Electron <webview> elements run in a separate process, so clicks inside
them don't dispatch pointerdown on the renderer document. Radix
DropdownMenu relies on document pointerdown for outside-click detection
and therefore misses webview clicks, leaving the menu stuck open.
Listening for window blur catches the moment focus leaves the renderer
(including into a webview) and closes the menu.
Co-authored-by: Orca <help@stably.ai>
On close/quit (especially auto-updater relaunch via quitAndInstall),
Electron/OS emit resize/move/unmaximize while the window is torn down.
The debounced persistence was capturing those near-minimum bounds, so
the next launch came up at minWidth x minHeight.
- Freeze bounds persistence on window 'close' and app 'before-quit'
(updater strips the window 'close' listener before quitting, so
the app-level latch is needed as a second line of defense).
- Release the freeze on will-prevent-unload so aborted Cmd+Q keeps
saving bounds.
- On restore, discard saved bounds at/below the min dimensions to
recover users who already persisted corrupt bounds.
Co-authored-by: Orca <help@stably.ai>
Before removing a <webview> that currently owns focus, blur the active
element and refocus the window. Without this, macOS hands activation to
the previously-active app (e.g. Slack) because the focused webContents
is gone with no replacement, pulling the user out of Orca on worktree
delete.
Co-authored-by: Orca <help@stably.ai>
Audited and rebased PR 1138. Squashed to remove the original untrusted commit stack; hook execution now requires explicit UI trust or CLI --run-hooks opt-in.
* refactor(settings): move provider accounts into dedicated Agent Accounts pane
Extracts the Claude, Codex, Gemini, and OpenCode Go account/provider sections
out of General and into a new "Agent Accounts" sidebar section so related
controls live together and General stays focused on workspace/editor/updates.
Co-authored-by: Orca <help@stably.ai>
* feat(settings): show provider logos on Agent Accounts headings
Adds the Claude, Codex, Gemini, and OpenCode Go brand icons to each provider
section heading so the Agent Accounts pane reads as a provider list at a
glance instead of a wall of text.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* perf(new-workspace): cache + dedupe Create-from work-item fetches
The Create-from tab was slow because it bypassed the renderer's existing
60s work-items cache: every sub-tab switch or modal re-open fired a fresh
`gh pr list --search is:pr is:open` / `gh issue list --search is:issue is:open`,
which also forces the main-side slow path (`listQueriedWorkItems`, uncached)
instead of the fast `listRecentWorkItems` path that wraps `gh api --cache 120s`.
- Route the PR + issue effects through the store's `fetchWorkItems` so
repeat opens / sub-tab toggles hit the 60s renderer cache + inflight
dedupe, and show cached data instantly while revalidating.
- Drop the `is:pr is:open` / `is:issue is:open` qualifiers when no query
is typed so the backend takes the fast cached recent-items path. Both
effects now share the same cache key on empty query, so PR ↔ Issue
switching issues a single underlying gh call.
- Add a small module-scoped 60s branches cache so `searchBaseRefs` isn't
reshelled out every time the Branches sub-tab becomes visible.
Measured on a cold orca repo: first render dropped from ~1,230 ms
(`is:pr` + `is:issue` sequential) to ~45 ms for the unqualified list,
with subsequent opens and sub-tab swaps serving from cache in <5 ms.
Co-authored-by: Orca <help@stably.ai>
* perf(new-workspace): finish create-from launch sooner
---------
Co-authored-by: Orca <help@stably.ai>
* feat(rate-limits): add Gemini and OpenCode Go usage tracking
- Extend provider union and RateLimitState with 'gemini' and 'opencode-go'
- Add opencodeSessionCookie to GlobalSettings (password input in GeneralPane)
- Add GeminiIcon and OpenCodeGoIcon to status bar icons
- Implement gemini-usage-fetcher: OAuth creds from ~/.gemini/oauth_creds.json,
auto-refresh expired tokens (including server-side 401 retry), loadCodeAssist
project resolution, retrieveUserQuota with pro/flash bucket mapping
- Implement opencode-go-usage-fetcher: cookie-based POST to opencode.ai/_server,
two-step workspace+subscription fetch, regex parse of text/javascript response
- Wire both fetchers into RateLimitService via Promise.allSettled for isolation
- Add formatWindowLabel() replacing hardcoded '5h'/'wk' strings in StatusBar
- Render Gemini and OpenCode Go segments in StatusBar and tooltip
- 28 new tests across fetchers, service, and label formatter
Closes#1022
* fix(persistence): additive merge for statusBarItems on load
New providers (gemini, opencode-go) were invisible to users with existing
settings because the persisted statusBarItems array (without the new entries)
overwrote the defaults. Union saved items with current defaults so new
providers appear automatically after upgrade without user intervention.
* feat(rate-limits): add Gemini multi-bucket usage
Restore provider auth wiring, preserve Gemini model buckets in detailed views, and keep compact status rendering summary-only. Avoid embedding OAuth client secrets by failing closed for auth.json refreshes.
* fix(gemini-oauth): resolve symlinks and use known-path + bundle-dir extraction
Replace the recursive directory walker with two targeted strategies:
1. Known paths: checks explicit Homebrew/Nix/npm layouts without walking.
2. Bundle dir: walks up from the binary to find package.json, then scans
the bundle dir for hash-named oauth2 chunks.
Also threads the refresh token as a plain string through
tryRefreshTokenFromBundle so both the oauth_creds.json and auth.json
paths share one refresh flow without coupling to either struct.
Windows: uses 'where gemini' and splits on newlines for multi-result output.
* fix(status-bar): fix Gemini bucket display — names, window size, model context
Three issues fixed:
1. windowMinutes was computed as time-remaining-until-reset instead of the
fixed window size. Gemini buckets are always 1-hour windows; use the
constant 60 so labels read "93% Pro 1h" instead of "93% 47m".
2. Unknown bucket names now humanize gracefully. Unknown model IDs get the
"gemini-" prefix stripped and title-cased ("gemini-3.0-ultra" → "3.0 Ultra")
instead of showing "Unknown (gemini-3.0-ultra)". Added more known model
mappings (2.0 Flash, 2.0 Flash Lite, 1.5 Pro, 1.5 Flash, Flash Lite).
3. Status bar segment now shows the most-constrained bucket name next to the
percentage so users know which model is the binding constraint.
Pure unit tests for getBucketName/deriveSessionSummary extracted to
gemini-bucket-helpers.test.ts to keep gemini-usage-fetcher.test.ts
under the 300-line lint limit.
* feat(status-bar): show all Gemini buckets individually in status bar
Instead of showing only the most-constrained bucket summary, render each
bucket by name with its remaining percentage (e.g. "Flash 93% · 3.1 Pro Preview 7%").
Falls back to the session/weekly window display for providers without buckets.
* fix(status-bar): show only Flash and 3.1 Pro Preview buckets in Gemini segment
Filter to the two most relevant buckets (Flash + 3.1 Pro Preview) to avoid
cluttering the bar. Falls back to session summary if neither bucket is present.
* fix(icons): replace GeminiIcon with official 2025 multicolor gradient
The previous icon used a simple linear gradient (blue→purple→red).
The official Google Gemini 2025 icon uses 11 blurred ellipses (feGaussianBlur)
stacked under an alpha mask to produce the characteristic multicolor glow effect.
Each instance gets unique filter/mask IDs via a module-level counter to prevent
ID collisions when the icon is rendered multiple times on the same page.
* feat(opencode): add monthly limits, workspace override, and improved cookie handling
* fix(opencode): show correct status when session cookie is missing
* fix(rate-limits): discard stale data on unavailable and show errors in tooltip
* fix(rate-limits): invalidate stale data when opencode config changes
* fix(security): resolve vulnerabilities and harden rate-limit fetchers
* fix: address critical security, performance and concurrency issues identified during code review
* fix(build): resolve claude rate-limit export and broken type definitions
* fix(build): remove unused code in claude-fetcher after rebase
* Fix claude fetcher
* fix: resolve synchronization, performance, and robustness issues in AI providers
- Convert synchronous file I/O to asynchronous to prevent main process blocking
- Implement concurrency limiting in recursive directory copying to avoid EMFILE errors
- Persist refreshed Gemini OAuth tokens to disk and improve project ID resolution
- Fix OpenCode Go fetcher to correctly handle workspace overrides and robustly resolve IDs
- Refine scraping regexes to handle nested objects and improve resilience
- Update status bar bucket names and fix Gemini model mapping typos
- Ensure proper handling of async operations in background services
* feat(gemini): deduplicate quota buckets and update model mappings
* fix(rate-limits): preserve stale data for Gemini and OpenCode Go on fetch errors
* fix: remove out-of-scope Linear changes and restore files to upstream/main
* fix(opencode-go): handle React Flight wire format and duplicate keys
The opencode.ai page uses React Server Components. Usage keys like
monthlyUsage appear twice: once as `key:$R[N]={...}` with real data
and once as `key:null` inside a billing component. Render order varies,
so on refresh the null could appear first, causing monthly to vanish or
show 100% from a sibling sub-object.
Replace flat regex extraction with extractUsageBlock, which:
- Iterates all occurrences of each key
- Skips null assignments (no { in 30-char window after colon)
- Handles the $R[N]= token between colon and opening brace
- Validates usagePercent + resetInSec as direct fields before accepting
Add regression tests using the real React Flight HTML format.
* fix(rate-limits): address PR review feedback from nwparker
Scope reverts (out-of-scope changes removed):
- Revert codex-accounts async refactor (fs-utils.ts, service.ts)
- Revert filesystem-auth.ts path-auth reordering
- Revert filesystem-mutations.ts bundled changes
- Revert repos.ts handler move; keep only -- separator fix
- Revert relay/fs-handler-git-fallback.ts RegExp try/catch
- Revert fs-handler.ts stat→lstat, useFileDeletion.ts !isRemote guard
- Revert persistence.ts statusBarItems additive merge
Feature fixes:
- Validate opencodeWorkspaceId override with ^(wrk|wk)_[A-Za-z0-9]+$ before URL interpolation
- Remove internal 5-min cache from fetchGeminiRateLimits (service polls already)
- Make saveGeminiCredentials atomic using tmp-file + rename pattern
- Add fetchGeneration counter to OpenCode to discard stale mid-flight results
- Add console.warn on safeStorage decrypt failure in persistence.ts
- Add geminiCliOAuthEnabled opt-in setting (default: false) with UI toggle and risk disclosure
- Use per-candidate AbortControllers in opencode-go fetcher
- Add fragility comments to brace-depth parsers in opencode-go fetcher
Refactor (keep under 300-line lint limit):
- Extract gemini-bucket-formatting.ts from gemini-usage-fetcher.ts
- Extract opencode-go-page-scraper.ts from opencode-go-usage-fetcher.ts
Co-authored-by: Orca <help@stably.ai>
* fix(rate-limits): restore OpenCode Go workspace ID regex + cleanup
- opencode-go-usage-fetcher: regex accidentally shipped as `\\s*` (matches
literal backslash-s) instead of `\s*` during the review-feedback commit,
breaking workspace ID extraction when no override is configured —
parseWorkspaceIds always returned []. 10 tests were failing as a result.
- gemini-usage-fetcher: drop unused `_force` parameter left over from the
removed 5-min internal cache; update service.ts call site.
- codex-accounts test fixtures: add missing `geminiCliOAuthEnabled` to
createSettings() to fix pre-existing typecheck errors introduced when
the new setting was added.
Co-authored-by: Orca <help@stably.ai>
* test(rate-limits): stabilize Gemini fetcher tests, silence max-lines
- Rewire Gemini fetcher tests to mock the CLI-credential extractor at the
module boundary instead of stubbing every fs/child_process call. The
extractor is a self-contained dependency with a simple async contract,
and was previously being reached through sync-fs mocks that stopped
matching after the extractor was refactored to node:fs/promises — three
tests were silently failing as a result. With this change, all 17
Gemini fetcher tests pass.
- Replace the "proceeds with empty projectId" test (which asserted that an
empty projectId still hits the quota API — the current fetcher
correctly short-circuits to an actionable error instead) with a test
that documents the new behavior, plus an explicit test for the
geminiCliOAuthEnabled=false unavailable path.
- Add a max-lines disable pragma to service.test.ts matching the one
already on service.ts, so the rate-limit fetch-ordering contract and
its tests remain reviewable as a single unit.
Co-authored-by: Orca <help@stably.ai>
* fix(codex-accounts): revert runtime-home-service async refactor
The review explicitly asked to drop the codex async refactor from this PR
(fires floating promises from the constructor via void, and the prepare*
helpers no longer block on sync completion — that is a behavior change
around account prep racing with launch that deserves its own design
discussion, not a drive-by).
Earlier reverts removed fs-utils.ts and service.ts but left
runtime-home-service.ts untouched, which was causing the matching
runtime-home-service.test.ts suite (11 tests) to fail in CI. This restores
the file to main so the suite is green and the PR stays scoped to the
Gemini / OpenCode Go feature.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* Wip
* fix(terminal): make split-pane cwd resolution reliable on macOS
Coalesce and cache per-pid lsof calls in the main process, and raise the
renderer's IPC timeout to 1s so cold lsof lookups (typically 100–500ms,
occasionally ~1s) don't fall back to the worktree root.
Co-authored-by: Orca <help@stably.ai>
* chore: remove stray screenshot and harden daemon getCwd test
- drop orca-before-split.png accidentally committed in the Wip commit
- accept null OR string from getCwd in the daemon test, since the new
terminal-host fallback calls resolveProcessCwd(pid) and the mock pid
55555 could resolve against a live process on CI
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Skill install is cheap (<1s, just symlinks) whereas pnpm install can take
minutes on a cold cache. Run the skills hook first so devs have skills
available immediately instead of waiting for deps.
No impact on public contributors: the env-gated `|| true` guard still
silently no-ops before pnpm install runs as normal.
Co-authored-by: Orca <help@stably.ai>
Follow-up to #1254. The lockfile tracks skill source/hash metadata which
now lives alongside the skill sources in the internal delivery repo;
keeping a parallel copy here in the public tree is misleading (entries
can drift) without being useful to anyone.
- Remove skills-lock.json from the tree.
- Gitignore it so local tooling can still write one without making
git status dirty.
Co-authored-by: Orca <help@stably.ai>
Private skill files are now stored and versioned in a separate internal
repo; a setup hook populates .claude/skills and .agents/skills with
machine-local symlinks instead. This keeps contributor-facing patterns
(agent skills in the tree) while allowing some skills to be developed
privately.
- Remove tracked skill files (62 files across 7 skill dirs).
- Gitignore the now machine-local skill directories.
- Add an env-gated hook to orca.yaml scripts.setup. Runs a setup script
whose path lives in $ORCA_INTERNAL_DEV_SETUP when present; silently
no-ops for public contributors.
No new contributor-facing requirements: the hook is optional, the env
var is only set by internal tooling, and the setup itself runs in the
worktree that Orca just created.
Co-authored-by: Orca <help@stably.ai>
Orca's terminal already encodes Shift+Enter as the kitty CSI-u sequence
`\x1b[13;2u`, but without `vtExtensions.kittyKeyboard` xterm.js never
answers the `CSI ? u` probe. CLIs that gate enhanced input on that
handshake (Claude Code, Codex, etc.) therefore drop the extended bytes
and treat Shift+Enter as a plain Enter — most visibly when running
inside tmux, which strips extended-key encodings by default.
- Enable `vtExtensions.kittyKeyboard` in the default terminal options
(matches VS Code's xtermTerminal).
- Lock in the flag with a regression test in pane-lifecycle.test.ts.
- Add docs/terminal-extended-keys.md explaining the Orca side and the
tmux-side `set -s extended-keys on` + `terminal-features xterm*:extkeys`
users need for nested Shift+Enter to reach a CLI.
Verified end-to-end in Electron: `cat -v` + Shift+Enter now prints
`^[[13;2u`, and `printf '\e[?u'` elicits the expected `CSI ? 0 u` reply
from xterm.js.
Co-authored-by: Orca <help@stably.ai>
Extracts the double-rAF xterm focus helper into a shared module and calls
it from all four new-terminal entry points (Cmd+T, "+" menu, IPC-triggered,
and per-group newTerminalTab/newTerminalWithShell). Previously only the
"+" menu path focused the new tab, so keyboard and IPC-created terminals
would drop the first keystroke.
Co-authored-by: Orca <help@stably.ai>
Previously the "Open remote project" dialog showed disconnected SSH targets
as disabled rows with a "Not connected" label, forcing users out to Settings
to bring them up. Now each disconnected row has an inline Connect button,
and the row state updates live via the ssh:state-changed listener so the
user can proceed without reopening the dialog.
Co-authored-by: Orca <help@stably.ai>
NeilandOrca
JinjingandOrca
Jinwoo HongandOrca
github-actions[bot]
Brennan BensonandOrca
mcd77
