The paired surface's waking cover now lets input through to the pane (pointer-events-none) while it
wakes, shows the held-input count with Clear, and toasts what was delivered, using the same
useWakeInput / useWakeInputNotices / wake-input-buffer as the owned surface. A failed wake covers the
pane again.
wakePairedCloudWorkspace reported 'ready' as soon as the control plane accepted the wake (well under
the overlay's 300ms show delay) while the VM took ~8s more, so the overlay never appeared and the
pane sat in Reconnecting. It now reports 'connecting' and re-reads status every 1.5s (bounded at
120s) until it says running, then 'ready'; a VM that never runs fails the wake (stalled copy).
SECRETS_KEK_SOURCE=kms unwraps KMS-wrapped KEKs once per isolate. Unset, the
SECRETS_KEK path is unchanged. With it on there is no plaintext fallback: a KMS
failure answers 503 secrets_unavailable and a workspace create fails instead of
starting without secrets. Tested against a fake KMS only.
Environment builds get only the team secrets an admin named, never a swapped model key, hand them to the install script alone, and fail with no snapshot (secret_in_image) when a value is still in a file the build changed.
cloud-glossary-lint.test.ts globs and reads src instead of importing it, so
neither name matching nor vitest's module graph ever selected it; #610 broke
it unnoticed. premerge-check.sh now appends every path listed in
config/scripts/cloud-integration/premerge-always-tests.txt to the targeted
set (still subject to the base-list filter).
Recent create-sheet commits moved VmBuildFailureActions' recipe-VM "Delete VM" branch from line 388
to 412, so cloud-glossary-lint failed on integration HEAD for any premerge that selects it. The
cloud branch still says "Delete sandbox"; only the allowlist line number changes.
* fix(cloud): PAIRED-BADGE no "primary" badge or star on a cloud workspace's own row in the LIVE card; delete dead card header paths
#560 gated the badge in worktree-card-header.tsx, which only the unrendered
WorktreeCardParentContent used; the live card (default-workspace-card.json via the element registry)
drew PrimaryBadge/PrimaryStar with no cloud check, so a paired-from-birth row kept "primary". The
gate now sits in the template parts themselves (NotOnCloudRow, useIsCloudHostRow). Deleted the dead
header, parent content and meta row so a fix can't land there again.
* chore(cloud): PAIRED-BADGE drop the deleted meta row from the localization allowlist (path-literal ratchet)
* fix(cloud): PAIRED-ACCOUNT-FILTER paired workspaces are scoped by the account their pairing was made under
* perf(cloud): PAIRED-ACCOUNT-FILTER read the active account once per profile-index write, not per paired lookup
"See plans" becomes "Compare plans" (the one key, auto.components.billing.comparePlans) on Plan &
billing's and the team plan's upgrade button, the VM build failure card and toast, and the
cloud-session create toast, as design-squad asked. The create sheet's billing blocker "Update
payment method" opens the billing portal in the browser, so it becomes an OpenExternalSplitButton
whose chevron copies the same portal link (COPY-LINK-RULE). Drops the two private keys it replaced.
'How to push to GitHub' is now an OpenExternalSplitButton: its chevron copies GitHub's
guide (PUSH_TO_GITHUB_URL) without opening it. 'Contact support' sits in the More
menu, where a row can't carry the chevron, so a 'Copy support link' item sits right
below it, the same pattern as 'Copy GitHub link' under 'Add a GitHub repository…'.
The support URL moves to vm-build-repo-actions.ts (ORCA_SUPPORT_URL) next to the
GitHub guide's.
Neil (n39): Project "~" (a folder) with Run on = Orca Cloud opened a 256 px Agent menu
under the full-width field. The composer passed matchTriggerWidth only for a resolved git
repository that isn't a project group (upstream's rule), so a folder, a GitHub-only Orca
Cloud repo or a still-resolving cloud target fell back to min-w-64. The field is always full
width there, so the menu now always matches it (coordinator ruling). The right-aligned
'Not set up' labels are unchanged.
Neil
Neil