* fix: gate worktree status on live PTYs so sleep reports inactive
Sleep preserves tab.ptyId as a wake-hint sessionId, so the previous
liveness check (`tab.ptyId != null`) kept the workspace dot green and
agent rows as "working" until the 30-min stale TTL decayed them.
Switch liveness to ptyIdsByTabId (cleared by every pty.kill / sleep)
via a new tabHasLivePty helper, and drop live agentStatusByPaneKey
entries on sleep so the inline rows disappear with the dot. Retained
"done" rows survive — that signal is dismissed by the user, not the
system.
Co-authored-by: Orca <help@stably.ai>
* fix: drop retained agent rows on worktree sleep
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
Co-authored-by: Orca <help@stably.ai>
* fix: preserve slept worktree status liveness
Co-authored-by: Orca <help@stably.ai>
* fix: treat slept pty hints as inactive
Co-authored-by: Orca <help@stably.ai>
* chore: remove sleep status planning docs
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
When a remote SSH workspace contains a symlink whose target lies outside
the registered repo/worktree roots, file reads failed with 'Path outside
authorized workspace'. This silently broke common workflows: HPC dataset
mounts, multi-checkout repos, dotfile editing, and any cross-mount
symlink.
Drop `RelayContext.authorizedRoots`, `validatePath`, and
`validatePathResolved` along with all ~33 call sites in fs-handler.ts
and git-handler.ts. The relay's threat model becomes 'the relay runs as
the SSH user and trusts the renderer.'
Why this is acceptable: `pty.spawn` and `git.exec` already concede the
same threat. A renderer that wants to reach `/etc/passwd` can spawn a
shell or run `git -C /etc cat-file`; the FS allowlist was friction, not
a security boundary. Intra-worktree path checks in `getDiff` and
`discard` are intentionally preserved.
Back-compat preserved: `session.registerRoot` (notification + request)
remains a valid RPC, retained as no-ops on new relays. Old main + new
relay and new main + old relay both keep working through the upgrade
window. `registerRelayRoots` is also kept for the same reason. A
narrowed error-translation block in `worktree-remote.ts` handles old
relays still surfacing the legacy error string to users.
Tests: removed two negative-allowlist tests; added a positive control
('reads files outside any registered root') and a direct regression
test for #1661 ('reads files via symlinks resolving outside the
workspace'). All 469 relay/SSH/IPC tests pass.
See docs/relay-fs-allowlist-removal.md for the full rationale,
back-compat matrix, alternatives considered, and follow-up cleanup
plan.
Closes#1661
Co-authored-by: Orca <help@stably.ai>
* feat(telemetry): instrument on_path:false triage on onboarding_agent_picked
Adds path_source and path_failure_reason to onboarding_agent_picked so the
~30% on_path:false rate on dashboard 1562016 can be split between shell
hydration failures and genuinely-not-on-PATH cases before picking a fix.
See docs/agent-on-path-detection.md.
Co-authored-by: Orca <help@stably.ai>
* fix(telemetry): close PathSource compile-time-sync hole
Add `_PathSourceSync` guard mirroring `_PathFailureReasonSync` so adding
a new `PathSource` value to the alias without updating the schema (or
vice versa) fails the build. Without it, drift would silently drop
`onboarding_agent_picked` at the strict validator. Also replace stale
line-number references in docs/agent-on-path-detection.md with named
function/handler references that survive future edits.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
When there are unstaged/untracked changes but nothing staged yet, the
Source Control primary button now reads "Stage Files" and bulk-stages all
unstaged + untracked paths in one shot, so users can immediately hit
Commit on the next click without manually staging first. This replaces
the previous behavior where Pull/Sync/Push/Publish could appear as the
primary on a dirty tree and then fail with "Please commit or stash them".
Co-authored-by: Orca <help@stably.ai>
* feat(telemetry): track agent_hook_install_failed per agent
Replaces the closure-style installer loop in `src/main/index.ts` with a
labelled `runManagedHookInstallers` so each catch can attribute the
failure to its agent. Adds the `agent_hook_install_failed` event +
`hookInstallAgentSchema` enum (claude/codex/gemini/cursor) and a unit
test pinning fail-open semantics, label routing, and the 200-char
error_message truncation.
Co-authored-by: Orca <help@stably.ai>
* fix(telemetry): harden agent-hook installer fail-open
- describeError always returns a string (JSON.stringify can return
literal undefined for throw undefined / Symbol / function, which
would crash the catch handler before track fires)
- wrap track() in inner try/catch so a telemetry-side throw can't
abort the installer loop
- dedupe AGENT_HOOK_TARGETS into one tuple in agent-hook-types so
the IPC AgentHookTarget type and hookInstallAgentSchema can't drift
- regression tests for object/undefined throws and track-throws
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* feat(diff-viewer): scroll to first change when opening a diff
On a fresh diff tab open (no cached view state, no pending scroll-to-note),
center the first diff change in the viewport. Cached view state and
explicit scroll-to-note requests still win.
The scroll runs from a dedicated useEffect, not from handleMount, so it
sequences after the comment-decorator inserts its view zones — otherwise
late zone insertion shifts content downward and the user lands on a note
further down the file instead of the first change.
Uses getTopForLineNumber(line, /* includeViewZones */ true) so the math
accounts for whatever zones the decorator added in this render pass.
A one-shot ref guards against re-firing on later effect re-runs.
Co-authored-by: Orca <help@stably.ai>
* test(window): mock ipcMain.handle/removeHandler in createMainWindow.test
The pr-bug-scan from #1583 added an ipcMain.handle('window:isMaximized', …)
call to createMainWindow but didn't extend this test's electron mock. Main
already added these mocks (PR #1634); add them here so the branch's CI passes.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(windows): tab row drag region overlaps window-controls overlay
The top-right tab group's no-drag spacer was hardcoded to 40px (for the
floating sidebar toggle). On Windows the fixed-position window-controls
overlay (138px wide) sits on top of the same corner, making the buttons
unreachable when the tab row's drag surface extended under them.
Widen the spacer to calc(40px + var(--window-controls-width, 0px)) so
it punches a hole for both the sidebar toggle and the overlay. The var
is 0px on non-Windows so this is a no-op there. Fixes#1664.
* fix(windows): remove double-compensation spacers from toggle and sidebar header
Two places were using both a CSS-based offset AND an internal spacer div,
doubling the reserved width (276px instead of 138px):
1. Floating right-sidebar toggle (workspace view): the container already
uses right:var(--window-controls-width) to position itself clear of
the overlay. The extra window-controls-titlebar-spacer inside was
pushing the button further left AND laying an invisible 138px div over
the pane-actions Ellipsis button, blocking clicks.
2. Right sidebar header (both layout modes): the header already has
right-sidebar-header-inset = padding-right:var(--window-controls-width).
The internal spacer was double-compensating, shifting the close button
far left with wrong spacing.
Remove the internal spacers from both. The single offset mechanism in
each case is sufficient.
* fix(windows): side-mode sidebar header has wrong gap before minimize button
In side activity-bar mode the 40px icon strip sits to the right of the
panel content, so the panel header never reaches the window-controls zone.
The right-sidebar-header-inset class (padding-right: 138px) was still
applied, pushing the close button 178px from the window edge and producing
a 40px visual gap between the close button and the minimize button.
Remove the inset class from the side-mode header only. The top-mode header
spans to the window edge so it still needs the inset.
* fix(windows): side-mode header close button overlaps minimize button
The 40px side activity bar absorbs only 40px of the 138px window-controls
overlay, leaving 98px of overlap on the panel header. The previous commit
removed all inset (making the gap 0), which caused the close button to
sit under the minimize button.
Add .right-sidebar-header-side-inset with padding-right:
max(0px, calc(var(--window-controls-width, 0px) - 40px))
= 98px on Windows, 0px elsewhere — exactly the uncovered remainder.
* fix(lint): remove unused isWindows variable in right-sidebar
---------
Co-authored-by: Neil Parker <nwparker@anthropic.com>
Reopening a GitHub issue/PR drawer paid full IPC + `gh` startup latency on
every open. Two changes here:
1. Module-level SWR cache in GitHubItemDialog.tsx keyed by
(repoPath, issueSourcePreference, type, number). Reopening within 30s
paints cached data instantly; older entries paint stale-then-refresh.
Concurrent opens dedupe on a shared in-flight promise. Mutation
handlers invalidate by (repo, type, number); a cache-generation
counter prevents in-flight refetches from resurrecting stale data
after a mid-flight invalidation.
2. Collapsed GraphQL query for issue details replaces 3 serial `gh`
subprocesses (REST issue + REST comments + GraphQL participants) with
one round-trip. Falls back to the legacy fan-out on any GraphQL error
so historical contract is preserved.
Cross-window invalidation rides a new `gh:workItemMutated` IPC broadcast
that skips the originating sender (the source already updated its cache
optimistically — re-broadcasting would race the optimistic write).
`addIssueComment` now takes a `type` so the broadcast scopes correctly
when a PR shares its number with an issue.
Co-authored-by: Orca <help@stably.ai>
* fix(status-bar): hide usage bars for agents not on PATH
When a CLI like Gemini isn't installed, the corresponding usage bar (and
its right-click / Settings toggle) was still surfaced — e.g. a fresh
Ubuntu install showing 'Gemini Usage' with no Gemini CLI on PATH.
Gate the Claude/Codex/Gemini bars + toggles on the existing
preflight.detectAgents() result. OpenCode Go is intentionally exempt
(it's a web/cookie-auth provider, not a CLI on PATH). Pre-detection
(null) preserves legacy behavior so nothing flickers on cold start, and
bars/toggles re-appear automatically once the CLI shows up on PATH.
Co-authored-by: Orca <help@stably.ai>
* fix(status-bar): refresh agent detection alongside rate-limit refresh
Self-review follow-up: when a user installs a new CLI (e.g. Gemini) after
Orca is already running, clicking the status-bar refresh button should
make the corresponding usage bar appear without an app restart.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
When the active surface was a browser tab (or focus was inside a
browser guest webview), Cmd/Ctrl+T was creating a new browser tab
instead of a terminal. Make Cmd/Ctrl+T always open a new terminal
regardless of active surface; Cmd/Ctrl+Shift+B remains the dedicated
new-browser-tab shortcut.
Co-authored-by: Orca <help@stably.ai>
* refactor(sidebar): tidy worktree list group header layout
Move the collapse chevron next to the group label, swap repo icon for a neutral muted Folder, and adjust header padding for better alignment.
Co-authored-by: Orca <help@stably.ai>
* style: minor padding tweaks on worktree group header
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Sharpens the routing boundary so agents reliably pick the right skill:
orchestration owns agent-to-agent messaging (writes that target another
AI agent's terminal), while orca-cli owns worktrees, browser, and
non-agent terminal I/O — including reads and waits on agent terminals.
Validated against adversarial routing tests.
Co-authored-by: Orca <help@stably.ai>
* fix(skills): remove broken doc references in orca-cli SKILL.md
Three files listed under ## References do not exist in the repository:
docs/orca-cli-focused-v1-status.md, docs/orca-cli-v1-spec.md, and
docs/orca-runtime-layer-design.md. Agents following the skill would hit
dead links when trying to resolve ambiguous CLI behavior. Replace the
stale list with a general pointer to the docs/ directory.
Co-Authored-By: Claude Code <noreply@anthropic.com>
* docs: remove stale Orca CLI doc index
---------
Co-authored-by: claude[bot] <claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
The buf0-bot fix-PR #1572 (findings from #1524) re-added a 30s
focus-gated fetchWorktrees poll in useGitStatusPolling that #1524 was
specifically removing. The other two findings in #1572 (worktrees:list
auth-cache poisoning and detached-HEAD encoding) are preserved.
Why: parent PR #1524's intent was to reduce background polling; the
bot's 'restoration' was an unintended behavior re-add framed as a bug
fix.
Co-authored-by: orca-bot <bot@stably.ai>
Fix mixed terminal/editor/browser tab context menu actions by resolving visible ids back to unified tab ids and counting all visible tab kinds for Close Others.\n\nAdds regression coverage for TabBar menu wiring and TabGroupPanel visible-id resolution.
* feat(windows): custom title bar with renderer-drawn window controls
Replace the default Windows native title bar with a custom renderer-drawn
titlebar to match the macOS experience:
- Set titleBarStyle:'hidden' on win32 to remove the OS chrome
- Add min/max/close buttons (Fluent-style SVG) fixed to the top-right corner,
rendered last in DOM order so they're never blocked by -webkit-app-region:drag
- Route close through IPC (window:close-requested) so the terminal-running
confirmation guard stays active; minimize/maximize via window:minimize and
window:maximize IPC channels
- Add maximize state sync (window:maximize-changed) so the restore icon shows
correctly
- Add Orca logo + ··· application-menu button on the left in place of the bare
pl-2 spacer; ··· calls Menu.getApplicationMenu().popup() replicating Alt-key
reveal
- Add window-controls-titlebar-spacer to reserve 138px on the right of the
full-width titlebar so content isn't obscured by the overlay
* fix(windows): titlebar logo color and window-controls overlap
- Logo light-mode invert: :not(.dark) selector was matching in dark mode
because .dark lives on <html> (:root), not on a descendant. Fixed to
:root:not(.dark) so the invert(1) filter only fires in light mode.
- Overlap with right-side controls: introduce --window-controls-width CSS
var (138px on Windows, 0px elsewhere) on the root div so every affected
surface reads a single source of truth:
- Workspace-view floating sidebar toggle (absolute top-0): right now uses
var(--window-controls-width) instead of hardcoded 0
- window-controls-titlebar-spacer width uses the var
- Right sidebar header: new .right-sidebar-header-inset class adds
padding-right: var(--window-controls-width) to both the top-activity-bar
and side-layout header variants so the close button is never hidden
* fix(windows): window-controls hover must not bleed below titlebar
The .window-controls container and .window-controls-btn were both 42px
tall while the titlebar is 36px. The hover background filled the full
button height, painting 6px of highlight into the content area below
the titlebar. Shrink both to 36px to match.
* fix(windows): side activity bar icons obscured by window-controls overlay
In side-bar activity-bar mode the icon strip is flush against the right
window edge. The fixed-position window-controls overlay (138×36px)
covers the top-right corner, making the topmost icons unreachable.
Add --window-controls-height (36px on Windows, 0px elsewhere) CSS var
and apply it as padding-top on the side activity bar via
.side-activity-bar-windows-inset — same pattern used by
--window-controls-width for the horizontal dimension.
---------
Co-authored-by: Neil Parker <nwparker@anthropic.com>
Added windowsShell parameter to buildAgentDraftLaunchPlan so the post-exit clear-var uses Remove-Item Env: on PowerShell/pwsh and set "FOO=" on cmd.exe; threaded settings.terminalWindowsShell through both call sites.
### Findings addressed
- ✅ **[high]** `src/renderer/src/lib/tui-agent-startup.ts:160-163` — Windows clear-var command only works in cmd.exe, breaks in PowerShell
Rebased onto current main; added settings?.terminalWindowsShell to the useCallback dep array in useComposerState to satisfy react-hooks/exhaustive-deps.
Co-authored-by: orca-bot <bot@stably.ai>
Made installRemoteWatcher return tri-state ('installed'|'unavailable'|'cancelled') so scheduleRemoteWatcherRetry only re-arms on 'unavailable', preventing stale overflow after unwatch/shutdown.
Findings addressed:
- [medium] src/main/ipc/filesystem-watcher.ts:540-549 — Cancelled install reschedules retries; stale overflow fires after unwatch
Rebased onto current main to resolve conflicts.
Co-authored-by: orca-bot <bot@stably.ai>
Added DeviceRegistry.rotatePendingDevice and threaded a 'rotate' option through the mobile:getPairingQR IPC + preload + MobilePane so explicit Regenerate clicks mint a fresh pending token instead of returning the same one.
Findings addressed:
- [medium] src/main/runtime/device-registry.ts:44-50 — 'Regenerate QR' no longer rotates the token
Rebased onto current main to resolve conflicts.
Co-authored-by: orca-bot <bot@stably.ai>
Brennan BensonandOrca
Jinwoo HongandOrca
github-actions[bot]
JinjingandOrca
NeilandNeil Parker
buf0-bot[bot]andorca-bot
Cristian Lopez