Pi's launch catalog now opts into launch-time model/effort preferences, so
`orca agent launch --agent pi` and `orca orchestration worker-start --agent pi`
accept `--model <provider/id>` and `--effort <level>` instead of refusing.
Pi models without a provider/id shape are refused up front, before a
worktree or worker is created. A new host capability,
`agent.launch.pi-model.v1`, lets the CLI refuse a Pi model/effort on older
execution hosts that would otherwise start Pi on its default model.
Co-authored-by: Neil <neil@stably.ai>
macOS Local Network caches one executable UUID per bundle id, and the terminal host shares the app's bundle id. With a UUID of its own the cache flips between the two, which blocked some connections and prompted again after an update. Give the host exactly the main executable's UUID per CPU type, and check that in packaging and after notarization.
Orca terminals run under the signed helper, whose executable was stock Node,
sharing its LC_UUID with every install of that Node build. macOS Local Network
privacy maps a responsible process to an app by that UUID, so terminals could be
attributed to another program and blocked from the LAN while Orca showed allowed.
Rewrite the helper executable's UUID during assembly (same scheme as #41676),
and fail packaging and the release check if it drifts.
Fixes#21988
* fix(computer): press, set and scroll Windows native controls without activating the window
Measured on Windows CI: UI Automation's Invoke, Toggle, ValuePattern and
ScrollPattern focus a background WinForms control first, which activates its
window. Native controls now go through their own messages instead, each
owner-checked: BM_CLICK for buttons, check boxes and radio buttons, select-all
plus EM_REPLACESEL for set-value on edits, CB_SETCURSEL with CBN_SELCHANGE for
combo boxes (exact-text match, read back after the app's handler runs) and
LB_SETTOPINDEX for list box pages.
* fix(computer): refuse read-only Windows documents before typing keys, document the caret fallback
* fix(computer): keep Windows native routes to measured controls and refuse partial writes
BM_CLICK only for WinForms buttons, multi-column lists stay on ScrollPattern, a
list already at its end reports success, edits refuse text past their limit,
the combo's owner is checked right before the selection, a cleared selection
reads as a mismatch and a disabled control is element_not_enabled.
* fix(computer): hold Windows edit limits without a readback, require a complete combo search
* fix(computer): read a long Windows edit's length from the field for its limit check
* test(computer): share the Windows fixture action helpers
* feat(computer): add launch-app to start apps without taking the foreground
* fix(computer): leave running apps alone and keep the launch env clean
* fix(computer): recheck aliases, keep focused launches visible, refine launch hints
* chore(computer): document the launch result casts
* test(computer): check launch-app reports where the app ended up on Windows CI
* docs(computer): point app_not_found at launch-app
* test(computer): format the merged Windows background e2e
* fix(computer): match launch paths to the running file and word background launch as an attempt
* fix(computer): type into Windows text fields without raising the window
Adds type-text --element-index on Windows through EM_REPLACESEL for user32,
RichEdit and WinForms edits (owner-checked, read back with WM_GETTEXT), or a
ValuePattern write merged with the TextPattern selection. Keyboard verbs on a
background window now refuse with background_unavailable before sending
anything and point at type-text --element-index. Foreground typing uses one
SendInput KEYEVENTF_UNICODE batch instead of WM_CHAR posted to the top-level
window, and get-app-state shows multiline edit text again.
* fix(computer): refuse typing into Windows list items, keep the caret on a confirmed prefix
* fix(computer-use): observe minimized, hidden and other-Space windows on macOS without a restore
macOS only enumerated on-screen windows and dropped minimized AX windows,
so an app whose window was minimized, hidden or on another Space (any
full-screen app) could not be observed, and agents fell back to
--restore-window, which activated every window of the app and switched
the user's Space.
Enumerate every window, keep the off-screen ones accessibility can still
read (other-Space windows by remote token, closed windows dropped by
their Space membership), and report their real minimized and off-screen
state. Background pointer and key input on such a window refuses before
sending anything. --restore-window now raises only the target window,
once per request, and delivery is measured from whether the target
became frontmost.
* fix(computer-use): pin the restored window and prefer visible windows by default
* fix(computer-use): keep window-index cache keys and stale-element checks across a restore
* fix(computer-use): restore only this app's resolved window and refuse a closed target before raising
* docs(computer-use): say macOS reads minimized, hidden and other-Space windows
* fix(cli): keep Orca in the background when orca open launches it
* docs(cli): say orca open leaves the foreground alone
* fix(cli): ask a running Orca to open its window in the background
* fix(main): keep background reveals inactive on Linux maximize and drop the flag on admin restart
* fix(cli): narrow the open status before returning it
* fix(main): keep focus-existing-window free of main-window contracts for the web typecheck
* fix(cli): cap the open window request at five seconds
* fix(computer): ask the user before retrying with --restore-window
Error hints, recovery steps, the skill guide and the CLI follow-up command
told agents to retry with --restore-window on their own, which raises the
target app and takes the user's screen. They now say to ask the user first,
stop recommending a restore just to observe, and fix stale per-platform
background claims.
* docs(computer): name the Linux keyboard gate and the Wayland limit
#41870 added hover/focus/press outlines to every Button, Toggle and
SelectTrigger, which read as noise on dense toolbar icon buttons.
Restore the previous focus-visible ring for those primitives and keep the
outline treatment only for buttons inside DialogFooter.
* fix(computer-use): refuse Windows pointer fallbacks without --restore-window
Coordinate, right, middle, modified and multi-clicks, clicks on elements with no
primary pattern, unscrollable wheel scrolls and drags raised the window and
moved the real cursor without being asked. They now refuse with
background_unavailable before anything is sent. Coordinate and fractional
scrolls go through ScrollPattern first. With --restore-window only the target
window is raised (never a cloaked one), with a UIA activation fallback and a
second attempt, points are validated first and the cursor is put back behind
the input. A failing UIA pattern or disabled element is an error instead of a
real click, and delivery is measured after the post-action observe.
* fix(computer-use): settle Windows clicks before restoring the cursor and keep scroll writes honest
* fix(computer-use): restore the Windows cursor with SetCursorPos and hit-test coordinate scrolls
* test(computer-use): assert Windows raise outcomes, not attempt order
* fix(computer-use): report a Windows page scroll the provider ignores as not scrolled
Add an on-by-default Claude usage polling switch with live-terminal-only behavior when disabled, cancellation and account attribution safeguards, and translations for all supported locales.
Fixes#27151.
Fixes#39502.
Fixes#37037.
Co-authored-by: Sibyl <scauyb@qq.com>
* fix(notifications): lift toasts and corner cards onto a shared notice surface
* fix(notifications): keep corner-card shadows unclipped and match the StarNag toast
* fix(notifications): keep the stack's scrollbar on screen and its overflow off the status bar
* fix(notifications): collapse stack shadow room while scrolling and paint lower cards above upper shadows
* fix(notifications): pair re-pointed surfaces with popover foregrounds and keep close-hover border
* fix(notifications): keep notice text readable on plugin themes and catch card growth in a capped stack
* fix(notifications): track stack cards from mutation records and tidy test types
* fix(notifications): check painted notice colors and outline unfilled secondary buttons
* fix(notifications): paint app-theme notice colors as the exact hex measured, with a one-step margin
* fix(notifications): keep muted panels on the notice surface's polarity for app themes
* fix(notifications): keep toast descriptions and outline buttons readable on notice surfaces
The surface lift now also keeps the 80% toast description blend readable, so
mid-gray dark popovers no longer drop descriptions under 4.5:1. The notice scope
remaps --background with --foreground, so outline buttons keep a dark surface
under light popover text in light-base themes with dark popovers.
* Give every Settings pane the same card structure
Settings cards that hold rows were built several ways (the non-grouped
SettingsSection px-7 card, shadcn Card, the Appearance accordion, one-off
bordered boxes), each with its own side padding and row inset. Every one
now goes through SettingsGroup: one 20px inset, rules between rows, title
outside the card. SettingsGroup gains an id, a collapse prop for the
Appearance groups, SettingsGroupSubsection, SettingsGroupNestedRows and
SettingsGroupDisclosure (the old Appearance advanced disclosure), plus
shared bleed classes for rows that span the card. The non-grouped
SettingsSection body is removed.
* Fix settings card typecheck errors
* Keep collapsible group headings valid and restore notification row padding
* Keep Chat names anchor on its group, toggle Appearance groups from the whole header, and steady the Machines row padding
* Show Appearance groups as plain cards and even the Computer Use card's top inset
* Restore the SettingsGroup subsection exports dropped with the collapse mode
* feat(computer): type into a named text field without focusing it on Linux and macOS
* fix(computer): report unconfirmed Linux text readback and cover element typing
* test(computer): send an element with benchmark text only for targeted typing
* test(computer): pick gedit's editor, not its hidden overview map, in Linux e2e
* docs(computer): confirm focus before the unindexed type-text fallback
* fix(computer): report unreadable element text readback as readback_unsupported
* fix(computer-use): scroll, expand and set sliders on Windows without raising the window
* fix(computer-use): wait for Windows scroll and slider writes to settle before verifying
* fix(computer-use): reject NaN for Windows slider set-value
* test(computer-use): wait on the Windows fixture state with vi.waitFor and a schema
* test(computer-use): check activation per action against a holder window in the Windows fixture
* test(computer-use): log fixture window events for activation failures
* fix(computer-use): report foreground when a Windows app raises itself for a UI Automation action
WPF activates its own window for Scroll, ExpandCollapse, RangeValue and SelectionItem calls from any UIA client, so the runtime now compares the foreground window before and after a pattern action instead of assuming background. The Windows e2e checks delivery against the fixture's own activation count, with a holder window in another process.
* test(computer-use): skip an unstarted holder when closing the Windows fixture
* fix(computer-use): bound Windows pattern scroll paging and tighten slider read-back
* fix(computer-use): cap Windows slider read-back tolerance and run the UIA e2e only on CI
* fix(computer): refuse quit, log out and lock shortcuts unless explicitly allowed
* fix(computer): close Linux keysym bypasses in the system shortcut guard
* fix(computer): refuse Linux keycode, L1/L2 and VT-switch keysym bypasses
* fix(computer): catch control characters in Linux keycode tokens and point recovery at the stated effect
* feat(computer): show where snapshots were cut and read one element's subtree
* fix(computer): validate subtree targets against the fresh walk and keep scope for focused input
* fix(computer): return whole-window action results after subtree reads
* fix(computer): count kept records toward the macOS limit and index subtree reads against the latest cache
* fix(computer): index Linux/Windows subtree reads against the snapshot they started from
* feat(computer-use): add orca computer wait for text, enabled controls and window titles
* fix(computer-use): bound wait reads by the deadline and wait out missing Linux/Windows windows
* fix(computer-use): read disabled traits after role text with parentheses and bound the capability probe
* fix(computer-use): capture KDE Wayland windows through the desktop portal
KWin is the only process on KDE Wayland that knows where a window is and
what covers it, so a one-shot KWin script reports window geometry and
stacking. Orca crops the xdg-desktop-portal screenshot to that window and
returns a screenshot error when the window is hidden, covered, or moves
during capture, or when the portal prompt is unanswered or denied.
* fix(computer-use): refuse KDE screenshots during Show Desktop or off every screen
* fix(computer-use): clean up oversized portal files and skip shaded KDE windows
* Hide projects from the sidebar without stopping them
Adds Repo.hiddenAt, a per-host, view-only flag. A hidden project's
workspaces, empty header and project-filter entry leave the desktop
sidebar, the paired phone's list, the new-workspace picker and the
palette's project filter. Its terminals, agents and automations keep
running, and repo.list / worktree.ps still list it.
- Hide Project in the project menu (toast with Undo), a collapsed
"N hidden projects" list under the workspace list with Show buttons,
and a Hide from sidebar switch in Settings > Projects.
- repo.setHidden RPC ({repo, repoHostId?, hidden} -> {repo, hostId,
hidden}) and `orca repo hide|unhide [--host]`; `repo list` marks
hidden rows.
- Opening a hidden project's workspace (notification, CLI, deep link)
focuses it without unhiding it, lifting sidebar filters, or leaving a
pending sidebar reveal.
- repo.update echo check: a host that drops hiddenAt reports failure
instead of reading as hidden.
* Address hidden-projects review: multi-host hide, picker scope, mute, stale filters, shared predicate, restore list styling
* Hidden projects re-review: keep saved filters, Agents filter, composer seed, per-toast Undo, shared default host
* Hidden projects: address review threads (pre-feed, palette search, notices, dialog default, seed remap, row keys, a11y)
* Hidden projects: no implicit dialog default when every project is hidden
* feat(plugins): host API 1.9: agent.listSessions (history:read), resume past sessions, agents.list task titles
* test(plugins): host API 1.9 coverage; regenerate plugin artifacts
* fix(plugins): host API 1.9 review fixes
- agent.resume starts a past session where the desktop's Resume would: the same preparation
request and answer handling (now shared), and the transcript in the home it pins
- AI Vault list cache keeps four scopes, so plugin reads never evict the panel's list
- list fingerprints ignore scan id and issues, so an unchanged history revalidates
- workspace mapping resolves symlinked workspaces and prefers a project over a folder
- agents.list task only for open dispatches, read at most once a second
- running matches OpenCode versions; history reads reset when the vault list is invalidated
- truncation, consent copy and limitations documented
* fix(plugins): forced history refresh supersedes cached scopes; resume legacy Codex sessions from their recorded transcript
* fix(plugins): address host API 1.9 review threads
- a scan that began before a forced history refresh no longer caches its older result
- list fingerprints count which issues there are (not their wording)
- symlinked workspaces rank by their resolved folder
- a session-only status row is no live pane: resume prepares the session
- a failed task-title read leaves agents.list rows intact
- the symlink test uses a junction on Windows
* test(ai-vault): order the stale scan before the forced refresh
* feat(plugins): proposed tier for host methods not yet frozen
A method spec may set `proposed: true`: only development plugins may call
it (others get not_permitted), and the minor, frame/worker method lists,
typings and skill references omit it. The reference renders such methods
in a separate Proposed section; dev workers' host.has answers for them.
* feat(plugins): param capabilities, host confirmations, automation provenance
- PluginHostMethodSpec.paramCapabilities: a passed param can require a
second capability; executePluginHostCall and the mock host refuse it with
capability_denied before any audit or effect, and the reference shows it.
- confirmPluginAction generalizes the external-open prompt into a host-owned
confirmation, exposed as PluginHostServices.confirm (desktop only; absent
in headless serve). It re-checks the plugin's approval after the answer.
- Automations record createdBy { kind: 'plugin', pluginKey, name }, set by
the runtime from the in-process plugin caller (RpcContext.plugin), never
from params; the Automations detail shows "Created by <plugin>".
* feat(plugins): workspace:create, automation:read and automation:write capabilities
New closed-enum kinds (older Orcas refuse such manifests with the engines
message), worker-only, with consent copy that names what each allows;
release floor PLUGIN_HOST_API_1_8_SINCE (1.4.259) joins
PLUGIN_SCHEMA_NEWEST_SINCE. agent:launch copy now says it also resumes.
* feat(plugins): host API 1.8 methods: workspace.create, agent.resume, automation.*
- workspace.create (workspace:create; agent also needs agent:launch): a
worktree in a Git project, as orca worktree create does; with agent, the
CLI's agent.launch create-worktree path, so the agent starts after setup.
Setup is skipped or follows the project's settings; never run, an
approved hash or a startup command.
- agent.resume (agent:launch): terminal.ensureAgentSession by session id;
started is false when a terminal already ran it. agents.list rows and
agent.status.changed carry sessionId.
- automation.list/create/update/delete (automation:read/write): create
forwards only name, prompt, agent, target, schedule, time zone and
enabled; update/delete of automations another plugin or the person made
ask the person first and report cancelled or consent-unavailable.
* test(plugins): host API 1.8 coverage; regenerate plugin artifacts
Covers param capabilities (host and mock host), workspace.create payloads
and refusals, agent.resume keys and adoption, sessionId on agents.list,
automation projection, forbidden create fields, confirmation outcomes,
runtime-set provenance and capability access growth. Regenerates the
reference, schemas, typings, declarative runtime and skill references.
* fix(plugins): host API 1.8 review fixes
- Confirmations spend the frame dialog budget, allow one question per
plugin at a time and pause after a refusal (rate_limited); a worker's
question shows in the focused window, else the first visible one.
- Changing what an automation with extra agent settings runs (prompt,
schedule, resuming) asks first even for its creator, showing the prompt.
- Removing, disabling or blocking a plugin pauses its automations and ends
its ownership (createdBy.endedAt), so neither re-enabling nor a reinstall
under the key resumes or edits them silently; the remove dialog says so.
- workspace.create and agent.resume record the terminals they return as
the plugin's own; a launch that fails after its worktree exists names it.
- Setup-decision refusals are told by the runtime's error class (kept as
the in-process RPC error's cause); generated names see every worktree
of the project; resume transcripts match the workspace and host.
- Created by shows the plugin id beside its name.
* fix(plugins): end automation ownership only on uninstall, disable or block
- The ownership sweep no longer reads discovery: only an uninstall
(announced by the removal path), the disabled list, the kill list or
the plugin-system switch end it, and only once the service is ready,
so an unreadable plugins folder pauses nothing. An install under the
same key after a removal keeps what it creates.
- A new time zone on an automation with extra agent settings asks first.
- A failed launch names only a new worktree made from the requested name.
- Settings' plugins-off state and the CLI's plugin system off and plugin
disable say that plugin-created automations are paused and stay so.
* fix(plugins): address host API 1.8 review threads
- Confirmations close when the worker's call ends, freeing the plugin's
turn; they name the automation (short id, project, workspace,
schedule), show any new prompt, and are refused as `changed` when the
automation was edited while the person was asked.
- automation.create takes hostId (through the project's setup on that
host) and a creationKey scoped to the plugin; the runtime rechecks the
plugin's approval right before the write.
- agent.resume records only terminals it started; both it and
workspace.create recheck approval before recording.
- automation.list never cuts a schedule (null when too long) or fails on
an id too long to show.
- The Automations detail says when a creator plugin was removed or
disabled.
* feat(plugins): host API 1.7 — workspace ids, project/terminal list, terminal focus/close
Plugins that track workspaces and terminals across Orca had to read the private runtime
token or shell out to the CLI. Host API 1.7 gives them the same through consented methods:
- workspace.readContext (and workspace.changed) carry `workspaceId`, the id workspace.list
gives; workspace.created/removed and agent.status.changed add `workspaceListId` beside
their existing raw `workspaceId`, which keeps its meaning.
- workspace.list rows name their `projectId`; opt-in `includeStatus` joins each row's agent
state, unread flag, live terminal count and last activity from worktree.ps.
- project.list (workspace:read), terminal.list (workspace:read), terminal.focus
(workspace:write, desktop only, steers only this window) and terminal.close
(terminal:send, reports whether the process is known to have stopped).
- Runtime refusals (unknown or ambiguous workspace, stale or exited terminal) reach plugins
as fixed messages instead of runtime wording.
- Consent copy for workspace:read, workspace:write and terminal:send says what they now
allow; terminal.focus and terminal.close are audited by terminal id.
- PLUGIN_SCHEMA_NEWEST_SINCE covers the editor typography and theme video floors it missed,
and the provisional 1.7 floor, so development builds accept plugins requiring them.
* fix(plugins): narrow terminal.close and harden host API 1.7 from review
- terminal.close closes only terminals of the focused workspace (the check terminal.sendText
uses) or ones this plugin opened with terminal.create or agent.launch, recorded in a bounded
per-plugin registry that is forgotten when its worker stops or it is disabled or removed.
terminal.focus stays any-terminal; summaries and terminal:send copy say so.
- Lifecycle events carry the worktree's identity and host: from the new row on create, and read
host-qualified before the purge on every removal path. agent.status.changed looks up the
identity on the reporting host only. The global removed-identity map is gone.
- includeStatus shares one in-flight worktree.ps and a 1 s cache across plugins, and reports
statusTruncated when that listing stopped short.
- Stored remote contexts get their identity host-qualified; panels and editors never get a raw,
path-bearing workspace id from readContext or workspace.changed.
- Runtime refusals map to fixed messages (tab pinned, no window, tab gone, host disconnected);
any other runtime error or malformed answer is a fixed action_failed with the detail logged.
- hostId is `local`, `ssh:` or `runtime:` in both workspace.list and project.list; rows past the
id or path bounds are left out with truncated set instead of failing the list.
- The mock testing host answers terminal.focus and terminal.close by default.
* fix(plugins): keep shipped host API values and codes; honest terminal results
- workspace.list hostId keeps the values 1.3 shipped (recorded host, else null; folder rows
their executionHostId); project.list always names the host. Both summaries say which.
- Methods that shipped before 1.7 report every runtime refusal as action_failed, as before;
the unavailable/conflict mapping applies to 1.7 methods only.
- includeStatus shares a pending worktree.ps however long it runs; the 1 s TTL starts when it
lands.
- The opened-terminal registry records only for a call still approved and not cancelled, and is
pruned on disable or removal only, so event-driven workers keep close rights across restarts.
- terminal.close answers { closed: true }: a local close cannot tell whether the process exited.
terminal.focus answers focused: false when the request was superseded or not navigated.
- workspace.list and project.list cut labels to 512 instead of failing the list.
- Removal events from the runtime job and the IPC retry are tested to carry the identity read
before the purge; folder deletion carries its host.
* fix(plugins): name the status-listing owner type
Monaco falls back to brackets for auto-closing, so a plugin bracket up to 128
characters was typed into the file as you type. The shared schema now fills in
autoClosingPairs with the brackets that pass the 8-character typed-pair rule.
Liquid's {% comment %} / {% endcomment %} were dropped by hosts and refused by
validate:plugin. Comment markers are only inserted by Toggle Comment, so they
share the 128-character printable one-line rule with brackets; typed pairs keep 8.
The site now lives at orca.dev; the old onorca.dev and www.onorca.dev hosts
redirect there. Linking to orca.dev directly skips that redirect.
Only page links change. Service hosts, sign-in and relay endpoints stay as they are.
* feat(orchestration): let coordinators approve worker permission prompts when the user turns it on
One setting on the orchestration page, off by default. When on, the
escalation offers orchestration approve and deny, both with a reason, and
the user still sees Allow/Deny: the first answer wins. A prompt the
worker's agent lets only a person approve is refused and stays with the
user. The machine running the worker enforces its own setting.
* fix(native-chat): a worker approval's receipt shows the command, not its tool input as JSON
* test(orchestration): list every worker-side case in the coordinator approval table
* chore(i18n): ship the coordinator approval setting's search keywords in the runtime catalog
* fix(orchestration): a reasonless allow keeps the person's refusal, and terminal checks no hook may approve are person-only
* fix(orchestration): address review on coordinator approvals
- A person-only chat prompt answered meanwhile reports as closed.
- A terminal allow reads Claude's warning from the screen it checks, so a
late-painted person-only warning still refuses before the hook is used.
- The receipt keeps a chat worker's whole command.
- orchestration approve prints the reason it sent.
* fix(native-chat): read the receipt's command through a parsed shape, not Reflect
* docs(skills): drop worker permission prompt guidance; the escalation carries it
* fix(computer-use): capture Wayland windows with grim
* fix(computer-use): skip Wayland captures of windows that are not on screen
Sway and Hyprland report windows on other workspaces at coordinates that grim
would fill with whatever is visible there. Require the one matching window to be
visible, name why a capture was skipped, check for a supported compositor before
asking for grim, and load GdkPixbuf without needing Gdk.
* fix(computer-use): keep Wayland screenshots aligned with accessibility frames
Skip the capture when the compositor window size differs from the AT-SPI window
bounds, since element frames are measured against those bounds. Treat a running
Sway or Hyprland as Wayland even when XDG_SESSION_TYPE is tty.
---------
Co-authored-by: Kelvin Amoaba <97001695+AmoabaKelvin@users.noreply.github.com>
* Revert "Make chat wait check the chat's work state instead of reading its history every second (#41129)"
This reverts commit 9a10464bec.
* Revert "feat(cli): read, message and wait on agent chats with orca chat list/read/send/wait (#40836)"
This reverts commit c2e6ebbf0b.
buf0-bot[bot]
lucas.wuandNeil
Jinwoo Hong
Neil
Kelvin Amoaba
Brennan Benson
OrcaWinandOrcaWin
Jinjing
lucumaandKelvin Amoaba