* perf(i18n): cache option-free translations per language and resource version
A workspace switch re-renders chrome that resolves hundreds of static strings
through i18next (~3 ms per switch). Option-free lookups only change with the
language or the loaded resources, so cache them keyed on both.
* perf(file-search): skip file search state writes that change nothing
Every workspace switch cancels the outgoing workspace's idle search, which wrote
an identical state object and re-notified every store subscriber.
* perf(sidebar): keep unchanged worktree cards and project headers memoized across switches
A plain press replaces the sidebar selection, and the selection-keyed gesture
callbacks plus the shared selectedWorktrees array were passed to every card, so
every card and its menus re-rendered on each workspace switch. Gesture callbacks
now read the latest selection from a ref, only selected rows receive the
selection, and project header actions are memoized.
* test(terminal): bound toast translations from above now that static strings are cached
* perf(terminal): stop re-rendering hidden panes and retained tab strips on workspace switches
Hidden panes re-measured their title-overlay rects on every switch, forcing a
layout and clearing the rects, which re-rendered the pane once on hide and again
on show. Hidden overlays are display:none, so they keep their last rects until
shown. Retained tab strips subscribed to the active repo and worktree for a
Windows-only shell menu, re-rendering every strip; those reads are gated like
the project maps beside them.
* perf(app-shell): let root overlays skip the App render a workspace switch causes
App re-renders on every switch (its chrome layout tracks the active worktree),
and it handed fresh floating-workspace and onboarding objects to the root
overlays, re-rendering every overlay and dialog. Both objects are memoized,
AppRootSurfaces and the floating toggle button are memo components, and the
toggle callback is stable.
* perf(worktrees): switch the active repo and worktree in one store write
Activating a worktree in another project wrote activeRepoId and then the
active worktree separately, so every store subscriber re-ran its selector twice
(~1 ms per switch). The repo change now rides along as a state transition of the
same setActiveWorktree write, as the SSH server-copy activation already does.
* perf(app-shell): stop App re-rendering on workspace switches
App subscribed to the raw active worktree and tab ids through the chrome layout
and three sync hooks, so every switch re-rendered the whole app shell. The
layout now exposes booleans, shortcut dispatch and the titlebar expand button
read the active ids when they fire, and the git-status polling, web session tab
sync and review refresh reporting hooks run in a null gate component under
AppBackgroundServices.
* perf(worktrees): fold visit recency and nav history into the activation write
A switch wrote the active worktree, then the leave/enter recency stamps and the
nav-history entry as separate store writes, each re-running every subscriber's
selector. The stamps (resolved against the post-activation selection, as
markVisited did) and the history entry now ride in the same setActiveWorktree
state transition as the repo follow.
* perf(terminal): present instead of clearing the shared glyph atlas on worktree reveal
The settled reveal reset predates xterm's per-renderer page-layout versioning
(renderers now rebuild their model when a shared atlas page changes), so a
healthy atlas no longer needs re-rasterizing on every worktree switch. DPR
repair and system wake keep the full reset.
* fix(worktrees): keep fresh visit stamps when the activation's history entry is de-duplicated
* fix(app-shell): repaint memoized shell controls on a language change
* test(floating-terminal): stub the language subscription in the toggle button's hook harness
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* feat(files): save a remote text file larger than one request
The editor opened files up to 50 MB from a WSL host or SSH server but refused to save anything
over 720 KB. A staged save sends the content in chunks to a temp the host makes beside the
target, and the commit replaces the target by rename under the same locks and disk
precondition as files.writeIfUnchanged. Bounded per save, connection and host; idle saves are
dropped; a journal lets host start remove temps a crash left. Older hosts keep the refusal.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(files): stage large remote saves privately and commit them with the one-request save
Review of #35073: chunks now go to the profile's private staging folder, the commit
re-authorizes the target and writes it in place through writeLocalTextFileWithDiskPrecondition
(same locks, precondition and inode as a one-request save), ops on a save run one at a time so
an abort or commit never races an append, a closed socket's saves are aborted, and host start
clears the staging folder in the background.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(files): check a staged save's temp size at commit, and stage per process
Review of #35073: the commit refuses a temp whose size on disk isn't the declared total, and each
process stages in its own subfolder; the start sweep removes only its own folder and those whose
owner has exited, so runtimes sharing a profile never wipe each other's saves.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(files): a runtime without staged saves closes a socket cleanly
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat(wsl): stop an idle WSL hook relay so its distro can stop
Once no bridge terminal is left in a distro, the hook relay was the only thing keeping the
distro (and the WSL VM's memory) running, for as long as Orca ran. After 5 minutes with no
bridge terminal and no hook traffic the relay now stops, detached first so recovery never
restarts it, and its config is parked; the next terminal or agent in that distro starts it
again. Nothing new starts a relay, so nothing boots a distro.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl): a WSL terminal of unreported distro keeps every hook relay
Review of #35173: a WSL shell whose spawn reported no distro (an older daemon) still uses the
default distro's relay, so it now counts as presence for every distro rather than none.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(wsl): a hook relay stays while the daemon still runs a bridge session in its distro
Review of #35173: after a relaunch, a hidden worktree's or headless tab's bridge session is live
in the terminal daemon though no pane in this run noted it, and orchestration, automations or
mobile may wake its agent. Before an idle stop the relay now asks the daemon's own session
inventory; a live session there, or an inventory it can't vouch for, keeps the relay.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* perf(sidebar): switch workspaces on mouse press instead of click
A plain primary mouse press on a sidebar workspace row now activates it; the click that
ends the same press is skipped. The ~80-120 ms a press is held before release hides the
switch, so the new workspace is usually painted before the button comes up.
Modified presses, touch and pen, nested controls, rows inside a multi-selection, kanban
cards and keyboard-forwarded clicks keep click activation.
* test(sidebar): drop wall-clock cache stub from press activation test
* fix(sidebar): keep press activation off drags that wake, resume or close the board
A press-activated switch now keeps focus in the new terminal: the press's native mousedown
no longer moves it to the workspace list. Presses fall back to click activation when the
target would be woken (sleeping workspace or agent session, slept VM, disconnected SSH),
outside the terminal view, on selectable text, and while the workspace board is open, so a
row dragged onto the board no longer closes it. The skip-the-next-click flag now ends with
its gesture instead of surviving a drag-suppressed click.
* fix(sidebar): keep press activation off hosts a focus could boot
Switching workspaces focuses the row's host: a stopped WSL distro boots on focus and a recipe
VM resumes on activation, both before a press is known to be a drag. A press now activates only
on a proven-ready host (local, an SSH target, a WSL host reporting ready, a connected paired
runtime), resolved from the row's own host so folder workspaces and host twins match; recipe-VM
targets and unknown hosts keep click activation.
* fix(sidebar): activate on press only for local workspaces
Remote hosts can connect, boot or resume when their workspace gains focus, and the
focus subscribers resolve a workspace by bare id, so a twin or an SSH folder row could
still reach a remote host from a press that becomes a drag. Press activation now needs
the row's own host and the id's owning host to both be local; every SSH, WSL, runtime
and VM workspace keeps click activation.
* fix(sidebar): keep click activation while a text field has focus or a terminal would respawn
* fix(sidebar): keep click activation for workspaces without a running terminal; leave focus to the list when the press moved none
* fix(sidebar): keep a multi-selected folder row's press for the group drag
* fix(sidebar): drop the pre-press focus reference when the gesture ends
* fix(sidebar): keep click activation while a menu or dialog is open
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(browser): retire passkey account requests with their documents
* test(browser): fold passkey document-retirement coverage into the picker suite
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(session): a managed host's old SSH rows no longer replace its runtime workspace on reload
On a desktop that still catalogs a host's pre-managed-server SSH repo, startup
adoption let the old ssh: partition supersede the runtime partition's rows for
the same workspace. Its editor tabs and split were dropped, and stale closed
tabs came back on every reload. Workspaces a runtime partition holds are now
foreign to SSH adoption; the SSH rows stay parked in their own partition.
Moves the SSH partition catalog attribution into its own module unchanged
apart from the runtime-owner check, to stay under the file line limit.
Fixes#34376Fixes#34416
* fix(session): only an SSH host's own server supersedes its old SSH rows
Treating every runtime-held workspace as foreign to SSH adoption broke the
contested gap-fill for unrelated hosts that share a bare workspace id. Limit it
to the managed or SSH-tunnelled server running on that same SSH host, which
startup now learns from the runtime environment list.
A workspaceDir of "~/..." was never expanded, so it resolved relative to
each repo and worktrees were created under <repo>/~. Expand a leading ~
when settings are loaded and on every settings write, and share the
expansion with the floating-workspace path resolver.
Co-authored-by: Neil <neil@stably.ai>
* fix: retire extension frame listeners with their document
* fix: snapshot extension owner before native destruction
* refactor(extensions): keep listener registry within its line budget
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
The legacy Compact card-property migration returned the Compact preset even
when the stored list already was a current Compact preset, so every clean
reload of a Compact profile scheduled a full profile write. Treat both the
raw ['status'] and the normalized ['status', 'unread'] form (persisted by any
UI write) as already migrated.
Fixes#34828
Co-authored-by: Neil <neil@stably.ai>
A background hooks:check refused for a stopped WSL distro now says so (unavailable:
'wsl-distro-stopped'). The setup-script prompt maps it to a distro-stopped state: the card hides
instead of showing 'Couldn't verify…' with a Retry that cannot succeed, and focus re-inspects, so
the card returns once the distro runs. An unverifiable distro stays a retryable error.
* fix(wsl): never boot a terminated distro off a list taken while it was still stopping
WSL keeps listing a distro for a moment while it stops. A bridge pane's exit now marks its distro
as possibly stopped, its host-loss verdict and boot-id reread only count a running list started
after that settles, and deferred background work (file watcher and hook relay restarts, history
cleanup, CLI repair) is drained only by a settled list. Before, a bridge exit's own list could
read 'running' mid-stop and lead to a boot-id exec, and any confirmed list probed mid-stop
drained deferred restarts that spawn wsl.exe, booting the distro the user had just terminated.
* fix(wsl): gate the hook-relay restart and setup-script inspection on a settled running read
- A deferred hook-relay restart re-reads a settled running list right before spawning the relay
(wsl.exe), and waits again if the distro stopped; a drained deferral is only a hint.
- Setup-script import-candidate inspection (sidebar prompt, runtime RPC) opens nothing under
\\\\wsl.localhost while the distro is stopped or unverifiable: those UNC opens booted it about 2 s
after each terminate on the awin verify.
* fix(wsl): close a pane's clean exit at once, and settle the guest-process fast path
- A bridge pane's code-0 exit is the user's own (a terminate gives -1): it now closes at once,
with no stop mark, settle wait or running-list read. Non-zero exits keep the E9 discipline.
- readWslGuestPaneProcesses' fast path for a live pane (Sleep, quit) trusts the cached running
list only when it was probed after any stop of the distro settled.
- When a mid-stop list skipped deferred work, one unref'd probe just past the settle drains it,
instead of waiting on an unrelated probe.
* fix(wsl): mark a clean bridge exit as a possible stop, and fix the exit check test's probe timing
A code-0 bridge exit still closes at once, but now also marks its distro as possibly stopped, so
an in-guest poweroff or wsl --shutdown that exits 0 cannot leave background reads trusting an old
running list. The coalesced-probe test waits for the probe, which now starts after the settle
anchor, before answering it.
* fix: preserve successor plugin panels after renderer loss
* test(plugins): drop redundant panel lifetime control test
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* perf(electron): target persisted UI broadcasts to main renderer
* test(ui): use a supported top-level view in broadcast regression
* test(ui): collapse UI broadcast routing tests into one wiring check
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
hooks:check takes an optional background flag. The sidebar setup-script prompt and the setup
guide's progress probe, which run on render, pass it: on a stopped or unverifiable WSL distro
the check answers status 'error' without opening orca.yaml over \\\\wsl.localhost, which would boot
the distro. Launch preflight and settings, user acts that start the distro anyway, are unchanged.
When the pinned Bun binary is installed but its version probe times out,
required typecheck callers (repo typecheck, CLI build, E2E and mobile
typecheck) now report the timeout with the executable path and budget
instead of claiming Bun is missing. Each caller suggests its own compiler
fallback. Optional Bun consumers keep returning null and falling back.
Fixes#33707
Co-authored-by: Neil <neil@stably.ai>
run-use --takeover-legacy on an ordinary (non-legacy, non-adopted) Run
hit the takeover authority gate first and told the caller to repair
terminal authentication, even though the flag can never apply there.
Only require takeover authority when the target is legacy, missing, or
the adopted Run, so ordinary Runs reach bindRun, which keeps the caller
and worker fences and rejects the flag before any binding changes.
Fixes#30779
Co-authored-by: Neil <neil@stably.ai>
Pass --literal-pathspecs to the per-file diff in collectAddedLineRanges so
filenames containing glob characters (e.g. `[ab].tsx`) match only
themselves instead of also pulling in other files' hunks (e.g. `a.tsx`).
Covers both edits and renames with real-Git regression tests.
Fixes#34784
Co-authored-by: Neil <neil@stably.ai>
On awin a wsl --terminate exited each bridge pane with -1, while exit and exit 0 gave 0, so a
terminate never yields 0. A clean exit keeps today's verdict without the extra wsl.exe spawn.
Co-authored-by: Claude <noreply@anthropic.com>
resolveSimulatorUdid matched the first device whose name contained the
requested name, so asking for "iPhone 17" could attach an earlier
"iPhone 17e". Prefer a case-insensitive exact name match first, then fall
back to the existing substring/UDID match.
Only srcset is a comma-separated candidate list; src and href hold one URL.
Splitting them invented missing targets for paths containing commas or
spaces and could pass a missing target whose fragments were tracked.
Fixes#34815
* perf(terminal): release hidden WebGL canvases' drawing buffers
Chromium keeps a display:none WebGL canvas's drawing buffers alive (on macOS
a back buffer plus up to four pooled full-size surfaces). Hidden terminal
tabs and retained worktrees therefore held ~80 MB of GPU memory each until
they were parked. Collapse the canvas backing store while it has no layout
box and keep the context; xterm's device-pixel observer restores the size
and redraws synchronously on reveal.
7 terminal tabs, 1920x1050@2x: GPU process 670-760 MB -> 350-408 MB.
* perf(terminal): free hidden canvases only after 30s and never for suspended worktrees
Reallocating the backing on reveal cost about one frame. Delaying the release keeps rapid
switching allocation-free, and worktree-suspended panes keep their backing so worktree
switches match main. A MutationObserver re-checks a canvas that xterm resizes while hidden.
* fix(terminal): restore released WebGL canvases before the reveal frame paints
- Reveal restore reallocates at the current DPR and draws past xterm's paused
renderer inside the ResizeObserver callback, so the first painted frame has
content; also covers engines without devicePixelContentBoxSize.
- DPR repair reports released canvases as 'released' (current) instead of
'deferred', so window-resize recovery stops retrying them.
- Veto release for panes of a hidden worktree surface (marked from
isWorktreeActive) instead of webglAttachmentDeferred, which a hidden
prewarm clears.
- Schedule release for canvases attached or regrown while already boxless;
a zero-size element gets no initial ResizeObserver entry.
- Clear the timer through the canvas's own window.
* test(terminal): guard hidden WebGL canvas release and reveal restore
* perf(terminal): restore a released WebGL canvas at its exact device size without a full resize
Set the backing to the reveal entry's device-pixel size (xterm's own fallback
size where that box is unavailable) and draw once, instead of handleResize:
xterm's device-pixel observer then finds nothing to resize, which removes a
second reallocation and redraw from the reveal. A DPR change while hidden
still takes the full resize path.
* fix(terminal): paint a revealed released canvas through a held synchronized-output frame
A released canvas has no last coherent frame to keep, so when a TUI holds DEC
2026 at reveal, the buffered refresh left it blank for up to xterm's 1s
watchdog. Use forceFullViewportPresent, which draws the current buffer once
directly; the TUI's sync end still presents its finished frame normally.
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
When git status failed (e.g. a corrupted index), the read returned an empty
result and Source Control said the workspace was clean. getStatus now carries
Git's error as an optional readError; the store keeps the last known entries
and conflicts while it is set, and the panel shows a status-read banner with
Git's message and Retry instead of the clean empty state. The Retry logic is
shared with the too-many-changes banner, and the per-worktree error is cleaned
up on teardown and migrated on worktree rename.
Fixes#28033
Co-authored-by: Neil <neil@stably.ai>
Follow-up to #35050 review: a pane spawned after a running list saw its distro stop, but before
any bridge exit reached the adapter, could take the old boot's id. The identity now drops the
distro's cache on a stop observation, listening only while bridge panes live. The relaunch
suite waits on the daemon reaping the session rather than assuming it is synchronous.
Co-authored-by: Claude <noreply@anthropic.com>
* feat(files): page a remote server's big folders in the explorer
* fix(files): list a remote folder whole unless the host refuses it as too large, then page it
* fix(files): page a remote folder after a cursor entry, not at an offset
* fix(files): release expired folder listings, share one in-flight listing, keep an oversized one alone
* fix(files): cap and time out cached folder listings, bound the cursor name, match id: selectors
On Windows/Linux, window-all-closed quit unconditionally. A hidden browser
extension native page (content-script restore) destroyed before the first
main window existed emitted window-all-closed and quit the app mid-startup.
Gate the quit policy on the main window having opened at least once.
Fixes#34911
* fix(terminal): a WSL bridge pane keeps its session when its distro is booted again before the check
A bridge exit that the running list calls 'running' is now host loss when the distro's boot id
changed since the pane spawned (something booted it again first), and an unanswered list is asked
once more before the exit stays an exit. Boot ids are read once per distro boot, only into a
distro the background-work gate confirms running, so the read never boots one.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(terminal): an exit drops the distro's boot id at once, and a new incarnation takes the current one
Reviews of #35050: a pane spawned during another pane's exit verdict, or the same session
respawned into a rebooted distro, kept the old boot's id, so its own later exit read as
'rebooted' and its tab never closed. A burst of exits now shares one read of the current id,
and the verdict log names the exit code.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(terminal): a stale bridge exit drops the boot id, and the respawn that beat it re-reads its own
Co-Authored-By: Claude <noreply@anthropic.com>
* test(terminal): wait on the exit, not the clock, in the bridge relaunch suite
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* perf(orcad): qualify a bundled slot once per unchanged host instead of every launch
Every bundled orcad launch ran a second full orcad-server.js process (the startup preflight)
before serving: 0.7-1.4 s after a WSL distro restart. Once a launch with the same key reaches
readiness, the slot records a marker; the next launch with that key skips the child. The key
covers the artifact version, each installed file's stat identity, the runtime identity, Node
version, libc and kernel. The marker is consumed at startup and rewritten only after readiness,
so a launch that fails or crashes before readiness re-qualifies; it is written via temp + rename,
and any read, parse or write problem falls back to the preflight.
* perf(orcad): keep running the startup preflight on Windows
There the child also proves the process identity table, which depends on host services rather
than on the slot's bytes.
* docs(wsl): note when the version GC memo can leave a stale dir behind
* fix(orcad): harden the startup qualification marker
- A failed preflight child deletes any marker, so a concurrent launch cannot rely on it.
- Only managed slots (launched with the managed activation root, as for the compile cache)
outside process.resourcesPath ever read or write a marker.
- The key fingerprints NODE_OPTIONS, LD_PRELOAD, LD_LIBRARY_PATH and TMPDIR as orcad sees them.
Chats with an explicit mode showed a disabled 'Permissions' placeholder whenever no running agent had reported, which is every idle or resumed chat, so the mode could not be read or changed. A live report still wins; chats that follow the agent's own settings still wait for the report.
* perf(wsl): read the kernel, login home and platform in one exec
The WSL connect's first exec now prints the kernel release, $HOME and the marker-backed uname
platform probe together, and hands the platform and home to resolveOrcadRemoteContext, which
then skips its own uname and $HOME probes: two fewer serial guest round trips per connect. SSH
passes neither, so its probes are unchanged.
* fix(wsl): accept the folded host facts only in their exact shape
Each fact now prints after its own marker, and the output is used only when it has exactly the
kernel line, the home line, the blank separator and the platform line. Anything else (stdout
noise, a HOME containing a newline) falls back to reading the kernel alone and lets the context
probe the platform and home itself, so no truncated path is ever used.
R39 follow-up. When one Orca's Remove kept the server for another, that other
Orca's later Remove must tear it down once the first is gone. The test covers
it end to end on a real server: kept while both are connected, still kept
inside the first Orca's 60-second reconnect grace, and no peers after it.
OrcaWinandm4air
NeilandClaude
berceandNeil
Vyacheslav ScherbininandNeil
Blue DaydreamingandNeil
Henry SuandNeil
BingZ
Samuel VilaandNeil
Brennan Benson