starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-30 16:47:34 +00:00
Code Issues Packages Projects Releases Wiki Activity
17,194 Commits 15,359 Branches 1,149 Tags
7cdfebdc1becc12ae969bd34ea98186b7f3947ff
Commit Graph
923 Commits
Author SHA1 Message Date
OrcaWinandOrcaWin 7cdfebdc1b Revert iteration checks and custom Vitest selection (#34834) 
* revert: remove iteration checks and custom Vitest selection

* chore: use upstream affected-test selection

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-28 00:11:04 -07:00
NeilandClaude 1eaaf85e9f Land the WSL project mover dark (merges only after verify-15b, the flag-off audit and green CI) (#34059) 
* test(orcad-migration): pin the SSH manifest through the real dormant collectors

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor(orcad-migration): read the dormant-state export through a source-kind scope

A local-WSL scope lives on host local and owns only its projects, so host-wide
matches stay an SSH whole-host rule. SSH bytes are pinned by the collector golden.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): export a local WSL move's signed manifest with its dormant state (D1b-3c)

Collects the scoped projects, their groups and every dormant-state kind through the
local-WSL export scope, rewrites UNC paths to the distro's, and returns blockers for
anything the collectors can't carry instead of dropping it. Automations move disabled,
as the wire requires, and come back as a list to re-enable on the host after commit.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): reset an interrupted move to zero, or finish it once the host proves a commit

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): abort a move by its identity when its manifest is too large for a request

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): cap a new move's manifest below the request limit, and move forward on a by-reference commit only once the host flushed it

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): remove only the newest move of a distro, so its chain stays readable

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(runtime): clients read a migrated pane's scrollback from its host (D1b-6d-1)

* fix(runtime): hold a remote pane only when its host is known to serve scrollback, and never read bytes in render (D1b-6d-1)

* fix(runtime): route the scrollback read by the tab's own host, never the focused one (D1b-6d-1)

* fix(runtime): resolve the scrollback host through resolveOwner and use the shared RPC error check, after main moved both (D1b-6d-1)

* feat(wsl-mover): a moved project's existing chats stay listed and resumable on this computer (D1b-7a)

* fix(wsl-mover): moved-project chats go through the layout owner instead of writing layout directly (D1b-7a)

* test(wsl-mover): run the moved-project chat runtime test in the Node runtime (D1b-7a)

* test(wsl-mover): read the hidden local row through main's per-host hidden-repo API (D1b-7a)

* feat(wsl-mover): rewrite the desktop's routing and seed the host's session after a move (D1b-7c)

Registers the main-side desktop rewrite stores ui-routing, session-globals and host-session-seed. Adds a +2 main layout-writer baseline line for wsl-move-main-rewrite-stores.ts: these are one-shot, ledgered move rewrites, and no LayoutCommand can set focus or seed a runtime host's partition.

* fix(wsl-mover): finish the main rewrite before the window loads, keep one copy of each moved tab, and copy instead of move (D1b-7c)

* feat(wsl-move): rewrite renderer stores for moved projects and keep their UI through catalog prunes (D1b-7d)

Registers the renderer-side desktop rewrite stores quick-open-history, file-view-preferences and notebook-environments. The renderer copies each moved workspace's entry to its WSL host key, marks it applied in the same storage, and records the ledger entry; main requests a storage flush first and accepts only the main window. Committed moves are re-listed for re-application at every startup. Catalog prunes keep filters, hook trust and setup-script dismissals of moved repos.

* fix(wsl-move): import the migration manifest types from main's orcad-migration folder (D1b-7d)

* fix(wsl-move): import wslUncPathToLinux from shared wsl-paths in the manifest exporter, where 7d moved it (D1b-7d)

* feat(wsl-mover): rewrite a moved project's orchestration history on the desktop (D1b-7e)

Settled local worker dispatches and their worker-terminal rows in a moved
project take the WSL host's worktree id, in one ledgered, idempotent store.
Chat workers, live rows, federated attachments and JSON receipts stay as
written; automations keep their unchanged local copy (the scheduler only
advances it). Per-table dispositions for orchestration.db.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): hold the orchestration store while a worker in scope is live; skip federated rows (D1b-7e review)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): copy in-app browser logins into the WSL host on a move (D1b-7f)

A committed WSL move now copies each in-app browser profile's cookies once into
the WSL host's stable route partition (owner decision 3a), merging without
overwriting what the host jar holds and never touching the source. Where that
is infeasible (no deployment link so no stable partition, the destination is
not a WSL host or is gone, or the partition name is held by another identity)
the host starts fresh and the move journal records why (3b). Registered as the
ledgered browser-cookies rewrite store; it runs only once browser sessions and
an app window exist. WSL_MOVE_DESKTOP_REWRITE_REGISTRY_COMPLETE stays false.

* feat(wsl-mover): retain moved source rows, reconcile them on start, and plan delta moves (D1b-8)

* fix(wsl-mover): keep the retained mark out of the WSL move manifest (D1b-8)

* feat(wsl-mover): the move driver runs a WSL move end to end, with production gate facts and journaled restore folders

One entry point (and preview/start/cancel/listUnfinished IPC for D1b-9) plans the move, gates
terminals on the hook server's agent status, the close-tab process probe, running automation runs
and live dispatches, pauses and proves exit, stages, sends blobs, commits only from
blobs-transferred (#29825), and finishes on the desktop. Any failure resets to zero or goes forward
when the host committed. Restore folders and the automations to turn back on are kept in the
journal; the host turns those automations back on after commit, retried until it confirms.
A real-PTY test pauses daemon shells, and runs on a real distro in the WSL orcad lane.

* feat(wsl-mover): move dialog with preview, blockers, progress and result behind the internal WSL hosts gate (D1b-9)

* fix(wsl-mover): move dialog hides instead of blocking, follows runs after a reload, and lets a start settle an unfinished move (D1b-9 review)

* fix(wsl-mover): word an unfinished earlier move as still finishing (D1b-9)

* test(wsl-mover): type the e2e's fake move state instead of reading it through Reflect (D1b-9)

* WIP(wsl-mover): 7f-2 registry complete, coverage proof, startup re-apply (D1b-7f-2)

* test(wsl-mover): registry-complete lifecycle, stale-focus restart, unload re-apply (D1b-7f-2)

* fix(wsl-mover): share the session focus write so the re-apply adds no layout writer (D1b-7f-2)

* fix(wsl-mover): redo additive rewrites once at a stale window's unload; behavioural coverage proof (D1b-7f-2 review)

* test(wsl-mover): the IPC record test now finishes the rewrite with the registry complete (D1b-7f-2)

* fix(wsl-mover): fence worktree-less spawns by cwd and re-prove terminal exit before commit (R46, WIP)

* test(wsl-mover): pin the commit re-proof, browser jar identity and repeated move generations (R45, R46, R47)

* fix(wsl-mover): fence any spawn by its folder and name the re-proof's reason (R46 review)

* fix(wsl-mover): a terminal in a known folder outside the move never blocks it (R46 follow-up)

* test(wsl-mover): kill the real move driver at every point against a real host store; abort a reset move's leftover stage on reconnect

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): carry unsaved drafts into the moved project; round-trip every fixture through the real export, driver and host import

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): reset a move waiting on a distro that is proven unregistered; test updates mid-move (R41), lost distros (R38) and two desktops (R39)

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): list the D1b-10 real-SQLite mover tests

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): type the fault test's journal hook without a cast

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): reset for a lost distro even when its kept host fails to connect, never for a renamed one; compare filled-in repo keys only where the source lacked them

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): carry markdown frontmatter visibility and closed-terminal-tab tombstones into the moved project

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): read the persisted stage through a typed record, not Reflect

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(telemetry): report how WSL moves end, by phase and reason code (R43)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(telemetry): report a pause refusal's reason, an outcome for a thrown run, and only real transport errors as unreachable

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(agent-hooks): a WSL host's orcad never removes the hook entries the WSL bridge shares (R42)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(agent-hooks): a WSL host's Codex account-home launch with hooks off skips too; mark the R42 guard to drop with the bridge

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): "Use on this computer again" brings a moved project back as it was before the move

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): judge a bridge WSL pane's foreground inside its distro

On Windows every live bridge pane's own process is wsl.exe, so the busy-terminal gate read every
open WSL terminal as running a program and refused the move. Read the pane's terminal foreground
process group inside the distro (processes carry ORCA_PANE_KEY): only shells means idle, anything
else blocks, and an unreadable guest stays unverifiable.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): only the selected projects' session rows can refuse a WSL move

The session eligibility check treated host local's whole partition as the move's, as the SSH
conversion does. So an agent session or unsaved draft in any other project on this desktop, or in a
project an earlier move retained, refused every later WSL move from that distro.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): sign the manifest as the journal and the host read it

The digest was computed over in-memory rows. A value with toJSON (a Date on a row added this
session) canonicalized to {} when signing but to its string once written to the journal or sent to
the host, so the first move after adding a project reset with orcad_migration_manifest_digest_mismatch
until a restart reloaded the row. Normalize through JSON before signing.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): carry a slept pane's scrollback from its daemon checkpoint

The move sleeps every pane first, and a slept pane's history lives only in the daemon's checkpoint,
never in a renderer snapshot. The export carried renderer snapshots only, so moved terminals opened
empty. After Sleep the driver reads each paused pane's checkpoint (as cold restore would replay it)
and the export carries it under the pane's own snapshot ref; the snapshot channel serves those bytes,
checked against the signed hash. SSH conversions pass no reader and are unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): say why when a move can't be prepared, instead of a bare reset

An export or journal failure after the pause (a digest mismatch, on awin) was rethrown and shown as
"everything was put back" with no reason. Nothing is journaled yet at that point, so refuse with the
error named instead.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): retry a renderer store main refused to record

The renderer applied a store and wrote its marker, but ignored a refused ledger record (gated-off,
failed, not-main-window), so a committed move stayed unfinished and refused every later move of the
distro until the next app start. Log the reason and retry with backoff until it lands.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a WSL pane is idle only when its shell has nothing else

Review of #32343: reading only the terminal's foreground group let background jobs, nohup and
disowned work, setsid daemons and a script waiting at read pass as idle, and the move's Sleep would
end them. Scan the pane shell's subtree, its session and every process carrying its key; any
non-shell process, or a shell running a script, blocks.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): never leave behind an agent whose key may be the selected project

Review of #32343: scoping the session check to the selected projects let an unqualified key for a
repo id another host also registers fall out of both the transfer and the refusal. Such a key now
refuses. Adds tests that fail on the old code: another project's live agent with its tab open and
its draft don't refuse, the same kinds of state in the selected project still do.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): refuse an unreadable slept checkpoint, prefer it, and spool it to disk

Review of #32343:
- A checkpoint behind an unreadable log (or an unreadable one) refuses with the pane named instead
  of carrying stale history.
- For a pane the move just slept the checkpoint is the newest copy, so it wins over an older
  renderer buffer or snapshot.
- Buffers spool to a per-move folder and only their hashes and sizes stay in memory; the snapshot
  channel reads them by offset. The folder is removed whatever the outcome.
- A journal write that landed before it threw is reset, so no orphan record blocks the next move.

awin's checkpoints were 310-615 KB, well inside the 5 MB per-pane cap, so nothing there is trimmed.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): retry a failed listing, never a record another window was refused

Review of #32343: not-main-window can't clear by waiting, while a listing failure is transient.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): sign the manifest as the host parses it

The likelier cause of awin's digest mismatch: the signature covered the exported objects, but the
manifest parser keeps only the fields it knows, so a session field it drops (one a sleep can
write) left the journal and the host hashing something else. Sign the parsed form, and warn when the
parser dropped anything, since such a field does not move.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): split the journal step out of the driver, and format

The review fixes took wsl-move-driver.ts past the line limit; the export-and-journal step moves to
its own module unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a slept pane passes the busy check; say what each move dropped or lacked

Re-run on awin (c5d263c77c):
- Every slept pane read unverifiable: the distro was asked about panes whose wsl.exe had already
  exited, and found no shell. Only a pane the host still sees running is asked now.
- A live pane read unverifiable when the WSL relay above its shell carried the pane key too; the
  pane's shell is now the topmost tagged shell.
- The parser-dropped-fields warning names the paths, and the slept-history reader logs how many
  panes it carried, could not read, or found no checkpoint for, so the next run says why a moved
  terminal opened empty.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): read the history of panes slept before the move too

verify-3 on awin: panes the user slept earlier in the session have no live terminal, so the move
listed 0 of 0 panes and moved them empty. Their layout still names the session whose checkpoint
holds the history; read those too, live panes first.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): moved panes paint their history, slept panes are found without a reload, and an older undo names the newer move

- A moved tab's first mount reads its history from the host even before this window has the host's status; it used to mount empty and never ask again.
- The window reports the panes it slept (main retires their binding on Sleep), checked against the moved workspaces before their history is read.
- A tab's Windows shell choice is dropped on purpose, not by the parser.
- "Use on this computer again" on an older move names the projects of the newer one to bring back first.

* fix(wsl-mover): moved panes read their history, an idle agent passes, refusals name tabs and show

- The manifest carries no desktop PTY binding: the host kept them, so the client took each moved
  pane for a live terminal, skipped the scrollback read and opened a fresh prompt.
- Progress counts the terminal history it sends while staging, not only the blobs.
- "Use on this computer again" shows a refusal in a dialog; the toast sat behind the update notice.
- Unreadable slept history names the tab by its title and is refused in the preview too.
- A bridge pane whose one job is an agent CLI lets the hook status decide: idle passes, working blocks.

* fix(wsl-mover): a split agent tab's shell panes restart as shells, not fresh agents

A moved (or any headless-restored) agent tab with a plain shell split beside the agent
pane brought every split back as a new agent: the start path used the tab-wide
launchAgent for each pane that had no recorded session. Tab-wide launch evidence now
applies only to a tab's sole pane, as the renderer already treats it.

Found in the D1b-10 real-host run on awin (report bug 6).

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): restore folders of panes slept before the move; keep browser tabs

D1b-10 real-host run on awin (report bug 7, with bug 8 pinned), and verify-3:

- A pane slept before the move had no live terminal, so its last folder never reached
  the restore hints and it reopened at the project root (verify-3 lost `deep/`). The
  pause step now adds the panes the saved session or the window still binds, through
  the slept-pane listing that already feeds their history, so hints and history read
  the same panes.
- The move pauses projects through Sleep, which closes a workspace's browser tabs, so
  a moved project lost its in-app browser tab. A move's Sleep request now asks the
  renderer to keep them; an older renderer ignores the field.
- A moving project's unsaved draft carries (the host-session seed lays it back); a
  test pins that it never refuses the move.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): sweep journal writes that died before their rename

A killed journal write left <id>.json.<pid>.<ts>.tmp in the move journal forever
(D1b-10 real-host run, report bug 10). Once per directory and process, the journal now
removes another process's temporaries older than a minute; its own writes and a
write another instance may still be finishing are kept.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): move dialog and add-host fixes from the real-host run

D1b-10 real-host run on awin, report bug 9:
- A host that will not connect now refuses as host-unavailable, in the preview and
  at start, instead of "Orca could not check these projects" / an unexpected error.
- A run that ends without committing reports its result on the progress channel, so
  a window that only follows the run (reloaded mid-move, or started elsewhere) leaves
  "Moving… Preparing" for the result instead of sticking there until a reload.
- The preview counts terminal panes, as the terminal blockers do, not tabs.
- Small transfers read in B or KB, not "0.0 MB of 0.0 MB".
- A distro that stopped after the add-host list was read refreshes the list, so the
  button becomes Start and add, with a message that says so.
- The add-host copy no longer says bridge projects keep working "as they are" with
  no mention that they can move to the host.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a sleeping WSL pane keeps its shell's folder

Bash on the bridge reports no folder, so a slept pane's checkpoint kept
its spawn folder and the move reopened every pane at the project root.
Before the final checkpoint of a Sleep, read the shell's folder inside
the distro (the busy check's probe, now with /proc/<pid>/cwd) and store
it. Internal WSL hosts gate and Windows only.

* fix(wsl-mover): moved browser tabs and drafts survive the moving window

The window open across a move saved its mirror of the host's tabs over
the host partition, and the unload's redo skipped any workspace that
mirror named, so the seed's browser tab and draft never came back. The
redo now adds the carried browser tabs and this desktop's drafts beside
that mirror, never replacing what it holds. A seeded draft is bound to
the host, as the SSH move's draft rename binds it.

* fix(wsl-mover): a pane whose only history is a stored snapshot cold-restores it for every client

A moved (or imported) pane carries its history only as a stored scrollback snapshot,
which no paired client's mirrored layout names, so the host started a fresh shell and
every desktop showed an empty prompt. Before starting such a pane, the host now seeds
a terminal session from the snapshot, so the start cold-restores it like any
interrupted session. Reproduced end to end in wsl-move-host-pane-history.spec.ts.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): seed history only for WSL-moved local panes, once per pane

Review of the first version: it seeded any pending pane with a saved snapshot,
including SSH panes (which would be asked to reattach a session the remote never
had) and ordinary panes. Now only panes of a project a committed WSL move brought
here (its import receipt names it) and never an SSH workspace. The session id is
the pane's own, so a later start reuses the folder the pane has since written,
or its clean exit, and never replays the stale snapshot; meta.json is written
last, by rename. Tests pin the gate, the reuse, and the legacy history restore
the seed relies on; the e2e adds the not-moved control.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): seed only panes the move carried; show history once; redo a cut-short seed

Second review: narrow the seed from per-repo to per-pane (a tab created after the
move's import is the host's own), redo a seed a crash left without meta.json, and
prove on a windowless host (as the distro's orcad is) that the desktop paints the
moved history exactly once - its mirrored layout never names the snapshot, so it
never reads it too - and that the moved browser tab is listed.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): refuse "Use on this computer again" while files are unsaved

An unsaved file's beforeunload silently vetoed main's reload after a release, so the
window kept the moved layout with panes bound to dead terminals (awin verify-5).
The renderer now asks for those files to be saved first; main logs a vetoed reload.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): log where an open pane's history, folder and busy verdict come from

awin verify-5 saw an open pane carry 140 B after 3,000 lines, reopen at its root, and
stay "cannot check" after its job was killed elsewhere. None reproduces off Windows,
since all three run through wsl.exe; these lines name the gap on the next run.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): an open pane keeps its shell folder through a move

Bash on the bridge reports no folder, so an open pane's checkpoint kept only its
spawn folder and `cd deep/er` reopened at the project root (awin verify-5). The
pause now reads each live pane's shell folder inside its distro before Sleep ends
the shell, and the restore hint prefers it.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): carry a slept pane's history once, not twice

Cold restore fills scrollbackAnsi from snapshotAnsi for a normal screen, so both
hold the whole buffer; the move concatenated them, carrying every line twice, and
the per-pane cap then kept only the newest ~1,040 of 2,000 lines (awin verify-6).
The move now carries the normal buffer once, as cold restore replays it.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): ask the distro when Windows can't observe a pane after a relaunch

After an app relaunch, Windows reads a reattached bridge pane's wsl.exe children as
unverifiable, so every live bridge pane stayed "cannot check" and blocked every
move until it was slept (awin verify-6). The gate now asks the distro about panes
Windows cannot observe too; only a pane whose shell the distro also can't find
stays unverifiable. Also formats the earlier commits' tests.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): name a terminal's pane after a relaunch before judging it

A terminal the runtime rediscovers after a relaunch carries no pane key until a
layout names it again, and the gate read every paneless terminal as unverifiable,
so no move could start after a restart (awin verify-6). The gate and the pause now
take the pane main's PTY bookkeeping binds the terminal to.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): read manifest diff paths through a typed record, not Reflect.get

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): type the slept-pane modes fixture instead of asserting it

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): the move gate reads panes a relaunched window has not reopened

After an app relaunch, every live WSL bridge pane read "cannot check" and blocked every
move (awin verify-6, item 5). Root cause: the daemon adapter's hasPty only knows sessions
this app process spawned or reattached. A pane the relaunched window had not reopened is
still running in the daemon and listed by the runtime, but the inspection pre-check read
hasPty=false as terminal_gone, so the probe was unverifiable. Reproduced on macOS with a
two-launch e2e: an idle pane in an unopened workspace inspected as
{verdict:'unverifiable', reason:'terminal_gone'} after the relaunch. The same run showed the
runtime still holds the pane's original paneKey, so the paneKey theory is refuted.

The gate now passes includeUnattached, which skips that pre-check and asks the daemon,
which still refuses a session it no longer runs. Other callers keep the old behaviour.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): an idle stub agent passes the move gate once its Stop arrives

awin verify-6 item 5d was inconclusive: p4's stub agent answered, but the preview stayed
"agent-working". Replaying the D1b-10 stub's hook payloads through the real hook server and
the gate's fact collection shows Stop settles the pane to done and the gate reads ready, so
the Stop path is not at fault. The run's screenshot (ev/p4-agent2.png) shows the likely cause:
the harness launched the stub twice in p4, and one instance sat at its prompt having fired
only SessionStart. The stub fires SessionStart at launch, which Orca's Codex normalizer treats
as a turn start, so a stub never given a prompt reads as working. No product change.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): an unreachable daemon reads as unverifiable for the move gate

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): browserless host e2e and stale-window unit test for moved browser tabs and drafts

The distro's server has no browser of its own; an e2e-only switch (never in a packaged app)
starts the headless server the same way. With the desktop's per-host copy as a move leaves it,
the moved browser tab and pre-move draft show as tabs. The unload redo after a move rewritten
under an open window keeps both, whether the host published first or the rewrite seeded first.

* fix(wsl-mover): moved browser tabs and drafts survive the prepared reload after a move

"Reload now" backs up unsaved files by dispatching a synthetic unload first. That first unload
staged the window's mirror of the host (no browser tab, no draft) and drained the redo mark, so
the window, still open, saved its mirror again and the real reload had nothing to redo. The redo
now runs at every unload of the stale window and a last time when its document is replaced
(did-navigate), and only then is the mark drained.

* test(wsl-mover): the undo-path test's store answers the unsaved-file check

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): read workspace records through the selectors

Main's new workspace-record read ratchet flags the mover's direct reads; the move dialog, the moved
projects section and its store helpers now read through workspace-record-selectors, and the scope
rows' catalog names its own fields. Prunes the layout-writer baseline to its actual count.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): the dialog e2e expects the slept panes the start request now names

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a moved terminal's pane key comes from paneOfPty

Main's L80 census allows only paneOfPty and the switch-guarded writers to read a PTY record's pane
copies; the WSL move's live-terminal list now reads through it.

Co-Authored-By: Claude <noreply@anthropic.com>

* style: format the imports the main merge repointed

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): carry each moved pane's daemon checkpoint as a terminal-history blob the host restores once

Replaces the host-side stored-scrollback seed (#32789) with an installed interrupted session the pane's first start claims.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): the desktop sends each paused pane's checkpoint as its terminal-history blob

Drops the snapshot-ref spooling and the restore-hints blob for moved panes: one source (the pane's daemon checkpoint) carries history and folder.

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor(wsl-mover): register WSL move wiring from its own module

Keeps register-core-handlers under the max-lines limit.

* fix(wsl-mover): one import from ./ui in the move wiring

* refactor(wsl-mover): build the manifest's session before the payload

* style(wsl-mover): one import from stable-pane-id after the main merge

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): drop the e2e for the stored-snapshot seed this redesign deletes

The moved pane's history now comes from its own checkpoint; wsl-move-restore-lifecycle.spec.ts
covers it once, across reloads.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): keep #32668's two layout writers in the baseline until 2/3 deletes them

Main's layout-writer ratchet now counts main-process writers; wsl-move-echoed-browser-tabs.ts, the
file the hold-and-reload in 2/3 deletes, writes two. Restore redesign 2/3 removes the entry.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): move the project you have open into a host that has its own focus

The carried session named this desktop's focus, and a host that already focused another project
refused it (orcad_migration_dormant_focus_conflict:activeRepoId), so moving the project you had
open reset with "Nothing was moved" (awin verify-7 N1). The desktop's focus names nothing on the
host and the desktop rewrites its own focus after the move, so the export now carries none and
the host keeps its own. The reset result also says why the move stopped.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): startup removes the slept-history spools of moves the journal dropped

A run killed mid-pause is reset at the next startup without its process, so its export documents
(25 KB per pane on awin verify-7) stayed under wsl-move-slept-scrollback for good.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a woken WSL pane keeps its folder unless the probe proves it gone

The cold restore checked a WSL pane's folder with stat over \\wsl.localhost, which waits for a
stopped distro and fails for reasons other than absence. After a rollback the pane stayed blank
about 15 s, then opened at the project root without its folder (awin verify-7, 5e). It now uses
the bounded wsl.exe probe every other restore uses, which keeps the folder unless proven missing.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a moved pane's new shell prompt starts on its own line

The carried screen ends on the old shell's prompt with the cursor after it, so the host's new
shell printed its prompt beside it (`$ $`, awin verify-7). The exported checkpoint now ends the
normal screen with a line break; a TUI's screen and an unfinished escape are left as they are.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): wait on conditions, a fixed clock and stated reasons instead of sleeps

Main's flaky-test ratchet flags the mover's tests:
- The browser-draft and pane-history e2e slept fixed seconds. They now wait on what they slept
  for: the host's tabs mirrored, the host terminal's last line, the moved tabs shown, the pane
  painted.
- The journal sweep test read the wall clock; it runs on a fixed fake time.
- Each longer per-test timeout says why it needs the time.

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor(wsl-mover): start the WSL mover from its own startup module

The mover's startup (rewrite stores, interrupted-move recovery, retention, retry) lived inline in
main-process-ready-foundation.ts. With main, the host reconnect and D1c branches each adding a
few lines on top, the file passed the max-lines limit in the combined build. It moves as one
unit to wsl-move-startup.ts; the foundation keeps the one call and its ordering.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(wsl-mover): hold the window's saves from commit until main reloads it (restore redesign 2/3)

The window open across a move hydrated before the desktop rewrite, so every save it made
(session, UI, the unload checkpoint behind Reload now) wrote stale state back, and three files
re-applied the rewrite after it: echoed browser tabs, the seeded view state's redo and the
stale-window reapply. Now main holds that window's saves from the commit request until its
reloaded page has loaded, and reloads it itself once the rewrite is on disk. Use on this computer
again takes the same path, replacing its per-project release hold.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): only a settled commit reloads the window it held

A rewrite pass that ends while a commit request is out (another move's retry) must not reload
the window early: the reloaded page could save its view of projects the host is publishing.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): prune the deleted re-apply writers from the layout baseline

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): the move's pause sleeps a workspace again before refusing

A workspace whose pane was still restoring, or had just spawned, could miss its final checkpoint
on the first Sleep and stay awake; the move then refused with "Orca could not pause the terminals"
although a second Sleep stopped it (awin verify-7, 6e). The pause now sleeps the failed workspaces
up to twice more, a second apart, and refuses only when they keep failing.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a move retries a workspace whose pause failed instead of refusing at once

When one workspace of a move failed to pause, the move was refused right away with
host_terminal_stop_failed, and the retry added for awin verify-7 never ran (awin verify-8, 6e).
The window rolls a failed workspace's panes back and reports that rollback as an error. The
pause's persist step waited on every workspace and failed on that error, so the whole pause
call threw instead of returning the failed workspace. The retry only ran on a returned failure,
and the move's first pause had no retry at all.

The persist step now fails only on errors from workspaces main reported as slept; main already
reports the failed ones. Both of the move's pauses sleep a failed workspace up to twice more
before refusing. Each attempt is a fresh pause with its own id, so a re-sleep is not counted
as a duplicate.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): e2e for the restart-style restore and undo (restore redesign 3/3, WIP)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a moved pane's first subscriber gets its whole replayed history

The host replays a moved pane's checkpoint once, but every remote subscribe snapshot carried at
most 1000 rows, so the desktop's first view of a 2,000-line pane lost its first half. Only for
panes whose session is a moved one, the subscribe snapshot now tries 5000 rows first, then 2000,
then the usual ladder, within the same byte budget.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): the restore lifecycle e2e waits for the printer instead of sleeping

Main's flaky-test ratchet flags it: it now waits until the host terminal shows the printer's
last line before the pane sleeps, and each longer timeout says why.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): undo after reloads and a restart wakes split panes live, each with its history once

The undo e2e now follows a real move: main's own Sleep pauses a split tab, the committed move runs
its desktop rewrite and retention at startup, the window reloads three times and the app restarts,
then "Use on this computer again". The project comes back slept (no live terminal until opened),
and opening it wakes both panes from their checkpoints, history once, taking input.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): carried and retained agents resume once across move, reloads and undo

The move e2e now carries the pane's idle Codex session to the host (its session file where the
distro keeps it): the agent resumes in the moved pane's folder on the first open and no reload
resumes it again. The undo e2e gives pane A an idle agent: after the undo it resumes there, once,
and pane B starts none.

Verify-6 item 5d (an idle agent read as working): the awin stub posts Codex's SessionStart at
launch, which Orca reads as a turn start; Codex posts it with the first prompt. The gate test now
pins that a resumed agent passes until its next prompt starts a turn.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): read the undo e2e's agent record without a cast

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): parse the undo e2e's agent records instead of reflecting into them

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): the lifecycle e2e shows the moved pane when its agent does not start

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): start the carried agent by its recorded absolute command

A login shell may reset PATH (Ubuntu CI did), so the stub is named by the launch config the move
carries, as a recorded agent command is.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): say where a resumed moved pane started when it is not its folder

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): print login profiles that move a shell when the resumed pane is outside its folder

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): keep the CI runner's login-profile cd out of the moved pane's folder check

Blacksmith's /etc/profile.d/blacksmith.sh ends with cd "$GITHUB_WORKSPACE", so every login
shell on CI, restored or new, plain or agent, starts there. Reproduced in Ubuntu 24.04 with the
same profile line: a plain restored pane lands in GITHUB_WORKSPACE too, and with it unset the
moved pane and its resumed agent start in the pane's folder. Orca spawns the shell in the right
folder; the runner's profile moves it.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): judge the resumed pane's folder by where its shell started

Blacksmith's /etc/profile.d/blacksmith.sh sources the job env and cds into GITHUB_WORKSPACE, so on
CI every login shell, plain or agent, restored or new, moves there after Orca starts it in the
pane's folder (reproduced in Ubuntu 24.04 with that profile line; a plain restored pane moves too).
The check now accepts the pane's folder as PWD or as the OLDPWD a profile cd left behind.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): undo stops the host's copy of the project before its agents resume here

"Use on this computer again" resumed the project's agents here while the host's copies kept
running, so one agent session ran on both sides and two writers shared its transcript (awin
verify-7, 6c). Undo now sleeps the project's workspaces on the host and waits until none of their
terminals runs. A host that does not answer, or whose terminals do not exit, keeps the move and
says so; a host the user removed runs nothing, so the project comes back.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): e2e: undo stops the host's running copy before the project comes back

A paired host holds the moved project under the move's ids with its terminal still running; after
"Use on this computer again" none of the host's terminals for it runs. Fails with the host stop
removed (the host's terminal stays at 1).

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): "Use on this computer again" refuses only for the move's own unsaved files

An unsaved file in any project refused bringing a moved project back, so p6's draft README
blocked undoing p9 (awin verify-8). The window reload no longer stops on an unsaved file, and
only the move's own workspaces come back from their pre-move state. The window now tells main
which workspaces have unsaved files; main refuses only if the move holds one of them, before it
stops anything on the host, and the window names just those files.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): a refused "Use on this computer again" leaves the host's terminals running

Undo stopped the host's copies of the move's terminals before it checked whether the move could
be released, so an undo refused because a later move builds on it still killed the host's shells
and agents; the agents then resumed again (awin verify-9, X1). Undo now runs every refusal first:
unsaved files, a running move, a newer move in the chain, and whether the host answers for every
workspace. Only then does it stop anything, and a host that cannot answer for one workspace has
none of them stopped.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): the move gate finds a pane the window has not reopened since a relaunch

A pane the window has not shown since an app relaunch has no spawn-time pane key in main, so
the move gate's guest busy check could not find its shell. The gate now falls back to main's
own pane record. The Sleep half of the relaunch gap (awin verify-9, X2) moved to main with
#33398 and #33425.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): log who spawns each WSL pane and whether its cold restore came with it

After an undo reload a restored, inactive terminal tab showed only a prompt: something spawned
its session 2 s after the reload, before the window showed it, and its checkpoint never replayed
(awin verify-10). No log named the spawner. Each WSL pane spawn or reattach now logs its
session, spawn intent, whether it was new, whether a cold restore came with it, and the four
caller frames above the daemon client, for verify-11 to capture.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(wsl-mover): the undo host-copy e2e says why it needs its longer timeout

Main's flaky-test ratchet flags an unexplained per-test timeout.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): record the WSL spawn caller where it enters the daemon router

verify-11's `[wsl-spawn-origin]` lines named only the daemon client's own frames
(createOrAttachSpawn ← doSpawn ← withDaemonRetry): the async spawn path drops the caller.
The caller's frames are now captured synchronously at the router's `spawn` entry and logged
with the spawn, so verify-12 can name what starts a restored pane before its window shows it.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): capture the WSL spawn caller where every daemon spawn enters

verify-12 still logged "caller":[]. The router only wraps the daemon client when
legacy daemons exist; otherwise the bare client is the installed provider, so the
router capture never ran. Capture at the client's spawn entry (keyed by the
minted id too) and raise the stack limit so the async caller frames survive.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): log the seed and the daemon's screen for WSL cold restores

verify-13's second-cycle `$ $` checkpoint shows the daemon's own screen
without the fresh-shell blanking (old prompt still in the viewport,
scrollbackLines 0), which the macOS daemon harness never reproduces.
Log the seed's shape and tail with the spawn, and the daemon's screen
3 s after a WSL cold restore, so the next run shows where it is lost.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(wsl-mover): keep an open host pane from restarting its agent during undo

"Use on this computer again" slept the host workspace and waited for its
terminals to go. A host pane open in the window saw its terminal exit and
resumed the agent on the host 1.6 s later, after the stop had already
counted zero, so the reloaded window resumed a second copy here (awin
verify-14, 6c). Refuse this window's terminal and agent starts on that host
from before the stop until the reloaded page has loaded (capped at 2 min),
and lift the fence when undo is refused.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(wsl-mover): pre-landing cleanup for the dark landing

- Strip the verify-only spawn-origin and cold-restore-screen logging and the
  per-pane process warning.
- Read a pane's stored scrollback from its host only for WSL hosts; SSH and
  paired-server tabs no longer hold for a placeholder or ask their host.
- Limit the ambiguous-owner refusal to WSL moves; SSH conversions match as
  before.
- Drop the duplicate split-tab launch check (main fixed it in the projection,
  #32418).
- Reword comments that cited internal verify runs.

* fix(terminal): save a woken terminal's first history as a full snapshot

A wake that reused the Sleep-time cold-restore cache reopened the history
writer without asking for a full checkpoint, so the new process's output was
appended to the pre-wake checkpoint, which lacks the fresh-shell padding the
seed gave the daemon. The next save that replayed checkpoint + log (quit's
final save, or a relaunch's adoption) printed the new shell's prompt on the
restored one's row (`$ $`). Mark a full checkpoint for a new process in that
path, as the uncached cold-restore path already does.

* fix(terminal): keep ConPTY's viewport top through a width change, checked against a captured transcript

A captured ConPTY 1.23 resize (wsl.exe) shows it keeps the line at the top
of its viewport through every resize and repaints only that viewport. xterm
keeps the cursor's rows instead: a wider grid that rejoins wrapped rows pulls
rows out of scrollback (ConPTY's repaint then overwrites them), and a
narrower one that rewraps pushes rows into it (the repaint then repeats
them). The windowsPty row rule covered neither. ConPTY-backed emulators now
put the top line back on its row after a resize.

* feat(wsl-mover): D3a move orchestrator skeleton (dark) (#33802)

* feat(wsl-mover): D3a move orchestrator skeleton, dark behind the internal WSL hosts gate

* fix(wsl-mover): exhaustive orchestrator telemetry transition

* feat(wsl-mover): D3a T2 trigger, confirmed-running host readiness and T3 guard

* fix(wsl-mover): D3a review fixes (stuck moving, user release parks, A1 timer, deferred backoff, chain restore, GUID-only R38, uncounted window failures, backoff docs, restore settle, coalesced wakes)

* fix(wsl-mover): restore chain order without mutating

* fix(wsl-mover): D3a never touches a WSL host whose Remove is pending (E11 pendingStop)

* fix(wsl-mover): D3a survives an unreadable journal, honours a release mid-step, replays wakes after Restore, re-checks pendingStop before readying a host

* refactor(wsl-mover): orchestrator ports in their own module

* test(wsl-mover): warm the orchestrator wiring import before its first test

* fix(wsl-mover): a user Remove of a WSL host declines its move until the user adds it or retries

* test(wsl-mover): one checked cast in the host user-action test

* fix(wsl-mover): D3a review 3 — removal-pending clears, start re-checks after the window answers, non-blocking replies, replay in finally; split orchestrator modules under max-lines

* test(wsl-mover): index check style

* test(wsl-mover): core handler test mocks the move orchestrator wiring

* fix(wsl-mover): every user Remove of a WSL host declines its move; readying a host re-checks the decline before connect or add

* fix(wsl-mover): a failed sidecar save or step error never rejects a fire-and-forget trigger

* test(wsl-mover): split orchestrator tests under max-lines with shared fake ports

* fix(wsl-mover): report a host Remove before its cleanup, so a failed cleanup keeps the decline

* fix(wsl-mover): keep the moved-pane history wire surface off outside a WSL host

Register session.readTerminalScrollback, advertise its capability and the
terminal-history migration blob, and install that blob only on a WSL move's
destination (the WSL host's orcad, or an e2e host standing in for one).
Restoring a pane only probes for a moved pane's history there too. The
journal's orphaned-write sweep is limited to the WSL move journal, so SSH
migration journals behave as on main. Pin the advertised blob kinds again.

* fix(wsl-mover): user moves connect the host, automatic ones never boot; gate D3a's selector; tolerate a missing environment list

- The dialog's preview and start reach the host through service.connect (may boot, lifts a park);
  the orchestrator and its startup recovery keep the no-boot path (A1, E9). A host with a Remove
  pending is never connected either way.
- WslMoveDialogHost's active-distro selector does no worktree lookup with the flag off.
- hostScrollbackEnvironmentId returns null before the environment list loads; the mount test
  fixture supplies a WSL host.

* fix(wsl-mover): D3a waits out a move still being retained; orchestrator-over-driver tests (#34087)

* fix(wsl-mover): D3a waits out a move still being retained instead of failing attempts; orchestrator-over-driver integration tests

* fix(wsl-mover): D3a counts an unverifiable in-flight refusal, caps uncounted waits at a day (parks as stuck) and re-checks a done distro waiting on retention

* fix(wsl-mover): cap D3a's uncounted waits by checks, not wall clock; any in-flight detail counts

* fix(wsl-mover): a user's move leaves an already-ready host connected as is

service.connect bumps the liveness generation and re-ensures the server; the orchestrator readies
the host before the driver runs, so the driver connects only a host that is not ready.

* Revert "fix(terminal): keep ConPTY's viewport top through a width change, checked against a captured transcript"

This reverts commit ecd8f07396.

* test(wsl-mover): the orchestrator's automatic path never reconnects a serving host, and adds a bridge host once (E9)

* fix(wsl-mover): keep session.readTerminalScrollback in the RPC manifest; gate its registration

Gating the method out of ALL_RPC_METHODS dropped it from the generated params catalog. It is
static again, so the catalog types it, and the dispatcher leaves it unregistered on any host that
does not serve moved panes' history (method-not-found there, as before).

* fix(wsl-mover): undo returns focus from the host copy, so the reload does not reopen it

verify-15b 6c: undo stopped the host's copy of p9, but the window's focus still named the host
copy (the move pointed it there), so the reloaded window opened that workspace, the host
re-created its pane as a visible user-resume, and, since #34054 resumes a restored host pane's
agent from the hook store, Codex resumed on the host beside the one restored here. With writes
held and before the reload, undo now points focus at the project's copy here, reusing the move's
focus writer with the inverse patch.

* fix(wsl-mover): undo turns the host's copies of the move's automations off before releasing

After "Use on this computer again" the desktop's retained copy of a moved automation runs again,
while the host's copy stayed on: both ran against the same files. Before each move is released,
undo now turns off, on the host, that move's automations whose copy here is on (one off here keeps
the user's choice there). A host that cannot be reached refuses as host-unreachable and one that
refuses as failed, releasing nothing, like the terminal stop.

* fix(wsl-mover): undo turns host automations off before stopping terminals, and back on if it refuses

d3-gate-audit: with the automation step after the terminal stop, a refusal there left the host's
terminals and agents killed while undo refused, breaking X1. Per move, undo now turns the
automations off first (a step that undoes cleanly), then stops the terminals, then releases. A
terminal stop that fails turns back on what was turned off, and a disable that fails partway
turns back on what it had turned off before it throws.

* fix(wsl-mover): roll back undo's host automation step on any later refusal; review lows

- Any refusal after the automations went off (terminal stop, release failure or supersede) turns
  back on exactly what this attempt turned off. One it cannot is recorded on the move
  (hostAutomationsLeftOff), shown in the unfinished-move notice and retried by the rewrite retry.
- The spawn fence is released in a finally, and the port answers failed instead of throwing on an
  unreadable environment store.
- A host with a pending Remove (E11) is left alone with its own refusal copy; the
  host-automations refusal tells the user to connect the host.

* fix(wsl-mover): undo carries the host's automation states back and leaves each running in one place

Owner decision on d3a's item 5: undo reads every one of the move's automations on the host, turns
off each host copy that is on, and, with the release, gives the copy here the host's state (the
user's latest choice; one deleted there reads as off). An automation turned off on the host after
the move no longer comes back on here, and one turned on there no longer keeps running against a
project the host no longer owns. A refused undo restores the host's flags and changes nothing
here.

* fix(wsl-mover): the left-off automation retry re-reads the move after the host round trip

d3-gate-audit: the retry wrote back the snapshot it read before awaiting the host, so an undo that
released the move meanwhile could be undone, or a phase advance rolled back. It now re-reads the
record after the await, writes nothing for a move that is gone, and removes only the ids it
turned on, keeping everything else current.

* fix(wsl-mover): undo records the user's automation choice before turning any off, and takes turns with the retry

d3a re-review and d3-gate-audit:
- Undo reads every moved automation on the host, records those states on the move before turning
  anything off, and applies them here as part of the release step (undone if the release then
  refuses). An earlier attempt's record wins, so one left off by a failed rollback, or by a crash,
  keeps its choice (on) here instead of reading as off.
- A disable the host drops mid-loop carries what it could not turn back on on its error; those
  are recorded as left off, shown in the unfinished-move notice and retried.
- Undo's per-move steps and the left-off retry take turns, and the retry re-reads the move inside
  its turn, so a release during a retry neither resurrects the move nor leaves the host copy on.
- At startup, an undo a crash interrupted sends what it read as on back on through the retry.

* fix(wsl-mover): a left-off retry that finds the move released turns its host copies back off

If a move is released while the retry is turning a left-off automation back on, the host copy
would run for a project that is local again. After the round trip the retry re-reads the move;
when it is gone it turns what it just turned on back off (best effort, logged).

* fix(wsl-mover): a restart keeps a left-off automation's choice; undo's rollback never skips the host

d3a re-review:
- Startup settling keeps the recorded choice (on) for what it sends to the retry, and undo also
  reads any id on the left-off list as on, so a later undo after a restart and failed retries keeps
  it on here.
- A failed revert of the copies here no longer skips turning the host's copies back on; each
  revert write is tried on its own.
- Turning automations back on stops at a host that stops answering, leaving the rest as left off,
  instead of waiting on each in turn while undo's turn is held.

* fix(wsl-mover): undo always asks the host for the move's terminals, refusing a host that does not answer

verify-15c: with the host's orcad stopped, "Use on this computer again" for p7 proceeded, and after
a normal undo p6's host shell kept running. Undo's host-copy stop took the host workspaces to stop
from this computer's session, which after a move keeps only a moved project's chats: a project
with none named no workspace, so undo asked the host nothing (no reachability check, nothing
stopped) and released it. The stop now always lists the host's terminals first, adds every
workspace of the move's scope that runs one, and refuses as host-unreachable when the host does
not answer, answers with an error, or cuts the list short.

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-28 00:02:37 -07:00
OrcaWinandOrcaWin 0866cb1b08 fix: bound local iteration checks and show live progress (#34700) 
* fix: bound local iteration checks and show live progress

* fix: harden check lifecycles and cached test evidence

* fix: preserve process instrumentation and fixture lifecycles

* fix: give fixture unref spy a portable function type

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 23:04:23 -07:00
OrcaWinandOrcaWin ca2154945b ci: run advisory e2e lanes on free hosted runners (#34725) 
The layout oracle merge gate keeps Blacksmith via fast_runners: true; the
advisory e2e call, nightly schedule and layout-owner dispatch run on
ubuntu-24.04.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 22:08:17 -07:00
OrcaWinandOrcaWin 8b7f8c88ce ci: run terminal perf on demand only, on a hosted runner (#34726) 
* ci: run terminal perf on demand only, on a hosted runner

The nightly failed every run: the presented-frame guard accepts only
GitHub-hosted Xvfb displays, but the workflow ran on Blacksmith. Drop the
schedule, move dispatch runs to ubuntu-24.04 and document local use.

* docs: record the first hosted terminal perf result

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 21:48:08 -07:00
OrcaWinClaudeOrcaWin
 		8b64ec281a ci: restore main's Vitest transform cache in PR unit shards (#34512) 
* ci: restore main's Vitest transform cache in PR unit shards

Main produces per-shard transform caches on a schedule; PR shards restore
the newest one for the same config/lockfile/runtime policy. A Vitest cache
key generator folds each literal specifier's resolution candidates into the
per-module key so newly added files that shadow a resolution invalidate the
importer, and bails on glob-expanded dynamic imports.

* ci: list the resolution key plugin in the node tsconfig project

* ci: accept Vitest's CACHEDIR.TAG when sealing the unit module cache

Vitest 5.0.5 tags its cache root, which made every seal fail with
'invalid cache entry name' so no producer cache was ever saved.

* ci: reseed the unit module cache when any cache-key input lands on main

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-27 20:04:56 -07:00
OrcaWinandOrcaWin 5f4d9654f9 ci: run operation-count performance contracts on hosted runners (#34668) 
The contracts count operations and retained objects; wall-clock budgets
stay in pnpm test:perf:benchmarks, which no CI job runs. They do not
need Blacksmith's consistent hardware, and the PR path filter runs them
~40 times a day ($7.90/day, $5.50 of it on the 6-vCPU Mac).

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 19:44:37 -07:00
OrcaWinandOrcaWin 1df26abf60 ci(adhoc): package Mac architectures on 6-vCPU runners (#34673) 
Each 12-vCPU arch job spends ~3 of its ~7 minutes waiting on Apple's
notary service; packaging itself runs at the same speed as the hourly
build's 6-vCPU runner. Halve the per-minute rate.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 19:44:18 -07:00
OrcaWinandOrcaWin e0f32dcac1 ci: seed hosted Linux packaging and mobile bundle caches on main, and stop PR-local saves (#34672) 
- Warm electron-builder-linux-<versions> and the hosted ubuntu-24.04 Electron native modules
- PRs restore hosted Linux Electron native modules without saving
- Replace mobile verify's bundler-cache with a restore of a warmup-saved bundle
- Drop the pnpm store cache where a direct install was faster (mobile main, glibc-floor containers)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 19:40:29 -07:00
OrcaWinandOrcaWin 4cd62c4946 ci: split the layout oracle window scenarios across two shards (#34671) 
The single-file oracle cannot be split by whole-file balancing, so pass
Playwright test-level shards to the changed-spec lane. It was the last
required check in 40 of 42 measured runs.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 19:25:17 -07:00
OrcaWinandOrcaWin 1f5939dffc ci: run relay integration on a free hosted runner (#34666) 
It finishes in ~1.2 min beside ~7 min unit shards, so Blacksmith minutes buy no wall time.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 19:21:13 -07:00
OrcaWinOrcaWinClaude
 		beb53a7f9e ci: keep hourly and daily macOS builds on Blacksmith (#34640) 
Hosted macos-15 fails afterPack's packaged x64 terminal host boot check
(hourly run 40608643418: timed out waiting for the PTY), so no
latest-mac.yml is published. Windows, template qualification and routing
jobs stay on hosted runners.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-27 18:18:20 -07:00
OrcaWinandOrcaWin 2cd3e6d6a3 ci: narrow churny cache keys and move PR-local cache saves to main (#34600) 
* ci: narrow native, launcher and packaging cache keys and stop PR-local saves

* ci: hash Rust crate sources, not build outputs, in launcher and hook keys

* ci: fail closed on unlocked native packages and cover transitive key inputs

* ci: resolve the Windows Rust cache scope with a script, not a nested local action

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 18:14:29 -07:00
OrcaWinOrcaWinClaude
 		59dbb54dad ci: keep Git compatibility on Blacksmith (#34625) 
Its three parallel real-Git lanes, two of them through Docker, push
git-binary-compatibility.test.ts past the 30s test timeout on the 4-vCPU
hosted runner (64s file time vs 14s), failing PR #34600 twice after #34566.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-27 17:29:39 -07:00
OrcaWinandOrcaWin 965286939d ci: sweep caches on idle non-main branches every three hours (#34605) 
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 16:53:14 -07:00
OrcaWinOrcaWinClaude
 		7a834988dc ci: run mobile main tests on the hosted ARM runner PR verify uses (#34611) 
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-27 16:20:41 -07:00
OrcaWinandOrcaWin 791502fae4 ci: move secondary, scheduled and contract workflows to GitHub-hosted runners (#34568) 
* ci: move secondary, scheduled and contract workflows to GitHub-hosted runners

Public-repo standard hosted runners are free under Enterprise. Release, build,
benchmark, e2e and unit workflows stay on Blacksmith. ci-xterm-cache seeds both
cache stores since its PR consumer's pool is undecided.

* test(pi): resolve the smoke bundle's external packages from the repo

#34148 pulled zod into the commit-message planner graph; the bundle in the
OS temp dir could not resolve it on any runner.

* ci(unit): use four workers on the hosted four-core x64 runner

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 16:15:14 -07:00
OrcaWinOrcaWinClaude
 		f4d98b74e3 ci: run hourly and daily dev builds on free hosted runners (#34585) 
Hourly and daily builds publish unvetted dev channels on a schedule, so their
latency is not user-facing. Move the macOS build to hosted macos-15, the
Windows build to hosted windows-2022 (the release path), template
qualification to hosted lanes, and the small routing/publish jobs to
ubuntu-latest. Adhoc and release builds stay on Blacksmith.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-27 16:02:46 -07:00
OrcaWinandOrcaWin 1864543ade ci: warm GitHub-hosted runner caches and drop the serve-switch installer cache (#34576) 
* ci: warm hosted runner caches and drop the serve-switch installer cache

* ci: seed only restored caches from hosted warm legs

* docs(ci): hosted dev builds and no larger runners

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 15:33:07 -07:00
OrcaWinandOrcaWin 03d359749e ci: stop publishing the pnpm store from GitHub-hosted runners (#34588) 
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 15:32:51 -07:00
OrcaWinandOrcaWin 9cc555e2de ci: run off-critical-path PR jobs on free GitHub-hosted runners (#34566) 
Keep preflight and the unit-test matrix (the PR critical path) on Blacksmith; move routing, aggregation, contract, packaging and mobile checks to hosted standard runners, which are free for public repos under Enterprise concurrency.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 15:19:23 -07:00
OrcaWinandOrcaWin 3058cdd1a8 ci(node-server): run PR and scheduled qualification on free hosted runners (#34560) 
Only explicit fast_runners callers (manual, hourly/daily/adhoc builds) keep
Blacksmith; qualified-orcad-template's cache/save jobs always use ubuntu-latest.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 15:14:01 -07:00
Kelvin Amoaba 917ef9c737 feat(browser): install Chrome extensions from the Web Store into Orca's browser (#30940) 2026-10-27 22:04:12 +00:00
OrcaWinandOrcaWin 7b8ca17c64 build(runtime): target Node 24 while retaining host compatibility (#34177) 
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 14:40:37 -07:00
Younghwan ChaeNeilClaude Opus 5.5
 		44f4b1d255 docs(contributing): list the native toolchain and system libraries a first pnpm install needs (#31592) 
Local Setup named only Node, pnpm, and Bun. A first pnpm install also
compiles node-pty and the native addons with node-gyp and loads them in
Electron, and *.electron.test.ts fall back to xvfb-run on headless Linux.
Document the per-platform build toolchain, the Linux Electron runtime
libraries plus xvfb, and the Corepack/pnpm version caveats.

Fixes #31589

Co-authored-by: Neil <neil@stably.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-27 05:19:43 -07:00
bangchang 20411c1e5d docs: fix typos in the PR template (#29692) 
Fixes #29691
 2026-10-27 04:34:25 -07:00
OrcaWinandOrcaWin 164ced27e9 ci: run the node-server Windows x64 lane on the free hosted windows-2022 runner (#34350) 
The free windows-11-arm and macos-15-intel lanes already set the matrix's wall
time; the paid 8-vCPU Blacksmith Windows lane finished minutes earlier for ~$48/day.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 02:32:40 -07:00
OrcaWinandOrcaWin 64090416e3 ci(adhoc): start the 12-vCPU Mac packaging jobs after template qualification (#34327) 
Both arch jobs overlapped ~2.5 min of setup with qualification, then polled
for the template for 400-560 s on the most expensive runner we use.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 02:18:24 -07:00
OrcaWinandOrcaWin 581e23319d ci: run the macOS computer-use smoke only for macOS-relevant changes (#34325) 
The owner-loss smoke builds the Swift helper and forks the computer sidecar;
neither imports src/cli or src/main/daemon, yet those paths started the paid
macOS runner on every computer-e2e trigger. Move it to its own workflow with
the macOS-relevant subset of the old paths.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-27 01:39:36 -07:00
Neil ab9532ecd8 feat(wsl): let an idle WSL distro stop once its server idle-exits (#33084) 
* feat(wsl): let an idle WSL distro stop once its orcad idle-exits

The WSL host's holder kept the distro (and the WSL VM) running after Orca quit, even with
nothing running in it. orcad now leaves a release request in ~/.orca when a managed idle stop
retired its terminal daemon; the holder waits for that orcad to exit, claims the request and
ends, so WSL can stop the distro. Live terminals, working agents, enabled automations or a
returning client keep the distro held as before. A host whose distro is stopped at startup
reads as stopped instead of unreachable, and the real-WSL lane gains a phase that proves the
release and records memory.

* fix(wsl): key the holder release on the WSL-host launch marker; name the lane phase

The real-WSL lane showed orcad idle-stopping with its daemon retired while the distro stayed
up: the setsid'd orcad's environment is not guaranteed to carry WSL_DISTRO_NAME, so the
release request was never written. Use ORCA_WSL_ORCAD_HOST, which only WSL-host launches set.
Phase 3 now carries its phase name and path filter, and records what kept a distro running.

* test(wsl): dispose the idle-release lane's guest transports

Each guest command left its exec loop running, a wsl.exe client that kept the distro up after
the holder had already let go (the receipt showed no holder, no orcad, no request left).

* test(wsl): record which wsl.exe clients keep the idle-release lane's distro up

* test(wsl): satisfy the flaky-test ratchet; feed the new idle port in the release test

* test(wsl): snapshot guest processes after launch to find what holds the session

* test(wsl): locate the step that leaves the zombie holding the idle distro

* test(wsl): log the idle-release lane's guest commands with times to place the zombie

* test(wsl): follow the remote runtime client's move

* test(wsl): record when each leftover WSL session init started

* fix(wsl): keep the distro while the user still runs anything, and never trip on the request file

Review of #33084:
- The holder now checks, before claiming a release, that no process of the user runs outside
  the holder itself (session plumbing aside: systemd --user, (sd-pam), dbus-daemon). A detached
  tmux, nohup job or dev server keeps the distro; it fails toward holding.
- A new holder drops any request left from before it started, so an older orcad's request can
  never end a holder a client just asked for.
- orcad touches the request file only for WSL-host launches and never throws over it.
- The real-WSL lane proves a detached job keeps the holder and its request, and the distro
  stops once the job ends.

* fix(wsl): a running container keeps the distro, whoever owns its shim

Docker's containerd-shim processes run as root, so the user-only scan missed them and a
release would have stopped running containers. Any containerd-shim process now keeps the hold.

* fix(wsl): read each process status only up to Uid; document what keeps the hold

Delta review of #33084: dash reads a status file a byte at a time, so stop at Uid. Document
that a root default user never releases, that per-user agents hold it, and the hidepid
exception. The lane's pkill no longer matches the shell running it.
 2026-10-27 01:28:40 -07:00
Neil 0cff8e0fb7 ci(windows): rehearse the orcad template reseal over SignPath-signed binaries (#34316) 
* ci(windows): rehearse the orcad template reseal over SignPath-signed binaries

* ci(windows): keep rehearsal template jobs on GitHub-hosted runners
 2026-10-27 01:27:59 -07:00
hwantageandNeil 483573f0b9 fix(browser): focus newly opened image tabs (#34127) 
* fix(browser): focus newly opened image tabs

Focus the window before the webview so Command+W closes the new
image tab instead of the original tab after a plain image click.

Add tests for focus order, image loading, and close-shortcut forwarding.

Fixes #34114

* test(browser): verify image tab focus with native keyboard input

* refactor(ci): keep browser E2E routes within registry size limit

* fix(ci): enable background launch for native browser regression

* test(ci): include browser routes in isolated detector fixture

---------

Co-authored-by: Neil <neil@stably.ai>
 2026-10-26 22:52:40 -07:00
Neil 7a9abe48f3 refactor: group remote runtime client modules (#34133) 2026-10-26 17:47:25 -07:00
OrcaWinandOrcaWin 875d89af50 Refine lint performance and safe process execution (#34147) 
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-26 17:16:23 -07:00
OrcaWinOrca Test AuditOrcaWin
 		ad2156c358 test: remove 140 low-value cases and 49 suites (#34062) 
* test: remove 140 low-value cases and redundant browser probes

* fix: remove unused upstream chat menu import

* test: pin the host-split layout fixture branch

---------

Co-authored-by: Orca Test Audit <test-audit@stably.ai>
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-26 15:16:27 -07:00
Brennan Benson 5709037f4c Continue a chat after the terminal agent exits (#33759) 
* fix(native-chat): a chat sends again once the terminal's agent exits on macOS

The terminal-writer check required the pane's root process to be a shell,
but macOS panes spawn under login(1), which stays as the shell's parent,
so the check refused every send until the terminal closed. Census the
shell login started instead.

* Reconcile current terminal writer evidence before continuation

* Share fresh foreground confirmation and prove hosted login census

* Restore shell process identity import in foreground tracker

* Correct process fixture identity and polling callback contracts

* Align decisive Windows inspection fixture expectations

* Complete foreground inspection Session fixture
 2026-10-26 13:47:20 -07:00
OrcaWinandOrcaWin f34c13ca1e test: remove low-value main-process suites and browser probes (#33889) 
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-26 12:48:28 -07:00
OrcaWinandOrcaWin 819d273e27 perf(lint): one ast-grep scan feeds both the lint gate and the flaky-test ratchet (#33903) 
lint:ast-grep and check-flaky-test-pattern-ratchet each parsed the whole tree.
ast-grep-gates.mjs scans once; the lint gate re-runs ast-grep only on files with
warning-or-error findings (ast-grep's own report and exit code), and the flaky
ratchet counts test-* matches from the shared scan.

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-26 03:50:42 -07:00
OrcaWinandOrcaWin a26006aa6a perf(ci): overlap preflight's serial tail; parallel ratchets; allow 2-10 unit shards (#33887) 
- Plan unit selection starts after setup (overlaps lint) instead of last.
- Localization extraction starts with the typecheck; test-file-runners is background.
- run-ratchets.mjs runs ratchets in a pool (19s serial -> 8s locally).
- pnpm lint uses CI's single-parse check-import-boundaries.mjs.
- ORCA_UNIT_FULL_SHARD_COUNT accepts 2-10 (default stays 5).

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-26 03:17:34 -07:00
Brennan Benson 407069bc63 Unify terminal starts under one host operation (#32076) 
* Unify terminal starts under one host operation

* Pin winning geometry across a late terminal join

* Use terminal creation options type in launch race test

* Check closed panes after acquiring the terminal spawn lease

* Preserve terminal start resource and join boundaries

* Keep terminal attach regression within project boundaries

* Capture terminal spawn authority and preserve image coverage

* Use checked fixtures for terminal image replay regression

* test: expose persisted pane to main layout in attach race

* test: contract terminal spawn scaling and retention

* test: correct spawn scaling fixture types and CI selection

* test(terminal): cover exited prompt claims and adopted team cleanup

* test(pty): consolidate mock registry imports

* fix(pty): retain untyped IPC resume inputs in common contract
 2026-10-26 00:25:37 -07:00
OrcaWinandOrcaWin de93f326ea test: remove low-value inventories, passthroughs and redundant cases (#33796) 
* test: remove low-value inventories, passthroughs and redundant cases

* style: format test suites after pruning redundant cases

* test: remove obsolete workflow and flaky-test references

* test: prune deleted builder test from Windows shim allowlist

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-25 23:41:49 -07:00
Jinwoo Hong 64bba690ad feat(connector): inbox with held long poll, two confirmations and expiry, on connector tokens (#33734) 2026-10-26 01:27:26 -04:00
Jinwoo Hong 8cc8024504 feat(connector): connector service skeleton that checks auth-service tokens (#33723) 2026-10-26 01:20:53 -04:00
Jinwoo Hong a5f7da4928 revert(daemon): ship official Node in the macOS terminal host again, keep stall telemetry (#33688) 
Reverts #29133 except its daemon async-I/O stall telemetry, so we can measure how often stalls happen on official Node before committing to a patched runtime. The macOS terminal host goes back to the official Node 24.22.1 download and the daemon protocol back to v51; no release or hourly build published v52.
 2026-10-25 20:07:30 -04:00
Neil d9a7aa89c8 ci(wsl): rerun a WSL2 lane job once when its hosted runner freezes (#33532) 
* ci(wsl): rerun a WSL2 lane job once when its hosted runner freezes

* ci(wsl): pin the retry to the lane workflow and keep a 30 min job cap
 2026-10-25 16:06:20 -07:00
Brennan Benson 883b768bc7 A chat never starts writing a conversation a terminal is still writing, and restored panes respect open chats (#30930) 
* fix(native-chat): one ownership index with link roles, and a chat refuses to start while a terminal writes its conversation

Each chat link now carries its role (head or earlier) and key; Session History names
the chat continuing a conversation first, duplicate adoption checks only head links in
both the pre-commit check and the store transaction, and terminal resumes stay refused
exactly as before. The terminal-writer check now also runs inside acquireOwner before
the spawn, refusing with the typed pre-spawn reason conversationOpenInTerminal.

* fix(native-chat): hold a terminal start Orca issues until its terminal reports it

An in-memory registry of managed terminal starts per conversation, registered in the
same step as the resume admission (terminal.send with a resume command, createTerminal
with a command), bound to the PTY execution that runs it, and ended only when that
terminal's hooks report the conversation or the execution is gone. A chat's agent
start refuses while an entry may hold its conversation.

* fix(terminal): an automatic pane restore never resumes a conversation an open chat continues

Resume recipes built from a pane's saved facts (cold restore, deferred and late reattach,
sleeping wake, host mobile materialization) carry resumeOrigin 'saved'. The execution host
decides before any command is issued: while an open chat continues the conversation, or a
chat may be writing it, the pane starts its plain shell with the started-fresh notice and
its saved claim is forgotten; with unreadable records only a saved restore is refused and
its record kept. An admitted resume registers its managed start in the same step, so the
chat's agent start refuses until the terminal reports it or exits. Clearing the last saved
record now reaches disk.

* Fix saved terminal resume ownership and effective launch results

* Preserve conversation case and clear refused cold restore identity

* fix: publish effective terminal launch results on attachment

* fix: preserve terminal launch callback and candidate ownership

* fix: keep existing terminal attachments observational

* fix: consolidate terminal launch imports

* test: document snapshot runtime fixture boundary

* fix: preserve terminal launch identity types

* fix: accept reattach payload policy sessions

* fix: preserve terminal result validation contracts

* refactor: separate terminal create contract

* test: document partial terminal runtime fixtures

* test: align sleeping resume store fixture

* Fix terminal create type contracts

* fix: return the terminal main started to its waiting view

* fix: register reattached terminals before publishing their handles

* Check unavailable-resume test fixture types

* Complete sidebar resume test store fixture

* test: bound saved resume ownership and refusal work

* Settle refused saved resume claims from actual launch results

* Fix saved resume test type contracts

* test(e2e): capture exact terminal parking diagnostics

* test: verify parked terminal with fresh host inventory

* Consolidate agent session imports in remote terminal transport

* Clarify terminal conversation refusal guidance

* Admit note-only saved conversations without hiding live writers

* Retain terminal writer proofs through final admission
 2026-10-25 14:39:05 -07:00
Neil 65e513b193 fix(daemon): recover lost macOS worker wake-ups in the packaged terminal runtime (#29133) 
Builds the macOS terminal host's Node 24.22.1 from pinned source with a libuv patch: idle threadpool workers recheck for queued work every 30 s instead of waiting forever, so a lost Darwin condition-variable wake-up (libuv #5280) no longer strands terminal I/O. Bumps the daemon protocol to v52 so new terminals start on the patched runtime right after an update; older daemons stay attachable. Adds stalled/recovered daemon async-I/O telemetry, and lets release workflows rebuild older refs that predate the source build.

Fixes STA-11709, #31926.
 2026-10-25 17:28:34 -04:00
OrcaWinandOrcaWin 2a28fc7d4e [comment audit] Finish launcher and configuration comment review (#33513) 
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-25 04:20:32 -07:00
OrcaWinandOrcaWin 7d6603aa17 [comment audit] Complete repository-wide comment cleanup (#33249) 
* [comment audit] Align legacy failure-read counts with cached display

* [comment audit] Condense shared provider lifecycle and browser recovery comments [skip ci]

* [comment audit] Condense shared generation, path and preview comments [skip ci]

* [comment audit] Condense host, file and Git contract rationale [skip ci]

* [comment audit] Tighten Git lifecycle and provider contract comments [skip ci]

* [comment audit] Clarify shared host authority and launch isolation [skip ci]

* [comment audit] simplify local access mobile and native chat contracts [skip ci]

* [comment audit] simplify native chat presentation and state contracts [skip ci]

* [comment audit] simplify native runtime and provider contracts [skip ci]

* [comment audit] simplify migration and orchestration contracts [skip ci]

* [comment audit] simplify plugin trust and process capture rationale [skip ci]

* [comment audit] simplify terminal delivery and remote compatibility rationale [skip ci]

* [comment audit] clarify remote recovery and launch wire rationale [skip ci]

* [comment audit] shorten shared RPC compatibility and runtime evidence comments [skip ci]

* [comment audit] simplify secure storage shell startup and sidebar rationale [skip ci]

* [comment audit] clarify sidebar, skill and SSH invariants [skip ci]

* [comment audit] condense structured chat delivery and timing rationale [skip ci]

* [comment audit] condense terminal replay and telemetry invariants [skip ci]

* [comment audit] clarify launch permission and terminal delivery rationale [skip ci]

* [comment audit] clarify workspace ownership and layout contracts [skip ci]

* [comment audit] wait for fitted and painted SSH terminal links

* [comment audit] clarify layout persistence and session ownership [skip ci]

* [comment audit] clarify host routing and workspace lifecycle contracts [skip ci]

* [comment audit] clarify startup persistence and app lifetime comments [skip ci]

* [comment audit] clarify recovery and activity boundaries [skip ci]

* [comment audit] condense activity and artifact invariants [skip ci]

* [comment audit] condense automation authority contracts [skip ci]

* [comment audit] simplify automation scheduling and history contracts [skip ci]

* [comment audit] clarify browser chrome and annotation lifecycles [skip ci]

* [comment audit] clarify browser routing and retained guest ownership [skip ci]

* [comment audit] clarify browser recovery and document ownership comments [skip ci]

* [comment audit] restore hosted runners required by native IME fixtures

* [comment audit] shorten preview, palette and dashboard invariants [skip ci]

* [comment audit] clarify terminal preview, dashboard and retention comments [skip ci]

* [comment audit] clarify diff-note recovery and editor lifecycle comments [skip ci]

* [comment audit] shorten rich-text and combined-diff ownership comments [skip ci]

* [comment audit] shorten autosave, draft recovery and model ownership comments [skip ci]

* [comment audit] shorten save-queue, notebook and Markdown constraints [skip ci]

* [comment audit] shorten Monaco, PDF and rich Markdown safeguards [skip ci]

* [comment audit] clarify rich Markdown source and selection safeguards [skip ci]

* [comment audit] clarify editor loading and emulator stream lifetimes [skip ci]

* [comment audit] trim emulator and feature tour narration [skip ci]

* [comment audit] clarify floating workspace and GitHub cache ownership [skip ci]

* [comment audit] trim provider controls and Linear filter explanations [skip ci]

* [comment audit] clarify pairing and chat resume lifetimes [skip ci]

* [comment audit] clarify chat delivery and transcript lifetimes [skip ci]

* [comment audit] clarify session options and host-owned status [skip ci]

* [comment audit] clarify draft durability and live-status precedence [skip ci]

* [comment audit] Trim chat send and model ownership explanations [skip ci]

* [comment audit] Shorten transcript ownership and send recovery comments [skip ci]

* [comment audit] Simplify native chat composer and transcript hook comments [skip ci]

* [comment audit] Shorten native chat scroll and structured session explanations [skip ci]

* [comment audit] Trim workspace picker and onboarding commentary [skip ci]

* [comment audit] Simplify pet rendering, review cache and quick open comments [skip ci]

* [comment audit] Trim sidebar and session history explanations [skip ci]

* [comment audit] Condense session resume and review checks comments [skip ci]

* [comment audit] Shorten checks state and file explorer refresh comments [skip ci]

* [comment audit] Trim plugin bridge and source-control action rationale [skip ci]

* [comment audit] Trim source-control listing and review rationale [skip ci]

* [comment audit] Shorten sidebar lifecycle and explorer safeguards [skip ci]

* [comment audit] Condense Settings account and appearance rationale [skip ci]

* [comment audit] Trim pairing and repository Settings explanations [skip ci]

* [comment audit] Condense Settings search SSH and terminal safeguards [skip ci]

* [comment audit] Shorten Settings voice and provider ownership comments [skip ci]

* [comment audit] Condense Settings draft persistence and host-state rationale [skip ci]

* [comment audit] Trim Settings hooks and sidebar setup rationale [skip ci]

* [comment audit] Condense sidebar deletion and board-filter safeguards [skip ci]

* [comment audit] Condense worktree cards, host ownership and Markdown contracts [skip ci]

* [comment audit] Condense sidebar drag, folder and filtering contracts [skip ci]

* [comment audit] Condense sidebar parity, sleep and host ownership contracts [skip ci]

* [comment audit] Prune focus-read baseline after comment cleanup

* [comment audit] Clarify sidebar visibility, board drops and agent evidence [skip ci]

* [comment audit] Tighten sidebar listing, drag and reveal contracts [skip ci]

* [comment audit] Clarify viewport geometry and skill update safeguards [skip ci]

* [comment audit] Tighten skill inventory, usage and host status comments [skip ci]

* [comment audit] Clarify usage ownership and resource kill safeguards [skip ci]

* [comment audit] Tighten tab selection, rename and search contracts [skip ci]

* [comment audit] Tighten tab-strip geometry and drag ownership comments [skip ci]

* [comment audit] Tighten Tasks recovery, pagination and mutation comments [skip ci]

* [comment audit] Tighten provider loading and terminal recovery comments [skip ci]

* [comment audit] Tighten completion, cadence and PTY ownership comments [skip ci]

* [comment audit] Clarify terminal restore and parked-pane boundaries [skip ci]

* [comment audit] Tighten PTY startup and replay explanations [skip ci]

* [comment audit] Clarify PTY identity and delivery ownership [skip ci]

* [comment audit] Shorten remote reconnect and input replay rationale [skip ci]

* [comment audit] Condense terminal parking clipboard and file link comments [skip ci]

* [comment audit] Clarify IME ownership and trim trace history [skip ci]

* [comment audit] Shorten pane recovery and parked watcher explanations [skip ci]

* [comment audit] Condense snapshot replay and visibility recovery rationale [skip ci]

* [comment audit] Shorten terminal parking and keyboard ownership rationale [skip ci]

* [comment audit] Trim renderer lifecycle and menu rationale [skip ci]

* [comment audit] Condense workspace cleanup ownership and settlement notes [skip ci]

* [comment audit] Clarify renderer hook evidence and source ownership [skip ci]

* [comment audit] Tighten IPC ownership and reconnect explanations [skip ci]

* [comment audit] Trim renderer focus, paste and attention comments [skip ci]

* [comment audit] Shorten scroll, locale and agent lifecycle comments [skip ci]

* [comment audit] Trim agent launch, resume and ownership commentary [skip ci]

* [comment audit] Shorten account, browser and editor comments [skip ci]

* [comment audit] Clarify host-mirror waits, previews and input ownership [skip ci]

* [comment audit] Condense launch recovery and editor tokenization comments [skip ci]

* [comment audit] Condense workspace selection and terminal pane rationale [skip ci]

* [comment audit] Condense terminal fitting and rendering recovery comments [skip ci]

* [comment audit] Condense terminal input and host routing explanations [skip ci]

* [comment audit] Condense ownership and sleeping-session recovery rationale [skip ci]

* [comment audit] Condense structured launch and terminal link explanations [skip ci]

* [comment audit] Condense terminal ownership and workspace file routing rationale [skip ci]

* [comment audit] Condense session persistence and workspace activation rationale [skip ci]

* [comment audit] Condense workspace routing and browser ownership rationale [skip ci]

* [comment audit] Condense mirror recovery and layout authority rationale [skip ci]

* [comment audit] Condense runtime transport and file safety rationale [skip ci]

* [comment audit] Condense runtime graph and structured session rationale [skip ci]

* [comment audit] Condense browser creation and remote tab recovery rationale [skip ci]

* [comment audit] Condense snapshot authority and publisher recovery rationale [skip ci]

* [comment audit] Condense frame, startup and provider cache rationale [skip ci]

* [comment audit] Condense host twin and agent lifecycle rationale [skip ci]

* [comment audit] Condense browser authority and editor cleanup rationale [skip ci]

* [comment audit] Condense editor buffer identity and review cache rationale [skip ci]

* [comment audit] Condense provider lifetime and repository ownership rationale [skip ci]

* [comment audit] Condense reconnect, hydration and terminal retirement rationale [skip ci]

* [comment audit] Condense recovery, reconciliation and persistence rationale [skip ci]

* [comment audit] Condense cleanup ownership and listing admission rationale [skip ci]

* [comment audit] Condense teardown ordering and terminal ownership rationale [skip ci]

* [comment audit] Condense recovery ledger and web host-boundary rationale [skip ci]

* [comment audit] Condense web reconnect and credential lifecycle rationale [skip ci]

* [comment audit] Condense cloud rollout and assignment safety rationale [skip ci]

* [comment audit] Condense relay session and database recovery rationale [skip ci]

* [comment audit] Condense relay placement and protocol compatibility rationale [skip ci]

* [comment audit] Condense build and packaging constraints [skip ci]

* [comment audit] Condense CI gates and validation isolation rationale [skip ci]

* [comment audit] Condense catalog identity and browser validation rationale [skip ci]

* [comment audit] Condense mobile browser and frame-budget rationale [skip ci]

* [comment audit] Shorten mobile route and browser test explanations [skip ci]

* [comment audit] Condense editor and session seam test rationale [skip ci]

* [comment audit] Trim session and terminal closure history [skip ci]

* [comment audit] Shorten terminal browser and census explanations [skip ci]

* [comment audit] Preserve root-only E2E diagnostic baseline

* [comment audit] Condense mobile seam and HTML preview test rationale [skip ci]

* [comment audit] Condense preview instrumentation and render harness rationale [skip ci]

* [comment audit] Condense bundle contracts and native-build constraints [skip ci]

* [comment audit] Shorten native packaging and CI routing rationale [skip ci]

* [comment audit] Condense release tooling and benchmark constraints [skip ci]

* [comment audit] Condense packaging and platform gate rationale [skip ci]

* [comment audit] Shorten mobile route and history rationale [skip ci]

* [comment audit] Condense mobile browser and component rationale [skip ci]

* [comment audit] Shorten drawer and workspace-form rationale [skip ci]

* [comment audit] Trim mobile review and editor-document explanations [skip ci]

* [comment audit] Condense editor lifecycle and Markdown explanations [skip ci]

* [comment audit] Trim mobile file, diagnostics and dictation commentary [skip ci]

* [comment audit] Simplify mobile host-list and workspace-view explanations [skip ci]

* [comment audit] Clarify mobile shell lifetime and bridge delivery constraints [skip ci]

* [comment audit] Condense bridge stream, native request and audio rationale [skip ci]

* [comment audit] Reduce bridge schema and page-client commentary [skip ci]

* [comment audit] Tighten mobile page bridge contracts [skip ci]

* [comment audit] Clarify mobile cache and session constraints [skip ci]

* [comment audit] Condense mobile route and lifecycle rationale [skip ci]

* [comment audit] Tighten mobile shell hook timing rationale [skip ci]

* [comment audit] Clarify route handoff and notification compatibility [skip ci]

* [comment audit] Clarify push registration and dictation cleanup constraints [skip ci]

* [comment audit] Condense keyboard geometry and native media ownership rationale [skip ci]

* [comment audit] Tighten mobile chat scroll and composer concurrency rationale [skip ci]

* [comment audit] Condense mobile reply compatibility and upload ownership rationale [skip ci]

* [comment audit] Condense optimistic echo and scroll ownership rationale [skip ci]

* [comment audit] Tighten stream replay and queued session ownership rationale [skip ci]

* [comment audit] Condense mobile composer and reply-schema constraints [skip ci]

* [comment audit] Clarify mobile transcript recovery and session ownership [skip ci]

* [comment audit] Clarify mobile queue and source-control compatibility [skip ci]

* [comment audit] Condense storage and task launch constraints [skip ci]

* [comment audit] Clarify task schemas and terminal document ownership [skip ci]

* [comment audit] Tighten terminal input and viewport rationale [skip ci]

* [comment audit] Shorten terminal and RPC recorder contracts [skip ci]

* [comment audit] Condense recorder engine and connection contracts [skip ci]

* [comment audit] Shorten host credential and relay recovery comments [skip ci]

* [comment audit] Tighten pairing recovery and bundle transport rationale [skip ci]

* [comment audit] Clarify RPC delivery and workspace catalog boundaries [skip ci]

* [comment audit] Condense catalog and relay entry contracts [skip ci]

* [comment audit] Shorten shutdown and SSH relay delivery contracts [skip ci]

* [comment audit] Condense WSL relay and E2E regression rationale [skip ci]

* [comment audit] Shorten cross-version harness and renderer fixture explanations [skip ci]

* [comment audit] Condense paired-host and E2E lifecycle rationale [skip ci]

* [comment audit] Shorten layout oracle and regression explanations [skip ci]

* [comment audit] Condense paired recovery and ownership regression contracts [skip ci]

* [comment audit] Shorten restart, sidebar and SSH lifecycle contracts [skip ci]

* [comment audit] Condense terminal rendering and IME regression rationale [skip ci]

* [comment audit] Shorten terminal recovery and benchmark contracts [skip ci]

* [comment audit] Condense tooling and Windows lifecycle proof rationale [skip ci]

* [comment audit] Condense workflow routing and release rationale [skip ci]

* [comment audit] Condense mobile security and installer contracts [skip ci]

* [comment audit] Shorten native rationale and stylesheet workarounds [skip ci]

* [comment audit] Shorten Windows visibility probe rationale [skip ci]

* [comment audit] Condense embedded release and signing rationale [skip ci]

* [comment audit] Retain current main test behavior in final reconciliation [skip ci]

* [comment audit] Complete final comment review across current source inventory

* [comment audit] Handle consolidated audit reports before final CI

* [comment audit] Preserve credential storage census detail [skip ci]

* [comment audit] Scale broad changed E2E selections with verified timing shards

* [comment audit] Align E2E assertions with browser close and settled session metadata

* [comment audit] Match existing E2Es to current resource and windowing contracts

* [comment audit] Observe the shared server outage notice in reconnect coverage

* [comment audit] Make existing renderer probes measure settled tab and PTY work

* [comment audit] Align palette E2E selector with task search

* [comment audit] Refresh remaining palette search selectors

* [comment audit] Keep selector correction within selected audit specs

* [comment audit] Await emoji fixture settings inside renderer evaluation

* [comment audit] Cancel fixture fit retries between terminal tests

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
 2026-10-25 04:05:46 -07:00
Neil 3e950ca049 refactor(native-chat): group tool attribution modules (#33482) 2026-10-25 02:45:52 -07:00