Codex usage no longer double-counts forked sessions: forks copy the parent's token_count events with fresh timestamps, so cumulative events are now keyed on turn id + totals (timestamp fallback when no turn id); the turn id is kept in the incremental-scan checkpoint and the usage cache is rebuilt once.
Fixes#19139
Supersedes #19152
Co-authored-by: Jio Kim <26668612+MeroZemory@users.noreply.github.com>
Hold the orchestration mailbox pointer (and coordinator nudges) while the agent's composer has an unsent draft, so Orca never submits over what the user is typing.
Fixes#26992
Supersedes #27195
Co-authored-by: Hotragn <103170876+Hotragn@users.noreply.github.com>
Read `codex login`'s stderr too: Codex prints the browser sign-in URL there (codex-rs/cli/src/login.rs), so WSL Codex sign-in opened nothing and spun until timeout. Each stream gets its own line buffer and the URL is published once.
Windows managed hook skip paths (Devin/Grok/Cursor replay guards, and orca-agent-hook.exe) exit immediately instead of draining stdin through more.com, so a held-open writer can no longer hang the hook.
Fixes#24907
Supersedes #24909
Co-authored-by: inforanger <29155427+inforanger@users.noreply.github.com>
Ctrl+Enter reaches Claude Code as CSI-u (`\x1b[13;5u`) on local Windows ConPTY panes, matching macOS/Linux, so custom ctrl+enter keybindings work.
Fixes#29711
Terminals created with a flagged agent command (e.g. `omp --thinking high`) now get the agent's identity at creation, so `tui-idle` waits for the agent instead of reporting ready early.
Fixes#25264
Supersedes #25320
Co-authored-by: ggbdpq <67929842+ggbdpq@users.noreply.github.com>
Graceful close (mobile pane, headless tab, worktree stop) of a shell without launch metadata now sweeps descendants on macOS/Linux, matching desktop tab close, while sparing the shell's own nohup/disown jobs (login-wrapper aware). Windows graceful plain-shell close is unchanged.
Fixes#16714
Leave a user's node or python program alone after a Claude account switch; unchecked terminals get an accurate toast.
Fixes#30327
Co-authored-by: Adif Sgaid <69080239+adifsgaid@users.noreply.github.com>
* fix(terminal): a pane a relaunched app has not reopened keeps its history and folder when slept
After an app relaunch, a terminal the window had not shown again was known to the daemon client
only from its terminal list: no history writer and, for a WSL pane, no distro or pane key. Its
Sleep then wrote no final checkpoint at all (only output.log), so Wake restored from older output
and, for a WSL pane on Windows, reopened at the spawn folder (awin verify-10, X2). #33398 learned
those facts in `reconcileOnStartup`, which nothing in the app calls.
Sleep now adopts such a session first: one `listSessions`, then the same history reconciliation,
distro and pane key a startup adoption records. Its final checkpoint then lands with the shell's
folder. Sessions the client spawned or reattached skip this.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(terminal): Sleep never re-adopts a session this client suspended after a seed failure
Review of #33425: adopting an unattached session before Sleep also caught sessions this client
already holds but suspended after a history seed failed (an old daemon, an oversized seed, a
transfer failure). Re-adopting one wrote its fresh-only screen as the authoritative checkpoint,
so Wake lost everything from before the restore. Sleep now adopts only sessions the client
does not already hold as active.
A session it does adopt becomes active only once its history writer is open, so an exit
during the reconcile leaves it out.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
DSH: Orca re-presses Enter (up to a 30s launch budget) while dsh's launchpad still visibly holds the launch prompt — dsh refuses Enter while its session is starting — and stops as soon as the prompt leaves the screen, so no Enter reaches the first-run guide. The shared draft reader recognises dsh's boxed launchpad composer. Fixes#29131, #33227. Supersedes #33229.
Co-authored-by: Xulin Wu <35489799+wuuli@users.noreply.github.com>
* test(e2e): a saved SSH forward on a managed host comes back after a restart (#32484)
* test(e2e): a restart that reaches the host only through its server's tunnel restores saved forwards (#32484)
* fix(ssh): restore saved port forwards whenever a host's server is up, not only after an SSH connect (#32484)
A host whose managed server the app reaches at startup through its tunnel
publishes its served status from the tunnel path, which never ran the
forward restore. The served status itself now triggers the restore, from
any publisher, and a host kept on the legacy relay bridge restores too.
* test(ssh): type the restore spy's target argument
* fix(ssh): user forward edits keep unrestored saved forwards; restore once the tunnel is up
Add, edit and remove now merge with saved forwards that aren't live, so a
restart that restored nothing no longer lets one re-added forward erase
the rest. A call that brings up the managed server's tunnel restores too,
so a failed update check or redeploy can't skip it, and a restore runs once
per transport instead of on every status note.
* fix(ssh): a forward that failed to bind is retried on the same transport
* fix(ssh): restore again when a restored forward closed; a reused local port replaces its old mapping
* fix(ssh): user forward edits and restores share one per-host queue
A restore that ran mid-edit could reopen the mapping the edit was
replacing and save both. Every add, edit, remove and restore for a host now
runs in order through the same queue.
* fix(ssh): pace forward restores and back off a forward that keeps failing
Each runtime call triggers a restore over the managed tunnel, and with
system SSH every attempt is a new login. Restores on the same transport
now run at most once per 30 s, a forward that keeps failing waits longer
each time, and teardown forgets both. A tunnel with no status yet counts
only outside a connect; a remove re-checks its forward inside the queue;
drop a circular listener test and the plain restart e2e case.
* fix(ssh): a start a teardown cancelled records no backoff
* fix(ssh): a reconnected transport retries failed forwards at once
* perf(lint): keep JS plugins out of default oxlint and adopt ast-grep
Any jsPlugin makes Oxlint hand every file's AST to Node, so the seven custom
plugins cost the default `oxlint` run several times its native time.
- Move app-store-performance, quadratic-buffer-concat, renderer-scrollbar-style
and ime-enter-guard (scope- or dataflow-aware) to config/oxlint-js-plugins.json,
run by `pnpm lint:js-plugins`, CI, lint-staged and the changed-lines gate.
- Port sort-comparator-performance, mobile-pairing and native-chat-design-tokens
to ast-grep rules with rule tests, and delete the plugins.
- Add @ast-grep/cli, config/sgconfig.yml, `pnpm lint:ast-grep` / `test:ast-grep`,
a CI step, and an ast-grep pass in check-changed-code-quality.
- Add flaky-test rules (wall-clock reads, real-time waits, polling loops,
unquarantined skips, unexplained timeout bumps), baselined by a count ratchet.
* Enforce flaky-test ratchet on changed files; refresh baseline
* docs(agents): keep custom-rule details out of AGENTS.md
* Resolve ast-grep from the repo so gate scans of other roots work
* feat(devex): component fixtures with headless screenshots for fast UI checks
Colocated *.fixture.tsx files export named fixtures (render + optional store
seed, setup, interact, width). A dev-only Vite entry (vite.fixtures.config.ts,
extending vite.web.config.ts) renders one fixture in isolation with the real
I18nProvider, TooltipProvider, theme class, default-seeded store, and the web
client's preload bridge (installWebPreloadApi) as window.api.
`pnpm fixtures:shot <id|glob> [--theme dark|light|both]` starts or reuses a
detached server (Vite + one headless Chromium) and writes PNGs to
.cache/fixtures/. A warm page re-renders in place (~100ms/shot) and reloads
only after source changes. A stdio MCP server (registered in .mcp.json)
exposes list_fixtures and screenshot_fixture.
Fixtures load only through import.meta.glob in the fixture entry, which is
not a production build input; oxlint rejects static imports of *.fixture.
* Keep fixture config and agent config inside reviewed root entries
* Baseline the fixture page's default-settings seed in the focus-read ratchet
* docs(agents): shorten fixtures pointer
* Allowlist the dev-only fixture explorer's labels in localization coverage
macOS: Option+Forward-Delete sends ESC d (delete word forward) for shells and inline agent TUIs, so Claude Code deletes a word instead of the whole line; full-screen non-agent apps (vim, nano, less) keep the native CSI 3;3~. Linux/Windows unchanged. Fixes#21491. Supersedes #21893.
Co-authored-by: bbingz <11211020+bbingz@users.noreply.github.com>
* refactor: group local and WSL filesystem watchers
* test: isolate startup ordering from watcher initialization
* test: collect the startup preflight subject once
Windows + Codex: Ctrl+V, Shift+Insert and Edit > Paste send multi-line pastes with Alt+Enter newlines like right-click already does (restoring #14456 wiring lost in a refactor), so pasted lines no longer submit one by one when Codex's paste-burst heuristic doesn't catch them (e.g. disable_paste_burst = true). macOS/Linux clients unchanged. Fixes#30470. Supersedes #30550.
Co-authored-by: STiFLeR7 <157357792+STiFLeR7@users.noreply.github.com>
Orchestration mailbox pointers now get their delayed Enter for Cursor too (the Cursor no-Enter skip from #3156 left mail delivered but never acted on). Verified with real cursor-agent. Fixes#19760. Supersedes #19761.
Co-authored-by: Maple <54388301+zleo-ai@users.noreply.github.com>
* fix(windows): respawn a ConPTY pane that started without an input reader
Bundled ConPTY occasionally starts a pane whose console host never reads
its input pipe: the shell prints its banner and prompt, but every keystroke
and the typed launch command are dropped. Such a pane is identifiable from
its first output, because a healthy one always queries DA1 before relaying
anything else. The daemon now waits for that first output, respawns once
when it is missing, and replays the buffered startup output so no byte is
lost. The table stress probe now waits for node-pty's own readiness rather
than typed input.
* fix(windows): bound the ConPTY startup check and never re-run a command
- Respawn only when no command rode in the shell's argv; otherwise keep the
pane and say on screen that it cannot take input.
- Accept the pane unverified after 5s of silence instead of stalling the spawn.
- Distrust the check after two misses with no pane ever announcing, so a
changed ConPTY build cannot respawn every pane.
- Kill a discarded pane through its job before closing the pseudoconsole.
- Report a cancel during the wait as an attach cancel, not a spawn failure.
- Assert on real Windows ConPTY that a fresh pane announces its input reader.
* fix(windows): respawn only Orca's own shell argv and close an unready pane now
- Treat user shell args like an argv startup command: never respawn, show
the notice instead, so a command such as pwsh -Command never runs twice.
- Close a discarded pane's pseudoconsole directly; node-pty defers kill()
until first output, which a silent pane never produces. Kill the shell by
pid when no job owns it.
- Reconcile a master node-pty retired during the startup wait.
- Drop the test-only respawn counter; the count rides in the daemon log.
* fix(windows): tear a discarded unready pane down through node-pty's agent
node-pty defers kill() until first output, so closing only the native
pseudoconsole left the input pipe and output worker of a silent discarded
pane alive until daemon exit. The agent's kill closes all three.
* fix(windows): discard startup panes by handle only; account for the mock prelude
A pid-addressed kill could hit a recycled pid when the shell exited during
startup; the job and the agent's native kill both act on handles. Lifecycle
assertions now expect the replayed DA1 query when the suite runs on Windows.
* test(e2e): give the mocked Windows pane its ConPTY prelude
* fix(runtime): keep another paired runtime's terminals when one runtime republishes a shared workspace
Desktop B can mirror one SSH workspace from two paired runtimes: the host's
server, which runs its terminals, and desktop A's app, which hosts a browser
tab A opened there. Any frame from A's app replaced every mirrored terminal
row in the workspace, so B dropped the server's terminals until the server's
next frame re-created them. A frame now replaces only the mirrored terminals
and chats its own runtime owns, matching how browser and editor rows were
already scoped.
Fixes#31983
Reported-by: amara-black
* fix(runtime): retire an omitted host's rows without waiting on a sibling host's replay
A tombstone now retires only its own host's rows, so the visibility-resume
repair no longer has to hold it back until every surviving host has a frame
to replay over the wiped workspace.
* refactor(runtime): one ownership rule for rows a paired runtime's frame may retire
Bindings first, then the frames that last published the row, then the
workspace's own server; owners that were removed no longer count, so any
runtime's frame can retire their rows.
* fix(runtime): address review on cross-runtime mirror ownership
Drop the workspace-owner guess for rows with no evidence, let a frame that
publishes the same chat take its row over, and refocus a surviving runtime's
terminal when the active one is retired.
* refactor(runtime): a mirrored terminal stays while any other live runtime claims it
Union pane bindings and last-frame mappings into one claim set, so a row two
runtimes share survives one runtime's retraction. Drop the chat ownership
extension: chats are shared across runtimes by session id, and the reported
bug is terminals only.
* refactor(runtime): claims come from the frames that published a terminal
A runtime that stopped publishing a terminal no longer claims it through a
cached pane binding; bindings only speak before any frame this session.
Keep the visibility-resume repair's survivor deferral as it was.
* fix(runtime): bound pane resources decide a mirrored terminal's runtime; chats follow the same rule
A shared terminal whose bound runtime drops it is retired and rebuilt by the
other runtime's next frame, so it never streams from a runtime that left.
Chats another live runtime owns survive this frame unless it publishes or
replaces them.
* fix(terminal): close another paired runtime's terminal on that runtime
A workspace can now keep terminals another runtime publishes, so a close
follows the runtime the tab's own PTY names before the workspace catalog.
* fix(runtime): only this machine or a live paired runtime keeps a chat another frame omits
Windows Codex: when a large dispatch/worker-start/agent prompt paste is still held in Codex's composer (Codex reads the paste as key events and treats an early Enter as a newline), Orca re-presses Enter only while the composer visibly holds exactly that pasted prompt, re-checking turn start, permission and the deadline right before each Enter, within the worker-start budget. Non-Windows unchanged except the blind launch retry is skipped once a turn starts. Fixes#11343.
OpenCode 2.x model-selection launches require 2.0.19+ (upstream #51938 waits for agent/model before auto-submitting --prompt) or a native-prompt version (2.0.12, 2.0.16), fixing a regression from #33307 where 2.0.14/15/17/18 accepted a picked model but silently dropped the first prompt.
Windows Claude hooks for profile paths with a space register in Claude's exec form (orca-agent-hook.exe + args) instead of the slow encoded-PowerShell fallback (~650ms → ~15ms per event); the script path in args lets older Orca builds recognise and replace the entry. Older Claude keeps the PowerShell launcher. Fixes#19187. Supersedes #19255.
Co-authored-by: marcdhansen <7607160+marcdhansen@users.noreply.github.com>
* feat(devex): add pnpm check:changed as the single pre-handoff gate
Runs format, oxlint, the changed-code gate, affected typecheck projects,
affected unit tests, and the ratchets/verifiers whose inputs changed, in
parallel against the origin/main merge base plus local edits. Printing is
limited to failures, and a pass is cached by a hash of the diff, untracked
files, lockfile, and config so an unchanged rerun exits immediately.
* fix(devex): keep the check:changed pass valid across staging and commits
* docs(agents): slim Useful Commands to the commands agents need
Keep the rules most UI changes need in docs/STYLEGUIDE.md (32.9KB -> 10.1KB)
and move per-component specs, native chat scale, UX rationale, and the
screen review rubric into docs/styleguide/. Values now point at main.css
instead of being restated. Lint messages and comments that cited moved
sections now point at the new files.
Serves the renderer through Vite's experimental bundled dev mode when the
variable is set. Strict execution order keeps the React Refresh preamble ahead
of chunks shared by the four HTML entries. Default dev behavior is unchanged.
* feat(agents): TypeScript 7 code intelligence for coding agents, load-aware tsrs checkers
The stock agent TypeScript plugin needs a compiler build TS 7 no longer ships, so agents in
this repo got no diagnostics or ran some other TypeScript.
- config/scripts/agent-typescript-lsp.mjs starts the repo's own TS 7 language server
(tsrs on Apple Silicon and Linux, the typescript package's tsc elsewhere) and turns its
pull-only diagnostics into pushed publishDiagnostics for push-only clients.
- .claude/settings.json registers a repo-local plugin marketplace (config/agent-plugins)
and enables the orca-typescript LSP plugin; opencode.json runs the same server.
- Local tsrs typechecks now pass --checkers, splitting the cores the load average leaves
idle between concurrent projects (floor 4); ORCA_TYPECHECK_CHECKERS pins it.
* docs(agents): drop LSP and checker notes from AGENTS.md
- test:changed exits before starting Vitest when Git reports no changed files.
- Unrecorded tests beyond 100 in scope use Vitest's static import graph instead
of all running, so a fresh worktree's first changed run no longer runs the
whole suite (patched RecordedModulesResolver; CI does not record, unchanged).
- Bun's slow config load was the SQLite import scan statting every unit test;
filtered runs now classify only the tests their filters can select, and the
scan walks directories instead of fs.globSync.
- Silence the native config loader notice on every run.
- Zod's test bundle is content-addressed and reused, so a killed run leaks
nothing; leaked per-run directories older than 6h are swept.
- build:packages skips compiling when package inputs, compiler, and dist are
unchanged; test scripts no longer nest pnpm invocations.
Hermes: after the pane's turn ends, tool hooks from Hermes' hidden background memory/skill review are ignored until the next pre_llm_call, so a finished pane no longer flips back to Working. Delegate children (platform: subagent) don't end the parent's turn; approvals are always admitted. Fixes#31798. Supersedes #31807.
Co-authored-by: Matt Bass <76124126+mattjax16@users.noreply.github.com>
- Bump mobile typescript to ^7.0.2 and vitest to 5.0.5; keep TypeScript 6 as typescript-api
for the test-support code that walks the AST, mirroring the root.
- Patch Expo CLI's tsconfig reader to fall back to typescript-api: TypeScript 7 has no
compiler API, and Metro otherwise crashes reading tsconfig paths.
- Register mobile/tsconfig.json and mobile/tsconfig.test.json with the root typecheck runner;
locally they use incremental tsrs (Bun elsewhere), CI uses Bun like root CI.
- Route the tests-typecheck ratchet through the same compiler selection.
- Enforce root/mobile parity for typescript, typescript-api and vitest.
Linked worktrees now get a per-worktree userData profile under
orca-dev-wt/<hash>, a deterministic collision-checked renderer port
(15200+) and CDP port (9333+), so parallel `pnpm dev` runs no longer hit
the single-instance lock. The main checkout keeps the shared orca-dev
profile; --shared-profile / --worktree-profile / ORCA_DEV_PROFILE override.
The runner prints `ORCA_DEV_INSTANCE {json}` on stdout and mirrors it to
out/dev-instance.json so agents can attach over CDP. orca-dev.mjs and the
terminal wrappers follow the profile the worktree's dev app used.
Adds profile seeding (pnpm dev:seed-profile, pnpm dev --seed-profile,
pnpm dev:fresh --seed-from): an allowlisted slim copy of projects,
workspaces, settings, SSH targets, and the account session, written as
orca-data.json for Orca's own import; the source is only read.
Storage reclaim removes per-worktree profiles once their worktree is gone
and no app, runtime, or daemon still uses them. dev-fresh-profile.sh is
replaced by a cross-platform dev-fresh-profile.mjs.
Add `pnpm native ensure <ios|android>`, which installs a cached dev-client
build keyed by the Expo fingerprint and only runs `expo run` on a miss.
The cache lives in the user cache dir so every worktree shares it, and
app.config.js registers it as Expo's buildCacheProvider so plain
`expo run` reuses hits too. A report-only PR job flags fingerprint
changes against the base in the step summary.
* fix(sidebar): keep the workspace hover card open behind link actions and system-browser opens
* fix(sidebar): scope the unfocused hover hold to external opens and fix chooser dismissal edge cases
* perf(sidebar): register the refocus listener only while a hover hold is set
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* fix(worktrees): never leave the create-worktree dialog stuck on a stalled preflight
Bound the same-repo PR branch fetch with the review-head fetch timeout, and
hand a slow composer submit off to a staged sidebar row so the dialog closes.
* fix(worktrees): harden create-worktree handoff from adversarial review
Dedupe handed-off submits against linked creations resolved during preflight,
bound the staged sidebar row with a deadline, offer Reopen on handed-off
failures, and bound the GitLab MR branch fetch.
* test(worktrees): expect the bounded PR/MR branch fetch timeout
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Hermes home resolves like Hermes itself on Windows (HERMES_HOME, else %LOCALAPPDATA%\hermes, else a legacy ~\.hermes that alone exists), shared by hook install/status, skill discovery and session reading; session reading also honors HERMES_HOME. Fixes#24966. Supersedes #25058.
Co-authored-by: innocarpe <2222333+innocarpe@users.noreply.github.com>
Kimi Code workspace pre-trust: Orca writes Kimi's own trust record (<KIMI_CODE_HOME or ~/.kimi-code>/workspace-trust/wd_<slug>_<hash>) for the exact launch folder, so Kimi's "Trust this folder?" menu no longer swallows Orca's prompt. Never pre-trusts the home folder or a filesystem root. Fixes#26680. Supersedes #26738, #26741.
Co-authored-by: Naveen Chatlapalli <54518943+1aifanatic@users.noreply.github.com>
* fix(mobile): stop losing phone terminal output sent as output spans
Hosts sent stripped/transformed terminal output to terminal.subscribe as
OutputSpan (opcode 15), which no phone has ever decoded. The phone dropped
it silently, e.g. the reset after a killed full-screen program, leaving
the phone stuck on the alternate screen.
- Host: terminal.subscribe sends spans as plain Output text; only the
desktop multiplex (which decodes spans) keeps OutputSpan.
- Mobile: decode OutputSpan for older hosts, use the shared protocol
table, and end the stream with a logged error on any frame it can't read.
* fix(mobile): throttle unreadable-frame resets and log once per stream
* fix(mobile): reset a throttled stream after the window; forget released stream ids
* fix(mobile): defer throttled unreadable-frame resets instead of dropping them
* feat(managed-server): offer Update and Update anyway on a managed SSH server's row
A managed SSH server only updated on connect, and every connect deferred while
a terminal ran there. Its row now offers Update when this desktop bundles a
newer build than the Orca that runs the host. When running terminals defer it,
Update anyway restarts the server past them; the terminal daemon carries them
across the restart.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(managed-server): Update anyway passes only counted live terminals and keeps Update's version admission
Update anyway now sends the incumbent build it confirmed over; under the host
fence it is refused if another desktop activated a build since, keeps the
newer-host downgrade refusal, and never passes an uncounted terminal census.
The offer also covers hosts activated before the Orca version was recorded,
for the build this desktop already deferred there.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(managed-server): Update anyway also confirms a menu Update the row does not advertise
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(managed-server): the row shows one confirmation at a time
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* ci(e2e): route managed-server update sources to the Update anyway Docker spec
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(terminal): a slept WSL pane on Windows wakes in the folder its shell was in
Bash in a WSL pane on Windows reports no folder (no OSC 7), so Sleep's final checkpoint kept the
folder the pane was spawned in, and Wake reopened every such pane at the workspace root. Before
that checkpoint, the daemon client now reads the pane shell's folder inside its distro, from
/proc, by the ORCA_PANE_KEY its processes inherit, and stores it in the checkpoint Wake restores
from. The read is one fixed script per distro per Sleep batch, shared while in flight, capped at
3 s and a quarter of the Sleep's remaining budget. It only runs in a distro that is already
running. Any failure keeps today's spawn folder.
After an app relaunch, the client learns each live WSL session's distro and pane key from the
sessions it adopts at startup. A pane slept before the window reopened it therefore keeps its
folder too.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(terminal): read only Orca pane processes, skip the running check for live panes, wake at the asked folder when the kept one is gone
Review of #33398:
- Speed: the guest script forked about a dozen times per /proc entry (2.3 s for 405 processes),
so busy distros spent the whole 3 s budget. One `grep -l` over every environ now picks the
Orca pane processes first, and only those are read, so the cost no longer grows with the
distro's process count. A test counts the tool calls for 5 and 400 other processes and
expects the same number.
- Fewer launches: a live pane's own wsl.exe keeps its distro running, so a Sleep of a live pane
skips the `wsl --list --running` check and costs one launch per distro instead of two.
- Deleted folder: a pane whose kept folder is deleted before Wake failed to spawn when the
guest could not answer the folder probe. Wake now retries once in the folder the pane asked
for, as before the folder was kept.
- Drops the unused sid and argc fields.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(terminal): skip the running check only for a distro last seen running; keep the asked folder through the restore re-spawn
Review of #33398:
- A live pane skips the `wsl --list --running` check only when its distro is also in the last
confirmed running list. The client can still hold a session as live after its distro was
terminated or across a daemon disconnect, and reading that distro would boot it.
- The probe-to-create race re-spawn now reads back the folder the spawn actually used, so after
the deleted-folder retry neither `initialCwds` nor the cold-restore payload keep the gone path.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
<!-- orca-pr-loc -->
<!-- Programmatic LoC summary. Do not edit by hand; rewritten on every commit. -->
| | Files | Added | Deleted | Net |
| :--- | ---: | ---: | ---: | ---: |
| Test | 4 | $\color{#1a7f37}{\Huge{\mathbf{+}}}$406 | $\color{#cf222e}{\Huge{\mathbf{−}}}$4 | $\color{#1a7f37}{\Huge{\mathbf{+}}}$402 |
| Prod | 6 | $\color{#1a7f37}{\Huge{\mathbf{+}}}$165 | $\color{#cf222e}{\Huge{\mathbf{−}}}$10 | $\color{#1a7f37}{\Huge{\mathbf{+}}}$155 |
<!-- /orca-pr-loc -->
## ELI5
Relay servers ("cells") normally get their seat bookings from the front door (the director). If the director goes quiet for a minute or two, each cell switches itself to an older mode that talks to the shared Postgres database for every connection (the "dead-man" trip). Today every cell switches at once, so the database budget must keep room for every cell's full connection pool. This PR adds a per-cell switch that caps how many cells may trip at the same time. A cell that cannot trip yet stays in its normal mode and keeps serving the desktops it already has.
## What Changed
- New cell flag `deadManTripSlots` (integer 0-64). Absent, which is every cell today, keeps the current behaviour: trip as soon as the dead-man window (60-120 s) passes.
- With the flag set, a cell whose window has passed first claims a slot in Postgres. The claim is one short transaction: it takes an advisory lock without waiting, counts the other reserve cells whose own `relay_cell_admit_effective` row says `db`, and writes this cell's row to `db` only if that count is below the flag. Only then does the cell trip (void bookings, re-register its hosts, run on its full pool).
- A cell that gets no slot is "held". It stays in reserve mode, logs `orca_relay_cell_reserve_dead_man_held` once, keeps writing `reserve` to its row, and asks again every 30 s.
- A slot is held while the holder's own row says `db`, its switch still says `reserve`, and the row was refreshed in the last 10 minutes. A holder that restarts or is re-armed writes `reserve` and frees its slot. One that died tripped frees it after 10 minutes. Heartbeats are not used: they reach Postgres through the director, so in a director outage they all go stale and every slot would read as free.
- A tripped cell skips its 15 s row refresh while its pool has waiters. So that a long brownout cannot age its row out of the count, a tripped cell's row older than 5 minutes is refreshed even when the pool is busy.
- A trip stays latched after the director returns, as today. The tripped cells keep their slots until an operator re-arms them with a new reserve write. Until then, a second outage trips nobody new: the other cells stay held. That is the intended bound, but re-arming after an outage now also frees the slots.
- The claim goes through `CellAdmitEffectiveWriter`, which already serialises every write of that row. A `reserve` write still in flight therefore cannot land after the claim and hide the slot from the next claimant.
- Cells keep their existing per-cell window spread (60-120 s by cell-id hash), so the earliest windows claim first.
What a held cell does during a director outage (unchanged code paths, now for longer than the window):
- Desktops already connected keep their sockets. Nothing is closed or re-registered.
- A desktop that drops and redials at the same epoch is admitted from memory (`seatedHereAt`). Any other hello falls through to the normal database check, as it does in reserve mode today.
- The database placement path places no new desktops on it, because its row says `reserve`. It also never re-places the held cell's desktops, because `liveReserveCell` keys on the switch (`relay_cell_admit_modes`), not on this row.
- New placements during the outage go to cells already in database mode (c32, c33 and c34 today) plus the tripped slot holders.
## Why
The database budget (Cloud SQL `orca-cloud-auth-db`, shared with auth, max_connections 500, 490 usable) currently reserves every relay cell's full pool. The only reason for that is the dead-man trip of the whole fleet at once. Spare is 35 on main and about 3 once C36/C37 land, which caps the number of Asia cells.
Budget arithmetic (`relay-cloud-sql-connection-budget.mjs` on orca-cloud main: directors 15, auth 20, API 50, rollout overlap 65, maintenance 5, explicit reserve 10):
| | Cells line | Operating | Spare |
|---|---:|---:|---:|
| Main today: 6 db/legacy cells at 10, 16 US at 8, 7 Asia at 16 | 300 | 455 | 35 |
| Plus C36/C37 at 16 | 332 | 487 | 3 |
| Same fleet, `deadManTripSlots=2`, Asia reserve cells budgeted at 12 (measured peak) | 76 + 128 + 8x12 + 2x4 = 308 | 463 | 27 |
| Plus two more Asia cells at 12 | 332 | 487 | 3 |
So with two slots, two more Asia cells fit in the room C36/C37 leave today. Two caveats keep this honest:
- The bound holds only once every reserve cell runs this image with the same flag value. An older image ignores the flag and trips freely, though its `db` row still takes a slot from the capped cells. With mixed values the cap is the largest value set.
- Counting reserve cells at their measured peak is a softer guarantee than counting their configured pool: the pool is still 16, and a reserve cell could burst past 12. Making it a hard bound needs a pool ceiling that depends on the mode (reserve-mode ceiling 12, the full 16 only for a slot holder or a deliberate db cell). That is a follow-up; this PR does not change pool sizes.
Alternatives considered:
- Longer or ranked trip delays only spread the trips out. A trip is latched until the switch is rewritten, so after the longest delay every cell is still in database mode. That bounds the burst, not the budget.
- A static per-cell "may trip" list in the switch file needs no database coordination, but a listed cell that is down or draining wastes its slot, and an operator has to keep the list current.
- Removing the fallback (cells never trip) is the target design, but it waits on the director stall fix and two weeks of clean running. `deadManTripSlots=0` gives exactly that per cell, so it is the same switch.
Deliberate db flips (for example, flipping reserve cells to db for an image roll) are outside the cap. Budget each Asia cell flipped that way at its full 16. With a two-cell Asia roll batch running during an outage, the slot row above is 316, which leaves room for one more Asia cell rather than two.
Rollout: the flag is dark. Setting it is an `Operate Relay Production Cell Flags` write, per cell, after every reserve cell runs this image.
## Linked Issue
N/A (internal relay capacity work).
## Visual Proof
N/A: relay server behaviour only, no UI.
## Testing
- `cell-reserve-dead-man.test.ts` (new): trips as before without the flag; held until a permit, then latched; slot 0 never trips; a permit for a silence that contact ended, or for an earlier switch generation, is dropped.
- `cell-admit-effective-writer.test.ts`: the claim waits for an in-flight reserve write; a refused claim keeps the reserve row fresh and retries after 30 s; no claim while the pool has waiters or the switch is off reserve; a tripped row is refreshed past a saturated pool after 5 minutes, a reserve row is not.
- `cell-reserve-dead-man-slots.blackbox.test.ts` (new, real cell on SQLite): a director outage with the only slot taken by another cell that writes nothing but its own row: the cell stays reserve across several claims, re-registers nothing, keeps its desktops connected, and lets a redialing desktop back in from memory; once the peer writes `reserve`, the cell trips and re-registers. Also: slot 0 rides out 30 minutes of outage without tripping; no flag trips as before.
- `cell-dead-man-trip-slot-postgres.test.ts` (new, PostgreSQL): eight cells claiming together get exactly two slots; a live holder keeps its slot; a stale one frees exactly one. Removing the advisory lock fails this test.
- Mutation checks: making the slot count always 0, or removing the lock, each fails a test.
- Full relay suite, including the PostgreSQL suites against a local PostgreSQL 17: 173 files, 1564 passed, 3 skipped. The pr.yml static-analysis steps pass locally.
- Two rounds of adversarial review. Round 1 found that the first version counted holders by director-written heartbeats (fixed). Round 2 found the brownout aging (fixed) and the latched slots after an outage (documented above).
- [x] I manually tested these changes locally
- [x] Automated tests added/updated, or explained why not below
## Review
## Agent skill upstream boundary
- [x] Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.
## Notes
No new table or column. The claim reads `relay_cell_admit_effective` and `relay_cell_admit_modes` (one row per cell). Under a fleet-wide trip, held cells add one short transaction each per 30 s; the advisory lock is held for about one round trip.
## Checklist
- [x] This PR is small and focused
- [x] I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
- [x] Before/after screenshots or videos attached for UI changes, or `N/A` with reason
- [x] Self-reviewed for correctness, security, and performance
- [x] Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
- [x] `pnpm lint`, `pnpm typecheck`, `pnpm test`, and `pnpm build` pass (or CI will cover; local preferred)
NeilandJio Kim
OrcaWinandOrcaWin
Jinjing
Adif Sgaid
