* Preserve remote browser certificate warnings through navigation
* Apply current remote observations at the session boundary
* Document array proxy forwarding in the performance contract
* Keep remote browser failure fallbacks within current observations
* Defer remote observation reads to lifecycle callbacks
* Apply remote page observations without preempting pending outcomes
* Preserve command loading ownership across partial page updates
* Reuse browser host identity within each mirror record
* Explain transparent record access in the loading contract fixture
* Keep adoption fixture aligned with remote loading session
* Name the remote navigation fixture return contract
* fix(cli): keep Orca in the background when orca open launches it
* docs(cli): say orca open leaves the foreground alone
* fix(cli): ask a running Orca to open its window in the background
* fix(main): keep background reveals inactive on Linux maximize and drop the flag on admin restart
* fix(cli): narrow the open status before returning it
* fix(main): keep focus-existing-window free of main-window contracts for the web typecheck
* fix(cli): cap the open window request at five seconds
lint-staged 16.4.0 walks the whole worktree several times before any
linter runs. On a cold stat cache that made small commits take over a
minute. Extend the existing lint-staged patch:
- getDeletedFiles: replace the serial `ls-files --deleted` with
`diff-files -D` (parallel preload, fsmonitor bypassed) plus
assume-unchanged entries, filtered by the same lstat rule, so the
deleted-file contract is unchanged.
- getUnstagedFiles: `status --untracked-files=no`; the `??` lines were
already discarded.
- config discovery: list tracked config files only. A nested config
must be tracked or staged to apply; untracked configs at the repo
root are still found.
Run lint-staged directly from the hook; husky already puts
node_modules/.bin on PATH, so `pnpm exec` only added startup time.
* perf(github): share and pace timed pull request reads on the host
Reuse exact completed results for automatic refreshes, back off unchanged
settled pull requests, and route server revalidation through the existing
host budget while preserving foreground reads and older clients.
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* fix(github): preserve shared producer settlement and selected demand
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* test(github): cover paired receipt retries and watch fairness
* test(github): explain shared fake-clock fixture
* test(github): typecheck host and renderer integration together
* test(github): name exported fixture mock types
* Revert "test(github): typecheck host and renderer integration together"
This reverts commit 756a38787c.
* test(github): place host and renderer loops in cross-layer suite
* fix(github): preserve refresh policy and shared callers
Use the same validated freshness for cached queue reads and their follow-up. Keep forced mergeability rereads and detach cancelled consumers independently from the shared lookup.
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* fix(github): refresh settled rows when exposed again
Use the same finite foreground age to admit and consume the queued read. A recent exact result can still satisfy it, and settled rows do not acquire a recurring timer.
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* fix(github): accept only current PR read completions
Keep shared publication and retry planning on the accepted actual read. Preserve legacy own replies, terminal loading and ordinary work after a superseded lookup, and honor the accepted error gate before automatic recovery.
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* test(github): follow moved request contracts
* test(github): explain the partial event fixture type assertion
* fix(github): preserve queued deadlines and detachable PR waits
* fix(github): compare refresh wakes on the elapsed clock
* test(github): format queued refresh deadline cases
* fix(github): charge actual producers and fence retry gates
* fix(github): preserve fresh intent and producer error policy
* fix(github): retain owned cold-read retry gates
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
A tab a page opened with no gesture counted as the agent's only within the
agent's 20 s idle window, so a late open (an OAuth tab finishing after the
agent went quiet) switched the user's visible tab. Track, per guest, whether an
agent drove the page since the desktop user last gave it input, carry it into
popups the page opens, and keep such opens in the background.
A popup whose owner tab was gone handed any http(s) open to the system browser,
including agent, phone and scripted ones, which took the foreground. Only the
desktop user's own click opens it there now; the rest are reported blocked.
* feat(computer-use): scroll and select rows in background Linux windows, and aim GTK 4 pointer input
Scroll moves the nearest scroll bar's value by whole viewports, handing
the scroll outward at a view's end, or pages a web document with
Component.ScrollTo, before falling back to the pointer. A click on a
list row with no action selects it through the list's Selection when
the index is proven to name that row. GTK 4 rectangles come from
WINDOW extents plus the X11 client origin, since its SCREEN extents
read [0, 0, w, h].
* fix(computer-use): keep Linux background scroll and select honest under partial and slow results
Wait for ScrollTo to move before planning the next page, report pages
already scrolled instead of falling back, let refused scroll bars fall
through, clear a multi-select list before a plain-click select, accept
only an InvalidArgs refusal as index proof, bound child walks, and
read GTK 4 origins lazily.
* fix(computer-use): scroll the innermost Linux view that overflows, and bound the scroll search
ScrollTo now runs on each ancestor that overflows its own box, innermost
first, so an inner scroller moves before the page; coordinate scrolls
start from the deepest node under the point. Cap the scroll bar search
to small containers, report a document at its end as a no-op, keep
looking past an unusable spanning child, and look up GTK 4 window names
once per operation.
* feat(settings): add per-project workspace cleanup rules to project settings
A project's settings get a Workspace cleanup section: Use global, Off, or
Custom rules seeded from the host's global rules, using the same rule rows
as the Workspace Cleanup page.
* fix(settings): compare a cleanup change against a fresh preview, not the cached one
A cached baseline can predate files that now protect a workspace, which
would hide it from the confirm. The host shares concurrent previews, so a
fresh read stays one evaluation.
* test(browser): measure agent input focus on the Windows desktop
* test(browser): show Orca inactive before the Windows holder takes the foreground
* test(browser): name the foreground window in Windows holder replies
* test(browser): lift the foreground lock before the Windows holder takes the foreground
* test(browser): run the Windows agent focus check from a dispatch-only workflow
* test(browser): skip the Windows focus checks before launch off hosted runners
* test(browser): harden the Windows focus holder and its dispatch workflow
* fix(computer): ask the user before retrying with --restore-window
Error hints, recovery steps, the skill guide and the CLI follow-up command
told agents to retry with --restore-window on their own, which raises the
target app and takes the user's screen. They now say to ask the user first,
stop recommending a restore just to observe, and fix stale per-platform
background claims.
* docs(computer): name the Linux keyboard gate and the Wayland limit
Pages outside an Orca pane (popups, serve pages) got native webContents.focus() on every agent press, which focuses and can raise their window. Emulate page focus instead, and focus natively only inside a window that already has focus.
* Add setup scripts for project group folder workspaces
* Align setup regression fixtures and catalog read validation
* Target the Advanced disclosure in group setup regression
* test: initialize project groups in worktree slice fixture
* Preserve group setup startup input across paired hosts
* Check paired group startup regression in cross-layer project
* Restore group setup settings when saving fails
* Wait for group agents to accept startup input
* Type the group startup readiness fixture foreground state
* Give group startup fixture mocks portable public types
* Reuse worktree startup for group folder setup
* Keep example shell regression while removing obsolete observer tests
* Complete launch runtime fixture PTY options
* Exercise terminal startup failure and worktree draft paste in parity tests
* Preserve repository type defaults for setup commands
* Reuse resolved executable paths for Mac process launches
* Keep synchronous launch wrappers covered by the ratchet
* Explain executable launch type assertions
* Remove resolved Git imports from the direct-launch baseline
* Keep native spawn cancellation on the native lookup path
* fix(mobile-relay): resolve on persistent 4404 and make deferral logs readable
* fix(mobile-relay): bound 4404 director resolves for a desktop that stays offline
Review follow-up:
- Resolve on the 2nd consecutive 4404 of an episode, then the 4th, 8th, 16th,
and never twice within 5 minutes per host. A sleeping laptop with a
foregrounded phone now costs 6 resolves in 30 minutes, not ~1 per 2 dials.
- If the director names the same cell and epoch, keep the normal 4404 wait:
no re-route and no immediate redial.
- The streak ends on any other outcome (including aborts), when the phone has
connected since the last 4404 (a direct-path win), or after a 2-minute gap.
- Clear the gate reprobe due time with its timer so the deferral log never
reports a stale remainingMs.
* fix(mobile-relay): double the gap between 4404 resolves while the desktop stays offline
The 5-minute floor alone set the pace (12 resolves/hour, forever). After each
resolve the minimum gap now doubles, 5 -> 10 -> 20 -> 40 -> 60 min, and
returns to 5 min after a successful relay dial or any connection. A laptop
asleep for two hours with the phone in the foreground costs 5 resolves.
* refactor(mobile-relay): namespace the supervisor's diagnostic log import to stay within max-lines
* fix(computer-use): keep Linux actions in the background unless the user allows a raise
Pointer fallbacks, scroll and drag no longer raise the target window and
warp the pointer without --restore-window; they refuse with
background_unavailable before sending anything. With the flag, the
target point is validated before the raise, a window on another
workspace is refused instead of switching the user's view, and the
pointer is put back afterwards.
Also refuse background clicks that open menus, keyboard-grabbing popups
or dialogs (ported from agent-desktop's foreground classifier), refuse
synthetic input on Wayland where it never lands, press Return through a
GTK entry's activate action, re-check focus and held modifiers while
typing, and report action.delivery from what happened.
* fix(computer-use): check the workspace before every Linux raise and release held buttons
Run the other-workspace check before GrabFocus too, raise before a
user-approved menu or dialog opener, validate a pointer target before
asking for the flag, count newly active app windows as foreground,
release synthetic buttons when input is interrupted, and stop typing
without an exception exit so the user's held keys are left alone.
* fix(computer-use): keep held modifiers from other X screens and settle remapped keys on early stop
* fix(computer-use): refuse a Linux raise when the target's workspace can't be read
* fix(relay): faster stall detection and a 60s retry cap when only the cell failed
Start the existing 3 x 8 s ping probe once a keepalive reply is 10 s overdue,
cutting silent-stall detection without shortening the keepalive interval or
tearing down on a single lost frame.
When the director answered and only the cell connect failed, cap the drain
retry at 60 s instead of 300 s. Director failures keep the full schedule.
* fix(relay): use the 60s cap only for a newly named failing cell
Every drain retry re-asks the director, so capping retries at 60 s for a cell
that keeps failing would raise director load for every host on that cell. The
short cap now applies only when the director names a cell that has not just
failed; the same cell failing again falls back to the full 300 s schedule.
* refactor(relay): keep retry-cap state next to assignment state
* fix(relay): give each failing cell the short retry cap once per episode
A director alternating between failing cells (A, B, A, B) kept the 60 s cap
forever because only the previous cell was compared. Track every cell that
failed since the last success; a repeat of any of them uses the full backoff.
* fix(relay): re-ask the director when data attaches fail and on broker self-close
Edge keepalives are answered without the host being seated, so a live control
does not prove phones can reach the desktop. Two consecutive data-attach
failures within 2 minutes now drain the origin through the existing
resolve-director path (at most once per 60 s per origin).
The coordinator now rebuilds a broker that closed itself after token refresh
gave up immediately instead of at the next 5-minute tick, and the tick no
longer tears down a pool that is already retrying against the director.
* fix(relay): count only failed host data dials, per-pool pacing, bounded recovery trust
Review follow-up for the data-path and coordinator fixes:
- Only a host data dial that fails before opening counts. After open, 4401
(phone left), 4408 (phone dropped) and the attach deadline (quiet phone)
are phone behaviour, not path evidence.
- Require failures on two distinct connections; a replayed pending attach
counts once.
- Pace data-path recovery once per minute per pool (not per origin) and
drain with a 60 s grace so live phones on the old cell are not cut off.
- isRecovering() trusts a failing pool retry for at most 5 minutes and never
after a non-retryable director refusal, so ensureLive rebuilds again.
* fix(relay): count a data dial that opens after half the attach window as failed
The relay's attach window starts when it sends conn-open and ours when we
receive it. On a lossy path a dial that opens at ~7 s leaves host-data-auth
missing the relay's window (phone gets 4404 attach-timeout, relay closes
4401), yet it counted as healthy and cleared the failure set. Opens slower
than RELAY_HOST_ATTACH_DEADLINE_MS / 2 now count as failures and never clear
it; fast opens still do.
* fix(relay): count a slow data dial only if its attach then fails
A slow open whose first relay frame still arrives (a slow-but-working path,
an event-loop stall, wake from sleep) no longer counts as a failure, and it
clears pending failures. The transport now reports each attach once, when it
ends: open latency plus whether the first frame arrived. A slow open counts
only if the socket closes or times out before that frame, the relay's 4401
first-frame timeout being the real failure.
Desktop: drop IPv4 169.254.0.0/16 (and, as before, IPv6 fe80::/10)
addresses from the pairing interface list, so an APIPA or idle adapter is
never the QR's direct endpoint. When nothing else is usable the offer
already omits the direct address (Relay carries the invite; LAN-only
refuses). Among non-Tailscale candidates, an adapter known to hold the
default route now wins ties.
Mobile: a relay-paired host whose stored endpoint is link-local seeds its
logical client with a never-dialing 'reconnecting' stand-in and disables
the direct return probe, so already-paired phones go straight to Relay
instead of redialing the dead address. Relay-less hosts still dial.
#41870 added hover/focus/press outlines to every Button, Toggle and
SelectTrigger, which read as noise on dense toolbar icon buttons.
Restore the previous focus-visible ring for those primitives and keep the
outline treatment only for buttons inside DialogFooter.
* fix(computer-use): refuse macOS background actions that open a menu or dialog over the user
* fix(computer-use): let web comboboxes click in the background and stop probing a hung app
* fix(computer-use): refuse background drags that start on a menu owner
* docs(computer-use): note background drags on menu owners are refused
* fix(computer-use): classify the element under a drag's start and check AXConfirm/AXOpen secondary actions
* fix(computer-use): refuse Windows pointer fallbacks without --restore-window
Coordinate, right, middle, modified and multi-clicks, clicks on elements with no
primary pattern, unscrollable wheel scrolls and drags raised the window and
moved the real cursor without being asked. They now refuse with
background_unavailable before anything is sent. Coordinate and fractional
scrolls go through ScrollPattern first. With --restore-window only the target
window is raised (never a cloaked one), with a UIA activation fallback and a
second attempt, points are validated first and the cursor is put back behind
the input. A failing UIA pattern or disabled element is an error instead of a
real click, and delivery is measured after the post-action observe.
* fix(computer-use): settle Windows clicks before restoring the cursor and keep scroll writes honest
* fix(computer-use): restore the Windows cursor with SetCursorPos and hit-test coordinate scrolls
* test(computer-use): assert Windows raise outcomes, not attempt order
* fix(computer-use): report a Windows page scroll the provider ignores as not scrolled
* feat(settings): add Workspace Cleanup settings page
Adds a Settings > Workspace Cleanup page for the host that owns the repos:
status with Clean up now, the rule switches, the ignored-files protection
and an Activity list of past runs. Turning on a delete rule that matches
workspaces right now asks first; Keep pins a workspace.
The page refreshes when the host's runner finishes a run: desktop main now
forwards workspaceCleanupRunFinished to its window, and remote hosts' event
is no longer dropped by the client event allowlist.
* feat(settings): confirm any cleanup rule change that would delete workspaces now
Lowering the inactive days or turning off the ignored-files protection makes
the runner delete within seconds too, so those changes get the same confirm
as turning a rule on.
* fix(settings): serialize cleanup rule changes and guard the confirm
One rule change at a time, built from the host's rules as they are when it
is saved; Esc or the close button can no longer abandon a confirm that is
already saving. Local save failures surface, a host whose rules cannot be
read says so with a retry, and the page follows project rules that keep
the runner on.
* fix(settings): keep cleanup changes bound to fresh rules and this page
A change re-reads the host's rules when it is confirmed, a change still
previewing when the page closes is dropped, Keep locks while saving, and
each preview is kept with the rules it evaluated. The page is hidden in a
paired browser, whose settings are not the host's.
* refactor(settings): reuse existing helpers in the Workspace Cleanup page
One row key helper, useMountedRef, SettingsSwitchRow and the shared
runtime target builder; only the preview of rules about to be saved is
kept as the page's matches, and the report waits for the rules.
* chore(i18n): protect the cleanup confirm's copy
* fix(settings): re-check the cleanup confirm when the rules moved meanwhile
If another client changed the rules while the confirm was open, preview
again and list any workspace the dialog had not shown before saving.
* fix(settings): preview again on every cleanup confirm
A workspace can age past a rule while the confirm is open, so the confirm
always checks again and lists anything new before saving.
* fix(settings): drop a confirmed cleanup change if the page closed while pinning
* feat(workspace-cleanup): keep PR number and ignored file names on cleanup rows
Run and preview rows now carry the merged PR number and up to 3 ignored
file names the evidence already read, so the page can say 'Merged · #4182'
and 'Ignored files · .env'. No new Git reads; older saved runs lack them.
* fix(settings): say when a run's saved receipt lists fewer kept workspaces
* fix(workspace-cleanup): import at-risk local files from its new home
* perf(workspace-cleanup): share in-flight previews and stop re-scanning confirmed rules
The host shares one evaluation between previews of the same rules, so
reopened pages and several clients no longer stack full scans. The page
keeps a would-be rules preview out of its matches until those rules are
saved, then adopts it, and reuses its own preview for the current rules.
* fix(hooks): approve setup from the ref a new workspace checks out
The setup trust check before a create read orca.yaml from the project's
own checkout, while the host (since #37977) checks the created worktree.
A checkout behind origin/main made every create skip setup and open the
"branch has different setup commands" dialog right after creation.
The check now reads orca.yaml at the ref the create checks out (the
resolved base, or the local branch for explicit reuse), refreshing it
only when create would, under one deadline. Any failure falls back to
the previous checkout read, and older hosts ignore the new parameter.
* fix(hooks): stop optional setup reads at the deadline and cover automation recovery, VM and web paths
* fix(hooks): refuse late WSL git retries and approve an automation's saved base on recovery
* docs(hooks): move the skipped-setup recovery comment back to its function
* fix(automations): re-approve setup when an automation's base branch changes
* fix(crash-reporting): read renderer allocation profiles only on heap growth
Each sampling-profile read makes V8 run a full renderer GC first, and the
old 30 s refresh paid that pause for as long as a window's heap stayed high.
Main's 30 s tick now asks only for heap usage (no GC); a profile is read once
after one interval and then only after 5% of the limit of further growth.
Stopping detaches instead of calling stopSampling, which also forced a GC.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(crash-reporting): take the baseline profile on main's first heap check
Tie the no-growth baseline read to main's first heap check instead of a
wall-clock deadline, so a clock correction can't postpone it, and ignore
non-finite heap readings.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The per-server check from #41834 used `state IN ('open', 'cancel_owed')`, which makes SQLite
build a small temporary set on every call, and asked about home conversations in a separate
statement. A server with one live link and no home conversation paid more per pull than the
old global scan did.
It is now one statement: a home-conversation seek, then one equality seek per live link state
on the same covering index, stopping at the first row. Closed-link history still never enters
the check. The answer, the read-error fallback and global discovery are unchanged.
Brennan Benson
Kelvin Amoaba
Jinjing
OrcaWinandOrcaWin
Yasyf Mohamedali
Neil
Jinwoo Hong
