* fix(native-chat): a chat sends again once the terminal's agent exits on macOS
The terminal-writer check required the pane's root process to be a shell,
but macOS panes spawn under login(1), which stays as the shell's parent,
so the check refused every send until the terminal closed. Census the
shell login started instead.
* Reconcile current terminal writer evidence before continuation
* Share fresh foreground confirmation and prove hosted login census
* Restore shell process identity import in foreground tracker
* Correct process fixture identity and polling callback contracts
* Align decisive Windows inspection fixture expectations
* Complete foreground inspection Session fixture
applyManagedHooks rebuilt each managed Claude hook from scratch, so an
explicit "async" a user added to an Orca hook in settings.json was wiped
on every install. Carry the boolean over from the managed hook being
replaced for the same event; fresh installs stay synchronous and
user-owned hooks never donate their value.
Fixes#26718
Co-authored-by: Neil <neil@stably.ai>
top costs ~263 ms of CPU per sample, so the memory panel only refreshed
footprints every 10 s. The new orca-process-footprint helper reads
phys_footprint for every same-user process in ~3 ms, so footprints now
refresh on the panel's 2 s poll. top stays as the fallback when the helper
is missing or fails.
Co-authored-by: m4air <m4air@Mac.localdomain>
Route the remaining hardcoded English in the crash report dialog, the
macOS/Windows notification failure hint, the feature tour reopen hint and
the CLI install fallback through translate(), with keys in all locales.
Fixes#27074
Co-authored-by: outof-place <contact@outofplace.space>
* fix(wsl-host): a runtime-call reconnect never boots a distro that stopped meanwhile (E9)
ensureForRuntimeCall reconnects only to a distro confirmed running, but the distro
could stop between that read and the reconnect, which would then boot it. A runtime
call now asks for a no-boot connect: the connector supplies a running-list check that
the connection manager runs right before anything spawns in the distro, refusing
with WslDistroNotRunningError (and starting nothing) when the distro isn't confirmed
running. The generation is read before that await, so a close during it still
supersedes the connect.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(wsl-host): import the no-boot error alongside the other connection errors
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl-host): no-boot connects don't swallow a focus boot, report no failure, re-verify (E9 review)
Review of #34050:
- A connect that may boot (focus, Connect) joined an in-flight no-boot connect and so
inherited its refusal. It now waits for that one and runs its own.
- A no-boot refusal published 'failed'. It now publishes nothing from the manager;
the supervisor, whose connect had already disarmed the entry, re-verifies instead of
arming the incumbent (which would dial into the distro), so liveness gives the
verdict and parks a stopped distro.
- The generation is checked right after the running-list read, so a close during it
supersedes the connect before anything deploys.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Concurrent refreshes each re-imported the same four modules. Under vitest,
overlapping imports of a vi.mock'd module share one importer callstack and
fall through to the real module, so the second and third of three rapid
browser creates loaded and transformed the real session-tabs graph inside the
test (about 20-28s) instead of using the mocks.
* fix(orchestration): let a sleeping chat's background commands send as it
* fix(orchestration): keep unreconciled sleeping sessions and ask refused
* test(orchestration): cover ask refusal for a sleeping session
* Fix automatic branch naming for workspace labels in every language
* Use creature branch seeds for typed workspace labels
* Keep first-work generator mocks in creator test suites
* Type the created worktree test mock from its production signature
* Assert created worktree results before exercising first work
* Match the missing-folder update contract in first-work fixtures
* fix(native-chat): make the chat view toggle a remappable keybinding
The terminal and Chat UI toggle was hardcoded to Mod+Shift+J, so users
could not rebind or disable it, Settings did not list it, and it
overrode user bindings on that chord. Declare it as
terminal.toggleNativeChat in the keybinding registry, match it through
the user's keybindings, and render its menu labels from the registry.
* fix(keybindings): align native chat toggle admission and execution
* fix(keybindings): preserve runtime input and defer closed menu hints
* test(keybindings): use typed alias read instrumentation
* Fix keybinding dependency direction and physical modifier inputs
* Preserve typed input facts in floating shortcut arbitration
* Clarify native chat shortcut precedence on Windows and Linux
* Simplify native chat shortcut resolution and nominal labels
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(ports): bound macOS scans by the lifetime of each operation
* refactor(ports): keep Darwin metadata acquisition together
* fix(ports): preserve valid Darwin observations and source host routing
* fix(ports): retain scan admission outside aged temporary cleanup
* perf(ports): skip unused listener acquisition for ownership actions
* test(ports): make child fixture streams portable across runtimes
* fix(ports): share source host derivation across scan rows
* test(ports): initialize scan projection without a type assertion
* fix(ports): restore existing browser open routing
* fix(ports): preserve scanner compatibility on degraded hosts
* test(ports): explain real process lifetime timing
* fix(native-chat): render math and center standalone equations
* fix(native-chat): parse math without rewriting message source
* fix(native-chat): accept element roots for math selections
* fix(native-chat): preserve math boundaries and selected source
* fix(native-chat): derive math fence closure from accepted parser events
* fix(native-chat): reuse exhausted math searches per tokenizer
* fix(native-chat): load math typesetting after parsed formulas
* Use declaration references for chat math augmentations
* Declare chat math metadata and register equation label
* Preserve i18n exports in selection quote test mock
* test: expect cached legacy failure display reuse
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Several zh.json strings used a translation with the wrong meaning for the
UI context (e.g. git base ref, dividers, host, browser profile, search
keywords). Align them with the intended sense and consistent terminology.
Co-authored-by: Neil <neil@stably.ai>
The packaged agent-browser binary resolves its version-matched skills from the
nearest skills/ directory above it (Resources/). Only the binary shipped, so
`agent-browser skills get core` answered "Skill not found" and `skills list`
"No skills found". Ship node_modules/agent-browser/skills/agent-browser and
skill-data beside it on mac, linux and win, and cover it with a test that stages
the host's extraResources slice and runs the real binary.
Refs #17705
Co-authored-by: zerone0x <zerone0x@users.noreply.github.com>
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(ssh): show Move anyway on a host card whose move saved state refuses
A host whose move to its Orca server was refused over saved state (an
enabled SSH automation and its runs, stale workspace details, unsupported
saved tabs) stayed in error on every Connect. Move anyway, which connects
it and leaves those items on this computer, was only in the card's
overflow menu, so the host looked stuck. The card now offers Move anyway
next to its refusal, as it already does for Recover server.
Refs #29083.
* fix(ssh): make Move anyway the next step when saved items refuse a host's move
When a host's move to its Orca server is refused only over saved items
that Move anyway can leave on this computer (#29083's enabled
automation and its runs, for example), every surface now leads with it:
- the host card says which items can't move and that Move anyway
connects the host and keeps them here, with Move anyway as its
primary button;
- the refusal toast says the same and offers Move anyway, opening SSH
Hosts where the move is confirmed;
- the terminal pane's Move anyway is primary too;
- the host picker and connect toast read the same line.
Refs #29083.
* fix(wsl-host): boot only the focused WSL host, and keep a stopped one down
E9 connect policy, part 1. A stopped distro now boots only for an explicit user action
or when its host becomes focused:
- Visible work is the active workspace plus workspaces focused earlier in this window
that still have tabs. Saved tabs alone no longer count, so a launch with two hosts
boots only the focused one.
- After a confirmed stop (wsl --shutdown, WSL update) the host is parked. Liveness no
longer reboots it even when it is visible, and polls get "<distro> was stopped"
instead of a boot. Re-focusing the host, Connect, or the distro running again lifts it.
- Liveness recovery always needs a confirmed-running distro, so a distro that stops
mid-recovery is never booted again.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(wsl-host): launch boots one of two hosts; polls never boot; lost contact never parks
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl-host): only a focus entry or a user action boots a WSL host (E9 review)
Review of #33838:
- Re-focus never lifted a park: a host focused earlier stayed in the visible set, and
the renderer skips unchanged reports. The renderer now sends a separate focus entry
(focusHost) each time the user switches to a workspace on a WSL host, including the
launch restore; only that, or Connect, lifts a park and may boot.
- Runtime calls could boot: ensureForRuntimeCall connected any visible, unparked host.
It now reads the host's reachability first: a confirmed-stopped distro parks at once,
an unreadable running list refuses, and only a distro confirmed running is
reconnected (for visible work). Visible work itself never connects anything.
- Turning WSL hosts on no longer boots every visible host, and focus isn't recorded
while they're off; the window re-reports its focused host instead.
- Each window's visible work is kept apart and unioned, so one window can't drop
another's.
- wakeForAutomation/isConnected move to the automation PR, which uses them.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl-host): a poll waits for liveness's verdict right after an exit (E9 re-review)
Right after `wsl --shutdown` WSL can still list the stopping distro as running (the
supervisor waits and re-reads for exactly this). A poll's cold probe then read
'unreachable', reconnected, superseded the pending distro-stopped verdict and booted
the distro again. The supervisor now reports when it is settling (a verdict in
progress, or a watch/holder exit within the last few seconds), and a runtime call
refuses instead of reconnecting then; the verdict parks the host as before.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(wsl-host): a new supervised entry starts with no recorded exit
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
OMP's ACP session advertises commands it handles itself (e.g. /fast), but
native chat claimed them as host-only TUI commands and refused them as
unavailable. Commands the running session reports in its slash menu are now
left unclaimed so they send through, on desktop and mobile. Mobile reads the
session command list once in the native-chat lane and shares it between the
send path and the composer menu.
* fix(forge): skip PR refreshes for a WSL host that is off, and say so
E9 connect policy, part 3. PR status for a workspace on a WSL host is fetched through
the host, and a poll never boots it. While the host isn't ready, the visible-row
refresh skips it (the row keeps its last badge and the existing "host disconnected"
mark), a direct PR refresh keeps the last answer and records a 'host-off' skip, and
the Checks panel says the host is off and to reconnect it. The cached-field half of the
refresh candidate moves to its own helper to keep the lookup file in bounds.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(forge): a WSL host that goes off keeps its last PR badge and records host-off
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(forge): only a stopped or closed WSL host is "off"; mark row badges as last known (E9 review)
Review of #33840:
- Connecting, reconnecting and unverifiable hosts were treated as off. Only a
confirmed-stopped (or parked) host, or one closed with WSL hosts turned off, is off
now; anything else lets the call proceed or fail as usual. A status change re-runs
the visible refresh, so rows refresh as soon as the host turns ready.
- Row badges now carry the stale mark too: the card's review status gets the hover
card's last-known treatment and "Last known status" in its label, and the hover
card's reference rows are stale and not fetched while the host is off.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(forge): build the host-off PR refresh test on the shared GitHub slice harness
Drops the copied store and seed casts.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
The Team, Lead, Members and Labels popovers in the Linear new-project
dialog are portaled outside the dialog, so its scroll-lock cancelled
native wheel input over their inner max-h-64 lists. Opt their
PopoverContent into the shared wheel shim via wheelScroll, and move the
p-1 padding onto the children so the layout is unchanged.
Fixes#16412
Co-authored-by: Neil <neil@stably.ai>
Replace mistranslated subagent summaries ("kicked off" rendered as "fired"/
"kicked out", untranslated "Ran") and add missing measure words to the zh
tool-run clauses. Leading tool-run clauses are now joined with a translated
runListSeparator so CJK locales use 、 instead of an English comma.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(ssh): say why SSH failed when Connect never reaches the host
When the SSH session itself could not open (key rejected, port refused,
host not answering, host key not trusted), Connect on a host Orca had not
set up yet said "Orca couldn't start its server on this host" and offered
a plain SSH terminal that could not work either. Errors from opening the
SSH session are now marked where they are dialed, and a setup that fails
on one ends the connect with SSH's own reason. A held move keeps its
status. The connect-failure toast also drops Electron's IPC prefix.
* fix(ssh): lead an SSH connect failure with what to do about it
#33928 shows SSH's own reason when Connect never reaches the host. Raw
reasons like "connect ECONNREFUSED 10.0.0.1:22" or "Timed out while
waiting for SSH authentication" still leave users guessing. A failure
from opening the SSH session is now published with a next step for the
kinds users can act on (host key mismatch, rejected sign-in, refused
port, unknown host name, no route, timeout), and SSH's words follow in
parentheses. The connect-failure toast reads the same published text.
With the experimentalConnectors setting on and the desktop signed in to Orca, the desktop keeps one long-poll request open to the Orca Cloud connector and hands each delivery to the existing connector code that starts or talks to an agent. Each delivery is confirmed twice (received, then its result), and the agent's turn and prompt events are reported back. The desktop authenticates with a 5-minute connector token from the Orca sign-in service, follows the relay's start/stop lifecycle, and stops on sign-out. Its hello lists Slack as the one source it accepts. Off by default with no settings UI.
A host whose move to its Orca server was refused over saved state (an
enabled SSH automation and its runs, stale workspace details, unsupported
saved tabs) stayed in error on every Connect. Move anyway, which connects
it and leaves those items on this computer, was only in the card's
overflow menu, so the host looked stuck. The card now offers Move anyway
next to its refusal, as it already does for Recover server.
Refs #29083.
A connector conversation now names its source (slack, discord or linear), and a posted reply reports a neutral messageId. Each machine's hello lists the sources it accepts, and the cloud only routes a Slack conversation to machines that list Slack. Machine events from other sources are filtered out where they arrive, and a reply for a non-Slack conversation is refused, so a Discord or Linear conversation can never post into a Slack thread with the same id. The unused turn-bound cancel fields are removed (they return with Stop). Inert: no shipped desktop uses the contract, and Slack is off unless configured.
sanitizeWorkspaceStatusLabel cut labels with slice(0, 32), which could keep
only the high surrogate of an emoji straddling the limit and render U+FFFD.
Use the existing surrogate-safe sliceAtCodeUnitLimit helper instead.
Closing the Agent Dashboard drawer or workspace board with Escape still
forwarded the key to a focused xterm, because xterm ignores
defaultPrevented. Stop propagation only when the target is the xterm
helper textarea so other fields keep their own Escape handling.
When an imported or cloned folder's derived project id does not match the
selected project, the error now names the id the folder resolves to (for
example github:owner/repo) instead of a generic mismatch message. Host-local
ids and identical ids keep the generic message. The setup-existing-folder
help notes which ids --project accepts.
Fixes#23528
Co-authored-by: Neil <neil@stably.ai>
When a Slack-started agent asks for approval or asks one pick-one question, the thread gets a card with one button per option. Only the person who asked for the work can answer; anyone else is told so privately. The answer travels through the existing inbox and delivery path, and the card closes once answered or no longer pending. Other question formats (grouped, pick-several, typed answers) still point to Orca; a follow-up adds them. Connector service only; Slack is off unless configured.
setActiveWorktree's no-op guard now compares activeWorkspaceKey with the key
derived from the target worktree, so reselecting the current worktree repairs
a stale key instead of returning early.
Session hydration always derives activeWorkspaceKey from the restored
activeWorktreeId instead of trusting a persisted key that may name another
workspace, which kept the wrong sidebar row highlighted after restart.
Fixes#14474
Co-authored-by: Neil <neil@stably.ai>
An Orca launched from inside a Claude Code session inherits CLAUDECODE,
CLAUDE_CODE_EXECPATH, and CLAUDE_CODE_ENTRYPOINT alongside the child-session
stamps #9961 already strips. Every pane then looks nested to Claude Code and
to agent-aware tools, and the inherited entrypoint overrides Claude's own
detection. Add them to the existing inherited-stamp deletion list so every
local, daemon, and relay spawn drops them while explicit pane values win.
Closes#9155
Co-authored-by: Neil <neil@stably.ai>
* fix(claude-accounts): restart System default sessions on the outgoing login when switching
A Claude account switch only restarted sessions in the outgoing account's
own folder. A session on System default (~/.claude) signed in to that
account's exact login, as older Orca's copied login leaves it, was skipped
silently. Match it by email and organization, read by main at switch time;
never compare managed folders by login. Sessions in the user's own
CLAUDE_CONFIG_DIR are no longer treated as System default, and legacy
accounts match their current launch folder.
The ask dialog groups sessions into Running on X, Not on X and Can't move,
and the Always restart toast names sessions it left and offers Review.
* refactor(claude-accounts): simplify the switch login match, scan and toast styling
Inline the single-use login adapters, carry each pane's foreground result with
its row, keep the header-pin listener local to its effect, move the inline
toast action classes to the Sonner module, and stop the Review dialog
promising a restart for sessions that cannot move.
Each terminal tab and the Floating Workspace own separate PaneManagers, each
with its own activePaneId. The hover gate skipped any pane that was already
its manager's active pane, so a single-pane main terminal never took focus
back from the floating terminal (or vice versa). Refocus an already-active
pane when DOM focus sits in another terminal pane; focus outside panes
(chat, editor, inputs) is still left alone.
Fixes#29912
Co-authored-by: Neil <neil@stably.ai>
Brennan Benson
Naveen ChatlapalliandNeil
OrcaWinandm4air
Neilandoutof-place
Kelvin Amoaba
Jinwoo Hong
Pr1pandBrennan Benson
Samuel VilaandBrennan Benson
lvxindaandBrennan Benson
Chen ShiandNeil
hjkwonandNeil
apeppppandNeil
shahidbeig-a11yandNeil
Yunqian FanandNeil
BAEKSEUNGHYEONandNeil
Yoshito Ohata (sheat)andNeil