* perf(rpc): stop the dispatcher importing every RPC method by default
Callers pass the method list. A test that builds a dispatcher no longer loads
the full method registry, cutting the dispatcher's import graph from ~4k to
~550 modules.
* chore(lint): keep the RPC dispatcher and plugin RPC off the method registry
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Five refused provider opens can outlast a 2s real-time budget on a loaded host,
so the preamble resolves 'unobserved' instead of throwing the refusal under test.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* perf(terminal): send idle remote keystrokes without the 8ms debounce
Remote terminal input batching was a pure trailing debounce, so every
isolated keystroke waited 8ms before leaving the renderer. Send input at
once when the batcher is idle and coalesce only what arrives inside the
following window. Recovery-hold replay keeps the trailing path so a
synchronous flush cannot re-enter the still-buffering hold.
* perf(ssh): disable Nagle on loopback sockets carrying orcad RPC
The SSH forward listener, the stdio bridge listener, and the remote
bridge's connect to orcad relay WebSocket RPC (keystrokes and echo).
ws sets TCP_NODELAY on its own sockets, but these relay sockets did not,
so small writes could wait behind an unacknowledged segment.
* perf(terminal): decode terminal frame payloads as views, not copies
Every message buffer is fresh and consumers decode the payload
synchronously or retain it read-only; the only in-place rewrite touches
header bytes.
* fix(terminal): send idle remote keys at once only to input-acking hosts
On hosts without input acks, an immediately sent key travels as a stream
frame while a following accepted write (Ctrl+C, paste) goes as a separate
terminal.send RPC on another socket, so the host could apply them out of
order. Keep the trailing batch there so both still leave as one RPC.
* Report image copies the clipboard refused instead of showing "Copied"
The desktop clipboard image write returned without an error when it refused an
image (too large, not a PNG, undecodable), so "Copy as PNG" and browser screenshot
copies showed success while the clipboard was unchanged.
- Main and web image writes now reject on every refusal.
- The image viewer copies a raster image's own bytes (natural size), reusing the
paste/copy PNG conversion; only SVGs still render at 2x for sharp text.
- Too-large failures say so, through one shared description used by native chat
and the image viewer.
- Browser screenshot copies show success only after the write resolves.
Refs STA-14205
* Keep grab toasts on their own screenshot and show a successful retry as success
Refs STA-14205
* Drop a grab screenshot result once a newer toast, copy or cancel replaced it
Refs STA-14205
* Move the grab screenshot copy owner into its own hook
Refs STA-14205
* Test that native chat explains a too-large image copy behind the IPC error prefix
* fix(ssh): keep the managed tunnel's TCP forward when a slow ProxyCommand delays its login
`ssh -L` binds its local listener only after its own login. The managed
tunnel gave that login 750ms plus a 5s channel check, then judged the
forward "never listened", killed it and switched the whole connection
generation to the per-socket stdio bridge. Through a slow ProxyCommand
(Coder `ssh --stdio` on Windows, without ControlMaster) the login often
takes longer, so the working forward was discarded and every socket paid
a fresh proxied SSH login, leaving the server Unreachable (#38636).
Give the listener the same 30s budget a system SSH connect gets, keep
the short wait for the channel answer once it listens, and stop waiting
as soon as the forward process exits so a refused login still falls back
at once with ssh's own exit reason.
Refs #38636
* test: give the slow-login forward test its timeout reason and real-socket wait exception
Adds a branch picker to the Source Control header for switching or creating a branch in place. Switching is disabled while an agent is working in the workspace, and results show as toasts.
* refactor(agent-session): split subscribe params and read failure text into their own modules
Both host files sit at the 300-line budget, so the append negotiation that
follows needs room. Pure moves: SubscribeParams keeps its exact schema (now
z.object + sessionId instead of OptionsParams.extend, which is equivalent) and
is re-exported from the params module; stream failure text moves beside the
other read-refusal classification.
* perf(agent-session): stream running tool output heads as appends
A running tool call re-sends its whole output head (up to 16KB) on every
revision, and keeps re-sending the saturated head after it stops growing.
Streams that also ask for toolOutputAppend (host advertises
agent-session.tool-output-append.v1) now get only the head's new text under the
same shared sender/reader rules and self-healing refusal as reply appends.
- The live read negotiates the exact subscribe capabilities object instead of
a boolean; mobile asks for tool output appends when advertised.
- Hosts with only text-append.v1 drop the unknown key, so clients ask only
when the new capability is advertised and both ends track the same bases.
- Text-only streams keep the 8-base limit already-shipped readers evict at.
- A host that refuses the capabilities param (an older build after a
downgrade) makes the next open go without appends instead of failing forever.
* perf(native-chat): ask remote hosts for streamed text appends on desktop
Desktop chats on a paired or SSH-managed orcad received every streamed reply
checkpoint whole: about 9x the reply's bytes at the Claude/Codex checkpoint
cadence, and O(N^2) for ACP/JSONL providers that rewrite each 60ms window.
The desktop read now asks environment hosts for reply and tool-output appends
when they advertise them, reusing the shared reader that rebuilds whole items
before the reducer. Local IPC reads are unchanged and still subscribe in the
same turn. The support read runs once per chat run, overlapping hydration.
* refactor(remote-runtime): share compressed frame inflate across client platforms
Move the length checks and decode of paired E2EE compressed frames into
the shared module behind a small gzip/UTF-8 codec, so the desktop can
read them with node zlib while mobile keeps its native/fflate path.
* perf(remote-runtime): read compressed frames from paired hosts on desktop and CLI
Desktop and CLI sockets to orcad/orca serve now advertise
transport.compressed-frames.v1, so a v2 host gzips large text replies and
terminal output before sealing them, as it already does for phones.
- Every Node client transport (one-shot requests, request connection,
shared control, subscriptions) opens frames through one sealed-frame
reader that inflates compressed frames on v2 channels, synchronously so
frame order and v2 counters stay in arrival order.
- A compressed binary frame may claim up to the 8 MB binary outbound cap
(terminal frames can exceed the 4 MB JSON cap), for phones too.
- ORCA_DISABLE_MOBILE_COMPRESSED_FRAMES=1 now also stops a desktop or CLI
from asking for compressed frames.
- Relayed phones and the browser client are unchanged.
* refactor(remote-runtime): simplify the mobile inflate codec and clarify capability comment
* fix(remote-runtime): name why a sealed frame could not be read
Text-only sockets report an authentic binary payload as an unexpected
binary frame again, and tell a decrypt failure apart from a corrupt
compressed frame, instead of calling every failure undecryptable.
* fix(terminal): use Regular weight by default on Windows
Cascadia Mono, the Windows default, has no Medium face, so a 500 request
rasterizes as SemiBold. New Windows profiles default to 400; Windows profiles
still on 500 move to 400 once and see one persistent toast with a live
preview and a switch to keep 400 or go back to 500. Skipped when the
terminal font renders both weights identically.
* chore: prune stale renderer layout-writer baseline entry
* fix(i18n): translate the Windows weight toast label reactively
Adds a Custom… option to the App Icon switcher. The picked PNG/JPEG is
header-checked before decoding (square, 64–2048 px, ≤10 MB), re-encoded as
PNG into userData, and applied to the macOS Dock and every window icon. It
persists across restarts and can be removed, which resets to Classic.
Closes#13316
The managed server liveness probe matched kill -0's ESRCH text
case-sensitively. zsh and ksh print it lowercase, so on hosts whose login
shell is zsh a recorded PID that no longer existed read as UNKNOWN. The
wake then never restarted the stopped server, the update deferred on an
uncounted census, and the host stayed unreachable. Match either case;
permission errors still stay UNKNOWN.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Claude transcripts only sit directly in a project bucket; the History walk now shares the bucket-depth rule the session-id lookup already uses instead of only pruning subagents/.
* fix(terminal): never type a colour reply into the shell after the program that asked has exited
The PTY owner holds a colour-query reply made inside a shell command for up
to 20 ms and drops it if the command's OSC 133;D arrives, or (POSIX) another
process group takes the terminal; otherwise it answers. Command markers ride
the colour scan every emission already pays, so the hot path does no new
work until a query is pending. No daemon protocol change.
Closes#16633Closes#14631
* fix(terminal): track command markers in the existing colour scan, drop the live-group shortcut, and hold through claimed echoes
* fix(terminal): one verdict for every query held behind the first, contiguous ranges through a held echo, drop held replies at the final snapshot
* refactor(terminal): move the torn query/echo holds out of the ingress
* fix(terminal): a query completed after a verdict is judged afresh; the final snapshot judges held askers instead of dropping them
Shows CI result lines in the chat that opened or pushed to a pull request. They're hidden in the terminal overlay and on the phone until the phone app gets the setting.
* fix(runtime): keep a terminal's last output on exit and stop charging dropped screencast frames
* fix(browser): clear an oversize frame held for credit instead of retrying it
* fix(tasks): confirm a lost Tasks comment by author on GitLab and GitHub REST reads
Only GitHub GraphQL's viewerDidAuthor marked the viewer's comments, so on GitLab,
the GitHub REST fallbacks (including issues with more than 100 comments) and the
gh view fallbacks the phone kept an unconfirmed draft even after the comment
posted. Those reads now match the login of the account that made them, and an
explicit PR refresh reads comments uncached.
* fix(mobile): settle an unconfirmed comment only on one posted after the send
A refresh of an issue with more than 100 comments reads comments the first
load never showed, so an older identical comment by the same account looked
new and could clear the draft.
* refactor(gitlab): share the glab viewer read and skip it on Checks polling
* test(mobile): pin the clock in the unconfirmed comment test
The Resource Manager samples every 2 s while visible. execFile runs ps
directly instead of through /bin/sh -c, one fewer process per tick, with
the same arguments and output.
The collector test mocked child_process.exec; it now mocks execFile.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Neil <neil@stably.ai>
* Prepare queue rows to preserve accepted delivery intent
* Keep waiting native chat input in one ordered queue
* Keep a typed view of admitted queue records
* Keep the removed queue caption in the runtime catalog
* Remove the unused queue barrier caption
* Keep queue writes local and preserve accepted send provenance
* Read the sender from the queued admission request
* Keep continuation fixture clock within its operation window
* Remove deleted queue-barrier test from ratchet baseline
* Keep ratchet baseline change scoped to the deleted test
* Filter historical acceptance reads before loading payloads
* Instrument cached acceptance cursor once per fixture
* Restore original personal provenance after legacy card cleanup
* Complete legacy sender fixture metadata
* Narrow admitted history record types
* Reconstruct accepted personal proof after restoring original admissions
* Use the fixed clock for historical queue fixtures
* Consolidate queue source and type imports
* Preserve admission refusals and failed startup ownership
* Keep manual queue holds independent of later turn endings
* Remove obsolete mobile queue barrier expectations
* Keep journal format initialization independent of its decoder
* Assert returned-row recovery for released send clients
* Preserve Stop assertion across handoff-only publication
* fix(agents): workspaces created on a paired host use the host's launch settings
Creating a workspace with agent picks or a draft could launch the paired host's agent with desktop settings, or lose the picks during recovery. Let capable hosts compose those launches from their own settings and preserve the user's inputs through fallback creation. Older hosts retain their existing requests.
* fix(agents): workspaces created on a paired host use the host's launch settings
When a workspace is created on a paired computer, agent picks and Arguments can be replaced by this computer's defaults or dropped during recovery. Keep explicit choices with the submission and let the paired computer resolve its own launch settings.
Preserve older-host request behavior, disabled-agent draft substitution and prompt submission, and restore the composer if compatibility preparation fails.
* fix(agents): workspaces created on a paired host use the host's launch settings
Keep the submitted choices available when a background launch has no prepared startup carrier. Tighten the regression checks for restored composer names, legacy commands and prompt submission so recovery preserves the user's work.
* fix(agents): workspaces created on a paired host use the host's launch settings
Creating a workspace on a paired machine could ignore its agent settings or lose a draft while the terminal connected. Keep the selected launch inputs and the pending text together through fallback and reconnect, and never replay partially written input. Preserve older hosts' launch commands and ordinary new-tab prompts' editable behavior.
* fix(agents): workspaces created on a paired host use the host's launch settings
Keep a workspace's pending prompt attached to its original terminal while the pane reconnects. Stop automatic delivery before reporting a final failure, retain the recoverable text, and recognize a launch handed off to the paired host even before its tab appears. Avoid delaying creation on a redundant host status request.
* fix(agents): workspaces created on a paired host use the host's launch settings
New workspaces on a paired computer could lose their first prompt when the terminal briefly disconnected. Delayed delivery could also continue after reporting failure, or leave terminal-only agents without an accessible copy of their prompt.
Keep pending prompts through attachment loss, stop content writes when automatic delivery ends, and offer the existing composer to recover unsent text. Preserve launch identity without inventing empty Arguments or treating missing metadata as a replacement.
* fix(agents): workspaces created on a paired host use the host's launch settings
A replacement pane can learn its terminal before the layout catches up after reconnecting. Re-registering the effective launch settings then dropped the original first-prompt identity.
Recover that identity from the existing verified terminal binding so later remounts keep the same pending prompt.
* fix(agents): workspaces created on a paired host use the host's launch settings
A terminal binding can identify the launch before its effective Arguments are known. Keep permission notifications working in that state without assuming a launch-settings recipe exists.
* fix(agents): workspaces created on a paired host use the host's launch settings
Keep an unsent prompt attached to its launch when a paired host briefly disappears, so reconnecting the same terminal can finish delivery. Clear the rest of the exited pane's status as before, and release the binding after delivery or a confirmed end.
Offer Copy prompt when automatic delivery finally fails, so the prompt can be pasted into the terminal that already opened. Keep creation-failure Reopen separate.
* fix(agents): preserve paired prompt recovery across transport updates
Resolve the consumed startup token through the pane's verified binding instead of reading renderer ownership during every remote attach. Keep the transport's host-authoritative exit and reconnect behavior and its fixture guards.
Settle pending prompt delivery when the host reconfirms a closed surface, including after it discards the terminal's exit record. Update the remount fixture for the Windows PTY model binding.
* fix(agents): merge duplicate imports flagged by type-aware lint
* test(agents): fix type assertions in paired launch fixtures
Type the repository rows, mutable agent choice and terminal tab used by
launch regressions. Reuse the session binding across its real installers
and document the partial-fixture adapters required by the runtime APIs.
Keep the RPC, remount and prompt-delivery assertions unchanged.
* fix(agents): route workspace terminals through their owning host
Creating a terminal for an existing workspace could send it to another focused server. Resolve its owning host when no explicit route was supplied, and keep the host-shaped draft regression within the shared startup contract so renderer checks do not pull in main-process code.
* test(agents): align launch fixtures with runtime dependencies
Retain real i18n exports while replacing translation output, hoist the terminal restore toast spy, and supply the explicit host environment used by paired terminal callers. Keep the existing behavior assertions unchanged.
* fix(agents): isolate prompt failure notice dependencies
Load the prompt failure notice only when a settled hosted launch needs it,
so workspace recovery consumers do not initialize toast and localized agent
catalogs just by importing delivery code. Keep prompt retirement and its
recoverable draft synchronous, and preserve the existing Copy prompt action.
Restore the ordinary new-tab failure toast's original invocation and verify
that Fix Checks retains its edited request through the activation handoff.
* test(agents): route legacy wire launches to their fixture host
Pass the paired environment explicitly in legacy terminal-creation fixtures,
matching real launch callers instead of relying on the focused host. Keep
all compatibility and accepted-creation assertions unchanged.
* fix(agents): preserve paired work-item completion without a startup plan
Blank-terminal work-item launches on paired hosts now keep their successful activation result. If the agent command cannot be built, show that error once instead of reporting an activation failure.
* refactor(agents): deliver paired creation prompts once like agent tabs
Drop the retained hosted-prompt lifecycle (pending map, rebind, deadline,
terminal retirement, token recovery). After the host creates the session the
desktop attempts the prompt once; failure shows the prompt-not-sent toast with
Copy prompt.
* fix(agents): silence prompt failures after closing a workspace terminal
Closing a paired workspace terminal before the agent was ready could report a prompt failure after that terminal was gone. Use shared launch completion and existing tab records to keep deliberate closes silent while preserving one Copy prompt notice after an interrupted delivery. Prepared launches now decide client delivery from the host request.
* fix(agents): report every failed paired prompt delivery
A paired host can retract its tab from inventory without the user cancelling the launch. Always report a failed prompt attempt with Copy prompt, using the same single-attempt completion as agent tabs.
* test(agents): name host-session fixture mock types
OrcaWinandOrcaWin
Neil
Brennan Benson
Kelvin Amoaba
Jinjing
Jinwoo Hong
