mirror of
https://github.com/stablyai/orca.git
synced 2026-10-31 09:07:40 +00:00
4dca163bb7794d049f1e007ce01acdd8745b5f13
105
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  Žan MlakarandNeil
|
4dca163bb7 |
fix(github): count gh pr and issue commands against the GraphQL rate limit (#28778)
* fix(github): count gh pr and issue commands against the GraphQL rate limit gh serves pr/issue/repo view-style subcommands over GraphQL, but the breaker filed every non-api command under core and only matched REST's "API rate limit exceeded" wording, so GraphQL exhaustion never tripped it. Map those subcommands to the graphql bucket, match GraphQL's "API rate limit already exceeded", and guard project-view issue close/reopen against the GraphQL quota. Fixes #28767 * test(github): drop redundant Date.now() args in graphql breaker test Keeps the flaky-test-pattern ratchet at its baseline. --------- Co-authored-by: Neil <neil@stably.ai> |
||
 yzxcj797andNeil
|
9105ade917 |
docs: fix dead Goose and Continue quickstart links (#14574)
The Goose (block.github.io/goose/docs/quickstart/) and Continue (docs.continue.dev/guides/cli) links 404. Point them at goose-docs.ai/docs/quickstart/ and docs.continue.dev/cli/quickstart in the READMEs, the supported-agents docs page, and the in-app agent catalog. Co-authored-by: Neil <neil@stably.ai> |
||
    
|
b62f9bf624 |
feat(i18n): add Traditional Chinese (zh-Hant) UI locale (#29795)
* feat(i18n): add Traditional Chinese (zh-Hant) UI locale Adds 繁體中文 as a selectable UI language and derives its catalog from zh.json rather than translating English afresh, so the reviewed Simplified terminology and Orca glossary decisions carry over. The conversion needed three corrections beyond OpenCC's `cn -> twp`: - One pass only. `twp`'s phrase dictionary is not idempotent (it maps 進程->程序 and 程序->程式), and iterating to a fixed point makes output worse: it rewrites the correct Taiwan 游標 to 遊標, and 程序 to 程式 where the source meant an OS process. - 16 terms where `twp` emits a form Taiwan does not use, each confirmed against Microsoft's VS Code zh-Hant language pack (許可權 0 vs 權限 84, 賬戶 0 vs 帳戶 111, and so on). - 進程 vs 程序 collapse in `twp` output. Taiwan calls an OS process 行程, so the generator consults the Simplified source to disambiguate; daemon copy reads 守護行程, not 守護程式. Also pins `load: 'currentOnly'` on both i18next instances. i18next's default expands `zh-Hant` into ['zh-Hant', 'zh', 'en'], so a key missing from the Traditional catalog would silently render Simplified. zh-Hant.json is generated and compared byte-for-byte, so the new check is wired into verify:localization-catalogs to fail when a Simplified edit skips regeneration. Refs #10592 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(i18n): fail the zh-Hant check on an unreadable zh.json The generator caught every error from reading and parsing zh.json, so a malformed or unreadable Simplified catalog logged "absent here" and exited 0 without ever comparing the generated Traditional catalog. Only ENOENT means there is nothing to derive, so every other failure now propagates. Tests cover the three paths the catch was conflating: an absent zh.json still passes for the combined verifier's synthetic fixtures, malformed JSON throws, and a directory where the catalog belongs throws EISDIR rather than reporting the file as missing. Co-Authored-By: Claude Code <noreply@anthropic.com> * feat(i18n): ship Traditional Chinese (Taiwan) as a maintained built-in catalog Keeps the zh-Hant locale from this PR and makes it a hand-maintained catalog like the other built-ins, without the OpenCC generator: - Catalog reconciled with current en.json. Per key it prefers the Taiwan-reviewed copy from #22402 (which carries #14223), falls back to the zh-derived copy here, and drops entries whose English changed. A review pass then applied Taiwan terms (代理程式, 工作階段, 存放庫, 分頁, 列/欄) and 「」 quotes. Glossary: config/i18n-traditional-chinese.md. - Label 繁體中文（台灣）in every catalog, the picker, onboarding and search. - Detection maps zh-TW/zh-HK/zh-MO/zh-Hant* to zh-Hant; zh-CN/zh-SG/zh-Hans stay on zh. Both i18next instances use load: 'currentOnly' so missing keys fall back to English, not Simplified. - Drops opencc-js, the generator scripts and their verify hook. Co-authored-by: hungchihsueh <84211143+hungchihsueh@users.noreply.github.com> Co-authored-by: chilung-cgu <b0423031@gmail.com> * feat(i18n): translate remaining Traditional Chinese (Taiwan) catalog keys Fill the 2,043 keys added to en since the source PRs branched, following the Taiwan glossary, and extend the glossary with skill, automation, usage, review, token and related terms. * fix(i18n): review Traditional Chinese (Taiwan) catalog wording Apply 629 reviewed corrections across the full catalog: 30 meaning or untranslated-text fixes and 599 glossary and phrasing fixes (終端機, 用量, API 金鑰, clearer counts and actions). Each edit was cross-checked by an independent review pass. * fix(i18n): polish sampled zh-Hant strings and drop redundant locale test Co-authored-by: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> Co-authored-by: hungchihsueh <84211143+hungchihsueh@users.noreply.github.com> Co-authored-by: chilung-cgu <b0423031@gmail.com> |
||
 Brennan Benson
|
74a2ee5337 | docs(cli): explain automation prechecks and folder workspace removal (#34523) | ||
 OrcaWinandOrcaWin
|
2e0ba4e4de |
fix(i18n): translate missing ko/ja/es/fr/pt UI strings (#34643)
* fix(i18n): translate missing ko/ja/es/fr/pt UI strings Fill every en.json key missing from the ko, ja, es, fr and pt catalogs (293 ko/es/fr, 244 ja, 316 pt leaves; purely additive). The provider credit-balance status-bar keys stay sparse per provider-credit-balance-locales.test.ts, and zh is left to #34478. Also list Français and Português (Brasil) in the Settings docs. Closes #34513 * fix(i18n): keep goal-change failure wording in English until reviewed --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
 berceandNeil
|
9e8c601861 |
docs(hibernation): describe per-pane reclaim and per-tab foreground protection (#33983)
Automatic hibernation checks and stops each agent pane on its own and only protects terminal tabs that are visible on screen, so other tabs in the active worktree can still sleep. Update the hibernation page to match: drop the "hibernate together as a unit" claim, scope the foreground rule to visible tabs (active tab, other split groups, Activity page), separate manual whole-worktree sleep from automatic per-pane reclaim, and describe resume as happening when you return to the agent's tab. Fixes #33940 Co-authored-by: Neil <neil@stably.ai> |
||
 Seiji KoharaandNeil
|
2327180d12 |
feat(quit): add Quit and Stop All Sessions to the app menu and tray (#32153)
* feat(quit): add Quit and Stop All Sessions to the app menu and tray Quit keeps daemon sessions alive for warm reattach. The new item, placed directly above Quit in the macOS app menu and menu bar icon, the Windows File menu and tray, and the Linux File menu, asks for confirmation, runs Settings' Kill all sessions in the renderer, and quits only when every session stopped. Closing the tabs first means nothing reopens or resumes on the next launch. Serve hosts do not offer the item. * fix(quit): keep Orca open when Kill all cannot prove every session stopped - Kill all no longer reads a daemon generation that failed to list as "no sessions": a failed poll keeps the last confirmed remaining set, and a failed initial listing sets listingIncomplete. - Quit and Stop All Sessions stays open on an incomplete listing or a terminal tab opened during the sweep, logs why it stayed open, and reveals the window before the final quit. - Share the main-window message box helper, stub the request on the web client, and add Portuguese strings. - Cover the windowless path, request expiry, the in-flight guard, and failed listings in tests; bound the E2E exit wait. * fix(terminal): count Kill all per daemon generation within a time window - A poll updates only the daemon generations that answered, so one failing generation no longer hides the kills of the others. - Poll for 6.5 s of wall-clock time instead of 65 attempts, because a wedged generation fails each listing only at the request timeout. - Flag a sweep with no daemon provider as listingIncomplete. - Log the leftover-tab exit, share the one-shot window intent with Open Settings, and cover the sender check, the reveal before the final quit, and retries in tests. * fix(quit): stay open while a newer build's daemon is held - Set listingIncomplete while this build holds a newer protocol's daemon, whose sessions it can neither list nor stop. - Reuse getDaemonAdapters in Kill all, type the shared one-shot helper by its flag factory, and move the app-menu quit handlers next to the tray options so both serve/desktop splits are tested. - Cover a quit that outlasts the request expiry and a failed request pull, and fix the docs lead-in for the new quit-time case. * fix(quit): explain, without stopping anything, while a newer version runs terminals - Check the newer-version daemon hold before the confirmation and show an explanation instead, so Kill all no longer closes every tab and then refuses. listingIncomplete stays as the backstop. - Translate the explanation, describe listingIncomplete generically, and assert the single timed-out poll in the Kill all test. * fix(quit): explain before asking whenever Kill all cannot list every session - Show the explanation instead of the confirmation while the daemon provider is missing (still starting or failed) as well as while a newer version's daemon is held. - Name only the steps that work (wait for terminals to open, reopen a terminal opened in a newer version), avoid stating a hold as fact, and label the dialog's button through the catalog. * fix(quit): add the relaunch step to the explanation and align the ja wording * test(pty): keep a confirmed stop when its generation fails a later poll * test(quit): give the E2E timeout bump its reason * fix(quit): stay open when the daemon still lists a session after Kill all Kill all counts only the sessions of its first listing, so a session started since then, for example from the CLI or an automation before its tab reaches the renderer, would outlive the quit. Main now lists every daemon generation again before quitting, and quits only after a listing in which every generation answers and none lists a session. It polls within Kill all's 6.5 s window so the tab sweep's PTY shutdowns can finish; otherwise the renderer shows the existing error and Orca stays open. ui:quitAfterStoppingAllSessions becomes an invoke that answers whether main quits. * feat(quit): rename to Quit Completely with a macOS hover hint, and explain plain Quit in the confirmation * fix(quit): show progress while Quit Completely runs, and refuse at once when the daemon can't be fully listed --------- Co-authored-by: Neil <neil@stably.ai> |
||
 Neil
|
3414917b70 |
docs(codex): explain wrapper scripts that force CODEX_HOME (#34319)
Refs #19598 |
||
 Samuel VilaandBrennan Benson
|
161927f562 |
fix(native-chat): make the Chat UI ⇄ terminal shortcut a remappable keybinding (#31679)
* fix(native-chat): make the chat view toggle a remappable keybinding The terminal and Chat UI toggle was hardcoded to Mod+Shift+J, so users could not rebind or disable it, Settings did not list it, and it overrode user bindings on that chord. Declare it as terminal.toggleNativeChat in the keybinding registry, match it through the user's keybindings, and render its menu labels from the registry. * fix(keybindings): align native chat toggle admission and execution * fix(keybindings): preserve runtime input and defer closed menu hints * test(keybindings): use typed alias read instrumentation * Fix keybinding dependency direction and physical modifier inputs * Preserve typed input facts in floating shortcut arbitration * Clarify native chat shortcut precedence on Windows and Linux * Simplify native chat shortcut resolution and nominal labels --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> |
||
 NeilandZrzzzz
|
a1c6e1273d |
Continue remote CLI conversations in Chat UI on paired servers (#33954)
* Enable continuing remote CLI conversations in Chat UI * fix(native-chat): send the host's own pane key; ask older hosts to update On a paired host the desktop names a pane by its mirrored surface key, but the host matches cliSource against its own agent-status rows, so every remote "Continue in Chat UI" create was refused as unreadable. Translate the key with toHostSessionPaneKey before sending. A resume launch's join identity now includes its execution host, so a remote resume never joins an in-flight resume of the same conversation id on another host. A verified host that lacks resume-history now shows the pane-header action disabled, with "Update Orca on this host to continue in Chat UI." in its tooltip and accessible name, instead of hiding it. --------- Co-authored-by: Zrzzzz <1160026659@qq.com> |
||
 Wooseong KimandNeil
|
5b1e387895 |
docs: use the full stablyai/orca/orca cask name and warn that bare orca is Plotly (#14777)
Bare `brew upgrade --cask orca` resolves to the unrelated, disabled Plotly cask in homebrew-cask. Add a warning and a qualified upgrade line to the README install blocks (all locales) and qualify the upgrade command on the docs site install page. Fixes #14591 Co-authored-by: Neil <neil@stably.ai> |
||
 Neilandzerone0x
|
4fda57bb11 |
feat(open-in): open SSH workspaces in Cursor and Zed (#33877)
* feat(open-in): open SSH workspaces in Cursor and Zed Cursor shares VS Code's Remote-SSH argv and now opens SSH and SSH-reached server workspaces the same way, in a new window like its local launch. Zed opens them through its ssh://[user@]host[:port]/path URL, so manual custom-port hosts work without a local SSH config alias. Co-authored-by: zerone0x <soberzml2333@gmail.com> * fix(open-in): keep manual Zed targets on their saved route Always send the saved port for manual targets so a matching ssh config Port cannot redirect them, ask for an ssh config alias when a manual host needs a key, agent or proxy the URL cannot carry, reject option-like hosts, and accept the zeditor CLI name. * refactor(open-in): move the remote SSH editor launch into its own module Keeps external-editor-launch.ts under the max-lines limit after the main merge, and moves main's new macOS CLI fallback test onto the remote launch API. --------- Co-authored-by: zerone0x <soberzml2333@gmail.com> |
||
|
Neil
|
639d52952d |
feat(ssh): per-host Reconnect on launch toggle (#33935)
* feat(ssh): per-host Reconnect on launch toggle A host with Reconnect on launch turned off starts each launch as if the user had disconnected it: main records the session user-disconnect for it and the managed servers reached through it, so neither the startup restore, pane mounts nor managed-server calls dial it until the user connects it. The renderer also skips it in the startup restore. The switch lives in Settings -> SSH -> Advanced for hosts this desktop dials; undefined keeps today's behaviour. * fix(ssh): hold opted-out hosts before server status probes start Server status probes start inside registerCoreHandlers, before the SSH handlers register, so hold launch opt-outs right before it (once per process). Relay-era panes that hit a held host now wait for Connect instead of reporting a failed connect. |
||
 eatmoreduckandNeil
|
15fc7a6769 |
docs(settings): describe the GitHub integration as the local gh CLI login, not OAuth (#26609)
Orca has no OAuth app; it reads tokens from the gh CLI on the machine running Orca. Document that, the per-host login for Remote Orca Servers, and the repo/read:org/project scopes auth-diagnose expects. Refs #26604 Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com> |
||
|
Neil
|
2c0c6ac0c4 |
docs: stop promising cross-worktree split panes and Shift-Enter split in Jump Palette (#33902)
Panes are scoped to a single worktree and the Jump Palette has no Shift-Enter handler, so replace those promises with the real flow: watch sidebar status indicators and jump between worktrees with Cmd-J (macOS) / Ctrl-Shift-J (Windows / Linux). Fixes #10477 |
||
|
Neil
|
33ddab70b7 |
feat(serve): keep macOS serve out of the Dock and opt in to the GPU on Linux (#33878)
* feat(serve): keep macOS serve out of the Dock and opt in to the GPU on Linux On macOS, orca serve now runs as an accessory app with no Dock icon or Cmd-Tab entry, and gets them back only while it hosts a desktop window. On Linux, ORCA_SERVE_GPU=1 keeps hardware acceleration on for hosts that expose a GPU to the server. * fix(serve): restore the Dock only for real launches, after window services resolve Gate the restore on any background or E2E launch, since dock.show() activates the app, and run it just before the window is created so a services failure cannot leave a windowless Dock tile. Say in the docs what the GPU opt-in can't do on Orca's own Xvfb. |
||
|
Neil
|
5d6a110706 |
fix(sharing): name a headless host's missing sharing service instead of the device setting (#33754)
Part of #33593 |
||
  JinjingandLuca Critelli
|
7423928beb |
Open browser links beside their source (#32907)
* Open links beside their source and reuse matching browser pages - Preserve source-group placement across terminal, chat, file, and runtime links - Add explicit “Open in this group” actions with safe refusal handling - Match browser pages by host, session, resource, and exact page identity * Preserve file link ownership when opening beside source * Isolate browser link sessions by workspace profile * Wait for browser tabs to render before activating links * Respect explicit group requests when opening detected files * Preserve legacy link ownership when opening browser tabs * Clean up unactivated browser tabs after failed link opens * Reveal routed browser links without stealing focus * Preserve browser profile reuse and foreground ownership during link open * Prefer visible browser panes and reuse exact link destinations Reuse matching pages within the same workspace, execution host and browser profile. Otherwise open in the focused or most recently used visible browser, or create a split beside the source when no browser is visible. Keep explicit group placement and background/focus ownership protections. Incorporate visible-browser selection and popup routing from #22686 into #32907, including selector regression coverage. Co-authored-by: Luca Critelli <lucacri@gmail.com> * Route browser links by workspace without reading global focus * Validate SSH browser ownership before opening links * fix branch file size limit * fix(ci): track extracted browser link ratchet entries * fix(test): follow source-aware browser link opening --------- Co-authored-by: Luca Critelli <lucacri@gmail.com> |
||
|
OrcaWinandOrcaWin
|
2a28fc7d4e |
[comment audit] Finish launcher and configuration comment review (#33513)
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
OrcaWinandOrcaWin
|
7d6603aa17 |
[comment audit] Complete repository-wide comment cleanup (#33249)
* [comment audit] Align legacy failure-read counts with cached display * [comment audit] Condense shared provider lifecycle and browser recovery comments [skip ci] * [comment audit] Condense shared generation, path and preview comments [skip ci] * [comment audit] Condense host, file and Git contract rationale [skip ci] * [comment audit] Tighten Git lifecycle and provider contract comments [skip ci] * [comment audit] Clarify shared host authority and launch isolation [skip ci] * [comment audit] simplify local access mobile and native chat contracts [skip ci] * [comment audit] simplify native chat presentation and state contracts [skip ci] * [comment audit] simplify native runtime and provider contracts [skip ci] * [comment audit] simplify migration and orchestration contracts [skip ci] * [comment audit] simplify plugin trust and process capture rationale [skip ci] * [comment audit] simplify terminal delivery and remote compatibility rationale [skip ci] * [comment audit] clarify remote recovery and launch wire rationale [skip ci] * [comment audit] shorten shared RPC compatibility and runtime evidence comments [skip ci] * [comment audit] simplify secure storage shell startup and sidebar rationale [skip ci] * [comment audit] clarify sidebar, skill and SSH invariants [skip ci] * [comment audit] condense structured chat delivery and timing rationale [skip ci] * [comment audit] condense terminal replay and telemetry invariants [skip ci] * [comment audit] clarify launch permission and terminal delivery rationale [skip ci] * [comment audit] clarify workspace ownership and layout contracts [skip ci] * [comment audit] wait for fitted and painted SSH terminal links * [comment audit] clarify layout persistence and session ownership [skip ci] * [comment audit] clarify host routing and workspace lifecycle contracts [skip ci] * [comment audit] clarify startup persistence and app lifetime comments [skip ci] * [comment audit] clarify recovery and activity boundaries [skip ci] * [comment audit] condense activity and artifact invariants [skip ci] * [comment audit] condense automation authority contracts [skip ci] * [comment audit] simplify automation scheduling and history contracts [skip ci] * [comment audit] clarify browser chrome and annotation lifecycles [skip ci] * [comment audit] clarify browser routing and retained guest ownership [skip ci] * [comment audit] clarify browser recovery and document ownership comments [skip ci] * [comment audit] restore hosted runners required by native IME fixtures * [comment audit] shorten preview, palette and dashboard invariants [skip ci] * [comment audit] clarify terminal preview, dashboard and retention comments [skip ci] * [comment audit] clarify diff-note recovery and editor lifecycle comments [skip ci] * [comment audit] shorten rich-text and combined-diff ownership comments [skip ci] * [comment audit] shorten autosave, draft recovery and model ownership comments [skip ci] * [comment audit] shorten save-queue, notebook and Markdown constraints [skip ci] * [comment audit] shorten Monaco, PDF and rich Markdown safeguards [skip ci] * [comment audit] clarify rich Markdown source and selection safeguards [skip ci] * [comment audit] clarify editor loading and emulator stream lifetimes [skip ci] * [comment audit] trim emulator and feature tour narration [skip ci] * [comment audit] clarify floating workspace and GitHub cache ownership [skip ci] * [comment audit] trim provider controls and Linear filter explanations [skip ci] * [comment audit] clarify pairing and chat resume lifetimes [skip ci] * [comment audit] clarify chat delivery and transcript lifetimes [skip ci] * [comment audit] clarify session options and host-owned status [skip ci] * [comment audit] clarify draft durability and live-status precedence [skip ci] * [comment audit] Trim chat send and model ownership explanations [skip ci] * [comment audit] Shorten transcript ownership and send recovery comments [skip ci] * [comment audit] Simplify native chat composer and transcript hook comments [skip ci] * [comment audit] Shorten native chat scroll and structured session explanations [skip ci] * [comment audit] Trim workspace picker and onboarding commentary [skip ci] * [comment audit] Simplify pet rendering, review cache and quick open comments [skip ci] * [comment audit] Trim sidebar and session history explanations [skip ci] * [comment audit] Condense session resume and review checks comments [skip ci] * [comment audit] Shorten checks state and file explorer refresh comments [skip ci] * [comment audit] Trim plugin bridge and source-control action rationale [skip ci] * [comment audit] Trim source-control listing and review rationale [skip ci] * [comment audit] Shorten sidebar lifecycle and explorer safeguards [skip ci] * [comment audit] Condense Settings account and appearance rationale [skip ci] * [comment audit] Trim pairing and repository Settings explanations [skip ci] * [comment audit] Condense Settings search SSH and terminal safeguards [skip ci] * [comment audit] Shorten Settings voice and provider ownership comments [skip ci] * [comment audit] Condense Settings draft persistence and host-state rationale [skip ci] * [comment audit] Trim Settings hooks and sidebar setup rationale [skip ci] * [comment audit] Condense sidebar deletion and board-filter safeguards [skip ci] * [comment audit] Condense worktree cards, host ownership and Markdown contracts [skip ci] * [comment audit] Condense sidebar drag, folder and filtering contracts [skip ci] * [comment audit] Condense sidebar parity, sleep and host ownership contracts [skip ci] * [comment audit] Prune focus-read baseline after comment cleanup * [comment audit] Clarify sidebar visibility, board drops and agent evidence [skip ci] * [comment audit] Tighten sidebar listing, drag and reveal contracts [skip ci] * [comment audit] Clarify viewport geometry and skill update safeguards [skip ci] * [comment audit] Tighten skill inventory, usage and host status comments [skip ci] * [comment audit] Clarify usage ownership and resource kill safeguards [skip ci] * [comment audit] Tighten tab selection, rename and search contracts [skip ci] * [comment audit] Tighten tab-strip geometry and drag ownership comments [skip ci] * [comment audit] Tighten Tasks recovery, pagination and mutation comments [skip ci] * [comment audit] Tighten provider loading and terminal recovery comments [skip ci] * [comment audit] Tighten completion, cadence and PTY ownership comments [skip ci] * [comment audit] Clarify terminal restore and parked-pane boundaries [skip ci] * [comment audit] Tighten PTY startup and replay explanations [skip ci] * [comment audit] Clarify PTY identity and delivery ownership [skip ci] * [comment audit] Shorten remote reconnect and input replay rationale [skip ci] * [comment audit] Condense terminal parking clipboard and file link comments [skip ci] * [comment audit] Clarify IME ownership and trim trace history [skip ci] * [comment audit] Shorten pane recovery and parked watcher explanations [skip ci] * [comment audit] Condense snapshot replay and visibility recovery rationale [skip ci] * [comment audit] Shorten terminal parking and keyboard ownership rationale [skip ci] * [comment audit] Trim renderer lifecycle and menu rationale [skip ci] * [comment audit] Condense workspace cleanup ownership and settlement notes [skip ci] * [comment audit] Clarify renderer hook evidence and source ownership [skip ci] * [comment audit] Tighten IPC ownership and reconnect explanations [skip ci] * [comment audit] Trim renderer focus, paste and attention comments [skip ci] * [comment audit] Shorten scroll, locale and agent lifecycle comments [skip ci] * [comment audit] Trim agent launch, resume and ownership commentary [skip ci] * [comment audit] Shorten account, browser and editor comments [skip ci] * [comment audit] Clarify host-mirror waits, previews and input ownership [skip ci] * [comment audit] Condense launch recovery and editor tokenization comments [skip ci] * [comment audit] Condense workspace selection and terminal pane rationale [skip ci] * [comment audit] Condense terminal fitting and rendering recovery comments [skip ci] * [comment audit] Condense terminal input and host routing explanations [skip ci] * [comment audit] Condense ownership and sleeping-session recovery rationale [skip ci] * [comment audit] Condense structured launch and terminal link explanations [skip ci] * [comment audit] Condense terminal ownership and workspace file routing rationale [skip ci] * [comment audit] Condense session persistence and workspace activation rationale [skip ci] * [comment audit] Condense workspace routing and browser ownership rationale [skip ci] * [comment audit] Condense mirror recovery and layout authority rationale [skip ci] * [comment audit] Condense runtime transport and file safety rationale [skip ci] * [comment audit] Condense runtime graph and structured session rationale [skip ci] * [comment audit] Condense browser creation and remote tab recovery rationale [skip ci] * [comment audit] Condense snapshot authority and publisher recovery rationale [skip ci] * [comment audit] Condense frame, startup and provider cache rationale [skip ci] * [comment audit] Condense host twin and agent lifecycle rationale [skip ci] * [comment audit] Condense browser authority and editor cleanup rationale [skip ci] * [comment audit] Condense editor buffer identity and review cache rationale [skip ci] * [comment audit] Condense provider lifetime and repository ownership rationale [skip ci] * [comment audit] Condense reconnect, hydration and terminal retirement rationale [skip ci] * [comment audit] Condense recovery, reconciliation and persistence rationale [skip ci] * [comment audit] Condense cleanup ownership and listing admission rationale [skip ci] * [comment audit] Condense teardown ordering and terminal ownership rationale [skip ci] * [comment audit] Condense recovery ledger and web host-boundary rationale [skip ci] * [comment audit] Condense web reconnect and credential lifecycle rationale [skip ci] * [comment audit] Condense cloud rollout and assignment safety rationale [skip ci] * [comment audit] Condense relay session and database recovery rationale [skip ci] * [comment audit] Condense relay placement and protocol compatibility rationale [skip ci] * [comment audit] Condense build and packaging constraints [skip ci] * [comment audit] Condense CI gates and validation isolation rationale [skip ci] * [comment audit] Condense catalog identity and browser validation rationale [skip ci] * [comment audit] Condense mobile browser and frame-budget rationale [skip ci] * [comment audit] Shorten mobile route and browser test explanations [skip ci] * [comment audit] Condense editor and session seam test rationale [skip ci] * [comment audit] Trim session and terminal closure history [skip ci] * [comment audit] Shorten terminal browser and census explanations [skip ci] * [comment audit] Preserve root-only E2E diagnostic baseline * [comment audit] Condense mobile seam and HTML preview test rationale [skip ci] * [comment audit] Condense preview instrumentation and render harness rationale [skip ci] * [comment audit] Condense bundle contracts and native-build constraints [skip ci] * [comment audit] Shorten native packaging and CI routing rationale [skip ci] * [comment audit] Condense release tooling and benchmark constraints [skip ci] * [comment audit] Condense packaging and platform gate rationale [skip ci] * [comment audit] Shorten mobile route and history rationale [skip ci] * [comment audit] Condense mobile browser and component rationale [skip ci] * [comment audit] Shorten drawer and workspace-form rationale [skip ci] * [comment audit] Trim mobile review and editor-document explanations [skip ci] * [comment audit] Condense editor lifecycle and Markdown explanations [skip ci] * [comment audit] Trim mobile file, diagnostics and dictation commentary [skip ci] * [comment audit] Simplify mobile host-list and workspace-view explanations [skip ci] * [comment audit] Clarify mobile shell lifetime and bridge delivery constraints [skip ci] * [comment audit] Condense bridge stream, native request and audio rationale [skip ci] * [comment audit] Reduce bridge schema and page-client commentary [skip ci] * [comment audit] Tighten mobile page bridge contracts [skip ci] * [comment audit] Clarify mobile cache and session constraints [skip ci] * [comment audit] Condense mobile route and lifecycle rationale [skip ci] * [comment audit] Tighten mobile shell hook timing rationale [skip ci] * [comment audit] Clarify route handoff and notification compatibility [skip ci] * [comment audit] Clarify push registration and dictation cleanup constraints [skip ci] * [comment audit] Condense keyboard geometry and native media ownership rationale [skip ci] * [comment audit] Tighten mobile chat scroll and composer concurrency rationale [skip ci] * [comment audit] Condense mobile reply compatibility and upload ownership rationale [skip ci] * [comment audit] Condense optimistic echo and scroll ownership rationale [skip ci] * [comment audit] Tighten stream replay and queued session ownership rationale [skip ci] * [comment audit] Condense mobile composer and reply-schema constraints [skip ci] * [comment audit] Clarify mobile transcript recovery and session ownership [skip ci] * [comment audit] Clarify mobile queue and source-control compatibility [skip ci] * [comment audit] Condense storage and task launch constraints [skip ci] * [comment audit] Clarify task schemas and terminal document ownership [skip ci] * [comment audit] Tighten terminal input and viewport rationale [skip ci] * [comment audit] Shorten terminal and RPC recorder contracts [skip ci] * [comment audit] Condense recorder engine and connection contracts [skip ci] * [comment audit] Shorten host credential and relay recovery comments [skip ci] * [comment audit] Tighten pairing recovery and bundle transport rationale [skip ci] * [comment audit] Clarify RPC delivery and workspace catalog boundaries [skip ci] * [comment audit] Condense catalog and relay entry contracts [skip ci] * [comment audit] Shorten shutdown and SSH relay delivery contracts [skip ci] * [comment audit] Condense WSL relay and E2E regression rationale [skip ci] * [comment audit] Shorten cross-version harness and renderer fixture explanations [skip ci] * [comment audit] Condense paired-host and E2E lifecycle rationale [skip ci] * [comment audit] Shorten layout oracle and regression explanations [skip ci] * [comment audit] Condense paired recovery and ownership regression contracts [skip ci] * [comment audit] Shorten restart, sidebar and SSH lifecycle contracts [skip ci] * [comment audit] Condense terminal rendering and IME regression rationale [skip ci] * [comment audit] Shorten terminal recovery and benchmark contracts [skip ci] * [comment audit] Condense tooling and Windows lifecycle proof rationale [skip ci] * [comment audit] Condense workflow routing and release rationale [skip ci] * [comment audit] Condense mobile security and installer contracts [skip ci] * [comment audit] Shorten native rationale and stylesheet workarounds [skip ci] * [comment audit] Shorten Windows visibility probe rationale [skip ci] * [comment audit] Condense embedded release and signing rationale [skip ci] * [comment audit] Retain current main test behavior in final reconciliation [skip ci] * [comment audit] Complete final comment review across current source inventory * [comment audit] Handle consolidated audit reports before final CI * [comment audit] Preserve credential storage census detail [skip ci] * [comment audit] Scale broad changed E2E selections with verified timing shards * [comment audit] Align E2E assertions with browser close and settled session metadata * [comment audit] Match existing E2Es to current resource and windowing contracts * [comment audit] Observe the shared server outage notice in reconnect coverage * [comment audit] Make existing renderer probes measure settled tab and PTY work * [comment audit] Align palette E2E selector with task search * [comment audit] Refresh remaining palette search selectors * [comment audit] Keep selector correction within selected audit specs * [comment audit] Await emoji fixture settings inside renderer evaluation * [comment audit] Cancel fixture fit retries between terminal tests --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
cedce2aa9f |
feat(cli): add orca ports to list a workspace's detected ports (#33016)
* feat(cli): add orca ports to list a workspace's detected ports Scripts and agents had no way to read the ports Orca already detects for a workspace, so finding a dev server on a random port meant redoing the lsof scan by hand. `orca ports` reuses the host-scoped workspacePorts.scanHost RPC, keeps the rows owned by the current (or --worktree) workspace, and prints port, pid, process, connect host, protocol, how the owner was matched, and the advertised URL. --all shows every listener on that host. An older runtime without scanHost gets an "update Orca" error instead of a raw method_not_found. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): resolve folder workspaces in orca ports and match rows by path Run inside a native folder, `orca ports` failed with selector_not_found (or picked an enclosing git worktree) because it only searched the worktree list. It now resolves the cwd like `agent launch`, native folders first, and shows that host's listeners. Rows are matched on the owner's path instead of its id, so every instance of a repo-backed folder workspace keeps its ports even though attribution names only the first instance as owner. `--all` adds the worktree id when two owners share a display name, and the skill guide notes that only workspace rows carry `owner` and `advertisedUrl`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): refuse orca ports for folder workspaces without --all; document the command Co-authored-by: Manuel Meurer <manuel@meurer.io> * fix(cli): recognise native folder path selectors in orca ports; note SSH scan limits Co-authored-by: Manuel Meurer <manuel@meurer.io> * fix(cli): refuse a folder path shared by several folder workspaces in orca ports Co-authored-by: Manuel Meurer <manuel@meurer.io> * fix(cli): refuse a path a worktree and a folder workspace share in orca ports Co-authored-by: Manuel Meurer <manuel@meurer.io> --------- Co-authored-by: Manuel Meurer <manuel@meurer.io> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Neil
|
18d25591f9 |
fix(deps): resolve body-parser and happy-dom security findings (#32983)
* fix(deps): resolve body-parser and happy-dom security findings * test(mobile): await rich markdown effect cleanup |
||
|
Neil
|
ec5cfbad37 | fix(deps): patch vulnerable Zod collections in mobile and docs (#32941) | ||
|
OrcaWin
|
914b260fa6 | fix(deps): resolve security advisories across desktop, mobile, and docs (#32326) | ||
|
OrcaWinandOrcaWin
|
8f6283b32b |
test: exercise real boundaries and trim redundant cases (#32353)
* test: replace redundant checks with observed behavior * docs: reconcile completed audit batches and upstream review --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> |
||
|
NeilandBrennan Benson
|
d9dc87b2fb |
Use incremental tsrs locally and update Bun to 1.4.4 (#32276)
* Use incremental tsrs for local typechecks * Update pinned Bun to 1.4.4 * fix(deps): bump dompurify to 3.4.17 and docs next to 16.4.1 for security advisories dompurify 3.4.17 patches GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr and GHSA-c6gr-qvv4-5v3f in the root and mobile lockfiles. next 16.4.1 patches GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr and GHSA-p3m5-59mp-jv5r in the docs site. * Prepare mobile bundle for smoke benchmarks * Give native compiler benchmarks a larger ARM runner --------- Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com> |
||
|
Jinjing
|
3f7b34106a |
Refine Agent Dashboard lifecycle handling (#32172)
* Track Agent Dashboard adoption and daily visible use - Record enablement, board opens, and per-surface daily visibility - Persist daily limits across restarts and respect consent and window visibility * Track dashboard telemetry at surface roots |
||
|
NeilandClaude
|
6bbc8e2b96 |
docs(chat): explain structured sessions and conversation handoffs (#32063)
* docs(chat): explain structured sessions and conversation handoffs * docs(chat): distinguish copy handoffs from in-place view switches Same labels mean different things by surface: tab/header Continue in Chat UI opens a new structured chat, while the terminal-pane context menu toggles the transcript view in place. Scope composer live-value routing by session type. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
 Jinwoo Hong
|
d3dbd9683f |
Update Orca's skills with Orca's own installer instead of npx skills (#31688)
* Add Orca's own bundled-skill planner and installer (not wired in yet) One planner decides what installing Orca's bundled skills does to each target folder; execute re-plans under per-path locks and runs only a plan whose digest still matches; a shared summary derives badge, wording and exit code. A copy counts as Orca's untouched one only when its SKILL.md bytes match a version some build shipped (resources/skills/released-digests.json, generated from git history and checked add-only). Nothing calls this yet; the npx path is unchanged. * Report left-alone folders as warnings and keep backups in the home A leave is no longer a failure: the outcome line says what happened plus "N left alone: <reason>", and the exit code is 1 only for a failed or changed op. Backups for every scope go to <home>/.agents/.orca-skill-backups on the executing host, so a project Replace never writes into the repo; moving there falls back to copy, verify, then remove across filesystems. * Update Orca's skills with Orca's own installer instead of npx skills The app's Update skills dialog, badge, nudge and status pills now read the bundled-skill plan and summary, and Update executes the reviewed plan's digest. `orca skills install|update` runs the same planner in-process with --dry-run, --force, --json and per-summary exit codes. Removes both npx spawn sites, the freshness inventory modules and the npx round-trip CI. * Update only where the skill already is; one provider-root rule for app and CLI installedOnly now drops every location that holds nothing (keeping the shared slot only when an existing agent link points at it), so Update never adds a skill for another agent. The app and CLI resolve the Claude skills folder through the same rule in localBundledSkillInput; a test asserts both plan identically. * Compact Update skills dialog: one row per skill, locations named by agent summarizeBundledSkillPlan now returns each skill's locations, labelled by agent (or "Shared folder") with a ~-collapsed path; the dialog shows one row per skill that needs something, collapses up-to-date skills into one line, and lists every location behind "Show all locations". The result reads "Updated N skills · M left alone". Under installedOnly a Replace with no shared copy replaces in place instead of adding one. * fix(skills): keep location paths readable by putting the state under the path * fix(skills): hold the last plan in state, not a ref mutated during render Split the update dialog's rows, headline and footer into components, move the Update label next to the other plan copy, and use z.strictObject for the request schemas. * Escape non-ASCII characters in bundled-skill regex and wording The orcad bundle rejects a literal non-ASCII character in a regex. * fix(cli): escape non-ASCII apostrophes in the skills install help text * test(orcad): check the bundled CLI plans a skill install without npx Drop the deleted roundtrip workflow's group from the closed-PR cancellation fixture. * Make bundled-skill test fixtures link folders the way the product does on Windows Directory links in fixtures are junctions on Windows, which need no Developer Mode; the one file-link fixture is skipped there. * Resolve legacy skill agent keys canonically * Reject stale skill replacements when auxiliary content changes * Keep ordinary bundled skill classification shallow * Leave unreadable skill replacements alone without aborting plans * Pass force-all through shallow planning and describe unreadable copies * Clarify skill update statuses and folder details * Keep selected skill replacements in place with one status * Report completed skill replacements with their backup confirmation * Clarify available skill updates and skipped copies * Keep skill update results in preview order * Show each skill skip reason once * Count skipped skills instead of skipped folders * Make installer input and link tests work on Windows * Bound bundled skill classification reads and parse names linearly * Keep workspace skill roots inside the resolved workspace * Compare workspace skill roots with native path semantics * Restrict bundled skill backups to their owner on POSIX * Keep recovered skills needing attention until they are updated * Count completed skill updates in the status tooltip * Sync the runtime localization catalog |
||
|
Jinjing
|
8fc1698ebb |
Add Resource Manager PTY inventory and checked terminal termination (#31593)
* feat(resources): end local terminals with checked identity checks - Add a PTYs view to the Resource Manager that lists local terminals and can end one. Before stopping, the host confirms the terminal's incarnation, agent ownership, and attachments. This prevents ending a same-ID replacement that started after the list was read. - Bump the daemon protocol to v50 and gate the new fenced kill on it. Older daemons ignore the extra fields, so the client refuses End instead of sending an unchecked kill. - Admit diagnostic reads (PTY listing and memory snapshot) only while the Resources view is visible, so a hidden window does no background scanning. - Report incarnation and host on spawn and exit events so the renderer can match them to the terminal it showed. - Replace the popover's terminal-session list with the new inventory and move memory polling into the Resources view. * Show unrouted daemon PTYs in the Resource Manager * Simplify PTY controls and clarify safe termination * Format local build compatibility protocol lists * Add PTY resource management localization strings * Harden PTY resource manager test fixtures * Use typed IPC event in PTY kill test fixture * Refine local PTY resource view model typing * Refine local PTY resource view model typing * Include local host identity in PTY lifecycle event tests |
||
|
Neil
|
7ff3a071c6 | fix(docs): avoid backtracking in excerpt link destinations (#31884) | ||
|
Neil
|
5f50b95c9c |
fix: remediate dependency security advisories across workspaces (#31681)
* fix: remediate dependency security advisories across workspaces * test: verify security patches without ad hoc dependency installs |
||
|
NeilandClaude
|
0ee13f831d |
fix(ssh): say "Orca on <host>" instead of "managed server" in the UI (#31099)
* fix(ssh): say where Orca runs instead of "managed server" in the UI Users read "managed server" as hosting run by someone else, so they declined moving their SSH hosts. Every user-facing string now says "Orca on <host>" or "this host's Orca server", in all six locales; Settings > "Orca on your SSH hosts" and the setup line say the code and files stay where they are and only Orca's list of projects, tabs and terminals moves to the host. CLI command names, logs and identifiers are unchanged. Fixes #30880 Co-Authored-By: Claude <noreply@anthropic.com> * fix(ssh): reassure only when something moves; name the host's label in its row Review follow-ups: the reassurance shows only while Orca sets itself up or moves a host, not on every reconnect; the converting line no longer repeats it; the row names the SSH host's current label; the section description and the Move anyway dialog stop repeating themselves; translate the Restart dialog's buttons; drop "managed" from the remaining raw causes and the external automation refusal. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Neil
|
d893cf5548 | chore(docs): move site runtime and Node types to 24 (#30615) | ||
|
Neil
|
b331710b31 |
build: move cloud and docs/site to pnpm 12 (#30600)
The root moved to pnpm 12 in #17156 but these two isolated workspaces were left on pnpm 10, so CI and deploys carried a second pnpm and pnpm/action-setup. - Pin the root's integrity-checked pnpm 12.14.0 and regenerate both lockfiles (only the pnpm 12 package-manager document is added; the dependency graph is unchanged). - Move settings pnpm 12 ignores out of .npmrc and package.json#pnpm into each pnpm-workspace.yaml; onlyBuiltDependencies becomes allowBuilds, and cloud keeps esbuild's script skipped as pnpm 10 did. package-manager-strict is gone in pnpm 12, whose own version pinning supersedes it. - docs/site drops --ignore-workspace: under pnpm 12 it skips the workspace file, losing the overrides and failing the frozen install. vercel.json now pins install/build so a stale dashboard command cannot reintroduce it. - Cloud and docs workflows use pnpm/setup@v2 like the root; the relay unit-test step uses the root's pnpm instead of npx pnpm@10. |
||
|
Jinjing
|
81730c0b3d |
Track usage of closing tabs to left and right (#30557)
* Add telemetry for directional tab close requests Measure how often people use Close Tabs To The Left and Right, without recording tab titles, paths, or workspace identifiers. - Sample a stable 10% of installs by hashing the install ID, so membership survives restarts. The app-open event carries the sampled flag so the group can be analysed. - Cap each direction to one event per app session, tracked in main, so repeated clicks or extra windows cannot inflate volume. - Count the request before the close flow runs, so cancelled save prompts still count. - Route both directions through one helper that counts eligible unpinned tabs in visible order. * Count settings opt-in sessions in tab-close sampling denominator Enabling telemetry from settings now fires `app_opened` for that session, not only when the opt-in came from the pending banner. Before, settings opt-ins never emitted `app_opened`, so those sessions were missing from the adoption denominator for directional tab close events. - `trackAppOpenedOnce` now marks the session as tracked only when `track()` accepts the event. An opt-out or environment consent override no longer uses up the session's denominator. - Tests cover sampling for settings opt-in and the `DO_NOT_TRACK` override. |
||
|
Jinjing
|
5ee118a908 | fix(source-control): clear unavailable branch line totals (#30475) | ||
 Neilandstevelliu
|
347d0e46a1 |
feat(cli): set the title of one terminal pane (#30485)
* feat(cli): set the title of one terminal pane Adds `orca terminal set-pane-title --terminal <handle> --title <text>`; `--title ""` clears it. The runtime resolves the live handle to its saved leaf and asks the desktop window to name that pane through a new optional notifier hook (`ui:setPaneTitle`). Mounted panes apply it through the same local setter the GUI uses; parked panes get it in the saved layout their next mount reads. The tab's own name is never touched. Rebuilt on current main from #24755. Co-authored-by: stevelliu <stevelliu@tencent.com> * fix(renderer): a main-owned layout takes a CLI pane title before the window shows it * fix(renderer): a CLI pane title reaches a never-mounted tab with a rootless layout --------- Co-authored-by: stevelliu <stevelliu@tencent.com> |
||
|
4940654793 |
fix(cli): --host and --project accept the names host list and project list print (#30438)
* Accept host aliases and infer the host for a single-setup project `orca worktree create --project scalp-it` failed with "Project is not set up on the selected host" even though the project has exactly one ready setup, and `--host trader-local` was rejected as an invalid value even though `orca host list` prints that name. Three separate causes: - `--project` was matched against the stored `projectId` only, which is a provider-scoped string (`github:owner/repo`). The display name shown by `orca project list` never matched, so the lookup found nothing and the failure was reported as a missing host. - With no `--host`, the host fallback existed but was unreachable, because the project lookup above had already filtered to zero candidates. - `parseExecutionHostId` accepts only `local`, `ssh:<id>` and `runtime:<id>`, so a bare alias could not parse at all. `ssh:<label>` already resolved labels; only the unprefixed spelling was missing. Now: - `--project` takes the project id or the display name, resolving through `project.list` and falling back to the setup's own display name for hosts that predate that method. Two projects sharing a name are refused rather than guessed. - `--host` is only required when the project is set up on more than one host. A single setup is used directly; an ambiguous one fails with every host and the flag to select it. - `--host <alias>` resolves against both axes: paired servers by name before routing, SSH targets by label once a client exists. An alias that names a machine on both is refused with the prefixed flag for each. Errors now echo the flag the caller typed instead of an `ssh:` spelling they did not use, and carry the hosts to retry with in `nextSteps`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Refuse a host alias that collides with duplicated SSH labels assertAliasNamesOneHost asked findSshTargetByName whether the alias also named an SSH target, but that function returns undefined for a label two targets share — deliberately, so an ambiguous label never resolves. Read as a boolean it says "no SSH target by that name", so an alias naming one paired server and two same-labelled SSH targets looked conflict-free and resolved to the server. The opposite direction was already covered: a unique SSH target against two servers sharing a name fails through assertEnvironmentNameUnambiguous. Fall back to ambiguousSshTargets so both axes refuse, and list every colliding target in nextSteps rather than only the first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Only fall back to setup display names on a server without project.list findProjectsByName caught every error from project.list and returned an empty list, so a network failure, a permission error, or a genuine server fault was indistinguishable from "no project by that name" — and the caller was then told `Project is not set up on the selected host` for a project that exists and is set up. Narrow the catch to method_not_found, the only code that means the weaker fallback is warranted, matching callProjectHostSetup and listSshTargets in the same layer. The function now returns null for that version gap and an empty array for a real miss, so the two cases stay distinguishable at the call site. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Refuse a legacy display-name match that spans two projects The pre-project.list fallback matches ProjectHostSetup.displayName, which is the repo's folder name rather than the project's name, so two projects holding repos with the same folder name both match. selectSetupOnHost would then have taken the first candidate — targeting a project the caller never named. Reject when the matched setups span more than one projectId and name each one, the same rule the project.list path already applies to duplicate display names. A single project with several setups is unaffected; the host selection below still decides between them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Spell the --host placeholder as <host> in the project setup usage lines The worktree create usage was updated to <host> when aliases became valid, but the four project setup-* lines kept <host-id> in both the command specs and the root help text they mirror. Those commands accept an alias too, so the narrower placeholder hid it from anyone reading help. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Document host names and the optional --host in the CLI docs The published CLI reference described `--host` as taking only `local`, `ssh:<target-id>` or `runtime:<environment-id>`, and the automations page showed `--host <hostId>` as required alongside `--project`. Both now understate what the commands accept, which is how the original report started: `orca host list` prints a name, the docs never said you could type it, so the generated id looked mandatory. Spell out that `--host` takes the bare name from `host list` on either axis, that a name resolves only when unique and is otherwise refused with the prefixed flag for each candidate, and that `--host` is unnecessary when the project has a single setup. Also note `--project` accepts the display name from `orca project list`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Name the runtime host id as the paired-server tie-breaker in the docs The host-selection page told readers to fall back to ids when a name is ambiguous but only ever showed `--environment <server-name>` for paired servers — and that selector is exactly the one that cannot separate two servers sharing a name. Spell out the pair the resolver actually emits in its nextSteps: `--host ssh:<target-id>` and `--host runtime:<environment-id>`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Spell the automations create usage as --project <id-or-name> [--host <host>] `automations create` resolves --project and --host through the same alias-capable resolver as `worktree create`, and its own notes already say --project takes a display name and --host takes a bare host name. The usage line still read `--project <id> [--host <id>]`, the last spot left on the old spelling (flagged by CodeRabbit after the main merge). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Give the fake runtime client cast in the host alias tests its SAFETY note Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): accept every name host list and project list print, everywhere --project/--host is taken Extends the alias work to the commands it did not reach and the names it missed: - `project setups --project <display name>` filtered by projectId only. - `project setup-existing-folder|setup-clone|setup-create --project <name>` now send the project id that name resolves to (pass-through for ids and for servers without project.list). - `--host "this machine"` (the local row's name) resolves to local, and is refused if an SSH target or paired server shares it. - One pair of wrapping quotes is ignored, since cmd.exe passes single quotes through literally. - With --environment/--pairing-code, a bare --host name is a machine the routed server reaches, not a different locally paired server. - An unknown project is reported as a project miss, not a host miss. Co-authored-by: Younghwan Chae <chyohw97@gmail.com> * fix(cli): keep exact project ids over names, and refuse an unverifiable host name An exact --project id whose only setup is not ready no longer falls through to a project whose display name equals that id. A bare --host name that matches a paired server now routes there only once this machine's SSH targets were actually read, and under --environment/--pairing-code a bare name always means a machine the routed server reaches. Co-authored-by: Younghwan Chae <chyohw97@gmail.com> --------- Co-authored-by: younghwan <chyohw97@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Neil
|
68808db38a | chore(docs): replace ESLint with Oxlint (#30180) | ||
|
Neil
|
33e6785fe2 | fix(deps): update vulnerable dependencies and prune stale overrides (#30143) | ||
|
Jinwoo Hong
|
90c1c0ac50 |
feat(mobile): draw the host Accounts screen from the desktop's page (#30020)
* fix(mobile): wall hosts that cannot serve the page instead of opening native screens * refactor(mobile): drop the native-route state and the shell fallback prop; unknown routes say unavailable * test(mobile): read the nullable page route refusal in its policy test * refactor(mobile): every build is the OTA shell; drop the native/OTA build switch The owner retired the native-screen fallback with no emergency native build, so EXPO_PUBLIC_MOBILE_SHELL, mobileShellBuildKind, shellSwitchDecision, the Metro cache-key suffix and both release workflows' shell input go. Every host route mounts the shell; a route naming no screen the shell could open gets the existing refusal screen instead of a native screen. Claude-Session: https://claude.ai/code/session_6cea92f6 * refactor(mobile): delete native screens the OTA shell no longer reaches With every build the OTA shell, these native siblings run nowhere: the native-executed closure (index.js plus every non-web route) does not reach them, and the page resolves their .web siblings. Each .web sibling takes the plain name, its web-overrides entry goes, and the native-only rich Markdown editor and Mermaid WebView generators and their outputs go with them. Kept: native siblings the node test suite still renders shared screens through (terminal WebView, browser frame path, clipboard, dictation, media picker, live input, snapshot budget, input styles). Claude-Session: https://claude.ai/code/session_6cea92f6 * test(mobile): drop the phone-preview comparison the deleted native sibling held Claude-Session: https://claude.ai/code/session_6cea92f6 * refactor(mobile): drop the dead web route, flag-era comments and the one-value shell kind The host route files no longer switch, so their comments say what they do now: a route naming no screen shows the unavailable screen. app/h/[hostId]/web.tsx duplicated index.tsx and nothing linked to it, so it and its stack entry go (the bundle sweep is re-measured: 77 scripts at 15 routes). Diagnostics print the bridge protocol on its own instead of a shell kind that has one value. Claude-Session: https://claude.ai/code/session_6cea92f6 * refactor(mobile): one host for the rich editor, plain Text, and drop two unused native deps MobileSelectableText was react-native's Text, so callers use Text. The rich Markdown editor's host-facing seams (messages, URL prompt, keyboard inset) are required now that the page is its only host; the WebView defaults go. Comments that described deleted native components are rewritten, and expo-image-manipulator and react-native-uitextview leave package.json and the lockfile. Claude-Session: https://claude.ai/code/session_6cea92f6 * feat(mobile): draw the host Accounts screen from the desktop's page Accounts was the last host screen the shell still drew natively, so its changes needed a phone build. It is now a page route like Tasks: the screen moves to src/accounts/MobileAccountsScreen.tsx, accounts.web.tsx renders it on the page, and accounts.tsx mounts the shell for it. What React Native Web needed: Alert.alert is a no-op there, so the reset confirmation, its outcome and a failed account switch are ConfirmModal drawers (ConfirmModal can now drop Cancel for a notice); Back goes through the route handoff, which pops the shell's stack; and the reset idempotency key is built from getRandomBytes, since randomUUID needs a secure context the iOS custom scheme is not. edit.tsx edits the phone's own pairing and never renders on the page, so the route manifest leaves it out and the page's host stack does not declare it. The script sweep is re-measured for the 14-route tree. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(accounts): answer a same-offer Codex reset retry with its recorded outcome; mobile mirrors the desktop The desktop keeps no client journal for a reset credit: the host's ledger owns the attempt. A remote client that lost a reply and retried the same offer under a new key was refused with "already attempted" (or "unknown outcome" while the provider call was unresolved), which is why the phone carried its own durable journal to replay the old key. The coordinator now answers a request for an offer an earlier key already claimed as that attempt: the settled outcome, the running attempt, or a resume of the pending one under its original key. A different offer for the account is still refused while an outcome is unknown, so nothing can spend twice. The reply shape is the one a same-key replay always had, so installed clients with their journal read it unchanged. With that, the Accounts page sends a fresh key per attempt like the desktop and keeps nothing on the phone: the AsyncStorage journal, its client singleflight and the retry-record warnings are deleted, and the journal-resume recording goes with them. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(accounts): resume an account's unresolved Codex reset when the retry names a newer offer Review follow-ups: - Host: after an unknown provider outcome the usage refresh moves the offer, so a retry names a newer one. The coordinator now answers it as the account's unresolved attempt (resumed under its own key and scope), as the desktop's consumeCurrent does, instead of refusing forever. One ledger lookup finds own key, offer claimant, then unresolved attempt. - Mobile: a reply is matched on target, account and account revision, not the offer, so the resumed attempt's scope is accepted. - The key is minted inside requestCodexResetCredit from randomV4Uuid, the session helper moved to src/platform/random-v4-uuid.ts. - RefreshControl goes; the header refresh stays. ConfirmModal's onConfirm is optional for an OK-only notice. - Stale journal comments and the mobile docs line are corrected. - The edit.tsx page exclusion is dropped from this PR; the script sweep is re-measured for 15 routes. - Root oxlint: escape the apostrophe; zod v4 strictObject. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(mobile): secure UUID fallback from expo-crypto; pin reset retry routing - randomV4Uuid never falls back to Math.random: without crypto.randomUUID it builds the v4 UUID from ExpoCrypto.getRandomBytes, as the old reset key did. Tests get Node's secure bytes for expo-crypto from the setup file, since the native module has no Node build. - Host tests: a new offer after a settled attempt spends again rather than replaying, and a retry naming a newer offer joins a resumed attempt in flight (one provider call, original key). Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * chore: restore main's bytes for files the merge's pre-commit format touched The merge commit's lint-staged run reformatted 27 files this PR does not change. Committed without the hook so they match origin/main exactly. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): stand in for expo-crypto with a Node alias, not a setup-file mock Anti-slop forbids module mocking outside test files. The vitest config now aliases expo-crypto to a faithful Node implementation of the names shared code reaches; a test file's own mock still wins. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * docs(mobile): match the bridged-parity comments to the measured 795-golden tally Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb |
||
|
Neil
|
52419be3a5 |
feat(linux): opt-in per-terminal memory and swap limits for the terminal host (#29413)
ORCA_TERMINAL_MEMORY_MAX and ORCA_TERMINAL_MEMORY_SWAP_MAX set MemoryMax and MemorySwapMax on each terminal's systemd user scope. Off by default, applied only after the probe scope shows the kernel enforcing them, and dropped (logged) where the host cannot, so terminal scopes never turn off because of them. Refs STA-3430 |
||
|
Neil
|
904b6f2b32 |
fix(ssh): flag a macOS host whose managed server outlived its launching SSH session (#29371)
* fix(ssh): flag a macOS host whose managed server outlived its launching SSH session macOS Local Network privacy pins a nohup-launched orcad to the sshd-session that started it; once that session ends, its terminals lose LAN access (#25934). A macOS launch now records that session, a connect reports it when it proved exited, and the host status offers a restart when no terminals are running. * fix(ssh): retire the idle terminal daemon on a launch-session restart * fix(ssh): keep the fence on an unsettled restart stop, and report a restart that can't hold its session * fix(ssh): carry the launch session forward while the terminal daemon survives; never redial for the check * chore(i18n): add the launch-session warning and restart strings to the English catalog |
||
|
Jinjing
|
232f6048e7 | Remove obsolete Hermes cron documentation and translations (#28877) | ||
 NeilandJerome Würf
|
cf119167a5 |
fix(jira): support scoped Cloud API tokens (#28604)
Support scoped Jira Cloud API tokens through the configured gateway while keeping self-hosted routing, redirects, diagnostics, and selected-host capabilities bounded. Co-authored-by: Jerome Würf <oss@scharom.de> |
||
 NeilandNikita Maketryuk
|
b428def8f1 |
feat(cli): open files at a requested line and column (#28240)
Accept positive safe-integer line and column flags through the existing file-open path. Reject invalid or incomplete positions before changing the editor. Bind deferred reveals to the requested workspace and tab, including floating panels, and clamp oversized positions without moving another editor or stealing late focus. Co-authored-by: Nikita Maketryuk <n.maketryuk@lince.studio> |
||
|
Neil
|
3f81541188 |
Support restarting Windows Orca as administrator (#28073)
* feat(windows): add administrator PowerShell terminal setting * fix(settings): localize administrator terminal search keywords * fix(windows): restrict elevated terminal host to Orca's runtime and requesting account * fix(windows): harden administrator terminal routing, inventory and restore * fix(build): build the Windows agent hook when electron-builder packages Windows * fix(build): build the packaged Windows agent hook for the target architecture * fix(windows): accept the development terminal runtime and test real elevation in CI * feat(windows): show administrator status and restart instructions * fix(settings): localize administrator mode search keywords * test(settings): isolate the desktop permission section in shell picker tests * Add Windows administrator restart and simplify Terminal settings * Keep administrator restart silent and settings actions within narrow panes * Keep Windows shell choices and permission guides usable at minimum width * Prevent later restarts from replaying administrator terminal reset * Fix CI route resolution and transient Windows fixture cleanup |
||
|
Jinwoo Hong
|
5a77f068b6 |
Link the Android APK through a stable URL and bump it on release (#28143)
* Link the Android APK through a stable URL and bump it on release READMEs, the docs site, and the desktop app now link https://www.onorca.dev/download/android, which the marketing site redirects to the current APK, so none of them need a per-release edit. A published Android release opens a PR on the marketing site that bumps its one ANDROID_RELEASE_VERSION constant; a failed bump is reported in the job summary and does not fail the release. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * Skip the APK download bump for OTA-shell test builds Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * Bump the APK download for every published Android release Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb |
||
 OrcaWinandOrca Worker
|
83056e5edb |
fix(skills): judge official skill updates by ownership, not snapshot matching (#27603)
* fix(skills): judge official skill updates by ownership, not snapshot matching Orca decided whether an installed official skill was pristine by matching its bytes against a shipped list of past snapshots, falling back to the skills CLI's lock hash. Copies installed between releases, CRLF copies, and installs whose lock recorded a sha256 hash all read "doesn't match the official version" and could not be updated (#26841), and older content could be labelled newer and never offered. Now an official skill is Orca's when the skills.sh global lock says it came from stablyai/orca, and it is current only when its listed files equal the bundled manifest (line endings and sidecars ignored); anything else is outdated. Install and update are one pinned `skills add .../tree/v<appVersion>` command, used by the in-app runner, `orca skills update`, and the Settings rails. The update dialog preselects Orca-owned rows and lists same-named skills from elsewhere unchecked. Removes the snapshot registry, release mapping, git-tree identity, lock trust and convergence logic, and the release-cut provenance step. * ci(skills): run the pinned-add round trip on a skills CLI that can fetch a commit * fix(skills): let orca skills update target the shared folder on a bare host Update became the same pinned add as install, so it inherited install's refusal when no agent is detected. That broke the bare-host update the old command guaranteed, and the built-CLI check (update --dry-run, no --agent) on CI runners. The in-app runner already fell back to universal; both now share one detectSkillsCliUpdateAgentKeys rule. Also brings the CLI skills docs off `npx skills update`. * refactor(skills): derive the update selection from the grouped rows The selection hook took the live and the retained inventory, re-derived Orca ownership from installations beside the grouping's own orcaOwned, and kept a separate display count. Groups already carry both eligibility and ownership, so the hook reads them once; the button's existing live-scan gate is the only authorization check. The unselected line is inlined into the headline. * refactor(skills): drop helpers the ownership design made redundant - isOwnerManagedSkillScope only negated into the participation check once plugin caches stopped participating; fold it in. - Eligibility re-checked resolvedPath/physicalIdentity, which observation already turns into 'inaccessible'. - The manifest verifier probed access() before a readFile that throws anyway. - orchestration-install-command.ts only forwarded one constant from the lib module its three importers already import. * i18n(skills): stop naming npx skills update in four skipped-copy strings The es/ja/ko/zh cantUpdateReason and tipDuplicate strings still named `npx skills update`, which Orca no longer runs for its skills. Say 'the update command' instead. * refactor(skills): inline the single-use pinned source URL helper orcaSkillsSourceUrl was exported but only called by the builder beside it. * fix(skills): let an update choice lapse when the install source changes The selection froze every checked name, Orca's preselection included, the moment the user ticked anything. A re-check that then attributed a name to another source kept it checked, replacing it without consent. Store only the user's explicit choices, keyed by name and lock source, and default to ownership otherwise. * fix(skills): label the empty update action 'Update skills', not 'Update 0 skills' The button stays whenever a row is updatable, so unticking every row (or a dialog with only non-Orca copies outdated) doesn't reflow the footer. At zero selected it stays disabled and reads 'Update skills' instead of a zero count. The label lives beside the dialog's other count copy. * fix(skills): let keyboard focus open the Not from Orca tooltip The source of a non-Orca copy is only in the tooltip, and its trigger was a plain span. Make it focusable like Orca's other tooltip-on-text triggers (tabIndex 0, cursor-help, the row primitive's focus ring), as in the agreed mock. * test(skills): hold the round-trip add equal to the shared install builder The CI round trip hardcoded its skills add argv, so it could drift from what Orca runs. A .mjs script can't import the TS builder (extensionless imports), so the argv moves into an exported roundTripAddArgs and a unit test asserts it is the builder's unattended add with the tag swapped for the PR commit. The script runs under the same main guard as the manifest generator. * i18n(skills): translate the skill row's location count and duplicate reason es, ko and zh still carried English for SkillUpdateRow.oneLocation and manyLocations, and es and ko for SkillFreshnessRow.skippedReasonDuplicate. * fix(skills): pin official skill installs to the build commit and skills CLI `skills add .../tree/v<version>` only works for stable and RC builds: hourly, daily and adhoc builds publish elsewhere, so stablyai/orca has no tag for their version and both install and update failed there. Every build is made from a commit that exists in stablyai/orca, so the build now stamps `git rev-parse HEAD` and the one shared builder pins to `tree/<commit>`, which equals the bundled skills by construction. Main, renderer, web and vitest get it as ORCA_BUILD_COMMIT (replacing ORCA_APP_VERSION); the tsc-built CLI reads it from the compiled out/package.json boundary. A missing or malformed commit fails the build or the command with a clear error instead of building a bad URL. The builder also pins the skills CLI (`npx skills@1.7.2`): 1.5.x cannot fetch a commit, and a bare `npx skills` can reuse a stale cache or resolve to another binary (#18687). The CI round-trip script reuses the same constant. * ci(skills): run the round trip on the shared pinned skills CLI version * docs(skills): document the commit-pinned skills add * refactor(skills): keep the pinned skills CLI version in the install builder skills-cli-version.ts existed only so the plain-Node round-trip script could strip-load a .ts file, which needed --disable-warning in CI. The version now lives beside the builder that uses it; the script keeps a literal, and the existing round-trip test already asserts its argv, skills@<version> included, equals the builder's. * refactor(skills): validate the build commit once, where it is resolved resolveBuildSourceCommit already refuses anything but a full hash, and both the define and the CLI's stamped package.json come from it. The builder's second check could only fire as a module-load throw in the renderer's command constants. Also drops the resolver's unused cwd parameter. * test: stamp a fixed build commit instead of running git in the vitest config Tests only interpolate ORCA_BUILD_COMMIT, so they need not read HEAD (or fail outside a git checkout) on every run. * refactor(settings): match only skills add in the Windows npx preflight Every official skill command is now the builder's skills@<version> add; no rail emits skills update any more. * fix(skills): fail an update that leaves a broken skill link behind Eligibility already skips names with a broken link before the run, so one afterwards is the run's own damage; report it instead of claiming success. * ci(release): refuse to tag when the skill manifest is stale The removed --release step implicitly checked the committed manifest against skills/. Keep that guarantee with a verify-only run; it writes nothing. --------- Co-authored-by: Orca Worker <orca-worker@localhost> |