Orca terminals run under the signed helper, whose executable was stock Node,
sharing its LC_UUID with every install of that Node build. macOS Local Network
privacy maps a responsible process to an app by that UUID, so terminals could be
attributed to another program and blocked from the LAN while Orca showed allowed.
Rewrite the helper executable's UUID during assembly (same scheme as #41676),
and fail packaging and the release check if it drifts.
Fixes#21988
* fix(computer): press, set and scroll Windows native controls without activating the window
Measured on Windows CI: UI Automation's Invoke, Toggle, ValuePattern and
ScrollPattern focus a background WinForms control first, which activates its
window. Native controls now go through their own messages instead, each
owner-checked: BM_CLICK for buttons, check boxes and radio buttons, select-all
plus EM_REPLACESEL for set-value on edits, CB_SETCURSEL with CBN_SELCHANGE for
combo boxes (exact-text match, read back after the app's handler runs) and
LB_SETTOPINDEX for list box pages.
* fix(computer): refuse read-only Windows documents before typing keys, document the caret fallback
* fix(computer): keep Windows native routes to measured controls and refuse partial writes
BM_CLICK only for WinForms buttons, multi-column lists stay on ScrollPattern, a
list already at its end reports success, edits refuse text past their limit,
the combo's owner is checked right before the selection, a cleared selection
reads as a mismatch and a disabled control is element_not_enabled.
* fix(computer): hold Windows edit limits without a readback, require a complete combo search
* fix(computer): read a long Windows edit's length from the field for its limit check
* test(computer): share the Windows fixture action helpers
* wip
* wip
* wip
* wip
* Improve experimental worktree cards with compact agent summaries
- Add an optional details row for workspace metadata and indicators
- Roll up descendant activity timestamps to parent cards
* Reduce worktree card metadata indentation
* wip
* Expand sidebar agent lines with subagents and remote host status
- Show subagent activity, send targets, and unread signals in slot cards
- Identify remote hosts and provide SSH reconnection controls
* Show child workspace status counts in sidebar cards
Distinguish monitoring agents and refine lineage alignment so workspace
activity is easier to scan.
* Enable navigation from worktree sidebar activity indicators
- Open the matching agent or workspace directly, or choose among multiple sources
- Use host-qualified identities for nested workspace activity
- Show pull requests in 2.0 card details and refine compact card layout
* Show every status in the sidebar card corner and let cards open and close
The title-row corner now shows one glyph per status the card speaks for
(needs, failed, unread, working), most urgent first, followed by the time,
instead of only the most urgent one. Each glyph opens its own sources.
Collapsed child workspaces report all their statuses through a flat,
shallow-comparable record.
Experimental 2.0 cards can also be opened and closed; a closed card's
title slot speaks for its hidden agents and children.
* final worktree design
* wip
* rm
* wip
* wip
* fix style
* fix commit
* Improve worktree card interactions and spacing
- Let users toggle cards by clicking their headers.
- Delay details until the pointer rests to avoid accidental popups.
- Add breathing room around card content.
* wip
* fix issues
* wip
* Improve workspace sidebar icons and navigation
- Batch AI icon generation and add settings to customize and regenerate icons.
- Fix agent navigation and unread handling across execution hosts.
- Keep linked reviews visible while loading and reduce unnecessary refresh work.
* Fix sidebar agent ownership and targeted title updates
Resolve unstamped agent sessions to their workspace runtime so sidebar
summaries and unread state follow the correct host. Limit title-change
invalidation to affected workspaces.
* fix build
* Simplify worktree sidebar icons and agent rows
- Generate monochrome icons that match the sidebar foreground
- Move agent model names into row tooltips to reduce clutter
* Keep agent timestamps visible alongside dismiss controls
* Fix worktree icon regeneration and bound the cache
Cancel stale requests when clearing icons so older results cannot
restore the previous cache. Evict unused renderer entries to limit
memory growth.
* Unify experimental workspace cards around title status
- Surface hidden agent and child workspace activity in the card title.
- Retire the second experimental layout and AI-generated icons.
- Preserve existing experimental card selections and add a details row option.
* wip
* wip
* wip
* fix bugs
* improve perf
* Fix sidebar lineage rollup: unread dot on children, running status on collapsed parent
- A card's unread dot and bold title now include its own visible agent rows'
unread results, so expanding a parent reveals which child the unread came from.
- A collapsed parent's status lane shows the most urgent descendant state
(needs you > failed > working) when it beats the parent's own status.
- Host-scoped workspace unread markers and related attention fixes.
* Improve sidebar activity rollup performance
- Refresh only stale descendant slots and scope unread updates to their workspace.
- Share agent row projections and index unread markers to reduce repeated work.
- Preserve host-specific agent activation and show the latest activity time.
* wip
* Fix sidebar attention state and optimize slot invalidation
- Preserve unread flags raised by users or earlier sessions when markers clear.
- Scope agent list expansion to each host.
- Track displayed panes and freshness deadlines to limit slot updates.
* wip
* Fix sidebar workspace status and host ownership
- Keep agent navigation and unread state scoped to the correct host,
including paired SSH workspaces and runtimes.
- Correct collapsed lineage status, stale review display, and settings
synchronization while reducing unnecessary sidebar refreshes.
* Show unread agent completions and scope workspace reads by host
* fix compile issue
* wip fix static checks
* wip
* Fix workspace sidebar agent ownership and PR display
- Update agent rows when terminal host bindings arrive and preserve
local ownership for unstamped retained completions.
- Keep newer hosted PRs visible when an older merged PR is cached.
* fix(computer): type into Windows text fields without raising the window
Adds type-text --element-index on Windows through EM_REPLACESEL for user32,
RichEdit and WinForms edits (owner-checked, read back with WM_GETTEXT), or a
ValuePattern write merged with the TextPattern selection. Keyboard verbs on a
background window now refuse with background_unavailable before sending
anything and point at type-text --element-index. Foreground typing uses one
SendInput KEYEVENTF_UNICODE batch instead of WM_CHAR posted to the top-level
window, and get-app-state shows multiline edit text again.
* fix(computer): refuse typing into Windows list items, keep the caret on a confirmed prefix
* Reuse resolved executable paths for Mac process launches
* Keep synchronous launch wrappers covered by the ratchet
* Explain executable launch type assertions
* Remove resolved Git imports from the direct-launch baseline
* Keep native spawn cancellation on the native lookup path
* fix(mac): give Orca's main executable its own Mach-O UUID
macOS Local Network privacy identifies an app by its main executable's
UUID. The packaged executable is stock Electron's, so it shares that UUID
with every other app on the same Electron version and macOS can apply
another app's Local Network decision to Orca. Rewrite LC_UUID in every
slice to a value derived from the app id, executable name and CPU type,
before signing.
* fix(mac): re-sign rewritten executables ad hoc, cover the terminal host, assert UUIDs at release
Rewriting LC_UUID breaks Electron's linker ad hoc signature, and arm64
kills unsigned code, so identity-less local builds (where app signing is
skipped) produced an Orca.app that died at launch. Re-sign the rewritten
executable ad hoc, outside the bundle so codesign does not treat it as
the bundle; real signing replaces it later.
The terminal host's executable is a stock Node binary whose UUID is
shared by every copy of that Node release, so give it its own stable
UUID the same way. Packaging and release verification now fail when a
shipped executable does not carry its expected UUID.
* fix(mac): scope the executable UUID rewrite to the main app
The terminal host gets a separate design; leave it unchanged here.
* fix(speech): spell near misses of dictionary terms the term's way
* fix(speech): ship the common-word list as a 2% Bloom filter to fit the phone page budget
* fix(ime): keep plain-committed Hangul so macOS 2-Set can rebuild it in place
Right after an input-source switch, macOS 2-Set can commit a lone jamo as
plain text and then rebuild it (ㅇ + ㅏ → 아) by replacing that committed
range. The native text forwarder emptied the field after every commit, so
the replacement had nothing to land on and the vowel was dropped (#9738).
Keep Hangul commits in the field (Latin commits still clear for #11504),
and erase replaced text from the PTY before the replacement is sent.
* fix(ime): only erase retained Hangul when the replacement is forwarded and still at the PTY cursor
Drop retention on blur, on any composition start, and on chord/named keydowns
the pane handles before the forwarder (macOS Ctrl+C, non-Latin control chords).
Erase only for insertText/composition replacements that end at the field tail.
* ci(e2e): route terminal IME changes to IME specs again after the input/ owner move
#39113 moved IME and keyboard policy files under terminal-pane/input/, but the
native IBus and synthetic IME routes still matched the old paths, so IME changes
selected neither lane.
Neil
Kelvin Amoaba
Jinjing
Brennan Benson
OrcaWinandOrcaWin
Jinwoo Hong