* fix(speech): keep the old model when the new one can't be moved in
Deleting the old folder before the rename lost both copies when the rename
failed, e.g. a Windows antivirus lock.
* fix(speech): keep an interrupted swap's backup and let delete wait for it
Retry renames through Windows file locks, and keep .previous when it is the
only old copy left.
* fix(speech): remove the migration source's model backup on delete
* test(speech): assert the kept model, not the backup folder name
* refactor(speech): remove each model folder's leftovers in one loop on delete
* fix(speech): check model folders with async stat during the swap
* fix(session-history): discover OMP profile session dirs
OMP stores per-profile transcripts under <config home>/profiles/<name>/agent/sessions
(XDG_DATA_HOME/omp/profiles/<name>/sessions on POSIX with XDG set). The app process
usually lacks OMP_PROFILE/PI_PROFILE, so profile-run sessions were missing from
Agent Session History, orca search, and native chat.
Enumerate existing profile session dirs in ompProfileSessionsDirs() (same env +
safety rules as resolveOmpSessionsDir; PI_CONFIG_DIR-aware; suppressed under the
legacy OMP_CODING_AGENT_DIR override) and include them in ompSessionsRootDirs()
(discovery + path allowlist) and the omp branch of the native chat resolver.
An explicit ompSessionsDir override still pins one location.
main-sync-fs baseline for omp-session-root.ts 1 -> 3: one readdir of the small
fixed profiles dir plus one existsSync candidate check per profile (single call
site), the same small-dir probe style the file already uses - not a per-file
sweep. Flagged for reviewer sign-off per the ratchet's rule.
* fix(session-history): enumerate XDG-only OMP profile dirs
ompProfileSessionsDirs only listed profile names from the local config home, so a profile that exists solely under $XDG_DATA_HOME/omp/profiles (e.g. OMP run with a different PI_CONFIG_DIR) was never discovered. Enumerate both roots; per-profile candidate checks and output dedup are unchanged.
* docs(session-history): document profile dir helpers for coverage
* fix(session-history): use non-blocking profile enumeration in the native chat ID lookup
* refactor(session-history): share one OMP root list for discovery and chat lookup
Drop the duplicated async profile scan: native chat ID lookup now reuses
ompSessionsRootDirs, which already runs the small sync profile probe on the
main process for row deletion. Reuse normalizedProfile for directory names
and trim tests to the behavior that fails on revert.
* fix(session-history): prefer a profile's XDG sessions dir in OMP ID lookup
---------
Co-authored-by: ducts <ducts@fpt.com>
Co-authored-by: Kelvin Amoaba <97001695+AmoabaKelvin@users.noreply.github.com>
* feat(automations): redesign the automation detail overview
Group the overview into a run-health band (last run, next run, spend), Schedule and Execution property panels, and a Prompt panel with copy and a fading show-more. Run Now is now the primary action next to Edit; Pause and Delete move into an overflow menu with Delete separated as destructive.
* test(e2e): align prompt disclosure spec with the 8-line clamp
The redesign raised the collapsed prompt clamp from 4 to 8 lines and caps the
prompt at 80ch, so the resize prompt no longer overflowed at 820px. Lengthen it
so it wraps to ~11 lines at 820px and ~6 at 1400px, and assert line-clamp 8.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* perf(persistence): saves name the profile domains they changed
UI changes, window moves, SSH terminal exits, phone tab switches and
repo/folder/SSH/lineage edits no longer re-serialize and hash the whole
profile on the main thread. Each save names its domains (or 'whole' where
an operation can't know them), and one per-domain saved form serves both
selective and whole saves, writing dependent domains together.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(persistence): keep folder re-tiering and plugin context on named saves
Folder workspace unread writes re-tier sort stamps again, and plugins
hear an active folder's rename, now that those saves name their domain
instead of the whole profile. The folder-note test drains the load's
whole save so it checks the named save.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(persistence): typed folder workspace fixture for the re-tier case
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(persistence): build the serializer from typed state in the parity test
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(persistence): read unprojected domains without a type assertion
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(persistence): stall and fail the selective writer UI saves now use
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(persistence): every mutation saves only the domains it changed
Removing a project, renaming a worktree's path, re-adopting an SSH
target, importing a catalog, deleting a group or folder workspace,
retrying a failed terminal close and remapping session panes now name
their domains instead of rewriting the whole profile. Only startup load
and maintenance resume rewrite every domain, through a separately named
entry point a lint rule keeps out of mutation code. A named
automationRuns save refreshes a pending run delta so it can't write an
older run list.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(persistence): a named automation-run save supersedes older run lists
A catalog import replaces the run list while an earlier run write can
still be in flight; if that write fails, its restored pending list must
not win over the import. Domain lists name the local session through
the shared constant so the layout-writer ratchet stays exact.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(persistence): keep the whole-row fallback for replaced run lists
A run list replaced outside the run-delta path (catalog import, SSH
re-adoption) saves as a whole row again, so histories that can't use
the per-run storage still save. A failed in-flight run write restores
its pending list only while that list is still current; otherwise it
marks the run domain for a whole-row save.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(persistence): save run lists per-run rows can't hold as one row
A run delta whose list can't be stored as per-run rows (a legacy
history with duplicate run ids) now saves as the ordinary whole-row
replacement instead of failing the transaction, so a catalog import
or run edit on such a profile still commits.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(appearance): let app chrome follow the terminal theme
Add an "App Chrome Appearance" setting (Default / Match Terminal) next to
Left Sidebar Appearance. In match-terminal mode the terminal theme's
background/foreground are written as document-root CSS variables
(--bg-titlebar, --background/--card/--popover/..., both sidebar token
families), so the tab strip, status bar, side panels, full-page views and
popovers all follow the terminal instead of the app theme. Left-sidebar
modes still win because they scope their own variables below the root.
The terminal color pair and token derivation move into
terminal-surface-colors.ts and are shared with the sidebar resolver.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(status-bar): configurable usage format template
Add Settings → Appearance → Status Bar → "Usage format": a template that
replaces the built-in per-provider usage text when non-empty. Placeholders
cover {provider}, {plan}, the 5h/7d/fable/30d windows as percentages
(following Used/Remaining), {x.reset} countdowns, {x.resetAt} clock times
and Gemini {buckets}; "[...]" groups drop out when a placeholder inside is
empty so one template works across providers with different windows.
Whitespace is rendered as authored (whitespace-pre).
Persisted as PersistedUIState.statusBarUsageFormat with a byProvider
override map reserved for later; the RPC UI-update schema gains the
optional field.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore(appearance): document touched functions; surface usage format in search
Add one-line JSDoc to every function this branch adds or edits so the
review docstring gate passes. Include the usage-format entry in the
Status Bar section's search match so searching "template" or
"placeholder" no longer hides the parent row, and mention popovers in
the App Chrome Appearance descriptions since the setting styles them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(appearance): let file editors follow the terminal theme in match-terminal mode
With App Chrome Appearance = Match Terminal, the tab strip, status bar and
side panels took the terminal palette but every file pane kept the stock app
theme: Monaco (code, plain text, diffs, notebooks, markdown source) was
hard-wired to `vs`/`vs-dark`, and the markdown preview / rich editor painted
the fixed `--editor-surface` with GitHub-colored hljs tokens.
- `terminal-editor-palette.ts` derives an editor palette from the active
terminal theme (background/foreground/cursor/selection + syntax roles mapped
onto the ANSI slots) and builds a Monaco theme (`orca-terminal`) from it;
light/dark is rated by the terminal background, so a light terminal theme
under a dark OS setting still gets light styling.
- match-terminal chrome variables now include `--editor-surface` and
`--syntax-*`; the hljs stylesheets read those ahead of their defaults.
- `useEditorSurfaceAppearance` / `useMonacoEditorTheme` replace the inline
`isDark ? 'vs-dark' : 'vs'` computations; the diff-section chain passes the
Monaco theme name instead of a dark flag.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbWbChctXeMvaR2zdbFY99
(cherry picked from commit dc85fadee0a2664adbf55a49dd3c97c9b10fc111)
* fix(status-bar): honor the usage template in compact usage mode
ProviderSegment only rendered a user template on the verbose branch, so
switching usage mode to compact silently fell back to the built-in
tightest-window label. A non-empty template now replaces the built-in
text in both modes; the mini bar stays verbose-only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbWbChctXeMvaR2zdbFY99
* docs(appearance): document remaining functions touched by the diff
Adds one-line JSDoc to the editor surfaces, diff viewers, palette helpers
and UI-slice entry points this branch modifies so the diff's docstring
coverage clears the pre-merge threshold.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbWbChctXeMvaR2zdbFY99
* fix(editor): keep Monaco theme registration and preview clock out of render
The upgraded oxlint React rules flag reassigning a module variable during
render and calling Date.now() inside useMemo. Move the terminal Monaco
theme's signature cache into ensureTerminalMonacoTheme() and pin the
usage-format preview clock with a lazy useState initializer.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbWbChctXeMvaR2zdbFY99
* localization: complete Brazilian Portuguese catalogs
* fix(i18n): localize remaining hard-coded UI copy and complete Simplified Chinese coverage
Route the English literals and shared English labels that ignored the UI
language through the existing catalog: host labels, plugin cards and consent,
CLI and SSH errors, the checks pill, browser profile labels, shortcut groups,
app and context menus, and the macOS computer-use permission window. Shared
labels are translated where they render, so src/shared stays English for
mobile, CLI and older paired hosts.
- en.json gains 314 keys bootstrapped from inline fallbacks; four duplicate
"Unassigned" keys collapse into translateUnassignedLabel()
- zh gains 337 entries and refreshes existing ones; the other nine locales get
the newly extracted keys
- joinSentences ends a CJK sentence that has no final stop with 。 before the
next one
- the desktop caller passes the computer-use helper its locale; orcad and the
CLI stay Electron-free
- three files the copy pushed past max-lines each shed a focused module
* test: expect labeled roles in the editable context menu
The edit menu now passes explicit Cut, Copy and Select All labels so the roles render in the UI language; the upstream template assertion still expected bare roles.
* fix(i18n): key translated memos on the UI language without bare void reads
Upstream's React Compiler ratchet rejects `void language;`, which the compiler drops, and treats a react-hooks lint suppression as a bailout. The two host-label hooks now pass the language through readUiLanguageMemoInput so it stays a real memo input. ContextualTourOverlay drops its language key: getContextualTour is a static lookup, and step copy is localized at render.
* fix(i18n): translate editor theme settings
* Fix reactive localization and catalog extraction
* Fix combined localization validation
* Localize nested import failures and refine catalogs
* Handle older nested import responses
* Fix localized merge prompts and quota windows
* Address localization and runtime review feedback
* Keep host search and configuration examples usable
* Preserve configured names in add-project host selector
* Preserve host label origins across views
* Use localized fallback for missing local host
* Preserve custom names and refresh localized host labels
* Refresh task host labels without repeating searches
* Preserve Portuguese mobile tab translations
* Address localization review feedback
* fix(status-bar): import window visibility interval from its new path (#40951)
---------
Co-authored-by: lisi <lisi.see@bytedance.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: marlico77 <marlonssoficial@gmail.com>
Co-authored-by: x-Ai <5061489+x-Ai@users.noreply.github.com>
Co-authored-by: Kelvin Amoaba <97001695+AmoabaKelvin@users.noreply.github.com>
* fix(mobile): serve the phone page from a Linux install updated in place
Package managers (pacman, apt, dnf) replace Orca's files while the old
process keeps running. The host cached the manifest for the life of the
process and read assets through Electron's launch-time asar header, so
every read of the replaced files failed with asset_changed until Orca
restarted. Read from app.asar.unpacked and re-read the manifest when
manifest.json changes on disk.
Fixes STA-14385
* fix(mobile): check the page manifest off the main thread, and retry a mismatch
Read and stat the manifest with fs/promises and keep the probed root, so
bundle RPCs add no sync file calls. Keep only passing hash verdicts: a
package install writes files one at a time, so a mismatch may clear.
* fix(mobile): key the page manifest cache on its bytes
Inode, size and mtime can all repeat when ext4 rewrites a same-length
manifest within one clock tick.
* fix(mobile): read a newer in-place install's page manifest
A release written in place may add schema-v1 manifest fields the running
host predates. Read it with a stripping schema so the host serves the
fields it supports instead of reporting no bundle until restart.
* refactor(mobile): derive the installed-manifest reader from the writer's shapes
* feat(workspaces): run setup and archive scripts for folder projects
Folder projects get the setup and archive scripts git projects have:
creating a workspace runs setup in a Setup tab, and removing one runs
archive first. The script sees the workspace's name and id, so
`orca worktree create` inside it attaches each new worktree to that
workspace, however the workspace was created.
- Folder creates (desktop IPC and runtime) prepare setup through the
shared setup prep; runtime creates start it with the worktree terminal
startup, so Setup-before-agent ordering matches.
- Runner files live in <folder>/.orca, one fresh file per launch, removed
with the workspace.
- Only the host whose catalog holds the folder reads its orca.yaml or runs
its scripts; a setup problem becomes a warning, never a failed create.
- Shared orca.yaml setup with no approval from an older client is skipped;
ask/inherit never refuses a folder create.
- No orca.yaml default tabs for folders, since every workspace shares the
directory.
- New capability worktree.folder-setup.v1 gates the Settings section on
runtime hosts; the composer, Settings and trust prompt reuse the
existing setup surfaces.
* i18n: add folder workspace hooks strings
* chore: drop the runner's sync-fs baseline and an array cast
* fix(workspaces): close review gaps in folder project setup
- Whole-project trust sends an explicit run for folder creates the
policy would run, since it carries no content hash.
- Folder setup skips file access for a skipped setup and never starts a
stopped WSL distro for a create nobody started; removal does the same.
- Runtime folder creates return the trust mismatch, so the window re-asks.
- The composer hides folder setup controls on hosts without
worktree.folder-setup.v1 and keeps their old explicit skip.
- Hook checks read a folder only on the host that owns it.
- Git archive hooks get the removed workspace's id; WSL hooks blank
inherited pane identity too.
- Runner files are written through the drive path WSL needs for its
drive mounts, and kept out of git status with .orca/.gitignore.
- The CLI's older-host warning covers --agent creates and --json output.
* fix(workspaces): wait for the folder setup capability and read orca.yaml once
Create now waits for a runtime host's folder-setup answer instead of
sending Skip while the probe is pending, and runtime setup reuses the
parsed orca.yaml when merging effective hooks.
* fix(workspaces): keep a failed folder setup probe unknown and retry it on create
* fix(workspaces): share folder setup capability answers with the composer
* fix(workspaces): re-ask the host for folder setup support on every create
* fix(settings): read orca.yaml for folder projects and use workspace copy in hook rows
QA found Settings reporting no orca.yaml for folder projects while the
composer ran that script, and the inner hook rows still said worktree.
* fix(folder-workspaces): open one Setup tab for an instant folder create
* fix(workspaces): run setup when a created workspace has only editor tabs
* perf(folder-workspaces): per-workspace runner dir, bounded setup answers, one archive config read
* fix(folder-workspaces): retain setup capability for active consumers
* fix(folder-workspaces): match hook search to workspace descriptions
* fix(i18n): drop obsolete hook search descriptions
* test(folder-workspaces): follow relocated setup trust modules
* refactor: finish terminal and Mobile defining-owner imports
* fix: retain completion coordinator type binding
* refactor: consolidate direct terminal tree imports
* refactor(renderer): import typography from defining owners
* refactor(renderer): group file and document feature owners
* refactor(renderer): remove orphaned editor recovery registration suite
* refactor(renderer): colocate file explorer tree result contract
* feat(plugins): add editor.readTypography and editor.typography.changed
Plugins that render code next to Orca's editor had to open the private
profile database and reimplement Orca's font rules to match it. Host API 1.6
adds editor.readTypography (no capability; worker, panel and editor frames):
the font family and CSS stack, size with editor zoom, weight, line height in
px, ligatures, word wrap and minimap that the file editor resolves now.
editor.typography.changed carries the same values after a settings write or
an editor zoom changes them; it is the first event that needs no capability.
The pure resolution (editor typography, editor zoom, monospace font stack)
moves to src/shared so main and the renderer use one implementation.
* fix(plugins): keep editor typography resolution from throwing in main
A hand-edited profile with a non-string font family made the shared resolver
throw, which the main-process watcher would surface at startup and on every
settings write. Font values are now type-checked, the watcher catches and
logs, and it reads live settings so a write without listeners cannot leave the
event payload stale. Over-long font families are cut to the schema bound
instead of failing every read. Regenerates the testing runtime.
* refactor(mobile): group host catalog credentials descriptors and connection history
* refactor(mobile): import RPC sender and result types from defining owners
* refactor(mobile): colocate push delivery with registration operations
* refactor(mobile): point push recordings at delivery owner
* perf(native-chat): project structured chat tabs per workspace bucket
The shared chat-tab list was keyed on the whole unifiedTabsByWorktree
identity, so every tab write anywhere (terminal title batches included)
rescanned all tabs and handed every consumer a new list. Rebuild only the
buckets whose identity changed and return the previous list while no chat
tab changed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(native-chat): reconcile chat status membership per changed tab
The status bridge rebuilt every member and host group and captured every
chat on any tab-map or owner-input change, and recaptured every chat on any
launch notification. Membership now updates only the tabs whose identity
changed; owner-input changes re-resolve only unstamped tabs, the only ones
whose host depends on them; launch notifications name their session so only
its tabs are recaptured (unaddressed ones still recapture all). The sleep
and launch-directory companions of one projection land in one store write.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): guard whole tab-map triggers and hot-map listeners
Add a count ratchet for identity comparisons of the whole
unifiedTabsByWorktree/tabsByWorktree map in renderer code (counts may only
fall), wired into pnpm lint, run-ratchets discovery and changed-check
selection. Extend the advisory no-whole-hot-map-selector rule to inline
store listeners that compare a whole hot map and to effect bodies that use
one whole from getState().
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* revert(lint): drop the hot-map listener/effect extension
The guard stays scoped to the repaired seams; no repository-wide rule change.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(native-chat): capture chat status on semantic tab changes; address tombstone retirement
Focus, preview and order-only tab writes no longer recapture a chat's
status: membership and the projection fences compare the fields the
projection reads. Absent-tombstone retirement now names the sessions it
retired, so no launch producer sends an unaddressed notification.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(store): keyed-record transition seam for tab maps and companion records
Writers build next tab buckets and keyed companion records through
replaceTabBuckets / replaceRecordEntries (or name the keys of a record they
already built), which record exactly which keys and tab IDs changed against
the produced record. Readers ask readTabMapChanges / readRecordChanges for
an addressed delta; any unannotated link reads as a full resync. Adds
subscribeTabTransitions and a store-observer installer registry. The
chat-tab list and the status bridge now consume addressed deltas and keep
the whole-list walk only as the cold path.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(store): annotate every shared tab-map writer through the seam
Shared tabsByWorktree/unifiedTabsByWorktree writers (tab, editor, browser,
worktree, ssh, terminal create/close/navigation/title-batch/reconnect/
hydration, web-session mirroring and layout frames) now build or annotate
their next tab buckets and companion records with the exact workspace and
tab IDs they changed; full hydration, full frame builds and reconnect
inventories are named full resyncs. Writers that copied every bucket for
one tab (preview promotion, dirty-file preview clear, worktree removal
filters, sleeping-record identity rename) now keep unchanged buckets.
Replace the renderer-wide tab-map comparison ratchet with a narrow seam
guard: the repaired consumers may walk a whole tab map only in named cold
paths, and the pinned writer modules may not build raw seam records.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(store): name seam fields once; type seam records; record moved respawn writes
Writers stop repeating tracked field names (centralized in
seam-record-fields.ts), the seam takes a named KeyedSnapshot record type
instead of casts, and the layout-writer baseline records the respawn
helpers moved unchanged out of worktree-layout-lifecycle.ts.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(store): drop seam field cast; record the seam field list in the layout-writer baseline
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(native-chat): keep chat-tab list in source workspace order (C3/F1)
Every source workspace keeps a projection slot, even without chats, and the
seam reports when a write added or deleted a workspace key or moved a
surviving bucket, so the incremental list never reorders first-match
consumers; those transitions take the cold rebuild.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(native-chat): keep projection and retirement debt awake (C2, F3)
A member is owed from attach or semantic change, members without a host
feed keep their own debt, and every reconciliation drains existing owed or
retired work even when no new member changed, including a closed last chat
whose feed is gone.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(store): stop inferring host-mirror companion IDs from visible tabs (C1)
A host retraction can delete PTY or layout records for tabs neither
inventory lists, so the mirror funnel marks its tab-keyed records full
resync instead of advertising an incomplete addressed set.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): close indirect paths in the tab-map seam guard (C4)
The guard now rejects ordinary callers of the bridge cold path, value
imports the repaired consumers have not reviewed, and raw seam records built
into a local binding without a seam helper annotating it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(native-chat): drive real tab actions through the status bridge (F2)
Close, session rebind with a late old-session tick, and a legacy owner
change, through createUnifiedTab/setTabLabel/closeUnifiedTab, so the
addressed reconciliation path is exercised.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: exempt seam field-name constants from the layout-writer ratchet; drop dead setters (F4)
The seam's SEAM_*_FIELDS lists name fields without writing them, so the
ratchet skips them and the raised baseline row is gone (renderer total 569,
main 571). setStructuredChatSleptAt and the two launch-directory setters
lost their last callers to the batched companion write.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(store): Map provenance and source-ordered change keys in the seam (PR A addenda)
replaceMapEntries gives Map-typed fields (runtimeStatusByEnvironmentId) the
same weak provenance and readRecordChanges protocol. Change keys compose
forward through a chain, oldest write first, so added keys come out in
source order (index keys first for records, as Object.keys orders them). A
surviving key deleted and re-added, in one write or across a chain, and a
record builder that moves a surviving key, read as a 'reordered' full
resync.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(store): writers declare key order; seam reports ordered additions (N1c, N1a)
The seam no longer scans both records to rediscover order on every
annotation. replace* helpers know insertion order by construction; annotate*
takes a declared order ('appended' by default, 'reordered' for a builder
that moves keys, read as a full resync), verified only under test.
Addressed changes now report keys, source-ordered added keys and deleted
keys, so a reader holding its own key ranks places changes in O(changed).
Worktree removal declares its editor-transfer records reordered.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(native-chat): scope the chat-tab projection to chat-bearing workspaces (N2c)
The projection keeps chat subsets only for workspaces that have chats, plus
per-workspace source ranks that change only when a workspace is added or
deleted. A focus, label or title write costs O(that workspace); the
ordered list is materialized lazily, only for full-list readers, and keeps
its identity while no chat changed. Workspace adds and deletes are
addressed through the ranks instead of a cold rebuild.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): resolve aliases and require annotation before publication (C4)
Any reference to a cold helper or Object enumerator outside its named
callers counts, including aliases and callbacks; writer values are followed
through local aliases and must be annotated before the write that
publishes them.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(native-chat): scoped hydration keeps the warm chat list equal to a cold read (D1)
Drives the real scoped hydrateTabsSession on early/later chats of one
session: source order, list order and first-match precedence match a cold
rebuild, including when the selection order differs from hydrated order.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(native-chat): cache the chat-workspace order across chat edits (D1 item 5)
The lineage keeps chat-bearing workspaces in rank order and only inserts or
removes one when it gains its first or loses its last chat; a chat object
change re-flattens the list without re-sorting. Full resyncs rebuild it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): the seam guard recognizes only construction helpers and cold marks (D1)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor(store): addressed provenance only from constructing helpers (D1)
Remove annotateRecordReplacement/annotateTabBucketReplacement and their
caller-declared order: only replace*/recordDraft/tabBucketDraft, which
perform the construction, derive changed keys, additions and deletions from
their operations (delete-then-reinsert reads as reordered); opaque
reconstructions use markFullResync. Every former annotate caller is
migrated: ordinary local writes build their records once through helpers
or drafts with today's operations and order; scoped tab and terminal
hydration, the reconnect inventory, host-mirror application and layout
flush are full resyncs. Change readers move to keyed-record-change-reads.ts.
Renderer layout-writer total 567 (main 571).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(native-chat): type the hydration fixture without a cast
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(store): seam record writes define own entries, even __proto__ (N5c)
replaceRecordEntries and drafts assigned through the inherited __proto__
setter, so a tab id '__proto__' lost its own PTY, layout and startup
entries. Both now define an own data property, as the computed-key literals
they replaced did; contract test included.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(terminal): build each createTab record once (N4c)
createTab took ensureGroup's and insertSplitGroup's whole records and the
orphan cleanup's seam records, then rebuilt them through the seam. It now
takes the per-worktree group and split results and gives the orphan
cleanup only the bucket it reads, so every seam record is constructed once
with its ordered operations.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(ratchets): record createTab's orphan-cleanup input view (renderer total 570, main 571)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor(terminal): split orphan cleanup so createTab cleans only companion caches (N6c)
buildOrphanTerminalCompanionCleanupPatch holds the per-tab cache, tab-bar
order and selection cleanup; buildOrphanTerminalCleanupPatch adds the seam
record deletes on top, unchanged for reconciliation. createTab calls only
the companion part with real state and deletes the seam entries through its
single construction, so the stub input view and its layout-writer baseline
rise are gone (terminal-tab-creation.ts back to 10).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(terminal): filter the orphan cleanup's kept bucket once (N7c)
The full cleanup filters the workspace's tabs once and hands the kept
bucket to the companion part, which takes its replacement active tab from
it; createTab's companion-only call still makes its single find pass.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Scope terminal parking inputs and registries to workspace ownership
* Guard parking ownership and cover background split output
* Connect parking ownership to accepted tab transitions
* Use accepted Map provenance and preserve parking owner order
* Read paired parking capability deltas from the shared seam
* Consume ordered additions from accepted record transitions
* Expose first-tab and outside-owner views of terminal membership
* Construct terminal binding and startup transitions at their writers
* Construct shutdown and orphan cleanup transitions from ordered operations
* Construct presentation and sleeping record transitions at their writers
* Express semantic parking inputs and close annotation guard escapes
* Keep replacement values typed from their source records
* Construct sleeping session moves without changing nullable status records
* Follow the constructing seam integer-key module
* Adopt the separated transition reader module
* Ratchet the cold parking compiler bailout improvement
* Exercise parking fixtures through addressed inputs and live ownership
* fix(tabs): keep removed worktrees' group entries deleted on removal
The second emptied-group collapse in removeWorktreeLayout also visited
removed worktrees and wrote their deleted groupsByWorktree entry back as
an empty list, a delete-then-set the seam read as a reordered full resync.
It now visits only surviving workspaces, so removal stays addressed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(tabs): closeEmptyGroup collapses through the shared builder again
collapseGroupLayout takes the record builder, and the renderer passes the
seam's replaceRecordEntries, so the per-worktree collapse publishes with
provenance without new counted layout writes (tabs-group-actions back to 12).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(tabs): reconciliation names its draft fields once (2 + 4 <= 9)
The written-field sets come from SEAM_ field-name constants instead of
string literals, so the reconciliation split no longer raises the combined
layout-writer count (tabs-reconciliation 2, tabs-reconciliation-batch 4,
against the original 9).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(terminal): bound parking updates to changed ownership facts
* fix(terminal): type parking ratchet entry descriptors
* chore(tabs): publish reconciliation drafts with explicit field writes (N9c)
Revert the SEAM_ field-name constants: the drafts are held under their own
names and finishReconciliationDrafts publishes each written draft as an
explicit unifiedTabsByWorktree/groupsByWorktree/activeGroupIdByWorktree/
layoutByWorktree property, so the counter sees every real write and the
split totals 2 + 4 against the original 9, with no exemption.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(parking): follow merged module paths
* Move parking assignment invalidation into the store observer
* Limit parking assignment checks to changed tab rows
* Separate tab row recording from provenance reads
* Preserve uncertainty across skipped tab reinsertion
* Keep root terminal watchers within workspace surfaces
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: retain prepared checkout cleanup ownership after timeout
* test: retain capacity for unregistered preparation leftovers
* fix: keep expired cleanup admission outside retry budget
* fix: verify original preparation registration before removal
* Retain preparation authority through bounded capacity recovery
* Exercise preparation cleanup failures through real filesystem fixtures
* Inject root mkdir failure without obstructing checkout absence proof
* Match the host filesystem path in preparation failure coverage
* Align preparation fixtures with physical cleanup ownership
* Await owned recovery in the fleet cleanup control
* Release abandoned preparation cleanup maintenance leases
* Match cleanup test identity paths on Windows
* Wait for completed preparation disposal in maintenance regression
* Await final cleanup state in maintenance controls
Neil
OrcaWinandOrcaWin
Kelvin Amoaba
JinjingandClaude
Brennan BensonandClaude Opus 5.5
