Prepare requested immutable historical snapshots before timed extraction and direct reads, using the existing acquisition/process helpers and local-only consumers. Move four suites' historical module setup into per-pin hooks without changing pins, compatibility assertions, workers, extraction/assertion deadlines or publication ownership.
Independent reviews and the binding design settlement passed. The cold comparison and normal uninstrumented final-head CI each passed49files197tests; normal Checkout62s/job276s. All temporary probes removed; brennan-ready READY.
Tracked in STA-13683. Outer-hook failure attribution limitation tracked in STA-13703. No application, saved-data or wire behavior change.
* refactor(mobile): keep phone list facts beside the desktop's worktree row
The phone wrote its own list facts (lineage depth, host labels, list keys
and so on) onto the worktree.ps row object it got from the desktop, so a
desktop field with one of those names would be read as the phone's own.
List items are now { row, view }: the row is the desktop's, typed from the
shared RuntimeWorktreePsSummary contract, and view holds what the phone
works out. Host labels are a lookup beside the rows instead of fields on
them. A type test fails if the desktop row gains a view field's name or a
type the phone row would not accept, and a contract test feeds rows from
the desktop's own worktree.ps builder through the phone list.
* fix(mobile): type desktop replies from shared contracts and reject unchecked rows (#37923)
* wip: contract guards
* fix(mobile): type desktop replies from the shared contracts and ban unchecked z.custom
Session tabs, the createSupport reply and native-chat frames were typed by
hand on the phone, so a desktop change could leave the phone compiling
against a stale shape. They are now Pick/Partial of shared types; the
createSupport reply and native-chat transcript frames gain shared types the
desktop uses too, which also gives the phone the 'chat-program' reason it
was missing. Type tests fail when a desktop tab gains a phone-only name or
a field type the phone would not accept.
Catalog rows were admitted with z.custom<Worktree>() and no check. They now
need a string worktreeId, and an ast-grep rule rejects a z.custom with no
check anywhere in mobile/src.
* test(mobile): the desktop contract check also catches a null the phone would not accept
* Keep async question answers stable until delivery
* Cover pending answers with recorded question input
* Cancel delayed answers when question controls disable
* Scope pending question answers to their form and journal order
* Verify revised questions and handover ordering through production sources
* Use typed phone answer fixtures
* Reuse answer delivery evidence and skip unquoted queue matching
* Supply derived journal scope in the translator regression
* Use named type imports for mobile question contracts
* Exercise canonical pending rows and buffered phone read coverage
* Align phone controller assertions with optional send intent
* Supply transcript metadata for phone question test fixtures
* Fix question prompt test literal typing
* fix(claude): reflect model fallback in chat and composer
* test(claude): reproduce fallback display before and after
* fix(i18n): ship the model fallback notice in the runtime catalog
* fix(mobile): ship the model fallback notice in the runtime catalog
* fix(claude): accept unnamed init models in response observations
* fix(claude): keep fallback observations display-only
Response model metadata must not satisfy delayed input evidence or
change saved launch preferences.
* test(claude): type fallback regression fixtures
* test(claude): expect init model display reports
---------
Co-authored-by: Vyacheslav Scherbinin <gentslava@mail.ru>
* fix(terminal): a local file link opens in the workspace it was clicked in
Clicking a terminal link to a file inside another local workspace switched to
that workspace: the editor loader moved the absolute-path tab to the workspace
containing the path (#11369), and link routing jumped to a sibling tab already
showing the file (#16544). This computer reads absolute paths directly, so
local tabs now stay where they were opened, editable. SSH and server hosts,
which read only workspace-relative paths, keep moving to the owner.
Refs #32158, #25838
* fix: merge duplicate editor store import
Capture Antigravity process ownership before managed hook shells and preserve it through HTTP, startup replay and host relays. Reuse host admission for desktop and mobile, including foreground recovery.
Fixes#37505
Co-authored-by: zhangxaochen <3416677+zhangxaochen@users.noreply.github.com>
Revert the live-history compaction and incremental vacuum added by #36053 to remove their serving-thread stall risk for the release. Preserve retired-history cleanup, saved formats/readers/writers and already-compacted sparse histories; add sparse reopen/write/reopen coverage.
Temporary: redundant live history can grow until the separate repair tracked in #37802 is ready. Older synchronous saves remain.
Tracked in STA-13374 and STA-13375. Six focused suites / 40 tests, independent correctness/architecture/final comparison and final-head CI passed.
* fix(sidebar): stop the resize handle from covering the workspace list scrollbar
The sidebar's overflow-hidden clipped the outer half of the straddling
resize handle, so the remaining half sat on top of the 10px list
scrollbar and left only 3px of it clickable. Render the handle outside
the clipped box and bias it toward the terminal side.
* fix(sidebar): keep resize grab room under drawers and keep thumb visible on handle hover
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* Keep opened GitHub work items bound to their exact repository
* Bind GitHub work item ownership through consumers and dispatch
* Keep empty mention lists from consuming selection keys
* Preserve GitHub action and consumer ownership across resource changes
* Exercise repository account updates through their production store action
* Exercise account publication and cache settlement through GitHub consumers
* Simplify fork PR contract verification
* Make contract verification imports and clocks deterministic
* Correct mobile task test fixtures and model types
* Correct task recording fixtures and CI types
* Correct task fixture types and static checks
* Consolidate replay test RPC imports
* Separate GitHub metadata imports from Linear hooks
* Scope mobile PR sidebar reads to the selected resource
* Separate desktop GitHub changes from phone updates
* Preserve complete phone GitHub repository identity updates
* Fix relay authority probe census across topology cases
* Repair repository owner proof fixtures and compiler allocation
* Preserve repository row observation in host lookup
* Seed metadata fixture before server-side store acquisition
* Preserve nullable fixture settings and discover mixed test types
* Refetch phone reviewer list after a connection change
A disconnect or session change while the reviewer list loaded left the drawer showing an empty list until it was reopened. The drawer now shows its loading state while disconnected and fetches the same repository again once connected, still ignoring the cancelled load's result. Also merges a duplicate type import that failed mobile lint.
* Keep phone reviewer rows through connection changes
The reviewer picker now owns one query per open visit of a client, worktree and repository. A connection or session change retires the in-flight request at once but keeps the people already loaded; reconnecting refreshes them in the background. Without loaded people the drawer shows its spinner, or the existing connection explanation once an outage is revealed, and never a false empty list. Closing, retargeting or reopening starts a fresh visit that no earlier reply can paint. Also wraps the synchronous bridge teardown steps so the cleanup loop awaits only promises.
* Keep the viewed phone PR through connection changes
A relay/direct switch or reconnect selected a fresh, hidden PR observation in Source Control and Diff Review, so the next render unmounted the PR, closed the reviewer picker and erased an unsent comment. The PR observation is now scoped to the client, worktree and branch. One connection listener retires the in-flight reads when the connection changes and repeats the query the screen already asked for once connected, so accepted content stays mounted and refreshes in place. A failed background refresh keeps the accepted result. Task PR files likewise keep their loaded contents and expansion across a connection loss and read an interrupted file again on reconnect.
* Show a failed PR refresh over kept content; recover task files on every connection change
A failed refresh of an accepted PR (or no-PR) result now keeps the content and shows the existing "Failed to refresh pull request." line with Retry above it, whoever started the read, until the next good read. Task PR file reads are retired and re-read from the task selection's own connection listener, so a reconnect batched into one render or a connection switch at the same state also recovers an interrupted file. The reviewer-picker contract test leaves the React Native test program for now; its checked owner follows.
* Typecheck the phone/host contract tests through emitted declarations
The reviewer-picker contract test and the recorded request params test import real desktop sources, which do not typecheck under the phone's React Native libraries. Both source graphs now emit declarations under their own compiler settings, and a strict Node program checks the two test bodies against them; Vitest still runs them against the original sources through path aliases. The tests typecheck ratchet runs this program and fails unless both bodies are in it and it passes, the CI test runner checks that Bun ran and passed both, and the Mobile workflow finishes compiler work before starting tests. The six other excluded tests stay runtime-only and are labelled that way.
* Name the types phone declaration emission needs
Declaration emission for the phone/host contract program could not name the i18n instance's type or the buffered terminal draft send type; annotate the one and export the other. Also types the drawer mock's children in the Source Control scenario so the React Native test program checks it.
* Stub every icon in the Source Control scenario
Source Control modules read icons at import time, so the scenario's fixed icon list failed to load the file under Bun.
* Give the recorded params check's stand-in method a permission
The recorded request params test is now typechecked and its stand-in method lacked the permission every RPC method declares; parsing never reads it.
* Use the real composer styles in the Source Control scenario
Source Control's list styles read composer style constants at import time, so stubbing that module failed the file under Bun.
* Mock the PR sidebar hooks without loading their native modules
Only the PR sidebar reads these hooks, so the Source Control scenario's mocks need not load the real modules, whose imports reach Expo native code that does not run under Vitest.
* Count recording-internal observations apart from recorded ordinals
The scripted transport runs the real request tracker, and its connection wait, id allocation, completion, late-reply and terminal observations each took the shared write ordinal that requests, frames and effects record. Every recording's ordinals shifted although the same frames went out in the same order. Those observations now use their own counter, keeping their association with the native request, so recorded ordinals match the existing recordings again.
* Record a cleanup checkpoint only when teardown adds effects
Comparing the whole snapshot before and after teardown added a cleanup checkpoint whenever a pending request settled at dispose, which changed about 166 recordings without new evidence. Restore the condition the recordings were made with: teardown effects alone add the checkpoint.
* Run the bridged recording corpus on Node
Its goldens hold V8's TypeError wording, which the Bun pass reports differently, so ten exact error comparisons failed only on engine text. It now runs with family-recordings on Node; the comparison stays exact.
* Bind the probe test's fresh status.get by its actual child
* Edit the GitLab status scenario's GitHub issue only after opening it
* Type the Source Control scenario's composer adapters with the real component props
* Mock the Source Control scenario's icons and protocol gates without loading the real modules
* Give the PR sidebar probe test the shared typed fake client
* Select the GitLab status scenario's GitHub issue as a typed task item
* Declare the buffered terminal draft send as an exported type
* Run the Source Control scenario's focus effect only when its callback changes, as the router does
The router mock ran the loaders' focus effect after every commit, so each status read re-rendered and re-ran it. Also mock AppState for the comments section and stop act from awaiting held PR reloads.
* Re-record the GitHub and Tasks goldens for the selected-repository requests
Re-recorded with pnpm --dir mobile rpc:record for the 71 scenario IDs: 66 changed and 5 added for the exact-target status.get probe, 0 removed. The goldens now carry the selected repository on GitHub requests, the exact-target probe before GitHub operations, the skipped hidden metadata loads and the new item-detail failure copy.
* Declare the probed GitHub operations' params in the order the app sends them
The bridge probe test compares the forwarded frame byte for byte with the declared params, so tk-item-detail-github, tk-item-status-gitlab and tk-project-row-files-merge now declare the exact key order their goldens record. Values are unchanged, and completion matching ignores key order.
* Close the native connection before the page in recordings, and make late replies and inherited timers explicit
Recording teardown now closes the native client, flushes its rejection through the bridge, then closes the page, so page callers see the relayed native close. Sibling rejections name the stable logical site in every mode. Replies scripted after a timeout or disconnect are explicit late replies that must resolve nothing. Four product timers inherited from main are declared by producer, scenario, owner and delay and still reported; every other run keeps zero residual timers. The bridge probe oracle for tk-item-status-gitlab expects the published deadline failure and the exact retained issue.
* Judge unchanged bridged recordings as main does and changed ones by their own outcomes
Unchanged producers follow main's order again: identical earns identical, History keeps its strict path, and other divergences take a legacy label from the reply-meta counterfactual's typed evidence. A bounded guard pins zero unclassified, small-class membership and the branch-base tally less each named moved or removed producer; eight moved producers without a base pin are named as old-class-pending until their baseline replay. The re-recorded producers are judged directly in both page modes against their reviewed goldens, with only the page's refusal of the injected absent result applied, or by their exact strict own-undefined stop, and are pinned as bridge contracts. Bridge-only preludes are observed after their action, and the pending invocation's relayed native close is read from its own page promise. Every producer must be routed exactly once.
* Say what to do when the GitHub server check fails, and share one deadline with the action
The exact-target check runs before a GitHub action is sent, so a timeout or lost connection now shows the existing 'The Orca server connection changed. Try again.' and a refused or unreadable answer shows the existing 'Update Orca on the executing server' message, instead of raw text naming status.get. The check's own connection-changed error passes through. On native, the checks and the action share one 30-second budget, so a dead server fails in 30 seconds instead of 60.
* Pass the scenario manifest to the changed-producer comparison
* Correct the bridged corpus repairs from their first full run
The re-recorded producers no longer stop on the strict own-undefined matcher and all replay in bridge mode, so they are all judged directly; the page's refusal of the GitHub server check now expects the connection-changed copy. Unchanged legacy labels read their first difference from the replay without injected metadata. The sibling timeout and each interruption, including the cutover, end the requests the goldens record as ended, so those replies are explicit late replies. New producers in pinned families get their bridge-contract pins, and an unexpected timer or changed outcome now names its scenario and values.
* Restore six unchanged scenarios to their single own-undefined steps
tw-smart-search-all-providers, tw-smart-search-linear-listed, tk-list-gitlab-items, review-mark-reviewed-persists, review-mark-reviewed-rolls-back and session-create-terminal-without-active-tab had their own-undefined steps split into native and bridge copies, so the page replay no longer reached the strict own-undefined stop and these unchanged producers left their baseline labels. Their steps are the branch-base steps again; native recordings are unchanged.
* Fill the eight moved producers' base classes from the admitted baseline replay
pr-read-surface was identical and the seven github.pr-read matrices were result-absent-settlement at the branch base, so the unchanged tally is exact again with no pending members.
* Deliver the sibling disconnect's trailing replies as late replies too
A disconnect rejects preflight.check, linear.status and jira.status before the suffix replays their replies, exactly as the sibling timeout does, so those declared replies are late in both variants; the cutover stays strict.
* Expect the page's refusal in the two Linear producers' result-absent checkpoints
Natively the injected { ok: true } reads as an empty result, so the Linear detail and status update finish; the page refuses that frame and the screen shows the refusal instead. Each producer now has one finite expectation for that checkpoint, guarded on the reviewed golden's final effects, and everything else must still equal the golden.
* Share one deadline between the shell's server check and the GitHub action
The shell gave the exact-target check and the forwarded action each the page's full timeout unless the page asked otherwise, so a dead server took twice as long to fail on the hosted page as on native. The two legs now always share the page's one deadline; the forwarded options are unchanged.
* Deliver the sibling client cutover's trailing replies as late replies too
* Build the changed producers' page expectations from one finite table before comparing
* Re-record the three exact-target check goldens for the mapped copy
The GitHub check now shows the update-server or connection-changed copy instead of raw reply text; the item detail's empty-message cases now also record their detailError effect. Recorded on the admitted run (check-3949 Job 1).
* Declare the traced inherited timers per inner scenario and recording mode
Each declaration now names the modes where its inner scenario leaves the timer. Adds the inner scenarios traced in check-3949/qa-report-trace.md Job 2, with the ruled delays and owner chains: the reveal's 300 ms first-poll timer for all ten reply partitions of tabs.list-1 and tabs.activate-1 in both modes, and the pr-triage 20,000 ms reconnect waiter for transport-rejection and transport-rejection-no-message in both modes and result-absent through the page only. Exact counts, owners and delays stay enforced.
* Expect the compiler wait before Mobile verify's tests and only the fastlane tools after
* Call recorded timer callbacks through a typed signature
* Show the reviewer picker's no-rows wait with the screen header's connection verdict
The drawer classified only its client's state and counters, so during relay recovery it flipped between Disconnected and Connecting on every dial and never showed relay or pairing verdicts. The source control and diff review screens now pass the host's own verdict inputs (reconnect attempts, last connect, relay recovery status), re-read on host state and path changes, so the drawer shows the same steady verdict as the header.
* Say a timed-out GitHub target check timed out, on native and in the shell
A server check that ran out its own deadline on a connection that never changed now reads "Timed out confirming the executing Orca server.", as the shell's budget already did, and the native shared budget running out uses the same copy. A lost or changed connection still reads "The Orca server connection changed. Try again."
* Name the paired desktop when it is the build missing the exact-target check
When the phone's paired desktop relays to an updated executing server but lacks the exact-target capability itself, the edit now says "Update Orca desktop" instead of pointing at the executing server. An old executing server still gets the executing-server copy.
* Preserve GitHub detail argument types and optional capabilities
* Say what updating the paired desktop enables, as the executing-server copy does
* Drop the tab-reveal timer declarations now that main removed the reveal operation
* Let keyed details queries own pending read replacement
* Repair GitHub RPC and relay test fixture boundaries
* Own the new PR tab's caches, sheets, confirmations and polls by the complete PR
Fork #N and upstream #N were one owner to the tab: check details, open sheets and confirmations keyed by worktree and number survived a repository change, so a fork draft or decision could act on upstream and fork check data could show for upstream. Each is now owned by the PR incarnation (client, worktree, branch and full resource key), selected during render, so a departure closes old requests without retargeting them, A -> B -> A starts fresh, an outgoing sheet renders nothing and sends nothing, a late save closes only its own request, and a departed PR's poll neither blocks nor re-arms its successor.
* Load the reviewers sheet's people through the selected repository's resource-owned query
The new sheet read people once on the first search with no repository, connection recovery or retry, so a fork PR listed the wrong repository and a search while reconnecting stuck on an error. The first search of an open sheet now demands the selected repository's list through the exact-target helper; the query reads only while connected, retires its attempt on every real state or generation change, recovers on reconnect, keeps accepted rows and search through refreshes, and shows the header's own calm connection verdict while it has no candidates. Closing or a PR departure ends the visit; reopening starts fresh.
* Mark a failed PR discovery from every caller, polls included, and keep a poll's checks-only failure quiet
Main's poller made a failed background discovery silent, narrowing the ruled all-caller contract. Any current failed discovery over an accepted PR or no-PR result now keeps it and shows the one refresh-failed row with Retry, and the poll still backs off on 'failed'. A poll whose discovery succeeded but whose checks read failed for the same complete PR lands its discovery (clearing an older warning) and keeps the prior checks, reporting 'failed' once; equal numbers in another repository no longer count as the same PR. A viewed-file update from a departed observation changes nothing.
* Send the phone's addressed details reads with the server's read intent where it is advertised
github.workItemDetails accepts optional canonical:false (ordinary) / true (Refresh), advertised by github.exact-details-read-intent.v1; missing intent means ordinary. The phone's addressed details reads (PR tab and Tasks) now pass that intent through the existing exact-target preparation: a host advertising it gets canonical:false for ordinary loads, recovery and polls and canonical:true for the user's explicit Refresh; a canonical-only host gets ordinary reads without the owner and Refresh with the owner only; hosts with neither keep today's params, and an explicit Refresh there is refused as unsupported. Refresh intent travels only with the Refresh command, never as reconnect demand. The poll's checks-only settling moves into pr-sidebar-load-result to keep the controller within its size limit.
* Keep today's details params for a host with neither read-intent capability, Refresh included
* Drive the reviewer target contract through the new tab's reviewers sheet, first search included
* Cover a poll's discovery warning, its clearing, and a same-PR checks-only poll failure in the controller
* Prove the Source Control PR tab's demand, retained sheet and draft, failure line and fork/upstream request ownership on the new navigation
* Cover the details read intent the phone sends to explicit-intent, canonical-only and older hosts
* Fix the round's test typecheck and assertion findings: awaited controller loads, the diff review props, typed doubles
* Send Refresh's owner to a canonical-only server outside the exact-target check, as the desktop does
* Restore the base's mobile change-scope test, which the base merge dropped by mistake
* Prove the PR poller keeps each fork/upstream incarnation's poll, backoff and cadence its own
* Verify expected GitHub account at repository execution capture
* Give the Linear detail recording adapter the detail Refresh request its loader reads
* Keep the detail Refresh request ref out of the recorded owner projection, like the other ref
* Count cancelled GitHub probes against the desktop request cap main introduced
* Keep the comment tree out of the diff review controller test, as its drawers already are
* Restore the Source Control action icons the scenario rewrite dropped from its icon mock
* Supply the settled-list setter main added to the Tasks list fixture
* Preserve captured GitHub account expectations through client dispatch
* Re-record the Linear team-context goldens for this PR's actionItem owner effect
* Retain observed runtime status after switching environments
* Fix account contract fixture types and RPC setup timing
* Restore the negative-capability switch probe assertion
* Align account fixtures with runtime identity and configured origin
* Consolidate details test imports
* Type the reviewer test's search stand-in locally so native declarations stay out of its Node-checked program
* Add the PR tab Retry label's English entry the localization check requires
* Restore the PR tab Retry label's translations in the other mobile locales
* Pass the phone write reread through the reviewer contract.
The sheet fixture omitted the required reread, so the phone typecheck failed. Desktop settlement tests that main already removed were still on this branch and pulled telemetry into the web typecheck.
* Declare the phone pull request refresh failure.
The sidebar already shows this sentence when a refresh fails. The English catalog omitted it, and the boot bundle still carried two strings no startup call needs.
* Let the phone sidebar tests subscribe to connection state.
The sidebar records the client's connection before it loads a pull request. These tests drive that through the screen's connection prop, so the stand-in client only has to accept the subscription.
* Justify the phone sidebar test client.
The changed-code check rejects a new cast unless the line says why it is sound. These tests still only subscribe and read connection state.
* Name the repository on the phone sidebar details fixture.
A same-numbered pull request in another repository is not this one. The loaded body has to name the repository the test selected.
* Keep phone review-thread feedback on its accepted detail revision
* Capture phone review actions from the current render
* Align phone recording fixtures with the integrated detail loader
* Keep provider-switch detail fixtures addressed to the selected item
* Preserve same-turn bridge refusal evidence across client call shapes
* Publish phone detail revisions through one synchronous owner
* Type the queued publication regression with its provider contract
* Conform phone regression and relay types to static analysis
* Trim duplicate phone RPC tests and focus recorded observations
* feat(terminal): add a setting to keep scroll position on input
Typing or pasting in a scrolled-up pane can keep the current viewport.
Settings > Terminal Interaction now has Scroll to Bottom on Input, on by
default, mapped to xterm's scrollOnUserInput.
* feat(terminal): translate the scroll on input setting
Add the label, description and search keywords to every locale catalog so
the setting does not fall back to English.
* refactor(settings): move the scroll on input type out of global settings
The field took global-settings-types.ts past the 300 line lint limit. Keep it
in a small settings type composed into GlobalSettingsBase, as the other
feature settings are.
* fix(settings): match the scroll on input row on localized keywords
The row passed English keywords to SearchableSetting, so a translated
query such as "einrasten" found the terminal pane but hid the row. Move
the entry to its own catalog getter and pass it to the row, so both use
the same localized keywords.
* test(settings): type the i18n mock without a cast
The changed-code quality gate rejects the type assertion.
* fix(settings): tighten scroll on input copy and add settings fixture
Shorten the Scroll to Bottom on Input description so it fits on one line,
widen the Terminal Interaction subtitle to cover scrolling, and add a
component fixture for the section.
---------
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
- Electron 43.8.4 -> 43.8.6: upstream Chromium/V8/ANGLE/PDFium/Skia/WebRTC
security backports. Drops the now-unneeded minimumReleaseAge exclusion.
- @hono/node-server 2.1.0 -> 2.1.5 (GHSA-rmxm-3fg6-px4f), lockfile only.
- mobile node-forge 1.4.0 -> 1.4.2: fixes 10 advisories (5 high) and the
previously patched GHSA-86w9-cpqp-85rv, so the local patch and its audit
exception are removed. The regression test still passes on 1.4.2.
Keep the GitHub Tasks source picker, rows, totals, searches and issue creation tied to the selected project, host and source. Ignore outdated replies and wait for source preference saves before creating an issue. Preserve support for older paired servers.
Tracked in #8726. Tracked in STA-1815.
* Show orchestration message content without the agent envelope
* fix: retain orchestration content through journal storage
* test: preserve large orchestration queue capacity
* test: inspect phone card text as a string
* Keep mobile mail fixture independent of desktop runtime
* Separate browser mail fixtures from formatter integration fixtures
* improve app loading efficiency
* Preserve diagnostic cooldown during worktree fallback
* Fix attribution diagnostic cooldown expiry
Simplify persisted token usage state to the current snapshot schema
and verify retries within a process and after restart.
* Stop retrying final native agent startup refusals
* Retire startup opens after exit and keep final answers across exit orders
- A start flight cancels its outstanding provider open on every ended path; a direct attach keeps the child-bound abort.
- The post-exit answer join is bounded by the remaining startup ceiling.
- An elapsed initialize deadline keeps its words when the exit wins the race.
- Codex cloud config temporary declarations retry on thread/resume as on thread/start.
- A Claude exit before acquisition publishes waits briefly for initialize's answer, so a rejected initialize stays final.
- The Claude startup stdout observer parses only failed root results, within the shared line budget, and detaches once it has one.
* Keep saving the last turn when a Claude process exits after startup
The exit path skipped saving the resume cursor whenever Orca had not
dispatched a message, but turns can settle without an Orca dispatch and an
already-started idle session still owns its exit save. Only a start that
died before initialize answered and before any turn now skips the save and
gets the short cleanup bound. A failed result captured before the first send
counts as a startup failure only when no turn ran in that process.
* Merge duplicate test imports
* Bound resumed Claude starts that exit during catch-up and keep untyped refusals final
Exit-time cursor writes and the short close bound now key on the host-awaited
open actually returning, so a resume that exits while transcript catch-up is
pending publishes ended at once instead of waiting on a cursor write. The
startup observer no longer reads an answer from an oversized line's prefix.
A typed acquisition refusal without a dedicated failure kind keeps its
refusal marker, so an exit-only start stays final.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: pin the fake clock in the resumed-exit start test
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: bound startup answer parsing by candidates at N and 10N records
Drive the startup observer through the shared framer at 100 and 1000
irrelevant hook and assistant records, and assert that only the failed
root result is parsed, one capture happens, the data listener retires,
and no parse follows capture or finish, with identical counts at both
populations.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: shape startup fixtures like the real providers
Held opens in the launch test now reject when their child exits, as a
real connection does, and the temporary open failures use the provider's
actual overload envelope. Also fixes the test-only type errors CI found.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: use the real Codex canonical-filename refusal wire capture
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(claude): align merged startup tests with answer-wins and final generic results
An exit with no stderr leaves the start to Claude's buffered result, so that result is the start's one failure. A generic startup failure result is final after one start; only an unanswered exit retries, and the recovery case now recovers from such an exit.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(claude): let a final initialize answer outrank a physical exit reported fault-first
The connection reports one physical root exit through onFault and then
onExit. It now marks that error as an observed exit before either
callback, and acquisition's onFault leaves a proven exit to onExit's
bounded initialize join, so a final initialize rejection that arrives
just after the exit owns the start instead of a retryable bare exit.
Typed refusals, live-root faults and processless spawn faults still end
the start at once.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(claude): await a macrotask instead of real time in the exit-answer start test
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(claude): replace casts in the exit-answer start test with an annotation and guard
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): let each adapter decide a failed start, and give the start one owner
A start that the agent refused could still be replayed: the host joined a
child's exit with its open's error and rebuilt the meaning from provider error
classes, and an answer written just before exit could lose to the exit itself.
Each adapter now answers its own acquire, open and required startup reads with
one typed result (final, or safe to run once more), keeping a final answer
beneath the exit proofs cleanup adds. Transports keep reading answers already
written after the agent stops reading or exits, within the existing one-second
drain, and only a drained exit of the agent's own process counts as unanswered.
The child's open is the single owner of the start's outcome: it awaits the
adapter's result and required settlement, records the verdict once, writes a
direct attach's failure row, and stops the child. The start flight reads that
verdict instead of joining exit and open. A start whose adapter gives no outcome
within five seconds of its own process exit fails through a timer that no
bookkeeping can hold, and the original start deadline stays in force until the
start is decided.
Tracked in STA-12982.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): bound a failed start's lifetime and keep Orca's own refusals final
- A start's ending is kept only while its owner can read it: admitted when the
acquisition starts, retired when the owner finishes, the acquisition fails, or
the session is released or closed. An exit after ready records nothing.
- Codex takes its own exit as the start's wake from the moment the process is
seen, before spawn bookkeeping, and a failed acquire keeps that exit as cause.
- Once the handle or rewind write began, an unanswered death no longer decides
the start: the write's refusal stays final, and the exit grace bounds the wait.
- Stop, the deadline and the exit grace release the start's callers at once; the
failure row is queued first but never awaited by them.
- An ACP connection Orca closed before the exit keeps that cause, so cleanup's
exit is not read as the agent ending unanswered.
- A request deadline keeps its words when an exit is seen around it.
- A direct attach whose exit settled first keeps the exit's words.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): let a start's owner, not its live route, keep and retire its ending
Exit acknowledgment drops a session's route while the start's owner may
still be reading how its acquisition ended, so the router now reaches the
adapters by exact generation for both the read and the retirement. Claude
admits its acquisition before publication can observe an exit.
An ACP start Orca refused before the agent exited now fails with that
original refusal as the adapter's final verdict, through every cleanup
wrapper, instead of a generic closed-while-starting error.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(agent-session): give the worker retry fake the Codex adapter's typed start verdict
The host now reads only the adapter's verdict on a failed start, so the
fake open rejects with the verdict the Codex adapter returns for its
declared overload instead of the raw request error.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): let Claude's own exit record decide a start the SDK reports as exited
A Claude CLI missing from the launch PATH makes the supervisor exit 127 with the spawn error on
stderr. The SDK rejects initialize with only "process exited with code 127", and the start took
that report as its cause, so the missing CLI was lost: the chat said Claude stopped before it
finished starting and the start was retried as an unanswered exit. The SDK's exit report is no
answer; the start now reads Orca's own record of that exit, which carries the missing CLI.
Also brings two ACP tests in line with the typed start verdict (a signed-out open rejects with
the adapter's notSignedIn verdict) and the bounded drain after the agent stops reading.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(agent-session): stop parsing Claude's startup output once its failure is captured, and pin start and drain work at N and 10N
A failed root result captured mid-chunk still let the rest of that chunk be framed and parsed;
nothing reads those records once the start has its answer. The observer now accepts no further
line once it has captured the failure, and drops what that chunk left in its framing state.
Two contract tests drive the production start owner and transports at N and 10N:
- starts through the host, router and Codex adapter (ready, final refusal, safe replay, deadline
expiry): each start's owner, abort handles, tracked attempt, flight, buffered exits, adapter
receipts, root-exit subscription and deadline timer return to baseline, a waiting start holds
a fixed set, and spawns, opens, router reads and retirements, timers and failure rows grow
exactly linearly;
- ACP, JSON-lines and Codex connections with a pending call, answered at exit or abandoned after
the agent stops reading (with duplicate terminal signals): each call settles once, each output
drain finishes once and leaves no listener or timer;
- an ACP start refused at sign-in keeps its own first cause and leaves no receipt or child.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(agent-session): decide a failed start once from everything its adapter saw
A failed start was decided from whichever error reached the decision first, so a later or
poorer report could replace the one that explained it: the SDK's exit report hid the missing
CLI Orca's own exit record carried, and an output drain let a load deadline give way to an
unanswered exit. One shared rule now weighs every observation an adapter kept. The start may
run again only if every observation allows it, and the most specific one explains it: what the
user can act on, then a request deadline, then the agent's answer, then Orca's record of its
exit, then an SDK's report of that exit. Claude, Codex and Pi pass their exit records alongside
the operation's error instead of choosing between them.
An ACP agent that exited while its output drained no longer gets a replacement session after
its load fails. JSON-lines output that reports both its end and its close now starts one wait,
so the agent's exit can always cancel it.
Contracts at N and 10N: JSON-lines output ending while its root lives, real Claude and Pi
adapters retiring every start's receipt, and a user Stop whose cleanup is held then released.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(acp): keep a missed saved-session load deadline instead of opening a replacement
A live agent that let session/load run past its deadline fell through to the
takeover path, and the replacement session/new answer then replaced the
deadline the user had to see. The takeover predicate now propagates any
provider request deadline unchanged, read through the existing typed timeout.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Use the shared agent picker for Source Control text actions, with Model and Effort choices while preserving Custom command, Arguments, inherited defaults and Save/Discard behavior.
Reviewed on bbdb46a369cc872ae6cbb7c4b65dc5968e21fcba; final CI passed and brennan-ready returned READY.
OrcaWinandOrcaWin
Jinjing
Neil
Brennan Benson
Jinwoo Hong
Kelvin AmoabaandVyacheslav Scherbinin
