buildPluginListEntries disambiguates plugin names with `t`; the
manager already reads it, so pass it and recompute on a language
switch. The manager would go over budget, so its entries memo and the
auto-update reads it depends on move to use-plugin-manager-entries.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix: report agent launch failures once with actionable recovery
* fix: keep terminal launch controls shown but waiting while the host connects
Replace per-row pending metadata with one derived terminal-readiness flag on
the agent menu model, kept out of picker identity keys. Terminal buttons and
rows stay mounted and disabled while SSH or a paired server is still
connecting; chat and Configure stay usable, and the terminal default is not
changed. Repo targets with no workspace yet read the repo host's facts.
Invalid Source Control arguments keep their existing actionable message.
* fix: keep launch readiness and failure ownership consistent across pickers and fallbacks
A host that is still connecting now declines a terminal launch silently at the
launcher, including shortcuts and fallbacks, instead of reporting a failure.
A terminal fallback refused behind a visible chat reports through that chat's
notice rather than a second toast. The agent picker stays usable while only a
terminal waits; an armed terminal rechecks readiness on Enter; a configured
chat option no longer inherits the terminal's waiting state; waiting terminal
controls say why. Invalid CLI arguments name the actual problem for every
caller, the no-agent shortcut message is restored, and prospective repo
readiness no longer rescans repos on unrelated store writes.
* fix: keep the handoff dialog open when a host-waiting launch opens nothing
A session continuation launched through the host's admission now waits for
that launch to settle before reporting the handoff. When the host declines the
chat and its terminal fallback is declined while the host is still connecting,
nothing opens, so the dialog stays open for a retry instead of closing with no
session and no message.
* fix: let the handoff dialog close while its session is starting
Cancel, Escape and outside clicks now close the Hand Off dialog even while a
start is in flight; Start stays disabled with its spinner. Closing aborts agent
detection if it is still running, and a dialog closed during detection starts
nothing. A launch already sent settles on its own and reports through its
existing owners. The in-flight start belongs to the request it was made for, so
a late finish never closes, completes or blocks a dialog reopened since.
* test: replace type assertions in launch refusal tests with typed fixtures
* refactor: name the setup panel's launch helper launchSurface
* perf: resolve a picker's terminal host only when ownership changes
The terminal readiness check rebuilt the target's ownership chain and ran
the full OS resolver on every store write, for every mounted picker. Each
picker now keeps its target host and re-resolves it only when an ownership
slice changes; other writes read just that host's connection and contact
facts. Local hosts read nothing. The launcher's own pending decline uses
the same host pieces from execution-host-facts, so the rule has one copy.
* perf: word a declined chat's fallback failure without re-saving launches
Wording the failed chat's notice after its terminal fallback was refused
re-saved every retained launch record, though the wording itself is never
saved. Listeners now hear about it without a save; lifecycle changes still
save. The refused-fallback test moves to its own file and counts saves at
two sizes.
* test: narrow refused launch outcomes where tests read the opened tab
launchAgentInNewTab now returns a refusal instead of a tab when the
launcher declines, so tests that read the opened tab's surface or
completion narrow it first. Fixes the web typecheck.
* fix: keep Configure usable and show one reason on a waiting agent row
While the host connected, each New Chat agent row was marked
aria-disabled, so its Configure button read as disabled to assistive
tech and keyboard. The row now only blocks its launch and points to its
"Connecting…" reason. A row shows one reason, the one that stops its
launch now, and the agent name keeps its width so it is not cut to a
single letter.
* test: cover distinct repo targets and host freshness in the picker perf contract
Pickers for workspaces not created yet now count repo reads cold and after
another host's row is republished, at two scales with a repeated-target
control, and assert no unaffected renders. Two freshness controls follow
the cached host: an owner moving from local to a connecting SSH host and
back, and a paired server that is still checking versus verified with its
OS.
* fix: mark a waiting agent launch unavailable while Configure and chat stay usable
An agent row's launch item also held its Configure button (New Chat) or
its start-in-chat button (the + menu). Disabling the row while the host
connected disabled those too; leaving it enabled made the waiting launch
read as available and then do nothing.
The launch item and those controls are now siblings. While the host
connects the launch item is marked unavailable, dimmed and described
"Connecting…", and stays focusable so arrow keys still reach the
controls beside it. Configure and chat keep their own state. A chat
started from Configure or the chat button goes through the row's guarded
launch and closes the menu, without choosing the waiting item.
* fix: release the agent row button's press listeners when a press is cancelled
Each press on the button beside an agent row added a window listener that
only a pointerup removed, so cancelled touches and closed menus left them
behind. A press now owns one handler that removes both listeners on
release, cancel, the next press or the row closing; drag release onto the
button still chooses it.
* fix: give the agent launch row item its own menu item variant
The launch item beside Configure or the chat button restyled the shared
menu item (transparent focus, dimmed while unavailable), which the design
system gate rejects. That treatment is now the menu item's launch-row
variant; the rendered rows are unchanged.
* fix: route the menu's terminal host by owner and repair the e2e and ja checks
The menu's terminal readiness now reads workspace records through the
workspace record selectors and picks a not-yet-created workspace's repo by
the host it names, without the focused-host fallback; with no host named
it settles only when the id has one row, which reads the same. Its cached
host is re-checked when the settings slice changes instead of reading the
focus setting. E2E unit tests narrow refused launch outcomes, and the two
new ja strings write Agent as the rest of the catalog does.
* test: count a launch as opened only when it returned a surface
A refused launch now returns its refusal instead of null, so the parity
check asks whether a surface opened.
* perf: keep menu readiness on the workspace's owner and index the twin fallback
Terminal readiness re-resolved every mounted menu's host on any settings
write, and an unstamped worktree whose project is listed both here and by
a paired server walked the whole repo catalog to resolve. Readiness now
resolves an existing workspace's host from its resource owner only, never
the focused default a row-less setup terminal is created on, so settings
writes leave it alone. The shared-project check reads that project's rows
from the existing per-snapshot repo index instead of the whole catalog.
Setup terminals and every route keep their behavior.
* test: assert which readiness pickers render on each detected-twin update
The detected-twin perf contract now checks render deltas per update: a
catalog republication renders no picker, and stamping the first workspace
with a checking server, then that server reporting its OS, renders only
that workspace's pickers.
* test: give the structured chat fixture's owner stub the menu's resource host
The fixture replaces the whole worktree owner module with a stub, so the
menu readiness check's new resource-host export was missing and the
picker path threw before launching. The stub now answers both exports
with the scenario's owner host.
* Keep launch failures with one action owner on current menus
* Align Start work regression with its remote launch target
* Narrow refused launch outcomes in current contract tests
* Assert notified refusals in existing launch regressions
* Assert the refused keyboard launch receipt
* Narrow successful web runtime launches in tests
* Keep agent menu labels left aligned
* Keep merged launch reporting within existing checks
* Keep direct launch argument reads within the file limit
The holder's script is the production text with pollSeconds=0.1; fixed 2.5s
'still running' windows become waits for the holder's blocked note or its
'sleep 1' wait on the requesting orcad, then a short several-poll window.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test(pty): run codex --no-daemon shell cases concurrently
Each case still gets its own fresh shell and sandbox; spawning async lets
pwsh startups overlap instead of running back to back.
* test(daemon): skip raw-API serialize variants outside differential runs
Only the differential (old vs new build) I1 check reads variants 1 and 2;
a single-build replay compares variant 0, the production snapshot path.
* test(codex): shorten app-server start budgets and batch teardown races
Stand-ins arm in under 100ms on a loaded host, so a 3s start budget still
leaves wide margin; the 40 stdin-close/root-exit races run 4 at a time.
* test(codex): keep 5s start budgets for slow CI runners
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
use-ai reads useTranslate for its conflict-launch toast, and the
create-review header actions take the action model's `t`. Both files
would go over budget, so the recipe-save callbacks and the provisional
hosted-review provider inference move to their own modules first.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test(agent-session): jump the start retry backoff on a fake clock
The five-attempt cases waited 1.5s of real 100·2^n ms backoff each. Route the
backoff's promise delay through fake timers and jump it while real time still
passes for file and database work.
* test(cli): delete the owner-choice work-count suite
It asserted property visits, serialized bytes and call counts under spied
globals at 10,000 workspaces; owner election behavior stays covered by
index-workspace-owner-choice.test.ts.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The cursor-owner test called MonacoGutterContextMenu as a plain function
and dug its action out of the element tree, which kept the component on
translate(). Render it instead, reading each item's action by label, and
convert the component.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* perf(ssh): let orcad coalesce output longer for background-visible terminal streams
Adds capability-gated SetOutputCadence (opcode 20) and an initial subscribe
cadence. Background streams batch over 100ms instead of 5ms (64KB cap kept,
bytes unchanged); switching to focused, or output carrying a reply query the
view answers, flushes immediately.
* perf(ssh): report focused vs visible-background cadence for remote panes
The remote multiplexer advertises outputCadence and sends cadence changes only
after the host echoes it. Panes report focused only when visible and the
active split, resyncing on bind, visibility, focus and tab-activity changes.
* perf(ssh): resync output cadence after splits and update cadence test fixtures
* perf(ssh): add orcad output-cadence kill switch and shorten background window to 50ms
ORCA_DISABLE_TERMINAL_OUTPUT_CADENCE=1 makes orcad neither echo the capability
nor apply the background window. Only callers that retune cadence advertise it,
so other terminal subscribers keep their wire shape.
IpynbViewer translates its invalid-notebook fallback at render instead
of inside the parse memo, so the memo still depends only on content.
CopyButton resolves its default title from `t` instead of a parameter
default.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test(agent-hooks): drive Claude helper-kill transcript polls on a fake clock
The 1s transcript poll deadline made each waitFor sleep ~1s of real time.
Fake setTimeout/performance and advance the clock while file I/O stays real.
* test(orchestration): spawn the bundled CLI in the restart handoff test
Each of ~25 CLI subprocesses paid ~1s for a tsx loader start. Bundle the real
CLI once with the orcad CLI build and run it under plain Node.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* perf(rpc): stop the dispatcher importing every RPC method by default
Callers pass the method list. A test that builds a dispatcher no longer loads
the full method registry, cutting the dispatcher's import graph from ~4k to
~550 modules.
* chore(lint): keep the RPC dispatcher and plugin RPC off the method registry
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Five refused provider opens can outlast a 2s real-time budget on a loaded host,
so the preamble resolves 'unobserved' instead of throwing the refusal under test.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* perf(terminal): send idle remote keystrokes without the 8ms debounce
Remote terminal input batching was a pure trailing debounce, so every
isolated keystroke waited 8ms before leaving the renderer. Send input at
once when the batcher is idle and coalesce only what arrives inside the
following window. Recovery-hold replay keeps the trailing path so a
synchronous flush cannot re-enter the still-buffering hold.
* perf(ssh): disable Nagle on loopback sockets carrying orcad RPC
The SSH forward listener, the stdio bridge listener, and the remote
bridge's connect to orcad relay WebSocket RPC (keystrokes and echo).
ws sets TCP_NODELAY on its own sockets, but these relay sockets did not,
so small writes could wait behind an unacknowledged segment.
* perf(terminal): decode terminal frame payloads as views, not copies
Every message buffer is fresh and consumers decode the payload
synchronously or retain it read-only; the only in-place rewrite touches
header bytes.
* fix(terminal): send idle remote keys at once only to input-acking hosts
On hosts without input acks, an immediately sent key travels as a stream
frame while a following accepted write (Ctrl+C, paste) goes as a separate
terminal.send RPC on another socket, so the host could apply them out of
order. Keep the trailing batch there so both still leave as one RPC.
TerminalPane's default-shell search entry and the terminal link action
keywords move to their own search modules, like their sibling sections.
The search catalogs bind `t` once through searchKeywordTranslator, so
threading it keeps them within budget; the bound function keeps the
translateSearchKeyword name so catalog extraction still reads its keys.
TerminalSettingsPreview reads useTranslate; its lifecycle test's hook
mock now covers useContext. ShortcutsPane and the catalog app themes
pass `t` into the helpers their memos call.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Section headers and the setup prompt's candidate source read their copy
through helpers that called translate(). The worktree viewport and the
setup prompt already read `t`; pass it through instead. Two files
would go over budget, so the header row context type and the setup
inspection effect move to their own modules first.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The run sentence and background task rows read their words through
module translate() tables, so a memoized render keeps the old language.
Key both on `t` with recomputeOn. The language-switch tests now mount
TranslationScopeProvider, as the app does, so `t` changes there too.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* Report image copies the clipboard refused instead of showing "Copied"
The desktop clipboard image write returned without an error when it refused an
image (too large, not a PNG, undecodable), so "Copy as PNG" and browser screenshot
copies showed success while the clipboard was unchanged.
- Main and web image writes now reject on every refusal.
- The image viewer copies a raster image's own bytes (natural size), reusing the
paste/copy PNG conversion; only SVGs still render at 2x for sharp text.
- Too-large failures say so, through one shared description used by native chat
and the image viewer.
- Browser screenshot copies show success only after the write resolves.
Refs STA-14205
* Keep grab toasts on their own screenshot and show a successful retry as success
Refs STA-14205
* Drop a grab screenshot result once a newer toast, copy or cancel replaced it
Refs STA-14205
* Move the grab screenshot copy owner into its own hook
Refs STA-14205
* Test that native chat explains a too-large image copy behind the IPC error prefix
readFullOutput listed failedAt as a dependency without reading it, so a
compiled build would keep one reader across failures and the dialog
would keep the first run's output. recomputeOn makes failedAt an input.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Five tests passed only because each re-render re-read mutated inputs.
Set host capabilities through the store, pass new controller and
runtime snapshot objects, and read popover state from context like
Radix does. Drop AgentIcon render-count assertions.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(ssh): keep the managed tunnel's TCP forward when a slow ProxyCommand delays its login
`ssh -L` binds its local listener only after its own login. The managed
tunnel gave that login 750ms plus a 5s channel check, then judged the
forward "never listened", killed it and switched the whole connection
generation to the per-socket stdio bridge. Through a slow ProxyCommand
(Coder `ssh --stdio` on Windows, without ControlMaster) the login often
takes longer, so the working forward was discarded and every socket paid
a fresh proxied SSH login, leaving the server Unreachable (#38636).
Give the listener the same 30s budget a system SSH connect gets, keep
the short wait for the channel answer once it listens, and stop waiting
as soon as the forward process exits so a refused login still falls back
at once with ssh's own exit reason.
Refs #38636
* test: give the slow-login forward test its timeout reason and real-socket wait exception
Adds a branch picker to the Source Control header for switching or creating a branch in place. Switching is disabled while an agent is working in the workspace, and results show as toasts.
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* refactor(agent-session): split subscribe params and read failure text into their own modules
Both host files sit at the 300-line budget, so the append negotiation that
follows needs room. Pure moves: SubscribeParams keeps its exact schema (now
z.object + sessionId instead of OptionsParams.extend, which is equivalent) and
is re-exported from the params module; stream failure text moves beside the
other read-refusal classification.
* perf(agent-session): stream running tool output heads as appends
A running tool call re-sends its whole output head (up to 16KB) on every
revision, and keeps re-sending the saturated head after it stops growing.
Streams that also ask for toolOutputAppend (host advertises
agent-session.tool-output-append.v1) now get only the head's new text under the
same shared sender/reader rules and self-healing refusal as reply appends.
- The live read negotiates the exact subscribe capabilities object instead of
a boolean; mobile asks for tool output appends when advertised.
- Hosts with only text-append.v1 drop the unknown key, so clients ask only
when the new capability is advertised and both ends track the same bases.
- Text-only streams keep the 8-base limit already-shipped readers evict at.
- A host that refuses the capabilities param (an older build after a
downgrade) makes the next open go without appends instead of failing forever.
* perf(native-chat): ask remote hosts for streamed text appends on desktop
Desktop chats on a paired or SSH-managed orcad received every streamed reply
checkpoint whole: about 9x the reply's bytes at the Claude/Codex checkpoint
cadence, and O(N^2) for ACP/JSONL providers that rewrite each 60ms window.
The desktop read now asks environment hosts for reply and tool-output appends
when they advertise them, reusing the shared reader that rebuilds whole items
before the reducer. Local IPC reads are unchanged and still subscribe in the
same turn. The support read runs once per chat run, overlapping hydration.
* refactor(remote-runtime): share compressed frame inflate across client platforms
Move the length checks and decode of paired E2EE compressed frames into
the shared module behind a small gzip/UTF-8 codec, so the desktop can
read them with node zlib while mobile keeps its native/fflate path.
* perf(remote-runtime): read compressed frames from paired hosts on desktop and CLI
Desktop and CLI sockets to orcad/orca serve now advertise
transport.compressed-frames.v1, so a v2 host gzips large text replies and
terminal output before sealing them, as it already does for phones.
- Every Node client transport (one-shot requests, request connection,
shared control, subscriptions) opens frames through one sealed-frame
reader that inflates compressed frames on v2 channels, synchronously so
frame order and v2 counters stay in arrival order.
- A compressed binary frame may claim up to the 8 MB binary outbound cap
(terminal frames can exceed the 4 MB JSON cap), for phones too.
- ORCA_DISABLE_MOBILE_COMPRESSED_FRAMES=1 now also stops a desktop or CLI
from asking for compressed frames.
- Relayed phones and the browser client are unchanged.
* refactor(remote-runtime): simplify the mobile inflate codec and clarify capability comment
* fix(remote-runtime): name why a sealed frame could not be read
Text-only sockets report an authentic binary payload as an unexpected
binary frame again, and tell a decrypt failure apart from a corrupt
compressed frame, instead of calling every failure undecryptable.
* fix(terminal): use Regular weight by default on Windows
Cascadia Mono, the Windows default, has no Medium face, so a 500 request
rasterizes as SemiBold. New Windows profiles default to 400; Windows profiles
still on 500 move to 400 once and see one persistent toast with a live
preview and a switch to keep 400 or go back to 500. Skipped when the
terminal font renders both weights identically.
* chore: prune stale renderer layout-writer baseline entry
* fix(i18n): translate the Windows weight toast label reactively
Adds a Custom… option to the App Icon switcher. The picked PNG/JPEG is
header-checked before decoding (square, 64–2048 px, ≤10 MB), re-encoded as
PNG into userData, and applied to the macOS Dock and every window icon. It
persists across restarts and can be removed, which resets to Classic.
Closes#13316
The managed server liveness probe matched kill -0's ESRCH text
case-sensitively. zsh and ksh print it lowercase, so on hosts whose login
shell is zsh a recorded PID that no longer existed read as UNKNOWN. The
wake then never restarted the stopped server, the update deferred on an
uncounted census, and the host stayed unreachable. Match either case;
permission errors still stay UNKNOWN.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Claude transcripts only sit directly in a project bucket; the History walk now shares the bucket-depth rule the session-id lookup already uses instead of only pruning subagents/.
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(terminal): never type a colour reply into the shell after the program that asked has exited
The PTY owner holds a colour-query reply made inside a shell command for up
to 20 ms and drops it if the command's OSC 133;D arrives, or (POSIX) another
process group takes the terminal; otherwise it answers. Command markers ride
the colour scan every emission already pays, so the hot path does no new
work until a query is pending. No daemon protocol change.
Closes#16633Closes#14631
* fix(terminal): track command markers in the existing colour scan, drop the live-group shortcut, and hold through claimed echoes
* fix(terminal): one verdict for every query held behind the first, contiguous ranges through a held echo, drop held replies at the final snapshot
* refactor(terminal): move the torn query/echo holds out of the ingress
* fix(terminal): a query completed after a verdict is judged afresh; the final snapshot judges held askers instead of dropping them
* perf(renderer): add unfocused slowdown to shared visibility poll primitives
installWindowVisibilityInterval gains slowWhileUnfocused (focus read at tick
time, overdue catch-up on window focus) and the git status refresh scheduler
gains cadenceScale + retime(). Opt-in; focused cadence is unchanged.
* refactor(source-control): extract git status scheduler window-presence hook
* perf(ssh): slow remote port, git status and compare polls while unfocused
Visible-but-unfocused windows poll workspace/host ports, branch compare,
stale conflict probes and active git status 4x slower, so agent edits no
longer drive remote git status every 3s behind another app. Hidden windows
still pause; window focus runs overdue work immediately.
* perf(source-control): keep activity debounce when refocus re-times git status
* test: drop cadence-count tests for unfocused poll slowdown
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Live reasoning and reduced-motion replies passed streaming but never growing,
so each update re-parsed the whole message (~260ms avg per update on a 20KB
reply in happy-dom, vs ~3ms block by block).
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The accepted option support and the selection controller's terminal revision were read from mutable owners during render. Pass the reader snapshot and the selection revision each hook already subscribes to as recomputeOn inputs, so a compiled memo recomputes exactly when those values can change. Without the compiler the reads are unchanged.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* wip
* Open HTML previews in the editor's tab group
Keep previews in the invoking group for local and remote files, and
avoid changing the selection if the user navigates away while opening.
* test: cover HTML preview from editor
* fix perf issue
* Prevent HTML previews from opening on the wrong host
* Guard HTML previews against workspace ownership changes
Applies pnpm i18n:reactive-translate --helpers. Output is unchanged: t delegates
to translate() and helpers default the threaded parameter.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
OrcaWinandOrcaWin
Brennan Benson
Neil
Kelvin Amoaba
Jinjing