- local.run-actions: autoRunAfterSetup after a good setup and not after a failed one, Run button,
one trust prompt, Stop -> Stopped, menu Restart replaces the tab, Cmd+Opt+Enter start/restart
- run.nonconcurrent: echo-loop started in B stops A's
- run.ports: ORCA_PORT/ORCA_PORT_COUNT/CONDUCTOR_PORT per terminal, distinct blocks, stable across
an app restart, served locally; cloud half: the action in the VM reachable here via auto-forward
- run.cloud-resume: action back after Sleep/wake and after Restart sandbox
DS-34:
- One billing store (billing-summary-store) replaces the summary, the hook's local state and the
Run-on picker cache; it keeps the last good result through a failed read and still drops answers
from before a team or account switch (DS-17).
- Skeleton while Plan & billing loads.
- '{{count}} sandbox hours left' and '{{count}} sandbox hours over the included amount this month'
as i18n plurals; no bare 'hours'; the unreachable 100% branch is gone.
- Usage warning driven by usageWarningPercent ('Your team has used {{percent}}% of this month's
sandbox hours.'), in Settings, the plans page and the account menu.
- capTooHigh states the maximum ('The spend cap can be at most {{max}}.'), from offers.maxSpendCapCents.
- Plans dialog focuses its heading on open, so Tab reaches the interval toggle before the cards.
- Payment notice uses InlineError; the build card's overage buttons land on the overage section.
- Account menu names the team once and adds the hours-left line.
DS-44: warning tone at 90%+, '$' as an input prefix, neutral paid check, 24px dialog close hit
area, no <p> inside the CheckoutPanel <dl>.
- Agent and worktree come from the terminal orcad verifies from launch
evidence (verifiedCallerTerminalHandle, shared with turn-sender); the
terminalHandle param is gone and a worktree hint is kept only when the
host knows it.
- secrets.* are accepted, and their events sent, only on cloud orcad
(ORCA_IS_CLOUD=1 + ORCA_SANDBOX_ID); already-set never reads orcad's env.
- touchRequest emits secrets.requestUpdated; natural expiry emits
secrets.requestSettled {status: expired}.
- orca-env skips the control plane's reserved names and prefixes, with a
test that reads them from secrets.ts.
- reason drops bidi controls and turns C0/C1 controls into spaces.
Customers keep flat sandbox hours. Each stopped session's activeCpuDurationMs
(from Vercel's stop response or GET session) is stored in a new session_cpu
table (migration 0042), idempotent per session. Recording is best-effort and
never blocks suspend, stop or usage reporting; a 5-minute cron sweep retries
recent sessions still missing CPU. Operator-only GET /v1/internal/fair-use
reports per-account 30-day utilisation sum(active_cpu_ms)/sum(wall_ms*vcpus)
with fairUseFlag above 60%. Nothing reaches usage_outbox, billing or clients.
- Orca account pane: signed-out and reconnect-required lines name Orca Cloud.
- Every unauthorized failure (lifecycle toast, cloud workspace errors, share links,
cloud secrets) now says "Sign in to Orca again to continue." with a "Sign in" action.
- Team page busy row keeps full contrast: spinner + aria-busy, no opacity dimming.
- destructive-chip text uses a new --destructive-text token (light: 85% mix with
foreground) so it clears AA on its tint.
- TeamDialogHost quietRefresh depends on the stable refresh callbacks.
#216 let a launcher-set ORCA_PORT (the VM launcher sets 3000) override the per-workspace block, so
two worktrees on one cloud VM would both get 3000. Each workspace always gets its own registry
block again; a regression test covers a host env with ORCA_PORT=3000.
Live on dev the first capture sealed zero sessions: agentSession.subscribeStatus needs a streaming
transport and the unix socket refuses it, and worktree.ps lists only agents live right now. The
collector now reads orcad's own session records (agent-session-journal.db, read-only): provider,
name and last turn, open tabs first; live worktree.ps rows override status; history still comes
from agentSession.history, with the stored last turn as fallback.
* fix(w3): port row keeps only Open in browser, Share… and More inline; Copy details gets its own icon (DS-29 follow-up)
* chore(w3): drop the unreferenced inline copy-button label from every locale
Found live on an Orca Cloud rollover (m4air): the persisted-run reader referenced a const declared
below the module-level read, so every restart started with no runs and nothing relaunched. The
relaunch also read orca.yaml before the replacement host served RPCs; it now retries with a bound.
orcad keeps agent-initiated secret requests in memory with the contract's
limits (3 pending, 10/hour, 15 min TTL, touch capped at 60 min, dedupe per
name), derives the agent from the calling terminal, and announces
secrets.requested on runtime.clientEvents (replayed on attach; phones get
status only). The CLI waits on it and prints the D4 reload hint; the VM
ships orca-env and makes zsh read the session env hook.
Design-squad sign-off tweaks for DS-15: the action reopens the composer rather
than creating, so it says so; member billing bodies put 'Nothing was created,
and you weren't charged.' before who to ask.
- Rewind confirm lists the changed files under the choice (three, then Show N more);
the host preview returns up to 200 sorted paths.
- 'Restore files to here' in a user message's menu restores files without
rewinding the chat (Claude Code's code-only rewind), with Undo.
- Rewind hover action uses the --focus-ring outline token.
- Disabled unchecked checkboxes keep a full-strength --input border on a muted fill.
- Fixture: NativeChatRewindConfirm:restoreFilesOnly; restoreFiles shows six paths.
DS-15: no-plan access carries canManageBilling. Members see 'Ask an owner or
admin' instead of Upgrade, and the hint says 'Ask an owner or admin to choose
one.'; at the cap they're told to raise the spend cap. Every billing failure
on the build card offers 'Create on this computer instead' (same prompt,
Local), and Dismiss hands the typed prompt back to the composer.
DS-16: choosing a plan from an Orca Cloud wall leaves an intent. Once paid,
the plans dialog returns to the open composer with Orca Cloud picked, or
retries the refused create. The no-plan card adds Try again, and the Team
page's create action opens on Orca Cloud.
Neil
Neil