Carry the terminal identity worker alongside chat SQL workers and adopt provider aliases at the committed SQL cache boundary. Keep worker release and automation consumers on their relocated owners, preserving asynchronous journal reads and authority checks.
Retain main test deletions; none of the 47 deleted tests had branch-owned changes. Port incoming ACP fixtures to the asynchronous resume contract.
Validation: the standard merge hook, whole-merge lint, tc:node, e2e typecheck ratchet and changed-quality passed in gate825. All 120 tests in 14 owning files passed on Node and configured Bun. O1 diagnostics are isolated on their separate local branch and absent from this merge.
Carry retained Codex input intent, admission safety, account attribution and
idle confirmation through the SQL journal owners. Preserve main relocations
and deletions and the SQL queue, history and custody assertions.
Suppress publication of unchanged SQL command acknowledgments so empty queue
claims cannot renew a chat's idle clock. This SQL mismatch predates this sync;
main's new idle-retirement coverage exposed it. Mail custody fixtures now hold
native admission and use real edit leases without altering automatic delivery.
Validation: direct Node through tc-gate; merge hook, basic lint, tc:node,
e2e typecheck and pinned-main changed quality pass. All 148 owning tests in
25 files pass on both Node and configured Bun. O1 diagnostics remain excluded.
* Give terminal agents a lasting Orca Agent ID
Terminal agents now get an Orca ID (orca_session_id:<agent>_<uuid>) derived
from their own conversation id on the host that runs them, so it stays the
same across worktree sleep/wake, app restart and a hand-run resume in any
pane. The terminal pane menu gets Copy Agent ID beside Copy Session ID, and
worktree ps --json agent rows carry orcaSessionId. Messaging a terminal
agent by that ID is refused with a message naming its pane until terminal
delivery lands.
* Name terminal agents at row admission and fix review round 1
- Perf: a row's Agent ID is resolved once, when its provider key changes at
admission (legacy rows via the status adapter's prepareRow hook, tmux rows at
canonical commit) and carried on the row as runtime-only agentIdentity.
Snapshots, publications and internal notifications only copy it; no key
serialization, cache lookup or database access per walk. Drops the pane FIFO
cache.
- Refusal: the identity service keeps a reverse index id -> rows, kept exact by
the adapter's rowChanged hook; a terminal refusal reads only matching panes
and names only confirmed running ones (no resume seeds, exited or
unconfirmed restored rows).
- Retry: a read-only identity file is lookup-only and never mints; any store
failure backs off all SQLite work for 30 s; a Copy click retries once.
- Menu: Copy Agent ID shows for a live pane only when its host stamped an ID,
and for a sleeping pane only when this app owns it on macOS/Linux.
- SSH: a sleeping record keeps its connection; a foreign (non-WSL) one resolves
no ID.
- Renderer keeps an existing ID only for the same agent, owner and provider key
including the Pi transcript locator.
- tmux-selected terminal rows carry their ID at every snapshot seam and in Copy
resolution; structured chat rows stay excluded.
* Keep Agent ID work out of notifications and reach Copy wherever a host can answer
- Internal status/provider notifications walk rows without Agent ID work:
canonical (tmux-selected) rows are decorated only for outputs that carry
the id (snapshots, live emit, ps, Copy). The tmux publish body is now
publishTmuxSelectedStatus so tests drive the production path.
- A row this host can name but has not yet (failed or pending link) is
published with orcaSessionId: null; older hosts omit the field. The
renderer offers Copy Agent ID on a live row whenever the field is present,
and the click retries through terminal.agentId.
- Hosts advertise terminal.agent-id.v1. A sleeping pane offers Copy Agent ID
when its owner is this app on macOS/Linux, or a remote owner that advertises
the capability on a known non-Windows platform, and its record names no
foreign connection.
- "Running in pane" places require that this runtime observed the row; a
saved status, Done included, is history.
* Guard the pane menu subscription and stop offering Copy where it can never succeed
- A settled read-only miss (no link in a newer build's identity file) no
longer publishes orcaSessionId; only a resolved id or a pending failed link
does, so Copy Agent ID is offered only where a click can succeed.
- Render contract for the per-pane menu selection: another pane's or host's
status change re-renders no unaffected pane; a pane's own stamp flips its
availability.
* Move terminal agent identity SQL into a worker thread
Main's blocking-SQLite ratchet forbids the synchronous identity store, so
(per the decider ruling) agent-identities.db is now owned by one lazy
worker-thread entry per hook-server owner, desktop and orcad alike.
- The schema, open/version handling, mint/link transaction and read-only
behaviour move unchanged into agent-identity-worker-entry.ts; main keeps
only the key type, path and an async client over WorkerThreadRequestQueue.
- Admission stays synchronous: a new key is published pending (null), one
request per exact key is shared by every row and click, and the committed
answer re-stamps the current rows still pending on that key (legacy and
tmux-selected) as identity-only replays. Replies are fenced by store
generation, key and current subscription; failures back off 30 s and a
Copy click retries once.
- terminal.agentId and the terminal-ID refusal are async: Copy waits for the
pending lookup and revalidates the pane; send/task routing resolves the
terminal recipient (awaiting the store's has() on an index miss) before
any synchronous routing or effects.
- The renderer treats the host's row naming a conversation as authoritative
for its id, so a settled miss clears a pending null, while ID-less local
updates keep it.
- Packaged for desktop and orcad; registered as a worker entry, no baseline
growth.
* Own identity demand per key, publish settled ids as projections, recheck authority
Implements the second decider ruling for the identity worker:
- One owner-level demand table replaces the per-key promise backlog and the
settled-row scan: each exact key a current row or caller needs has one
record (identity, places, waiters); the pump sends the worker one operation
at a time, only for keys still needed, so a healthy burst completes and
detached keys are never sent. Operation deadlines start at dispatch; a
caller's wait expiring never drops a row's demand.
- One failure gate for lookups and membership: after a failure nothing is
sent for 30 s except one coalesced Copy attempt; a single owner wake
retries while rows still wait, and cancels with the last demand or close.
- The retirement barrier outlives a client: a replaced worker must exit
before another starts; a different store path is a different authority.
- Settlement re-stamps the stored row and publishes a projection only: window
readers get the row without its hook event (no agent-state record) and
session.tabs is woken by a row touch; no enriched subscriber, plugin event
or freshness heartbeat runs again.
- Copy and terminal membership check the owner generation after their waits.
A known chat is decided by the chat store alone; send, peer mail, reply and
assignee admission resolve the terminal recipient before reading the facts
they act on, recheck the sender after the wait, and group send reselects
its audience and mailboxes after each wait before writing.
* Scope identity answers to their store authority, expire Copy grants with callers, index provider aliases
- One synchronized authority token before Copy/reverse fast paths, compared after their awaits;
answers carry their authority and an ended store turns rows, tmux subjects and the reverse
index pending together. Status path changes sync the authority outside admission.
- A failed operation reschedules the pump so a queued click gets its attempt; grants belong to
live waiters and a click joining a running attempt earns none.
- Provider-native ids resolve through a commit-maintained alias index at the record store.
- Group fan-out no longer classifies authoritative candidates; @idle rereads statuses with
current candidates before the final synchronous selection.
- Hook-server unit fixtures use an in-memory identity client; a real worker load/stop failure
check covers the worker boundary.
* Pick a shared provider alias's owner among its owners only
The alias index keeps the store's listing order (readable, then unreadable) as derived ranks, updated from the draft's appended keys on commit, so a duplicate alias no longer walks the history per lookup.
* Ask a remote pane's host for its Agent ID by the host's own pane key
Copy Agent ID on a web-terminal surface sent the client's mirrored pane key, which the execution host does not know, so it answered null.
* Keep focus where the user moved, recover a missed identity re-stamp, ack peer-mail replays first
Copy Agent ID refocuses its pane only when focus is unclaimed or still in the pane; a carried pending row takes its key's settled answer; an already-delivered peer-mail retry is acknowledged before recipient preparation.
* fix(settings): drop nested cards from Worktree hooks
The orca.yaml status, its parse-error callout and the local-scripts notice drew bordered panels inside the Worktree hooks card. Render them as flat rows; code blocks and inputs keep their borders.
* fix(settings): show healthy orca.yaml status as a collapsed row
Loaded and missing orca.yaml now render as a disclosure row under Command source instead of a tinted card inside the Worktree hooks card; the script preview or template is collapsed by default. Parse-error and update-available keep their warning card. Advanced content is indented to line up with its label. Restores the local-scripts notice card from main.
* chore(i18n): drop orca.yaml status strings the new row no longer uses
* fix(settings): keep orca.yaml row inside design-system lint rules
Keep main owner relocations and deliberate test deletions, carry SQL
journal readers to their surviving owners, and preserve the native chat
title generation ruling. Move SQL publication, startup failure and
durable shutdown assertions into the surviving owning suites.
Validation: standard merge hook, full Node typecheck, code quality,
anti-slop, flaky and e2e typecheck gates pass; owning suites pass on
Node and the configured Bun entry (23 files,119 tests each).
O1 diagnostics work remains uncommitted and excluded from this merge.
Preserve main's removal of model-report picker overrides while keeping SQL option writes, finite message steering inputs and tracked idle confirmation. Adopt the incoming owner relocation and deliberate test retirements; the new option freshness regression uses the surviving fixture.
Audited all 11 incoming commits from the prior main tip, pinned at 81d2b0b240. The standard merge hook and all static gates pass, and 33 owning cases pass on direct Node and the configured Bun entry. O1 diagnostics work remains excluded from this merge; no further main movement is folded in.
Preserve the SQL journal authority while adopting main's consumer relocations, account holds, context usage and deliberate API/test removals. Move retained SQL regression assertions to surviving owners and keep the retired conversation title owner deleted.
The P7 costs remain small measured overhead: warm work lookup p50 rises by 0.167 us (3.542 to 3.709 us; ratio 1.047, 60/80 pairs slower), and empty / two subscribers / changed writer acknowledgment p50 rises 5.5% (0.259459 to 0.273833 ms; paired interval excludes parity) on a writer path P7 does not change. Completion improves from 1.546834 to 0.657125 ms.
The 232-commit consumer audit and local validation receipts are recorded in the lane evidence. O1 diagnostics work remains excluded from this merge.
* fix(mobile): let the chat transcript scroll by touch on the phone's web pages
Gesture handler 3 (Expo 58 upgrade, #37935) gives a GestureDetector's view
touch-action: none on web by default. The chat transcript's pinch-to-zoom
detector sits on its scroller, so in the phone's WebView pages the browser
refused every touch pan and no chat could scroll. Gesture handler 2 left it
at auto.
The row list now wraps its own scroller in MobileNativeChatPinchZoom, which
keeps touch-action: auto. A browser render check pins the scroller's
touch-action under the detector.
* fix(mobile): keep the transcript pinch on its text size, not page zoom
touch-action: auto let a two-finger pinch on the transcript zoom the whole
page in the phone's web pages, so the transcript's text-size pinch never ran
and a zoomed page stopped the composer lifting over the keyboard.
pan-x pan-y keeps one-finger scrolling (and sideways code blocks) with the
browser and hands the pinch to the detector.
The render check now pans the transcript with one finger and pinches it
with two, asserting it scrolls, the text scale changes and the page stays
at scale 1.
* Antigravity settings: flatten into agy terminal and Chats cards
Replace the nested Antigravity card with two flat settings cards. Saved agy
accounts become Codex-style rows (click to select, Active badge, Remove), the
current login gets an inline Save, and usage refreshes from the active row.
Chats lists Sign in with (Enterprise fields inline), Account status with its
action, then Chat runtime.
* Use primitive variants for Antigravity row buttons and badge
* Antigravity settings: speak usage values and keep the /logout step
* feat(plugins): proposed tier for host methods not yet frozen
A method spec may set `proposed: true`: only development plugins may call
it (others get not_permitted), and the minor, frame/worker method lists,
typings and skill references omit it. The reference renders such methods
in a separate Proposed section; dev workers' host.has answers for them.
* feat(plugins): param capabilities, host confirmations, automation provenance
- PluginHostMethodSpec.paramCapabilities: a passed param can require a
second capability; executePluginHostCall and the mock host refuse it with
capability_denied before any audit or effect, and the reference shows it.
- confirmPluginAction generalizes the external-open prompt into a host-owned
confirmation, exposed as PluginHostServices.confirm (desktop only; absent
in headless serve). It re-checks the plugin's approval after the answer.
- Automations record createdBy { kind: 'plugin', pluginKey, name }, set by
the runtime from the in-process plugin caller (RpcContext.plugin), never
from params; the Automations detail shows "Created by <plugin>".
* feat(plugins): workspace:create, automation:read and automation:write capabilities
New closed-enum kinds (older Orcas refuse such manifests with the engines
message), worker-only, with consent copy that names what each allows;
release floor PLUGIN_HOST_API_1_8_SINCE (1.4.259) joins
PLUGIN_SCHEMA_NEWEST_SINCE. agent:launch copy now says it also resumes.
* feat(plugins): host API 1.8 methods: workspace.create, agent.resume, automation.*
- workspace.create (workspace:create; agent also needs agent:launch): a
worktree in a Git project, as orca worktree create does; with agent, the
CLI's agent.launch create-worktree path, so the agent starts after setup.
Setup is skipped or follows the project's settings; never run, an
approved hash or a startup command.
- agent.resume (agent:launch): terminal.ensureAgentSession by session id;
started is false when a terminal already ran it. agents.list rows and
agent.status.changed carry sessionId.
- automation.list/create/update/delete (automation:read/write): create
forwards only name, prompt, agent, target, schedule, time zone and
enabled; update/delete of automations another plugin or the person made
ask the person first and report cancelled or consent-unavailable.
* test(plugins): host API 1.8 coverage; regenerate plugin artifacts
Covers param capabilities (host and mock host), workspace.create payloads
and refusals, agent.resume keys and adoption, sessionId on agents.list,
automation projection, forbidden create fields, confirmation outcomes,
runtime-set provenance and capability access growth. Regenerates the
reference, schemas, typings, declarative runtime and skill references.
* fix(plugins): host API 1.8 review fixes
- Confirmations spend the frame dialog budget, allow one question per
plugin at a time and pause after a refusal (rate_limited); a worker's
question shows in the focused window, else the first visible one.
- Changing what an automation with extra agent settings runs (prompt,
schedule, resuming) asks first even for its creator, showing the prompt.
- Removing, disabling or blocking a plugin pauses its automations and ends
its ownership (createdBy.endedAt), so neither re-enabling nor a reinstall
under the key resumes or edits them silently; the remove dialog says so.
- workspace.create and agent.resume record the terminals they return as
the plugin's own; a launch that fails after its worktree exists names it.
- Setup-decision refusals are told by the runtime's error class (kept as
the in-process RPC error's cause); generated names see every worktree
of the project; resume transcripts match the workspace and host.
- Created by shows the plugin id beside its name.
* fix(plugins): end automation ownership only on uninstall, disable or block
- The ownership sweep no longer reads discovery: only an uninstall
(announced by the removal path), the disabled list, the kill list or
the plugin-system switch end it, and only once the service is ready,
so an unreadable plugins folder pauses nothing. An install under the
same key after a removal keeps what it creates.
- A new time zone on an automation with extra agent settings asks first.
- A failed launch names only a new worktree made from the requested name.
- Settings' plugins-off state and the CLI's plugin system off and plugin
disable say that plugin-created automations are paused and stay so.
* fix(plugins): address host API 1.8 review threads
- Confirmations close when the worker's call ends, freeing the plugin's
turn; they name the automation (short id, project, workspace,
schedule), show any new prompt, and are refused as `changed` when the
automation was edited while the person was asked.
- automation.create takes hostId (through the project's setup on that
host) and a creationKey scoped to the plugin; the runtime rechecks the
plugin's approval right before the write.
- agent.resume records only terminals it started; both it and
workspace.create recheck approval before recording.
- automation.list never cuts a schedule (null when too long) or fails on
an id too long to show.
- The Automations detail says when a creator plugin was removed or
disabled.
* refactor(ai-vault): group scanner modules by defining owner
* refactor(ai-vault): consolidate owner imports and isolate path absence
* Preserve mobile CI triggers for extracted absence predicate
Brennan Benson
Neil
OrcaWinandOrcaWin
Jinjing
Jinwoo Hong
Kelvin Amoaba