The first-launch 'Trust <repo> for agents?' modal blocked agent launches
to ask a question that offered no real protection: undecided repos, and
every unattended launch, already pre-trusted. Drop the dialog, the launch
hold and the skipAgentWorkspaceTrust plumbing. Repos default to
pre-trust; the per-repo setting remains as an opt-out.
* refactor: finish terminal and Mobile defining-owner imports
* fix: retain completion coordinator type binding
* refactor: consolidate direct terminal tree imports
* refactor(renderer): import typography from defining owners
* fix(terminal): keep remote-viewer clipboard env on command-less creates (#39852)
A paired viewer's plain terminal reaches the host renderer's tab-create
bridge with spawn env (ORCA_REMOTE_VIEWER_CLIPBOARD, PI_CLIPBOARD_OSC52)
but no startup command. The bridge queued pendingStartup only when a
command existed, dropping the env, so the spawned shell never saw the
remote-viewer clipboard marker and copied text stayed on the host
clipboard (#39852).
- Queue the startup whenever the request carries launch material
(env/envToDelete/launchConfig/resume), not only a command.
- PtyPaneStartup.command becomes optional for env-only startups; spawn
options already tolerate a missing command.
- Keep the plain-shell pre-bind input hold for startups that plan no
post-bind work, so an env-only startup types as a plain shell does.
Co-Authored-By: Claude Code <noreply@anthropic.com>
* test(e2e): layout oracle marks only panes the user can see
A hidden tab with a queued startup is laid out at opacity 0 so it spawns at
real geometry. The marker check counted it as visible because it has a size,
then waited for output that the hidden-delivery gate correctly withholds.
Paired-client creates now queue spawn env, so their background tabs hit this.
---------
Co-authored-by: Chen <zwq19980411@gmail.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
* fix(automations): reopen a reused automation chat tab in the background
An automation that reuses its last chat queued the prompt into that
session even after the user closed its tab, but never brought the tab
back. After a reused send is accepted (including a lost or refused reply
recovered from the run receipt), reveal the session and publish its tab
with activate:false so it reappears without taking focus. A publish
failure is logged and never undoes the accepted send.
Extract the reveal + background publish pair into
publishChatTabInBackground and share it with reopenWorkerChat.
Fixes#40260
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
* test(automations): use the string workspace id in the chat-reuse harness
---------
Co-authored-by: Neil <neil@stably.ai>
* refactor: move atomic publication to its filesystem owner
* refactor: group shared browser definitions by feature
* refactor: bind proxy process and session contracts to defining owners
* refactor: consolidate direct session contract type imports
* refactor: retain atomic publication test timing under moved owner
* fix(benchmark): resolve historical tunnel framing source before loading
* refactor: use concrete browser and input owners
* refactor: bind remote runtime callers to concrete transport owners
* Use checked subscription mock argument types
* Type browser lease mock with its subscription contract
* refactor: bind sleeping VM status probe test to socket owner
* refactor(main): organize SSH transport and managed server owners
* Remove orphan deploy readiness fixture and shrink test baselines
* refactor(wsl): import lock records from their defining owner
* refactor(wsl): use the canonical deferred update contract
* refactor(mobile): give relay and encryption concrete owners
* refactor(mobile): organize session and review feature owners
* refactor(mobile): organize RPC and host ownership
* test(mobile): point render fixtures at concrete owners
* refactor(mobile): use explicit type-only owner imports
* refactor: import journal queue state from defining owners
* refactor(shared): organize execution and automation owners
* fix: retain type imports used by surviving test cases
* refactor: finish work item owners and refresh validation metadata
* test: infer reconnect status fixture type
* test(claude): resolve source files beside same-named directories
* test(runtime): group repository creation mock registrations
* fix(mobile): re-subscribe Home and the follow-up preference after the client event stream ends
* fix(mobile): try a refused client event wire once per connected edge
* refactor(mobile): mark replayed client event readies in the shared stream
* test(e2e): give the phone feed socket client a state listener
* perf(mobile): show the workspace list from memory and refresh it on desktop changes
* fix(mobile): import the host list queries type without an import() annotation
* fix(mobile): keep host labels on a not-connected read and update the phone feed e2e helper
* fix(mobile): keep the event router listening when its stream ends while opening
* fix(mobile): reuse the shared read-view base and remount for the cache-return recording
* refactor(renderer): organize host and terminal implementation owners
* fix(refactor): align active adoption reliability references
* refactor(terminal): remove forwarding shells and stale mocks
* fix(renderer): consolidate direct owner imports
* fix(refactor): route incoming issue trust type to its owner
* test(runtime): give independent status viewers separate pairing tickets
* style(refactor): normalize rebased terminal mock formatting
* refactor(renderer): organize runtime clients and feature state owners
* fix(refactor): preserve incoming consumers and validation routing
* fix(refactor): consolidate defining-owner type imports
* Ask once per repo before pre-trusting agent folders
* Route the trust prompt's repo lookup by the launch host; use dialog primitives as designed
* Bound the first-launch trust hold and honour the answer for the launch
* Move agent folder trust settings into their own settings group
* test(e2e): wait for the shell-ready deadline after a startup exec
Since #30978 the terminal host no longer probes for a prompt when a profile
exec drops Orca's ready marker; it submits the startup command once at the
15 s shell-ready deadline. The oracle allowed only 8 s, so the headless serve
case failed unless the exec barrier happened to run long. Wait until that
deadline (measured from terminal creation) plus the recovery budget, and
route the spec from the shell-ready barrier and shell startup sources.
* ci(e2e): route the startup-exec oracle helper to its spec
The one-time 'This page renders on your desktop' tour opens beside the address
bar of the first client-hosted page and intercepts clicks on the address-bar
suggestion. Seed it as seen for this spec via a new paired-client launch
option, and route address-bar conversion sources to the spec.
Since #33622 a confirmed HTML preview link honors openLinksInApp (default off,
so it opens the system browser) and no longer calls
openBrowserProfileTabInActiveWorkspace, so the spec's store spy never fired.
Opt the client into in-app links and observe the opened page URL directly.
Route doc-preview sources to the spec.
* fix(automations): Run now returns the saved pending row; quiet, titled, retained run terminals
Run now answers with the durable pending row instead of waiting behind
the automation's lane; one detached handler records a launch failure.
Existing-workspace launches no longer surface their owner, a new
workspace's startup tab carries the run title, and finished-run cleanup
keeps a terminal a user opened after its process started.
* fix(automations): keep launched runs and user-opened run terminals intact
A failed flush after a launch no longer rewrites a dispatched run as a launch failure.
A user tab open marks the pane activation shows, read after any spawn it starts.
* fix(automations): own launch-failure recording in the service; quiet pending pane notice on mobile
* perf(mobile): share one clientEvents stream per host connection
* perf(mobile): keep the shared clientEvents stream across a same-tick rejoin
* fix(mobile): let a later subscriber retry after the shared clientEvents open throws
* fix(mobile): guard the shared clientEvents cleanup after a throwing open
* test(e2e): give the phone list's socket client the shared clientEvents shape
* refactor: group structured session modules by owner
* test: retire status history work-count oracle suite
* refactor(main): organize journal storage and projection owners
* Consolidate restart recovery fixture imports
* Consolidate concrete session option model imports
Terminals a paired desktop or mobile client opened on a headless serve
host got a workspace-less serve-<uuid> session id, so the host inferred
their owner from the cwd. Folder workspaces that share a path then traded
those terminals whenever one was listed, and deleting a workspace stopped
terminals shown in another.
Serve ids now carry the workspace like every other daemon id. Inventory
refresh keeps a persisted layout binding even when a targeted listing does
not include its workspace, so restored serve-<uuid> terminals stay put.
A cwd guess is recorded as such and never drives a worktree-scoped stop.
Fixes#36716
Reported-by: Guy Shechter (@shechter)
Co-authored-by: Bing.Z <zzb@gxsmjx.com>
Keep Claude plugin status and toast frames out of native chat, and give terminal-input requests an actionable failure with safe conversation recovery. Preserve genuine outside replies while hiding internal repair content.
Tracked in STA-13468. Built on #37480 by @agustin2606.
Co-authored-by: agustin2606 <agustinvarela2606@gmail.com>
* fix(ci): run the release skill-sharing Electron install step in bash
#38130 turned this step into a POSIX path fallback, but the skill sharing
release gate also runs on windows-2022, where the default shell is
PowerShell. The step failed with a ParserError, so release-preflight
skipped every build for the v1.4.250 cut.
* test(e2e): keep the one-time Codex notice out of golden runs
The v1.4.250 golden e2e on Linux timed out clicking New Terminal: the
'Orca now runs Codex without its shared server' toast fires once when the
golden stub (a Codex terminal) appears, and here it landed while the +
menu was open and closed it. Mark it seen in the completed-user fixture
like the other one-time notices, and restore that fixture from the
workflow ref in the release golden job so a recovered tag uses it.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
relaunch() already lets a scenario declare terminalsRestart and passes it to
oracle.step, but compareRestart masked PTY ids only for coldDaemon, so
sleep-quit-resume reported its permitted terminal restart as a PTY id change.
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Add Chat UI choice to onboarding and tailor agent tours
* Add setup guide controls for Chat UI and Yolo permissions
* Refresh native chat agents and improve surface radio controls
- Re-read the host inventory alongside workspace refreshes, including WSL
- Recognize downloaded, ready chat runtimes without a CLI on PATH
- Standardize onboarding and checklist surface choices on accessible radio variants
* Show full-access agent overrides in Yolo mode settings
* Polish Chat UI onboarding and clarify terminal fallbacks
- Group agents by launch surface and refresh selection previews
- Add scroll-edge fades to reveal clipped onboarding content
* Recognize ready custom Chat commands and nested scroll changes
* Advance agent tour after selecting a new tab type
* Install onboarding skills for selected chat providers
- Route Chat UI setup to local provider-specific skill roots
- Improve tour focus, Escape handling, and delayed target transitions
* Keep split lesson while a new pane mounts; update renamed skill in test
* Assert agentDefaultSurface in Chat UI onboarding e2e
* Open the chosen Chat UI agent when a new project's default checkout opens
* Make the onboarding chat preview match native chat
- Soften the selected preview tile styling.
- Accept a leading separator in dev:fresh arguments.
* Fix scrolling in the onboarding agent step
* Preserve initial working directory when opening empty workspaces
Also check only remaining tour steps for unfinished actions.
* Fix tour resumption after completed split steps
* refactor(mobile): keep phone list facts beside the desktop's worktree row
The phone wrote its own list facts (lineage depth, host labels, list keys
and so on) onto the worktree.ps row object it got from the desktop, so a
desktop field with one of those names would be read as the phone's own.
List items are now { row, view }: the row is the desktop's, typed from the
shared RuntimeWorktreePsSummary contract, and view holds what the phone
works out. Host labels are a lookup beside the rows instead of fields on
them. A type test fails if the desktop row gains a view field's name or a
type the phone row would not accept, and a contract test feeds rows from
the desktop's own worktree.ps builder through the phone list.
* fix(mobile): type desktop replies from shared contracts and reject unchecked rows (#37923)
* wip: contract guards
* fix(mobile): type desktop replies from the shared contracts and ban unchecked z.custom
Session tabs, the createSupport reply and native-chat frames were typed by
hand on the phone, so a desktop change could leave the phone compiling
against a stale shape. They are now Pick/Partial of shared types; the
createSupport reply and native-chat transcript frames gain shared types the
desktop uses too, which also gives the phone the 'chat-program' reason it
was missing. Type tests fail when a desktop tab gains a phone-only name or
a field type the phone would not accept.
Catalog rows were admitted with z.custom<Worktree>() and no check. They now
need a string worktreeId, and an ast-grep rule rejects a z.custom with no
check anywhere in mobile/src.
* test(mobile): the desktop contract check also catches a null the phone would not accept
wsl-host-paired-phone asserted the pre-#36771 'isn't running' copy; it now
asserts the stable remote_runtime_unavailable code and '<distro> is stopped'.
wsl-move-dialog's gate-closed case seeds a saved host, which since #34683 puts
the app in serve-only: the WSL hosts section still lists the host. Assert
instead that Add is hidden and the host row's menu has no move entry.
Co-authored-by: Claude <noreply@anthropic.com>
Neil
Kelvin Amoaba
Jinwoo Hong
Brennan Bensonandagustin2606
OrcaWinandm4air
Jinjing
