* refactor(editor): drop SSH endpoint, path flavor and WSL alias folding from buffer identity
SSH files are keyed by connection target; the guarded save catches a retarget.
\\wsl$ and \\wsl.localhost stay distinct, including for discard holds and the
per-file write lock: main compares WSL writes at write time.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): keep WSL alias folding in discard-hold and write-lock keys
A discard via \\wsl$ must hold autosave of a tab opened via \\wsl.localhost:
the local guarded write is not atomic against git. Buffer identity stays
unfolded; only the hold/lock key folds, on the local Windows client.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Preserve terminal reading position on foreground and reconnect by reusing the existing scroll-preservation option. Adapted from community PR #23401 by Shahar Mor (@shaharmor), with native iOS before/after proof and 38 focused regression tests.
Co-authored-by: Shahar Mor <shaharmor1@gmail.com>
* refactor(terminal): no catalog-less fail-open to the focused runtime in terminal spawn routing
* chore(ratchet): prune the workspace-record read baseline for terminal-worktree-route
* test(terminal): pin that a state with no owner catalogs never spawns on the focused runtime
Wait for the source drawer to finish closing before opening the create surface. Preserve task, project, Linear, and Jira selections through the handoff.
Closes#17558.
Adapted from #13147.
Co-authored-by: Jian Zhou <16776397+ZhouJian26@users.noreply.github.com>
Retire queued continuation echoes when transcript rows represent the sends. Preserve literal backslashes, occurrence boundaries, and image barriers on mobile and desktop.
Closes#15288.
Adapted from #15283.
Co-authored-by: grboy6770 <2000grboy@gmail.com>
Preserve Cursor identity across imported Claude hooks and mobile terminal tabs while retaining current tab status, rename, and scroll behavior.
Closes#30543.
Adapted from #30544.
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
* refactor(editor): one running + one queued save per tab, settle instead of cancel
Saves now run one at a time per tab with at most one queued save behind
them; later requests join the queued save, which reads the latest text
when it runs and writes nothing if the tab is already clean. Writes to
one physical file (edit tab, unstaged diff, combined-diff section) share
one lock. Quiesce no longer cancels saves: it flushes pending text, drops
the autosave timer and waits for the running and queued saves. Autosave
and restart write through the first view whose owner is still current.
Removes save generations, bumpSaveGeneration, the exported
clearAutoSaveTimer, the model-URI queue key and the unbounded save chain.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): Don't Save drops edits before draining saves; one lock key
Don't Save now marks the tab clean and clears its draft before waiting
on saves, and a save requested while the tab was dirty writes nothing
if the tab is clean when it reaches the write (Overwrite excepted). A
queued or not-yet-writing save can no longer put discarded text on disk
or recreate a deleted file. A Cmd+S on an already-clean tab still writes,
so a tab whose file was deleted can still recreate it.
Editor saves and combined-diff section saves share one lock key and
skip the lock when the file's host is unknown.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(editor): type-safe held writes in save queue tests
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): a discard voids every save asked for before it
Don't Save bumps a per-buffer discard epoch alongside clearing the
draft. A save whose epoch is stale writes nothing, Overwrite included,
and skips the pending-edit flush that could republish the discarded
text. Dirty state alone wasn't enough: a notebook's retained cells or a
remote snapshot can re-dirty the tab after the discard.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): stop discarded bytes at the send and hold autosave through Don't Save
A save that passed the discard check could still send discarded content
after a remote host's status/capability round trip or an older host's
compare read. The writer now takes a last-moment check, run just before
the bytes are sent on every path (local, unguarded, guarded, older-host
fallback, retry); a discard in that window aborts the send.
Don't Save's drain no longer flushes pending editor text, and it holds
autosave for the file until the tab is closed, so a view that
republishes the dropped text mid-drain can't schedule a fresh autosave.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Removing a workspace closed its editor tabs and threw away unsaved text
without a word, including with "Don't ask again" on.
Removal confirms now list the files whose unsaved edits the removal
discards: the tabs the purge itself would close (host twins included),
kept only when no view sharing their model or record stays open. Editable
unstaged diff tabs count; delayed rich Markdown, CSV and notebook text is
flushed first.
- Delete Workspace dialog: the list sits with the git-change warnings.
While it is non-empty the dialog no longer starts focus on Delete, and
"Don't ask again" no longer skips the dialog.
- The same list in Remove Project, SSH workspace forget/reconnect-and-
delete, SSH host removal with its workspaces, nested-worktree deletion
(rows matched by path containment under the parent) and project-group
deletion with its contained projects.
- Removals with no dialog whose files stay on disk refuse instead, with
"Save or close N unsaved files in <name> first": folder-workspace
delete (card action, context menu, hovered shortcut, through one shared
helper) and Settings > Remove Project.
Force retries with no list of their own (the failure toast's Force
Delete / Delete Anyway, Space's Force button) re-check at that moment and
refuse the same way. A folder-workspace delete that leaves a same-id
folder on another host closes no tabs, so it is not refused. Removal
confirms touched here render on the security surface.
Removals with no prompt (CLI, automations, paired clients) behave as
before; a follow-up offers their text back.
Known limitation: the list is decided by the tabs a removal closes, not
by paths; a symlink into a deleted folder is not resolved on the host.
Co-authored-by: Claude <noreply@anthropic.com>
* ci: install fish 4 from its GitHub release when the Launchpad PPA is down
* TEMP: skip the fish PPA to prove the GitHub release fallback (revert)
* Revert "TEMP: skip the fish PPA to prove the GitHub release fallback (revert)"
This reverts commit 58ba0c5074.
* ci: install pinned fish directly from its verified release
* ci: isolate standalone fish from runner resources
* feat(settings): the default agent can be set to open as a chat or a CLI
With Chat UI on, Settings > Agents > Default Agent now shows a Chat | CLI
choice for the selected agent. It writes the same per-agent chat switch
that Chat > Providers and the + menu already use, so no new setting is
saved and the two places can't disagree.
* test: type the store stand-in without an assertion
* chore: drop accidental lockfile churn
* fix: clarify default agent launch preference scope
* refactor(renderer): name the owner adapters for what they do: resolveOwnerOrLocal, runtimeEnvironmentIdOrLocalUnlessTwin
The Active Server focus fallback they were named for is gone (#31058, #31119); what is left reads an
id no row places as this app's (a folder's saved-session server, a web client's only server).
* docs(renderer): resolveOwnerOrLocal keeps a named host's miss; baseline note names the setup-terminal read
orcad-browser-provider and the pinned runtime materializer each kept a private
errorMessage; the WSL holder record and the secret-key record kept private
error-code checks, and the secret-key record its own kill(0) liveness check.
They now call errorMessage, hasErrorCode and isProcessAlive.
Comments and one log line still said a host falls back to the relay, keeps
the pinned-relay ladder, or shares code with the relay's spawn and install
paths. No relay client exists; an unserved host fails its connect with a
reason, and the legacy bridge only keeps old relay terminals alive.
The SFTP/exec-stdin transfer helpers, their options type and the install
timeout still carried relay names from before orcad; they install the orcad
bundle and the Node runtime. The timeout's derivation from the relay's
native-deps budget is replaced by its value and the reason for it.
Dispatch the leading terminal scroll immediately and coalesce subsequent movement behind the outstanding request. Preserve queue expiry, limits and ordering.
Closes#30299.
Adapted from #30311.
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
Paint the fractional terminal area from the last visible row background. Preserve terminal theme, scrolling and row-color behavior.
Closes#23507.
Adapted from #23508.
Co-authored-by: Wooseong Kim <innocarpe@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Preview HTML files by default across file-opening flows
* Centralize workspace file opening and HTML preview routing
- Preserve source, diff, and host-safety behavior across all entry points
- Reuse previews within the requested editor group and support branch HTML files
* Respect working tree state when opening HTML previews
* Route HTML links through owning workspaces and editors
* Preserve HTML preview state and refresh changed local files
* Resolve HTML preview hosts from workspace ownership
* Update file-opening tests for HTML preview routing
Four twin checks (sort stamps, sidebar unread, sort-order notify, worktree-meta owner)
each rebuilt new Set(repos.filter(id).map(getRepoExecutionHostId)). Name it once as
getRepoRegistrationHostIds in shared/repo-host-identity.
* fix(ssh): name what refuses an SSH host's move, and offer Move anyway in the terminal pane
The refusal line said only "something on the host stops the move" and hid main's
reason (which already names the blocker and the way out) behind a Details menu,
and the terminal pane banner dropped it entirely. The line now shows that reason,
capped inline with the whole text behind Details, and the pane offers Move anyway
for a refusal saved state alone causes.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(ssh): keep a refusal's way out in the pane, and don't race a connect in flight
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Seven runtime decisions read repo.connectionId, so a row naming its SSH host only as
executionHostId 'ssh:<target>' read as local: the missing-worktree sweep killed local PTYs
unfenced, the drift probe ran local git on a remote path, relay recovery skipped its mobile
tabs, and agent launch picked this machine's platform. Route them through
getRepoRoutingConnectionId, drop a dead includeLocalRegistry branch, and shrink the
repo-host-read ratchet from 91 to 81. resolveRepoForConnection keeps the raw read: it
matches the raw id a client sends.
getStoredRepoSshConnectionId and seven inline
getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo)) spellings answered the same
question. Name it once in shared (getRepoDialableSshTargetId), build
getRepoRoutingConnectionId on it, and drop the getRepoHostedReviewExecutionHostId re-export
alias in favour of a direct import of getStoredRepoExecutionHostId.
flushDurableStateOrThrowAsync and six exported types (AgentSessionSpawnTokenScanEvidence,
FreshExplicitAgentStatus, LiveTerminalPty, RemoteStartReceipt, WorkerStartMode(Reason),
WorktreeTeardownStopPty) had no reader anywhere in src, mobile, config or tests.
Five modules each declared the same all-null census for a daemon that could
not answer; they now use one frozen constant from the shared census module.
Removes the relay ladder's answered-failure predicate, the unused test-probe
joins, two dead renderer broadcast helpers, the bound-port reader the tunnel
no longer uses, the WSL terminal-verdict mapper the supervisor never called,
and an unused type.
The window stamps it (equal to ORCA_WORKTREE_ID) for every workspace kind and agent
wrappers forward it; terminals started from the phone, the CLI or a server's own create
in a git worktree lacked it.
* fix(editor): remote models are keyed by an owner authority, so TSX parses and imports stay on one host
Remote editor models were keyed `file:///path#<owner>`. Monaco's TypeScript service names files by
URI, so the fragment hid the `.tsx` extension and imports resolved across hosts. They are now
`vscode-remote://<owner hash>/<host path>`: the file name stays last, and TypeScript treats
`scheme://authority/` as a root, so `..` can't climb into another owner's tree or into local
`file:` models. Monaco keeps closed-file undo for this scheme, and its default label service shows
the URI path, so peek, references and snippet variables show the host's path with no override.
Local models keep their `file:` URIs. A UNC server moves into the path.
A parity test proves exactly the same tab pairs share a model as before; model URIs stay in memory.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(editor): key remote UNC models so the TypeScript worker finds them
A remote UNC file was keyed `vscode-remote://<owner>//server/share/a.ts`. TypeScript collapses the
doubled slash, but the worker looks models up by exact URI, so hover and definitions failed. UNC
paths now mark the owner authority (`<owner>-unc`) and keep `/server/share/a.ts` as the path, which
stays distinct from the same POSIX path. Test-only Monaco module types move out of env.d.ts.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(orcad): hold terminal admission from a stop's start until exit; fence rollback and restart counts
Once orcad begins any stop (signal, managed stop request, idle exit), its terminal
admission stays closed until the process exits, past an update census's 60s fence
or a deferring desktop's reopen. Rollback and restart now take their count through
the same fenced recount the update uses, reopen admission when they leave the
server serving, and stop nothing once that count may have outlived its fence.
* fix(orcad): check the rollback's stop deadline after its transaction write
* fix(orcad): rollback and restart recount under the host lock; a reopen never wakes a server
Only the lock holder closes or reopens a server's terminal admission, so a
rollback or restart that loses the lock can no longer clear another update's
fence. A reopen skips the serving check, so it never starts or recovers a
stopped server, and a stop that begins before the runtime binds still holds.
* fix(orcad): reopen admission when a rollback's stop was withdrawn
* fix(orcad): keep admission closed after a stop that may still be on its way
* refactor(orcad): route update, rollback and restart through one fenced stop
runFencedStop is the single count, close, stop, reopen-on-abort sequence. The
update's activation, the rollback and the restart each supply only their own
refusal, journal step and stop; the reopen and deadline rules live in one place.
* fix(session-search): Project search works for projects with hundreds of worktrees
A Project-scope search showed "The search index is not ready yet" on a fully
indexed computer when the project had ~500 or more worktree paths outside a
shared workspace folder. Each scope path added an OR arm to the session filter,
and past ~495 arms SQLite refuses the statement ("Expression tree is too large
(maximum depth 1000)"); the desktop then reported the thrown search as not-ready.
The scope ranges now travel as one JSON parameter read through json_each, so the
statement has the same shape for any number of paths and each path is still a
seek on sessions_cwd_key. A failed search is also logged before it is reported
as not-ready.
* refactor(session-search): one scope subquery with one parameter; keep lone-surrogate scopes matching
One json_each join with the exact-or-range ON plans as a MULTI-INDEX OR seek,
so the UNION ALL and second bound copy go. Scope keys are made well-formed
before JSON, since a bound key stores a lone surrogate as U+FFFD and JSON
would decode it to other bytes. The plan test now also catches a scan of the
aliased inner table.
* fix(mobile): warn about unwakeable agents on a windowless server only when the workspace really has slept agents
A running ('live') or quit agent's resume record made a windowless server tell the phone
'Open Orca on the host to wake sleeping agents.' Count only real sleep records, using the
shared isPaneSleepRecord predicate.
* refactor: move the headless wake check into a shared hasSleptAgentToWake predicate
* docs: say a live or quit record is resumed by its own pane
* test: build the headless wake report store from the shared partitioned fixture, without casts
* test: make a host-less session read miss the record, so the SSH partition test proves the named-host read
* Mobile chat composer uses desktop's placeholder
The phone composer said "Message Codex" (or "Message, @files, /commands") while desktop says "Ask anything, @ to mention files, / for commands". Both now read the one string from the shared native-chat copy table, so they can't drift again.
* Ship the shared composer placeholder in the runtime English catalog
* Keep the composer placeholder beside, not inside, the turn-status copy
The turn-status table maps one-to-one onto the status.* catalog keys; the placeholder is composer.placeholder, so it gets its own constant and its own catalog check.
* Read the composer catalog without a type assertion
* Read the composer placeholder from the typed catalog directly
* feat(native-chat): a Codex chat shows the turns made outside it
When a Codex chat's agent opens its conversation, Orca reads Codex's own saved
turns and adds the ones the chat doesn't have, after the chat's rows, behind a
quiet "Continued outside this chat." divider. Turns are matched by Codex's own
turn ids, read whole before anything is written, and never re-imported; a chat
imported from a transcript gets only turns started after the import. A failed
or partial read adds nothing and the next open tries again.
* chore: remove accidental package manager lockfile churn
* test(codex): expect restored turns with optional timestamps
* test(codex): run catch-up SQLite fixtures under Node
* Make Codex history catch-up atomic and preserve adoption origin
* Keep imported Codex history separate from send delivery
* Derive Codex history reconciliation from saved journal facts
* Validate saved Codex turn identity before planning its notice
* Align Codex catch-up fixtures with current journal contracts
* Check oversized item echo declarations by their saved identity
* test: retain Codex catch-up flow and concrete regressions
The card rebuilt its Linear source context on every workspace write, and both
card Linear effects listed that object as a dependency, so a comment, agent
status or activity update re-ran them and refetched the issue whenever the 60s
cache had expired. Hold the context while it is equal to the rebuilt one.
Tracked in STA-10988. Same approach as community PR #30090.
* feat(agents): Create worktree and continuation pickers offer chat or CLI per agent, like the "+" menu
The Create worktree, Create folder and session-continuation agent pickers now
list the same rows as the tab bar "+" menu: chat agents first, each with a
terminal button that picks the agent's CLI instead, then the agents that only
run in a terminal, labelled "(CLI)". A terminal pick shows as "Claude (CLI)"
and starts the agent in a terminal even when chats are the default.
A continuation into a subfolder shows chat as unavailable there.
* fix(agents): picker rows keep the combobox item spacing instead of restyling CommandItem
* chore: drop accidental lockfile churn
* fix(agents): type the surface picker's props and the composer's agent rows
* fix(agents): submit the picker selection captured by each form
* test(agents): include repository identity in continuation fixture
* fix(agents): settle inventory when workspace ownership is unresolved
* test: hydrate workspace owners in quick launch fixtures
Neil
Brennan Benson
Jinjing
Jinwoo Hong
Kelvin Amoaba
