* build: fail the React Compiler ratchet on stale uncompiled-list paths
- A listed path that no longer names a renderer source (a rename or split) fails the ratchet, so the file can't silently start compiling.
- The build and the ratchet read the lists through one parser that drops trailing notes, resolved from the repo root rather than the current directory.
* build: resolve uncompiled lists from import.meta.url and check listed paths on disk
- electron-vite's config bundle rewrites import.meta.url per file but not import.meta.dirname, so the repo root came out wrong and desktop builds failed with ENOENT.
- A listed path is stale only if no renderer file exists there; the scan's test-name filter no longer flags shipped files like notification-test-delivery.ts.
* build: require uncompiled-list entries to name the exact file the build matches
A ../ segment, a directory or a different letter case passed the existence check, but the build's exclusion matches only the exact path, so the file still compiled.
* build: reject backslashes in uncompiled-list entries
On Windows path.join turns a backslash into a separator, so the entry passed the check while the build's forward-slash match missed it.
#39817 added one realpathSync.native in floating-workspace-directory.ts
without a baseline entry, so main-sync-fs ratchet fails on main and every
open PR. The call resolves home once and caches it per home path (one-shot,
not per-RPC), which the ratchet allows with reviewer sign-off.
- break import cycles: cloud-message-sender takes its identity reader at install (no store import);
hosted-workspace-service and connectivity handlers import the offline seam, not the service
- floating-workspace-directory (upstream #39817) baseline-listed for its one realpathSync
* perf(mobile): load the terminal engine and the session dock only when needed
Opening a session parsed xterm (with its WebGL addon) and the wide-layout
dock's Source Control and Files panels, even for chat sessions on phones.
The page's terminal now imports its engine when the first terminal mounts,
and the dock lazy-loads its panels behind a frame that paints at once.
The page build anchors lazy modules that share boot code the way it already
anchors routes, so the new lazy chunks don't split the boot chunks.
* fix(mobile): show the terminal start error when replaying queued commands throws
Extract shared state/helpers into leaf modules (pure moves, re-exports kept)
so import/no-cycle can run at full depth with type-only imports ignored.
120 src + 8 mobile cycles -> 0. 10 suppressions remain on the browserManager
singleton hub, which needs DI to break.
- loopback-callback-listener runs lsof through @orca/process-host
- MCP egress ledger read is async; cloud-mcp-sync's two memoized one-shot reads and the
loopback grant's liveness poll (a heartbeat with a stop) are baseline-listed
- auth-callback-forward under max-lines; VmBuildFailureActions uses Button variant quiet
- test casts replaced by typed fixtures (Translate, WorktreeCreationRequest builders,
typed HostedSandboxRequest, LegacyRenameRuntime); one SAFETY-annotated store stub
- runtime catalog + protected-copy keys synced
- workspace-resume lost-contact tests partially mock ssh-target-registry (new import chain)
* feat(mobile): announce dictation to VoiceOver through the shell
* feat(mobile): speak dictation from the host, so leaving the session and the pill's toasts are announced too
* fix(mobile): say dictation outcomes where they are known, and re-read a repeated live message
* fix(mobile): leave a setup refusal to its setup sheet instead of reading the raw code
* fix(mobile): say cancelled when a kept recording is discarded
* feat(mobile): smart rail keys for the terminal agent's state, with Shift/Ctrl/Alt latches
* fix(mobile): cancel key presses only when the key row really moves
* fix(mobile): keep Smart rail on through Reset Defaults and finish two-write keys
* fix(mobile): only a finger scrolling the key row cancels its presses
* fix(mobile): hold the smart group until the tap's press lands, and drop clicks on keys that moved
* refactor(mobile): simplify the smart rail touch hook and layout read
* chore(mobile): allowlist the Shift, Ctrl and Alt key names
* feat(mobile): Codex async question keys on the smart rail
* fix(mobile): drop the Codex Always key, whose key differs by approval
Codex binds "don't ask again" to p for a command-prefix rule and a for session and file approvals (0.136 through 0.166). The permission hook doesn't say which one is on screen.
* perf(native-chat): project structured chat tabs per workspace bucket
The shared chat-tab list was keyed on the whole unifiedTabsByWorktree
identity, so every tab write anywhere (terminal title batches included)
rescanned all tabs and handed every consumer a new list. Rebuild only the
buckets whose identity changed and return the previous list while no chat
tab changed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(native-chat): reconcile chat status membership per changed tab
The status bridge rebuilt every member and host group and captured every
chat on any tab-map or owner-input change, and recaptured every chat on any
launch notification. Membership now updates only the tabs whose identity
changed; owner-input changes re-resolve only unstamped tabs, the only ones
whose host depends on them; launch notifications name their session so only
its tabs are recaptured (unaddressed ones still recapture all). The sleep
and launch-directory companions of one projection land in one store write.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): guard whole tab-map triggers and hot-map listeners
Add a count ratchet for identity comparisons of the whole
unifiedTabsByWorktree/tabsByWorktree map in renderer code (counts may only
fall), wired into pnpm lint, run-ratchets discovery and changed-check
selection. Extend the advisory no-whole-hot-map-selector rule to inline
store listeners that compare a whole hot map and to effect bodies that use
one whole from getState().
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* revert(lint): drop the hot-map listener/effect extension
The guard stays scoped to the repaired seams; no repository-wide rule change.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(native-chat): capture chat status on semantic tab changes; address tombstone retirement
Focus, preview and order-only tab writes no longer recapture a chat's
status: membership and the projection fences compare the fields the
projection reads. Absent-tombstone retirement now names the sessions it
retired, so no launch producer sends an unaddressed notification.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(store): keyed-record transition seam for tab maps and companion records
Writers build next tab buckets and keyed companion records through
replaceTabBuckets / replaceRecordEntries (or name the keys of a record they
already built), which record exactly which keys and tab IDs changed against
the produced record. Readers ask readTabMapChanges / readRecordChanges for
an addressed delta; any unannotated link reads as a full resync. Adds
subscribeTabTransitions and a store-observer installer registry. The
chat-tab list and the status bridge now consume addressed deltas and keep
the whole-list walk only as the cold path.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(store): annotate every shared tab-map writer through the seam
Shared tabsByWorktree/unifiedTabsByWorktree writers (tab, editor, browser,
worktree, ssh, terminal create/close/navigation/title-batch/reconnect/
hydration, web-session mirroring and layout frames) now build or annotate
their next tab buckets and companion records with the exact workspace and
tab IDs they changed; full hydration, full frame builds and reconnect
inventories are named full resyncs. Writers that copied every bucket for
one tab (preview promotion, dirty-file preview clear, worktree removal
filters, sleeping-record identity rename) now keep unchanged buckets.
Replace the renderer-wide tab-map comparison ratchet with a narrow seam
guard: the repaired consumers may walk a whole tab map only in named cold
paths, and the pinned writer modules may not build raw seam records.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(store): name seam fields once; type seam records; record moved respawn writes
Writers stop repeating tracked field names (centralized in
seam-record-fields.ts), the seam takes a named KeyedSnapshot record type
instead of casts, and the layout-writer baseline records the respawn
helpers moved unchanged out of worktree-layout-lifecycle.ts.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(store): drop seam field cast; record the seam field list in the layout-writer baseline
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(native-chat): keep chat-tab list in source workspace order (C3/F1)
Every source workspace keeps a projection slot, even without chats, and the
seam reports when a write added or deleted a workspace key or moved a
surviving bucket, so the incremental list never reorders first-match
consumers; those transitions take the cold rebuild.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(native-chat): keep projection and retirement debt awake (C2, F3)
A member is owed from attach or semantic change, members without a host
feed keep their own debt, and every reconciliation drains existing owed or
retired work even when no new member changed, including a closed last chat
whose feed is gone.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(store): stop inferring host-mirror companion IDs from visible tabs (C1)
A host retraction can delete PTY or layout records for tabs neither
inventory lists, so the mirror funnel marks its tab-keyed records full
resync instead of advertising an incomplete addressed set.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): close indirect paths in the tab-map seam guard (C4)
The guard now rejects ordinary callers of the bridge cold path, value
imports the repaired consumers have not reviewed, and raw seam records built
into a local binding without a seam helper annotating it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(native-chat): drive real tab actions through the status bridge (F2)
Close, session rebind with a late old-session tick, and a legacy owner
change, through createUnifiedTab/setTabLabel/closeUnifiedTab, so the
addressed reconciliation path is exercised.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: exempt seam field-name constants from the layout-writer ratchet; drop dead setters (F4)
The seam's SEAM_*_FIELDS lists name fields without writing them, so the
ratchet skips them and the raised baseline row is gone (renderer total 569,
main 571). setStructuredChatSleptAt and the two launch-directory setters
lost their last callers to the batched companion write.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(store): Map provenance and source-ordered change keys in the seam (PR A addenda)
replaceMapEntries gives Map-typed fields (runtimeStatusByEnvironmentId) the
same weak provenance and readRecordChanges protocol. Change keys compose
forward through a chain, oldest write first, so added keys come out in
source order (index keys first for records, as Object.keys orders them). A
surviving key deleted and re-added, in one write or across a chain, and a
record builder that moves a surviving key, read as a 'reordered' full
resync.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(store): writers declare key order; seam reports ordered additions (N1c, N1a)
The seam no longer scans both records to rediscover order on every
annotation. replace* helpers know insertion order by construction; annotate*
takes a declared order ('appended' by default, 'reordered' for a builder
that moves keys, read as a full resync), verified only under test.
Addressed changes now report keys, source-ordered added keys and deleted
keys, so a reader holding its own key ranks places changes in O(changed).
Worktree removal declares its editor-transfer records reordered.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(native-chat): scope the chat-tab projection to chat-bearing workspaces (N2c)
The projection keeps chat subsets only for workspaces that have chats, plus
per-workspace source ranks that change only when a workspace is added or
deleted. A focus, label or title write costs O(that workspace); the
ordered list is materialized lazily, only for full-list readers, and keeps
its identity while no chat changed. Workspace adds and deletes are
addressed through the ranks instead of a cold rebuild.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): resolve aliases and require annotation before publication (C4)
Any reference to a cold helper or Object enumerator outside its named
callers counts, including aliases and callbacks; writer values are followed
through local aliases and must be annotated before the write that
publishes them.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(native-chat): scoped hydration keeps the warm chat list equal to a cold read (D1)
Drives the real scoped hydrateTabsSession on early/later chats of one
session: source order, list order and first-match precedence match a cold
rebuild, including when the selection order differs from hydrated order.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(native-chat): cache the chat-workspace order across chat edits (D1 item 5)
The lineage keeps chat-bearing workspaces in rank order and only inserts or
removes one when it gains its first or loses its last chat; a chat object
change re-flattens the list without re-sorting. Full resyncs rebuild it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): the seam guard recognizes only construction helpers and cold marks (D1)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor(store): addressed provenance only from constructing helpers (D1)
Remove annotateRecordReplacement/annotateTabBucketReplacement and their
caller-declared order: only replace*/recordDraft/tabBucketDraft, which
perform the construction, derive changed keys, additions and deletions from
their operations (delete-then-reinsert reads as reordered); opaque
reconstructions use markFullResync. Every former annotate caller is
migrated: ordinary local writes build their records once through helpers
or drafts with today's operations and order; scoped tab and terminal
hydration, the reconnect inventory, host-mirror application and layout
flush are full resyncs. Change readers move to keyed-record-change-reads.ts.
Renderer layout-writer total 567 (main 571).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(native-chat): type the hydration fixture without a cast
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(store): seam record writes define own entries, even __proto__ (N5c)
replaceRecordEntries and drafts assigned through the inherited __proto__
setter, so a tab id '__proto__' lost its own PTY, layout and startup
entries. Both now define an own data property, as the computed-key literals
they replaced did; contract test included.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(terminal): build each createTab record once (N4c)
createTab took ensureGroup's and insertSplitGroup's whole records and the
orphan cleanup's seam records, then rebuilt them through the seam. It now
takes the per-worktree group and split results and gives the orphan
cleanup only the bucket it reads, so every seam record is constructed once
with its ordered operations.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): record createTab's orphan-cleanup input view (renderer total 570, main 571)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor(terminal): split orphan cleanup so createTab cleans only companion caches (N6c)
buildOrphanTerminalCompanionCleanupPatch holds the per-tab cache, tab-bar
order and selection cleanup; buildOrphanTerminalCleanupPatch adds the seam
record deletes on top, unchanged for reconciliation. createTab calls only
the companion part with real state and deletes the seam entries through its
single construction, so the stub input view and its layout-writer baseline
rise are gone (terminal-tab-creation.ts back to 10).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(terminal): filter the orphan cleanup's kept bucket once (N7c)
The full cleanup filters the workspace's tabs once and hands the kept
bucket to the companion part, which takes its replacement active tab from
it; createTab's companion-only call still makes its single find pass.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(tabs): keep removed worktrees' group entries deleted on removal
The second emptied-group collapse in removeWorktreeLayout also visited
removed worktrees and wrote their deleted groupsByWorktree entry back as
an empty list, a delete-then-set the seam read as a reordered full resync.
It now visits only surviving workspaces, so removal stays addressed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(tabs): closeEmptyGroup collapses through the shared builder again
collapseGroupLayout takes the record builder, and the renderer passes the
seam's replaceRecordEntries, so the per-worktree collapse publishes with
provenance without new counted layout writes (tabs-group-actions back to 12).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(tabs): reconciliation names its draft fields once (2 + 4 <= 9)
The written-field sets come from SEAM_ field-name constants instead of
string literals, so the reconciliation split no longer raises the combined
layout-writer count (tabs-reconciliation 2, tabs-reconciliation-batch 4,
against the original 9).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(tabs): publish reconciliation drafts with explicit field writes (N9c)
Revert the SEAM_ field-name constants: the drafts are held under their own
names and finishReconciliationDrafts publishes each written draft as an
explicit unifiedTabsByWorktree/groupsByWorktree/activeGroupIdByWorktree/
layoutByWorktree property, so the counter sees every real write and the
split totals 2 + 4 against the original 9, with no exemption.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(native-chat): apply Windows environment overrides consistently
Use the same case-aware composition for native chat launches, preflight,
model discovery and naming. Canonicalize configured Windows names before
account readers and preserve account pins and POSIX case distinctions.
Tracked in #39075.
Co-authored-by: 김태겸 <oharapass@gmail.com>
Co-authored-by: Vitalii Kulish <mancunianez@gmail.com>
* test(native-chat): cover effective Windows catalog changes
* test(native-chat): retain child environment test import after sync
* test(native-chat): verify Windows child environment precedence
---------
Co-authored-by: 김태겸 <oharapass@gmail.com>
Co-authored-by: Vitalii Kulish <mancunianez@gmail.com>
Offline models write out the speech before each pause while recording goes on.
Short noises and slow window-padded decodes are held off the pause cuts, a VAD
error falls back to bounded chunks, and slow phrase decodes are judged per
dictation against the time spoken. The VAD download carries legacy files and
fetches after any GGUF model.
transcribe-cpp is now the only on-device engine on every platform, so
the sherpa-onnx packages, their packaging (extraResources, the darwin
libonnxruntime prune, the native-variant assert and the Linux libstdc++
exemption), the sherpa recognizer in the speech process and the
per-model engine choice all go. Hotwords are written as plain terms.
* feat(speech): move the speech catalog to transcribe-cpp models
Parakeet v2/v3, Whisper tiny and SenseVoice now download their GGUF
builds, which run on transcribe-cpp everywhere, Intel Macs included (on
the CPU). A model still holding its old sherpa-onnx download shows
"Update to the faster version (<size>)"; updating replaces the old
files, and dictating before then says the model needs that update.
The five models with no GGUF build are retired and their users moved
over: the Japanese Parakeet, the Chinese-English Zipformer and the
Paraformer to SenseVoice, and the Korean and Chinese streaming
Zipformers to the new Nemotron 3.5 (28 languages). Nemotron's locale
codes (ko-KR) are matched from the ISO language setting.
* feat(speech): offer the speech model update once after the engine change
A card in the notification corner tells people whose selected on-device
model needs the new download, or whose retired model was replaced, and
starts the same download as Settings > Voice. After a replacement it
offers to delete the retired model's files.
* feat(speech): move retired Korean and Chinese models to SenseVoice and offer Whisper Large v3 Turbo
On transcribe-cpp 0.4.1 with Metal, SenseVoice beat Nemotron 3.5 on Korean
and Chinese FLEURS clips, so the retired Korean and Chinese streaming
Zipformers now move to SenseVoice. Whisper Large v3 Turbo (Q8_0, 886 MB)
joins the catalog as the most accurate choice for Japanese, Korean and
Chinese. Nemotron 3.5 stays, described by the languages it does best.
* feat(speech): run GGUF models on transcribe-cpp, falling back to the CPU
The speech host child can now load a second engine. A model whose files
are GGUF runs on transcribe-cpp (Metal on Apple silicon, Vulkan on
Windows and Linux, CPU otherwise); everything else stays on sherpa-onnx,
which remains the only engine on Intel Macs.
A GPU that fails to load, errors, stalls for 25 s or crashes the process
moves the dictation to a CPU-only process (TRANSCRIBE_BACKENDS=cpu) that
replays the audio the GPU had not decoded yet, so no words are lost or
repeated. A GPU that crashed or would not load is remembered per
transcribe-cpp version and OS release, and voice.speechGpu = 'off' keeps
it on the CPU.
Packaging copies transcribe-cpp, koffi and the target's native package
into resources/node_modules outside asar, fails when a target's package
is missing, and ships the MSVC runtime beside transcribe.dll on Windows.
No catalog model is GGUF yet, so nothing runs on transcribe-cpp until
the catalog change that follows.
* fix(speech): keep the speech queue running after a failed task, and drop audio frames after a discard
* fix(speech): keep the engine's file reads off the main thread's hot paths
The engine lookup and the GPU failure marker are read once per process
instead of on every dictation start and mobile catalog request, the marker
is written asynchronously, and the child reads the hotwords file with
fs/promises. The baseline moves the existing engine presence checks from
stt-worker-paths to the shared package table and adds the once-per-process
marker reads.
Variants instead of restyles (Badge statusActive, Button secondary-floating, Skeleton card, InlineError strip
layouts, Input code-body/leading adornment, DropdownMenuLabel hint); theme tokens for build status colours;
getIntlLocale for counts; IME guard on Enter; typed fixtures; build-followers sweeper stops when idle;
renderer intervals via installWindowVisibilityInterval; repo routing helpers for disk usage.
Neil
OrcaWinandOrcaWin
Brennan Benson
Neil
Kelvin Amoaba
