Codex account re-auth no longer signs the account out on cancel/failure: `codex login` revokes and deletes existing auth before it starts, so re-auth now logs in inside a staging CODEX_HOME and copies auth.json in only on success. Listing accounts relabels a host account whose auth.json identity no longer matches its saved record.
Fixes#10795Fixes#22284
Supersedes #11852
Co-authored-by: Rod Boev <106971+rodboev@users.noreply.github.com>
Opening a workspace while its local creation is still pending no longer seeds an idle terminal that steals focus from (or drops) the agent launch: the creating event carries the new workspace id, activation during creation shows the existing "Creating worktree…" panel, and the workspace takes over when creation finishes. A terminal the user explicitly opens is kept and the agent gets its own tab.
Fixes#25807
Supersedes #25812
Co-authored-by: Eotel <49769982+Eotel@users.noreply.github.com>
Resuming a Codex session on Windows no longer fails with a misleading credentials error: Codex reports a resumed rollout path with a \\?\ prefix, and the legacy migration, account-restart move and selected-account repin now share codexDatedRolloutRelativePath (the trust check's normalisation) instead of comparing against the plain sessions root.
Fixes#27200
* test: tighten transport, recovery, and diagnostic checks
* test: use at for last mock socket access
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The WSL hook relay now also tries the Node Orca installs for its WSL server (~/.orca-remote/runtimes/node-*) after any system Node, test-running each candidate, so distros without their own Node get in-distro agent status instead of the slow fallback and the repeating "no node >= 18" warning.
`worker-start --terminal` can reuse an idle native-install Claude worker on macOS again: when the cached foreground name isn't a known agent, shell or wrapper (e.g. Claude's `2.1.310` version-named binary), the presence check does one awaited fresh process read (the same read message sending uses, #18238) before refusing.
Fixes#32090
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
* test: strengthen transport recovery and benchmark assertions
* test: use preferred array type in reconnect fixture
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
A Codex terminal worker whose remote app-server reconnect fails no longer hangs its orchestration dispatch forever: Codex's reconnect-failed error cell (column-0 U+25A0 notice, detected on the settled screen via the shared Codex notice tracker, Codex panes only) fails the active dispatch with stage agent_session_lost and escalates to the coordinator; the terminal stays open.
Fixes#24791
* fix(terminal): keep desktop history in main's copy after a phone or paired desktop subscribes
A phone subscribe rebuilt main's hidden copy of a pane from the phone
snapshot (at most 1000 rows, or the screen alone under the byte budget),
so a later desktop reveal repainted the pane truncated again. Seed the
copy from a desktop-depth renderer read of the same sequence instead,
falling back to the phone snapshot if the renderer moved on.
Paired desktop clients' initial snapshot now carries desktop depth within
the 2 MB requested-snapshot budget, matching what their reveal snapshots
already allow; phones keep 1000 rows and 512 KB. The headless emulator's
default scrollback now names the shared desktop default.
* fix(terminal): publish the phone recovery before deepening main's copy
The desktop-depth read ran before the late-renderer recovery's sequence
check, so output during that read aborted the phone recovery and left the
phone blank. Keep the original order (check, seed from the phone snapshot,
publish) and deepen main's copy afterwards, only while no output has
followed. Paired desktop initial snapshots keep a margin under older
clients' 2 MiB cap (1.75 MiB) and step down through 2500 rows.
* revert(terminal): keep paired desktop initial snapshots at 1000 rows
Deeper first snapshots cost every pane on every reconnect; a lazy
background top-up is the follow-up design. This PR keeps the phone
recovery's hidden-copy fix and the shared scrollback default.
* test(terminal): build the late-renderer runtime fake with checked types
An idle saved Claude account whose ~8h access token lapsed (Orca never refreshes Claude logins; the CLI does on its next run) keeps its last-good usage for up to 24h and reads "Updates when Claude runs" instead of "signed out". Logins that can't recover (no refresh token, expired refresh token, or a revoked 401) still ask to sign in again, and the status bar keeps its warning icon when shown usage is over 30 minutes old. Kept snapshots drop windows whose reset has passed.
Fixes#30289
Supersedes #31105
Co-authored-by: luijoc <96428056+luijoc@users.noreply.github.com>
On macOS the temp dir sits behind the /private symlink and the runtime
stores the resolved path, so two existing-folder tests failed locally.
realpath is a no-op on Linux CI.
Resumed Claude/Codex agents come back in the folder they were started in: resume records save the agent's starting cwd from hooks (kept within a session and across Claude /clear and compact), persist it, and resume as `cd <folder> && <agent> --resume <id>` when it differs from the workspace root. A deleted folder now fails loudly at the cd instead of silently resuming in the root.
Fixes#16960
Refs #15485
* fix(worktrees): one host's git status no longer rewrites a same-path twin's branch (#32918)
* fix(worktrees): match a twin through its runtime alias and persist its review clear on the same copy
* fix(worktrees): keep the id-only patch for a lone copy; background refreshes refuse an unplaced twin
* fix(worktrees): a twin's identity patch skips the id-keyed review clear instead of reaching its sibling
* fix(worktrees): count runtime provenance when finding twins; Source Control refresh refuses an unplaced twin
* fix(worktrees): a twin's branch switch clears its own push target and review link on its host
* fix(worktrees): a twin's review clear keeps its stale-refetch guard and relink check, scoped to its own copy
* fix(worktrees): a twin tombstone names its full owner, and detected rows are stamped before sanitizing
* fix(worktrees): each twin copy keeps its own review-clear tombstone
* fix(worktrees): a rename carries each twin copy's review-clear tombstone
* fix(worktrees): a copy's tombstone from its twin days still drives its clear retry
* chore(worktrees): name why the existing review-link cast is safe
* fix(worktrees): one resolver names the copy for every git-identity read and write
* fix(worktrees): a Create PR run refuses when its copy no longer resolves; local null stays local
* fix(worktrees): an unselected twin stays unplaced; a legacy row's guard survives its first stamp
* fix(worktrees): a Create PR run keeps the copy it pinned at start; a legacy row's relink drops its stamped guard
* fix(worktrees): key review clears by the full stamp the next listing gives the row
* fix(worktrees): fill only missing stamp parts when keying review clears
* fix(worktrees): stamp review-clear keys from repo registrations, not the focused host
* fix(worktrees): a local row keeps its review-clear guard when discovery stamps it local
* fix(worktrees): stamp review-clear keys from the sole repo registration first
* fix(worktrees): a runtime-hosted copy's owner key ignores backfilled provenance
* fix(worktrees): Create PR and post-generation refresh read the pinned copy's push target
* fix(worktrees): a lone copy's push target still answers when the host index misses
* fix(worktrees): the push-target fallback accepts only an unstamped lone copy for a named host
* fix(worktrees): only SSH copies borrow a registration's provenance for review-clear keys
Claude panes show Needs You while a Claude Code MCP server's elicitation dialog is open: install Claude's Elicitation/ElicitationResult hooks (>=2.1.63), map Elicitation to waiting and restore the pre-dialog state on ElicitationResult (done when there is no prior record).
Fixes#25020
Supersedes #25057
Co-authored-by: Wooseong Kim <2222333+innocarpe@users.noreply.github.com>
Main built its copy of a hidden pane from the renderer's xterm at the
phone's 1000-row limit, and the hidden-output reveal repaints the pane
from that copy, so a restored pane with more history lost all but its
last 1000 rows on first reveal.
A woken sleeping agent keeps its launch config (flags like permission mode, model, custom args) so a later Orca restart restores it with the same flags; consuming the sleeping record no longer deletes the pane's launch config (retirement and launch-token/session matching still govern it).
Supersedes #31756
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
When Antigravity's Orca-managed chat runtime isn't installed, default-chat launches (orchestration workers, agent.launch from CLI/mobile/automations) fall back to a terminal running agy with reason chat_runtime_not_installed instead of failing at terminal_create; an explicit --surface chat is refused with an install hint. Desktop chat tabs still show the install card.
Fixes#30973
Claude history, usage, native-chat lookup and worktree-retirement discovery now include the user's own CLAUDE_CONFIG_DIR read from the login shell, so sessions in a custom config folder show up even when Orca was launched from the Dock.
Refs #23505
A Codex (or Antigravity/Cline/Prime Agent) dialog drawn and erased in place no longer leaves the pane "blocked" forever when no hook/OSC 7501 clears it. The line tail still decides; the live screen may only clear a tail block when caught up, quiet 3s, no blocker anywhere on screen, and the agent's composer is ready — then the stale block stamp is cleared so the send's own echo doesn't re-block. Also defers the daemon re-attach seed's output sequence until the seed lands.
Fixes#24187
Supersedes #24308
Co-authored-by: Wooseong Kim <2222333+innocarpe@users.noreply.github.com>
dsh worker dispatches (and other dsh agent-prompt sends) now get #33316's bounded Enter retry: dsh paints its launchpad before its session opens and refuses the first Enter with "still starting", so a fresh worker's task sat unsent. The retry only re-presses while the launchpad still holds the same prompt and stops once a turn starts.
Fixes#30778
Co-authored-by: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
After an app relaunch, the window reattaches a live pane without its spawn environment, so the
daemon client never learned the pane's ORCA_PANE_KEY. Sleep then skipped the folder read for it,
and the pane woke at its spawn folder. A move's kill-at-quiesced rollback also put a pane `cd`'d
before the relaunch back at the project root (awin verify-11, 5e). Sleep now takes the pane key
from the daemon's session list when it knows the session's distro but not its key. That is the
same one `listSessions` the adoption of an unattached session already uses.
Co-authored-by: Claude <noreply@anthropic.com>
After Wake the window paints the restored history and then blanks its viewport, so the new
shell's prompt starts on a clean screen. The daemon's own copy of the screen, seeded with the
same history, skipped that step. A later reattach (a reload, a second window, the phone)
therefore showed the new prompt beside the dead shell's last one: `p7/sub$ orca@awin:~/projects/p7$`
(awin verify-11). The seed now ends with the same viewport blanking the window writes, built by
one shared function, after the process-boundary ground, which still never moves the cursor.
Co-authored-by: Claude <noreply@anthropic.com>
Codex sessions launched from an Orca-managed account home now honor the user's global ~/.codex/rules exec-policy files: each regular global .rules file is copied in as rules/_orca-global-<name> on launch (sorted before the account's own files so its saved decisions still win last-one-wins rules); approvals keep saving to the account's default.rules.
Fixes#24431
Co-authored-by: Yuichi Uemura <82369+u-ichi@users.noreply.github.com>
Release queued startup input when a figterm-style relay (Kiro CLI's kiro-cli-term) exec-replaces the shell: if the pane's foreground process isn't a shell, accept a direct child that is the expected shell, foreground on its own tty, at an editable prompt. Startup with Kiro shell integration drops from a 15s timeout to <1s.
Fixes#25586
Supersedes #25899
Co-authored-by: ggbdpq <67929842+ggbdpq@users.noreply.github.com>
Kimi sessions keep resuming across repeated Orca restarts: register Kimi's SessionStart hook (matcher ^resume$, so new sessions pay nothing) and map a resume to an idle session-start status that refreshes the resume record; recognise npm-installed Kimi (node_modules/@moonshot-ai/kimi-code/dist/main.mjs) on Windows so the pane isn't mistaken for a shell.
Fixes#31311
* feat(ssh): list saved port forwards that couldn't start, with why, and let you remove them (#32484)
A saved forward whose local port is taken, or that keeps failing, stayed
saved but invisible, retried in the background with no way to remove it.
The port-forward lists now show each saved forward that isn't open, with
the last start error, and Remove deletes it by its mapping.
* fix(ssh): a forward whose ssh exits after starting backs off like a failed start
* fix(ssh): re-register the new forward channels, close a forward a restore reopened before removing it, and update IPC fixtures
* fix(ssh): a flapping forward keeps its backoff streak until it stays up
* fix(ssh): translate the saved-forward row, say Stopped for a forward that died, toast a failed remove, and reset backoff on manual edits
* fix(ssh): keep saved forwards listed and removable while the host is offline; label the remove button; test the healthy-uptime reset
* fix(ssh): mirror saved forwards from main with a stale-read guard, including hosts that never connect
* fix(ssh): scroll the offline ports panel when saved forwards overflow it
* test(e2e): give the saved-forward restart case's timeout its reason
Detect Qwen Code on Windows: exact node entrypoint identities for the npm (@qwen-code/qwen-code cli-entry/cli) and standalone (qwen-code/lib) layouts, and comparablePath now collapses . / .. segments so shim paths like .bin\..\ match.
Fixes#17326
Supersedes #17382
Co-authored-by: Baojiang Lee <101562714+libaojiang@users.noreply.github.com>
On a Claude account's first setup, shared folders Claude already created (e.g. plugins/) are merged into the shared ~/.claude folder and linked instead of being skipped as user-owned; conflicts keep the user's copy and retain Claude's in <name>.orca-profile-merge.
Refs #33170
OrcaWinandOrcaWin
NeilandRod Boev
