optionalAskTimeout computed exactly what cappedWait does (an undefined timeout stays undefined;
anything else clamps to 0..ORCHESTRATION_ASK_MAX_TIMEOUT_MS), so the ask call uses cappedWait.
Three functions used only inside their own file lose their export, and the per-host switch's
doc names the orchestration commands it has gated since #29571.
Co-authored-by: Claude <noreply@anthropic.com>
* Run automated workspace setup in a dedicated tab
* Preserve native-chat setup route coverage after placement retirement
* Preserve Setup tab design and independent review evidence
* Classify activation test fixtures consistently for routing checks
* Sync runtime English catalog after removing setup preferences
* Update listener savings model after retiring setup action
* fix(terminal): open the picked Windows shell on a managed host instead of typing it into PowerShell
* fix(terminal): keep the shell pick through materialization and folder runtimes
* fix(terminal): refuse a shell pick on agent launches and update paired-tab expectations
* test(terminal): type the shell-selection runtime fixture instead of casting
resolveResumeLaunchRecipe now also carries the recorded agentCommand and ompResumeFilePath, so
the three resume lanes stop repeating the same conditional spreads. The rule is unchanged: a
resume relaunches with exactly what its launch recorded, or nothing.
Co-authored-by: Claude <noreply@anthropic.com>
The synchronous drainAgentHookSpool and currentAgentSessionThreadGoalBySequence lost their
last production callers earlier today; tests now exercise the functions production calls.
git-object-quarantine reuses isDefinitiveAbsence instead of a private ENOENT/ENOTDIR copy.
Co-authored-by: Claude <noreply@anthropic.com>
The deploy's pinned-runtime download (SSH, WSL host, Windows host) passes no fetcher, so it goes
through getMainHttpClient(), which the desktop backs with Chromium's default session: system, PAC
and Orca proxy settings and proxy login apply. Guard that a plain global fetch never replaces it.
Co-authored-by: Claude <noreply@anthropic.com>
A Claude chat's / menu listed /color, /doctor and /reload-plugins until the
first message ran, then dropped them: the CLI names its terminal-only commands
only in the init frame a turn emits, and the catalog treated that list as a
hide-list. Chat runs all three (/color and /reload-plugins answer locally,
/doctor is an ordinary turn), so the catalog now keeps every command Claude
reports and the menu no longer changes on the first message.
- Specs with their own CI jobs were also being assigned to general E2E shards, so they could run twice or in the wrong job.
- planE2e now drops dedicated specs before balancing and fails if no general specs remain, instead of producing an empty plan.
- The mobile subscribe spec builds a paired runtime connection from the pairing offer before sending requests, matching the updated remote runtime helper signatures.
* fix(settings): show a Keychain unlock on its own instead of leaving the locked notice up
The server already recovers on its next status read, but Settings read Linear
and Jira status once, so the locked notice stayed until the user pressed Test.
While the notice is up it now re-reads its provider's status every 10 seconds.
* fix(settings): wait for each Keychain status read before the next
A newer status read discards an older one, so an interval could keep
discarding every slow read and never show the recovery.
* fix(settings): poll the Keychain status with an in-flight guard
* fix(wsl-cli): keep the WSL CLI status check from timing out on a cold or slow-profile distro (#29497)
* fix(wsl-cli): run install/remove without the login PATH; a PATH-check timeout reports PATH unknown
* Finish structured agent readiness before delivering held work
* Adapt permission fixtures to startup lifecycle
* Keep model discovery for chats before their first start
* Use one host readiness promise for provider operations
* Await provider opening in the execution host
* Await Claude initialization in host-owned open
* Observe Claude readiness through the host status
* Keep optional readback behind host readiness
* Recheck launch permission after host readiness
* Preserve the awaited child during permission revalidation
* Record failed owned opening before the first message
* Abort a matching provider open when its child exits
* Cover provider exit during an unanswered host open
* Cover explicit failure facts on a host-stopped child
* Keep startup waits cancellable and preserve operation order
* Keep live choices and delivery order while agents start
* Apply startup picks and let parked messages release operations [skip ci]
* Save a waiting startup pick after Stop ends its opening [skip ci]
* Save choices when startup ends or a replacement is still opening
* Check saved choices separately from Claude startup reports
* Align startup fixtures and preserve observed Claude exits
* Order startup picks before later messages and retain flow regressions
* Keep reviewed lifecycle contracts while pruning duplicate tests
* Save picks after a proven exit without requiring a child
* Type the startup reply fixture against the Claude control contract
* Honor the before-input callback in the startup reply fixture
* Keep startup option menus independent and show the saved choice
* Exercise startup picks across real menus and the runtime
* Keep saved effort visible when picking a model during startup
* Include the running-turn scope in repeated Stop fixture
* Use the current attach contract in import fixtures
* Align carried-message fixture with startup event contract
* Keep launch-only permission picks usable while prior writes wait
* ci: rerun on main with the locale fix
* Preserve goal retries and chat launch selections
* Give launch regression its request identity
* test(native-chat): type the provisional-launch hook's session prop
* fix(projects): refuse a folder-to-Git type change that would hide folder workspaces (STA-10638)
A folder project's extra workspaces exist only as metadata rows that the folder listing shows. Changing the project to Git switches it to `git worktree list`, so those workspaces drop out of the next refresh and their saved tabs are purged as if they had been deleted. Only the automatic upgrade checked for this; `orca project setup-update --kind git`, repo updates and clone-into-folder did not.
The check now lives in the one repo write every type change goes through, so any caller gets the same refusal and nothing is written. The automatic upgrade and both clone paths use the same check and keep the project as a folder project.
* test(repos): give the repo handler store mock the metadata read the clone path now uses
* test: run repo catalog request coordination in Bun
* fix: remove redundant chat callback alias to restore lint
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(relay): destroy a pooled client whose session the server ended, and mark work that never ran
pg keeps calling a client queryable until its socket's end arrives, so a client released after
57P01 (pg_terminate_backend, shutdown) or a dropped socket went back to the pool and failed the
next caller's statement with 'Connection terminated unexpectedly'. Such clients are now released
with the error, so pg-pool discards them.
Also marks failures where no statement of the operation reached the server (acquire, a failed
BEGIN, a client dead at checkout) so a caller can tell work safe to re-run.
* fix(relay): skip ROLLBACK on an ended session, drop unused nothing-ran marking
Adds 57P04/57P05 to the session-ended codes and covers 08xxx, a dropped
socket, an ordinary 23505, and a real pg_terminate_backend.
Claude-Session: f2fe8cb5
* Ask Claude for a resting chat's / menu instead of rebuilding it from folders
A Claude chat whose Claude isn't running (a new chat, or any chat after a
restart) offered only clear/compact plus folder commands and skills, so
Claude's own built-ins like /goal, /init and /review were missing until the
first message started Claude.
The at-rest catalog now sends Claude one initialize control request in the
chat's launch folder, through the same sessionless path the model list uses
(same binary, env, account pin and supervised runner), and shows the list
Claude answers. Hooks and MCP servers are off for that one process. Results
are cached per workspace and account for 5 minutes, and at most two probes
run at once. If Claude can't answer, the folder scan is used as before.
* fix(claude): keep Claude's own / list when a later refresh fails
* fix(claude): preserve CLI commands across overlapping fallback scans
* fix(claude): keep overlapping command refreshes eligible
* test(claude): await fallback settlement in overlap case
* test(pty): pin where the two spawn lanes build a daemon spawn's host env differently
Characterization on main's code before the host-env step merges: which failed env builds sweep
per-PTY state (minted ids only, both lanes), the empty-id split, the host-only WSL Pi/OMP guest
readiness wait, and that a host create operation still waits on a managed Codex login.
* refactor(pty): one host-env step for both terminal spawn lanes
The window (pty:spawn) and host (runtime controller) lanes each carried a copy of Codex resume,
Codex home selection, the managed-auth wait, backfill recovery and the daemon host-env build.
Both now call resolvePtySpawnHostEnv. Lane differences are explicit inputs: two TEMPORARY ones
(the host-only WSL Pi/OMP guest readiness wait; the host skipping host env for an empty id) and
three that mean the same in both lanes. The resume step's launchEnv was never read and is gone.
* test(pty): pin that both lanes hand Codex resume prep the request's CODEX_HOME
orca serve (#29209) skips resume prep for a launch whose env names a client-sent CODEX_HOME.
* test(pty): type the new lane-pin requests instead of asserting them
* test: pin selected Codex home on terminal restart
* test(launch): pin what a paired agent session spawns today
Characterization on main's code before createAgentSession moves onto the
host planner: plain launch, short/long/multi-line prompts on macOS, a
stdin-prompt agent starting clean, Windows PowerShell and cmd quoting, and
the identity-required refusal when no launch can be built.
* refactor(runtime): plan paired agent sessions with the host planner
terminal.createAgentSession built its own launch command beside the planner
every other host launch uses, and the two had drifted. It now hands the
request to createTerminal as a startupAgent, so one planner builds it.
The planner gains a draft delivery input, and one TEMPORARY input
(startupPromptCarry: 'force-line') keeps what createAgentSession did: the
prompt always rides the typed line, and an agent that reads its prompt
after start launches clean. The later change that delivers uncarried
prompts after start removes it. A launch that can't be built still refuses
with agent_session_identity_required.
* test(accounts): pin that the selected account wins over Settings agent env
A paired agent session now layers the host-selected account env the way
every other host launch does.
* fix(runtime): report prompt carry truthfully on the planner's direct path
Review round 1: a stdin-prompt agent's text never rides its launch line, a
draft comment that overstated the carry rule, the error class's name, and
formatting the cherry-picked commit skipped.
* docs(runtime): scope the account-order and draft comments accurately
Review round 2.
* test(launch): drop paired-session parity rows that pin nothing new
The no-prompt and short-prompt rows plan the same with or without
force-line, and the Windows cmd row repeats the OpenCode-model Windows
row's createAgentSession runtime and cmd quoting. The long-prompt,
aider, PowerShell, refusal and account-env pins keep the coverage.
* docs(runtime): label the draft's carry-rule exemption temporary
Skipping the typed-line carry rule for drafts is createAgentSession
parity, not design: a draft on the line has the same hazards as a
submitted prompt. The one prompt/draft delivery policy removes it with
force-line.
* fix(runtime): keep main's error name for an unbuildable agent launch
Overriding the name made every other planner caller's stringified
error read 'AgentLaunchUnbuildableError: ...' instead of main's
'Error: ...', which renderer code that strips an 'Error:' prefix
would show raw. createAgentSession matches by instanceof, so the
override bought nothing.
CI's Mobile verify timed the 'finishes' case out at 5s: it hashed and base64-encoded
twelve real 384 KiB windows under fake timers. The link now costs a fixed 17s of
fake time per window over a 1 KiB grid, so the test runs in ~20ms and still fails
on the per-read timeout without the #29751 fix.
* fix(mobile): keep the app download going over a slow link instead of timing out each queued read
Each bundle window read had its own 30s request timeout, but its reply queues
behind the other three reads in flight. On a slow link (Tailscale through a
relay) the fourth reply could not land within 30s, so the download showed
progress and then failed with 'Request timed out: mobileWeb.bundle.range'.
The fetch now fails only when no window reply lands for 30s, and each read's
own deadline is a long backstop.
Fixes#29697
* fix(mobile): bound a stalled bundle fetch's pending reads to the in-flight budget
* test(mobile): re-record bundle-fetch goldens for the per-read backstop option
* chore(i18n): translate new keys to es/fr/ja/ko/zh
Scan 2026-10-15 (window 7244bf3e6f..e2f2277d512): 38 new en keys, 16
removed, 0 changed. All five locales missed the same 18 keys (the other
14 are pinned English-fallback). Translated the 18 x5, fixed badly
translated existing strings, and ran two review rounds.
* rm worklog file
* Add website navigation to the Cmd+J palette
Typing a URL or host such as brex.com or localhost:3000 in Cmd+J now
offers a "Go to <url>" row that opens the site in a new browser tab in
the invoking group. Previously the query only went to search, and the
new tab always opened the default page.
- Classify input with the existing tab-create URL classifiers. Blocked
schemes such as javascript: and file:, oversized queries, and plain
words stay on the normal search path.
- Pass an optional URL through openNewBrowserTabInActiveWorkspace. A
requested URL skips address-bar focus so the page can load directly.
- Rank the website row first unless an exact entity match or an
issue/PR URL should lead. Query-bound actions carry sourceQuery and
are ignored on select if the live input has changed, so a stale row
cannot open the wrong site.
* Open typed websites from Cmd+J in a browser tab
Cmd+J now opens a typed site such as brex.com or localhost:3000 in a new
browser tab. Bare dotted names only count as sites when the suffix is a
listed domain, so file names like App.vue or Cargo.lock still resolve as
files. Browser open failures show a toast instead of an unhandled rejection.
* Fix Cmd+J website action availability
Jinjing
Brennan Bensonandm4air
NeilandClaude
Jinwoo Hong
OrcaWinandOrcaWin
Kelvin Amoaba
Žan MlakarandKelvin Amoaba