* fix(composer): show full worktree path on hover in Run on dropdown
Co-authored-by: Orca <help@stably.ai>
* refactor(composer): use native title tooltip for Run on paths
Co-authored-by: Orca <help@stably.ai>
* fix(composer): reliable native-style tooltip for Run on paths
The native title attribute won't re-trigger between adjacent rows in
Chromium, so the tooltip flickered/dropped as you moved down the list.
Use the shared (controlled) Tooltip instead, styled compact + arrowless
to read like an OS tooltip; the app-level provider's skip-delay makes
row-to-row hovers reliable.
Co-authored-by: Orca <help@stably.ai>
* fix(composer): stop Run on path tooltip wedging shut
Radix's uncontrolled hover state could flash the tooltip open then
wedge it closed inside the cmdk list (shared pointer-transit state
getting stuck), so re-hovering never reopened it. Drive open state
with a controlled hover-intent handler (open after a delay, close
after a short grace) so re-entry always reopens and transient
enter/leave thrash debounces to a stable state.
Co-authored-by: Orca <help@stably.ai>
* fix(composer): rebuild Run on path tooltip as a portal (no loop/wedge)
Both the native title and Radix Tooltip (controlled or not) misbehaved
inside the cmdk list: flashing, wedging shut, or opening/closing in a
loop. Replace with a self-contained tooltip that renders a fixed,
pointer-events-none portal on document.body and only changes state on
pointer enter/leave/down (never pointermove). Opening it cannot reflow
the list or become the hover target, so it structurally cannot create
the enter/leave feedback loop.
Co-authored-by: Orca <help@stably.ai>
* fix(composer): trigger Run on path tooltip on the path line, always below
- Scope the hover trigger to the truncated path line itself (not the
whole row), so only hovering the path reveals it.
- Always position the tooltip below the hovered line for predictable
placement (was flipping above near the viewport bottom).
Co-authored-by: Orca <help@stably.ai>
* fix(composer): anchor Run on path tooltip under the path line
The old placement anchored to the window's right half when the trigger
sat past viewport-center, which shoved the tooltip to the far right edge
of the window, disconnected from the dropdown. Always left-align it
directly under the hovered path line and cap max-width to the remaining
viewport width so long paths wrap instead of overflowing.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Resolve Microsoft Store PowerShell App Execution Aliases to their real package executable before ConPTY spawn, while preserving explicit PowerShell choices and the existing fail-safe fallback chain.
* Allow hiding Orca Mobile sidebar button once a device is paired
Introduce a shared external store (`paired-mobile-devices.ts`) to cache
and synchronize the paired mobile device list across the sidebar,
Settings pane, and Mobile page. This prevents redundant backend IPC
requests when multiple surfaces mount simultaneously.
Using this shared pairing status, display an inline "Hide from sidebar"
control next to "Orca Mobile" in the navigation sidebar once a device
has been paired. This allows users to easily declutter their sidebar
after completing setup.
* Handle device load errors with recovery on focus/reconnect
- Add error flag to distinguish failed device loads from empty device lists
- Recover from transient startup IPC failures by retrying on window focus or online
- Validate revoke device success before routing or showing success toast
- Only show hide control after first device is actually paired
- Use snapshot getter to avoid manual device ref tracking in MobilePane
* Handle device load errors with recovery on focus/reconnect
- Shared module-level listeners for failed load recovery reduce IPC spam
compared to per-consumer event listeners on every focus/online event.
- Optimistically remove revoked devices if post-revoke reload fails,
keeping success toast and intro routing correct.
- Prevent repo/branch label overflow with CSS text truncation.
- Fix HTML entity rendering: use plain spaces instead of in
translations so React text nodes render them correctly.
- Add comprehensive tests for the paired devices hook covering load,
navigation, revoke, and error recovery paths.
Only offer 'Proceed Anyway (Unsafe)' if the connected remote runtime
advertises browser.certificate-trust.v1 support. Older runtimes cannot
honor the request and would fail silently, creating a false affordance.
Centralize certificate error normalization to prevent divergence
between main and renderer certificate matching, and unify URL redaction
for Kagi session token stripping across load-error paths.
* feat(ssh): download folders from remote explorer
* fix(ssh): harden remote folder downloads
* Add missing getRepo stub to worktree cwd test mock
Restoring headless mobile tabs looks up the repo for the active
worktree id; the mock lacked getRepo, so the test only passed
incidentally. Add it explicitly and return undefined since wt-1
is a worktree id, not a registered repo.
* Enable SSH folder downloads, gated for system-SSH connections
- Folder downloads require SFTP, unavailable on system SSH (which
offers only raw file operations). Add supportsFolderDownload flag
to gate the feature in the UI layer.
- Reject symlinks at directory-entry level, preventing tree escapes
and eliminating unnecessary stat calls.
- Check abort signal before opening dialog for better responsiveness
when renderer closes.
- Log cleanup errors without re-throwing to preserve underlying
transfer failures.
* Gate SSH folder downloads to SFTP-capable connections
Enforce fail-closed gating and add Windows path traversal validation to
ensure downloads are only available when explicitly supported and safe.
* Gate SSH folder downloads to SFTP-capable connections
Enforce fail-closed gating and add Windows path traversal validation to
ensure downloads are only available when explicitly supported and safe.
* fix(ssh): keep provider types under max-lines after main merge
Move FolderDownloadOptions next to the SFTP download implementation and
narrow IFilesystemProvider.downloadFolder options to AbortSignal only so
types.ts stays within the 300-line oxlint budget when merged with main.
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Raise the floating terminal panel from z-30 to z-45 so it sits above
notification cards (z-40) but below the modal layer (z-50), preventing
notifications from burying the terminal. Raise the toggle button to z-46
to keep it clickable where it overlaps the panel.
* Guard add-review-note chord to prevent remount (product B)
- Scoped guards consume chord at composer level to prevent remount and leakage
- Handle OS key-repeat: ignore when no draft, consume when one is mounted
- Clear stale block keys in markdown preview when content renumbers
- Flush pending selection before reading targets to fix timing races
* fix(editor): repair add-review-note guard tests and close remaining chord gaps
- Update the product-B guard tests to the Mod+Shift+A default binding
(#9257 retired Mod+Alt+N as AltGr-unsafe); they asserted the old chord,
so seven landed red and the rich-editor repeat test passed vacuously.
- Monaco: recompute the annotation target from the live selection at
keydown instead of the render-lagged ref, so a chord right after a drag
cannot open on the previous selection or miss a fresh one.
- Preview: key the stale-block-key cleanup on renderedContent (the DOM
the block keys live in), which can lag content during external-edit
section preservation.
Co-authored-by: Orca <help@stably.ai>
* fix(editor): mirror shortcut-guard refs in effects instead of render body
CodeRabbit on #9412: render-body ref writes can leak from a render pass
React replays and discards. Move the state->ref mirrors for
commentPopoverRef / shouldShowMarkdownAnnotationsRef (MonacoEditor) and
activeAnnotationBlockKeyRef (MarkdownPreview) into effects; same-tick
keydown paths keep their eager event-handler writes.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
Resolve agent CLIs against PATH with fs instead of spawning one where/which subprocess per candidate (~34 at startup). Same found/not-found result (same env/PATH, faithful which/where semantics); subprocess spawns 34->0.
Fixes#9297.
Derive the collapsed session limit label from resetsAt and tick it live via a shared boundary-scheduled countdown clock (no polling). Combines #6252/#6585.
Fixes#5399.
Co-authored-by: gatsby74 <166927047+gatsby74@users.noreply.github.com>
On a fork checkout (origin=fork, upstream=parent) PR details failed to load because getOwnerRepo() resolved only the origin remote while GitHub PRs live on the upstream parent. Make getOwnerRepo() prefer upstream (mirroring getIssueOwnerRepo), and pin the call sites that genuinely need the checkout's own origin identity (getRepoSlug, getRepoUpstream, createGitHubPullRequest, resolvePrWorkItemSource) to the origin-only primitive.
Lands the fix community-identified in #7332 and hardened in #7513.
Closes#7331
Co-authored-by: fsdwen <1214772+fsdwen@users.noreply.github.com>
Co-authored-by: brennanb2025 <79079362+brennanb2025@users.noreply.github.com>
Invalidate xterm's linkifier hover cache (throttled) when output streams into a visible pane, so a URL printed under a stationary pointer underlines and becomes Cmd/Ctrl+clickable on the next pointer move instead of after several clicks. Skips while a link is hovered (no flicker) and re-arms so the reset is never dropped mid-hover. Reuses the visibility-resume primitive (#9061).
* fix(sidebar): guard every worktree sort against undefined displayName (crash 99657ab1)
Worktree.displayName is typed non-optional but arrives undefined at runtime for
persisted/discovered worktrees (crash 99657ab1). PR #8683 fixed the kanban board;
this extends the same guard to the five other sort sites that share those worktree
objects — including the Cmd+J switcher (order-empty-query-worktrees) — via one
shared compareWorktreeDisplayName helper in lib/. Behavior-neutral when names are
present; a missing name now sorts as '' instead of throwing.
Co-authored-by: Orca <help@stably.ai>
* docs(agents): add over-commenting anti-pattern example to the comment rule
Anchors the existing 'document the why, briefly' rule with a concrete
before/after (the worktree-displayName guard) so agents stop dumping the
crash id, mechanism, file location, and every call site into a comment.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
* fix(pty): stop daemon reattach/kill race from orphaning restored terminals
Two cold-start defects let a PTY kill silently orphan a live daemon session
after a renderer/app restart — the PTY-orphaning-on-restart half of #7742:
- DaemonPtyAdapter.shutdown() was the only session op that skipped
ensureConnected(). The daemon client connects lazily, so a kill arriving
before the first spawn (startup sleep/hibernation sweeps, closing a
restored tab) threw "DaemonProtocolError: Not connected" against a
HEALTHY daemon; the renderer swallows the rejection and the live session
survives detached. Fix: connect first, like every other session op.
- pty:kill had no startup barrier while pty:spawn did. A kill issued before
initDaemonPtyProvider swapped the provider resolved against the pre-daemon
LocalPtyProvider, whose shutdown() silently no-ops on daemon ids; the
handler then reported success and sent a synthetic pty:exit, permanently
clearing the persisted tab->ptyId binding so the session never reattaches.
Fix: pty:kill awaits the same getLocalPtyStartupPromise gate as spawn.
Both reproduced red-first (real DaemonServer socket rig for the adapter;
deferred-barrier IPC rig for the handler) and pass after the fix.
Scope: this restores the reattach/teardown invariant. It does NOT address
the renderer crash trigger or the daemon-process-death path that produces
the Windows PowerShell FailFast symptom (separate follow-ups).
* fix(pty): gate runtime shutdown on daemon startup
* fix(pty): keep shutdown independent of hook startup
The connectPanePty suite intermittently fails in CI on
`clearAgentLaunchConfig` call-count assertions (e.g. expected exactly
once, received 5 with pane keys belonging to other tests).
Root cause is cross-test async leakage: pane foreground-agent trackers
kick off `confirmForegroundProcess` reads whose continuations settle on
the microtask queue, not on fake timers. A test that ends with one still
in flight leaks it into the next test, where it resolves against that
test's fresh store mock and calls clearAgentLaunchConfig with the prior
test's pane key.
Drain pending microtasks in afterEach (before tearing down fake timers,
while the test still owns its store mock) so each test absorbs its own
async fallout. No behavior change; full suite stays green (446/446).
Note: this is a CI-timing flake not reproducible locally in isolation
(ordered runs pass repeatedly, incl. under GC pressure); the fix targets
the confirmed leak mechanism and removes the timing dependence.
* fix(keybindings): use AltGr-safe default for Add Review Note
The editor.addReviewNote default was Mod+Alt+N, which resolves to
Ctrl+Alt+N (AltGr) on Windows/Linux. On diacritic layouts AltGr+N
types a real character (e.g. Polish n-acute), so the editor-scope
chord hijacked normal typing. Switch the default to Mod+Shift+A,
which is AltGr-safe and keeps a mnemonic (A for annotate).
* test(keybindings): cover Add Review Note chord end to end
* fix(ssh): probe npm via prepended PATH, not colocated with node (#9165)
The remote Node/npm toolchain gate invoked npm by its absolute path
<nodeBinDir>/npm (POSIX) / npm.cmd (Windows, behind a Test-Path
colocation check). But deploy (commandWithNodePath) runs bare `npm`
with nodeBinDir merely prepended to PATH, so npm can resolve from
anywhere on PATH.
A host whose only resolvable node has npm elsewhere on PATH (e.g. node
symlinked into a dir without npm) deployed fine on v1.4.144, but after
upgrade the candidate is rejected with no fallback → SSH/relay
connection fails to establish.
Make the probe resolve npm exactly the way deploy does — bare
`npm --version` under the same prepended PATH — so it still confirms npm
is runnable (the #8450 concern) without requiring colocation. Windows
now prepends the backslash-form dir (matching deploy) so bare-command
PATH lookup resolves reliably.
* test(ssh): cover split Node npm PATH resolution
The account-switched restart card had two near-synonymous dismissive
buttons (Dismiss / Collapse) whose distinct behaviors weren't legible,
and body copy that attributed "keep working with the current account"
to Collapse — which only minimizes the notice.
Remap to intent-named actions:
- Dismiss -> "Keep old account" (clears the notice; pane stays on the
old account)
- Collapse -> "Not now" (minimize to the pill; decision deferred)
- Body no longer claims the minimize action commits you to an account.
Restart, the title, and the heading are unchanged. New English strings
get fresh auto keys so stale es/ja/ko/zh translations don't persist;
catalog re-synced.
* fix(terminal): don't report agent exit on a degraded foreground scan
On Windows/ConPTY the foreground scan (a Get-CimInstance Win32_Process
PowerShell fork) can exceed its 3s budget under load, and there is no
wmic fallback on Win11 24H2+. A timed-out scan returned the shell name,
which the completion coordinator reads as "agent exited" and fires a
false "agent done" notification while the agent is still working.
Prefer the last positively-recognized agent across a degraded
(available:false) scan so a transient failure no longer looks like an
exit. An authoritative (available:true) scan still refreshes/clears the
memory, so a genuine exit or crash is still detected. No-op on macOS,
where the scan is always available.
* fix(terminal): drop stale foreground scan results
* fix(updater): humanize update-error card and hide raw error behind Show details
Windows auto-update failures surfaced the raw electron-updater message as the
card headline — most visibly the PowerShell "Command failed: … Get-Authenticode
Signature …" dump when antivirus/EDR blocks the post-download signature check.
That reads as a crash, not an actionable state.
Classify each failure and lead with one plain-language sentence + the right
action, keeping the raw error one click away:
- New shared classifier (updater-windows-signature-check): distinguishes an
AV/EDR-blocked signature check (environment) from a genuine wrong-publisher
mismatch (security). The two are mutually exclusive so a real integrity
failure is never softened into "try again".
- UpdateCard: raw error moves behind a collapsed "Show details" toggle; adds a
security-stop variant (wrong publisher → no retry, "Open official releases")
and the AV-blocked variant ("Update Verification Blocked"). HTTP/2 and generic
paths keep their existing actions, now with the same details disclosure.
- Main process records a windows_signature_check_blocked lifecycle event so we
can size the affected Windows cohort in the field.
Verified each error scenario in a running Electron build (signature-check
blocked, wrong-publisher security stop, HTTP/2, generic, and the expanded
details view).
* fix(updater): make Show details a caret disclosure above the action row
Move the raw-error toggle directly above the Retry/Download buttons and give it
a rotating chevron; the Last error block now expands in place beneath the caret
instead of appearing above the summary, with the action buttons pinned below.
* fix(updater): prevent signature-check bypass
* fix(updater): surface retry start immediately
* feat(agents): pi session resume support
* fix(pi): require persisted session files for resume
* test(sleeping-agent): use non-resumable sentinel in malformed-record fixture
The 'drops malformed sleeping agent resume records' test used agent:'pi' as
its example of an unknown/non-resumable agent, expecting the record to be
dropped. This PR added 'pi' to RESUMABLE_TUI_AGENTS, making that fixture
valid and retained, so the toBeUndefined assertion broke. Switch the
malformed-case fixture to a genuinely non-resumable sentinel
('definitely-not-an-agent') so the drop-malformed path is still exercised;
no other assertions changed.
* Add durable resume identity for Pi sessions without fabricating turn sta
Pi's `session_start` hook now carries the session file needed to resume
a sleeping pane, but until now Orca either discarded it or treated it
as a fake status transition. Thread a `providerSessionOnly` envelope
through the hook listener, relay, main-process server, and renderer
store so resume identity (and its session-file-scoped equality/claim
key) can be persisted and replayed without emitting prompt telemetry
or a visible working/done row.
* Add durable resume identity for completed Pi sessions
Pi's agent_end hook marks a turn done, but the underlying TUI session
stays alive and resumable. Previously a `done` status wiped sleeping
records and launch config as if the session ended, so hibernation,
manual worktree sleep, and quit-capture all lost Pi's resume identity.
- Track a "live recovery" record for done-but-still-resumable Pi
sessions, exempting it from the usual done-state cleanup paths in
agent-status.ts and agent-hibernation-planner.ts
- Gate providerSessionOnly rows and sleeping-agent schema records on
actual resumability (getAgentResumeArgv) instead of trusting the
presence of a provider session
- Wait for Pi to persist its session file before advertising resume
metadata, and treat `/reload` as a non-terminal event so it doesn't
clobber visible status
- Extend SSH relay envelopes to carry providerSessionOnly so remote
hosts get the same behavior
* Add explicit periodic/quit mode to sleeping-agent session capture
Split captureAllSleepingAgentSessions into 'periodic' and 'quit' modes
so a background checkpoint can no longer downgrade a confirmed-quit
record or promote a completed Pi session without an authoritative
transcript path. Updates all call sites and tests accordingly.
* Use normalizeAgentStatusPayload for default pi status
Remove unnecessary JSON.stringify wrapper and call the appropriate normalization function directly.
---------
Co-authored-by: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Translate 105 ko.json entries that were still identical to their English
source after the machine bootstrap — dialog bodies, settings descriptions,
shortcut recorder labels, Windows firewall notices, Jira connection copy,
crash-report notices, and source-control panel text.
Intentionally left in English: brand/product names, command and config
examples, CSS/selector strings used by animated visuals, and lowercase
concatenation fragments whose word order cannot be reordered safely.
github-actions[bot]
NeilandOrca
OrcaWin
Jinjing
gatsby74andJinjing
Brennan Benson
Jinwoo-HandOrca
Jinho Choi
hanjoonchoe
slashdevcorpse
Jinwoo HongandOrca
eisen0419andJinjing
Asurada
