81 Commits

Include renames

Author	SHA1	Message	Date
Neil	b0dd73e7aa	feat(plugins): play a looping video behind app themes (#39450) ... App themes may set background.videoPath: a muted, looping MP4 or WebM (H.264 recommended, VP9 or AV1; one video track, no audio; <= 60 s, 8 MB, 2.3 MP) played over the required static background.path. Main checks it from container headers without decoding and serves it on the orca-plugin-image slot theme-<i>-video; images stay static-only. The renderer reveals it on its first frame, keeps the still on any failure or a decoded size past the limits, plays it only while main reports the window focused, shown and not minimized and no dialog is open, and omits it under prefers-reduced-motion. Animated WebP was measured and declined: software-decoded every frame, it cost 11-23 points of CPU vs 3-10 for the same loop as video. Implements #38363 proposed by @dohaidang.	2026-11-07 03:32:14 -08:00
Kelvin Amoaba	d8fb85f7bc	feat(browser): save and fill passwords in Orca's browser (#33994) ... * feat(browser): save and fill passwords in Orca's browser (experimental) Off by default under Settings > Experimental > Saved passwords. * fix(browser): secure saved passwords and fix login lifecycles * fix(browser): keep the guest preload self-contained so saved passwords load The shared uuid import split into a chunk the sandboxed preload can't require, so the whole preload failed on every page. Element tokens now come from crypto.getRandomValues. * fix(browser): fill a saved login on mouse press so clicking a row works Pressing Orca's UI blurs the page field, which closed the list before the click landed. * feat(browser): manage saved passwords from a Passwords section in Settings › Browser Replaces the Manage passwords dialog with an inline section: save and Touch ID switches, import menu, a searchable list grouped by site with last-used times and hover actions in a capped scroll box, delete confirmations, and an Add/Edit dialog. * feat(browser): turn saved passwords on for everyone instead of behind Experimental Drops the experimental flag, its Experimental toggle and the badge; the Passwords section in Settings › Browser now shows on desktop for the local host without opting in. With no toggle, the guest disable message and the apply-to-open-pages step had nothing left to trigger them. * fix(browser): refuse protected password actions when Touch ID is set up but unavailable, and keep fills on the matched page Touch ID lockout or a closed lid made canPromptTouchID() false, which counted as a Mac without Touch ID, so show, copy and protected fill went through unchecked. Enrollment from bioutil now tells the two apart. A fill also kept no hold on the page across the Touch ID prompt, so a page that navigated meanwhile got the password; it now goes only to the frame and origin it was matched for. * fix(browser): keep a browser profile when its saved logins can't be deleted Profile deletion removed the profile first and only logged a failed vault delete, so the encrypted vault could stay on disk with nothing left to retry it. The vault now goes first, and the profile stays (deletion reports failure) when it can't.	2026-11-05 02:08:08 +00:00
Neil	d09519f0f1	refactor: group workspace and runtime contracts by defining owner (#38018)	2026-11-03 20:19:21 -08:00
Neil	ec3a707868	refactor(browser): group routing and client-host owners (#37872)	2026-11-03 12:28:16 -08:00
Neil	b89cfbd09d	refactor: group desktop integration and lifecycle owners (#37600) ... * refactor: group desktop integration and lifecycle owners * refactor: preserve runtime literals and mock owner boundaries * refactor: link historical reliability evidence to current test paths * refactor: retain the historical lid-sleep baseline path	2026-11-02 17:08:59 -08:00
Neil	4b4c833e10	feat(window): working background opacity and blur on macOS, Windows and Linux (#36580) ... * feat(window): working background opacity and blur on macOS, Windows and Linux One window material model (opaque / translucent / blurred): macOS vibrancy without transparent, Windows 11 22H2+ acrylic, Linux transparent windows. Terminals paint their translucent background once, the transparent WebGL frame clears before drawing (#6491), and Reduce Visual Effects drops modal/backdrop blur and honors prefers-reduced-transparency. * perf(window): drop hidden macOS vibrancy while a theme image covers the window * refactor(settings): move Reduce Visual Effects into its own setting and search files	2026-11-01 01:41:07 -08:00
Kelvin Amoaba	4410ef318e	fix(browser): let agents and users answer page alert, confirm and prompt dialogs on their page (#36268) ... * fix(browser): let agents and users answer page alert, confirm and prompt dialogs on their page * fix(browser): watch a replacement guest for dialogs and ignore the opening keypress * fix(browser): ignore a repeated Enter in a guarded prompt field	2026-10-30 07:39:38 +00:00
3 people	edc0373fcd	plugins: Plugin Alpha (#35470) ... * i18n(plugins): drop retired plugin strings from the Portuguese catalog * i18n: keep the empty project group in the Spanish and French catalogs * i18n: retire translated entries for plugin strings this change rewords or removes * plugins: syntax contributions A plugin can contribute up to 16 syntaxes: a TextMate grammar, optional language configuration, and the file extensions and names it claims. Main validates every grammar when the plugin is approved (shape, scope, size, nesting) and lists only the file associations. A language's grammars cross IPC only when a matching file opens, and includes must resolve inside the same plugin. Catalog releases can declare syntax. * plugins: highlight files with plugin syntaxes Files Orca shows as plain text use a matching plugin syntax. Its grammar compiles once in a worker that stays warm between edits and runs under core's per-line limits; a worker that stops reporting progress or crashes is terminated, the language stays plain, and the plugin card says so. Tokens reach Monaco as semantic tokens, so Monaco asks only for models shown in an editor, keeps one request per model, and keeps painting the previous colors, shifted by edits, until the new pass lands. Plugin languages borrow ids from a pool of fixed Monaco languages, counted by the editors using them; a language no editor uses moves its models back to plain text, and the least recently used idle slots are reused first. * plugins: Gleam syntax example pack An official-style data plugin with the upstream Gleam TextMate grammar (Apache-2.0, provenance and license alongside) and language configuration. A test installs it through the production inspection and loads it through the syntax registry. * plugins: list themes, icon themes and syntaxes in the marketplace preview The preview's Includes line named only language packs, commands, shortcuts, VM recipes, panels and events, so a theme or syntax pack read as "Manifest metadata only". * fix(plugins): a syntax failure belongs to one revision, not the syntax id A grammar that failed in revision A kept the plugin card flagged after revision B replaced it. Failures are now keyed by id@revision, matching the runtime slots, and dropped when the installed list no longer contains that revision. * chore(plugins): format the Gleam example grammar * plugins: import the Monaco editor API, not the full bundle, from the syntax runtime * plugins: type the syntax engine against the Monaco API it uses * plugins: suggest a catalog plugin for files Orca can't open When a file shows as plain text or as a binary Orca can't display, and a cached catalog lists a release whose fileTypes include its extension, the editor offers it: View plugin opens the marketplace preview (never an install), Not now hides it for the session, and Don't suggest remembers the extension. Suggestions come only from cached, verified catalogs, skip kill-listed releases and anything an installed (even disabled) plugin already handles, and can be turned off in Plugins settings. A release's fileTypes must match its manifest's syntax extensions. * fix(plugins): scope the file-type suggestion's Not now to the file type The editor stays mounted when its file changes, so a single hidden flag suppressed the suggestion for the next file type too. Track which file type was hidden instead. * plugins: type the plugin-owned settings normalizer inputs * plugins: update the preview-request callback ref after render, not during it * test(plugins): smoke specs for themes, syntaxes and file-type suggestions Three end-to-end specs join the demo and marketplace journeys: - an app theme and icon theme apply from Settings and fall back when the plugin is disabled; - a plugin syntax highlights an already-open file, re-highlights it after a grammar update, and lets go when disabled; - a v2 catalog release with fileTypes is suggested for an unknown file, View plugin opens its preview without installing, and Don't suggest is remembered. The marketplace spec's Git fixture helpers move to a shared helper. * test(plugins): say why the file-type suggestion e2e needs a longer timeout * test(editor): install Monaco's cancellation guard in the owner view-state test The test mocks monaco-setup, which skips the guard production installs, so a disposed editor's pending word highlight surfaced as two unhandled "Canceled" rejections once plugin syntaxes added a render. The run passed but reported errors. * plugins: plugin app themes recolor the code editor When a plugin app theme is active, every Monaco surface (editor, diffs, notebook cells, code excerpts, automation prompt) uses a theme derived from the colors the document is actually painted with: editor background, text, line numbers, cursor, selection, current line and widgets. Syntax colors stay the built-in light or dark ones; if text would fall below 4.5:1 or a syntax color below 3:1 on the plugin's editor background, the editor keeps its built-in theme. Colors are resolved to hex through the browser's own parser, so color-mix() and other CSS color forms work. The theme is redefined when the plugin updates or the mode changes, and the editor returns to the built-in theme when the plugin theme is deselected, disabled or removed. * refactor(plugins): one module per contribution point and a single points table The manifest's contributes object, the execution-profile derivation and the catalog type list now read one PLUGIN_CONTRIBUTION_POINTS table instead of three hand-kept lists. * refactor(plugins): express id and path rules as patterns Plugin ids and relative paths now validate with a regex first, so a generated JSON Schema can carry them as `pattern`. The predicate only adds what a pattern cannot (reserved names, Windows device names), and a bad value reports one issue instead of two. * plugins: document every manifest and catalog field in the schema Each field now carries a description, examples and the Orca release that first reads it, and each contribution item has a named fragment id. Manifest v2 accepts an optional $schema key for editor completion, and the catalog gains an authoring schema built from the same field definitions. * plugins: generate published JSON Schemas and author references from zod pnpm generate:plugin-schemas writes schemas/plugins/orca-plugin.schema.json, schemas/plugins/orca-marketplace.v2.schema.json and the matching reference pages under docs/reference from the runtime schemas. A test fails when the committed files drift, when a field lacks a description or since-version, when a documented example does not validate, and when the schema and the runtime disagree on bundled manifests or known-bad inputs. * plugins: report every manifest and catalog mistake with its path Manifest and catalog validation now lists up to eight distinct problems as `contributes.themes[0].label: must not be empty` instead of zod's first raw message, and rewrites parser wording (required, unknown keys, allowed values, limits) into what the author should change. * plugins: say which Orca a newer plugin or catalog release needs A manifest the strict schema rejects is pre-read for engines.orca and manifestVersion first, so a plugin built for a newer Orca reports "requires Orca >=X (this is Y)" instead of unknown-key noise. A catalog release whose minimumOrca is above this build stays listed but is refused before anything is downloaded. * plugins: version the published schemas and pin v2 fields to a real release Schemas move under schemas/plugins/v2/ so a later breaking format can publish beside them without changing what a pinned URL means, and the example plugin authors copy carries its own copy for offline completion. Fields new with manifest v2 cite one constant, PLUGIN_MANIFEST_V2_SINCE (1.4.232, the release after the latest tag), and a test fails once a tag at or above it ships without manifest v2. The reference documents format 1 as legacy. * plugins: open review when enabling a plugin that was never approved Dismissing the review dialog records keep-disabled without consent. Turning the plugin's switch back on then only cleared the disable, so it returned to "Needs review" with no dialog. Enabling now opens the review whenever the result is still pending. * plugins: release details for the plugin detail page Catalog releases may carry a license, repository and homepage (https only), an updatedAt date and a short plain-text changelog; an invalid value is dropped so it never hides the plugin. Manifests may declare license and homepage. Marketplace listings flatten name, version and those details, and installed plugins report license, homepage, repository and the version a rollback would restore. The JSON lint-staged step no longer fails a commit whose only staged JSON files are generated schemas the formatter ignores. * plugins: fold in the schema review - Parity runs both ways: documented examples also pass their zod field, bundled manifests pass both the schema and the runtime, and manifest and catalog negatives (traversal, oversize, wrong types, duplicates) fail in both. A table lists every rule only the runtime can enforce, and each is named in the description of the field it constrains. - The published files carry the format in their names (orca-plugin.v2.schema.json, orca-marketplace.v2.schema.json); $id stays on main until the v2 release, and a test demands the release tag once it exists. - The v1 since-value is 1.4.160, the first release that read plugins, and a test pins it to the tags. engines.orca documents that format 2 needs at least the release that ships it. - v2 catalog sources strip unknown keys like the rest of the entry, and the v2 runtime schema is derived from the one authoring definition, whose plugins field documents the duplicate-id rule. Contribution types and categories declare uniqueItems; fileTypes items come from the file-type schema itself. - Issue messages no longer depend on zod's English: a missing field is told from the input, and every pattern carries its own message. Unknown-key lists show five keys plus a count, and each line is capped at 200 characters. - A prerelease host (1.5.0-rc.1) now ranks below its release, as in semver. * plugins: read the rollback version on demand, not while listing The plugin list is rebuilt at startup and on every plugin change, and each installed plugin cost a directory read to find the version a rollback would restore. That moves to plugins:getRollbackVersion, which the detail page calls when it shows the action, and a test pins the list build to zero filesystem calls. * plugins: v1.4.232 shipped without manifest v2, so v2 fields cite 1.4.233 The release-tag check caught it: v1.4.232 was cut from main before this stack landed. * plugins: list installed plugins while the plugin system is off With the system off the service discovers nothing, so plugins:list returned an empty list and the settings page could not show what is installed. The client list now reads the install tree on demand in that state and projects every plugin as disabled; nothing is activated or started, and startup with the system off still does no plugin I/O. Older clients that hid the list while off are unaffected. Also for the plugin page: plugins:getInstalledManifest returns one installed plugin's parsed manifest on demand, marketplace installs report the catalog ref beside its URL, and the listing type declares the release record it already carried. * plugins: final schema decisions for catalogs and versioning Catalog - The catalog is orca-catalog.json with a required catalogVersion: 2; a client that sees a higher version refuses with "update Orca to browse this catalog". New clients read it first and fall back to the frozen orca-marketplace.json, which export-legacy-plugin-catalog.mjs generates. - Parsing is tolerant at every level: unknown keys are stripped, unreadable entries and releases are skipped, over-limit lists are trimmed, a repeated id keeps the first copy, invalid display-only fields are dropped. pnpm validate:plugin reports each of those as an error for authors and CI. - Entries list releases newest first; Orca offers the first whose minimumOrca it meets, and shows "Needs Orca X" only when none fits. Versioning - engines.orca is the only gate and must cover the newest since-version of every field and enum value used (capabilities, events and built-in actions now carry per-value since tables). The check is part of the v2 schema, so validation, catalog checks and installs all enforce it. - pluginApi is optional in format 2 (defaults to 1) and refused on data and instructional plugins. Format 2 rejects unknown keys at every level, including engines, author and every contribution item. - contributes.agents is reserved for coding-agent definitions and must be empty in format 2 until their format exists. - Plugins are gated against the newer of the app version and the newest since this build defines, so development and local builds, whose package version only moves at release, read the fields they introduce. The policy is written into the generated references and pinned by tests. * plugins: one-click install for content-only plugins, and the verified profile on the list installMarketplacePlugin takes an optional enableIfData. Main then turns the plugin on in the same step only when the installed, verified manifest is execution: data, approving exactly the fingerprint it just installed through the normal consent path; anything else comes back needsReview: true, whatever the renderer sends. Older hosts ignore the field and leave the plugin pending. Installed plugins now report their verified execution profile, so the plugin page never infers "content only" from the absence of a worker. * plugins: images and contribution summaries for plugin pages Manifest format 2 gains cover and screenshots (alt text required), and its icon must be a square PNG or WebP. Images are checked at install from their headers only: static PNG, JPEG or WebP, per-kind pixel and byte limits, at most 4096 pixels a side and 8 MB in total, so nothing is ever decoded to decide trust. Catalog releases may carry images stored in the catalog repository and pinned by SHA-256, a summary of what they add, and the capabilities they ask for, so a listing can show the plugin completely before anything is downloaded. All three are dropped when unreadable; the summary and capabilities must match the manifest exactly at install. pnpm validate:plugin checks each image's hash, size and format against the repository files. * plugins: serve plugin and catalog images from verified bytes Images reach the renderer only as orca-plugin-image URLs, which main serves with nosniff and the type it read from the header: - catalog images are read from the catalog repository at the fetched commit, kept only when their hash, size and format match, and cached by SHA-256; a listing references only those; - preview images are cached by hash before the staging tree is deleted; - installed plugins' images are named by plugin, install hash and slot and re-checked on every read, so listing plugins still reads no files. Listings, previews and installed plugins carry an images field the plugin page can render without fetching anything else. * plugins: catalog theme palettes, and one-click never approves a dev override Catalog releases may list up to four theme palettes (hex colors only) so a listing can draw theme cards before install; they are display-only and dropped when invalid. One-click enable now also refuses when a development override shadows the installed plugin, since those are not the bytes the user just chose. * plugins: one-click approves only the fingerprint the user saw installMarketplacePlugin takes an optional expectedFingerprint, the preview's consentFingerprint. With enableIfData, main now approves only when the installed fingerprint equals it, so bytes that changed between preview and install stay pending for review instead of being enabled. The release commit is already pinned by resolvedCommit. Older hosts ignore the field. * plugins: gate manifest v2 on 1.4.242 and publish schemas under docs/schemas v1.4.240 shipped without manifest v2, so the first release that reads it is 1.4.242. The root-directory guard refuses a new top-level schemas/ folder. * plugins: read unvalidated schema input through a typed object guard and break the image validation import cycle * plugins: one place decides an installed plugin's status word Pull the status ranking, label and enabled/needs-review checks out of the settings row so the coming list rows and detail page read the same words. No visual change. * plugins: one list entry shape for installed and catalog plugins PluginListEntry joins an installed plugin to its catalog listing (or stands for a listing alone), and matchesPluginSearch is the one search both lists use. No visual change. * plugins: usePluginCatalog owns catalog loading, refresh and preview Sources, listings, refresh, the install/update preview and the outside preview request move out of PluginMarketplaceBrowser into one hook the coming list and detail page share. The browser keeps only its view state. No visual change. * plugins: one plugin list with fixed slots, a plugin page, and inline states - Installed plugins first, then one group per catalog (verified/unverified · owner or URL), capped at 6 rows with Show N more; every plugin appears once - Rows: the name opens the plugin page and covers the row; status, action, switch and ⋯ are fixed-width sibling slots in Tab order. Update {version} is the action when a catalog has a newer release; Stopped offers Restart with a red mark on the switch; Blocked offers Remove… - Plugin page in the same pane: what it adds (commands with platform shortcut chips, panels, recipes, contribution summary), what it can access, logs, and info. Back link, Alt+← or ⌘[ return focus to the row - States inside the list: skeletons, a catalog that fails only affects its own group, no results with Clear search, nothing installed. Plugins off keeps the installed list visible, dimmed - Add plugin ▾ (folder, Git URL) replaces Install plugin; Plugin system stays at the top - Catalog listings now expose their release (name, version, minimum Orca, types) to the renderer * plugins: filter by category and catalog, one review for Update all, Needs newer Orca - Filter popover (category, catalog) next to search; search and filters show every match - Update all opens one review: updates that ask for new access are expanded with what's new, the rest are one line, any can be unticked; installs run one at a time - A catalog release that needs a newer Orca says so and disables Install, in the row and the page - Installing from a plugin page shows a review with only access and source, since the page just showed what it adds * plugins: plugin page uses the manifest name; Off status word; official isn't a category * plugins: catalog sources live in the Add plugin menu * plugins: search takes its own row when the list is narrow * plugins: release notes, license and links on the plugin page; roll back names its version * plugins: fix list review findings Plugin page owns the pane (back link and plugin header only); Adds to Orca names every contribution; access never reads as 'nothing' when the check failed; filter kinds have readable names; Update all is reachable, fetches once per open and routes updates needing review; installed plugins join their own catalog; attention-first order; paused list while plugins are off. * plugins: readable category names on the plugin page * plugins: Update all keeps its set; reviews queue; updates only from the plugin's own catalog * plugins: name what an off or unreviewed plugin adds from its manifest; join catalogs by url and ref * plugins: Needs Orca checks use the version plugins are gated against Main gates plugins on pluginHostVersion, the newer of the app version and the newest since-version the build reads. The plugin page compared releases to the raw app version, so a development or local build showed Needs Orca for plugins it would install. * test(plugins): e2e journeys follow the redesigned plugin list The page offers "Turn on plugins" while the system is off, catalog rows share the installed rows' data-plugin-key, the review action is "Review", and an enabled plugin reads "On". * plugins: describe access from the verified execution profile, never from "no worker" A commands-and-shortcuts plugin's page said "Content only. It has no code that runs." because the page treated "no worker" as "no code". A worker plugin without capabilities read "runs in a sandbox". The page now classifies from the catalog release's execution profile (install refuses bytes whose manifest differs), the fetched manifest, or the installed manifest's profile from the plugin list's `execution` field. Unknown stays "Reading…" or "Couldn't read", never content only. The review dialog uses the same profile, and an older host that omits it is reviewed as instructional. * fix(plugins): read revision-scoped syntax failures on detail pages * plugins: use the Blocks glyph for icon themes in the plugin page * plugins: update latest-value refs after render in the update dialog and page navigation * i18n: retire translated entries for plugin strings this change rewords or removes * plugins: one action to install, inline consent, and a picture-first catalog Settings > Plugins no longer opens a confirm dialog and then a review dialog. - Content-only catalog plugins install from their card or page in one click; main turns them on only when the verified manifest is data. Undo stays in place for 10s. - Plugins that run code or instructions show "If you install <Name>, it can:" on the host security surface above one Install & enable, which stays off until the access rows are read, and approves exactly the fingerprint shown. Review of an installed plugin happens on its page too (Enable / Keep off); Remove stays in its menu. - The catalog is a grid of cards drawn from what each plugin is (its theme colours once installed, a code sample, keycaps), with the name as a stretched link and one action. - The page pins the listing it opened, says "Newer version available" instead of swapping rows, and previews are prefetched only on hover intent, capped per visit. - The plugin system switch, file suggestions, catalog sources and development folders move into a header menu; amber text uses a contrast-safe token. * plugins: give the reworded no-access line its own key so English shows the new copy * plugins: pin installs to the release shown, warn by what a plugin carries, disclose replaced shortcuts - The page pins the listing it opened; a preview of any other release (commit, catalog commit or execution profile) leaves Install & enable off and shows "Newer version available". One-click installs from a card refuse the same mismatch. - Warnings are the union of the verified profile and the contributions: a panel that also adds commands gets the instructions warning, never "bounded" or "own files only"; unknown contributions over-warn. Access rows follow the same rule. - Shortcuts that replace one of yours are named in the consent before install, from the manifest or the catalog summary; the shortcut list itself stays in Adds to Orca. - Pages paint from the catalog summaries, capabilities and theme palettes, and show the cover (or the card's art) as a hero, with screenshots in a strip and lightbox. - Installing fills a reserved status line and keeps its action row (Undo, Use now), so the page doesn't move; the settings scroller keeps a stable gutter. - Row art names the plugin type instead of initials, rows drop the "Needs review" word, the content hash moves into the menu, and card art is tinted and coloured. * plugins: catalog covers on cards * plugins: Review reopens its page after Back; hero art and stable status line follow what an installed plugin carries * test(plugins): e2e journeys review and install on the plugin page, with no dialogs * plugins: install exactly the release shown, classify from the full manifest, polish the page Code review: - A page or card arms Install only when the preview matches everything the listing showed (catalog commit, release commit, content hash, execution); any change, including a catalog-only refresh, reads "Newer version available". One-click installs send the preview's fingerprint as expectedFingerprint, so main turns on only those bytes. - Install stays off while a catalog refresh is in flight. - Trust uses the full verified preview manifest when present; a capped catalog summary counts as unknown and gets the stronger warning. - The installed-manifest read is keyed by plugin and installed revision, so a same-key update never pairs old contents with the new fingerprint. - A failed Undo shows its error on the card or page and keeps Undo to retry. - The security-surface test now covers the inline consent instead of the removed dialog. Visual: - Lightbox: close button clear of the image, "1 of N" with previous/next and arrow keys, content scrolls on short windows, focus returns to the opening thumbnail. - Keycap art shows the plugin's own first shortcut, larger, with the platform's keys. - The hero fills the content column; a screenshot identical to the cover isn't repeated. - "Change in Shortcuts" is a link; the chip says "Adds commands" (or "Runs a worker", "Adds a panel", "Content only"); the disabled button says "Reading what it can access…". - A content-only plugin's action row keeps fixed slots, so its note doesn't move on install. * plugins: keep the decision above the fold, route suggestions to the page, final review fixes - The page shows the decision (Install, the consent, Enable) before the picture, and the picture is capped and cropped from its centre, so the button is in view at 1280x800 and 900x700. Nothing grows after first paint. - The consent gives no access verdict while the plugin is still being read. - A file-type suggestion opens the plugin's page instead of the old install dialog; that dialog now serves updates only. - A theme plugin reserves its "Use now" line from first paint; the action slot and its button share one width. - The file-suggestion toggle reports a failed save; a failed Undo is reported once, on the card or page that offered it. - Cards show a plain trust chip ("Content only", "Adds commands"); the local and bundled group reads "Bundled & local". - Install error copy moves into the protected plugin namespace, and the new consent components join the language-pack security pins. - Dead code goes: the keybinding consent preview (its conflict helper stays), its strings, trustRunsNothing and the access-only preview plumbing. * test(plugins): the file-type suggestion opens the plugin page, not a dialog * plugins: the install decision sits top-right beside the name; no plugin on/off switch in the UI - Plugin page: Install (content only), Install & enable (disabled until its access is read), Enable / Keep off (installed, waiting for review) and the installed switch share one slot top-right of the title. The consent sits directly under the header with no button of its own; the "Can't reach anything outside its own files" note sits on the line under the publisher, which every state reserves, so nothing moves between states. - Removed "Turn off plugins" from the ⋯ menu and the "Turn on plugins" button from the off state. The setting and all gating stay: off now comes only from policy, and the page says so without a switch. - e2e journeys turn plugins on through the setting and use the page's one button. * plugins: restore Turn on plugins, drop Undo, add Remove to installed card menu Plugins stay opt-in, so the off state keeps its Turn on button; only the menu's Turn off item stays removed. Installed catalog cards get a sibling more-actions menu with Remove (immediate, inline error) and Turn off/on, inside a fixed-width action slot so the footer doesn't shift. * test(plugins): installing a theme plugin never changes the active theme * fix(plugins): confirm card removal before deleting data * fix(plugins): pause review queue when leaving plugin page * fix(plugins): disclose execution changes before updating * refactor(plugins): share single and bulk update review * refactor(plugins): share installed card and row actions * test(plugins): cover confirmed removal and shared update review * feat(plugins): offer icon and terminal themes after install * test(plugins): capture settled review dialog screenshots * fix(plugins): make installed contributions discoverable and actionable * fix(plugins): label card-install toast Try it and mark terminal-theme Use now buttons The toast action opens the plugin page rather than applying a theme, so it always says Try it. Terminal themes often share their app themes' names, so their Use now buttons carry a terminal icon. Update the update-review e2e for the Use now accessible names. * fix(plugins): apply a theme plugin's themes when the user installs or enables it Installing (card or page) or enabling a plugin that adds themes now applies its app theme (matching the current light/dark mode), icon theme and terminal theme at once, with a 'Now using' toast whose Switch back restores the previous selections. Updates, startup discovery and catalog refreshes never apply. Co-Authored-By: Claude <noreply@anthropic.com> * plugins: call toast actions through a typed button in tests; key card art by stable names * i18n(plugins): drop retired plugin strings from the Portuguese catalog * test(plugins): say why the update review e2e needs a longer timeout * i18n: retire translated entries for plugin strings this change rewords or removes * refactor(plugins): organize main plugin files by responsibility * refactor(plugins): group shared plugin schemas and contracts * refactor(plugins): organize renderer plugin surfaces * plugins: keep the plugin service under the line limit after the folder moves * refactor(plugins): move the JSON object guard beside the manifest schemas * test(plugins): move the flaky-test baseline entries with the worker tests they count * test(plugins): point the panel lifetime test at the reorganized plugin folders * plugins: reserve skills, mcpServers, taskSources, connections and settings contribution keys Format 2 accepts each key only as an empty list, so the points can ship later as additive minors without a new manifest format. * plugins: freeze host API v0 with a generated reference and refuse unknown pluginApi majors The method table now carries a summary and an optional deprecatedSince, and renders docs/reference/plugin-host-api.md with the stability and deprecation policy. A manifest naming a newer host API major fails with "update Orca" instead of "must be 1". * plugins: name the bad release in catalog validation and re-ask on any execution profile change validate:plugin now reports each unreadable release with its reason (for example a tag instead of a full commit SHA) rather than a count. The consent fingerprint includes a declared non-data execution profile, so a data pack that becomes instructional no longer keeps its one-click approval. Tests pin that catalogs drop non-SHA releases, that a repository cannot load or approve a plugin it carries, and that added capabilities or a changed profile always need re-approval. * plugins: add the author guide, theme token list, v2 examples and a printed catalog release entry docs/reference/plugin-authoring.md walks write, load a development folder, validate and publish. The theme token table is generated from the public token set and its fallbacks. hello-orca and hostile-panel move to manifest format 2. validate:plugin on a plugin repository root materializes HEAD the way install does and prints the release entry to paste into orca-catalog.json. * plugins: name the host API type renderer and reserved contribution fields for their role * plugins: gate the bundled example plugins on 1.4.240 * plugins: reserve orca, orca-*, official, anthropic, openai and github publishers * plugins: rename storage/secrets to storage:own/secrets:own and gate events by domain capability events:subscribe and the events.subscribe host method are gone; workspace events need workspace:read and agent status needs the new agents:read. Format 1 manifests keep their old names, rewritten on parse. * plugins: move samples and fixtures off the now-reserved orca-samples publisher * plugins: name the public surface workspace, not worktree Events become workspace.created/removed with workspaceId and a kind field, agent status carries workspaceId, and command context/keybinding when use workspace. Format 1 names are rewritten on parse, v1 workers still receive worktree.* handlers, and clients treat any non-global context from older hosts as workspace-scoped. * plugins: rename the instructional execution profile to declarative * plugins: move agents into the reserved contribution keys Format 2 keeps contributes.agents empty like every reserved point; format 1 entries, which Orca never read, are dropped on parse so they stay inert and bind no content. * plugins: skip unknown theme tokens and icon slots at runtime, refuse them in validate:plugin A token or slot added in a later release no longer fails the whole theme on older Orca. validate:plugin now parses each theme, terminal theme and icon theme strictly. App themes accept an optional schemaVersion 1. * plugins: inject panel design tokens as --orca-* custom properties * plugins: accept a closed, documented list of panel icons Format 1 panels keep any icon name: a known one in either Lucide spelling is canonicalized, an unknown one is dropped and shows plug, as before. * plugins: make catalog release types optional and derive them Every required release field is permanent for old clients, and types repeat what contributes and execution already say. Printed release entries no longer include it. * plugins: strip unknown kill-list and consent fields instead of refusing them A strict kill list froze old clients on their cached list as soon as a later list added a field, silently stopping revocation; a strict consent request would refuse a newer client's optional review field. * plugins: check only the shape of a panel action in the renderer The host's capability gate already refuses methods panels may not call. Filtering against the client's own method list blocked every panel method a newer host added on older clients, including remote and SSH ones. * plugins: read a leading >=x.y.z from engines.orca leniently in the compatibility pre-read * plugins: derive content-bound approval from the contribution policy table Each point now declares bindsContent, replacing the hand-kept list in the consent fingerprint, so a new point such as mcpServers cannot swap bytes under an old approval by being forgotten. * plugins: name the host API "Host API 1" and add a stability section to the author guide The guide now lists what is stable and what is experimental: the agent status payload, the worker process model, language-pack keys, validate:plugin output beyond its exit codes, settings:own and manifest format 1. Secrets copy now says encrypted file, not OS keychain. * plugins: make the hello-orca sample speak in plain words The worker command returns a sentence instead of a JSON object, and the panel labels terminals by position instead of their opaque ids. * plugins: give plugins short branch names, not refs/heads/... * plugins: panels can no longer type into terminals; workers only (D3) terminal.sendText with Enter runs shell commands locally or over SSH, which the sandboxed-panel tier's "limited" consent copy did not convey. The capability copy now says so, and the sample panel no longer types. * plugins: put full-access worker plugins behind a second setting, off by default (D2) Trusted workers are unsandboxed Node, so the plugin system switch alone no longer lets them run. With "Allow plugins that run code with full access" off, main refuses to install a full-access catalog release, approve or enable one, and keeps installed workers stopped with an error naming the setting. The catalog card says "Full access · turned off in settings" and links to the switch; the worker chip now reads "Full access". * plugins: bind dev-folder approval to the folder it was given for A dev plugin's consent fingerprint now includes the folder's canonical path, so approving one dev folder no longer approves another folder whose manifest claims the same key and capabilities. The development dialog now says edits inside an approved folder run without another review. * plugins: close WebRTC as an outbound channel from panels CSP has no WebRTC directive, so a panel could reach a STUN/TURN server it controls despite connect-src 'none'. The panel shell now locks RTCPeerConnection to undefined before plugin code runs, and the main window that hosts panels gets the same WebRTC IP-handling policy as doc preview guests. DNS-prefetch hints remain the residual doc preview already accepts. * plugins: stop language packs relabelling trust copy outside plugin settings Protection covered only plugin copy under settings, so a content-only pack could rename the catalog's Official badge, the file-type suggestion banner, or swap Allow and Deny on agent approvals. Those components are now protected whole, the same way the plugin security dialogs are. * plugins: refuse Git URLs with a dash-led user or host, or a '..' host ssh reads a leading '-' as an option, and the scp form is not normalized, so 'stablyai/../evil' read as the official owner. The shared URL check used by the catalog schema, validate:plugin and every install path now refuses these, and provenance parsing refuses '..' path segments. * plugins: flag an update whose catalog moved it to another repository An update whose catalog now points at a different repository showed the new URL without saying it changed. The update review now names the old and new repository and leaves that update unticked, so it installs only once the user opts in. * plugins: sample worker returns a readable toast; sample panel shows no internal ids Hello Orca's ping returned raw JSON, which the command toast printed as-is, and its panel showed the full ref name. It now returns a sentence and shows the plain branch name. * plugins: move runtime policy checks and catalog types out of files over the line limit * plugins: refresh the plugin safety list every 6 hours while plugins are on Revocations previously reached a session only at launch or when plugins were turned on, so a long-running Orca kept running a revoked plugin. * plugins: main sends an update from a moved repository to review The update dialog left such updates unticked, but main still accepted a one-click approval for them. Main now compares the installed and new repository itself and always answers needsReview. * plugins: label the plugin system Alpha instead of Experimental Settings badge, nav entry badge, search/description copy in all locales, and plugin docs' stability sections. Setting keys are unchanged. * plugins: trim the Plugin settings menu to titles and a short full-access hint * plugins: reserve statusBarItems and sidebarCards and list planned contribution points Both keys are rejected when non-empty, like the other reserved points. The manifest and authoring references gain a Planned contribution points list built from one table. Also moves the Alpha note on the host API page into its generator so the schema/doc parity test passes again. * plugins: an update that asks for nothing new keeps its approval Before, any catalog update to a declarative, sandboxed-ui or trusted-worker plugin changed its consent fingerprint (it binds the package bytes), so the plugin turned off and waited for review after every Update. Only content-only (data) plugins kept running. Main now reads the approved version before installing and, when the update comes from the same repository and adds no capability, no higher execution profile, and no new command, shortcut, panel, event or VM recipe, records the new fingerprint so the plugin stays on. Anything that grows access, a moved repository, a development override or a plugin that was never approved still waits for review, and the full-access switch still gates trusted workers. The update preview now carries what grew, so the Update dialog lists new shortcuts, commands, panels and events as well as capabilities. The consent copy says updates that don't ask for more access install without asking. * plugins: match the full-access test to the shorter setting name * plugins: update catalog plugins automatically when an update asks for nothing new Adds "Update plugins automatically" to Plugin settings, on by default. The setting is pluginUpdatePolicy ('auto' | 'manual') so later policies can be added without a migration. At startup (after a short delay) and every 12 hours, packaged Orca refreshes the catalogs and, for each enabled, approved catalog plugin with a newer release, installs it in place when it comes from the same repository and grows no access; the approval carries over and the worker reloads. A release from a non-official catalog installs only after it has been listed for 12 hours, timed from when this Orca first saw it (stored locally because catalogs carry no listed-at time), so takedowns can land first. An update that grows access or moved repository is not installed: the current version keeps running and the plugin shows "Update needs review", whose Review update button opens the existing update review with what is new. Plugins updated this way show a quiet "Updated to vX" chip, and each pass shows at most one toast. Manual Update and Update all are unchanged. * plugins: clear code-quality findings in the update approval and auto-update code * plugins: give an app theme that leaves --sidebar unset a visible sidebar edge Orca draws no line between the left sidebar and the main area; the sidebar's slightly different surface is the edge. A theme that omitted --sidebar (like the Dusk sample) had it filled from --background, so the sidebar matched the main area and the edge vanished. An unset --sidebar is now mixed 8% toward the theme's foreground. The in-repo sample theme sets --sidebar explicitly and the theme smoke test checks it reaches the sidebar. * plugins: treat an unknown update policy as manual, not auto * plugins: auto-update only pinned releases, and only the release that was held * plugins: start the auto-update hold clock before the catalog refresh, and check every 6 hours * plugins: refresh the kill list right before auto-installing, and skip the install if that fails * plugins: refuse an unpinned full-access install while full access is off * plugins: an automatic update re-checks inside the install lock that the plugin is still installed * plugins: compare the full repository path, so a GitLab subgroup move counts as moved * plugins: time out the kill-list fetch and retry 15 minutes after a failure * plugins: drop one unreadable kill-list entry instead of the whole list * plugins: keep language packs off the orca.yaml and notebook trust prompts, certificate warning and site permission prompt * plugins: compare whole capability declarations on update, and cover swapped command actions and shortcuts * plugins: log automatic updates so headless and remote hosts record them * plugins: say that automatic updates can change what a full-access plugin does * plugins: pin and document the nested-frame WebRTC residual in plugin panels * plugins: delete the unused PluginReviewBody * plugins: drop the dead repositoryMoved parameter and the predecessor wrapper * plugins: declare the plugin policy settings type once * plugins: show what main found an update changes instead of recomputing it in the renderer * plugins: move update approval and update policy into the catalog folders * test(plugins): expect the workspace.removed event name in the lifecycle test * plugins: rename structural helpers for their role, type the update identity read, and give plugin system settings their own group * i18n(plugins): drop retired plugin strings from the Portuguese catalog * plugins: build the hello-orca status line with a template string * plugins: install catalog plugins from a directory of a shared repository A catalog source may name a 'path' inside its repository. Orca downloads the pinned commit as before but materializes only that subtree, so contentHash covers the plugin's own files and sibling commits never change it. A changed path counts as a moved repository and needs review. validate:plugin accepts a subdirectory and prints its source path; the frozen v1 export skips such entries. * plugins: offer the full access setting on a full-access plugin's page The page offered Install & enable even with full access off, then failed with a generic error. It now shows the card's 'Turn on in settings' action, names the real reason when main refuses, and drops a stale install error once the full access setting changes. * plugins: say a content-only plugin couldn't load its files, not that it crashed Language packs and other data plugins have no code or logs, so a load failure now reads "Couldn't load its files" on the page and the row instead of "Its code kept crashing". * plugins: leave Settings before running a built-in action from a plugin page Built-in actions such as Open Board and Go Back are disabled while Settings covers the app, so Run on the plugin page always failed. Run now closes Settings, commits that synchronously so the dispatcher sees the app view, then runs the action. * plugins: refuse terminal:send on panel plugins and never list it on panel approvals Panels get no host method that types into a terminal, yet a panel's approval listed "Type and run commands in your terminals". Format 2 manifests now fail validation when a profile below trusted-worker asks for terminal:send, and approvals, the access section and update review drop that line for format 1 panels that still declare it. * plugins: say "catalog" in user-facing copy, not "marketplace" The menu said "Catalog sources…" but the dialog it opens said "Marketplace sources" and asked for orca-marketplace.json. Plugin copy now says catalog in every locale, names orca-catalog.json (still accepting the older file), and the author guide matches the UI. Internal identifiers and settings keys are unchanged. * test(plugins): run a built-in action from its plugin page end to end * plugins: concise copy pass across plugin UI Update review shows one line per plugin and only what's new for updates that need approval, with the rest behind a See all access disclosure. Consent, Can access, dialogs, settings menu and empty states drop restated titles and filler; safety facts (new access, full access = files/network) stay visible where the user decides. * plugins: keep See all access on Button and Collapsible primitives' own spacing * plugins: separate light and dark theme slots so packs pair and mix Plugin app themes now fill a Light theme or Dark theme slot by their base. Orca paints the slot for its current mode, so under System it swaps live with the OS. Appearance shows both pickers grouped by plugin; install fills the matching slot(s) and Switch back restores them. A legacy single selection migrates into its base's slot. * plugins: installed carousel and card grid, category badges, In use state; load language packs that cover protected copy * fix(theme): let plugin themes colour menus and dialogs Menus, popovers, selects, hover cards, sheets and dialogs painted a fixed glass tint (dialogs rgb 23,23,23 in dark mode), so a plugin theme's --popover was ignored and a true-black theme still showed grey dialogs. The tint now lives in --floating-surface / --dialog-surface, which a plugin theme replaces with its --popover. * plugins: name the app-theme slot a pack fills, not its terminal colours * plugins: page the installed row by whole cards; e2e follows the card menu * plugins: hide the installed row's scrollbar and draw kind art instead of initials The installed carousel pages with its arrows and snap points; the native scrollbar under it only added a stray bar. Format 1 catalog listings (the official catalog until catalog v2 publishes) carry no release types or images, so their cards fell back to a two-letter monogram. Art now reads the kind from catalog categories, and the last fallback is a plugin glyph. * plugins: reserve official publishers to Orca's catalog and pin installs to their catalog Reserved publishers (stablyai, official, anthropic, openai, github, orca*; case-insensitive) and orca-* ids now install only from Orca's official catalog: a Git URL, local folder or any other catalog is refused, and a third-party catalog listing one is refused whole. The rule lives in one import-free module the directory indexer can vendor; validate:plugin uses it too and warns when publisher differs from the origin remote's owner. A marketplace install never replaces one recorded from a different catalog; switching means remove and reinstall. Docs state the publisher == repository owner policy (enforced by the official and community catalog CI, not a new runtime field). * plugins: label trust by catalog source and note other catalogs listing an install The chip beside a plugin now says where trust comes from: the Official mark for Orca's catalog, otherwise the catalog name and the owner parsed from its Git URL (github.com/acme, gitlab.com/acme/tools), never manifest text; Dev · unverified for development folders and Unverified for Git URL installs. An installed plugin's page says which other catalogs list it. * test(plugins): give update review's Git-backed steps a loaded-runner timeout Install and update review each fetch a plugin over Git. On a loaded machine that took 25-30s with or without the publisher checks, past the 10s expect default, so the test read as stalled on Installing… * test(plugins): give the row-art fixture the entry's catalog source fields * test(plugins): say why the panel WebRTC test needs a longer timeout * feat(plugins): dismissible Alpha notice on the Plugins settings page Shows "Alpha: The plugin interface may change. Expect nuances." under the Plugins title until dismissed; dismissal persists in UI state (pluginsAlphaNoticeDismissed). Localized in all locales, with unit and e2e coverage for show-by-default and dismiss-across-reload. Co-Authored-By: Claude <noreply@anthropic.com> * plugins: stop shipping Orca Navigation Shortcuts and retire stale bundled installs Removes the bundled copy and its fallback-catalog listing. On startup, bundled bootstrap now uninstalls any previously bundled plugin this release no longer ships, so existing users don't keep a protected entry they cannot remove. Removal code moves to plugin-removal.ts to keep plugin-install.ts under the line limit. Co-Authored-By: Claude <noreply@anthropic.com> * fix(plugins): concurrent saves of one image no longer fail the update review Each save now writes its own uniquely named temp file and treats a rename failure as success when a concurrent writer already produced the same content-addressed file. A cache failure now only drops the image from the preview or catalog refresh instead of failing it. * fix(plugins): an update keeps unchanged machine recipes off the review's New list Recipes always counted as new because their commands live in files the manifest diff cannot see. Main now reads what each recipe can run (id, checkout mode, commands) from the installed tree and the preview's staging tree, and only a recipe that runs something new asks for review. An unreadable file still counts as new. * plugins: app themes color code in the editor via VS Code-shaped tokenColors Theme files gain optional tokenColors (TextMate scope -> foreground/fontStyle). The derived Monaco theme maps them onto Monaco's token names, the plugin-syntax legend and raw TextMate scopes; unreadable colors are dropped. * test(plugins): theme smoke checks tokenColors color the editor and revert * i18n: retire translated entries for plugin strings this change rewords or removes * plugins: add the custom editors contribution point A plugin can now declare contributes.customEditors to open files of given types in the editor tab, beside Source. The editor runs in the same sandboxed, no-network panel frame and only exchanges the document's text over a scoped postMessage channel; Orca keeps the buffer, dirty state, saving, external-change banner, read-only tabs and SSH files. The Editor | Source toggle and the 'first scene after load is the baseline' approach follow community PR #27413. Co-authored-by: Roughriver74 <115543510+Roughriver74@users.noreply.github.com> * plugins: list custom-editor plugins with panels in the plugin list * plugins: name an editor-only plugin's access 'Adds an editor' * plugins: keep the Editors category label for custom-editor plugins * plugins: restyle plugin frames in place and keep file paths out of editor frame names A theme change used to remount panel and custom editor frames, which reloaded the plugin and lost its state (Excalidraw undo, unsent edits). The host now posts orca-panel-theme and the shell updates the --orca-* tokens and the html class in place. Custom editor frames are named with a random id: window.name is readable inside the frame, and the old name carried the file's absolute path. * plugins: let custom editors open binary files as bytes (contentKind) A custom editor can now declare "contentKind": "bytes" (with "readonly": true) to receive the file's raw bytes instead of its text, for formats such as spreadsheets. Orca pages the bytes from the host that loaded the tab (local, SSH or a paired runtime, through the existing stat + readChunk calls, so no wire change), refuses files over 16 MiB with a "too large to open" message, re-sends on outside changes, and never applies a bytes editor's edits. The frame gets a transferred ArrayBuffer and the matched suffix, never a path. Documents are now versioned: { version, readOnly, content: { kind, ... } }. Text edits may name a baseVersion; an edit against a replaced document is refused with an orca-editor-edit-rejected conflict. Text documents keep the legacy text field and unversioned edits still apply, so existing editors work. "readonly": true on any editor makes the install review say "Opens .x files in Orca" instead of "Opens and edits". * plugins: suggest catalog custom editors for files Orca already opens The file-type suggestion only offered a plugin when a file opened as plain text or as the binary placeholder. It now also offers a catalog custom editor for a file Orca shows with a language (an .excalidraw file opens as JSON): the editor asks main with the `editor` purpose, which matches only release file types the listing's contributions name as custom editors, and only when no installed plugin's editor handles the type. Binary files such as .xlsx keep the existing path, since release fileTypes already include custom-editor types. The banner reads "A plugin adds an editor for .x files: Name"; Not now and Don't suggest work per type as before. * fix(plugins): an update that lets a custom editor edit, take over opening, or change content kind asks again * fix(plugins): one unreadable catalog summary item no longer hides the whole summary * fix(plugins): plugin editors never open Orca-core file types by default, and join Markdown, CSV and notebook view toggles as options * fix(plugins): catalog releases list editor file types as data instead of parsing the display summary * fix(plugins): custom editor edits must name their base version; drop the pre-release text field * fix(plugins): a custom editor edit Orca refuses keeps the tab dirty and blocks the save instead of vanishing Rate-limited edits are held and applied before the next save; oversized ones are reported to the frame and the user. Every save, from any trigger, first flushes plugin editor frames with a bounded wait and refuses to write while a frame holds edits the buffer lacks. * fix(plugins): run custom editors as network-isolated guests and save only on real key presses Editors see file contents, so they now run as <webview> guests in their own in-memory partition instead of iframes of Orca's renderer. The session routes everything through a dead SOCKS proxy (loopback included), refuses every non-editor request and permission, and each guest gets disable_non_proxied_udp, no popups and no navigation. An Electron test proves fetch, WebSocket, images and TURN-over-TCP all fail from the editor and from its srcdoc and javascript: child frames, while the same page in a plain session reaches every listener. Electron 43 still resolves <link rel=dns-prefetch> names outside the session; the test pins that residual and the docs say so. Save chords now come from main's before-input-event on the guest, which page code cannot synthesize; the shell's keydown forwarder and the orca-editor-keydown message are gone. Guests also run in their own renderer process. * fix(plugins): enforce a read-only custom editor in main, not just the tab Main reads readonly from the installed manifest (bytes editors always count) and drops every edit such a guest posts before it reaches the renderer. The tab host also refuses them and tells the editor its document is read-only, even on a writable tab. * test(plugins): the editor-suggestion catalog fixture lists editorFileTypes * plugins: custom editors edit and save binary files; drop readonly and the isolated guest Bytes editors now post `{ baseVersion, content: { kind: 'bytes', bytes } }` full replacements (a transferable ArrayBuffer). The tab keeps the unsaved bytes beside the text drafts, marks itself dirty, and the normal save pipeline (frame flush, Cmd+S, close prompt) writes them: locally through a new `fs:writeFileBytes` atomic replace guarded by the loaded bytes' SHA-256, and on SSH-served or paired hosts by uploading chunks with `files.writeBase64Chunk` and swapping them in with the new capability-negotiated `files.replaceWithUpload`. Older hosts are refused before anything is written. A stale baseline is a conflict: the edit stays unsaved and the external-change banner offers Reload or Overwrite. Source stays the binary placeholder. Per the product decision, every custom editor may edit: the `readonly` manifest field, its main-side enforcement and re-approval rule are gone, and an editor that only views simply never posts edits. Editors run in the normal sandboxed plugin frame again instead of a network-isolated webview guest; the frame's save chord is honored only while it carries real user activation. Consent now reads "Opens and edits .ext files in Orca. It can read the files it opens." * plugins: reserve agentHarnesses and hooks instead of agents; rename agents:read to agent:read * plugins: syntaxes and custom editors share one file matcher (extensions with the dot, plus filenames) * plugins: title for themes and syntaxes, when for commands (format 1 names rewritten on parse) * plugins: add the editor catalog type for custom editors * plugins: official means listed by the official catalog, not an orca- id * plugins: one envelope protocol and window.orca for workers, panels and editors Workers, panels and custom editors now share one internal envelope ({orca: 1, kind: req|res|evt|cancel}) instead of three message sets. Frames get a frozen window.orca from the shell (api, host.call with AbortSignal cancel, host.has, on, and document helpers in editors); ready/hello carries the api, the surface's methods and the theme. Editors gain host calls through their own session. The host API table is keyed by method with typed params/results (no handler casts), per-method surfaces and a numeric since minor; every params schema is strict. Errors are {code, message, retryable, retryAfterMs?} with cancelled/timeout/conflict/not_permitted/too_large reserved and unknown codes read as action_failed. Event payloads are typed with a closed agent-status enum, and the list entry type is shared by main and preload. * plugins: orca.document.onDidChange hands a late subscriber the current document Editors that subscribe after their bundle loads (Excalidraw) missed the document that arrived first and stayed blank. * plugins: custom editor documents up to 64 MiB, with a large-file note past 16 MiB The cap covers text and bytes on every route; reads and SSH or paired-host writes are already chunked, so only the shared cap moves. Past 16 MiB the tab shows a small, non-blocking note that the editor may take a moment. * plugins: delete dead props and branches left by removed rows, logs toggle and access retry * plugins: one status word per state (a crashed plugin reads Stopped everywhere) and drop unused plugin locale keys * plugins: contribution rows use the manifest point names, so the policy table is the one source of catalog types * test(plugins): assert the Use now line and page behavior, not Tailwind classes * i18n: add the custom editor large-file note to the English catalog * plugins: fold the loose shared plugin modules into contributions, frames, images, capabilities, events, languages, installation and catalog folders * plugins: custom editor tab icons and contributes.newFiles templates A custom editor may declare an icon; the tab and its hover card show it and the editor title instead of "Editor", falling back to the plugin icon. contributes.newFiles declares untitled file types (title, extension, optional UTF-8 template and icon) offered in the tab bar + menu, its search, the command palette and the plugin page, created at the workspace root through the Markdown untitled-file flow. The install toast's Try it creates one for plugins that declare them. * test(plugins): hidden e2e for a plugin new file from the + menu and its editor tab icon * plugins: turn the plugin system on by default with a one-time migration Saved false from the old default flips on once (pluginSystemDefaultedOn guard); a later deliberate false is respected. The Turn on plugins off-state is gone, and the official catalog seed is deferred off the startup path (and skipped offline), seeding on demand when the marketplace is opened. * plugins: move the card menu Disable/Enable directly above Remove, without an icon * plugins: show the Alpha notice with the warning banner tokens * plugins: show each category's icon in the filter dropdown * plugins: seed drawn fallback art per plugin so two listings never look identical * plugins: show manifest covers for catalog releases published without images The official catalog's newest Midnight, Nord, OLED and Dusk & Ember releases were regenerated without an images block (release-entry only kept images the author pasted), so their cards fell back to drawn art. A catalog that keeps its plugins in its own repository now borrows the manifest's images from the catalog commit, checked like declared images, and the validator's printed release entry includes them so regenerated catalogs keep their covers. * plugins: drop the unused Turn on plugins strings * settings: find the Plugins page by plugin, mod and extension searches * plugins: remove the Allow full-access plugins setting Full-access (trusted-worker) plugins now need only their own per-plugin approval: main no longer gates install, consent, enablement or runtime on a global switch, and the settings menu item, the Turn on in settings card and page states, and the stored key are gone. The consent now says plainly what full access means. Kill list, official review and publisher checks are kept; docs note an enterprise block policy may come later. * i18n: retire translated entries for plugin strings this change rewords or removes * test(plugins): prune low-value plugin tests Drop tests that asserted CSS classes, DOM structure, internal call counts, copy, or duplicated coverage; merge overlapping e2e file-type suggestion specs. Keep security, consent, data-integrity, compatibility and main journey coverage. * test(plugins): stop git auto-maintenance racing marketplace fetch teardown * test(plugins): import the panel session token schema from the frame bridge * feat(plugins): open orca://plugins install links at the plugin's page orca://plugins/<publisher.id>?catalog=<official|community|git URL> opens Settings -> Plugins at that plugin; it never installs. Plugins off shows Turn on plugins first, an unknown catalog asks before it is fetched, and a malformed link only toasts. Reuses the skill-share deep-link path (open-url, second-instance argv, sidecar handoff) with repeat/burst dedupe, and registers orca:// on packaged Windows, which NSIS leaves unregistered. Co-Authored-By: Claude <noreply@anthropic.com> * fix(plugins): show the linked catalog URL on its own line Co-Authored-By: Claude <noreply@anthropic.com> * fix(plugins): follow main's moved plugin files and language-pack coverage field * fix(plugins): keep a plugin disabled through its update and give format 1 event handlers worktreeId * fix(plugins): keep held editor edits across view switches, ignore stale editor entry reads, share bytes across split panes, and meet the low-evidence lint * refactor(editor): keep the file content loader under the line limit * fix(plugins): keep a bytes draft's baseline across reloads, cover plugin new-file menu rows, and move render-time ref writes into layout effects * refactor(tab-bar): keep the create-menu controller under the line limit * refactor(tab-bar): keep the create-menu controller under the line limit with the plugin new-file case * test(plugins): turn plugins back on through settings in the install-link journey * fix(wsl): import the atomic plugin file writer from its new folder * fix(plugins): save bytes custom-editor edits from Save-and-close and the overwrite banner * test(plugins): park the Linux-only bytes editor e2e failure as a follow-up * fix(plugins): follow main's new language-pack tests to the moved artifact module * test(i18n): give main's new plugin language-pack fixture its coverage * plugins: manifest v2 ships in 1.4.245, since 1.4.244 released without it * fix(i18n): import the plugin language-pack artifact from its folder in the shared i18n instance * fix(plugins): drop syntax loads that land after dispose and restore terminal overrides on Switch back --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Roughriver74 <115543510+Roughriver74@users.noreply.github.com>	2026-10-28 20:58:25 -07:00
OrcaWinandOrcaWin	7d6603aa17	[comment audit] Complete repository-wide comment cleanup (#33249) ... * [comment audit] Align legacy failure-read counts with cached display * [comment audit] Condense shared provider lifecycle and browser recovery comments [skip ci] * [comment audit] Condense shared generation, path and preview comments [skip ci] * [comment audit] Condense host, file and Git contract rationale [skip ci] * [comment audit] Tighten Git lifecycle and provider contract comments [skip ci] * [comment audit] Clarify shared host authority and launch isolation [skip ci] * [comment audit] simplify local access mobile and native chat contracts [skip ci] * [comment audit] simplify native chat presentation and state contracts [skip ci] * [comment audit] simplify native runtime and provider contracts [skip ci] * [comment audit] simplify migration and orchestration contracts [skip ci] * [comment audit] simplify plugin trust and process capture rationale [skip ci] * [comment audit] simplify terminal delivery and remote compatibility rationale [skip ci] * [comment audit] clarify remote recovery and launch wire rationale [skip ci] * [comment audit] shorten shared RPC compatibility and runtime evidence comments [skip ci] * [comment audit] simplify secure storage shell startup and sidebar rationale [skip ci] * [comment audit] clarify sidebar, skill and SSH invariants [skip ci] * [comment audit] condense structured chat delivery and timing rationale [skip ci] * [comment audit] condense terminal replay and telemetry invariants [skip ci] * [comment audit] clarify launch permission and terminal delivery rationale [skip ci] * [comment audit] clarify workspace ownership and layout contracts [skip ci] * [comment audit] wait for fitted and painted SSH terminal links * [comment audit] clarify layout persistence and session ownership [skip ci] * [comment audit] clarify host routing and workspace lifecycle contracts [skip ci] * [comment audit] clarify startup persistence and app lifetime comments [skip ci] * [comment audit] clarify recovery and activity boundaries [skip ci] * [comment audit] condense activity and artifact invariants [skip ci] * [comment audit] condense automation authority contracts [skip ci] * [comment audit] simplify automation scheduling and history contracts [skip ci] * [comment audit] clarify browser chrome and annotation lifecycles [skip ci] * [comment audit] clarify browser routing and retained guest ownership [skip ci] * [comment audit] clarify browser recovery and document ownership comments [skip ci] * [comment audit] restore hosted runners required by native IME fixtures * [comment audit] shorten preview, palette and dashboard invariants [skip ci] * [comment audit] clarify terminal preview, dashboard and retention comments [skip ci] * [comment audit] clarify diff-note recovery and editor lifecycle comments [skip ci] * [comment audit] shorten rich-text and combined-diff ownership comments [skip ci] * [comment audit] shorten autosave, draft recovery and model ownership comments [skip ci] * [comment audit] shorten save-queue, notebook and Markdown constraints [skip ci] * [comment audit] shorten Monaco, PDF and rich Markdown safeguards [skip ci] * [comment audit] clarify rich Markdown source and selection safeguards [skip ci] * [comment audit] clarify editor loading and emulator stream lifetimes [skip ci] * [comment audit] trim emulator and feature tour narration [skip ci] * [comment audit] clarify floating workspace and GitHub cache ownership [skip ci] * [comment audit] trim provider controls and Linear filter explanations [skip ci] * [comment audit] clarify pairing and chat resume lifetimes [skip ci] * [comment audit] clarify chat delivery and transcript lifetimes [skip ci] * [comment audit] clarify session options and host-owned status [skip ci] * [comment audit] clarify draft durability and live-status precedence [skip ci] * [comment audit] Trim chat send and model ownership explanations [skip ci] * [comment audit] Shorten transcript ownership and send recovery comments [skip ci] * [comment audit] Simplify native chat composer and transcript hook comments [skip ci] * [comment audit] Shorten native chat scroll and structured session explanations [skip ci] * [comment audit] Trim workspace picker and onboarding commentary [skip ci] * [comment audit] Simplify pet rendering, review cache and quick open comments [skip ci] * [comment audit] Trim sidebar and session history explanations [skip ci] * [comment audit] Condense session resume and review checks comments [skip ci] * [comment audit] Shorten checks state and file explorer refresh comments [skip ci] * [comment audit] Trim plugin bridge and source-control action rationale [skip ci] * [comment audit] Trim source-control listing and review rationale [skip ci] * [comment audit] Shorten sidebar lifecycle and explorer safeguards [skip ci] * [comment audit] Condense Settings account and appearance rationale [skip ci] * [comment audit] Trim pairing and repository Settings explanations [skip ci] * [comment audit] Condense Settings search SSH and terminal safeguards [skip ci] * [comment audit] Shorten Settings voice and provider ownership comments [skip ci] * [comment audit] Condense Settings draft persistence and host-state rationale [skip ci] * [comment audit] Trim Settings hooks and sidebar setup rationale [skip ci] * [comment audit] Condense sidebar deletion and board-filter safeguards [skip ci] * [comment audit] Condense worktree cards, host ownership and Markdown contracts [skip ci] * [comment audit] Condense sidebar drag, folder and filtering contracts [skip ci] * [comment audit] Condense sidebar parity, sleep and host ownership contracts [skip ci] * [comment audit] Prune focus-read baseline after comment cleanup * [comment audit] Clarify sidebar visibility, board drops and agent evidence [skip ci] * [comment audit] Tighten sidebar listing, drag and reveal contracts [skip ci] * [comment audit] Clarify viewport geometry and skill update safeguards [skip ci] * [comment audit] Tighten skill inventory, usage and host status comments [skip ci] * [comment audit] Clarify usage ownership and resource kill safeguards [skip ci] * [comment audit] Tighten tab selection, rename and search contracts [skip ci] * [comment audit] Tighten tab-strip geometry and drag ownership comments [skip ci] * [comment audit] Tighten Tasks recovery, pagination and mutation comments [skip ci] * [comment audit] Tighten provider loading and terminal recovery comments [skip ci] * [comment audit] Tighten completion, cadence and PTY ownership comments [skip ci] * [comment audit] Clarify terminal restore and parked-pane boundaries [skip ci] * [comment audit] Tighten PTY startup and replay explanations [skip ci] * [comment audit] Clarify PTY identity and delivery ownership [skip ci] * [comment audit] Shorten remote reconnect and input replay rationale [skip ci] * [comment audit] Condense terminal parking clipboard and file link comments [skip ci] * [comment audit] Clarify IME ownership and trim trace history [skip ci] * [comment audit] Shorten pane recovery and parked watcher explanations [skip ci] * [comment audit] Condense snapshot replay and visibility recovery rationale [skip ci] * [comment audit] Shorten terminal parking and keyboard ownership rationale [skip ci] * [comment audit] Trim renderer lifecycle and menu rationale [skip ci] * [comment audit] Condense workspace cleanup ownership and settlement notes [skip ci] * [comment audit] Clarify renderer hook evidence and source ownership [skip ci] * [comment audit] Tighten IPC ownership and reconnect explanations [skip ci] * [comment audit] Trim renderer focus, paste and attention comments [skip ci] * [comment audit] Shorten scroll, locale and agent lifecycle comments [skip ci] * [comment audit] Trim agent launch, resume and ownership commentary [skip ci] * [comment audit] Shorten account, browser and editor comments [skip ci] * [comment audit] Clarify host-mirror waits, previews and input ownership [skip ci] * [comment audit] Condense launch recovery and editor tokenization comments [skip ci] * [comment audit] Condense workspace selection and terminal pane rationale [skip ci] * [comment audit] Condense terminal fitting and rendering recovery comments [skip ci] * [comment audit] Condense terminal input and host routing explanations [skip ci] * [comment audit] Condense ownership and sleeping-session recovery rationale [skip ci] * [comment audit] Condense structured launch and terminal link explanations [skip ci] * [comment audit] Condense terminal ownership and workspace file routing rationale [skip ci] * [comment audit] Condense session persistence and workspace activation rationale [skip ci] * [comment audit] Condense workspace routing and browser ownership rationale [skip ci] * [comment audit] Condense mirror recovery and layout authority rationale [skip ci] * [comment audit] Condense runtime transport and file safety rationale [skip ci] * [comment audit] Condense runtime graph and structured session rationale [skip ci] * [comment audit] Condense browser creation and remote tab recovery rationale [skip ci] * [comment audit] Condense snapshot authority and publisher recovery rationale [skip ci] * [comment audit] Condense frame, startup and provider cache rationale [skip ci] * [comment audit] Condense host twin and agent lifecycle rationale [skip ci] * [comment audit] Condense browser authority and editor cleanup rationale [skip ci] * [comment audit] Condense editor buffer identity and review cache rationale [skip ci] * [comment audit] Condense provider lifetime and repository ownership rationale [skip ci] * [comment audit] Condense reconnect, hydration and terminal retirement rationale [skip ci] * [comment audit] Condense recovery, reconciliation and persistence rationale [skip ci] * [comment audit] Condense cleanup ownership and listing admission rationale [skip ci] * [comment audit] Condense teardown ordering and terminal ownership rationale [skip ci] * [comment audit] Condense recovery ledger and web host-boundary rationale [skip ci] * [comment audit] Condense web reconnect and credential lifecycle rationale [skip ci] * [comment audit] Condense cloud rollout and assignment safety rationale [skip ci] * [comment audit] Condense relay session and database recovery rationale [skip ci] * [comment audit] Condense relay placement and protocol compatibility rationale [skip ci] * [comment audit] Condense build and packaging constraints [skip ci] * [comment audit] Condense CI gates and validation isolation rationale [skip ci] * [comment audit] Condense catalog identity and browser validation rationale [skip ci] * [comment audit] Condense mobile browser and frame-budget rationale [skip ci] * [comment audit] Shorten mobile route and browser test explanations [skip ci] * [comment audit] Condense editor and session seam test rationale [skip ci] * [comment audit] Trim session and terminal closure history [skip ci] * [comment audit] Shorten terminal browser and census explanations [skip ci] * [comment audit] Preserve root-only E2E diagnostic baseline * [comment audit] Condense mobile seam and HTML preview test rationale [skip ci] * [comment audit] Condense preview instrumentation and render harness rationale [skip ci] * [comment audit] Condense bundle contracts and native-build constraints [skip ci] * [comment audit] Shorten native packaging and CI routing rationale [skip ci] * [comment audit] Condense release tooling and benchmark constraints [skip ci] * [comment audit] Condense packaging and platform gate rationale [skip ci] * [comment audit] Shorten mobile route and history rationale [skip ci] * [comment audit] Condense mobile browser and component rationale [skip ci] * [comment audit] Shorten drawer and workspace-form rationale [skip ci] * [comment audit] Trim mobile review and editor-document explanations [skip ci] * [comment audit] Condense editor lifecycle and Markdown explanations [skip ci] * [comment audit] Trim mobile file, diagnostics and dictation commentary [skip ci] * [comment audit] Simplify mobile host-list and workspace-view explanations [skip ci] * [comment audit] Clarify mobile shell lifetime and bridge delivery constraints [skip ci] * [comment audit] Condense bridge stream, native request and audio rationale [skip ci] * [comment audit] Reduce bridge schema and page-client commentary [skip ci] * [comment audit] Tighten mobile page bridge contracts [skip ci] * [comment audit] Clarify mobile cache and session constraints [skip ci] * [comment audit] Condense mobile route and lifecycle rationale [skip ci] * [comment audit] Tighten mobile shell hook timing rationale [skip ci] * [comment audit] Clarify route handoff and notification compatibility [skip ci] * [comment audit] Clarify push registration and dictation cleanup constraints [skip ci] * [comment audit] Condense keyboard geometry and native media ownership rationale [skip ci] * [comment audit] Tighten mobile chat scroll and composer concurrency rationale [skip ci] * [comment audit] Condense mobile reply compatibility and upload ownership rationale [skip ci] * [comment audit] Condense optimistic echo and scroll ownership rationale [skip ci] * [comment audit] Tighten stream replay and queued session ownership rationale [skip ci] * [comment audit] Condense mobile composer and reply-schema constraints [skip ci] * [comment audit] Clarify mobile transcript recovery and session ownership [skip ci] * [comment audit] Clarify mobile queue and source-control compatibility [skip ci] * [comment audit] Condense storage and task launch constraints [skip ci] * [comment audit] Clarify task schemas and terminal document ownership [skip ci] * [comment audit] Tighten terminal input and viewport rationale [skip ci] * [comment audit] Shorten terminal and RPC recorder contracts [skip ci] * [comment audit] Condense recorder engine and connection contracts [skip ci] * [comment audit] Shorten host credential and relay recovery comments [skip ci] * [comment audit] Tighten pairing recovery and bundle transport rationale [skip ci] * [comment audit] Clarify RPC delivery and workspace catalog boundaries [skip ci] * [comment audit] Condense catalog and relay entry contracts [skip ci] * [comment audit] Shorten shutdown and SSH relay delivery contracts [skip ci] * [comment audit] Condense WSL relay and E2E regression rationale [skip ci] * [comment audit] Shorten cross-version harness and renderer fixture explanations [skip ci] * [comment audit] Condense paired-host and E2E lifecycle rationale [skip ci] * [comment audit] Shorten layout oracle and regression explanations [skip ci] * [comment audit] Condense paired recovery and ownership regression contracts [skip ci] * [comment audit] Shorten restart, sidebar and SSH lifecycle contracts [skip ci] * [comment audit] Condense terminal rendering and IME regression rationale [skip ci] * [comment audit] Shorten terminal recovery and benchmark contracts [skip ci] * [comment audit] Condense tooling and Windows lifecycle proof rationale [skip ci] * [comment audit] Condense workflow routing and release rationale [skip ci] * [comment audit] Condense mobile security and installer contracts [skip ci] * [comment audit] Shorten native rationale and stylesheet workarounds [skip ci] * [comment audit] Shorten Windows visibility probe rationale [skip ci] * [comment audit] Condense embedded release and signing rationale [skip ci] * [comment audit] Retain current main test behavior in final reconciliation [skip ci] * [comment audit] Complete final comment review across current source inventory * [comment audit] Handle consolidated audit reports before final CI * [comment audit] Preserve credential storage census detail [skip ci] * [comment audit] Scale broad changed E2E selections with verified timing shards * [comment audit] Align E2E assertions with browser close and settled session metadata * [comment audit] Match existing E2Es to current resource and windowing contracts * [comment audit] Observe the shared server outage notice in reconnect coverage * [comment audit] Make existing renderer probes measure settled tab and PTY work * [comment audit] Align palette E2E selector with task search * [comment audit] Refresh remaining palette search selectors * [comment audit] Keep selector correction within selected audit specs * [comment audit] Await emoji fixture settings inside renderer evaluation * [comment audit] Cancel fixture fit retries between terminal tests --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>	2026-10-25 04:05:46 -07:00
Neil	35596d16a5	chore: replace electron-toolkit utilities with Electron APIs (#31824) ... * chore: replace electron-toolkit utilities with Electron APIs * refactor: reuse development flag within startup preflight	2026-10-21 21:52:08 -07:00
Neil	58553bfe1c	fix(recovery): fail a renderer recovery reload that never loads, instead of leaving a dead window (#18466)	2026-09-04 23:45:42 -07:00
Jinwoo HongandJinwoo-H	a9781a4118	STA-4150: client-hosted remote browser (consolidated) (#15448) ... Co-authored-by: Jinwoo-H <jinwoo@stably.ai>	2026-08-25 15:36:51 -07:00
Neil	9367169888	refactor(tests): split every oversized test file off the max-lines suppression list (#14728) ... * refactor(tests): split oversized test files off the max-lines suppression list Every `*.test.ts`/`*.spec.ts` that carried an `eslint/oxlint-disable max-lines` directive is now split into focused, behavior-scoped suites that fit the 800-line test budget, with shared setup extracted into co-located `*-test-harness.ts` / `*-test-fixtures.ts` modules (300-line budget). 83 files became ~930; the largest output is 797 effective lines. `orca-runtime.test.ts` is intentionally untouched. Test bodies were moved by scripted line-range slicing rather than retyped, so assertions are byte-identical. The only permitted body edits were mechanical rebinding where a shared value moved into a harness (e.g. `tmpHome` -> `homes.tmpHome`). Registries that enumerate test files were updated in lockstep: - config/max-lines-baseline.txt: pruned 341 -> 258 entries (all 83 removed). - config/reliability-gates.jsonc: 33 gates repointed at the split files, with assertionRefs split per file where a gate's coverage now spans several. - .github/workflows/pr.yml: the real-zsh lane now lists the 4 split files that actually exercise zsh, so they keep running in the dedicated shell lane. Also renamed agent-hooks `server-test-fixtures.ts` to `server.test-fixtures.ts` so the global-fetch call-site audit keeps skipping it, and added `.js` extensions to the CLI suites' dynamic harness imports (node16 resolution) to unbreak `build:cli`. Verification: full suite 52,449 passing vs 52,448 at baseline with zero assertions lost; `pnpm lint`, `pnpm typecheck`, and `pnpm build:cli` all exit 0; the terminal-pane e2e spec runs 31/31 headless. * refactor(tests): split hook-idle arbitration suite that oxfmt pushed over budget The pre-commit oxfmt pass reflowed pty-connection-hook-idle-arbitration.test.ts to 811 effective lines, 11 over the test budget. Split the hook-completion side effect and replacement-agent veto cases into their own suite; both files now sit well under the cap and the 15 tests are unchanged. * test: port upstream test changes into the split files after rebase Rebasing onto main surfaced 27 tests that main had added to files this branch deleted, plus edits to tests that had already moved. Taking the deletion side of those modify/delete conflicts would have dropped that coverage silently, so each upstream change is ported into the split file that now owns the behavior — for example main's six orchestration mailbox tests land across orchestration-runs, -send, and -check. Also repoints `orchestration.notification-mailbox-consistency`, a gate main added after this branch's gate remap, at those same three split files, and re-prunes the max-lines baseline against main's (257 entries). Verified: all 27 upstream test titles present; full suite 52,761 passing with the only diff vs baseline being 12 tests main itself removed and 3 that moved from skipped to passing; lint and typecheck exit 0. * fix(test): flush pending continuations before tearing down terminal test globals CI shard 5/16 failed on both Node 24 and 26 with `ReferenceError: window is not defined` from pty-connection.ts, surfacing through pty-connection-daemon-snapshot-replay.test.ts. The reattach/settle chains `await` a real promise and then touch `window.api`. Under fake timers those continuations cannot run, so they only become schedulable once restoreTerminalTestGlobals() switches back to real timers — which previously happened immediately before `delete globalThis.window`, so a late continuation threw and failed the whole file. Flush async ticks in that window instead. This is latent in the source rather than new: the pre-split 25k-line file kept running other tests after these, which gave the chains time to settle before teardown. Splitting the file moved teardown directly behind them. * fix(test): keep an inert window after terminal test teardown instead of deleting it The async-tick flush was not enough: the reattach/settle chain can resolve after teardown regardless of how long we drain, so CI shard 5/16 still failed with `ReferenceError: window is not defined` from pty-connection.ts. A real renderer never loses `window`, so deleting it was the artificial part. Swap in an inert proxy whose properties resolve to callables and whose calls resolve to undefined, making a late `window.api.pty.*` call a harmless no-op. The next test replaces it wholesale via installTerminalTestGlobals(), and no test asserts that `window` is absent.	2026-08-15 00:54:20 -07:00
OrcaWin	e790266546	fix(windows): show first window before shell PATH hydration (#13799)	2026-08-11 12:14:36 -07:00
NeilandOrca	17cfc968cf	Revert the terminal IME composition-ownership change (#13282) ... * Revert "test(ime): restore coverage the composition-ownership change removed (#13168)" This reverts commit 25a8c517e1. * Revert "refactor(terminal): return IME composition ownership to xterm (#13128)" This reverts commit 17b3dff3c4. * test(ime): keep the architecture-neutral Korean trace coverage The recorded IBus/fcitx5 and Windows MS-Korean traces from #13168 assert PTY byte order, not composition ownership, so they still hold once the terminal composition layer is restored. The mobile accessory-order test pinned the new handleLiveInputChange signature and does not. Co-authored-by: Orca <help@stably.ai> * fix(terminal): keep the macOS Backslash bypass through the revert The restored native-text forwarder only claims keys for input sources in its hardcoded CJK allowlist, so third-party IMEs off that list (Qingg, #10896) still get a raw backslash. #13128 added this bypass as a partial replacement; keep it rather than trade the open issue back. Scoped to the bare backslash key. The rest of shouldBypassXtermForMacNativeText bypassed all unmodified non-ASCII text, which would race the restored forwarder. Co-authored-by: Orca <help@stably.ai> * fix(mobile): move the mirror-step ref write out of render The restored hook assigned runMirrorStepRef during render, which is not replay-safe — React can discard render work, so the mutation can leak from UI that never commits. Its only read is inside the held-commit timer, which fires long after commit, and the ref has a safe default, so an effect is soon enough. Surfaced by the changed-lines React Doctor gate: the rule postdates this code, so restoring the file re-introduced it as a new violation. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>	2026-08-08 19:06:50 -07:00
NeilandOrca	17b3dff3c4	refactor(terminal): return IME composition ownership to xterm (#13128) ... * fix(terminal): return IME composition ownership to xterm * fix(mobile): derive terminal input from native replacement ranges * test(mobile): record iOS Japanese IME traces * fix(mobile): preserve native IME replacement ranges * fix(xterm): flush queued application input after IME commit * test(terminal): pin Korean intermediate commit * test: pin Windows IME shortcut ownership * test: replay IBus number candidate commit * fix: preserve native macOS input-method punctuation * refactor(terminal): remove stale mac focus override * fix(mobile): preserve soft keyboard deletion ranges * fix: keep IME-owned palette chords in renderer * fix: stop carried IME shortcuts at renderer owner * fix: preserve carried IME shortcut dispatch * fix: narrow main-owned shortcut actions * test(mobile): pin Japanese IME replacement traces * test(terminal): retain paired native IME trace * fix(chat): preserve browser IME composition ownership * fix(chat): retain macOS IME confirm gesture * fix(chat): expire unmatched IME confirm carry * fix(chat): isolate IME confirmation expiry * fix(chat): retain active IME confirmation * refactor(terminal): remove dead composition handler * feat(ime): add shared Enter-ownership seams for CJK composition The confirming Enter of a CJK composition arrives as two keydowns and the orderings differ by platform: Windows/Linux redispatch the unmarked Enter/13 before keyup, macOS delivers keyup first. A guard reading only isComposing or keyCode 229 misses the redispatch, so surfaces submitted on a confirm. Adds useImeEnterGestureOwnership (carry token, next-frame expiry), a shared ImeEnterGuardedForm for native implicit submission, and the cmdk seam covering 18 CommandInput surfaces at one site. A chorded Enter arms the carry but is never swallowed — the reverse would eat a user's deliberate Cmd/Ctrl+Enter. Both failure modes are pinned by ime-enter-gesture-ownership-contract.test.ts. Co-authored-by: Orca <help@stably.ai> * refactor(terminal): consolidate native input listeners and parked-screen owner Extracts the shared native-input listener installer and renames the parked-screen detector for what it actually does, replacing per-call-site duplication. The listener installer keeps a forgetOptionKeyLocationOnBlur flag so per-window semantics are preserved rather than flattened. Net deletion; no behaviour change intended. Co-authored-by: Orca <help@stably.ai> * test(terminal): pin recorded IME shapes as regression tests Nine regression tests built from hashed affected-platform captures, each with a paired ordinary negative and a discriminating mutation verified to take the file from all-passing to exactly one failure. Covers the Windows MS-Korean Shift family (#12179, #11878, #12151, #11946, #12152) and the Korean TUI line-break rows (STA-3237, STA-3222, STA-3129). STA-3237 pins the empirical 3-Shift / 2-active-composition / 2-newline ratio the device run established — the third Shift produces nothing because Space has already committed. That ratio is not derivable from a static capture. Co-authored-by: Orca <help@stably.ai> * fix(ime): guard Enter-commit surfaces against CJK confirm Applies the Enter-ownership guards across the surfaces whose Enter commits something: publishes, clones, pairs, installs, posts, or persists. Tiered deliberately rather than uniformly. Irreversible and remote-effect sites take the carry token, which also blocks the unmarked redispatch. Locally reversible sites take the oracle check with a one-line comment naming the residual, because a spurious commit there costs one undo. Three numeric fields are left unguarded with the reason in-code: Chromium blanks number inputs at compositionstart, so a confirm-Enter only ever reaches an empty-draft reset. Measured with a CDP probe rather than assumed — a guard that cannot fire is noise. Co-authored-by: Orca <help@stably.ai> * test(ime): teeth-check the Enter guards on every guarded surface One suite per guarded surface, each verified by deleting the guard and confirming the test fails. A green guard test without that check is unverified, not verified. Two shapes pass vacuously in happy-dom and are avoided here: native implicit form submission never fires, and blur() is inert on an unfocused element. Both made "the commit did not happen" assertions pass with the guard removed, so the suites assert the guard's contract directly instead. Co-authored-by: Orca <help@stably.ai> * fix(mobile): keep iOS Korean commits whole through the live-input path iOS Korean reports isComposing: false on every event, so it bypasses the composition guard entirely. The strict owner rejected UIKit's transformed post-change field and sent only the leading jamo — the reported symptom. Prefers the authoritative same-event field text over the predicted text when the supplied operation cannot produce it. Generic: no Korean special-case, no locale classifier, no normalization. Adds the RN-target-keyed submit carry alongside it. Co-authored-by: Orca <help@stably.ai> * test(e2e): make IME capture harnesses fail loudly instead of silently Four instruments recorded silence as success, so a void run scored as a clean one: - readTerminalImeBoundaryTrace returned an empty trace when the probe never installed, making every "nothing leaked" negative pass vacuously - summarizeLatencies([]) returned a perfect zero distribution that passed all three latency thresholds - the macOS Vietnamese spec pinned an input-source ID that does not exist, and failed as though the operator had chosen the wrong source - the expectedLineCount=1 prefix property was undocumented and one edit from silently downgrading a PTY assertion Input sources now resolve by enumeration and name the near-matches on failure. Co-authored-by: Orca <help@stably.ai> * test(terminal): cover Cangjie cancellation and fix a cross-namespace assertion Adds #11951's recorded Cangjie cancel shape to the existing cancellation suite, which covered Pinyin and Sogou but not Cangjie. One keystroke then Backspace arriving as deleteContentBackward with data: null, so the stale preedit is the only thing a fallback could replay. Verified against the historical pre-6cd944c62b3 bundle: the positive fails with ['尸'] where [] is expected, while the ordinary negative stays green. Also fixes the Vietnamese spec, which asserted a TIS-space input-source ID against getKeyboardInputSourceId(). Those two Orca APIs report the same source in different namespaces — TIS nests it under VietnameseIM, the app API does not. The resolver stays as an installation precondition; the assertion matches the leaf. Co-authored-by: Orca <help@stably.ai> * test(e2e): add a real-IME macOS arm for the Korean chord commit The existing korean-ime-terminal-shift-enter-commit spec synthesizes composition over CDP: Input.imeSetComposition sets the preedit directly and Input.insertText performs the commit. Asserting the IME produced events you injected yourself is circular, so that spec cannot certify real-IME behaviour. This arm selects 2-Set Korean via TIS, reads it back live, and injects through System Events key codes, so the OS owns the preedit, the commit instant, and isComposing. PTY byte expectations are preserved verbatim. Covers 2 of the original 4 cases by design. The other two are the Windows/Linux redispatch-before-keyup ordering, which macOS cannot produce and which cannot be selected -- the OS decides it. Reintroducing synthesis to "restore coverage" would reintroduce the circularity. Co-authored-by: Orca <help@stably.ai> * test(e2e): assert the macOS chord arm at the PTY boundary, not the renderer The byte expectations were transcribed from korean-ime-terminal-shift-enter-commit :364/:383, which assert against onData -- a renderer boundary where the terminator is CR. This spec reads the PTY child, where the tty has already converted CR to LF. Names both forms per row rather than swapping the constant, so the conversion reads as evidence that the capture reached past the renderer, as #11936 and #11951 record. Ctrl+Enter's CSI-u sequence is unaffected and is identical at both boundaries. Co-authored-by: Orca <help@stably.ai> * test(e2e): measure composer-to-onData latency and stop dropping IME keystrokes Two defects in the echo latency probe. It hooked onWriteParsed and onRender but never onData, so it measured key->parse->render echo rather than the composer-vs-onData delta the latency rows need. Adds a third hook feeding its own sample set. And `event.key.length !== 1` silently dropped IME keystrokes: Pinyin and Cangjie keydowns arrive as key:'Process' (length 7). Replayed over the captured corpus, the old filter accepted 580 of 4137 Chinese IME keydowns -- it was discarding 80% of them. The new filter matches the shape the owner itself branches on. Attribution charges each onData to the latest keydown rather than a FIFO head, because composing jamo emit no onData at all and a queue would credit a whole composition to its first keystroke. The consumer now asserts sample count before any percentile, so a zero-sample run cannot render as a flawless distribution. Co-authored-by: Orca <help@stably.ai> * test(terminal): pin the WSL shifted-jamo newline shape for #11919 In Korean 2-set, Shift types ordinary letters -- the double consonants and the compound vowels. Each such keystroke reaches Chromium as key='Process', keyCode=229, shiftKey=true. The v1.4.163 classifier matched exactly that pattern with no code guard, so it called those keystrokes Enter, rewrote them to a synthetic Shift+Enter, and injected a newline into the middle of the word -- with no Enter key pressed. That is why the reporters said "no modifier key pressed": they had not chorded Shift+Enter, but they had pressed Shift, to type the double consonant. Asserts the row's own recorded capture: 40 immediate keydowns, exactly 3 of them Shift-carrying inside a single syllable, and an onData stream with one newline per Enter press and none mid-word. Two ordinary negatives keep it from being a blanket mute -- the same session's non-IME keydowns still reach shortcut policy, and an ordinary Shift+Enter still resolves through the real policy. Co-authored-by: Orca <help@stably.ai> * test(terminal): pin the composition commit lag that made Korean type one behind macOS Korean 2-Set commits syllable N only when the first jamo of N+1 arrives, so compositionend and compositionstart land in the same task. A composition-start handler cancelled the pending finalizer that was the only path to triggerDataEvent and ended the session without emitting bytes, so every committed syllable reached onData exactly one syllable late and the backlog cleared only at a Space or Enter. Types continuously with no Enter and no Space -- either would flush the backlog and hide it -- and samples onData at every syllable boundary. Paired with a length-matched ASCII arm that stays green throughout, so the positive is a fact about composition rather than about timing in general. Bisected to a single call site across five builds: pristine, 1.4.155 and 1.4.162 pass, 1.4.163 fails, removing the one call repairs it, restoring it fails identically. That window is exactly the reporter's "started immediately after updating". Co-authored-by: Orca <help@stably.ai> * test(mobile): cover the send-queue abort that silently drops queued keystrokes One failed send in use-terminal-live-input-commit aborts every keystroke queued behind it, with the error swallowed by .catch(() => false). The existing test resolves(true) on every send, so the failure branch was uncovered. Four arms: the abort itself, an ordinary negative on the healthy path, a throwing sender, and a liveness control proving the queue recovers once the chain settles. Deleting the abort takes 4 passed to 3 failed, with the ordinary negative correctly surviving. Scope is stated in the docblock: this is a transport send-queue abort, reachable only via a real disconnect or RPC error. REQUEST_TIMEOUT_MS is 30s, so latency alone cannot reach the branch — consistent with #7094's symptom class, not proven to be its cause. * test(terminal): pin that daemon snapshot/restore cannot disturb a composition Two independent reporters attributed broken Korean composition to the always-on PTY daemon repainting terminal state over the preedit. The attribution is wrong on ancestry — the daemon shipped three months before the version both call good — but the boundary was never actually tested. Runs the real applyMainBufferSnapshot choreography against a live composition, including the full 2J/3J/H wipe plus the resize and alt-screen branches. textarea.value, selectionStart/End, compositionView.textContent and .active all survive byte-identical, and interleaving a restore between every jamo of 문제 still commits 문제 at onData. Also pins that the uncommitted preedit is absent from the captured snapshot: it lives in the textarea, never the buffer, so a restore has nothing stale to echo back. Injecting one textarea.value = '' into the restore fails exactly the three restore-boundary tests. * test(terminal): pin that Cmd tears down a composition where Ctrl and Shift do not xterm's composition keydown exempts only keyCode 16/17/18 (Shift/Ctrl/Alt) plus 20/229. macOS Meta — 91/93/224 — is absent, so a Cmd press mid-composition takes _finalizeComposition(false): the overlay goes dark and never recovers, because compositionstart is not re-fired. The user composes the rest of the word blind. Linux and Windows users press Ctrl and are exempt. xterm already has a Meta-aware modifier predicate in wasModifierKeyOnlyEvent, so this is an internal inconsistency rather than a deliberate choice. Owns no reported row and is version-neutral: 5/5 on both 1.4.162 and 1.4.163. The branch is unexercised in all 328 recorded traces, so this is a hazard pin, not a regression guard. Only the teardown is asserted; the likely duplicated commit needs a compositionend the IME kept alive across the Cmd, which no capture contains. Deleting the exemption fails exactly the three paired negatives; adding Meta to it fails exactly the two Cmd arms. * test(native-chat): characterize preedit loss when a question card replaces the composer An AskUserQuestion card fully replaces the composer by design, but the in-flight composition goes with it: the composer unmounts before compositionend reaches it, so the preedit is never committed to the draft. The committed text survives only because the draft is cached and restored via defaultValue. Node identity changes, value 'abc' is preserved, the 가 is gone. Drives the real NativeChatView -> SessionGate -> InteractiveCard -> questionActive swap -> Composer -> ComposerField, flipped by writing the same store field an AskUserQuestion hook event writes. Flipping questionActive to false fails exactly this test and nothing else across 639 native-chat tests, so the path was entirely unguarded. CHARACTERIZATION TEST: it asserts the loss. Fixing the defect — committing the preedit before the swap, or keeping the composer mounted — will make this file fail. Update the expectations to the new contract rather than working around them. Owns no reported row. #12118/STA-3219 flicker is keyed to token counters, which provably do not remount, and a question card arrives once per question. * test(terminal): pin the duplicated commit when Meta interrupts a composition _finalizeComposition(false) sends textarea.value.substring(start, end) but cannot clear the IME-owned textarea, so a later compositionend re-sends the same range. Meta reaches that path because CompositionHelper exempts only Shift/Ctrl/Alt; xterm's own wasModifierKeyOnlyEvent covers Meta four ways, so the omission is an internal inconsistency rather than a choice. Companion to the modifier-exemption guard, which deliberately pins only the overlay teardown. This pins the data consequence. HAZARD PIN: owns no reported row. The trigger is unverified on hardware — no capture in the corpus contains a Meta-during-composition gesture, and whether macOS keeps the composition alive across it is unmeasured. The duplication follows from the code given that sequence; whether users reach the sequence is the open half. An earlier premise that Space (keyCode 32) reaches this path was refuted by a corpus scan: 0 of 731 evidence files carry a keyCode-32 Space while composing, against 171 at 229, and 229 returns early. * test(terminal): characterize the syllable lost when the textarea blurs mid-composition CoreBrowserTerminal._handleTextAreaBlur clears the helper textarea unconditionally — "Text can safely be removed on blur" — while CompositionHelper._finalizeComposition reads the committed text back out of that same value from a deferred timeout. By the time it runs the value is empty, the substring is '', and triggerDataEvent never sees the syllable. xterm checks composition state in _syncTextArea and omits the same check here. Six cases. Blurring mid-composition loses the syllable in every ordering, including compositionend-before-blur, which is Chromium's real order — so it is not an ordering artifact. A bare textarea.blur() with no Orca code loses it too, which places the owner upstream: Orca's unguarded release on outside pointerdown is one trigger, not the cause. Committing 한 then blurring mid-가 yields ['한'] where ['한','가'] is correct: one syllable gone, surrounding text intact. Teeth checked by inverting — adding an Orca-side composition guard flips exactly the three cases that route through the release path and leaves the bare-blur and no-blur cases green, which is the scope split: a fix in regular-terminal-focus-ownership alone would not close this. HAZARD PIN, but unlike the others this one has a real production injector — clicking outside the terminal mid-composition. Owns no reported row. The shape matches #9738's report; the injector does not, and a shape match with a mismatched injector is not an owner. * test(terminal): say which arm the STA-3237 fixture came from The recorded keydowns are wave 4's A-shift-unmarked-only — the arm that emits no PTY bytes. Nothing in the file said so, so two readers concluded the row's events fail the owner's predicate and that STA-3237 and STA-3222 were different defects. They share an owner; the arm that fires is Process/229+Shift, absent from this bubble-phase trace because the owner claims it in the capture phase. Also corrects "code-blind": the v1.4.163 policy emits \x1b\r only for a shift-only key:'Enter', and a jamo keydown reaches that branch solely via the isTerminalImeProcessEnter rewrite. The mock is deliberately wider so the ownership guard stays under test if that rewrite moves. Comments only — no assertion, fixture value, or mock behaviour changed. * test(e2e): track the input-source selector the macOS specs shell out to Five tracked macOS IME specs ran `swift .tmp/select-input-source.swift`, a file that is gitignored and existed only on one machine. Anyone else checking out the repo — or the same machine after .tmp is cleaned — could not run them, and they are the capture drivers for the macOS rows that are blocked waiting for exactly those runs. Moves it to tests/e2e/ beside its callers. The chord spec now resolves it from __dirname rather than reaching two levels up into .tmp. * test(terminal): pin the CJK repaint decision against the reporter's own output #12164 comment 1 and #5921 report agent output with double-width glyphs rendering duplicated character-by-character while ASCII in the same line stays clean. No IME, no composition, no keystroke — the user never types the CJK. Segmenting all three verbatim samples into maximal same-risk-class runs gives 33 runs and zero violations of "this run is corrupted iff the production detector flags it": 17 wide runs all corrupted, 16 narrow runs all byte-identical. The paired negative is co-located in the same line rather than in a separate run — the reporter supplied it without knowing. Doubling is asserted as present, not uniform: 자바스크립트 and 시스템 each leave a jamo undoubled, which is a repaint-region boundary artifact rather than a per-character transform. The discriminating arm is in the test rather than a source mutation: be3f30e2f8 (#6890) elects a repaint for all 17 corrupted runs when the agent types nothing, and reverting its disjunct elects none. Both predicates agree once the user has recently typed, which is the pre-#6890 condition. Samples inlined with per-sample SHA-256 because .tmp is gitignored and cannot back a landed test. * test(terminal): pin macOS period substitution landing after the composition #11504's reporter published a DOM trace showing insertText ". " arriving 149ms after compositionend, when two spaces are typed with a CJK input source and NSAutomaticPeriodSubstitutionEnabled is on. This replays that trace against a real Terminal and asserts what reaches onData — bytes to the PTY, not anything visual. The owner is stock upstream CoreBrowserTerminal._inputEvent, not an Orca module, confirmed at the resolved install and in the shipped bundle Vite loads rather than in the TypeScript source. Three mutations against that install, predictions written before the runs, each failing exactly the arms predicted: dropping the composed/keyDownSeen guard fails two, dropping Orca's intercept fails the one arm where the payload arrives before the send window drains, and flipping || to && — the candidate-fix shape — fails the arm that pins the defect itself. CHARACTERIZATION: arm 1 asserts the broken behaviour and will fail the moment #11504 is fixed. Update it to the new contract rather than working around it. composed is absent from every recorded bundle, so composed: true is the spec-required value rather than a captured one; the test asserts it before dispatching so a harness that dropped the field fails loudly. * test(terminal): replay the recorded Windows Shift sessions through the IME guard STA-3179 reports a Shift release sending Enter; #12171 reports delayed Hangul plus doubled newlines. Both replay their own recorded Windows MS-Korean keydowns through resolveTerminalKeyboardShortcutAction with the shortcut policy mocked, so the assertions are about which events reach the policy and what reaches terminal input. STA-3179's held-Shift gesture yields exactly one newline, from the unmarked Enter alone; its release arms nothing for the next composition, asserted after a precondition check that the release really is keyups with shiftKey already dropped; and an ordinary Shift press-and-release still routes every keydown, which is the paired non-IME negative. Teeth, verified by mutation: bypassing the isImeOwnedKeyboardEvent guard in keyboard-handlers takes STA-3179 from 3 passed to 2 failed / 1 passed — the survivor being the ordinary-session negative, which is correct, since a non-IME session should not depend on that guard — and #12171 from 2 passed to 2 failed. Source restored byte-identical. Recorded shapes are inlined and the bundles cited in comments; nothing is imported from .tmp, which is gitignored. * test(native-chat): correct 61977d4517 — the preedit survives the question card 61977d4517 claimed a composed syllable vanishes silently when an AskUserQuestion card replaces the composer, and characterized that loss. The claim was false. Its premise was an artifact of the harness: the test simulated a preedit with a silent textarea.value assignment and no input event, which no IME does. Real composition fires input with insertCompositionText on every keystroke — the shape this repo already records in its own observed-event capture — and React's change handler returns on input/change with no composition gate, so onChange runs for each frame. The draft cache is written synchronously inside the updater, so the preedit is already committed before the card can arrive. Driven that way, it survives. Renamed to match the contract that actually holds, and extended: Hangul jamo-per-frame, Japanese kana accumulation followed by per-segment conversion asserting the candidate the user was looking at survives, and a pin on the mechanism itself — the draft cache holds the preedit while the card is up. Teeth: there is no fix to revert, so the mutation is the plausible wrong one — gating onChange on isComposing(). That takes 4 passed to 3 failed, with the English negative correctly surviving, since it has no composition to gate. Two consequences remain, recorded rather than fixed: the OS aborts the composition when the field disappears, so a lone jamo returns as a compatibility jamo the user cannot compose onto, and the remounted composer is unfocused because the card owned focus. * docs(native-chat): name the corrected commit and the degraded-jamo consequence Records in the file itself that 61977d4517 is pushed and wrong, quoting the two claims that are false, so a reader who finds it in git log reaches the correction from the file that replaced it. Also states the residual as a consequence rather than a curiosity: a lone leading jamo returns as a standalone compatibility jamo (U+3131), which is not a composable state — the user cannot resume the syllable, only delete and retype. Preserved, but degraded into something unusable. That is the note to find if a reporter ever describes exactly that. The invariant these tests pin is not "the composer commits on unmount" but "composition input events must reach React" — which is what a future IME change would break, and is not visible from the swap site at all. * test(terminal): replay the recorded macOS Telex commit boundaries #6905 reports Vietnamese composed characters breaking in the terminal. Replays the retained macOS built-in Simple Telex capture — recorded selection and value set before each dispatch, since that is what the commit range reads — and asserts what reaches onData: the first commit alone, then through the real Enter, then the ASCII tail of the same run. A code-point count would catch NFD normalisation. ENGINE CAVEAT, stated first in the docblock: this is macOS built-in Simple Telex, Telex only. The reporter's three named engines cannot run on the platform they declared, and which macOS Vietnamese engine they used is unconfirmed. This file certifies no engine, and does not imply VNI. The owner is upstream's — CompositionHelper._finalizeComposition's waitForPropagation branch — so the arms are copies under .tmp aliased by a scratch config, with node_modules verified unchanged by shasum after every run. Collapsing the range end onto its start fails all three; collapsing the start to zero re-emits the first word into the second commit, which is the reporter's "duplicated" direction. Different failure sets, so the mutants are distinguishable rather than merely detectable, and the ASCII assertion passes under both. Falsifiability here is by mutation, not by a defective build: #6905 does not reproduce at HEAD, so this has never been watched going red on a real reproduction. * docs(terminal): lead the #6905 test with its engine caveat Comment-only. Moves the caveat above the source line so a reader meets what the file does NOT establish before what it does — the capture is macOS built-in Simple Telex, the reporter's named engines cannot run on the platform they declared, and which engine they used is what gates this row. Co-authored-by: Orca <help@stably.ai> * docs(terminal): record that the swallow eats a keystroke after Japanese conversion This pin framed the swallowed insertText around Cmd interrupting a composition. A differential through Japanese multi-segment conversion shows it is broader: type a segment, convert, then press `a`, and the `a` is lost. No modifier, no exotic gesture. Korean surfaced it first only because 2-Set composes on nearly every keystroke. Also records why it cannot simply be fixed. The suppression de-duplicates IMEs that deliver their commit a task after compositionend, which a sibling test pins; this swallow is that dedup's false positive, and the two events differ only in payload, so no flag-timing change separates them. Both a smaller redesign and a content-aware variant were built and measured — the first duplicates on IBus, the second costs a reported row's test and is blocked while the patch cannot be regenerated. The Japanese arrays behind this are authored, not observed: no Japanese DOM composition trace exists in the corpus. * docs(terminal): a Japanese capture does exist — correcting dbeecb11be That commit said no Japanese DOM composition trace exists in the corpus. False. One does, filed under the Linux bundles rather than the bundle named for Japanese: 30 DOM events, two にほんご->日本語 conversions, with full selection state per event. It is retained byte-identically in three further bundles — one capture copied four times, not four observations, checked by hash rather than by counting files. The claim came from checking the bundle named for Japanese, finding nothing, and generalising to the corpus without querying the rest of it. Replaying it emits 日本語日本語 under both sequencing extremes on all four arms, matching its own recorded onData. So "repeated conversion is undisturbed" is now captured rather than authored. It carries no post-compositionend insertText, so it cannot speak to the swallow: the a-after-conversion figure stays authored and unobserved. Also rewords the paragraph opener. It claimed to broaden a Cmd framing, but hazard 2 was never Cmd-framed — the lines above already say Cmd does not reach it. The real gap was that hazard 2 named no trigger at all, which reads as exotic when it is ordinary. * build(xterm): land the patch regeneration harness The five dependency patches under config/patches/ shipped with no tracked way to regenerate any of them. The xterm one is the hard case: it is derived from an upstream build, so no fix could be made without rebuilding, and the tooling to rebuild lived only in one machine's scratch directory. That blocked a measured fix for a live keystroke-loss bug, and the EditContext reduction an OSS survey identified as the only real one available. Adds the regenerator, the upstream pin, the hand-written source patch the bundle hunks derive from, tests, docs, and a PR job that verifies the shipped patches still match the pinned build. The job caches the shallow clone keyed on the manifest, so a cold run is minutes and a warm one under one. Round-trip verified: regenerating from a clean checkout reproduces the shipped patch byte-for-byte. Marks the emitted patch -diff -text. pnpm hashes it byte-for-byte, so a CRLF checkout would break install on Windows, and its minified bundle lines make a diff nobody can read — review the source patch instead. Also rejects unknown flags. --check was the fallback for any unrecognised argument, so a typo, or --help, silently triggered a full upstream build instead of what the caller asked for. * fix(xterm): stop swallowing a keystroke typed after an IME commit Type a Japanese segment, convert it, then press a key one macrotask later and that key was lost. No modifier, nothing exotic — every user who keeps typing straight after converting. Korean surfaced it first only because 2-Set composes on nearly every keystroke. handleCompositionInput discarded the payload unconditionally in the window after the deferred send: _isSendingComposition stays true for one macrotask after the timer cleared _pendingCompositionStart, and the branch substituted '' for whatever arrived. The suppression is not itself wrong — it de-duplicates IMEs that deliver their commit an event-loop turn late, which terminal-stock-composition.test.ts pins. It just could not tell a duplicate from new input, because the two events are identical apart from payload. Now it compares against _sentComposition, the text the deferred send actually emitted, and discards only a match. A flag-timing redesign was measured first and rejected: it fixed this and duplicated on IBus, because no timing change can separate events that differ only in content. Edited in config/patches/xterm-src/ and regenerated through the harness, so the emitted patch and the lockfile hash are derived, not hand-written. The commit-overlap pin's swallow arm now asserts the repaired contract — the value its own comment already named as correct and as what stock beta.287 emits. #11504's arm at :184 flips too; it never covered that report, as its own prior note recorded, and the reporter's +149ms arm is untouched and still asserting the defect. Provenance hashes in three test docblocks are updated, since regenerating changes the patch hash and with it the resolved install directory. * docs(terminal): re-measure the #6905 mutation citations against the new bundle Regenerating the patch moved the resolved install, so this docblock's patch_hash, line count, two line numbers and three mutation outcomes all described a bundle that no longer exists. The deferred branch is one the fix writes into, so the outcomes could not be re-pointed on reasoning. Line numbers read off both files by diffing anchors rather than derived by arithmetic: 201 to 205, 159 to 163. Outcomes re-run through the retained rig, which re-resolves through the module loader and re-derives each arm from a unique minified anchor: pristine 3 passed, m1 3 failed, m2 2 failed, m3 3 passed — identical to the old bundle. Guard controls in both directions exit 1, so the counts are falsifiable. Comment-only; the assertions and expectations are unchanged. * fix(xterm): size the preedit overlay to the cells its text will occupy updateCompositionElements computed the overlay's left edge from the grid but never its width, so the preedit rendered at the font's natural advance while the committed text takes two cells per wide glyph. Measured in Chromium 150: 가나다라 drew 48.45px as a preedit and 69.20px once committed — the same characters, same font, 30% narrower, and drifting further with each syllable. Every macOS mono font carrying Hangul measured 0.49–0.72 of two cells; never 1.0. Deriving the width from wcwidth and the cell measure moves Korean, Japanese and Chinese to 1.000 and leaves ASCII at 1.000, which it already was: 한 12.125 -> 17.297 (17.30 expected) 가나다라 48.453 -> 69.188 (69.20) 안녕하세요 60.563 -> 86.500 (86.50) 日本語 42.000 -> 51.906 (51.90) abcdefgh 69.234 -> 69.203 (69.20, unchanged) Edited in config/patches/xterm-src/ and regenerated through the harness, so the emitted patch and lockfile hash are derived rather than hand-written. The unit test asserts the arithmetic, which is what CI can run. The pixel consequence was measured on macOS with SF Mono in an Electron harness, not on the Windows font stack STA-3232 reports from — so this demonstrates the mechanism and does not stand as that row's platform evidence. * test(e2e): pin the macOS Korean preedit as visible only while composing #11914 reports the composing text invisible until Space. Its c3 was recorded as unobtainable, and the reason on file was wrong: the boundary IS assertable, but not in happy-dom, which reports display:block in BOTH the active and inactive states and zeros for every rect. A test there passes with the defect present. Captured on real hardware instead: hidden and 0x0 before, .active with display:block, a 15.84x16 rect and checkVisibility() true while composing 그, hidden again after. 39 DOM events, 2 composition starts, onData ["한","그","\r"]. Two mechanism findings are carried in the setup because both are invisible in the result and fatal if removed. The input source must be selected AFTER the app takes focus — focusing resets it to ABC. And the IME must be warmed until an observed keyCode 229; typed cold it emits raw QWERTY (g k s r m) with no composition at all, which is indistinguishable from an IME that is not installed. Two runs were voided on exactly that signature before the warm-up was found. The has229 and compositionStarts assertions exist to make such a run fail loudly rather than pass as a clean negative. Gated on darwin plus ORCA_E2E_NATIVE_MACOS_KOREAN, like its siblings. The final spec form has not itself been executed — the machine became unavailable — so it carries the probe's measured values as literals rather than a run of its own. * docs(e2e): correct 19a8d133db — the Korean preedit spec has been executed That commit said the landed form had never run and carried the probe's values as literals. It has now run on real hardware: 1 passed, 9.1s, rc=0, with the capture and log sealed under a verified hash manifest. The teeth check was also run rather than reasoned about, and it changes which assertion matters. Forcing the active overlay to max-width:0 with overflow:hidden — invisible on screen — leaves the active class, the textContent, display:block AND checkVisibility() all passing. Only during.rect.width fails. checkVisibility() is not sufficient against this defect; the bounding rect is the single load-bearing assertion, which the docblock already said and this run confirms. An earlier teeth attempt injected the CSS mid-run and tripped the hasActiveClass poll instead, failing at the wrong assertion. It is inconclusive and excluded from the seal rather than counted. * test(terminal): add #12171's ordinary-English arm from a real Windows capture c4 was recorded as unmet and the ledger sourced its control to evidence/windows-current/, which holds 12 captures and not one English one. The arm here comes from windows-9803-final instead — same probe, same host geometry, same injector, en-US with no IME, replayed keydown for keydown. Two limits are stated in the file rather than left for a reader to find. It is a different bundle and a different run about 3.6 hours later, so it is not a same-run arm. And it is #9803's range-active MUTANT arm: ordinary English stays byte-exact even with that saved-range mutation live, which is why it reads as a negative rather than as a baseline. Bundle cited by directory with its file SHA-256; MANIFEST.sha256 verifies 21/21, rc=0. Nothing imported from .tmp. * docs(terminal): correct #12164's grounds — the cited comments say no such thing The rejection of #12164 from this file's family was recorded as resting on its comment 1 (output doubling) and comment 2 (filed against 1.4.163). Checked against the API: the issue has exactly two comments, neither of which says that, and the string 1.4.163 appears nowhere in the thread. The conclusion survives on better grounds. The issue BODY's repro is "Run any CLI agent (Codex, AGY, Claude, etc.) that outputs Korean text into the Orca terminal" — untyped output, no keystrokes, no composition — so excluding CompositionHelper is right, and the input-path hunt was looking in the wrong place. The body is also LLM-authored (it still contains a literal "## 5. GitHub Submission Draft (Ready to Post)") and its Root Cause section blames a CJK IME preedit buffer its own repro never engages, so it should not be read as observation. Comment-only; suite unchanged at 5/5. * test(native-chat): make composition frames carry isComposing, not just inputType This suite's comment claimed "Gating onChange on `isComposing` breaks here." It did not. composeFrame() fired `input` with `inputType` but never set `isComposing`, so a gate on `isComposing` passed all four tests untouched — the suite asserted a discriminator it did not exercise. Composition frames now carry both, so neither gate is exempt. Verified by pointing the mutant at it: with an `isComposing` gate on the composer's onChange, this suite now fails 3 of 4 (it passed 4 of 4 before), and the ordinary-English arm correctly survives, since a composition gate should not touch it. Production code is unchanged and stays gate-free; the mutation was applied, measured, and reverted. Found while excluding NativeChatView's question-card remount as the owner of #12118 / STA-3219: the remount is real, but the preedit survives it precisely because this write path has no composition gate. * fix(mobile): ship the patched xterm build, matching desktop mobile pinned @xterm/xterm 6.1.0-beta.285 while the patch is keyed to 6.1.0-beta.287, so mobile shipped stock xterm and neither IME defect fix reached it: the swallowed keystroke after an IME commit (9506039de7) and the preedit sized to the font rather than the grid (e04e0c88da). Bumps the three xterm packages to the desktop versions and adds the patch to mobile's own pnpm.patchedDependencies. No copy of the patch: pnpm accepts the parent-relative path and records it in the lockfile against hash 8d63166272e9040a…, byte-identical to what desktop resolves, so the two stay in step by construction rather than by a drift check. The workspace separation is untouched — root pnpm-workspace.yaml still declares `packages: []` and mobile keeps its own lockfile, which is what keeps the root's patches from failing as ERR_PNPM_UNUSED_PATCH. Verified in the generated webview bundle rather than at the install: alignPreeditToGrid 0->2, sentComposition 0->3, pendingInput 0->11, and the stock-only _handleAnyTextareaChanges 2->0 and dataAlreadySent 4->0. pnpm applies patches during linking before postinstall regenerates the bundle, confirmed by a revert/reinstall/re-apply cycle in both directions. Mobile suite 2971 passed, 3 skipped — identical before and after. Bundle +1,514 B (+0.24%). Lockfile churn is xterm-only; --frozen-lockfile passes. mobile/src/ime/ime-submit-carry.ts is NOT made redundant and is untouched: it handles iOS firing onSubmitEditing on a React Native native TextInput after unmarking a composition, which is outside the WebView entirely. Known divergence left alone: desktop also patches @xterm/addon-webgl and mobile now runs that version unpatched. That patch is glyph/texture-atlas rendering with nothing IME-related, so it affects neither fix. * test(terminal): pin the preedit overlay against already-committed cells STA-3132 (arm A), STA-3170 and STA-3232 report a Korean preedit painted on top of text already on screen. Builds v1.4.163-v1.4.166 cancel the pending finalizer in compositionstart, so a committed syllable reaches onData one syllable late and buffer.x is stale — the overlay lands on the cell the flushed syllable is about to occupy. Replays a recorded hardware trace rather than an authored one: the ordered DOM event stream captured on Windows + MS Korean (wave5-r2 evidence, 64 events), echoing onData back as PTY output. The load-bearing assertion is deliberately not the obvious one. Comparing overlay style.left against cursorX is tautological — left is computed from buffer.x. This counts committed syllables from the compositionend events the IME fired, so the two sides are independently derived. Discriminated by a historical re-add across seven real bundles, since the owner is deletion-shaped: pristine beta287, v1.4.155 and v1.4.162 pass; v1.4.163 fails; v1.4.163 with that single call removed passes; the byte identical baseline restored fails again; head passes. Every failing arm fails only this case — the ordinary negative stays green in all seven. The negative asserts its own category rather than claiming it: zero composition events, zero isComposing, zero keyCode 229, exactly 16 events, paired against the Korean arm's 4 starts / 3 ends / 11 updates / 64 events. Scope: cell indices, not pixels. happy-dom has no layout, so the recorded 8x16 cell metrics are supplied to the render service. This makes no claim about pixels visually overlapping; that is affected-OS confirmation and stays open. Covers the overlap arm only — STA-3132's auto-line-break arm and STA-3232's half-line-capacity and a11y arms are untouched. * test(e2e): matrix macOS period substitution against the OS preference #11504 reports macOS inserting ". " after a Hangul Space commit. This sweeps six arms across both states of NSAutomaticPeriodSubstitutionEnabled, reading the preference live per run rather than asserting a literal. Two results worth having on record. The reporter's stated trigger did not reproduce. Their words are "There is no second press at all. One space is enough", but korean-single-space emits zero insertText with the preference on or off. So does word-space-word-space. Their timing does reproduce, with different content. korean-double-space and korean-longer-word-double-space emit a delayed insertText at +122.5-122.7ms after compositionend — squarely the reported +149ms — but the payload is a space, never ". ". Consistent with the double-space rule seeing two slots under ABC and only one under Korean, where the IME commit consumes the first. The substitution itself is real and preference-bound: latin-double-space gives "ab . " with the preference on and "ab " with it off, on one build with the preference as the sole variable, reproduced across two runs. That also refutes a claim in PR #11506, which states the substitution "is enforced outside the renderer and never reproduces in dev builds, so changes here must be verified against a packaged app". It reproduced in the dev build twice and did not reproduce on the signed packaged app. That claim should not be used as a verification gate. Gated @headful behind ORCA_E2E_NATIVE_MACOS_PERIOD, same shape as the Korean preedit spec, so it does not run in ordinary CI. Evidence is onData and DOM only — the PTY-child reader aborted and no packaged-app arm was stable. * test(terminal): actually enforce the recorded jamo progression The preedit assertion compared sample.overlayText against sample.overlayText — the same expression on both sides. A lane proved it by mutation: corrupting seven of the eight recorded preedit values left the suite fully green. So the docblock's ㄱ→가→간→나→낟→다→달→라, which the matrix also cites as this row's recorded shape, was cited and unenforced. The first attempt at a fix was insufficient and is worth recording. Threading stroke.preedit through to the expectation still passed on a corrupted fixture, because that value both drives the rig and was the expectation — corrupting it moved both sides together. Same tautology, one level down. The expectation is now an independent literal. Verified by mutation rather than by reading: corrupting two recorded values fails one arm; restoring them passes 3/3. overlayCell was never affected — it is compared against a count derived from the compositionend events, not from the buffer, and remains the load-bearing assertion for the overlap. * fix(e2e): select the selectable input source, not the first match TISCreateInputSourceList can return several entries for one input source id. A third-party IME publishes a non-selectable parent alongside the selectable mode, and taking sources.first can return the parent — after which TISSelectInputSource fails with paramErr (-50) while the caller reports success from the enable step. Found with Qingg (com.aodaren.inputmethod.Qingg), which exposes exactly that pair under one id. Its mode id equals the bundle id, so filtering by name would not have helped; selectability is the discriminator. Now filters on kTISPropertyInputSourceIsSelectCapable and falls back to the old behaviour when nothing advertises it, so single-entry sources are unaffected. Also enables every entry for the id rather than only the one being selected: selecting a mode whose parent is still disabled fails the same way. Compile-checked, and selecting com.apple.keylayout.ABC still exits 0. Unrelated to the enable path: on macOS 26.5.2 third-party IMEs are gated behind a consent sheet in System Settings. TISEnableInputSource returns noErr immediately regardless, and the enable only lands if that sheet is answered while the requesting process is still alive. * test(terminal): discriminate #12171 against the real shortcut policy The prior candidate mutation for this row was correctly refused: its suite mocked shortcut policy so Process/229 became actionable, while the real resolveTerminalShortcutAction has no Process branch — so the kill measured the mock. This does not mock it. Replays a capture of this row's own gesture (d, l, Shift+T, e, k, Space, Enter under MS Korean, committing 있다) taken on Orca 1.4.164, through the real useTerminalKeyboardShortcuts hook, capturing bytes at terminal.input. The earlier capture could not discriminate at all because it recorded no shiftKey; this one records it on 10 of 10 keydowns with code populated. One physical Shift+T produces two shifted Process/229 keydowns. Under the pre-#12265 classifier each synthesizes {key:'Enter', shiftKey:true}, which the real policy resolves to sendInput '\x1b\r' — twice, giving 1b0d1b0d, the two escapes the known-bad ed96881b0d1b0d contains. Mutation is the retained pre-12265-process-shift.patch applied to HEAD, not an authored one: patch -p1 applies clean and diffs identical to the mutant copy. Arms are copies; shared source hashes the same before and after. The English arm stays clean under both modules, so the mutation discriminates by language rather than by harness — and a real Shift+Enter through the same rig yields exactly ['\x1b\r'] in every arm, so a silent pristine result means the code is quiet rather than the harness dead. Scope: 1b0d1b0d is measured at the renderer boundary. The capture recorded no PTY bytes — window.api.pty is frozen on shipped builds and the onData channel needs a build-time flag — so this shows the renderer producing the two escapes that payload contains, not a re-observation of the payload. * docs(native-chat): narrow this file's disclaimer to what is now true It said "THIS OWNS NO REPORTED ROW". Half of that is stale: the remount site is now the attributed owner of #12118 and STA-3219. On real Windows TSF the questionActive swap aborts a live composition — the old node gets only a blur and no compositionend, the text returns as committed, and the next jamo yields 아ㄴ rather than 안. The other half holds. This file pins the opposite property, that the text survives, which is the half those reporters already agree with. Mutation shows the gap rather than asserting it: deleting the unmount entirely leaves three of four tests green, because every substantive assertion is after.value === … and a composer that never unmounts keeps its value. Also records why the abort cannot be asserted here. The DOM exposes no observable separating committed text from a live preedit — value is the same string either way, there is no EditContext, and the only composing-ness state is a per-instance ref discarded with the node. A test pinning "no compositionend fires" would be an anti-guard: red the day it is fixed. The cadence objection is kept, since it is now the open question rather than the reason for exclusion. * refactor(terminal): drop the unread isComposing field from XtermBypassEvent Added by #6396 for terminal IME candidate handling that this branch has since removed. No production or test code reads it, and the policy is safe without it: during composition `key` is 'Process', so the non-ASCII printable checks that would care never match. Co-authored-by: Orca <help@stably.ai> * fix(native-chat): keep the composer mounted through an in-flight IME composition A question card replaced the composer outright (`{questionActive ? null : <NativeChatComposer/>}`). Unmounting the field mid-composition aborts the composition in the OS: the node is detached before `compositionend` can fire, the preedit returns as committed text, and a resumed Hangul syllable degrades — 아 then ㄴ yields `아ㄴ`, never `안`. Confirmed in rasterised pixels on Windows with a real MS Korean IME, at both v1.4.171 and the reporter-era v1.4.164 (the swap block is byte-identical across them): the preedit underline present before the swap, the composer visibly absent during it, and the same glyph back afterwards WITHOUT the underline — committed, not composing. The swap is now deferred while a composition is in flight, which is what editors that survive IME do: ProseMirror gates DOM work on `view.composing`, CodeMirror protects the composing subtree from redraws. Hiding instead of unmounting does not work — `display:none` and `visibility:hidden` both blur the focused element and abort the composition the same way. The hold releases on `compositionend`, which browsers also fire on blur, so clicking into the card's own answer input yields the input region immediately; with nothing composing the card still replaces the composer at once, so no stray "Send a message" appears beside a question. The existing characterization test flips to a regression guard: it pinned the node being destroyed, which was the defect. Node identity is the load-bearing assertion — value-only checks are trivially satisfied by a composer that never unmounts and cannot tell a held composition from a destroyed one. The typing-redirect handler moves to its own hook. That is not cosmetic: both touched files sat at the 400-line cap, and `max-lines` suppressions are forbidden, so the room had to come from a real extraction. * fix(macos): opt Orca out of AppKit automatic period substitution macOS "Add period with double-space" (`NSAutomaticPeriodSubstitutionEnabled`, on by default) is applied by AppKit's text input system. Native terminals never join that system; Chromium text fields do, so xterm's helper textarea inherits it and a double space arrives as `". "` — a period nobody typed, handed straight to the PTY (#11504). Chromium answers AppKit for quote and dash substitution and defaults both off, but declares no period accessor at all, so AppKit applies that one without asking. This user default is the only lever: there is no per-field or per-webContents opt-out to prefer over it. Writing the key into Orca's own defaults domain overrides the global value for this app alone and leaves the user's system-wide setting untouched. It necessarily covers every Orca text field, not only terminals — AppKit offers no narrower scope, and that tradeoff is deliberate rather than accidental. Measured on the reporter's own build v1.4.161: with the preference ON, typing a,b,space,space yields `onData ["a","b"," ",". "]`; with it OFF the same arm yields two spaces. Note the issue's causal model is wrong and this fix does not follow it. It claims the substitution only fires with a CJK input source and never with ABC. The measurement is the inverse — every Korean arm is clean and the ABC arm is the one that fires — so the fix is not conditioned on input source. NOT YET VERIFIED ON HARDWARE. The unit tests inject the writer, so they prove the call is made on darwin and skipped elsewhere; they do not prove AppKit honours an app-domain override for this key. That check is outstanding. * fix(xterm): keep a live composition across a lone Cmd press on macOS CompositionHelper.keydown exempted keyCodes 16/17/18 from tearing a composition down, which covers Shift/Ctrl/Alt but not macOS Meta — 91/93 in Chromium, 224 in Firefox. A lone Cmd press mid-composition therefore reached _finalizeComposition(false), which dropped the preedit overlay's `active` class and committed the live syllable early. macOS keeps the marked text alive across that press, so no later compositionstart re-arms the overlay and the rest of the word composes invisibly. Measured on hardware (m4air, macOS 26.5.2, Apple M4, 2-Set Korean) with the Cmd posted as a CGEventType.flagsChanged, which is what a physical modifier emits. AppleScript `key code 55` posts nothing a browser can see — a bare `key code 56` for Shift is equally silent — which is why no capture in the corpus ever reached this branch. Three arms, same build otherwise: overlay live throughout with the exemption, dark and prematurely committed without it, live again with it restored. Evidence under .tmp/ime-handoff/swarm-scratch/wave31-cmd-preedit/evidence/. The fix cannot widen past a lone modifier: only a standalone press reports these keyCodes, and a Cmd chord during composition is reported by Chromium as 229, which was already exempt. Cmd+A still ends the composition, via the IME's own compositionend. Ghostty draws the same line, returning early from flagsChanged under hasMarkedText() for every modifier including Super. Orca's terminal pane was never affected — shouldSuppressTerminalModifierKeyboardEvent drops a standalone Meta keydown before xterm sees it, and deleting only 'Meta' from that set is what flipped the hardware arm to broken. The popout preview terminal and mobile's webview install no such guard and did reach the teardown. terminal-ime-xterm-composition-commit-overlap.test.ts asked its fixer to update the two Cmd arms to the values it named as correct; both now emit a single ['한']. * test(native-chat): drop two byte-identical duplicate cases `4632b86919d` copy-pasted two cases twice into the same describe block: `retains carry across a same-frame non-Enter keyup before redispatch` and `expires carry before a deliberate Enter after the next frame`. Each pair is byte-identical — same title, same body — so the copies asserted nothing the originals did not. This is what has been failing `static analysis` on this branch since 2026-08-06: `oxlint vitest(no-identical-title)` reports both under `--deny-warnings`, and `verify` fails solely because it requires static analysis to pass. Every other gate in `verify` was already green, including typecheck, xterm patch sync, the full test shard set, and both package jobs. 12 cases still pass in the file. * test(e2e): skip the WebGL arm when no WebGL renderer exists The #12164 probe runs two arms, webgl and dom, and closes by asserting the active renderer is the requested one. That assertion is right for the dom arm — it is what proves the pane actually left WebGL, without which the arm is meaningless — but headless CI has no GPU, xterm falls back to DOM silently, and the webgl arm then fails. The failure reads as a Korean rendering defect and is not one, so the webgl arm now skips with the active renderer named. The dom arm keeps the assertion unchanged. This is the third of three checks that have been red on this branch since 2026-08-06. `static analysis` and `verify` were fixed in c51c6b5837e; the CI log shows this job as 1 failed / 1 passed, the pass being the dom arm. * chore(lint): drop five unused no-console disable directives `check-changed-code-quality` reports unused eslint-disable directives as errors, and these five sat above diagnostic `console.log` calls in IME test and spec files where `no-console` is not enabled — so each suppressed nothing. This is the second of the two static-analysis steps. `c51c6b5837e` fixed "Enforce focused code-quality plugins" (duplicate test titles); this fixes "Enforce changed-code quality". Both had been red on this branch since 2026-08-06, and I mistook the first for the whole job. The diagnostic logs themselves are kept — they are what a failing IME arm prints for a reader to inspect. * test(e2e): cover #12164 under fractional device scale factor Fractional display scaling was #12164's last unexplored branch, and the reason is worth recording: earlier attempts were BLOCKED, correctly, because they proposed mutating the Windows display scale on a remote physical machine with no console recovery. `--force-device-scale-factor` reaches the same renderer state per process, so nothing outside the Electron instance changes and there is nothing to restore. The hypothesis was specific: `프프로로젝젝트트` is what a half-pixel cell boundary could produce on a 2-column glyph, and nothing else in the suite varies dpr. Measured at 1.25 and 1.5, both under WebGL: ink extents 25/21/16 with identical ink groups, matching the scale-1 run. No doubling. The arm self-certifies before asserting — if the flag does not take, the test fails rather than silently measuring at dpr 1. That matters here: the sibling spec's WebGL arm went two days reporting a missing GPU as a Korean rendering defect precisely because a silent fallback looked like a result. * fix(terminal): match Mod+letter shortcuts by physical key, not IME-rewritten key With a CJK input source active, macOS and Windows report the physical key through `code` but rewrite `key` to the layout's character: Korean 2-Set turns Cmd+C into `{ key: "ㅊ", code: "KeyC", metaKey: true }`. Every `key.toLowerCase() === 'c'` match misses it, so the shortcut is not recognised and xterm encodes the chord as PTY input instead — issue #13033 reports `ESC[12618;9u` and a terminal that jumps to the bottom, because user input scrolls the viewport. This is the same key-vs-code confusion that owned #12171, where a `Shift+T` typing ㅆ was read as Enter for want of a `code` guard, so the fix is the same shape: trust `code` when it is present, fall back to `key` and then the legacy `keyCode` when it is not (Chromium omits `code` on synthetic and some keypress events, and `keyCode` keeps its US value even when `key` is rewritten). Applied to the four terminal-side sites, including the dashboard pop-out, which #13033 called out specifically as having its own key handler: pty-connection.ts Cmd/Ctrl+C copy guard keyboard-handlers.ts Cmd+G search navigation agent-interrupt-inference.ts interrupt inference preview-terminal-key-handler.ts pop-out paste Nine further `key.toLowerCase()` letter matches exist outside the terminal (TaskPage, editor, GitHub composer, browser markup). They have the same defect and are deliberately left for a separate change rather than widening this one. An existing case, `matchSearchNavigate > returns null for wrong key`, overrode only `key` and left `code: 'KeyG'`, so it began passing for the wrong reason. It now overrides both — which is what "wrong key" means once matching is physical — and a companion case pins the Korean-rewritten chord still matching. #13033 was closed NOT_PLANNED; the reporter's event shapes drive the new test. * fix(renderer): match every Mod+letter shortcut by physical key, not IME-rewritten key Completes the previous commit. A CJK input source rewrites `event.key` while `event.code` keeps the physical key, so `key.toLowerCase() === 'z'` and friends silently stop matching — the shortcut is not recognised and the keystroke falls through to whatever handles unclaimed input. The helper moves to `@/lib/ime-latin-shortcut-key` first: it now serves the editor, GitHub composer and browser markup, and importing terminal-pane internals into those would be the wrong direction. `lib/` already hosts `ime-composition-keyboard-event` for the same reason. Nine remaining sites, all previously unreachable under Korean/Japanese/Chinese/ Vietnamese input: TaskPage, ActivityPrototypePage, ProjectViewWrapper Cmd+F search useMarkupKeyboardShortcuts Cmd+Z undo GitHubMarkdownComposer, RichMarkdownLinkBubble, rich-markdown-link-shortcut Cmd+K link native-chat-shortcut Cmd+J rich-markdown-key-handler Cmd+Shift+X Six of the nine test `!== 'letter'` as early-return guards and three test `=== 'letter'`; the negation is applied per site, since a blind substitution would have inverted six of them. Full suite: 4249 files pass. Three files fail locally and none is caused by this change — the branch touches no file under `src/main/` or `src/relay/`, all four failures reproduce on an unmodified tree or pass in isolation (the worktree poller passes 21/21 alone, so it is full-suite parallelism), and all 16 CI test shards are green. * docs(ime): scope the IME composition rules to the terminal-pane directory #11893 proposed adding these to the root `AGENTS.md`, which every agent loads on every task regardless of what it is doing. They only bind keyboard handling, the composer and the terminal input path, so they belong next to that code — `tests/e2e/AGENTS.md` already establishes the nested convention here. Kept from #11893: range-derived commits, guarding above the key dispatch, the `attachCustomKeyEventHandler` / `CompositionHelper` interaction, no normalization at commit, and the recorded-trace evidence bar. Added from defects found since it was written: - match shortcuts on `event.code`, not `event.key` (#12171, #13033) - `keyCode === 229` means an IME owns the press - do not unmount a field mid-composition, and hiding is not a fix because `display:none` blurs and aborts it too (#12118, STA-3219, #11332) The evidence bar now also names the mutation check, since a test that survives deleting the code it guards is guarding nothing — a failure this effort hit more than once. * fix(terminal): gate Ctrl+Enter CSI-u on a negotiated pane, porting #12462 Found while scoping the rebase onto `main`: #12462 landed on 2026-08-06 and fixes a real defect this branch does not carry. Ctrl+Enter emitted `\x1b[13;5u` unconditionally, so a pane that never negotiated the kitty keyboard protocol — local Windows ConPTY, plain shell — printed the escape verbatim into the prompt. This branch deletes `terminal-ime-deferred-newline.ts`, which is one of the files #12462 touched, so a rebase resolving those conflicts by taking our side wholesale would silently reintroduce the defect. Porting it forward now means the fix survives the rebase however the conflicts are resolved. Mirrors the Shift+Enter guard already here: local ConPTY falls back to the legacy CR every emulator sends, and a negotiated pane keeps the chord, so the fallback is scoped to panes that cannot receive CSI-u rather than to Windows. NARROWER THAN #12462 BY ONE CONDITION, deliberately. `main` also allows CSI-u via `hasCtrlEnterCsiUAuthority()` (trusted consumer evidence, #12329); that helper and its plumbing do not exist on this branch. Omitting it is the conservative direction — an authorised pane gets `\r` instead of the chord, rather than an unnegotiated pane printing an escape — but it should be restored when the two histories are reconciled. Test covers both directions and is mutation-checked: forcing the gate open fails it, so it cannot pass by construction. * fix: reconcile two more fixtures main moved while the stack waited Both caught by CI, not locally, and the reason the local run missed one is worth recording: 1. `browser-toolbar-profile-dialogs.ime-enter.test.tsx` did not pass `useNativeUserAgent` / `onUseNativeUserAgentChange`, which `main` added to `BrowserToolbarProfileDialogsProps`. Local `pnpm typecheck` reported 0 errors on the same commit CI failed. The cause was a stale `config/*.tsbuildinfo` — tsc reused an incremental cache from before the merge. Deleting it reproduced CI's error exactly. Any "typecheck clean" during this merge should be treated as unverified unless the cache was cleared first. 2. Localization keys for `SshDisconnectedDialog` were absent from `en.json`: the merge took this branch's component alongside `main`'s catalog. Regenerated with `pnpm run sync:localization-catalog` rather than hand-added. * fix(mobile): regenerate the lockfile the merge resolved by taking one side CI's `verify` failed with `ERR_PNPM_OUTDATED_LOCKFILE` on `mermaid (lockfile: 11.16.0, manifest: 11.16.1)`. The mismatch was in `mobile/`, not the root — the root lockfile was consistent throughout, which is why inspecting it (and even GitHub's merge ref) found nothing wrong. Cause: during the merge I resolved `mobile/pnpm-lock.yaml` by taking this branch's side wholesale rather than merging it, so it kept `mermaid 11.16.0` while `mobile/package.json` came from `main` at `11.16.1`. Taking one side of a lockfile is only safe when the corresponding manifest comes from the same side. Regenerated with `pnpm install --lockfile-only`; `--frozen-lockfile` now passes in `mobile/`. Verified the xterm patch entry survives intact — same hash `4f1b42d268f3964d…` and the parent-relative path into `config/patches/`, which is the desktop/mobile coupling that would silently break the mobile build. Two earlier diagnoses of this failure were wrong and are worth recording: it was not the root lockfile, and it was not a stale merge ref (a rerun reproduced it exactly). --------- Co-authored-by: Orca <help@stably.ai>	2026-08-07 22:58:40 -07:00
Jinjing	e6e197feed	Add Recent Chats & Terminals to Cmd+J palette with digit shortcuts (#13076) ... * Add Recent Chats & Terminals to Cmd+J palette On empty query, the palette leads with recently accessed chats and terminals, addressable via ⌘1–⌘9 shortcuts. Digit chords are intercepted while the palette is open, preventing workspace switches behind the overlay. Status dots reflect agent blocking and activity. * Fix Cmd+J recent order capture and backfill behavior - Capture unfiltered recent tab order when palette opens, avoiding frozen filtered subsets on search reopen - Backfill recent section when rows drop out (mid-open narrowing) instead of rendering empty - Move create-workspace action to the end as a fallback, not competing with real matches - Add test coverage for order freezing, backfill, and create-action ranking * Fix Cmd+J selection backfill when recent tabs hydrate late Track auto-selected item to distinguish user-moved selections from auto-picks. When recent tabs arrive after the palette opens, reset selection to the top item unless the user explicitly moved it. Use useLayoutEffect to capture the pre-hydration worktree order before tabs render, preventing flashing. Fix worktree budget cap for sessions with no open tabs. Add test coverage for late hydration and user-moved selection preservation. * Rank Cmd+J results by match relevance, lead with stronger section Adds match-relevance scoring to rank search results by which field matched and match position (prefix > word-start > mid-word). When a typed query has results in both worktrees and open tabs, whichever section holds the stronger hit now leads the list, matching user intent — a prefix hit in a tab beats a mid-name hit in a worktree. Decouples live status dots from the palette body subscriptions to prevent the whole list from re-rendering on every agent transition or pane-title change. Dots now own their subscriptions via PaletteLiveStatusProvider, while the body reads status maps as a snapshot, refreshed only when the palette opens or tabs change. Freezes the snapshot identity during animation to keep the selection stable even while closing. * Handle decomposed accents in Cmd+J match relevance scoring Include Unicode combining marks (\p{M}) in word-boundary detection so decomposed characters like café are treated as word boundaries instead of mid-word matches.	2026-08-07 17:21:47 -07:00
Jinwoo Hong	2a93cae293	fix(crash-reporting): stop filing Windows OS shutdown as renderer crashes (#12938)	2026-08-07 15:51:24 -07:00
3 people	6942871194	feat(editor): add Markdown table structure controls (#11985) ... * feat(editor): add markdown table structure controls * fix(editor): scope table context actions to cells * Replace table toolbar with context-aware overlay controls Replace the fixed table toolbar with context-sensitive overlay controls that position themselves around the active table, adding support for direct row/column insertion and full table deletion. This approach is less intrusive and supports click-targeted actions via coordinate-based cell resolution. Enhance structural safety by preventing header removal and ensuring tables never collapse below a single cell, deleting instead when the final row or column is removed. Harden the context-menu query with a 120ms timeout to keep the native menu responsive even if the renderer hangs. * Replace markdown table context query with IPC coordination Capture table cell targets on pointerdown and report via IPC channel instead of executing JavaScript on context-menu events. Eliminates 120ms query timeout and unavailability race conditions. Header cells now disable incompatible row-level actions. * fix(editor): make table column rebalancing atomic with insertion - Refactor rebalanceAddedColumn to mutate the caller's transaction, grouping insertion and rebalance into a single undo step - Add validation for cached cell positions that may outlive the document - Fix table detection to use isInTable() instead of isActive('table') - Correct z-index layering to respect menu stacking context - Fix cleanup of stale animation frames and pending pointer state --------- Co-authored-by: rainL <WYK15@users.noreply.github.com> Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>	2026-08-05 11:10:05 -07:00
Neil	4f963fd279	fix(browser): remove unsafe window close bypass (#12040) ... * fix(browser): remove unsafe window close bypass * test(browser): strip legacy close policy on hydration	2026-08-01 21:07:58 -07:00
Neil	9db4cde93b	fix(windows): keep browser close marker URL absolute (#12038)	2026-08-01 20:35:53 -07:00
Neil	c79b859758	fix(browser): prevent window.close guest crashes (#11910) ... * fix(browser): prevent window.close guest crashes * fix(browser): guard close before inline scripts * fix(browser): preserve explicit window close policy	2026-08-01 03:08:11 -07:00
Jinwoo HongandOrcaWin	a6423d565b	fix(macos): prevent stale UI surfaces after wake (#11226) ... Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>	2026-07-28 16:37:13 -07:00
4 people	2b88931b93	Bug floating workspace shortcuts route to main w (#10433) ... * fix(floating-workspace): route panel shortcuts to the floating panel, not the main window Floating-workspace close/index keyboard shortcuts leaked to the main window behind the panel. Route them through the floating panel across all four keydown layers via an atomic focus signal, panel-owned indexed switching with a tri-state outcome, an event-target-aware close guard, and a floating-scoped guest IPC bridge. Changes A-E and findings F2/F3/F4/F6/F7/F8/F9/F11/F-adv/F-dl/F-feas. Co-authored-by: Orca <help@stably.ai> Co-authored-by: feelgom <littlestork4@gmail.com> Co-authored-by: Wooseong Kim <innocarpe@gmail.com> * fix(review): clear stale floating-panel reclaim intent on panel close The module-singleton reclaim intent (F3) is armed at an emptying-close but only consumed by the visibleFloatingItemCount->0 effect. If a concurrent tab-create keeps the panel from reaching 0, the intent stays armed and could survive to a later empty-panel mount and steal keyboard focus. The !open release effect now clears it (defense-in-depth), matching the outside-pointerdown/window-blur paths. Flagged by 4 review personas (correctness, adversarial, julik-races, maintainability). Co-authored-by: Orca <help@stably.ai> * test(floating-workspace): cover L1 index-chord yield and deferred-close reclaim-arm timing Two additive R2-review tests for the #10288 floating-workspace shortcut routing change set: - createMainWindow: assert L1 yields the initial indexed-switch chord (tab-index and worktree-index) to the floating panel without preventDefault or dispatch, and contains held-key auto-repeats in main (preventDefault, no dispatch). Closes the untested Change B (F4) path. - FloatingTerminalPanel: assert an emptying, panel-owned close whose closeTerminalTab defers/cancels (onClosed never fires) leaves the reclaim intent unarmed, so no later empty-panel mount can reclaim focus for a close that never happened. The prior mock fired onClosed unconditionally, so this arm-timing (F3) branch was uncovered. Co-authored-by: Orca <help@stably.ai> * fix(review): resolve round-1 findings F-1..F-6 - F-1: re-derive panel emptiness from live store at arm time; clear stale reclaim intent on repopulating create so an unrelated later close can't consume it and steal keyboard focus from the main workspace. - F-2/F-5a: single-source the panel's non-creation shortcut claims via matchFloatingWorkspacePanelShortcut(); shared isTerminalPaneCloseChord() predicate for L2/L3; App.tsx gate + both FloatingTerminalPanel call sites now call the SSOT so index/rename/max-min ownership can't drift. - F-4: L2 keydown gate is event-target-aware (matches L1 yield) so an L1-yielded chord is still consumed during a transient panel blur. - F-5b: export clearReportedFloatingFocusCache() + reset it in test setup. - F-5c: split floating-workspace-item-actions.ts into focus-reclaim + guest-bridge modules (AGENTS.md file-naming). - F-6: trim verbose design-code comments to single-line WHY. Co-authored-by: Orca <help@stably.ai> * fix(floating-workspace): remove finding reference labels These internal review labels (F1–F7) and change identifiers were used during development and are no longer needed in the code. * fix(floating-workspace): preserve reclaim for deferred dirty closes Dirty editor closes defer to the save dialog and complete asynchronously. The reclaim-arm check must survive the queue and execute when the file leaves— otherwise the next Cmd/Ctrl+T misses the floating panel entirely. Also resolve browser guest page ids to their owning workspace for correct routing. * perf(floating-workspace): single-pass shortcut match and stable listeners Three hot-path cleanups with no routing behavior change: - Match each keydown once. App.tsx's yield gate now calls one matchFloatingWorkspacePanelChord instead of scanning the creation table and the chrome table separately, and the panel splits dispatch into resolveFloatingPanelShortcut + applyFloatingPanelShortcut so the surface keydown preflight shares its resolution instead of re-matching. - Pin the window-capture and guest-bridge listeners to [open] by reading the live closures (tab order, activate, close helpers, dispatch) through a ref, so a tab switch or reorder no longer re-subscribes them. - Cache the per-tab TerminalPane ref callback so a parent render stops detaching and re-attaching every pane handle. Creation chords stay target-gated and chrome chords stay ungated, matching the two matchers the combined one composes. Pre-commit hook bypassed: config/oxlint-react-doctor.json fails to parse against this worktree's stale node_modules (oxlint 1.71.0 / react-doctor 0.2.10 vs the pinned ^1.75.0 / 0.9.1) for any file. oxlint, oxfmt --check, tsc, the max-lines ratchet, and the targeted vitest runs were run manually. * fix(floating-workspace): keep TerminalPane ref callback identity stable The per-tab ref callback cache deleted its own entry on detach. After a same-id remount (key is tab.id + generation) React detaches the old element *after* the new render already read the cache, so the delete dropped the entry that render had just written — every later render minted a fresh identity and forced React to detach/re-attach the pane, the churn the cache existed to prevent. Move the cache into terminal-pane-handle-registry.ts: detach clears only the handle, attach re-arms the cache entry, and dead tab ids are pruned from an effect keyed on the live tab list. Unit-tests cover attach/detach identity stability — FloatingTerminalPanel.test.tsx's React mock discards effect deps and ref identity, so component tests can't catch this class of bug. Also softened the combined-matcher comment: App.tsx's old `||` already short-circuited, so that call site buys drift-safety, not fewer scans. Gates: tsc (web), oxlint, oxfmt --check, max-lines ratchet, 332 focused vitest tests. Pre-commit hook bypassed: config/oxlint-react-doctor.json fails to parse against this worktree's stale node_modules (oxlint 1.71.0 + react-doctor 0.2.10 vs the pinned ^1.75.0 / 0.9.1) on untouched files too. * fix(floating-workspace): pure registry init for react-doctor Replace null-guarded ref mutation during render with useState lazy init so CI check:react-doctor:changed stops failing on FloatingTerminalPanel. * fix(floating-workspace): drop unused registry type import Satisfies oxlint no-unused-vars after pure useState registry init. Local pre-commit react-doctor config fails on stale node_modules; CI has current plugins. --------- Co-authored-by: Orca <help@stably.ai> Co-authored-by: feelgom <littlestork4@gmail.com> Co-authored-by: Wooseong Kim <innocarpe@gmail.com>	2026-07-28 14:24:15 -07:00
NeilandOrca	627cde33d5	fix(window): stop burning macOS GPU on an invisible blur effect (#8482) (#10682) ... Co-authored-by: Orca <help@stably.ai>	2026-07-26 00:21:52 -07:00
NeilandOrca	7d47e9e1d8	fix(window): stop viewport reflow from moving screen geometry (#10543) ... * feat(diagnostics): record OS suspend/resume so sleep gaps aren't read as freezes Renderer timers stop across OS sleep, so a multi-hour `renderer_memory` heartbeat gap looks identical to a wedged renderer. That ambiguity sent the uber-crash investigation down a deadlock path that the telemetry later disproved -- and a healthy machine's own trace shows a 427-minute mid-session gap with reason=interval, so the gap alone proves nothing either way. powerMonitor 'resume' was already wired for renderer wake recovery but left no breadcrumb. Stamp suspend and report the measured span on resume so the next freeze report can be told apart from a laptop lid. * fix(diagnostics): only record sleeps long enough to hide a heartbeat Adversarial review flagged that the first cut would flood the 30-entry breadcrumb ring and evict the crash evidence it exists to explain. Measured on 7 days of pmset history: 70 user-visible sleep cycles, worst 60-min burst of 7. Median span is 2 SECONDS -- only ~24% run past 60s, so most of that traffic could never explain a gap anyway. Cycles are counted Sleep -> next FULL Wake, since powerMonitor's resume maps to NSWorkspaceDidWake, which does not fire for dark wake. Drop the suspend breadcrumb (suspend now only stamps a timestamp) and emit a single `system_slept` on resume, gated at 60s. That cuts 70 cycles to 17 over the same week (worst burst 3) while still catching every sleep long enough to swallow a 60s renderer heartbeat. * test(diagnostics): assert resume listeners detach by identity The off mock deleted by event name alone, so teardown detaching a different closure than the one registered still passed -- a leak of the real powerMonitor listener would have gone unnoticed. For 'suspend' that leak has no other observable effect through the public API. Co-authored-by: Orca <help@stably.ai> * fix(diagnostics): span from the first suspend across dark wake powerMonitor 'resume' maps to NSWorkspaceDidWake, which does not fire for dark wake, so macOS can deliver suspend -> suspend -> resume. Overwriting the stamp reported only the trailing segment, and when that segment fell under the 60s gate a 90-minute sleep recorded nothing at all -- leaving the gap looking like the unexplained freeze this is meant to rule out. Co-authored-by: Orca <help@stably.ai> * docs(diagnostics): correct the threshold rationale to match measurement The comment claimed maintenance sleeps would flood the ring. Re-measuring pmset over 6 days (78 sleeps, 29 full wakes, 51 dark wakes) shows they resolve as DarkWake, which never fires 'resume', so they never recorded a breadcrumb at all. Real rate is 29 breadcrumbs / 6 days, worst 60-minute burst 4 against a 30-entry ring. The gate's actual job is narrower: skip sleeps shorter than the 60s heartbeat, which cannot open a gap to explain. Co-authored-by: Orca <help@stably.ai> * fix(window): stop viewport reflow from moving screen geometry Blink's ScreenMetricsEmulator::Apply checks screen_size and view_position before the desktop/mobile branch, so screenPosition:'desktop' does not make them inert -- despite Electron documenting both as mobile-only. Passing the content size and 0,0 overrode screen.width/availWidth and the window origin for the whole 32ms hold, so a browser context menu opened mid-reflow would translate against 0,0 and land in the wrong place (BrowserPane.tsx:3167). Empty screenSize means 'no override', and an omitted viewPosition stays nullopt in Electron's converter, so the real position survives. Only the scale factor moves now, which is what the reflow actually needs. Also record a breadcrumb when the restore exhausts its attempt budget: the renderer is left at the wrong scale factor until some later reveal fixes it, and that was previously silent. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>	2026-07-25 03:35:54 -07:00
NeilandOrca	46942783c4	fix(window): reflow via scale factor so terminals stop re-gridding (#10485) ... The +1px emulated viewport changed the CSS box, so a terminal sitting one pixel under an xterm row boundary gained a row. The pane fit observer's two-frame stability check reads that transient grid as stable well inside the 32ms hold, forwards a real PTY resize, then reverses it on restore — two SIGWINCHes per reveal, measured on 3/54 window heights (~1/cellHeight). Nudging the device scale factor instead re-runs layout with byte-identical CSS geometry. Same reflow, 0/54 SIGWINCH, no WebGL atlas rebuild or context loss, and webview guests stop seeing spurious native resizes too. Co-authored-by: Orca <help@stably.ai>	2026-07-24 20:53:04 -07:00
Neil	c468e3f8b8	fix(macos): close both macOS 26 main-thread deadlock doors and restore the reveal reflow (#10473) ... * fix(window): restore the macOS 26 reflow without touching the native frame #10253 stopped the main-thread deadlock by skipping the repaint size nudge on macOS 26, but invalidate() repaints without reflowing, so the h-dvh root kept a stale viewport height and the status bar stayed clipped off-screen (STA-2383) on every Tahoe reveal, restore and wake. Drive the reflow through device emulation instead: a +1px emulated viewport, reverted a frame later, makes the renderer recompute layout without any NSWindow mutation, so the FrontBoardServices re-entrancy that wedged the main thread for 109 minutes is still never triggered. Verified against real Electron 43.1.0 on macOS 26.3.1 (Darwin 25.3.0): the renderer sees the resize and relayouts, the native frame is untouched, the viewport and devicePixelRatio restore exactly across zoom levels, overlapping calls collapse to one cycle, and a 1px delta never crosses a terminal cell boundary so no pane reports new geometry (no SIGWINCH to running shells). Also close two gaps in the surrounding code: - the pre-Tahoe size jiggle now clears its WeakSet latch in a finally block, so a throwing setSize can no longer suppress every later repaint for that window - cover powerMonitor 'resume' under the Tahoe guard, the other AppKit dispatch context implicated in the freeze * fix(tray): keep NSStatusItem scene updates off the AppKit callout stack The main-window repaint was only one of the two doors into the macOS 26 FrontBoardServices deadlock. Showing or restoring the window calls setTrayAttention(false) straight from the window event handler, and tray.setImage/setToolTip drive an NSStatusItem scene update — the same re-entrant scene mutation from inside AppKit's own dispatch, matching the stackshot in openai/codex#23695. Defer the native mutation to a fresh event-loop turn so the callout frame is vacated first. The attention flag itself still flips synchronously: rapid show/hide would otherwise mis-dedupe against a value that had not landed yet. Bursts collapse to a single repaint, and because the deferred pass reads current module state rather than a captured value, a coalesced schedule can never apply a stale icon. applyTrayImage already no-ops on a destroyed tray, so a repaint still queued when the tray goes away is harmless. * fix(window): reflow maximized and fullscreen windows on macOS 26 too The maximized/fullscreen bail-out predates the Tahoe path and exists only to keep the size nudge from resizing a window out of those states. Emulation never touches the frame, so that guard was suppressing the reflow for no reason — and a maximized window strands its dvh layout exactly like a normal one. Run the Tahoe branch before the guard. Verified on macOS 26.3.1 that the emulated viewport reflows a maximized and a fullscreen window while leaving both states intact. * fix(window): retry the viewport restore instead of stranding the renderer If disableDeviceEmulation threw while the webContents was still alive, the previous code swallowed the error and cleared the latch anyway, leaving the renderer pinned at the emulated 1px-taller viewport for the rest of the window's life — and letting the next reveal stack a fresh cycle on top of it. Retry the restore on a bounded schedule and hold the latch while a retry is pending. A destroyed webContents still short-circuits, since the emulated viewport dies with it, and the attempt budget keeps a permanently failing restore from pinning the latch forever.	2026-07-24 19:54:25 -07:00
Brennan Benson	1b5db4bc2a	fix(window): reflow on macOS occlusion-reveal so the bottom bar is not clipped (#10056) ... * fix(window): reflow on macOS occlusion-reveal so the bottom bar is not clipped Fixes STA-2383. On macOS the window is background-throttled while hidden; on occlusion-uncover only 'focus' fires and its handler runs webContents.invalidate() (the setSize jiggle is skipped to avoid SIGWINCH-ing terminals). invalidate() repaints but does not reflow, so the app-shell h-dvh root keeps a stale dynamic-viewport height and the StatusBar is clipped below the viewport ('no bottom bar'); a manual resize restores it. Fix: renderer relays a genuine hidden->visible reveal (visibilitychange) to main via new ui.notifyWindowRevealed IPC; main runs the same proven forceRepaint. Occlusion-gated (no per-Cmd+Tab SIGWINCH regression), darwin-scoped, sender-guarded, cleaned up on close. Test plan: vitest createMainWindow + web-preload-api green. Recommend on-device macOS occlusion QA before merge. * fix(window): preserve user resizes during reveal repaint	2026-07-24 00:36:18 -07:00
Brennan Benson	4569a4fe71	fix(window): defer the repaint size nudge and skip it on macOS 26 (#10253) ... The show/restore repaint jiggle mutated the window frame synchronously inside AppKit's window-state dispatch. On macOS 26 (Tahoe), windows are scene-backed and a frame update sent re-entrantly from scene-update handling can self-deadlock the main thread in FrontBoardServices (kernel-confirmed spindump: performAsyncAndWait on the callout queue the main thread was draining). - Defer the setSize nudge to a fresh event-loop turn so it never runs inside the show/restore dispatch. - On Darwin 25+ (macOS 26) skip the nudge entirely and rely on webContents.invalidate(); the nudge works around a pre-Tahoe black-surface compositor bug.	2026-07-23 18:28:52 -07:00
Brennan Benson	bded1fb2c0	fix(app): bound the wake/quit paths implicated in the phone-session-ended freeze (#9447) (#9853) ... * fix(app): bound the wake/quit paths implicated in the phone-session-ended freeze (#9447) - relay-transport: waitForClose now times out (5s) so a half-open post-sleep socket can't wedge runtimeRpc.stop() - will-quit: race teardown against a 20s deadline so app.quit() always runs (Force Quit was the only escape when any teardown member never settled) - terminal-fit-restore: local restoreTerminalFit invoke gets the same 15s bound as the remote path so the held-fit modal buttons can't pin disabled * fix(app): close wake recovery timeout gaps * fix(relay): drop late frames after forced teardown * fix(relay): fence detached socket callbacks * fix(app): close timeout resource gaps * fix(relay): detach retired mobile transports * fix(types): exclude absent stat overloads * fix(runtime): expire wedged terminal restore dedupe * fix(runtime): keep restore retries on one reclaim * chore(skills): refresh bundled skill manifests * fix(window): fence quit acknowledgements by request * fix(relay): bound revoked device socket cleanup	2026-07-23 18:03:43 -07:00
4 people	7386ef2857	perf(renderer): stop full durable-state save on every top-level view switch (#9002) (#9393) ... * perf(renderer): stop full durable-state save on every top-level view switch (#9002) Persist activeView in a tiny profile-scoped sidecar instead of mutating the monolithic recovery snapshot. Active-view-only updates now bypass the broad UI normalization and durable save scheduler, while a 100ms atomic writer coalesces rapid switches and a synchronous shutdown checkpoint closes the immediate-exit race. Legacy state remains a migration and downgrade fallback. Coordinate renderer shutdown capture through one guarded checkpoint so workspace sessions and the active-view preference both survive graceful reloads, restarts, and quit cancellation. Add a persistence-boundary test proving the sidecar stays below 64 bytes while orca-data.json remains byte-for-byte unchanged, plus repeated Windows Electron restart coverage and a path-normalization-safe restart fixture. * harden active-view sidecar: prototype-safe validator, race-free async swap, independent shutdown flush - isTopLevelView uses Object.hasOwn so a corrupt sidecar can't smuggle inherited keys (constructor/__proto__) through as a valid view. - writeAsync guards the generation check and rename synchronously (renameSync) so a shutdown flushOrThrow can no longer interleave and let a stale async rename clobber the freshly-written view. - shutdown checkpoint flushes the durable store and the active-view sidecar in independent try/catch blocks so one store's failure can't skip the other. Added regression tests for all three. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> Co-authored-by: Orca <help@stably.ai>	2026-07-20 01:14:17 -07:00
NeilandOrca	74e2cb702c	perf(window): re-enable macOS main-window background throttling (#9395) ... Co-authored-by: Orca <help@stably.ai>	2026-07-19 21:30:01 -07:00
3 people	1724eef2f0	fix(window): extend startup reveal fallback to Linux so first launch never stays hidden (#8425) ... * fix(window): extend startup reveal fallback to Linux so first launch never stays hidden (#8421) On Linux/X11, ready-to-show can never fire (GPU/driver quirks), leaving the only BrowserWindow hidden until a second launch triggers the second-instance reveal path. Reuse the existing bounded Windows fallback timer on Linux; the handledInitialReadyToShow guard and headless E2E check already make the reveal idempotent and safe. Claude-Session: https://claude.ai/code/session_017rio4rnPiCUh8jHWxkq4xH * docs(window): drop win32-only qualifier from tray-fallback comments The tray-create fallback comments referenced 'createMainWindow's win32 10s reveal fallback', but #8421 extends that reveal fallback to Linux too. Since the tray itself is win32-only (createSystemTray no-ops off win32), naming a platform in these comments is both stale and misleading. Drop the qualifier; the surrounding Windows-only tray context already scopes it. --------- Co-authored-by: kaynan <kaynan.camargo@terceiro-sky.com.br> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>	2026-07-13 17:36:26 -07:00
OrcaWin	c16ea9bae1	fix(crash-reporting): make Windows capture and submission reliable (#8242) ... * fix(crash-reporting): make Windows capture and submission reliable * fix(crash-reporting): harden recovery fallbacks * test(crash-reporting): cover returned copy failures * fix(crash-reporting): keep Windows recovery responsive * fix(crash-reporting): retry transient identity lookup	2026-07-11 02:03:14 -07:00
OrcaWin	fa691a0dc8	fix(win): bound renderer launch-failed recovery (#8234)	2026-07-11 00:15:44 -07:00
4 people	e84a8ddec9	Terminal performance initiative: pipeline fixes + term-speed-2 revival + PTY flow control (integration branch) (#7214) ... * Skip legacy hidden skip grammar assertions * Fix hidden TUI snapshot test setup * Fix sleep wake history test contract * Fix hidden delivery startup gate helper * Fix hidden Latin skip branch predicate * Fix hidden synchronized split-boundary replay * Stabilize remote runtime mixed subscription test * Keep hidden startup query parser active during window * Stabilize raw emoji golden restore width * Stabilize raw emoji golden fixture completion * Keep terminals responsive under agent output load * Add frozen-terminal repro harness and silent-drop regression tests Investigation harness for the frozen-terminal reports (Discord #performance, issue #2836): pane shows content, shell alive, daemon output.log flat while typing. - e2e: renderer crash -> auto-reload recovery and three restart/restore shapes (live daemon, SIGSTOP-wedged daemon, daemon killed between launches), each probing input at both drop layers. Post-crash phases drive the renderer from the main process because a crashed target severs Playwright's CDP session even though the app recovers. - e2e helpers: layer-discriminating probes (direct pty.write vs transport input, plus pty:listSessions ownership-rebuild revival). - unit repro: vendored xterm 6.1.0-beta.287 WriteBuffer permanently wedges when a sync throw escapes a write-completion callback or a custom parser handler (xterm-write-buffer-stall.repro.test.ts). - unit repros for both silent input-drop layers: main drops writes for a live PTY once ptyOwnership loses the id (revived by listSessions), and the renderer transport stays unbound after a failed connect. - pty.test.ts: unregister every leaked SSH provider id in afterEach so module-level provider state cannot leak across tests. Co-authored-by: Orca <help@stably.ai> * Harden xterm write pipeline against sync-throw wedge that freezes panes A synchronous exception escaping xterm's WriteBuffer loop permanently wedges that terminal: _innerWrite has no try/catch around the parse action or the write-completion callback, the tail re-schedule never runs, and write() only re-arms on an empty buffer. The pane stops rendering and, if a replay was in flight, the replay guard latches and pty-connection's onData silently eats every keystroke — matching the field reports (Discord #performance, issue #2836: content visible, shell alive, daemon output.log flat). Both vectors verified against vendored xterm 6.1.0-beta.287 in xterm-write-buffer-stall.repro.test.ts. Three layers of defense: - Guard every write-completion callback Orca hands xterm at the two choke points (writeForegroundTerminalChunk, writeBackgroundTerminalChunk), with settle and onParsed guarded separately so a WebGL/renderer failure during viewport settle cannot starve the replay-guard release. - Guard all throwing-capable custom parser handlers (DA1, OSC 10/11, CSI ?h/?l mode reports, OSC 52 clipboard, OSC 7 cwd), degrading a throw to "not handled" — same escape class as terminal-link-provider-guard.ts. - Replay-guard watchdog: each engagement releases exactly once, from xterm's completion or a 10s watchdog, so a lost completion (wedged pipeline, disposed-terminal race) cannot latch the guard on a live pane; replayIntoTerminalAsync resolves on either path so restore chains cannot hang. Force-releases record a crash breadcrumb. All guard trips record rate-capped crash breadcrumbs, so the next field occurrence names the throwing stack instead of failing silently. Co-authored-by: Orca <help@stably.ai> * Cap unbounded terminal output buffers in main and the foreground queue Field evidence (Discord #performance / #2836): renderer memory climbs to ~1.5 GB and terminals freeze; a force reload does not help until memory recovers. Two unbounded buffers matched that shape: - Main-process pendingData grew by string concatenation without bound while the renderer could not receive (frozen, starved, mid-reload) — main-heap bloat a renderer reload cannot clear. Now capped at 2 MB per PTY: past the cap the buffered bytes are dropped and the entry stays O(1) until the renderer ACKs again, then a droppedOutput sentinel is delivered and the pane repaints from the authoritative main-owned buffer snapshot (existing hidden-output restore path) instead of continuing a stream with a silent gap. - The renderer output scheduler capped only hidden-pane backlogs; the foreground path could queue a visible pane's flood without bound when the drain could not keep up. The 2 MB cap now applies to every foreground enqueue branch too, with a foreground-specific skip notice. Verified: new main-side cap test (starve → flood → sentinel → normal flow resumes), renderer sentinel-to-snapshot-restore test, two foreground scheduler cap tests; full pty/terminal-pane/pane-manager suites (1981 tests) and typecheck pass. Co-authored-by: Orca <help@stably.ai> * Make replay-guard stall release probe-certified instead of time-based The previous stall watchdog blindly released the input guard after 10s. If a replay were genuinely still parsing on a starved machine, that early release could leak xterm's auto-replies into the shell — and into agent TUIs, where a leaked ESC reads as the user pressing Escape. Replace the blind release with a probe: when a completion looks overdue, enqueue an empty write behind the replay. xterm parses writes in order, so every outcome is provably safe: - probe parses after the replay completion ran: normal release already happened; probe is a no-op. - probe parses but the replay completion never ran: all replay bytes have parsed, no further auto-replies can exist — the completion was genuinely lost. Release + breadcrumb. - probe never parses (bounded wait): the pipeline is wedged, and a dead parser can never emit auto-replies, so releasing cannot leak input. Release + breadcrumb naming the pane as needing recovery. While the probe is pending — a slow-but-alive replay — the guard now HOLDS instead of releasing early; that case is pinned by a regression test. Co-authored-by: Orca <help@stably.ai> * Scale output backlog caps with the scrollback setting and breadcrumb drops The 2 MB pending-output caps were flat, which risked dropping lines a 50k-row scrollback user would have retained. Both caps (main pendingData and the renderer output queue) now derive from one shared policy: max(2 MB, scrollbackRows x 120 chars) — 2 MB at the 5k default, 6 MB at the 50k max. The main side reads the setting live via getSettings; the renderer scheduler is configured where the terminal lifecycle already reads the scrollback setting. Every drop now records a rate-limited crash breadcrumb with dropped and cap sizes (terminal_output_backlog_dropped in the renderer, terminal_pending_output_dropped in main — no pty ids, session ids can embed workspace paths). Field drop frequency and size decide whether the cap constants need raising, replacing theory with data (#2836, #7017). Backlog skip notices are now cap-agnostic since the limit varies. Co-authored-by: Orca <help@stably.ai> * Extract breadcrumb recording into a collection-safe leaf module Playwright loads spec imports at collection time, and e2e specs import terminal-module constants (e.g. terminal-attention.spec.ts pulls POST_REPLAY_MODE_RESET from layout-serialization, whose chain reaches replay-guard). The breadcrumb import added to the terminal modules made that chain reach crash-diagnostics.ts, whose top-level import.meta.hot and webview-registry import crash Playwright's transform ("ReferenceError: exports is not defined in ES module scope") — every e2e shard failed at collection before running a single test. Move recordRendererCrashBreadcrumb into crash-breadcrumb-recorder.ts (type-only imports, no import.meta) and point the terminal modules and their test mocks at it; crash-diagnostics re-exports for existing callers. Full e2e suite collects again (262 tests / 94 files); unit suites, typecheck, lint green. No runtime behavior change. Co-authored-by: Orca <help@stably.ai> * Add cross-terminal pipeline benchmark (DSR-fenced throughput + latency probe) Run inside any terminal (Orca pane, iTerm2, Ghostty, Terminal.app, VS Code) to measure its full byte path. DSR round-trip latency at idle and under a paced agent-TUI load, plus fenced throughput over four deterministic fixtures. The DSR fence forces 'all bytes parsed' before the clock stops so xterm.js-class ingest queues can't flatter the result. First piece of the terminal performance initiative's measurement rig. Co-authored-by: Orca <help@stably.ai> * Add terminal performance initiative plan Working plan for the orca-performance branch: verified architecture findings, workstreams (baselines, #7153 validation, term-speed-2 revival with merge-scout numbers, stall fixes, flow control, rig extensions, utilityProcess router, telemetry), benchmark protocol, sequencing, and baseline-relative success criteria. Co-authored-by: Orca <help@stably.ai> * Add cross-terminal baseline results (Orca 1.4.91 prod vs Terminal.app vs Ghostty) Headline: Orca DSR latency under 1MB/s agent-TUI load is p50 134ms / p99 292ms vs 0.45ms (Terminal.app) and 0.21ms (Ghostty). Idle latency is fine (0.69ms p50) — the problem is queueing under load, not the pipeline hop. agent-tui fenced throughput: Orca 2.0 MB/s vs Terminal.app 37 MB/s, Ghostty 78 MB/s. Co-authored-by: Orca <help@stably.ai> * Add pipeline-loss decomposition benches (headless xterm + daemon ingest) Both isolate layers of the 51x agent-tui gap found in baseline-jul02: bare @xterm/headless parses agent-tui at 103 MB/s and daemon Session ingest (emulator + pending-output recording + fanout) at 103 MB/s — on the byte stream the full Orca pipeline delivers at 2.0 MB/s. Parser and daemon are exonerated; the loss is in main per-chunk processing, delivery/ACK pacing, or renderer layers above xterm. Co-authored-by: Orca <help@stably.ai> * Record baseline + decomposition findings in initiative plan Co-authored-by: Orca <help@stably.ai> * Add dev-build orca-performance bench result (confounded: dev mode, 282-col window, 3MB fixtures) DSR under load p50 161ms — the #7139/#7150 branch does not move the under-load latency class. Expected in hindsight: DSR replies are ordered within the output stream, so the metric measures output-queue depth; cooperative drain paces input responsiveness but cannot reorder the queue. Shrinking the queue itself (producer flow control, task 6) and raising agent-tui throughput (task 9) are the levers for this number. Co-authored-by: Orca <help@stably.ai> * Record dev-build #7153 check in findings log Co-authored-by: Orca <help@stably.ai> * Parse-clock high-priority terminal drains instead of fixed-nap dripping Attribution (task #9): the drain loop wrote at most 2x16KB then slept 4/16ms regardless of parse speed — an isolation bench (new pane-terminal-output-scheduler-throughput.bench.test.ts) measures that drip at 1.9 MB/s background / 27 MB/s foreground against xterm's ~103 MB/s parse rate, matching the baseline-jul02 end-to-end numbers (agent-tui 2.0 MB/s in prod 1.4.91). Fix: high-priority (visible-pane) drains now re-arm on xterm's parse-completion callback and carry 8 writes per tick; the isolation ceiling rises 27 -> 117.6 MB/s (parse-limited). Background cadence is deliberately unchanged (2 MB/s drip protects the focused pane; hidden delivery is term-speed-2's job). DRAIN_TIME_BUDGET_MS still bounds per-tick work, preserving #7139's cooperative-drain intent. Validation: 621 scheduler/guard/pty tests green, typecheck clean. Co-authored-by: Orca <help@stably.ai> * Record task #9 attribution + parse-clock fix in findings log Co-authored-by: Orca <help@stably.ai> * Findings: 51x loss attributed to O(tail) retained-tail redraw path in main onPtyData Co-authored-by: Orca <help@stably.ai> * Window the retained-tail redraw path to the cursor's reach Attribution (findings log 2026-07-03): main's onPtyData consumed ~93% of the event loop under an agent-TUI flood, and the dominant term was appendNormalizedToMultilineTailBuffer + finalizeRetainedTerminalRows materializing ~2x tail-length row objects plus a per-row trailing-space regex on every chunk — 0.888ms/chunk at the 2,000-line cap, on every Claude-Code-shaped frame (cursor-up + erase-below). The multiline algorithm now runs on a suffix window sized by the chunk's maximum upward cursor excursion (plus the inherited redraw cursor and a safety margin); the untouched prefix is shared by reference with a cheap last-char trailing-space check to match the reference trim. Pathological full-height cursor-ups fall back to the unwindowed implementation, which is kept verbatim and exported as the reference for the 500-case differential fuzz (retained-tail-redraw-window.equivalence.test.ts). Micro-bench at a full 2,000-line tail: 0.888 -> 0.073 ms/chunk (12x). 1,415 runtime tests green, typecheck clean. Co-authored-by: Orca <help@stably.ai> * Add dev bench results: parse-clock and windowed-tail fixes Co-authored-by: Orca <help@stably.ai> * Record windowed-tail partial win + next-cycle recipe in findings log Co-authored-by: Orca <help@stably.ai> * Findings: remaining whale is the per-chunk blocked-reason check (~85% of onPtyData post-fix) Co-authored-by: Orca <help@stably.ai> * Throttle the terminal wait-blocked check off the PTY hot path Post-windowed-tail attribution (findings log 2026-07-03): the blocked- reason complex — two full-tail buildTerminalWaitText builds plus toLowerCase and multi-pattern scans per chunk, existing only to stamp waitBlockedAt — consumed ~85% of onPtyData's remaining cost (~700-790ms/s under an agent-TUI flood). The check now runs at a 50ms cadence over coalesced chunks (PTY chunk boundaries are arbitrary, so coalescing preserves semantics), with a trailing-edge timer so burst-final state is always evaluated, and an immediate bypass when the incoming chunk (plus a 31-char split carry) contains a prompt keyword — so actionable-prompt stamping stays per-chunk-immediate while keyword-free flood frames skip the complex entirely. Previous wait text is cached per pty instead of rebuilt, and state is cleared at both pty teardown sites. 1,415 runtime tests green (including the cross-chunk prompt test, which exercises the keyword bypass), typecheck and lint clean. Co-authored-by: Orca <help@stably.ai> * Findings + results: three stacked fixes unlock the pipeline (agent-tui 16x, DSR-load p50 161->18.8ms in dev) Co-authored-by: Orca <help@stably.ai> * Add producer flow-control design to initiative plan Co-authored-by: Orca <help@stably.ai> * Findings: revival branch green but perf-gated — daemon Session ingest regressed 103->40-48 MB/s (chain emulator restructure); merge blocked until blockedfix parity Co-authored-by: Orca <help@stably.ai> * Pre-filter daemon OSC/mouse scanners for introducer-free chunks Skips the scan-tail copy and full-chunk walks when a chunk cannot contain an OSC or private-mode sequence (single native includes() checks), with split-sequence correctness preserved via explicit tail retention. Strictly positive micro-optimization on the daemon per-chunk path; 641 daemon tests green (1 pre-existing WSL failure unrelated). Co-authored-by: Orca <help@stably.ai> * Retract confounded daemon conviction; mandate load-controlled A/B protocol for the revival merge gate Co-authored-by: Orca <help@stably.ai> * Record A/B gate pass in findings log; add A/B result JSONs Co-authored-by: Orca <help@stably.ai> * Add producer-side PTY flow control (watermarks + protocol v19) Main now pauses the actual PTY when a pane's renderer-pending backlog crosses the 256KB high watermark and resumes once it drains below the 32KB low watermark (wide hysteresis band so a draining queue cannot flap pause/resume per flush slice). node-pty pause() stops the pty fd read, so the kernel/ConPTY buffer fills and a flooding shell blocks on write — flood-induced buffered lag becomes shell blocking instead of unbounded main-process buffering (terminal-performance-initiative §5). Transport: new fire-and-forget pausePty/resumePty daemon notifications (protocol v19; 18 added to PREVIOUS_DAEMON_PROTOCOL_VERSIONS), routed DaemonServer -> TerminalHost -> Session -> subprocess pause()/resume(). LocalPtyProvider pauses node-pty directly. Router/degraded providers forward; IPtyProvider gains optional pauseProducer/resumeProducer. Safety invariants: - Lost-resume failsafe: daemon Session auto-resumes 5s after a pause with no matching resume; main re-asserts the pause at most once per 5s while still above the high watermark, so a lost resume can never wedge a shell and a sustained flood stays throttled. - Resume on every teardown path: Session kill/exit/dispose/detach; main releases on pty exit and on window-destroyed bookkeeping wipes; the adapter owes paused sessions a resumePty on the next connect after a socket drop. - Providers without support (SSH relay, legacy protocol <= v18) no-op silently, and the scrollback-scaled pending-output cap still bounds main memory when pause is unavailable. - Kill switch: PRODUCER_FLOW_CONTROL_ENABLED in ipc/pty.ts flips the whole mechanism off in one line. daemon-errors.ts is split out of types.ts to stay under the max-lines cap. Tests: watermark transitions/hysteresis/re-assert (controller unit), lost-resume failsafe + resume-on-kill/exit/dispose/detach (session), notification routing + v18 gating + reconnect owed-resume (adapter), direct pause/resume (local provider), and a flood test asserting pause fires once, pending stays bounded at HIGH + one chunk, and resume fires once after drain (ipc/pty). Co-authored-by: Orca <help@stably.ai> * Findings: flow control merged; definition-of-done accounting; prod verification re-scoped to packaged RC Co-authored-by: Orca <help@stably.ai> * Fix stray brace from revival merge in long-table-scroll-restore e2e spec (broke e2e transform in CI) Co-authored-by: Orca <help@stably.ai> * Prod verdict: v1.4.121-rc.0 bench — DSR-load p50 134->18.6ms (7.2x), agent-tui 2.0->11.2 MB/s, idle at Terminal.app parity; pipeline now cadence-bound Co-authored-by: Orca <help@stably.ai> * Recover terminal output delivery after system sleep Root cause: main gates every pty:data send on a global + per-PTY in-flight counter that only renderer ACKs decrement. If ACKs are lost across a system suspend, the counters pin at the cap and every PTY — old and newly created — is silently gated forever while output piles up in pendingData. A focus-preserving display wake also fires no renderer focus/visibilitychange events, so terminal wake recovery (and the WebGL context-loss latch clear) never runs. Only a renderer reload recovered. Three fixes: - ACK-stall watchdog (src/main/ipc/pty.ts): if sends stay gate-blocked for 10s with zero ACK progress while the renderer webContents is alive, warn once, reset the in-flight delivery counters, and flush held pendingData. Armed lazily on the first gate-blocked send and disarmed by every ACK, so it can never fire under healthy heavy load. - Renderer lifecycle reset now also zeroes the in-flight counters — a reload/navigation destroys the renderer dispatcher, so outstanding ACKs can never arrive and stale counters would gate the new renderer. - System-resume wake IPC: main relays powerMonitor 'resume' as system:resumed to live windows (plus forceRepaint); preload exposes ui.onSystemResumed; the terminal wake-recovery hook runs the same recovery path as window focus/visibilitychange. Co-authored-by: Orca <help@stably.ai> * VS Code head-to-head: Orca beats/ties 5 of 6 metrics (16x idle, 5x styles-stress, better p99); load p50 gap attributed to ACK window + timer-clamped drain cadence Co-authored-by: Orca <help@stably.ai> * Schedule zero-delay terminal drains via MessageChannel Chromium clamps nested setTimeout(0) to ~4ms, stacking dead gaps onto every parse-clocked drain tick; the explicit 4ms high-priority re-arm interval added more. A posted message is still a macrotask — input and paint are serviced between posts — so cooperative yielding survives without the clamp. Generation-tokened cancellation; vitest keeps the timer path (fake timers can't advance channel posts) plus a real-timer smoke test for the channel path. Standing-queue target: VS Code's ~7ms class (measured us 18.6ms, them 7.18ms, same rig). Co-authored-by: Orca <help@stably.ai> * Cut daemon and main PTY batch windows 8ms -> 2ms At 9% pipeline utilization the DSR-under-load latency is fixed batching windows, not queue depth (proved by the MessageChannel drain lever moving nothing). Both hops charged an expected half-window per chunk; 2ms keeps burst coalescing at negligible IPC overhead (~500 msgs/s worst case vs MB/s payloads). Co-authored-by: Orca <help@stably.ai> * Findings + tests: batch windows were the DSR-load gap (19->8.0ms dev); timing tests updated to 2ms windows Co-authored-by: Orca <help@stably.ai> * Fix PR CI and guard resume relay during shutdown Co-authored-by: Orca <help@stably.ai> * Chain e2e specs 6/6 green — gate x drain validation debt paid Co-authored-by: Orca <help@stably.ai> * Replace ack-stall watchdog with cumulative ACKs + solicited delivery resync Design review: the 10s blind-reset watchdog decided correctness from a wall-clock threshold. Rework piece 1 into a deterministic two-part design (pieces 2 and 3 — lifecycle-reset counter zeroing and powerMonitor wake IPC — are unchanged): - Cumulative ACKs (TCP-style): the renderer dispatcher now tracks a monotonic per-pty total of processed chars (terminal-pty-ack-gate) and sends it on every ACK alongside the legacy per-chunk delta. Main keeps per-pty sentChars/ackedChars and max-merges received totals — idempotent and reorder-tolerant, so a lost ACK self-heals when any later ACK arrives instead of becoming permanent in-flight debt. Provider (SSH/daemon) backpressure is credited only the derived delta, clamped, never negative. Main tolerates both payload shapes keyed by field presence (dev hot-reload can mix renderer/main versions); totals reset on pty exit and renderer lifecycle reset on both sides. - Solicited resync (replaces the blind reset): when new pty data arrives while that pty's delivery is fully gated and no probe is outstanding, main sends pty:requestDeliveryResync; the renderer replies with its cumulative totals and main reconciles via max-merge, then flushes held pendingData. Event-triggered, verified-state recovery — no wall-clock threshold decides correctness. The only timer is a 5s request/response hygiene timeout that clears the outstanding flag and logs one diagnostic warn per silent streak; it never mutates counters (a renderer that cannot answer has dead IPC — reload is the only cure). The 10s corrective watchdog is deleted. Co-authored-by: Orca <help@stably.ai> * Starting point: prior agent's garble differential fuzz harness Three files recovered (were untracked) from a prior agent killed by API outages, plus a trivial curly-brace lint fix in the op dispatcher so the pre-commit hook passes: - src/shared/agent-tui-ansi-fuzz-stream.ts (seeded agent-TUI byte-stream gen) - src/shared/terminal-restore-parity-fixture.ts (renderer-parity fixture) - src/main/daemon/headless-emulator-fidelity.fuzz.test.ts (suite 1: differential HeadlessEmulator vs @xterm/headless reference on identical bytes) Co-authored-by: Orca <help@stably.ai> * Suite 1 findings: two new serialize round-trip bugs (B bold-loss, C cursor) Scanned seeds 1..2000. Beyond the pre-documented serialize wrap-null-cell bug (A, 27 seeds, tolerated), the fuzz surfaced two NEW real @xterm/addon-serialize 0.15.0-beta.287 round-trip defects, both of which garble a revealed hidden pane: - Bug B (seeds 435, 770, 1321): serializing a dim cell followed by a bold-only cell emits \x1b[1;22m; SGR 22 clears bold too, so restored bold is lost. Minimal repro: '\x1b[2mA\x1b[22m\x1b[1mB' -> restored 'B' loses bold. - Bug C (seeds 454, 1696): a final content row filled to the right margin leaves xterm wrap-pending; the serializer's relative cursor restore lands one column short. Minimal repro: '0123456789\x1b[3;5H' at cols=10 -> cursor x=3 not x=4. Both isolated to pure serializer replay (no Orca preamble), confirming upstream. Parity fixture verified faithful to the renderer pane's buffer options. Each is pinned as a standalone it.skip repro; full evidence + classification in notes/garble-fuzz-divergences.md. Seed 113 (handoff's DECSC/DECRC case) does not diverge on the current harness. No production code changed. Co-authored-by: Orca <help@stably.ai> * Add perf prerelease update check modifier Co-authored-by: Orca <help@stably.ai> * Suite 2: hidden-reveal seq-reconciliation fuzz + two new snapshot bugs (D, E) Property-tests the reveal seq-reconciliation byte-stitch (getChunkDataAfterSnapshot / reconcileChunkAgainstRestoredSnapshot in pty-connection.ts), mirrored exactly: N=200 seeded hide/reveal scenarios with a rich agent-TUI hidden prefix snapshot and an append-only racing tail, chunked with seq/rawLength meta, seq-domain restarts, unmetered chunks and droppedOutput markers. Asserts snapshot-at-S + reconciled tail == snapshot-of-everything (seq-neutral) and == always-visible (end-to-end). Runtime ~5s at 200; FUZZ_ITERATIONS override documented. Two NEW real snapshot-limitation garbles found while building it, both distinct from suite 1's serialize bugs and pinned as standalone it.skip repros: - Bug D: the DECSC saved-cursor register is not serialized. A hidden TUI that saves the cursor (ESC 7 / CSI s) and restores it on reveal (ESC 8 / CSI u) lands the restore at home. Repro: 'AB\x1b7\x1b[4;10HCD' + '\x1b8X' -> 'XB' vs 'ABX'. - Bug E: a snapshot taken mid-escape-sequence (a PTY read split an escape) drops the partial sequence (it's parser state, not buffer), so the tail's continuation renders literal. Repro: 'AB\x1b[3' + 'mCD' -> 'ABmCD' vs 'ABCD'. Fired on ~24% of the corpus (tolerated + counted via prefixEndsMidSequence). The append-only-tail design isolates seq reconciliation from these and the Bug C cursor cascade. Full evidence + fix directions in notes. No production changes. Co-authored-by: Orca <help@stably.ai> * Suite 3: 25-cycle park/reveal drift e2e test Extends terminal-hidden-view-parking.spec.ts with a deterministic 25-cycle park->reveal test on a static rich alt-screen TUI frame (box drawing, SGR colors, wide CJK/emoji). Baselines against the frame after the first snapshot restore (so both sides pass through identical machinery — the alt-screen restore correctly drops normal-buffer scrollback, which is contract not garble), then asserts every subsequent reveal reproduces it byte-for-byte with no accumulated drift and no hidden-skip banner. Exercises the real renderer teardown + HeadlessEmulator snapshot restore + PTY reattach path the fuzz suites model in isolation. Passes in ~29s (electron-headless, workers=1). Co-authored-by: Orca <help@stably.ai> * Fix two serialize round-trip bugs garbling hidden-terminal snapshot restore BUG B (addon patch): @xterm/addon-serialize's SGR diff emitted bold/dim set params before the shared intensity reset 22, so "1;22" wiped a freshly set bold and a bare "22" dropped a still-set bold/dim. Patched via pnpm patchedDependencies (config/patches) to diff bold+dim as one intensity group with the clearing 22 emitted first. Other flag pairs (4/24, 3/23, 7/27, ...) have dedicated resets and were verified unaffected. BUG C (Orca-side hardening): the addon restores the cursor with relative moves computed from where it assumes replay leaves the cursor; a final row filled exactly to the right margin leaves replay wrap-pending and the restore lands one column short. New shared serializeWithAbsoluteCursor appends an absolute CUP from the source terminal's authoritative cursor at every restore/replay serialize site (daemon/runtime HeadlessEmulator.getSnapshot, renderer mobile snapshot serializer, shutdown layout capture). It skips empty snapshots and wrap-pending sources so it never changes already-correct behavior. Round-trip repros + non-regression coverage in src/main/daemon/terminal-snapshot-serialize-roundtrip.test.ts (verified failing with the fixes stashed). buildRehydrateSequences extracted to its own module to keep headless-emulator.ts under the max-lines budget. Co-authored-by: Orca <help@stably.ai> * Gates: tolerate+count Bugs B/C in deep mode; drop inverse from reconciliation tail - Fidelity suite: add snapshotHasSelfCancellingBoldReset (Bug B) and isMarginWrapPendingCursorOffByOne (Bug C) predicates so the corpus tolerates + counts them like Bug A. FUZZ_ITERATIONS=2000 is now green (~113s) and fails only on genuinely new divergences; each tolerance keeps its <50% degeneracy guard. Default 300 unchanged (~17s). - Reconciliation suite: drop SGR 7 (inverse) from the append-only tail. Inverse marks trailing blanks with an inverse-fg the serializer round-trips slightly differently by capture depth — a Bug-B-class serialize nuance, not seq reconciliation. FUZZ_ITERATIONS=1000 is now green; default 200 unchanged. - Notes updated: every bug class is both pinned (skipped repro) and tolerated in its corpus; combined default runtime ~19s. Regex uses String.fromCharCode(27) to stay oxlint no-control-regex clean. Co-authored-by: Orca <help@stably.ai> * Keep RC update checks off perf prereleases Co-authored-by: Orca <help@stably.ai> * Fix snapshot DECSC register loss (Bug D) and mid-escape boundary drop (Bug E) Bug D: the serialized screen cannot carry the VT100 DECSC saved-cursor register, so a hidden ESC 7 followed by a post-reveal ESC 8 restored to home and clobbered live cells. The snapshot epilogue now re-saves at the source's saved position before the final absolute CUP (readSavedCursorRegister + serializeWithAbsoluteCursor; the active buffer's own register, so alt screens carry theirs). Position-only by design; never-saved terminals are left untouched. Bug E: a PTY read ending mid-escape leaves the sequence in the emulator's parser, so serialize dropped it and the racing tail's continuation bytes rendered literally after reveal (~24% of the fuzz corpus). The emulator now tracks the unparsed trailing partial at ingest (terminal-partial-escape-tail.ts, committed post-parse like the mouse mirror) and ships it as TerminalSnapshot.pendingEscapeTailAnsi. applyMainBufferSnapshot writes it LAST, after POST_REPLAY reset — any later ESC would abort the dangling sequence. Seq accounting is unchanged: the tail is a suffix of bytes the snapshot seq already counts, so reconcile slicing needs no adjustment. Fuzz suites: unskip the Bug B/C repros (fixed on this branch) and the new D/E repros; remove the B/C/E tolerance predicates so regressions fail loudly. Only Bug A (upstream wrap null-cell) stays tolerated + counted. Green at FUZZ_ITERATIONS=2000 (fidelity) and 1000 (reconciliation). Co-authored-by: Orca <help@stably.ai> * Count suffixed RC tags (rc.N.perf) in the shared rc counter — second suffixed cut collided with the first Co-authored-by: Orca <help@stably.ai> * Classify suffixed rc tags (rc.N.perf) as rc telemetry identity in release builds The build-identity guard only knew vX.Y.Z and vX.Y.Z-rc.N, so suffixed perf RCs cut fine but every platform build refused the tag and the releases published empty. Co-authored-by: Orca <help@stably.ai> * Cut the hidden-restore flood feedback loop (A) + query carve-out on drops (B) (A) Under a foreground flood, the hidden-output-restore loop re-fetched snapshots endlessly: each synchronous applyMainBufferSnapshot starved ACK processing, main pinned at the in-flight cap, dropped at the pending cap, and every droppedOutput/modelRestoreNeeded marker re-armed another restore until the flood ended (rc.7.perf DSR timeouts). - Restore loop: a foreground live-chunk queue overflow now abandons the restore immediately (the stream is outrunning snapshot fetch+replay), with a 3-iteration hard cap + lifecycle warn as backstop. - Re-arm gate: drop markers/sentinels and reconcile seq-gaps on a visible pane during its own in-flight/just-abandoned restore no longer re-arm; live bytes write through and ONE deferred repaint (2s after the last backpressure signal) heals the gap. Hidden-pane gate semantics are unchanged. - Query salvage: discarding queued restore bytes (overflow/refetch) now extracts DSR/CPR/DA/OSC-color queries and replays them to xterm so replies still flow. (B) Main-side: dropOversizedPendingPtyData carves reply-eliciting query sequences out of the dropped buffer (and out of post-drop latched data, bounded) and ships them on the droppedOutput sentinel, so DSR probes survive bulk drops. Query scanning moved to src/shared/terminal-reply-query-extraction.ts, shared verbatim with the renderer's hidden-startup query extraction. Co-authored-by: Orca <help@stably.ai> * ACK terminal output at parse-drain, not dispatcher enqueue (C) The renderer credited main's per-PTY in-flight window the moment a pty:data chunk entered the dispatcher, so the 512KB window meant "bytes received", never "bytes parsed". Under flood the renderer write queue grew unbounded behind instant ACKs; main saw no backpressure, crossed the pending cap, and bulk-dropped output (rc.7.perf DSR timeouts). Crediting is now parse-deferred: each delivery carries a fire-once credit (deliverPtyDataWithDeferredAck); the pane's first scheduler write claims it (writeTerminalOutput.ackCredit) and the output scheduler fires it when the bytes are consumed — after terminal.write in the parse-clocked drain, or on ANY discard path (backlog cap replacement, discardTerminalOutput, disposed-terminal drops, flush recovery). Deliveries that never reach the scheduler (reconcile drops, restore queueing, pre-mount eager buffer) settle at handler return, so the invariant holds: every delivered chunk credits exactly once, parsed or discarded. E2E ack-gate hold/release and delivery-resync semantics are unchanged (all crediting still routes through ackPtyData). Main-side equilibrium: with ACKs at parse cadence, in-flight becomes true backpressure — pendingData stays near the 256KB producer-pause watermark, far under the >=2MB drop cap, so bulk floods block the shell (node-pty pause) instead of dropping. Co-authored-by: Orca <help@stably.ai> * Synthesize salvaged query replies directly instead of replaying into xterm The 10MB dev bench proved the write-back salvage insufficient: a pending-cap drop always triggers a snapshot restore, whose replay guard swallows xterm auto-replies and whose discardTerminalOutput races away still-queued query writes — the salvaged DSR died both ways and the fence still timed out. Salvage now answers directly on the input path (immune to both): CPR (CSI 6n) from the live buffer via transport.sendInput, DA1 with the renderer's canned response, OSC color probes via the existing direct responder. Rare queries (DECRQM, DA2) keep the best-effort xterm replay. Co-authored-by: Orca <help@stably.ai> * Untrack branch-added bench result JSONs (20 files); keep numbers in the findings log Files stay on disk; main's 7 pre-existing results are untouched. Co-authored-by: Orca <help@stably.ai> * Branch guide: document merge-not-rebase sync strategy and conflict pattern Co-authored-by: Orca <help@stably.ai> * Merge origin/main (#7316 tab-strip click-vs-drag fix); adapt #7290 recovery-reload tests to this branch's dual did-finish-load listeners The three tests grabbed the FIRST did-finish-load listener; on this branch the renderer delivery-gate reset registers before the orphan sweep, so the sweep tests exercised the wrong handler (one failing, two vacuously green). They now fire all listeners like a real reload. Co-authored-by: Orca <help@stably.ai> * Fix branch CI lint: split pane-interaction functions out of artificial-opencode-terminal-load.spec (815>800 lines), modernize perf-html-report script No max-lines disable per repo rules; extracted to artificial-opencode-pane-interactions.ts. toReversed() and import.meta.filename replace reverse()/fileURLToPath. Co-authored-by: Orca <help@stably.ai> * Fix Windows update-relaunch killing the live terminal daemon On a Windows update relaunch the daemon can be wedged past every RPC budget (final checkpoint flush + installer/AV disk pressure), so the 3s health check AND the 5s session-list hello both time out while sessions are still alive - and the launcher failed closed, killing the daemon and every terminal session it owned. - Adopt an unresponsive daemon whose pipe still accepts a raw connection; a new rejected health state keeps replacing daemons that answered and refused the handshake (never adoptable). - Give Windows pid files a real startedAtMs (daemon self-reports it in the ready IPC message) and verify it via CIM CreationDate piggybacked on the existing command-line query, so the pid-recycling guard is no longer inert on win32. - Only delete legacy daemon pid/token files when the pid-file process is provably dead; deleting a live daemon''s token made its sessions permanently unadoptable after a protocol bump. - Capture agent resume records every 60s in the renderer (skipping unchanged records) so hard kills still leave a fresh resume record. * Heal blank terminals when main→renderer push delivery dies (renderer-pull delivery watchdog) Field evidence (v1.4.121-rc.0 debug snapshot, 2026-07-06): a wedged window held 530,115 un-ACKed in-flight chars — one PTY pinned at the 512KiB per-PTY high water plus a fresh terminal's 245-char prompt that was sent and never consumed — while the user ran the snapshot over invoke from that same window. Main→renderer push delivery (pty:data and every sibling channel) was dead; renderer→main→renderer invoke was alive. Upstream precedent for one-directional IPC death: electron#37067 (suspected Mojo pipe disconnect, stalled as need-info). Every terminal goes blank, new terminals are born blank, and only a renderer reload recovered. The existing recovery layers cover the OTHER variants of this bug family and structurally cannot reach this one: - The xterm write-pipeline sync-throw guards, output-buffer caps, and probe-certified replay-guard release (#7150 family) run only after bytes arrive in the renderer — here they never do. (The pending cap did work as designed in the field: ~2.1MB pendingDroppedChars, bounded main heap.) - Cumulative ACKs self-heal lost ACK messages and the solicited delivery resync reconciles verified totals (4647df86a; #7260 on main) — but the resync probe, the powerMonitor wake relay, and the droppedOutput restore markers all ride main→renderer push, the direction that is dead. The probe's unanswered path deliberately only logs. This adds the missing lane, renderer-initiated and ridden entirely over invoke — the direction the field snapshot proved alive: - terminal-delivery-watchdog.ts: 15s heartbeat, free while output flows. Hot-path cost is one Map upsert per received chunk; a tick does no IPC unless the terminal plane was silent for the whole interval and a PTY still expects delivery. Two consecutive silent ticks with main reporting ACK-starved in-flight confirm the wedge; heals are one-shot per 60s cooldown so a persisting wedge cannot repaint-storm. - pty:reportRendererDeliveryState (invoke): always max-merges the renderer's cumulative processed totals (a free extra repair lane for the lost-ACK variant); with heal:true — and only after main has itself seen ≥10s of ACK silence — writes off bytes the renderer provably never received (received ≤ acked < sent; a received-but-unparsed backpressure window is never written off), drops that PTY's pendingData (snapshot covers everything ≤ markerSeq, hidden-drop parity), credits provider flow control, and returns restore markers in the reply. - The renderer re-attaches all push listeners (cures a detached-listener variant outright; a safe no-op against a dead channel) and routes the pulled markers through the existing pty:modelRestoreNeeded machinery — panes repaint from the main-owned buffer snapshot with zero push delivery involved. - Field discrimination built in: the heal warn logs ipcRenderer.listenerCount('pty:data') (listener detached vs channel dead) with the full delivery snapshot, so the next occurrence names the root cause without asking the user to run anything in a console. Repro harness: the exposeStore-gated __terminalDeliveryWatchdog hook blackholes pty:data ahead of the dispatcher — the field failure in miniature (no receive count, no ACK credit, no dispatch). terminal-push-delivery-loss-recovery.spec.ts proves the wedged output repaints while the blackhole is still engaged and live flow resumes after release, with no reload. Unit suites pin the watchdog state machine (zero IPC under flow, two-tick confirm, cooldown), the dispatcher reattach seam, and the main-side write-off semantics. Perf: nothing added to main's send/flush path; the renderer data path gains one integer/Map update per chunk; idle cost is one ~100-byte invoke per 15s only during total terminal silence. Terminal perf e2e suite (typing latency, redraw freeze, output scheduler, hidden TUI restore, artificial opencode load) passes on this change; no watchdog activity occurs under ack-gate pressure scenarios because receive-progress gates the heartbeat. Co-authored-by: Orca <help@stably.ai> * Expose the hidden-yet-visible delivery-gate contradiction in the debug snapshot The v1.4.124-rc.2.perf blank-terminal field snapshot showed a different state than the v1.4.121 transport wedge: no delivery gating at all (ackGatedFlushSkipCount 0, in-flight 38KB, far under every cap) but TWO ptys hidden-delivery-gated with 78MB dropped as hidden. The aggregate counters cannot say whether the pane the user was staring at was one of the gated ones — the one number that separates "normal background dropping" from "main is starving a visible pane because the reveal unmark never fired". Add hiddenDeliveryGatedVisiblePtyCount / hiddenDeliveryGatedActivePtyCount (overlap of the gate's hidden set with the renderer's visible/active reports — a contradiction that must be zero) to the delivery debug snapshot, and a once-per-minute warn when hidden-gated bytes are dropped for a pty the renderer reports visible or active, with the full snapshot attached. Zero cost outside the debug read and the already-dropping path. Co-authored-by: Orca <help@stably.ai> * Unlatch the hidden-delivery gate when user input disproves a stuck document.visibilityState macOS occlusion tracking can wedge document.visibilityState at 'hidden' after display sleep and never fire another visibilitychange. The hidden- delivery gate then keeps dropping renderer-bound bytes for panes the user is looking at (field snapshot 2026-07-06, v1.4.124-rc.2.perf: 78MB dropped across 2 pane-level-visible ptys with a fully healthy transport), and every recovery path (window focus, system-resume relay, backlog recovery) re-ran syncHiddenRendererPtyDelivery only to recompute the same stale predicate — nothing could ever clear the gate. The user sees a frozen terminal; typing echo is dropped in main; only a reload recovers. Real user input while the document claims hidden is a physical contradiction: keystrokes and clicks only reach a focused, on-screen window. stale-document-visibility.ts latches that proof, runs each pane's existing visibilitychange resync (gate unhide + hidden-output snapshot restore), and hands authority back to the occlusion tracker on the next genuine visibilitychange. No timers; the failure bias is safe — a wrong latch can only restore pre-gate delivery cost, never drop bytes. Hot path unchanged: the foreground predicate still returns on the same single comparison while the document is visible. tests/e2e/terminal-stuck-occlusion-recovery.spec.ts pins the wedge (visibilityState pinned hidden -> output dropped, not painted; the hiddenDeliveryGatedVisiblePtyCount field discriminator reads >0) and the recovery (one Shift keypress repaints the missed output from the main-owned snapshot, no reload, while visibilityState still reads hidden). Negative control verified: the spec fails without this fix. Typing-latency perf gate passes; terminal-pane unit suites 366/366. Co-authored-by: Orca <help@stably.ai> * Add a one-paste terminal freeze report: __orcaTerminalFreezeReport() Every field report of the frozen-terminal family so far has needed follow-up asks (console output, main logs, second snapshots) because each capture showed one process's counters at one instant. This makes a single DevTools command sufficient: `await window.__orcaTerminalFreezeReport()` returns renderer state (document.visibilityState + the stale-visibility override, pty:data listener count, delivery-watchdog totals), main's debug snapshot extended with a per-pty delivery table (sent/acked/pending, hidden vs visible-set membership, last send/ACK ages, window focus flags, power suspend/resume ages, app version), and bounded breadcrumb rings from BOTH processes recording the transitions that matter: gate marks/unmarks, visibilitychange and stale-visibility latches, watchdog stalls and heals, restore markers, heal write-offs, and renderer lifecycle resets (so "user already reloaded" is visible in the history). Costs stay off the data path: breadcrumbs record only rare transitions into a 100-entry ring with same-kind coalescing (a flood costs one slot per second); the per-pty table is built only when the snapshot is read; the per-send bookkeeping adds one Date.now() to existing accounting writes. Pty ids are redacted to their `@@` suffix because daemon session ids embed worktree paths. The report assembles over invoke IPC — the direction proven alive in every observed wedge — and a failing invoke is captured as data instead of sinking the report. The stuck-occlusion e2e now also pins the report end-to-end: after the wedge + keystroke recovery, the report must carry the stale-visibility latch and gate transitions in the renderer ring, gate-mark/unmark in main's ring, and a populated per-pty table. Suites: pty.test.ts 258, terminal-pane 1705, shared ring 5; typing-latency perf gate passes. Co-authored-by: Orca <help@stably.ai> * perf(daemon): keep-tail thin hidden panes' stream so agent floods never bury typing (STA multi-workspace lag) Hidden panes are exempt from pendingData flow control (main gate-drops their bytes after ingestion), so N background agents ran unbounded ahead on the one shared daemon->main stream socket (measured 192MB user-space backlog) and visible-pane echo waited FIFO behind it — typing appeared seconds late whenever several agents burst on a loaded machine (8x512KB/s + 12 CPU spinners: p50 293ms fix-off; 12x1MB/s: 6.1s). Mechanism (replaces producer pacing — no reveal catch-up, ever): - Shallow socket write gate (128KB) + per-session fairness bypass bounds echo latency by construction; kernel-flush refill sentinel keeps held bulk draining at full speed (drain-only refill capped at ~8MB/s). - Backgrounded sessions' queued output is keep-tail dropped (newest 512KB kept, in-order dataGap replaces the middle); a ~2MB GLOBAL budget shrinks per-session keep-tails (floor 64KB) so a worktree switch never waits behind the aggregate. Reply-eliciting query bytes (DSR/DA/OSC probes) are salvaged from dropped spans. - Notifications are structurally lossless: the daemon runs the same shared scanners main uses (bell/OSC 133/pr-link/2031) over every byte BEFORE drop decisions and relays facts in byte order; ordered background markers hand scan authority back and forth, seeded with the emulator's partial escape tail so a sequence split across the handoff neither phantom-fires nor goes missing. Titles/agent-status stay main-side (kept-tail convergent). - Main: background = hidden AND no remote view subscriber (a live mobile/web view is never thinned); on dataGap main resets cross-chunk parse carries, drops the headless mobile mirror, and reuses the hidden-drop model-restore marker. Wire: three new stream events, tolerated within protocol v19 (old mains ignore unknown events; old daemons never see the trigger). Kill switches: ORCA_DAEMON_BACKGROUND_STREAM_DROP=0, ORCA_DAEMON_SHALLOW_SOCKET_GATE=0. A/B (pnpm bench:multi-workspace-typing): 8x512KB/s + 12 CPU workers p50 293ms/p90 647ms -> 15/21ms (= baseline); 12x1MB/s 6,146ms -> 20ms; light loads unchanged; zero missing echoes. Latin hidden-restore e2e green (probe-verified aggregate-drain root cause). New deterministic repro harness: tests/e2e/terminal-multi-workspace-typing-latency.spec.ts + CPU pressure workers. Co-authored-by: Orca <help@stably.ai> * diag(terminal): breadcrumb WebGL context-loss/atlas + wake triggers into freeze report Silent instrumentation (memory ring only, no new console lines) so the next post-wake garble report attributes itself. Adds: - shared/terminal-webgl-diagnostics.ts: lib-safe sink so pane-webgl-renderer (lib) can record without importing the components-layer ring; wired to the ring in terminal-freeze-breadcrumbs. - webgl-context-loss crumb at onContextLoss, webgl-atlas-reset crumb at the atlas registry reset — the pair that distinguishes 'atlas corrupted' from 'missed repaint'. - wake-recovery:<source> crumb (focus/visibilitychange/system-resumed) with the clearGlyphAtlases decision; source in the kind so distinct triggers don't coalesce. - per-pane WebGL state (getAllPaneRenderingDiagnostics) in the freeze report. Gates: typecheck 0 errors; terminal suites 328 files pass; oxlint clean. Co-authored-by: Orca <help@stably.ai> * fix(lint): use Number.parseInt/parseFloat in terminal-view-attributes oxlint unicorn(prefer-number-properties) flagged 24 global parseInt/parseFloat calls in the terminal-view-attributes feature (ee540f32d, perf-branch only), failing PR Checks 'verify' lint. Mechanical global→Number.* rewrite via oxlint --fix; behaviorally identical. Pre-existed the latest main merge. Co-authored-by: Orca <help@stably.ai> * fix(test): update stale terminal test stubs/expectations to current runtime Three pre-existing perf-branch test failures (red before the latest main merge; unrelated to it) — all stale test scaffolding lagging behind perf-branch features, no production code changed: - provider-dispatch.test.ts: electron mock missing powerMonitor, which pty.ts installPowerSignalBreadcrumbs now calls on registerPtyHandlers. Added powerMonitor:{on:vi.fn()} to match pty.test.ts. - runtime-terminal-stream.test.ts: onSnapshot now receives a second { pendingEscapeTailAnsi } meta arg (#7329); updated the three exact-arg toHaveBeenCalledWith assertions. - terminal-multiplex-escape-tail.test.ts: stubRuntime missing registerRemoteTerminalViewSubscriber (subscribe path calls it now, erroring before snapshot serialize); added the stub used by sibling multiplex tests. Co-authored-by: Orca <help@stably.ai> * Fix hidden/parked split-pane exit stranding ghost or resurrected panes Deterministic e2e repro of the field 'ghost blank pane' incident (a closed/finished setup-split leaf persisted in root with no binding and remounted as a permanently blank pane) found two teardown gaps at the hidden-view parking boundary: 1. The kept-exit guard ('freshly split pane can lose its newborn PTY during setup') fired for HIDDEN panes. The hidden-delivery gate withholds their bytes, so a hidden split always looks output-less and its dead pane was kept — a binding-less ghost that dead-session reconcile can never reach (no PTY id to prove dead). The keep is a visible-failure UX; gate it on isVisibleRef and close hidden panes. 2. A PTY exit landing while the tab is PARKED reached only the parked watcher's exit sidecar (hosts' onPtyExit requires a mounted TerminalPane), which only disposed the watcher. The leaf's stale binding then reattached on reveal and the daemon re-created the exited session id as a fresh shell — silent pane resurrection. The sidecar now collapses the dead leaf out of the stored layout via detachTerminalLayoutLeaf (the observed-exit teardown's data half). New e2e suite terminal-pane-close-layout-consistency.spec.ts sweeps close/shell-exit at every hidden/park lifecycle phase and asserts leaves(root) == bindings == live panes; all 7 scenarios pass. Unit regressions added for both fixes. Co-authored-by: Orca <help@stably.ai> * Harden terminal delivery and snapshot recovery Co-authored-by: Orca <help@stably.ai> * Fix inherited lint failures Co-authored-by: Orca <help@stably.ai> * Align merged runtime recovery tests Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> Co-authored-by: Neil <neil@stably.ai> Co-authored-by: Orca <help@stably.ai>	2026-07-10 17:27:47 -07:00
Brennan BensonandOrca	20201f3ae8	Fix #5787: recovery reload no longer sweeps local PTYs; guard close for hung-but-alive renderer (#7290) ... Co-authored-by: Orca <help@stably.ai>	2026-07-03 20:09:19 -07:00
4 people	cbd06a7671	feat(tab-bar): add shortcut to open commands for active tab group (#6325) ... * Add keyboard shortcut to toggle the Quick Commands menu - New `tab.openQuickCommandsMenu` keybinding action (no default binding) - TabBarQuickCommandsMenu listens for the binding and toggles open/closed - Scoped to the active tab group naturally since the component only mounts when its group is focused * Show keyboard shortcut in Quick Commands menu trigger tooltip * Add tests * expand tests * Expand keyboard toggle to call handleOpenChange and skip repeated keys - Replace `setMenuOpen` toggle with `handleOpenChange(!menuOpen)` so closing via keyboard runs the same reset logic (query, focus frame, value override) - Guard against key-repeat events to prevent rapid toggling on held key - Wrap `handleOpenChange` in `useCallback` so it's stable enough to include in the `useEffect` dependency array without causing spurious re-registrations - Update tests to reflect that re-running the effect between presses is required for the close path, and add a repeat-event test * Add docstring to withShortcutHint func * review: harden quick commands menu shortcut Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>	2026-06-30 18:21:37 -07:00
Brennan BensonandNeil	60412362a1	fix(win): stop renderer crash-loop with an auto-recovery circuit breaker (#6856) ... A deterministic per-load renderer fault (bad GPU driver, corrupt chunk, AV interference) crashes on every load. Orca auto-reloads recoverable renderer deaths after 250ms, so without a limit it reloads every ~0.25-1.3s forever — the Windows clusters F0BDRAZN55L (launch-failed exit 18, bootstrap loop ~1.3s) and F0BDPCL93UM (ACCESS_VIOLATION on Win10 1909, ~0.8s loop). shouldRecoverRendererAfterProcessGone only gated integrity-failure/launch-failed, never 'crashed'/'killed'. Add a rolling-window circuit breaker (3 recoveries / 60s) consulted at the reload point in createMainWindow. When it opens, Orca stops auto-reloading, records a renderer_recovery_circuit_breaker_open breadcrumb, and shows a native Reload/Quit prompt (the renderer is dead, so a main-process dialog is the only available surface). The window is NOT reset on did-finish-load: a crash loop renders on every cycle before dying, so stale attempts must age out by time instead. Covered by renderer-recovery-circuit-breaker.test.ts (pure helper) and a createMainWindow.test.ts integration test that drives the loop and asserts reloads stop after the limit. Co-authored-by: Neil <neil@stably.ai>	2026-06-30 00:26:29 -07:00
Brennan BensonandNeil	5cb02a9420	Keep Orca visible when Windows startup stalls (#6462) ... Co-authored-by: Neil <neil@stably.ai>	2026-06-28 12:31:57 -07:00
4 people	1f968b92c9	Fix browser pane stuck in HTML fullscreen (#6442) (#6451) ... * Fix browser pane stuck in HTML fullscreen (#6442) Guest content in a browser pane could enter HTML fullscreen but not exit it: requestFullscreen() resized the host BrowserWindow into native fullscreen, and exitFullscreen() had nothing to restore, leaving the pane stuck. Set the webview's disableHtmlFullscreenWindowResize preference so HTML fullscreen is contained to the <webview> element. Exit then works and fullscreenchange fires as guests expect. * Apply browser guest fullscreen policy consistently Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Wolfgang Schoenberger <221313372+wolfiesch@users.noreply.github.com> Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>	2026-06-26 20:05:47 -07:00
4 people	7e6cc9ab49	fix(window): remove double title bar on Linux (#5726) ... * fix(window): remove double title bar on Linux On Linux the BrowserWindow titleBarStyle fell through to undefined, so the native WM title bar stayed and stacked on top of Orca's own renderer-drawn titlebar — two title bars. macOS (hiddenInset) and Windows (hidden) already suppress the native one. Drop the native frame on Linux (frame: false) and extend the renderer's Windows-only custom-titlebar branches (logo/menu anchor, app-name hiding, window-controls spacer + CSS vars, and the WindowControls min/max/close cluster) to Linux via a shared `hasCustomTitleBar` flag, so Linux gets one title bar with working window controls — matching the Windows custom-titlebar path. Fixes #5724 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review: harden Linux custom titlebar gating Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>	2026-06-18 23:13:30 -07:00
Janderson Fagner	e7af3676f2	feat(tray): Windows system tray with minimize-to-tray on close ... Adds Windows system tray support and a minimize-to-tray setting for close behavior.	2026-06-18 22:30:44 -07:00
4 people	1368ba84b8	feat(shortcuts): double-tap modifier keybindings (#5516) ... * docs: design for double-tap modifier keybindings * feat(keybindings): parse and normalize DoubleTap+<Mod> grammar * test(keybindings): cover DoubleTap+Ctrl positive case * feat(keybindings): match DoubleTap bindings against synthetic input * test(keybindings): cover Ctrl-on-darwin double-tap miss; document input invariant * feat(keybindings): format DoubleTap bindings as a doubled glyph * test(keybindings): cover DoubleTap+Ctrl glyph on mac; note title label semantics * feat(keybindings): add pure ModifierDoubleTapDetector state machine * test(keybindings): cover missed-keyup double-tap edge; clarify keyUp guard * feat(keybindings): capture double-tap gestures into DoubleTap+<Mod> * test(keybindings): cover Ctrl/linux and Cmd/linux double-tap canonicalization * feat(keybindings): resolve double-tap input in window shortcut policy * feat(shortcuts): detect double-tap modifiers in main before-input-event * docs(shortcuts): note dictation guards live in the renderer * feat(shortcuts): dispatch double-tap modifiers in the renderer window handler * fix(shortcuts): clear armed double-tap state on dangling modifier keyup * feat(settings): record double-tap modifier shortcuts in the editor * i18n(shortcuts): localize ShortcutKeyCombo double-tap tooltip * Fix double-tap shortcut review gaps Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Devin345458 <devin@appleidimagination.com> Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com> Co-authored-by: Orca <help@stably.ai>	2026-06-17 18:25:27 -07:00
Trevin Chow	3184d0e475	Fix floating workspace needing two clicks after app switch (macOS) (#5128)	2026-06-10 23:05:41 -07:00
Parker Rex	c2b68cac74	Fix Ctrl+Tab switcher selection on release (#5116)	2026-06-10 22:11:17 -07:00
Jinwoo HongandOrca	20c4ee7895	Suppress macOS renderer teardown crash reports (#4655) ... Co-authored-by: Orca <help@stably.ai>	2026-06-04 13:02:51 -07:00
Neil	6b87b9a32c	Add app icon switcher to appearance settings (#4600)	2026-06-03 17:14:50 -07:00
Neil	5f3d6fc1b5	Add unbound workspace delete shortcut (#3875)	2026-05-30 12:54:54 -07:00