* feat(native-chat): image messages wait in the queue like text
A message with images now queues behind the running turn and the cards
ahead of it, instead of skipping the queue. Cards show an image icon and
count, an image-only card names its image, and editing a card's text keeps
its images. The host publishes no card holding an image to a client that
has not advertised agent-session.queued-image-cards.v1, since released
clients edit by copying a card's text and deleting the card.
* test(native-chat): an image follow-up queues like text
* fix(native-chat): project queued images before phone frame limits
* fix(native-chat): preserve image sends from older clients
* Clarify direct text recovery at send admission
* fix(native-chat): expose queued image names to keyboard users
* fix(mobile): edit queued messages in place
* fix(mobile): use the platform input font size for queued edits
* fix(mobile): handle missing host support while probing queued edits
* Keep phone queued edits owned through save settlement
* Keep phone queued edits local to mounted chat
* fix(mobile): retire queued editor when its card disappears
* fix(mobile): retain queued edits while reconnecting
* test(mobile): await reconnect timer inside act callback
* fix(mobile): publish queued edit transport after commit
* test(mobile): await queued Edit inside act callbacks
* fix(mobile): hand a stale queued Save to the composer and reopen on the newer text
* fix(mobile): close an unchanged queued Save locally and keep stale typing in its own chat
* fix(mobile): explain disconnected queued edit refusal
* fix(mobile): combine queued session contract imports
* feat(native-chat): one queue header that becomes the pause row; no composer Resume or send dialog
The queued cards now sit under one header row on desktop and phone: "Queued"
and the count normally, and "Paused" with the count, Clear all and Resume
while the host holds the queue after a Stop. A chevron folds only the cards;
the choice is local to the view and resets when the queue empties.
The composer's Send no longer turns into a second Resume, and a message sent
into a paused queue no longer asks "Send message?": it sends, its accepted
turn lifts the pause, and the cards follow it. Clear all deletes every card
through the existing per-card delete. No wire or host change.
* test(mobile): find the background-tasks strip's toggle inside the strip, not the queue header's
* Make queued Clear all atomic across clients
* Show queued message failures in collapsed headers
* Use per-card delete for paused queue Clear all
* Join repeated paused queue Clear actions
* fix(native-chat): a queue action still on its way greys its controls, like the phone
The desktop kept in-flight queue actions only in refs (one per card, one for
Resume, a joined promise for Clear all), so on a slow or remote host pressing
Clear all, Delete, Steer or Send changed nothing on screen until the host
answered. One keyed in-flight set, held as a ref and as render state, now
covers cards, Resume and Clear all; Clear marks every card it deletes.
* fix(native-chat): Resume and Clear all refuse each other in the queue guard; the steer chord skips a card already on its way
Resume and Clear all now hold one shared in-flight key, so each refuses the
other in the guard rather than only in the drawn state, and both header
buttons grey on it. Cmd/Ctrl+Enter returns false when the newest card's
action (or a Clear deleting it) is still out, so the chord no longer
scrolls to the latest with nothing sent. Test controllers gain the new
fields.
* test(native-chat): move the slow Clear all test into its own file
The queued-list test file passed its line limit; the in-flight test and the
held-write render it needs now live beside it, and the list test file is
back to the base's helpers.
* fix(native-chat): Clear all waits out a card's own action instead of skipping the card
Clear all now greys while any card in the queue has its own Steer or Delete
on its way, and once that settles it claims every card. Before, it stayed
enabled and quietly left the busy cards out, so a failed Delete left a card
behind after Clear all, and with every card busy the click did nothing.
* chore(native-chat): one comment for Clear all's availability rule
* test(native-chat): update held-start queue fixture after main merge
* fix(native-chat): reserve pending chips before checking dropped files
A local file drop checked each file before adding it, with nothing in the
composer meanwhile: Send during the check went without the file, which then
landed in the next draft; unmounting mid-check lost it; and files queued
behind an input-method composition were lost on unmount.
Drops now reserve a pending chip per file before the check, so Send waits
as it already does for server-upload drops. The prepared attachment travels
through the existing composition queue as one operation, settles into its
draft scope after unmount, releases its chips when refused or disabled, and
reads the scope's current image capability when it applies.
* test(native-chat): server-upload chip calls carry no options without paste
* refactor(native-chat): move the composer's image chip list into its own hook
Main's server-owned paste pushed the attachments hook past the file length limit.
* fix(native-chat): a pending attachment chip shows a spinner and its name, not a stacked icon
A local drop now waits as a pending chip, which drew the kind icon, the file name and a centered spinner on top of each other. Without a thumbnail the chip shows the spinner above the name; with one, the dimmed picture keeps a spinner strip along its bottom.
* test(native-chat): a pending chip shows its name and spinner, no kind icon
Typed hosts like github.io, vercel.app, or readthedocs.io were treated as bare public suffixes and sent to search. They are registrable domains, so they now navigate directly.
- Suffix check now uses ICANN-only rules. The private-section list made `foo.github.io` a domain, but it also let the bare suffix pass, so the classifier now treats the hosting-provider suffix itself as a navigable domain.
- Website navigation now outranks a name match only when the query equals a worktree, tab, or page name in full. Partial matches such as "project.dev server" no longer block the "Go to" row.
- Browser tab creation from a URL forwards the target group as `clientTargetGroupId`, so older hosts that publish the page before the create response still place the tab in the invoking split.
* feat(sidebar): main produces per-workspace activity facts in shadow mode
* perf(sidebar): agent pings keep last-read surfaces; shadow counts comparisons
* fix(sidebar): settle review findings in the activity-facts producer and shadow check
* fix(sidebar): refresh on inventory verdict clears; resync agents only when tabs move
* fix(sidebar): scope the shadow comparison by each row's owner, not the focused host
* refactor(sidebar): name the shadow scope after what it keeps
* fix(sidebar): classify sidebarInputs as host-owned in the operation ownership census
* feat(native-chat): a chat whose host has no program to run shows Install in place of its composer
The chat's one input slot is chosen in one place: a final read refusal, then an owned prompt card,
then Install while the host has nothing runnable (its install included), then the composer. Until
the first status answer the slot stays empty instead of flashing either. Send and slash commands are
refused while Install holds the slot, so nothing hidden reaches the host. The draft stays in its
store and is there when the composer returns. A failed status read leaves the composer; the host
remains the final refusal.
* fix(native-chat): keep the composer slot reserved until the host's agent list says, and say nothing about sending while Install shows
- While the host's capabilities or agent list are still loading for a chat's agent, the slot stays
quiet instead of flashing the composer.
- While the install row holds the composer's place, a failed start's notice ("Send your message
to try again", Retry) is left out: nothing starts until the install lands.
- The chat install card's title is semibold like the other cards in that slot.
* fix(native-chat): keep the chat session view within its line limit after the install slot
* fix(native-chat): the composer stays while the host's first install answer is out, its sends held, so no agent's chat loses its input box
* fix(native-chat): the install slot holds Send through the composer's existing held-send reason instead of a flag of its own
* fix(native-chat): the install slot hands the chat its held-Send reason, keeping the chat session view under its line limit
Seeds local+ssh, local+runtime and folder twins (one id on two hosts) with live
shells, a dormant tab, dirty docs, drafts, sleeping-agent records and module-level
stores, then runs a hand-declared action table (remove, folder delete, purge,
kill, sleep, select) on one twin and asserts the other twin is untouched.
Today's leaks are listed cell by cell and asserted to still leak, so a fix
turns them red until the entry is removed.
* Agree with main on a workspace's first group and the tab order, and stop writing a preview flag main never stores (dark, layout-owner build only)
Switch-on builds only; switch-off behaviour is unchanged.
Group ids: a window save made before main's frame with a workspace's first
tab carries none of that workspace's tab-bar records, so the Loader rebuilt
the tab in the group it names for the workspace while main had minted a
random one: every workspace's first save replaced main's group. Main now
names a workspace's first group as the window's root group and the Loader
do (`workspaceRootGroupId`), or takes the sender's when the window drew the
tab in a group main lacks (the window keeps its emptied group); the
window's `ensureGroup` names it the same way. The detector reads a lone
group with no stored tree as that group's leaf, as main's own save writes
it. Empty groups: the window never saves a group it holds empty, so a save
cannot bring back one main closed (locked by a test).
Tab order: a reorder the window makes itself (an anchored CLI or agent
create, a reopened tab's old slot) is recorded in main as `moveTab` steps
at the store boundary; callers that already asked main pass
`layoutOwnerHandled`. The reopened-editor record this replaces is deleted.
A paired client's move (`ui:moveSessionTab`) goes to main first through
the tab-bar drop path.
Preview: activating a tab removed its preview flag by writing
`isPreview: false` on every tab; main stores no flag, so every activation
changed the tab in main's model. The window now drops the flag instead.
* Record a reopened tab's place in main every time, leave a move into a tab's own group alone, and keep a preserved preview untouched (dark, layout-owner build only)
Review fixes, switch-on only:
- A reopened tab's place is recorded as one moveTab whenever its old
position is known, as the deleted editor-only record did, now for
every kind; the reorder it may make is not recorded twice.
- A move into the tab's own group (a paired client can send one) goes
to today's no-op instead of a moveTab that reordered the tab.
- Activation that preserves a preview returns the tab unchanged.
Tests: switch-off first group stays minted; tabOrderMoves refuses a
duplicate order.
* Send a paired client's tab reorder to main as its whole order (dark, layout-owner build only)
A client reorder names the group's full order, but it went to main as
one moveTab of the named tab, so [a,b,c] -> [b,a,c] naming c moved
nothing anywhere. It now takes the store's reorder path, whose record
turns the whole order into main's moves (tabOrderMoves), the one rule
for every window-side reorder. Moves and splits still go main-first.
* feat(layout): main-made terminal tabs drawn with main's facts; resume records reach main record-only (dark)
In layout-owner builds only:
- A terminal tab main made itself (drag-out, CLI or host terminal, live-surface
adoption) is drawn with main's createdAt and creation fields from the frames,
and the window sends no create for it.
- An editor tab main records takes the time the window drew it.
- Every change of the window's agent resume records (live and quit captures,
dropped records) reaches main through record-only sleep and wake commands,
which stop or start nothing.
- A terminal row's remount generation is declared the window's.
* fix(layout): real wake reaches main before the record drop; drag-out keeps a frame-drawn tab (dark)
In layout-owner builds only:
- A resumed pane's wake is sent before the window drops its record, so main's
wake still finds the pane sleeping.
- A drag-out whose new tab main's frame already drew shows the pane in that
tab instead of throwing "Terminal tab already exists".
- A main-made tab keeps the window's shell, cwd, host-runtime and launch agent
where main's copy names none (a runtime create records a shell only when
its launch named one).
- No record-only wake for a tab the window closed; main dropped its records
with the tab.
- Tests for the resume-record follower.
* fix(layout): a dragged-out chat pane's new tab opens in chat view in main (dark)
Main's movePaneToNewTab now gives the new tab viewMode 'chat' when the moved
pane is its source tab's chat pane, as the window's own drag-out does. In a
layout-owner build the window adopts the row main's frame drew, so without
this the tab opened in terminal view.
* fix(layout): a bound pane with a resume record starts as a no-op; resume records only for held tabs (dark)
- startPane checks the pane's live terminal before its resume record: a
running agent's live or quit record does not make its pane asleep. A pane
with no terminal and a record is still refused.
- The window sends record-only sleeps, like record-only wakes, only for tabs
it still holds; a capture from a stale agent status no longer names a tab
main already closed.
* fix(browser): keep slept workspace browser tabs off the reopen-closed list
Sleeping a workspace closed its browser tabs as if the user had closed them, so
Reopen Closed Tab could bring back a tab that was only slept. Sleep now closes
them with a 'sleep' reason that skips the reopen stack while still releasing
host pages, doc grants and webviews as before.
* feat(layout): send a browser tab's window timestamps with its open (dark)
A layout-owner build's openBrowserTab carried no createdAt, so main stamped the
tab-bar entry and the browser record with its own apply time and the window's
next save diverged on createdAt for both. The window now sends both times, as
createTerminalTab does; only switch-on builds send them.
* Revert "fix(browser): keep slept workspace browser tabs off the reopen-closed list"
This reverts commit 6798c3c701.
* test: drop the slept-tab close test that went with the held sleep fix
Partially reverts #27540 and the plain-http part of #27552, which broke web
pairing on upgrade for 1.4.227 users who open Orca at a LAN or Tailscale address:
- The host no longer refuses a first pairing from a plain-http page on another
machine (insecure_origin, ORCA_ALLOW_INSECURE_WEB_PAIRING).
- Such a page keeps its pairing code in local storage and signs in with it, as
in 1.4.227, so reloads, new tabs and bookmarks stay paired; no notice.
- Session-only browser keys (pairing.device-key-ephemeral.v1, the idle sweep)
stay for browsers without Ed25519.
- A web client whose credentials are refused shows the host's reason instead
of an empty workspace and "Session restore failed".
* fix(runtime): the host stops a removed project's terminals itself
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): a runtime-stamped project still stops the shells that run here
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): refresh the PTY inventory and sweep again after a project's removal
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): bound the project inventory refresh and recheck the WSL move fence
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): fence a project's removal sweep by its SSH connection and wait out in-flight spawns
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): bound the project stop's lease wait by the removal deadline
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): refuse spawns into a removed project and skip a stop a same-id sibling shares
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): bound each project stop by the removal deadline
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): pass the removal deadline to the lease so a timed-out waiter is dequeued
Co-Authored-By: Claude <noreply@anthropic.com>
* test(runtime): type the project-removal fixtures instead of casting
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Relinking projects the server already held still re-imported this desktop's
retained copy of their project groups, so a group renamed on the server while
it was managed failed the reconnect with orcad_migration_project_group_id_conflict.
A relinked move now leaves to the server every group its projects sit in (read
from repo.list's projectGroupId) and those groups' ancestors unless a moving row
needs one, journals those ids, and keeps them out of the exported rows while
still reading them for folder-workspace host ownership. Later delta moves
subtract them as they do moved groups.
* feat(acp): one install row shows and drives a managed runtime install, for Settings and chat
The row reads the shared host state: Install, byte progress with Cancel, extract and verify lines,
Retry after a failure or cancel, and in Settings Reinstall or Update once installed. A failed status
read says it could not check, never that nothing is installed. Strings in all six locales.
* fix(settings): the install row says when a copy is damaged, when a PATH copy is used, and when the host needs unzip
- A damaged copy reads "This copy of {agent} is damaged." with Install, which repairs it.
- A copy found on this host outside Orca's reads "Uses the copy of {agent} found on this host."
with no Install, since a launch would never run the download.
- A host without the program to unpack the archive says so, with no Install.
* fix(settings): say why a host running its own copy is offered no download
* fix(settings): the install row says Cancelling only where Cancel was clicked, offers Orca's copy beside one found on the host, and keeps its status line after a failed install
The host no longer publishes a cancelling phase or a missing unzip, so the row drops both: the
row whose Cancel is still out says Cancelling and holds its button until the host's cancel
settles. A copy found on PATH or in an install folder still gets Install of Orca's copy in
Settings (the chat keeps its composer). An older installed release reads Installed. with Update.
A failed first install keeps Not installed. beside the failure and Retry. The status line is a
polite live region.
* fix(settings): the install row says it is retrying a failed status check, and names the step after the download
* fix(settings): a Cancel that fails for no stated reason says the cancel failed, not the install
* fix(mobile): remove the dead space around the chat composer
The Tools toggle floats over the transcript and shows only when the chat
has tool calls; the composer is one row (attach, message, mic, send) until
focused or drafted; Stop takes Send's slot while there is nothing to send;
the bridge lane's working dots move to the transcript's tail.
* fix(mobile): name the composer's content facts for their role
* fix(mobile): preserve composer controls and picker focus
* fix(mobile): typecheck working indicator test lookup
* test(mobile): find the floating Tools pill when checking a chat switch keeps it expanded
* fix(native-chat): decide owed helper work from what the provider reported, not the capped store
Idle cleanup, replacing an outgrown agent, /clear, /compact, rewind,
command handover and the teardown resume marker decided whether a chat
still had helpers running by reading the agent-status store. That store
is a bounded display projection: it refuses records when it is full or
for per-record reasons, and a refused helper is still running.
The host now keeps an uncapped per-session set of the child work its
provider reported running and has not reported over, fed from every
child-work edge before the store sees it. Every owed-work decision reads
that set. An entry leaves on the child's own end (a late end of an
earlier run leaves the current run open, as the store's run verdict
does), on a Stop the store settled, or on the session's end.
The strip's "incomplete" note and Stop all's unlisted route are now
derived: open work that no live current-run record answers to. This
replaces the refused-for-room side list, so every refusal reason is
covered and nothing needs separate bookkeeping.
* test(native-chat): the real-store test sink reads recorded helper handles, as production's does
* fix(native-chat): keep helper run identity through delayed events and Stop
* fix(native-chat): name the host helper lifetime token
* test(native-chat): explain the Stop adapter fixture boundary
* fix(native-chat): derive helper coverage from running store records
* docs(native-chat): clarify running helper coverage
* test(native-chat): use an explicit helper end event
* Scope background Stop to captured child work
* Exercise refused helper Stop race through status store
Records the post-#29946 text order for workspace rows (Name, Recent and
project-name sort), project group names and folder workspace names, ungrouped
and grouped by project, so a future ordering change shows up as a golden diff.
* fix(workspace-cleanup): let select-all include the workspace you are in
Deleting the current workspace is allowed like any other, so select-all now
includes it; a live agent stays excluded. Cleanup removal now hands focus to a
surviving sibling after the batch, as the sidebar's batch delete does.
Linear: STA-4686
* test(workspace-cleanup): cover focus handoff after the dialog closes and after Delete anyway
* fix(workspace-cleanup): move focus off a deleted active workspace as soon as its row is gone
* fix(workspace-cleanup): don't reopen a workspace the user left while a cleanup batch runs
The per-row focus handoff fired whenever no workspace was selected, so
closing the successor's last tab mid-batch re-activated it (and spawned a
new terminal) on the next row. Move focus only when the workspace the
batch left the user on is actually gone and nothing else took focus.
* refactor(workspace-cleanup): move focus off the active workspace when a cleanup delete starts
Switch to the successor once, right after the batch rows are marked deleting, instead of
repairing an empty selection after each row settles. The active row is no longer active when
it is removed, so the store never clears the selection and no later handoff is needed.
* fix(workspace-cleanup): never hand focus to a workspace in the same cleanup batch
The scan qualifies local rows as host `local`, so their delete state lives
under a host-qualified key, while a sidebar row with no stored host only
matches an unqualified key. The successor picker therefore saw batch rows as
not deleting and could focus one about to be removed, leaving an empty screen
once it went. Exclude the batch's own ids directly.
* test(workspace-cleanup): use scan-shaped hosts in the active-workspace focus tests
Candidates now carry the `local` host the scan publishes, which is what
exposed the picker gap. The other-host case also stamps the viewed row with
its host so it resolves; before, the lookup missed and the test passed with
the host check removed.
* feat(workspace-cleanup): confirm before a cleanup delete stops a running agent
A cleanup delete (bulk, single row, or "Delete anyway") that includes a
workspace with a running agent now shows a step naming those workspaces
before anything is queued. The check reads live agent state at click time,
attributed like the sidebar so structured chats count too, and re-asks if
another agent starts while the step is open.
The approved candidate records which agents the user agreed to stop; the
per-row preflight that runs right before each delete refuses a row whose
agent started after confirmation. With the step in place, live-agent rows
join select-all like the active workspace.
* refactor(workspace-cleanup): name the agent-stop same-action check
* fix(workspace-cleanup): drop an open agent-stop step when the dialog reopens mid-batch
* style(workspace-cleanup): match the agent-stop step's heading to the delete step
* test(workspace-cleanup): type the cache-hydration mocks in the reopen test
* style(workspace-cleanup): let the agent-stop step's heading use the dialog's own typography
The changed-lines design-system gate rejects restyling DialogTitle and
DialogDescription; the delete step's overrides predate that gate.
* fix(worktree-delete): key delete state by the identity the sidebar card reads
A cleanup delete names local rows with the 'local' host, so their queued and
deleting state landed under 'local|<id>' while a card stored without a host
reads the bare id and never showed it. Every delete-state write now derives
its key from the store's own worktree record.
* refactor(workspace-cleanup): reuse the sidebar delete's focus hand-off
Drops the move-focus-before-delete path. Each confirmed row prepares the same
prepareActiveWorktreeFocusAfterDelete committer the sidebar delete uses and
runs it when that row's own removal succeeds, so the user stays on the
workspace while it is queued, lands on the most recently visited surviving
sibling once it is gone, and stays put if its delete fails.
* refactor(workspace-cleanup): reuse the close-terminal stop-agent wording
The stop step's single-agent title is the existing "Stop this agent?" string,
and its description follows the close-terminal prompt's wording.
* test(worktree-delete): cover a local-qualified removal failure on an unhosted card
* docs(workspace-cleanup): describe the after-delete focus hand-off in the bulk-select note
* fix(workspace-cleanup): name one agent in the stop step's button and keep one agent term per locale
* fix(terminal): keep starting terminals in a workspace that is only queued for deletion
A cleanup batch now marks its local rows with the same delete state the sidebar card reads,
so the terminal spawn guard sees them. The guard exists because removal just killed the
workspace's terminals; a queued row still has them and can fail its own delete and stay, so
a new terminal opened there (often the current workspace) stayed blank.
* refactor(terminal): name the teardown-started check the spawn guards share
* chore(workspace-cleanup): keep one agent term in ko/zh and refresh a spawn-guard comment
* fix(workspace-cleanup): refresh consent and focus per removal
* fix(workspace-cleanup): invalidate detected host evidence
* fix(workspace-cleanup): admit removal at transport send
* test(workspace-cleanup): expect the send-time admission callback and a published chat tab
* fix(native-chat): identify the owner when resume create is refused
* test(native-chat): consolidate transcript refusal cases
* test(native-chat): keep ownership coverage at the launch boundary
* test(native-chat): update adoption fixture for early ownership admission
* test(native-chat): align resume admission assertions with host ownership
* test(native-chat): keep RPC coverage focused on ownership proof
* test(native-chat): assert blank request presence before optional source
* fix(native-chat): admit the actual CLI source during chat creation
* fix(native-chat): satisfy source admission lint checks
* test(native-chat): provide the waiting hook prompt
* test(native-chat): isolate source admission fixtures from host homes
* test(native-chat): canonicalize adoption fixture directories
* test(native-chat): preserve early ownership admission in source stack
* fix(native-chat): preserve resume refusal behavior and honest transcript feedback
* fix(native-chat): retain import read evidence in typed result
* fix(native-chat): preserve admitted source and prepared execution home
* fix(chat): retain source evidence for dispatched adoption
* fix(chat): keep source capture within module limits
* test(chat): allow host evidence in create routing
* fix(native-chat): admit an unsaved transcript under a linked account folder
A missing transcript stayed unresolved while its account root resolved through
symlinks, so containment failed and a not-yet-saved conversation showed a load
error instead of the unsaved notice.
* refactor(native-chat): move the newest-item import window into its own module
Keeps journal-legacy-import.ts under the line limit after the source
identity observer landed on top of the streaming import.
* fix(native-chat): restore the refusal error import lost in the main merge
* fix(native-chat): admit Pi transcripts against the root Session History walks
A PI_CODING_AGENT_DIR that already ends in sessions, or any custom folder,
made admission expect <dir>/sessions while the lookup searched <dir>, so a
found conversation was refused.
* refactor(native-chat): admit and look up CLI transcripts in one store per account
Each agent's import described where an account keeps its conversations twice,
once for the path check and once for the lookup, and the two could disagree
(the linked-folder and Pi custom-root refusals). The import now names one
conversation store per account; the create path resolves it once and both the
hook-path check and the fallback lookup judge that same store. OpenCode's
store is its exact database.
* fix(sidebar): order sidebar text the same on every device
Sidebar names, project labels, project-group names and folder workspace
names were ordered with localeCompare, whose result depends on the ICU data
bundled with Electron, the phone WebView or Node. Order them with one
comparator in src/shared/sidebar-list/text-order.ts instead: case-folded and
NFC-normalized, digit runs by value, the rest by code point, and equal text
broken by host-qualified id.
Co-Authored-By: Claude <noreply@anthropic.com>
* perf(sidebar): fold each sort label once per sort; reuse the phone row identity helper
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(sidebar): ignore accents when ordering sidebar names
Accents and case now only break exact ties, so "Éclair" sorts beside "eclair".
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
The + agent menu waited 5 s for the new tab's terminal and otherwise showed
"Couldn't launch X — the terminal did not start." Any slow spawn (Windows,
a cold or busy terminal host, a queued spawn) passed through that state and
got the false toast before the agent came up. The pane's own spawn already
reports a real failure in the pane, so the guess is removed.
* fix(orcad): replace a retired terminal daemon when a client returns during idle shutdown
* fix(daemon): drop idle-retired legacy generations when replacing the daemon
* fix(orcad): treat a lost or late daemon retirement reply as committed
* fix(orcad): settle a lost retirement reply with the daemon itself before replacing it
* fix(orcad): bind the replacement to the retired daemon and honor the router fence
* test(daemon): type the pending census
* fix(daemon): skip the owner check only for a proven-dead endpoint
The preparation lock reason named only the owner's pid, so a host sharing the repo's disk
(an NFS home) read another machine's in-progress preparation as abandoned and discarded it.
The reason now carries the writer's machine identity (optional, appended after the fields
older builds read); a different or unknown machine is unverifiable, and a reason without
one is judged by pid only on a local disk.
* fix(projects): removing one host's project keeps its same-path twin's shells, tabs and edits
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): close the removed host's browsers, chats and late tabs under a twin id
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): attribute a twin's terminals by every PTY id it keeps, SSH included
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): kill a removed local/SSH twin's shells directly and keep its files out of reopen history
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): prune the removed twin's closed editors from the reopen stack
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): recheck twin survivors after the host call and keep reopen order in step
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): close a removed twin's simulators and prune its closed browsers
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): attribute an unstamped twin browser by its pages' host
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): plan a twin's terminal teardown so PTYs other tabs bind survive
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): treat a null browser host as local and close stale stamped editor tabs
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): a host stamp yields to a PTY naming another host; sweep tabless sleeping records
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): cancel a twin's pending launches, clear its PTY records, prune its local editors
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): an ownerless remote pane blocks a stamp; keep the focused surface on background twin removal
Co-Authored-By: Claude <noreply@anthropic.com>
* chore(projects): leave closeFile's active-surface choice to closeFile
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): keep the selection fields consistent after twin teardown
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): closing a background workspace's file keeps the focused surface
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): a file's own host outranks its tab stamp in twin attribution
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): kill only a twin tab's live PTYs and honor a browser's own host stamp
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): skip twin files the removal refresh already closed
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): kill a batch's live PTYs whichever tab the planner chose; background file close keeps focus
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): resolve a removed SSH copy's paired-runtime alias in twin attribution
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): stop the removed host's pane in a tab another host's pane keeps
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): judge a still-present twin surface on its latest evidence
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): apply the removed copy's runtime alias to launches and history; layout-only hints prove nothing
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): repair a selection naming the removed copy's runtime alias
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(projects): leave single-host selection to the bulk purge; test background file close
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
useWorkspaceServer keyed the server's status read on the desktop's connection state, so a server restart or update under a connected desktop never re-read what it supports. It now passes the server's computed state.
Co-authored-by: Claude <noreply@anthropic.com>
* fix(ssh): keep existing hosts' orca CLI control switch off after the on-by-default flip
Builds before the flip saved an explicit off as an absent value, so absent=on
silently turned on hosts the user had turned off. On the first load after this
upgrade, pin every saved host's absent switch to an explicit false and record a
one-shot marker in settings so hosts added later keep the new default.
* test(ssh): check the saved profile without a type assertion
* fix(ssh): say the CLI control switch is on by default for new hosts at the call site too
On a shared home, a peer lock's PID is evidence only on the machine that issued it.
Cache retention judged the instance lock and daemon PID records by PID alone, so a
second machine evicted the slot another machine's live serve or daemon runs from.
A host that could open a window but had none left a workspace-slept running
agent's record for a window wake that never came, so opening its tab from a
paired client or phone launched a fresh agent with settings defaults (for
example --dangerously-skip-permissions instead of the saved --permission-mode
plan). The pane now resumes it with only the recorded flags. Before the spawn
it durably claims the record by rewriting it into the host's own pane-owned
capture form, which a window wake never relaunches (no second writer) and
which still resumes the pane on a later open if the PTY is lost or the spawn
fails. With a window present the window still owns the wake, and the pane
opens a plain shell instead of a fresh agent.
* refactor(sidebar): move sort settling, the Smart latch and sweep retention into shared pure reducers
* refactor(sidebar): let the settle reducer own the Manual and mode-switch rule
* feat(layout): route a terminal tab's own changes to main first (dark)
Rename, color, agent and vault titles, view mode and an ended launch
agent now reach main as layout commands from every caller, in
layout-owner builds only. Main's create also takes the window's
createdAt, and frames keep the window's pane mount generation.
* fix(layout): toggle from the mode sent to main, give each agent title its own answer (dark)
A second view toggle before main answers the first now flips from the
mode already sent, so the tab ends where a window-owned build would.
An agent-title batch applies each tab's title when main answers that
tab, and a paired server's tab at once. Drops the frame merge's
generation field: the window's own save already carries it. Reverts
unrelated formatting.
* fix(layout): clear a pending view mode only on its own send's answer (dark)
* chore: restore three files the commit hook reformatted outside this change
* fix(layout): send one agent title per tab while main has not answered (dark)
The window keeps a tab's first generated title, so a second prompt's
title sent before main answered the first would leave main on the
second and the window on the first.
* fix(editor): keep an editor tab Orca moved to its file's workspace across restart
The move saved the tab under the file's owned id and left the tab's
workspace pointing at the old one. Restore rebuilt a local file under
its bare path, so the tab named no open file and was dropped. Restore
now maps a saved owned id to the id it rebuilds, and the move gives
the tab its new workspace.
* refactor(editor): delete reorderFiles, which nothing calls
* chore: prune the renderer layout-writer baseline
* fix(layout-owner): keep diff, preview and conflict records when a frame redraws editor tabs
Switch-on builds only. A frame rebuilds the window's tabs through the
restore builders, which drop every diff, conflict and check tab (restore
has no record for them), and the store patch dropped every open file
the frame did not carry. Frames carry only edit-mode files, so the next
frame after opening a diff closed it in the window while main kept it,
and a markdown preview kept its tab but lost its record.
The rebuild now keeps a transient tab whose record the window holds,
and a held record goes only with the last tab showing it; a record no
tab shows (a conflict review's selected file) stays.
* feat(layout-owner): record renamed open files and closed conflict placeholders in main
Switch-on builds only; switch-off behaviour is unchanged.
A rename or move in the explorer rekeys open editor, preview and diff
tabs in the window and main learned it only from the window's save.
The window now records the rekey as a `renameEditorFiles` command,
under the ids it chose (bare path, owner-qualified id, diff id), one
per workspace, with each edit-mode file's new record. It records
rather than asks first: the rekey is atomic with drafts and the
autosave echo gate, and its answer gates the move coordinator. Main's
path-keyed `editorFilesRenamed` transition, which nothing produced and
which could not match owner-qualified or diff ids, becomes this command.
A git status poll that sees a deleted-side conflict resolved drops its
placeholder record but leaves the tab to the tab reconcile; frames then
brought main's edit record back. Main now closes that tab.
* test: type the rename command as a window layout command
* fix(editor): map a moved tab's owned id on restart only; main records a renamed file only for a tab it shows
* fix(editor): restore a moved tab's file under the owned id the tab names
Restart and frames now agree: neither rekeys the tab, and a frame that
redraws one workspace never points its tab at a same-path file in
another. A rename that changes nothing leaves no empty file list.
* test: a moved tab's owned id stays apart from a sibling's same-path file in any frame
* fix(ssh): a refused relay socket on a network home is unverifiable, not exited
On a shared NFS home behind a round-robin SSH alias, the next connect can land on a
different node than the relay's. That node's kernel refuses the socket and its lsof
sees no holder, so the probe called a live relay exited and its terminals were retired.
A refused socket now proves exit only on a filesystem local to the probing machine.
* fix(ssh): read the socket filesystem on macOS hosts whose Node lacks statfsSync
* fix(terminals): route sleep and hibernation by each PTY's own host when two hosts publish a worktree
* fix(terminals): settle every runtime stop before rolling back a multi-host sleep
* fix(terminals): refuse a sleep whose PTYs span two runtimes instead of splitting it
* test: type-safe selector read in twin hibernation test
* refactor: keep hibernation owner mapping pure and settle the focus-read baseline
Capturing the destination host called ssh.listTargetSummaries directly, so a
paired server predating it failed the whole write with a raw method_not_found.
Reuse the listTargets fallback host-selector-alternatives already applies,
factored so the destination check still surfaces every other error instead
of treating it as "no targets".
remove() marked the host as being removed, then awaited disconnect and
releaseHolder with no cleanup on failure. A throw (EBUSY/EPERM on Windows)
left every later connect and runtime call refused. Clear the mark in a
finally, keep the record and its visible work (dropped only on success), and rethrow
so the user sees the error and can retry.
Since #27609 a server serves no SSH target and refuses repo.addRemote, yet the add-project dialog
still offered "Project on this server's SSH host" and the refusal read "SSH connection not found
or not connected". The row is now disabled with a message pointing to adding the SSH host on this
computer, and the server's refusal says the same for older clients that still offer it.
A background connect (managed tunnel, census, runtime context) that was
waiting for the old transport to close resumed after the user's
Disconnect or Remove host and registered a fresh connection. Re-check the
attempt token after that await so the cancelled attempt never registers.
* feat(orcad): ship the mobile web page so phones paired to orcad get it
orcad never carried out/mobile-web, so it did not advertise
mobileWeb.bundle.v1 and phones paired directly to an orcad server fell
back to the app's built-in native screens.
The built page now ships in every orcad package at out/mobile-web, the
path getBundledMobileWebBundleRoot already probes under the install
root. Its manifest is a fixed artifact; its content-addressed assets
join the hashed artifact list from that manifest, as one shared copy in
the template's common files. build-orcad fails when the page is missing
or stale, and CI lanes that build orcad now build the page first.
* ci(orcad): check out mobile/ for the Windows host template build
* refactor(orcad): copy the page tree whole and build it once per CI run
The guard already refuses unlisted files, so staging copies the
bundle directory as native-chat-visuals is copied. The shipped template
takes the page the qualification lanes tested, the e2e build artifact
carries it, and the PR smoke builds it through install-mobile-dependencies
behind its own scope step. Drops tests that duplicated the guard's own.
* fix(orcad): refuse a template page asset name that escapes the slot
* test(sidebar): capture golden fixtures of today's sidebar row model
Golden output of the unmodified window pipeline (filter, sort, grouping,
pins, lineage, host sections, Cmd+1-9 targets) across every groupBy x sortBy
x projectOrderBy x pinned policy, plus host-filter, repo-filter, hide-sleeping
and hide-default-branch scenarios, each expanded and collapsed. Kept as the
correctness reference for moving the row builder.
* refactor(sidebar): move the pure row builder into src/shared/sidebar-list
The sidebar's list rules (visible filter, grouping, pinned rows, project
group sections, placeholders, host sections, collapse keys) move to
src/shared/sidebar-list as pure functions. Headers carry an icon key instead
of a React component; the window resolves glyph and tone when it paints, and
passes localized header labels in. The window keeps calling through thin
adapters (build-rows, compute-visible-worktrees); sort latch, settled epoch,
sleeping retention and pending creations stay where they are.
github-cache-key moves to src/shared/github because PR-status grouping needs
it; the renderer path stays as a re-export so its callers are untouched.
Other edits outside the sidebar are import paths only. The golden fixtures
from the previous commit pass unchanged.
* refactor(sidebar): resolve header labels at render, add an inbox golden
Header labels are read on every re-emit again, as before the move. Settings
and labels types move next to the other row types; header visuals no longer
export what nobody imports. Adds a golden for the new-external-worktrees inbox
row, captured on the pre-move pipeline.
* refactor(sidebar): shrink the shared builder's inputs to plain readers
- The builder takes a PR-lane reader instead of the PR cache and settings;
getPRGroupKey stays in the window, so github-cache-key no longer moves.
- Pinned, All and PR-lane headers carry only an icon key; the window names
and draws them at paint (status headers keep their data label).
- The status icon key carries the status id; the window looks up its look.
- Window callers use planSidebarRows directly; the positional helper is a
test fixture.
- Folder path-status routing and rendered-row keys stay in the window.
Goldens pass byte-identical.
* refactor(sidebar): point stale builder comments at planSidebarRows
The runtime GitLab API answered listAssignableUsers with an empty list, so the reviewer picker
was always empty for a paired server's repo. Add an optional gitlab.listAssignableUsers RPC on the
host; a host that predates it answers method_not_found and the picker stays empty as before.
* fix(ssh): re-check a macOS host's ended launch-session warning so another desktop's restart can clear it
The ended verdict was cached for the whole SSH session, so when another desktop restarted the server under a live session, this desktop kept the warning. It now expires like every other verdict: a live re-probe clears the note, and an unanswered one keeps the proven verdict.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(ssh): only a live probe clears a proven launch-session end, and a failed recheck republishes it
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(ssh): a failed launch-session recheck restores the warning only for the same live connection
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Brennan Benson
Jinjing
Jinwoo Hong
Neil
Kelvin Amoaba
Žan Mlakar