Reduce import-scanner work by omitting unused AST parents and the duplicate traversal. Run the mandatory process-host import check alongside static work and explicitly join it before CI can succeed.
Update both workflow phase/enforcement contracts and migrate the newer benchmark to the public subprocess package API. Keep the original package build path, manifests, runtime, test selection, and shard count. Independent native review is clean; validation and timing evidence are in the PR.
A runtime host whose status probe verified is reachable even while its
shared-control socket is still connecting; the status owner already withdraws
that verification whenever a ready socket drops, so a status retained from a
previous socket still reads as connecting.
Fixes#10704
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* Pair native chat tool results in linear time with provider identity
* Preserve orphan tool output and independent disclosure identity
* Keep mobile tool detail attached to its command after row changes
* Keep named mobile results open across copied history refreshes
* fix(persistence): a session write cannot bring back a tab its partition recorded as closed
Main records every terminal close, but only PTY bindings and orphan
adoption honoured the record. A renderer save that still listed the tab
(when no topology revision fenced it yet), a relay write, or a fast
unified-tabs patch could write the closed tab back. Every full write and
unified-tabs patch now removes tabs the same partition has a live close
record for, scoped to the record's worktree. Rollback stays exempt.
* fix(persistence): the close fence accepts host slices that omit terminal maps
A host slice with no terminal rows omits tabsByWorktree, and the forced
close transform indexed it, so a browser-only save to a partition with a
live close record threw and never persisted. Close only tabs actually
listed, with the terminal maps supplied.
* refactor(persistence): the close fence reuses the shared tab-listing check
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
The web client had no Jira namespace, so every Jira call fell through to
the silent fallback and returned undefined. Forward each Jira method to the
server's jira.* RPCs, stream issue details, and warn once per namespace when
a call lands on the fallback.
Builds on #16803 by @JasonJarvan.
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
The web client's usage and Claude/Codex account bridges were stubs, so the
status-bar usage bars never appeared and switching accounts did nothing.
Back them with the server's existing accounts.list / accounts.subscribe
snapshot (which already carries rate limits) and its select/remove RPCs.
Adding or re-signing accounts now fails with a reason instead of silently
returning an empty roster.
Harvests the approach and tests from #25133 by @gustavobragac.
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: gustavobragac <gustavobragac@users.noreply.github.com>
Clicking x did nothing when the worktree catalog had not hydrated yet or
the tab's group record was missing. The close now routes by the host the
tab's own PTY ids (or unified tab) name, and with no host at all still
prunes locally and reaches main's close record; per-PTY teardown already
fails closed for an unproven host. closeUnifiedTab closes a tab whose
group record is gone instead of returning null.
Fixes#11308
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(runtime): a terminal close commits in the session partition that holds the tab
One worktree's tabs can be split across the local and runtime:<id> saved
partitions. The host close searched only the routed partition, so a tab
in the other one was reported tab_not_found (or recorded nowhere useful)
and the next snapshot brought it back. The close now resolves every
partition that holds that exact tab id and commits there.
Fixes#18202
* fix(runtime): refuse a close when a second copy of the tab was rebound since it was asked
The owner fence checks only the first partition holding the tab, so a
second legacy copy rebound before admission was retired and its PTY
collected for kill. Owner-fenced closes now capture every holder and
refuse with terminal_pane_owner_changed when a later copy is new or
changed.
* fix(runtime): fence a close's second copies on snapshots, not live sessions
The binding writer mutates a session in place, so comparing a captured
session reference with the current one compared a replacement with
itself. Capture an immutable copy of each holder's row, bindings and
incarnations when the close is asked.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(repos): every repo catalog uses the host-catalog fence
The all-host and active-target repo loaders fenced only by fetch
generation, so a catalog fetched over a runtime connection that was
replaced mid-fetch still overwrote the current one. All three repo
loaders now claim the shared host-catalog fence (generation, SSH-state
and runtime-connection generations), which replaces the repo-only
per-host generation map and the Connect flow's inline checks. A dropped
catalog is not an answer, so the all-host load skips repo-scoped UI
validation.
* fix(repos): a superseded all-host load claims no remote fences
Its late claim would void the newer load's in-flight catalog, so neither
would apply.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* [CI] Consolidate renderer test modules and retire static scans
* [CI] Keep consolidated test within the existing line limit
* [CI] Refresh evidence for the preserved turn-duration gate
Update and hydrate refuse a parent worktree on another execution host and
the renderer drops such an edge, but create recorded it anyway. Create now
checks the new worktree's host before anything is created: an explicit
parent on another host fails with LINEAGE_PARENT_CONTEXT_CONFLICT, and an
inferred one is dropped with a warning. An unknown host on either side
stays permissive, as in the projection.
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(hosts): the unresolved-owner sentinel is never routable
When a worktree's owner publications conflict, the renderer marks it with
runtime:unresolved-owner so nothing treats it as local. That id parses as
a paired runtime, and AI Vault and the port scanner dialed environment
'unresolved-owner'. The sentinel is now a named shared constant with a
routable-host parser that rejects it; AI Vault list/titles/resume and the
renderer's runtime target builder use it, and the scattered string
compares collapse onto the same helpers.
* fix(worktrees): refuse a create captured on the unresolved owner
Without a routable target, the direct-SSH desktop IPC fallback would have
created the workspace on this machine.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(cli): implicit worktree selection is scoped to the caller's host
A CLI run from a shell on SSH host D matched its cwd against every host's
worktrees, so a same-path twin on host A could win. Candidates are now
limited to the caller's execution host (the relay's SSH stamp, else this
machine), and a pane's forwarded ORCA_WORKTREE_ID is scoped the same way.
* fix(cli): a local caller keeps runtime-stamped checkouts this runtime holds
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(session-tabs): a returning paired publisher is repaired by an authoritative census, not dropped
* fix(session-tabs): a census never outranks a stream frame received while it was in flight
* fix(session-tabs): a coalesced census uses the newest subscription and is forgotten with its worktree
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(terminal): honor the OpenSSH DefaultShell on Windows SSH hosts running orcad (#9327)
* fix(terminal): honor only a PowerShell-family DefaultShell so agent launch quoting still matches
* fix(terminal): import the registry reader's runner from @orca/process-host
* test(terminal): type the spawnSync stub's options
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(native-chat): retire a first send's echo in transcript time, not this client's
A send into an empty transcript had no row to anchor on, so its echo was
matched against rows newer than the renderer's send time. Row timestamps
come from the host that writes the transcript; with that host's clock
behind, the echo's own turn looked older than the send and the queued
bubble never retired.
A send made after the transcript read has settled empty now records that
every row is after it. A send made while the read is still loading keeps
the existing rule, so older history arriving later cannot retire it.
* fix(native-chat): bind the empty-transcript claim to the session that was read
'ready' with no rows is also the placeholder before a provider session is
known, which read nothing; a resumed transcript can then hold an older
identical turn that retired the new send, and with it a rejected or
unconfirmed notice. The claim now needs a provider session id, records it,
and is released for any other session, falling back to the existing rule.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(ssh): a direct-SSH host republish no longer steals this view's tab selection
* fix(ssh): keep the home screen out of the kept selection
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(runtime): automatic tab activation no longer wakes a worktree the host put to sleep
* fix(pty): a joined user wake no longer inherits an automatic sleep refusal
* refactor(runtime): pass caller spawn guards through one helper
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
On Windows a WSL workspace and a Windows workspace are both 'local', so the
resume check let a WSL session resume in PowerShell (and a Windows session
inside WSL), opening a tab that does nothing. Local resumes now also require
the session's namespace (its WSL distro, or native) to match the target's;
an unknown target namespace still refuses only what it can prove.
Pi and Prime Agent resume by transcript path, and got the raw
\\wsl.localhost UNC spelling inside WSL, so they silently started a new
session. Their provider session now uses the same normalized path OMP
already used.
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Only Codex had a WSL fallback when a transcript is looked up by session id,
so Claude running inside WSL with no hook path was searched only on the
Windows profile and chat showed "Transcript unavailable". Every id lookup
now searches this host's roots first and, only on a miss, each running
distro's roots for the same agent, through the shared per-root WSL scan.
One layout table names how each agent files a session (claude, codex, grok,
omp) for both host and WSL lookups.
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
OpenClaw discovery walked every directory under <state>/agents and accepted
any JSONL under a 'sessions' segment, so an embedded <agent>/agent/codex-home
was walked (thousands of serialized SSH readDirs) and listed as OpenClaw.
Both the local and remote source tables now enter only 'sessions' below each
agent dir; the OpenClaw source entry moves next to that rule.
When a single host answers that its search is off (relays keep their index
off by design) or unavailable, the History box falls back to the title
filter for that host with a notice, instead of an empty wall.
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* refactor(ai-vault, native-chat): one per-call agent root table
The native-chat transcript resolver kept its own copy of each agent's
session roots, and it had drifted from the AI Vault source table. Both now
read session-scanner-roots: host roots computed per call, and one table of
where each agent's tree sits under a home dir (host or WSL guest).
AI Vault now lists Claude sessions under CLAUDE_CONFIG_DIR, which the CLI
writes to and native chat already read.
* fix(ai-vault): forward CLAUDE_CONFIG_DIR to the scanner child
The desktop scanner runs with an allowlisted env, so the new config-dir
root was resolved in the parent but stripped in the child that lists
History.
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* fix(agent-hooks): route the first-work branch rename by the repo's execution host
* fix(agent-hooks): state runtime branch ownership without overclaiming server wiring
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
* Let a Codex chat stop a sub-agent from the background-tasks strip
A Codex sub-agent showed in the background-tasks strip with no Stop, and
the chat's own Stop interrupts only the main turn, so a helper ran on until
it finished. Codex's app-server takes `turn/interrupt` for any loaded thread,
sub-agent threads included, so a sub-agent row's Stop now interrupts the
turn Orca saw that sub-agent run, through the same background Stop route
Codex commands use.
Codex's -32600 refusal (no active turn, another turn, thread not found)
means the run the row showed is over, so the Stop is quiet; any other
refusal says the task wasn't stopped; a timeout or lost contact is
unconfirmed. A live run showed Codex holds an interrupt that lands as the
turn ends until the sub-agent's next turn ends, so a timeout on a run the
session has since seen end is quiet too. Older clients' `codex-agent:` rows
name no host record and stay unstoppable.
* Stop a Codex sub-agent's own sub-agents and commands with it, and hold Stopping per run
A sub-agent Stop interrupted only that helper's turn, so the commands it was
running (Codex keeps a turn's processes when the turn is interrupted) and the
helpers it had spawned kept going, and its row stayed in the strip. The Stop
now interrupts the helper's run and every descendant's run, then terminates
the processes those threads hold where the app-server has background
terminals. The interrupt goes through interruptCodexTurn, and a small
codex-background-task-stops module composes the sub-agent and terminal stops,
so the terminals module is terminals only again.
A Codex helper keeps one row id (its thread id) across runs, so a confirmed
Stop's held button carried over to the helper's next run. Both clients now
hold it for the run it was pressed on, read from the row's invocation.
* Test that a sub-agent Stop leaves siblings alone and skips terminates after a timeout
Adds direct tests of the per-run Stop hold (including an older host's roster),
matches the desktop hold comment to mobile's, and reuses the one 10 s bound.
* feat(native-chat): offer Codex Ultrafast as a speed choice
Codex lists Ultrafast as a third service tier for eligible models and
accounts (GPT-6.1 Sol). Codex chats saved Fast as on/off, which cannot
hold a third tier. The Codex speed is now a Standard/Fast/Ultrafast
choice built from the tiers the model lists; the tier id is still
resolved from the catalog at each send. Older clients keep their Fast
toggle: the host still reports Fast on/off and accepts it as a speed.
* refactor(native-chat): save the Codex tier id instead of a speed name
The chat now keeps the tier id Codex lists (serviceTier: default,
priority, ultrafast) and sends it as-is on turn/start; Codex drops a
tier the model no longer lists with its own warning. This removes the
saved per-model tier map, the send-time lookup and the reconcile code.
The unused fastModeTierByModel catalog field is deleted. Older clients
still get Fast on/off, derived from the model's tier named Fast. Also
drops the pnpm-lock.yaml churn the first commit picked up.
* test(pi): drop the removed fastModeTierByModel catalog field
* fix(native-chat): review round 1 for Codex service tiers
- Accept an older client's fastMode write through the Codex adapter; it
was refused before reaching the tier alias.
- Bump the saved model catalog schema so catalogs from before
serviceTiers re-list instead of offering a Fast toggle with no tier.
- Keep only the reported tier on the record, not the Fast it implies.
- Drop a reported tier, not only a picked one, when the next model does
not list it.
- Localize Standard inside the speed choice only.
- Return the options answer directly instead of a one-field wrapper.
* fix(native-chat): review round 2 for Codex service tiers
Keep a tier Codex reports for the thread (it accepts unlisted ones such
as flex); read the legacy Fast tier beside an empty serviceTiers list.
* fix(native-chat): review round 3 for Codex service tiers
A reported tier the old model listed and the new one does not resets to
Standard on a model switch, and the reported tier itself stays pickable.
* fix(native-chat): keep a re-picked reported Codex tier
The thread's reported tier is never reset by the unlisted-tier drop, so a
re-picked Flex survives the next read, a model switch, and the turn.
* refactor(native-chat): one rule for which Codex tier a model offers
Standard, a tier the model lists, or the thread's reported tier that no
model lists. The setter and the unlisted-tier reset share it, replacing
the separate reported-tier and model-switch guards.
* test(native-chat): drop the removed fastModeTierByModel field from main's new catalog test
A dropped or picked file used to land as its raw @path text. The pill
still serializes to that reference, so what the agent reads is unchanged.
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* fix(agents): one host-routed agent-detection entry point
preflight.detectAgents / refreshAgents take an optional { worktreeId } and the
host resolves that workspace's project runtime (WSL included) or SSH target.
Gated by preflight.workspace-scoped.v1; old peers keep the host default.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): route detection by the worktree's own host record
A repo id shared by local and SSH rows made the first row pick the detection
host. Resolve the worktree from the host's list and apply the shared
execution-host routing rule; ambiguous rows refuse. Dashboard falls back to the
host-default list until a workspace's own list loads.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): refuse an ambiguous workspace instead of probing the host
Only selector_not_found keeps the host default; selector_ambiguous now fails
closed. Adds runtime-level coverage of the lookup.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): refuse an ambiguously owned folder workspace
Co-Authored-By: Claude <noreply@anthropic.com>
* test(agents): quick-launch runtime target carries the workspace
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Claude <noreply@anthropic.com>
The open question below a queued card already says the agent is waiting,
so the card's own caption said the same thing twice. A card behind an open
question is now plainly queued (the 'turn' hold): same Steer, Delete and
More actions, same sending rules, no caption. The 'awaiting-answer' hold
and its pending-prompt input fed only that caption, so both go, on desktop
and in the phone app, along with the now-unused locale key.
Co-authored-by: Claude <noreply@anthropic.com>
Extract subprocess execution and process contracts into @orca/process-host with explicit public entry points, independent checks, and one Node 18 compatible CommonJS runtime. Migrate application consumers and integrate package builds, dependency selection, import enforcement, and runtime resource staging.
Preserve daemon startup ownership and profile isolation, and qualify development rebuild recovery and concurrent output publication. Remove unnecessary aliases, test forwarding exports, and a duplicate output scan.
Validation: full typechecks, changed-code quality, package and artifact checks, native Windows builds/types plus 306 runtime tests, and independent native reviews.
Matched full E2E controls on original main and unchanged reviewed head both pass all 17 applicable tests (nine skips). Earlier intermittent E2E failures are documented in the PR; no assertions were weakened. The final combined-tree audit preserves both branches with no import-boundary violations.
* fix(settings): keep MCP repository configs on the repo's own host
Settings read and created MCP configs through the desktop filesystem for
repos owned by a managed host, so it showed the desktop's file at the same
path and could write the starter config onto the desktop. Route inspection,
creation and opening through the existing runtime file client using the
selected repo row's host.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(settings): an unreadable listed MCP config still counts as present
A read failure after the listing found the file marked it absent, which
offered "Create empty config" and could overwrite the real config.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: preserve streamed turn duration after host restart
* test: run restart duration regression in Node
* fix: preserve provider receipt time in journal updates
* test: verify provider receipt in Claude ownership assertion
* fix(native-chat): time interrupted turns from real provider output, not flushes
Shared-timeline checkpoints stamped the coalescer flush or retry time as the
provider's latest proof of life, so a turn whose provider died before a delayed
flush settled with an inflated duration after a host restart. Carry each delta's
receipt time through the coalescer and timeline lane.
* fix(native-chat): derive interrupted-turn duration from saved output
A reply cut off by a server restart could show "Worked for 0s" because recovery
ended the turn at the last heartbeat or the reply's first timestamp. End it at
the latest time this owner's output was saved to chat history instead, derived
in the existing journal fold from the row save time. Drops the per-frame
receipt plumbing through every provider and buffer.
* fix(chat): exclude host recovery revisions from provider activity
Mark journal-open and connection-cleanup revisions with the existing recovery
annotation so an interrupted turn does not include host downtime. Preserve
buffered provider output and advance restart fixtures to the restart clock.
* fix(native-chat): interrupt turns a replaced server left running
When the managed server died mid-reply and a new one started on the same
host, the cut-off turn settled `unverifiable` with no end whenever the old
provider's identity could not be proven gone, and nothing ever revised it:
the chat showed no turn status and the sidebar said "unconfirmed".
The new server opens the chat records holding the host's instance lock, so
every runtime that wrote them before is gone, and every provider it held
lost its pipes with it. Record that at load (the fences those runtimes
granted, the loaded owner's last renewal, how its runtime ended) and let
the stale settle end those runtimes' running or unverifiable turns as
interrupted at the owner's last saved output or renewal, with the existing
Orca-stop row. Lease adjudication and the live / unverifiable / exited
owner verdicts are unchanged.
* fix(native-chat): require the record store for any journal open that settles
Only an acquisition's open may skip it; a reader open without the store would leave a replaced server's turns unverifiable.
* fix(native-chat): say a remote host's Orca restarted, not that it was closed
A reply cut off when a remote host's Orca server stopped read "Orca on <host> was closed while
this response was in progress." Nobody closed anything there: the server stopped and Orca started
it again before the row could show. For a chat on a remote environment, cause quit now reads
"Orca on <host> restarted while this response was in progress." The desktop's own quit keeps
"was closed". Renderer-only; no wire change.
* fix(native-chat): say a remote host's Orca stopped, true for a shared desktop too
* test(native-chat): register Grok without compaction in the recovery-output rig
Main's #26502 made Grok declare compaction; the rest-test rig adapter has no compact, so the
registry refused it before any recovery case ran.
* chore(native-chat): say a replaced runtime also revises an unverifiable turn
* feat(native-chat): edit a queued message in place on the host
A queued card's Edit used to copy its text into the composer and delete the
card, so the message lost its place, an agent-mail card lost its sender, and
while a question or approval replaced the composer the text vanished.
The execution host now edits the card itself:
- agentSession.queuedMessageUpdate replaces only the card's text, as a
compare-and-set on the body fingerprint the client last saw. It keeps the
id, position, sender, kind, send mode and attachments; a command card is not
editable. A resent Save answers from the card as it stands (unchanged or
changed), so a lost answer never overwrites newer text.
- agentSession.queuedMessageEditHold acquires, renews and releases an
in-memory edit lease per caller and edit. While one is live, automatic
delivery stops at the card (earlier cards still send, later ones wait); an
explicit Send still overrides. Leases expire after two minutes on their own,
re-derive validity from the card on every read, and die with the
conversation. Release uses cleanup admission.
- The published card carries an optional editHeld marker, never `paused`.
- Both methods sit behind the new agent-session.queued-message-edit.v1
capability, independent of the dark mid-turn queue capability, and are on
the mobile allowlist for the phone follow-up.
* feat(native-chat): edit a queued card inline on desktop
Edit message now opens an editor inside the queued card instead of moving the
text into the composer. The card keeps its place and sender, and the editor
stays usable while a question or approval holds the composer's slot (it does
not lose focus to the prompt card).
- Enter or Cmd/Ctrl+Enter saves, Shift+Enter is a newline, Escape cancels;
IME composition keys never save or cancel. Save and Cancel replace the
card's own actions while it is edited; one editor per pane.
- The editor holds the host's edit lease, renewing every 30 seconds and taking
it again after a lapse. Lease failures are only logged: they never block
typing, Save or Cancel.
- If the card is sent or removed elsewhere mid-edit, a clean edit just
closes; changed text goes into the chat box after any existing draft, with
one toast. A Save that lands and then sends counts as success.
- Against a host without agent-session.queued-message-edit.v1 the card offers
no Edit (no copy-and-delete fallback); an empty overflow menu is hidden.
* fix(native-chat): name every queued-edit notice in its switch
* fix(native-chat): keep queued-edit typing safe and stop disabling Send elsewhere
- Save with an unreadable answer (dropped for a moved runtime fence, or lost)
now reads the published card: saved text shown -> close; card gone -> the
sent-as-saved / chat-box path; otherwise keep the editor quietly.
- Send and Steer stay enabled on a card edited on another device; the
published editHeld marker is gone (no reader left). Automatic delivery
still stops at an edited card on the host.
- Save answering changed moves the typing to the chat box and reopens the
editor on the newer text. Notices say when the chat box is hidden by a
question or approval.
- Closing the pane or switching chats with unsaved typing appends it to that
chat's box quietly.
- Lease renewal no longer publishes, so an open editor is not idle-sweep
activity.
- The consume compare-and-set also matches the body fingerprint.
- Saving unchanged text keeps the original blocks.
* fix(native-chat): keep Agent in the Japanese queued-edit notices, as the catalog does
* fix(native-chat): close a queued edit its own Save already landed, wake the queue for a pruned lease, keep typing across a reload
A Save whose answer was lost now closes once the card shows the saved text,
and a card that went out with exactly the typed text closes quietly instead
of copying it to the chat box. A renew that prunes another editor's lapsed
lease wakes the queue in place of the timer it cancels. A reload, which
unmounts nothing, hands unsaved typing to the chat box like closing the pane.
* refactor(native-chat): move the queued-edit notices to their own module
* fix(native-chat): unref the edit-lease timer in a way the phone's typecheck accepts
The lease module reaches the mobile test program through journal-store, where
setTimeout answers a number, so `timer.unref?.()` failed mobile's tests
typecheck ratchet.
* test(cross-version-wire): call the queued-edit methods in both skew directions
The manifest must name every agentSession method; the two edit methods
reach their host methods on a new build and are only called by clients
on a host advertising agent-session.queued-message-edit.v1.
* test(rpc): count the two queued-edit methods on the structured surface
* fix(native-chat): lay out the inline queued-message editor as a header, field and Save footer
While a card is edited, its row shows a pencil, "Editing message", the sender and an X that
cancels; the field at full width; and a footer with the key hint and Save. The card's queue icon
and its status line are hidden until editing ends.
* fix(native-chat): show the Enter key on the queued-message editor's Save button
The editor footer's muted key hint is gone. Save now carries the same inline
key badge as the new-workspace composer's Create button, extracted into a
shared ButtonKeyHint so both buttons render one badge.
* feat(native-chat): add a chat-owned command receipt store
Adds the agent_session_command_receipts table and an insert-if-absent
receipt write that runs inside a command's own journal transaction. A
receipt records the command's identity, canonical hash, status and a
pointer to the row holding its result; it dies with its chat record.
Nothing uses it yet: the existing operation ledger stays authoritative.
* fix(native-chat): key command receipts like today's ledger ids
Rows are keyed by caller and operation id; a send looks across callers and
other methods look up only their caller's row, matching the existing ledger.
Bad rows and newer table shapes read as unreadable instead of throwing.
* fix(native-chat): order receipt lookups by insertion and key by operation id
Global lookups now take rows in insertion order, so a read and an insert
agree on which receipt answers an id regardless of the host clock. The
primary key leads with the operation id, so its own index serves both
lookups.
* fix(native-chat): accept sends through their own receipt
Send (direct, queued, steer) and /compact no longer commit a separate
ledger reservation before the message is saved. Their command receipt is
inserted-if-absent in the same transaction as the submission or queued
draft; a repeated id replays from it, a changed request conflicts.
Operation ids are checked for syntax only, so age, clock skew, pruning
and the reservation's own storage can no longer refuse a send.
The ledger success row they already co-committed stays as a temporary
insert-if-absent write so families not yet switched keep seeing these
ids; it is never read on this path.
* fix(native-chat): answer a send's receipt one way, share /compact's id space with Send, wake delivery once
- After its commit, a send whose publication fails answers through the same receipt replay a retry takes, so one id gets one answer; the in-memory copy and journal reload are gone.
- /compact ids are global like Send's: a retry under a new connection replays instead of needing a second acknowledgment write.
- The receipt route calls its runner directly; the runner wakes delivery when a new message row commits.
- The compatibility ledger row expires from host time; each temporary site is labelled.
- Receipt read errors and post-commit failures are logged.
* test(native-chat): expect receipt answers where tests assumed the send ledger
Restart-continuation tests now model the case Send cannot vouch for (saved but
not loaded into memory) and keep it unconfirmed; a later throw after the message
is in the chat answers continued, as a resend would. Drop /compact's unreachable
legacy replay branch and fix stale comments.
* test: run the queued tests that open the journal database in the Node runtime project
* perf(usage): keep per-source usage caches off the main thread
The usage stores kept every provider's per-source scan cache
(processedFiles / processedDatabases) inside the one JSON file main
loads at startup. On a large Claude history that file is 56 MB, 43 MB
of it per-source records only a scan reads, so main paid a sync
read+parse at launch, a structured clone of the whole cache to and
from the scan worker on every scan, and a pretty-printed rewrite
after every scan.
The usage scan worker now owns those records in a sidecar
(`<cache>-sources.json`): it reads it before a scan, writes it after
(compact, durable rename), and returns only sessions and daily
aggregates. Main keeps and writes only that report, compact. A cache
still carrying inline records is split on the worker the first time
it is loaded (above 8 MB); smaller ones parse on main and rescan cold.
Sync IPC getters and automation lookups wait for the load.
Synthetic 56 MB cache, same machine, interleaved runs:
- first launch: 108 ms sync parse -> 18 ms main busy, 4 ms longest block
- later launches: ~69 ms -> ~7 ms
- forced scan, longest main-thread block: 89 ms -> 11 ms
(real built app, headless: 84-94 ms -> 11-13 ms)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(usage): preserve cache attribution and legacy warm scans
* fix(usage): reclaim cache temps after worker retirement
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Neil <neil@stably.ai>
* perf(daemon): send PTY output to main as raw bytes, not NDJSON
The stream socket's hello can now negotiate binary-v1 framing:
length-prefixed frames carrying PTY data as raw UTF-8 next to a small
JSON header, so neither the daemon nor main escapes or parses the
payload. Older daemons ignore the hello field and stay on NDJSON; older
mains never ask. The hello reader now hands the stream reader the exact
bytes that followed its line, which an event sharing the hello's read
used to lose. ORCA_DAEMON_BINARY_STREAM=0 keeps NDJSON.
Fixes#27003
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(daemon): preserve negotiated output and encode ordinary frames once
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Neil <neil@stably.ai>
Neil
OrcaWinandm4air
Jinwoo Hong
Brennan Benson
Kelvin AmoabaandBrennan Benson
