* feat(w8): teammates wake a team workspace from the phone (team route long-poll wake, same access/billing/cap; owner route stays the fallback)
* test(w8): team wake refuses an admin on a private row, never returns the endpoint; phone never falls back on 401/403
* fix(w8): phone forgets cloud workspaces that are gone (missing from the complete registry list, or wake says not_found); never on transient errors
* fix(w8): prune only on the registry's own not_found for that workspace (lists are capped and skip hidden rows; status 404s are owner-only); restore a link whose host removal failed
* perf(w8): host prune is single-flight and remembers a confirmed-present workspace for 5 minutes
* fix(w8): removing a member revokes their phones; role changes move phones too; a phone's stored role never re-syncs keys
* fix(w8): one removal path revokes keys, phones, grants and routines; stale desktop tokens can't re-sync roles or vouch phones; a grant revoked mid-issue stays revoked
* fix(w8): a removed member's unexpired desktop tokens stop working; changes count from auth's time; desktop re-mints and retries enroll on stale_token
* feat(w8): role-aware plan-denial copy on the phone (owners and admins get the fix, members who to ask)
* fix(w8): W10 copy (per-seat team limit, choose a plan) and FE review (3 s abortable role read, Android live region, more copy cases); no casts
* feat(cloud): Orca Cloud workspaces on the phone (W8)
Home gets a Cloud section that lists the team's cloud workspaces straight from
the control plane (phone-signed device-session tokens; no desktop in the path).
A workspace screen wakes the sandbox (W2 long-poll wake), gets this phone its
own revocable orcad device through a W4 sealed grant (opened with the shared
opener on pure-JS primitives for Hermes), pairs directly over E2EE to the stable
sandbox endpoint, and delivers prompts queued on the phone while it was asleep
(agent.launchReplay, deduped by operation id). Create a workspace from the
phone (repo, branch, agent, first prompt, sandbox size), sleep, archive, live
status and spend, per-phone access management with revoke and disconnect, and
team share links (orca://cloud/w/<id>) open on the phone. Copy follows the
Orca Cloud glossary; dark/light, Reduce Motion, VoiceOver announcements.
* fix(w8): design round 2 (honest spend, can't-connect state, queue states, distinct titles, neutral archive, hairline groups)
* fix(w8): FE + W10 round 2 (retry ids, pairing give-up, create idempotency, neutral dots, waking composer, a11y values, salvage storage)
* fix(w8): tell same-named cloud workspaces apart by when they were made
* fix(w8): agent names from the shared table; localized repo placeholder
* fix(w8): round 3 (agent-started card with terminal sign-in path, transport-safe retries, open waits for the connection, single wake timer, created-ago rows)
* fix(w8): FE round 4 (open never blocked on worktree lookup, one connect deadline per run, mid-delivery prompts never stranded, no blank terminal on open session)
* fix(w8): prompts interrupted mid-delivery count as waiting (Open and retry resume them)
* feat(mobile): create a worktree per repository from an empty folder workspace
A folder workspace with no attached worktrees lists one card per
repository in its project group, as desktop's empty state does. Tapping
one creates a worktree named after the folder, attached to it, in place;
a taken name or a setup choice opens the new-workspace composer with the
repo, the name and the folder parent filled in. Shown only when the host
creating it supports exact-name creation.
* chore(mobile): merge the folder repo read's execution-host imports
* fix(mobile): folder creates keep their repository until the folder shows them
Every create from a folder's empty state, direct or through the
composer, holds its repository from admission until the folder lists
the new worktree, so a lost reply, a remount or a reopened form can't
start a second one. The composer and toasts belong to the folder
screen, stay on the folder's host, and say nothing once it's left. A
relayed server's repository read holds no desktop event stream, and a
failed read can be retried.
* test(mobile): a folder create resent after a lost reply carries the same mutation id
* fix(mobile): folder creates keep their name, and a left or replaced form shows and holds nothing
* fix(mobile): pause folder rows under the create form; a lost folder create is checked, never resent as another
* fix(mobile): a folder card never resends a form's create, and one form owns the folder screen at a time
* fix(mobile): a folder setup choice resends only its own unconfirmed create, and the newest form silences older ones
* test(mobile): declare the submit hook's folder launch in its recording fixture
* fix(mobile): a create refused on a resend after a lost reply tries no other name and stays unconfirmed
* fix(mobile): a replayed refusal after an agent-launch fallback stops the retry, and the composer says it may have been created
* test(mobile): type the replayed refusal reply in the retry test
* ci: retrigger checks
* fix(mobile): localize the folder and uncertain-create messages in the workspace composer
* perf(mobile): load the terminal engine and the session dock only when needed
Opening a session parsed xterm (with its WebGL addon) and the wide-layout
dock's Source Control and Files panels, even for chat sessions on phones.
The page's terminal now imports its engine when the first terminal mounts,
and the dock lazy-loads its panels behind a frame that paints at once.
The page build anchors lazy modules that share boot code the way it already
anchors routes, so the new lazy chunks don't split the boot chunks.
* fix(mobile): show the terminal start error when replaying queued commands throws
Extract shared state/helpers into leaf modules (pure moves, re-exports kept)
so import/no-cycle can run at full depth with type-only imports ignored.
120 src + 8 mobile cycles -> 0. 10 suppressions remain on the browserManager
singleton hub, which needs DI to break.
iOS emptied Library/Caches under storage pressure, and Android's cacheDir is
cleared by Clear cache, cleaner apps and low storage. Each purge cost a full
foreground download of the page build on the next open. Builds now live in
Application Support (excluded from backup) on iOS and filesDir on Android
(kept off device transfers), and the old cache folder moves over once.
* fix(mobile): stop reading a tab's name as its agent's terminal title
The host publishes a terminal tab's name (custom name, quick-command
label or agent session name) in place of its live title. Mobile fed
that name to the shared tab-agent resolver as title evidence, so a
finished Claude tab named "Agy status bar item" was read as a reused
Antigravity pane. Desktop resolves from the raw title and shows Claude.
Fixes#40084
Co-authored-by: Wenhao <4804785+Manho@users.noreply.github.com>
* fix(mobile): re-render a terminal tab when only its name changes
---------
Co-authored-by: Wenhao <4804785+Manho@users.noreply.github.com>
Files past the LCS cell budget fell back to prefix/suffix diffing, so two
edits at the ends of a 450-line file showed every line as rewritten. Use
jsdiff's Myers diff bounded by edit count for those files, keeping the
prefix/suffix fallback for mass rewrites.
* fix(mobile): keep the selected GitHub project when switching projects
Picking another GitHub Project on the phone snapped back to the first one.
A remembered desktop Board view made the pick throw before it committed,
and a committed pick wrote picker rows (title, summary) into settings,
which the host's strict schema refused, so the next hydration restored
the old project.
Commit only identity fields, ask for a view when the remembered one is
not a table, keep the candidate project's views out of the active list
until it commits, drop late view replies from an earlier pick, and key
Browse rows by project identity.
Co-authored-by: Eng. Mahmoud Bek ElNemer <tt21913@gmail.com>
* fix(mobile): keep github.com implicit in project refs and error on projects with no table view
---------
Co-authored-by: Eng. Mahmoud Bek ElNemer <tt21913@gmail.com>
* feat(mobile): announce dictation to VoiceOver through the shell
* feat(mobile): speak dictation from the host, so leaving the session and the pill's toasts are announced too
* fix(mobile): say dictation outcomes where they are known, and re-read a repeated live message
* fix(mobile): leave a setup refusal to its setup sheet instead of reading the raw code
* fix(mobile): say cancelled when a kept recording is discarded
* perf(native-chat): keep streaming chats from re-projecting their whole transcript
Each stage of the streaming transcript pipeline (reducer merge, question
pass and receipts, message projection, desktop list fold) keeps its
previous input and output and re-derives only revised or appended rows,
falling back to the existing full projection whenever another row could
change. Desktop folds through the phone's fold units, now shared, and live
trims batch by a bounded slack so appends keep row positions.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(native-chat): reuse appended subagent rows and batched revisions
Appended rows in chats with subagent rows extend their turn chunk when
earlier turn inputs are unchanged; batch merges and multi-row revisions
do one pass each; rows without journal positions keep in-place reuse.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(native-chat): look up subagent chunks once per appended batch
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(native-chat): pin the live trim slack
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(mobile): smart rail keys for the terminal agent's state, with Shift/Ctrl/Alt latches
* fix(mobile): cancel key presses only when the key row really moves
* fix(mobile): keep Smart rail on through Reset Defaults and finish two-write keys
* fix(mobile): only a finger scrolling the key row cancels its presses
* fix(mobile): hold the smart group until the tap's press lands, and drop clicks on keys that moved
* refactor(mobile): simplify the smart rail touch hook and layout read
* chore(mobile): allowlist the Shift, Ctrl and Alt key names
* feat(mobile): Codex async question keys on the smart rail
* fix(mobile): drop the Codex Always key, whose key differs by approval
Codex binds "don't ask again" to p for a command-prefix rule and a for session and file approvals (0.136 through 0.166). The permission hook doesn't say which one is on screen.
* Fork Codex replies from the current history after rewind
* Strengthen Codex fork preparation failure coverage
* Preserve Codex fork compatibility and original chat guidance
* Explain when Codex cannot start for a fork
* Show AskUserQuestion option previews on desktop and phone
Claude can attach a preview (a mockup or snippet) to each option of a
single-select question. Orca dropped it, so users chose between bare labels.
Options now carry the preview through the journal, terminal asks and the
phone, and the question card shows the selected option's preview as plain
monospace text. Questions with previews confirm explicitly instead of
auto-advancing, so the preview stays readable.
* Keep phone previews bounded and digit focus on the named option
Phone previews get a capped height with their own vertical scroll, and
opening one never scrolls past its top. A digit always focuses its row
before the chosen-row check, so Enter confirms the option the user named.
Tighter preview line height, a stable phone row root, and a persistence
test whose expected previews come from the fixed input.
* Narrow the reopened question with a type guard instead of a cast
* feat(speech): spell dictionary terms in dictation, with repo terms and Whisper prompt
* test(speech): pin host repo terms for phone dictation
* fix(speech): keep symbol terms whole, accept null setup params, resolve SSH repos
* refactor(speech): key transcript words once and type phone terms at the reply schema
* refactor(speech): merge speech-types imports in the speech IPC
* feat(runtime): tell phones when the desktop refreshes a PR
* fix(runtime): name every checkout a coalesced PR read stood for
* fix(runtime): don't count a read that couldn't load checks as a checks change
* feat(mobile): keep dictating after leaving the session, with a floating pill
* feat(mobile): translate the dictation pill and its toasts
* fix(mobile): type away words without claiming the terminal, and keep the pill above screens
* fix(mobile): float the pill above bottom bars, reopen the owner's own screen, and tell a refused start wherever you are
* fix(mobile): float the dictation pill above the source control bar
* fix(mobile): keep pill state out of the host context and reopen the starting screen first
* refactor(mobile): subscribe the pill only while it shows and trim the session dictation hook
* fix(mobile): key bar clearances by symbol
* feat(mobile): save the chat when the app leaves the foreground
A swipe-kill from the app switcher can end the app before the page is
hidden: iOS fires visibilitychange only at background, and Android Recents
leaves the activity resumed. The shell now sends an appInactive frame on
iOS inactive and Android window blur, to pages that declare they read it,
and the page saves any chat rows the store doesn't hold yet.
* fix(mobile): keep the leave callback out of render
* fix(mobile): notice a changed middle row before skipping a chat save
* perf(mobile): show accounts from the last snapshot
* fix(mobile): never count a stored accounts snapshot as live
* test(mobile): pin when accounts usage counts as live
* fix(mobile): date accounts reads by when they were sent and block switches until live
* fix(mobile): show accounts usage only from this screen's own read, drop replies from before a reconnect
* fix(mobile): stop Review's branch compare re-reading back to back during git bursts
fetchHostQuery re-read a compare as soon as it landed marked by a git event, so a burst of gitStatusChanged events with reads slower than the event spacing kept the desktop running compares back to back, and kept going after Review closed. A re-read now goes at once only after a quiet spell (a write's own event), otherwise floorMs after the last read landed, and stops once Review's build is no longer current. A superseded build no longer evicts the entry a newer build is reading.
* fix(mobile): show each compare that lands during a git burst while Review reads it again
* fix(mobile): keep note edits when a later compare lands on a shown Review build
* perf(mobile): open Home with last-known workspaces and counts
* fix(mobile): keep disconnected desktops on Home and judge agents by the client's connect time
* fix(mobile): store the seeded Home counts before removing the old snapshot
* fix(mobile): floor router reads after failures, catch up reads that span a stream reopen, seed the wide host list from Home
* fix(mobile): keep the old Home snapshot until the store can take it, and never re-date stored totals
* perf(mobile): key Home's counts in the host list module so the page boot never loads Home's code
* test(mobile): type the Home catalog adapter's modules with type imports
* perf(mobile): read Home's stored rows in one batch beside the host list, and keep mark-read a delta read
* perf(mobile): paint Home's desktop rows without waiting for the stored counts
* perf(mobile): restore Home's stored rows after the desktop list paints, from its host ids
* perf(mobile): read Home's counts on the connected edge itself, not a render later
* feat(mobile): keep commit, PR and review drafts across kills
* refactor(mobile): build commit, PR and review drafts on the shared draft fields, and clear only the text that was sent
* fix(mobile): keep a toggle made during Write with AI, the edit note while its sheet closes, and a newer PR edit after an earlier save
* test(mobile): wait for the saved review note row instead of sleeping
* perf(mobile): keep a hash of the PR text an edit was typed against, not a second copy
* feat(mobile): open chats on their last messages after a relaunch
The phone's store keeps each chat's newest rows (up to 512 KiB, 500 rows)
and its resume point, written when a turn settles, on hidden and when the
chat closes. A relaunched session opens on its stored chat tab, paints the
saved rows, and resumes from the stored cursor; the live read restates what
the agent is doing. Offline, the composer line says when the copy is from.
* test(mobile): keep the relaunch test typechecking
* i18n(mobile): translate the offline as-of line
* perf(mobile): encode chat copies in slices off the settle frame
* perf(mobile): keep three visited terminals mounted and release hidden WebGL
* fix(mobile): scope the mounted-terminal LRU to the terminal frame
* fix(mobile): keep chat's lease-only stream when a terminal pane unmounts
* fix(mobile): report a hidden terminal's cell box only once it is shown
* perf(mobile): keep hidden terminals' WebGL contexts instead of rebuilding them on every switch
* perf(mobile): back off spare page refills after an unclaimed drop or memory warning
* fix(mobile): skip a spare whose store read outlived an unclaimed drop
* fix(mobile): arm the spare refill timer on whole milliseconds
* fix(mobile): floor event-driven reads after failures and catch up reads that span a stream reopen
* test(mobile): pin the event router's read floor after a refused read in a recording
* feat(mobile): keep Tasks and new-workspace drafts across kills
Task comments (per item and project row), the New issue title and body,
and the New workspace note now live in device-store draft rows. They come
back after the form closes or the app is killed, and only into an empty
field. A comment's setter stays bound to its item, so a send that settles
after the user moved on clears the right row.
* fix(mobile): rebuild comment sends when the draft's item changes
* fix(mobile): key the workspace note by host and keep cleared fields cleared
* fix(mobile): clear only the note a finished create sent
* fix(mobile): count clearing an empty draft field as the user's choice
* perf(mobile): cap field drafts, read sheet drafts on open, retry a failed read once
* fix(mobile): retry a failed draft read after a pause and keep New issue text typed during a create
* fix(mobile): save draft text again once a failed store read can be retried
* fix(mobile): remove a stored draft when an unread field is cleared
* perf(github): use the desktop's PR fallback rule on the phone and forward refreshes
* fix(github): keep a merged fallback PR while the phone has no head
* feat(runtime): tell phones when relay hosts change
* fix(runtime): keep the relay host backstop live and watch every list input
* fix(mobile): hold the relay host feed only for desktops that announce changes
* perf(runtime): watch relay host inputs only while phones read the list
Codex reports both approved and denied automatic approval reviews on the
guardianWarning channel. Orca rendered every one as a yellow "safety review
warning", so routine approvals looked like problems. Approved reviews now
render as a neutral "approved this action" notice on desktop and mobile;
denials and timeouts keep the warning tone.
Co-authored-by: Sean876-alt <224890246+Sean876-alt@users.noreply.github.com>
Co-authored-by: Neil <neil@stably.ai>
Neil
Neil
OrcaWinandOrcaWin
Brennan Benson
Kelvin Amoaba
Jinjing
