387 Commits

Include renames

Author	SHA1	Message	Date
3 people	8604a4d570	fix(bitbucket): recognize ssh.bitbucket.org remotes (#31002) ... * fix(bitbucket): recognize the SSH host alias * fix(bitbucket): recognize the SSH host alias on current main Apply Chen's original SSH alias fix to current main, preserving canonical Bitbucket browser links and adding case/port and lookalike-host coverage. Co-authored-by: Chen <zwq19980411@gmail.com> --------- Co-authored-by: Neil <neil@stably.ai>	2026-10-23 20:43:39 -07:00
4 people	df97aa3a6f	fix(gitlab): recognize SSH-over-443 remotes (#30998) ... * fix(gitlab): recognize SSH-over-443 remotes * fix(gitlab): canonicalize SSH-over-443 project and review URLs Reuse the existing GitLab transport-host normalizer in project identity, hosted links, and manual merge-request links. Cover alias variants, lookalikes, nested groups, and canonical encoded links. Fixes #30876 Co-authored-by: lorenzozanee <wyz0707@proton.me> * test(gitlab): cover alias identity consumers --------- Co-authored-by: Neil <neil@stably.ai> Co-authored-by: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>	2026-10-23 20:30:43 -07:00
Neil	4975e2451e	fix(git): preserve binary output through termination barriers (#32633)	2026-10-23 19:21:53 -07:00
fancivezandNeil	2fb3de3405	fix(git): close subprocess stdin for SSH-signed commits (#30961) ... Co-authored-by: Neil <neil@stably.ai>	2026-10-23 19:20:58 -07:00
OrcaWinandOrcaWin	4687e90a16	[comment audit] Continue main-process comment cleanup (#32946) ... * [comment audit] Shorten daemon, hook, and emulator comments [skip ci] * [comment audit] Shorten VM, conversation, SQLite, and theme-import comments [skip ci] * [comment audit] Tighten Git execution and source-control comment contracts [skip ci] * [comment audit] Clarify repository probes and maintenance comments [skip ci] * [comment audit] Shorten status, diff-cache, and checkout comments [skip ci] * [comment audit] Clarify worktree lifecycle and WSL routing comments [skip ci] * [comment audit] Shorten forge identity and review-refresh comments [skip ci] * [comment audit] Tighten hosted-review client comment contracts [skip ci] * [comment audit] Clarify GitLab compatibility and review comments [skip ci] * [comment audit] Tighten hook ownership and watchdog rationale [skip ci] * [comment audit] Condense host and integration compatibility comments [skip ci] * [comment audit] Clarify IPC authority and remote-routing rationale [skip ci] * [comment audit] Finalize file-import and containment comment cleanup * [comment audit] Fix stale Jira type imports blocking full CI --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>	2026-10-23 16:27:37 -07:00
Neil	c32d46850b	fix: offload macOS deletion spawns and reduce branch cleanup (#32227) ... * fix: reduce worktree deletion branch cleanup overhead Refresh only the remote base branches needed to prove a branch merged, with automatic maintenance disabled. Skip merge simulation when no common ancestor is available and preserve the branch when its remote base cannot be refreshed. * fix: preserve fetch mappings and live branch cleanup fallbacks * fix: spawn macOS worktree deletion commands off the main thread	2026-10-23 02:24:07 -07:00
Jinjing	f1189be850	Offer Resolve with AI for paused merge, rebase, and cherry-pick (#28569) ... * Offer Resolve with AI for paused merge, rebase, and cherry-pick A paused operation can need recovery after every conflict is staged, but the Resolve with AI action only appeared when unmerged paths remained. The operation banner now offers it whenever AI actions are visible and an operation is in progress. Starting an AI conflict-resolution agent is also blocked while a Git operation is running. The composer, the banner and card buttons, and the agent launch itself check the running-operation state, so a launch that began during agent detection cannot start while Git is still running. * Block paused-operation recovery only on Orca's own Git work The previous gate scanned the host's process table and refused "Resolve with AI" whenever it could not prove no Git process was running. That refused recovery on older paired hosts, on Windows whenever any Git process ran anywhere on the machine, and while a paged `git reflog` or `git grep` was open in a terminal. - The host tracks Orca's own mutating Git commands per worktree (including ones still queued) and reports them through `git.mutationInFlight`. Reads and fetch/push/ls-remote are not tracked. - Recovery is refused only when the host reports that work. Older hosts without the method keep today's behavior. - The gate applies only to launches from the paused-operation banner and conflict card, not every resolveConflicts launch, so the Checks panel's PR-conflict flow is unchanged. - The agent prompt now tells the agent to stop if index.lock exists or another git command is running, which covers Git started outside Orca on every host. With no unmerged files, the prompt asks the agent to find why Git paused instead of listing zero conflicts. * Preserve Git mutation state until terminated commands exit - Cancel stale recovery checks and agent launches when their dialog or scope closes - Guide rebase recovery agents to amend fixes after failed exec steps * Cover failed rebase exec recovery with real Git * Recognize global Git options in worktree mutation tracking	2026-10-22 12:08:38 -07:00
Brennan Benson	1a0e1e9414	PR conflict previews fetch the base branch through the shared fetch controller (#30654) ... * fix(github): PR conflict previews fetch the base branch through the fetch controller The conflict summary on a PR card spawned its own `git fetch origin <base>`, outside RuntimeRemoteFetchController: it refetched a base a worktree create had just refreshed (and vice versa), ran git's auto-maintenance in the background, and never armed the idle loose-ref sweep. It now asks the runtime's controller for the exact-base refresh creates already use (same argv, per-remote queue, dedupe and freshness), waiting at most the old 10 s before falling back to the local ref. The runtime registers its controller at construction, since the IPC and poller paths have no runtime handle. Also corrects the controller comment that claimed every fetch skips auto-maintenance: full fetches keep it on purpose (#8039). * test(github): read the mocked fetch's WSL option without a type assertion * test(github): give the conflicting fallback-lookup test a git mock for its conflict summary * test(github): check WSL routing without duplicating fetch policy * fix(git): bound preview fetch ownership without cancelling create * Preserve repository identity after preview cancellation	2026-10-20 17:14:25 -07:00
Neil	b03ac56c00	fix(git): forward stdin on buffered Git reads (#30634) ... gitExecFileAsyncBuffer never passed stdin to the child, so a buffered read that needs it (cat-file --batch, hash-object --stdin) waited for EOF until its timeout. Add the option and forward it, with a real-Git regression test.	2026-10-19 14:18:03 -07:00
zzr	95f544aedf	fix(git): derive clone folder from scp-style remote path (#30763)	2026-10-19 10:58:05 -07:00
Stefan StefanovandClaude Sonnet 5.5	346f6028a3	fix(git): stage and discard files in WSL repos opened by UNC path (#30693) ... The Git runner sends a command into WSL when the working directory is a \wsl.localhost UNC path, even if no WSL distro is set in the options. literalPathspec only looked at the options, so Windows-style backslashes in file paths reached Git inside WSL unconverted and stage, unstage and discard failed to match the file. literalPathspec now also checks the worktree path, and every caller passes it. Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-19 04:43:08 -07:00
Neil	f6e9e649f4	fix(projects): a project added from the CLI, web or a paired desktop through a symlink or subfolder shows its workspaces (#30657) ... * fix(projects): a project added from a paired client or the CLI through a symlink or subfolder shows its workspaces * fix(git): keep a literal backslash in a POSIX checkout root	2026-10-19 01:54:59 -07:00
Brennan Benson	05688e7856	fix(git): stop starting Git in deleted project folders and for removed projects (#28822) ... * fix(worktrees): skip Git sweeps for missing repo folders * fix(worktrees): skip missing roots in headless scans * fix(worktrees): check missing roots at Git listing boundary * test(git): treat branch removal fixture as existing repo * test(git): keep mocked worktree roots present for Git cases * test(git): await host preflight in scan sharing fixtures * revert(worktrees): drop the listing pre-check for missing repo folders Reverts 82ccf05a4d, 13854fd3dc, c19604012a, 3f1b7ef64c, a868225608 and 962d9218c2. The reader-level stat ran in the wrong WSL distro, added a wsl.exe spawn per listing, and only covered git worktree list. The next commits replace it with a gate at the shared Git runner. * fix(git): stop spawning Git in deleted native project folders A registered project whose folder was deleted spawned a failing Git process (spawn git ENOENT) on every sweep: git worktree list and the git remote probes. The shared async Git runner now remembers, in memory, a native cwd once a spawn ENOENT is followed by a definitive lstat absence. Later calls for that cwd re-check with lstat before admission and, while it is still absent, reject with the same spawn ENOENT shape without starting a process. The entry is dropped as soon as the folder exists again. WSL routes and UNC paths are never recorded, so their behavior is unchanged. The fenced-output readers move unchanged to captured-git-output.ts so git-exec-file.ts stays under the file-length limit. * fix(github): skip queued PR refreshes for removed projects A PR-status refresh queued before its project was removed still ran and probed Git (git remote) against the removed path. The drainer now re-checks registration for each entry before any Git or GitHub call, using the same predicate the refresh IPC entry points use, so every removal path (sidebar, CLI, phone, closed window) and the rate-limit re-queue are covered. The skip mirrors the existing not-visible skip, so there is no new skip reason on the wire. * fix(git,github): skip missing folders without a span; pure refresh registration Round-2 review fixes. - The known-missing-folder check now runs before withGitSpan in both async runners, so a skipped call starts no process and writes no git.exec span. The command is resolved lazily, only for a cwd already recorded, and the git.known_missing_cwd attribute is gone. - The gate uses stat, which follows symlinks the way spawn's chdir does, so a symlinked project root whose target is gone is recorded too. - The Set is re-checked after the stat, so concurrent first failures record and warn once. - The PR-refresh drain check is now a pure predicate: is a project still registered at the candidate's path on its execution host. It reads the store each time and no longer resolves runtime Git options, which could throw inside the drain loop. Matching by path and host, not repo id, keeps a re-added project's coalesced refresh from being dropped. * refactor(git,github): one wrapper per Git runner; drainer holds its check Tripwire re-plan cuts, no behavior change except one Windows edge. - The missing-folder gate is a single wrapper around each exported async runner (gitExecFileAsync outside the fetch-head lock, and gitExecFileAsyncBuffer). It decides "native" from the call's inputs (cwd set, not UNC, and no WSL distro on Windows) for both recording and checking, so the early command resolution and the second filter are gone. The span bodies are back to main's code. - A Windows WSL project's linked worktree that runs host Git on a drive path is no longer recorded; before, it was recorded but never gated. - The synthesized error is built from constants (spawn git ENOENT, empty stdout and stderr). Nothing reads spawnargs, and the buffer runner's only caller reads code and message. - The drainer holds the registration check the way the event publisher holds its outcome observer, and the registration skip shares the existing not-visible skip.	2026-10-18 22:25:27 -07:00
NeilandClaude	6328a104bd	refactor(ssh): split ssh-connection-utils into concretely named modules (#30488) ... * refactor(ssh): split ssh-connection-utils into concretely named modules - classifiers -> ssh-reconnect-error-classification.ts - retry/timeout constants and sleep -> connection/ssh-connection-timing.ts - buildConnectConfig -> connection/ssh-connect-config.ts - credential callbacks -> connection/ssh-connection-callbacks.ts - exec options and abort error -> connection/ssh-exec-options.ts - wrapRemoteCommandForPosixShell -> ssh-posix-command-wrapper.ts - shellEscape and shared/wsl-login-shell-command quotePosixShell (identical) -> shared/shell-argument-quoting.ts quotePosixShell No re-exports are left behind. Co-Authored-By: Claude <noreply@anthropic.com> * fix: point the WSL git benchmark and the WSL lane route at shell-argument-quoting Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-10-18 20:48:05 -07:00
Jinjing	5ee118a908	fix(source-control): clear unavailable branch line totals (#30475)	2026-10-18 20:44:00 -07:00
Neil	58ce3f5eb4	refactor(git): the common-dir check uses areWorktreePathsEqual (#30263) ... Its private POSIX copy predates areWorktreePathsEqual's POSIX guard and WSL UNC fold, which now give the same answers; the one difference is macOS treating /tmp and /private/tmp as one directory, which they are. Also reuse looksLikePosixAbsolutePath in the frozen comparison key.	2026-10-18 01:04:34 -07:00
Neil	f47337d852	refactor(worktree): one worktree path equality; the ipc copy folded WSL ext4 tails (#30227) ... src/main/ipc/worktree-path-comparison.ts kept its own areWorktreePathsEqual and dedupeWorktreesByPath. Its Windows branch lowercased a WSL UNC path's ext4 tail, so two case-twin WSL checkouts merged into one row in removal safety, folder-upgrade dedupe and the SSH listing fallback. Every caller now uses git/worktree-path-comparison, which gains the macOS /private/tmp fold the ipc copy had. worktreePathComparisonKey keeps its exact bytes (retirement namespace keys persist it) in worktree-path-comparison-key.ts, and the worktree-logic re-export goes.	2026-10-18 00:02:29 -07:00
Neil	0ed0caa663	fix(wsl): run wsl.exe probes from the system folder, never the profile (#29853) ... * fix(wsl): run wsl.exe probes from the system root, never the profile WSL holds wsl.exe's working directory busy for about its idle timeout after the probe exits. Since #29209 the orcad startup probe ran in the profile, so a temporary orca serve profile could not be deleted for about a minute (diagnosed in #29845). * test(orcad): drop the WSL profile-hold wait from serve parity Reverts #29845's extended EBUSY retry: wsl.exe no longer runs in the profile, so nothing outside the test's process tree holds it. * build(cli): list the WSL spawn-directory module in the CLI typecheck project	2026-10-16 17:12:44 -07:00
Brennan Benson	23b60a5d07	fix(worktree): offer Force Delete with a plain warning when a checkout has submodules (#28878) ... * fix(worktree): remove a clean checkout that contains submodules Git refuses to remove any worktree with an initialized submodule unless --force is set, even when nothing is uncommitted. After that specific refusal, re-check the checkout including files inside the submodule and pass --force once. A dirty submodule still blocks the delete. A second --force is not added, because that would also clear a Git lock. * fix(worktree): offer Force Delete for a checkout Git refuses over submodules Drop the automatic --force retry. A forced removal deletes the submodule's repository under .git/worktrees/<id>/modules, including commits, local branches and stashes that were never pushed, and the parent's dirty check cannot see them (the retry #24602 removed for the same reason). Instead classify Git's "working trees containing submodules cannot be moved or removed" refusal as a new Force Delete reason, 'submodules', after the lock check and the force guard. The renderer classifies the error string, so older SSH and paired hosts get it too with no wire change. The toast, the delete dialog and the Space manager row show one plain warning naming what Force Delete would lose instead of Git's text. Keep --ignore-submodules=none in the pre-teardown dirty check so a user's ignore setting cannot hide submodule edits from it. Replace the retry test with one real-Git test: a clean checkout whose submodule holds a local-only commit is refused without --force, stays registered, keeps the commit, and its refusal classifies as 'submodules'. * fix(worktree): clarify the submodule Force Delete warning and hide View for it The warning now says Git deletes the workspace only with Force Delete, the submodule refusal no longer offers View (there are no changes to show), the real-Git test pins that Force Delete then succeeds, and a comment no longer describes the removed retry. * fix(worktree): name submodules when a changed submodule blocks the delete, and clear a stale delete toast With a commit inside a submodule that the parent has not recorded, the parent sees `M vendor`, so Orca's dirty check refused first with the generic "It has changed files". Force Delete then destroyed the never-pushed submodule commit without warning. On a dirty refusal the check now asks `git status --porcelain=v2` whether a changed entry is a submodule, and if so reports a refusal the app shows with the submodule Force Delete warning. The detail keeps the dirty sentence, so older apps still offer Force Delete. After the Space manager deleted a workspace (its row Force, or a later delete), the failure toast for that workspace stayed up and still offered Force Delete. A Space delete now dismisses it. * fix(worktree): warn about submodules on any refused delete of a checkout that has them Review found the warning still vanished when a submodule commit was already recorded and some other file was dirty: the parent's status shows no submodule change, yet Force Delete destroys the commit. The changed-files check now asks whether the checkout has a populated submodule (a .gitmodules path holding a .git, as Git's own refusal checks) instead of whether one changed. The refusal keeps the changed paths after the detail, and View stays available since there are changes to view. * test(worktree): mock the .gitmodules probe as missing in the preflight unit tests * refactor(worktree): attach the dirty-check status without a type assertion * fix(worktree): key the delete failure toast by host and worktree id A Space delete on one host must not dismiss another host's failure toast for a worktree with the same id. * fix(worktree): dismiss the failure toast by the store row's host after a Space row Force	2026-10-16 15:23:13 -07:00
Neil	088fefbb5a	fix(wsl): bound the line-ending sample's index scan, not just its matches (#29552) ... * fix(wsl): bound the line-ending sample's index scan, not just its matches The WSL-on-Windows-drive line-ending sample piped ls-files --eol through grep then head, so when no entry was eligible (* text=auto) head never closed the pipe and every file was read over drvfs until the 15 s timeout, which stage, discard and commit waited on after each backoff. Cap the raw ls-files output before the grep. Follow-up to #27778. * docs(wsl): describe the line-ending sample as the first index entries	2026-10-16 02:27:24 -07:00
NeilandClaude	99064a5e11	fix(worktree): a worktree created from a remote branch tracks it (#26344) (#29275) ... Co-authored-by: Claude <noreply@anthropic.com>	2026-10-15 18:19:03 -07:00
Brennan Benson	131986aa16	feat(worktree): show checkout progress while a worktree is created (#24093) ... * feat(worktree): show checkout progress while a worktree is created A local create spends most of its time in the checkout `git worktree add` performs, and the card only said "Creating worktree…" for that whole time. Git already writes its "Updating files: N%" meter into our stderr pipe, so the add call reads it passively (same command line and environment) and the create card shows "Checking out files… N%" with a thin bar. All six create labels are translated so a create never switches language mid-flight. Rebuilt on main from the version stacked on the create-gating branch. On main a create can also claim a prepared checkout; that path never runs `git worktree add`, so it keeps today's "Creating worktree…" label with no bar, and a missed claim falls back to the plain add, which shows the bar. * test(worktree): pin that finalizing a prepared checkout reports no checkout progress Claiming a prepared checkout never runs `git worktree add`, so the create card keeps its label with no bar; this pins that at the finalize step, including the retarget `reset --hard`. * test(worktree): keep only the checkout-progress tests that pin a contract Drops unit tests that mirror the implementation; the real-git flow, the parser captures, the cross-version Git contract and the create card test remain. * test(worktree): pin the checkout meter's path from git to the create card * test(worktree): merge the narrow-terminal capture's pipe chunks	2026-10-15 18:14:56 -07:00
Brennan BensonandClaude	0fea878680	fix(git): keep merge-tree's throwaway trees out of the real object store (#22356) ... * fix(git): keep merge-tree's throwaway trees out of the real object store The PR conflict summary and the squash-merged branch cleanup both run `git merge-tree --write-tree` only to read its output, but every divergent run left unreachable loose objects behind. Run it with a per-call scratch object directory (inside objects/, alternates pointing at the real store) that is deleted afterwards, on native, WSL and SSH relay hosts alike. * fix(git): keep partial-clone downloads and clean up stranded scratch stores - A partial clone fetches missing blobs during merge-tree; those packs landed in the scratch store and were deleted, so every check re-downloaded them. Move fetched packs (index last) into the real store before removing the scratch dir. - Sweep this app's own scratch dirs older than an hour, once per objects dir per process, so a crash or failed delete cannot strand one forever in repos where gc never runs. - Remove with Windows transient-lock retries; the shared core now owns all filesystem work and host adapters only resolve the objects dir. * fix(git): quote Windows alternates paths containing ';' and log scratch cleanup failures * fix(git): sweep a merge-tree scratch dir only when its owner is provably gone Another Orca process on the same repo (a second instance, dev and release builds) could delete a scratch object dir still in use once its mtime passed an hour. Each scratch dir now records its owner (pid, hostname, platform, Linux pid namespace); the sweep removes it only when that owner shares this pid space and has exited, or, with no checkable owner, at Git's own two-week tmp_ expiry. Also: - A fetched pack whose later rename fails is rolled back, so the real store never keeps an index-less pack; a pack already installed is left alone. - WSL Git gets the /mnt/<drive> spelling of a drive-path common dir (Git < 2.31 prints it relative, resolved against the C:\ repo path). - conflict-summary tests no longer create scratch dirs in the cwd. * fix(git): cap every merge-tree scratch dir at two weeks, live-looking owner included A reused pid held by a long-lived process could keep a leftover scratch dir forever in a repo where git gc never runs. The two-week age (git gc's own tmp_ expiry) now removes any scratch dir; a younger one is still swept only when its owner shares this pid space and has exited. * fix(git): sweep merge-tree scratch dirs by age alone, off the check's path - The stale sweep now removes any scratch dir at least two weeks old, Git's own expiry for its objects/tmp_* dirs; no merge-tree runs that long. The owner file and pid-space probe are gone, and with them the cases where a sweeper misjudged another process's pid. - The sweep no longer delays the user's check: it starts without being awaited and can only touch dirs far older than the current run's. - A fetched pack's .keep never moves into the real store, so a transient one from an aborted lazy fetch cannot stop gc from repacking that pack. - Tests: the legacy merge-tree fallback gets the scratch env; the local quarantine's WSL decisions (distro from a UNC path, drvfs spelling, host-Git linked-worktree skip, WSLENV hand-off). * fix(git): let quarantined merge-tree see exactly the object stores Git sees without it The scratch object store must not change what merge-tree can read, or the conflict list and the squash-merged branch cleanup differ from main: - An inherited GIT_ALTERNATE_OBJECT_DIRECTORIES (from Orca's or the SSH relay's environment) was replaced; it is now kept and the real store appended after it, as Git's own temporary object stores do. - An inherited GIT_OBJECT_DIRECTORY is the store Git reads and writes, so the command now runs unquarantined. On the WSL route a Windows value only counts if WSLENV forwards it, and then the quarantine is skipped too. - The real store's own info/alternates entries are listed before it, so an alternates chain is linked at the same depth as without the quarantine (a 6-deep chain no longer hits Git's nesting limit). An alternates file that cannot be read or holds a quoted entry runs unquarantined. * fix(git): run merge-tree unquarantined when the repo's store has its own alternates Mirroring Git's alternates resolution could not match it in every shape: a path back to the real store (mutual alternates, or an inherited alternates value naming the repo itself) still linked its chain one level deeper, and a NUL byte in info/alternates broke the spawn. When objects/info/alternates exists, or cannot be checked, the command now runs exactly as before. Repos cloned with --reference or --shared keep writing throwaway objects, as they always have. Inherited alternates are still appended to, and an inherited GIT_OBJECT_DIRECTORY still skips the quarantine. * refactor(git): drop the stale-folder sweep and pack-move rollback from merge-tree's scratch store A scratch folder left by a crash is a tmp_* dir inside objects/, which Git's own gc prunes after gc.pruneExpire, as it does Git's own leftovers, so Orca's 14-day sweep and its test hooks go. Packs a partial clone fetched into the scratch store are moved in Git's migration order: pack- files only, index last, existing names left in place, stopping at the first failed rename with no rollback. A failed move is logged and never stops the scratch dir's removal or the result. Adds a real-Git test that a partial clone lists its conflicts offline once an earlier check downloaded the contents. Co-Authored-By: Claude <noreply@anthropic.com> * fix(git): quarantine merge-tree only once the host is known to support --write-tree Git before 2.35 cannot prune a leftover scratch folder under objects/tmp_*, so a crash in the moment one exists makes every later `git gc` warn and stops automatic cleanup. On Git before 2.38 merge-tree --write-tree is rejected, yet the first check per host per session still made and removed a folder around it. Branch cleanup and the PR conflict list now use the scratch object store only when that host's capability cache already knows merge-tree --write-tree works. Until then the command runs exactly as it does on main: on a Git that rejects it no folder is ever created, and every Git that does get one is 2.38+, whose gc prunes it. Also reword two comments in the quarantine module. Co-Authored-By: Claude <noreply@anthropic.com> * fix(git): learn merge-tree support from a conflicting branch-cleanup check Branch cleanup quarantines merge-tree only once the host's capability cache knows --write-tree works. A conflicting merge-tree exits 1, so the check threw and support was never recorded; on a host whose only checks conflict (likely over SSH, where the relay has no conflict summary to teach its cache) every check kept writing loose objects into the real store. A failure whose stdout starts with a tree ID proves --write-tree ran (old Git that rejects the option prints nothing there), so it now resolves to the same "not merged" result and lets the cache record support. Every other failure is rethrown unchanged. Also shorten two comments and soften a third. Co-Authored-By: Claude <noreply@anthropic.com> * fix(git): put WSL Git's scratch object store on its command line A WSL login profile that set GIT_ALTERNATE_OBJECT_DIRECTORIES replaced the WSLENV-forwarded value, so a quarantined merge-tree lost the real store and failed where main succeeds. The WSL runner now passes both variables as command-line assignments after the profile, appending to its alternates. * test(git): drop quarantine tests the real-Git and compatibility tests already pin The cold-capability gating, scratch-folder lifecycle and WSL path spelling are covered end to end by merge-tree-object-quarantine-real-git.test.ts, the real-binary compatibility contract (Git 2.25/2.38/2.49) and the localGitObjectsDirectory tests, so the unit copies only mirrored them. --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-10-15 15:23:18 -07:00
Jinjing	0d4eb242d7	Recover failed-job log retrieval onto main (#29180) ... * feat(checks): add optional job log outcome * fix(checks): preserve host capture lifetimes and safe outcomes * fix(checks): retrieve and retry bounded failed-job logs * test(checks): cover queued snapshots and captured error safety * test(checks): verify sanitized host excerpts and paired failures * test(checks): identify measurements and preserve paired cleanup * Use the generated check-log fixture in host retrieval tests * Keep real paired-server shutdown outside the injected stall deadline	2026-10-15 10:36:21 -07:00
Neil	6607c54984	perf(ci): cut redundant tests and reuse expensive setup (#28669) ... * perf(ci): reduce test overhead and reuse expensive build work * test(ci): keep worker startup outside failure-case deadlines * test: isolate push fixture advisory locks * test(ci): preserve fixed drain retry allowance * Align CI contracts with current triggers and guide content * Stabilize consolidated reveal scenarios and retain behavioral CI contracts * Fix upstream lint blockers while retaining behavior and assertions * Classify global Jira preferences in the WSL migration inventory * Align Jira test fixtures with startup and build safety checks * Include package-test routing dependency in CI checkouts and fixtures * Keep native stream classes intact in transcript dependency tests	2026-10-14 16:14:27 -07:00
Brennan Benson	38255300d9	fix(worktrees): never delete a folder git no longer tracks (#25075) ... * fix(worktrees): a retried or resumed delete only removes the folder it started deleting A failed worktree delete stays listed for a retry, and an interrupted one is finished at the next start. Both later deletes force-deleted whatever was at the recorded path, proven only by "git does not list it and it has no .git", so an ordinary folder the user put at that path since was deleted with its files, with no click needed in the startup case (STA-9338). An accepted removal now records the checkout directory's identity (device, inode, creation time) in its durable record. A retry, a startup finish, and the in-slot check before the force-delete refuse any folder at the path that is not that directory. Startup no longer rebuilds a missing .git for a registered checkout unless the folder is the recorded one. Records without an identity (older builds, or no creation time) are only finished through Git's own checks and never force-deleted. * fix(worktrees): identify the accepted checkout by inode and a real creation time only The device number changes when an external volume is attached again, so a genuine leftover read as a different folder. Windows reports a missing creation time as a negative number rather than 0, which slipped past the guard. * refactor(worktrees): every background removal states the checkout identity it accepted A new acceptance site that forgot the identity used to compile and silently write records no retry or resume could ever finish. The resume tests also assert the identity was read, so their refusals can't pass as unrecorded. * fix(worktrees): a delete that leaves the user's folder in place also ends the workspace When Orca decided the folder at a failed or interrupted delete's path was not the one it started deleting, it dropped the removal record but kept the workspace's metadata. That metadata still says Orca created a checkout there, and with no record left, the next Delete of the same workspace (a runtime Delete from mobile, the CLI or a paired client, or a second desktop Delete on a row not yet refreshed) went to the cleanup that deletes an Orca-created folder Git no longer lists, and removed the user's folder after all. Now, when a removal ends without deleting while Git does not list the path (a listing ends a failed delete, or a retry, resume or first delete fails with no leftover to show), the host runs a finished delete's bookkeeping: metadata, terminal history, caches and change events. The folder and the branch are left alone, and nothing is ended while Git still lists the path. * test(worktrees): cover the in-slot folder check when Git cannot remove a registered checkout Reverting that check left every test green: only the unregistered branch's check had a test where the folder changes during the delete-slot wait. * fix(worktrees): a resumed or retried Git delete checks the folder inside the delete slot The check that the folder at the path is still the one Orca accepted ran before the watcher gate and the delete-slot wait, which can last minutes behind other large deletes. A folder restored there meanwhile with a copy of the checkout's .git file passes Git's own validation, so `git worktree remove --force` deleted it. The resume and retry now repeat the check inside the slot, right before Git deletes, as the non-Git branch already did; the refusal skips the Windows recovery that could otherwise finish the delete itself. A normal first delete is unchanged. * test(worktrees): assert the second desktop Delete refuses the user's folder The handler result is untyped, so the previous catch-all did not typecheck; the assertion now names the refusal the Delete gets once the workspace has ended. * test(worktrees): the desktop Delete test's stand-in host ends the workspace without a cast * fix(worktrees): a listing asks Git before dropping a failed delete, and ends its workspace in the same step * fix(worktrees): a failed delete Git cannot be asked about stays failed for the next listing to decide * test(worktrees): the failed-delete record test states that Git still registers the checkout * fix(worktrees): a restart keeps a failed delete whose checkout is gone, so the first listing ends its workspace * fix(worktrees): a folder Orca cannot read keeps its failed delete and is never deleted * fix(worktrees): a failed delete leaves the disk only after its workspace's end is saved * fix(worktrees): a runtime Delete of a failed delete's row is told when Orca left the folder in place * test(worktrees): the desktop Delete test's stand-in host returns nothing * fix(worktrees): a Delete of a failed delete's leftover whose .git Orca cannot read says so * Revert "fix(worktrees): a runtime Delete of a failed delete's row is told when Orca left the folder in place" This reverts commit 68d65989de. The shortcut reaches no real client: the CLI and mobile list the workspace before deleting it, which ends the failed delete first, so they still answer not found (the folder is kept either way). * fix(worktrees): a failed delete Git could not be asked about is dropped once Git says it still registers the checkout * revert to main before the standard-model rework * fix(worktrees): stop deleting Orca-created folders that have no .git and that Git no longer tracks Deleting an Orca-created workspace whose folder Git no longer tracked and that had no `.git` force- deleted the whole folder once the user confirmed force. "Orca made a workspace here once" and "there is no .git" do not prove the folder still holds that checkout: an ordinary folder the user put at the path was deleted. Such a folder now gets the existing "Refusing to delete unregistered worktree path" answer, forced or not. Once the user removes the folder, Delete takes the existing missing-path branch and drops the workspace. An orphaned worktree whose `.git` file points back at this repo is still deleted after the user confirms force, as before. * fix(worktrees): delete a failed or interrupted workspace only through Git A delete that failed partway (Git dropped the registration, files left) stays listed as "Delete failed", and a delete a quit interrupted is finished at the next launch. Both later deletes removed the folder with Orca's own file removal, proven only by "Git does not list it and there is no .git". An ordinary folder the user put at that path was deleted, at startup without any click. Orca now deletes a checkout only through Git, plus the existing cleanup right after a Git delete that succeeded in the same operation: - Delete on a failed row: if Git registers a checkout at the path, the normal delete runs. If the folder is still there and Git does not register it, Delete refuses with "Git no longer tracks <path>, so Orca won't delete it. Remove the folder yourself; Orca removes this workspace once the folder is gone." and keeps the row. With the folder gone, Delete prunes Git's stale entry, deletes the branch as recorded and drops the workspace. - Startup finish of an interrupted delete: a checkout Git still registers is removed with `git worktree remove` and the user's recorded force choice, no longer always forced. If Git refuses or fails, the row shows Git's error. The step that rewrote a missing `.git` so Git could force the delete is gone. A folder Git does not register becomes a failed row and is not deleted; with the folder gone, the rest of the delete finishes. Records written by earlier daily builds still load; fields this version does not know are ignored. * test(worktrees): read Git's listing before the Delete call in the real-Git failed-delete suite * docs(worktrees): say when a failed delete's record ends under the Git-only delete * fix(worktrees): keep main's handling of a startup finish Git refuses, and say the listing drops the workspace A startup finish that Git refuses for a checkout Git still registers now clears its record and leaves Git's normal row, exactly as an in-session failure does on main; the resumed-only failed record and the listing that put Git's error on Git's own row are gone, and the listing is main's again. An unregistered folder that still exists is still a failed row, and nothing is deleted. The refusal now reads: "Git no longer tracks <path>, so Orca won't delete it. Remove the folder yourself, and Orca will drop this workspace from the list." The listing drops a failed record once its folder is gone, as on main. * fix(worktrees): finish a failed delete's branch and push-target remote when it fails A delete Git fails partway keeps a "Delete failed" row for the folder Git left. The row's record also carried the branch delete and the push-target remote cleanup for later, but the listing drops the record once the user removes the folder, so both were silently left behind. Now, once Git no longer registers the checkout, the failure runs that Git side right away (merged branch only, stale admin entry, push-target remote), in the one settle path desktop and runtime share. It deletes no files, and a failure of this bookkeeping is logged without touching the failed row. * fix(worktrees): unregister an interrupted delete's checkout whose .git Git already deleted A quit mid-delete can leave a checkout Git still registers but whose .git link Git already deleted (Git deletes it first on Windows). No `git worktree remove` can validate it, so the startup finish failed, the record was cleared, and the workspace came back as a normal row no Delete could ever remove. The startup finish now has Git prune that registration (refused while locked; every file kept) and then treats the folder as one Git no longer registers: the "Delete failed" row with the remove-it-yourself message, ending once the user removes the folder. Adds the non-forced partial-delete case: Git refuses, the files stay, and the row returns as before. * fix(worktrees): name a worktree Git registers inside a failed delete's folder before asking the user to remove it The refusal for a folder Git no longer tracks tells the user to remove the folder. When that folder holds another worktree Git still registers, doing so would delete that worktree's files too. Delete on the failed row and the startup finish now run the existing nested-worktree check first, so its message ("contains another registered worktree: <path>") wins, as it did before this branch. * fix(worktrees): don't prune other worktrees when a delete fails The Git side of a failed delete started with a repo-wide `git worktree prune`. It did nothing for the failed delete, whose admin entry Git had already dropped, but it unregistered any other worktree whose folder was missing at that moment (an unmounted drive), so Orca dropped that workspace too. The failure now runs only the branch step; the prune stays where it was on main, in the folder-gone finish and at startup. * test(worktrees): cover the push-target cleanup every delete job wires for a failed delete A failed delete removes the push-target remote Orca added through the hook each job creator passes: desktop Delete, runtime Delete, and the startup finish. Nothing tested that wiring; these tests fail when any creator drops it. * fix(worktrees): say the leftover folder was left on disk instead of what Orca won't do	2026-10-14 10:58:27 -07:00
Neil	13a75d3939	[CI] Reduce redundant test work and import existing helpers directly (#28365) ... * [CI] Reduce redundant test work and import existing helpers directly * [CI] Preserve provider guards and pin the mobile browser test core * [CI] Fix CI test setup and verify retained contracts * [CI] Compare native media chunks without boxed byte arrays * [CI] Detect shifted native media reads with position-sensitive bytes	2026-10-13 20:25:00 -07:00
Jinwoo Hong	c745051d7d	refactor(main): share one caller-signal + timeout composition (#28393) ... Behavior-preserving refactor. Eleven sites built the same `signal ? AbortSignal.any([signal, AbortSignal.timeout(ms)]) : AbortSignal.timeout(ms)` inline or behind a local wrapper (Codex `createCodexBackendRequestSignal`, `probeDeadline`, `boundedSignal`). They now call one `abortSignalWithTimeout(signal, timeoutMs)` in src/main/lib/abort-signal-with-timeout.ts: - usage requests: Claude OAuth, Cursor, Grok, OpenCode Go API key, ZCode, Codex backend usage + reset-credit read - local worktree path presence, fork sync, retarget divergence budget, upstream-ref watch resolution The Codex reset-credit redeem, which never had a caller signal, uses plain AbortSignal.timeout. Transports, request options, timeout values, error mapping, and Retry-After handling are unchanged.	2026-10-13 16:14:17 -04:00
NeilandClaude	0a1f99fb3a	fix(wsl): recheck watcher-reported paths with full stat on Windows Git drive checkouts (#27817) ... * fix(wsl): recheck watcher-reported paths with full stat on Windows Git drive checkouts Co-Authored-By: Claude <noreply@anthropic.com> * fix(wsl): keep rechecked-dirty drive-checkout paths through watcher overflow and restarts A path the default-stat recheck proved dirty stays a suspect until a recheck proves it clean, so an overflow, interruption, watcher reinstall, or closed watcher no longer drops it back to minimal-only status, where it would silently read as clean. * fix(wsl): stage and discard rechecked drive-checkout paths with full stat Status rechecks watcher-reported paths with core.checkStat=default, but add and restore ran with the injected minimal stat, so a same-size rewrite that kept its mtime showed as modified yet Stage and Discard silently did nothing. Path writes now redo the tracked suspects inside their scope with default stat; everything else stays minimal. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-10-12 20:19:33 -07:00
Neil	a7e24766b7	fix(wsl): run WSL git with Windows Git line-ending settings on checkouts Windows Git wrote (#27778) ... * fix(wsl): run WSL git with Windows Git settings on Windows-authored drive checkouts * fix(wsl): detect Windows Git checkouts from host autocrlf plus a whole-tree sample * fix(wsl): keep WSL-created worktrees on Linux Git defaults and never commit CRLF on an unproven checkout - worktree add / clone write a new checkout whose .git points at /mnt/..., which Windows Git cannot open; injecting autocrlf=true there produced CRLF files later read unflagged. - Writes on a host-autocrlf=true checkout whose sample is unproven run with autocrlf=input, so staging normalizes CRLF without ever writing CRLF to disk. - Writes wait for a stale host answer and re-check checkout identity after joining a sample. * fix(wsl): compare a joined sample with the checkout identity read after it settles	2026-10-12 18:40:06 -07:00
OrcaWinandOrca Worker	83056e5edb	fix(skills): judge official skill updates by ownership, not snapshot matching (#27603) ... * fix(skills): judge official skill updates by ownership, not snapshot matching Orca decided whether an installed official skill was pristine by matching its bytes against a shipped list of past snapshots, falling back to the skills CLI's lock hash. Copies installed between releases, CRLF copies, and installs whose lock recorded a sha256 hash all read "doesn't match the official version" and could not be updated (#26841), and older content could be labelled newer and never offered. Now an official skill is Orca's when the skills.sh global lock says it came from stablyai/orca, and it is current only when its listed files equal the bundled manifest (line endings and sidecars ignored); anything else is outdated. Install and update are one pinned `skills add .../tree/v<appVersion>` command, used by the in-app runner, `orca skills update`, and the Settings rails. The update dialog preselects Orca-owned rows and lists same-named skills from elsewhere unchecked. Removes the snapshot registry, release mapping, git-tree identity, lock trust and convergence logic, and the release-cut provenance step. * ci(skills): run the pinned-add round trip on a skills CLI that can fetch a commit * fix(skills): let orca skills update target the shared folder on a bare host Update became the same pinned add as install, so it inherited install's refusal when no agent is detected. That broke the bare-host update the old command guaranteed, and the built-CLI check (update --dry-run, no --agent) on CI runners. The in-app runner already fell back to universal; both now share one detectSkillsCliUpdateAgentKeys rule. Also brings the CLI skills docs off `npx skills update`. * refactor(skills): derive the update selection from the grouped rows The selection hook took the live and the retained inventory, re-derived Orca ownership from installations beside the grouping's own orcaOwned, and kept a separate display count. Groups already carry both eligibility and ownership, so the hook reads them once; the button's existing live-scan gate is the only authorization check. The unselected line is inlined into the headline. * refactor(skills): drop helpers the ownership design made redundant - isOwnerManagedSkillScope only negated into the participation check once plugin caches stopped participating; fold it in. - Eligibility re-checked resolvedPath/physicalIdentity, which observation already turns into 'inaccessible'. - The manifest verifier probed access() before a readFile that throws anyway. - orchestration-install-command.ts only forwarded one constant from the lib module its three importers already import. * i18n(skills): stop naming npx skills update in four skipped-copy strings The es/ja/ko/zh cantUpdateReason and tipDuplicate strings still named `npx skills update`, which Orca no longer runs for its skills. Say 'the update command' instead. * refactor(skills): inline the single-use pinned source URL helper orcaSkillsSourceUrl was exported but only called by the builder beside it. * fix(skills): let an update choice lapse when the install source changes The selection froze every checked name, Orca's preselection included, the moment the user ticked anything. A re-check that then attributed a name to another source kept it checked, replacing it without consent. Store only the user's explicit choices, keyed by name and lock source, and default to ownership otherwise. * fix(skills): label the empty update action 'Update skills', not 'Update 0 skills' The button stays whenever a row is updatable, so unticking every row (or a dialog with only non-Orca copies outdated) doesn't reflow the footer. At zero selected it stays disabled and reads 'Update skills' instead of a zero count. The label lives beside the dialog's other count copy. * fix(skills): let keyboard focus open the Not from Orca tooltip The source of a non-Orca copy is only in the tooltip, and its trigger was a plain span. Make it focusable like Orca's other tooltip-on-text triggers (tabIndex 0, cursor-help, the row primitive's focus ring), as in the agreed mock. * test(skills): hold the round-trip add equal to the shared install builder The CI round trip hardcoded its skills add argv, so it could drift from what Orca runs. A .mjs script can't import the TS builder (extensionless imports), so the argv moves into an exported roundTripAddArgs and a unit test asserts it is the builder's unattended add with the tag swapped for the PR commit. The script runs under the same main guard as the manifest generator. * i18n(skills): translate the skill row's location count and duplicate reason es, ko and zh still carried English for SkillUpdateRow.oneLocation and manyLocations, and es and ko for SkillFreshnessRow.skippedReasonDuplicate. * fix(skills): pin official skill installs to the build commit and skills CLI `skills add .../tree/v<version>` only works for stable and RC builds: hourly, daily and adhoc builds publish elsewhere, so stablyai/orca has no tag for their version and both install and update failed there. Every build is made from a commit that exists in stablyai/orca, so the build now stamps `git rev-parse HEAD` and the one shared builder pins to `tree/<commit>`, which equals the bundled skills by construction. Main, renderer, web and vitest get it as ORCA_BUILD_COMMIT (replacing ORCA_APP_VERSION); the tsc-built CLI reads it from the compiled out/package.json boundary. A missing or malformed commit fails the build or the command with a clear error instead of building a bad URL. The builder also pins the skills CLI (`npx skills@1.7.2`): 1.5.x cannot fetch a commit, and a bare `npx skills` can reuse a stale cache or resolve to another binary (#18687). The CI round-trip script reuses the same constant. * ci(skills): run the round trip on the shared pinned skills CLI version * docs(skills): document the commit-pinned skills add * refactor(skills): keep the pinned skills CLI version in the install builder skills-cli-version.ts existed only so the plain-Node round-trip script could strip-load a .ts file, which needed --disable-warning in CI. The version now lives beside the builder that uses it; the script keeps a literal, and the existing round-trip test already asserts its argv, skills@<version> included, equals the builder's. * refactor(skills): validate the build commit once, where it is resolved resolveBuildSourceCommit already refuses anything but a full hash, and both the define and the CLI's stamped package.json come from it. The builder's second check could only fire as a module-load throw in the renderer's command constants. Also drops the resolver's unused cwd parameter. * test: stamp a fixed build commit instead of running git in the vitest config Tests only interpolate ORCA_BUILD_COMMIT, so they need not read HEAD (or fail outside a git checkout) on every run. * refactor(settings): match only skills add in the Windows npx preflight Every official skill command is now the builder's skills@<version> add; no rail emits skills update any more. * fix(skills): fail an update that leaves a broken skill link behind Eligibility already skips names with a broken link before the run, so one afterwards is the run's own damage; report it instead of claiming success. * ci(release): refuse to tag when the skill manifest is stale The removed --release step implicitly checked the committed manifest against skills/. Keep that guarantee with a verify-only run; it writes nothing. --------- Co-authored-by: Orca Worker <orca-worker@localhost>	2026-10-11 18:30:03 -07:00
OrcaWinandm4air	c5224f70d8	refactor(providers): delete the SSH git and filesystem providers and relay-only wiring (#27644) ... * refactor(providers): delete the SSH git and filesystem providers and relay-only wiring * refactor(ssh): drop relay-protocol exports only the deleted stream readers used --------- Co-authored-by: m4air <m4air@Mac.localdomain>	2026-10-11 17:48:43 -07:00
Neil	a944a37c8c	[CI] Check real I/O progress during worktree deletion (#27620)	2026-10-11 16:26:37 -07:00
OrcaWinandm4air	df2f2a72de	refactor(ipc): filesystem and repo handlers are local or runtime only (#27609) ... * refactor(ipc): filesystem and repo handlers are local or runtime only * test(ipc): drop two casts in the rewritten listing and import tests * fix(providers): keep the default error name so IPC callers see the old text --------- Co-authored-by: m4air <m4air@Mac.localdomain>	2026-10-11 15:41:56 -07:00
Jinwoo HongandNeil	3f8d296b8d	fix(macos): preserve terminal permissions across app updates with a small signed helper (#27021) ... * fix(macos): preserve terminal privacy identity across app updates * test(macos): make launchd fixtures portable across host platforms * fix(macos): probe protected contents and close handles on denial * fix(i18n): register terminal permission status labels * fix(macos): fork the daemon when no stable-bundle job can claim the endpoint A copy, signature, plist or deadline failure before bootstrap, a bootstrap launchd refused with the job absent, a job whose daemon exited before answering, and a foreign endpoint all threw out of the launcher. The app then lost its persistent daemon and fell back to local PTYs, where main forks one. These now fall through to the existing fork path, which also adopts a foreign occupant normally instead of as a degraded endpoint. A timed-out bootstrap or a job still running/unreadable stays fatal, so no second daemon races it. * feat(telemetry): split daemon origin events by stable-copy launch method daemon_adopted, daemon_pty_cwd_denied and daemon_pty_cwd_readable gain a closed-enum launch_method (stable-copy / app-fork / unknown), read from the spawner path the daemon recorded, so the update fix is measurable per daemon even when an old forked daemon is adopted across updates. The reliability gate is a test manifest with no runtime switch, so there is no gate state to report; spawner_path_class reports the private copy as 'other' alongside other non-/Applications installs. * refactor(telemetry): report the stable copy as a spawner path class The separate launch_method property duplicated what the recorded spawner path already says. spawner_path_class gains `stable-copy`, classified from the same path under the private runtime root, and launch_method, its enum and classifier are removed from all three .strict() daemon origin events. A deleted copy still reports `missing`. * refactor(settings): gate terminal-host Full Disk Access on macOS once The permissions handler already asks for the terminal-host status only on macOS, so the status function's own platform check and the pane's 'unsupported' branch could never fire. The off-macOS guarantee is now tested at the handler. * fix(macos): keep the fork fallback inside the startup PTY gate The stable launch could run until 55 s after the launch started, so a late "unavailable" verdict left the fork fallback's own 10 s readiness wait to finish after the 60 s gate had already moved the app to local PTYs. The launcher now gives the stable attempt one handoff deadline: the gate minus the fork's readiness timeout and the 5 s lease/adapter allowance (45 s). Copy, signature check and plist conversion share one abort signal that ends early enough for bootstrap and the job's own readiness wait to meet that deadline; every command otherwise keeps a fixed timeout. An unavailable verdict past the deadline is reported instead of forking a daemon that cannot arrive in time. The per-step budget module is gone (its deletion landed in the previous commit by a staging slip). The launch body is now two blocks: preparation (plist, plutil, deadline check) fails as unavailable after removing the copy and job file, and bootstrap runs in its own try/finally that always deletes the job file. Retirement is simpler and claims more orphans: one in-flight collection per process instead of a per-root map and rotating 20-record scan, and the job record (written before copying) no longer carries a bundle name because lsof +D scans the whole runtime directory (measured equal cost, same result on a live copy). A never-submitted copy is retired once its producer has exited and its job is missing, so a bootstrap timeout or a crash mid-copy no longer leaves a copy forever; the open-file check still guards deletion. Collection now starts from the launcher after the attempt. * docs(macos): ship the daemon launch rules, not the investigation The signed investigation harness left the tree in the previous telemetry commit by a staging slip; its results and pinned link stay in the PR. This trims the reference doc to why the copy and launchd exist, the fallback states and the cleanup rule, trims the reliability gate to what its validator needs, and points AGENTS.md at the reference doc next to the Windows relocation entry. * fix(macos): hand off to the fork as soon as the stable job exits A copied daemon refused at exec (for example by Gatekeeper) never answers, so every fresh start paid the full 10 s readiness wait before the fork fallback. The readiness loop now reads the job state every 500 ms and abandons as soon as the job is stopped or missing; a running or unreadable job is still waited out and never forked beside. Also drops the dead forkEntryPath the stable launch never read (its options type now omits it) and un-exports the handoff constant. * fix(macos): keep daemon copies out of Spotlight and unregister retired ones Each runtime copy is a full Orca.app, so Spotlight indexed it as an app and LaunchServices kept a record for it that outlived the copy. A registered copy claims orca: links and Markdown/CSV files, and becomes their default handler whenever /Applications/Orca.app is not registered. New copies go under runtime-*/app.noindex/, which Spotlight skips and which stops the record LaunchServices made while the bundle was being copied. Retirement now runs lsregister -u on every bundle in the copy (both the app.noindex layout and the earlier runtime-*/Orca.app layout) once lsof shows it unused, then deletes it. A running copy stays registered, because Local Network access may be resolved through that record. Collection and stable-copy telemetry match the runtime-* directory, so copies made before this change are still adopted, classified and retired. * docs(macos): record the LaunchServices trade-off and the rollback plan The reference doc now explains why copies sit in a .noindex folder, why only retired copies are unregistered, and how to turn the copy launch off: make launchMacDaemonFromStableBundle return null, and keep the retirement code until no copy-launched daemon can remain, because the old code never deletes copies. A test pins that rollback: with the stable launcher returning null, the launcher forks and still runs the copy collection. * fix(macos): keep daemon copies registered so Local Network can resolve them The `.noindex` folder kept copies out of Spotlight and LaunchServices, but Local Network access is resolved from the signing identifier through LaunchServices to the executable's Mach-O UUID. After an update that changes Electron only the copy carries the running daemon's UUID, so an unregistered copy risks the same Local Network loss main has today. Copies go back to `runtime-*/Orca.app`; retirement still unregisters each copy before deleting it, so deleted copies leave no LaunchServices entry. The remaining trade-off: while `/Applications/Orca.app` is missing, a running registered copy can be picked for `orca:` links and documents. * fix(macos): hide daemon copies from Spotlight and tie the job to Orca Spotlight listed each runtime copy as a second Orca app. New copies go back under runtime-*/app.noindex/Orca.app, which Spotlight skips. Retirement and stable-copy telemetry match the runtime-* directory, so copies in the earlier runtime-*/Orca.app layout still retire and classify the same way. Local Network access identifies the daemon by its code signature and main-executable UUID, not by a LaunchServices record, so an unregistered copy keeps it. The launchd job now sets AssociatedBundleIdentifiers to com.stablyai.orca, which is how a job not installed through SMAppService names the app it belongs to. Copies are never registered explicitly; retirement still runs lsregister -u before deleting each one. * feat(macos): package a signed terminal host helper that runs the daemon on the pinned Node Contents/Helpers/Orca Terminal Host.app carries the pinned Node, the daemon's out/main JS and this slice's node-pty, signed inside-out as com.stablyai.orca. afterPack boots it through one PTY round trip, then fails the build on layout, Info.plist, macOS floor (NODE_RUNTIME_DARWIN_MINIMUM_OS vs Node's minos), architecture or signature drift. * ci(macos): cache and prefetch the pinned Node before packaging Packaging now fetches the darwin Node from nodejs.org, whose download has no retry. Each mac workflow caches it with the electron-builder downloads, keyed on the pin, and warms both darwin targets inside the existing retry wrapper. * feat(macos): launch the daemon from a copy of the terminal host helper, not the whole app The stable launch now clones Contents/Helpers/Orca Terminal Host.app (~124 MiB instead of ~628 MiB) and runs its Node on its daemon entry, without ELECTRON_RUN_AS_NODE. The copy must still match the running app's designated requirement. A missing helper falls back to the fork, and macOS below the helper's Node floor forks without copying. * docs(macos): describe the terminal host helper, its floor and its identity * fix(macos): bound the terminal host boot check by its deadline and always clean up A daemon that stayed silent hung packaging past the 20 s deadline; one that closed the connection left the hello unsettled so Node exited 0 without cleanup; a malformed line threw uncaught. Every connect, hello and PTY wait now races the deadline, close/error/parse failures reject, and the daemon and scratch dir are removed on every path. * ci(macos): cache the pinned Node on its own key with no restore-keys fallback Sharing the electron-builder cache let old Node archives accumulate through restore-keys. Also moves release-mac-build's Electron cache comment back onto its step. * fix(macos): reject a universal slice for the terminal host and pin its name in one test packageMacTerminalHost turned an unknown arch into darwin-undefined; it now throws through the shared mac arch mapping. A test asserts the packager and the desktop agree on the helper bundle and executable names, replacing a Linux/Windows test that could not fail. * fix(macos): pass the launchd adoption lease its options object after the main merge * test(macos): accept a reset as the daemon closing the boot-check connection; keep only passing gate commands * fix(daemon): bump the terminal daemon protocol to v45 so new macOS tabs start in the terminal host helper * fix(macos): ship the daemon's required packages in the terminal host and boot it outside the build tree * style(macos): use a template literal in the terminal host resolution check * fix(macos): derive the terminal host's packages from the daemon's own module graph * fix(macos): treat any non-literal daemon load as computed, follow directory loads, and keep nested dependencies * refactor(macos): move terminal-host telemetry, Settings status and Helper folder strings to a follow-up Keeps this change to the update-safe terminal host itself. The follow-up restores: - the `stable-copy` spawner path class in daemon adoption telemetry; - the per-terminal-host Full Disk Access row in Settings and its daemon RPC; - writing folder usage descriptions into the app's Electron Helpers for the fork fallback. The helper still takes its Desktop, Documents and Downloads descriptions from `macos-folder-usage-descriptions.cjs`, so that constant stays. * fix(i18n): restore en.json to this branch's base, not newer main The previous commit took the file from a newer main, which pulled unrelated strings into this PR. * refactor(macos): publish one terminal-host copy per helper build under a fixed launchd label Name the copy after the helper's CDHash, reuse it when present, and publish a new one by cloning into a staging dir, verifying it once against the app's designated requirement and renaming it into place. One launchd label per profile and protocol replaces per-launch labels, so job.json, producer pids and per-label collection go away. Retirement deletes any other copy lsof shows unused. The stable launcher returns null for every fork fallback and logs its reason. * fix(packaging): copy terminal-host dependencies from where Node resolves them A nested package's own dependencies were never walked, so a hoisted dependency of a nested package was left out of the helper. Resolve each dependency through the node_modules lookup Node performs from its parent and copy it to the same relative place, unless a copied package already carries it. * fix(packaging): fail release and CI mac builds that cannot boot a terminal-host slice An arm64 runner without Rosetta skipped the x64 helper's PTY boot check and shipped the slice untested. Release channels and CI now fail there; local cross-arch builds still skip with a log line. * docs(macos): describe the per-build terminal-host copy and its fallback reasons * docs(macos): keep the codesign command on one line * test(macos): type the launchd test state without an assertion * docs(macos): name what the login-session flag gates in the stable launcher * fix(macos): wait for launchd to drop a booted-out terminal job before reusing its label --------- Co-authored-by: Neil <neil@stably.ai>	2026-10-11 14:54:36 -04:00
OrcaWinandm4air	215ee3e625	refactor(runtime): runtime git and file callers drop SSH arms (#27501) ... Co-authored-by: m4air <m4air@Mac.localdomain>	2026-10-11 08:23:12 -07:00
OrcaWinandm4air	ec14775f93	refactor(providers): an ssh: route carries no provider and throws one typed error (#27477) ... Co-authored-by: m4air <m4air@Mac.localdomain>	2026-10-11 06:25:41 -07:00
OrcaWinandm4air	2b4b60a87e	refactor(relay): delete the SSH relay server, its build assets and tests (#27215) ... * wip: delete the SSH relay server and its build, assets and tests * wip: drop main/relay plugin conformance; WSL reader lookup test * fix: drop the emptied relay bench; prune baselines * test: keep the native halves of tests that also covered the relay * chore(ci): drop shard timings for the deleted relay server tests * fix: keep the directory listing budget that darwin terminal names now import --------- Co-authored-by: m4air <m4air@Mac.localdomain>	2026-10-10 22:36:42 -07:00
Neil	b63d39ebe5	Keep repository detection off the main registration thread (#26760) ... * Keep repository detection off the main IPC thread Share repository discovery decisions across synchronous compatibility callers and the existing asynchronous Git runner. Await discovery in project registration, nested imports, and folder upgrades, and recheck folder ownership after discovery completes. * Make repository detection fixtures work on native Windows * Await asynchronous Git checks in folder upgrade fixtures * Prevent duplicate project registration after async discovery * Check authoritative registration identity before renderer convergence * Narrow repository responsiveness to detection and registration * Keep one local project identity after concurrent registration * Run registration SSH coverage in the existing Docker lane * test(git): cover classifier failure stages and literal path identity * test(git): use the current process host package * test(repos): use current process host in registration fixture	2026-10-10 02:00:15 -07:00
Neil	1912c90141	Extract subprocess handling into @orca/process-host (#26963) ... Extract subprocess execution and process contracts into @orca/process-host with explicit public entry points, independent checks, and one Node 18 compatible CommonJS runtime. Migrate application consumers and integrate package builds, dependency selection, import enforcement, and runtime resource staging. Preserve daemon startup ownership and profile isolation, and qualify development rebuild recovery and concurrent output publication. Remove unnecessary aliases, test forwarding exports, and a duplicate output scan. Validation: full typechecks, changed-code quality, package and artifact checks, native Windows builds/types plus 306 runtime tests, and independent native reviews. Matched full E2E controls on original main and unchanged reviewed head both pass all 17 applicable tests (nine skips). Earlier intermittent E2E failures are documented in the PR; no assertions were weakened. The final combined-tree audit preserves both branches with no import-boundary violations.	2026-10-09 18:32:28 -07:00
OrcaWinandm4air	3e0b828358	refactor(main): route git probe and terminal-artifact provider checks through the host router (#27066) ... Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>	2026-10-09 18:19:54 -07:00
4 people	6aef5c569c	Phase 3.7: fix SSH/remote failures found by adversarial real-host testing (#26847) ... * fix(remote-terminal): keep a reconnected pane's size after an SSH outage (P1-4) (#26625) * fix(remote-terminal): keep a reconnected pane's grid when its stale stream is reaped (P1-4) The host's width floor only handed ownership to viewers that had claimed since subscribing. A reconnecting desktop pane re-subscribes without claiming, so when the heartbeat later reaped the dead socket that owned the floor, the host reclaimed the PTY to its spawn size (120x40) and held the pane there. The owner's same-client replacement stream now inherits the floor, and a pane whose stream was reaped before it reconnected resumes ownership on re-register unless the host or another viewer claimed since. * fix(remote-terminal): host typing during an outage revokes the reaped owner's resume Host input reaches the PTY without a renderer viewport claim once the host has reclaimed its grid, so the orphaned-owner entitlement survived and a passive reconnect resized the host pane back to the remote grid. The host write path now clears that entitlement on driving input (query replies, focus reports and launch writes excluded). * test(pty): stub the runtime's host-input note in write-path handler tests --------- Co-authored-by: m4air <m4air@Mac.localdomain> * fix(remote): an oversized RPC reply fails that request instead of closing the host connection (#26624) Expanding a folder with ~80k entries on a managed SSH host produced a files.readDir reply over the 4 MiB encrypted-reply cap. The channel treated that as a transport fault and closed the whole control socket (1013), and the explorer rendered the failed folder as empty. - The WebSocket RPC transport now answers an over-cap reply with a reply_too_large error for that request id, so the channel never sees it. - files.readDir checks remote listings against the request's content budget and names the entry count. - The explorer shows a subfolder's read error on its expanded row. Finding: HH-2 (Phase 3.7 hostile-host). Co-authored-by: m4air <m4air@Mac.localdomain> * fix(ssh): let a slow host finish installing the pinned Node runtime (HH-3) (#26631) * fix(ssh): let a slow host finish installing the pinned Node runtime The POSIX promote (extract, hash, self-test and publish the ~110 MiB node binary) ran under the 30 s default exec timeout. On slow home storage it timed out, the remote work kept running, and the runtime store lock it held stayed until the 20-minute stale rule, so relay rung A queued behind it past its own deploy bound. Give both platforms the 300 s promote bound and have the host release the store lock itself when the promote exits, with owner-checked releases so a late release never removes a lock someone else took. (HH-3) * fix(ssh): let the host release the store lock after a slow under-lock re-hash The under-lock re-check of a sibling-published runtime hashed the ~110 MiB executable as its own command under the 30 s exec default and outside the host-side lock release. On slow storage it timed out, the client correctly kept the lock, and nothing on the host freed it until the 20-minute stale rule, so later installers ran out their deploy bound. Run the re-hash and the conditional promote as one host command wrapped in the host release, and give every full-runtime hash, including the initial probe, the slow-storage bound. (HH-3) * test(ssh): count the combined under-lock re-probe and promote as one host command --------- Co-authored-by: m4air <m4air@Mac.localdomain> * fix(ssh): shell startup output on stdout no longer breaks SSH connect (HH-1) (#26617) * fix(ssh): fence captured exec stdout so shell rc output cannot break connect sshd runs the user's login shell before Orca's /bin/sh wrapper, so any startup-file stdout (fish/tcsh/zsh/bash echo, or a bare terminal-title escape) was glued onto every captured answer. The home probe read "banner\n/home/u" and connect failed with "Remote home is not a valid path". execCommand now wraps wrapped POSIX commands in a per-call nonce fence and returns only the payload between the markers; the SSH folder browser gets the same fence. The fence is the existing WSL captured-login-shell fence, moved to src/shared/posix-stdout-fence.ts so both transports share it. Finding: HH-1 (phase 3.7 hostile-host). Refs #8324. * fix(ssh): fence the login-shell Node probe and fall back from a noisy SFTP handshake The login-shell 'command -v node' probe ran unwrapped, so output from sshd's shell and the nested login profile became the Node path. It now prints a one-line fence every login shell parses, inside that shell. An external sftp-server is started through the user's shell, so startup output corrupts the SFTP handshake. ssh2 reports that parse failure only before the session is ready, so SshConnection.sftp tags it, and relay install transfers treat it as SFTP unavailable and stream over exec stdin. Finding: HH-1 follow-up (phase 3.7 hostile-host). Refs #8324. * fix(ssh): keep the stdout fence marker out of the command text The runtime-store inventory lists processes with ps, which prints its own script, so a literal marker in the script was read as the fence and the store GC skipped every pass. printf now joins the marker from two halves. --------- Co-authored-by: m4air <m4air@Mac.localdomain> * fix(orcad): finish an abandoned update on connect, and refresh renderers after a main-side re-pair (P1-A, P1-C) (#26635) * fix(orcad): finish an update or rollback its client abandoned, and tell renderers about main-side re-pairs P1-A: a wake that finds the activation fence now runs crash recovery, which takes only a stale, previous-boot or exited-own fence. Recovery of an activation interrupted after the candidate launched resumes it: the candidate commits if it passes the readiness gate, else the activation is undone as before. P1-C: invalidating a still-linked environment's transport restarts its status owner, and a renderer that sees status under a newer pairing revision re-reads the catalog before applying it. * fix(orcad): a resumed update keeps the app version that started it Recovery that commits an abandoned candidate stamped no activeAppVersion, so an older desktop read the host as pre-tracking and downgraded it over state the newer build had migrated. The activate journal now records the initiating app version; recovery stamps it, and a journal too old to carry it is undone instead of committed. * test(runtime-env): answer nothing for the status restart a re-pair now triggers * fix(orcad): recovery leaves running an update server a too-old journal cannot commit A journal without candidateAppVersion was sent to undo, which stopped a healthy candidate that had already migrated state and then refused to restart the incumbent, leaving the host serving nothing. Refuse instead, keeping the fence and the candidate, until the operator accepts Restore. --------- Co-authored-by: m4air <m4air@Mac.localdomain> * fix(terminal): a remote recovery never splices stale history above the new screen (P2-5, P2-7) (#26647) * fix(terminal): a remote recovery never splices stale history above the new screen A pushed remote snapshot (overflow recovery, seq-gap resync, first attach) is sent because the client's stream broke, so the pane's own history ends before that image. Since #26319 a screen-only image kept that history, splicing a stale block directly above the final screen with a silent gap of up to ~270k lines (P2-5), and a first attach to an older host left silent holes (P2-7). - Host: the ACK-overflow recovery serializes up to 1000 history rows. - Client: the seq-gap resync asks for the same 1000 rows. - Client: a pushed snapshot always replaces the pane's scrollback; the keep-local-scrollback path is removed. A screen-only image from an older host now shows only its screen, which is lossy but never misleading. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(terminal): a pushed image replaces the normal buffer over a live alt screen too Over a pane already on the alternate screen, an image that also ended on alt repainted only its alt frame and kept the pane's normal buffer, inferring the two had frozen together. Inside the gap the TUI can exit, the shell print and a second TUI start, so once that TUI exited the pane showed its stale history where the host had the missed output. A pushed image now always rebuilds the normal buffer and history from the host before entering alt itself. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(terminal): bound recovery history by link slack and keep pre-TUI scrollback under screen-only images A recovery that carries history now goes out only when the stream's ACK window has drained; under a sustained flood recoveries stay screen-only and the owed history follows once the client catches up, so snapshot bytes no longer outgrow the client's intake. A pushed image without history (scrollbackRows absent or 0) over a live alt screen repaints only the alt frame again, so a reconnect to an older host no longer wipes the pane's pre-TUI scrollback. --------- Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(source-control): Stage All stages every change when the listing hit the 1,000 cap (HH-4) (#26618) * fix(source-control): Stage All stages every change when the listing hit the 1,000 cap The status listing stops at 1,000 rows, but Stage All built its path list from those rows, so it staged 1,000 of 20,000 changes and the next commit was silently partial. When the listing is capped, Stage All (and the Changes header Stage all) now asks the host to stage the whole worktree via an optional scope on git.bulkStage; unresolved conflicts stay unstaged. Older hosts ignore the field and stage the listed paths. Fixes HH-4. * fix(source-control): whole-worktree Stage All needs a host receipt, skips shared links, and reaches mobile - Scoped stage sends no paths and requires a stagedScope receipt, so an older runtime or relay stages nothing and the client reports it instead of a silent partial stage. - Scoped 'all' skips Orca's shared symlinks (configured and really a link), matching the status listing. - The capped-listing banner offers Stage All, reachable when the visible prefix is entirely staged. - Mobile reads didHitLimit and uses the same scoped stage and receipt. * test(source-control): type the Stage All test stubs so lint and the mobile test typecheck pass * fix(source-control): match Shared Paths saved as ./name or name/ against git's spelling The Shared Paths setting keeps entries as typed, but git prints worktree paths without a leading ./ or trailing /. Stage All's conflict path compared the raw spelling to git's untracked list and staged the shared node_modules link, and an exclude pathspec ending in / made git refuse the add after tracked changes were already staged. Status listing had the same mismatch. getSafeRelativePath now returns git's spelling, so every caller gets it, including saved settings. --------- Co-authored-by: m4air <m4air@Mac.localdomain> * fix(ssh): redeploy a managed server another desktop stopped; forget one whose host is gone (P1-D, P1-E) (#26628) * fix(ssh): redeploy a server another desktop stopped; let a dead managed host be forgotten P1-D: a connect whose linked server the host reports as not activated (another desktop stopped it) now goes on to the update check, which redeploys it in place. P1-E: add Forget (managedServer.forget, orca environment forget, Settings row) that runs Stop's local unlink without contacting the host; the verdict stays unverifiable. * test(ssh): type the forget test's hoisted store without an assertion * fix(ssh): never downgrade a stopped host; redeploy it mid-session and retry after a failure A stop now keeps the stopped build's Orca version, so an older desktop's reconnect skips as host-newer instead of starting an older server on a store a newer build migrated. A stop recorded without that version is not guessed at. A stopped host retries the redeploy on each connect instead of the once-per-version failure suppression, and a runtime call that finds the server stopped mid-session redeploys it before the call. * fix(ssh): rebuild the managed forward after redeploying a stopped host A redeploy can bind a different port than the reused forward targets. * fix(ssh): keep stop journals readable by older desktops and recheck version policy under the fence - The stop journal's recordAfter is the core deactivated record older peers compute; the committed record keeps activeAppVersion (which released planners already honour) and rolledBackFrom, rebuilt from recordBefore on recovery. - Auto-update re-applies its version policy to the record read under the host fence, and a census counted against another incumbent is treated as unverifiable. * fix(ssh): file a dispatched stop where older desktops cannot commit it, so their recovery never drops the version guard * fix(ssh): refuse a fresh deploy of an older orcad onto a host a newer desktop stopped The unlinked deploy path never consulted the stopped record's activeAppVersion, so a desktop without a link to the host could activate its older build over state a newer build migrated. Both the auto-update planner and the fresh deploy now apply one downgrade rule under the fence. --------- Co-authored-by: m4air <m4air@Mac.localdomain> * fix(ssh): redeploy a managed server a pre-version Stop left; let a forced deploy run over a newer one (#26766) A stopped activation record without activeAppVersion is what every Stop on main writes, so refusing it stranded those hosts behind an unforceable policy refusal. Only a provably newer host is now refused; a forced fresh deploy runs this version anyway, and the refusal names both versions. Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local> * fix(remote-terminal): no keystroke lost, duplicated or split across a silent outage (P1-1, P1-2, P1-3) (#26630) * fix(remote-terminal): no keystroke lost, duplicated or split across a silent outage Remote pane input was fire-and-forget: keys handed to a socket that had silently died were gone, keys still in the 8 ms debounce at detection were cleared, and held keys were discarded when the auto-recovery window ran out. - New negotiated `inputAck` capability: the client names an input session and sequences Input frames (existing frame header `seq`); the host records the last applied sequence per (PTY, session) across connections, writes each sequence once and acks it with new opcode InputAck (18), sent only to clients that advertised the capability. - The pane keeps sent-but-unacked input and replays it to the same terminal on reattach; the host dedupes. Old hosts keep current behavior. - Debounced and claim-queued input at detection is held, not cleared. - Held input survives the 'disconnected' phase; the hold coalesces keys so minutes of typing do not hit the per-entry cap. - Banner copy no longer claims a one-minute retry window. Fixes P1-1, P1-2, P1-3 (phase 3.7 network findings). * fix(remote-terminal): never replay into a restarted runtime; keep Ctrl+C and validating paste in order - Host publishes inputLedgerId with inputAck; the client drops unacknowledged input sent to a different ledger (runtime restart with the same PTY) instead of running it twice. - A replayed duplicate is acked only after the original write settles. - Accepted input (Ctrl+C, Escape, paste) rides the sequenced stream and resolves on the host ack. - Keys typed while held queue behind a paste still in size validation. * fix(remote-terminal): parse subscribed capabilities into a typed shape instead of Reflect.get * fix(remote-terminal): ack only applied input; withdraw writes their caller gave up on - Host ledger records each write's outcome: a refused write is rolled back and never acked, so the client's replay writes it; nothing queued behind it runs or is acked. A write that threw is acked as delivery-unknown, so the client reports it failed and never replays it. - Paste and file-drop timeouts abort their accepted write: a copy still held for an outage is withdrawn, and a journaled copy is left out of the replay. - A batch of sequenced input keeps one endpoint and ledger, so a send that retires the stream mid-batch no longer discards earlier unacked input. * fix(remote-terminal): host writes sequenced input strictly in order and asks the live stream to resend after a refusal - The ledger admits only the next sequence; a refusal or gap answers with an InputAck resend request instead of WriteUnavailable, so the pane keeps its journal and resends on the same stream (no remount, no carrier bookkeeping). - Sequenced input uses the provider's settled write; an unverifiable handoff is delivery-unknown, not refused. - Replays fill given-up slots with empty input so the host can continue; the client remounts only after every resend backoff is refused. - Typing batched ahead of a paste goes out as its own sequences, so cancelling the paste keeps it. * refactor(remote-terminal): deliver sequenced input with standard go-back-N Replace the hand-built "block on refusal" bookkeeping with go-back-N: - Host: per (PTY, input session) the ledger keeps only appliedSeq, the highest contiguous confirmed write. Frames run one at a time in arrival order: a duplicate is re-acked, the next sequence is written and acked on confirmed success, and a refusal or gap is answered with a resend request carrying appliedSeq. No blocked state; every stream is equal. A settlement that proves no byte left is a refusal; one that may have written advances as delivery-unknown and is never retried. - Client: one journal keeps unacked input in order and resends from appliedSeq + 1 on a resend request (with backoff), on a new stream, or when acks stall. Refusals never remount the pane. Withdrawn pastes, stale query replies and over-budget bytes resend as empty slots. - The recovery hold pauses (keeps the rest) when a release is cut short by another outage, and keeps delivering typing after an accepted write a sequenced stream withdrew or could not confirm. - Add a seeded model-based test that drives the real pane transport, multiplexer and journal against the real host dispatcher and ledger through 2,000 random fault schedules. * test(remote-terminal): cover the refusal remount on a stream without sequenced input A sequenced stream now resends refused input on the same stream instead of remounting, so the end-to-end remount check negotiates no inputAck, as an older peer does. * fix(remote-terminal): escalate persistent input refusals, drop input once recovery gives up, and never report a lost unknown ack as applied - The pane falls back to its remount path when the host keeps refusing input past the resend backoff ladder. - Held and journaled input is discarded when auto-recovery gives up, and input typed under the disconnected banner is not held. - The host ledger answers a duplicate for its own sequence and remembers delivery-unknown outcomes; the client settles a write as applied only from its own ack. - The input model now requires a write reported applied to have reached the PTY whole, and covers a refusal that never clears. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local> Co-authored-by: Claude <noreply@anthropic.com> * fix(remote-terminal): keep input typed past the auto-recovery window for the same terminal, within a bounded grace (P1-3) (#26832) The last round of #26630 discarded held and journaled input as soon as auto-recovery gave up, and refused input under the disconnected banner. On a real host a 200 s outage lost 102 of 120 keystrokes, although the pane reattached the same terminal on its own seconds later. Input now stays held for the same handle and incarnation while the pane is disconnected, for up to 5 minutes after it gave up. Past that grace it is discarded, and typing into the dead pane is refused, so stale keys never run at an arbitrary later reconnect. The grace is a timestamp checked when input moves, so a latched pane stays free of timers. Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: Claude <noreply@anthropic.com> --------- Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: m4air <m4air@m4airs-MacBook-Air.local>	2026-10-09 04:58:48 -07:00
OrcaWinandOrcaWin	4d1a3dd6ac	Detect installed GitHub CLI behind hung launchers (#25183) ... * Recover installed forge CLIs after launcher timeouts * Preserve healthy CLI timeouts and add native platform checks * Resolve Windows tree termination outside PATH * Use native absolute paths in the relative PATH fixture * Expect the absolute System32 taskkill in tree-kill tests --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>	2026-10-08 15:37:25 -07:00
NeilandKyou0203	2137295bb6	fix(git): use branch-safe author names as username fallback (#25984) ... Co-authored-by: Kyou0203 <kyou12138@gmail.com>	2026-10-06 15:59:38 -07:00
3 people	9e8a3a5c67	fix(repos): stop reporting clones that never ran as successful (#23770) ... * fix(repos): reuse a saved project only when git shows it's this clone A saved project outlived its folder, so Clone reported success without running git. Fixes #23563 * fix(repos): let a repeat clone of an empty repository reuse its project A clone of a repository with no commits leaves HEAD unborn, which `rev-parse --verify HEAD` rejects exactly like the `refs/heads/.invalid` HEAD a killed clone leaves. The saved-project check read both as "not a finished clone", so cloning a brand-new empty repo a second time — a double-clicked Clone, a re-run `orca project setup-clone`, or #2981's queued retry — fell through to git and died on "destination path already exists and is not an empty directory". Ask the two questions apart when `--verify` fails: `symbolic-ref HEAD` resolves an unborn branch but not a killed clone's HEAD. It is already on the relay's read-only allowlist. Probes also short-circuit once the clone is cancelled, so no probe after Cancel spawns git. * fix(repos): prepare the worktree root after re-cloning a project's folder The branch that re-clones into a saved project's folder returned the project without the two steps every sibling branch runs: the worktree root that vanished with the deleted folder is never re-created, and the authorized-roots cache keeps the answers it cached while the folder was missing. Creating a worktree or reading files in the recovered project then fails on a root that is not there. * fix(ssh): register the root after re-cloning a saved project's folder `addRemoteRepoFromPath` returns an existing project before it notifies `session.registerRoot`, which was unreachable before the saved-project check could re-clone into a project's own path. The relay therefore never learned the folder came back, so sessions under it stayed unregistered. Notify from the clone, mirroring the folder-to-git upgrade beside it. * fix(repos): say which reason refused a clone over a saved project One message covered both "that project holds a different repository" and "Orca has no record of what that project held", which need different things from the user. Name the recorded URL when there is one, and say plainly that there is no record when there isn't — the second is the case a project predating remote-identity enrichment lands in, and the user cannot act on it without being told why. Also drops the `upstream` remote-name check into a named binding: `origin` is the only stored remote that names a project's own repo, because `Repo.upstream` and the GitHub avatar derived from it both name the repo a fork came from. * fix(repos): bound saved-clone probes and prove empty clone completion * fix(repos): keep clone validation host-scoped and locale independent --------- Co-authored-by: Neil <neil@stably.ai> Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>	2026-10-06 13:14:03 -07:00
Neil	8507111d87	Document Apple Git ref recovery retirement condition ... Name the affected Apple Git-154 (2.39.5) build and document when corruption recovery can be retired while retaining current-Git disambiguation. Comments only; lint, formatting, and review pass.	2026-10-06 00:29:44 -07:00
Neilandkino	1de3aa405f	Fix truncated Unicode branch names in base ref search ... Preserve complete branch selectors when Git truncates or disambiguates short names, and keep slash-named local branches separate from remote-tracking refs through worktree creation and reuse. Keep native/SSH namespace boundaries and mixed-version client capability gates intact. Accept Git-valid dotted components and cover collisions with configured and orphan tracking refs. Adapted from @nishino-tsukasa's #19540. Independently reviewed in seven adversarial rounds; 235 focused tests and 77 affected-Apple-Git tests pass, along with typecheck, quality checks, and the desktop build. Correct the inherited file-explorer cache-scan expectation while retaining its exact constant-work bound. Correct the inherited release-parser compatibility assertion to match the pinned test dependency; all 121 cross-version tests pass locally. Fixes #19515 Co-authored-by: kino <nishinotsukasavirgo@gmail.com>	2026-10-05 23:47:01 -07:00
Neil	ca4e239861	Remove low-value test inventories and duplicate fuzz oracles (#25791)	2026-10-05 22:23:48 -07:00
Neil	d5bb69d348	Cut CI time in store, Git contention and readiness tests (#25147) ... * Check store retention boundaries with a faster independent oracle * Replace CI diagnostic sleeps with gated contention and scoped transcript clocks	2026-10-03 23:13:45 -07:00
Aashish Mahato	e5ba5975df	Recover working local forge CLIs behind broken PATH launchers ... Recover a working local forge CLI when an earlier PATH launcher is broken. Bound executable probes and reuse the verified selection for native operations without replaying authentication or user requests. Fixes #22975 Co-authored-by: Aashish <145881415+aashish254@users.noreply.github.com>	2026-10-03 20:45:52 -07:00