m4air run 3: same tab, same leaf, new PTY, and state 1 after, but the relaunch was a new conversation
(no --resume; new session id). Orca Cloud tabs are host-surface tabs: the desktop reconnect only
attaches, and the host woke the slept leaf with its original launch. After the reversible stop, the
desktop now asks the host to ensure the agent on the pane's own provider session, placed in the same
host tab and leaf, then reconnects. A pane with no session keeps the host's fresh launch ('Starts a
new conversation'). A host that does not stop or resume shows the failure with the reason.
Strip (design-squad): 'Restarting Claude…' is the spinner and words only, with no button and no ×.
The failure says it once: the body names the reason when known ('The workspace didn't respond.')
and is otherwise empty; Try again and × stay.
On click the strip stays as 'Restarting Claude…' (spinner, button disabled, no ×). It settles on the
relaunched agent's first status, after which it follows the account (state 1 again if the sign-in is
still bad). No relaunch within 10 s, no startup to launch, or a startup that throws shows
'Couldn't restart Claude · Try again.' with Try again and Dismiss. A relaunch that stays quiet past
10 s counts as restarted. The forced past-the-mid-turn mark now clears on launch, failure or timeout,
so a stale queued restart never jumps the account-switch wait rule.
The pane runner is extracted (runReadyPaneAccountRestarts) and covered end to end through the real
store: a 'blocked' Claude relaunches in place with its resume startup, an account-switch restart still
waits, and each failure path reports.
- When the Orca account goes from active/expiring to expired/revoked, every running Orca Cloud
Claude/Codex pane shows the strip (same component, place, height as #315): 'Your Claude sign-in
expired' / 'Renew to keep working. Your conversation is kept.' / Renew (compact: 'Claude sign-in
expired' + Renew). The process keeps running; nothing is parsed from terminal output.
- One Renew clears state 1 everywhere; the panes that showed it move to state 2: 'Claude sign-in
renewed' / 'Restart Claude to pick up where you left off.' (or 'Starts a new conversation.') /
Restart Claude / Dismiss. Restart reuses the account-restart path (queuePaneAccountRestarts), which
resumes the pane's own session. Never automatic; a turn that ends cleanly after the renewal clears it.
- Kill switch / never offered: nothing new on a running pane. A held launch keeps #315's strip.
- Account reads while a running cloud agent pane is mounted: on window focus and at most once a
minute (one timer per window).
- #315 P2: the strip is a pane-top banner (useReservePaneTopSpace), so the terminal refits below it
and no row is covered; a spacer keeps it under a chromeless pane's title-row buttons.
- Spec: terminal starts below the strip and its last row stays visible (held and running); state 2's
Dismiss sits a full title row below the pane's ×. Removes the debug screenshot left in #315's spec
and polls the resize assertion (it raced the layout).
From the m4air real-app shots:
- The width class was frozen at mount, so a pane narrowed after mount collapsed the text to 'Y.'/'S.'.
The strip now lays itself out from its own width (ResizeObserver): wide / narrow / tiny, plus a
compact class below 360 px with one line ('Claude sign-in expired') and Renew; the detail stays the
region's aria-describedby and tooltip. Height stays 56 px.
- The strip sat under the pane's split and close buttons. CloudStripLayer (shared by the pane and the
fixture) starts it below the pane title row (--orca-pane-title-height), and the renew strip drops
its own × (Renew is the action; Escape still cancels).
Specs: resize after mount keeps the title readable at 520 and 320 px; the pane's split and close
buttons are hit-testable above the strip in three states.
AI provider accounts becomes Agent accounts: a page whose first part is This computer (or the
selected host), holding the existing provider accounts, switching and usage. renderAccountsSettingsSection
takes additionalSections so other parts can be added below it with AgentAccountsSubsection. The
section id stays 'accounts', so every deep link keeps working.
The Settings nav, its group labels and the matching section titles move to sentence case
(Orca account, Computer use, SSH hosts, ...). In-app, CLI and docs references to
'AI Provider Accounts' now say 'Agent accounts'.
Root cause: an Orca Cloud workspace is a paired web host, so launchAgentInNewTab publishes the
agent through the host (launchAgentInWebHostTab -> terminal.create) and the desktop only attaches.
startFreshSpawn never runs, so the #295 pre-gate (and #40228's gate) never saw these launches.
- launchAgentInWebHostTabWithCloudHold wraps the host-published launch: on Orca Cloud with an
expired/revoked Orca-account sign-in and no key, the host opens a plain shell tab, its first pane
shows the account-recovery strip, and the agent starts (placeholder closed) once Renew fixes it.
Cancel leaves the shell. One-line hook in launch-agent-in-new-tab.ts.
- A stale accounts read (>30 s) no longer decides at once: it re-reads within the 3 s budget, so a
revoke since the last read holds the next launch.
- Electron e2e (headless paired host as Orca Cloud, expired status from main): the real New tab ->
Claude path shows the strip and never opens a Claude tab. Fails without the fix.
* feat(cloud): DS-40 Fix with agent for failed Orca Cloud environment builds
A failed environment build (Settings > Orca Cloud > Cloud environments) now offers, to admins on the
latest build, Try again next to Show error, plus Fix with agent when the install script is what failed.
Fix with agent opens the composer on Orca Cloud with the prompt prefilled ('The environment build
failed at {{step}}. Fix the install script so the build succeeds.'), the current install script and the
log lines already visible in the viewer (redacted, 60 lines / 6 KB, fences neutralized). The new cloud
workspace boots from the environment's last good build, or a blank sandbox if none succeeded, as every
new cloud workspace does. orca cloud env only works on the desktop, so the agent hands back the full
fixed script for an admin to save and rebuild.
Install scripts only run in environment builds (never during a workspace create), so this lives on
the environment panel's failure summary rather than the create sheet.
* fix(cloud): DS-40 design follow-ups: two actions, and clone failures
(a) The failed-build summary drops Show error: the failed step already opens on its error, and the
summary title now jumps back to it (log scrolled, collapsed or virtualized). Actions are Try again
(outline) and Fix with agent (ghost). The unused cloudEnvironment.log.showError key is pruned.
(b) Clone failures: from the visible log, repo-content failures (submodules, LFS, paths that can't be
checked out) offer Fix with agent with 'The environment build failed while cloning {{repo}}. Fix
the repository setup so the clone succeeds.' (no install script attached; the agent fixes the repo
on a branch and opens a PR). Access and auth failures offer Give access (GitHub install for that
repo), never an agent. Anything unrecognized, or a clone log that isn't loaded, offers neither.
New fixtures panelCloneFailedContent / panelCloneFailedAccess; classifier and helper unit tests;
fixture spec 3/3.
* fix(cloud): DS-22 composer a11y: shared focus ring, no open on Tab focus, no buttons inside Run on options
- Project, parent, Run on, name, advanced fields and the create-multiple switch draw focus with the
shared --focus-ring token (input.tsx / button.tsx patterns) instead of ring-ring/50.
- Project and Run on comboboxes no longer open on focus; they open on typing, ArrowDown,
Alt+ArrowDown or click. Fixtures and unit tests open them by click.
- Run on needs-setup rows: Connect and Set project location are button-styled spans (pointer only,
as before), so no option nests an interactive control (axe nested-interactive). The unused
setLocationOnHost key is pruned from the catalogs.
- tests/component-fixtures/new-workspace-composer-a11y.spec.ts: tab-walk, focus-ring token,
open keys and a nested-interactive check over the open lists, light and dark (repo has no axe).
* fix(cloud): DS-22: the parent worktree trigger is a combobox field shell, not a restyled <Button>
Private layer only; no #40228 file changes (its exports are read, not edited).
- cloud-agent-launch-hold: a cloud Claude/Codex launch decides from the Orca account (cached read,
never the sandbox). Ready or covered by a key: no hold, no delay. Expired or revoked with no key:
held on the strip until Renew in S0 fixes it; every held pane starts together.
- cloud-agent-credential-spawn-gate: installed outside #40228's spawn gate from
deferred-cold-restore-and-snapshot.ts (one line).
- CloudAgentSignInStrip: the 56 px strip (redesign §6) overlaying the pane top while the agent hasn't
started (no terminal layout change): needExpired with Renew (card 13), and #40228's per-workspace
sign-in steps on cloud with the kill-switch / never-offered copy. Fixed slots; width class decided
at mount; region, not a dialog; one polite sentence per state.
- AgentPanePortals: cloud panes with a gate get the strip; SSH, WSL and paired hosts keep #40228's card.
Playwright AC-1: every strip state keeps identical boxes (wide and narrow sets).
The NP-3 Agents row reads a never-offered provider as its sign-in-here state (reason notOffered:
'Signs in for each cloud workspace for now', never 'paused', never Set up). Settings collapses the
Orca Cloud section to 'Claude and Codex sign in for each cloud workspace for now.' when neither
provider is offered (design-squad).
- One row from the Orca account, never the sandbox: 32 px ready line when every agent is ready at
mount, otherwise 48 px; every later state renders inside that height (Playwright: measured layout
shift 0, logs toggle never moves).
- R2 Set up runs S0's setup inline for each agent in turn; device code, browser, paste, failed,
expired, kill switch (per-workspace sign-in, queued until the sandbox answers), A6 desktop key.
- ⋯ menu: Source per agent in this workspace (new per-workspace setWorkspaceSource / workspaceSources
IPC; main resolves the sandbox id from its own runtime records), Manage agent accounts.
- Removes the v3 'Add an agent' build step and the per-sandbox Cloud sign-in row from the sheet.
- Refuse a restore that would write or delete inside a nested repository, and
verify every on-disk path it touches is in the undo tree first (git add can
skip a path without failing).
- A turn counts as busy from its snapshot until the hand-off; terminal agents
working in the workspace make restores refuse; the preview reports busy and
the dialog disables the files choice.
- W10 copy: statement description, i18n plurals, state-dependent detail line,
option directly under the description, 'The chat was rewound, but…' errors.
- Index restore keeps skip-worktree bits; large-file scan honours the deadline.
- Component fixture for the rewind prompt states.
* Simplify Settings chrome and organize General into focused views
* Preserve search and skill actions across Settings views
* Correct Settings validation leftovers
* Keep skill conflict details visible in compact Settings rows
* Refresh Settings search and protected copy catalogs
* Use Settings design tokens and button variants
* Keep Settings test setup and translation catalogs current
* Keep Settings search metadata independent of display labels
* Build repository search groups only for the selected pane
* Keep pending skill installs and server menu labels accurate
* Use the supported role locator in the skill regression
* Keep absent skill installation actions on their supported path
* Restore the Settings sidebar to its existing appearance
* Restore shared navigation title keys in pane headings
* Preserve the Settings shell entry animation
* Drop unused Voice labels after the main sync
* Preserve main Voice translations and the moved skill module import
* feat(agent-session): keep the permission mode a Claude session reports
Claude names its live permission mode on prompt, tool and Stop hooks. Keep the
root agent's latest value on the provider session, next to effort, so a resume
without a recorded launch can tell whether the session ran in bypass.
Ports the capture from #36359 by Nelef.
* fix(agent-launch): resume an unrecorded launch bare unless it reported bypass
Without a recorded launch, every restart path now resumes with no settings
Arguments, env or permission default; the configured Command still runs. A
session whose root agent last reported bypassPermissions keeps its bypass flag,
so a hand-typed claude --dangerously-skip-permissions keeps it while a bare
hand-typed claude never gains one (#29898).
Account-switch restart used the shared rule only for Claude; it now uses it
for every agent. Thanks to JustinCMR (#37304) for finding the account-switch
and cold-restore gaps.
* fix(terminal): keep the launch recipe of a window-started agent in main
A window spawn hands main its recipe, but main kept only the token and agent,
so restarts that main runs (workspace sleep capture, closed-worker reopen)
found no recipe and resumed bare. Keep it with the launch authority, the same
gate that admits the token.
* fix(orchestration): reopen a closed worker with the recipe it launched with
A closed worker's pane record goes away with its tab, so orchestration send
reopened it bare (#37693). The worker row now keeps the recipe Orca launched
the agent with, keeps it when a later capture of the same launch arrives
without one (main loses it on a daemon reattach), and a reopen prefers it over
a pane record that may hold another launch of the conversation.
Adapted from #37757 by Pr1p, without a new column.
* fix(terminal): keep a slept pane's earlier recipe only for the same launch
A host sleep capture without a recipe reused the pane's earlier record for the
same conversation. That is right after a daemon reattach, when Orca's launch
still runs but main lost its recipe, and wrong for an agent typed into the
shell that resumed the conversation: it never ran that launch.
* fix(agent-session): restore a paired pane with the recipe its host recorded
A client restoring a pane on a paired host sends only its recorded Arguments,
and the host filled the rest from its current settings. A saved restore now
replays the host's own record for that pane, or, with none at all, resumes
bare and keeps a bypass only when this host's hooks saw it reported. History
and other user-chosen resumes keep current settings.
* fix(terminal): replay a saved note only for the launch main still holds
A note belongs to the agent in a pane only while main holds that launch's
token: main admits it at spawn and retires it when the launch command
finishes, and a daemon reattach restores neither. Worker, host sleep and
hook/quit captures now take a note only from that attested launch, and no
longer copy an earlier record's note by agent or conversation match, which a
typed resume in the same shell also satisfies. With no attested launch the
unrecorded rule applies.
Replaces the inferred orcaLaunched / recipeLostPaneKeys flags and drops the
mock-only reopen and fixture-echo worker tests.
* fix(agent-status): take a pane's note from the launch main attests
The window carried a pane's saved note into each new record by agent and
conversation match, so an agent typed into the shell that resumed the same
conversation inherited an earlier launch's bypass. Main now sends the note of
the launch it still holds with each status, and the window records only that,
its own launch registration, or, for a restored replay of the very status a
record was written from, that record's note. /clear and compact keep the note
because main still holds the same launch.
* fix(orchestration): reopen a worker with its own recipe or none
A worker without its own note took the note of whichever pane record held the
same conversation. Its reopen now always passes a complete recipe: its own
note, or the unrecorded rule. The unrecorded bypass is also scoped to Claude,
whose hooks are the ones that report a root agent's permission mode.
* fix(agent-session): restore a paired pane from its source pane, never current settings
A saved restore on a paired host looked up the destination pane, which a Wake
opens as a new tab, and fell back to the host's current settings whenever the
client sent its partial Arguments. The client now names the source pane (to
hosts advertising agent-session.restore-source-pane.v1), and the host replays
its note for that pane or, with none, resumes bare keeping only a bypass its
own hooks saw there. Older hosts keep today's behavior.
* fix(terminal): re-arm a launch across a main restart while its agent still runs
The daemon outlives main, so it now keeps main's admitted launch (token and
note) and drops it when that launch's command finishes. On reattach main
re-arms the launch only when the same agent still runs in the foreground:
nothing can be typed into a daemon PTY while main is down, so a running agent
there is the one the unretired note launched. A shell foreground clears the
daemon's note; an unknown read, including every Windows read, declines.
Older daemons keep no note, so restore declines there as before.
* fix(terminal): the daemon retires a launch note when its command finishes
A launch can finish while main is down, so main's own retirement never sees it and a
hand-typed agent in that pane would later pass the reattach foreground check.
* fix(agent-status): a fresh Claude start never inherits the last process's permission mode
A hand-typed resume of the same conversation may run without the bypass the previous
process had, so only /clear and compact carry the mode forward.
* fix(agent-session): name a restore's source pane in the host's own keys
A mirrored pane's key carries the desktop tab prefix, so the host's exact lookup missed
its saved note.
* fix(terminal): retire a daemon launch note by its token from the one retirement owner
A delayed reattach result or a late retire could clear a newer launch's note. Retires now
name the token they retire, the reattach checks its PTY before clearing, and re-arming the
same launch keeps the daemon's completion scanner.
* fix(agent-status): only the launch owner's statement changes a pane's note
Main now states the attested note, or null for none, on every hook status. An OSC or
display update makes no statement, so after a completed turn it no longer erases an Orca
launch's note; a typed resume still drops it through main's null.
* fix(terminal): an attach leaves alone a launch main already holds
The renderer attaches a pane the CLI just launched before its agent starts, so the
attach saw the shell and retired the new launch's daemon note.
* fix(agent-status): a paired client keeps a pane's note only on its host owner's word
The host's session-tabs frame now says whether the Orca launch it admitted still runs on
the published incarnation, and the client applies that fact whichever writer wins the
status. With an owner's word the conversation no longer decides; an older host that says
nothing keeps the same-conversation rule.
* refactor(agent-status): one decision picks a pane's note for every reader
The live entry, quit capture, provider-session updates, account restart and cold
restore now ask the same owner-aware decision. An owner's none is final and, when it
turns, ends the pane's registry entry and saved note, locally and from a paired host's
frame. Cold restore and account restart take that answer for a live invocation and read
the saved record only when none is live. Inlines single-use wrappers.
* refactor(agent-status): a paired retirement test reaches the cold-restore command; trim comments
Replaces the projection and continuity tests with one transition: host frame retires the
launch, the next OSC keeps no note, and the cold-restore command has no old bypass.
* fix(agent-status): an owner's none retires the pane's matched launch registry entry
* chore: satisfy changed-code gates (type guards, SAFETY notes, fixed test clock)
* fix(agent-launch): a teams launch keeps its note; a legacy leaf id restores without throwing
* refactor(daemon): keep the session launch note on the process base so session.ts stays in budget
* fix(agent-launch): a restarted terminal main can't vouch for keeps main's earlier launch rule
* fix(agent-launch): read the pane's current terminal; a finished launch settles an undecided pane
* fix(agent-launch): undecided and held launches end with their process
A finished command, a fresh launch or a replacement process settles an undecided pane;
a newer attach or finish supersedes a foreground read still in flight; a legacy relay
reattach without an incarnation stays undecided; a held launch applies only to the
process it was recorded for.
* refactor(terminal): watch and arm a created terminal's launch in one call
Keeps terminal-create.ts within the 300-line budget after main's growth.
* refactor(terminal): keep main's launch evidence in one immutable record
Replace the undecided flag, the reattach check map and the re-arm's writes
to main's orchestration launch fields with one launchEvidence object
(unknown, gone for an incarnation, or held with its recipe), owned by
launch-evidence.ts.
- A fresh admitted launch is held; any other fresh process is gone.
- A finished command or confirmed exit is gone, sticky for its process:
no reattach, legacy or noted, can revive it.
- A replacement retires its predecessor's evidence without deciding the
newcomer, which may still prove its own launch through a reattach.
- A reattach note is held only after a foreground read sees its agent;
the evidence object fences that read.
- A gone launch clears its recipe and blocks both refill sites; a
deliberate sleep snapshot keeps its recipe past the launch it captured.
- launchToken, launchIncarnationId and launchAgent writes match main.
* fix(terminal): keep launch evidence through a first incarnation and sleep snapshots
- Learning a process's first incarnation binds its held or gone evidence
to it, so a later attach can neither revive a finished launch nor drop
a running one; a known X->Y replacement is fenced as before and now also
clears the predecessor's recipe.
- A status from no Orca launch leaves a sleep snapshot of its session for
the wake and never takes that snapshot's recipe into a live or quit
record.
* fix(terminal): record a runtime split's fresh shell as running no launch
* chore: rerun CI on main with the typecheck fix
* fix(automations): reopen a reused automation chat tab in the background
An automation that reuses its last chat queued the prompt into that
session even after the user closed its tab, but never brought the tab
back. After a reused send is accepted (including a lost or refused reply
recovered from the run receipt), reveal the session and publish its tab
with activate:false so it reappears without taking focus. A publish
failure is logged and never undoes the accepted send.
Extract the reveal + background publish pair into
publishChatTabInBackground and share it with reopenWorkerChat.
Fixes#40260
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
* test(automations): use the string workspace id in the chat-reuse harness
---------
Co-authored-by: Neil <neil@stably.ai>
* fix(vm-recipes): hide an in-progress VM checkout in every window, the phone and the jump palette
A VM create's checkout was hidden only in the sidebar of the window that
started the create. Windows now publish their pending VM checkouts to the
main process, which shares every window's set with all windows and
filters the paired phone's host workspace list and workspace context.
The jump palette and the sidebar read the shared set, and a grouped VM
project no longer draws an empty-project placeholder while its create
is pending. A window's set is dropped when it closes, crashes or reloads.
* test(project-groups): reset leaked runtime environment revisions between files
A recipe VM create registers the VM's project before its environment
checks run, so the VM's primary checkout showed as a normal workspace
next to the pending row while the checks ran or were paused on a
failure. Hide that checkout in both sidebar list models until the
create adopts it (or makes its worktree). A cancelled or failed create
keeps it hidden while its VM is cleaned up; a VM that could not be
cleaned up is shown again so it can be removed.
Upstream landed EnvironmentProviderDriver (#40315, #40332). Kept upstream's interface (EnvironmentReady.result)
and added the hosted-only extensions as optional members (renewLease, rollover, leaseExpiresAt, egressInjection,
entitlement_denied, the entitlement/renew/rollover phases); ported the hosted driver, registry and recipe adapter
to result. #40313 moved agent-catalog: fixed the #40228/#40303 imports.
* refactor: group agent launch, status, and messaging owners
* refactor: consolidate direct owner imports
* refactor: import pane ownership directly in status listeners
* test(e2e): give the provisioned-root VM a reachable git remote
VM creates now run the environment checks before creating the workspace
(#40152). The fixture VM's origin pointed at a GitHub URL it cannot push
to, so the git push check failed and the create paused on the build
sheet; the spec then read the VM's primary checkout before it was
adopted. Point the VM checkout at a local bare repo so the checks pass.
* test(e2e): wait for the provisioned root's adoption, not its listing
The VM's primary checkout appears under its branch name once its project
is set up, before the environment checks finish and adoption writes
ephemeralVmCheckoutMode. Poll for the adopted row instead.
* test(vm): pin file saves in a recipe-created Orca server workspace (#11762)
* test(vm): wait for the save round trip, let the app reconnect itself, edit a plain-text file
* test(vm): say why the recipe save spec needs a longer timeout
* refactor: group renderer workspace ownership and navigation
* refactor: use the defining WSL rewrite store identifier
* refactor: route new upstream consumers to workspace owners
* refactor: consolidate connection owner test imports
* refactor: preserve upstream review-owner test retirement
Sign out of Claude/Codex on a host now runs that agent's logout against the
login launches there use, after a confirm dialog, instead of deleting the
host's saved Orca account. The host check asks the CLI in that same login.
Starting Claude or Codex on a runtime host where it isn't signed in holds the
launch behind an inline card. Sign in with browser runs the unmodified CLI login
on the host; this computer forwards the browser's localhost callback to it over
a narrowly scoped tunnel, so the token never leaves the host. Adds a verdict-only
host check, agent sign-out in the host menu, and paste/device-code fallbacks.
* refactor: move atomic publication to its filesystem owner
* refactor: group shared browser definitions by feature
* refactor: bind proxy process and session contracts to defining owners
* refactor: consolidate direct session contract type imports
* refactor: retain atomic publication test timing under moved owner
* fix(benchmark): resolve historical tunnel framing source before loading
* feat(setup): slim the setup-script prompt and make long imported scripts collapsible
* fix(setup): require the full imported script on screen before saving
* style(setup): use the ghost button colour for the script toggle
* style(setup): keep the source path readable in the narrow prompt card
* feat(setup): title imports, restore the package-manager card, keep the review dialog inside the viewport
* fix(setup): count every script line, keep the e2e import spec in step with the new copy
The active terminal refits a frame after the browser splits mount and can
refocus xterm after the spec focused the Reload button, so Ctrl+C reached
the shell instead of arming grab. Refocus until the toolbar keeps focus.
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* refactor: use concrete browser and input owners
* refactor: bind remote runtime callers to concrete transport owners
* Use checked subscription mock argument types
* Type browser lease mock with its subscription contract
* refactor: bind sleeping VM status probe test to socket owner
* fix(sidebar): let the divider resize instead of scrolling the workspace list
The 4px scrollbar strip past the seam covered the visible divider pixel, so
grabbing the divider over a scrolling list dragged the scrollbar. Drop the
strip and start the resize handle on the divider; the native scrollbar inside
the sidebar is unchanged.
* fix(sidebar): trim the resize handle's outer reach by 1px
Neil
Neil
Brennan Benson
Jinwoo Hong
OrcaWinandOrcaWin
