The startup PATH probe spawned the user's login shell with -ilc. The
interactive (-i) flag forces sourcing of interactive rc init (compinit,
oh-my-zsh, completion generators, nvm/sdkman) that forks many nested
execs. On managed macOS machines with Endpoint Security agents (Jamf
Protect / CrowdStrike), each nested exec awaits an ES_EVENT_TYPE_AUTH_EXEC
verdict; a stalled verdict wedges the spawn in uninterruptible kernel
sleep (U state) that SIGKILL cannot reap, hanging Orca startup with no
window until reboot.
Switch to login-but-non-interactive (-lc). PATH lives in login profiles
and unguarded rc exports, both still sourced under -lc, so the captured
PATH stays complete while the subprocess-spawning interactive init that
triggers the AUTH_EXEC wedge is skipped. The 5s timeout + SIGKILL is kept
as defense-in-depth (it cannot reap a U-state process, so avoiding the
wedge via -lc is the real fix).
Co-authored-by: Orca <help@stably.ai>
Fixes#6274.
Non-Latin layouts (Cyrillic, Greek, ABNT2, …) report a non-Latin logical `event.key` for physical letter keys (physical `KeyC` → `с`) while `event.code` stays `KeyC`. The shortcut matcher only fell back to the physical code when `event.key` was empty/Dead/Unidentified, so Mod+letter/digit chords never matched on those layouts — Ctrl+C copy in Monaco Source mode appeared to do nothing and the chord could not even be rebound in Settings.
Adds a tightly-gated non-Latin physical-code fallback (non-macOS, real Ctrl/Meta modifier held, excludes AltGr/Ctrl+Alt composition, only when no logical Latin token exists). Verified: full keybindings suite (55 tests) + targeted Cyrillic/Greek/AltGr/wrong-key cases pass; web + node typecheck clean.
* fix(source-control): refresh branch compare after upstream changes
- Refresh branch compare when upstream status changes for the same worktree and base ref
- Prevent stale Create PR eligibility from remaining clickable while a newer preflight is loading
- Add regression coverage for upstream-driven compare refreshes and stale Create PR loading precedence
* fix(source-control): preserve review provider during preflight refresh
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Combined diff tabs (such as branch, commit, or uncommitted changes)
use display labels as relative paths and require the desktop-only
combined renderer. Excluding these tabs from the mobile snapshots
prevents mobile clients from incorrectly attempting to read them
via files.read.
* Pass ptyId directly to restorePaneTerminalFit to avoid race conditions
Avoid re-reading the pane transport after a mobile disconnect race,
which could otherwise restore a recycled pane instead. Passing the PTY
ID directly ensures the correct terminal is restored.
* Prevent reclaiming terminal if PTY ID does not match current pane
Avoid restoring a terminal with a stale PTY ID if a different terminal
has already reused the pane slot. Trigger a state override tick to make
stale portals disappear instead.
Replace the play icon with a plus icon and update the label from
"Command" to "Add Quick Command…" (including localizations).
This provides clearer visual and textual cues that the action creates
a new command rather than running an existing one.
* fix(renderer): answer OSC color queries from active terminal theme
- reply to OSC 10/11 foreground/background queries using the resolved xterm theme
- suppress replayed OSC color replies to avoid leaking escape output into fresh shells
- cover theme-derived color replies and replay suppression with focused tests
* test(renderer): cover terminal OSC color query replies
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
Catch errors during hosted review lookup if local blockers are present.
This ensures that network or API failures do not completely hide the
Create PR preparation UI if we can still guide the user to resolve local
issues first.
* fix Orca CLI path resolution and improve registration UI
- Hydrate the shell PATH before running installer actions on macOS to
match the user's terminal instead of launchd.
- Resolve the active macOS command path dynamically against shell PATH
candidates, ignoring broken symlinks and non-executable files.
- Detect and report conflicts with unmanaged executables shadowing the
configured command path.
- Add "Preparing..." and "Registering..." loading states to the settings
and setup panels during preflight checks.
* Fix Orca CLI detection and installation path conflict checks
- Allow detecting a managed Orca command located later in PATH when the
default path entry is missing or non-executable.
- Avoid raising installation conflicts for unmanaged commands located
after the default install path, as they will be safely shadowed.
- Translate terminal setup and Orca CLI registration strings for
Spanish, Japanese, Korean, and Chinese locales.
* Only open terminal when pre-install checks succeed
Prevent the terminal from opening and setting the terminal command if
onBeforeOpenTerminal or refreshPreInstallNotice throws an error.
When committing East Asian text (e.g., via Microsoft Pinyin) on Windows,
the local terminal renderer can leave newly printed glyphs blank until
a repaint is triggered.
This detects CJK, Korean, and fullwidth Unicode ranges and forces a
viewport refresh when such output is received immediately following
active terminal input on Windows clients.
The "Scanning sessions" loader sat in a `flex items-center gap-2` row
next to a plain text span with no flex-1/min-w-0 sibling to absorb
slack. Both items default to flex-shrink: 1, so the SVG could be
compressed below its 14px width while keeping 14px height — a
non-square box shifts the rotation pivot off center, making the icon
drift instead of spinning in place.
Add `shrink-0`, matching every other text-adjacent spinner in the app.
Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Fix browser pane stuck in HTML fullscreen (#6442)
Guest content in a browser pane could enter HTML fullscreen but not
exit it: requestFullscreen() resized the host BrowserWindow into native
fullscreen, and exitFullscreen() had nothing to restore, leaving the
pane stuck.
Set the webview's disableHtmlFullscreenWindowResize preference so HTML
fullscreen is contained to the <webview> element. Exit then works and
fullscreenchange fires as guests expect.
* Apply browser guest fullscreen policy consistently
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Wolfgang Schoenberger <221313372+wolfiesch@users.noreply.github.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
* fix(pet): shrink overlay drag area to hug the pet content
The pet overlay's `pointer-events-auto` handle used `size-full`, so the
entire `size × size` box (default 180px) was draggable even where the pet
was transparent. Non-square pets left a large dead-zone: the bundled
Claudino (320×180) renders 180×101 in the box, leaving a ~79px empty but
draggable band; OpenCode/Gremlin (252×320) render 142×180, leaving ~38px
on the left.
Restructure the overlay into three layers: the outer box and a new
centering layer stay `pointer-events-none`; only an innermost
`w-fit`/`h-fit` wrapper opts back into pointer events and carries the drag
handlers, cursor, bob animation, and `touch-action`. A `min-w`/`min-h`
floor keeps it grabbable during the image-load window when the wrapper
would otherwise collapse to 0×0.
Also size the `DetectedSpriteFrame` canvas to one fixed footprint bounding
the largest scaled frame (instead of the full box) so detected sprites
tighten too, with frames re-centered within that footprint.
Drag math, viewport clamping, and persisted position are unchanged — they
remain keyed to the outer box, so dragging, edge-clamping, and saved
positions behave exactly as before.
* fix(pet): cap the img fallback at the pet size
The w-fit/h-fit drag wrapper is fit-content, so the img's max-w/h-full had
no fixed box to resolve against and rendered at intrinsic size, overflowing
the persisted size box that clamping still assumes. Cap explicitly with
maxWidth/maxHeight: size. Addresses CodeRabbit review on #6437.
* test(pet): cover overlay hit area render branches
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
* Fix macOS Chinese IME full-width punctuation and window-switch input
Two macOS IME regressions in the terminal:
- Full-width punctuation (，。？！) was sent as half-width ASCII. With
kitty keyboard on, xterm encodes+sends the ASCII symbol on keydown and
preventDefaults it, dropping the IME's committed glyph from the input
event. Bypass those punctuation keydowns/keypress/keyup so the native
input pipeline runs, then forward the committed glyph to the PTY.
- After switching windows, the IME stayed stuck in ASCII with no way back
to CJK. macOS+Chromium leaves a stale NSTextInputContext on the still
focused helper textarea after reactivation (electron#32307/#34952).
Force a blur -> next-frame refocus on window focus to rebuild it.
Both paths are macOS-scoped where relevant and covered by unit tests.
* Tighten macOS IME punctuation handling
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* fix(browser): keep webview guests alive across worktree switches
Electron <webview> guests are destroyed when their DOM parent is removed.
When switching worktrees, BrowserPane chrome unmounts and previously tore
down the webview, forcing a reload on return.
Introduce persistent page viewports inside overlay slots so webviews stay
in a stable parent without keeping the full React chrome mounted. On
worktree switch, park hidden viewports instead of destroying guests;
explicit close paths still call destroyPersistentWebview.
Fixesstablyai/orca#6385
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(browser): harden persistent webview viewports
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
- Centralize and align auto-merge eligibility logic across web and
mobile clients.
- Use the `enablePullRequestAutoMerge` GraphQL mutation instead of
`gh pr merge --auto` to prevent immediate merges on clean branches.
- Fall back to `gh pr merge --auto` when a merge queue is required on
the base branch.
- Hide the auto-merge control when only optional checks are pending.
Previously, the AI Vault only blocked resume actions for workspaces with
an active SSH connection (checking `connectionId`). This allowed resume
actions to run on runtime-owned workspaces, which are non-local but do
not use SSH.
To resolve this:
- Introduce `getAiVaultResumeWorkspaceTargetStatus` to classify targets
based on both `connectionId` and `executionHostId`.
- Restrict AI Vault panel actions, session resume checks, and drop layers
to local workspaces.
- Preserve the `executionHostId` on project groups during normalization to
ensure runtime-owned groups retain their execution host status across
persistence reloads.
Avoid forcing the active view back to the creation panel when background
worktree preflight completes after the user has already navigated away.
- Add a `revealCreationSurface` option to `continueBackgroundWorktreeCreation` to skip switching views.
- Check both `activeView` and `activePendingCreationId` to determine if the creation UI is actually visible.
- Use this option when kicking off background creation for GitHub work items.
Windows runs managed hooks through a shell, and #6078 wrapped the
launcher in `powershell -EncodedCommand` to survive spaces in profile
paths. Combined with the inner PowerShell Invoke-WebRequest post, every
hook spawned two PowerShell processes (~300ms startup each), so a hook
took ~650ms+ and fired up to 6x per turn. Codex 0.140 renders that as
lingering "Running <event> hook" rows. The earlier RC worked around it
by deleting SessionStart/UserPromptSubmit/Stop, which loses lifecycle
status fidelity.
Keep all six Codex events and make them fast instead:
- Codex runs hooks as `cmd.exe /C <command>` and forwards our string
verbatim when it has no spaces/quotes, so emit the bare .cmd path for
cmd-safe profiles (zero shell startup) and fall back to the encoded
PowerShell launcher only for spaced/metachar paths (#6078 robustness).
- Replace the inner PowerShell post with curl.exe (Windows 10 1803+),
posting the same form fields as the POSIX hook and reading the raw
payload from stdin via `--data-urlencode payload@-` so UTF-8 (e.g. CJK)
survives without code-page translation.
Result: the common Codex case is 0 PowerShell (~70-150ms vs ~650ms);
spaced-path profiles drop to 1.
Claude runs hooks through Git Bash, so its launcher must stay
PowerShell-encoded (a bare path is what breaks it), but its inner post
moves to curl.exe too, cutting Claude from two PowerShell startups to
one.
Validated against the real Codex 0.140 binary (interactive TUI + exec):
all managed hooks fire, render briefly, and clear with no lingering
rows; the listener receives every post in 1-6ms.
Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* fix(automations): track exact run terminal targets
Record terminal pane keys and PTY ids on automation dispatches, persist them across run updates, and propagate them through runtime launch results.
Use the recorded pane and PTY for completion detection, session reuse, prompt submission, and View run navigation so split-pane tabs reopen the actual run terminal.
Keep legacy runs compatible by falling back to workspace resume when exact terminal identity is absent.
* chore: address automation targeting review cleanup
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
NeilandOrca
Jinjing
Brennan Benson
Siddiqui QamarandJinjing
Jinwoo HongandOrca
lvfenandJinjing
