The first create of a repo that no environment of the account lists makes a default environment for it
(just the repo, cloned blobless, no install script) and builds it in the background with the existing
environment build pipeline (EnvironmentBuildRunner). Later creates boot from its active build and fetch
only what changed, in the background, shown as 'Update repository' with git's real progress.
- environments.kind 'org' | 'auto' + last_used_at (migration 0049, applied to dev); an admin's edit
adopts an auto environment; an admin environment listing the repo always wins
- auto environments unused for 14 days are deleted with their snapshots (cron); per account only
- golden refresh, staleness, pruning and the warm pool apply as for any environment
- the caller's machine size stands for auto environments; an explicit other region skips them
- AUTO_ENVIRONMENTS=off disables it
- desktop: feature repo-update, 'Update repository' / 'Fetching changes…' / sidebar 'Updating the
repository…'
Measured on dev (stablyai/orca, staging OWNER): before 6 s to ready + 58 s clone; the background build
took 79 s; after, ready in 6.6-8.7 s with the repo current 0.7 s later (7.4-9.4 s total).
Runs the confirm-before-revoke auth check on demand: a pass within 10 min answers at once (verified_at, migration 0048), otherwise one check rate-limited to one a minute per person, revoking (audited) only on a definite authentication_error. Storing a new token forgets the old verification.
From the m4air real-app shots:
- The width class was frozen at mount, so a pane narrowed after mount collapsed the text to 'Y.'/'S.'.
The strip now lays itself out from its own width (ResizeObserver): wide / narrow / tiny, plus a
compact class below 360 px with one line ('Claude sign-in expired') and Renew; the detail stays the
region's aria-describedby and tooltip. Height stays 56 px.
- The strip sat under the pane's split and close buttons. CloudStripLayer (shared by the pane and the
fixture) starts it below the pane title row (--orca-pane-title-height), and the renew strip drops
its own × (Renew is the action; Escape still cancels).
Specs: resize after mount keeps the title readable at 520 and 320 px; the pane's split and close
buttons are hit-testable above the strip in three states.
design-squad P1-P3 on #310 from the m4air run:
- P1: after a restart leatherback fell back to the title-derived row ("Claude Code - Idle":
prompt = title label, lastAssistantMessage = "Idle"), whose message made "no turn finished"
false. While Agent accounts say not set up / expired / revoked, the sign-in state now wins over
every done/idle/unverifiable row shape; only a sign-in made on the sandbox (cliLogin) clears it,
not the Orca-account placeholder the sandbox reports as an API key. Covered accounts with a
signed-out sandbox clear once a turn ends after the account became active (first covered read).
- P2: sign-in rows use the catalog name (Claude/Codex), never the title or a stale reply.
- P2: the tooltip opens below, aligned to the start, so the workspace name stays visible.
- P3: the full row reads "Needs sign-in - Claude" / "Sign-in expired - Claude" and drops the
stale message line.
- interrupted-turn-continue reads its delivery helpers at call time: the cloud workspace store
imports it, so launch-agent-picker-prompt.test's partial paste mock failed at module load
- plugin-shot-editor test marks its temp cwd as a repo root so the default shots dir (which walks up
to the nearest plugin folder / repo root) can't be redirected by anything above the shared temp dir
A single 401 on an Orca-account request no longer revokes the person's Claude account everywhere. The hook only fires after the real credential was swapped in and sent. The control plane then makes one free auth check with the real token (Anthropic count_tokens, oauth beta) and revokes only on a definite authentication_error; anything else (passes, 429, 5xx, other 401 types, network) keeps the account. Checks are rate-limited to one per person and agent per minute (agent_credentials.checked_at), and every keep/revoke is audited (agent_credential_audit, migration 0047). Codex keeps its lease-refresh path.
Neil
Neil