* fix(review-notes): converge note rollback to the last persisted list (STA-4064)
Consecutive folder-note save failures left a phantom persisted note: writes
coalesce at dequeue time, but each mutation rolled back to its own immediate
predecessor, so the last failed write in a burst restored a mid-burst list
while disk still held the pre-burst one.
Track the last list that actually reached disk per persist-queue key, seeded
on an idle queue and re-seeded when an out-of-band replacement breaks the
mutation chain, and roll back to that floor from inside enqueuePersist's
failure path. Both maps drain with the queue tail. The identity guard,
payloads, wire shapes, and public slice signatures are unchanged.
Co-authored-by: Orca <help@stably.ai>
* fix(review-notes): keep an out-of-band replacement past a successful write (STA-4064)
F1: the floor update after a successful persist was unconditional, so a write
that resolved after a chain break re-seeded the floor overwrote the replacement
with its pre-replacement captured list, and the next failing write in the burst
converged the store to that stale list. Guard the update with a per-key seed
epoch bumped on every re-seed.
F2: recordFeatureInteraction now runs outside the persist try/catch (and swallows
its own throw), so telemetry failing no longer reports a save that reached disk
as failed — the UI treats null/false as "keep the draft open for retry".
Co-authored-by: Orca <help@stably.ai>
* fix(review-notes): capture the floor seed epoch at dequeue time (STA-4064)
A write enqueued before a chain break but dequeued after it captured a stale
epoch, so it could never update the rollback floor — even though the list it
persisted already carried the out-of-band replacement. The next failing write
in the burst then rolled the store back past a note durably on disk.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Parsers now properly tear down gated transcript streams in finally blocks,
even when throwing mid-parse, so stalled gate deadlines do not leak file
handles into later scans. Handle close queues are isolated per WSL route
so a stuck distro cannot strand closes on healthy ones. Route key logic is
extracted to a shared module used by both the gate's admission and the
close queue's serialization.
The main-process worktree resolution cache expired on wall-clock time: the whole-fleet snapshot has a 1s TTL, so any poller faster than 1Hz recomputed it, and every 30s the per-repo scan cache expired and shelled out `git worktree list` for every registered repo. A production trace recorded 4,272 `git worktree` invocations over 3h27m across 10 repos.
In-Orca mutations are already event-driven, so the 30s TTL existed only to discover changes made outside Orca. Before re-running an expired scan for a local, non-WSL repo, read a cheap subprocess-free Git-admin fingerprint (admin dir entries, per-checkout HEAD and its ref tip, gitdir/locked/existence per entry, packed-refs and reftable stamps). If it matches the fingerprint captured at the cached scan's start, extend the cache without spawning Git. A real scan still runs every 5 minutes so anything the probe cannot see still reconciles.
Measured: 600 -> 60 `git worktree list` spawns on the reported workload (10 idle repos, 1Hz polling, 30 simulated minutes), and main-thread event-loop stall of 2.69ms -> 0.01ms per refresh. External worktree add/remove/move/lock/checkout/commit discovery stays bounded at 30s.
SSH repos, WSL-routed repos, folder workspaces, agent-scratch repos, and any repo whose layout the probe cannot read keep today's behaviour exactly.
Design: docs/reference/worktree-scan-fingerprint.md
* fix(files): fsync read-only files on POSIX
* test(e2e): add golden E2E tests for POSIX profile index fsync
Validates that profile index files are properly persisted on POSIX systems, including with restrictive umask settings. These are release-blocking golden tests for Linux and macOS.
* test(terminal): wait for fish child ownership before stdin write
Fish 4.8 withdraws DECSET 2031 before spawning the child, so the
shell-contracts harness could send hello into an intermediate prompt
and hang waiting for CHILD-READ. Wait for the child's CHILD-READY
marker and answer split DA1/CPR/OSC queries across chunk boundaries.
* test(e2e): verify profile index persists to disk with restrictive umask
Strengthen the POSIX fsync test to verify the rebuilt index is actually
written to disk and has correct permissions under a restrictive umask,
not just cached in memory.
* fix(ai-vault): gate post-resolution WSL transcript I/O (STA-4049)
PR #14090 admitted only path *resolution* through the WSL transcript
filesystem gate. Every byte read afterwards from the resulting
\\wsl.localhost\... UNC path ran raw, so a distro that answers the first
access() and then stalls hung Native Chat at "loading" and AI Vault at
"scanning" with no timeout and no error.
Route that I/O through a new wsl-transcript-fs-access accessor, which is
a verbatim node:fs passthrough off UNC and an admitted, deadlined task on
it. open/positional-read opt out of coalescing (dedupe: false): joiners
would share one FileHandle or one caller's buffer.
Refusals now surface as the existing retryable message rather than
notFound, per-root scan failures are contained to an AiVaultScanIssue,
and the memoized Codex/Kimi indexes evict on refusal so a stall cannot
pin "no titles"/"no cwd" until the index changes.
* fix(ai-vault): stop caching WSL gate refusals as results (STA-4049)
Code review 1 P1 fixes on top of the transcript gate:
- transcript-read-cache: never store a gate refusal. The refusal leaves the
file's mtime untouched, so the cached error would have been served to every
later call until the transcript itself changed.
- kimi/grok/opencode parsers: rethrow WslTranscriptFsError instead of folding it
into "no session"/"no transcript", so the session parse cache cannot store a
null or partial answer under an unchanged mtime. Ordinary missing/half-written
files stay contained.
- opencode-usage scanner: gate the data-directory readdir and the absolute
OPENCODE_DB stat. The AI Vault's primary OpenCode source reaches them
transitively, which is why the direct-import guard never saw them.
- gated stat/lstat: accept an AbortSignal, matching gated open/read, so a
cancelled watch install or title probe detaches immediately instead of holding
a waiter to its deadline.
- gated open: close a FileHandle whose syscall lands after the last waiter gave
up, and close handles off UNC verbatim (awaited, failures surfaced).
Co-authored-by: Orca <help@stably.ai>
* fix(native-chat): decode gated chunks incrementally and cancel drain I/O (STA-4049)
Addresses the CR2 blockers.
UTF-8 chunk-boundary corruption: the UNC branch yielded raw 1 MiB Buffer
slices that `decodeTranscriptStream` decoded independently, so any multibyte
codepoint straddling a boundary became U+FFFD on both sides — corrupting the
JSONL line and shifting `consumedBytes` (which seeds fallback message ids).
`gatedChunks` now holds a StringDecoder when `encoding` is set, and
`decodeTranscriptStream` holds one for the Buffer path, matching what
`createReadStream`'s decoder already did off UNC.
Watcher teardown: `installTranscriptWatcher` owns an AbortController that
`unsubscribe()` aborts, threaded through every gated call on the drain path.
Waiters now detach at teardown instead of holding to the 30s deadline, and
the gate's aborted-signal pre-check stops an in-flight drain from admitting
new tasks after close.
Rovo `session_context.json`: `readJsonObjectIfExists` rethrows
WslTranscriptFsError so `parseSessionCandidate` records a scan issue, instead
of caching an un-enriched session under an unchanged mtime that never re-reads.
Primary OpenCode source: `listOpenCodeDatabases` takes an optional refusal
reporter so a refused `OPENCODE_DB`/`XDG_DATA_HOME` surfaces an
AiVaultScanIssue, matching `listOpenCodeDatabasesInDirectory`.
`boundaryFingerprint` moved to its own module to keep the watcher engine
under the max-lines cap.
* refactor(native-chat): consolidate transcript I/O and remove fallback te
- Move boundaryFingerprint from its own module to transcript-file-version.ts
- Extract runPathOperation helper to eliminate duplicate UNC path routing
- Remove tests for fallback behaviors when transcripts are unavailable or incomplete
- Clean up implementation comments and verbose test documentation
* consolidate scan issues and gate session scanner I/O (STA-4049)
Both local and remote session scans hit stalled WSL distros identically:
one failed probe per discovered path. Unifying issue recording and gate
refusal handling prevents duplication and ensures consistent behavior.
- Gate all file operations (stat, readdir, read, open) through WSL
stall detection instead of scattered or missing gates
- Serve cached transcripts when stat stalls; distinguish gate refusals
from missing files
- Serialize UNC close operations to prevent thread pool exhaustion
- Incremental chunk decoding in streams handles codepoint boundaries
correctly
---------
Co-authored-by: Orca <help@stably.ai>
* fix(store): keep project catalog identity when repo.addedAt is 0
projectHostSetupProjectionFromRepos used `repo.addedAt || now`, so a
missing or zero addedAt stamped Date.now() into createdAt/updatedAt on
every refresh. #13803's reconcile then treated the project as changed
and never reused it.
Use a finite check with a stable 0 fallback, and treat 0 as unknown in
merge so a persisted createdAt is not wiped. Refresh-identity tests use
production-shaped nested fixtures plus structuredClone and go red if
the fallback is reverted.
Co-authored-by: Orca <help@stably.ai>
* type(shared): return readonly setups from getProjectHostSetupsForProject
The helper already takes a readonly catalog and returns a filter subset.
Mark the return readonly so callers cannot mutate a live setups array.
Co-authored-by: Orca <help@stably.ai>
* style: oxfmt projection files and drop stale addedAt comment
oxfmt --check failed on the addedAt identity commit. Also stop claiming
the projection still restamps Date.now() when addedAt is 0.
Co-authored-by: Orca <help@stably.ai>
* fix(store): treat createdAt 0 as unknown when merging sibling repos
Repo order decided a project's createdAt: a zero-addedAt repo seeded the
accumulator with 0, and the merge only treated the *incoming* addedAt as
unknown, so min(0, 100) kept 0 when the unknown sibling came first.
Share unknown-aware mergeCatalogCreatedAt/mergeCatalogUpdatedAt helpers and
apply them on both sides of the projection merge and of the renderer's
cross-host mergeProjectCompatibilityProject, which had the same 0-poisoning
via Math.min(base.createdAt, overlay.createdAt).
Co-authored-by: Orca <help@stably.ai>
* test(store): pass a valid updateProject payload in createdAt merge case
updateProject only accepts localWindowsRuntimePreference. The new
unknown-vs-known createdAt test used displayName and failed typecheck.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(persistence): keep folder-workspace notes across a build rollback
normalizeFolderWorkspaces rebuilds each FolderWorkspace field-by-field, so the
inline diffComments field #14112 added is dropped by any build that predates it
— and the next full-state write makes the loss durable with no user edit.
Move the on-disk home to an optional top-level PersistedState.folderWorkspaceDiffComments,
which older builds round-trip untouched through their {...defaults, ...parsed} load
spread and omit-style getDurableState(). load() hydrates it onto the records and
deletes it from Store state; buildStateToSave() is the only producer. The in-memory
FolderWorkspace shape, and therefore every IPC/RPC/renderer/mobile path, is unchanged.
Co-authored-by: Orca <help@stably.ai>
* fix(persistence): prefer inline folder notes over a stale map entry
Hydrate preferred a non-empty folderWorkspaceDiffComments entry over non-empty
inline notes. A rollback to a notes-capable #14112 build writes notes inline and
leaves the older map untouched, so re-upgrading deleted everything authored while
rolled back. Inline now wins when present; the map only fills a stripped record.
Co-authored-by: Orca <help@stably.ai>
* Extract folder workspace diff comments to dedicated module
Moves normalizeFolderWorkspaceDiffComments and
collectFolderWorkspaceDiffComments from persistence.ts to a new
folder-workspace-diff-comments.ts module for better code organization.
---------
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): keep worktree lineage map identity on no-op refresh
A host-scoped lineage refresh always spread IPC clones into new maps, so
WorktreeList Object.is subscriptions missed every time even when capture,
taskId, and coordinatorHandle were unchanged. Reuse structurally equal
records, return the previous maps when nothing moved, and skip set() when
both maps are still current so a no-op refresh is actually a no-op.
Co-authored-by: Orca <help@stably.ai>
* type(store): mark worktree lineage maps readonly
Widen reuseEqualRecordMap and the renderer lineage store fields to
Readonly<Record<...>> so a reused no-op refresh map cannot be mutated
in place.
Co-authored-by: Orca <help@stably.ai>
* type(store): build lineage overlays on mutable records
mergeExactHostLineage was writing into AppState map types after they
became Readonly. Use local mutable Records, then reuseEqualRecordMap.
Co-authored-by: Orca <help@stably.ai>
* fix(renderer): keep direct-ssh host hydration under the max-lines cap
The lineage overlay rewrite pushed the file to 305 counted lines against the 300 cap, failing oxlint. Fold the duplicated per-map filter/overlay into one scoped helper so both maps share it.
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): drop dead reuseEqualRecordMap key loop
A key missing from next always shows up as either a key-count mismatch or a failed previous lookup in the first pass, so the second pass over the previous keys could never flip identical. Cover the identity contract with focused unit tests, including the same-count key swap that the removed loop appeared to guard.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(browser): require runtime browser capability
* fix(browser): reuse capability verdict and exclude floating terminals
Cache the runtime browser capability check across multiple remote port opens instead of checking for each port independently. Prevent floating-terminal workspaces from routing to remote browsers.
* fix(browser): pin remote pane link opens to owning runtime
Remote pane link opens must route to the pane's runtime, never the client.
Fails if the workspace has moved to a different host while the pane still
displays a remote page, preventing silent misrouting to a dev server.
* trim comments
* perf(github): reuse workItemsCache identity on no-op refetch
A force refresh always remapped IPC rows and allocated a new cache entry,
so TaskPage's useShallow selector treated every poll as a real change and
remapped visible work-item rows. Reconcile nested rows structurally, bump
fetchedAt on the existing entry when nothing changed, and only write a new
entry when a row or meta field actually differs.
Co-authored-by: Orca <help@stably.ai>
* type(github): mark workItemsCache data readonly
Store work-item rows as readonly GitHubWorkItem[] and assign the
reconciled catalog directly so a no-op or structurally-equal refetch
cannot mutate the live cache array.
Co-authored-by: Orca <help@stably.ai>
* type(github): propagate readonly workItemsCache through TaskPage
Widen fetchWorkItems, inflight promises, and TaskPage cache selectors
so CacheEntry<readonly GitHubWorkItem[]> typechecks against consumers.
Co-authored-by: Orca <help@stably.ai>
* perf(github): drop tautological workItemsCache data ternary
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): keep project catalog identity on SSH readoption
SshPane calls recordSshRepoReadoptions on every Manage-pane importConfig(),
often with []. The publisher always rebuilt projects and projectHostSetups
via projectCompatibilityFromRepos then mergeProjectHostSetupCompatibility
and spread the new objects into set(), so WeakMap and Object.is selectors
missed even when nothing was re-adopted.
Fetch paths already reconcile through mergeFetchedProjectCompatibilityForHost,
but that helper is host-scoped and this write is all-repos. Reconcile the
merged rows against the previous catalog with the same identity keys, omit
unchanged keys from set(), and skip the work entirely when both the incoming
and pending readoption lists are empty.
Tests reuse the production-shaped nested repo fixture and the structuredClone
fetch path. A pending-only readoption stays identity-stable, and removing
the two reconcile calls turns that case red.
Co-authored-by: Orca <help@stably.ai>
* type(store): mark pending SSH readoptions readonly
Widen pendingSshRepoReadoptions, recordSshRepoReadoptions, and the
merge/reconcile helpers to readonly so a reused pending queue cannot be
mutated in place after a no-op catalog reconcile.
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): drop redundant catalogRowsUnchanged after reconcile
reconcileCatalogRows already hands back the previous array when nothing
moved, so the extra element-wise compare could never disagree. Pin the
empty-readoption early return with a whole-state identity assertion,
which is the only guard the previous test could not distinguish.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(mobile): trade a lease-only stream for output when leaving a chat tab
Tapping a terminal tab from a native-chat tab left the terminal blank. The
route subscribes the incoming handle synchronously in switchTab, while the
coverage it reads still describes the chat tab being left, so the handle gets
a `mobileInputLeaseOnly` subscribe — the host answers `subscribed` and nothing
else, no scrollback and no data frames. Input kept working because it rides a
separate terminal.send RPC.
The reconciler then cleared its covered marker (the active handle changed), so
the stream was active and uncovered — which its state machine could not tell
apart from a healthy one, because `streamActive` conflated the two. It settled
on 'none' and nothing else repaired it: the route's web-ready path bails on any
live subscription. The tab stayed blank until app restart.
Track which handles hold a lease-only subscribe and thread it into the
reconciler as `streamIsLeaseOnly`, so an uncovered handle holding one resumes
into a full stream. The covered branch is untouched, so the input lease that
keeps the chat composer from locking forever (#10681) still survives.
* fix(mobile): clarify stream reconciliation ownership
* fix(mobile): keep stream reconciliation checks clean
* perf(store): keep runtimeEnvironments identity across no-op catalog lists
A no-op list or hydrate always allocated a new catalog because redact remaps
endpoints[] and IPC structuredClone rebuilds the rest. Object.is selectors
then missed on every 60s TTL refresh. Reconcile rows with areValuesEqual and
return the previous state when the catalog, statuses, and removed-id set are
unchanged after hydration.
Co-authored-by: Orca <help@stably.ai>
* type(store): mark runtimeEnvironments readonly
Widen the store field and setRuntimeEnvironments param to readonly and
stop slicing the reconciled catalog so a changed list still keeps the
reconcileCatalogRows identity instead of a fresh mutable copy.
Co-authored-by: Orca <help@stably.ai>
* type(store): propagate readonly runtimeEnvironments to consumers
Widen hydration helpers and terminal quick-command host state so the
readonly catalog typechecks, and stop asserting partial fixtures as
readonly AppState arrays.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(store): keep setup-script dismissal array identity on no-op repo fetches
filterSetupScriptPromptDismissalsToValidRepos always allocated a new
array, so fetchRepos, fetchRuntimeEnvironmentRepos, and
validateRepoScopedUi replaced setupScriptPromptDismissedRepoIds even
when every entry was already a valid host-identity key.
SetupScriptPromptCard Object.is-subscribes to that array, so a no-op
catalog refresh missed 100% of the time.
Return the original store array when the filtered result is
element-wise identical to the input. Allocate only when an entry is
dropped, rewritten from a legacy generation-v1:repoId key, or deduped.
Call sites already assign the helper result.
Co-authored-by: Orca <help@stably.ai>
* type: make setupScriptPromptDismissedRepoIds readonly
Return readonly string[] from filterSetupScriptPromptDismissalsToValidRepos
and sanitizeSetupScriptPromptDismissals, and update the store field type to
readonly. This prevents accidental mutation of the live store array on no-op
prune cycles. Add isUnchangedDismissalList type predicate for identity check.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(workspaces): recognize pasted Linear issue URLs
* fix(workspaces): resolve legacy Linear URLs and keep typed-name fallback
Saved API-key Linear workspaces often omit organizationUrlKey, so pasted
issue URLs never called fetchLinearIssue. Probe those unknown-org
workspaces and accept only a matching issue URL.
Keep "Use … as workspace name" visible in Smart Entry when a Linear URL
owns the results. sourceIntent still focuses the issue row.
Co-authored-by: Orca <help@stably.ai>
* fix(workspaces): jump to existing worktrees from pasted task URLs
Cmd+J now treats GitHub, GitLab, Jira, and Linear issue/PR URLs as
decisive search, so pasting one lists already-linked worktrees first
and keeps a create preview underneath. GitHub/GitLab/Jira still hand
the raw URL to the composer for cross-project detection.
Co-authored-by: Orca <help@stably.ai>
* fix(workspaces): resolve GitHub issue titles in Cmd+J URL paste
Pasted GitHub issue/PR URLs now fetch the title for the create preview,
same as Linear. Existing linked worktrees stay selected first so Enter
jumps; create still hands the raw URL to the composer.
Co-authored-by: Orca <help@stably.ai>
* fix(workspaces): attach resolved GitHub items from Cmd+J create
Pasting a GitHub issue/PR URL into Cmd+J already previewed the title, but
Enter still opened the composer with the raw URL. Await the in-flight
lookup and hand the linked work item through, matching Linear and Task
page create. Also fix CI type, lint, and focus-routing source checks.
Co-authored-by: Orca <help@stably.ai>
* fix(workspaces): add Cmd+J task-URL locale keys
Unblock PR CI localization catalog checks and make the Linear lookup-miss
e2e wait out the resolving state before advancing to the agent field.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(agent-hooks): fail closed without detected agent allowlist
Omit/empty agents no longer means install every remote managed hook.
Closes the remaining hole after #11442 that recreated uninstalled
agent config homes via the relay/SSH/WSL install path (#11641).
* test(agent-hooks): pin installManagedHooks fail-closed gate
The leaf guard already had a regression test, but the early return in
installManagedHooks was invisible to the suite: reverting it left every
agent-hooks and relay test green, because the leaf guard makes the summary
identical and the only delta is side effects (GROK_HOME login-shell probe,
host-identity read, ~/.orca mkdir + install lock).
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Windows terminal rendering golden is flaky on CI runners. Re-enable
Windows in the golden E2E gate with a scoped test for the fresh-profile
startup regression from #14130. Terminal rendering continues on Linux
and macOS; Windows runs fresh-startup only.
* perf(browser): bulk clear cookies when an import excludes nothing (STA-4065)
PR #14086 replaced the bulk clear with one Electron cookies.remove() per
removable cookie so partitioned excluded cookies survive an import. That is
required whenever something must be preserved, but it also runs when nothing
is excluded, where a single clearStorageData is equivalent and far cheaper:
421ms -> 7.3ms at 1k cookies and 1764ms -> 20.1ms at 3k on Electron 43.
The fast path is gated on the same unfiltered cookies.get() the exclusion
predicate already reads, which an Electron fixture now proves returns
partitioned cookies, so "no exclusions in the snapshot" means "nothing in the
jar to preserve".
* fix(browser): protect cookie clear fast-path race (STA-4065)
* test(browser): keep the no-bulk-clear assertion honest after the clearData switch
The mocked session still exposed clearStorageData, so asserting it was never
called could no longer fail once the fast path moved to clearData.
* docs(browser): stop the fallback comment from asserting a rollback
The per-cookie path's rollback is being removed by STA-4061; the comment only
needs to say the fallback re-removes what survived.
* test(browser): keep the STA-4061 rollback fixture on the per-cookie path
The bulk fast path clears a jar with no excluded cookie in one call, which
would have made every assertion in the partition-rollback fixture vacuous.
Give it a live Google cookie so the partial-failure clear still runs, and
assert the bulk call count is zero so a future widening fails loudly.
* perf(browser): always bulk clear cookies, not only when nothing is excluded
The fast path only fired when the jar held no Google cookie, but this import
exists for Google, so a Google cookie is normally present and the common case
still paid one native remove per cookie. Measured on Electron 43, clearData
excludeOrigins preserves the whole google.com registrable family -- host,
leading-dot, subdomain and partitioned cookies -- so the bulk call is safe with
cookies to keep, and the gate was never load-bearing for preservation.
Drop the caller-supplied exclusion predicate so the preserved set has exactly
one source of truth: a predicate that disagreed with NON_TRANSPLANTABLE_DOMAINS
would have deleted cookies the bulk call is meant to keep. The per-cookie loop
stays as the fallback for a rejected bulk clear, carrying the same exclusion.
* fix(browser): re-read the cookie jar after a rejected bulk clear
clearData can empty part of the jar before rejecting, so the per-cookie
fallback was working from a snapshot taken before the attempt: it retried
removals for cookies that were already gone and could not see cookies that
arrived during the clear. Re-read on rejection only.
Also repairs three fixtures that mocked the session with clearStorageData
after the call moved to clearData. The missing method threw, the catch
swallowed it, and every one of those tests silently asserted per-cookie
behaviour while believing it covered exclusion. Records the registrable-domain
invariant at NON_TRANSPLANTABLE_DOMAINS, since excludeOrigins derives one
origin per entry, and extends the real-Electron fixture to prove http-only and
domain-scoped Google cookies survive alongside the partitioned one.
* Add filter and sort to automations list
- Filter by status (enabled/paused) or last-run outcome (failed/succeeded/never)
- Sort by name or last run with toggleable direction
- Display last-run status with relative time in new table column
* Add filter and sorting to automations list
- Move run indexing to parent component for performance (avoid O(rows × runs) on re-render)
- Add internationalized labels for sort direction that include the column name
- Internationalize automation status labels and use locale-aware string sorting
* perf(renderer): index project host ownership on repo catalog refresh
mergeFetchedProjectCompatibilityForHost runs synchronously inside a zustand
set() on every repo catalog refresh and was O(projects x (setups + repos)):
getProjectHostIds / getExplicitProjectHostIds rescanned all setups and all
repos once per project, and mergePreviousProjectMetadata rebuilt a full
catalog repo key-set per project.
Precompute the indexes once and hand each helper only its own project's slice.
No ownership logic is reimplemented — the same resolvers run, just on
pre-sliced inputs, memoized per project object.
200 repos 1.1 ms -> 0.2 ms (5.2x)
600 repos 11.2 ms -> 0.7 ms (15.3x)
1200 repos 43.0 ms -> 1.6 ms (26.6x)
Verified against 4,000 randomized differential cases (duplicate repo ids,
dangling sourceRepoIds, empty-repoId and orphan setups, dropped setups,
local/SSH/runtime host mixes) comparing output element provenance and order
against the previous implementation, not just deep structure. Each of the
three index helpers was negative-controlled: breaking any one of them turns
the differential red.
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): keep the repo filter array identity across no-op refetches
Three fetch sites unconditionally reallocated filterRepoIds
(`s.filterRepoIds.filter(...)`) on every repo catalog refresh, even when
nothing was pruned. Six identity-sensitive subscribers select this array,
including App.tsx at the root, so every refresh woke the whole tree.
retainValidFilterRepoIds returns the input when every id is still valid;
`.every` short-circuits so the common case allocates nothing at all. It lives
in its own module rather than ui.ts: repos.ts does not import ui.ts and this
codebase has a documented circular-slice-import hazard.
The store type widens to `readonly string[]`, which takes three more
declaration edits (visible-worktrees, add-repo-skip-finalization, the setter).
PersistedUI.filterRepoIds deliberately stays `string[]`: main owns that array,
and widening it would fail the ui-state schema-parity assertion unless the zod
schema gained `.readonly()`, which Object.freeze()s every parsed `ui.set`
payload arriving from a paired client. Copy at the App.tsx IPC boundary
instead — one allocation per debounced 150ms persist, not per render.
Co-authored-by: Orca <help@stably.ai>
* perf(renderer): reconcile projects and host setups across no-op refetches
mergeFetchedProjectCompatibilityForHost always allocates — sourceRepoIds is
rebuilt per project and fetched setups arrive freshly cloned over IPC — so
`projects` and `projectHostSetups` lost both array and element identity on
every catalog refresh. #13770's identity work covered only projectGroups and
folderWorkspaces.
Reconcile both at the merge's single return site (five callers) against
`previous`, keyed on what each merge already dedups by: project.id, and
getProjectHostSetupOwnerKey for setups. setup.id is deliberately not the setup
key — the repo-derived fallback sets id = repo.id, so one repo on two hosts
yields two setups sharing an id, and keying on it would splice the wrong
host's routing metadata into a row.
filterSetupsForPrunedRepoRows had to stop returning `[...setups]`
unconditionally: three callers feed its result in as `previous`, so the
throwaway copy defeated the reconcile even though element identity survived.
Rather than add a third parallel deep-equality helper, generalize
reconcileFetchedRepos (#13744) into reconcileCatalogRows and delete repos.ts's
isPlainCatalogObject + areCatalogEntriesEqual (#13770). The two were the same
algorithm modulo the null-prototype branch; the survivor takes the union of
both prototype guards, which is strictly more permissive and so can only
reconcile more, never mask a change. repos-catalog-merge-identity.test.ts and
repo-identity-reconcile.test.ts stay green unmodified as the proof.
Element-level reuse means a consumer mutating a Project or ProjectHostSetup in
place would corrupt the previous render's object, so RepoSlice['projects'],
['projectHostSetups'] and ProjectHostSetupProjection widen to readonly. That
is the safety mechanism, not polish — it caught two real in-place accumulators
(ai-vault-scope-paths and the runtime-host purge in worktrees.ts), which now
annotate mutable locals per the repo's readonly precedent. No casts added.
Co-authored-by: Orca <help@stably.ai>
* test(renderer): cover repo catalog refresh identity
A dedicated file — repos.test.ts is already at the max-lines ceiling and these
are a distinct concern.
The fixture is production-shaped on purpose. A scalar-only repo reconciles even
when the structural compare is broken, which is how an earlier version of this
work shipped green while being completely inert; addedAt is pinned non-zero
because project-host-setup-projection falls back to `repo.addedAt || now`, so a
zero timestamp stamps Date.now() into every projection and nothing ever
reconciles. Every mocked fetch returns a structuredClone so identity can never
match by accident.
Every identity assertion was verified red against reverted source:
- drop reconcileCatalogRows from the merge return -> no-op-refetch identity and
per-element reuse fail
- filterSetupsForPrunedRepoRows back to `[...setups]` -> no-op-refetch identity
fails
- retainValidFilterRepoIds back to `.filter(...)` -> both filter-identity cases
fail
- areValuesEqual reduced to `a === b` -> all three reconcile cases fail
- areValuesEqual forced to `true` -> all six change-propagation cases fail
- setup key switched to setup.id -> the two-hosts-one-repo-id case fails
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Why: OMP ask maps to blocked sidebar state but should not trigger
native prompt rendering. Only Pi's ask_user_question needs the
interactivePrompt payload for live card display.
The omp agent-hook path could never reach the blocked state: the
ask-question gate in normalizePiCompatibleEvent required
agentType === 'pi', isAskUserQuestionTool only matched
ask_user_question/request_user_input (omp's tool is named 'ask'),
and extractPiToolFields only derived interactivePrompt for Pi.
An omp agent parked on its ask tool therefore showed 'working'
in the sidebar with no question card.
Widen all three gates to include omp so tool_call /
tool_execution_start for 'ask' maps to blocked and carries the
pending-question envelope for the live card.
* fix(terminal): repaint a recovered remote pane from the host's retained buffer
A remote-runtime pane that loses its stream re-subscribes, but the recovery
subscribe only carries new bytes. When the host's push snapshot is empty --
an idle pane, or one whose PTY has exited and is preserved with its buffer --
the transport dropped it and nothing re-armed the restore, so the pane stayed
blank until a visibility flip issued the tagged snapshot request. That is why
switching worktrees once "fixed" it.
Emit onStreamRecovered from the recovery subscribe path only, and mark the
hidden-output restore needed so the pane pulls the buffer the host still holds.
The initial subscribe is untouched: it already carries the host snapshot, and
re-arming there would cost every pane a redundant restore request on open.
* perf(terminal): avoid duplicate recovery snapshot replay
Brennan Benson
Jinjing
Neil
Jinwoo Hong
BingZandBrennan Benson
m4air
FurmaPandaandcoderabbitai[bot]
FurmaPanda
