* fix(native-chat): one ownership index with link roles, and a chat refuses to start while a terminal writes its conversation
Each chat link now carries its role (head or earlier) and key; Session History names
the chat continuing a conversation first, duplicate adoption checks only head links in
both the pre-commit check and the store transaction, and terminal resumes stay refused
exactly as before. The terminal-writer check now also runs inside acquireOwner before
the spawn, refusing with the typed pre-spawn reason conversationOpenInTerminal.
* fix(native-chat): hold a terminal start Orca issues until its terminal reports it
An in-memory registry of managed terminal starts per conversation, registered in the
same step as the resume admission (terminal.send with a resume command, createTerminal
with a command), bound to the PTY execution that runs it, and ended only when that
terminal's hooks report the conversation or the execution is gone. A chat's agent
start refuses while an entry may hold its conversation.
* fix(terminal): an automatic pane restore never resumes a conversation an open chat continues
Resume recipes built from a pane's saved facts (cold restore, deferred and late reattach,
sleeping wake, host mobile materialization) carry resumeOrigin 'saved'. The execution host
decides before any command is issued: while an open chat continues the conversation, or a
chat may be writing it, the pane starts its plain shell with the started-fresh notice and
its saved claim is forgotten; with unreadable records only a saved restore is refused and
its record kept. An admitted resume registers its managed start in the same step, so the
chat's agent start refuses until the terminal reports it or exits. Clearing the last saved
record now reaches disk.
* Fix saved terminal resume ownership and effective launch results
* Preserve conversation case and clear refused cold restore identity
* fix: publish effective terminal launch results on attachment
* fix: preserve terminal launch callback and candidate ownership
* fix: keep existing terminal attachments observational
* fix: consolidate terminal launch imports
* test: document snapshot runtime fixture boundary
* fix: preserve terminal launch identity types
* fix: accept reattach payload policy sessions
* fix: preserve terminal result validation contracts
* refactor: separate terminal create contract
* test: document partial terminal runtime fixtures
* test: align sleeping resume store fixture
* Fix terminal create type contracts
* fix: return the terminal main started to its waiting view
* fix: register reattached terminals before publishing their handles
* Check unavailable-resume test fixture types
* Complete sidebar resume test store fixture
* test: bound saved resume ownership and refusal work
* Settle refused saved resume claims from actual launch results
* Fix saved resume test type contracts
* test(e2e): capture exact terminal parking diagnostics
* test: verify parked terminal with fresh host inventory
* Consolidate agent session imports in remote terminal transport
* Clarify terminal conversation refusal guidance
* Admit note-only saved conversations without hiding live writers
* Retain terminal writer proofs through final admission
* Keep the permission pill inside the Arguments box
* Share the Settings permission menu and commit Arguments on field exit
* Honor changed permission choices and acknowledged host picks in reset notices
* Show acknowledged permission resets with scoped Undo
* Consume removed permission recipes in the Arguments draft
* Keep reset notices separate from the inline permission field
* Use Textarea variant for composite arguments field
* Fix permission test query typing and sync English runtime catalog
* Flow arguments beneath the permission chip
* Keep composite argument typography in Textarea variant
* Share native scrolling between permission chip and arguments
* Place all-agents permission menu beside its label
* Preserve permission menu width while settings load
Builds the macOS terminal host's Node 24.22.1 from pinned source with a libuv patch: idle threadpool workers recheck for queued work every 30 s instead of waiting forever, so a lost Darwin condition-variable wake-up (libuv #5280) no longer strands terminal I/O. Bumps the daemon protocol to v52 so new terminals start on the patched runtime right after an update; older daemons stay attachable. Adds stalled/recovered daemon async-I/O telemetry, and lets release workflows rebuild older refs that predate the source build.
Fixes STA-11709, #31926.
New native-chat Pi sessions are no longer refused before Pi starts when a remembered effort (e.g. xhigh) isn't listed in Orca's saved `pi --list-models` row: a remembered effort the row doesn't list moves to the nearest listed level (explicit --model/--effort stay strict), and the remembered preference itself is left intact. Pi clamps unsupported levels itself.
Fixes#31493
Supersedes #31576
Co-authored-by: 王浩生 <22971846+hualong1009@users.noreply.github.com>
New WSL Codex managed accounts no longer link all past rollouts before Codex first opens the home (which stalled startup past Codex's 30s backfill gate or left later-linked sessions unindexed): Codex opens the home first, then history is linked and indexed in background batches newest-first, resumable across restarts — matching #22971's non-WSL order.
Supersedes #23843
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(orchestration): point idle headless terminals at their mail
A headless orca serve publishes no window leaves, so the mailbox lookups
(getLiveLeafForHandle, leaves, handleByLeafKey, the title idle edge) found
no target and the pointer never reached a live coordinator. When no window
publishes a terminal's pane, its connected PTY record now stands in as the
mailbox target, built from the runtime's existing PTY-lane lookups. A window
leaf stays authoritative, and the idle and settled gates are unchanged.
Fixes#33228
Co-authored-by: Fede654 <buzondefede@gmail.com>
* fix(orchestration): keep the PTY mail lane to a ready headless graph
A window host's missing leaf means a reload, crash or unmounted pane, so
the lane must not type there. It now runs only under ready headless graph
authority, keeps assertGraphReady, and defers to any leaf that holds the
PTY. The parked submit target reuses the same PTY leaf builder.
Co-authored-by: Fede654 <buzondefede@gmail.com>
* fix(orchestration): type no headless pointer while two PTYs claim one pane
A retained predecessor and its replacement can both be connected at the same recorded pane; the lane now finds no owner then, so mail waits for an explicit check instead of reaching the wrong process.
Co-authored-by: Fede654 <buzondefede@gmail.com>
* fix(orchestration): one pane-owner check for every headless pointer step
The headless lane now also refuses a pane a window retracted before it closed, and the delayed Enter re-runs the same owner check, so a claimant that appears after the pointer is typed withholds the submit.
Co-authored-by: Fede654 <buzondefede@gmail.com>
* fix(orchestration): a cancelled desktop promotion keeps headless mail flowing
Restoring headless authority clears handle records the PTY lane still owns; mailbox handle checks now re-issue them under headless authority, as other PTY-owned handle reads do.
Co-authored-by: Fede654 <buzondefede@gmail.com>
---------
Co-authored-by: Fede654 <buzondefede@gmail.com>
* Refuse unsupported SSH project setup before local API dispatch
* fix(projects): keep the desktop's SSH refusal copy and drop a re-export
The desktop's own project-setup IPC is not an Orca server, so it keeps
saying the SSH connection is not connected; the renderer now refuses SSH
setup before reaching it. Callers import the shared refusal message
directly instead of through the controller. Adds a headless paired e2e
that sets up a project on the server's SSH host from a web client.
Refs #33124
* fix(projects): give the server refusal only for a paired server's SSH host
A desktop's own SSH host keeps its 'not connected' copy; the server
refusal shows on a web client, or for a target only a paired server lists.
Refs #33124
* test(e2e): read the added SSH target from the RPC result
* test(e2e): pass a typed SSH execution host id
* test(e2e): give the paired SSH project-setup timeout bump its reason
---------
Co-authored-by: Mohith S <smohith58@gmail.com>
On Windows with Git Bash as the terminal shell, Orca now captures the agent environment through `powershell.exe -NoProfile -EncodedCommand` run inside the login shell, so PATH/HOME/TEMP come back as Windows paths and CLIs added to PATH in ~/.bash_profile resolve for AI commit messages and structured chats (and the same copy as the terminal is used).
Fixes#30946
The idle terminal-mode reset (ESC[0 q) is no longer written into the middle of an escape sequence split across output chunks (which made xterm print fragments like `41;41;41m`, e.g. Codex's composer sparkle on Windows): a per-pane tracker holds the reset until the next write that ends cleanly.
Fixes#20596
Supersedes #23733
The mobile session tab strip no longer shows Done while the workspace list shows Working: once the PTY-title renewal has kept a newer non-done status against the same clocked OSC title, the mobile projection no longer re-demotes it without the clock (seen on Windows ConPTY where the spawn-time cmd.exe title lingers).
Supersedes #32472
Co-authored-by: zhangxaochen <3416677+zhangxaochen@users.noreply.github.com>
Hermes workers no longer time out at agent_readiness while the TUI is ready: Orca recognizes Hermes' ready status + composer (including built-in skin prompt symbols) and Hermes started through its own installer launcher (`python -I -c … import hermes_bootstrap`, interpreter -c only).
Fixes#23723
Supersedes #24748
Co-authored-by: Route Smith <2595827+routesmith@users.noreply.github.com>
Panes follow a Claude Code conversation that moves into a background job (agent view ← then Enter, and /clear inside the job): on the presence recheck Orca reads the pane's own transcript `continued-in` record and the job's state.json (UUID-validated, sibling-folder only, overtaken pointers ignored, cwd kept) instead of trusting job hooks, so mobile and native chat stop freezing on the old session.
Refs #24117
Supersedes #26569
Co-authored-by: mtsr404 <10844682+mtsr404@users.noreply.github.com>
Co-authored-by: dimakrest <12894495+dimakrest@users.noreply.github.com>
On Windows, a cached foreground name that flaps to the tool shell (pwsh.exe) during Codex tool calls no longer makes Orca treat the agent as exited (clearing its working row and possibly writing the mouse-reporting reset): a fresh uncached foreground read must agree before the exit settles. Unknown-shell panes still detect real exits.
Fixes#29996
Supersedes #30606
Co-authored-by: Stone.W <218376701+Stoneeu@users.noreply.github.com>
* feat(native-chat): OpenCode and Grok chats show the turns made outside them
When an OpenCode or Grok chat reopens its conversation, the agent replays its
saved history before it answers. Orca used to drop all of it. Now the turns in
it the chat never saw (made in the agent's own CLI, or anywhere else) are added
once, in the agent's order, after the chat's rows and behind the existing
"Continued outside this chat." divider.
Turns are matched by the agent's own ids: Grok's prompt id (Orca's own turns
carry the id Orca sent) and OpenCode's saved message ids, plus the rows of a
transcript the chat was adopted from. A send of the chat's own that failed
before any reply is matched by its text between the turns proven around it,
because OpenCode never tells a client the id it gives a person's message.
The import is translated by the same translator and assembler as a live turn
into an in-memory overlay, then written as one settlement: a stale or failed
import writes nothing, and it never fails the open. A turn imported part-way
gets the rest of what the agent saved on a later open.
* fix(native-chat): type the ACP catch-up staging and origin reads
* refactor(native-chat): share the catch-up open runner across agents
The Codex catch-up's agent-neutral parts move to one module: the open-time
envelope (its own deadline and cancellation, never gating the open), the
bounded staged batch, the single settlement commit that re-checks the
journal before writing, and the "Continued outside this chat." divider.
Codex keeps only how it reads its saved turns and what the chat already
holds. No behavior change; the other agents' catch-up builds on this
instead of copying it.
* fix(acp): bound final catch-up journal barrier
* chore: remove unrelated pnpm executable metadata
* refactor(native-chat): the catch-up runner reads the chat's view only when the agent asks
* refactor(acp): catch up through the shared history runner
The open envelope, budget, divider and one checked commit now come from the
shared catch-up runner; ACP keeps only how it reads the reopen replay and what
the chat already holds. The final-barrier deadline test moves with the barrier
to the runner.
* chore: remove regenerated pnpm executable metadata
* fix(native-chat): the catch-up deadline also bounds waiting for its commit to be written
A journal write barrier that never settled after the import was admitted held
the provider's open past the catch-up deadline. The wait now ends with the
deadline or the open's cancellation, like every other step.
* test: type the history catch-up sink fixture without assertions
* fix(acp): reconcile imported history snapshots without claiming live work
* fix(native-chat): bound and revoke history preparation
* feat(native-chat): validate expected saved items during history catch-up
* fix(acp): preserve user boundaries and visible catch-up dividers
* fix(acp): replay ordered messages within provider executions
* fix(acp): report replay overflow and refresh journal test reads
* test(rpc): explain partial runtime fixture boundary
* Bound ACP history reconciliation and rejected-copy projection work
* test: use typed calls for history scaling instrumentation
* test: account for history views and exit provenance work
* fix: type history scaling test fixtures explicitly
* test: route history probes to Node and bind replay sink before open
* test(acp): explain journal scaling timeouts
After an Orca restart with the PTY daemon alive, a surviving terminal placed in a different pane than its spawn ORCA_PANE_KEY now carries that key's agent status (prompt, session) to the live pane, using the daemon-reported spawn key and the manual pane-move mechanism; ambiguous keys (claimed by more than one live terminal) are left alone.
Fixes#23753
Supersedes #31841
Co-authored-by: Kelvin Amoaba <97001695+AmoabaKelvin@users.noreply.github.com>
The health check compared two copies of the daemon identity with ===, which is never true because getDaemonIdentity() returns a fresh copy. Every read came back unverifiable, so the banner from #29087 could never appear. Compare the identity fields instead.
On Windows, WSL Claude transcripts reported through an Orca account-profile symlink (claude-profiles/<id>/home/projects → ~/.claude/projects) are found: when the Windows-visible path is missing, Orca resolves the folder's realpath inside the same running distro (realpath -m, cached 30s) and reads it from there.
Fixes#33165
Co-authored-by: Kooooojun <99903251+Kooooojun@users.noreply.github.com>
A slept agent whose tab disappeared now resumes in a fresh tab (with --resume, through the existing duplicate/host guards) when its workspace opens, and main's stranded workspace-sleep record is then dropped (only if no tab still lists that pane), instead of the record sitting forever while the workspace opens a bare shell.
Fixes#22657
In-process pi-subagents helper sessions no longer take over the lead Pi session's pane: Orca's Pi status and title extensions keep the first Pi session in the process as owner and only move ownership on new/resume/fork session starts (helpers start with reason startup), so resume ids, turn completion and the title spinner stay with the lead. OMP behaviour is unchanged.
Fixes#31526
Supersedes #31739
Co-authored-by: Yash Kakade <28981385+ykakade@users.noreply.github.com>
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(terminal): keep restored history when ConPTY repaints after a resize
The Windows daemon's emulator grew rows the way a Unix terminal does,
pulling scrollback back into the screen. ConPTY then repaints the grid
it owns from the top and overwrote those rows, so a relaunched window's
first fit lost about a screen of restored history and printed the new
shell's prompt onto the restored prompt's row. Give ConPTY-backed daemon
sessions (WSL shells included) xterm's windowsPty resize model, as the
window already does for native Windows panes.
* test(terminal): model ConPTY's repaint at the height it was resized to
ConPTY's screen holds only what the shell wrote at its current height, so a
shrink drops the rows above the cursor and each resize repaints that screen.
Assert every restored and shell row appears once, in order, across shrink,
shrink-then-grow and grow-past-original heights.
* test(terminal): show the Unix grow model loses restored history under ConPTY
A pane's owning agent takes the pane back from a nested/background child on its next hook when the hook matches the owner's recorded session (agent type and session id), instead of staying hijacked until the child finishes; stale owners and nested same-type children with new sessions stay rejected. No recorded session (older hosts/relays) keeps main's behavior.
Fixes#30589
Refs #13341
`orca terminal send --text … --enter` now uses the bracketed paste + Enter agent-prompt path for every recognized agent (not just Claude/Codex), so Pi's #/@ completion and Grok's y/n trust question no longer swallow or answer typed prompts. Agents whose process names collide with ordinary tools (orca, acli, cn, vibe) still need title/hook evidence. A send into a permission/trust menu is refused with a hint to send --text and --enter separately.
Refs #20695
Refs #18399
* Open links beside their source and reuse matching browser pages
- Preserve source-group placement across terminal, chat, file, and runtime links
- Add explicit “Open in this group” actions with safe refusal handling
- Match browser pages by host, session, resource, and exact page identity
* Preserve file link ownership when opening beside source
* Isolate browser link sessions by workspace profile
* Wait for browser tabs to render before activating links
* Respect explicit group requests when opening detected files
* Preserve legacy link ownership when opening browser tabs
* Clean up unactivated browser tabs after failed link opens
* Reveal routed browser links without stealing focus
* Preserve browser profile reuse and foreground ownership during link open
* Prefer visible browser panes and reuse exact link destinations
Reuse matching pages within the same workspace, execution host and browser
profile. Otherwise open in the focused or most recently used visible browser,
or create a split beside the source when no browser is visible. Keep explicit
group placement and background/focus ownership protections.
Incorporate visible-browser selection and popup routing from #22686 into
#32907, including selector regression coverage.
Co-authored-by: Luca Critelli <lucacri@gmail.com>
* Route browser links by workspace without reading global focus
* Validate SSH browser ownership before opening links
* fix branch file size limit
* fix(ci): track extracted browser link ratchet entries
* fix(test): follow source-aware browser link opening
---------
Co-authored-by: Luca Critelli <lucacri@gmail.com>
On Windows, the Codex at-rest skills probe no longer starts its 70s-lived `codex app-server` inside the worktree (which locked the folder and made worker release / worktree removal fail with EBUSY); it starts from Orca's stable probe folder and still lists the worktree's skills via the per-request cwd.
Fixes#33174
Codex account re-auth no longer signs the account out on cancel/failure: `codex login` revokes and deletes existing auth before it starts, so re-auth now logs in inside a staging CODEX_HOME and copies auth.json in only on success. Listing accounts relabels a host account whose auth.json identity no longer matches its saved record.
Fixes#10795Fixes#22284
Supersedes #11852
Co-authored-by: Rod Boev <106971+rodboev@users.noreply.github.com>
Opening a workspace while its local creation is still pending no longer seeds an idle terminal that steals focus from (or drops) the agent launch: the creating event carries the new workspace id, activation during creation shows the existing "Creating worktree…" panel, and the workspace takes over when creation finishes. A terminal the user explicitly opens is kept and the agent gets its own tab.
Fixes#25807
Supersedes #25812
Co-authored-by: Eotel <49769982+Eotel@users.noreply.github.com>
Resuming a Codex session on Windows no longer fails with a misleading credentials error: Codex reports a resumed rollout path with a \\?\ prefix, and the legacy migration, account-restart move and selected-account repin now share codexDatedRolloutRelativePath (the trust check's normalisation) instead of comparing against the plain sessions root.
Fixes#27200
* test: tighten transport, recovery, and diagnostic checks
* test: use at for last mock socket access
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The WSL hook relay now also tries the Node Orca installs for its WSL server (~/.orca-remote/runtimes/node-*) after any system Node, test-running each candidate, so distros without their own Node get in-distro agent status instead of the slow fallback and the repeating "no node >= 18" warning.
`worker-start --terminal` can reuse an idle native-install Claude worker on macOS again: when the cached foreground name isn't a known agent, shell or wrapper (e.g. Claude's `2.1.310` version-named binary), the presence check does one awaited fresh process read (the same read message sending uses, #18238) before refusing.
Fixes#32090
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
* test: strengthen transport recovery and benchmark assertions
* test: use preferred array type in reconnect fixture
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
A Codex terminal worker whose remote app-server reconnect fails no longer hangs its orchestration dispatch forever: Codex's reconnect-failed error cell (column-0 U+25A0 notice, detected on the settled screen via the shared Codex notice tracker, Codex panes only) fails the active dispatch with stage agent_session_lost and escalates to the coordinator; the terminal stays open.
Fixes#24791
* fix(terminal): keep desktop history in main's copy after a phone or paired desktop subscribes
A phone subscribe rebuilt main's hidden copy of a pane from the phone
snapshot (at most 1000 rows, or the screen alone under the byte budget),
so a later desktop reveal repainted the pane truncated again. Seed the
copy from a desktop-depth renderer read of the same sequence instead,
falling back to the phone snapshot if the renderer moved on.
Paired desktop clients' initial snapshot now carries desktop depth within
the 2 MB requested-snapshot budget, matching what their reveal snapshots
already allow; phones keep 1000 rows and 512 KB. The headless emulator's
default scrollback now names the shared desktop default.
* fix(terminal): publish the phone recovery before deepening main's copy
The desktop-depth read ran before the late-renderer recovery's sequence
check, so output during that read aborted the phone recovery and left the
phone blank. Keep the original order (check, seed from the phone snapshot,
publish) and deepen main's copy afterwards, only while no output has
followed. Paired desktop initial snapshots keep a margin under older
clients' 2 MiB cap (1.75 MiB) and step down through 2500 rows.
* revert(terminal): keep paired desktop initial snapshots at 1000 rows
Deeper first snapshots cost every pane on every reconnect; a lazy
background top-up is the follow-up design. This PR keeps the phone
recovery's hidden-copy fix and the shared scrollback default.
* test(terminal): build the late-renderer runtime fake with checked types
OrcaWinandOrcaWin
Brennan Benson
Neil
Jinwoo Hong
Kooooojun
JinjingandLuca Critelli
