* refactor: organize remaining terminal pane features by owner
* refactor(terminal): consolidate replay guard type imports
* refactor(terminal): retarget notification mocks and generated consumer import
* refactor(terminal): repair benchmark owner lookup and stale mock export
Adds .github/SECURITY.md so GitHub links reporters to the private
vulnerability reporting form, and points to it from CONTRIBUTING.md.
Replaces #25553, carried over with small wording changes.
Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
* fix(packaging): require macOS 13.4, which the bundled speech engine needs
* fix(updater): keep the macOS requirement title clear of the close button
* fix(packaging): check out the Darwin floor table for adhoc builds and raise the cask floor
* refactor(updater): reuse the parsed Darwin floor for the macOS requirement
* fix(updater): use a margin to keep the macOS requirement title clear of the close button
* fix(updater): say the macOS requirement comes from Electron and the speech engine
* feat(mobile): sign Android release builds with a dedicated release key
Add an Expo config plugin that gives the generated app/build.gradle an
env-driven release signing config, and have the Android release workflow
require the keystore secrets, fail before building when they are missing,
and check the APK's signing certificate against a pinned fingerprint.
* fix(mobile): keep the signing setup hint intact in the workflow error
* test(mobile): type the plugin import without a cast
* feat(mobile): keep debug signing until release signing is enabled
Release signing now turns on when the ORCA_ANDROID_RELEASE_CERT_SHA256
(or ORCA_ANDROID_REQUIRE_RELEASE_SIGNING) repository variable is set.
Until then the workflow keeps today's debug-signed build and adds a
warning and job summary note; once enabled, missing secrets fail.
* feat(mobile): enable v2 and v3 APK signing for the release key
#38638 moved journal-payload-bounds.ts and journal-reasoning-row.ts into
agent-session-journal/item-lifecycle/; #38956 then listed them at their old
paths, which fails the path-literal ratchet on every PR.
* refactor: group structured session modules by owner
* test: retire status history work-count oracle suite
* refactor(main): organize journal storage and projection owners
* Consolidate restart recovery fixture imports
* Consolidate concrete session option model imports
The path filter config/scripts/*dependency-security* stopped matching after the
scripts moved under config/scripts/dependency-security/, so scanner-only PRs
skipped the audit.
* Bound every pull request CI job with timeout-minutes
* ci: bound the PR-triggered jobs added since #28784 with timeout-minutes
Sized from recent run times: containers 1.2 min max, mac-native-owner-smoke 5.5,
contract 1.2. Secret scan (1.8 max) and mobile_web_app (5.4 max) get roomier limits.
* ci: check PR job time limits in code_paths so workflow-only PRs are covered
A PR that changes only mobile.yml or cloud-verify.yml skips the root unit
shards, so the timeout test never ran for it. Run the check from code_paths,
which runs on every PR, as check-required-pr-context already does.
* ci: use a uniform 3h ceiling on newly bounded PR jobs to stop runaway jobs
The goal is only to stop jobs that would otherwise run to GitHub's 6h
default, not to tune per-job limits. The guard keeps requiring a limit
below 360 minutes on every PR job but no longer enforces a lower value.
---------
Co-authored-by: Kelvin Amoaba <97001695+AmoabaKelvin@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
* Keep dropped-macOS updaters on their last compatible build and explain why
Stamp minimumSystemVersion into every mac update manifest from the built
app's LSMinimumSystemVersion, and refuse to publish an ungated release.
When the updater withholds a newer release for this macOS, show a one-time
notice and say so in Settings and the update card.
* Trim the unsupported-Mac notice copy
* ci: auto-merge the README downloads badge PR
main is PR-only, so the badge workflow's PR sat unmerged and the badge stopped updating. Enable auto-merge (squash) on the PR after each update; it merges once 'PR checks passed' succeeds.
* ci: auto-merge the badge PR by its URL
Merge the PR the step created or found (scoped to main) rather than resolving the branch name again.
* ci: ignore fork PRs when finding the badge PR
A fork PR can reuse the badge branch name; only the bot's own same-repo PR may get auto-merge.
* fix(serve): keep `orca serve` running while it probes the login shell
`orca serve` started from an interactive terminal stopped itself ("[1]+
Stopped") before printing its pairing link. orcad inherits the terminal
and probes the login shell with `$SHELL -ilc`; an interactive bash 5 or
zsh takes the terminal's foreground job, so orcad's next terminal access
raised SIGTTOU/SIGTTIN. Give both shell probes (login environment and
PATH) a POSIX session of their own so they never hold a controlling
terminal. Windows keeps attached spawns, where `detached` would open a
console.
Refs #38347
* fix(serve): end a detached shell probe with its owner and on timeout
A probe in its own session no longer receives the terminal's Ctrl+C or
hangup, so a hung rc could outlive `orca serve`. Kill the probe's process
group by its own pid when it times out and when its owner exits while it
still runs; orcad and Electron turn INT/TERM into an exit, so a Ctrl+C
reaches it that way. No signal listeners: one would replace Electron's
graceful signal quit. The timeout now also ends what the rc started, not
just the shell.
Refs #38347
* fix(ci): run the release skill-sharing Electron install step in bash
#38130 turned this step into a POSIX path fallback, but the skill sharing
release gate also runs on windows-2022, where the default shell is
PowerShell. The step failed with a ParserError, so release-preflight
skipped every build for the v1.4.250 cut.
* test(e2e): keep the one-time Codex notice out of golden runs
The v1.4.250 golden e2e on Linux timed out clicking New Terminal: the
'Orca now runs Codex without its shared server' toast fires once when the
golden stub (a Codex terminal) appears, and here it landed while the +
menu was open and closed it. Mark it seen in the completed-user fixture
like the other one-time notices, and restore that fixture from the
workflow ref in the release golden job so a recovered tag uses it.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
OrcaWinandOrcaWin
Neil
Kelvin Amoaba
Brennan Benson
Jinwoo Hong
