- Desktop notification (title "Orca Cloud", body reuses the in-app usage sentence) when a
billing read crosses 75, 90 or 100%, once per level per account and billing period. Main
owns the ledger (userData/orca-billing-usage-alerts.json), so reloads, re-renders and
second windows never repeat it; a new period starts over. Members are never notified.
- Click opens Settings > Orca account (Plan & billing) via ui:openSettings with a target.
- The in-app usage notice (account menu, billing panel, plans page) is now owners/admins only.
- Billing panel: muted note under the Overage description that owners and admins are alerted
at 75%, 90% and 100%.
- Fixtures: account menu at 90% (admin and member), billing panel member at 90%.
- N9: orca://cloud/setup/return?session=cs_… is routed (open-url + second
instance), validated, focuses Orca and fans out to renderer listeners
(onCloudSetupReturn) so the setup session re-reads at once.
- N10: cloud_setup_step_{started,done,failed}, cloud_setup_first_sandbox and
cloud_setup_plan_chosen, enum-only, derived from the setup rows.
- X1: setup error kinds (timed_out, checkout_canceled, bank_step,
trial_unavailable, team_create_failed, wrong_account) and their actions.
- B2: billing POST /v1/billing/team-plans returns other teams' plan state with
the caller's own token; auth confirms membership from that token (no new
credential). Desktop IPC billingTeamPlans + useSwitchToPlannedTeam. The team
switch logic moves out of SidebarTeamSubmenu so the composer can reuse it.
Per design-squad on #244. The Agent API keys editor gets one muted line under the host scope choice,
'Not used in Orca Cloud. Save a key to your Orca account to use it in cloud workspaces.', instead of
changing #40303's own label.
Verified on a dev sandbox (Claude Code 2.1.319, codex-cli 0.166.0): runCommand runs as ubuntu with
HOME=/vercel (same user as orcad); `claude auth logout` and `codex logout` exist and exit 0; the
script reported {loggedOut:2,left:0}, removed both credential files and kept other ~/.claude.json keys.
* fix(w8): cloud-icon rule on the phone: a paired desktop's Orca Cloud workspaces lead with the Cloud glyph + state dot (worktree.ps carries orcaCloud.status), home cloud rows read 'Cloud workspace, …', muted Cloud before the cloud workspace title
* fix(w8): cloud-icon review: glyph label merges into the row (no own focus stop), no filled ring behind the dot (pressed/active fills), newest VM record speaks for a workspace
* fix(w8): cloud-icon review 2: a cleaned-only workspace stays cloud (as on the desktop) with no dot, a live VM beats a cleaned one, cleanup_failed draws no forever-pulsing dot; store-order test
* test(w8): cloud-icon ps status test without a cast
* fix(w8): cloud-icon dot sits mostly outside the glyph's bottom-right (design-squad), clear of the title
- Panel sections 2–3 on Orca Cloud (standalone, for gap-agents' AgentHostPanel shell):
Cloud-secret key rows with scope chips and shadowed keys listed disabled with the reason;
effective variables; missing names with inline Add / Add mine; asleep and shared (D13) states.
- S2: missing = environment envVarNames − effective secrets for the repo and caller; Paste .env,
per-name scope, batch save, build-time team-only note (Q7), post-open 'secrets missing' notice.
- S4-b: card for orcad secrets.requested/requestSettled; Personal by default, Repository only if
writable, agent scope as hint; N more requests; expired and saved-after-expiry; touchRequest at
most once a minute; Restart {{agent}}; value saved via Cloud secrets PUT, then resolveRequest.
- Main: cloudSecrets.workspaceSharing reads GET /v1/agent-sources (owner, sharedWorkspace).
- Fixtures for every state, dark and light.
- Overage stays $1.00 per sandbox hour (ORCA_CLOUD_OVERAGE_CENTS_PER_HOUR) and is now billed by
the minute: a per-minute metered TEST price (unit_amount_decimal = rate / 60 to 12 decimals,
transform_quantity divide_by 60, round up), created the same way by stripe-test-setup.ts.
capSeconds rounds the cap down to whole minutes and spentCents mirrors the invoice, so the
cap math matches Stripe. The meter still counts seconds.
- Opting in re-prices an overage item still on an older price (e.g. $0.75 / h) instead of adding
a second item on the same meter, and removes any extra stale one.
- Alerts at 75%, 90% and 100% of included hours (warnAtPercent).
- New top-level entitlement.suspendRunning: payment grace expired, or at the limit (out of hours
with overage off, or at the spend cap). The start check and usage answers carry it, so the
control plane puts running sandboxes to sleep (snapshot kept, never deleted). Payment fields and
/v1/internal/suspensions stay payment-only, so no data-retention clock starts at a cap.
- Copy (desktop billing panel, plan card, build sheet, phone, CLI): "billed by the minute" after
the rate; at the limit "Running sandboxes go to sleep and new ones can't start. Nothing is
deleted, and your files are safe."
- Keys-on-this-computer rows read '{{agent}}: your API key ••••{{hint}} is only on this computer'
with 'Save to your Orca account' (spec v4); a saved row shows a check and 'Saved to your Orca
account', a failed row a compact error 'Couldn't save {{ENV}}. Nothing was changed.' with Try again.
- Agent API keys scope reads 'Every host except Orca Cloud'.
- Copy: 'Choose how your agents get access…', 'Give your agents access in Orca Cloud.', 'Claude'
(catalog name) instead of 'Claude Code' in the setup dialog and composer hint.
- The build-sheet fixtures now are the Orca Cloud path (provider orca-cloud: 'Starting your cloud
workspace' / 'Start sandbox'), wire the desktop-key action, and add one with both outcomes.
- DS-33: the composer's agent prompt is hidden while Orca Cloud can't start (signed out, no plan,
cap, payment issue).
- Command-finished events carry the pane's leaf; a run learns its pane while its tab has one,
ignores other panes, and Stop interrupts the run's own pane.
- Workspaces whose setup ran in the environment build (hooks report environmentProvisioned) start
the autoRunAfterSetup action the first time they are opened, once per workspace.
- Worker: run orca-agent-signout (each agent's logout, then credential files) on a running sandbox
before the provider delete; bounded (20 s) and best effort, never blocks the delete.
- Environment builds: scrub agent auth (--scrub-only) before the snapshot; fail closed.
- New VM script registered in VM_SCRIPTS + provision loop; vm-scripts regenerated.
- Main IPC ephemeralVm:forwardedEnvSummary returns names only, grouped by credential-looking.
- P-4 warning component (+ fixture) shown under Settings > recipes; delete dialog line for awake
Orca Cloud sandboxes.
- nonconcurrent now matches Conductor's run_mode: starting it stops that action in the project's
other workspaces; the project's other actions keep running (W9 finding).
- A VM launcher's ORCA_PORT=3000 is the first workspace's block (persisted, stable across wake), so
its agents, terminals, setup and run actions all agree; later worktrees on the VM get registry
blocks that never overlap it. The daemon no longer hands the host's block to panes without one,
and setup/archive hooks resolve the workspace block before they run.
DS-34:
- One billing store (billing-summary-store) replaces the summary, the hook's local state and the
Run-on picker cache; it keeps the last good result through a failed read and still drops answers
from before a team or account switch (DS-17).
- Skeleton while Plan & billing loads.
- '{{count}} sandbox hours left' and '{{count}} sandbox hours over the included amount this month'
as i18n plurals; no bare 'hours'; the unreachable 100% branch is gone.
- Usage warning driven by usageWarningPercent ('Your team has used {{percent}}% of this month's
sandbox hours.'), in Settings, the plans page and the account menu.
- capTooHigh states the maximum ('The spend cap can be at most {{max}}.'), from offers.maxSpendCapCents.
- Plans dialog focuses its heading on open, so Tab reaches the interval toggle before the cards.
- Payment notice uses InlineError; the build card's overage buttons land on the overage section.
- Account menu names the team once and adds the hours-left line.
DS-44: warning tone at 90%+, '$' as an input prefix, neutral paid check, 24px dialog close hit
area, no <p> inside the CheckoutPanel <dl>.
Neil
Neil