Moves the push gateway's database layer into a shared cloud/packages/cloud-database package (service name and schema passed in). Push's behaviour, log names, SQLite file and tests are unchanged.
Adds cloud/packages/connector-contract: the shapes the desktop and the cloud connector service exchange (hello, held poll, received/done acks, events with per-hello seq, replies), limits, error codes and the contract version. Nothing calls it yet.
* fix(wsl): open, save and rename a UNC drive-mount project's files through its drive path
WSL 2.7 refuses Windows file access to its drive mounts over UNC. #33735 fixed listing a saved
\\wsl.localhost\<distro>\mnt\c\... project, but opening a file from it still failed with EPERM, as
did saving, renaming, creating and copying.
The open/read helpers (editor reads, ranged reads, media previews), the save path (write probe,
disk precondition, its locks), rename, create, copy, the file stat/exists checks, the runtime
provider used by remote clients and the document-folder realpaths now hand the filesystem the
drive path. Authorization is unchanged: it still runs on the caller's UNC spelling against the
UNC roots. Delete already runs inside the distro.
* fix(wsl): check a missing path's ancestors for links through the drive path
Authorizing a path that does not exist yet walks up to the nearest existing folder and refuses a
dangling link on the way; that link check ran lstat on the UNC spelling, which WSL 2.7 refuses for
drive mounts. So New File, New Folder, a first save, an upload and a copy or rename into a new
folder all failed with EPERM (failing closed). The check now lstats the drive path, where Windows
still reports junctions and symlinks.
* fix(wsl): read a UNC drive-mount project's files through its drive path
WSL 2.7 refuses Windows file access to its drive mounts over UNC: \\wsl.localhost\<distro>\mnt\c\x
answers EPERM, while the distro's own folders still open. A project saved under such a path lost
its file explorer (fs:readDir failed on the authorization realpath) and logged an EPERM warning
for every setup-script import candidate.
The authorization realpath now resolves a UNC drive-mount path through its drive and answers in
the caller's UNC spelling, so allow-list checks are unchanged; readdir and the import-candidate
reads open the same folder by drive path. Distro folders, other UNC shares and non-Windows hosts
are untouched.
* fix(wsl): read a UNC drive-mount repo's orca.yaml through its drive path; pin junction refusals
orca.yaml checks (hasHooksFile, loadHooks, the unknown-key probe) opened the UNC path, which WSL
2.7 refuses for drive mounts, so a saved /mnt/c project's setup hooks silently disappeared. They
now use the same drive mapping.
Also pin that authorization still judges a UNC drive-mount path against the UNC roots: a junction
under the project that resolves to another drive or outside the project is refused.
* test(wsl): run the UNC drive-mount fs:readDir suite in the Windows package lane
Its cases need native Windows path resolution, so they skip on Linux and macOS. Gate the suite
(not each case) on win32 and register the file with the Windows lane, so CI actually runs it.
The headless CLI bundle resolved jsonc-parser to its UMD build, whose
relative requires fail beside the single-file bundle, so
`orca agent hooks status|on|off` crashed with "Cannot find module
'./impl/format'". Every orcad bundle now shares one plugin list, and the
build refuses any bundled UMD module.
Fixes#33592
Reverts #29133 except its daemon async-I/O stall telemetry, so we can measure how often stalls happen on official Node before committing to a patched runtime. The macOS terminal host goes back to the official Node 24.22.1 download and the daemon protocol back to v51; no release or hourly build published v52.
Post-merge cleanup after the agent-integration fixes: remove the unreachable Windows hook-script stdin drain epilogue; Windows statusline exits instead of draining outside an Orca pane; Codex CLI fork uses the \\?\-aware rollout path; WSL browser-network relay falls back to orcad's pinned Node (shared launcher revision stamp); stranded sleep records only drop for their own worktree; renames (hidden probe cwd, local Windows ConPTY helper).
Adds an end-to-end test that boots an isolated headless serve host and drives the orca connector CLI against a scripted Claude. Runs in the existing PR e2e job only when connector code changes.
* fix(native-chat): one ownership index with link roles, and a chat refuses to start while a terminal writes its conversation
Each chat link now carries its role (head or earlier) and key; Session History names
the chat continuing a conversation first, duplicate adoption checks only head links in
both the pre-commit check and the store transaction, and terminal resumes stay refused
exactly as before. The terminal-writer check now also runs inside acquireOwner before
the spawn, refusing with the typed pre-spawn reason conversationOpenInTerminal.
* fix(native-chat): hold a terminal start Orca issues until its terminal reports it
An in-memory registry of managed terminal starts per conversation, registered in the
same step as the resume admission (terminal.send with a resume command, createTerminal
with a command), bound to the PTY execution that runs it, and ended only when that
terminal's hooks report the conversation or the execution is gone. A chat's agent
start refuses while an entry may hold its conversation.
* fix(terminal): an automatic pane restore never resumes a conversation an open chat continues
Resume recipes built from a pane's saved facts (cold restore, deferred and late reattach,
sleeping wake, host mobile materialization) carry resumeOrigin 'saved'. The execution host
decides before any command is issued: while an open chat continues the conversation, or a
chat may be writing it, the pane starts its plain shell with the started-fresh notice and
its saved claim is forgotten; with unreadable records only a saved restore is refused and
its record kept. An admitted resume registers its managed start in the same step, so the
chat's agent start refuses until the terminal reports it or exits. Clearing the last saved
record now reaches disk.
* Fix saved terminal resume ownership and effective launch results
* Preserve conversation case and clear refused cold restore identity
* fix: publish effective terminal launch results on attachment
* fix: preserve terminal launch callback and candidate ownership
* fix: keep existing terminal attachments observational
* fix: consolidate terminal launch imports
* test: document snapshot runtime fixture boundary
* fix: preserve terminal launch identity types
* fix: accept reattach payload policy sessions
* fix: preserve terminal result validation contracts
* refactor: separate terminal create contract
* test: document partial terminal runtime fixtures
* test: align sleeping resume store fixture
* Fix terminal create type contracts
* fix: return the terminal main started to its waiting view
* fix: register reattached terminals before publishing their handles
* Check unavailable-resume test fixture types
* Complete sidebar resume test store fixture
* test: bound saved resume ownership and refusal work
* Settle refused saved resume claims from actual launch results
* Fix saved resume test type contracts
* test(e2e): capture exact terminal parking diagnostics
* test: verify parked terminal with fresh host inventory
* Consolidate agent session imports in remote terminal transport
* Clarify terminal conversation refusal guidance
* Admit note-only saved conversations without hiding live writers
* Retain terminal writer proofs through final admission
Builds the macOS terminal host's Node 24.22.1 from pinned source with a libuv patch: idle threadpool workers recheck for queued work every 30 s instead of waiting forever, so a lost Darwin condition-variable wake-up (libuv #5280) no longer strands terminal I/O. Bumps the daemon protocol to v52 so new terminals start on the patched runtime right after an update; older daemons stay attachable. Adds stalled/recovered daemon async-I/O telemetry, and lets release workflows rebuild older refs that predate the source build.
Fixes STA-11709, #31926.
* Refuse unsupported SSH project setup before local API dispatch
* fix(projects): keep the desktop's SSH refusal copy and drop a re-export
The desktop's own project-setup IPC is not an Orca server, so it keeps
saying the SSH connection is not connected; the renderer now refuses SSH
setup before reaching it. Callers import the shared refusal message
directly instead of through the controller. Adds a headless paired e2e
that sets up a project on the server's SSH host from a web client.
Refs #33124
* fix(projects): give the server refusal only for a paired server's SSH host
A desktop's own SSH host keeps its 'not connected' copy; the server
refusal shows on a web client, or for a target only a paired server lists.
Refs #33124
* test(e2e): read the added SSH target from the RPC result
* test(e2e): pass a typed SSH execution host id
* test(e2e): give the paired SSH project-setup timeout bump its reason
---------
Co-authored-by: Mohith S <smohith58@gmail.com>
* feat(native-chat): OpenCode and Grok chats show the turns made outside them
When an OpenCode or Grok chat reopens its conversation, the agent replays its
saved history before it answers. Orca used to drop all of it. Now the turns in
it the chat never saw (made in the agent's own CLI, or anywhere else) are added
once, in the agent's order, after the chat's rows and behind the existing
"Continued outside this chat." divider.
Turns are matched by the agent's own ids: Grok's prompt id (Orca's own turns
carry the id Orca sent) and OpenCode's saved message ids, plus the rows of a
transcript the chat was adopted from. A send of the chat's own that failed
before any reply is matched by its text between the turns proven around it,
because OpenCode never tells a client the id it gives a person's message.
The import is translated by the same translator and assembler as a live turn
into an in-memory overlay, then written as one settlement: a stale or failed
import writes nothing, and it never fails the open. A turn imported part-way
gets the rest of what the agent saved on a later open.
* fix(native-chat): type the ACP catch-up staging and origin reads
* refactor(native-chat): share the catch-up open runner across agents
The Codex catch-up's agent-neutral parts move to one module: the open-time
envelope (its own deadline and cancellation, never gating the open), the
bounded staged batch, the single settlement commit that re-checks the
journal before writing, and the "Continued outside this chat." divider.
Codex keeps only how it reads its saved turns and what the chat already
holds. No behavior change; the other agents' catch-up builds on this
instead of copying it.
* fix(acp): bound final catch-up journal barrier
* chore: remove unrelated pnpm executable metadata
* refactor(native-chat): the catch-up runner reads the chat's view only when the agent asks
* refactor(acp): catch up through the shared history runner
The open envelope, budget, divider and one checked commit now come from the
shared catch-up runner; ACP keeps only how it reads the reopen replay and what
the chat already holds. The final-barrier deadline test moves with the barrier
to the runner.
* chore: remove regenerated pnpm executable metadata
* fix(native-chat): the catch-up deadline also bounds waiting for its commit to be written
A journal write barrier that never settled after the import was admitted held
the provider's open past the catch-up deadline. The wait now ends with the
deadline or the open's cancellation, like every other step.
* test: type the history catch-up sink fixture without assertions
* fix(acp): reconcile imported history snapshots without claiming live work
* fix(native-chat): bound and revoke history preparation
* feat(native-chat): validate expected saved items during history catch-up
* fix(acp): preserve user boundaries and visible catch-up dividers
* fix(acp): replay ordered messages within provider executions
* fix(acp): report replay overflow and refresh journal test reads
* test(rpc): explain partial runtime fixture boundary
* Bound ACP history reconciliation and rejected-copy projection work
* test: use typed calls for history scaling instrumentation
* test: account for history views and exit provenance work
* fix: type history scaling test fixtures explicitly
* test: route history probes to Node and bind replay sink before open
* test(acp): explain journal scaling timeouts
* test: tighten transport, recovery, and diagnostic checks
* test: use at for last mock socket access
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* test: strengthen transport recovery and benchmark assertions
* test: use preferred array type in reconnect fixture
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* perf(lint): keep JS plugins out of default oxlint and adopt ast-grep
Any jsPlugin makes Oxlint hand every file's AST to Node, so the seven custom
plugins cost the default `oxlint` run several times its native time.
- Move app-store-performance, quadratic-buffer-concat, renderer-scrollbar-style
and ime-enter-guard (scope- or dataflow-aware) to config/oxlint-js-plugins.json,
run by `pnpm lint:js-plugins`, CI, lint-staged and the changed-lines gate.
- Port sort-comparator-performance, mobile-pairing and native-chat-design-tokens
to ast-grep rules with rule tests, and delete the plugins.
- Add @ast-grep/cli, config/sgconfig.yml, `pnpm lint:ast-grep` / `test:ast-grep`,
a CI step, and an ast-grep pass in check-changed-code-quality.
- Add flaky-test rules (wall-clock reads, real-time waits, polling loops,
unquarantined skips, unexplained timeout bumps), baselined by a count ratchet.
* Enforce flaky-test ratchet on changed files; refresh baseline
* docs(agents): keep custom-rule details out of AGENTS.md
* Resolve ast-grep from the repo so gate scans of other roots work
* feat(devex): component fixtures with headless screenshots for fast UI checks
Colocated *.fixture.tsx files export named fixtures (render + optional store
seed, setup, interact, width). A dev-only Vite entry (vite.fixtures.config.ts,
extending vite.web.config.ts) renders one fixture in isolation with the real
I18nProvider, TooltipProvider, theme class, default-seeded store, and the web
client's preload bridge (installWebPreloadApi) as window.api.
`pnpm fixtures:shot <id|glob> [--theme dark|light|both]` starts or reuses a
detached server (Vite + one headless Chromium) and writes PNGs to
.cache/fixtures/. A warm page re-renders in place (~100ms/shot) and reloads
only after source changes. A stdio MCP server (registered in .mcp.json)
exposes list_fixtures and screenshot_fixture.
Fixtures load only through import.meta.glob in the fixture entry, which is
not a production build input; oxlint rejects static imports of *.fixture.
* Keep fixture config and agent config inside reviewed root entries
* Baseline the fixture page's default-settings seed in the focus-read ratchet
* docs(agents): shorten fixtures pointer
* Allowlist the dev-only fixture explorer's labels in localization coverage
* refactor: group local and WSL filesystem watchers
* test: isolate startup ordering from watcher initialization
* test: collect the startup preflight subject once
* fix(windows): respawn a ConPTY pane that started without an input reader
Bundled ConPTY occasionally starts a pane whose console host never reads
its input pipe: the shell prints its banner and prompt, but every keystroke
and the typed launch command are dropped. Such a pane is identifiable from
its first output, because a healthy one always queries DA1 before relaying
anything else. The daemon now waits for that first output, respawns once
when it is missing, and replays the buffered startup output so no byte is
lost. The table stress probe now waits for node-pty's own readiness rather
than typed input.
* fix(windows): bound the ConPTY startup check and never re-run a command
- Respawn only when no command rode in the shell's argv; otherwise keep the
pane and say on screen that it cannot take input.
- Accept the pane unverified after 5s of silence instead of stalling the spawn.
- Distrust the check after two misses with no pane ever announcing, so a
changed ConPTY build cannot respawn every pane.
- Kill a discarded pane through its job before closing the pseudoconsole.
- Report a cancel during the wait as an attach cancel, not a spawn failure.
- Assert on real Windows ConPTY that a fresh pane announces its input reader.
* fix(windows): respawn only Orca's own shell argv and close an unready pane now
- Treat user shell args like an argv startup command: never respawn, show
the notice instead, so a command such as pwsh -Command never runs twice.
- Close a discarded pane's pseudoconsole directly; node-pty defers kill()
until first output, which a silent pane never produces. Kill the shell by
pid when no job owns it.
- Reconcile a master node-pty retired during the startup wait.
- Drop the test-only respawn counter; the count rides in the daemon log.
* fix(windows): tear a discarded unready pane down through node-pty's agent
node-pty defers kill() until first output, so closing only the native
pseudoconsole left the input pipe and output worker of a silent discarded
pane alive until daemon exit. The agent's kill closes all three.
* fix(windows): discard startup panes by handle only; account for the mock prelude
A pid-addressed kill could hit a recycled pid when the shell exited during
startup; the job and the agent's native kill both act on handles. Lifecycle
assertions now expect the replayed DA1 query when the suite runs on Windows.
* test(e2e): give the mocked Windows pane its ConPTY prelude
* feat(devex): add pnpm check:changed as the single pre-handoff gate
Runs format, oxlint, the changed-code gate, affected typecheck projects,
affected unit tests, and the ratchets/verifiers whose inputs changed, in
parallel against the origin/main merge base plus local edits. Printing is
limited to failures, and a pass is cached by a hash of the diff, untracked
files, lockfile, and config so an unchanged rerun exits immediately.
* fix(devex): keep the check:changed pass valid across staging and commits
* docs(agents): slim Useful Commands to the commands agents need
* feat(agents): TypeScript 7 code intelligence for coding agents, load-aware tsrs checkers
The stock agent TypeScript plugin needs a compiler build TS 7 no longer ships, so agents in
this repo got no diagnostics or ran some other TypeScript.
- config/scripts/agent-typescript-lsp.mjs starts the repo's own TS 7 language server
(tsrs on Apple Silicon and Linux, the typescript package's tsc elsewhere) and turns its
pull-only diagnostics into pushed publishDiagnostics for push-only clients.
- .claude/settings.json registers a repo-local plugin marketplace (config/agent-plugins)
and enables the orca-typescript LSP plugin; opencode.json runs the same server.
- Local tsrs typechecks now pass --checkers, splitting the cores the load average leaves
idle between concurrent projects (floor 4); ORCA_TYPECHECK_CHECKERS pins it.
* docs(agents): drop LSP and checker notes from AGENTS.md
- test:changed exits before starting Vitest when Git reports no changed files.
- Unrecorded tests beyond 100 in scope use Vitest's static import graph instead
of all running, so a fresh worktree's first changed run no longer runs the
whole suite (patched RecordedModulesResolver; CI does not record, unchanged).
- Bun's slow config load was the SQLite import scan statting every unit test;
filtered runs now classify only the tests their filters can select, and the
scan walks directories instead of fs.globSync.
- Silence the native config loader notice on every run.
- Zod's test bundle is content-addressed and reused, so a killed run leaks
nothing; leaked per-run directories older than 6h are swept.
- build:packages skips compiling when package inputs, compiler, and dist are
unchanged; test scripts no longer nest pnpm invocations.
- Bump mobile typescript to ^7.0.2 and vitest to 5.0.5; keep TypeScript 6 as typescript-api
for the test-support code that walks the AST, mirroring the root.
- Patch Expo CLI's tsconfig reader to fall back to typescript-api: TypeScript 7 has no
compiler API, and Metro otherwise crashes reading tsconfig paths.
- Register mobile/tsconfig.json and mobile/tsconfig.test.json with the root typecheck runner;
locally they use incremental tsrs (Bun elsewhere), CI uses Bun like root CI.
- Route the tests-typecheck ratchet through the same compiler selection.
- Enforce root/mobile parity for typescript, typescript-api and vitest.
Linked worktrees now get a per-worktree userData profile under
orca-dev-wt/<hash>, a deterministic collision-checked renderer port
(15200+) and CDP port (9333+), so parallel `pnpm dev` runs no longer hit
the single-instance lock. The main checkout keeps the shared orca-dev
profile; --shared-profile / --worktree-profile / ORCA_DEV_PROFILE override.
The runner prints `ORCA_DEV_INSTANCE {json}` on stdout and mirrors it to
out/dev-instance.json so agents can attach over CDP. orca-dev.mjs and the
terminal wrappers follow the profile the worktree's dev app used.
Adds profile seeding (pnpm dev:seed-profile, pnpm dev --seed-profile,
pnpm dev:fresh --seed-from): an allowlisted slim copy of projects,
workspaces, settings, SSH targets, and the account session, written as
orca-data.json for Orca's own import; the source is only read.
Storage reclaim removes per-worktree profiles once their worktree is gone
and no app, runtime, or daemon still uses them. dev-fresh-profile.sh is
replaced by a cross-platform dev-fresh-profile.mjs.
* feat(managed-server): offer Update and Update anyway on a managed SSH server's row
A managed SSH server only updated on connect, and every connect deferred while
a terminal ran there. Its row now offers Update when this desktop bundles a
newer build than the Orca that runs the host. When running terminals defer it,
Update anyway restarts the server past them; the terminal daemon carries them
across the restart.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(managed-server): Update anyway passes only counted live terminals and keeps Update's version admission
Update anyway now sends the incumbent build it confirmed over; under the host
fence it is refused if another desktop activated a build since, keeps the
newer-host downgrade refusal, and never passes an uncounted terminal census.
The offer also covers hosts activated before the Orca version was recorded,
for the build this desktop already deferred there.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(managed-server): Update anyway also confirms a menu Update the row does not advertise
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(managed-server): the row shows one confirmation at a time
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* ci(e2e): route managed-server update sources to the Update anyway Docker spec
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(daemon): contain ConPTY output-relay write errors to the one terminal instead of killing the daemon
* fix(daemon): end a Windows terminal whose output relay dies before connecting
* fix(daemon): kill a Windows terminal whose output relay fails before its first output
Run 40149801617 timed the SysWOW64 probe out at the 60s watchdog after it
had printed its policy receipt, so PowerShell had started and the first
Win32_Process query on the fresh runner was the slow part; the System32
probe right after took 14.7s. Run each probe once with a 150s bound in
beforeAll so the watchdog measures the probe rather than WMI's first query.
Neil
Jinwoo Hong
Brennan Benson
OrcaWinandOrcaWin
