* fix(browser): attach the desktop browser bridge to environment recipe SSH hosts
Recipe workspaces connect runtime-owned SSH targets that serve a managed
Orca server, but the bridge picked candidates from the SSH settings list,
which hides runtime-owned targets, and browser routing refused them too.
Pick bridge candidates from the managed-orcad claims, validate route
partitions by registration, and route deployment hosts whoever owns them.
Fixes#38603
Reported-by: Mehul K (@mek97)
* fix(browser): follow recipe host connections for the bridge and page routes
Owned SSH targets returned before the bridge rechecked, so a recipe host
connecting never attached it, and recipe browser panes had no published
SSH state to wait on. Recheck the bridge on every SSH state change, and
read a recipe target's connection from its server's state.
Fixes#38603
* fix(browser): settle a recipe browser route when its server is unreachable
Only a live dial waits; lost or never-made contact now lets the route
card offer Retry and browsing from this device.
Fixes#38603
* test: annotate hoisted fixtures instead of casting
Fixes#38603
* fix(mobile): say why a chat launch started a terminal instead
When the host falls back to a terminal for an agent the user set to Chat
(for example Antigravity without its chat runtime installed), show the
host's reason in the launch toast instead of opening a CLI silently.
* fix(mobile): skip the fallback notice for agents that have no chat
* fix(mobile): keep the launch notice toast up long enough to read
* refactor(agent-launch): own the chat-fallback rule in the launch contract
The server-side download transfer store wrote through the runtime file
mutations without a host expectation, so every write was refused as
coming from an outdated client. Each transfer now captures the
workspace's host as it prepares the download directory, and passes that
expectation on every later mutation, so a host that moves mid-transfer
refuses the rest.
Fixes#38122
Prepare a missing owned Claude account home through its existing setup owner and retain useful startup failure guidance. Keep uncertain opening messages in their original chat for explicit Retry, accept exact late proof without duplicate messages, and persist one aggregate launch snapshot before notifying listeners.
Verified with independent code and performance review, Claude/Codex runtime recovery and upgrade QA, targeted renderer and persistence contracts, and required CI. Tracked in STA-13879.
A paired desktop (client kind 'runtime') was classified with phones as an
untrusted relay caller, so the host stripped resumeCommand and filePath
from search hits and the desktop stripped them again on receipt. The same
pairing already returns those fields from the session list, so Resume in
New Tab worked from the list but was disabled for the same search hit.
Classify by client kind once: phones keep the redacted view, paired
desktops get the same fields the session list gives them.
Fixes#38555
Reported by @ArtemMakaryev
* fix(daemon): a main-process freeze no longer tears down the terminal daemon link
On a Windows host where starting a process blocks for seconds, main spends most of its time
frozen inside synchronous spawns (git, mostly). After such a freeze Node runs due timers before
the socket completions that arrived meanwhile, so the 5 s write-settlement deadline expired ahead
of a write the daemon had already taken, and main tore the daemon connection down as dead. Every
session on that daemon then refused input until re-attached, and the reconnect's hello and connect
deadlines failed the same way. Only acknowledged input waits on that settlement, which is what a
paired desktop sends: its keystrokes were refused in a loop while phone and local typing went
through.
The settlement, hello and connect deadlines now count only the time the event loop could run: a
freeze is credited as a single tick, and a tick that ran late never expires a deadline itself, so
the I/O phase runs first. A daemon that stops answering while main runs is still condemned after
the same timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(daemon): freeze-tolerant connection-attempt and RPC deadlines
---------
Co-authored-by: registered2nd <39094401+registered2nd@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(runtime): stamp title-only agent status at the PTY status transition
Program activity moves a PTY's agent status without a new title, so a
title-only frame dated by the title clock alone could sort behind the
working row a paired client already holds. The client then dropped the
done as stale and kept the spinner. Title-only frames and shell-title
demotions now carry the later of the title time and the status
transition time.
Fixes#25136
Co-authored-by: Fede654 <buzondefede@gmail.com>
* fix(runtime): stamp the no-hook title fallback at the PTY status transition
The builder's fallback for a pane with no live hook dated its title-only
frame by the title clock alone, so it could sort behind a title-only
working the renew path had stamped at the status transition.
Fixes#25136
Co-authored-by: Fede654 <buzondefede@gmail.com>
* fix(runtime): never date a shell-title demotion behind the status it replaces
Fixes#25136
Co-authored-by: Fede654 <buzondefede@gmail.com>
* test(runtime): keep the title-only stamp tests beside the mobile status projection
---------
Co-authored-by: Fede654 <buzondefede@gmail.com>
* fix(remote): re-attach terminals a daemon reconnect detached, for remote views and input
When the host's main process loses and re-makes its daemon connection, the daemon drops main's
attachments and the adapter refuses input to every session until it is attached again. Only a pane
mounted in the host's own window re-attaches by itself; a session with no pane there stays silent
and refuses every keystroke from a paired desktop, a phone or `orca terminal send`, while
`terminal list` still calls it connected and writable. A client remount or restart did not help:
its new subscription never re-attached the session.
Main now notes each session the provider's endpoint loss names, re-attaches it once a remote view
shows it (at the loss or when a view subscribes later), and holds input for it until that attach
lands instead of refusing it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(runtime): main re-attaches every session an endpoint loss detached
* fix(runtime): held input honours cancellation and the session it was sent to
Fixes#38433
---------
Co-authored-by: registered2nd <39094401+registered2nd@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(mobile): rewind a chat to an earlier message
Bring desktop's "Rewind to here" to phone chats. The rewind flow moves
into a shared React-injected hook so desktop and mobile share one set of
rules; desktop behaviour is unchanged. The host now lets phones call
agentSession.rewind behind agent-session.rewind.phone.v1, so a phone on
an older host offers nothing it would be refused.
* feat(mobile): put the message time first, then copy and rewind together
* fix(managed-server): drop a cached update deferral once the host's active build moves
Status reads the host record every time but kept a local deferral until the
host's active version compared equal to or newer than the candidate. Two
builds of the same release differ only by content hash, which compareAppVersions
cannot order, so after the host moved the deferral could stay for days and
the UI kept reporting a pending update that described nothing.
Record the host's active version with the deferral; any change clears it.
This addresses the stale-cache part of the issue; the interrupted-transaction
retry and the supervised-update workflow are separate.
Refs #38400
* fix(managed-server): key a deferral to the host's activation, not just its version
A host that moves to another build and back between two status reads keeps
its version but gets a new activatedAt; the deferral it recorded no longer
describes that host. Compare active and activatedAt, the record identity the
activation code already uses for the same question.
Refs #38400
* fix(managed-server): drop a deferral whose candidate the host already runs
Refs #38400
---------
Co-authored-by: Pr1p <zwq19980411@gmail.com>
* feat(omp): show OMP's ask questions in chat
Orca's ACP client never advertised form elicitation, so OMP started in
the chat view left out its ask tool and extension dialogs. The OMP
dialect now advertises forms and maps each elicitation onto the
existing question card: multi-question tabs, multi-select and Other.
PI_NO_PTY keeps `pty: true` bash from opening a TUI overlay ACP can't draw.
Co-authored-by: Narry <3047793+NarryG@users.noreply.github.com>
* fix(omp): tell OMP which ask questions past the fourth were never shown
* test(omp): assert behaviour, not note copy, in ask form tests
* fix(omp): let older clients answer single-question OMP forms
* refactor(acp): answer form elicitations in the generic request path
---------
Co-authored-by: Narry <3047793+NarryG@users.noreply.github.com>
The shared-control connection now bounds OPEN to ready with a 30s deadline
owned by its readiness timer. When it elapses, the generation closes with a
ready_timeout cause and reconnects through the existing backoff, which only
resets after 30s of stable readiness, so a slow host cannot cause a storm.
Fixes#37330
* fix(native-chat): list OpenCode 2 commands before the chat's first message
OpenCode chats had no at-rest command catalog, so the / menu showed only
Orca's own commands until the first prompt started the agent. Widen the
ACP at-rest catalog to every agent that lists models in a chat-folder
session: OpenCode 2.x opens a throwaway session in the chat's folder,
reads its available_commands_update and deletes it, as the 2.x model
probe already does. OpenCode 1.x cannot delete sessions and is skipped
without spawning.
* test: drop a no-op OpenCode launch-args assertion
* refactor(acp): share the release listing rule and session-delete policy with the model probe
* feat(mobile): copy, save and share an image from the chat image viewer
* refactor(mobile): pass image viewer actions in so diagrams skip them
* fix(mobile): name the image verb native.image.act and serialize image actions
* fix(mobile): queue image actions per page and skip SVG links
* refactor(mobile): share the cache-folder helper and table the viewer's image actions
* fix(mobile): keep the toast's live region mounted so screen readers hear it
* test(mobile): re-record agent history goldens for the always-mounted toast region
* test(mobile): import the declared routes in the moved routes test
An explicit Update, Rollback, Recover or Restart resumed the server's
status before invalidating its transport, so the first probe could ride
the connection about to be dropped. The action now includes its own
invalidation and note clearing, and status resumes after both. A test
also covers the SSH host's Disconnect being lifted for a managed server.
Refs #38347
* feat(mobile): set, pause, resume and clear a chat's goal from the phone
The phone sent /goal to the agent as plain text and showed no goal. It now
has desktop's goal mode (Goal chip, goal placeholder) and a goal strip on the
composer's top edge that expands to Pause/Resume and Clear goal.
The goal logic desktop and mobile share moves to src/shared: the goal report
(journal rows over the options answer), status labels, elapsed format, the
goal-mode pick rule and the goal row filter. agentSession.threadGoal joins the
phone allowlist behind agent-session.thread-goal.phone.v1, so older hosts keep
showing the goal without offering changes.
* fix(mobile): open each new goal's strip collapsed
* fix(mobile): keep goal sends' delivery choice and scope goal locks per chat
* fix(mobile): offer goal changes only when the paired desktop relays them
* test(mobile): pin which goal changes the phone offers per host
* refactor(mobile): reuse the queued box style and keep the goal strip stable per chunk
* fix(mobile): set phone goals through the composer's changeThreadGoal
Checks sidebar edit/delete of PR conversation comments always used desktop
IPC, so server-owned repos and SSH workspaces behind a paired server edited
and deleted with this computer's GitHub credentials while reads and posts
used the server's. Add one owner-aware client for slug-addressed GitHub
operations and move every slug caller onto it, so ownership is resolved at
the client boundary instead of in each component. An unknown owner now
fails explicitly instead of falling back to desktop credentials, and a
result that lands after the panel moved on no longer touches the list.
Refs STA-13254. Reported by Jinjing.
Co-authored-by: Claude <noreply@anthropic.com>
* fix(new-workspace): restore right-click "Set as default" on the agent picker
The shared agent picker (#35802) replaced the combobox in the new-workspace
composer and dropped the context menu that set the default agent. Wire
defaultAgent/onSetDefault through AgentLaunchPicker so agent rows, the
Blank Terminal row, and the closed field offer it again.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): keep the "Set as default" menu open when the mouse moves
The context menu was non-modal, so hovering the agent rows beneath it
moved focus to them and dismissed the menu. Make it modal so focus stays
in the menu until the user picks or dismisses.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): keep the row highlighted while its "Set as default" menu is open
Row highlight follows focus, which moves into the context menu. Mark the
trigger with data-context-menu-open and style it like the hovered row.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(agents): address review on the Set as default context menu
- Keep the context menu non-modal; prevent focus-outside dismissal instead,
so combobox callers keep one-click selection and scrolling.
- Drop the field-level context menu: it clobbered the dropdown trigger's
data-state/data-slot, ignored the disabled gate, and doubled up on long-press.
- Pass onSetDefault through unchanged so memoized rows stay stable.
- Reset the open marker when the menu unmounts while open.
- Stop asserting the CSS-only highlight marker in tests.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Repeated clicks on the native chat composer + (Attach file) button opened
one OS file picker per click because shell:pickAttachments opened a
parentless (modeless) dialog with no in-flight guard. Route all shell:pick*
and repos:pick* handlers through a single-flight wrapper; overlapping
requests resolve as canceled, which every caller treats as a no-op.
* feat(mobile): offer Sign in on a signed-out chat via a host terminal login
* feat(mobile): say which host is out in the chat composer, with Reconnect for the desktop link
* refactor(mobile): fit the host outage line beside main's chat changes
* perf(native-chat): stop rescanning whole chat history on every status update and subagent label
Status re-derived after every journal write built a map of every item body in the
chat to find conversation-command turns; index only command entries instead.
Same-named sibling subagents restarted their ordinal search at 2 for each sibling
(quadratic); resume each label's search where it stopped. Output is unchanged.
* perf(native-chat): find command turns through an indexed read on each status update
Status re-derived after every journal write still walked the whole history to
learn which turns belong to conversation commands. The host now passes a by-key
read of the same status rows (same display state, presentation membership and
stop-note projection, limited to the current /clear context), and the request,
preview and interruption readers check only the turns their backward scans reach,
the way the usage-limit reader already does. Clients without an index keep the
scan. A contract test drives real journal writes at 10x history and pins both the
constant indexed reads and the remaining per-row work.
* test(native-chat): count status body reads without Reflect.get or casts
* chore: drop accidental lockfile churn
* perf(native-chat): read the status display state once and pin indexed status parity
The host's status lookup now reads the journal's display state once per projection.
The status contract test covers the /clear boundary, an interruption verdict behind
a skipped command turn, a revised command turn, and the journal's per-row render
budget; the context-rows test expects the returned /clear sequence.
* test(native-chat): bound status work on the write that records an Orca stop
* test(native-chat): status follows a turn that becomes a command turn
* fix(native-chat): take the status lookup from the status read itself
Status read the journal's display state directly, which journals without queued
messages (test stand-ins, older wiring) do not have. The status read now returns
the by-key lookup bound to the state it rendered; readers whose status read has
none keep the scan.
* Add collapse and expand all projects controls
Support a sidebar button, keyboard shortcut, and Alt-click on project
headers, with a contextual tip to introduce the feature.
* rm mockup file
* Clean up project header toggle handling and fixtures
* feat(mobile): continue an interrupted chat from the phone
Desktop offers Continue on a turn Orca's own stop cut off; the phone only
showed the words. The offer and failure rules move to
src/shared/native-chat/native-chat-interrupted-continue.ts, desktop uses
them unchanged, and the phone drives them from its session over
agentSession.continueInterrupted when the host advertises it.
* refactor(native-chat): type the Continue answer instead of casting it
* fix(mobile): let a phone call agentSession.continueInterrupted
The host refused the method from phones, so Continue on the phone always
failed. Allow it on the execution-host route and advertise
agent-session.continue-interrupted.phone.v1, which the phone gates on:
hosts that advertise only continue-interrupted.v1 still refuse phones.
* fix(mobile): hide Continue when an older paired desktop relays the chat
A newer page on a server routed through an older desktop would offer
Continue that the desktop refuses to forward. Gate it on the relaying
desktop too; the workspace server context moves to a react-native-free
module so session hooks can read it. Long failure text now shrinks so
the banner's dismiss stays on screen.
* refactor(mobile): reuse the chat's Try Again look and shared Continue wording
The Continue button takes the Try Again pill styles and common.continue,
the shared helper takes the RPC's answer instead of a call wrapper, and
the phone hook memoizes its result and keys late answers in one place.
* fix(i18n): keep the Continue failure copy inline so catalogs rebuild it
* refactor(mobile): keep the structured session hook under its line cap
* fix(native-chat): check the session's agent audience before continuing a turn
* Add child worktree creation to the context menu
Preselect the clicked parent and its owning host when opening the
workspace composer, including nested SSH worktrees.
* Fix child worktree creation across local and remote hosts
Chat links used the body text color, so a link only showed as a faint
underline and a theme's textLink.foreground had no effect. They now
paint --chat-link: the theme's link color, else the built-in note blue
for the chat's own scheme, mixed toward the chat foreground like the
other chat hues. Code and bold link labels follow the link color.
When the chat paints a terminal palette the app theme doesn't match,
the app theme's link color is cleared, as its bubble already is. The
theme contrast check now measures the chat link on the theme's user
bubble and drops only the bubble when it fails.
* refactor(native-chat): move chat link rules and the file-existence checker to shared
GitHub reference linking, the reference-repo rule, chat file-path linkification,
the per-chat existence checker and the path-existence batcher are platform-free.
Move them to src/shared so the phone's chat can use the same rules; desktop keeps
its host adapters and behaves the same.
* feat(mobile): link #123 refs, check file paths and wrap code in chat
* test(mobile): pin which chat paths and refs become links
* refactor(mobile): parse repo link fields instead of casting
* refactor(mobile): own chat link state in the chat overlay
* fix(mobile): keep unchecked chat paths as precise as before
* fix(mobile): only peek at known paths while reasoning streams
* test(mobile): leave #123 splitting rules to the shared transform's tests
* refactor(native-chat): tidy shared link helpers and skip separator-free text
* test(native-chat): import the existence type from its shared home
* style(mobile): fold the code-span link handler onto one line
* feat(chat): resume working chats after restart by default for new users
New profiles start with automatic resume on. Profiles saved before this
change that never chose keep it off, so existing users see no change.
* fix(chat): decide launch resume only after settings load
The launch reads the resume preference once. When held chats enabled it
before settings loaded, it read the preference as off and opened the
review dialog for the session. Also drop the web storage pin: the web
client never runs the launch resume.
* feat(mobile): paste images and long text into the chat composer
* test(mobile): pin which composer pastes attach
* fix(mobile): keep a long paste as text when no upload can start
* fix(mobile): re-encode pasted images agents can't read as PNG
* test(mobile): pin composer paste routing at the composer field
* refactor(mobile): fold composer paste routing into its hook
* fix(mobile): read pasted images in the uploader so the composer needs no shell bridge
* test(mobile): stub the context ring in the composer paste test
* feat(mobile): show the context usage ring in the chat composer
Desktop's ring reads the structured session's context facts; the phone
never read the host's contextUsage answer. The summary rules move to
src/shared so both read the same numbers, and the title card's anchored
card machinery is generalized so the ring's breakdown opens above the
composer without dropping the keyboard.
* refactor(native-chat): share the context ring's critical threshold
* test(mobile): stub the context ring where composer tests stub its siblings
* fix(mobile): keep the context card with the composer and the keyboard up
Touching the card no longer takes focus from the draft, the open card
moves with the composer as the keyboard or draft resizes it, and the
composer's own menu closes it.
* fix(mobile): close the context card when the composer hides, and let long titles wrap
* refactor(mobile): share the anchored card layer and the ring readout
* test(e2e): pass the new options arg in the permission publication test
* feat(native-chat): show the chat account usage for /usage
* fix(native-chat): derive usage card lifetime from its owning turn
* test(native-chat): keep runtime manifest coverage additive
* fix(native-chat): advertise usage from the host options reader
* fix(native-chat): read cold chat usage through the chat's own Codex launch
- Cold /usage starts a short-lived app-server the way the chat launches
(configured command, args, environment, pinned home), as Codex rename does;
the status-bar probe returns to its original path.
- Report each reset outcome inline after the card refreshes.
- Send the chat's account as a typed kind plus email; the client owns copy.
- API-key accounts are recognised by a typed error, not message text.
- Keep the caret after kept text; drop unreachable WSL matching.
* refactor(native-chat): share the at-rest Codex app-server launch between rename and usage
* fix(native-chat): keep a reset's outcome when the usage refresh fails; label accounts by kind
* fix(native-chat): drop stale usage replies by request id instead of a render-time ref
* test(native-chat): keep the usage card test inside the web project
* fix(native-chat): clear the usage card when a waiting prompt changes; retire its callbacks on unmount
* chore: drop accidental pnpm lockfile churn from the main merge
* fix(native-chat): put the caret after kept text on /usage; offer the reset once the host's first Codex read lands
* fix(native-chat): type the usage snapshot wait and its test state
* fix(native-chat): re-read the usage offer when the chat host's Codex state changes, instead of forcing a host read
* fix(native-chat): watch the usage host from the card's opening and keep one background re-read at a time
* fix(native-chat): bind the usage card's background re-read to its opening
* feat(native-chat): open /usage as a modal like /resume
The chat's Codex usage card now opens in a root-hosted dialog with the
same surface, width and dismissal as /resume's Session History, instead of
a full-width card docked above the composer. Closing the modal retires its
reads; docked-only clearing on turn, prompt and session changes is gone.
* fix(native-chat): give the /usage modal /resume's fixed height and drop a replayed mount's first read
* fix(native-chat): size the /usage modal to its card and keep the card's layout while loading
* fix(native-chat): pin the /usage modal's top where /resume's sits so loading never moves its title
* chore(native-chat): describe the /usage loading placeholder accurately
* feat(mobile): dock the chat's plan above the composer
Desktop docks the latest plan above the composer; the phone only drew it
inline in the transcript. Move desktop's docked-plan rule to src/shared and
draw it on the phone as a collapsible strip in the background-tasks box.
* perf(native-chat): keep the docked plan's identity until the plan changes
* refactor(native-chat): read the docked plan from the newest message back
* refactor(mobile): drop a cast in the docked plan's open memory
* test(mobile): pass the tray's new taskList in the recovery test
Neil
OrcaWinandOrcaWin
Kelvin Amoaba
Brennan Benson
Jinwoo Hong
Jinjing
