After a serve restart where the daemon survives, a paired client could
drop mouse and focus reporting for a still-live agent. The host publishes
the pane with its tab-default title until it seeds the daemon's live title
about 180 ms later. A reattach image replayed inside that window was judged
against the default title, read as a plain normal-buffer program, and got
the reset that disarms its modes, though the image itself carried them.
The snapshot now carries the host's tracked title when the image was taken,
as an additive `lastTitle` field in the snapshot info, gated on the image's
seq. Every reset that judges a replayed image as a live agent's (the
post-replay reset, the focus-in that follows it, the hidden-restore reset,
and the model-snapshot reattach) uses that title when present, so the
decision describes the same moment as the replayed bytes. Local Electron
model snapshots already carried this title and now use it the same way. The reattach policy itself is
unchanged: non-agent normal-buffer panes still shed modes a dead child may
have left (#7329, #7893).
Older hosts omit the field and clients fall back to the published title.
Older clients ignore it.
Refs #35559
- Commit-message generation keeps the host's optional errorCode, errorParams and
errorDetail and translates every known text-generation code, matching desktop's
rules: unknown codes, older hosts or missing values show the host's English
- Background tasks, subagent groups, the model label and agent-session write
notices use localized mobile adapters instead of the shared English sayers
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Every value import of ssh2 sat on the main-process startup graph, so
Electron paid for loading ssh2 before any window even when no SSH host
is configured. Route all runtime ssh2 access through a lazy loadSsh2(),
define the BaseAgent subclasses on first use, and read ssh2's default
host-key algorithm list on first connect instead of at module load.
Profiles with saved SSH targets still load ssh2 during startup, right
after the profile store loads and before any window or reconnect, so
SSH users keep the old timing. A failed eager load is logged and
surfaces at connect instead of aborting startup. Profiles without SSH
targets never load ssh2 until first use.
An oxlint no-restricted-imports entry rejects value imports of ssh2
outside tests, and a guard test imports the SSH connection graph to
prove ssh2 stays unloaded. SSH suites mock the loader seam instead of
the ssh2 package, so no global vitest setup is needed.
Fixes#35731
Co-authored-by: Chad Tolkien <chad@sodadigital.com.au>
* fix(claude): resume a chat with a saved effort on a Claude Code that predates --effort
A chat resumed with its saved effort always launched Claude with --effort,
which Claude Code before 2.1.38 rejects as an unknown option, so the chat
could never start again. New chats carry no saved effort and started fine.
Gate effort on the CLI version facts Orca already probes for
--thinking-display and --plugin-dir, which now answer supported,
unsupported or unknown. A chat with a saved effort waits out the version
probe and puts --effort on the command line only where the CLI has it.
Live effort and Fast changes use a control request Claude Code before
2.1.50 never answers, so on those CLIs saved choices stay saved but are not
sent, the chat offers no effort or Fast choice, and a live change is
refused at once instead of after a 30 second wait. Unknown versions keep
today's behavior.
Fixes#34795
* test(claude): give the scripted runtime a current Claude Code's flag support
Production always passes flag support, so a runtime without it now reads
as a CLI whose version is unknown and keeps saved effort off the command
line. The scripted CLI stands for a current Claude Code, so name its
version and keep its saved choices on the launch.
Refs #34795
* perf(native-chat): stop re-rendering composer controls on every keystroke (#35836)
Each keystroke (and each IME compositionupdate) re-rendered the composer's
action bar and TipTap editor, which re-applied editor options and re-decorated
the view, even though neither had changed. The draft store also gave each write
a fresh image-row array, which invalidated every image consumer.
Memoize NativeChatComposerActions and NativeChatPromptEditor (initialValue only
seeds the editor at mount), pass them stable handlers that call the latest
committed closure, and keep the stored image row's identity when it's unchanged.
Draft-store writes, onDraftChange and every consumer still see each edit
synchronously, so composition semantics are unchanged.
CDP-simulated pinyin IME, 4x CPU throttle, median per compositionupdate:
14.5ms -> 6.8ms (PTY composer), 14.3ms -> 7.2ms (structured composer).
* chore(native-chat): note the prompt editor memo's stable-props contract
* fix(wsl): main's background terminal starts never start a stopped WSL distro
Every start main makes through the runtime controller is background work unless its caller names the user's act (CLI and window creates and splits, paired-client creates and tab opens, agent launches and sessions, conversation resumes). #35813's hold now also holds those fresh and restored starts while the distro is stopped or unverifiable.
* fix(wsl): headless Run now starts as the user's act; update create expectations
A headless automation's Run now names the user's act through launchAgentTerminal, so it may start a stopped WSL distro; a scheduled run stays background and is held. The paired-client background create expectation now includes wslUserAct.
* fix(wsl): main's background start checks a folder workspace's path passively
With #35899's folder stat gate, the runtime preflight passes passiveWslRestore = !wslUserAct, so a background start never stats a stopped distro's folder as a user act before the daemon hold.
* fix(automations): a scheduled run never starts a stopped WSL distro
Scheduled runs whose target is on a stopped (or unverifiable) WSL distro skip with a coded, retryable wslDistroStopped reason naming the distro, checked at the tick and again at dispatch; repeated ticks fold into one skip. Run now is the user's act and still starts it.
* fix(automations): gate host-path WSL projects by their distro; translate the skip
A host-path project whose Git runs in WSL passes its project distro to the stopped-distro check (as #35778 does). wslDistroStopped is translated into the 10 other locales.
The workspace port scanner resolves each workspace root's realpath to match
listening ports; for a \\wsl.localhost root that 9P touch started a stopped
distro about 17 s after it was terminated (E9). It now leaves a stopped
root's alias unknown, as a timed-out lookup does, and never wakes.
* fix(wsl): Source Control's PR push-target and Create PR checks never start a stopped distro
Showing Source Control resolved the linked PR's push target
(worktrees:resolvePrBase) and its Create PR eligibility
(hostedReview:getCreationEligibility); both read the repo's git config over
\\wsl.localhost and ran git and gh in the distro, starting a stopped one
(E9). Both now refuse a stopped distro unless the user is creating or
launching from the PR, or pressed Create PR (optional wakeWslDistro), in
the IPC handlers and their runtime twins.
* fix(wsl): gate the GitLab MR push-target lookup the same way
Source Control's push-target ensure also resolves a linked GitLab MR
(worktrees:resolveMrBase / worktree.resolveMrBase), which read the repo and
ran glab and git in a stopped distro. It now refuses unless the user is
creating from the MR, which passes wakeWslDistro.
* test(runtime): let the mocked running gate cover guardWslUncPathAccess too
Runtime specs fake win32 with no wsl.exe and mock blockedWslDistroForPath
to running; the real guard calls its own module's check, so the PR-base,
MR-base and eligibility gates refused there. The guard mock now asks the
mocked check, keeping per-test overrides working.
- A blur with no edit saves nothing, so it never starts a stopped distro.
- The write gate also covers a host-path repo whose Git runs in WSL (its
save's ignore check); clearing runs no Git and stays lazy.
- A paired host's refused read is re-asked on focus and every 30 s while
visible, through a watchRefusedWslRead extracted from the base-ref
watcher, which now uses it too.
Requiring posthog-node at bundle evaluation and constructing the PostHog
client in initTelemetry put ~58ms on the main-process startup path before
any window showed. The SDK is now required lazily inside
createPostHogClient, and initTelemetry defers client creation until the
first window is shown (15s fallback for headless serve / GPU failures).
Captures tracked before the client starts are held with their original
timestamps and replayed in order on start. Opt-out and shutdown start the
client first so held events flush and telemetry_opted_out still enqueues
before optOut(); a client start failure no longer blocks either path.
Fixes#35752
Co-authored-by: Neil <neil@stably.ai>
When a structured worker's dispatch preamble is definitively rejected, the
dispatch_preamble_undelivered error now appends the provider's failure detail
("Details: ...") unless the rejection sentence already quotes it. The quoted
text is bounded and normalized by the same quotedProviderDetail helper the
rejection writer uses.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
A background read of a \\wsl.localhost folder workspace's status (sidebar
polling, runtime status RPC, a passive terminal restore) stat'ed the folder
and booted its stopped distro. The status now reports 'unavailable' without
touching it; a passive restore holds with Start; a spawn the user asked for
checks the folder as their act, which may start the distro as before.
The passive-restore hold lived in the daemon adapter, so a degraded or
off daemon (LocalPtyProvider) never applied it, and even with the daemon
the startup cwd probe (wsl.exe --exec test -d) ran first and could boot
the distro. The hold now runs in the shared startup-target resolution,
before that probe and before any provider spawns (E9).
The explorer's workspace-open read and the first git status took a pending
user switch with no age limit, so a switch no consumer used (sidebar closed)
could be redeemed long after the distro stopped. They now use the same 10 s
window as pane restore and git history, through one shared
takeRecentWorkspaceSwitchWake.
When a host restart restores a pane by starting a new shell, the pane kept
the dead process's title and the client's xterm kept its input modes. A
pane that had Claude open came back as bash but still read as Claude, so
the reattach picked the agent-preserving reset and mouse moves and focus
changes were typed into the shell as escape codes.
Two process-bound facts now follow the respawn verdict:
- Title: the cold-restore payload no longer carries the checkpoint's last
title into the new process's records, and durable checkpoints of the new
process take the title from the live terminal only. The title, agent
identity and title-derived status reflect the new shell.
- Input modes: a pane records which process incarnation its xterm's modes
belong to. When the host binds a different known incarnation, the pane
grounds the process boundary before the new process's replay, the same
ground a fresh spawn already writes, so only modes the new process set
are armed.
Older servers still report incarnations, so new clients ground their modes
against them; older clients get the neutral title from new servers and
take the shell reset path.
Fixes#35559
* fix(windows): start the WSL holder with only a NUL handle to inherit
libuv starts every Windows child with bInheritHandles=TRUE and no handle
list, so a detached holder that outlives Orca kept any inheritable handle
Orca had open, such as a launcher's pipe or a DevTools socket. Start it
through CreateProcessW with PROC_THREAD_ATTRIBUTE_HANDLE_LIST naming one NUL
handle for its stdio. The build probes now check the newest export without
calling it, and the lane receipt labels ConPTY's own startup output.
* fix(windows): report isolated holder exits and kills the way libuv does
* fix(wsl): Codex WSL hook installs and host hook checks never start a stopped distro (E9)
(a) installManagedHooksIntoWslRuntime checks the settled running gate inside
its trust queue right before the first UNC read, and again before the
post-hash fallback trust write; a later reconcile checks before revoking or
reinstalling. A stopped or unverifiable distro skips (null, as with no WSL
plan). The canonical-path probe runs through process-host behind
blockedWslDistroForExec; a refused probe settles as unavailable and keeps the
known identity. The guest shell preflight and a pane launch's home preparation
run as user acts on their distro.
(b) repo.hooksCheck takes an optional background flag (older hosts ignore it);
the renderer sends it, and the host refuses a stopped distro's background
check the same way the desktop's hooks:check does.
* fix(wsl): a pane launch is not a user act for the Codex hook install
A passive restore or remount reaches launch preparation too (#35813), so it no
longer runs as a user act; a stopped distro skips the install and the relay
installs once the distro runs. A skipped WSL home now returns not_installed
instead of falling through to the host writer, which would have written the
WSL home over UNC.
* fix(wsl): a fallback grant skipped mid-install reports trust pending
hooks.json is written before the hash wait, so a skip after it is not a clean
skip: return an error status saying the trust is pending instead of null.
* chore: drop the stale process-host direct-import baseline entry
* fix(wsl): Commits history wakes a stopped distro only on the user's own act
Showing Commits woke the distro on every mount, remount and re-show. Now
only the user expanding Commits in the same worktree, or the user's own
switch to the workspace (once per switch), may start it; the Refresh
button keeps its explicit wake (E9).
* test: a mount and a base-ref move read Commits history in the background
#35778's base-move refetch test expected every shown-history read to
wake a stopped WSL distro; only the user's own act does now.
* test: clear inherited GIT_* env once per test file so real-Git suites cannot write into an outer repo
* test: clear only repo-locating Git env so the compat lane keeps GIT_EXEC_PATH
Warm start (an app relaunch or reconnect with the distro and orcad
running) to first terminal output is the flag-on gate at 2.5 s p50; cold
start (distro restart) is tracked against 3.0 s p50. Five warm reconnects
follow the cold runs, and the receipt reports n, p50 and p90 of first
output, ensure, create and send-to-output for each, with the runs.
Moving a desktop's SSH state onto the host's Orca server refused with
orcad_migration_dormant_focus_conflict whenever the host already had a
focused project from another desktop. Focus is each desktop's own
selection, not saved state, so two desktops always differ and the second
could never move, on every retry.
The host now keeps its own focus as a unit and takes a desktop's focus
only when it has none, which is what the merge already did for the
fields it borrowed. Older servers still refuse until they update.
Fixes#35585
A first WSL deploy fetches the pinned Node archive, from this computer
and then from inside the distro. Behind a firewall that drops packets it
retried four times and then waited 20 s per host source, about two
minutes before failing. WSL deploys now give the desktop one 15 s attempt
with no retry on a missing response, and the host 15 s per source, so a
dead network fails in about 45 s. The host fallback stays, since the
distro's own route often succeeds when this computer's proxy refuses.
SSH keeps its timing.
The bullet asked users to install Node for a relay that no longer exists.
Orca now brings its own Node; point restricted networks at the download
mirror setting or the offline archive path the error names.
* fix(ssh): flag a config host whose route is already registered under another name
The ssh-config picker compared names only, so a machine added by IP showed up
again under its config alias. It now also compares the endpoint: hostname
(case-insensitive), validated port, case-sensitive user, jump host and proxy
command. Entries without HostName still match by alias only.
Squashed from #15750 (3c3a3c689c, a5575ce209, 8daf21370b, a29d91ea4a).
* fix(ssh): skip importing a config alias whose ssh -G route is already in Orca
Each config import now builds one snapshot: the config it read, and which new
aliases resolve, through ssh -G, to a route an existing target already has.
The duplicate check and the inserts both read only that snapshot. Imports and
picker refreshes run one at a time through a single queue, so none can race
another, and the picker reads the latest snapshot for its In Orca flags and
Add all count without waiting (alias-only until one exists).
A route is keyed only when ssh2's rules and system ssh's (OpenSSH run with
system ssh's own destination args, including an unclaimed alias's stored
endpoint) agree on host, port, user and proxy, with each transport's token
rules. Anything uncertain, or a failed ssh -G, gives no key, so nothing is
matched by guess. At most four ssh -G run at once. Restore brings back the
hosts it lists, previouslyRemoved stays alias-only, and DNS isn't consulted.
Co-authored-by: vam <zengyan@88.com>
* fix(ssh): rebuild the route snapshot after an import changes targets
An import that inserts or updates a target outdates its own snapshot, which
left the picker alias-only until the next refresh. It now queues a rebuild
behind itself. The picker also ignores a snapshot past its reuse window, and
the system-route shortcut requires a config alias.
Co-authored-by: vam <zengyan@88.com>
---------
Co-authored-by: vam <zengyan@88.com>
* fix(wsl): Settings' issue-command and path checks never start a stopped distro
Opening the repository and MCP settings sections read .orca/issue-command,
orca.yaml and stat'ed the repo root over \\wsl.localhost, which starts a
stopped distro (E9). The issue-command read (IPC and runtime) now returns
the unreachable result for a stopped distro unless a launch passes
wakeWslDistro, and shell:pathExists is gated like shell:pathsExist, with the
two link-click callers passing wakeWslDistro.
* fix(wsl): never save over an issue command a stopped distro kept unread
A refused read showed an empty, editable field, and typing then saved over
the hidden local override and started the distro. The editor now stays
read-only with a stopped-distro note, skips both saves, and re-reads when
main signals the distro running. Writes are gated too unless the user is
saving their own edit (wakeWslDistro). The MCP section's stopped message no
longer offers a Retry that cannot start the distro.
* fix(wsl): translate the stopped-distro issue command note; listen before reading
Adds the note in every shipped locale, and attaches the editor's running
listener before its read so a distro that starts while the refused read is
in flight still triggers a re-read.
* fix(wsl): keep the issue-command editor and writer tests on their seams
The editor reads window.api optionally, as hosts without a preload do, and
the writer tests spy on the gated write that the handlers now call.
The explorer's workspace-open read and the first git status woke WSL on every
mount, so a remount, launch restore or host loss after the user stopped the
distro started it again. Both now wake only when takeWorkspaceSwitchWake
reports a new user switch to that workspace, once per switch per consumer;
an expanded folder wakes only when it is newly expanded in the same
workspace, not when a mount or switch re-runs with the same folders.
* fix(i18n): translate updater failure messages shown in the renderer
* fix(i18n): localize the dev-channel platform list and paired-server updater errors
* fix(i18n): sync runtime catalog and coded updater status expectations
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* plugins: make Try it do the thing instead of opening the plugin page
* plugins: address review on Try it (row's icon theme, language switch result, pending plugins)
* fix(wsl): every local Git call follows its project's runtime unless it says why not (D1c-6)
* fix(wsl): rebuild Git routes on the store's own writes, never on a timer, and route a new worktree by its link
* fix(wsl): route WSL-made worktree links, aliased checkouts and sync Git; host Git only where marked; no wsl.exe storms
* fix(wsl): map WSL-made worktree links through each project distro's automount root
* fix(wsl): arm the missing-distro cache only with the Git router on, and feed it spawn failures
* fix(wsl): keep synchronous Git host-only, read the setup runner's path from the link, and keep the sync launch under the ratchet
* chore(wsl): move the sync Git runner's process-host import allowance with it
* fix(wsl): read only per-worktree git paths from the link, and only from a git dir that still exists
* fix(wsl): name which Git ran on stream and spawn spans too, so status shows its route
* test(wsl): setup runner lookups declare host Git; cover the link read with the router on and off
The hooks tests expected the setup runner's `rev-parse --git-path` call to
carry `wslDistro: 'Ubuntu'` for a WSL-runtime project. On main that field
never reached Git: main's gitExecFileSync options have no wslDistro and it
calls resolveCommand('git', args, cwd) with no distro override, so the
lookup ran host Git (WSL only when the cwd itself is a WSL path). The tests
pinned call arguments, not what ran. The sync runner now states that with
`hostGit: true` and resolves exactly as main did, so the tests assert that.
New worktree-runner-script-link tests cover the router-gated link read:
router on reads the link; router on with no usable link falls back to host
Git and converts its Linux path; router off makes main's host Git call and
never reads the link.
* test(git): read src/main once in the host-Git routing guard, so it holds under load
* test(wsl): pin the setup runner's sync Git spawn to main's exact launch on POSIX
The setup runner's path lookup now passes hostGit: true where it passed a
wslDistro that gitExecFileSync never read, so the binary, args, cwd and env
it spawns are unchanged. Update the call-shape assertions and pin the POSIX
execFileSync call itself.
(cherry picked from commit 6aae6d4d090e13b75c1d9ad2734f2f717dde7570)
* fix(wsl): await WSL Git admission in spawns only when there is one
With the Git router off admitWslGit returns null; awaiting it anyway added a
microtask to every spawn's admission path that main doesn't have.
(cherry picked from commit 883aaeb90bc23e89cafb039708a565ab3d72620e)
* fix(wsl): keep main's Git scheduling when the D1c Git router is off
The remote-identity sweep moved every user's probes to the background
admission tier, which only the router reads; it now keeps its tier unless the
router is on. Admission wrapping and the spawn stderr tail also step aside
without the router, so those calls run exactly as on main.
(cherry picked from commit 151a3091307c03078d0c0b98487bbe3bf467ec27)
* test(wsl): point the distro allowlist test at the sync runner's new home, as host Git
Co-Authored-By: Claude <noreply@anthropic.com>
(cherry picked from commit 255e85fc93deba83addc4370f889c1b721180188)
* test(wsl): installing the Git router with the gate closed or off Windows leaves none installed
Co-Authored-By: Claude <noreply@anthropic.com>
* perf(wsl): skip the span-only Git resolution on every spawn while the Git router is off
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl): read a distro's automount root only from a running list probed after its stop settled, so it never boots a terminated distro
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
* perf(stats): stop retaining and rewriting the raw stats event log (#35544)
The collector kept up to 10K raw events (~203 B each since #14657 switched
meta to pane keys and added worktree ids) and re-serialized the whole ~2 MB
file every 5 s. No consumer reads events; persist aggregates only, keep the
v1 file shape with an empty events array, and compact legacy files on load.
* test(stats): use a small event burst for the retained-size bound
* fix(i18n): localize remote server pairing, host sign-in and Bitbucket connect failures
* fix(i18n): map pairing guard codes without a partial switch
* fix(i18n): type the Bitbucket connect bridge with its coded result
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
A deferred re-watch drained right after a distro boots can stat the
root before its file share serves it, and the root was then remembered
unwatchable for good. A WSL root's stat failure now retries after 1, 2,
4 and 8 s, through the same running-distro gate, before giving up.
* fix(i18n): localize Orca's agent output and Kimi failure messages in AI text generation
* fix(i18n): keep Kimi option connectives inside the translated sentence
* fix(i18n): narrow Kimi empty-input diagnosis without an undefined case
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(wsl): a passive restore never starts a stopped WSL distro; its bridge panes wait with Start
* fix(wsl): a restore may start the distro only on the user's own open, once; an unanswered read holds too
* perf(wsl): fold a connect's remaining read-only guest probes
Three folds, each WSL-only:
- the connect snapshot also reads the lock holder's guest identity, so
adoption's liveness check needs no second exec for that pid;
- one exec asks whether the pinned runtime is cached and the slot complete,
under the existing WSL-only recordedNodeRuntimeProbe option;
- the active slot's liveness, readiness and pid are read in one exec after
launch, judged by the same functions SSH's separate probes use.
SSH sends exactly the commands it did. The lane now restarts five times per
family so round-trip counts and ms medians are both readable.
* test(managed-server): measure the cached-slot probe against the host-op byte budget
It is sent only on WSL (wsl.exe argv, never SSH-framed), so like the bash
stdio bridge it carries a measured ceiling above the SSH budget.
Neil
OrcaWinandOrcaWin
Venius24andNeil
Brennan Benson
