* feat: add windows ssh relay base support
* feat: support windows ssh relay runtime services
* fix: default windows ssh pty cwd to user profile
* fix: support windows hosts over system ssh
* fix: preserve degraded windows relay native deps
* fix: gate windows shell args by relay platform
* fix: preserve windows relay fallback pipes
* test: align windows native deps relay fixture
* fix: build valid windows install lock command
* fix: address windows SSH relay review findings
Resolve correctness, efficiency, and reuse issues found reviewing the
Windows SSH native-host support:
- GC liveness on Windows now probes the actual named pipe (via node
net.connect against markers + deterministic candidates) instead of
substring-matching Win32_Process command lines, which could remove a
live relay dir. Reports ALIVE conservatively only when there is no
liveness signal at all (no markers and no seed pipes).
- Resolve the remote node path once per deploy and thread it through
install/repair/launch instead of re-resolving 3-7x.
- Replace the 200ms node -e poll loop with a single long-lived remote
wait process during Windows relay startup.
- Skip the no-op executable command on Windows in uploadRelay.
- Make the Windows fallback pipe name deterministic and recoverable
(drop the global counter), with an extra reconnect attempt.
- Normalize the prepended node bin dir to backslashes on Windows PATH.
- Batch the system-SSH Windows directory upload into a single streamed
JSON package instead of one ssh process per file.
- Extract relay endpoint/marker helpers into ssh-relay-endpoints.ts and
consolidate the PowerShell EncodedCommand encoding into the shared
powershell-command-encoding module.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Support cancellation and timeouts in Windows port scanning
- Propagate the request AbortSignal and a 5-second timeout to both
PowerShell and netstat child processes during Windows port scanning.
- Avoid spawning the netstat fallback process if the port scan has
already been aborted.
- Wrap the .NET OSArchitecture check in a try/catch block during SSH
Windows platform detection to robustly fall back to environment
variables if needed.
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* Add remote SSH file download
Implement the remote file download flow described in docs/remote-file-download.md, including main/preload IPC wiring, SSH provider support, file explorer UI actions, and tests.
* Add open action to download toast
* rm design doc
* fix: detect agents via install-dir resolver when which misses on GUI launch
The Agents settings pane reports every agent as "Not installed" on a cold
GUI launch even when the CLIs are installed and runnable from Terminal.
detectInstalledAgents resolves each agent with `which`, which only sees
process.env.PATH. GUI-launched Electron inherits a stripped PATH from launchd
that omits the user's shell-rc dirs (~/.local/bin, ~/Library/pnpm,
~/.asdf/shims, nvm/volta/fnm/mise shims, ...). The synchronous seed in
patchPackagedProcessPath plus the async shell-PATH hydration both race the
first detection, and the first result is cached for the session, so the pane
can latch onto an empty "nothing installed" snapshot until the user relaunches
from a terminal or clicks Refresh.
Fall back to resolveCliCommand (the same resolver the spawn path uses in
src/main/codex-cli/command.ts) when the PATH lookup misses. Detection now has
the same reach as launch: if Orca can run it, Orca detects it, independent of
PATH-hydration timing. No false positives — an uninstalled agent still resolves
to a bare command name rather than an absolute path.
Verified on macOS that resolveCliCommand resolves claude (~/.local/bin), codex
(~/.asdf/shims), and opencode (~/Library/pnpm) under a stripped PATH.
* fix: bulk resolve agent install-dir detection
Co-authored-by: Orca <help@stably.ai>
* fix: ignore node navigator for linux webgl policy
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
* Customize Source Control AI action recipes
- Add per-action CLI arguments for generation and launch flows so saved
recipes can select model flags without putting prompts in argv.
- Share the text-generation dialog between commit messages and hosted-review
details, with first-run defaults and repo/global recipe support.
- Launch fix-check agents directly from saved recipes and harden prompt/template
handling for invalid args, blank prompts, and inherited variables.
* Allow custom commands for source control action recipes
- Let text action recipes save and resolve the custom-command sentinel
- Add settings UI for custom command recipes and preserve per-action defaults
- Split large source-control dialogs and direct launch helpers into focused modules
- Keep launch actions from treating custom text agents as runnable TUI agents
* Add per-repo Source Control AI enablement, custom command, and save-targ
- Repo overrides now support `enabled` and `customAgentCommand`, letting
repositories opt in/out of Source Control AI independently and supply a
repo-scoped custom command that takes precedence over the global one.
- Recipe-save dialogs gained a save-target selector ("Don't save / Save for
this repo / Save as global default") replacing the old boolean checkbox,
routing saves through the new `saveSourceControlActionRecipe` helper in
`source-control-ai-recipe-save.ts`.
- `normalizeRepoSourceControlAiOverrides` now returns `undefined` for empty
objects and passes the `null` sentinel through the IPC/RPC layer so the
persistence layer can clear repo overrides cleanly.
- `resolveSourceControlLaunchPlatform` resolves the correct shell platform
for SSH and WSL worktrees so agent launch commands are built correctly.
- Settings UI gained `RepositorySourceControlAiEnablement` and
`RepositorySourceControlAiCustomCommand` rows; draft/label logic was
extracted into focused modules to stay within lint line limits.
* Extract action recipe defaults into own component and use id-prefixed wo
- Move action recipe draft state and UI out of CommitMessageAiPane into SourceControlAiActionRecipeDefaults and source-control-ai-action-recipe-draft.ts to respect the max-lines lint rule
- Use toRuntimeWorktreeSelector() across all runtime git RPC calls so the runtime can resolve worktrees by ID rather than path
- Fix SSH launch platform resolution to use the repo's connection when the newly created worktree isn't hydrated yet
- Add edit and delete handlers for PR conversation comments with confirmation dialog
- Use text-status-success design token instead of hardcoded text-emerald-500
* add more search keyword
* Rename "Enable Source Control AI defaults" to "Show Source Control AI ac
* fix test
* Remove unused imports and variable assignment in launch-work-item-direct
* Fix test mocks to use `mocks.store` instead of `storeState.value` for di
* Extract Source Control AI logic into focused modules with fix-checks dia
---------
Co-authored-by: Orca <help@stably.ai>
* feat: non-blocking worktree creation with in-tab progress
The Create Worktree modal stayed open with a spinning button for the full
create IPC (base-ref git fetch + `git worktree add`, ~10-15s on heavy
repos) and only dismissed once it resolved, so the user stared at a frozen
modal with no way to work elsewhere.
Run creation in the background instead. On submit the modal closes
immediately and an in-tab "Creating worktree…" panel shows live setup
status, wiring the previously-unused `createWorktree:progress` main->renderer
event via a per-creation correlation id. A sidebar row tracks each
in-flight create, the user can navigate to other worktrees or cancel while
it runs, and on success it swaps to the real worktree + terminal in one
frame. Failure shows the error in the panel with retry; remote/runtime
targets (no progress events) show an indeterminate spinner.
Pending creations live in a separate store map rather than a faked Worktree
row, so git-status, the tab model, persistence, and PTY spawning are
untouched. Only the composer quick-create path changes; other createWorktree
callers keep their synchronous behavior.
* refactor: present in-flight worktree creates as inline tabs and rows
Rework the two surfaces that show an in-flight create so each reads like
the real thing it stands in for.
The in-tab panel is now a faux tab: a tab strip carrying the new
worktree's name (the title) over a quiet top-left status line, instead of
a centered card with a step checklist. An in-flight create reads as a real
workspace tab whose content is loading, the title and status never
duplicate each other, and the handoff to the terminal stays a same-frame
swap. Failure shows the error inline with retry.
In the sidebar, a pending create now renders as an inline row under its
target repo group — where the worktree will land — replacing the separate
strip that pinned every in-flight create to the top of the list.
* fix: keep pending worktree rows visible without repo metadata
---------
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* Suggest enabling local-main freshness when a new workspace finds it stale
Adds a "Keep Local Main Up to Date" suggestion path: when the setting is
off and a new workspace's local base branch is behind its remote, Orca
surfaces a one-time, dismissible toast nudging the user to enable it. The
toast is sticky (no auto-expire) so it can't be missed, with explicit
Turn On / Dismiss actions; dismissing (button, close X, or swipe) persists
localBaseRefSuggestionDismissed so the nudge — and its backend probe —
never runs again.
Also refactors the refresh logic so the advisory and mutating paths share
one fast-forward-safety evaluator, adds an SSH relay RPC for the ref
mutation, and fixes remote-tracking base parsing for fully-qualified refs.
Co-authored-by: Orca <help@stably.ai>
* fix: restore update-ref fast-forward for un-checked-out local base ref
The refactor that split refresh into evaluate + mutate dropped the
non-owner case: a local base branch checked out in no worktree was left
stale (return undefined) instead of fast-forwarded. Restore it across all
three layers — local evaluator/mutator, SSH evaluator, and relay handler
(which also removes the dead duplicated throw) — using the expected-old-OID
compare-and-swap form of update-ref so a concurrent ref move is a no-op.
The suggestion toast now also fires for this case.
Co-authored-by: Orca <help@stably.ai>
* refactor: restore resultBase spread in local-base-ref mutators
The evaluate/mutate split spelled out { baseRef, localBranch, status }
literally in the mutating paths; main used a resultBase spread. Restore
that pattern in both the local and SSH mutators — behavior-preserving,
collapses two identical skipped_error returns.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Fix packaged runtime inclusion for @parcel/watcher and its platform native subpackages. Adds pruning/tests for packaged resources and a real watcher integration regression test.
Creating a worktree from a cross-repository (fork) PR previously named the
local branch with the maintainer's branch prefix (e.g. `me/866`) and pushed to
origin instead of the contributor's fork, so maintainer edits never reached the
PR. Fork PRs now adopt the contributor's branch name (matching same-repo PRs)
and resolve a fork push target, with a non-blocking warning when the PR
disables maintainer edits and an indicator showing where a push will land.
- pr-start-point: return branchNameOverride/headSha/maintainerCanModify for
cross-repo PRs (previously only same-repo PRs received these)
- github client: surface maintainer_can_modify alongside the fork push target
- composer: warn (but still allow) when "Allow edits from maintainers" is off
- source control: show the fork push target (owner:branch) before pushing
- extract fork-remote cleanup and setup into dedicated, unit-tested modules
Adds unit suites for the cleanup multi-fork matrix, fork-remote setup,
push-target resolution, the warning decision, and the push-target label.
Note: pre-commit react-doctor hook bypassed — its warnings in useComposerState
are pre-existing (identical count on base) and not enforced by CI.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Adds ACK-backed renderer output admission control for PTY data, bounding per-PTY and global renderer in-flight output while preserving PTY ingestion for runtime state and notifications.
* fix(browser): set up session policies for default browser partition
The default browser partition (persist:orca-browser) was created in the
registry constructor but never got session policies — permission handlers,
download handlers, WebAuthn handlers, etc. — because:
1. hydrateFromPersisted() explicitly skips the default partition
2. createProfile() never targets the default partition
3. restorePersistedUserAgent() only restored the user agent, not policies
This meant sites in the default browser partition that requested
clipboard-sanitized-write (or any other permission) were denied by
Electron's default behavior, since no handler was registered.
Fix: call setupSessionPolicies(ORCA_BROWSER_PARTITION) in
restorePersistedUserAgent(), which is the startup path that runs after
app is ready. The configuredPartitions guard makes this idempotent.
Also adds a test verifying the default partition gets its session
policies on restore.
Co-authored-by: Orca <help@stably.ai>
* fix(browser): preserve clipboard permissions for browser session
Co-authored-by: Orca <help@stably.ai>
* Initialize browser sessions at app startup
- Move cookie replay and persisted session setup out of renderer IPC wiring
- Install default browser partition policies once per process before webviews load
- Cover startup ordering, retry behavior, permission denial, downloads, and WebAuthn policies
---------
Co-authored-by: Prethish-Complyance <prethish@complyance.io>
Co-authored-by: Orca <help@stably.ai>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Use a platform-shaped selected Codex home fixture so native Windows PTY tests exercise the host Codex home path instead of filtering a POSIX /tmp path as WSL-shaped.
* Track explicitly slept worktrees in session state
- Persist user sleep intent separately from inactive terminal/browser state
- Use slept markers for sidebar, jump palette, kanban, and activation deferral
- Preserve slept markers across local, web, and remote workspace sessions
* Preserve slept worktree state across remote sync
- Merge remote sleep/default-terminal markers by target workspace so remote
hydration does not discard local markers
- Let Sleep run for selected worktrees even when they only have preserved
wake hints, while avoiding reconnects for explicitly slept legacy sessions
* Allow session snapshots without slept worktree ids
Jinwoo-HandOrca
Jinwoo HongandOrca
Brennan BensonandOrca
Lesley Murfin
KayleeandNeil
