The previous `[ -x ... ] && /bin/sh ... || true` form silently swallowed
non-zero exits from the script itself, contradicting the doc comment.
Switch to `if [ -x ... ]; then /bin/sh ...; fi` so only the
missing-script case becomes a no-op and real script failures propagate.
Co-authored-by: Orca <help@stably.ai>
A managed hook entry in ~/.claude/settings.json (and the codex/gemini/cursor
equivalents) embeds the absolute script path under that Orca install's
userData. When the script is missing — the user wiped userData, switched
dev↔prod, the previous Orca instance overwrote the path with one whose
script no longer exists, etc. — `/bin/sh "<missing>"` returns 127 and
Claude reports `PreToolUse hook (failed) error: hook exited with code 127`
on every tool call.
Wrap the POSIX launcher in `[ -x "<path>" ] && /bin/sh "<path>" || true`
so a missing/non-executable script becomes a silent exit 0. Failures
inside the script itself still propagate. The existing managed-command
matcher is substring-based on `agent-hooks/<file>`, so the next install
sweeps unguarded entries from older builds and replaces them with the
guarded form automatically.
Co-authored-by: Orca <help@stably.ai>
* feat(feedback): let anonymous users opt in to PR tag + contact
When 'Submit anonymously' is checked the feedback dialog now smoothly
expands to reveal two optional fields:
- GitHub username \u2014 we'll @-mention them on the fix PR
- Email or x.com handle \u2014 we'll reach out when it's fixed
The animation uses a grid-rows 0fr\u21921fr transition so it expands
naturally without measuring DOM. New fields are forwarded through the
IPC + main-process proxy as 'anonymousGithubLogin' and 'anonymousContact'
so the backend can tell self-typed handles apart from verified gh
identity. Backend changes (slack message + route) ship in
orca-marketing-website.
Co-authored-by: Orca <help@stably.ai>
* feat(feedback): split anon contact into email + x.com, tighten copy
Address review:
- move 'all optional' wording up to the top header line
- drop the inline 'we'll tag you on the PR' helper (placeholder says it)
- split the single contact input into two separate inputs (email +
x.com handle), each with its own placeholder
IPC field rename: anonymousContact \u2192 anonymousEmail + anonymousX. Backend
PR is updated to match before either side ships.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Extended removeRepo in repos.ts to drop lastVisitedAtByWorktreeId entries belonging to the removed repo, preventing monotonic growth of timestamps for deleted repos.
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Fixed pty-connection passphrase wait gate: added 'disconnected' as terminal status (only after seeing a non-disconnected state) so cancel resolves; added waitTeardowns registry so dispose() actively u
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Rebased buf0-bot #1461 onto current main — the original branch was
71 commits stale and would have reverted #1485 (Cmd/Ctrl+F search) and
#1429 (instant theme transitions).
Co-authored-by: nwparker <nwparker@users.noreply.github.com>
Closes the race where siblings awaiting parentFieldProbeInFlight wake
between resolveProbe() and the deferred parentFieldRetriedByOwner.add()
in the outer block, see parentFieldProbeInFlight=null +
parentFieldRetriedByOwner without scopeKey, and issue duplicate
with-parent probes.
Originally raised in #1456, but that PR branched off pre-#1465 main and
its diff against current main reverted #1465's owner-keyed parent-field
caches back to global flags. This re-applies the fix on current main.
Refs #1456
Co-authored-by: nwparker <nwparker@stably.ai>
Adds 'tab profile list', 'tab profile create', 'tab profile delete' to the
supportsBrowserPageFlag exclusion list. These commands operate on profile
identifiers, not browser pages, so accepting --page silently was misleading.
Supersedes #1458 (which was branched off stale main pre-#1396 and would
have reverted 'tab current' out of the exclusion list).
Co-authored-by: Hermes Agent <hermes@orca>
Replace ProfileCreate.scope coerce-to-isolated transform with strict
z.enum(['isolated', 'imported']) so unknown scopes surface validation
errors instead of being silently rewritten.
Supersedes #1455 (which was branched off stale main and would have
reverted #1396).
Co-authored-by: Jinjing <jinjing@stably.ai>
When a user on an RC build doesn't get offered a newer stable release,
we currently have zero on-machine visibility into which step failed:
the atom-feed resolver, electron-updater's manifest fetch, or some
race in between. The static analysis path looks correct, but a real
user is hitting the bug — so add the missing logs before adding any
speculative behavior change.
- Wire autoUpdater.logger to console so electron-updater's per-step
progress (channel file URL, fetched version, dedup decisions) lands
in main-process stdout (Console.app on macOS, --enable-logging
elsewhere). Previously these were silently dropped.
- Log the resolved tag and pinned URL from pinPrereleaseFeed in one
line, so we can tell at a glance whether the atom-feed resolver
picked the expected newer release or fell back.
No behavior change. Tests + typecheck pass.
Co-authored-by: Orca <help@stably.ai>
When the new-workspace draft flow targets pi (e.g. user picks a GH issue
in the smart input + selects pi as the agent), the URL was supposed to
land in pi's input box as an editable draft. It didn't, because pi has
no `--prefill` flag and our bracketed-paste-after-ready path waits for
1.5s of stream silence after `\x1b[?2004h` — pi's startup banner
(Skills/Prompts/Extensions/conflicts) prints continuously for 5+ seconds,
which keeps the quiet-timer resetting until the 8s budget expires and
the paste is dropped. Claude works because of `--prefill`; codex works
because its startup is short enough to hit the quiet window.
Fix mirrors Claude's `--prefill` semantics for pi:
- Orca's pi overlay now installs a tiny `orca-prefill.ts` extension
alongside the existing titlebar spinner. On `session_start` it reads
`ORCA_PI_PREFILL` and calls `pi.ui.setEditorText(text)`, then deletes
the env var so subsequent /new sessions don't re-prefill.
- `TuiAgentConfig` gains `draftPromptEnvVar`; pi sets it to
`ORCA_PI_PREFILL`.
- `buildAgentDraftLaunchPlan` returns `{ launchCommand: 'pi', env: {...} }`
for env-var agents; the env is plumbed through `startup.env` into
`pty:spawn` (already supported by pty-connection.ts).
The launched shell command stays a clean `pi` — no `FOO='...' pi` prefix
typed into the terminal — and the readiness race is sidestepped entirely.
Co-authored-by: Orca <help@stably.ai>
* fix(gh-project): diagnose env-shadowed gh tokens in auth errors
`gh auth refresh -s project` silently no-ops when GITHUB_TOKEN/GH_TOKEN
is exported in the user's shell — gh prefers env tokens and refuses to
modify them, exiting 0. Users follow the canned remediation, see no
error, retry, and stay stuck.
Add a one-shot `gh auth status` probe (gh:diagnoseAuth IPC) that:
- Detects env-shadowed credentials and rewrites the fix to `unset
GITHUB_TOKEN` plus a grep to find where it's exported.
- Detects missing gh install, plain missing-scope on a keyring login,
and SAML SSO authorization.
- Surfaces a tailored multi-button error UI in ProjectViewWrapper and
ProjectPicker instead of one canned 'Copy command'.
Co-authored-by: Orca <help@stably.ai>
* fix(gh-project): address review feedback
- Cross-platform shell guidance: PowerShell commands on Windows
(Get-ChildItem Env:, Remove-Item Env:, [Environment]::SetEnvironmentVariable)
via navigator.userAgent platform check.
- Use `window.api.shell.openUrl` for the docs button instead of
`window.open`, matching SidebarToolbar's external-URL pattern.
- Tighten gh auth status parser: accept single-label hostnames and
optional trailing colon; recover host from the inline 'Logged in to
<host>' line so a missed section header never silently drops accounts.
- Add tests for multi-host output and host-recovery fallback.
- Drop dead command/copy locals in ProjectViewWrapper.ErrorState by
short-circuiting the auth-error case before they're computed.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* feat(new-workspace): branch-tab create row, scoped empty hints, name under Advanced, focus polish
- Branch tab autocomplete now offers "Create new branch <name>" instead of a
separate + button + dialog (replaces the original UX from #1408 / #1400).
Suppressed when the typed query exactly matches an existing branch.
- "Use <X> as workspace name" row is restricted to Smart mode; on dedicated
source tabs (GitHub/Linear/Branch) it was off-topic noise.
- Per-mode empty-state hints ("search GitHub PRs and issues", "find a branch
or create a new one", etc.) replace the generic message.
- When a source (PR/issue/Linear/branch) is selected, the auto-derived
workspace name is exposed as a "Name" input under Advanced where it can be
reviewed/overridden. With an explicitly typed name the smart input itself
is the name field, so no duplicated control.
- Forward Tab from the Repo combobox now skips the Smart/GitHub/Branch/Linear
segmented control and lands directly in the search input. Shift-Tab from
the input still focuses the active tab trigger so the segmented control is
reachable in reverse. Implemented via a focusCapture interceptor on
TabsList that distinguishes outside-entry from intra-list moves and from
the input's own shift-tab.
- Trigger checkLinearConnection() on mount so the "Connect Linear in
Settings" hint isn't shown stalely when the composer is the first
Linear-aware surface to render in the session; gate the disconnected
message on linearStatusChecked.
Co-authored-by: Orca <help@stably.ai>
* fix(new-workspace): Enter commits typed text while results are stale
When the user types faster than the 200ms search debounce, rows and
commandValue still reflect the previous query, so Enter would silently
pick a stale source row (e.g. a PR from the prior letters). Treat
results as stale while loading or while debouncedQuery hasn't caught up
to the input value, and commit the typed text via onValueChange instead.
Co-authored-by: Orca <help@stably.ai>
* fix(new-workspace): suppress stale source rows in autocomplete while typing
Source rows (GitHub items / branches / Linear issues) are driven by
debouncedQuery, so they're stale until the user pauses for the 200ms
debounce. The previous attempt only short-circuited Enter in the
input's onKeyDown, but cmdk's Command component has its own Enter
handler that still fires onSelect on the highlighted (stale) row.
Filter source rows out of the rows list itself when debouncedQuery
hasn't caught up to value, leaving only the typed-text row (use-name
in Smart, create-branch in Branches). With no stale rows present,
neither cmdk nor our own handler can pick a wrong source on Enter,
and the popover gives visual feedback (collapses to the typed-text
row) while results catch up.
Co-authored-by: Orca <help@stably.ai>
* fix(new-workspace): keep stale results visible, force highlight to typed-text row
Previous attempt removed source rows while debouncedQuery hadn't caught
up to value, which caused funky disappear/reappear flicker as the user
typed (rows present briefly while fresh, gone after the next keystroke).
Keep all source rows visible at all times to preserve continuity, but
control which row is highlighted while stale:
- Smart/Branches: force highlight onto the typed-text row (use-name /
create-branch) so cmdk's Enter handler commits the typed text instead
of a stale issue/PR/branch.
- GitHub/Linear: no typed-text fallback row exists, so clear the
highlight; the input's onKeyDown falls through to onPlainEnter rather
than picking a stale source.
Also fixed the input's Enter handler to fall through to onPlainEnter
when no row matches the (possibly empty) commandValue, so the keypress
isn't inert in the cleared-highlight case.
Co-authored-by: Orca <help@stably.ai>
* feat(new-workspace): auto-highlight matching source for #NNN, GH URLs, Linear IDs
When the typed value is unambiguously a source reference, snap the
autocomplete highlight onto the matching source row once it appears
instead of leaving it on the typed-text fallback. Enter then picks the
intended source.
Recognized patterns:
- GitHub shorthand: #1234
- GitHub URL: https://github.com/<owner>/<repo>/issues/123 or /pull/123
- Linear identifier: STA-123 (case-insensitive [A-Z][A-Z0-9_]*-\d+)
Stale-results behavior is unchanged: while debouncedQuery hasn't caught
up to value, the typed-text row stays highlighted (Smart/Branches) or
the highlight is cleared (GitHub/Linear) regardless of intent.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Gate gh retries on idempotency (auto-detected from argv/-X/mutation), key parent-field probe by (owner,ownerType), accept 'to an' in not_found classifier, and replace bulk label PUT with parallel sing
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Wrapped FirstLaunchBanner handlers' bodies in try/finally so inFlight resets even if fetchSettings rejects, preventing the banner from going permanently inert.
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Fixed two TaskPage resume-state regressions: the debounced GitHub search now persists even when activeTaskPreset is non-null (drops the guard, persists current preset+query), and re-added the mid-sess
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
* fix: address pr-bug-scan findings from #1444
Threaded linkedPRNumber through all ChecksPanel force-refresh paths; gated useComposerState's PR-URL-from-name recovery on selected repo slug match; wrapped main-process linkedPR fallback gh pr view i
* fix: satisfy react-hooks/exhaustive-deps in selectedRepoSlug effect
Extract selectedRepo?.path into a const so the effect's only dep is
the path string, removing the missing-dependency warning.
---------
Co-authored-by: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Co-authored-by: Neil <neil@nousresearch.com>
brennanb2025andOrca
Jinwoo HongandOrca
buf0-bot[bot]andorca-bug-scan-bot
Brennan BensonandOrca
