The staging director deploy binds its digest to staging-gce-c4's checked-in image. E is main
2bdb55350d (#27405 event-loop max, #27406 sidecar), already mirrored to staging. C4 itself
changes only through its own reviewed refresh workflow.
* feat(serve): let the owner resume paused automatic restores
The terminal daemon now answers automaticWorkStatus and
resumeAutomaticWork. Resume clears a recorded same-boot crash pause or
a pressure pause, writes the cleared state durably, and wakes restores
that were waiting. The runtime exposes runtime.automaticWork.status and
runtime.automaticWork.resume (host-admin; advertised as
runtime.automatic-work.v1), the CLI adds 'orca serve restore resume',
and a sleeping pane paused by its host offers 'Resume automatic
restores'. A daemon that predates the requests reports no gate.
* fix(serve): a stale daemon cannot resume, and an old one says so
Resume now re-reads endpoint ownership right before it runs, so a
daemon replaced by a successor cannot rewrite the successor's run
marker. A gate-bearing daemon from before resume existed is reported as
'terminal host predates resume' instead of 'no gate'; the CLI says to
run the command again after the terminal host restarts, and a sleeping
pane still resumes when the user asks for it.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
The terminal gate's relay lister always resolved to null in production (no SSH PTY
provider is ever registered), so its relay and previous-relay branches, the legacy
relay route/router/routing, the previous-relay census and the once-connected
re-check could never run. The gate now takes only the host census; census-only
verdicts are pinned by a characterization test written before the change.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude <noreply@anthropic.com>
On macOS a second Electron main aborts inside _RegisterApplication
before any Orca JavaScript can apply the one-Orca-per-profile rule, so
supervisors and agents retrying 'orca serve' loop on SIGABRT (#14541).
The CLI now checks the profile before it execs Electron serve. A runtime
that answers, or whose socket accepts, is live; one whose socket neither
accepts nor refuses, or that refuses this CLI's credentials, is
unverifiable; both refuse with exit code 3, the single-instance code
systemd units already key off. Only a definitive refusal (ENOENT or
ECONNREFUSED) lets it start. A fresh profile keeps the old synchronous
launch. A macOS startup abort is remembered per environment, so a later
separate 'orca serve' from the same launchd session refuses for 30
minutes with exit 78 instead of aborting again; --force overrides, and
a serve that reaches readiness clears it.
Adapted from #14768; the Launch Services diagnostic wording and the
exit code 3 contract come from #14542.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: thiagomsoares <5190162+thiagomsoares@users.noreply.github.com>
* feat(terminal): declare restore intent and keep deferred panes sleeping
The visible pane's agent restore is sent as user-resume and hidden ones
as automatic-restore, to hosts that advertise terminal.spawn-intent.v1
(and always on the local spawn path). When the host keeps a restore
asleep, the pane shows 'Sleeping — click to resume' with the reason,
keeps a sleeping record so the session stays listed and resumable, and
resumes as the user's own when it is opened or clicked. A deferred pane
is not remounted, which would only be deferred again.
* refactor(shared): one restore spawn intent type
* fix(terminal): a deferred pane owns its session against wake sweeps
A deferred pane has no PTY, so the activation and mobile wake sweeps
read its unfinished record as unowned and could launch the session in
a new tab while the pane still held a resume. The sweep now treats a
deferred pane as the owner, the remembered record is a quit-style
record a sweep never discards, and a retry declines to resume a session
that is already live in another pane.
* fix(terminal): keep a deferred pane's claim through its sweep and retry
The wake sweep now leaves a deferred pane's record alone, since that
pane's own queued resume matches it and is not a duplicate. A retry
keeps the pane registered as the session's owner until its PTY binds,
and declines to resume when another tab already has the same session
queued.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(updater): let supervised macOS serve installs stage Squirrel during install
Supervised `orca serve` keeps autoInstallOnAppQuit off, so electron-updater's
MacUpdater hands the download to Squirrel.Mac only inside quitAndInstall. The
updater, however, held the status at "downloading 100%" and gated quitAndInstall
on Squirrel having already staged the bundle. Neither could happen first, so
every macOS serve update stalled at macos_waiting_for_squirrel, remote installs
failed with remote_update_not_downloaded, and a local install request timed out
and quit without installing.
In supervised serve mode, report the download as installable and let the install
proceed to the handoff and native quitAndInstall. The install commits and arms
the exit watchdog when Squirrel signals it has staged the bundle; a staging
failure still recovers through the existing pre-commit error path.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(updater): hold destructive install prep until Squirrel stages the serve bundle
The supervised macOS install now calls electron-updater's quitAndInstall before
Squirrel has staged anything, and that staging completes asynchronously. Three
consequences needed handling:
- PTY cleanup and close-listener removal ran before staging, so a Squirrel
failure recovered the server with its in-process sessions already killed.
They now run when Squirrel reports the bundle staged, together with the
commit and exit watchdog.
- Any updater 'error' during staging (for example a background check) failed
the handoff while MacUpdater's pending listener would still quit and install.
While staging is awaited, only Squirrel's native error ends it.
- Nothing bounded a Squirrel that never answers. After two minutes the install
recovers through the existing pre-commit failure path and the server keeps
serving.
isMacStagingDeferredToInstall is now darwin-only, so Linux supervised installs
keep their immediate commit.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(updater): report a slow Squirrel staging instead of abandoning the install
Recovering the install on the staging timeout reset Orca's state and failed the
supervisor handoff, but electron-updater's MacUpdater keeps its own completion
listener. A Squirrel that finished after the timeout still quit the app and
installed, now with a failed handoff, so the supervisor skipped the replacement
spawn.
The timeout now only reports a non-retryable error status and records the slow
staging; the handoff and in-flight install stay live so a late staging commits
and relaunches normally.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(updater): commit a staged serve install before its session cleanup
Squirrel's update-downloaded listeners run in registration order, and Orca's
runs before the one MacUpdater adds to quit the app. The staged-install commit
ran PTY cleanup first, so a throwing cleanup callback skipped the commit, the
exit watchdog, and MacUpdater's quit, leaving the install stuck in progress.
Commit and arm the watchdog first, then run cleanup under the same
post_commit_cleanup_failed handling performQuitAndInstall already uses.
The tests now register MacUpdater's persistent quit listener per unstaged
install, so a retried install is followed through completion.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test(updater): pin the MacUpdater staging behavior supervised serve installs rely on
The supervised macOS serve install assumes electron-updater's MacUpdater starts
Squirrel staging only inside quitAndInstall when autoInstallOnAppQuit is off,
and quits the app once staged when autoRunAppAfterInstall is off. Every updater
suite mocks electron-updater, so run the installed MacUpdater methods directly;
an upgrade that changed either behavior now fails here instead of silently
restoring the deadlock.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test(updater): adapt the serve staging tests to current main
Main's macOS quit-guard test predates the staging callbacks this change
adds, so it now passes them, and the new install test builds its window
without a type assertion.
Co-authored-by: jbamlee <dev.jbam@gmail.com>
---------
Co-authored-by: jbamlee <dev.jbam@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: m4air <m4air@Mac.localdomain>
The legacy remote-server help text promises that one manual update enables remote updates, even when the server reports its updater is unavailable. Replace the promise with accurate host-side update guidance in every supported locale and cover the fallback and specific help branches.
Refs #22261
Co-authored-by: Oliver Mee <102673257+oliver-mee@users.noreply.github.com>
* fix(serve): keep the isolated profile off the login keychain
The E2E/pairing runtime hands the app a fresh HOME, so there is no login
keychain for OSCrypt to read. On the serve path the secret-protection report
runs inline before readiness and probes safeStorage on the main thread, where
Chromium's keychain lookup creates the item and waits on an authorization
reply that never arrives, so `orca serve` never advertises (#25453).
The sidecar already launches with --use-mock-keychain for exactly this
profile; share that decision and give the foreground serve process the same
switches.
* test(serve): read spawn args without type assertions
Co-authored-by: Paolo <paovalletta@hotmail.it>
* fix(serve): only an isolated userData profile drops the keychain
The sidecar always runs on a fresh profile, so either E2E variable is
enough there. The foreground serve process opens the selected profile's
sealed secrets, and a HOME override alone still selects the user's real
profile, so it now needs ORCA_E2E_USER_DATA_DIR.
Co-authored-by: Paolo <paovalletta@hotmail.it>
---------
Co-authored-by: Paolo <paovalletta@hotmail.it>
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(sidebar): stop a removed folder workspace from leaving a blank row
A folder-project workspace exists only as its worktreeMeta row. When it is
deleted while a terminal is still bound, the renderer keeps the row until its
teardown runs, and a PTY reattach in that window stamps lastActivityAt through
worktrees:updateMeta. setWorktreeMeta then minted a default row with an empty
name, which the sidebar listed under the project name and which came back after
every delete. The metadata IPC now refuses to create a row for a folder
workspace instance that no longer exists.
Fixes#22712
Claude-Session: https://claude.ai/code/session_01XZXEdbC4RKp288k2gBzLUW
* fix(sidebar): also refuse runtime writes to a removed folder workspace
Move the existence check into a shared predicate that matches any same-id
folder owner, so an owner at a different path on another host cannot bypass
it, and apply it to the runtime's worktree.set path, where a resolution
snapshot taken before the removal still returns the workspace.
Claude-Session: https://claude.ai/code/session_01XZXEdbC4RKp288k2gBzLUW
* test: type the removed-folder-workspace fixture meta for the anti-slop lint
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(runtime): accept a declared spawn intent from paired clients
Paired clients can now say whether a terminal restore is the pane the
user is looking at (user-resume) or a hidden one (automatic-restore).
The host forwards the intent to its fork gate, advertises
terminal.spawn-intent.v1 so clients only send it to hosts that accept
it (terminal.ensureAgentSession params are strict), and reports a
deferred fork as terminal_spawn_deferred with its reason.
No client sends the field yet; that lands next with the sleeping-pane
handling.
* fix(daemon): a claimed agent resume cannot declare itself interactive
Interactive forks skip the gate, and paired clients can now declare
intent, so the host keeps inferring from the claim when a request
says interactive.
* fix(runtime): clients may only declare restore intents
A daemon kept running across an update still lets a declared
interactive request skip its gate, even for a claimed resume. The RPC
and local IPC now accept only user-resume and automatic-restore, and
the daemon request boundary turns a claimed interactive into an
automatic restore.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
The pane listener subscribed to 'orca:wake-hibernated-agents-worktree' while the
dispatcher fires WAKE_HIBERNATED_AGENTS_WORKTREE_EVENT ('orca-wake-...'), so the
in-place wake never ran. Extract the listener and bind it to the shared constant;
the dispatcher test now drives the real listener instead of a stand-in.
Co-authored-by: m4air <m4air@Mac.localdomain>
orcad now checks its flags with the same validator Electron serve and the
CLI use, so contradictory pairing flags fail with the same message instead
of one silently winning. The CLI launcher drops its duplicate recipe check
(the CLI handler already ran the shared validator).
Removes the daemon-init and cli/runtime/index re-export barrels and the
parsePtySessionId / OrcadInstanceLockError re-exports; callers and mocks
import the defining modules.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(cli): extract the serve supervisor's after-exit decision into a pure policy
* refactor(cli): type the exit signal without a child_process import
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(runtime): reuse cached worktree rows when the admin probe cannot answer
* test(runtime): wait for the fingerprint probe to settle instead of a fixed delay
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(daemon): process-growth breaker that pauses automatic restores per host and names the agent
* fix(daemon): breaker trips only on sustained growth, pauses in memory, observes on desktop
* fix(daemon): sample fast only while a tree is rising or tripped
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(serve): report secrets unavailable instead of hanging on an unreachable macOS keychain
* fix(serve): classify keychain probe by exit code, skip under a mock keychain, ratchet direct safeStorage imports
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Nothing mints an SSH-bridge credential since the relay client was removed
(#27214), so the 'ssh-bridge' caller kind, its host binders, result filter,
the CLI bridge-mode policy and the ORCA_SSH_BRIDGE_CREDENTIAL env read could
never run. The allowRemoteCliControl target field stays for older peers.
Co-authored-by: m4air <m4air@Mac.localdomain>
Removes seven modules that only their own tests import, dead orcad exports
and protocol constants, spells orcad's configuration exit code once, reuses
the shared errorMessage helper, and drops links to the deleted
docs/reference folder.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(daemon): observe-only fork gate for automatic terminal restores
* fix(daemon): keep a canceled fork charged until reaped; never strand a user resume
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
The relay client is gone, so the three relay-ladder cells and the
@orcad-cli-relay-kept matrix case could not run. Delete them, their
last helper (ssh-test-target-connection), a stale path filter and the
unused build:relay step; rename the runner to invoke-windows-host-cells.ps1.
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(linux): stop the AppImage crashpad handler before the mount goes away
Crashpad's handler runs from the AppImage FUSE mount and outlives the main
process, so it SIGBUSes once the runtime unmounts it. On a validated
AppImage running from its own mount, SIGKILL this launch's handler from the
main process's exit hook.
Fixes#22542
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: clarify AppImage Crashpad exit hook
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A layout stream's cleanup is now registered under a key that includes the
subscriber's connection, and layout.unsubscribe builds that key from the
caller's own connection, matching session.tabs.unsubscribe. Another
connection can no longer end a stream by passing its id.
Fold the empty owner-routing baseline into the focus-read ratchet. The three
deleted focus-routing helpers stay banned as a forbidden-name list.
Co-authored-by: m4air <m4air@Mac.localdomain>
Container devpts instances reuse pts numbers, so selecting kill targets by
tty alone could SIGKILL same-uid processes in other namespaces. On Linux,
require each candidate's /proc session id to equal the PTY shell's pid.
Fixes#27337
Co-authored-by: m4air <m4air@Mac.localdomain>
#27396 deleted the write-only registry that consumed it; nothing sets the
option now, and its doc comment implied a cancellation path that no longer exists.
* ci: drop the relay Windows process-tree job from desktop packaging
* ci: refuse relay-era tags in a directly dispatched mac release build
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(relay): director reaches Cloud SQL through a proxy sidecar (staging), gated event-loop stall alert
On Cloud Run's built-in /cloudsql socket a connect() blocks the director's whole
event loop until the connector's upstream dial ends, 10 s per attempt while the
instance starts. Staging froze both directors for 134 s on 2026-10-11 and
production four directors for 40-50 s on 2026-09-28.
relay_director_cloud_sql_proxy_sidecar runs the Cloud SQL Auth Proxy beside the
director on 127.0.0.1:5432, as the GCE cells already do, with its own TCP
database URL secret. relay_event_loop_stall_alert adds the event_loop_ms_max
metric and a 5 s stall alert. Both default off, so production plans unchanged;
staging turns both on.
* fix(relay): adopt a reviewed Terraform director shape on deploy; counter-based stall alert; cheaper probed sidecar
- deploy-relay-blue-green: --shape-baseline-revision names the 0% revision a Terraform
apply created; the deploy preserves that shape instead of the serving one. It must be the
latest created, unserved revision on the serving image. Wired into the staging and
production director workflows behind ADOPT_RELAY_DIRECTOR_TERRAFORM_SHAPE.
- Event-loop stall alert is now a gated counter metric on eventLoopDelayMsMax>=5000.
- Sidecar gets a /liveness probe and 0.25 vCPU (Cloud Run rejects only a total under 1 vCPU
with concurrency above 1; checked with validateOnly against the API).
- staging.tfvars pins the serving director's concurrency 1000 and timeout 3600 s, so the
adopted apply shape does not fall to the 80 / 30 s defaults.
* fix(relay): shape adoption refuses identity, topology, pruning and image changes; GOMAXPROCS=1 on the sidecar
parseArguments now refuses --shape-baseline-revision with a runtime identity bootstrap, a
director topology change or revision pruning, so every caller is covered, and the deploy
refuses a shape baseline whose image differs from the serving one. Both director workflows
also refuse the combinations up front. The proxy sidecar runs with GOMAXPROCS=1 to match its
0.25 vCPU quota. The long-hold alert comment is back above its resource.
* fix(relay): keep seat polls off the cell-list read and report event-loop freezes
The seat poller no longer waits on its database cell-list read before polling
cells once it has a list, so a stalled read cannot starve the polls that feed a
reserve cell's dead-man. Runtime metrics add eventLoopDelayMsMax: a single long
freeze is one sample, so p99 read 68 ms across a 134 s staging freeze.
Adds a pool test against a database that accepts and never answers, and a
real-Postgres stop/start recovery test.
* fix(relay): state the seat-poller gain precisely, justify the AddressInfo cast
* fix(ssh): remove the relay-only remote workspace sync so reconnect never sticks on pulling
* refactor(ssh): drop snapshot apply tokens and terminal finalization only the sync used
* test: drop leftover sync-status mock
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Use the host HTTP client for usage, reset-credit reads and redemption, keep
those account requests cookie-free, and pass configured proxy settings to the
native Codex probe. WSL probes keep the guest's own proxy environment.
Co-authored-by: petersindex <287557875+petersindex@users.noreply.github.com>
Co-authored-by: mmarabel <166927047+mmarabel@users.noreply.github.com>
* feat(mobile): show SSH host health on the workspace row host badge
Rows on an SSH host the desktop cannot reach looked healthy on the phone. The badge now
adds the desktop sidebar's own word ("devbox · Disconnected"), derived by the same shared
function from the connection status ssh.listTargetSummaries already sends; old desktops keep today's badge.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): name an unhealthy SSH host even in a single-host list
The desktop card shows SSH status on any host count, so the phone now reads target summaries
whenever a repo is on SSH and badges an unhealthy host alone too. Labels and health share one
target-to-host keying, and a hook-level test pins the reply-to-row wiring.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): clear stale SSH host badges and announce them without the dot
A catalog that no longer spans hosts or holds an SSH repo now clears the health and label maps,
so a host that left cannot keep badging rows. The badge gets a screen-reader label ("devbox,
Disconnected") instead of reading the middle dot.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(runtime): let a paired desktop register its phones as delegated mobile devices
A desktop paired to this runtime can now call pairing.delegatedMobileDevice.sync to make each of
its phones an ordinary mobile-scope device it owns, so the phone mirrors that host through the
desktop. Children are never pending, inherit the parent's reach, and die with the parent's grant.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(runtime): move the mobile device revoke primitive below dispatch
Dispatch binds the caller-bound delegated-device context, so the revoke path it needs now lives in
a layer under it as a pure move; this drops the abstract method seam. No behaviour change.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(runtime): keep a runtime grant until its delegated phones are revoked
A failed child cleanup now leaves the parent in place so a retry can still find the children, and
revokeRuntimeAccess lives beside the revoke it cascades to. Adds restart, rename and bounds coverage,
shares credential minting, and drops the timing-dependent census.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(runtime): fail a delegated sync whose dropped phone cannot be revoked
Matches the parent revoke: a child whose cleanup could not be saved is kept and the sync errors
before minting anything, so the desktop retries instead of believing the server matches its list.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): relay a paired phone's server-workspace requests through the desktop
A phone mirrors its desktop, including workspaces on the desktop's configured servers. The desktop
now forwards a request that names `executionHost: runtime:<env>` to that server over one socket per
(phone, server), signed in as the phone's delegated device; replies pass through untouched except
stream ids. Hidden until the phone client ships: the relay capability is not advertised yet.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): type the single-host health fixtures inline so the test tsc passes
Fixtures hoisted into consts widened their health maps to string, which the now-required
hostHealthById rejects under the tests-typecheck ratchet; passing them inline keeps the union.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* docs(mobile): state the desktop relay contract in its entry module
main dropped docs/reference, so the relay's contract lives beside the code. Also pins that a
server whose delegated sync fails (e.g. delegated_device_revoke_failed) is unavailable until a
later request syncs it again.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): pin the relay's configured-server adapter
The production hosts adapter was only typechecked; this pins that it resolves configured servers
by exact id only (never a name or a removed server), fences by pairing revision and runtime
identity, and stops reporting retirements once unsubscribed.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): re-record the repo-metadata goldens for SSH host health
The settled metadata state now carries hostHealthById, and an SSH-only catalog now reads the
target summaries so a lone unhealthy host can be badged. Scoped re-record via rpc-recording.mts.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): tighten the desktop relay after elegance review
Reuses the shared E2EE socket opener, folds relay state into fewer fields, never sends a request
whose link ended while opening, passes failure codes through, relays only this desktop's own
phones, and drops the unused host-state reader until S2 needs one.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): bound relay frames and stop sticky relay verdicts
Restores the 8 MiB frame cap on every remote runtime socket, re-checks an update-needed server on
each new link so an in-place upgrade relays, answers a phone the server just declined without
syncing again, and ends a link whose mirrored capability update cannot be queued.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): run targeted desktop-owned calls on the desktop
The phone tags every call on a workspace screen with its execution host, so a
paired-desktop method carrying `runtime:<env>` now runs locally instead of
failing 'forbidden'. The Mac stays the only reader of the routing table.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* feat(mobile): list the desktop's configured servers and their last workspace rows for the phone
The phone needs the same host list the desktop shows, including servers that are offline or
too old to relay to. mobileRelay.hosts.list/worktrees answer from the desktop's own status and
its own worktree.ps fetches, cached per server and fenced by pairing, never from relayed replies.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): list server rows through one desktop fetch, with no side effect on listing
The phone now always lists a server's rows through mobileRelay.hosts.worktrees, so the
desktop's own fetch is both the live source and the cache, and stamping stays in main.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): fetch a server's full workspace list within a bound, and forget removed servers
The desktop now asks for the phone's full-catalog limit, answers within 5s with the last rows
when a server hangs, drops a server's rows when it is removed or re-paired, and checks the
server's identity after the fetch so a reply from before a re-pair is never served.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): list managed servers as the desktop sidebar does, and hide rows mid-delete
A server Orca manages on an SSH host now lists once under that host's name, or not at all while
the host is reached over the SSH relay, using the sidebar's own folding. Rows the server is
deleting are left out at reply time, as a phone asking the server itself would see.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): keep a disconnected server's last rows, and never join a re-paired server's fetch
Retirement also fires on a manual disconnect or managed-server update, which wrongly emptied
the phone's list; rows are now pruned only once a server is no longer configured. Fetches are
shared per server identity, so a poll after a re-pair asks the new server right away.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(ci): run the remote-runtime WebSocket opener test on Node
Under the bun vitest project, `ws` resolves to Bun's built-in client, which
ignores maxPayload, so the frame-cap test hung. The opener only ships on
Node/Electron, so run its test in the Node runtime project like its siblings.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile-relay): derive the phone allowlist from the routing table
Adding a phone method now takes one edit (its route). A server-targeted call on a
legacy non-E2EE socket is refused instead of running locally, and only
execution-host methods enter the relay.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile-relay): drop unread freshness fields from server workspace lists
The phone reads only the rows, so stale, fetchedAt, totalCount and truncated
were dead wire weight. The desktop still serves a server's last rows while
the server is unreachable.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(runtime): classify the mobileRelay RPC namespace as host-owned
main now requires every runtime RPC namespace in the host-operation ownership table; the relay-hosts methods are served by the desktop the phone is paired to.
Jinwoo Hong
OrcaWinandm4air
BingZandm4air
github-actions[bot]
Neil
