The Commit & Sync tooltip, the Rebase label/tooltip, and the Create PR
blocked hints were bare English literals while the labels beside them went
through translate(). Route all 25 strings through translate() with named
placeholders and add the keys to the English catalog.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(ssh): expand %d and other tokens in ssh -G IdentityFile paths
OpenSSH prints IdentityFile values from `ssh -G` with their percent
tokens unexpanded (it expands them only at connect time), so a config
line like `IdentityFile %d/keys/work.pem` reached Orca as a literal
relative path. The key was silently skipped and the connection fell
back to a password prompt even though plain `ssh <alias>` worked.
Expand the tokens OpenSSH supports for IdentityFile that can be derived
locally or from the ssh -G output (%%, %d, %u, %i, %l, %L, %h, %n, %p,
%r). Paths with tokens that need OpenSSH internals (%C, %j, %k) are left
unchanged. A configured, non-default identity file that does not exist
is now named in the auth error instead of being skipped silently.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(ssh): reproduce #33849 end to end and keep tests off the real ~/.ssh
Adds a Docker e2e: a host from ~/.ssh/config whose IdentityFile uses %r
and %p connects with that key. It fails on v1.4.241 and passes with
the token expansion. Drops a unit assertion that read the real
~/.ssh/id_xmss.
* fix(ssh): expand ${NAME} in ssh -G IdentityFile paths too
ssh -G also prints IdentityFile's ${NAME} environment references
unexpanded, so a key at ${KEYS}/work.pem fell back to a password prompt
in the same way as #33849's %d. Expand the braced form first, and keep
the raw path when the variable is unset, as OpenSSH refuses it.
---------
Co-authored-by: william <wanglv93@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The agent terminal preview auto-focuses xterm, which claims Escape and Tab,
and it swallowed the pane-close chord because a preview has no pane. Route
that verdict to an optional requestClose callback so the dialog (modal or
adjacent panel) closes; plain SSH terminals pass none and keep swallowing it.
The workspace keyboard router also treated the preview textarea as terminal
context, so the chord would have closed the active editor/browser tab or hid
an empty floating panel behind the dialog. Mark the preview container and
skip those close handlers for its targets.
Fixes#19757
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
When a worker reported its outcome (succeeded or failed) before the
worker-start path finished, a late startup error such as a rejected
prompt delivery overwrote that settled outcome with a start failure and
tore down the live worker session. The start-failure path now checks for
a settled report first and returns a ready receipt carrying the reported
workerOutcome without teardown; otherwise it records the failure before
awaiting teardown so no report can slip in between.
Co-authored-by: Neil <neil@stably.ai>
link-routing-preference-dialog.tsx exported both the provider and
useLinkRoutingPreferenceDialog, so it was never a Fast Refresh boundary.
When another file in the terminal subtree changed in the same watcher
batch (e.g. a branch switch), createContext ran twice and the terminal
pane read a different context than the provider published, throwing
"must be used inside LinkRoutingPreferenceDialogProvider".
Move the context and hook into a component-free module, matching the
confirmation-dialog-context split from #11980.
Since #27214 every SSH session is retagged runtime:<env>, so the #24236
check that drops a deleted cwd (and its prebuilt `cd`) before resuming
only ever ran for the legacy ssh: spelling. Resume on a paired or
SSH-managed server therefore ran `cd '<deleted folder>' &&` and failed.
The check now covers runtime hosts too, probing the folder with the
existing files.browseServerDir RPC; only a definite "missing" answer
drops the cwd, so an older or unreachable host keeps today's behaviour.
Search-hit cards carry no turns and remote hosts cannot reparse a first
prompt, so a server session found through search showed "No first
prompt" and "No conversation preview". Hits now borrow the preview of
their scanned history row.
The Add project host picker showed a failed SSH host as "Needs attention
- SSH" with no reason. Its Connect handler also overwrote the failure
main had just published with the host's earlier state, and toasted
Electron's raw IPC error. The picker row now shows the same reason
Settings → SSH Hosts does. The handler keeps main's published failure
and toasts through the shared SSH connect-failure toast.
Fixes#29648
Revoking a paired device, syncing repository settings drafts, and
auto-expanding the first failed check all mutated refs or queues inside
setState updaters, which React may run twice (StrictMode) or late. Move
the impure work into the event handler or effect that queues the update.
Fixes#25529
Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
@parcel/watcher reports FSEvents MustScanSubDirs ("... File system must be
re-scanned.") as a non-fatal per-batch error while the native stream keeps
running. Orca forwarded it as watch-error, which retired the watched root and
silently stopped external-edit delivery for the rest of the session.
Route rescan-required errors to a new delivery-queue overflow() so consumers
resync and the subscription stays live. A root deleted in the same batch is
still reported as watch-error. Other errors keep the existing path.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
Electron's BrowserWindow.webContents getter throws "Object has been destroyed"
once the native window is gone. Several ipcMain reply listeners (terminal
reveal, CLI/mobile terminal create, browser tab create, remote CLI scope) and
the main window focus lifecycle read mainWindow.webContents on every event, so
a late or replacement-window reply after close threw inside ipcMain.emit,
crashing main and starving the new window's listener.
Capture the renderer webContents once at setup and compare event.sender
against that reference instead. Adds a regression test for a pending reveal
on a closed window while a replacement window answers.
Co-authored-by: Neil <neil@stably.ai>
When the scrollback is full and the user has scrolled up, new output trims
the oldest lines and renumbers every buffer row. The pinned scroll intent
stored an absolute viewportY, so enforcing it later (mouse report, reattach,
visibility resume) jumped forward by the number of trimmed lines.
Pinned intents now carry a single xterm marker on the pinned line. Restore
and enforce use the marker's live line and fall back to the stored
coordinates when the marker is disposed (trimmed away or a replay clear).
A pinned sync after trimming compares against the live anchor and refreshes
the stored coordinates so keyed remounts restore the same content.
Fixes#23333
Co-authored-by: Neil <neil@stably.ai>
Windows runtime file watches run in-process, so closeFileExplorerWatchersForPath
never has a watcher child to close there. Re-resolving the authorized path after
Git already dropped an external sibling worktree's registration threw
'outside allowed directories' and aborted the Windows partial-removal recovery.
Fixes#26764
Co-authored-by: Neil <neil@stably.ai>
* fix(terminal): adopt another client's terminal under its own tab instead of a second one
A paired client that spawns a terminal in a host's local worktree leaves the host renderer without that tab. On activation the host reports the PTY unowned with the recorded pane, and adoption minted a tab with a random id because the recorded tab was not in this window, so the client showed the PTY in two tabs. Adopt it under the recorded tab id and leaf instead, unless that id was closed, and let PTYs the host names as a pane's owner bind before PTYs that only recorded one.
* fix(terminal): never mint a second tab for a PTY a recorded-tab create already bound
If createTab had to give the recorded tab another id, that tab already holds the PTY, so the fallback create would show it twice.
* test(terminal): pin the clock for the closed recorded-tab case
The wall-clock tombstone tripped the flaky-test ratchet. Also tightens the adoption doc comment and keeps the fixture header first.
---------
Co-authored-by: Minidoracat <11269639+Minidoracat@users.noreply.github.com>
Dispatched workers were told to run `orchestration check` but never to ack
the returned deliveryId, so the same batch replayed on every check and newer
coordinator mail stayed hidden. The dispatch preamble, orchestration skill
guide, and worker contract now tell workers to ack each processed batch with
`--ack <delivery_id>` (which also reads the next one) and repeat until count
is 0.
Co-authored-by: Neil <neil@stably.ai>
"reconnect restores the managed host name after its conversion catalog
fails" started page.waitForEvent('console') before the reconnect that
converts the host. Its 30 s clock ran through the conversion, so on a
loaded machine or a slow host the test timed out even though the catalog
failure was logged. It failed this way on unmodified main locally. With
the Docker host frozen for 35 s during the reconnect it fails every time
before this change and passes after it. The test now collects console
messages and polls once the host is managed. It also drops a log line
the app no longer prints.
* fix(session): clear an emptied field on a runtime partition this window loaded
* fix(session): leave hosts with parked contested rows to the shadow
Also replaces the new type assertions with checked types.
On macOS with a Korean IME, pressing Option+Left while a syllable was in
the preedit moved the shell cursor two words. Chromium forwards a
composing keydown for the chord, commits the composition, then replays
the same native key event (same timeStamp). Orca deferred the first
copy until the composition settled and then sent the replay too.
The deferred chord sender now remembers the deferred keydown's code and
timeStamp and absorbs exactly one matching replay. The absorb check runs
before the composing-defer branch, so a replay arriving before xterm
ends the composition session is covered as well. Any other checked
keydown, blur, or teardown forfeits the slot.
Fixes#17616
Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: kunsanglee <85242378+kunsanglee@users.noreply.github.com>
Daemon suites handed Windows production branches POSIX-shaped values, so
they failed on Windows checkouts:
- Preflight client replacement bound `join(dir, 'daemon.sock')`; win32
listens on the path verbatim and refuses a file path. Use
getDaemonSocketPath like the sibling daemon suites.
- Cwd-validation fixtures used POSIX cwds, which win32 preflight never
validates, so cancel/missing-dir cases reached spawn. Give them a native
`C:\` cwd on win32. The skipped validation also leaked a pending
mockImplementationOnce gate into the next test, which then timed out.
- ORCA_SHELL_FEATURES is only written on the POSIX launch path; gate the
history-wrapping expectation on platform.
Refs #18261
On Linux, PTYs inherit the daemon's RLIMIT_RTTIME. When the soft or hard
limit is 0 the kernel kills timer-armed jobs (SIGXCPU / SIGKILL, exit 152
or 137) and unprivileged code cannot raise the hard limit. Read
/proc/self/limits at terminal-scope initialization and log a
rttime-limit-zero event with a remedy hint (rtkit, or the launcher /
systemd LimitRTTIME that starts Orca). No-op off Linux or when the limits
file is unreadable.
Co-authored-by: Neil <neil@stably.ai>
* Enable continuing remote CLI conversations in Chat UI
* fix(native-chat): send the host's own pane key; ask older hosts to update
On a paired host the desktop names a pane by its mirrored surface key, but
the host matches cliSource against its own agent-status rows, so every
remote "Continue in Chat UI" create was refused as unreadable. Translate
the key with toHostSessionPaneKey before sending.
A resume launch's join identity now includes its execution host, so a
remote resume never joins an in-flight resume of the same conversation id
on another host.
A verified host that lacks resume-history now shows the pane-header action
disabled, with "Update Orca on this host to continue in Chat UI." in its
tooltip and accessible name, instead of hiding it.
---------
Co-authored-by: Zrzzzz <1160026659@qq.com>
* fix(session-tabs): retire kept terminal rows the host closed, and offer Close Pane on a closed remote terminal
* fix(session-tabs): a live handle outranks an older close record
* fix(runtime): recognize hand-typed native Claude at its startup dialogs
A shell-typed claude emits no title at the trust dialog, so nothing asked
which process owned the pane, and native Claude's process name is its
version (2.1.310). agentWait now identifies a title-less, unowned pane
from its foreground process, confirming an unfamiliar name with one process
scan whose verdict is kept while that name stays in the foreground.
* fix(runtime): scan only native Claude's version-named binary, only when a dialog is on screen
Review follow-ups: an untitled, unowned pane earns a foreground read only
when its live screen shows a blocked dialog, so plain shells answer without
a round-trip; the process scan runs only for a semver-shaped foreground name
(native Claude's versions/<semver> binary), never on win32, and only an
answered scan is cached.
* fix(runtime): don't persist a titleless pane's scanned identity
A hand-typed native Claude identified for an interactive-wait query was
stored as the pane's foregroundAgent. If the user declined the trust
dialog before Claude set a title, no title transition fired, so the shell
stayed labelled Claude until the next inventory refresh.
The identity now answers only the current query; the per-pty scan cache
(keyed by foreground name) keeps repeat queries cheap. Concurrent queries
share one in-flight identify, and the version-name match is anchored.
* fix(runtime): keep scanned identity out of background refresh; null for disconnected panes
- load() matches main again; only identify() consults the confirm-scan cache
- disconnected/unreadable panes answer null so the tail path still answers; only timeout is unknown
- check pane ownership before projecting the screen
- cache only recognized agents, so a not-an-agent verdict is rescanned
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(runtime): drop a titleless identity read if the pane rebinds; trim tautological tests
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(agent-status): show Claude/Codex panes waiting on the folder-trust dialog
Hooks only start after a folder is trusted, so a pane parked on Claude's or
Codex's trust dialog had no sidebar row (or an idle one) even though
agentWait already reported agent-trust-workspace. Main's headless-screen
observer now runs the same blocked-text detector on the screen and projects
a waiting row while the dialog shows, settling it with a session-boundary
done once the dialog leaves. The row is not first-party evidence: it skips
the prompt lifecycle and lastExplicitAgentStatus.
Refs #25854
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-status): match the live trust dialog's structure and settle on agent exit
Require the dialog's key footer and trust choice so quoted wording in a reply
cannot raise a waiting row, settle the row once a killed agent's pane is back
at a shell, and cover dismissal with a Codex 0.164 recording.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agent-status): settle the trust-dialog row only on positive evidence
ASCII-escape the dialog regexes for the orcad build, settle only after a quiet
settled screen without the dialog or a proven shell foreground (readLaunchedAgentForeground,
which is the only shell-alone proof on Windows), so a resize repaint split across
reads no longer flips the row and re-notifies.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(agent-status): move trust-dialog status projection out of headless hydration
Keeps headless-terminal-hydration.ts under the max-lines lint limit.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(agent-status): drive the trust-dialog settle window with fake timers
Co-Authored-By: Claude <noreply@anthropic.com>
* test(agent-status): drop the Codex dismissal capture the serializer fuzz rejects
Its replay trips known serialize I2 diffs; cover Codex dismissal with a composer
repaint over the existing 0.158 capture, and compare only appearance/absence.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(agent-status): track trust-dialog rows per PTY and clear on debounced screen reads
Keys state by ptyId so an emulator swap no longer strands the row, owns the
row by its receipt stamp instead of a toolInput tag, drops tracking as soon as
another writer replaces the row, and clears after two debounced reads without
the dialog instead of 3 s of total quiet.
* fix(runtime): clear the trust-dialog read timer when a screen read throws
---------
Co-authored-by: Claude <noreply@anthropic.com>
Claude background-job workers, and the `codex exec` runs they spawn,
inherit the dispatching pane's ORCA_* env, so the Codex hook posted
events against a pane the run never lived in. The Codex hook now exits
when CLAUDE_JOB_DIR is set, like the Claude hook already does.
The guard moves into agent-hooks/claude-background-job-guard.ts and is
shared by the Claude hook, Claude statusline, Windows Claude entry and
Codex hook. POSIX exits after stdin capture; Windows exits before
owning stdin so an abandoned stdin cannot hang the drain.
Pane spawns now drop an inherited CLAUDE_JOB_DIR so an Orca launched
from a Claude background job does not silence its panes' hooks.
Fixes#24516
Co-authored-by: Neil <neil@stably.ai>
JSON.parse silently keeps the last value of a repeated key, so the
catalog verifier could not see duplicates. Scan en.json and every target
catalog with ts.parseJsonText before parsing and fail with file:line and
the dotted key for each duplicate.
Fixes#27153
Co-authored-by: outof-place <contact@outofplace.space>
When the SSH session itself could not open (key rejected, port refused,
host not answering, host key not trusted), Connect on a host Orca had not
set up yet said "Orca couldn't start its server on this host" and offered
a plain SSH terminal that could not work either. Errors from opening the
SSH session are now marked where they are dialed, and a setup that fails
on one ends the connect with SSH's own reason. A held move keeps its
status. The connect-failure toast also drops Electron's IPC prefix.
cmd /c strips the first and last quote of a line that starts with a quote
unless exactly one quoted, paren-free executable path is present. A spaced
.cmd launcher plus any quoted argument (or a Program Files (x86) launcher)
was cut at its first space and the spawn silently failed. Prefix the batch
invocation with `@` so the line never starts with a quote, in both the
waiting and detached start /B forms.
Add a real cmd.exe round trip in the Windows CI lane.
Co-authored-by: Neil <neil@stably.ai>
Bare `brew upgrade --cask orca` resolves to the unrelated, disabled Plotly
cask in homebrew-cask. Add a warning and a qualified upgrade line to the
README install blocks (all locales) and qualify the upgrade command on the
docs site install page.
Fixes#14591
Co-authored-by: Neil <neil@stably.ai>
Agents that leave their OSC title behind on exit (grok, codex) never trip
the title-based exit, so ChatView stayed on top of the returned shell.
onConfirmedShellForeground now notifies onAgentExitedRef, except for
Orca's own hibernation stop, which keeps its chat surface.
Fixes#30613
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(terminal): skip an escape tail an abandoned hidden-output restore would print (#33766)
Main drops a hidden pane's renderer delivery after its model ingests the
bytes, so the first chunk sent on reveal can begin inside an escape whose
start was dropped. When the restore is abandoned, the renderer resets its
parser and writes the queued chunks, and xterm printed the tail (';242m',
the rest of a Codex OSC title).
Main tracks each PTY's escape state over every accepted payload and labels
the first delivery after a hidden or pending-cap drop with the escape it
resumes inside (gapEscapeState). Only the abandon path strips that
continuation; a successful restore keeps every byte so the snapshot's
pending escape tail can complete. No label means no change.
* fix(terminal): make the escape-continuation scan's switch exhaustive (#33766)
A disposed xterm silently drops its queued write callbacks, so replay
guards engaged on it never saw a parse completion. The stall probe then
certified a false wedge, logged a wedged-release breadcrumb and fired the
undeliverable-write recovery against a pane that was already gone.
Track each pending guard release per terminal and settle them with a
'target-disposed' reason from disposePane, and skip new replays into a
disposed xterm the same way certified-dead pipelines are skipped.
Co-authored-by: Neil <neil@stably.ai>
An explicit empty --terminal (or orchestration --from) was treated as absent,
so `orca terminal send --terminal ""` targeted the active pane and
orchestration check/inbox/worker-start fell back to the ambient
ORCA_TERMINAL_HANDLE mailbox. Hoist the existing getPresentStringFlag into
flags.ts and use it for these handles so a present-but-empty value fails with
invalid_argument.
Fixes#16694
Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: wusiyuan05 <wusiyuan05@zuoyebang.com>
* feat(open-in): open SSH workspaces in Cursor and Zed
Cursor shares VS Code's Remote-SSH argv and now opens SSH and SSH-reached
server workspaces the same way, in a new window like its local launch.
Zed opens them through its ssh://[user@]host[:port]/path URL, so manual
custom-port hosts work without a local SSH config alias.
Co-authored-by: zerone0x <soberzml2333@gmail.com>
* fix(open-in): keep manual Zed targets on their saved route
Always send the saved port for manual targets so a matching ssh config Port
cannot redirect them, ask for an ssh config alias when a manual host needs a
key, agent or proxy the URL cannot carry, reject option-like hosts, and accept
the zeditor CLI name.
* refactor(open-in): move the remote SSH editor launch into its own module
Keeps external-editor-launch.ts under the max-lines limit after the main merge,
and moves main's new macOS CLI fallback test onto the remote launch API.
---------
Co-authored-by: zerone0x <soberzml2333@gmail.com>
Browser-initiated beforeunload (Force Reload, reload) had no caller to surface
the checkpoint veto, so the reload silently did nothing. Show a reload-specific
failure toast naming the cause for trusted unload events; synthetic close and
restart dispatchers keep reporting their own verdict. Paired web skips the toast
since trusted unloads there also cover tab close/navigation and the browser's
leave prompt already reports the veto.
Fixes#21017
Co-authored-by: Claude <noreply@anthropic.com>
* fix(persistence): a paired server's workspaces keep their saved tabs across desktop restarts
Main's per-repo terminal topology revision fences window saves so a stale save
cannot undo main's own membership change. The window never sends revisions, so
on a runtime partition, which mirrors a paired server, one removal or main-side
close froze every workspace of that repo: from then on each window save had its
terminal rows rebased onto the prior rows, and every restart reopened those
workspaces on the server's per-device tab pick.
On runtime partitions the fence now lasts only through the race it guards: a
repo main changed is fenced for RUNTIME_PARTITION_TOPOLOGY_FENCE_MS, then the
window's saves win again. Local and SSH partitions keep the permanent fence.
* test(persistence): pin that a window save can drop a tab the server closed after a restart (#21236)
* fix(persistence): fence the retirements the sanitizer makes from legacy tombstones on runtime partitions
* feat(ssh): per-host Reconnect on launch toggle
A host with Reconnect on launch turned off starts each launch as if the user
had disconnected it: main records the session user-disconnect for it and the
managed servers reached through it, so neither the startup restore, pane
mounts nor managed-server calls dial it until the user connects it. The
renderer also skips it in the startup restore. The switch lives in Settings ->
SSH -> Advanced for hosts this desktop dials; undefined keeps today's behaviour.
* fix(ssh): hold opted-out hosts before server status probes start
Server status probes start inside registerCoreHandlers, before the SSH
handlers register, so hold launch opt-outs right before it (once per
process). Relay-era panes that hit a held host now wait for Connect instead
of reporting a failed connect.
`orca environment add` writes the saved-server file directly. Main already
watched that file but only repaired the Active Server preference, so every
renderer surface listing saved servers (the Agent Session History host
picker, host menus, the status bar) kept the old list until something
else refreshed it. Main now tells every window when the file changes, and
the renderer refreshes through the existing coalesced catalog refresher.
Co-authored-by: Tian-yi Liang <tianyilt@qq.com>
SendKeys presses Shift for an uppercase letter (VkKeyScan reports the
shift state), so `orca computer hotkey --key CmdOrCtrl+A` (the documented
example) sent Ctrl+Shift+A on Windows. Lower-case a single-character key
when the hotkey has modifiers; Shift is still sent when written explicitly.
Extract ConvertTo-OrcaSendKeysHotkey so runtime-render.test.ps1 can assert
the SendKeys strings case-sensitively.
Fixes#27589
Co-authored-by: jespo2021 <joeespo@gmail.com>
Co-authored-by: Neil <neil@stably.ai>
* fix(ssh): move through the remote folder browser with the arrow keys
The browser had no highlighted row and its filter box ignored Up/Down, so
the keys only scrolled the list. The first entry is now highlighted, the
arrows move it into view, and Enter opens it. A filter that leaves one
folder still starts on that folder, and a fully typed path starts on no
row so Enter still goes to that path. Also drops the duplicated
"No matches" line.
Fixes#31555
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Name the remote folder listbox and point at no row while a listing loads
While a listing loads only the spinner renders, so the highlight and
aria-activedescendant had been left on rows that were no longer there.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Keep Enter and the highlight off rows that are about to be replaced
While the committed listing loads, Enter fell back to the previous
listing's entries and could open a folder from it. While a path preview
resolves, its prior rows stay visible but are no longer targetable, so the
highlight and aria-activedescendant now clear. The filter input also gets
combobox semantics and a name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ssh): drop a moved highlight when a typed path previews the same listing
* fix(ssh): reset the folder highlight per keystroke and hold Enter until a typed path resolves
* fix(ssh): hold Enter on typed path input before its first preview
---------
Co-authored-by: Younghwan Chae <chyohw97@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(repos): prune a restored folder owner once its own host's catalog answers
One unreachable remote used to skip the restored-owner prune for every
workspace, so a local folder workspace stayed pinned to a dead runtime for
the whole session. Each host's applied catalog now counts on its own; a
missing workspace's owner is dropped only once that owner host hydrated.
Rebased from #11285 onto current main.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* fix(repos): only the owner host's copy or catalog settles a restored folder owner
Folder ids can repeat across hosts, so a same-id copy on another host no
longer clears a runtime's restored owner before that runtime answers; an
owner the environment list no longer names counts as settled.
* fix(repos): a superseded all-host load's environment list settles no restored owner
---------
Co-authored-by: MarkXian <mark-xian@foxmail.com>
Each test resets modules and re-imports main-process-ready to reset the
browser session registry's one-shot latch. Without a static import, the first
tests paid the cold transform of that graph inside the 30s test timeout and
timed out under CI load; later tests re-evaluate cached transforms in ~200ms.
#33919 and #33923 both fixed this file's cold-import timeout and crossed: #33923's beforeAll calls switchedBuild, which #33919 replaced with static imports. Main fails typecheck (TS2304). The static imports already pay the transform once.
A startup command embedded in the PowerShell -EncodedCommand payload runs
before the first prompt, and the prompt wrapper suppresses 133;D until it
has printed once. An agent launched this way exited with no
command-finished boundary, so its pane was never retired.
Emit 133;C before the embedded startup command and prime the prompt latch
so the first prompt reports 133;D with the exit code. Stdin-typed startup
commands keep readline's own marks. The encoded-command budget grows by
the mark's size so real commands keep the prior limit.
Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
* test(layout): load the runtime graph once before the layout capability tests
The first test paid the cold transform of the whole runtime graph inside its
30 s budget and timed out whenever a shard placed it without warm neighbors.
* perf(orcad): keep SSH hosts on the 10-minute scanner idle, give WSL hosts 3
Retiring the idle session scanner after a minute cost the next scan of a
large history ~14 s. SSH hosts have no memory budget to justify that, so
they return to the scanner's default; WSL hosts, which do, wait 3 minutes.
The first test paid the cold transform of the whole runtime graph inside its
30 s budget and timed out whenever a shard placed it without warm neighbors.
A repo-only Settings deep link (sidebar "Project Settings") recorded just the
entry and host, so when one entry holds two setups on the same host (e.g. a
Windows and a WSL clone of one remote, or a provisioned plus a user clone) the
pane resolved the host's first setup and showed the other clone's settings.
Carry the setup id like the explicit-host path already does.
Addresses #11689.
Co-authored-by: Neil <neil@stably.ai>
Worktree session owners are removed by their raw id, but activeWorkspaceKey
stores the canonical worktree:<id> form, so deleting a worktree left the
persisted active key pointing at the removed workspace in every partition.
Match both forms in deleteOwnerKeyedSessionFields so every owner-removal
path (worktree delete, repo pruning, invalid-layout purge) clears it.
Co-authored-by: Neil <neil@stably.ai>
* fix(native-chat): say why Claude refused to start a chat, including Full access as root
Claude Code exits before initialize when Full access (--dangerously-skip-permissions)
meets a root uid, which is common on SSH hosts. Orca reported only that Claude
stopped before it finished starting, and retried four times. Classify that refusal
as fullAccessAsRoot with a next step, and show the CLI's own startup words behind
Details on the failure row and on the unsent message.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(native-chat): keep message Details to start failures; cover the exit path
Route the exit-error module and delivery notices to the managed e2e, explain its
timeout, and drop the exec non-null assertion. Match the zh Full access label.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(native-chat): type the refused fixture so the web typecheck passes
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
The layout-owner tests reset modules and re-imported orca-runtime, the
dispatcher and the full RPC registry inside each test. Under CI load the
cold transform of that graph exceeds the 30s test timeout. The capability
check reads the switch at call time, so it only needs a flipped getter; the
window-owned registration check uses the default (switch-off) registry.
EvgeniiandNeil
Trevor SmithandNeil
Naveen ChatlapalliandNeil
arookieofc
JunandNeil
CIS2042andNeil
MeapriandNeil
Wooseong Kim
Jacob HonoréandNeil
Konstantin StasenkoandNeil
Tae Hyeong, SonandNeil
zhangxaochenandNeil
Daniele SolombrinoandNeil
hwantageandNeil
Anddy Sahir AgudeloandNeil
audichuangandNeil