Retire queued continuation echoes when transcript rows represent the sends. Preserve literal backslashes, occurrence boundaries, and image barriers on mobile and desktop.
Closes#15288.
Adapted from #15283.
Co-authored-by: grboy6770 <2000grboy@gmail.com>
Preserve Cursor identity across imported Claude hooks and mobile terminal tabs while retaining current tab status, rename, and scroll behavior.
Closes#30543.
Adapted from #30544.
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
* refactor(editor): one running + one queued save per tab, settle instead of cancel
Saves now run one at a time per tab with at most one queued save behind
them; later requests join the queued save, which reads the latest text
when it runs and writes nothing if the tab is already clean. Writes to
one physical file (edit tab, unstaged diff, combined-diff section) share
one lock. Quiesce no longer cancels saves: it flushes pending text, drops
the autosave timer and waits for the running and queued saves. Autosave
and restart write through the first view whose owner is still current.
Removes save generations, bumpSaveGeneration, the exported
clearAutoSaveTimer, the model-URI queue key and the unbounded save chain.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): Don't Save drops edits before draining saves; one lock key
Don't Save now marks the tab clean and clears its draft before waiting
on saves, and a save requested while the tab was dirty writes nothing
if the tab is clean when it reaches the write (Overwrite excepted). A
queued or not-yet-writing save can no longer put discarded text on disk
or recreate a deleted file. A Cmd+S on an already-clean tab still writes,
so a tab whose file was deleted can still recreate it.
Editor saves and combined-diff section saves share one lock key and
skip the lock when the file's host is unknown.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(editor): type-safe held writes in save queue tests
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): a discard voids every save asked for before it
Don't Save bumps a per-buffer discard epoch alongside clearing the
draft. A save whose epoch is stale writes nothing, Overwrite included,
and skips the pending-edit flush that could republish the discarded
text. Dirty state alone wasn't enough: a notebook's retained cells or a
remote snapshot can re-dirty the tab after the discard.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): stop discarded bytes at the send and hold autosave through Don't Save
A save that passed the discard check could still send discarded content
after a remote host's status/capability round trip or an older host's
compare read. The writer now takes a last-moment check, run just before
the bytes are sent on every path (local, unguarded, guarded, older-host
fallback, retry); a discard in that window aborts the send.
Don't Save's drain no longer flushes pending editor text, and it holds
autosave for the file until the tab is closed, so a view that
republishes the dropped text mid-drain can't schedule a fresh autosave.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Removing a workspace closed its editor tabs and threw away unsaved text
without a word, including with "Don't ask again" on.
Removal confirms now list the files whose unsaved edits the removal
discards: the tabs the purge itself would close (host twins included),
kept only when no view sharing their model or record stays open. Editable
unstaged diff tabs count; delayed rich Markdown, CSV and notebook text is
flushed first.
- Delete Workspace dialog: the list sits with the git-change warnings.
While it is non-empty the dialog no longer starts focus on Delete, and
"Don't ask again" no longer skips the dialog.
- The same list in Remove Project, SSH workspace forget/reconnect-and-
delete, SSH host removal with its workspaces, nested-worktree deletion
(rows matched by path containment under the parent) and project-group
deletion with its contained projects.
- Removals with no dialog whose files stay on disk refuse instead, with
"Save or close N unsaved files in <name> first": folder-workspace
delete (card action, context menu, hovered shortcut, through one shared
helper) and Settings > Remove Project.
Force retries with no list of their own (the failure toast's Force
Delete / Delete Anyway, Space's Force button) re-check at that moment and
refuse the same way. A folder-workspace delete that leaves a same-id
folder on another host closes no tabs, so it is not refused. Removal
confirms touched here render on the security surface.
Removals with no prompt (CLI, automations, paired clients) behave as
before; a follow-up offers their text back.
Known limitation: the list is decided by the tabs a removal closes, not
by paths; a symlink into a deleted folder is not resolved on the host.
Co-authored-by: Claude <noreply@anthropic.com>
* feat(settings): the default agent can be set to open as a chat or a CLI
With Chat UI on, Settings > Agents > Default Agent now shows a Chat | CLI
choice for the selected agent. It writes the same per-agent chat switch
that Chat > Providers and the + menu already use, so no new setting is
saved and the two places can't disagree.
* test: type the store stand-in without an assertion
* chore: drop accidental lockfile churn
* fix: clarify default agent launch preference scope
* refactor(renderer): name the owner adapters for what they do: resolveOwnerOrLocal, runtimeEnvironmentIdOrLocalUnlessTwin
The Active Server focus fallback they were named for is gone (#31058, #31119); what is left reads an
id no row places as this app's (a folder's saved-session server, a web client's only server).
* docs(renderer): resolveOwnerOrLocal keeps a named host's miss; baseline note names the setup-terminal read
orcad-browser-provider and the pinned runtime materializer each kept a private
errorMessage; the WSL holder record and the secret-key record kept private
error-code checks, and the secret-key record its own kill(0) liveness check.
They now call errorMessage, hasErrorCode and isProcessAlive.
Comments and one log line still said a host falls back to the relay, keeps
the pinned-relay ladder, or shares code with the relay's spawn and install
paths. No relay client exists; an unserved host fails its connect with a
reason, and the legacy bridge only keeps old relay terminals alive.
The SFTP/exec-stdin transfer helpers, their options type and the install
timeout still carried relay names from before orcad; they install the orcad
bundle and the Node runtime. The timeout's derivation from the relay's
native-deps budget is replaced by its value and the reason for it.
* Preview HTML files by default across file-opening flows
* Centralize workspace file opening and HTML preview routing
- Preserve source, diff, and host-safety behavior across all entry points
- Reuse previews within the requested editor group and support branch HTML files
* Respect working tree state when opening HTML previews
* Route HTML links through owning workspaces and editors
* Preserve HTML preview state and refresh changed local files
* Resolve HTML preview hosts from workspace ownership
* Update file-opening tests for HTML preview routing
Four twin checks (sort stamps, sidebar unread, sort-order notify, worktree-meta owner)
each rebuilt new Set(repos.filter(id).map(getRepoExecutionHostId)). Name it once as
getRepoRegistrationHostIds in shared/repo-host-identity.
* fix(ssh): name what refuses an SSH host's move, and offer Move anyway in the terminal pane
The refusal line said only "something on the host stops the move" and hid main's
reason (which already names the blocker and the way out) behind a Details menu,
and the terminal pane banner dropped it entirely. The line now shows that reason,
capped inline with the whole text behind Details, and the pane offers Move anyway
for a refusal saved state alone causes.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(ssh): keep a refusal's way out in the pane, and don't race a connect in flight
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Seven runtime decisions read repo.connectionId, so a row naming its SSH host only as
executionHostId 'ssh:<target>' read as local: the missing-worktree sweep killed local PTYs
unfenced, the drift probe ran local git on a remote path, relay recovery skipped its mobile
tabs, and agent launch picked this machine's platform. Route them through
getRepoRoutingConnectionId, drop a dead includeLocalRegistry branch, and shrink the
repo-host-read ratchet from 91 to 81. resolveRepoForConnection keeps the raw read: it
matches the raw id a client sends.
getStoredRepoSshConnectionId and seven inline
getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo)) spellings answered the same
question. Name it once in shared (getRepoDialableSshTargetId), build
getRepoRoutingConnectionId on it, and drop the getRepoHostedReviewExecutionHostId re-export
alias in favour of a direct import of getStoredRepoExecutionHostId.
flushDurableStateOrThrowAsync and six exported types (AgentSessionSpawnTokenScanEvidence,
FreshExplicitAgentStatus, LiveTerminalPty, RemoteStartReceipt, WorkerStartMode(Reason),
WorktreeTeardownStopPty) had no reader anywhere in src, mobile, config or tests.
Five modules each declared the same all-null census for a daemon that could
not answer; they now use one frozen constant from the shared census module.
Removes the relay ladder's answered-failure predicate, the unused test-probe
joins, two dead renderer broadcast helpers, the bound-port reader the tunnel
no longer uses, the WSL terminal-verdict mapper the supervisor never called,
and an unused type.
The window stamps it (equal to ORCA_WORKTREE_ID) for every workspace kind and agent
wrappers forward it; terminals started from the phone, the CLI or a server's own create
in a git worktree lacked it.
* fix(editor): remote models are keyed by an owner authority, so TSX parses and imports stay on one host
Remote editor models were keyed `file:///path#<owner>`. Monaco's TypeScript service names files by
URI, so the fragment hid the `.tsx` extension and imports resolved across hosts. They are now
`vscode-remote://<owner hash>/<host path>`: the file name stays last, and TypeScript treats
`scheme://authority/` as a root, so `..` can't climb into another owner's tree or into local
`file:` models. Monaco keeps closed-file undo for this scheme, and its default label service shows
the URI path, so peek, references and snippet variables show the host's path with no override.
Local models keep their `file:` URIs. A UNC server moves into the path.
A parity test proves exactly the same tab pairs share a model as before; model URIs stay in memory.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): key remote UNC models so the TypeScript worker finds them
A remote UNC file was keyed `vscode-remote://<owner>//server/share/a.ts`. TypeScript collapses the
doubled slash, but the worker looks models up by exact URI, so hover and definitions failed. UNC
paths now mark the owner authority (`<owner>-unc`) and keep `/server/share/a.ts` as the path, which
stays distinct from the same POSIX path. Test-only Monaco module types move out of env.d.ts.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(orcad): hold terminal admission from a stop's start until exit; fence rollback and restart counts
Once orcad begins any stop (signal, managed stop request, idle exit), its terminal
admission stays closed until the process exits, past an update census's 60s fence
or a deferring desktop's reopen. Rollback and restart now take their count through
the same fenced recount the update uses, reopen admission when they leave the
server serving, and stop nothing once that count may have outlived its fence.
* fix(orcad): check the rollback's stop deadline after its transaction write
* fix(orcad): rollback and restart recount under the host lock; a reopen never wakes a server
Only the lock holder closes or reopens a server's terminal admission, so a
rollback or restart that loses the lock can no longer clear another update's
fence. A reopen skips the serving check, so it never starts or recovers a
stopped server, and a stop that begins before the runtime binds still holds.
* fix(orcad): reopen admission when a rollback's stop was withdrawn
* fix(orcad): keep admission closed after a stop that may still be on its way
* refactor(orcad): route update, rollback and restart through one fenced stop
runFencedStop is the single count, close, stop, reopen-on-abort sequence. The
update's activation, the rollback and the restart each supply only their own
refusal, journal step and stop; the reopen and deadline rules live in one place.
* fix(session-search): Project search works for projects with hundreds of worktrees
A Project-scope search showed "The search index is not ready yet" on a fully
indexed computer when the project had ~500 or more worktree paths outside a
shared workspace folder. Each scope path added an OR arm to the session filter,
and past ~495 arms SQLite refuses the statement ("Expression tree is too large
(maximum depth 1000)"); the desktop then reported the thrown search as not-ready.
The scope ranges now travel as one JSON parameter read through json_each, so the
statement has the same shape for any number of paths and each path is still a
seek on sessions_cwd_key. A failed search is also logged before it is reported
as not-ready.
* refactor(session-search): one scope subquery with one parameter; keep lone-surrogate scopes matching
One json_each join with the exact-or-range ON plans as a MULTI-INDEX OR seek,
so the UNION ALL and second bound copy go. Scope keys are made well-formed
before JSON, since a bound key stores a lone surrogate as U+FFFD and JSON
would decode it to other bytes. The plan test now also catches a scan of the
aliased inner table.
* fix(mobile): warn about unwakeable agents on a windowless server only when the workspace really has slept agents
A running ('live') or quit agent's resume record made a windowless server tell the phone
'Open Orca on the host to wake sleeping agents.' Count only real sleep records, using the
shared isPaneSleepRecord predicate.
* refactor: move the headless wake check into a shared hasSleptAgentToWake predicate
* docs: say a live or quit record is resumed by its own pane
* test: build the headless wake report store from the shared partitioned fixture, without casts
* test: make a host-less session read miss the record, so the SSH partition test proves the named-host read
* Mobile chat composer uses desktop's placeholder
The phone composer said "Message Codex" (or "Message, @files, /commands") while desktop says "Ask anything, @ to mention files, / for commands". Both now read the one string from the shared native-chat copy table, so they can't drift again.
* Ship the shared composer placeholder in the runtime English catalog
* Keep the composer placeholder beside, not inside, the turn-status copy
The turn-status table maps one-to-one onto the status.* catalog keys; the placeholder is composer.placeholder, so it gets its own constant and its own catalog check.
* Read the composer catalog without a type assertion
* Read the composer placeholder from the typed catalog directly
* feat(native-chat): a Codex chat shows the turns made outside it
When a Codex chat's agent opens its conversation, Orca reads Codex's own saved
turns and adds the ones the chat doesn't have, after the chat's rows, behind a
quiet "Continued outside this chat." divider. Turns are matched by Codex's own
turn ids, read whole before anything is written, and never re-imported; a chat
imported from a transcript gets only turns started after the import. A failed
or partial read adds nothing and the next open tries again.
* chore: remove accidental package manager lockfile churn
* test(codex): expect restored turns with optional timestamps
* test(codex): run catch-up SQLite fixtures under Node
* Make Codex history catch-up atomic and preserve adoption origin
* Keep imported Codex history separate from send delivery
* Derive Codex history reconciliation from saved journal facts
* Validate saved Codex turn identity before planning its notice
* Align Codex catch-up fixtures with current journal contracts
* Check oversized item echo declarations by their saved identity
* test: retain Codex catch-up flow and concrete regressions
The card rebuilt its Linear source context on every workspace write, and both
card Linear effects listed that object as a dependency, so a comment, agent
status or activity update re-ran them and refetched the issue whenever the 60s
cache had expired. Hold the context while it is equal to the rebuilt one.
Tracked in STA-10988. Same approach as community PR #30090.
* feat(agents): Create worktree and continuation pickers offer chat or CLI per agent, like the "+" menu
The Create worktree, Create folder and session-continuation agent pickers now
list the same rows as the tab bar "+" menu: chat agents first, each with a
terminal button that picks the agent's CLI instead, then the agents that only
run in a terminal, labelled "(CLI)". A terminal pick shows as "Claude (CLI)"
and starts the agent in a terminal even when chats are the default.
A continuation into a subfolder shows chat as unavailable there.
* fix(agents): picker rows keep the combobox item spacing instead of restyling CommandItem
* chore: drop accidental lockfile churn
* fix(agents): type the surface picker's props and the composer's agent rows
* fix(agents): submit the picker selection captured by each form
* test(agents): include repository identity in continuation fixture
* fix(agents): settle inventory when workspace ownership is unresolved
* test: hydrate workspace owners in quick launch fixtures
* fix(terminal): start every terminal in the workspace root when its saved folder is gone, and say so
A terminal whose start folder was deleted opened at the workspace root only
when the window started it; the CLI, phone restore, orchestration and other
host starts failed with the raw "Working directory ... does not exist" error,
because the renderer had to opt in with a cwdFallback flag.
The execution host now makes that decision for every start that may create a
process (anything but a known live pane), with no caller flag. The fallback is
reported only when a process was proven started at the requested folder, so a
reattach or a crash restore in its recovered folder never claims "workspace
root", and only then does the saved start folder heal. A recovered folder that
was itself deleted yields to the request's resolved folder.
The notice reaches each caller through surfaces it already has: the window's
terminal line (now also written when a host-created tab attaches, and on a
restored reattach), the agent.launch warning (also for callers that show the
tab themselves), and a toast when a phone tap restores the tab.
* fix: recover terminal startup folders without healing unreadable paths
* fix: preserve saved start folder when revealing fallback terminals
* Reuse saved-tab lookup in cwd persistence test
* Import mobile tab activation result from its contract
* Check startup fallback response without a test cast
* Update expectation to catch up with accepted saved-folder metadata
* Preserve inconclusive WSL directory evidence when saving startup folders
* fix: project restored terminal ids for handle consumers
* test: return void from launch parity cleanup
* test: retain saved folder in shared spawn expectation
* fix(terminal): a CLI or phone close through main keeps a pinned tab, as the window-era close did
* feat(terminal): main applies phone closes, renames, pane titles, sleeps and agent-launch tabs itself, with or without a window (layout-owner build)
* fix(terminal): a tab close through main also ends the tab's dormant SSH relay session; agent-launch tabs main writes keep the window's focus rule, prompt and outcome (layout-owner build)
* feat(terminal): main starts a new tab's first terminal under the window's ids, and the pane attaches to it (layout-owner build)
* test(terminal): tests that counted the window's create calls or publications see main's start of a new tab
* fix(terminal): an account-switch restart binds only into a pane main's layout holds, with no window tree (layout-owner build, L197)
* test(terminal): the new-tab start tests hold no type assertions; the start's ledger row is L252
* fix(terminal): a new tab's pane attaches to any terminal main binds it to, and a failed start keeps the tab's startup
* test(terminal): a Claude account-switch restart's tests draw the pane main holds
* fix(terminal): a launch pane main takes back still tells the window why, which drops its hold and prompt; a rename through main answers the name it stored (layout-owner build)
* fix(terminal): a new tab another owner's terminal won attaches to it, and a failed start's startup never runs twice
* fix(terminal): main's pane close reads its stop result as a type only, so no runtime module loads before its base class
* fix(terminal): a phone's close through main drops the closed rows from what phones list at once, not at the window's next publish (layout-owner build)
* chore(terminal): mark the phone-close row drop interim (ledger L260)
* test(worktree-create): a new local tab's startup counts as run when main starts it (layout-owner build)
* test(worktree-create): record main's starts without a type assertion
* fix(terminal): a tab closed before main declines its start gets no startup back (layout-owner build)
* fix(terminal): the window's new tab starts in main when its own window asks over IPC, which labels itself a client (layout-owner build)
* fix(terminal): a refused close of a pinned tab leaves its running agent launch alone (layout-owner build)
* fix(sidebar): land flip-a's switch-on fixes on main, still dark (no flip)
The fixes found while the sidebar ran from main's feed, without turning
that on: ORCA_SIDEBAR_INPUTS_IS_MAIN stays false, and none of flip-a's
stop-gaps come along.
- Main stops counting a closed tab's terminal once it was asked to stop
and no pane shows it; a failed or refused stop takes the request back,
and a host out of contact stays unverifiable.
- Main fetches a paired server's rows with the transport's normal bound,
so a server slower than 5 s still lists.
- A deferred unread raise flips the folder row it was decided for, and a
read while the owner check is out cancels it.
- Phone: no worktree.ps flash before the feed; a host's last installed
feed stands in while a fresh read is out; it highlights its own
last-opened workspace and a fold never scrolls; projects file under
their project group with the desktop's indent; the collapse spinner
shows only after 500 ms; "Reopen to update" keeps the rows on screen.
- e2e helpers and journeys for the switch-on suite.
* fix(sidebar): keep an owed relay stop marked, clear a thrown stop, and prune pending unread raises
- A stop-and-wait that throws takes its stop request back, like one that fails.
- A final stop the legacy relay still owes stays marked, since the relay retries it.
- Pending unread raises are tracked only while one waits, so the map no longer grows.
- The paired-server fallback poll test gives its third fetch a reply and asserts live.
* feat(sidebar): main publishes cached snapshots and announces its own stores; detected, view and live-content domains (inert)
* fix(sidebar): keep links confirmed only by a new git run, no rescan on metadata writes, no phone wait on detected checkouts
* fix(sidebar): rescan the workspace rows when the Windows runtime default changes
* test(sidebar): gate the 1000-workspace publish cost on its median
* test(sidebar): name the git-run token type in the identity test
* Editor tabs main-first: the window sends each editor action to main and draws editor tabs only from main's frames (dark, layout-owner build only)
With ORCA_LAYOUT_OWNER_IS_MAIN on, editor open (preview replace, open to the side), reopen at
its position, close, close-all, promote, the resolved conflict placeholder, a restored-editor
move and a disk rename are layout commands the window sends before it draws anything. Window
content (open file records, drafts, buffers, the autosave gate) is written at once for an open,
and rekeyed in the same store update as the frame for a move or rename. Main publishes each
non-edit tab's view, keeps views in memory across applies and partition changes, stamps the
tab's time, folds same-file duplicates, and republishes a windowless host's session.tabs after
its own file open. The switch-off path is unchanged.
* test(d3a-2): the buffer view index follows a rename main answers
* test(e2e): the old-phone baseline records a windowless server opening the file, as main does since #31291 (test only)
* fix(sidebar): land flip-a's switch-on fixes on main, still dark (no flip)
The fixes found while the sidebar ran from main's feed, without turning
that on: ORCA_SIDEBAR_INPUTS_IS_MAIN stays false, and none of flip-a's
stop-gaps come along.
- Main stops counting a closed tab's terminal once it was asked to stop
and no pane shows it; a failed or refused stop takes the request back,
and a host out of contact stays unverifiable.
- Main fetches a paired server's rows with the transport's normal bound,
so a server slower than 5 s still lists.
- A deferred unread raise flips the folder row it was decided for, and a
read while the owner check is out cancels it.
- Phone: no worktree.ps flash before the feed; a host's last installed
feed stands in while a fresh read is out; it highlights its own
last-opened workspace and a fold never scrolls; projects file under
their project group with the desktop's indent; the collapse spinner
shows only after 500 ms; "Reopen to update" keeps the rows on screen.
- e2e helpers and journeys for the switch-on suite.
* fix(sidebar): keep an owed relay stop marked, clear a thrown stop, and prune pending unread raises
- A stop-and-wait that throws takes its stop request back, like one that fails.
- A final stop the legacy relay still owes stays marked, since the relay retries it.
- Pending unread raises are tracked only while one waits, so the map no longer grows.
- The paired-server fallback poll test gives its third fetch a reply and asserts live.
* fix(session-tabs): a windowless layout-owner server lists and pushes main's tab groups and order
With the layout-owner switch on and no window (orca serve, orcad), session.tabs rows came from
the snapshot hydrated from the saved session; main's layout was merged in only when a window
published. A routed reorder or Move to Split reached main's layout but not session.tabs.list or
the phone. Main now merges its layout into the rows it holds on each layout change and before
each list, with the same merge a window publication gets.
* refactor(session-tabs): keep the windowless merge with main's publisher, under the file's line cap
* WIP
* fix(session-tabs): every stored tab row follows main's layout, with or without a window
With the layout-owner switch on, the one writer of the rows phones read now merges main's
layout into every write for a workspace main owns, and main re-merges the held rows after
each layout commit on any host. A CLI rename, create or close reaches phones without a
window publish, and a row main's layout dropped cannot come back from an older snapshot.
A write that main's layout wholly overrides stores nothing, so list calls on settled rows
bump no version and push nothing. A pane's own title now counts as a manual name.
This commit also untracks a local vitest config and a scratch test that the previous
work-in-progress commit picked up by mistake.
* test(session-tabs): a rebuild from the saved session and a CLI rename keep main's groups and names on phones
* fix(session-tabs): the row writer only reorders and regroups; layout commits add main's new rows
With the layout-owner switch on, the one writer of the rows phones read now takes only main's
tab order and groups. It never adds or drops a row and never replaces a terminal id, so a
freshly started terminal keeps its id and rows the exit filters removed stay removed.
After each layout commit, on any host, the held rows take main's new rows, names and order,
keep any row main's layout lacks (closes are the close path's job), and pass any added
terminal through the same exit filters the window path uses. A main binding that runs nowhere
no longer replaces a running terminal's id. Both read main's last projection, so neither
adds a session read per write or per workspace.
A CLI close still leaves its row until the dropped-leaf hook lands; its test is marked as an
expected failure until then.
* test(session-tabs): the row writer's order and a commit merge's keep rules, unit by unit
* fix(session-tabs): a kept row keeps its group, and an unchanged commit pushes nothing
A layout commit's merge placed a row it kept (a tab main closed, until the dropped-leaf hook
removes it) by its row id, but groups list a terminal by its tab, so the row fell into the
active group. Both the writer's reorder and the merge now place rows through one shared
group-placement step keyed by the tab.
A commit now pushes only when the writer stored something. The writer skips a write only
when it keeps the stored occupant, publication and retirement proofs. A terminal row a commit
rebinds also passes the exit filters, a main binding the host saw exit no longer replaces a
running terminal, and a binding main made before its terminal connected reaches the rows when
it connects.
* test(session-tabs): a kept row's place and the no-push commit are separate tests
* fix(session-tabs): a rebuild with a new publication stamp is still skipped; simpler commit merge
The writer's skip compared publication stamps, but a rebuild from the saved session mints a
new stamp from the clock each time, so every rebuild minted a version and pushed. It now
stores only for a different workspace instance or new retirement proofs; an absent one keeps
what is stored.
The commit merge again runs the exit filters only for added terminal rows (they admit any row
the held rows list, so a rebind changed nothing), and a terminal connecting now schedules the
merge itself rather than a separate check, since an unchanged merge stores and pushes nothing.
* refactor(session-tabs): a commit merge pushes after every store again; name the window-path exit test
No reachable case was found where a commit merge's rows differ from the held rows while the
writer keeps the stored ones, so the extra "only when stored" check had nothing to guard and
goes. The exit-rule test now says it covers the window's publication path too.
* fix(session-tabs): a window reload's new publication stamp is stored, not skipped
The writer skipped a write that main's order wholly undid without comparing publication stamps,
so a window reload that republished the same rows under a new stamp kept the old one. The
reconciler then saw its accepted stamp missing and asked the window to republish on every sync,
and a host-built stamp could stay on window rows. The skip now treats stamps as unchanged only
when both are host-built, so repeated rebuilds from the saved session still mint nothing.
The windowed test of a row main's layout lacks also replays the window's older snapshot.
* Transfer keyboard focus when a sibling chat pane opens
* fix(native-chat): hand focus to newly opened chat composer
* fix(native-chat): keep tab bar controller within line limit
* fix(chat): use terminal pane opacity for split chat focus
* test(chat): verify split opacity follows the focused group
* fix(chat): an unfocused split chat dims exactly as much as a split terminal
A split chat was dimmed with the terminal's inner-pane opacity (0.9 by
default) while terminals and editors in an unfocused split group get the
group's 0.95, so chats looked dimmer than terminals beside them. The chat
layer now takes the same shared group dim and nothing more.
* fix(chat): terminals and chats in an unfocused split dim like editors
Editors and tab bars in an unfocused split group were dimmed to 0.95, but
terminals and chats are drawn in a layer outside the group, so they stayed
at full opacity. One shared opacity now dims the group panel and the
retained terminal and chat hosts alike, so all three look the same.
* fix(browser): a paired desktop shows a server's browser tab without opening a second page (switch-on builds only)
With the layout-owner switch on, a server browser tab drawn from the server's layout
reaches the desktop without a saved page handle. Showing it made the desktop create a
new page on the server, so the server went from one page to two.
Before creating, the desktop now asks the server for its browser pages and adopts the
one already named by the tab's page or browser tab id. It creates a page only when the
server has none, when the lookup fails, or when the server gives no list. A pane that
moved on during the lookup adopts nothing. Switch-off builds keep creating directly.
* test(browser): explain the fake runtime call's cast in the page session test
* fix(browser): adopt a server's browser page by the id its layout already names, not by listing pages (switch-on only)
This replaces the tab-list lookup. A tab list misses saved pages a restarted server has
not started, wakes the active saved page as a side effect, and can match a page another
client hosts.
The server's layout already records the page id on the browser tab. Desktop hydration
ignored it whenever the page record had not landed yet, and made up a new id on every
frame build. With the switch on, hydration now uses the tab's recorded page id, so the
desktop row is named by the server's page from the first frame and stays named by it.
A frame-drawn row still has no saved page handle: hydration has none for server-hosted
pages, and the server environment is known only to the pane. So, with the switch on, the
pane probes its row id with browser.tabShow. tabShow also starts a saved page the server
has not opened since a restart. On success the pane stores the handle and streams that
page. On not-found, or any other error, it creates a page as before and closes nothing.
A pane that moved on during the probe adopts nothing.
Why not reorder the server to save the page record before opening the tab: it would only
fix the id, not the missing handle, so the probe is needed either way. The page record
write also depends on the tab main writes asynchronously, so the order cannot be made
certain from the server alone.
* test(browser): explain the lifecycle harness's fake runtime call cast
* fix(browser): create a server browser page only when the server lacks it, and prefer the tab's active page id
The switch-on probe created a page after any tabShow failure, so a timeout or a brief
connection error could duplicate a page the server still runs. Now only a page-missing
answer creates one. Any other error is raised, as the stored-handle path already does, and
the pane shows its stopped state with Reconnect.
Hydration now names a tab's page by its recorded active page before its first page id,
which matches the page the server starts for a saved tab.
* perf(orcad): keep the server bundle ASCII so V8 stores it one byte per character
129 non-ASCII characters in regex literals (and three in a String.raw plugin
template) made V8 hold the whole ~11 MB orcad-server.js source as a two-byte
string. Write them as \uXXXX escapes and fail the build if any return.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(orcad): keep license comments ASCII and name the module the guard trips on
esbuild gathers legal comments at the end of the bundle; escape that comment so
a dependency's license text cannot fail the ASCII guard, while licenses still
ship with the code. The guard now reports the offset and, from an unminified
rebuild, the module the character came from. A dark-switch build is covered.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
A WSL distro is always a POSIX host and its deploy already detected Linux, so
the bridge skips the second uname round trip (100-150 ms per connect). SSH hosts
still probe exactly as before.
Co-authored-by: Claude <noreply@anthropic.com>
NeilandTauri-EPO
Brennan Benson
Jinjing
Jinwoo Hong
Kelvin Amoaba
