* fix(shortcuts): Cmd+C no longer pastes on remapped Latin keyboard layouts
On macOS the main-process paste intercept matched `code === 'KeyV'` OR
`key === 'v'`, so on Turkish F (where the C letter sits on the physical
KeyV) Cmd+C was routed to ui:appMenuPaste. Trust the produced key when it
is a Latin letter or digit and only fall back to the physical code for
non-Latin layouts (Cyrillic etc.), matching the shared keybinding matcher.
Fixes#29574
Claude-Session: https://claude.ai/code/session_01TYbS9P1pnW4WRN7bGpuNaW
* test(shortcuts): cover Dvorak, Korean and IME composition for the macOS paste intercept
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(shortcuts): match the macOS paste intercept by produced key token, in its own module
The produced key token wins on every Latin layout, punctuation included (BEPO puts . on KeyV); non-Latin and IME keys fall back to the physical key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: İzzetEmre <emreizzet@hotmail.com>
Co-authored-by: Jinwoo-H <jinwoo0825@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test(sidebar): the desktop window and a feed reader draw the same list (dark)
* fix(sidebar): a feed reader lists a paired server's folders and nested workspaces as the window does (dark)
* fix(sidebar): the paired-server shadow compares the lineage the server's check keeps (dark)
* fix(sidebar): paired-server rows carry the unread flag Smart Done reads (dark)
* Settle Codex review turns from their session completion
* Preserve interruption relay metadata when settling Codex reviews
* Keep the Codex turn id across status writers and settle through the existing host verdict path
The turn id that matches a rollout turn end was dropped by every lead writer
that did not pass it, so a failed turn after a child update never settled.
Drop the synthetic Stop label: the unlabelled poll update already carries the
host's main-agent verdict, including a failure, to current desktops. A remote
desktop now takes the host's settled verdict for a late hook, and a rollout
settle retires hook-only children like Stop does.
* Retire Codex children through the poll and start a fresh turn on any non-compaction session start
A rollout-settled turn deleted the child roster, so the local reconcile
re-seeded the child from the last row as running and the pane stayed Working.
Clear it instead, only from the poll (a child hook settling the root must not
drop that live child), and let a remote desktop clear its roster when the host
reports a done turn with no children. A resumed or forked session no longer
inherits the previous turn id. Also drops accidental pnpm-lock churn.
* Replay a Codex rollout turn end as the root Stop it stands in for
Codex fires no Stop for internal subagents such as /review, so the rollout's
task_complete was settling the main agent through a second path that every
other status writer (local and remote reconcile, child hooks, polls) had to
learn about. The transcript poll now replays that end as an ordinary root Stop
through hook normalization, and a root hook for an already ended turn is
classified as that Stop. A failed end carries its failure outcome and is
published unlabelled like a cancellation, since desktops derive a labelled
Stop's outcome as success. The separate settle path, the remote host-verdict
adoption and the child-hook rollout reads are gone.
* Keep an ended Codex turn retired across compaction, and keep WSL polls alive
A compaction SessionStart queued before the next prompt carried the previous,
already ended turn id, so the poll replayed its Stop: a Done flash and a
second "finished" notification. A compaction now keeps the turn only while
it is still running and its rollout end is unrecorded. The WSL guest
rescheduled its transcript poll with the update instead of the stored row,
so the poll stopped after its first update and a later turn end never
replayed there. A Stop also clears the child roster instead of deleting it,
so a reconcile cannot re-seed retired children from the previous row.
* Restate an ended Codex turn's hook in provider dispatch
Keeps the shared hook normalizer within its size limit after main's merge;
the Codex dispatch returns the event it normalized, which the envelope uses
for the published name and prompt classification.
* Type the rollout record helper in the Codex turn-end test
* Accept Codex's turn_complete name and keep only replayed Stops labelled
The rollout reader also records turn_complete, the name the existing
interruption reader already accepts. A poll row that is not a replay no
longer restates the last hook's event name, so only a replayed Stop can
carry the Stop label.
* Drop a delayed Codex hook for an ended turn the lead has moved past
A late root hook for an older finished turn was restated as Stop and marked
the newer running turn Done; passing it through would instead rewind the
lead's turn id so the poll replays the old end.
* feat(sidebar): Smart Done means finished and unread (dark)
Owner decision Q1: with ORCA_SIDEBAR_INPUTS=main, a Done row holds its tier only
while the workspace unread flag is set, so opening the workspace or sending the
next prompt ends it. Reuses the existing flag; no new state or timer.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): reading a workspace drops its Done row in the live list
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(macos): the TCC prompt watcher's log stream dies with Orca
log stream only writes when its predicate matches (about never), so it never
gets SIGPIPE when Orca dies without running stop() (crash, SIGKILL, e2e
teardown, force-quit dev builds) and lived on under launchd. One dev machine had
126 orphans holding 566 MB and ~40% CPU. A /bin/sh wrapper now holds a
never-written stdin pipe from Orca and kills log stream on EOF.
* fix(macos): reclaim TCC log streams that older builds orphaned
The wrapper stops new leaks, but users upgrading still have every log stream an
earlier crash or force-quit left under launchd. Ten seconds after launch, once
per process, Orca terminates launchd-parented processes running exactly the
watcher's old command line. A live watcher's log stream is parented by its
wrapper, so it never matches.
* test(macos): document the fake log stream cast
* fix(macos): arm log stream wrapper trap before fork; verify orphan executable
* fix(macos): re-read orphan identity before SIGTERM; disable inherited errexit in wrapper
* fix(layout): a workspace only main held shows main's tab on the window's first visit (dark, layout-owner build only)
* fix(layout): a live terminal no pane shows goes through main, which names the tab it holds; a pane close main has no pane for closes here (dark, layout-owner build only)
* test: no type assertions in the CLI-first tests
* refactor: the switch-off build keeps today's live-terminal mint as it was
* review: frame sync under the line limit; the first-visit test names exactly main's tabs
* fix(layout): adopt takes the recorded pane only while it is unbound
* fix(layout): a refused live-terminal adoption is declined, not counted as shown
* refactor(native-chat): move the slash picker builder and upload chunking to shared
Mobile builds the same skill and command list as desktop.
* feat(mobile): redesign the chat composer with file attachments and inline skills
* fix(mobile): the composer field owns its input style
The page's font-size census cannot follow a style passed in as a prop.
* refactor(sidebar): the stamp-sorted window list runs no settle, latch or saved order (dark)
With ORCA_SIDEBAR_INPUTS=main the window's sort hook is a pure read of the
rows' stamps: no settled-epoch store listener, no Smart latch, no saved Smart
order writes, no class telemetry over the old attention map. Switch off: the
existing hook, unchanged.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): stamp sort hook reads no live sources; stronger switch-on tests
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): clear the order-save mock between tests
Co-Authored-By: Claude <noreply@anthropic.com>
* wip: main keeps sleeping retention only
* fix(sidebar): stamp sort reads a shared empty-sources constant, not a renderer layout literal
The layout-writer ratchet counts layout field keys written in the renderer;
the empty sources object now lives beside SmartSortSources in shared code.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(sidebar): main keeps sleeping retention only; no order of its own (dark)
Clients sort by the owning host's stamps, so main's temporal owner loses its
settle window, Smart latch, create grace and catalog-listing classifier, and
the shadow check stops comparing order. Retention, its clock and its shadow
comparison stay.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(sidebar): every retention listing shares one sequence; publish after the first
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): the first listing bumps the retention revision
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* refactor(sidebar): the stamp-sorted window list runs no settle, latch or saved order (dark)
With ORCA_SIDEBAR_INPUTS=main the window's sort hook is a pure read of the
rows' stamps: no settled-epoch store listener, no Smart latch, no saved Smart
order writes, no class telemetry over the old attention map. Switch off: the
existing hook, unchanged.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): stamp sort hook reads no live sources; stronger switch-on tests
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): clear the order-save mock between tests
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(sidebar): stamp sort reads a shared empty-sources constant, not a renderer layout literal
The layout-writer ratchet counts layout field keys written in the renderer;
the empty sources object now lives beside SmartSortSources in shared code.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(terminal): a file dropped on a pane makes that pane active
Dropping a file on an inactive pane's title strip pasted the path but left the
other pane selected, because the drop only focused the terminal. Activate the
pane instead (which also focuses it). Tracked in STA-9893.
* test(e2e): give the title-strip drop the source owner real drags carry
* test(e2e): preserve pane selection when checking title-strip drops
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
* fix(cleanup): count visits as last activity once terminals stop stamping Recent (dark)
With ORCA_SIDEBAR_INPUTS=main, terminal start and exit no longer write
lastActivityAt, so a workspace used only through plain shells could look idle
to workspace cleanup and old in the jump palette. Both now read the later of
the Recent stamp and the last visit. Switch off: unchanged.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(cleanup): stamp the workspace you leave; space table reads visits too (dark)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(cleanup): every reveal stamps the workspace you leave, host-aware (dark)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Two merged changes left lines past the formatter's 100-column width in
structured-session-create-support.ts, structured-agent-session-create-adoption.ts
and transcript-opencode-sqlite-query.ts. Any branch that merges main gets them
reformatted by the pre-commit hook, which pushes two of them past the 300-line
limit and fails CI. Format them, and keep them under the limit by moving the
bounded row readers and the resume adopt payload into the modules that own them.
No behavior change.
* feat(sidebar): sort stamps reconcile stored tiers at startup against live hook rows and terminals (dark)
* test(sidebar): a restart clears an unbacked local tier and keeps an SSH host's
* fix(sidebar): run the sort tier reconcile once hook rows and PTYs settle, seeding hydrated rows
* fix(sidebar): clear a stored tier only on proof its terminals died; a rest seed adds no clear
* chore(sidebar): merge origin/main; locality helper moved to shared
* feat(sidebar): sort Recent and Smart by host stamps behind the sidebar-inputs switch
With ORCA_SIDEBAR_INPUTS=main, the window, main and the phone order Recent by
lastActivityAt and Smart by smartTier then smartAt (Needs you, Done, Working,
then the rest by Recent). The window holds its displayed order while the
pointer is over the list or a drag runs. Switch off: today's sort path.
Co-Authored-By: Claude <noreply@anthropic.com>
* chore: restore files the merge commit's formatter rewrote
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(sidebar): stamp-order review fixes behind the sidebar-inputs switch
The window writes no Recent stamps with the switch on (terminal start and
exit, unread marks, comment edits), the hover hold covers only Recent and
Smart and ends with a drag, main follows only explicit metadata saves, and
the phone picks its sort from the unfiltered rows.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): folder writers and a Manual drag under the stamp switch
Co-Authored-By: Claude <noreply@anthropic.com>
* test(sidebar): name the stamp type in the ps summaries test
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Require a full hover delay before each tab preview
Tab previews opened almost immediately after a previous preview had been shown, so sweeping across the tab strip caused a flurry of popups. Raise the tab tooltip delay to 800 ms and drop the warm-start chain: the shared open-state context, the 300 ms skip delay, and the slide animation that carried position between cards. Every tab now waits its full dwell time, and keyboard focus still shows the preview immediately.
* Test that tab hover cards wait a full dwell on every hover
The tab hover card no longer slides instantly between neighboring tabs. Each hover now waits for the full delay before showing a preview. The e2e test still expected instant sliding, so it was rewritten to match.
- Remove the frame-recording helpers and the slide and reversal assertions.
- Check that no card appears before the dwell, and that the card appears after it.
- Check that leaving a tab cancels a pending preview, and that time spent on other tabs does not count toward the dwell.
- Check that re-entering the same tab requires a fresh dwell.
* chore(layout): the drift check's ignore comment names every main-only kind (dark, layout-owner build only)
* fix(layout): a quit stage retried after a failed one still sends the resume records (dark, layout-owner build only)
* feat(layout): the window's local layout stream reopens after a loss, and its snapshot redraws every workspace (dark, layout-owner build only)
* fix(layout): a command whose target main's copy lacks is a logged refusal, not the window's own change (dark, layout-owner build only)
* feat(layout): frames keep each tab the window drew, closed or moved as drawn until main answers; the global frame hold goes (dark, layout-owner build only)
A refused draw-first terminal create is closed (its terminal stopped) at the refusal. The
activation create no longer draws main's tab itself while the stream is down: the reopened
stream's snapshot does.
* fix(layout): a tab move or drag-out the frame already drew is not placed again by the window (dark, layout-owner build only)
Also holds the group sizes the window drew until main saves them.
* test(layout): with frames flowing, a pin promotes a preview tab once and tab-change bookkeeping runs once (dark, layout-owner build only)
Also states that the held-tab overlay builds frame slices only.
* test(layout): read the rename's title without a cast
* chore(layout): the drift check's header lists the same ignored records as its inline comment
A due update check makes agy start --bg-updater, whose own console child opens
a visible window on Windows and takes focus, so stepping away from Orca for
15+ minutes and coming back flashed a terminal (#27390). Set
AGY_CLI_DISABLE_AUTO_UPDATE=true on both probes; a background quota read should
not update the user's CLI anyway. Only 'true' is honoured (agy 1.4.2).
Co-authored-by: Orca Worker <orca-worker@localhost>
* fix(mobile): put the session tabs in the top bar on a landscape phone
A sideways phone is about 390pt tall and the session header spent two rows
on it. On a landscape phone the tab strip now shares the top bar with the
back button, title and panel icons. Portrait and tablet layouts are unchanged.
* fix(mobile): give session tabs side borders and a filled active tab
In the landscape top bar the tabs sat between the title and the panel
icons with nothing marking where one tab ended. Each tab now has a 1pt
border on its sides, running the full height of the bar, and the active
tab gets the raised fill, as the desktop tab strip draws them. The same
strip is used in portrait, so both orientations match.
* fix(mobile): reset tab strip measurements on view attachment
* style(mobile): format tab strip ref dependencies
* fix(mobile): keep two header rows in landscape windows too narrow for top-bar tabs
A short, narrow window (a ~390x350 web window) is wider than tall, so it
counted as a landscape phone and moved the tabs into a top bar that has no
width left for them. Top-bar tabs now also need at least 568pt of width,
the narrowest landscape phone.
* fix(mobile): give the landscape top-bar tab strip a fixed left edge so scrolled tabs never read as part of the title
* fix(mobile): 12pt between the session title and the landscape tab strip
* feat(settings): remove a downloaded agent runtime from its Settings row
When the host offers managed-runtime.remove.v1 and an Orca-installed copy is
there with nothing running, the Settings install row shows a trash button
("Remove downloaded runtime") that asks first: "Remove {agent} from this
host? Running {agent} chats stop. Chat history is kept." While the host removes
it the row says "Removing…"; a refused removal shows the host's reason and keeps
the button. Chats never show it.
* fix(settings): offer Remove for a damaged copy too, and say which host the downloaded runtime leaves
The row offers Remove whenever the host says Orca's copy is there (canRemove), damaged included;
an older host without it keeps today's rule. The confirmation now reads "Remove the downloaded
{agent} runtime from {host}? Running {agent} chats there stop. Chat history is kept.", naming the
paired host, or this computer.
* fix(settings): Remove follows the host's canRemove alone
* fix(settings): the Remove dialog says the sign-in is kept too
* fix(settings): show the downloaded runtime's install state as the provider's status line
The Antigravity row in Settings > Chat > Providers drew its install state as a
bordered box nested inside the row. It now reads like the other rows: one grey
status line under the name, with its actions as inline links joined by ' · '
(Installed · Remove, Not installed · Install · size, a thin progress bar with
Cancel while downloading, Reinstall · Remove for a damaged copy, Try again
after a failure). A healthy install no longer offers Reinstall. The Remove
confirmation now says running chats stop and their history is kept.
* fix(settings): make Antigravity's first Install a primary button beside the switch
Not installed now shows a high-contrast Install button at the row's right end in
Settings > Chat > Providers and Settings > AI Provider Accounts > Antigravity; the
status line keeps the sentences (Not installed · 112 MB download.). Every other
action stays a link in the line.
Orca started jcode's background server itself as a terminal opened, ahead of
the jcode client. On daemon-backed terminals that launch had no PATH and
silently failed; where it did start, the server ran jcode's tools and hooks
outside the shell's environment, without the client's launch flags, and
outside jcode's own startup lock. jcode's client already waits for its server
to signal ready, so it is now the only thing that starts it.
* chore(layout): the drift check's ignore comment names every main-only kind (dark, layout-owner build only)
* fix(layout): a quit stage retried after a failed one still sends the resume records (dark, layout-owner build only)
* feat(layout): the window's local layout stream reopens after a loss, and its snapshot redraws every workspace (dark, layout-owner build only)
Removes the re-export lines in worktree-logic, worktree-base-directory-poller, filesystem-watcher and
runtime-environment-transport-routing. Test mocks that supplied a re-exported name now mock the
module that defines it, so they still reach the code under test.
Removes the re-export lines in 22 src/main/runtime modules (rpc schemas, skill surface, worker
identity, terminal viewport, teardown, git, e2ee crypto and more); importers and test mocks name
the real modules.
Removes the re-export lines in runtime-rpc-result (hasRuntimeRpcErrorCode), sync-runtime-graph,
sync-key, the terminal orphan-recovery modules, orcad-idle-exit, remote-runtime-subscription-transport,
two orcad modules and the ssh-connection test harness; importers and test mocks name the real modules.
Deletes local-agent-install-dir-detection, notification-burst-cooldown, terminal-git-credential-guard
and tui-agent-detection-commands (pure re-export modules) and the re-export lines in seven more
ipc modules; importers and test mocks name the real modules.
orcad-state-*, orcad-windows-host-* and orcad-machine-* leave src/main/ssh. git mv plus import and
path-literal rewrites, including the Windows host lane's test path in its workflow and PowerShell
runner.
orcad-managed-*, orcad-runtime-*, orcad-stdio-bridge-*, orcad-decommission-* and orcad-rollback-*
leave src/main/ssh. git mv plus import and path-literal rewrites; two e2e route regexes learn the
new folder. orcad-runtime-maintenance stays for now because open #29834 edits it.
orcad-remote-*, remote-install-*, remote-node-runtime-store-*, remote-versioned-install and
remote-deploy-timing leave src/main/ssh. git mv plus import and path-literal rewrites; one e2e route
regex learns the new folder. orcad-remote-deploy and orcad-remote-node-runtime-report stay for now
because open PRs #29834 and #29829 edit them.
* fix(mobile): break the transport and terminal-document import cycles and gate them after mobile's install
client-context re-exported the host-client hooks, which import client-context back: the re-export
barrel is gone and importers (and their test mocks) name host-client-hooks directly. In the terminal
document, the cell-metric getters move to a leaf cell-metrics module and select-mode entry/exit to
selection-mode, so fit, transform, overlay and range no longer import each other. pr.yml lints imports
before mobile's install, when mobile's tsconfig can't load, so Mobile verify now runs the same import
rules over mobile after its install with zero warnings allowed.
* fix(mobile): the browser-pane render harness imports useHostClient from host-client-hooks
Its route source is a template string, so no typecheck saw the removed client-context re-export; the mobile web bundle check did.
* fix(ci): the e2e typecheck ratchet counts the same with or without mobile's install
Specs reach mobile/src/transport, whose expo-crypto and async-storage imports resolve only after mobile's install and then load React Native's globals (numeric timers, a required NODE_ENV), adding errors in unrelated specs. An empty stub pins both, so the static job reads 232 either way.
First slice of the desktop side of managed orcad leaving src/main/ssh. git mv plus import and
path-literal rewrites; host-lane workflow filters and the cross-host prefix list gain the new folder.
Moves legacy-relay-bridge/ plus the relay-only census and endpoint files into ssh/legacy-relay/,
so the 2027-01-15 retirement deletes one folder. Live install, exec and framing modules that only
carried the relay name become remote-*. git mv plus import, path-literal, routing and workflow
path-filter rewrites only; no remote file name or path changes.
* fix(settings): show one coherent status for servers that revoked this computer
* fix(settings): drop the redundant warning icon on revoked server rows
* fix(status-bar): show access revoked / update required for paired servers
A server that revoked this computer's pairing (or refused it as incompatible)
read as a plain "Disconnected" row with a futile Connect action, and the
aggregate segment stayed idle grey. Rows now take the execution-host registry's
blocked verdict: "Access revoked" with a Re-pair… action opening the existing
RuntimeRepairDialog, or "Update required" with the compat detail. A blocked
host turns the aggregate indicator destructive instead of hiding as idle.
* fix(layout): an SSH pane's terminal binds in its own session partition (dark, layout-owner build only)
Main keeps its own layout over a window save, so a binding only a save carries is lost. A window
or runtime spawn of an SSH pane bound in the local partition; it now binds where the pane's layout
lives.
(cherry picked from commit beb2275b45)
* test(layout): the SSH binding test uses the shared spawn commit dependencies
(cherry picked from commit 672b641897)
* fix(layout): main moves a tab between a local and an SSH workspace itself (dark, layout-owner build only)
moveTabToWorkspace across two partitions was refused as other_partition and left to the window's
save. Main now reads both partitions, moves the tabs as within one, and writes both in one durable
mutation.
(cherry picked from commit ee27a0bb07)
* chore(layout): one binding write for the partition choice; shipped builds keep their exact replaced-binding read
* fix(layout): window saves keep main's layout and give it only the window's view and facts (dark, layout-owner build only)
windowViewSaveForMain/windowViewPatchForMain replace windowSaveForMain: main's own layout joined
with the window's view, facts and carried fields, written only into the records that change. A
paired server's partition passes through. A visited workspace main holds keeps its terminal row
(D1). The P10 pending case is on.
(cherry picked from commit 0c2fc15974)
* fix(layout): the save divergence detector becomes a report-only drift check behind its log (dark, layout-owner build only)
It no longer wraps the write: it compares the window's raw save with main's layout model, and
only when ORCA_LAYOUT_SAVE_DIVERGENCE_LOG is set.
(cherry picked from commit 6bc1e5556f)
* fix(layout): tab reconcile and terminal reconnect stop writing tab structure (dark, layout-owner build only)
Main's frames draw the tab bar and rows: reconcile still returns its counts but writes nothing,
and reconnect still advertises restored terminals but leaves the rows to main.
(cherry picked from commit ef8eb625ca)
* fix(layout): a layout command main cannot apply is a logged refusal, not the window's own change (dark, layout-owner build only)
other_partition, a thrown call, and host_not_owned for a workspace that is not a paired server's
are refused and logged: a window save no longer carries the change, so drawing it would last only
until the next frame. A twin main may route to a paired server keeps today's path, as does the
first terminal's host_not_owned fallback.
(cherry picked from commit 2c513b2d10)
* fix(layout): the window's refusal code type keeps main's host refusals
(cherry picked from commit 36d46bdcc2)
* fix(layout): the quit checkpoint records only the quit capture's resume records in main (dark, layout-owner build only)
Main keeps its own resume records over a window save, so the quit capture's changes, which reach
main as async commands, could miss the quit. The capture now sends only what it changed with the
synchronous stage, and main writes them through the record-only sleep command before staging; a
wake main recorded that the window had not seen stays.
(cherry picked from commit 2a0f433c34)
* test(layout): the quit capture test builds a typed resume record
(cherry picked from commit d92d1246ee)
* chore(layout): one layout write per save handler
* chore(layout): shipped builds keep their exact quit capture
* fix(layout): the drift check compares structure only, not records main writes itself (dark, layout-owner build only)
Pane bindings and resume records, default-tab marks, closed-tab records and terminal row owners
are main's own writes; a save that has not caught up with them asks main for nothing, so they are
no longer reported.
(cherry picked from commit 93e8b2627c)
* test(layout): relaunch first-terminal cases, and the side-by-side resume case moves its tab the way the window does
(cherry picked from commit ab381332b1)
* test(layout): the relaunch case also checks a reopen that cleared read-only
(cherry picked from commit bbf3d040c8)
* docs(layout): the drift check names the record kinds it ignores
* revert(layout): drop the SSH binding partition change; SSH terminal starts are refused before any binding is saved
getProvider refuses every non-local host, so neither spawn path reaches persistPtyBinding for an
SSH pane, with the switch on or off.
* test: run A2's two real-SQLite session tests in the Node runtime project
tests/ is typechecked by nothing in CI, so the Windows CLI matrix spec imported a helper that never existed (#30231). Per-file error counts under tests/ (tsc -p config/tsconfig.e2e.json) may now only go down.
Deletes ssh-system-fallback.ts and the re-export lines in ssh-config-parser.ts, ssh-connection.ts,
system-ssh-file-binary-transfer.ts and ssh-remote-powershell.ts; importers name the real modules.
SshConnection tests mock each real module, keeping the parser stub that holds ~/.ssh/config out.
* fix(layout): an SSH pane's terminal binds in its own session partition (dark, layout-owner build only)
Main keeps its own layout over a window save, so a binding only a save carries is lost. A window
or runtime spawn of an SSH pane bound in the local partition; it now binds where the pane's layout
lives.
(cherry picked from commit beb2275b45)
* test(layout): the SSH binding test uses the shared spawn commit dependencies
(cherry picked from commit 672b641897)
* fix(layout): main moves a tab between a local and an SSH workspace itself (dark, layout-owner build only)
moveTabToWorkspace across two partitions was refused as other_partition and left to the window's
save. Main now reads both partitions, moves the tabs as within one, and writes both in one durable
mutation.
(cherry picked from commit ee27a0bb07)
* chore(layout): one binding write for the partition choice; shipped builds keep their exact replaced-binding read
* revert(layout): drop the SSH binding partition change; SSH terminal starts are refused before any binding is saved
getProvider refuses every non-local host, so neither spawn path reaches persistPtyBinding for an
SSH pane, with the switch on or off.
Retain reveal sequence coverage until a parsed snapshot covers it, preventing a duplicate text-only replay from clearing newer terminal images. Keep conservative fallback recovery for unknown episodes, missing metadata and different terminal processes.
Verified against current main: 406 tests, full application typecheck, changed-code quality and four fresh hidden rendered restore checks pass. No xterm patches or dependency changes.
Removes the re-export lines in relay-region-preference, relay-session-broker,
browser-host-page-placement and browser-host-page-reconciliation-plan (no barrels).
* fix(runtime): show Re-pair required for revoked servers and re-pair in place
A server that revokes this computer's pairing token was labeled "Update
required" because auth refusals and protocol mismatches shared one blocked
state. Carry the blocked reason locally, label revoked hosts "Re-pair
required", and add a Re-pair action (sidebar host menu + Settings server
row) that verifies a new pairing link reaches the same server before
replacing the saved pairing.
* fix(sidebar): stop host header menu clicks from toggling or dragging the row
* fix(sidebar): vertically center host header label and menu button
Jinwoo Hong
Brennan Benson
Neil
Kelvin Amoaba
Jinjing
OrcaWinandOrca Worker