* fix(editor): open the link that received the modifier-click
* fix(editor): read clicked link href from its mark, not the sanitized DOM
Tiptap blanks rendered hrefs for file:, Windows drive paths and custom schemes; resolve the clicked anchor's document position and read the link mark instead.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(terminal): retain only timings in typing diagnostics
* Remove typed text from latency diagnostics and cover task overlap
* Preserve text metadata in diagnostic lifecycle test
Catch-up scanned the whole chat journal once per retained prompt. Index prompt-to-turn matches once per reader, the same way the reader already indexes local prompts, keeping every match as a commit dependency in journal order.
Tracked in STA-12049.
* fix(editor): normalize heading whitespace when navigating the TOC
* fix(editor): resolve TOC headings containing images and document links
* fix(editor): read only text and image alt when matching TOC headings
Skip comment nodes in heading text, and trim test cases that overstated NBSP coverage or checked an inert negative path.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
NotificationCardStack publishes its height so the toaster stacks above it instead of rendering
behind it (z-47 under z-50), and lines up with the cards at 1rem. The one-time Codex shared
settings notice moves from a sticky toast into the card stack.
* Release the last closed rich Markdown editor
* test(editor): reduce retention test to one case and note configure() ordering
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(editor): preserve selected code when indenting
* fix(editor): keep Shift-Tab list outdent for selections starting outside code
Gate code-block outdent on the selection starting in (or being fully covered by)
a code block so list items containing a nested indented code block still outdent.
Remove the dead empty-indent branch, restore the DOM-less test fixture, move the
DOM-dependent undo/caret tests to a scoped happy-dom file, and trim duplicate tests.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test: run the AI Vault title-input GC check on Node
The test asserts superseded maps are garbage collected. Under Bun, whose GC
scans the stack conservatively, it can keep one alive, which failed CI on an
unrelated PR. Route it to Node with the other V8 retention checks.
* test: run the other forced-GC checks on Node too
HostRemoveDialog and the happy-dom observer retention check force a
collection like the AI Vault check; under Bun's conservative GC they can
fail or pass falsely.
* fix(native-chat): stop the saved-status writer from remembering every closed chat
The writer deduped turn-edge writes with a per-chat memo that was never
cleared, so a long-running app kept one entry for every chat it had ever
shown. Dedupe against the saved record instead, holding only edges whose
write is still in flight; a reopened chat still skips an edge already saved.
* test: cover settled chat status writer retention
* test: simplify saved status retention contracts
* fix(bash): emit the shell-ready marker when ble.sh owns the prompt
ble.sh discards Bash's own readline prompt output and draws from its own
PS1 copy, so the daemon wrapper's PS1 ready marker never reached the PTY
and every startup command waited the 15s shell-ready timeout. Print the
marker directly from the prompt hook when BLE_ATTACHED is set.
Fixes#35784
* fix(bash): detect ble.sh 0.3 and ignore inherited ble.sh variables
ble.sh 0.3.x has no BLE_ATTACHED, so key the direct ready marker on
_ble_attached, and require ble.sh's functions in this shell so a stale
exported variable cannot select the cooked-mode path and double-echo
the startup command.
* fix(bash): wait for ble.sh's decoder and drop inherited ble.sh state
Nightly ble.sh renders its first prompt, which runs Orca's prompt hook,
before the key decoder attaches and can still fail back to cooked mode.
Print the direct marker only once _ble_decode_bind_state is set, and
unset inherited ble.sh attach state before profiles so exported
variables or functions cannot select the direct path.
* fix(bash): keep live ble.sh state from a system bashrc
Bash sources /etc/bash.bashrc before --rcfile, so ble.sh may already be
attached; the unconditional unset broke its decoder attach and hid the
ready marker. Drop only exported copies, which ble.sh never creates, and
make the wrapper tests require readiness before the first command.
* fix(computer-use): replace the macOS permission status gate with one 5s launch floor (#34390)
Follows up #36028. The earlier gate grew background/explicit flags, epochs,
backoff and a setup pgrep path that reviewers could not make correct.
- Status: one probe at a time and one 5s launch floor shared by every reader, so
every path stays at <=12 helper launches/min. Readers inside the floor join the
running probe or ride one trailing probe that fires only if someone waits.
Only grants are cached (until the floor expires); denials and errors are never
served, so a grant shows within one floor locally and on web. No app epochs:
without a denial cache they bought nothing. Off macOS the gate is skipped.
- Setup: one launch per 5s across every permission, claimed synchronously; a
request inside the window is queued (latest wins) and reported as
launchQueued. Kill-and-relaunch stays so a click always re-shows the helper.
Setup reuses the gate's in-flight/cached/last result instead of probing.
- Reset checks helper availability from the bundle and invalidates after any
tccutil attempt, including partial failures.
- Remove the background flag from preload/IPC/renderer/web, the app-activity
binding, and the sidecar permission_denied invalidation.
* fix(computer-use): close the remaining gaps in the permission launch floor (#34390)
- Clear the trailing timer whenever any probe launches and re-check the floor
when it fires, so a late timer can never launch inside the floor.
- Setup reuses a denial only until the floor expires.
- A reader that joins a probe older than 300ms and gets a denial rides the next
probe, so a grant shows within about one floor even after a stale web/RPC probe.
- Setup requests are numbered on arrival, including ones that coalesce, so the
latest request wins (A, B, A launches A); a queued launch already covered by a
newer launch is dropped. Reset and will-quit cancel any queued launch.
- The settings pane says "Opening…" and the CLI says queued for queued launches.
* fix(computer-use): measure permission launch floors from real spawns and cancel setup on every host (#34390)
- Both 5s floors use performance.now, so a wall-clock step cannot stretch or skip them.
- The status floor counts from the later of claim and the actual `open` spawn, and
the setup window from after its spawn, so a slow mkdtemp or pkill can't allow a
13th spawn in a 60s window.
- Setup cancellation registers through AppEnvironment quit handlers (desktop,
headless Electron serve, orcad) and orcad's shutdown trigger; reset and
shutdown bump a generation so an Open still waiting on status never launches.
- Reset cancels queued setup before its first await.
- A setup request leaves the coalescing map when it launches, so a later request
for the same permission queues and wins (latest-wins across microtasks).
- A failed probe clears the remembered denial.
* fix(computer-use): drop setup coalescing and gate setup on a host-wide shutdown flag (#34390)
- Remove the per-permission setupInFlight map. Every Open goes through the 5s
window and seq-ordered queue; a queued request with the same args that arrived
before the last spawn was already shown by it, so concurrent same-permission
Opens still spawn once. This fixes stale entries after reset turning the next
Open into a no-op or a cancelled one.
- A cancelled Open (reset or shutdown) rejects with an error instead of returning
launchedHelper: false, which every client rendered as "setup complete".
- Replace the per-host cancel calls with src/main/host-shutdown-state.ts, set
synchronously by Electron will-quit and orcad's shutdown admission; setup
checks it before every spawn, including the queued timer.
- Track the status cache's expiry from the probe that produced it, so starting a
new probe cannot revive an expired grant.
- The queued setup timer re-checks its deadline and re-arms when early, and both
timers round delays up; a throwing spawn there is logged, not uncaught.
* fix(computer-use): keep setup latest-wins after slow probes and surface cancelled setups (#34390)
- Record the launching request's seq; an older request that resumes or is queued
after a newer one spawned is dropped, so latest-wins holds when requests
resume out of order behind a probe.
- orcad sets the host shutdown flag on every cleanup entry, including failed
startup.
- The web facade only falls back for hosts without computer.permissions; other
failures, such as a cancelled Open, reject so the pane and onboarding show them.
- The cancellation check runs before an untargeted Open can report everything granted.
- Opens that arrive mid-reset wait for it, so reset's helper cleanup cannot kill
what they open.
- Queued wording now says a newer request or a reset may replace it.
* fix(computer-use): wait out a reset before an Open reads permission status (#34390)
* feat(telemetry): report plugin installs and removals from Orca's public catalogs
* refactor(plugins): move marketplace install origin out of the installer
* fix(wsl): main's background start preps its host env without waking the distro (E9)
* fix(wsl): daemon-off background starts prep their env without waking the distro (E9)
* fix(acp): update Antigravity model and effort metadata
* fix: confirm ACP model families and idle option metadata
* Preserve provider-owned model and effort selection
* test: repair model option host and consumer fixtures
* Use the provider child type for optional delivery ownership
* test: match model option fixtures to their protocol contracts
* fix: isolate resting options from adapter type dependencies
* Preserve Antigravity option fixture types
* Match option fixture control response contract
---------
Co-authored-by: Vyacheslav Scherbinin <gentslava@mail.ru>
* fix(editor): preserve literal text in citation paste fallback
* test(editor): drop paste-meta implementation assertion from fallback test
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Find stale lowlight decorations of touched code blocks in the old DecorationSet, remove them, then map only the survivors instead of mapping every span and searching by mapped bounds.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(claude): ignore a launcher's own version when choosing hook events
* Bind Claude capability versions to identified output
* Complete Claude version probe test process results
* perf(editor): collect review note elements once per geometry pass
* test(editor): drop selector call-count tests for review note heights
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(editor): scope delayed review saves to the current draft owner
* fix(editor): drop unreachable root/editor-swap checks from review submit guard
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* feat(computer): send tree diffs after actions and add get-app-state --query
Action results now carry only the accessibility-tree lines that changed since
the caller's last view of the same window (~ changed, + added, - removed as
index ranges, or an explicit no-change line), plus the focused element. The
runtime sidecar keeps the last tree per session/worktree and app, so all three
providers get it. The CLI opts in with treeDiff; older runtimes strip the
param and keep returning the full tree, and --full-tree opts out.
The macOS helper now keeps an element's index across snapshots of a window:
AX identity first, then the next unclaimed index with the same signature for
views that rebuild their AX objects, and never reuses a removed index.
get-app-state --query prints matching elements with their ancestors and
--max-elements caps the output, both in the CLI over the rendered tree.
Custom action names with raw newlines no longer split an element over lines.
* fix(computer): preserve parent changes in snapshot diffs
* fix(computer): refuse stale index reuse for lookalike controls
* fix(computer): print full trees in action replies
* fix(computer): keep controls located in snapshot replies
* fix(editor): preserve combining marks in whole-word replacement
* fix(editor): keep whole-word boundaries after emoji presentation sequences
Resolve a leading combining mark to its base character so VS16 after an
emoji does not count as a word character, treat enclosing marks (keycaps)
as symbols, and drop the redundant hook-level undo/redo test.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(computer): fail set-value when its read-back shows a different value
A value_mismatch came back as ok with exit 0, so callers that check only
the exit status took an ignored or misplaced write as success. The runtime
now turns it into a verification_failed error at the sidecar boundary,
which covers every provider and every caller of the RPC.
Part of #33511
* fix(computer): pair macOS AX windows with their CGWindowID
AppKit and WebKit windows don't answer AXWindowNumber, so matching a
capture to its accessibility window fell back to frames. Two windows with
the same frame then paired the screenshot of one with the tree and title
of whichever AX listed first, under the first one's id. Read the id with
_AXUIElementGetWindow, as yabai and Hammerspoon do, and keep AXWindowNumber
as the fallback.
Fixes#27252
* fix(computer): fail fast when a macOS app stops answering accessibility
Every request runs behind one helper lock, and a hung app cost a timeout
per AX read, so one get-app-state on it held every agent for up to the 60 s
RPC timeout. Pin the AX messaging timeout at 1.5 s, refuse an app that
doesn't answer a root probe, and stop a tree walk at the first read that
waits out the timeout, each with an action_timeout error.
A press or write that the app received but didn't answer now fails the
same way, saying it may have taken effect. Before, the click fell through
to AXConfirm and then a synthetic click, so a button whose handler blocked
ran twice, and type-text typed the text again as keys.
* fix(computer): report macOS accessibility actions that changed nothing
AXPress and other accessibility actions came back as plain unasserted
success even when the app ignored them, as Chromium does for a role=button
whose handler sits on a child. After such an action the helper now compares
the target's tree, frame and on-screen windows with the snapshot it took
just before. If they still match after re-reading for about a second, the
result says unverified/suspected_noop; if they change late, the result
carries the settled state instead.
The new reason is additive; older CLIs print it like any other reason.
Refs #31758
* fix(computer): propagate late macOS observation failures
* fix(computer): select existing text before replacement
* fix(computer): share native macOS window identity
* fix(editor): honor Plain text code block highlighting
* fix(editor): trim Plain text highlighting tests and drop redundant guard
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The N/10N case asserted exact start/peak/permit counts across concurrent work under fake timers and failed intermittently on CI (expected 3 to be 4). The phone dispatch/retirement and shared-context tests in the same file still cover the user-facing behavior.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
OrcaWinandOrcaWin
Jinjing
Brennan Benson
Neil
Jinwoo Hong
Kelvin Amoaba