Origin: *, so pdf.js could fetch ranges. That let any default-session frame holding a token read the bytes. pdf.js now reads a PDF grant's ranges through fs:readPreviewRange, which main answers only for the renderer that minted the token. The scheme is back to element-load privileges (standard, secure, stream), responses carry no CORS headers, and preflights get 405. Grant bookkeeping moves to preview-grant-registry.ts. An e2e spec proves an orca-media URL can't be fetched from the app page or read from another session. * ci(e2e): route the byte-range preview sources to the viewer specs that exercise them Changes to the orca-media grant path, the image/PDF viewers and the PDF range transport now run the PDF reload, rebuild and find specs, the remote large-file open, media playback and the partition-isolation spec. * fix(files): stop PDF range reads on abort, abort remote reads with the window, fix the CI route - A closed or reloaded viewer schedules no further pieces of a merged range, and a remote range read stops when its window goes away. - A URL without a size is an error rather than a fetch the scheme refuses. - The PR guard job's sparse checkout and its admission test include the new route module, and the route now also covers the mint handler, preload bridge, editor surfaces, scheme registration and read client. * fix(files): classify linked previews by their target, keep range reads off stopped WSL distros A local image or PDF reached through a link is classified by the file it resolves to, at mint and on every read, and a re-mint after the link is retargeted gets a fresh grant of the new type. A paired host's document whose first bytes are another kind defers to files.readPreview, which classifies the target there. Lazy local reads go through the non-waking WSL guard, as fs:readFile and fs:readFileChunk do. |
||
  Oleksandr SuvorovandNeil
|
3bfb2bd094 |
fix(build): explain missing mobile/ deps instead of failing build:mobile-web (#24325)
mobile/ is a separate pnpm project, so the root pnpm install leaves mobile/node_modules empty and pnpm build failed in build:mobile-web with hundreds of unexplained esbuild "Could not resolve" errors. build-mobile-web-app-bundle now checks for mobile/node_modules first and exits with the one command that fixes it. The probe path is shared with the bundle tests' dependency check. CONTRIBUTING documents the install in Local Setup and points "Before Opening a PR" at it. Fixes #24324 Co-authored-by: Neil <neil@stably.ai> |
||
|
Neil
|
fceb475e44 |
test(wsl): measure distro restart to first output for the WSL host and an old-bridge lower bound (#34864)
* test(wsl): measure reboot to first prompt for the WSL host and the old bridge The real-WSL lane's phase 3 now terminates its distro and times, median of 3 each, how long a WSL-host project takes to a working terminal (holder boot, orcad start, terminal spawn and an answered command) against one wsl.exe into the login shell, as the old bridge does. Test-only. * test(wsl): relabel the restart baseline honestly and raise the WSL2 job cap The baseline measures distro restart (VM warm) to first command output; the old-bridge figure is a non-PTY wsl.exe --exec lower bound, not ConPTY first paint. The job cap rises to 40 minutes so it no longer undercuts phase 3's own 30-minute timeout. |
||
 Grit
|
03dcd30367 |
docs: fix README typo and drop stale release-rc.yml cron note (#14569)
The README misspelled "sponsored" in the Signed Builds section, and CONTRIBUTING.md still pointed at a scheduled release-rc.yml workflow that no longer exists (release-cut.yml is dispatch-only). Fixes #14568 |
||
|
OrcaWinandOrcaWin
|
7cdfebdc1b |
Revert iteration checks and custom Vitest selection (#34834)
* revert: remove iteration checks and custom Vitest selection * chore: use upstream affected-test selection --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
 NeilandClaude
|
1eaaf85e9f |
Land the WSL project mover dark (merges only after verify-15b, the flag-off audit and green CI) (#34059)
* test(orcad-migration): pin the SSH manifest through the real dormant collectors Co-Authored-By: Claude <noreply@anthropic.com> * refactor(orcad-migration): read the dormant-state export through a source-kind scope A local-WSL scope lives on host local and owns only its projects, so host-wide matches stay an SSH whole-host rule. SSH bytes are pinned by the collector golden. Co-Authored-By: Claude <noreply@anthropic.com> * feat(wsl-mover): export a local WSL move's signed manifest with its dormant state (D1b-3c) Collects the scoped projects, their groups and every dormant-state kind through the local-WSL export scope, rewrites UNC paths to the distro's, and returns blockers for anything the collectors can't carry instead of dropping it. Automations move disabled, as the wire requires, and come back as a list to re-enable on the host after commit. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): reset an interrupted move to zero, or finish it once the host proves a commit Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): abort a move by its identity when its manifest is too large for a request Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): cap a new move's manifest below the request limit, and move forward on a by-reference commit only once the host flushed it Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): remove only the newest move of a distro, so its chain stays readable Co-Authored-By: Claude <noreply@anthropic.com> * feat(runtime): clients read a migrated pane's scrollback from its host (D1b-6d-1) * fix(runtime): hold a remote pane only when its host is known to serve scrollback, and never read bytes in render (D1b-6d-1) * fix(runtime): route the scrollback read by the tab's own host, never the focused one (D1b-6d-1) * fix(runtime): resolve the scrollback host through resolveOwner and use the shared RPC error check, after main moved both (D1b-6d-1) * feat(wsl-mover): a moved project's existing chats stay listed and resumable on this computer (D1b-7a) * fix(wsl-mover): moved-project chats go through the layout owner instead of writing layout directly (D1b-7a) * test(wsl-mover): run the moved-project chat runtime test in the Node runtime (D1b-7a) * test(wsl-mover): read the hidden local row through main's per-host hidden-repo API (D1b-7a) * feat(wsl-mover): rewrite the desktop's routing and seed the host's session after a move (D1b-7c) Registers the main-side desktop rewrite stores ui-routing, session-globals and host-session-seed. Adds a +2 main layout-writer baseline line for wsl-move-main-rewrite-stores.ts: these are one-shot, ledgered move rewrites, and no LayoutCommand can set focus or seed a runtime host's partition. * fix(wsl-mover): finish the main rewrite before the window loads, keep one copy of each moved tab, and copy instead of move (D1b-7c) * feat(wsl-move): rewrite renderer stores for moved projects and keep their UI through catalog prunes (D1b-7d) Registers the renderer-side desktop rewrite stores quick-open-history, file-view-preferences and notebook-environments. The renderer copies each moved workspace's entry to its WSL host key, marks it applied in the same storage, and records the ledger entry; main requests a storage flush first and accepts only the main window. Committed moves are re-listed for re-application at every startup. Catalog prunes keep filters, hook trust and setup-script dismissals of moved repos. * fix(wsl-move): import the migration manifest types from main's orcad-migration folder (D1b-7d) * fix(wsl-move): import wslUncPathToLinux from shared wsl-paths in the manifest exporter, where 7d moved it (D1b-7d) * feat(wsl-mover): rewrite a moved project's orchestration history on the desktop (D1b-7e) Settled local worker dispatches and their worker-terminal rows in a moved project take the WSL host's worktree id, in one ledgered, idempotent store. Chat workers, live rows, federated attachments and JSON receipts stay as written; automations keep their unchanged local copy (the scheduler only advances it). Per-table dispositions for orchestration.db. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): hold the orchestration store while a worker in scope is live; skip federated rows (D1b-7e review) Co-Authored-By: Claude <noreply@anthropic.com> * feat(wsl-mover): copy in-app browser logins into the WSL host on a move (D1b-7f) A committed WSL move now copies each in-app browser profile's cookies once into the WSL host's stable route partition (owner decision 3a), merging without overwriting what the host jar holds and never touching the source. Where that is infeasible (no deployment link so no stable partition, the destination is not a WSL host or is gone, or the partition name is held by another identity) the host starts fresh and the move journal records why (3b). Registered as the ledgered browser-cookies rewrite store; it runs only once browser sessions and an app window exist. WSL_MOVE_DESKTOP_REWRITE_REGISTRY_COMPLETE stays false. * feat(wsl-mover): retain moved source rows, reconcile them on start, and plan delta moves (D1b-8) * fix(wsl-mover): keep the retained mark out of the WSL move manifest (D1b-8) * feat(wsl-mover): the move driver runs a WSL move end to end, with production gate facts and journaled restore folders One entry point (and preview/start/cancel/listUnfinished IPC for D1b-9) plans the move, gates terminals on the hook server's agent status, the close-tab process probe, running automation runs and live dispatches, pauses and proves exit, stages, sends blobs, commits only from blobs-transferred (#29825), and finishes on the desktop. Any failure resets to zero or goes forward when the host committed. Restore folders and the automations to turn back on are kept in the journal; the host turns those automations back on after commit, retried until it confirms. A real-PTY test pauses daemon shells, and runs on a real distro in the WSL orcad lane. * feat(wsl-mover): move dialog with preview, blockers, progress and result behind the internal WSL hosts gate (D1b-9) * fix(wsl-mover): move dialog hides instead of blocking, follows runs after a reload, and lets a start settle an unfinished move (D1b-9 review) * fix(wsl-mover): word an unfinished earlier move as still finishing (D1b-9) * test(wsl-mover): type the e2e's fake move state instead of reading it through Reflect (D1b-9) * WIP(wsl-mover): 7f-2 registry complete, coverage proof, startup re-apply (D1b-7f-2) * test(wsl-mover): registry-complete lifecycle, stale-focus restart, unload re-apply (D1b-7f-2) * fix(wsl-mover): share the session focus write so the re-apply adds no layout writer (D1b-7f-2) * fix(wsl-mover): redo additive rewrites once at a stale window's unload; behavioural coverage proof (D1b-7f-2 review) * test(wsl-mover): the IPC record test now finishes the rewrite with the registry complete (D1b-7f-2) * fix(wsl-mover): fence worktree-less spawns by cwd and re-prove terminal exit before commit (R46, WIP) * test(wsl-mover): pin the commit re-proof, browser jar identity and repeated move generations (R45, R46, R47) * fix(wsl-mover): fence any spawn by its folder and name the re-proof's reason (R46 review) * fix(wsl-mover): a terminal in a known folder outside the move never blocks it (R46 follow-up) * test(wsl-mover): kill the real move driver at every point against a real host store; abort a reset move's leftover stage on reconnect Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): carry unsaved drafts into the moved project; round-trip every fixture through the real export, driver and host import Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): reset a move waiting on a distro that is proven unregistered; test updates mid-move (R41), lost distros (R38) and two desktops (R39) Co-Authored-By: Claude <noreply@anthropic.com> * test(wsl-mover): list the D1b-10 real-SQLite mover tests Co-Authored-By: Claude <noreply@anthropic.com> * test(wsl-mover): type the fault test's journal hook without a cast Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): reset for a lost distro even when its kept host fails to connect, never for a renamed one; compare filled-in repo keys only where the source lacked them Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): carry markdown frontmatter visibility and closed-terminal-tab tombstones into the moved project Co-Authored-By: Claude <noreply@anthropic.com> * test(wsl-mover): read the persisted stage through a typed record, not Reflect Co-Authored-By: Claude <noreply@anthropic.com> * feat(telemetry): report how WSL moves end, by phase and reason code (R43) Co-Authored-By: Claude <noreply@anthropic.com> * fix(telemetry): report a pause refusal's reason, an outcome for a thrown run, and only real transport errors as unreachable Co-Authored-By: Claude <noreply@anthropic.com> * fix(agent-hooks): a WSL host's orcad never removes the hook entries the WSL bridge shares (R42) Co-Authored-By: Claude <noreply@anthropic.com> * fix(agent-hooks): a WSL host's Codex account-home launch with hooks off skips too; mark the R42 guard to drop with the bridge Co-Authored-By: Claude <noreply@anthropic.com> * feat(wsl-mover): "Use on this computer again" brings a moved project back as it was before the move Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): judge a bridge WSL pane's foreground inside its distro On Windows every live bridge pane's own process is wsl.exe, so the busy-terminal gate read every open WSL terminal as running a program and refused the move. Read the pane's terminal foreground process group inside the distro (processes carry ORCA_PANE_KEY): only shells means idle, anything else blocks, and an unreadable guest stays unverifiable. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): only the selected projects' session rows can refuse a WSL move The session eligibility check treated host local's whole partition as the move's, as the SSH conversion does. So an agent session or unsaved draft in any other project on this desktop, or in a project an earlier move retained, refused every later WSL move from that distro. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): sign the manifest as the journal and the host read it The digest was computed over in-memory rows. A value with toJSON (a Date on a row added this session) canonicalized to {} when signing but to its string once written to the journal or sent to the host, so the first move after adding a project reset with orcad_migration_manifest_digest_mismatch until a restart reloaded the row. Normalize through JSON before signing. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): carry a slept pane's scrollback from its daemon checkpoint The move sleeps every pane first, and a slept pane's history lives only in the daemon's checkpoint, never in a renderer snapshot. The export carried renderer snapshots only, so moved terminals opened empty. After Sleep the driver reads each paused pane's checkpoint (as cold restore would replay it) and the export carries it under the pane's own snapshot ref; the snapshot channel serves those bytes, checked against the signed hash. SSH conversions pass no reader and are unchanged. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): say why when a move can't be prepared, instead of a bare reset An export or journal failure after the pause (a digest mismatch, on awin) was rethrown and shown as "everything was put back" with no reason. Nothing is journaled yet at that point, so refuse with the error named instead. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): retry a renderer store main refused to record The renderer applied a store and wrote its marker, but ignored a refused ledger record (gated-off, failed, not-main-window), so a committed move stayed unfinished and refused every later move of the distro until the next app start. Log the reason and retry with backoff until it lands. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): a WSL pane is idle only when its shell has nothing else Review of #32343: reading only the terminal's foreground group let background jobs, nohup and disowned work, setsid daemons and a script waiting at read pass as idle, and the move's Sleep would end them. Scan the pane shell's subtree, its session and every process carrying its key; any non-shell process, or a shell running a script, blocks. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): never leave behind an agent whose key may be the selected project Review of #32343: scoping the session check to the selected projects let an unqualified key for a repo id another host also registers fall out of both the transfer and the refusal. Such a key now refuses. Adds tests that fail on the old code: another project's live agent with its tab open and its draft don't refuse, the same kinds of state in the selected project still do. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): refuse an unreadable slept checkpoint, prefer it, and spool it to disk Review of #32343: - A checkpoint behind an unreadable log (or an unreadable one) refuses with the pane named instead of carrying stale history. - For a pane the move just slept the checkpoint is the newest copy, so it wins over an older renderer buffer or snapshot. - Buffers spool to a per-move folder and only their hashes and sizes stay in memory; the snapshot channel reads them by offset. The folder is removed whatever the outcome. - A journal write that landed before it threw is reset, so no orphan record blocks the next move. awin's checkpoints were 310-615 KB, well inside the 5 MB per-pane cap, so nothing there is trimmed. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): retry a failed listing, never a record another window was refused Review of #32343: not-main-window can't clear by waiting, while a listing failure is transient. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): sign the manifest as the host parses it The likelier cause of awin's digest mismatch: the signature covered the exported objects, but the manifest parser keeps only the fields it knows, so a session field it drops (one a sleep can write) left the journal and the host hashing something else. Sign the parsed form, and warn when the parser dropped anything, since such a field does not move. Co-Authored-By: Claude <noreply@anthropic.com> * chore(wsl-mover): split the journal step out of the driver, and format The review fixes took wsl-move-driver.ts past the line limit; the export-and-journal step moves to its own module unchanged. Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl-mover): a slept pane passes the busy check; say what each move dropped or lacked Re-run on awin ( |
||
|
OrcaWinandOrcaWin
|
0866cb1b08 |
fix: bound local iteration checks and show live progress (#34700)
* fix: bound local iteration checks and show live progress * fix: harden check lifecycles and cached test evidence * fix: preserve process instrumentation and fixture lifecycles * fix: give fixture unref spy a portable function type --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
ca2154945b |
ci: run advisory e2e lanes on free hosted runners (#34725)
The layout oracle merge gate keeps Blacksmith via fast_runners: true; the advisory e2e call, nightly schedule and layout-owner dispatch run on ubuntu-24.04. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
8b7f8c88ce |
ci: run terminal perf on demand only, on a hosted runner (#34726)
* ci: run terminal perf on demand only, on a hosted runner The nightly failed every run: the presented-frame guard accepts only GitHub-hosted Xvfb displays, but the workflow ran on Blacksmith. Drop the schedule, move dispatch runs to ubuntu-24.04 and document local use. * docs: record the first hosted terminal perf result --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
8b64ec281a |
ci: restore main's Vitest transform cache in PR unit shards (#34512)
* ci: restore main's Vitest transform cache in PR unit shards Main produces per-shard transform caches on a schedule; PR shards restore the newest one for the same config/lockfile/runtime policy. A Vitest cache key generator folds each literal specifier's resolution candidates into the per-module key so newly added files that shadow a resolution invalidate the importer, and bails on glob-expanded dynamic imports. * ci: list the resolution key plugin in the node tsconfig project * ci: accept Vitest's CACHEDIR.TAG when sealing the unit module cache Vitest 5.0.5 tags its cache root, which made every seal fail with 'invalid cache entry name' so no producer cache was ever saved. * ci: reseed the unit module cache when any cache-key input lands on main Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
5f4d9654f9 |
ci: run operation-count performance contracts on hosted runners (#34668)
The contracts count operations and retained objects; wall-clock budgets stay in pnpm test:perf:benchmarks, which no CI job runs. They do not need Blacksmith's consistent hardware, and the PR path filter runs them ~40 times a day ($7.90/day, $5.50 of it on the 6-vCPU Mac). Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
1df26abf60 |
ci(adhoc): package Mac architectures on 6-vCPU runners (#34673)
Each 12-vCPU arch job spends ~3 of its ~7 minutes waiting on Apple's notary service; packaging itself runs at the same speed as the hourly build's 6-vCPU runner. Halve the per-minute rate. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
e0f32dcac1 |
ci: seed hosted Linux packaging and mobile bundle caches on main, and stop PR-local saves (#34672)
- Warm electron-builder-linux-<versions> and the hosted ubuntu-24.04 Electron native modules - PRs restore hosted Linux Electron native modules without saving - Replace mobile verify's bundler-cache with a restore of a warmup-saved bundle - Drop the pnpm store cache where a direct install was faster (mobile main, glibc-floor containers) Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
4cd62c4946 |
ci: split the layout oracle window scenarios across two shards (#34671)
The single-file oracle cannot be split by whole-file balancing, so pass Playwright test-level shards to the changed-spec lane. It was the last required check in 40 of 42 measured runs. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
1f5939dffc |
ci: run relay integration on a free hosted runner (#34666)
It finishes in ~1.2 min beside ~7 min unit shards, so Blacksmith minutes buy no wall time. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
beb53a7f9e |
ci: keep hourly and daily macOS builds on Blacksmith (#34640)
Hosted macos-15 fails afterPack's packaged x64 terminal host boot check (hourly run 40608643418: timed out waiting for the PTY), so no latest-mac.yml is published. Windows, template qualification and routing jobs stay on hosted runners. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
2cd3e6d6a3 |
ci: narrow churny cache keys and move PR-local cache saves to main (#34600)
* ci: narrow native, launcher and packaging cache keys and stop PR-local saves * ci: hash Rust crate sources, not build outputs, in launcher and hook keys * ci: fail closed on unlocked native packages and cover transitive key inputs * ci: resolve the Windows Rust cache scope with a script, not a nested local action --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
59dbb54dad |
ci: keep Git compatibility on Blacksmith (#34625)
Its three parallel real-Git lanes, two of them through Docker, push git-binary-compatibility.test.ts past the 30s test timeout on the 4-vCPU hosted runner (64s file time vs 14s), failing PR #34600 twice after #34566. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
965286939d |
ci: sweep caches on idle non-main branches every three hours (#34605)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
7a834988dc |
ci: run mobile main tests on the hosted ARM runner PR verify uses (#34611)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
791502fae4 |
ci: move secondary, scheduled and contract workflows to GitHub-hosted runners (#34568)
* ci: move secondary, scheduled and contract workflows to GitHub-hosted runners Public-repo standard hosted runners are free under Enterprise. Release, build, benchmark, e2e and unit workflows stay on Blacksmith. ci-xterm-cache seeds both cache stores since its PR consumer's pool is undecided. * test(pi): resolve the smoke bundle's external packages from the repo #34148 pulled zod into the commit-message planner graph; the bundle in the OS temp dir could not resolve it on any runner. * ci(unit): use four workers on the hosted four-core x64 runner --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
|
f4d98b74e3 |
ci: run hourly and daily dev builds on free hosted runners (#34585)
Hourly and daily builds publish unvetted dev channels on a schedule, so their latency is not user-facing. Move the macOS build to hosted macos-15, the Windows build to hosted windows-2022 (the release path), template qualification to hosted lanes, and the small routing/publish jobs to ubuntu-latest. Adhoc and release builds stay on Blacksmith. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
OrcaWinandOrcaWin
|
1864543ade |
ci: warm GitHub-hosted runner caches and drop the serve-switch installer cache (#34576)
* ci: warm hosted runner caches and drop the serve-switch installer cache * ci: seed only restored caches from hosted warm legs * docs(ci): hosted dev builds and no larger runners --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
03d359749e |
ci: stop publishing the pnpm store from GitHub-hosted runners (#34588)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
9cc555e2de |
ci: run off-critical-path PR jobs on free GitHub-hosted runners (#34566)
Keep preflight and the unit-test matrix (the PR critical path) on Blacksmith; move routing, aggregation, contract, packaging and mobile checks to hosted standard runners, which are free for public repos under Enterprise concurrency. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
3058cdd1a8 |
ci(node-server): run PR and scheduled qualification on free hosted runners (#34560)
Only explicit fast_runners callers (manual, hourly/daily/adhoc builds) keep Blacksmith; qualified-orcad-template's cache/save jobs always use ubuntu-latest. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
 Kelvin Amoaba
|
917ef9c737 | feat(browser): install Chrome extensions from the Web Store into Orca's browser (#30940) | ||
|
OrcaWinandOrcaWin
|
7b8ca17c64 |
build(runtime): target Node 24 while retaining host compatibility (#34177)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
44f4b1d255 |
docs(contributing): list the native toolchain and system libraries a first pnpm install needs (#31592)
Local Setup named only Node, pnpm, and Bun. A first pnpm install also compiles node-pty and the native addons with node-gyp and loads them in Electron, and *.electron.test.ts fall back to xvfb-run on headless Linux. Document the per-platform build toolchain, the Linux Electron runtime libraries plus xvfb, and the Corepack/pnpm version caveats. Fixes #31589 Co-authored-by: Neil <neil@stably.ai> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
 bangchang
|
20411c1e5d |
docs: fix typos in the PR template (#29692)
Fixes #29691 |
||
|
OrcaWinandOrcaWin
|
164ced27e9 |
ci: run the node-server Windows x64 lane on the free hosted windows-2022 runner (#34350)
The free windows-11-arm and macos-15-intel lanes already set the matrix's wall time; the paid 8-vCPU Blacksmith Windows lane finished minutes earlier for ~$48/day. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
64090416e3 |
ci(adhoc): start the 12-vCPU Mac packaging jobs after template qualification (#34327)
Both arch jobs overlapped ~2.5 min of setup with qualification, then polled for the template for 400-560 s on the most expensive runner we use. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
581e23319d |
ci: run the macOS computer-use smoke only for macOS-relevant changes (#34325)
The owner-loss smoke builds the Swift helper and forks the computer sidecar; neither imports src/cli or src/main/daemon, yet those paths started the paid macOS runner on every computer-e2e trigger. Move it to its own workflow with the macOS-relevant subset of the old paths. Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
Neil
|
ab9532ecd8 |
feat(wsl): let an idle WSL distro stop once its server idle-exits (#33084)
* feat(wsl): let an idle WSL distro stop once its orcad idle-exits The WSL host's holder kept the distro (and the WSL VM) running after Orca quit, even with nothing running in it. orcad now leaves a release request in ~/.orca when a managed idle stop retired its terminal daemon; the holder waits for that orcad to exit, claims the request and ends, so WSL can stop the distro. Live terminals, working agents, enabled automations or a returning client keep the distro held as before. A host whose distro is stopped at startup reads as stopped instead of unreachable, and the real-WSL lane gains a phase that proves the release and records memory. * fix(wsl): key the holder release on the WSL-host launch marker; name the lane phase The real-WSL lane showed orcad idle-stopping with its daemon retired while the distro stayed up: the setsid'd orcad's environment is not guaranteed to carry WSL_DISTRO_NAME, so the release request was never written. Use ORCA_WSL_ORCAD_HOST, which only WSL-host launches set. Phase 3 now carries its phase name and path filter, and records what kept a distro running. * test(wsl): dispose the idle-release lane's guest transports Each guest command left its exec loop running, a wsl.exe client that kept the distro up after the holder had already let go (the receipt showed no holder, no orcad, no request left). * test(wsl): record which wsl.exe clients keep the idle-release lane's distro up * test(wsl): satisfy the flaky-test ratchet; feed the new idle port in the release test * test(wsl): snapshot guest processes after launch to find what holds the session * test(wsl): locate the step that leaves the zombie holding the idle distro * test(wsl): log the idle-release lane's guest commands with times to place the zombie * test(wsl): follow the remote runtime client's move * test(wsl): record when each leftover WSL session init started * fix(wsl): keep the distro while the user still runs anything, and never trip on the request file Review of #33084: - The holder now checks, before claiming a release, that no process of the user runs outside the holder itself (session plumbing aside: systemd --user, (sd-pam), dbus-daemon). A detached tmux, nohup job or dev server keeps the distro; it fails toward holding. - A new holder drops any request left from before it started, so an older orcad's request can never end a holder a client just asked for. - orcad touches the request file only for WSL-host launches and never throws over it. - The real-WSL lane proves a detached job keeps the holder and its request, and the distro stops once the job ends. * fix(wsl): a running container keeps the distro, whoever owns its shim Docker's containerd-shim processes run as root, so the user-only scan missed them and a release would have stopped running containers. Any containerd-shim process now keeps the hold. * fix(wsl): read each process status only up to Uid; document what keeps the hold Delta review of #33084: dash reads a status file a byte at a time, so stop at Uid. Document that a root default user never releases, that per-user agents hold it, and the hidepid exception. The lane's pkill no longer matches the shell running it. |
||
|
Neil
|
0cff8e0fb7 |
ci(windows): rehearse the orcad template reseal over SignPath-signed binaries (#34316)
* ci(windows): rehearse the orcad template reseal over SignPath-signed binaries * ci(windows): keep rehearsal template jobs on GitHub-hosted runners |
||
 hwantageandNeil
|
483573f0b9 |
fix(browser): focus newly opened image tabs (#34127)
* fix(browser): focus newly opened image tabs Focus the window before the webview so Command+W closes the new image tab instead of the original tab after a plain image click. Add tests for focus order, image loading, and close-shortcut forwarding. Fixes #34114 * test(browser): verify image tab focus with native keyboard input * refactor(ci): keep browser E2E routes within registry size limit * fix(ci): enable background launch for native browser regression * test(ci): include browser routes in isolated detector fixture --------- Co-authored-by: Neil <neil@stably.ai> |
||
|
Neil
|
7a9abe48f3 | refactor: group remote runtime client modules (#34133) | ||
|
OrcaWinandOrcaWin
|
875d89af50 |
Refine lint performance and safe process execution (#34147)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
ad2156c358 |
test: remove 140 low-value cases and 49 suites (#34062)
* test: remove 140 low-value cases and redundant browser probes * fix: remove unused upstream chat menu import * test: pin the host-split layout fixture branch --------- Co-authored-by: Orca Test Audit <test-audit@stably.ai> Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |