* feat(runtime): device-key authentication and per-installation key migration (host)
* fix(runtime): corrupt registry is never a revocation verdict; keyed sockets dispatch without a token; forks keep their Relay binding
* fix(runtime): keep an unparseable device registry aside; an unlisted key is never 'revoked' while it exists
* fix(runtime): a set-aside corrupt registry keeps verdicts doubtful even when the registry file is missing
* test(runtime): registerDeviceKey reaches the bound socket through the dispatcher for runtime and mobile rows
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* refactor(daemon): keep the gate's host share in its own module
* test(daemon): pin that an observing desktop's restores count against serve's budget
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* refactor(terminal): panes have two transports, local or remote runtime
* fix(terminal): keep local-only startup gates off unconverted SSH panes
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Fold the streaming dispatcher, the unary invocation helper and two
single-importer helpers into dispatcher.ts so request/response and
streaming-unary share one unary path. No behaviour change.
Co-authored-by: m4air <m4air@Mac.localdomain>
* refactor(runtime): paired sockets authenticate to a device principal
* chore: format and comment touch-ups
* test(mobile): give the launch-authority socket fixture its principal
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(daemon): cap terminals per execution host
* fix(daemon): never let a ledger cleanup throw into a spawn
* fix(daemon): recreate the host terminal ledger dir after a /tmp cleaner
* test(daemon): drop a default-parameter case from the ledger dir test
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Six feed cells, five in us-central1, so one dead US reserve cell is 1/6 of the fleet and 1/5 of its
region and the dead-cell guards in #27458 can decide. Staging only; nothing is applied by merging.
* fix(mobile): direct connections use v2 framing and never fall back once v2 is seen
* test: drop casts in direct v2 tests
* fix(mobile): count v2 handshake failures against the auth retry budget; latch only after host auth
* fix(mobile): pick direct framing at open, recheck the latch before legacy auth, and keep old hosts off the auth budget
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
The staging director deploy binds its digest to staging-gce-c4's checked-in image. E is main
2bdb55350d (#27405 event-loop max, #27406 sidecar), already mirrored to staging. C4 itself
changes only through its own reviewed refresh workflow.
* feat(serve): let the owner resume paused automatic restores
The terminal daemon now answers automaticWorkStatus and
resumeAutomaticWork. Resume clears a recorded same-boot crash pause or
a pressure pause, writes the cleared state durably, and wakes restores
that were waiting. The runtime exposes runtime.automaticWork.status and
runtime.automaticWork.resume (host-admin; advertised as
runtime.automatic-work.v1), the CLI adds 'orca serve restore resume',
and a sleeping pane paused by its host offers 'Resume automatic
restores'. A daemon that predates the requests reports no gate.
* fix(serve): a stale daemon cannot resume, and an old one says so
Resume now re-reads endpoint ownership right before it runs, so a
daemon replaced by a successor cannot rewrite the successor's run
marker. A gate-bearing daemon from before resume existed is reported as
'terminal host predates resume' instead of 'no gate'; the CLI says to
run the command again after the terminal host restarts, and a sleeping
pane still resumes when the user asks for it.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
The terminal gate's relay lister always resolved to null in production (no SSH PTY
provider is ever registered), so its relay and previous-relay branches, the legacy
relay route/router/routing, the previous-relay census and the once-connected
re-check could never run. The gate now takes only the host census; census-only
verdicts are pinned by a characterization test written before the change.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude <noreply@anthropic.com>
On macOS a second Electron main aborts inside _RegisterApplication
before any Orca JavaScript can apply the one-Orca-per-profile rule, so
supervisors and agents retrying 'orca serve' loop on SIGABRT (#14541).
The CLI now checks the profile before it execs Electron serve. A runtime
that answers, or whose socket accepts, is live; one whose socket neither
accepts nor refuses, or that refuses this CLI's credentials, is
unverifiable; both refuse with exit code 3, the single-instance code
systemd units already key off. Only a definitive refusal (ENOENT or
ECONNREFUSED) lets it start. A fresh profile keeps the old synchronous
launch. A macOS startup abort is remembered per environment, so a later
separate 'orca serve' from the same launchd session refuses for 30
minutes with exit 78 instead of aborting again; --force overrides, and
a serve that reaches readiness clears it.
Adapted from #14768; the Launch Services diagnostic wording and the
exit code 3 contract come from #14542.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: thiagomsoares <5190162+thiagomsoares@users.noreply.github.com>
* feat(terminal): declare restore intent and keep deferred panes sleeping
The visible pane's agent restore is sent as user-resume and hidden ones
as automatic-restore, to hosts that advertise terminal.spawn-intent.v1
(and always on the local spawn path). When the host keeps a restore
asleep, the pane shows 'Sleeping — click to resume' with the reason,
keeps a sleeping record so the session stays listed and resumable, and
resumes as the user's own when it is opened or clicked. A deferred pane
is not remounted, which would only be deferred again.
* refactor(shared): one restore spawn intent type
* fix(terminal): a deferred pane owns its session against wake sweeps
A deferred pane has no PTY, so the activation and mobile wake sweeps
read its unfinished record as unowned and could launch the session in
a new tab while the pane still held a resume. The sweep now treats a
deferred pane as the owner, the remembered record is a quit-style
record a sweep never discards, and a retry declines to resume a session
that is already live in another pane.
* fix(terminal): keep a deferred pane's claim through its sweep and retry
The wake sweep now leaves a deferred pane's record alone, since that
pane's own queued resume matches it and is not a duplicate. A retry
keeps the pane registered as the session's owner until its PTY binds,
and declines to resume when another tab already has the same session
queued.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(updater): let supervised macOS serve installs stage Squirrel during install
Supervised `orca serve` keeps autoInstallOnAppQuit off, so electron-updater's
MacUpdater hands the download to Squirrel.Mac only inside quitAndInstall. The
updater, however, held the status at "downloading 100%" and gated quitAndInstall
on Squirrel having already staged the bundle. Neither could happen first, so
every macOS serve update stalled at macos_waiting_for_squirrel, remote installs
failed with remote_update_not_downloaded, and a local install request timed out
and quit without installing.
In supervised serve mode, report the download as installable and let the install
proceed to the handoff and native quitAndInstall. The install commits and arms
the exit watchdog when Squirrel signals it has staged the bundle; a staging
failure still recovers through the existing pre-commit error path.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(updater): hold destructive install prep until Squirrel stages the serve bundle
The supervised macOS install now calls electron-updater's quitAndInstall before
Squirrel has staged anything, and that staging completes asynchronously. Three
consequences needed handling:
- PTY cleanup and close-listener removal ran before staging, so a Squirrel
failure recovered the server with its in-process sessions already killed.
They now run when Squirrel reports the bundle staged, together with the
commit and exit watchdog.
- Any updater 'error' during staging (for example a background check) failed
the handoff while MacUpdater's pending listener would still quit and install.
While staging is awaited, only Squirrel's native error ends it.
- Nothing bounded a Squirrel that never answers. After two minutes the install
recovers through the existing pre-commit failure path and the server keeps
serving.
isMacStagingDeferredToInstall is now darwin-only, so Linux supervised installs
keep their immediate commit.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(updater): report a slow Squirrel staging instead of abandoning the install
Recovering the install on the staging timeout reset Orca's state and failed the
supervisor handoff, but electron-updater's MacUpdater keeps its own completion
listener. A Squirrel that finished after the timeout still quit the app and
installed, now with a failed handoff, so the supervisor skipped the replacement
spawn.
The timeout now only reports a non-retryable error status and records the slow
staging; the handoff and in-flight install stay live so a late staging commits
and relaunches normally.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(updater): commit a staged serve install before its session cleanup
Squirrel's update-downloaded listeners run in registration order, and Orca's
runs before the one MacUpdater adds to quit the app. The staged-install commit
ran PTY cleanup first, so a throwing cleanup callback skipped the commit, the
exit watchdog, and MacUpdater's quit, leaving the install stuck in progress.
Commit and arm the watchdog first, then run cleanup under the same
post_commit_cleanup_failed handling performQuitAndInstall already uses.
The tests now register MacUpdater's persistent quit listener per unstaged
install, so a retried install is followed through completion.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test(updater): pin the MacUpdater staging behavior supervised serve installs rely on
The supervised macOS serve install assumes electron-updater's MacUpdater starts
Squirrel staging only inside quitAndInstall when autoInstallOnAppQuit is off,
and quits the app once staged when autoRunAppAfterInstall is off. Every updater
suite mocks electron-updater, so run the installed MacUpdater methods directly;
an upgrade that changed either behavior now fails here instead of silently
restoring the deadlock.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test(updater): adapt the serve staging tests to current main
Main's macOS quit-guard test predates the staging callbacks this change
adds, so it now passes them, and the new install test builds its window
without a type assertion.
Co-authored-by: jbamlee <dev.jbam@gmail.com>
---------
Co-authored-by: jbamlee <dev.jbam@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: m4air <m4air@Mac.localdomain>
The legacy remote-server help text promises that one manual update enables remote updates, even when the server reports its updater is unavailable. Replace the promise with accurate host-side update guidance in every supported locale and cover the fallback and specific help branches.
Refs #22261
Co-authored-by: Oliver Mee <102673257+oliver-mee@users.noreply.github.com>
* fix(serve): keep the isolated profile off the login keychain
The E2E/pairing runtime hands the app a fresh HOME, so there is no login
keychain for OSCrypt to read. On the serve path the secret-protection report
runs inline before readiness and probes safeStorage on the main thread, where
Chromium's keychain lookup creates the item and waits on an authorization
reply that never arrives, so `orca serve` never advertises (#25453).
The sidecar already launches with --use-mock-keychain for exactly this
profile; share that decision and give the foreground serve process the same
switches.
* test(serve): read spawn args without type assertions
Co-authored-by: Paolo <paovalletta@hotmail.it>
* fix(serve): only an isolated userData profile drops the keychain
The sidecar always runs on a fresh profile, so either E2E variable is
enough there. The foreground serve process opens the selected profile's
sealed secrets, and a HOME override alone still selects the user's real
profile, so it now needs ORCA_E2E_USER_DATA_DIR.
Co-authored-by: Paolo <paovalletta@hotmail.it>
---------
Co-authored-by: Paolo <paovalletta@hotmail.it>
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(sidebar): stop a removed folder workspace from leaving a blank row
A folder-project workspace exists only as its worktreeMeta row. When it is
deleted while a terminal is still bound, the renderer keeps the row until its
teardown runs, and a PTY reattach in that window stamps lastActivityAt through
worktrees:updateMeta. setWorktreeMeta then minted a default row with an empty
name, which the sidebar listed under the project name and which came back after
every delete. The metadata IPC now refuses to create a row for a folder
workspace instance that no longer exists.
Fixes#22712
Claude-Session: https://claude.ai/code/session_01XZXEdbC4RKp288k2gBzLUW
* fix(sidebar): also refuse runtime writes to a removed folder workspace
Move the existence check into a shared predicate that matches any same-id
folder owner, so an owner at a different path on another host cannot bypass
it, and apply it to the runtime's worktree.set path, where a resolution
snapshot taken before the removal still returns the workspace.
Claude-Session: https://claude.ai/code/session_01XZXEdbC4RKp288k2gBzLUW
* test: type the removed-folder-workspace fixture meta for the anti-slop lint
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(runtime): accept a declared spawn intent from paired clients
Paired clients can now say whether a terminal restore is the pane the
user is looking at (user-resume) or a hidden one (automatic-restore).
The host forwards the intent to its fork gate, advertises
terminal.spawn-intent.v1 so clients only send it to hosts that accept
it (terminal.ensureAgentSession params are strict), and reports a
deferred fork as terminal_spawn_deferred with its reason.
No client sends the field yet; that lands next with the sleeping-pane
handling.
* fix(daemon): a claimed agent resume cannot declare itself interactive
Interactive forks skip the gate, and paired clients can now declare
intent, so the host keeps inferring from the claim when a request
says interactive.
* fix(runtime): clients may only declare restore intents
A daemon kept running across an update still lets a declared
interactive request skip its gate, even for a claimed resume. The RPC
and local IPC now accept only user-resume and automatic-restore, and
the daemon request boundary turns a claimed interactive into an
automatic restore.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
The pane listener subscribed to 'orca:wake-hibernated-agents-worktree' while the
dispatcher fires WAKE_HIBERNATED_AGENTS_WORKTREE_EVENT ('orca-wake-...'), so the
in-place wake never ran. Extract the listener and bind it to the shared constant;
the dispatcher test now drives the real listener instead of a stand-in.
Co-authored-by: m4air <m4air@Mac.localdomain>
orcad now checks its flags with the same validator Electron serve and the
CLI use, so contradictory pairing flags fail with the same message instead
of one silently winning. The CLI launcher drops its duplicate recipe check
(the CLI handler already ran the shared validator).
Removes the daemon-init and cli/runtime/index re-export barrels and the
parsePtySessionId / OrcadInstanceLockError re-exports; callers and mocks
import the defining modules.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(cli): extract the serve supervisor's after-exit decision into a pure policy
* refactor(cli): type the exit signal without a child_process import
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(runtime): reuse cached worktree rows when the admin probe cannot answer
* test(runtime): wait for the fingerprint probe to settle instead of a fixed delay
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(daemon): process-growth breaker that pauses automatic restores per host and names the agent
* fix(daemon): breaker trips only on sustained growth, pauses in memory, observes on desktop
* fix(daemon): sample fast only while a tree is rising or tripped
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(serve): report secrets unavailable instead of hanging on an unreachable macOS keychain
* fix(serve): classify keychain probe by exit code, skip under a mock keychain, ratchet direct safeStorage imports
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Nothing mints an SSH-bridge credential since the relay client was removed
(#27214), so the 'ssh-bridge' caller kind, its host binders, result filter,
the CLI bridge-mode policy and the ORCA_SSH_BRIDGE_CREDENTIAL env read could
never run. The allowRemoteCliControl target field stays for older peers.
Co-authored-by: m4air <m4air@Mac.localdomain>
Removes seven modules that only their own tests import, dead orcad exports
and protocol constants, spells orcad's configuration exit code once, reuses
the shared errorMessage helper, and drops links to the deleted
docs/reference folder.
Co-authored-by: m4air <m4air@Mac.localdomain>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(daemon): observe-only fork gate for automatic terminal restores
* fix(daemon): keep a canceled fork charged until reaped; never strand a user resume
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
The relay client is gone, so the three relay-ladder cells and the
@orcad-cli-relay-kept matrix case could not run. Delete them, their
last helper (ssh-test-target-connection), a stale path filter and the
unused build:relay step; rename the runner to invoke-windows-host-cells.ps1.
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(linux): stop the AppImage crashpad handler before the mount goes away
Crashpad's handler runs from the AppImage FUSE mount and outlives the main
process, so it SIGBUSes once the runtime unmounts it. On a validated
AppImage running from its own mount, SIGKILL this launch's handler from the
main process's exit hook.
Fixes#22542
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: clarify AppImage Crashpad exit hook
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A layout stream's cleanup is now registered under a key that includes the
subscriber's connection, and layout.unsubscribe builds that key from the
caller's own connection, matching session.tabs.unsubscribe. Another
connection can no longer end a stream by passing its id.
Fold the empty owner-routing baseline into the focus-read ratchet. The three
deleted focus-routing helpers stay banned as a forbidden-name list.
Co-authored-by: m4air <m4air@Mac.localdomain>
Container devpts instances reuse pts numbers, so selecting kill targets by
tty alone could SIGKILL same-uid processes in other namespaces. On Linux,
require each candidate's /proc session id to equal the PTY shell's pid.
Fixes#27337
Co-authored-by: m4air <m4air@Mac.localdomain>
#27396 deleted the write-only registry that consumed it; nothing sets the
option now, and its doc comment implied a cancellation path that no longer exists.
OrcaWinandm4air
Neil
Jinwoo Hong
BingZandm4air
github-actions[bot]
