* fix(ssh): a bridged pane reattaches after a disconnect instead of going deaf
* fix(ssh): a bridged pane asks again when it turns live during an earlier ask
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
Publish Linux Wayland text copies with an independent clipboard owner, then clear Chromium's stale source only after publication succeeds. Use data control where available and GTK's clipboard bridge on GNOME. Keep macOS, Windows and X11 on their existing Electron writers.
Temporary workaround for https://github.com/electron/electron/issues/54645, with removal checks documented in the native README.
Verified full build, macOS arm64 packaging, Linux x64/arm64 library floors, clipboard/platform tests, real Wayland copy/paste and CI packaging.
Fixes#26917Fixes#23229
* wip: legacy relay bridge client
* Revert "fix(ssh): end an older Orca's relay terminals from the connect refusal (STA-10166) (#27748)"
This reverts commit d4a55f583e.
* feat(ssh): bridge terminals an older relay still runs into their old tabs
* test(ssh): cover the legacy relay bridge client, target bridge, transport and gate
* test(ssh): type the bridge test fakes without assertions
* test(e2e): a 1.4.224 relay's live terminal survives the upgrade on a Docker SSH host
* ci(e2e): route legacy relay bridge changes to its Docker spec
* fix(ssh): bridge delta moves too, and never read a non-exhaustive relay listing as exit
* fix(ssh): keep retrying a bridge for panes that mount before connect; end panes proven gone
* fix(ssh): bridge 1.4.224's detached leases through export preflight; publish every leased pane before the first look
* test(e2e): build the released relay out of process so Playwright never loads ESM build tooling
* fix(renderer): drop the recovery hook main removed from PtyTransport
* test(e2e): show the converted worktree before reading the bridged tab
* test(e2e): reconnect and wait for the converted host before opening the bridged tab
* fix(renderer): match bridged leases to tabs mirrored from the managed server
* test(e2e): find the mirrored relay-era tab under any worktree key
* test(e2e): open the converted worktree before looking for its mirrored tab
* test(e2e): a retired lease is terminated or pruned
* fix(ssh): back off attaches a listed terminal refuses; one pane per bridged shell
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(native-chat): show a finished resume as a result, not a picker
Once a resume starts and no chat is left to choose, the dialog drops the
Select all row and the checkbox column, so each chat's check reads as its
status instead of a ticked box. The Don't-ask-again box only shows while
choosing; a run started by the launch's auto-resume says so and links to
the setting. The finished description is past tense.
* fix(i18n): keep Agent untranslated in the ja resume copy
* fix(native-chat): keep resume results actionable and keyboard accessible
* Fix hidden resume preference replay after run starts
* Consume resume picker preference after applying it
* fix(native-chat): keep Don't ask again after Resume while auto-resume is off
The box now shows on the result view too whenever the setting is off and the
user started the resume, and saves only while it is visible, so a hidden tick
still never replays. Automatic launches keep their 'Resumed automatically'
note instead.
* feat(mobile): let the OTA page send extra top-level request fields
A page request could only carry method, params and three fixed options, so any new
top-level wire field needed a new app binary. Requests and subscribes now carry an
optional verbatim `envelope`, gated by a new `rpcEnvelope` grant; nothing sets it yet.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): one envelope merge seam per transport
Review follow-up: the direct tracker and registry now hand frames to a single
sendFrame that adds the credential and envelope, like the relay; page refusals
use one fixed code per error class and an envelope-only options bag posts no options.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): refuse a non-object envelope before treating it as empty
null threw synchronously and [] or a Date read as empty and was dropped; the schema
now runs first. The tracker tests settle their requests instead of leaving timers.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): type the direct socket's request as the wire request
The typecheck now proves every direct request carries the transport fields, and the
native-verb fence says why it drops an envelope. No behaviour change.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
In shells that send no command-finished mark (cmd.exe, Git Bash), quitting
Claude or Codex left the pane's live agent row behind: the pane's process
monitor confirmed the exit, but only the OSC 133;D path ever dropped the row.
The monitor's confirmed exit now arms the same drop and main-side reconcile
pair a confirmed 133;D uses, settled behind the existing host-verifiability
gate: a pane whose owner process the host can verify keeps the host's
decision; every other pane drops the row and keeps its resume identity.
Skipped when a 133;D drop is already armed, for remote panes, and when the
row belongs to another agent.
The terminal tab menu found its conversation through the tab-title lookup, which also
falls back to retained and sleeping records an exited agent leaves behind. Pass a
running-agents-only option for the move; tab titles keep the remembered conversation.
* perf(ports): run lsof without blocking on dead network mounts
Without -b, lsof stat()s every mounted file system before answering. A
hard-mounted network share that stops responding blocks that call in the
kernel, so each port scan left an unkillable lsof behind. Pass -b -w to
the lsof queries that name no file (port list, process cwd, executable
path); their output is unchanged. The -U and +D queries keep stat
because -b makes lsof reject named-file arguments.
Linear: STA-9017, STA-9716
* perf(ports): name the stuck lsof helper in the comment; plain readiness test name
* test: query a known child executable in lsof readiness smoke test
Move the 52 non-runtime, non-ipc importers of src/main/providers/types.ts
onto the per-domain contract files. The barrel itself stays until the
runtime and ipc importers move (3.4b/3.4c).
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(daemon): opt-in OS ceiling on terminal processes, reported on or off per host
* fix(daemon): verify the ceiling is enforced, reap its slice with the daemon, and keep terminals starting when systemd-run is unusable
* fix(daemon): stop the ceiling slice before the daemon scope, and report a dropped slice as lost
* test(daemon): expect the pid record's processCeiling field
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* test(chat): snapshot every native-chat agent's spawned child as a parity oracle
Captures the exact child each native-chat agent spawns (Claude, Codex, Grok,
OpenCode, OMP, Pi), worktree and floating, fresh and resumed, plus a registered
worker with visuals off, at the real spawn boundary (the process host's spawn)
and through production's own host dependency wiring. The inherited environment
holds every pane, hook, caller, terminal-handle and visuals key a parent Orca
pane could hand down, so the snapshot records today's per-agent differences as
they are. Each case also records the launch's permission posture, which for
Codex (thread policy) and the ACP agents (full access) acts only after spawn.
Each agent also runs fresh and resumed with every launch setting moved off its
default: a Command setting naming another binary, the permission posture
flipped, an environment overlay over inherited and shell keys, and only named
login-shell variables inherited (the fake login shell carries its own PATH and
a variable no case names).
A second test fails when a registered agent has no snapshot, since the oracle
lists its agents by hand.
Test only: the launch-path refactor that follows must leave both tests and the
snapshot file unchanged.
* refactor(chat): one composed launch for every native-chat agent
Every native-chat agent (Claude, Codex, Grok, OpenCode, OMP, Pi) now builds its
child through one composer instead of six hand-written resolvers. Each agent
contributes only its own part (command, args, agent env, keys it must strip);
the shared composer admits the session record, reads the launch directory,
base environment, launch overrides and visuals once each (memoized, in the
agent's original order), sets cwd, and seals the child.
The seal (sealStructuredSessionChild) is the one place that names a child:
session id, structured marker, worker terminal handle, the Orca CLI env, the
spawn token under one shared constant, and the per-launch list of inherited
keys to delete, minus any key the seal itself sets. Claude's delete list now
reaches its SDK spawn after buildClaudeChildProcessEnv's merge.
Behaviour is unchanged: the parity snapshot from the previous commit passes
byte for byte, including each agent's existing differences (Claude and Codex
keep inherited pane and hook env, Pi has no visuals and always full access,
the ACP history read stays unsealed). Admission refusals keep their reasons;
only log-only wording moved to the shared check.
Drops launch dependencies no production caller wires (resolveLaunchEnv,
resolveCodexOverrides) and folds the per-agent env overlay hooks into the
existing resolveAgentLaunchEnv.
* refactor(chat): only the seal names a native-chat child
Follow-ups from review of the composed launch:
- The spawn token is required on every resolveLaunch. The one read that
starts no child, ACP's restart-recovery history read, now has its own
path (composeStructuredLaunchRead, deps.readLaunch) that returns the
agent's own env unsealed, as before. Agent parts receive the session
identity only, never the token.
- structuredSessionChildIdentityEnv is gone; the seal is the only way to
build a child's identity env, and tests go through it.
- A launch's environment is the runtime's resolveAgentEnvironment, so the
base-plus-overlay rule exists once.
- Claude's connection test now covers a non-empty envToDelete applied
after the inherited env is merged.
No change to any spawned child: the parity snapshot is unchanged.
* ci: run the login-shell contract job for the renamed child-env seal
The seal moved from structured-session-child-identity-env to
structured-session-child-env, but the PR job classifier still listed the old
path, so a change to only the seal would skip the live login-shell contract
job. The prefix now covers the seal, its test and its test support (which
the login-shell harness imports).
* Add host-owned agent launch settings mutations
* Edit agent launch defaults on the selected execution host
* Await durable writes for host agent launch settings
* Fence agent detection by execution-host pairing
* Acknowledge host settings before hook reconciliation
* Preserve Reset after pending agent launch saves
* Simplify agent detection re-pair handling to the clear and the transport fence
A re-pair already clears every detected-agent list, flag and pending probe for
the environment, so the per-record pairing owner keys, the owner-keyed pending
probes, the settle-time pairing checks and the hook's ownership gating were
never reached. Detection now captures the pairing before the capability wait
and fences its RPCs with it; the refresh fallback still refuses after a
re-pair. Pins the fence across a capability wait, the needs-update clear, and
the agent-launch RPC permission levels.
* Open launch settings on the Active Server without the focus-routing helper
Main's new owner-routing ratchet counts getActiveRuntimeTarget calls, and this
pane's no-workspace default added one. It now reads the Active Server field the
way the Agents pane did before host selection, so the default is unchanged.
* Re-probe mounted launch surfaces after a re-pair; rely on the transport fence for the refresh fallback
A re-pair clears an environment's detected-agent lists, but a mounted tab bar,
quick launch or composer that was still waiting for its first list (or whose
first probe had failed) never asked again, leaving "Can't reach this
workspace's host" until another surface mounted. The hook now re-runs its
effect when the target environment's pairing revision changes.
The refresh fallback no longer re-checks the pairing in the renderer: it
already carries the pairing captured before the wait, and main refuses any
mismatch. Pins the Settings host form's remount key on re-pair.
* refactor(terminal): one remote input hold
* fix(terminal): keep restored typing scoped to its terminal until the connect settles
* refactor(terminal): name the restored-input expectation type
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(serve): orca serve service install|status|uninstall for launchd and systemd user units
* fix(serve): redact pairing secrets in the supervisor instead of an inherited env, validate the port and launcher at install
* fix(serve): keep the redaction module off a direct child_process import
* fix(serve): redact the JSON readiness offer and survive a closed log pipe
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(ssh): end an older Orca's relay terminals from the refusal, and name the command
* test: type confirmation mocks
* fix(ssh): match old relay daemons by argv position; owner-check the Windows command
* fix(ssh): select Windows relay daemons by argv position in the manual command
* fix(ssh): keep the relay daemon marker local so census mocks stay intact
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* test(launch): pin what the "+" launchers and the AI buttons' window route produce on main
Row 1 ("+": menu, shortcut, dashboard) joins the window-tab table on both halves;
saved-arg tokenize failures before routing, the restart of a never-mounted "+" tab
and the AI-button host gate are pinned at the window planner.
* test(launch): cut "+" pins main already holds and check outcomes, not internals
Drop the AI-button and restart tests and the duplicate \\wsl$ folder and macOS
unclosed-quote rows; the Q5 pair now checks that no tab or startup was made.
* feat(updater): auto-park registered serve supervisors during a desktop install
* test(serve): drop a type assertion in the bundle park test
* fix(updater): stop any server started during an install hold and re-list blockers right before commit
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* Share immutable historical source across local cross-version test caches
* Add preview-first cleanup of old historical test caches
* Include historical test cache cleanup in worktree space maintenance
* Report and retain read-only Electron installs during cleanup
* Protect read-only installs under root and isolate cleanup CLI fixtures
The orcad/remote-install transport now exposes exec as a neutral
RemoteCommandChannel (a Duplex with stdin, stderr, close and exit/close
events) instead of ssh2's ClientChannel, and drops sftp(): the only
consumer was a fallback for doubles without writeFile/uploadDirectory,
which the transport type already requires. SshConnection still satisfies
the type structurally, so the SSH adapter keeps returning the connection
itself and identity-keyed caches are unchanged.
The stdio bridge provider is split: the loopback listener (admission,
queueing, socket piping) now takes a channel factory and knows nothing of
SSH; the SSH provider resolves and checks the bridge over the host
transport and hands the listener a factory. No behavior or wire change.
* Skip unnecessary compatibility-boundary parsing and benchmark it in CI
* Use pinned preflight Bun for compatibility checks and localization extraction
* Measure two concurrent Bun projects in full preflight and update its scope test
* fix(chat): jump to messages without scrolling animation
* Jump to chat messages instantly instead of animating the scroll
Smooth scrolling let rows measured mid-animation shift the target, so jumps could land short or cancel near the end of the transcript. Jumps now write the scroll offset directly, and the align hook keeps its target until the row settles. Tests assert no smooth scroll is requested and that a loaded target lands within one frame.
* fix(bench): make the idle-CPU benchmark run and report CPU on Windows
Three independent Windows defects in the idle-CPU benchmark (its report is
what Windows performance work would cite):
- `buildAppIfNeeded` spawned `npx`, which is `npx.cmd` on Windows, so
execFileSync failed with ENOENT before any sampling. Build through
`config/scripts/run-electron-vite-build.mjs` instead — the repo's own
Windows-safe wrapper, which also runs the boot-graph verification.
- `readWindowsProcesses` returned `cpuTimeSeconds: null`, so the sampler's
per-process CPU delta (idle-cpu-process-sampling.mjs:198) fell back to
the hardcoded `percentCpu: 0` and every CPU KPI in the report was zero.
Read `UserModeTime`/`KernelModeTime` from `Win32_Process` (100 ns units)
and keep `null` when a host does not return them.
Measured on Windows, same options before and after the CPU fix:
| class | mean CPU before | mean CPU after |
| --- | ---: | ---: |
| renderer | 0 | 2.20 |
| gpu | 0 | 2.08 |
| utility | 0 | 0.11 |
| agent-or-node | 0 | 0.06 |
| total | 0 | 4.51 (p95 8.40) |
RSS is unchanged (934 MiB -> 937 MiB), so only the CPU reporting changed.
Refs #25235
* fix(bench): reject a missing Win32_Process time instead of reading it as zero
Review follow-up (CodeRabbit). `Number(null)` is `0`, which is also a real
counter value, so an absent `UserModeTime`/`KernelModeTime` passed the
finite check and the sampler would report a kernel-only delta instead of
taking the fallback. Require an actual number from the CIM payload.
Verified on Windows that the real payload still reports CPU once the check
is tight: total mean 4.40%, p95 14.48%, renderer 3.51%.
* test(bench): cover the Windows CIM CPU time mapping
The mapping was only reachable through Get-CimInstance, so no test ran it.
Lift it into cimCpuSeconds and assert the 100ns-to-seconds sum plus the
missing / string / non-finite cases that must stay null.
* fix(bench): read the Windows process table as UTF-8 so JSON.parse survives
PowerShell writes to a redirected stdout in the OEM code page (437 here),
which best-fits characters such as U+2022 and U+2192 in any running
process's command line to raw 0x07 / 0x1A bytes. ConvertTo-Json had left
them unescaped because they are not control characters in UTF-16, so the
sampler's JSON.parse failed with "Bad control character in string literal"
whenever such a process happened to be alive -- hence intermittent.
Set [Console]::OutputEncoding to UTF-8, as the app's own CIM scan does,
and cover it with a Windows-only test that fails without the fix.
Fixes#25236
* fix(bench): pass the local runtime to fetchRepos in the idle-CPU fixture
fetchRepos now requires a runtimeEnvironmentId, so the fixture's bare call
threw "Cannot read properties of undefined (reading 'runtimeEnvironmentId')"
before sampling on every platform. null selects this app's own catalog, as
the e2e helpers already do.
* ci(bench): run the Windows process-table test in the Windows lane
The UTF-8 regression test self-skips off win32, so it must be registered in
both Windows lists or it runs on no machine.
---------
Co-authored-by: Paolo <paovalletta@hotmail.it>
Co-authored-by: Orca Worker <orca-worker@localhost>
* fix(bench): resolve dynamically imported sources as file URLs
`await import(path.join(ROOT, '...ts'))` hands Node a bare Windows path
(`C:\...`), which the ESM loader rejects as an unsupported URL scheme
("Received protocol 'c:'"). The two benchmarks that load production
modules this way crashed on Windows before running a single scenario,
while working on macOS and Linux where an absolute path is a valid
specifier.
Wrap each computed specifier in `pathToFileURL(...).href`, the form the
other benchmark scripts already use for the same purpose.
Verified on Windows: bench:session-write-hot-path and
bench:agent-inspection-cadence now run and print their measurement
tables. The fish mode-2031 trace capture resolves its import too, but its
harness targets macOS/Linux shells and cannot complete on Windows.
Fixes#25235
* style(bench): format the session-write benchmark's file-URL import
---------
Co-authored-by: Paolo <paovalletta@hotmail.it>
Co-authored-by: Orca Worker <orca-worker@localhost>
* feat(serve): supervised mode for orca serve --supervise
Restart the server with jittered backoff instead of exiting when it dies,
with a crash-loop brake whose exhaustion is durable per profile and build,
an install hold while the executable is missing or ShipIt replaces the
bundle, and standby while another Orca serves the profile. Only an
explicit --supervise turns it on; Windows refuses it for now.
* fix(serve): let a supervised orcad serve wait for a live peer instead of counting it
* fix(serve): gate update replacements on the install hold, honor stop during the bundle wait, keep a give-up while the executable is missing
* fix(serve): hand a removed executable back to the service manager and key the brake on the app archive
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(wsl): stop booting stopped distros from background work
Any `wsl.exe -d` (or \\wsl.localhost access) boots a stopped distro: 1-2s of
VM boot, and on WSL < 3.0.1 its later idle-stop wipes the VM-wide WSLInterop
binfmt entry for every other running distro (microsoft/WSL#13885).
Add one gate (wsl-background-distro-gate.ts): background work checks
`wsl --list --running` (never boots), and stopped-distro work can be deferred
until the distro is next seen running (a confirmed running probe or a local
WSL terminal spawn).
- Startup CLI registration reconciliation: only running candidates; stopped
ones are deferred per distro and stay registry candidates for later starts.
- Fish history GC: keeps the tombstone (and its meta.json) while the distro is
stopped and finishes the cleanup once it runs; no admission slot is held.
- Codex/Claude/Kimi quota polls for WSL targets: skip while stopped (Codex
keeps its last value). User-driven resets still boot.
- Codex WSL auth drain before an update restart: skip stopped distros (no
live legacy pane there; the next launch prep drains anyway).
* fix(rate-limits): capture the Codex fetch generation before home resolution
The Codex home resolver is now async (it checks whether the WSL distro is
running), so a reset that lands during that await bumped the generation the
full-refresh cycle then read as its own, letting a stale result overwrite it.
Co-authored-by: Syed Zohaib Hussain <26768511+RoxasZohbi@users.noreply.github.com>
* fix(wsl): read an unconfirmed running-distro probe as stopped in the background gate
* test(wsl): pin the empty running list wsl.exe reports when no distro runs
---------
Co-authored-by: Syed Zohaib Hussain <26768511+RoxasZohbi@users.noreply.github.com>
* fix(native-chat): put chat text on one type scale that follows Text size
Sizes were picked per component, so the same kind of row came out 12, 13 or
14px and the Text size setting reached only a few of them.
* fix(native-chat): scale chat spacing and icons with Text size
Icons and gaps stayed fixed while text grew, so at larger sizes they looked
undersized and sat off-centre.
* fix(native-chat): implement PR #26685 review fixes
- Scale row gap with text size so controls don't overlap
- Clamp 'Match terminal interface' to 12-20 for labels/controls
- Use existing --status-warning token for warning color
- Rewrite stale test for scaled typography tokens
- Use app colors for in-progress tasks in composer dock
* fix(native-chat): leave the task list's dock colour as it was
* fix(native-chat): message text follows the terminal size; controls and spacing stay in 12-20
* test(native-chat): labels and spacing follow the bounded chat size; main's new notice test uses the chat colour
---------
Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
* refactor(startup): one agent-hook runtime binding set for every host
* fix(startup): read the hooks-enabled gate from its shared module
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
The relay runtime ladder (rungs A/B/C/legacy/D, its self-test, refusal
cache, per-host decision store and its telemetry) lost its only caller
when the relay was deleted. Two pieces were still live: picking the Node
runtime a host can run by glibc (managed orcad deploy, WSL guest
runtime) and the runtime-store pins orcad version GC keeps. Those move
to pinned-runtime-host-target.ts; pick/durationBucket move into
ssh-host-server-telemetry.ts, their only remaining user.
Co-authored-by: m4air <m4air@Mac.localdomain>
* perf(wsl): run ripgrep on the Windows host for drive-path projects
A project stored on a Windows drive (C:\...) with the WSL runtime selected
ran quick open, file-path search, content search and Markdown listing
through wsl.exe and the Linux rg reading /mnt/c over drvfs. rg only reads
files, so it has no git index whose stat cache two writers could thrash;
the host binary reads NTFS directly.
Measured on a 21.6k-file clone on C: (Windows 11, Ubuntu-24.04):
content search WSL rg 3.5 s -> host rg.exe 0.19 s
file listing WSL rg 0.14 s + ~65 ms wsl.exe spawn -> host 0.03 s
Git routing is intentionally unchanged: alternating Windows git and WSL git
on the same index forced a full ~250 s rehash on the next WSL git status.
WSL UNC roots and non-drive roots keep their existing routing.
* fix(search): keep host rg results whole when files only WSL can open exist
Windows rg cannot open a 'nul' file, Win32-trimmed names, or WSL-created
symlinks; treat those per-file errors as skipped rather than failing or
truncating the search, and keep symlink-following scans in WSL.
* feat(relay): declare Asia spare cell c35 as migration-only
Adds a seventh asia-east2 cell at the C34 shape (cap 3000, 6000 request
units, pool 16, e2-standard-4) in asia-east2-a, pinned to image F. It gets
its own topology and registration wave but no promotion wave, so the
admission script and workflow refuse to promote it; it stays a
migration-only spare and out of the fleet pool list. Mirrors #25336.
* test(relay): accept the c35 spare under the same-cap capacity allowlist
The switchers and the shared gh/glab preflight resolve the focused workspace's
owner row (getActiveWorkspaceOwnerTarget, which has no focus fallback) and fall
back to the default scope host only when nothing proves an owner. The task page
and Automations ignore a preflight whose context key names a paired server.
* refactor(daemon): share the cold-restore payload builder
Lets a reader outside the adapter build the same saved-screen payload from
history without spawning.
* feat(daemon): hold restored terminals a newer build's daemon may still run (STA-9257)
After a downgrade, an older build cannot adopt a newer-protocol daemon, so it
cold-restored that daemon's terminals under the same ids and resumed their
agents beside the originals. Startup now classifies newer-protocol pid records
in this profile's runtime dir as live, unverifiable or exited, and pty:spawn
refuses a restore no adopted daemon owns while one is live or unverifiable.
Reopen stops the newer daemon by verified signal only and reports success only
once its pid is confirmed gone.
* feat(terminal): show held restored panes read-only with a Reopen banner (STA-9257)
A pane refused for a newer daemon shows its saved screen read-only under a
pane-top warning. Reopen terminal stops the newer daemon and releases every held
pane through the existing reattach path, then toasts what actually reopened and
resumed; an unconfirmed stop reopens nothing and offers Try again.
* refactor(daemon): hold newer-daemon restores at the router, one classifier (STA-9257)
The hold moves from the pty:spawn IPC handler into DaemonPtyRouter.spawn so
every spawn source (IPC, runtime controller, mobile refresh, CLI) refuses a
cold restore of an id no adopted daemon owns while a newer daemon is held.
Discovery and stop share one classifier; an unidentifiable owner settles by
whether its endpoint accepts a connection, so a dead leftover never holds a tab
forever. Main announces a confirmed stop to the renderer.
* fix(terminal): per-pane failed state, one release path, no repeated screen (STA-9257)
A pane held after a failed Reopen shows the held state. Held panes also release
on main's stop announcement, with one toast only from the clicking window. A
pane whose saved buffer the layout restore already painted skips the history
screen and is not cleared on release.
* refactor(terminal): drop the release event, await the router hold, one phase per pane (STA-9257)
The release announcement only reached the window that clicked, which already
releases on its reply, so it is removed. The router hold check is always
awaited; three router tests released the adapter spawn before the router had
reached it and now wait for it instead. Each held pane carries its own phase.
* refactor(terminal): trim the newer-daemon hold, keep paired panes out of it (STA-9257)
A paired host's refusal is now an ordinary error: holding it locally looped,
since this window cannot stop that host's daemon. The history-screen read is
gone (the layout restore already paints saved output), discovery folds into the
hold module, the hold store uses zustand, the reattach returns its outcome so a
fresh-session fallback counts as reopened, and the toast uses plural keys.
* feat(terminal): show a held local pane's saved screen read-only (STA-9257)
Local daemon-backed panes keep no layout buffer, so a held pane was blank. Main
reads the session's saved screen from history without spawning and the pane
paints it read-only, unless the layout restore already painted the pane; it is
cleared before the normal reconnect.
* fix(daemon): re-probe a timed-out newer-daemon endpoint before holding (STA-9257)
* feat(terminal): count held panes in the reopen label, add Dismiss (STA-9257)
OrcaWinandm4air
Neil
Brennan Benson
Jinwoo Hong
github-actions[bot]
Jinjing
Kelvin AmoabaandBrennan Benson