* feat(cloud): pdx1 default region with iad1 fallback and one golden per region; Standard is 8 vCPU / 16 GB (U17, U18)
- golden_images and environment_builds record their region (0040, backfilled iad1); rotation,
git-source builds, smoke and activation run per region; lifecycle picks the region's golden.
- New creates default to pdx1; a create with no pinned region falls back to iad1 automatically on a
capacity/provider error (VERCEL_FALLBACK_REGIONS). Until pdx1 has an image, creates use iad1.
- Environment builds boot and smoke in their own region; workspaces from a build boot there.
- One size: Standard = 8 vCPU / 16 GB (ORCA_CLOUD_SANDBOX_SPEC). Legacy 'large' requests map to
standard; 0040 rewrites existing large rows.
* merge cloud/integration (ORCA_CLOUD_SANDBOX_SPEC landed in #196)
Hosts with credential rules (model APIs, api.github.com) are answered by Vercel's egress proxy with a
certificate from its CA. Vercel's command env trusts it (NODE_USE_SYSTEM_CA, NODE_EXTRA_CA_CERTS,
SSL_CERT_FILE) but orcad starts under env -i, so Node clients in terminals used Node's bundled roots:
Gemini CLI retried forever ('This is taking a bit longer') while the same call from a command
returned at once. Found on the live proof of the new agents; NODE_USE_SYSTEM_CA=1 in the terminal
fixed it there (1 s to the provider's answer).
Staging sign-in now works end to end in dev without a dev operator key on the user's machine.
Same account ids as billing dev (which trusts staging already); never honored when SANDBOX_ENV=prod;
a staging key cannot pass as the prod issuer.
Security review: a Copilot BYOK key without a usable base URL (or with one from another scope) had
no route, so it went to the VM as itself. Every swappable name now becomes a placeholder, routed or
not, and the Copilot pair resolves like the other agent keys (shared beats personal, as a pair).
The Cursor exchange reply is parsed whatever its content type and cut down to accessToken; headers
(set-cookie) are not passed. opencode.ai is not allowlisted (anonymous share uploads).
Image: pinned opencode-ai 1.19.5, @google/gemini-cli 0.67.0, @github/copilot 1.0.108 (npm) and
cursor-agent 2026.11.05-86047df (checksummed tarball). opencode's unused linux build variant is
dropped (~205 MB). First-run screens are answered at every boot/secret refresh (folder trust for
Gemini, Cursor and Copilot; Gemini's auth picker when a Gemini key is set; OpenCode's gateway model
from ANTHROPIC_MODEL/OPENAI_MODEL); self-update is off for all four.
Egress: GEMINI_API_KEY / GOOGLE_GENERATIVE_AI_API_KEY (generativelanguage.googleapis.com,
x-goog-api-key), CURSOR_API_KEY (api2.cursor.sh, only POST /auth/exchange_user_api_key; the
refresh token is stripped so nothing long-lived lands on the VM) and COPILOT_PROVIDER_API_KEY /
BEARER_TOKEN (host of COPILOT_PROVIDER_BASE_URL, same scope only) are placeholders in the VM and
swapped by the proxy. Allowlist adds the agents' API and sign-in hosts. API/MCP accept the image's
agents; routines stay on claude/codex.
- local.core-workflow: composer local worktree (Blank Terminal), edit in its terminal, diff in
Source Control and the diff tab, Stage All, commit
- acc.download: Explorer Download… (20 MiB file) and Download as ZIP… (folder) with progress and
success toasts and sha256 checks; only the native Save panel's answer is stubbed in main via the
inspector (W9D_MAIN_INSPECT)
- acc.remote-desktop: workspace menu Open remote desktop -> orcaDesktop connected, noVNC canvas
sampled, a red xterm launched on DISPLAY=:1 shows up; guest screenshots over CDP
- local rows without a host badge count as local
The wake phase "orcad ready" (W9) runs from orcad's spawn to the control plane
having the pairing offer. After orca-sandbox-start exits, the control plane
made a second Vercel round trip (files API, ~120 ms from here) to read the
offer, because command stdout is kept as logs.
startOrcad now passes a fresh 32-byte key per call in env (env is not kept).
The start script adds "sealedOffer": "<iv>.<base64 AES-256-CTR(offer line)>"
to the pointer line it already prints, so the logs only hold ciphertext and
the control plane opens the offer locally. The key is unset first thing in the
script and in the prelude, so nothing the script starts inherits it. If the
offer is missing or does not open (older image, no openssl, wrong key), the
control plane reads the file as before. Older Workers send no key, and
current images then print the plain pointer.
The ready poll in the start script drops from 50 ms to 10 ms (~20 ms mean),
keeping the 60 s minimum timeout.
Verified on a VM from snap_aQmW, driving the start script like the control
plane: all four starts, including an idempotent second start, opened without
the files API, and the stdout never held the pairing code.
NODE_COMPILE_CACHE only stores what V8 compiles before a script runs: 5.4 MB of
orcad-server.js's 15 MB. Every function startup runs still compiled lazily on
every boot. Measured on a VM from golden snap_aQmW, orcad ready went from
0.95-1.06 s to 0.70-0.78 s (5 pairs, alternated), and from ~1.25 s to ~0.95 s
on a slower host.
image/vm/orcad-boot runs orcad-server.js through a vm.Script whose code cache
is taken as the image's smoke run exits, so it covers what startup compiled.
orcad sees the same argv, __filename, require and import() resolution as under
plain node. The cache file starts with a header (Node version, arch, bundle
length and crc32): V8 itself only checks the source length, so a cache from
other bundle bytes would otherwise run stale code. Without a matching cache
orcad loads through require exactly as before.
Verified in that VM: the cache is accepted, the experimental-loader warning
stays out of orcad.log, and a terminal created through the CLI runs (node-pty
resolves via import() from the bundle directory).
Desktop-created cloud workspaces already run setup through orcad's worktree
create after the setup prompt. Workspaces made through createWorkspace use the
VM's primary checkout, which no worktree create touches, so their setup never
ran. Start it detached on create (once per workspace, orcad's env, skipped on
environment builds) and have routine runners wait for it.
dev:* accounts skip billing on dev, so W9 could not test the gate (no plan refused, active allowed,
grace expiry suspends, at-cap refused) with dev tokens. Dev accounts under the configured prefix now go
to the billing Worker. Honored only when SANDBOX_ENV is exactly 'dev' and only for a specific
sub-prefix (dev:<word>- or dev:<word>:), never all dev accounts; tests cover prod/staging/test being
ignored and over-broad prefixes being rejected. Dev sets dev:billing-test-.
- W9D_KEY_SAMPLES (default 10): stats gain p99; each sample records time since the workspace's
first terminal output and wall clock, plus a histogram and the outliers
- life.auto-resume (W9D_AUTO_RESUME=1, W9D_ONLY=auto-resume): personal AI Gateway secrets for the
dev user (kimi-k2, never logged, deleted after), Claude runs a 40 s loop, status panel Restart,
Orca must send continue once and the turn must finish; mapped to catalog life.auto-resume
- W9D_MODE=targeted: picker sign-in on a fresh profile and again after a sign-out, create +
keystroke, Move to this computer with Archive afterwards then Delete within seconds (destroyed,
no suspend/archive error toasts), normal delete
- asleep Delete through the dialog without a Force delete offer is intended: graded pass
- cleanup removes local copies a run made; catalog row + import mapping for move-then-delete
- auth.picker-sign-in: picking the signed-out Orca Cloud row must leave Orca Cloud selected
- life.delete-asleep(-after-move): no wake, Force delete offer, destroyed; life.destroy now a
normal delete of an awake workspace; D-2 passes on a cross-team destroy or a kept
"couldn't confirm" row
- vercel-check.ts: confirms each run sandbox is 404 on Vercel and records it in results.json
- catalog rows and import mapping for the new steps
* feat(w8): teammates wake a team workspace from the phone (team route long-poll wake, same access/billing/cap; owner route stays the fallback)
* test(w8): team wake refuses an admin on a private row, never returns the endpoint; phone never falls back on 401/403
terminal.send text+Enter to a daemon-backed shell always waited the 500 ms agent paste
settle: the daemon's shell-foreground answer is lifecycle ownership, which is only proven
after a recovery or full-screen exit, never for a fresh or plain-command shell. On Linux
the idle-prompt claim now also accepts the shell's own /proc stat (process group is the
terminal foreground group, i.e. ps '+'), scoped to the target PTY; other hosts unchanged.
The acceptance wake split uses one persistent paired connection per wake (the desktop's
transport) by default; transport=cli keeps the per-call socket the CLI dials.
- auth.signed-out-create (D-1/D-4), proj.cloud-name (D-3), life.delete-unconfirmed (D-2,
team switch -> not_found), life.delete-after-oob-destroy; life.destroy now requires destroyed
and records the asleep-delete refusal
- starts signed out (dev auth) with no sign-in-then-relaunch workaround; mock keychain so a
fresh dev app identity does not block on a macOS Keychain prompt
- cloud vs local rows disambiguated by badge (Move to this computer reuses the name)
- upload/download helpers for staging and collecting a run on a paired Orca environment
Neil
Neil