* fix(native-chat): offer restart resume for chats whose only work was background
The quit started the chat teardown and then stopped the hook server, which
emptied the status store holding each chat's subagents and background
commands. The teardown reads that store to decide which chats were still
working, so a chat whose turn had finished but whose background command or
subagent was still running was never offered to resume after a restart or
update. The quit now stops hook ingress without clearing the store.
* test: preserve background-only chat resume across shutdown
No ssh: git provider is registered in production, so the reconnect
coordinator's catalog and lineage reads always came back non-authoritative
and its worktree refresh never merged. Its only live effect was clearing an
unconverted target's stale PTY bindings on each connected push and on wake;
the state bridge now does that directly.
Deletes the coordinator, preparation, worktree refresh scheduler, host
hydration, rollout flag and their product telemetry event, the scoped
direct-SSH reconnect/hydration options, and the now caller-less
repos:listForExecutionHost and worktrees:listLineageForHost IPC handlers.
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(runtime): session-only browser keys and an opt-in for pairing from plain-http pages (host)
- pairing.registerDeviceKey accepts ephemeral: true (advertised as
pairing.device-key-ephemeral.v1). Such keyed rows are dropped when the host
restarts and after 12 hours with no live socket; a sweep removes them and cuts
any socket still bound to them, so later key auth gets device_revoked.
- The WebSocket upgrade Origin is recorded per socket. A first pairing (a
never-used pairing code) from an http:// page on another machine is refused
with a sealed insecure_origin error unless the operator sets
ORCA_ALLOW_INSECURE_WEB_PAIRING=1. Already-paired browsers, https and loopback
pages, and native clients are unchanged.
- Registry file reading moved to device-registry-file-read.ts to keep the
registry under the size cap.
* fix(runtime): gate first pairings only for the marked web client, never phones
React Native sends an http Origin on every LAN WebSocket, so the Origin alone
refused first-time QR pairing from released phones. The web bundle now marks
its upgrade with ?orca-client=web; only a marked socket from an http page on
another machine is gated. Released hosts ignore the query string.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Desktop, CLI, web and runtime transports now take a PairedRuntimeConnection
(endpoint, pinned host key, credential) instead of a PairingOffer. Offers stay on
the pairing input path (codes, QR, links, environment add) and are converted with
pairedRuntimeConnectionFromOffer. The credential is token-only today; request
envelopes still carry the same deviceToken, so the wire is unchanged.
This lets device-key and ticket credentials replace the token later without
touching every connect call site again.
Co-authored-by: m4air <m4air@Mac.localdomain>
* test(perf): in-app layout latency probe, event-loop delay on main and orcad, and a main baseline
* test(perf): plain report comment
* test(perf): name the latency report type
* test(perf): add the Linux CI baseline; routine runs take 10 samples
* test(perf): stamp close pane on the w key, keep probe work out of samples, label first drawn and Linux flood
* refactor(layout): keep compatibility code in named folders behind one entry
Moves the old-client translators into src/shared/workspace-layout/old-client/
and the remote layout snapshot recorder and persistence into
src/main/remote-layout-snapshot/, each behind an index.ts. A new
check-compat-boundary-imports script, run by pnpm lint and the PR workflow,
fails when code outside a compatibility folder imports past its index or
when a file other than the folder's named importer imports it. Moves only;
no behaviour change.
* test: drop whole-repo scan from boundary check unit tests; CI step runs it
* fix(lint): list only existing compatibility folders; resolve renderer aliases in renderer files
The host side of the terminal source-range ACK protocol had one producer: the
relay-fed SSH output intake, deleted in #27515. Since then nothing installs the
runtime's source-range hooks and nothing passes source ranges into PTY output,
so every terminal.multiplex subscribe that offers ackOutputSourceRanges is
already answered without it and uses the byte-window ACK.
Delete the ledger, the per-connection registry, the consumer hook surface on
the runtime, the stream-level reservation/commit/rollback plumbing in flow
control, initial snapshot and cleanup, the source-range ACK frame schema, and
the range slicing in output chunks, batching and replay. The subscribe schema
still accepts the ackOutputSourceRanges capability, and the client keeps its
range-ACK support for older hosts. A new golden test pins that an offering
subscribe gets the same reply and frames as a byte-ACK one.
Co-authored-by: m4air <m4air@Mac.localdomain>
* test(native-chat): pin each agent's subagent row writes before unifying the rosters
* refactor(native-chat): one shared subagent tracker owns every agent's subagent rows
Claude, Codex and ACP (Grok) each kept their own subagent roster with drifted
rules. They now only report what they observe; one tracker decides grouping,
runs, names, state, sweeps, retention, row writes and restart inheritance.
The golden row-write tests from the previous commit show each rule change.
* fix(native-chat): one entry per subagent, derived lookups, ACP end stamped in its session-end write
Review round 1: a resumed child keeps its one entry and reopens it where it is
listed (the chat draws one section per child, anchored at the first row naming
it), every lookup is read from the rows, the no-turn row is never released,
and ACP's session end stamps its live children inside the session-end write
instead of writing rows ahead of it.
* fix(native-chat): derive the no-turn group, end a foreground run with the turn that started it
Review round 2: the row no turn owns is recognised from its id (a stored flag
was lost when an earlier run's row was first reached through one of its
children), and a turn's end settles the foreground runs it started wherever
their child is listed.
* fix(native-chat): count an inherited subagent row as settled history when a lookup loads it
A read-only lookup could load an earlier run's settled row that retention never saw, so it was never
released and a fresh settled row was released in its place.
* fix(macos): preserve terminal privacy identity across app updates
* test(macos): make launchd fixtures portable across host platforms
* fix(macos): probe protected contents and close handles on denial
* fix(i18n): register terminal permission status labels
* fix(macos): fork the daemon when no stable-bundle job can claim the endpoint
A copy, signature, plist or deadline failure before bootstrap, a bootstrap
launchd refused with the job absent, a job whose daemon exited before
answering, and a foreign endpoint all threw out of the launcher. The app then
lost its persistent daemon and fell back to local PTYs, where main forks one.
These now fall through to the existing fork path, which also adopts a foreign
occupant normally instead of as a degraded endpoint. A timed-out bootstrap or
a job still running/unreadable stays fatal, so no second daemon races it.
* feat(telemetry): split daemon origin events by stable-copy launch method
daemon_adopted, daemon_pty_cwd_denied and daemon_pty_cwd_readable gain a
closed-enum launch_method (stable-copy / app-fork / unknown), read from the
spawner path the daemon recorded, so the update fix is measurable per daemon
even when an old forked daemon is adopted across updates. The reliability
gate is a test manifest with no runtime switch, so there is no gate state to
report; spawner_path_class reports the private copy as 'other' alongside
other non-/Applications installs.
* refactor(telemetry): report the stable copy as a spawner path class
The separate launch_method property duplicated what the recorded spawner
path already says. spawner_path_class gains `stable-copy`, classified from
the same path under the private runtime root, and launch_method, its enum
and classifier are removed from all three .strict() daemon origin events.
A deleted copy still reports `missing`.
* refactor(settings): gate terminal-host Full Disk Access on macOS once
The permissions handler already asks for the terminal-host status only on
macOS, so the status function's own platform check and the pane's
'unsupported' branch could never fire. The off-macOS guarantee is now
tested at the handler.
* fix(macos): keep the fork fallback inside the startup PTY gate
The stable launch could run until 55 s after the launch started, so a late
"unavailable" verdict left the fork fallback's own 10 s readiness wait to
finish after the 60 s gate had already moved the app to local PTYs.
The launcher now gives the stable attempt one handoff deadline: the gate
minus the fork's readiness timeout and the 5 s lease/adapter allowance
(45 s). Copy, signature check and plist conversion share one abort signal
that ends early enough for bootstrap and the job's own readiness wait to
meet that deadline; every command otherwise keeps a fixed timeout. An
unavailable verdict past the deadline is reported instead of forking a
daemon that cannot arrive in time. The per-step budget module is gone (its
deletion landed in the previous commit by a staging slip).
The launch body is now two blocks: preparation (plist, plutil, deadline
check) fails as unavailable after removing the copy and job file, and
bootstrap runs in its own try/finally that always deletes the job file.
Retirement is simpler and claims more orphans: one in-flight collection per
process instead of a per-root map and rotating 20-record scan, and the job
record (written before copying) no longer carries a bundle name because
lsof +D scans the whole runtime directory (measured equal cost, same
result on a live copy). A never-submitted copy is retired once its producer
has exited and its job is missing, so a bootstrap timeout or a crash
mid-copy no longer leaves a copy forever; the open-file check still guards
deletion. Collection now starts from the launcher after the attempt.
* docs(macos): ship the daemon launch rules, not the investigation
The signed investigation harness left the tree in the previous telemetry
commit by a staging slip; its results and pinned link stay in the PR. This
trims the reference doc to why the copy and launchd exist, the fallback
states and the cleanup rule, trims the reliability gate to what its
validator needs, and points AGENTS.md at the reference doc next to the
Windows relocation entry.
* fix(macos): hand off to the fork as soon as the stable job exits
A copied daemon refused at exec (for example by Gatekeeper) never answers,
so every fresh start paid the full 10 s readiness wait before the fork
fallback. The readiness loop now reads the job state every 500 ms and
abandons as soon as the job is stopped or missing; a running or
unreadable job is still waited out and never forked beside.
Also drops the dead forkEntryPath the stable launch never read (its
options type now omits it) and un-exports the handoff constant.
* fix(macos): keep daemon copies out of Spotlight and unregister retired ones
Each runtime copy is a full Orca.app, so Spotlight indexed it as an app
and LaunchServices kept a record for it that outlived the copy. A
registered copy claims orca: links and Markdown/CSV files, and becomes
their default handler whenever /Applications/Orca.app is not registered.
New copies go under runtime-*/app.noindex/, which Spotlight skips and which
stops the record LaunchServices made while the bundle was being copied.
Retirement now runs lsregister -u on every bundle in the copy (both the
app.noindex layout and the earlier runtime-*/Orca.app layout) once lsof
shows it unused, then deletes it. A running copy stays registered,
because Local Network access may be resolved through that record.
Collection and stable-copy telemetry match the runtime-* directory, so
copies made before this change are still adopted, classified and retired.
* docs(macos): record the LaunchServices trade-off and the rollback plan
The reference doc now explains why copies sit in a .noindex folder, why
only retired copies are unregistered, and how to turn the copy launch off:
make launchMacDaemonFromStableBundle return null, and keep the retirement
code until no copy-launched daemon can remain, because the old code never
deletes copies.
A test pins that rollback: with the stable launcher returning null, the
launcher forks and still runs the copy collection.
* fix(macos): keep daemon copies registered so Local Network can resolve them
The `.noindex` folder kept copies out of Spotlight and LaunchServices, but
Local Network access is resolved from the signing identifier through
LaunchServices to the executable's Mach-O UUID. After an update that changes
Electron only the copy carries the running daemon's UUID, so an unregistered
copy risks the same Local Network loss main has today. Copies go back to
`runtime-*/Orca.app`; retirement still unregisters each copy before deleting
it, so deleted copies leave no LaunchServices entry. The remaining trade-off:
while `/Applications/Orca.app` is missing, a running registered copy can be
picked for `orca:` links and documents.
* fix(macos): hide daemon copies from Spotlight and tie the job to Orca
Spotlight listed each runtime copy as a second Orca app. New copies go
back under runtime-*/app.noindex/Orca.app, which Spotlight skips.
Retirement and stable-copy telemetry match the runtime-* directory, so
copies in the earlier runtime-*/Orca.app layout still retire and classify
the same way.
Local Network access identifies the daemon by its code signature and
main-executable UUID, not by a LaunchServices record, so an unregistered
copy keeps it. The launchd job now sets AssociatedBundleIdentifiers to
com.stablyai.orca, which is how a job not installed through SMAppService
names the app it belongs to. Copies are never registered explicitly;
retirement still runs lsregister -u before deleting each one.
* feat(macos): package a signed terminal host helper that runs the daemon on the pinned Node
Contents/Helpers/Orca Terminal Host.app carries the pinned Node, the daemon's
out/main JS and this slice's node-pty, signed inside-out as com.stablyai.orca.
afterPack boots it through one PTY round trip, then fails the build on layout,
Info.plist, macOS floor (NODE_RUNTIME_DARWIN_MINIMUM_OS vs Node's minos),
architecture or signature drift.
* ci(macos): cache and prefetch the pinned Node before packaging
Packaging now fetches the darwin Node from nodejs.org, whose download has no
retry. Each mac workflow caches it with the electron-builder downloads, keyed on
the pin, and warms both darwin targets inside the existing retry wrapper.
* feat(macos): launch the daemon from a copy of the terminal host helper, not the whole app
The stable launch now clones Contents/Helpers/Orca Terminal Host.app (~124 MiB
instead of ~628 MiB) and runs its Node on its daemon entry, without
ELECTRON_RUN_AS_NODE. The copy must still match the running app's designated
requirement. A missing helper falls back to the fork, and macOS below the
helper's Node floor forks without copying.
* docs(macos): describe the terminal host helper, its floor and its identity
* fix(macos): bound the terminal host boot check by its deadline and always clean up
A daemon that stayed silent hung packaging past the 20 s deadline; one that closed the
connection left the hello unsettled so Node exited 0 without cleanup; a malformed line threw
uncaught. Every connect, hello and PTY wait now races the deadline, close/error/parse failures
reject, and the daemon and scratch dir are removed on every path.
* ci(macos): cache the pinned Node on its own key with no restore-keys fallback
Sharing the electron-builder cache let old Node archives accumulate through restore-keys.
Also moves release-mac-build's Electron cache comment back onto its step.
* fix(macos): reject a universal slice for the terminal host and pin its name in one test
packageMacTerminalHost turned an unknown arch into darwin-undefined; it now throws through the
shared mac arch mapping. A test asserts the packager and the desktop agree on the helper bundle
and executable names, replacing a Linux/Windows test that could not fail.
* fix(macos): pass the launchd adoption lease its options object after the main merge
* test(macos): accept a reset as the daemon closing the boot-check connection; keep only passing gate commands
* fix(daemon): bump the terminal daemon protocol to v45 so new macOS tabs start in the terminal host helper
* fix(macos): ship the daemon's required packages in the terminal host and boot it outside the build tree
* style(macos): use a template literal in the terminal host resolution check
* fix(macos): derive the terminal host's packages from the daemon's own module graph
* fix(macos): treat any non-literal daemon load as computed, follow directory loads, and keep nested dependencies
* refactor(macos): move terminal-host telemetry, Settings status and Helper folder strings to a follow-up
Keeps this change to the update-safe terminal host itself. The follow-up restores:
- the `stable-copy` spawner path class in daemon adoption telemetry;
- the per-terminal-host Full Disk Access row in Settings and its daemon RPC;
- writing folder usage descriptions into the app's Electron Helpers for the fork fallback.
The helper still takes its Desktop, Documents and Downloads descriptions from
`macos-folder-usage-descriptions.cjs`, so that constant stays.
* feat(macos): report terminal-host Full Disk Access, classify stable-copy daemons, and give Helpers folder strings
Restores what a32018836b moved out of the terminal host change:
- daemon adoption telemetry classifies a daemon spawned from the private copy as `stable-copy`;
- Settings shows the terminal hosts' own Full Disk Access verdict beside the app's, through a
new `fullDiskAccessStatus` daemon request that older daemons answer as unknown;
- packaging writes the Desktop, Documents and Downloads descriptions into the app's Helper
bundles, which still host terminals when the fork fallback runs.
* fix(i18n): restore en.json to this branch's base, not newer main
The previous commit took the file from a newer main, which pulled unrelated strings into this PR.
* refactor(macos): publish one terminal-host copy per helper build under a fixed launchd label
Name the copy after the helper's CDHash, reuse it when present, and
publish a new one by cloning into a staging dir, verifying it once
against the app's designated requirement and renaming it into place.
One launchd label per profile and protocol replaces per-launch labels,
so job.json, producer pids and per-label collection go away. Retirement
deletes any other copy lsof shows unused. The stable launcher returns
null for every fork fallback and logs its reason.
* fix(packaging): copy terminal-host dependencies from where Node resolves them
A nested package's own dependencies were never walked, so a hoisted
dependency of a nested package was left out of the helper. Resolve each
dependency through the node_modules lookup Node performs from its parent
and copy it to the same relative place, unless a copied package already
carries it.
* fix(packaging): fail release and CI mac builds that cannot boot a terminal-host slice
An arm64 runner without Rosetta skipped the x64 helper's PTY boot check
and shipped the slice untested. Release channels and CI now fail there;
local cross-arch builds still skip with a log line.
* docs(macos): describe the per-build terminal-host copy and its fallback reasons
* docs(macos): keep the codesign command on one line
* test(macos): type the launchd test state without an assertion
* docs(macos): name what the login-session flag gates in the stable launcher
* fix(macos): wait for launchd to drop a booted-out terminal job before reusing its label
* refactor(daemon): keep the health request types in their own module
types.ts hit the line limit once the Full Disk Access status request joined the union.
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(mobile): open Grok, OpenCode, OMP and Pi chats on the phone
The phone advertised only the Claude chat lane, so the host retitled every
other agent's chat tab 'Update to view' and the phone's resolver refused
non-Claude/Codex chat tabs anyway. Mobile now reads any agent the host
lists, passes the chat's real agent to its send and slash-command paths,
advertises the registered-agents and Pi dialog capabilities, hides image
attach for agents the host says take none (as desktop does), and draws
Pi's input dialog as one line.
* test(mobile): drive the agents read through the shared fake client
* fix(mobile): read options reports with no model
Grok, OpenCode and OMP can report no current model, and a chat at rest may
have none saved. The host refuses those reports to clients that don't
advertise agent-session.options.optional-model.v1, which left the phone's
model picker on its seed list and dropped /clear and /compact.
* fix(mobile): reserve the chat session for every launched agent
The phone matches a launched chat tab only by its session id, which it
minted only for Claude and Codex. A Grok, OpenCode, OMP or Pi chat started
from + landed only once the host replied, and a lost reply read as
"Couldn't confirm the agent started" even with the chat listed. Hosts
accept an agent-named id for any agent and ignore it for a terminal launch.
* fix(mobile): read the host's agents once per connection, retry after a failure
Every session-screen mount asked agentSession.agents again, so the attach
button popped in late for OpenCode and Pi, and a read that failed while
connected was never retried. Share one read per client, drop it on
disconnect, and forget a failed read so the next chat asks again.
* test(mobile): pin the chat's own agent on the send path and attach gating
The send-bridge test passed with the claude/codex narrowing reverted. Drive
an OpenCode chat through the controller and the structured session's send,
where /review is the agent's own command but Codex's host claims it, and
check the overlay offers attach only when the agent takes images.
* fix(mobile): offer a card's X only while a turn is running
The X on a structured prompt card stops its turn. Pi opens dialogs outside
a turn too, and tapping X there could only say "Stop not sent". Claude and
Codex cards arrive inside a running turn, so they keep their X.
* fix(runtime): let a phone read the host's registered agents
The phone now asks agentSession.agents to decide whether a chat's agent
takes images, but the mobile allowlist refused the method, so OpenCode and
Pi never got an attach button. It returns only each agent's id and its
fixed capability record.
* fix(mobile): keep a host's refusal of the agents list for the connection
Released hosts advertise registered agents but refuse agentSession.agents
to phones (forbidden, not available to mobile clients). Treat that answer
as no list until the next connection instead of re-asking on every chat;
keep retrying transient failures.
* fix(mobile): shrink the model pill before it pushes Send off the composer row
On a narrow phone, attach + a long model label + mic left no room for Send
(seen with Pi's resting label). The pill's slot is now the row's only
shrinkable item, so its label truncates and the buttons keep their size.
Rows that already fit look the same.
* fix(mobile): keep /clear and /compact for a chat whose agent lists no models
The phone dropped a structured chat's option controller when its picker had
nothing to show, and the / menu reads the chat's conversation commands from
that controller. OMP lists no models, so its menu lost /clear and /compact.
Keep the controller for every structured chat; the picker still renders
nothing without a model.
* feat(runtime): say in a chat's options report whether it takes images
The host's options read now carries acceptsImages for every session: the
agent definition's imagePrompts, narrowed by a running ACP child to what
its initialize advertised (the same rule its sends use). Absent means an
older host.
* refactor(mobile): read whether a chat takes images from its options report
The phone no longer reads the host's agent list for the attach button. It
takes acceptsImages from the agentSession.options read it already makes,
keyed to the chat, and kept through a pick made during that read. Before
the read answers, and from an older host, Claude and Codex keep attach and
other agents don't, as before. Drops the agent-list hook with its cache and
refusal latch, the host-support flag only it used, and agentSession.agents
from the host's mobile allowlist.
* refactor(native-chat): gate desktop chat images on the session's options report
The composer's image gate takes the session's acceptsImages answer first,
falling back to the host's agent list before the options read lands (a
new chat's start) and for an older host that sends no answer. With the
phone no longer using it, structuredAgentAcceptsImages moves back to the
renderer, where it was.
* test(native-chat): prove the session's image answer reaches the composer gate
* refactor(layout): add the per-view store, pane status and runtime leaf-record projection (unused)
Pure pieces the layout holder will use, with no caller yet:
- per-view records keyed by view id (desktop, device:<id>), read-time
fallback for removed tabs and panes, save-time prune and workspace removal;
- pane status derived from the start token, last outcome, sleeping record,
PTY registry and host reachability;
- the runtime's tab and leaf records projected from the layout model and the
PTY registry in the graph mirror's shape, checked against records captured
from today's mirror.
* fix(layout): follow today's close selection, title resets and lost-host status in P6
- A close moves each view's shown tab when applied, with the pre-close
order: most recent remaining, else the closed tab's neighbour, through
the headless close's pickNextActiveTabAfterClose (now exported).
- The projection's pane title is the newer of the PTY's OSC title and the
neutral reset the window applies after an agent exits or is interrupted;
those reset rules move to shared/terminal-pane-title-reset.ts and the
renderer uses them unchanged.
- A leaf is connected, as in the mirror, unless the host proved an exit,
but only when the PTY registry holds the terminal.
- An unbound pane on a lost host is waiting_for_host.
- The mirror capture covers a title reset, a lost host and an unregistered
PTY, and names each difference from the mirror.
* fix(layout): an emptied group hands a view's active group to its split sibling, as collapseGroupLayout does
* refactor(remote): one paired E2EE handshake core for desktop, CLI, web and mobile clients
Every paired client now builds its hello, checks the host's ready, seals its
auth frame and opens host frames through src/shared/paired-e2ee-client-handshake.
Platforms inject their own NaCl/base64 primitives. The v2 client session and its
pure-JS key schedule (@noble/hashes 1.8.0, the version mobile pins) move to
src/shared, and the per-host v2 latch policy is shared with an injected store.
No wire change: frames match the captured legacy and v2 fixtures byte for byte,
and a cross-version test drives the core against the released host and the
released client against this host. The auth step is now async so a device-key
signer can slot in later.
* fix(remote): keep @noble/hashes out of the CLI's unbundled runtime
The packaged CLI loads src/shared output from disk, so a bare @noble/hashes
import failed the packaged-runtime check. The v2 key schedule is now a
primitive: Node clients use the node:crypto schedule (moved to src/shared so
the CLI can reach it), while the browser and phone keep the pure-JS one.
* fix(mobile): re-check the v2 latch before sending a legacy auth frame
The auth step is async, so another socket can latch the host to v2 while a
legacy auth frame is being sealed. Refuse it at send time, as before.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* refactor(pty): drop SSH spawn, liveness and kill branches
* test(pty): drive the commit-durability tests through local PTYs only
* test(pty): drop the SSH host arm from the exit-durability fixture
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(macos): preserve terminal privacy identity across app updates
* test(macos): make launchd fixtures portable across host platforms
* fix(macos): probe protected contents and close handles on denial
* fix(i18n): register terminal permission status labels
* fix(macos): fork the daemon when no stable-bundle job can claim the endpoint
A copy, signature, plist or deadline failure before bootstrap, a bootstrap
launchd refused with the job absent, a job whose daemon exited before
answering, and a foreign endpoint all threw out of the launcher. The app then
lost its persistent daemon and fell back to local PTYs, where main forks one.
These now fall through to the existing fork path, which also adopts a foreign
occupant normally instead of as a degraded endpoint. A timed-out bootstrap or
a job still running/unreadable stays fatal, so no second daemon races it.
* feat(telemetry): split daemon origin events by stable-copy launch method
daemon_adopted, daemon_pty_cwd_denied and daemon_pty_cwd_readable gain a
closed-enum launch_method (stable-copy / app-fork / unknown), read from the
spawner path the daemon recorded, so the update fix is measurable per daemon
even when an old forked daemon is adopted across updates. The reliability
gate is a test manifest with no runtime switch, so there is no gate state to
report; spawner_path_class reports the private copy as 'other' alongside
other non-/Applications installs.
* refactor(telemetry): report the stable copy as a spawner path class
The separate launch_method property duplicated what the recorded spawner
path already says. spawner_path_class gains `stable-copy`, classified from
the same path under the private runtime root, and launch_method, its enum
and classifier are removed from all three .strict() daemon origin events.
A deleted copy still reports `missing`.
* refactor(settings): gate terminal-host Full Disk Access on macOS once
The permissions handler already asks for the terminal-host status only on
macOS, so the status function's own platform check and the pane's
'unsupported' branch could never fire. The off-macOS guarantee is now
tested at the handler.
* fix(macos): keep the fork fallback inside the startup PTY gate
The stable launch could run until 55 s after the launch started, so a late
"unavailable" verdict left the fork fallback's own 10 s readiness wait to
finish after the 60 s gate had already moved the app to local PTYs.
The launcher now gives the stable attempt one handoff deadline: the gate
minus the fork's readiness timeout and the 5 s lease/adapter allowance
(45 s). Copy, signature check and plist conversion share one abort signal
that ends early enough for bootstrap and the job's own readiness wait to
meet that deadline; every command otherwise keeps a fixed timeout. An
unavailable verdict past the deadline is reported instead of forking a
daemon that cannot arrive in time. The per-step budget module is gone (its
deletion landed in the previous commit by a staging slip).
The launch body is now two blocks: preparation (plist, plutil, deadline
check) fails as unavailable after removing the copy and job file, and
bootstrap runs in its own try/finally that always deletes the job file.
Retirement is simpler and claims more orphans: one in-flight collection per
process instead of a per-root map and rotating 20-record scan, and the job
record (written before copying) no longer carries a bundle name because
lsof +D scans the whole runtime directory (measured equal cost, same
result on a live copy). A never-submitted copy is retired once its producer
has exited and its job is missing, so a bootstrap timeout or a crash
mid-copy no longer leaves a copy forever; the open-file check still guards
deletion. Collection now starts from the launcher after the attempt.
* docs(macos): ship the daemon launch rules, not the investigation
The signed investigation harness left the tree in the previous telemetry
commit by a staging slip; its results and pinned link stay in the PR. This
trims the reference doc to why the copy and launchd exist, the fallback
states and the cleanup rule, trims the reliability gate to what its
validator needs, and points AGENTS.md at the reference doc next to the
Windows relocation entry.
* fix(macos): hand off to the fork as soon as the stable job exits
A copied daemon refused at exec (for example by Gatekeeper) never answers,
so every fresh start paid the full 10 s readiness wait before the fork
fallback. The readiness loop now reads the job state every 500 ms and
abandons as soon as the job is stopped or missing; a running or
unreadable job is still waited out and never forked beside.
Also drops the dead forkEntryPath the stable launch never read (its
options type now omits it) and un-exports the handoff constant.
* fix(macos): keep daemon copies out of Spotlight and unregister retired ones
Each runtime copy is a full Orca.app, so Spotlight indexed it as an app
and LaunchServices kept a record for it that outlived the copy. A
registered copy claims orca: links and Markdown/CSV files, and becomes
their default handler whenever /Applications/Orca.app is not registered.
New copies go under runtime-*/app.noindex/, which Spotlight skips and which
stops the record LaunchServices made while the bundle was being copied.
Retirement now runs lsregister -u on every bundle in the copy (both the
app.noindex layout and the earlier runtime-*/Orca.app layout) once lsof
shows it unused, then deletes it. A running copy stays registered,
because Local Network access may be resolved through that record.
Collection and stable-copy telemetry match the runtime-* directory, so
copies made before this change are still adopted, classified and retired.
* docs(macos): record the LaunchServices trade-off and the rollback plan
The reference doc now explains why copies sit in a .noindex folder, why
only retired copies are unregistered, and how to turn the copy launch off:
make launchMacDaemonFromStableBundle return null, and keep the retirement
code until no copy-launched daemon can remain, because the old code never
deletes copies.
A test pins that rollback: with the stable launcher returning null, the
launcher forks and still runs the copy collection.
* fix(macos): keep daemon copies registered so Local Network can resolve them
The `.noindex` folder kept copies out of Spotlight and LaunchServices, but
Local Network access is resolved from the signing identifier through
LaunchServices to the executable's Mach-O UUID. After an update that changes
Electron only the copy carries the running daemon's UUID, so an unregistered
copy risks the same Local Network loss main has today. Copies go back to
`runtime-*/Orca.app`; retirement still unregisters each copy before deleting
it, so deleted copies leave no LaunchServices entry. The remaining trade-off:
while `/Applications/Orca.app` is missing, a running registered copy can be
picked for `orca:` links and documents.
* fix(macos): hide daemon copies from Spotlight and tie the job to Orca
Spotlight listed each runtime copy as a second Orca app. New copies go
back under runtime-*/app.noindex/Orca.app, which Spotlight skips.
Retirement and stable-copy telemetry match the runtime-* directory, so
copies in the earlier runtime-*/Orca.app layout still retire and classify
the same way.
Local Network access identifies the daemon by its code signature and
main-executable UUID, not by a LaunchServices record, so an unregistered
copy keeps it. The launchd job now sets AssociatedBundleIdentifiers to
com.stablyai.orca, which is how a job not installed through SMAppService
names the app it belongs to. Copies are never registered explicitly;
retirement still runs lsregister -u before deleting each one.
* feat(macos): package a signed terminal host helper that runs the daemon on the pinned Node
Contents/Helpers/Orca Terminal Host.app carries the pinned Node, the daemon's
out/main JS and this slice's node-pty, signed inside-out as com.stablyai.orca.
afterPack boots it through one PTY round trip, then fails the build on layout,
Info.plist, macOS floor (NODE_RUNTIME_DARWIN_MINIMUM_OS vs Node's minos),
architecture or signature drift.
* ci(macos): cache and prefetch the pinned Node before packaging
Packaging now fetches the darwin Node from nodejs.org, whose download has no
retry. Each mac workflow caches it with the electron-builder downloads, keyed on
the pin, and warms both darwin targets inside the existing retry wrapper.
* feat(macos): launch the daemon from a copy of the terminal host helper, not the whole app
The stable launch now clones Contents/Helpers/Orca Terminal Host.app (~124 MiB
instead of ~628 MiB) and runs its Node on its daemon entry, without
ELECTRON_RUN_AS_NODE. The copy must still match the running app's designated
requirement. A missing helper falls back to the fork, and macOS below the
helper's Node floor forks without copying.
* docs(macos): describe the terminal host helper, its floor and its identity
* fix(macos): bound the terminal host boot check by its deadline and always clean up
A daemon that stayed silent hung packaging past the 20 s deadline; one that closed the
connection left the hello unsettled so Node exited 0 without cleanup; a malformed line threw
uncaught. Every connect, hello and PTY wait now races the deadline, close/error/parse failures
reject, and the daemon and scratch dir are removed on every path.
* ci(macos): cache the pinned Node on its own key with no restore-keys fallback
Sharing the electron-builder cache let old Node archives accumulate through restore-keys.
Also moves release-mac-build's Electron cache comment back onto its step.
* fix(macos): reject a universal slice for the terminal host and pin its name in one test
packageMacTerminalHost turned an unknown arch into darwin-undefined; it now throws through the
shared mac arch mapping. A test asserts the packager and the desktop agree on the helper bundle
and executable names, replacing a Linux/Windows test that could not fail.
* fix(macos): pass the launchd adoption lease its options object after the main merge
* test(macos): accept a reset as the daemon closing the boot-check connection; keep only passing gate commands
* fix(daemon): bump the terminal daemon protocol to v45 so new macOS tabs start in the terminal host helper
* fix(macos): ship the daemon's required packages in the terminal host and boot it outside the build tree
* style(macos): use a template literal in the terminal host resolution check
* fix(macos): derive the terminal host's packages from the daemon's own module graph
* fix(macos): treat any non-literal daemon load as computed, follow directory loads, and keep nested dependencies
* refactor(macos): move terminal-host telemetry, Settings status and Helper folder strings to a follow-up
Keeps this change to the update-safe terminal host itself. The follow-up restores:
- the `stable-copy` spawner path class in daemon adoption telemetry;
- the per-terminal-host Full Disk Access row in Settings and its daemon RPC;
- writing folder usage descriptions into the app's Electron Helpers for the fork fallback.
The helper still takes its Desktop, Documents and Downloads descriptions from
`macos-folder-usage-descriptions.cjs`, so that constant stays.
* fix(i18n): restore en.json to this branch's base, not newer main
The previous commit took the file from a newer main, which pulled unrelated strings into this PR.
* refactor(macos): publish one terminal-host copy per helper build under a fixed launchd label
Name the copy after the helper's CDHash, reuse it when present, and
publish a new one by cloning into a staging dir, verifying it once
against the app's designated requirement and renaming it into place.
One launchd label per profile and protocol replaces per-launch labels,
so job.json, producer pids and per-label collection go away. Retirement
deletes any other copy lsof shows unused. The stable launcher returns
null for every fork fallback and logs its reason.
* fix(packaging): copy terminal-host dependencies from where Node resolves them
A nested package's own dependencies were never walked, so a hoisted
dependency of a nested package was left out of the helper. Resolve each
dependency through the node_modules lookup Node performs from its parent
and copy it to the same relative place, unless a copied package already
carries it.
* fix(packaging): fail release and CI mac builds that cannot boot a terminal-host slice
An arm64 runner without Rosetta skipped the x64 helper's PTY boot check
and shipped the slice untested. Release channels and CI now fail there;
local cross-arch builds still skip with a log line.
* docs(macos): describe the per-build terminal-host copy and its fallback reasons
* docs(macos): keep the codesign command on one line
* test(macos): type the launchd test state without an assertion
* docs(macos): name what the login-session flag gates in the stable launcher
* fix(macos): wait for launchd to drop a booted-out terminal job before reusing its label
---------
Co-authored-by: Neil <neil@stably.ai>
* refactor(ipc): worktree handlers are local or runtime only
* refactor(runtime): explain the route witness on removal listing
* test(runtime): pin the SSH create refusal and drop the deleted branch's reliability gap
* test(runtime): drop a needless cast in the SSH create refusal test
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(native-chat): a new chat's effort pill keeps its first-frame value before the agent starts
A chat with no model pick runs the catalog's default model at that model's
default effort. The at-rest options answer now says so for every agent, not
only those whose live child reports the model's default, so the effort pill
no longer blanks and then jumps when the agent starts.
* fix(native-chat): read a chat's at-rest options for the folder it runs in
The at-rest options read asked the model catalog with no workspace, so it
always named the account's default model and effort, even in a repo whose
own agent config could pick another. The new chat's first frame, read for
that repo, names nothing there. The at-rest read now asks for the session's
own folder, so both frames agree on the model and the effort.
* fix(native-chat): scope the at-rest options read only for clients that take no model
A client that needs a model in every options answer (mobile today, older
desktops) refuses an answer naming none, and loses that read's commands with
it. Only a client advertising the optional-model capability gets the answer
for the chat's own folder; any other keeps today's account-default answer.
* test: run the at-rest workspace-scope RPC test in the Node SQLite project
* test: build catalog listings so the fixtures compile before and after main drops the tier map
* fix(native-chat): one at-rest rule — the chat's folder decides its default for every client
The folder-scoped catalog read now decides the default for every client. Where
it names one, the answer names that model and its effort. Where it names none,
a client that takes a model-less answer gets none, and one that needs a model
gets the account default model with no effort: exactly what it got before.
The reader is now required, and the first frame and the at-rest read share one
rule for which locations name a local folder.
* fix(native-chat): keep test callers of the host's options read untouched
Only in-process callers omit the reader at the host's entry, and they read
as the RPC gate treats an in-process caller. The shared read itself still
requires one. This leaves main's newer test call sites unconflicted.
* refactor: one native-local location check for Claude, Codex and the at-rest folder read
Nothing in production feeds the SSH PTY output intake: its only data and exit
entry points were called from tests, and the SSH PTY provider that would have
fed it is gone. Delete the intake, its source-obligation ledger, model
admission, projection publication and source-ack plumbing, and strip the
projection ids and source-credit bookkeeping they threaded through the local
renderer delivery path (accept, pending, flush, payload, accounting, exit,
session). Local terminal delivery is unchanged.
Because the intake also installed the runtime's remote source-range hooks,
this desktop host now answers a terminal.subscribe that asks for
ackOutputSourceRanges the way every orcad host already does: without the
capability, so the client uses the byte-window ACK. No source ranges were
ever attached to local output.
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(mobile): verified https pairing links; custom scheme carries no secret
The desktop's copy-link now emits https://www.onorca.dev/pair#<code>, with the
code only in the fragment. Orca Mobile claims that link as a verified app link
and refuses any pairing code delivered through orca://, which any app can claim;
orca://pair alone opens the scanner with an explanation. In-app QR scan and
paste still accept the custom scheme, so older desktops and phones keep pairing.
The confirm screen shows the desktop address and host key fingerprint before
pairing. config/verified-links/ holds the apple-app-site-association,
assetlinks.json and fallback page to deploy on www.onorca.dev, with a test that
keeps them, mobile/app.config.js and the link builder in agreement.
Part of #17397.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): refuse pairing codes nested in or normalized out of unverified links
The router unwraps expo-development-client ?url= links and normalizes dot
segments after +native-intent runs, so an orca:// wrapper could still deliver a
code to the confirm screen. Refuse any unverified link carrying code= at any
encoding depth, and match pairing routes on decoded, dot-free segments.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): escape the apostrophe in the refused-link notice
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): decode escapes byte by byte before refusing nested pairing codes
An invalid UTF-8 escape made the whole escape run fail to decode, hiding an
adjacent encoded &code= that the router still decodes leniently.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): decode nested pairing links to any depth before refusing codes
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): ignore URL-stripped whitespace when refusing nested pairing codes
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(mobile): decide pairing-link refusal on the router's own parse
Stop re-implementing URL decoding. The guard now runs expo-router's own
extractExpoPathFromURL and parseUrlUsingCustomBase, the functions its linking
applies after +native-intent, and refuses any link from which the router would
read a `code` param or reach a pairing route with a payload. A link the router
cannot parse is refused. Release builds refuse expo-development-client
wrappers outright. A property-style test walks wrapping depths, encoding
layers, stripped control characters, case and unicode, and asserts that the
guard never passes on a link from which the router would read a code.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(mobile): match pairing routes on the top-level segment only
A host link with a segment named pair was sent to the scanner.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(mobile): pin line-terminator fragment links as refused
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude <noreply@anthropic.com>
* refactor(main): agent detection, automations, AI vault and ephemeral VM drop SSH provider arms
* refactor(skills): refuse SSH skill destinations at the branch and delete the relay skill services
* test(preflight): clear the local-detection mock before the SSH refusal cases
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* refactor(pty): delete the SSH PTY provider and its registry slot
Nothing in production registers an SSH PTY provider, so the registry's SSH
map was always empty: every SSH lookup answered undefined or threw the
'No PTY provider for connection' error. Delete the provider stack, its
consumer-session and source-recovery contracts, the registry maps and the
getSshProvider dependency, keeping each caller's existing result for an
absent provider. The registry now dispatches only 'local'; any other host
throws PtyHostNotDispatchableError, which keeps the renderer-matched
message for SSH ids and is never read as a gone or exited PTY.
* test(pty): keep the no-provider SSH routing cases in local-only form
* test: reword a comment naming the deleted SSH PTY provider
* test: drop an import the rebase left unused
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(daemon): keep the host's own record of refused legacy restores
* feat(daemon): the host keeps its own record of old-client restores it refuses
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(runtime): device-key authentication and per-installation key migration (host)
* fix(runtime): corrupt registry is never a revocation verdict; keyed sockets dispatch without a token; forks keep their Relay binding
* fix(runtime): keep an unparseable device registry aside; an unlisted key is never 'revoked' while it exists
* fix(runtime): a set-aside corrupt registry keeps verdicts doubtful even when the registry file is missing
* test(runtime): registerDeviceKey reaches the bound socket through the dispatcher for runtime and mobile rows
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* refactor(daemon): keep the gate's host share in its own module
* test(daemon): pin that an observing desktop's restores count against serve's budget
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Fold the streaming dispatcher, the unary invocation helper and two
single-importer helpers into dispatcher.ts so request/response and
streaming-unary share one unary path. No behaviour change.
Co-authored-by: m4air <m4air@Mac.localdomain>
* refactor(runtime): paired sockets authenticate to a device principal
* chore: format and comment touch-ups
* test(mobile): give the launch-authority socket fixture its principal
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(daemon): cap terminals per execution host
* fix(daemon): never let a ledger cleanup throw into a spawn
* fix(daemon): recreate the host terminal ledger dir after a /tmp cleaner
* test(daemon): drop a default-parameter case from the ledger dir test
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(serve): let the owner resume paused automatic restores
The terminal daemon now answers automaticWorkStatus and
resumeAutomaticWork. Resume clears a recorded same-boot crash pause or
a pressure pause, writes the cleared state durably, and wakes restores
that were waiting. The runtime exposes runtime.automaticWork.status and
runtime.automaticWork.resume (host-admin; advertised as
runtime.automatic-work.v1), the CLI adds 'orca serve restore resume',
and a sleeping pane paused by its host offers 'Resume automatic
restores'. A daemon that predates the requests reports no gate.
* fix(serve): a stale daemon cannot resume, and an old one says so
Resume now re-reads endpoint ownership right before it runs, so a
daemon replaced by a successor cannot rewrite the successor's run
marker. A gate-bearing daemon from before resume existed is reported as
'terminal host predates resume' instead of 'no gate'; the CLI says to
run the command again after the terminal host restarts, and a sleeping
pane still resumes when the user asks for it.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
The terminal gate's relay lister always resolved to null in production (no SSH PTY
provider is ever registered), so its relay and previous-relay branches, the legacy
relay route/router/routing, the previous-relay census and the once-connected
re-check could never run. The gate now takes only the host census; census-only
verdicts are pinned by a characterization test written before the change.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude <noreply@anthropic.com>
On macOS a second Electron main aborts inside _RegisterApplication
before any Orca JavaScript can apply the one-Orca-per-profile rule, so
supervisors and agents retrying 'orca serve' loop on SIGABRT (#14541).
The CLI now checks the profile before it execs Electron serve. A runtime
that answers, or whose socket accepts, is live; one whose socket neither
accepts nor refuses, or that refuses this CLI's credentials, is
unverifiable; both refuse with exit code 3, the single-instance code
systemd units already key off. Only a definitive refusal (ENOENT or
ECONNREFUSED) lets it start. A fresh profile keeps the old synchronous
launch. A macOS startup abort is remembered per environment, so a later
separate 'orca serve' from the same launchd session refuses for 30
minutes with exit 78 instead of aborting again; --force overrides, and
a serve that reaches readiness clears it.
Adapted from #14768; the Launch Services diagnostic wording and the
exit code 3 contract come from #14542.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: thiagomsoares <5190162+thiagomsoares@users.noreply.github.com>
* fix(updater): let supervised macOS serve installs stage Squirrel during install
Supervised `orca serve` keeps autoInstallOnAppQuit off, so electron-updater's
MacUpdater hands the download to Squirrel.Mac only inside quitAndInstall. The
updater, however, held the status at "downloading 100%" and gated quitAndInstall
on Squirrel having already staged the bundle. Neither could happen first, so
every macOS serve update stalled at macos_waiting_for_squirrel, remote installs
failed with remote_update_not_downloaded, and a local install request timed out
and quit without installing.
In supervised serve mode, report the download as installable and let the install
proceed to the handoff and native quitAndInstall. The install commits and arms
the exit watchdog when Squirrel signals it has staged the bundle; a staging
failure still recovers through the existing pre-commit error path.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(updater): hold destructive install prep until Squirrel stages the serve bundle
The supervised macOS install now calls electron-updater's quitAndInstall before
Squirrel has staged anything, and that staging completes asynchronously. Three
consequences needed handling:
- PTY cleanup and close-listener removal ran before staging, so a Squirrel
failure recovered the server with its in-process sessions already killed.
They now run when Squirrel reports the bundle staged, together with the
commit and exit watchdog.
- Any updater 'error' during staging (for example a background check) failed
the handoff while MacUpdater's pending listener would still quit and install.
While staging is awaited, only Squirrel's native error ends it.
- Nothing bounded a Squirrel that never answers. After two minutes the install
recovers through the existing pre-commit failure path and the server keeps
serving.
isMacStagingDeferredToInstall is now darwin-only, so Linux supervised installs
keep their immediate commit.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(updater): report a slow Squirrel staging instead of abandoning the install
Recovering the install on the staging timeout reset Orca's state and failed the
supervisor handoff, but electron-updater's MacUpdater keeps its own completion
listener. A Squirrel that finished after the timeout still quit the app and
installed, now with a failed handoff, so the supervisor skipped the replacement
spawn.
The timeout now only reports a non-retryable error status and records the slow
staging; the handoff and in-flight install stay live so a late staging commits
and relaunches normally.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(updater): commit a staged serve install before its session cleanup
Squirrel's update-downloaded listeners run in registration order, and Orca's
runs before the one MacUpdater adds to quit the app. The staged-install commit
ran PTY cleanup first, so a throwing cleanup callback skipped the commit, the
exit watchdog, and MacUpdater's quit, leaving the install stuck in progress.
Commit and arm the watchdog first, then run cleanup under the same
post_commit_cleanup_failed handling performQuitAndInstall already uses.
The tests now register MacUpdater's persistent quit listener per unstaged
install, so a retried install is followed through completion.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test(updater): pin the MacUpdater staging behavior supervised serve installs rely on
The supervised macOS serve install assumes electron-updater's MacUpdater starts
Squirrel staging only inside quitAndInstall when autoInstallOnAppQuit is off,
and quits the app once staged when autoRunAppAfterInstall is off. Every updater
suite mocks electron-updater, so run the installed MacUpdater methods directly;
an upgrade that changed either behavior now fails here instead of silently
restoring the deadlock.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test(updater): adapt the serve staging tests to current main
Main's macOS quit-guard test predates the staging callbacks this change
adds, so it now passes them, and the new install test builds its window
without a type assertion.
Co-authored-by: jbamlee <dev.jbam@gmail.com>
---------
Co-authored-by: jbamlee <dev.jbam@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(serve): keep the isolated profile off the login keychain
The E2E/pairing runtime hands the app a fresh HOME, so there is no login
keychain for OSCrypt to read. On the serve path the secret-protection report
runs inline before readiness and probes safeStorage on the main thread, where
Chromium's keychain lookup creates the item and waits on an authorization
reply that never arrives, so `orca serve` never advertises (#25453).
The sidecar already launches with --use-mock-keychain for exactly this
profile; share that decision and give the foreground serve process the same
switches.
* test(serve): read spawn args without type assertions
Co-authored-by: Paolo <paovalletta@hotmail.it>
* fix(serve): only an isolated userData profile drops the keychain
The sidecar always runs on a fresh profile, so either E2E variable is
enough there. The foreground serve process opens the selected profile's
sealed secrets, and a HOME override alone still selects the user's real
profile, so it now needs ORCA_E2E_USER_DATA_DIR.
Co-authored-by: Paolo <paovalletta@hotmail.it>
---------
Co-authored-by: Paolo <paovalletta@hotmail.it>
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(sidebar): stop a removed folder workspace from leaving a blank row
A folder-project workspace exists only as its worktreeMeta row. When it is
deleted while a terminal is still bound, the renderer keeps the row until its
teardown runs, and a PTY reattach in that window stamps lastActivityAt through
worktrees:updateMeta. setWorktreeMeta then minted a default row with an empty
name, which the sidebar listed under the project name and which came back after
every delete. The metadata IPC now refuses to create a row for a folder
workspace instance that no longer exists.
Fixes#22712
Claude-Session: https://claude.ai/code/session_01XZXEdbC4RKp288k2gBzLUW
* fix(sidebar): also refuse runtime writes to a removed folder workspace
Move the existence check into a shared predicate that matches any same-id
folder owner, so an owner at a different path on another host cannot bypass
it, and apply it to the runtime's worktree.set path, where a resolution
snapshot taken before the removal still returns the workspace.
Claude-Session: https://claude.ai/code/session_01XZXEdbC4RKp288k2gBzLUW
* test: type the removed-folder-workspace fixture meta for the anti-slop lint
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(runtime): accept a declared spawn intent from paired clients
Paired clients can now say whether a terminal restore is the pane the
user is looking at (user-resume) or a hidden one (automatic-restore).
The host forwards the intent to its fork gate, advertises
terminal.spawn-intent.v1 so clients only send it to hosts that accept
it (terminal.ensureAgentSession params are strict), and reports a
deferred fork as terminal_spawn_deferred with its reason.
No client sends the field yet; that lands next with the sleeping-pane
handling.
* fix(daemon): a claimed agent resume cannot declare itself interactive
Interactive forks skip the gate, and paired clients can now declare
intent, so the host keeps inferring from the claim when a request
says interactive.
* fix(runtime): clients may only declare restore intents
A daemon kept running across an update still lets a declared
interactive request skip its gate, even for a claimed resume. The RPC
and local IPC now accept only user-resume and automatic-restore, and
the daemon request boundary turns a claimed interactive into an
automatic restore.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
orcad now checks its flags with the same validator Electron serve and the
CLI use, so contradictory pairing flags fail with the same message instead
of one silently winning. The CLI launcher drops its duplicate recipe check
(the CLI handler already ran the shared validator).
Removes the daemon-init and cli/runtime/index re-export barrels and the
parsePtySessionId / OrcadInstanceLockError re-exports; callers and mocks
import the defining modules.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(runtime): reuse cached worktree rows when the admin probe cannot answer
* test(runtime): wait for the fingerprint probe to settle instead of a fixed delay
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Brennan Benson
Neil
OrcaWinandm4air
Jinwoo Hong
BingZandm4air
