* feat: add windows ssh relay base support
* feat: support windows ssh relay runtime services
* fix: default windows ssh pty cwd to user profile
* fix: support windows hosts over system ssh
* fix: preserve degraded windows relay native deps
* fix: gate windows shell args by relay platform
* fix: preserve windows relay fallback pipes
* test: align windows native deps relay fixture
* fix: build valid windows install lock command
* fix: address windows SSH relay review findings
Resolve correctness, efficiency, and reuse issues found reviewing the
Windows SSH native-host support:
- GC liveness on Windows now probes the actual named pipe (via node
net.connect against markers + deterministic candidates) instead of
substring-matching Win32_Process command lines, which could remove a
live relay dir. Reports ALIVE conservatively only when there is no
liveness signal at all (no markers and no seed pipes).
- Resolve the remote node path once per deploy and thread it through
install/repair/launch instead of re-resolving 3-7x.
- Replace the 200ms node -e poll loop with a single long-lived remote
wait process during Windows relay startup.
- Skip the no-op executable command on Windows in uploadRelay.
- Make the Windows fallback pipe name deterministic and recoverable
(drop the global counter), with an extra reconnect attempt.
- Normalize the prepended node bin dir to backslashes on Windows PATH.
- Batch the system-SSH Windows directory upload into a single streamed
JSON package instead of one ssh process per file.
- Extract relay endpoint/marker helpers into ssh-relay-endpoints.ts and
consolidate the PowerShell EncodedCommand encoding into the shared
powershell-command-encoding module.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Support cancellation and timeouts in Windows port scanning
- Propagate the request AbortSignal and a 5-second timeout to both
PowerShell and netstat child processes during Windows port scanning.
- Avoid spawning the netstat fallback process if the port scan has
already been aborted.
- Wrap the .NET OSArchitecture check in a try/catch block during SSH
Windows platform detection to robustly fall back to environment
variables if needed.
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
* fix(ssh): sync ~/.ssh/config on import and Manage open
importFromSshConfig only inserted unknown hosts and never updated an
existing target, so a rotated port (or any changed config field) was
silently ignored on re-import. Make it an upsert: config-sourced targets
are refreshed in place, genuinely new hosts are inserted, and the SSH
Manage pane auto-syncs when it opens so changes appear without a manual
Import click.
A new optional SshTarget.source ('ssh-config' | 'manual') protects
user-created and user-edited targets from being overwritten by sync —
editing a target in the UI detaches it from config-sync. Unchanged
targets are skipped so a repeat sync performs no disk write. Editing a
target now also carries cleared optional fields (identity file, proxy
command, jump host) so removing a config-derived value actually deletes
it instead of silently keeping the stale value through the partial merge.
Resolves item #1 of #4684 (item #2 was fixed in #4860).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ssh): preserve legacy manual targets during config sync
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
* WIP: Changes before auto-review fixes
* Customize Source Control AI action recipes
- Add per-action CLI arguments for generation and launch flows so saved
recipes can select model flags without putting prompts in argv.
- Share the text-generation dialog between commit messages and hosted-review
details, with first-run defaults and repo/global recipe support.
- Launch fix-check agents directly from saved recipes and harden prompt/template
handling for invalid args, blank prompts, and inherited variables.
* Allow custom commands for source control action recipes
- Let text action recipes save and resolve the custom-command sentinel
- Add settings UI for custom command recipes and preserve per-action defaults
- Split large source-control dialogs and direct launch helpers into focused modules
- Keep launch actions from treating custom text agents as runnable TUI agents
* Add per-repo Source Control AI enablement, custom command, and save-targ
- Repo overrides now support `enabled` and `customAgentCommand`, letting
repositories opt in/out of Source Control AI independently and supply a
repo-scoped custom command that takes precedence over the global one.
- Recipe-save dialogs gained a save-target selector ("Don't save / Save for
this repo / Save as global default") replacing the old boolean checkbox,
routing saves through the new `saveSourceControlActionRecipe` helper in
`source-control-ai-recipe-save.ts`.
- `normalizeRepoSourceControlAiOverrides` now returns `undefined` for empty
objects and passes the `null` sentinel through the IPC/RPC layer so the
persistence layer can clear repo overrides cleanly.
- `resolveSourceControlLaunchPlatform` resolves the correct shell platform
for SSH and WSL worktrees so agent launch commands are built correctly.
- Settings UI gained `RepositorySourceControlAiEnablement` and
`RepositorySourceControlAiCustomCommand` rows; draft/label logic was
extracted into focused modules to stay within lint line limits.
* Extract action recipe defaults into own component and use id-prefixed wo
- Move action recipe draft state and UI out of CommitMessageAiPane into SourceControlAiActionRecipeDefaults and source-control-ai-action-recipe-draft.ts to respect the max-lines lint rule
- Use toRuntimeWorktreeSelector() across all runtime git RPC calls so the runtime can resolve worktrees by ID rather than path
- Fix SSH launch platform resolution to use the repo's connection when the newly created worktree isn't hydrated yet
- Add edit and delete handlers for PR conversation comments with confirmation dialog
- Use text-status-success design token instead of hardcoded text-emerald-500
* add more search keyword
* Rename "Enable Source Control AI defaults" to "Show Source Control AI ac
* fix test
* Remove unused imports and variable assignment in launch-work-item-direct
* Fix test mocks to use `mocks.store` instead of `storeState.value` for di
* Extract Source Control AI logic into focused modules with fix-checks dia
---------
Co-authored-by: Orca <help@stably.ai>
* feat: non-blocking worktree creation with in-tab progress
The Create Worktree modal stayed open with a spinning button for the full
create IPC (base-ref git fetch + `git worktree add`, ~10-15s on heavy
repos) and only dismissed once it resolved, so the user stared at a frozen
modal with no way to work elsewhere.
Run creation in the background instead. On submit the modal closes
immediately and an in-tab "Creating worktree…" panel shows live setup
status, wiring the previously-unused `createWorktree:progress` main->renderer
event via a per-creation correlation id. A sidebar row tracks each
in-flight create, the user can navigate to other worktrees or cancel while
it runs, and on success it swaps to the real worktree + terminal in one
frame. Failure shows the error in the panel with retry; remote/runtime
targets (no progress events) show an indeterminate spinner.
Pending creations live in a separate store map rather than a faked Worktree
row, so git-status, the tab model, persistence, and PTY spawning are
untouched. Only the composer quick-create path changes; other createWorktree
callers keep their synchronous behavior.
* refactor: present in-flight worktree creates as inline tabs and rows
Rework the two surfaces that show an in-flight create so each reads like
the real thing it stands in for.
The in-tab panel is now a faux tab: a tab strip carrying the new
worktree's name (the title) over a quiet top-left status line, instead of
a centered card with a step checklist. An in-flight create reads as a real
workspace tab whose content is loading, the title and status never
duplicate each other, and the handoff to the terminal stays a same-frame
swap. Failure shows the error inline with retry.
In the sidebar, a pending create now renders as an inline row under its
target repo group — where the worktree will land — replacing the separate
strip that pinned every in-flight create to the top of the list.
* fix: keep pending worktree rows visible without repo metadata
---------
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* Suggest enabling local-main freshness when a new workspace finds it stale
Adds a "Keep Local Main Up to Date" suggestion path: when the setting is
off and a new workspace's local base branch is behind its remote, Orca
surfaces a one-time, dismissible toast nudging the user to enable it. The
toast is sticky (no auto-expire) so it can't be missed, with explicit
Turn On / Dismiss actions; dismissing (button, close X, or swipe) persists
localBaseRefSuggestionDismissed so the nudge — and its backend probe —
never runs again.
Also refactors the refresh logic so the advisory and mutating paths share
one fast-forward-safety evaluator, adds an SSH relay RPC for the ref
mutation, and fixes remote-tracking base parsing for fully-qualified refs.
Co-authored-by: Orca <help@stably.ai>
* fix: restore update-ref fast-forward for un-checked-out local base ref
The refactor that split refresh into evaluate + mutate dropped the
non-owner case: a local base branch checked out in no worktree was left
stale (return undefined) instead of fast-forwarded. Restore it across all
three layers — local evaluator/mutator, SSH evaluator, and relay handler
(which also removes the dead duplicated throw) — using the expected-old-OID
compare-and-swap form of update-ref so a concurrent ref move is a no-op.
The suggestion toast now also fires for this case.
Co-authored-by: Orca <help@stably.ai>
* refactor: restore resultBase spread in local-base-ref mutators
The evaluate/mutate split spelled out { baseRef, localBranch, status }
literally in the mutating paths; main used a resultBase spread. Restore
that pattern in both the local and SSH mutators — behavior-preserving,
collapses two identical skipped_error returns.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
- Remove `experimentalUnifiedNewTabLauncher` flag and gate; the unified
launcher is now always enabled
- Drop the settings toggle from ExperimentalPane and search index
- Update placeholder/aria text to "Open any file, URL, agent, ..."
- Restyle the input: borderless, flush with dropdown edge, no search icon
- Update test fixtures to include agent-detection state fields now
unconditionally read by TabBarCreateEntry
* Add browser import hint button to the browser toolbar
- Adds a dismissible "Import" button in the browser address bar that opens a popover with browser detection and one-click cookie import
- Persists the hint's dismissed state via `browserImportHintHidden` in `PersistedUIState` so the hint stays hidden after the user clicks "Hide Hint"
- Extracts platform-aware import source labels into `browser-cookie-import-sources.ts` and hint visibility logic into `browser-import-hint-visibility.ts` for isolated testing
* fix the onblur for the import popover
Creating a worktree from a cross-repository (fork) PR previously named the
local branch with the maintainer's branch prefix (e.g. `me/866`) and pushed to
origin instead of the contributor's fork, so maintainer edits never reached the
PR. Fork PRs now adopt the contributor's branch name (matching same-repo PRs)
and resolve a fork push target, with a non-blocking warning when the PR
disables maintainer edits and an indicator showing where a push will land.
- pr-start-point: return branchNameOverride/headSha/maintainerCanModify for
cross-repo PRs (previously only same-repo PRs received these)
- github client: surface maintainer_can_modify alongside the fork push target
- composer: warn (but still allow) when "Allow edits from maintainers" is off
- source control: show the fork push target (owner:branch) before pushing
- extract fork-remote cleanup and setup into dedicated, unit-tested modules
Adds unit suites for the cleanup multi-fork matrix, fork-remote setup,
push-target resolution, the warning decision, and the push-target label.
Note: pre-commit react-doctor hook bypassed — its warnings in useComposerState
are pre-existing (identical count on base) and not enforced by CI.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(windows): stop synchronous powershell ACL spawns blocking the main thread
markEnvironmentUsed re-hardened the env-store on every runtime round-trip,
spawning powershell.exe ~5x synchronously (~1-1.5s each) and freezing the
Windows UI on launch and every keystroke. Throttle the non-security lastUsedAt
write (60s window; runtimeId changes bypass) and make path hardening idempotent
per process. ACL hardening is preserved; post-rename credential hardening still
always runs. ~14.0s -> ~6.8s launch; main thread 95.7% blocked -> 99.0% idle.
* Fix secure-file hardening cache retries
---------
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
- Remove `experimentalUnifiedNewTabLauncher` flag and gate; the unified
launcher is now always enabled
- Drop the settings toggle from ExperimentalPane and search index
- Update placeholder/aria text to "Open any file, URL, agent, ..."
- Restyle the input: borderless, flush with dropdown edge, no search icon
- Update test fixtures to include agent-detection state fields now
unconditionally read by TabBarCreateEntry
* Show Kimi Code subscription usage in the status bar
Add a read-only rate-limit fetcher for Kimi Code that reads the OAuth token from ~/.kimi-code/credentials (honoring KIMI_CODE_HOME) and queries Kimi's usages endpoint, surfacing the 5h session window and weekly quota in the existing status-bar rate-limit UI alongside Claude/Codex/Gemini. Gated on the kimi CLI being detected, with a settings toggle.
Read-only by design: the fetcher never refreshes or writes credentials — rotating Kimi's refresh token would log out the user's live CLI session — and never calls Kimi's completion endpoint. It only reads the existing token and the usages quota endpoint, mirroring how the CLI itself reads managed usage.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Harden Kimi usage status handling
Preserve cached quota on transient Kimi credential/API failures and migrate the default status-bar item for existing users.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Substring detection mis-fired on titles like "opencode-blinker" or
"claude-scratch", labeling a Codex tab as OpenCode whenever the terminal
title fell back to the bare worktree directory name.
- Extract token-matching regexes into `agent-name-token-match.ts` with
a boundary guard that rejects path separators and hyphenated compounds
- Replace all `lower.includes(name)` calls in `agent-detection.ts` with
`titleHasAgentName()`; re-export `AGENT_NAMES` to keep existing importers working
- Allow `.exe/.cmd/.bat/.ps1` suffixes so Windows launcher process names
(e.g. `openclaude.exe`) still resolve correctly
- Update tests: cwd-path fragments now return null; real agent titles
that contain the name as a proper token still resolve correctly
- trim prose punctuation from embedded GitHub URLs before smart submit parsing
- avoid treating generated workspace slugs as explicit user intent
- add regression coverage for both edge cases
* feat: hide markdown front matter by default with per-file toggle (#4468)
Front matter in the markdown preview was always visible above the
rendered body, which clutters reading for files where the metadata
is incidental. Default the card to hidden and let users opt in per
file via a small switch in the section header.
* Add a per-file markdownFrontmatterVisible flag in EditorSlice,
mirroring the editorViewMode pattern (absent entry = hidden;
storing only explicit true values keeps the record minimal).
* Clean the entry up on closeFile, preview-tab replacement, and
worktree removal; reset on runtime switch.
* Render the existing front-matter card unchanged when the toggle
is on, hide only the <pre> body when it is off, and keep the
section header + SettingsSwitch visible so the affordance stays
discoverable.
* Add 4 regression cases in editor.test.ts mirroring the
editorViewMode tests.
* fix: persist markdown front matter visibility
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Orca <help@stably.ai>
Jinwoo HongandOrca
Neil
Brennan BensonandOrca
Trevin ChowandNeil
KayleeandNeil
Lesley MurfinandJinwoo Hong
